gitops-ai 1.0.0 → 1.1.0

package/dist/core/gitlab-oauth.js

@@ -0,0 +1,190 @@
+import { createServer, } from "node:http";
+import { createHash, randomBytes } from "node:crypto";
+import { URL } from "node:url";
+import { execSync } from "node:child_process";
+import * as p from "@clack/prompts";
+import pc from "picocolors";
+import { isMacOS } from "../utils/platform.js";
+const OAUTH_SCOPES = "api read_repository write_repository";
+const CALLBACK_PATH = "/callback";
+const LOGIN_TIMEOUT_MS = 120_000;
+// ---------------------------------------------------------------------------
+// Pre-registered OAuth application per host (like Vercel, gh CLI).
+// Register once at: https://<host>/-/user_settings/applications
+//   Name:         gitops-ai
+//   Redirect URI: http://127.0.0.1/callback
+//   Confidential: No
+//   Scopes:       api
+// ---------------------------------------------------------------------------
+const BUILTIN_CLIENT_IDS = {
+    "gitlab.com": "0e183a7a911ca9b4e078a42bdc9e9ea6a2e821cd5303c3ceca6ce9be51f7e627",
+};
+// ---------------------------------------------------------------------------
+// PKCE helpers (RFC 7636)
+// ---------------------------------------------------------------------------
+function base64url(buf) {
+    return buf
+        .toString("base64")
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/, "");
+}
+function generateVerifier() {
+    return base64url(randomBytes(32));
+}
+function computeChallenge(verifier) {
+    return base64url(createHash("sha256").update(verifier).digest());
+}
+// ---------------------------------------------------------------------------
+// Browser opener
+// ---------------------------------------------------------------------------
+function openUrl(url) {
+    const cmd = isMacOS() ? "open" : "xdg-open";
+    try {
+        execSync(`${cmd} '${url}'`, { stdio: "ignore" });
+    }
+    catch {
+        /* user will see the manual URL in the terminal */
+    }
+}
+// ---------------------------------------------------------------------------
+// Resolve client_id — built-in or env var, nothing else needed.
+// ---------------------------------------------------------------------------
+function getClientId(host) {
+    const fromEnv = process.env.GITLAB_OAUTH_APP_ID;
+    if (fromEnv)
+        return fromEnv;
+    const builtIn = BUILTIN_CLIENT_IDS[host];
+    if (builtIn)
+        return builtIn;
+    throw new Error(`No OAuth application configured for ${host}. ` +
+        `Set GITLAB_OAUTH_APP_ID env var or add the host to BUILTIN_CLIENT_IDS.`);
+}
+// ---------------------------------------------------------------------------
+// Main browser-login flow
+// ---------------------------------------------------------------------------
+export async function loginWithBrowser(host) {
+    const clientId = getClientId(host);
+    const verifier = generateVerifier();
+    const challenge = computeChallenge(verifier);
+    const state = base64url(randomBytes(16));
+    return new Promise((resolve, reject) => {
+        let timer;
+        const server = createServer(async (req, res) => {
+            const url = new URL(req.url ?? "/", "http://127.0.0.1");
+            if (url.pathname !== CALLBACK_PATH) {
+                res.writeHead(404);
+                res.end();
+                return;
+            }
+            const error = url.searchParams.get("error");
+            if (error) {
+                const desc = url.searchParams.get("error_description") ?? error;
+                res.writeHead(200, { "Content-Type": "text/html" });
+                res.end(htmlPage("Authentication Failed", escapeHtml(desc), true));
+                finish(new Error(`GitLab OAuth: ${desc}`));
+                return;
+            }
+            if (url.searchParams.get("state") !== state) {
+                res.writeHead(200, { "Content-Type": "text/html" });
+                res.end(htmlPage("Security Error", "State mismatch — possible CSRF.", true));
+                finish(new Error("OAuth state mismatch"));
+                return;
+            }
+            const code = url.searchParams.get("code");
+            if (!code) {
+                res.writeHead(200, { "Content-Type": "text/html" });
+                res.end(htmlPage("Error", "No authorization code received.", true));
+                finish(new Error("Missing authorization code"));
+                return;
+            }
+            try {
+                const addr = server.address();
+                const port = typeof addr === "object" && addr ? addr.port : 0;
+                const redirectUri = `http://127.0.0.1:${port}${CALLBACK_PATH}`;
+                const tokenRes = await fetch(`https://${host}/oauth/token`, {
+                    method: "POST",
+                    headers: { "Content-Type": "application/json" },
+                    body: JSON.stringify({
+                        client_id: clientId,
+                        code,
+                        grant_type: "authorization_code",
+                        redirect_uri: redirectUri,
+                        code_verifier: verifier,
+                    }),
+                });
+                if (!tokenRes.ok) {
+                    const body = await tokenRes.text();
+                    throw new Error(`Token exchange failed (${tokenRes.status}): ${body}`);
+                }
+                const { access_token } = (await tokenRes.json());
+                res.writeHead(200, { "Content-Type": "text/html" });
+                res.end(htmlPage("Authenticated", "You can close this tab and return to the terminal.", false));
+                finish(null, access_token);
+            }
+            catch (err) {
+                res.writeHead(200, { "Content-Type": "text/html" });
+                res.end(htmlPage("Error", "Token exchange failed. Check the terminal.", true));
+                finish(err);
+            }
+        });
+        function finish(err, token) {
+            clearTimeout(timer);
+            server.close();
+            if (err)
+                reject(err);
+            else
+                resolve(token);
+        }
+        server.listen(0, "127.0.0.1", () => {
+            const addr = server.address();
+            const port = typeof addr === "object" && addr ? addr.port : 0;
+            const redirectUri = `http://127.0.0.1:${port}${CALLBACK_PATH}`;
+            const authUrl = new URL(`https://${host}/oauth/authorize`);
+            authUrl.searchParams.set("client_id", clientId);
+            authUrl.searchParams.set("redirect_uri", redirectUri);
+            authUrl.searchParams.set("response_type", "code");
+            authUrl.searchParams.set("scope", OAUTH_SCOPES);
+            authUrl.searchParams.set("code_challenge", challenge);
+            authUrl.searchParams.set("code_challenge_method", "S256");
+            authUrl.searchParams.set("state", state);
+            const urlStr = authUrl.toString();
+            p.log.info("Opening browser for GitLab authorization...");
+            p.log.info(pc.dim(`If the browser doesn't open, visit:\n${pc.cyan(urlStr)}`));
+            openUrl(urlStr);
+        });
+        timer = setTimeout(() => {
+            finish(new Error("Login timed out — no response within 2 minutes"));
+        }, LOGIN_TIMEOUT_MS);
+        server.on("error", (err) => {
+            finish(new Error(`Local OAuth server failed: ${err.message}`));
+        });
+    });
+}
+// ---------------------------------------------------------------------------
+// Callback HTML pages
+// ---------------------------------------------------------------------------
+function escapeHtml(s) {
+    return s
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;");
+}
+function htmlPage(title, message, isError) {
+    const accent = isError ? "#f85149" : "#58a6ff";
+    return `<!DOCTYPE html>
+<html><head><meta charset="utf-8"><title>GitOps AI — ${escapeHtml(title)}</title>
+<style>
+body{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif;
+display:flex;align-items:center;justify-content:center;min-height:100vh;
+margin:0;background:#0d1117;color:#e6edf3}
+.c{text-align:center;padding:3rem;border-radius:12px;background:#161b22;
+border:1px solid #30363d;max-width:420px}
+h1{color:${accent};margin-bottom:.5rem}
+p{color:#8b949e;line-height:1.6}
+</style></head><body><div class="c">
+<h1>${escapeHtml(title)}</h1><p>${message}</p>
+</div></body></html>`;
+}
+//# sourceMappingURL=gitlab-oauth.js.map

package/dist/core/gitlab-oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitlab-oauth.js","sourceRoot":"","sources":["../../src/core/gitlab-oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,GAGb,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,KAAK,CAAC,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAE/C,MAAM,YAAY,GAAG,sCAAsC,CAAC;AAC5D,MAAM,aAAa,GAAG,WAAW,CAAC;AAClC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AAEjC,8EAA8E;AAC9E,mEAAmE;AACnE,gEAAgE;AAChE,4BAA4B;AAC5B,4CAA4C;AAC5C,qBAAqB;AACrB,sBAAsB;AACtB,8EAA8E;AAE9E,MAAM,kBAAkB,GAA2B;IACjD,YAAY,EAAE,kEAAkE;CACjF,CAAC;AAEF,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,GAAG;SACP,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,OAAO,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,SAAS,OAAO,CAAC,GAAW;IAC1B,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;IAC5C,IAAI,CAAC;QACH,QAAQ,CAAC,GAAG,GAAG,KAAK,GAAG,GAAG,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,kDAAkD;IACpD,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,gEAAgE;AAChE,8EAA8E;AAE9E,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAChD,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAE5B,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAE5B,MAAM,IAAI,KAAK,CACb,uCAAuC,IAAI,IAAI;QAC7C,wEAAwE,CAC3E,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY;IACjD,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAEzC,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7C,IAAI,KAAqB,CAAC;QAE1B,MAAM,MAAM,GAAG,YAAY,CACzB,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAE,EAAE;YAClD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;YACxD,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;gBACnC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YAED,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC5C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,KAAK,CAAC;gBAChE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,uBAAuB,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;gBACnE,MAAM,CAAC,IAAI,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC3C,OAAO;YACT,CAAC;YAED,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,EAAE,CAAC;gBAC5C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CACL,QAAQ,CACN,gBAAgB,EAChB,iCAAiC,EACjC,IAAI,CACL,CACF,CAAC;gBACF,MAAM,CAAC,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC;gBAC1C,OAAO;YACT,CAAC;YAED,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,iCAAiC,EAAE,IAAI,CAAC,CAAC,CAAC;gBACpE,MAAM,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC9D,MAAM,WAAW,GAAG,oBAAoB,IAAI,GAAG,aAAa,EAAE,CAAC;gBAE/D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,IAAI,cAAc,EAAE;oBAC1D,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,SAAS,EAAE,QAAQ;wBACnB,IAAI;wBACJ,UAAU,EAAE,oBAAoB;wBAChC,YAAY,EAAE,WAAW;wBACzB,aAAa,EAAE,QAAQ;qBACxB,CAAC;iBACH,CAAC,CAAC;gBAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;oBACnC,MAAM,IAAI,KAAK,CACb,0BAA0B,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CACtD,CAAC;gBACJ,CAAC;gBAED,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAE9C,CAAC;gBACF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CACL,QAAQ,CACN,eAAe,EACf,oDAAoD,EACpD,KAAK,CACN,CACF,CAAC;gBACF,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;YAC7B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CACL,QAAQ,CACN,OAAO,EACP,4CAA4C,EAC5C,IAAI,CACL,CACF,CAAC;gBACF,MAAM,CAAC,GAAY,CAAC,CAAC;YACvB,CAAC;QACH,CAAC,CACF,CAAC;QAEF,SAAS,MAAM,CAAC,GAAiB,EAAE,KAAc;YAC/C,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,IAAI,GAAG;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;gBAChB,OAAO,CAAC,KAAM,CAAC,CAAC;QACvB,CAAC;QAED,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9D,MAAM,WAAW,GAAG,oBAAoB,IAAI,GAAG,aAAa,EAAE,CAAC;YAE/D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,WAAW,IAAI,kBAAkB,CAAC,CAAC;YAC3D,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YAChD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;YACtD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YAClD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YAChD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;YACtD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;YAC1D,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAEzC,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;YAClC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;YAC1D,CAAC,CAAC,GAAG,CAAC,IAAI,CACR,EAAE,CAAC,GAAG,CAAC,wCAAwC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAClE,CAAC;YACF,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,MAAM,CAAC,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC,CAAC;QACtE,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAErB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC;SACL,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,OAAe,EAAE,OAAgB;IAChE,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/C,OAAO;uDAC8C,UAAU,CAAC,KAAK,CAAC;;;;;;;WAO7D,MAAM;;;MAGX,UAAU,CAAC,KAAK,CAAC,WAAW,OAAO;qBACpB,CAAC;AACtB,CAAC"}

package/dist/core/gitlab.d.ts

@@ -1,10 +1,5 @@
-export declare function authenticate(pat: string, host: string): Promise<string>;
-export declare function resolveNamespaceId(namespace: string, host: string): Promise<string>;
-export interface ProjectInfo {
-    id: string;
-    httpUrl: string;
-    pathWithNamespace: string;
+import type { GitProvider } from "./git-provider.js";
+export interface GitLabProvider extends GitProvider {
+    readonly type: "gitlab";
 }
-export declare function getProject(namespace: string, name: string, host: string): Promise<ProjectInfo | null>;
-export declare function createProject(name: string, namespaceId: string, host: string): Promise<ProjectInfo>;
-export declare function configureGitCredentials(pat: string, cwd: string): void;
+export declare function createGitLabProvider(): GitLabProvider;

package/dist/core/gitlab.js

@@ -1,65 +1,136 @@
-import { exec, execAsync, execSafe } from "../utils/shell.js";
+import { exec, execSafe } from "../utils/shell.js";
 import { log } from "../utils/log.js";
-export async function authenticate(pat, host) {
-    await execAsync(`echo "${pat}" | glab auth login --hostname "${host}" --stdin`);
-    const username = await execAsync(`glab api "user" --hostname "${host}" | jq -r '.username'`);
-    log.success(`Authenticated as: ${username}`);
-    return username;
-}
-export async function resolveNamespaceId(namespace, host) {
-    const result = execSafe(`glab api --hostname "${host}" "namespaces/${namespace}" 2>/dev/null | jq -r '.id'`);
-    if (result.exitCode !== 0 || !result.stdout || result.stdout === "null") {
-        throw new Error(`Namespace '${namespace}' not found. Check the group or username.`);
+import { loginWithBrowser } from "./gitlab-oauth.js";
+// ---------------------------------------------------------------------------
+// REST helpers
+// ---------------------------------------------------------------------------
+async function apiFetch(path, token, host) {
+    const url = `https://${host}/api/v4${path}`;
+    let res = await fetch(url, {
+        headers: { Authorization: `Bearer ${token}` },
+    });
+    // Fall back to PRIVATE-TOKEN header (PATs on older GitLab versions)
+    if (res.status === 401) {
+        res = await fetch(url, {
+            headers: { "PRIVATE-TOKEN": token },
+        });
     }
-    log.success(`Namespace ID: ${result.stdout}`);
-    return result.stdout;
-}
-export async function getProject(namespace, name, host) {
-    const encoded = `${namespace}/${name}`.replace(/\//g, "%2F");
-    const { stdout, exitCode } = execSafe(`glab api --hostname "${host}" "projects/${encoded}" 2>/dev/null`);
-    if (exitCode !== 0 || !stdout)
-        return null;
-    try {
-        const data = JSON.parse(stdout);
-        if (!data.id)
-            return null;
-        return {
-            id: String(data.id),
-            httpUrl: data.http_url_to_repo,
-            pathWithNamespace: data.path_with_namespace,
-        };
+    if (!res.ok) {
+        throw new Error(`GitLab API ${path}: ${res.status} ${res.statusText}`);
     }
-    catch {
-        return null;
+    return res.json();
+}
+async function apiPost(path, token, host, body) {
+    const url = `https://${host}/api/v4${path}`;
+    const res = await fetch(url, {
+        method: "POST",
+        headers: {
+            Authorization: `Bearer ${token}`,
+            "Content-Type": "application/json",
+        },
+        body: JSON.stringify(body),
+    });
+    if (!res.ok) {
+        const text = await res.text();
+        throw new Error(`GitLab API POST ${path}: ${res.status} ${text}`);
     }
+    return res.json();
 }
-export async function createProject(name, namespaceId, host) {
-    const result = await execAsync([
-        "glab api --method POST",
-        `--hostname "${host}"`,
-        '"projects"',
-        `-f "name=${name}"`,
-        `-f "path=${name}"`,
-        `-f "namespace_id=${namespaceId}"`,
-        '-f "visibility=private"',
-        '-f "initialize_with_readme=false"',
-    ].join(" "));
-    const data = JSON.parse(result);
+export function createGitLabProvider() {
     return {
-        id: String(data.id),
-        httpUrl: data.http_url_to_repo,
-        pathWithNamespace: data.path_with_namespace,
+        type: "gitlab",
+        defaultHost: "gitlab.com",
+        cliTool: "glab",
+        tokenLabel: "GitLab Personal Access Token (api, read_repository, write_repository)",
+        async fetchCurrentUser(token, host) {
+            const u = await apiFetch("/user", token, host);
+            return { username: u.username, name: u.name };
+        },
+        async fetchOrganizations(token, host) {
+            const groups = await apiFetch("/groups?per_page=100&min_access_level=30&top_level_only=true&order_by=name&sort=asc", token, host);
+            return groups.map((g) => ({
+                name: g.name,
+                path: g.path,
+                fullPath: g.full_path,
+            }));
+        },
+        async fetchNamespaceProjects(token, host, namespace) {
+            const encoded = encodeURIComponent(namespace);
+            let projects;
+            try {
+                projects = await apiFetch(`/groups/${encoded}/projects?per_page=100&order_by=updated_at&sort=desc&include_subgroups=false`, token, host);
+            }
+            catch {
+                projects = await apiFetch(`/users/${encoded}/projects?per_page=100&order_by=updated_at&sort=desc`, token, host);
+            }
+            return projects.map((p) => ({
+                name: p.name,
+                description: p.description,
+                pathWithNamespace: p.path_with_namespace,
+                httpUrl: p.http_url_to_repo,
+            }));
+        },
+        async authenticate(token, host) {
+            const user = await this.fetchCurrentUser(token, host);
+            log.success(`Authenticated as: ${user.username}`);
+            return user.username;
+        },
+        async resolveNamespaceId(namespace, host, token) {
+            const encoded = encodeURIComponent(namespace);
+            try {
+                const ns = await apiFetch(`/namespaces/${encoded}`, token, host);
+                log.success(`Namespace ID: ${ns.id}`);
+                return String(ns.id);
+            }
+            catch {
+                throw new Error(`Namespace '${namespace}' not found. Check the group or username.`);
+            }
+        },
+        async getProject(namespace, name, host, token) {
+            const encoded = encodeURIComponent(`${namespace}/${name}`);
+            try {
+                const p = await apiFetch(`/projects/${encoded}`, token, host);
+                return {
+                    id: String(p.id),
+                    httpUrl: p.http_url_to_repo,
+                    pathWithNamespace: p.path_with_namespace,
+                };
+            }
+            catch {
+                return null;
+            }
+        },
+        async createProject(name, namespaceId, host, token) {
+            const p = await apiPost("/projects", token, host, {
+                name,
+                path: name,
+                namespace_id: Number(namespaceId),
+                visibility: "private",
+                initialize_with_readme: false,
+            });
+            return {
+                id: String(p.id),
+                httpUrl: p.http_url_to_repo,
+                pathWithNamespace: p.path_with_namespace,
+            };
+        },
+        configureGitCredentials(token, cwd) {
+            const { exitCode, stdout } = execSafe("git remote get-url origin 2>/dev/null");
+            let host = "gitlab.com";
+            if (exitCode === 0 && stdout) {
+                const match = stdout.match(/https:\/\/([^/]+)\//);
+                if (match)
+                    host = match[1];
+            }
+            exec(`git config --local --replace-all credential.helper '!f() { echo "username=oauth2"; echo "password=${token}"; }; f'`, { cwd });
+            log.success(`git credentials configured for ${host}`);
+        },
+        getAuthRemoteUrl(host, pathWithNamespace, token) {
+            return `https://oauth2:${token}@${host}/${pathWithNamespace}.git`;
+        },
+        async loginWithBrowser(host) {
+            return loginWithBrowser(host);
+        },
     };
 }
-export function configureGitCredentials(pat, cwd) {
-    const { exitCode, stdout } = execSafe("git remote get-url origin 2>/dev/null");
-    let host = "gitlab.com";
-    if (exitCode === 0 && stdout) {
-        const match = stdout.match(/https:\/\/([^/]+)\//);
-        if (match)
-            host = match[1];
-    }
-    exec(`git config --local --replace-all credential.helper '!f() { echo "username=oauth2"; echo "password=${pat}"; }; f'`, { cwd });
-    log.success(`git credentials configured for ${host}`);
-}
 //# sourceMappingURL=gitlab.js.map

package/dist/core/gitlab.js.map

@@ -1 +1 @@
-{"version":3,"file":"gitlab.js","sourceRoot":"","sources":["../../src/core/gitlab.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,GAAG,EAAe,MAAM,iBAAiB,CAAC;AAEnD,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAW,EACX,IAAY;IAEZ,MAAM,SAAS,CACb,SAAS,GAAG,mCAAmC,IAAI,WAAW,CAC/D,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,SAAS,CAC9B,+BAA+B,IAAI,uBAAuB,CAC3D,CAAC;IACF,GAAG,CAAC,OAAO,CAAC,qBAAqB,QAAQ,EAAE,CAAC,CAAC;IAC7C,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAAiB,EACjB,IAAY;IAEZ,MAAM,MAAM,GAAG,QAAQ,CACrB,wBAAwB,IAAI,iBAAiB,SAAS,6BAA6B,CACpF,CAAC;IACF,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CACb,cAAc,SAAS,2CAA2C,CACnE,CAAC;IACJ,CAAC;IACD,GAAG,CAAC,OAAO,CAAC,iBAAiB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9C,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,SAAiB,EACjB,IAAY,EACZ,IAAY;IAEZ,MAAM,OAAO,GAAG,GAAG,SAAS,IAAI,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC7D,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CACnC,wBAAwB,IAAI,eAAe,OAAO,eAAe,CAClE,CAAC;IACF,IAAI,QAAQ,KAAK,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAE3C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACnB,OAAO,EAAE,IAAI,CAAC,gBAAgB;YAC9B,iBAAiB,EAAE,IAAI,CAAC,mBAAmB;SAC5C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAY,EACZ,WAAmB,EACnB,IAAY;IAEZ,MAAM,MAAM,GAAG,MAAM,SAAS,CAC5B;QACE,wBAAwB;QACxB,eAAe,IAAI,GAAG;QACtB,YAAY;QACZ,YAAY,IAAI,GAAG;QACnB,YAAY,IAAI,GAAG;QACnB,oBAAoB,WAAW,GAAG;QAClC,yBAAyB;QACzB,mCAAmC;KACpC,CAAC,IAAI,CAAC,GAAG,CAAC,CACZ,CAAC;IAEF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACnB,OAAO,EAAE,IAAI,CAAC,gBAAgB;QAC9B,iBAAiB,EAAE,IAAI,CAAC,mBAAmB;KAC5C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,GAAW,EACX,GAAW;IAEX,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,QAAQ,CACnC,uCAAuC,CACxC,CAAC;IACF,IAAI,IAAI,GAAG,YAAY,CAAC;IACxB,IAAI,QAAQ,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAClD,IAAI,KAAK;YAAE,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IAED,IAAI,CACF,qGAAqG,GAAG,UAAU,EAClH,EAAE,GAAG,EAAE,CACR,CAAC;IACF,GAAG,CAAC,OAAO,CAAC,kCAAkC,IAAI,EAAE,CAAC,CAAC;AACxD,CAAC"}
+{"version":3,"file":"gitlab.js","sourceRoot":"","sources":["../../src/core/gitlab.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AACtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AASrD,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,KAAK,UAAU,QAAQ,CACrB,IAAY,EACZ,KAAa,EACb,IAAY;IAEZ,MAAM,GAAG,GAAG,WAAW,IAAI,UAAU,IAAI,EAAE,CAAC;IAE5C,IAAI,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QACzB,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;KAC9C,CAAC,CAAC;IAEH,oEAAoE;IACpE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACrB,OAAO,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE;SACpC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,KAAK,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAgB,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,IAAY,EACZ,KAAa,EACb,IAAY,EACZ,IAA6B;IAE7B,MAAM,GAAG,GAAG,WAAW,IAAI,UAAU,IAAI,EAAE,CAAC;IAE5C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,KAAK,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAgB,CAAC;AAClC,CAAC;AA2CD,MAAM,UAAU,oBAAoB;IAClC,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,YAAY;QACzB,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,uEAAuE;QAEnF,KAAK,CAAC,gBAAgB,CAAC,KAAK,EAAE,IAAI;YAChC,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAS,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACvD,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAChD,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAI;YAClC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAC3B,qFAAqF,EACrF,KAAK,EACL,IAAI,CACL,CAAC;YACF,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACxB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,QAAQ,EAAE,CAAC,CAAC,SAAS;aACtB,CAAC,CAAC,CAAC;QACN,CAAC;QAED,KAAK,CAAC,sBAAsB,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS;YACjD,MAAM,OAAO,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;YAC9C,IAAI,QAAqB,CAAC;YAC1B,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,QAAQ,CACvB,WAAW,OAAO,8EAA8E,EAChG,KAAK,EACL,IAAI,CACL,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,QAAQ,GAAG,MAAM,QAAQ,CACvB,UAAU,OAAO,sDAAsD,EACvE,KAAK,EACL,IAAI,CACL,CAAC;YACJ,CAAC;YACD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC1B,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,iBAAiB,EAAE,CAAC,CAAC,mBAAmB;gBACxC,OAAO,EAAE,CAAC,CAAC,gBAAgB;aAC5B,CAAC,CAAC,CAAC;QACN,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI;YAC5B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACtD,GAAG,CAAC,OAAO,CAAC,qBAAqB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAClD,OAAO,IAAI,CAAC,QAAQ,CAAC;QACvB,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK;YAC7C,MAAM,OAAO,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;YAC9C,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,MAAM,QAAQ,CACvB,eAAe,OAAO,EAAE,EACxB,KAAK,EACL,IAAI,CACL,CAAC;gBACF,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtC,OAAO,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACvB,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CACb,cAAc,SAAS,2CAA2C,CACnE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK;YAC3C,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,SAAS,IAAI,IAAI,EAAE,CAAC,CAAC;YAC3D,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,MAAM,QAAQ,CACtB,aAAa,OAAO,EAAE,EACtB,KAAK,EACL,IAAI,CACL,CAAC;gBACF,OAAO;oBACL,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChB,OAAO,EAAE,CAAC,CAAC,gBAAgB;oBAC3B,iBAAiB,EAAE,CAAC,CAAC,mBAAmB;iBACzC,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK;YAChD,MAAM,CAAC,GAAG,MAAM,OAAO,CACrB,WAAW,EACX,KAAK,EACL,IAAI,EACJ;gBACE,IAAI;gBACJ,IAAI,EAAE,IAAI;gBACV,YAAY,EAAE,MAAM,CAAC,WAAW,CAAC;gBACjC,UAAU,EAAE,SAAS;gBACrB,sBAAsB,EAAE,KAAK;aAC9B,CACF,CAAC;YACF,OAAO;gBACL,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChB,OAAO,EAAE,CAAC,CAAC,gBAAgB;gBAC3B,iBAAiB,EAAE,CAAC,CAAC,mBAAmB;aACzC,CAAC;QACJ,CAAC;QAED,uBAAuB,CAAC,KAAK,EAAE,GAAG;YAChC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,QAAQ,CACnC,uCAAuC,CACxC,CAAC;YACF,IAAI,IAAI,GAAG,YAAY,CAAC;YACxB,IAAI,QAAQ,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;gBAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;gBAClD,IAAI,KAAK;oBAAE,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC7B,CAAC;YAED,IAAI,CACF,qGAAqG,KAAK,UAAU,EACpH,EAAE,GAAG,EAAE,CACR,CAAC;YACF,GAAG,CAAC,OAAO,CAAC,kCAAkC,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,EAAE,KAAK;YAC7C,OAAO,kBAAkB,KAAK,IAAI,IAAI,IAAI,iBAAiB,MAAM,CAAC;QACpE,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,IAAI;YACzB,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/core/kubernetes.d.ts

@@ -1,4 +1,12 @@
 export declare function isClusterReachable(): boolean;
+export interface ExistingCluster {
+    type: "k3d" | "k3s";
+    names: string[];
+}
+export declare function detectExistingClusters(): ExistingCluster | null;
+export declare function listK3dClusters(): string[];
+export declare function k3dClusterExists(clusterName: string): boolean;
+export declare function k3sInstalled(): boolean;
 export declare function createK3dCluster(clusterName: string): Promise<void>;
 export declare function installK3s(): Promise<void>;
 export declare function setupKubeconfig(clusterName: string): string;
@@ -8,3 +16,4 @@ export declare function createSecret(name: string, namespace: string, data: Reco
 export declare function secretExists(name: string, namespace: string): boolean;
 export declare function deleteSecret(name: string, namespace: string): Promise<void>;
 export declare function createSecretFromFile(name: string, namespace: string, key: string, filePath: string): Promise<void>;
+export declare function createSshSecret(name: string, namespace: string, privateKey: string, publicKey: string, knownHosts: string): Promise<void>;

package/dist/core/kubernetes.js

@@ -1,4 +1,4 @@
-import { mkdirSync, writeFileSync } from "node:fs";
+import { mkdirSync, writeFileSync, rmSync } from "node:fs";
 import { exec, execAsync, execSafe } from "../utils/shell.js";
 import { isMacOS, isCI } from "../utils/platform.js";
 import { log, withSpinner } from "../utils/log.js";
@@ -7,6 +7,35 @@ export function isClusterReachable() {
     const { exitCode } = execSafe("kubectl cluster-info 2>/dev/null");
     return exitCode === 0;
 }
+export function detectExistingClusters() {
+    if (isMacOS() || isCI()) {
+        const names = listK3dClusters();
+        if (names.length > 0)
+            return { type: "k3d", names };
+        return null;
+    }
+    if (k3sInstalled()) {
+        return { type: "k3s", names: ["k3s"] };
+    }
+    return null;
+}
+export function listK3dClusters() {
+    const { stdout, exitCode } = execSafe("k3d cluster list --no-headers 2>/dev/null");
+    if (exitCode !== 0 || !stdout.trim())
+        return [];
+    return stdout
+        .trim()
+        .split("\n")
+        .map((line) => line.split(/\s+/)[0])
+        .filter(Boolean);
+}
+export function k3dClusterExists(clusterName) {
+    return listK3dClusters().includes(clusterName);
+}
+export function k3sInstalled() {
+    const { exitCode } = execSafe("command -v k3s");
+    return exitCode === 0;
+}
 export async function createK3dCluster(clusterName) {
     const { stdout } = execSafe("k3d cluster list 2>/dev/null");
     if (stdout.includes(clusterName)) {
@@ -78,4 +107,25 @@ export async function createSecretFromFile(name, namespace, key, filePath) {
     log.detail(`kubectl create secret generic ${name} --namespace=${namespace} --from-file=${key}`);
     await execAsync(cmd);
 }
+export async function createSshSecret(name, namespace, privateKey, publicKey, knownHosts) {
+    const tmpDir = "/tmp/flux-ssh-secret";
+    mkdirSync(tmpDir, { recursive: true });
+    try {
+        writeFileSync(`${tmpDir}/identity`, privateKey, { mode: 0o600 });
+        writeFileSync(`${tmpDir}/identity.pub`, publicKey);
+        writeFileSync(`${tmpDir}/known_hosts`, knownHosts);
+        const cmd = [
+            `kubectl create secret generic ${name}`,
+            `--namespace=${namespace}`,
+            `--from-file=identity="${tmpDir}/identity"`,
+            `--from-file=identity.pub="${tmpDir}/identity.pub"`,
+            `--from-file=known_hosts="${tmpDir}/known_hosts"`,
+        ].join(" ");
+        log.detail(`kubectl create secret generic ${name} --namespace=${namespace} (SSH)`);
+        await execAsync(cmd);
+    }
+    finally {
+        rmSync(tmpDir, { recursive: true, force: true });
+    }
+}
 //# sourceMappingURL=kubernetes.js.map

package/dist/core/kubernetes.js.map

@@ -1 +1 @@
-{"version":3,"file":"kubernetes.js","sourceRoot":"","sources":["../../src/core/kubernetes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,aAAa,EAAa,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEnD,MAAM,UAAU,kBAAkB;IAChC,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC,kCAAkC,CAAC,CAAC;IAClE,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,WAAmB;IACxD,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,8BAA8B,CAAC,CAAC;IAC5D,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,OAAO,CAAC,gBAAgB,WAAW,kBAAkB,CAAC,CAAC;QAC3D,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG;QACV,oBAAoB;QACpB,WAAW;QACX,yBAAyB,kBAAkB,QAAQ;QACnD,wCAAwC;QACxC,6BAA6B;QAC7B,+BAA+B;QAC/B,QAAQ;KACT,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChB,MAAM,WAAW,CAAC,yBAAyB,WAAW,GAAG,EAAE,GAAG,EAAE,CAC9D,SAAS,CAAC,GAAG,CAAC,CACf,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAChD,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,GAAG,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;QACrC,OAAO;IACT,CAAC;IAED,MAAM,WAAW,CAAC,gBAAgB,EAAE,GAAG,EAAE,CACvC,SAAS,CACP,wDAAwD,kBAAkB,qFAAqF,CAChK,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,WAAmB;IACjD,SAAS,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5D,IAAI,OAAO,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;QACxB,MAAM,cAAc,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,cAAc,WAAW,EAAE,CAAC;QACtE,MAAM,UAAU,GAAG,IAAI,CAAC,sBAAsB,WAAW,EAAE,CAAC,CAAC;QAC7D,aAAa,CAAC,cAAc,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,cAAc,CAAC;QACxC,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,IAAI,CAAC,sDAAsD,CAAC,CAAC;IAC7D,IAAI,CAAC,mDAAmD,CAAC,CAAC;IAC1D,IAAI,CAAC,8BAA8B,CAAC,CAAC;IACrC,MAAM,cAAc,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC;IAC1D,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,cAAc,CAAC;IACxC,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,MAAM,WAAW,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9C,MAAM,SAAS,CACb,8DAA8D,CAC/D,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY;IAChD,MAAM,SAAS,CACb,4BAA4B,IAAI,gDAAgD,CACjF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAY,EACZ,SAAiB,EACjB,IAA4B;IAE5B,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC;SAC7C,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,MAAM,GAAG,GAAG,iCAAiC,IAAI,gBAAgB,SAAS,IAAI,QAAQ,EAAE,CAAC;IACzF,GAAG,CAAC,MAAM,CAAC,iCAAiC,IAAI,gBAAgB,SAAS,EAAE,CAAC,CAAC;IAC7E,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,SAAiB;IAC1D,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAC3B,sBAAsB,IAAI,OAAO,SAAS,cAAc,CACzD,CAAC;IACF,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAY,EACZ,SAAiB;IAEjB,MAAM,SAAS,CAAC,yBAAyB,IAAI,OAAO,SAAS,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAY,EACZ,SAAiB,EACjB,GAAW,EACX,QAAgB;IAEhB,MAAM,GAAG,GAAG,iCAAiC,IAAI,gBAAgB,SAAS,gBAAgB,GAAG,KAAK,QAAQ,GAAG,CAAC;IAC9G,GAAG,CAAC,MAAM,CAAC,iCAAiC,IAAI,gBAAgB,SAAS,gBAAgB,GAAG,EAAE,CAAC,CAAC;IAChG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC"}
+{"version":3,"file":"kubernetes.js","sourceRoot":"","sources":["../../src/core/kubernetes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,aAAa,EAAa,MAAM,EAAE,MAAM,SAAS,CAAC;AACtE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEnD,MAAM,UAAU,kBAAkB;IAChC,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC,kCAAkC,CAAC,CAAC;IAClE,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC;AAOD,MAAM,UAAU,sBAAsB;IACpC,IAAI,OAAO,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,YAAY,EAAE,EAAE,CAAC;QACnB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IACzC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC,2CAA2C,CAAC,CAAC;IACnF,IAAI,QAAQ,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC;IAChD,OAAO,MAAM;SACV,IAAI,EAAE;SACN,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;SACnC,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,WAAmB;IAClD,OAAO,eAAe,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAChD,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,WAAmB;IACxD,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,8BAA8B,CAAC,CAAC;IAC5D,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,OAAO,CAAC,gBAAgB,WAAW,kBAAkB,CAAC,CAAC;QAC3D,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG;QACV,oBAAoB;QACpB,WAAW;QACX,yBAAyB,kBAAkB,QAAQ;QACnD,wCAAwC;QACxC,6BAA6B;QAC7B,+BAA+B;QAC/B,QAAQ;KACT,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChB,MAAM,WAAW,CAAC,yBAAyB,WAAW,GAAG,EAAE,GAAG,EAAE,CAC9D,SAAS,CAAC,GAAG,CAAC,CACf,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAChD,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,GAAG,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;QACrC,OAAO;IACT,CAAC;IAED,MAAM,WAAW,CAAC,gBAAgB,EAAE,GAAG,EAAE,CACvC,SAAS,CACP,wDAAwD,kBAAkB,qFAAqF,CAChK,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,WAAmB;IACjD,SAAS,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5D,IAAI,OAAO,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;QACxB,MAAM,cAAc,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,cAAc,WAAW,EAAE,CAAC;QACtE,MAAM,UAAU,GAAG,IAAI,CAAC,sBAAsB,WAAW,EAAE,CAAC,CAAC;QAC7D,aAAa,CAAC,cAAc,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,cAAc,CAAC;QACxC,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,IAAI,CAAC,sDAAsD,CAAC,CAAC;IAC7D,IAAI,CAAC,mDAAmD,CAAC,CAAC;IAC1D,IAAI,CAAC,8BAA8B,CAAC,CAAC;IACrC,MAAM,cAAc,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC;IAC1D,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,cAAc,CAAC;IACxC,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,MAAM,WAAW,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9C,MAAM,SAAS,CACb,8DAA8D,CAC/D,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY;IAChD,MAAM,SAAS,CACb,4BAA4B,IAAI,gDAAgD,CACjF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAY,EACZ,SAAiB,EACjB,IAA4B;IAE5B,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC;SAC7C,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,MAAM,GAAG,GAAG,iCAAiC,IAAI,gBAAgB,SAAS,IAAI,QAAQ,EAAE,CAAC;IACzF,GAAG,CAAC,MAAM,CAAC,iCAAiC,IAAI,gBAAgB,SAAS,EAAE,CAAC,CAAC;IAC7E,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,SAAiB;IAC1D,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAC3B,sBAAsB,IAAI,OAAO,SAAS,cAAc,CACzD,CAAC;IACF,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAY,EACZ,SAAiB;IAEjB,MAAM,SAAS,CAAC,yBAAyB,IAAI,OAAO,SAAS,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAY,EACZ,SAAiB,EACjB,GAAW,EACX,QAAgB;IAEhB,MAAM,GAAG,GAAG,iCAAiC,IAAI,gBAAgB,SAAS,gBAAgB,GAAG,KAAK,QAAQ,GAAG,CAAC;IAC9G,GAAG,CAAC,MAAM,CAAC,iCAAiC,IAAI,gBAAgB,SAAS,gBAAgB,GAAG,EAAE,CAAC,CAAC;IAChG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAY,EACZ,SAAiB,EACjB,UAAkB,EAClB,SAAiB,EACjB,UAAkB;IAElB,MAAM,MAAM,GAAG,sBAAsB,CAAC;IACtC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEvC,IAAI,CAAC;QACH,aAAa,CAAC,GAAG,MAAM,WAAW,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjE,aAAa,CAAC,GAAG,MAAM,eAAe,EAAE,SAAS,CAAC,CAAC;QACnD,aAAa,CAAC,GAAG,MAAM,cAAc,EAAE,UAAU,CAAC,CAAC;QAEnD,MAAM,GAAG,GAAG;YACV,iCAAiC,IAAI,EAAE;YACvC,eAAe,SAAS,EAAE;YAC1B,yBAAyB,MAAM,YAAY;YAC3C,6BAA6B,MAAM,gBAAgB;YACnD,4BAA4B,MAAM,eAAe;SAClD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,GAAG,CAAC,MAAM,CAAC,iCAAiC,IAAI,gBAAgB,SAAS,QAAQ,CAAC,CAAC;QACnF,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;AACH,CAAC"}

package/dist/schemas.d.ts

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import type { ProviderType } from "./core/git-provider.js";
 export declare const ClusterConfigSchema: z.ZodObject<{
     clusterName: z.ZodString;
     clusterDomain: z.ZodString;
@@ -6,8 +7,14 @@ export declare const ClusterConfigSchema: z.ZodObject<{
     letsencryptEmail: z.ZodOptional<z.ZodString>;
     ingressAllowedIps: z.ZodString;
 }, z.core.$strip>;
-export declare const GitLabConfigSchema: z.ZodObject<{
-    gitlabPat: z.ZodString;
+export declare const GitConfigSchema: z.ZodObject<{
+    gitProvider: z.ZodDefault<z.ZodEnum<{
+        gitlab: "gitlab";
+        github: "github";
+    }>>;
+    gitToken: z.ZodString;
+    gitFluxToken: z.ZodOptional<z.ZodString>;
+    gitHost: z.ZodOptional<z.ZodString>;
     repoName: z.ZodString;
     repoOwner: z.ZodString;
     repoBranch: z.ZodString;
@@ -18,11 +25,12 @@ export declare const SecretsConfigSchema: z.ZodObject<{
     openclawGatewayToken: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type ClusterConfig = z.infer<typeof ClusterConfigSchema>;
-export type GitLabConfig = z.infer<typeof GitLabConfigSchema>;
+export type GitConfig = z.infer<typeof GitConfigSchema>;
 export type SecretsConfig = z.infer<typeof SecretsConfigSchema>;
-export type BootstrapConfig = ClusterConfig & GitLabConfig & SecretsConfig & {
+export type BootstrapConfig = ClusterConfig & GitConfig & SecretsConfig & {
     selectedComponents: string[];
 };
+export type { ProviderType };
 export interface SopsConfig {
     keyDir: string;
     keyFile: string;
@@ -42,9 +50,12 @@ export interface ComponentDef {
 export declare const COMPONENTS: ComponentDef[];
 export declare const REQUIRED_COMPONENT_IDS: string[];
 export declare const DNS_TLS_COMPONENT_IDS: string[];
+export declare const MONITORING_COMPONENT_IDS: string[];
 export declare const OPTIONAL_COMPONENTS: ComponentDef[];
 export declare const KUBERNETES_VERSION = "1.35.1";
 export declare const SOURCE_GITLAB_HOST = "gitlab.com";
 export declare const SOURCE_PROJECT_PATH = "everythings-gonna-be-alright/fluxcd_ai_template";
 export declare const INSTALL_PLAN_PATH = "/tmp/installplan.json";
+export declare function isShortLivedGitHubToken(token: string): boolean;
+export declare function shouldUseSshDeployKey(config: BootstrapConfig): boolean;
 export declare function defaultSopsConfig(repoRoot: string): SopsConfig;

package/dist/schemas.js

@@ -12,8 +12,11 @@ export const ClusterConfigSchema = z.object({
     letsencryptEmail: z.string().optional(),
     ingressAllowedIps: z.string().min(1),
 });
-export const GitLabConfigSchema = z.object({
-    gitlabPat: z.string().min(1, "GitLab PAT is required"),
+export const GitConfigSchema = z.object({
+    gitProvider: z.enum(["gitlab", "github"]).default("gitlab"),
+    gitToken: z.string().min(1, "Git token is required"),
+    gitFluxToken: z.string().optional(),
+    gitHost: z.string().min(1).optional(),
     repoName: z.string().min(1),
     repoOwner: z.string().min(1),
     repoBranch: z.string().min(1),
@@ -29,12 +32,15 @@ export const COMPONENTS = [
     { id: "cert-manager", label: "Cert Manager", hint: "Automatic TLS certificates via Let's Encrypt", required: false, secrets: ["secret-cloudflare.yaml"] },
     { id: "external-dns", label: "External DNS", hint: "Automatic DNS records in Cloudflare", required: false, secrets: ["secret-cloudflare.yaml"] },
     { id: "prometheus-operator-crds", label: "Prometheus CRDs", hint: "Monitoring custom resource definitions", required: true },
+    { id: "grafana-operator", label: "Grafana Operator", hint: "Grafana dashboards and datasources via CRDs", required: false, subdomain: "grafana" },
+    { id: "victoria-metrics-k8s-stack", label: "Victoria Metrics Stack", hint: "Metrics collection, alerting and long-term storage", required: false, subdomain: "victoria" },
     { id: "flux-web", label: "Flux Web UI", hint: "Web dashboard for Flux status", required: false, subdomain: "flux" },
     { id: "openclaw", label: "OpenClaw", hint: "AI assistant gateway (requires OpenAI key)", required: false, secrets: ["secret-openclaw-envs.yaml"], subdomain: "openclaw" },
 ];
 export const REQUIRED_COMPONENT_IDS = COMPONENTS.filter((c) => c.required).map((c) => c.id);
 export const DNS_TLS_COMPONENT_IDS = ["cert-manager", "external-dns"];
-export const OPTIONAL_COMPONENTS = COMPONENTS.filter((c) => !c.required && !DNS_TLS_COMPONENT_IDS.includes(c.id));
+export const MONITORING_COMPONENT_IDS = ["grafana-operator", "victoria-metrics-k8s-stack"];
+export const OPTIONAL_COMPONENTS = COMPONENTS.filter((c) => !c.required && !DNS_TLS_COMPONENT_IDS.includes(c.id) && !MONITORING_COMPONENT_IDS.includes(c.id));
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
@@ -42,6 +48,14 @@ export const KUBERNETES_VERSION = "1.35.1";
 export const SOURCE_GITLAB_HOST = "gitlab.com";
 export const SOURCE_PROJECT_PATH = "everythings-gonna-be-alright/fluxcd_ai_template";
 export const INSTALL_PLAN_PATH = "/tmp/installplan.json";
+export function isShortLivedGitHubToken(token) {
+    return token.startsWith("gho_") || token.startsWith("ghu_");
+}
+export function shouldUseSshDeployKey(config) {
+    return (config.gitProvider === "github" &&
+        isShortLivedGitHubToken(config.gitToken) &&
+        !config.gitFluxToken);
+}
 export function defaultSopsConfig(repoRoot) {
     const keyDir = process.env.SOPS_AGE_KEY_DIR ?? `${process.env.HOME}/.sops`;
     return {