hatchkit 0.1.1 → 0.1.3

package/dist/status.js

@@ -0,0 +1,169 @@
+/*
+ * Shared status collection — what's configured, what's blocked, what's
+ * next. Used by the top-level menu, `hatchkit status`, `hatchkit doctor`,
+ * and the MCP server.
+ *
+ * Returns structured data (no chalk, no side-effects). The caller picks
+ * a renderer (human/json).
+ */
+import chalk from "chalk";
+import { getConfig, getConfigPath, getMlServices } from "./config.js";
+import { getCliVersion } from "./utils/version.js";
+export function collectStatus() {
+    const config = getConfig();
+    const providers = [];
+    providers.push({
+        key: "github",
+        label: "GitHub (gh CLI)",
+        configured: config.providers.github.status === "configured",
+        configureCommand: "hatchkit setup",
+    });
+    providers.push({
+        key: "coolify",
+        label: "Coolify",
+        configured: config.providers.coolify?.status === "configured",
+        detail: config.providers.coolify?.url,
+        configureCommand: "hatchkit config add coolify",
+    });
+    providers.push({
+        key: "hetzner",
+        label: "Hetzner Cloud",
+        configured: config.providers.hetzner?.status === "configured",
+        configureCommand: "hatchkit config add hetzner",
+    });
+    providers.push({
+        key: "dns",
+        label: "DNS",
+        configured: config.providers.dns?.status === "configured",
+        detail: config.providers.dns?.provider,
+        configureCommand: "hatchkit config add dns",
+    });
+    const s3Providers = Object.keys(config.providers.s3);
+    providers.push({
+        key: "s3",
+        label: "S3",
+        configured: s3Providers.length > 0,
+        detail: s3Providers.length > 0 ? s3Providers.join(", ") : undefined,
+        configureCommand: "hatchkit config add s3",
+    });
+    const gpuProviders = Object.keys(config.providers.gpu);
+    providers.push({
+        key: "gpu",
+        label: "GPU",
+        configured: gpuProviders.length > 0,
+        detail: gpuProviders.length > 0 ? gpuProviders.join(", ") : undefined,
+        configureCommand: "hatchkit config add gpu",
+    });
+    providers.push({
+        key: "glitchtip",
+        label: "GlitchTip (errors)",
+        configured: !!config.providers.glitchtip && config.providers.glitchtip.status === "configured",
+        configureCommand: "hatchkit config add glitchtip",
+    });
+    providers.push({
+        key: "openpanel",
+        label: "OpenPanel (analytics)",
+        configured: !!config.providers.openpanel && config.providers.openpanel.status === "configured",
+        configureCommand: "hatchkit config add openpanel",
+    });
+    providers.push({
+        key: "resend",
+        label: "Resend (email)",
+        configured: !!config.providers.resend && config.providers.resend.status === "configured",
+        configureCommand: "hatchkit config add resend",
+    });
+    const services = getMlServices();
+    const mlServiceList = Object.entries(services).map(([name, entry]) => ({
+        name,
+        endpoint: entry.endpoint,
+        platform: entry.platform,
+    }));
+    const nextStep = computeNextStep(providers);
+    const suggestions = computeSuggestions(providers);
+    return {
+        version: getCliVersion(),
+        configPath: getConfigPath(),
+        providers,
+        mlServiceCount: mlServiceList.length,
+        mlServices: mlServiceList,
+        nextStep,
+        suggestions,
+    };
+}
+function computeNextStep(providers) {
+    const required = ["github", "coolify", "hetzner", "dns"];
+    const firstMissing = providers.find((p) => required.includes(p.key) && !p.configured);
+    if (firstMissing) {
+        return `Run \`${firstMissing.configureCommand}\` — ${firstMissing.label} is required for full scaffolds.`;
+    }
+    return "You're set up. Try `hatchkit create` to scaffold a new project.";
+}
+function computeSuggestions(providers) {
+    const out = [];
+    const has = (k) => providers.find((p) => p.key === k)?.configured;
+    if (!has("github") || !has("coolify") || !has("hetzner") || !has("dns")) {
+        out.push({
+            command: "hatchkit setup",
+            why: "first-time onboarding wires up GitHub + Coolify + Hetzner + DNS at once",
+        });
+    }
+    if (has("coolify") && has("hetzner") && has("dns")) {
+        out.push({ command: "hatchkit create", why: "scaffold and (optionally) deploy a new project" });
+    }
+    out.push({
+        command: "hatchkit doctor",
+        why: "health-check every configured provider with contextual fix hints",
+    });
+    out.push({
+        command: "hatchkit add <project>",
+        why: "add per-project GlitchTip / OpenPanel / Resend clients",
+    });
+    out.push({
+        command: "hatchkit explain",
+        why: "one-page mental model of how the pieces fit together",
+    });
+    return out;
+}
+// ---------------------------------------------------------------------------
+// Renderers
+// ---------------------------------------------------------------------------
+export function renderStatusHuman(s) {
+    const lines = [];
+    lines.push(chalk.bold("  Provider Status:"));
+    lines.push("");
+    for (const p of s.providers) {
+        const icon = p.configured ? chalk.green("✓") : chalk.dim("·");
+        const detail = p.detail ? chalk.dim(` (${p.detail})`) : "";
+        const hint = p.configured ? "" : chalk.dim(`  — ${p.configureCommand ?? "not configured"}`);
+        lines.push(`  ${icon} ${p.label.padEnd(24)}${detail}${hint}`);
+    }
+    lines.push("");
+    lines.push(`  ML Services: ${s.mlServiceCount > 0 ? chalk.green(`${s.mlServiceCount} registered`) : chalk.dim("none")}`);
+    for (const m of s.mlServices) {
+        lines.push(chalk.dim(`    ${m.name}: ${m.endpoint} (${m.platform})`));
+    }
+    lines.push("");
+    lines.push(`  ${chalk.bold("Next:")} ${s.nextStep}`);
+    lines.push(chalk.dim(`  Config: ${s.configPath}`));
+    lines.push("");
+    return lines.join("\n");
+}
+export function renderMenu(s) {
+    const lines = [];
+    const configured = s.providers.filter((p) => p.configured).length;
+    const total = s.providers.length;
+    lines.push(`  ${chalk.bold("Hatchkit")} — scaffold, deploy, and provision full-stack projects`);
+    lines.push(`  ${chalk.dim(`${configured}/${total} providers configured`)}  ${chalk.dim("·")}  ${chalk.dim(s.version ? `v${s.version}` : "")}`);
+    lines.push("");
+    lines.push(`  ${chalk.bold("Next:")} ${s.nextStep}`);
+    lines.push("");
+    lines.push(chalk.bold("  Suggested commands:"));
+    for (const sug of s.suggestions) {
+        lines.push(`    ${chalk.cyan(sug.command.padEnd(28))} ${chalk.dim(sug.why)}`);
+    }
+    lines.push("");
+    lines.push(chalk.dim("  Run `hatchkit help <command>` for detail, or `hatchkit explain` for the mental model."));
+    lines.push("");
+    return lines.join("\n");
+}
+//# sourceMappingURL=status.js.map

package/dist/status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../src/status.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAuBnD,MAAM,UAAU,aAAa;IAC3B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,SAAS,GAAuB,EAAE,CAAC;IAEzC,SAAS,CAAC,IAAI,CAAC;QACb,GAAG,EAAE,QAAQ;QACb,KAAK,EAAE,iBAAiB;QACxB,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,KAAK,YAAY;QAC3D,gBAAgB,EAAE,gBAAgB;KACnC,CAAC,CAAC;IACH,SAAS,CAAC,IAAI,CAAC;QACb,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,SAAS;QAChB,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,KAAK,YAAY;QAC7D,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG;QACrC,gBAAgB,EAAE,6BAA6B;KAChD,CAAC,CAAC;IACH,SAAS,CAAC,IAAI,CAAC;QACb,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,eAAe;QACtB,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,KAAK,YAAY;QAC7D,gBAAgB,EAAE,6BAA6B;KAChD,CAAC,CAAC;IACH,SAAS,CAAC,IAAI,CAAC;QACb,GAAG,EAAE,KAAK;QACV,KAAK,EAAE,KAAK;QACZ,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,KAAK,YAAY;QACzD,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,QAAQ;QACtC,gBAAgB,EAAE,yBAAyB;KAC5C,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACrD,SAAS,CAAC,IAAI,CAAC;QACb,GAAG,EAAE,IAAI;QACT,KAAK,EAAE,IAAI;QACX,UAAU,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC;QAClC,MAAM,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;QACnE,gBAAgB,EAAE,wBAAwB;KAC3C,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACvD,SAAS,CAAC,IAAI,CAAC;QACb,GAAG,EAAE,KAAK;QACV,KAAK,EAAE,KAAK;QACZ,UAAU,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC;QACnC,MAAM,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;QACrE,gBAAgB,EAAE,yBAAyB;KAC5C,CAAC,CAAC;IAEH,SAAS,CAAC,IAAI,CAAC;QACb,GAAG,EAAE,WAAW;QAChB,KAAK,EAAE,oBAAoB;QAC3B,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,KAAK,YAAY;QAC9F,gBAAgB,EAAE,+BAA+B;KAClD,CAAC,CAAC;IACH,SAAS,CAAC,IAAI,CAAC;QACb,GAAG,EAAE,WAAW;QAChB,KAAK,EAAE,uBAAuB;QAC9B,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,KAAK,YAAY;QAC9F,gBAAgB,EAAE,+BAA+B;KAClD,CAAC,CAAC;IACH,SAAS,CAAC,IAAI,CAAC;QACb,GAAG,EAAE,QAAQ;QACb,KAAK,EAAE,gBAAgB;QACvB,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,KAAK,YAAY;QACxF,gBAAgB,EAAE,4BAA4B;KAC/C,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,aAAa,EAAE,CAAC;IACjC,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QACrE,IAAI;QACJ,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC,CAAC;IAEJ,MAAM,QAAQ,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAElD,OAAO;QACL,OAAO,EAAE,aAAa,EAAE;QACxB,UAAU,EAAE,aAAa,EAAE;QAC3B,SAAS;QACT,cAAc,EAAE,aAAa,CAAC,MAAM;QACpC,UAAU,EAAE,aAAa;QACzB,QAAQ;QACR,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,SAA6B;IACpD,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACzD,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACtF,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,SAAS,YAAY,CAAC,gBAAgB,QAAQ,YAAY,CAAC,KAAK,kCAAkC,CAAC;IAC5G,CAAC;IACD,OAAO,iEAAiE,CAAC;AAC3E,CAAC;AAED,SAAS,kBAAkB,CACzB,SAA6B;IAE7B,MAAM,GAAG,GAA4C,EAAE,CAAC;IACxD,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC;IAE1E,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,IAAI,CAAC;YACP,OAAO,EAAE,gBAAgB;YACzB,GAAG,EAAE,yEAAyE;SAC/E,CAAC,CAAC;IACL,CAAC;IACD,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,GAAG,EAAE,gDAAgD,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,GAAG,CAAC,IAAI,CAAC;QACP,OAAO,EAAE,iBAAiB;QAC1B,GAAG,EAAE,kEAAkE;KACxE,CAAC,CAAC;IACH,GAAG,CAAC,IAAI,CAAC;QACP,OAAO,EAAE,wBAAwB;QACjC,GAAG,EAAE,wDAAwD;KAC9D,CAAC,CAAC;IACH,GAAG,CAAC,IAAI,CAAC;QACP,OAAO,EAAE,kBAAkB;QAC3B,GAAG,EAAE,sDAAsD;KAC5D,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,MAAM,UAAU,iBAAiB,CAAC,CAAiB;IACjD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC7C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,gBAAgB,IAAI,gBAAgB,EAAE,CAAC,CAAC;QAC5F,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CACR,kBACE,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,cAAc,aAAa,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CACzF,EAAE,CACH,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACrD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IACnD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,CAAiB;IAC1C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,UAAU,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;IAClE,MAAM,KAAK,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC;IACjC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,wDAAwD,CAAC,CAAC;IAChG,KAAK,CAAC,IAAI,CACR,KAAK,KAAK,CAAC,GAAG,CAAC,GAAG,UAAU,IAAI,KAAK,uBAAuB,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAC5F,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CACjC,EAAE,CACJ,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACrD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAChD,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CACR,KAAK,CAAC,GAAG,CACP,yFAAyF,CAC1F,CACF,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/templates/addons/analytics/sentry.ts.hbs

@@ -3,10 +3,16 @@ import type { Express } from "express";
 import { config } from "../config.js";
 
 export function initSentry(app: Express): void {
+  // No DSN = no init. `hatchkit add` writes GLITCHTIP_DSN to
+  // .env.production by default; dev doesn't get one (dev error noise
+  // pollutes real metrics). Pass `--enable-dev-obs` to opt in.
   if (!config.GLITCHTIP_DSN) return;
 
   Sentry.init({
     dsn: config.GLITCHTIP_DSN,
+    // `environment` drives GlitchTip's UI filter. DEPLOY_ENV wins so
+    // staging deploys tag correctly even when NODE_ENV is "production".
+    environment: process.env.DEPLOY_ENV || process.env.NODE_ENV || "development",
     integrations: [
       Sentry.httpIntegration(),
       Sentry.expressIntegration({ app }),

package/dist/utils/cloudflare-api.d.ts

@@ -0,0 +1,30 @@
+export interface CloudflareZone {
+    id: string;
+    name: string;
+    name_servers: string[];
+    status: string;
+}
+export interface CloudflareApiOptions {
+    token: string;
+    /** Optional: filter to one account. Useful if the token spans multiple. */
+    accountId?: string;
+}
+/** Cloudflare REST API client. */
+export declare class CloudflareApi {
+    private token;
+    private accountId?;
+    constructor(options: CloudflareApiOptions);
+    private request;
+    /** Verify the token. "active" means it works. */
+    verifyToken(): Promise<string>;
+    /**
+     * List all zones accessible with this token, optionally filtered to one
+     * account. Paginates through the whole result set (CF caps per_page at
+     * 50). Safety valve: hard stop at 20 pages (= 1000 zones) to avoid
+     * runaway loops if the API misbehaves.
+     */
+    listZones(): Promise<CloudflareZone[]>;
+    /** Look up a single zone by name. Returns null if not found. */
+    getZoneByName(name: string): Promise<CloudflareZone | null>;
+}
+//# sourceMappingURL=cloudflare-api.d.ts.map

package/dist/utils/cloudflare-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare-api.d.ts","sourceRoot":"","sources":["../../src/utils/cloudflare-api.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAiBD,kCAAkC;AAClC,qBAAa,aAAa;IACxB,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,SAAS,CAAC,CAAS;gBAEf,OAAO,EAAE,oBAAoB;YAK3B,OAAO;IAoBrB,iDAAiD;IAC3C,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC;IAKpC;;;;;OAKG;IACG,SAAS,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IA2B5C,gEAAgE;IAC1D,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;CAMlE"}

package/dist/utils/cloudflare-api.js

@@ -0,0 +1,85 @@
+// Cloudflare REST API client.
+//
+// Minimal wrapper used by the `hatchkit dns link-to-cloudflare` command
+// to verify a token and list the zones in an account so we can
+// cross-reference them against domains registered at INWX. The DNS record
+// creation itself goes through Terraform (modules/cloudflare-dns) during
+// a normal `hatchkit create` flow — this client is for the standalone
+// migration / reconciliation command.
+//
+// NB: `hatchkit gh-pages` has its own inline Cloudflare DNS helper for
+// record CRUD. That path is separate and doesn't share this class.
+const API_BASE = "https://api.cloudflare.com/client/v4";
+/** Cloudflare REST API client. */
+export class CloudflareApi {
+    token;
+    accountId;
+    constructor(options) {
+        this.token = options.token;
+        this.accountId = options.accountId;
+    }
+    async request(method, path, body) {
+        const res = await fetch(`${API_BASE}${path}`, {
+            method,
+            headers: {
+                Authorization: `Bearer ${this.token}`,
+                "Content-Type": "application/json",
+                Accept: "application/json",
+            },
+            body: body ? JSON.stringify(body) : undefined,
+        });
+        const json = (await res.json().catch(() => null));
+        if (!res.ok || !json || !json.success) {
+            const errMsg = json?.errors?.map((e) => `${e.code}: ${e.message}`).join("; ") ?? res.statusText;
+            throw new Error(`Cloudflare ${method} ${path} failed: ${errMsg}`);
+        }
+        return json.result;
+    }
+    /** Verify the token. "active" means it works. */
+    async verifyToken() {
+        const data = await this.request("GET", "/user/tokens/verify");
+        return data.status;
+    }
+    /**
+     * List all zones accessible with this token, optionally filtered to one
+     * account. Paginates through the whole result set (CF caps per_page at
+     * 50). Safety valve: hard stop at 20 pages (= 1000 zones) to avoid
+     * runaway loops if the API misbehaves.
+     */
+    async listZones() {
+        const all = [];
+        let page = 1;
+        while (page <= 20) {
+            const query = new URLSearchParams({ per_page: "50", page: String(page) });
+            if (this.accountId)
+                query.set("account.id", this.accountId);
+            const path = `/zones?${query.toString()}`;
+            const res = await fetch(`${API_BASE}${path}`, {
+                headers: {
+                    Authorization: `Bearer ${this.token}`,
+                    Accept: "application/json",
+                },
+            });
+            const json = (await res.json());
+            if (!res.ok || !json.success) {
+                const errMsg = json?.errors?.map((e) => `${e.code}: ${e.message}`).join("; ") ?? res.statusText;
+                throw new Error(`Cloudflare GET /zones failed: ${errMsg}`);
+            }
+            all.push(...json.result);
+            const totalPages = json.result_info?.total_pages ?? 1;
+            if (page >= totalPages)
+                break;
+            page += 1;
+        }
+        return all;
+    }
+    /** Look up a single zone by name. Returns null if not found. */
+    async getZoneByName(name) {
+        const query = new URLSearchParams({ name });
+        if (this.accountId)
+            query.set("account.id", this.accountId);
+        const data = await this.request("GET", `/zones?${query.toString()}`);
+        return data[0] ?? null;
+    }
+}
+//# sourceMappingURL=cloudflare-api.js.map

package/dist/utils/cloudflare-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare-api.js","sourceRoot":"","sources":["../../src/utils/cloudflare-api.ts"],"names":[],"mappings":"AAAA,8BAA8B;AAC9B,EAAE;AACF,wEAAwE;AACxE,+DAA+D;AAC/D,0EAA0E;AAC1E,yEAAyE;AACzE,sEAAsE;AACtE,sCAAsC;AACtC,EAAE;AACF,uEAAuE;AACvE,mEAAmE;AA4BnE,MAAM,QAAQ,GAAG,sCAAsC,CAAC;AAExD,kCAAkC;AAClC,MAAM,OAAO,aAAa;IAChB,KAAK,CAAS;IACd,SAAS,CAAU;IAE3B,YAAY,OAA6B;QACvC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACrC,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACnE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,GAAG,IAAI,EAAE,EAAE;YAC5C,MAAM;YACN,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE;gBACrC,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC9C,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAyB,CAAC;QAC1E,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACtC,MAAM,MAAM,GACV,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC;YACnF,MAAM,IAAI,KAAK,CAAC,cAAc,MAAM,IAAI,IAAI,YAAY,MAAM,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,iDAAiD;IACjD,KAAK,CAAC,WAAW;QACf,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAiC,KAAK,EAAE,qBAAqB,CAAC,CAAC;QAC9F,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS;QACb,MAAM,GAAG,GAAqB,EAAE,CAAC;QACjC,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,OAAO,IAAI,IAAI,EAAE,EAAE,CAAC;YAClB,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1E,IAAI,IAAI,CAAC,SAAS;gBAAE,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAC5D,MAAM,IAAI,GAAG,UAAU,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC1C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,GAAG,IAAI,EAAE,EAAE;gBAC5C,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE;oBACrC,MAAM,EAAE,kBAAkB;iBAC3B;aACF,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiC,CAAC;YAChE,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC7B,MAAM,MAAM,GACV,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC;gBACnF,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;YACzB,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,WAAW,IAAI,CAAC,CAAC;YACtD,IAAI,IAAI,IAAI,UAAU;gBAAE,MAAM;YAC9B,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,gEAAgE;IAChE,KAAK,CAAC,aAAa,CAAC,IAAY;QAC9B,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,IAAI,IAAI,CAAC,SAAS;YAAE,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAmB,KAAK,EAAE,UAAU,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACvF,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACzB,CAAC;CACF"}

package/dist/utils/coolify-api.d.ts

@@ -14,7 +14,9 @@ export declare class CoolifyApi {
     private token;
     constructor(options: CoolifyApiOptions);
     private request;
-    /** Test connection and get Coolify version. */
+    /** Test connection and get Coolify version. The endpoint returns a
+     *  plain-text version string on modern Coolify, but older builds
+     *  wrap it as `{ version: "..." }` — accept either. */
     getVersion(): Promise<string>;
     /** List all servers. */
     listServers(): Promise<CoolifyServer[]>;

package/dist/utils/coolify-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"coolify-api.d.ts","sourceRoot":"","sources":["../../src/utils/coolify-api.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED,+BAA+B;AAC/B,qBAAa,UAAU;IACrB,OAAO,CAAC,GAAG,CAAS;IACpB,OAAO,CAAC,KAAK,CAAS;gBAEV,OAAO,EAAE,iBAAiB;YAKxB,OAAO;IAqBrB,+CAA+C;IACzC,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC;IAKnC,wBAAwB;IAClB,WAAW,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;IAkB7C,yBAAyB;IACnB,YAAY,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAIlE,4BAA4B;IACtB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAIxE,wEAAwE;IAClE,gBAAgB,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAI9F;mEAC+D;IACzD,SAAS,CACb,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAO,GACpC,OAAO,CAAC,IAAI,CAAC;CAYjB;AAED,mEAAmE;AACnE,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAG/E"}
+{"version":3,"file":"coolify-api.d.ts","sourceRoot":"","sources":["../../src/utils/coolify-api.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED,+BAA+B;AAC/B,qBAAa,UAAU;IACrB,OAAO,CAAC,GAAG,CAAS;IACpB,OAAO,CAAC,KAAK,CAAS;gBAEV,OAAO,EAAE,iBAAiB;YAKxB,OAAO;IAiCrB;;2DAEuD;IACjD,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC;IA0BnC,wBAAwB;IAClB,WAAW,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;IAkB7C,yBAAyB;IACnB,YAAY,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAIlE,4BAA4B;IACtB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAIxE,wEAAwE;IAClE,gBAAgB,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAI9F;mEAC+D;IACzD,SAAS,CACb,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAO,GACpC,OAAO,CAAC,IAAI,CAAC;CAYjB;AAED,mEAAmE;AACnE,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAG/E"}

package/dist/utils/coolify-api.js

@@ -20,12 +20,46 @@ export class CoolifyApi {
             const text = await res.text().catch(() => "");
             throw new Error(`Coolify API ${method} ${path} failed: ${res.status} ${res.statusText}${text ? ` — ${text}` : ""}`);
         }
-        return res.json();
+        const text = await res.text();
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            const ct = res.headers.get("content-type") ?? "unknown";
+            const snippet = text.slice(0, 200).replace(/\s+/g, " ").trim();
+            const hint = text.trimStart().startsWith("<")
+                ? " (got HTML — token may be invalid or URL points to a login page)"
+                : "";
+            throw new Error(`Coolify API ${method} ${path}: response is not JSON${hint}\n  content-type: ${ct}\n  body: ${snippet || "(empty)"}`);
+        }
     }
-    /** Test connection and get Coolify version. */
+    /** Test connection and get Coolify version. The endpoint returns a
+     *  plain-text version string on modern Coolify, but older builds
+     *  wrap it as `{ version: "..." }` — accept either. */
     async getVersion() {
-        const data = await this.request("GET", "/version");
-        return data.version;
+        const res = await fetch(`${this.url}/api/v1/version`, {
+            headers: {
+                Authorization: `Bearer ${this.token}`,
+                Accept: "application/json, text/plain;q=0.9",
+            },
+        });
+        if (!res.ok) {
+            const text = await res.text().catch(() => "");
+            throw new Error(`Coolify API GET /version failed: ${res.status} ${res.statusText}${text ? ` — ${text}` : ""}`);
+        }
+        const text = (await res.text()).trim();
+        try {
+            const parsed = JSON.parse(text);
+            if (typeof parsed === "string")
+                return parsed;
+            if (parsed && typeof parsed === "object" && typeof parsed.version === "string") {
+                return parsed.version;
+            }
+        }
+        catch {
+            // Fall through: plain-text version string (e.g. "4.0.0-beta.432")
+        }
+        return text;
     }
     /** List all servers. */
     async listServers() {

package/dist/utils/coolify-api.js.map

@@ -1 +1 @@
-{"version":3,"file":"coolify-api.js","sourceRoot":"","sources":["../../src/utils/coolify-api.ts"],"names":[],"mappings":"AAYA,+BAA+B;AAC/B,MAAM,OAAO,UAAU;IACb,GAAG,CAAS;IACZ,KAAK,CAAS;IAEtB,YAAY,OAA0B;QACpC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC7B,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACnE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,UAAU,IAAI,EAAE,EAAE;YACnD,MAAM;YACN,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE;gBACrC,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC9C,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,eAAe,MAAM,IAAI,IAAI,YAAY,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACnG,CAAC;QACJ,CAAC;QAED,OAAO,GAAG,CAAC,IAAI,EAAgB,CAAC;IAClC,CAAC;IAED,+CAA+C;IAC/C,KAAK,CAAC,UAAU;QACd,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAsB,KAAK,EAAE,UAAU,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,wBAAwB;IACxB,KAAK,CAAC,WAAW;QACf,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAO7B,KAAK,EAAE,UAAU,CAAC,CAAC;QAErB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtB,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CAAC,CAAC;IACN,CAAC;IAED,yBAAyB;IACzB,KAAK,CAAC,YAAY;QAChB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAC1C,CAAC;IAED,4BAA4B;IAC5B,KAAK,CAAC,aAAa,CAAC,IAAY;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,gBAAgB;QACpB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IAC9C,CAAC;IAED;mEAC+D;IAC/D,KAAK,CAAC,SAAS,CACb,OAAe,EACf,IAA4B,EAC5B,UAAmC,EAAE;QAErC,MAAM,IAAI,GAAG;YACX,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;gBAChD,GAAG;gBACH,KAAK;gBACL,UAAU,EAAE,OAAO,CAAC,SAAS,IAAI,KAAK;gBACtC,aAAa,EAAE,KAAK;gBACpB,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;SACJ,CAAC;QACF,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,iBAAiB,OAAO,YAAY,EAAE,IAAI,CAAC,CAAC;IAC1E,CAAC;CACF;AAED,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW,EAAE,KAAa;IAC5D,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3C,OAAO,GAAG,CAAC,UAAU,EAAE,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"coolify-api.js","sourceRoot":"","sources":["../../src/utils/coolify-api.ts"],"names":[],"mappings":"AAYA,+BAA+B;AAC/B,MAAM,OAAO,UAAU;IACb,GAAG,CAAS;IACZ,KAAK,CAAS;IAEtB,YAAY,OAA0B;QACpC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC7B,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACnE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,UAAU,IAAI,EAAE,EAAE;YACnD,MAAM;YACN,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE;gBACrC,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC9C,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,eAAe,MAAM,IAAI,IAAI,YAAY,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACnG,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC;YACxD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;gBAC3C,CAAC,CAAC,kEAAkE;gBACpE,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,KAAK,CACb,eAAe,MAAM,IAAI,IAAI,yBAAyB,IAAI,qBAAqB,EAAE,aAAa,OAAO,IAAI,SAAS,EAAE,CACrH,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;2DAEuD;IACvD,KAAK,CAAC,UAAU;QACd,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,iBAAiB,EAAE;YACpD,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE;gBACrC,MAAM,EAAE,oCAAoC;aAC7C;SACF,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,oCAAoC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAC9F,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,OAAO,MAAM,KAAK,QAAQ;gBAAE,OAAO,MAAM,CAAC;YAC9C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC/E,OAAO,MAAM,CAAC,OAAO,CAAC;YACxB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;QACpE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,wBAAwB;IACxB,KAAK,CAAC,WAAW;QACf,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAO7B,KAAK,EAAE,UAAU,CAAC,CAAC;QAErB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtB,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CAAC,CAAC;IACN,CAAC;IAED,yBAAyB;IACzB,KAAK,CAAC,YAAY;QAChB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAC1C,CAAC;IAED,4BAA4B;IAC5B,KAAK,CAAC,aAAa,CAAC,IAAY;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,gBAAgB;QACpB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IAC9C,CAAC;IAED;mEAC+D;IAC/D,KAAK,CAAC,SAAS,CACb,OAAe,EACf,IAA4B,EAC5B,UAAmC,EAAE;QAErC,MAAM,IAAI,GAAG;YACX,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;gBAChD,GAAG;gBACH,KAAK;gBACL,UAAU,EAAE,OAAO,CAAC,SAAS,IAAI,KAAK;gBACtC,aAAa,EAAE,KAAK;gBACpB,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;SACJ,CAAC;QACF,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,iBAAiB,OAAO,YAAY,EAAE,IAAI,CAAC,CAAC;IAC1E,CAAC;CACF;AAED,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW,EAAE,KAAa;IAC5D,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3C,OAAO,GAAG,CAAC,UAAU,EAAE,CAAC;AAC1B,CAAC"}

package/dist/utils/inwx-api.d.ts

@@ -0,0 +1,36 @@
+export interface InwxApiOptions {
+    username: string;
+    password: string;
+    /** Use the OTE sandbox instead of production. Set via INWX_SANDBOX=1. */
+    sandbox?: boolean;
+}
+/** INWX JSON-RPC API client. */
+export declare class InwxApi {
+    private url;
+    private username;
+    private password;
+    private cookie;
+    constructor(options: InwxApiOptions);
+    private request;
+    /** Log in and capture the session cookie. Must be called before any
+     *  other method. Idempotent — safe to call twice. */
+    login(): Promise<void>;
+    /** Log out and drop the session cookie. */
+    logout(): Promise<void>;
+    /** Look up a single domain. Returns the record including current
+     *  nameservers. Throws if the domain isn't registered on this account. */
+    getDomainInfo(domain: string): Promise<{
+        domain: string;
+        ns: string[];
+    }>;
+    /**
+     * Update the nameservers delegated at the registrar for `domain`.
+     * Replaces the full list — pass all the NS you want, not a diff.
+     *
+     * INWX's `domain.update` also accepts many other fields (contacts,
+     * transferLock, authinfo, ...). We only touch `ns` here so we never
+     * accidentally clobber contact info set via the web UI.
+     */
+    setDomainNameservers(domain: string, nameservers: string[]): Promise<void>;
+}
+//# sourceMappingURL=inwx-api.d.ts.map

package/dist/utils/inwx-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inwx-api.d.ts","sourceRoot":"","sources":["../../src/utils/inwx-api.ts"],"names":[],"mappings":"AAmBA,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAQD,gCAAgC;AAChC,qBAAa,OAAO;IAClB,OAAO,CAAC,GAAG,CAAS;IACpB,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,MAAM,CAAuB;gBAEzB,OAAO,EAAE,cAAc;YAMrB,OAAO;IAsCrB;yDACqD;IAC/C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAU5B,2CAA2C;IACrC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ7B;8EAC0E;IACpE,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAK9E;;;;;;;OAOG;IACG,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAQjF"}

package/dist/utils/inwx-api.js

@@ -0,0 +1,105 @@
+// INWX JSON-RPC API client.
+//
+// The INWX Terraform provider can create DNS records inside a zone, but it
+// can't change the nameservers that the TLD delegates a domain to. That's
+// a "domain object" operation (domain.update), not a "nameserver object"
+// operation — different part of the INWX API. This client handles the
+// domain-level call so hatchkit can automatically point an INWX-registered
+// domain at Cloudflare's nameservers after the CF zone is ready.
+//
+// API docs: https://www.inwx.com/en/help/apidoc
+// Endpoints: https://api.domrobot.com/jsonrpc/  (OTE sandbox on api.ote)
+//
+// The API is JSON-RPC 2.0 over HTTPS, session-cookie authenticated. Call
+// `account.login` once, capture the PHPSESSID cookie, include it on every
+// follow-up request.
+const PROD_URL = "https://api.domrobot.com/jsonrpc/";
+const OTE_URL = "https://api.ote.domrobot.com/jsonrpc/";
+/** INWX JSON-RPC API client. */
+export class InwxApi {
+    url;
+    username;
+    password;
+    cookie = null;
+    constructor(options) {
+        this.url = options.sandbox ? OTE_URL : PROD_URL;
+        this.username = options.username;
+        this.password = options.password;
+    }
+    async request(method, params) {
+        const headers = {
+            "Content-Type": "application/json",
+            Accept: "application/json",
+        };
+        if (this.cookie)
+            headers.Cookie = this.cookie;
+        const res = await fetch(this.url, {
+            method: "POST",
+            headers,
+            body: JSON.stringify({ method, params }),
+        });
+        if (!res.ok) {
+            throw new Error(`INWX API ${method} failed: HTTP ${res.status} ${res.statusText}`);
+        }
+        // Capture the session cookie from the response on login. INWX sets
+        // PHPSESSID; we pass it back on every subsequent call.
+        const setCookie = res.headers.get("set-cookie");
+        if (setCookie) {
+            const match = setCookie.match(/(PHPSESSID=[^;]+)/);
+            if (match)
+                this.cookie = match[1];
+        }
+        const json = (await res.json());
+        // INWX returns HTTP 200 with an error code in the body. 1000 = success,
+        // anything else is a failure. The `msg` field is the human-readable
+        // error — surface it verbatim so callers can see what went wrong
+        // (e.g. "Authentication error" vs "Object does not exist").
+        if (json.code !== 1000) {
+            throw new Error(`INWX ${method} failed: ${json.code} ${json.msg}`);
+        }
+        return json.resData;
+    }
+    /** Log in and capture the session cookie. Must be called before any
+     *  other method. Idempotent — safe to call twice. */
+    async login() {
+        await this.request("account.login", {
+            user: this.username,
+            pass: this.password,
+        });
+        if (!this.cookie) {
+            throw new Error("INWX login succeeded but no session cookie was set");
+        }
+    }
+    /** Log out and drop the session cookie. */
+    async logout() {
+        try {
+            await this.request("account.logout", {});
+        }
+        finally {
+            this.cookie = null;
+        }
+    }
+    /** Look up a single domain. Returns the record including current
+     *  nameservers. Throws if the domain isn't registered on this account. */
+    async getDomainInfo(domain) {
+        const data = await this.request("domain.info", { domain });
+        return data;
+    }
+    /**
+     * Update the nameservers delegated at the registrar for `domain`.
+     * Replaces the full list — pass all the NS you want, not a diff.
+     *
+     * INWX's `domain.update` also accepts many other fields (contacts,
+     * transferLock, authinfo, ...). We only touch `ns` here so we never
+     * accidentally clobber contact info set via the web UI.
+     */
+    async setDomainNameservers(domain, nameservers) {
+        if (nameservers.length < 2) {
+            // Most registries require ≥2 NS records. Fail loud rather than
+            // letting the TLD registry reject it with a less obvious error.
+            throw new Error(`At least 2 nameservers required, got ${nameservers.length}`);
+        }
+        await this.request("domain.update", { domain, ns: nameservers });
+    }
+}
+//# sourceMappingURL=inwx-api.js.map

package/dist/utils/inwx-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inwx-api.js","sourceRoot":"","sources":["../../src/utils/inwx-api.ts"],"names":[],"mappings":"AAAA,4BAA4B;AAC5B,EAAE;AACF,2EAA2E;AAC3E,0EAA0E;AAC1E,yEAAyE;AACzE,sEAAsE;AACtE,2EAA2E;AAC3E,iEAAiE;AACjE,EAAE;AACF,gDAAgD;AAChD,yEAAyE;AACzE,EAAE;AACF,yEAAyE;AACzE,0EAA0E;AAC1E,qBAAqB;AAErB,MAAM,QAAQ,GAAG,mCAAmC,CAAC;AACrD,MAAM,OAAO,GAAG,uCAAuC,CAAC;AAexD,gCAAgC;AAChC,MAAM,OAAO,OAAO;IACV,GAAG,CAAS;IACZ,QAAQ,CAAS;IACjB,QAAQ,CAAS;IACjB,MAAM,GAAkB,IAAI,CAAC;IAErC,YAAY,OAAuB;QACjC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;QAChD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IACnC,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,MAA+B;QACtE,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,kBAAkB;SAC3B,CAAC;QACF,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAE9C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;SACzC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,YAAY,MAAM,iBAAiB,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QACrF,CAAC;QAED,mEAAmE;QACnE,uDAAuD;QACvD,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;YACnD,IAAI,KAAK;gBAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAC;QAEtD,wEAAwE;QACxE,oEAAoE;QACpE,iEAAiE;QACjE,4DAA4D;QAC5D,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,QAAQ,MAAM,YAAY,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,OAAO,IAAI,CAAC,OAAY,CAAC;IAC3B,CAAC;IAED;yDACqD;IACrD,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE;YAClC,IAAI,EAAE,IAAI,CAAC,QAAQ;YACnB,IAAI,EAAE,IAAI,CAAC,QAAQ;SACpB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,KAAK,CAAC,MAAM;QACV,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;QAC3C,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC;IACH,CAAC;IAED;8EAC0E;IAC1E,KAAK,CAAC,aAAa,CAAC,MAAc;QAChC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAmC,aAAa,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7F,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,oBAAoB,CAAC,MAAc,EAAE,WAAqB;QAC9D,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,+DAA+D;YAC/D,gEAAgE;YAChE,MAAM,IAAI,KAAK,CAAC,wCAAwC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;IACnE,CAAC;CACF"}

package/dist/utils/secrets.d.ts

@@ -5,11 +5,18 @@ export declare const SECRET_KEYS: {
     readonly hetznerToken: "hetzner:token";
     readonly dnsInwxPassword: "dns:inwx:password";
     readonly dnsCloudflareToken: "dns:cloudflare:token";
+    /** Registrar password when DNS is on Cloudflare but the domain is
+     *  registered at INWX. Used by the post-apply NS flip in deploy/terraform
+     *  and by `hatchkit dns link-to-cloudflare`. */
+    readonly dnsInwxRegistrarPassword: "dns:inwx-registrar:password";
     readonly s3AccessKey: (provider: string) => string;
     readonly s3SecretKey: (provider: string) => string;
     readonly gpuApiKey: (platform: string) => string;
     readonly glitchtipToken: "glitchtip:auth-token";
-    readonly openpanelToken: "openpanel:personal-access-token";
+    /** Root-mode OpenPanel client used by the Management API to auto-create
+     *  per-project clients. Created once in the OpenPanel dashboard. */
+    readonly openpanelRootClientId: "openpanel:root-client-id";
+    readonly openpanelRootClientSecret: "openpanel:root-client-secret";
     readonly openpanelClientSecret: (name: string) => string;
     readonly resendApiKey: "resend:api-key";
     /** Per-scaffolded-project dotenvx private key for .env.production.

package/dist/utils/secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/utils/secrets.ts"],"names":[],"mappings":"AAoBA;mEACmE;AACnE,eAAO,MAAM,WAAW;;;;;qCAKE,MAAM;qCACN,MAAM;mCACR,MAAM;;;2CAGE,MAAM;;IAEpC;;+DAE2D;8CAC1B,MAAM;CAC/B,CAAC;AAEX,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAEnE;AAED,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEzE;AAED,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEhE;AAED,iEAAiE;AACjE,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAGrD"}
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/utils/secrets.ts"],"names":[],"mappings":"AAoBA;mEACmE;AACnE,eAAO,MAAM,WAAW;;;;;IAKtB;;oDAEgD;;qCAExB,MAAM;qCACN,MAAM;mCACR,MAAM;;IAE5B;wEACoE;;;2CAGtC,MAAM;;IAEpC;;+DAE2D;8CAC1B,MAAM;CAC/B,CAAC;AAEX,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAEnE;AAED,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEzE;AAED,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEhE;AAED,iEAAiE;AACjE,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAGrD"}

package/dist/utils/secrets.js

@@ -22,11 +22,18 @@ export const SECRET_KEYS = {
     hetznerToken: "hetzner:token",
     dnsInwxPassword: "dns:inwx:password",
     dnsCloudflareToken: "dns:cloudflare:token",
+    /** Registrar password when DNS is on Cloudflare but the domain is
+     *  registered at INWX. Used by the post-apply NS flip in deploy/terraform
+     *  and by `hatchkit dns link-to-cloudflare`. */
+    dnsInwxRegistrarPassword: "dns:inwx-registrar:password",
     s3AccessKey: (provider) => `s3:${provider}:access-key`,
     s3SecretKey: (provider) => `s3:${provider}:secret-key`,
     gpuApiKey: (platform) => `gpu:${platform}:api-key`,
     glitchtipToken: "glitchtip:auth-token",
-    openpanelToken: "openpanel:personal-access-token",
+    /** Root-mode OpenPanel client used by the Management API to auto-create
+     *  per-project clients. Created once in the OpenPanel dashboard. */
+    openpanelRootClientId: "openpanel:root-client-id",
+    openpanelRootClientSecret: "openpanel:root-client-secret",
     openpanelClientSecret: (name) => `openpanel:${name}:client-secret`,
     resendApiKey: "resend:api-key",
     /** Per-scaffolded-project dotenvx private key for .env.production.

package/dist/utils/secrets.js.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/utils/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,iEAAiE;AACjE,uEAAuE;AACvE,sEAAsE;AACtE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,UAAU,CAAC;AAElE;mEACmE;AACnE,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,YAAY,EAAE,eAAe;IAC7B,YAAY,EAAE,eAAe;IAC7B,eAAe,EAAE,mBAAmB;IACpC,kBAAkB,EAAE,sBAAsB;IAC1C,WAAW,EAAE,CAAC,QAAgB,EAAE,EAAE,CAAC,MAAM,QAAQ,aAAa;IAC9D,WAAW,EAAE,CAAC,QAAgB,EAAE,EAAE,CAAC,MAAM,QAAQ,aAAa;IAC9D,SAAS,EAAE,CAAC,QAAgB,EAAE,EAAE,CAAC,OAAO,QAAQ,UAAU;IAC1D,cAAc,EAAE,sBAAsB;IACtC,cAAc,EAAE,iCAAiC;IACjD,qBAAqB,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,aAAa,IAAI,gBAAgB;IAC1E,YAAY,EAAE,gBAAgB;IAC9B;;+DAE2D;IAC3D,iBAAiB,EAAE,CAAC,WAAmB,EAAE,EAAE,CAAC,WAAW,WAAW,yBAAyB;CACnF,CAAC;AAEX,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW;IACzC,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,KAAa;IACxD,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW;IAC5C,OAAO,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACnF,CAAC"}
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/utils/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,iEAAiE;AACjE,uEAAuE;AACvE,sEAAsE;AACtE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,UAAU,CAAC;AAElE;mEACmE;AACnE,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,YAAY,EAAE,eAAe;IAC7B,YAAY,EAAE,eAAe;IAC7B,eAAe,EAAE,mBAAmB;IACpC,kBAAkB,EAAE,sBAAsB;IAC1C;;oDAEgD;IAChD,wBAAwB,EAAE,6BAA6B;IACvD,WAAW,EAAE,CAAC,QAAgB,EAAE,EAAE,CAAC,MAAM,QAAQ,aAAa;IAC9D,WAAW,EAAE,CAAC,QAAgB,EAAE,EAAE,CAAC,MAAM,QAAQ,aAAa;IAC9D,SAAS,EAAE,CAAC,QAAgB,EAAE,EAAE,CAAC,OAAO,QAAQ,UAAU;IAC1D,cAAc,EAAE,sBAAsB;IACtC;wEACoE;IACpE,qBAAqB,EAAE,0BAA0B;IACjD,yBAAyB,EAAE,8BAA8B;IACzD,qBAAqB,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,aAAa,IAAI,gBAAgB;IAC1E,YAAY,EAAE,gBAAgB;IAC9B;;+DAE2D;IAC3D,iBAAiB,EAAE,CAAC,WAAmB,EAAE,EAAE,CAAC,WAAW,WAAW,yBAAyB;CACnF,CAAC;AAEX,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW;IACzC,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,KAAa;IACxD,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW;IAC5C,OAAO,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACnF,CAAC"}