hatchkit 0.1.4 → 0.1.6

package/dist/deploy/rollback.js

@@ -0,0 +1,295 @@
+/*
+ * Rollback — print a tailored cleanup recipe for a partial `hatchkit
+ * create` and (optionally) execute it.
+ *
+ * Two entry points:
+ *   - `handleCreateFailure(ledger, err)` — called from the create-flow
+ *     try/catch. Prints the error, the recipe, and a 3-way prompt:
+ *     roll back now / show recipe again / leave it. Destructive steps
+ *     (rm -rf appDir, github repo delete, terraform destroy) get a
+ *     per-step confirmation before they run, so a single 'y' at the
+ *     top doesn't unleash a cascade of irreversible operations.
+ *   - `runRollback(ledger, opts)` — used by `hatchkit destroy` for the
+ *     same execution path, with `--yes` to skip per-step prompts.
+ *
+ * Steps undo in reverse order. Failures within an undo are logged but
+ * don't abort the rest of the rollback — we want to claw back as much
+ * state as we can and surface what's left.
+ */
+import { existsSync, rmSync, unlinkSync } from "node:fs";
+import { confirm, select } from "@inquirer/prompts";
+import chalk from "chalk";
+import { getCoolifyConfig, getDnsConfig } from "../config.js";
+import { CoolifyApi } from "../utils/coolify-api.js";
+import { exec } from "../utils/exec.js";
+import { RunLedger } from "../utils/run-ledger.js";
+import { deleteSecret } from "../utils/secrets.js";
+/* ─────────────────────────────────────────────────────────────────────── */
+/*  Failure handler — called from the create-flow try/catch              */
+/* ─────────────────────────────────────────────────────────────────────── */
+export async function handleCreateFailure(ledger, err) {
+    const message = err instanceof Error ? err.message : String(err);
+    console.log(chalk.bold.red(`\n  ✗ hatchkit create failed: ${message}`));
+    if (ledger.steps.length === 0) {
+        console.log(chalk.dim("  No steps completed before failure — nothing to clean up.\n"));
+        ledger.delete();
+        return;
+    }
+    console.log(chalk.dim(`  Completed ${ledger.steps.length} step${ledger.steps.length === 1 ? "" : "s"} before failing. ` +
+        `Ledger: ${ledger.path}\n`));
+    printRecipe(ledger);
+    // Loop the prompt so "show recipe" doesn't drop the user back into
+    // an unreviewed default.
+    for (;;) {
+        const choice = await select({
+            message: "How would you like to handle the partial state?",
+            choices: [
+                { name: "Roll back now (with confirmation per destructive step)", value: "rollback" },
+                { name: "Show the recipe again", value: "recipe" },
+                { name: "Leave it — I'll clean up later", value: "leave" },
+            ],
+            default: "leave",
+        });
+        if (choice === "recipe") {
+            printRecipe(ledger);
+            continue;
+        }
+        if (choice === "leave") {
+            console.log(chalk.dim(`\n  Ledger preserved at ${ledger.path}. Run \`hatchkit destroy ${ledger.name}\` later to undo.\n`));
+            return;
+        }
+        await runRollback(ledger, { yes: false });
+        return;
+    }
+}
+/* ─────────────────────────────────────────────────────────────────────── */
+/*  Recipe printer — copy-pasteable bash commands                        */
+/* ─────────────────────────────────────────────────────────────────────── */
+export function printRecipe(ledger) {
+    console.log(chalk.bold("  ── Cleanup recipe ──────────────────────────────────────────\n"));
+    console.log(chalk.dim("  Run these in order to manually undo the partial create:\n"));
+    // Reverse order: undo the latest step first.
+    const lines = [];
+    for (const step of [...ledger.steps].reverse()) {
+        const cmd = recipeFor(step);
+        if (cmd)
+            lines.push(cmd);
+    }
+    for (const line of lines) {
+        console.log(`    ${line}`);
+    }
+    console.log();
+}
+function recipeFor(step) {
+    switch (step.kind) {
+        case "mlService":
+            return chalk.dim(`# manual: delete ${step.name} from your ${step.platform} dashboard`);
+        case "coolifyDb":
+            return chalk.dim(`# manual: delete database ${step.uuid} from the Coolify dashboard`);
+        case "coolifyApp":
+            return chalk.dim(`# manual: delete application ${step.uuid} from the Coolify dashboard`);
+        case "terraformApplied":
+            return `cd ${shellEscape(step.stackDir)} && terraform destroy -var-file=${shellEscape(step.tfvarsPath)}`;
+        case "coolifyEnv":
+            return `rm ${shellEscape(step.path)}`;
+        case "tfvars":
+            return `rm ${shellEscape(step.path)}`;
+        case "glitchtip":
+            return `hatchkit remove ${shellEscape(step.project)} glitchtip --yes`;
+        case "github":
+            return `gh repo delete ${shellEscape(step.repo)} --yes`;
+        case "scaffold":
+            return `rm -rf ${shellEscape(step.path)}`;
+        case "keychain":
+            return `security delete-generic-password -s hatchkit -a ${shellEscape(step.account)}`;
+    }
+}
+function shellEscape(s) {
+    if (/^[A-Za-z0-9_./:@%+=,-]+$/.test(s))
+        return s;
+    return `'${s.replace(/'/g, "'\\''")}'`;
+}
+/* ─────────────────────────────────────────────────────────────────────── */
+/*  Executor — reverse-order undo                                        */
+/* ─────────────────────────────────────────────────────────────────────── */
+export async function runRollback(ledger, opts = {}) {
+    console.log(chalk.bold("\n  ── Rolling back ────────────────────────────────────────────\n"));
+    let undone = 0;
+    let skipped = 0;
+    let failed = 0;
+    const remaining = [];
+    for (const step of [...ledger.steps].reverse()) {
+        const label = describeStep(step);
+        // Per-step confirmation for the irreversible ones unless --yes.
+        if (!opts.yes && isDestructive(step)) {
+            const ok = await confirm({
+                message: `${chalk.red("Destructive:")} ${label}. Proceed?`,
+                default: false,
+            });
+            if (!ok) {
+                console.log(chalk.dim(`    skipped: ${label}`));
+                skipped += 1;
+                remaining.push(step);
+                continue;
+            }
+        }
+        process.stdout.write(`  ${label} … `);
+        try {
+            const result = await undoStep(step);
+            if (result === "skipped") {
+                console.log(chalk.dim("skipped"));
+                skipped += 1;
+                remaining.push(step);
+            }
+            else if (result === "not-found") {
+                console.log(chalk.dim("already gone"));
+                undone += 1;
+            }
+            else {
+                console.log(chalk.green("✓"));
+                undone += 1;
+            }
+        }
+        catch (err) {
+            console.log(chalk.red(`✗ ${err.message}`));
+            failed += 1;
+            remaining.push(step);
+        }
+    }
+    console.log(chalk.bold("\n  ── Rollback summary ────────────────────────────────────────\n"));
+    console.log(`  Undone:    ${chalk.green(undone)}`);
+    console.log(`  Skipped:   ${chalk.dim(skipped)}`);
+    console.log(`  Failed:    ${failed > 0 ? chalk.red(failed) : chalk.dim(failed)}`);
+    if (remaining.length === 0) {
+        ledger.delete();
+        console.log(chalk.dim(`\n  Ledger removed.\n`));
+    }
+    else {
+        // Replace the ledger with what's left so the next `hatchkit destroy`
+        // run picks up where we paused.
+        rewriteRemaining(ledger, remaining);
+        console.log(chalk.yellow(`\n  ${remaining.length} step(s) still pending. Re-run \`hatchkit destroy ${ledger.name}\` to retry.\n`));
+    }
+}
+/** Rewrite the on-disk ledger to keep only the steps that weren't
+ *  undone (because they failed or the user skipped them). Done by
+ *  calling `start` to clobber the file, then re-recording each
+ *  remaining step in original (forward) order. */
+function rewriteRemaining(ledger, remaining) {
+    // Steps were processed in reverse; remaining is in reverse too.
+    // Restore original order so a future rollback walks them correctly.
+    const fresh = RunLedger.start(ledger.name);
+    for (const step of [...remaining].reverse()) {
+        fresh.record(step);
+    }
+}
+function isDestructive(step) {
+    return (step.kind === "scaffold" ||
+        step.kind === "github" ||
+        step.kind === "terraformApplied" ||
+        step.kind === "coolifyApp" ||
+        step.kind === "coolifyDb");
+}
+function describeStep(step) {
+    switch (step.kind) {
+        case "scaffold":
+            return `delete local repo ${chalk.cyan(step.path)}`;
+        case "github":
+            return `delete GitHub repo ${chalk.cyan(step.repo)}`;
+        case "glitchtip":
+            return `delete GlitchTip project ${chalk.cyan(step.project)}`;
+        case "tfvars":
+            return `remove ${chalk.cyan(step.path)}`;
+        case "coolifyEnv":
+            return `remove ${chalk.cyan(step.path)}`;
+        case "keychain":
+            return `delete keychain entry ${chalk.cyan(step.account)}`;
+        case "terraformApplied":
+            return `terraform destroy in ${chalk.cyan(step.stackDir)}`;
+        case "coolifyApp":
+            return `delete Coolify app ${chalk.cyan(step.uuid)}`;
+        case "coolifyDb":
+            return `delete Coolify db ${chalk.cyan(step.uuid)}`;
+        case "mlService":
+            return `${chalk.cyan(step.platform)} ML service ${chalk.cyan(step.name)}`;
+    }
+}
+async function undoStep(step) {
+    switch (step.kind) {
+        case "scaffold": {
+            if (!existsSync(step.path))
+                return "not-found";
+            rmSync(step.path, { recursive: true, force: true });
+            return "done";
+        }
+        case "github": {
+            const res = await exec("gh", ["repo", "delete", step.repo, "--yes"], { silent: true });
+            if (res.exitCode !== 0) {
+                // Already gone, or the user lacks delete:repo scope.
+                if (/not found|404/i.test(res.stderr ?? ""))
+                    return "not-found";
+                throw new Error(`gh repo delete failed: ${res.stderr || res.stdout}`);
+            }
+            return "done";
+        }
+        case "glitchtip": {
+            const { deleteGlitchtipClient } = await import("../provision/glitchtip.js");
+            const result = await deleteGlitchtipClient(step.project);
+            return result === "not-found" ? "not-found" : "done";
+        }
+        case "tfvars":
+        case "coolifyEnv": {
+            if (!existsSync(step.path))
+                return "not-found";
+            unlinkSync(step.path);
+            return "done";
+        }
+        case "keychain": {
+            const ok = await deleteSecret(step.account);
+            return ok ? "done" : "not-found";
+        }
+        case "terraformApplied": {
+            // We need the same env vars `runTerraform` used. Re-derive from
+            // the user's saved DNS config; if creds aren't there anymore,
+            // the destroy won't work and we say so.
+            const dns = await getDnsConfig();
+            const env = {};
+            if (dns?.provider === "cloudflare" && dns.apiToken) {
+                env.TF_VAR_cloudflare_api_token = dns.apiToken;
+            }
+            else if (dns?.provider === "inwx" && dns.username && dns.password) {
+                env.TF_VAR_inwx_username = dns.username;
+                env.TF_VAR_inwx_password = dns.password;
+            }
+            else {
+                throw new Error("DNS credentials no longer in keychain — re-add them, then retry");
+            }
+            const res = await exec("terraform", ["destroy", "-auto-approve", `-var-file=${step.tfvarsPath}`], { cwd: step.stackDir, env, silent: true });
+            if (res.exitCode !== 0) {
+                throw new Error(`terraform destroy failed: ${res.stderr || res.stdout}`);
+            }
+            return "done";
+        }
+        case "coolifyApp": {
+            const cfg = await getCoolifyConfig();
+            if (!cfg)
+                throw new Error("Coolify config no longer present");
+            const api = new CoolifyApi({ url: cfg.url, token: cfg.token });
+            const result = await api.deleteApplication(step.uuid);
+            return result === "not-found" ? "not-found" : "done";
+        }
+        case "coolifyDb": {
+            const cfg = await getCoolifyConfig();
+            if (!cfg)
+                throw new Error("Coolify config no longer present");
+            const api = new CoolifyApi({ url: cfg.url, token: cfg.token });
+            const result = await api.deleteDatabase(step.uuid);
+            return result === "not-found" ? "not-found" : "done";
+        }
+        case "mlService":
+            // Per-platform delete is platform-specific (Modal/RunPod/HF/Replicate).
+            // Surface in the recipe but skip auto-undo for now.
+            return "skipped";
+    }
+}
+//# sourceMappingURL=rollback.js.map

package/dist/deploy/rollback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rollback.js","sourceRoot":"","sources":["../../src/deploy/rollback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAmB,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAOnD,6EAA6E;AAC7E,2EAA2E;AAC3E,6EAA6E;AAE7E,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAiB,EAAE,GAAY;IACvE,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,iCAAiC,OAAO,EAAE,CAAC,CAAC,CAAC;IAExE,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC,CAAC;QACvF,MAAM,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CACP,eAAe,MAAM,CAAC,KAAK,CAAC,MAAM,QAAQ,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,mBAAmB;QAC/F,WAAW,MAAM,CAAC,IAAI,IAAI,CAC7B,CACF,CAAC;IACF,WAAW,CAAC,MAAM,CAAC,CAAC;IAEpB,mEAAmE;IACnE,yBAAyB;IACzB,SAAS,CAAC;QACR,MAAM,MAAM,GAAG,MAAM,MAAM,CAAkC;YAC3D,OAAO,EAAE,iDAAiD;YAC1D,OAAO,EAAE;gBACP,EAAE,IAAI,EAAE,wDAAwD,EAAE,KAAK,EAAE,UAAU,EAAE;gBACrF,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,QAAQ,EAAE;gBAClD,EAAE,IAAI,EAAE,gCAAgC,EAAE,KAAK,EAAE,OAAO,EAAE;aAC3D;YACD,OAAO,EAAE,OAAO;SACjB,CAAC,CAAC;QACH,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxB,WAAW,CAAC,MAAM,CAAC,CAAC;YACpB,SAAS;QACX,CAAC;QACD,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CACP,2BAA2B,MAAM,CAAC,IAAI,4BAA4B,MAAM,CAAC,IAAI,qBAAqB,CACnG,CACF,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,WAAW,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1C,OAAO;IACT,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,2EAA2E;AAC3E,6EAA6E;AAE7E,MAAM,UAAU,WAAW,CAAC,MAAiB;IAC3C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC,CAAC;IAC5F,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC,CAAC;IAEtF,6CAA6C;IAC7C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/C,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,GAAG;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,CAAC,GAAG,EAAE,CAAC;AAChB,CAAC;AAED,SAAS,SAAS,CAAC,IAAgB;IACjC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,WAAW;YACd,OAAO,KAAK,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,IAAI,cAAc,IAAI,CAAC,QAAQ,YAAY,CAAC,CAAC;QACzF,KAAK,WAAW;YACd,OAAO,KAAK,CAAC,GAAG,CAAC,6BAA6B,IAAI,CAAC,IAAI,6BAA6B,CAAC,CAAC;QACxF,KAAK,YAAY;YACf,OAAO,KAAK,CAAC,GAAG,CAAC,gCAAgC,IAAI,CAAC,IAAI,6BAA6B,CAAC,CAAC;QAC3F,KAAK,kBAAkB;YACrB,OAAO,MAAM,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,mCAAmC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3G,KAAK,YAAY;YACf,OAAO,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,KAAK,QAAQ;YACX,OAAO,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,KAAK,WAAW;YACd,OAAO,mBAAmB,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;QACxE,KAAK,QAAQ;YACX,OAAO,kBAAkB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC1D,KAAK,UAAU;YACb,OAAO,UAAU,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,KAAK,UAAU;YACb,OAAO,mDAAmD,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1F,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,IAAI,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AACzC,CAAC;AAED,6EAA6E;AAC7E,2EAA2E;AAC3E,6EAA6E;AAE7E,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAiB,EAAE,OAAwB,EAAE;IAC7E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC,CAAC;IAE9F,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,SAAS,GAAiB,EAAE,CAAC;IAEnC,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAEjC,gEAAgE;QAChE,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC;gBACvB,OAAO,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,KAAK,YAAY;gBAC1D,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;YACH,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,KAAK,EAAE,CAAC,CAAC,CAAC;gBAChD,OAAO,IAAI,CAAC,CAAC;gBACb,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACrB,SAAS;YACX,CAAC;QACH,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;gBAClC,OAAO,IAAI,CAAC,CAAC;gBACb,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvB,CAAC;iBAAM,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;gBAClC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;gBACvC,MAAM,IAAI,CAAC,CAAC;YACd,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC9B,MAAM,IAAI,CAAC,CAAC;YACd,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACtD,MAAM,IAAI,CAAC,CAAC;YACZ,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC,CAAC;IAC9F,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAElF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAClD,CAAC;SAAM,CAAC;QACN,qEAAqE;QACrE,gCAAgC;QAChC,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACpC,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CACV,OAAO,SAAS,CAAC,MAAM,qDAAqD,MAAM,CAAC,IAAI,gBAAgB,CACxG,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;kDAGkD;AAClD,SAAS,gBAAgB,CAAC,MAAiB,EAAE,SAAuB;IAClE,gEAAgE;IAChE,oEAAoE;IACpE,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAgB;IACrC,OAAO,CACL,IAAI,CAAC,IAAI,KAAK,UAAU;QACxB,IAAI,CAAC,IAAI,KAAK,QAAQ;QACtB,IAAI,CAAC,IAAI,KAAK,kBAAkB;QAChC,IAAI,CAAC,IAAI,KAAK,YAAY;QAC1B,IAAI,CAAC,IAAI,KAAK,WAAW,CAC1B,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,IAAgB;IACpC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,UAAU;YACb,OAAO,qBAAqB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,KAAK,QAAQ;YACX,OAAO,sBAAsB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvD,KAAK,WAAW;YACd,OAAO,4BAA4B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAChE,KAAK,QAAQ;YACX,OAAO,UAAU,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,KAAK,YAAY;YACf,OAAO,UAAU,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,KAAK,UAAU;YACb,OAAO,yBAAyB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7D,KAAK,kBAAkB;YACrB,OAAO,wBAAwB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7D,KAAK,YAAY;YACf,OAAO,sBAAsB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvD,KAAK,WAAW;YACd,OAAO,qBAAqB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,KAAK,WAAW;YACd,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAgB;IACtC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,WAAW,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACpD,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACvF,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBACvB,qDAAqD;gBACrD,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;oBAAE,OAAO,WAAW,CAAC;gBAChE,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;YAC5E,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzD,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;QACvD,CAAC;QACD,KAAK,QAAQ,CAAC;QACd,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,WAAW,CAAC;YAC/C,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC5C,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC;QACnC,CAAC;QACD,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACxB,gEAAgE;YAChE,8DAA8D;YAC9D,wCAAwC;YACxC,MAAM,GAAG,GAAG,MAAM,YAAY,EAAE,CAAC;YACjC,MAAM,GAAG,GAA2B,EAAE,CAAC;YACvC,IAAI,GAAG,EAAE,QAAQ,KAAK,YAAY,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACnD,GAAG,CAAC,2BAA2B,GAAG,GAAG,CAAC,QAAQ,CAAC;YACjD,CAAC;iBAAM,IAAI,GAAG,EAAE,QAAQ,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACpE,GAAG,CAAC,oBAAoB,GAAG,GAAG,CAAC,QAAQ,CAAC;gBACxC,GAAG,CAAC,oBAAoB,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC1C,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;YACrF,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,IAAI,CACpB,WAAW,EACX,CAAC,SAAS,EAAE,eAAe,EAAE,aAAa,IAAI,CAAC,UAAU,EAAE,CAAC,EAC5D,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAC1C,CAAC;YACF,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,GAAG,GAAG,MAAM,gBAAgB,EAAE,CAAC;YACrC,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YAC9D,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;YAC/D,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtD,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;QACvD,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,GAAG,GAAG,MAAM,gBAAgB,EAAE,CAAC;YACrC,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YAC9D,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;YAC/D,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnD,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;QACvD,CAAC;QACD,KAAK,WAAW;YACd,wEAAwE;YACxE,oDAAoD;YACpD,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC"}

package/dist/deploy/terraform.d.ts

@@ -1,4 +1,13 @@
 import type { ProjectConfig } from "../prompts.js";
+/** Result of `runTerraform`. Returns metadata the caller can record in
+ *  the run ledger so a later rollback knows which stack to destroy. */
+export interface RunTerraformResult {
+    /** Set when an apply actually ran. Undefined for manual-DNS or skip. */
+    applied?: {
+        stackDir: string;
+        tfvarsPath: string;
+    };
+}
 /** Run Terraform for the project. */
-export declare function runTerraform(config: ProjectConfig, repoRoot: string): Promise<void>;
+export declare function runTerraform(config: ProjectConfig, repoRoot: string): Promise<RunTerraformResult>;
 //# sourceMappingURL=terraform.d.ts.map

package/dist/deploy/terraform.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"terraform.d.ts","sourceRoot":"","sources":["../../src/deploy/terraform.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAInD,qCAAqC;AACrC,wBAAsB,YAAY,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA2FzF"}
+{"version":3,"file":"terraform.d.ts","sourceRoot":"","sources":["../../src/deploy/terraform.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAiBnD;uEACuE;AACvE,MAAM,WAAW,kBAAkB;IACjC,wEAAwE;IACxE,OAAO,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CACpD;AAED,qCAAqC;AACrC,wBAAsB,YAAY,CAChC,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,kBAAkB,CAAC,CAoI7B"}

package/dist/deploy/terraform.js

@@ -1,37 +1,66 @@
-import { join } from "node:path";
+import { promises as dnsPromises } from "node:dns";
+import { select } from "@inquirer/prompts";
 import chalk from "chalk";
-import { getDnsConfig, getHetznerToken, getS3Config } from "../config.js";
+import { getDnsConfig, getHetznerToken, getS3Config, promptAndSaveInwxRegistrarCreds, } from "../config.js";
+import { resolveStackDir } from "../scaffold/infra.js";
+import { CloudflareApi } from "../utils/cloudflare-api.js";
 import { exec, execStream } from "../utils/exec.js";
 import { InwxApi } from "../utils/inwx-api.js";
 /** Run Terraform for the project. */
 export async function runTerraform(config, repoRoot) {
     const hetznerToken = await getHetznerToken();
     const dnsConfig = await getDnsConfig();
-    const stackDir = config.deployTarget === "new"
-        ? join(repoRoot, "terraform", "stacks", "node-realtime")
-        : join(repoRoot, "terraform", "stacks", "dns-only");
-    const tfvarsFile = join(stackDir, `${config.name}.tfvars`);
-    // Build env vars for Terraform
+    const dnsProvider = (dnsConfig?.provider ?? "inwx");
+    console.log(chalk.bold("\n  ── Terraform ──────────────────────────────────────────────\n"));
+    // Manual DNS on an existing server: nothing for Terraform to do.
+    if (config.deployTarget === "existing" && dnsProvider === "manual") {
+        console.log(chalk.dim("  Manual DNS — no Terraform stack to apply. Set DNS records yourself."));
+        return {};
+    }
+    const stackDir = resolveStackDir(repoRoot, config.deployTarget, dnsProvider);
+    if (!stackDir) {
+        console.log(chalk.dim("  No matching Terraform stack — skipping."));
+        return {};
+    }
+    const tfvarsFile = `${stackDir}/${config.name}.tfvars`;
+    // Build env vars for Terraform — only what the chosen stack needs.
     const env = {};
     if (hetznerToken) {
         env.TF_VAR_hcloud_token = hetznerToken;
     }
-    // DNS credentials. The stack's dns_provider variable decides which
-    // provider actually *applies* records, but the INWX Terraform provider
-    // calls account.login during Configure() regardless, so valid INWX
-    // creds must always be passed through when we have them. Either the
-    // primary DNS creds (provider = "inwx") or the registrar creds
-    // (provider = "cloudflare" with INWX still holding the domain) satisfy
-    // that requirement.
-    if (dnsConfig?.provider === "inwx") {
-        env.TF_VAR_inwx_username = dnsConfig.username || "";
-        env.TF_VAR_inwx_password = dnsConfig.password || "";
-    }
-    else if (dnsConfig?.provider === "cloudflare") {
-        env.TF_VAR_cloudflare_api_token = dnsConfig.apiToken || "";
-        if (dnsConfig.registrarUsername && dnsConfig.registrarPassword) {
-            env.TF_VAR_inwx_username = dnsConfig.registrarUsername;
-            env.TF_VAR_inwx_password = dnsConfig.registrarPassword;
+    // Preflight + DNS creds. The dns-only-* stacks each only declare one
+    // DNS provider, so we pass only that provider's creds. The legacy
+    // node-realtime stack still bundles both providers (count-gated
+    // modules) and inherits the older "INWX creds required even for CF"
+    // footgun — fixing that is a follow-up.
+    let registrarPlan = null;
+    if (dnsProvider === "inwx") {
+        if (!dnsConfig?.username || !dnsConfig.password) {
+            throw new Error("INWX is configured as the DNS provider but credentials are missing. Re-run `hatchkit config add dns`.");
+        }
+        env.TF_VAR_inwx_username = dnsConfig.username;
+        env.TF_VAR_inwx_password = dnsConfig.password;
+    }
+    else if (dnsProvider === "cloudflare") {
+        if (!dnsConfig?.apiToken) {
+            throw new Error("Cloudflare is configured as the DNS provider but the API token is missing from the keychain.");
+        }
+        env.TF_VAR_cloudflare_api_token = dnsConfig.apiToken;
+        // dns-only-cloudflare doesn't ask for INWX creds at all. The
+        // node-realtime path still does (legacy footgun) — we mirror the
+        // old behavior there until that stack is split too.
+        if (config.deployTarget === "new") {
+            if (dnsConfig.registrarUsername && dnsConfig.registrarPassword) {
+                env.TF_VAR_inwx_username = dnsConfig.registrarUsername;
+                env.TF_VAR_inwx_password = dnsConfig.registrarPassword;
+            }
+        }
+        else {
+            // dns-only-cloudflare: figure out whether a registrar NS-flip is
+            // even needed *before* terraform runs, and prompt for INWX creds
+            // inline if it is. We only block on a working answer here so that
+            // the post-apply step has what it needs (or knows to skip).
+            registrarPlan = await preflightRegistrarFlip(config.baseDomain, dnsConfig);
         }
     }
     if (config.features.includes("s3") &&
@@ -43,7 +72,6 @@ export async function runTerraform(config, repoRoot) {
             env.TF_VAR_s3_secret_key = s3.secretKey;
         }
     }
-    console.log(chalk.bold("\n  ── Terraform ──────────────────────────────────────────────\n"));
     // Init
     const initResult = await exec("terraform", ["init"], {
         cwd: stackDir,
@@ -66,24 +94,136 @@ export async function runTerraform(config, repoRoot) {
         throw new Error("Terraform apply failed");
     }
     console.log(chalk.green("\n  ✓ Terraform apply complete"));
-    // Post-apply: if we just deployed to Cloudflare but the domain is
-    // still registered at INWX, update INWX's delegated NS to point at
-    // Cloudflare. This is the "auto-wire" step that would otherwise
-    // require clicking through the INWX web UI for every domain.
-    if (dnsConfig?.provider === "cloudflare" &&
-        dnsConfig.registrarUsername &&
+    // Post-apply: NS-flip if dns-only-cloudflare path decided one was
+    // needed and we now have creds. Both decisions live in registrarPlan
+    // so this code doesn't re-derive intent.
+    if (registrarPlan?.action === "flip") {
+        await updateInwxNameserversFromTfOutput(stackDir, env, {
+            username: registrarPlan.registrarUsername,
+            password: registrarPlan.registrarPassword,
+        });
+    }
+    else if (registrarPlan?.action === "skip") {
+        console.log(chalk.dim(`  (registrar NS-flip skipped — ${registrarPlan.reason})`));
+    }
+    else if (config.deployTarget === "new" &&
+        dnsProvider === "cloudflare" &&
+        dnsConfig?.registrarUsername &&
         dnsConfig.registrarPassword) {
-        await updateInwxNameserversFromTfOutput(stackDir, env, dnsConfig);
+        // Legacy node-realtime path — preserve the original behavior.
+        await updateInwxNameserversFromTfOutput(stackDir, env, {
+            username: dnsConfig.registrarUsername,
+            password: dnsConfig.registrarPassword,
+        });
     }
+    return { applied: { stackDir, tfvarsPath: tfvarsFile } };
+}
+/**
+ * Decide whether the registrar NS-flip is worth doing for this deploy:
+ *
+ *   1. Look the domain up in Cloudflare → its assigned name_servers.
+ *   2. Resolve the current public NS for the domain.
+ *   3. If they already match → skip (NS already pointed at Cloudflare).
+ *   4. If they don't match → a flip is needed. Use saved INWX registrar
+ *      creds if present; otherwise prompt for them inline (with an
+ *      "I'll do it manually" escape hatch).
+ *
+ * Returns a plan describing what post-apply should do. Network errors
+ * during the lookup (CF API down, no internet) degrade gracefully into
+ * "skip" with a note — the user can re-run `hatchkit dns
+ * link-to-cloudflare` later.
+ */
+async function preflightRegistrarFlip(domain, dnsConfig) {
+    console.log(chalk.dim("\n  Checking whether the registrar NS-flip is needed..."));
+    // Strip subdomain — registrar delegation is at the apex.
+    const apex = apexDomain(domain);
+    let expectedNs;
+    try {
+        if (!dnsConfig.apiToken) {
+            return { action: "skip", reason: "no Cloudflare token to look up zone" };
+        }
+        const cf = new CloudflareApi({ token: dnsConfig.apiToken, accountId: dnsConfig.accountId });
+        const zone = await cf.getZoneByName(apex);
+        if (!zone) {
+            return {
+                action: "skip",
+                reason: `${apex} isn't in your Cloudflare account yet — add the zone, then re-run`,
+            };
+        }
+        expectedNs = zone.name_servers.map((n) => n.toLowerCase()).sort();
+    }
+    catch (err) {
+        return { action: "skip", reason: `Cloudflare lookup failed: ${err.message}` };
+    }
+    let currentNs;
+    try {
+        const ns = await dnsPromises.resolveNs(apex);
+        currentNs = ns.map((n) => n.toLowerCase()).sort();
+    }
+    catch {
+        // ENOTFOUND on a brand-new domain just means "no NS yet" — we
+        // definitely need the flip.
+        currentNs = [];
+    }
+    const same = currentNs.length === expectedNs.length && currentNs.every((n, i) => n === expectedNs[i]);
+    if (same) {
+        return { action: "skip", reason: "NS already point at Cloudflare" };
+    }
+    console.log(chalk.dim(`    expected NS: ${expectedNs.join(", ")}`));
+    console.log(chalk.dim(`    current NS:  ${currentNs.length ? currentNs.join(", ") : "(none)"}`));
+    // Need a flip. Try saved creds first.
+    if (dnsConfig.registrarUsername && dnsConfig.registrarPassword) {
+        return {
+            action: "flip",
+            registrarUsername: dnsConfig.registrarUsername,
+            registrarPassword: dnsConfig.registrarPassword,
+        };
+    }
+    // No saved creds — ask inline.
+    console.log(chalk.yellow(`\n  ${apex} needs its registrar NS pointed at Cloudflare, but INWX registrar creds aren't configured.`));
+    const choice = await select({
+        message: "How would you like to proceed?",
+        choices: [
+            {
+                name: "Provide INWX registrar credentials now (saved to keychain for reuse)",
+                value: "provide",
+            },
+            {
+                name: "Skip — I'll point NS at Cloudflare manually (or my registrar isn't INWX)",
+                value: "skip",
+            },
+        ],
+    });
+    if (choice === "skip") {
+        return { action: "skip", reason: "user opted to flip NS manually" };
+    }
+    const creds = await promptAndSaveInwxRegistrarCreds();
+    return {
+        action: "flip",
+        registrarUsername: creds.username,
+        registrarPassword: creds.password,
+    };
+}
+/** "ai.example.com" → "example.com". TLDs with second-level domains
+ *  (".co.uk") aren't auto-detected — registrar lookups only happen on
+ *  the apex anyway, so we just take the last two labels. Good enough
+ *  for >99% of cases; users with country-code 2LDs can pre-configure
+ *  registrar creds. */
+function apexDomain(domain) {
+    const parts = domain.split(".");
+    if (parts.length <= 2)
+        return domain;
+    return parts.slice(-2).join(".");
 }
 /**
  * Read the stack's dns_provider + dns_domain + dns_nameservers outputs
  * and push them to INWX as the new delegated NS for that domain. No-op
- * if the stack didn't actually apply a Cloudflare zone (e.g. user kept
- * dns_provider = "inwx" in tfvars even though their CLI config says
- * Cloudflare).
+ * if the stack didn't actually apply a Cloudflare zone (e.g. legacy
+ * node-realtime stack with dns_provider = "inwx" in tfvars). Caller is
+ * responsible for the decision to call this — the registrar plan in
+ * `runTerraform` handles preflight + creds.
  */
-async function updateInwxNameserversFromTfOutput(stackDir, env, dnsConfig) {
+async function updateInwxNameserversFromTfOutput(stackDir, env, registrarCreds) {
     const out = await exec("terraform", ["output", "-json"], {
         cwd: stackDir,
         env,
@@ -116,14 +256,9 @@ async function updateInwxNameserversFromTfOutput(stackDir, env, dnsConfig) {
     console.log(chalk.bold("\n  ── INWX registrar: pointing NS at Cloudflare ────────────\n"));
     console.log(chalk.dim(`  Domain:  ${domain}`));
     console.log(chalk.dim(`  New NS:  ${nameservers.join(", ")}`));
-    // registrarUsername/Password presence is guaranteed by the caller's
-    // guard — assert here to keep the types clean.
-    if (!dnsConfig.registrarUsername || !dnsConfig.registrarPassword) {
-        return;
-    }
     const inwx = new InwxApi({
-        username: dnsConfig.registrarUsername,
-        password: dnsConfig.registrarPassword,
+        username: registrarCreds.username,
+        password: registrarCreds.password,
         sandbox: process.env.INWX_SANDBOX === "1",
     });
     try {

package/dist/deploy/terraform.js.map

@@ -1 +1 @@
-{"version":3,"file":"terraform.js","sourceRoot":"","sources":["../../src/deploy/terraform.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAkB,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE1F,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAE/C,qCAAqC;AACrC,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAqB,EAAE,QAAgB;IACxE,MAAM,YAAY,GAAG,MAAM,eAAe,EAAE,CAAC;IAC7C,MAAM,SAAS,GAAG,MAAM,YAAY,EAAE,CAAC;IAEvC,MAAM,QAAQ,GACZ,MAAM,CAAC,YAAY,KAAK,KAAK;QAC3B,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,eAAe,CAAC;QACxD,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IAExD,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,IAAI,SAAS,CAAC,CAAC;IAE3D,+BAA+B;IAC/B,MAAM,GAAG,GAA2B,EAAE,CAAC;IAEvC,IAAI,YAAY,EAAE,CAAC;QACjB,GAAG,CAAC,mBAAmB,GAAG,YAAY,CAAC;IACzC,CAAC;IAED,mEAAmE;IACnE,uEAAuE;IACvE,mEAAmE;IACnE,oEAAoE;IACpE,+DAA+D;IAC/D,uEAAuE;IACvE,oBAAoB;IACpB,IAAI,SAAS,EAAE,QAAQ,KAAK,MAAM,EAAE,CAAC;QACnC,GAAG,CAAC,oBAAoB,GAAG,SAAS,CAAC,QAAQ,IAAI,EAAE,CAAC;QACpD,GAAG,CAAC,oBAAoB,GAAG,SAAS,CAAC,QAAQ,IAAI,EAAE,CAAC;IACtD,CAAC;SAAM,IAAI,SAAS,EAAE,QAAQ,KAAK,YAAY,EAAE,CAAC;QAChD,GAAG,CAAC,2BAA2B,GAAG,SAAS,CAAC,QAAQ,IAAI,EAAE,CAAC;QAC3D,IAAI,SAAS,CAAC,iBAAiB,IAAI,SAAS,CAAC,iBAAiB,EAAE,CAAC;YAC/D,GAAG,CAAC,oBAAoB,GAAG,SAAS,CAAC,iBAAiB,CAAC;YACvD,GAAG,CAAC,oBAAoB,GAAG,SAAS,CAAC,iBAAiB,CAAC;QACzD,CAAC;IACH,CAAC;IAED,IACE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC9B,MAAM,CAAC,UAAU,KAAK,UAAU;QAChC,MAAM,CAAC,UAAU,KAAK,MAAM,EAC5B,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,EAAE,EAAE,CAAC;YACP,GAAG,CAAC,oBAAoB,GAAG,EAAE,CAAC,SAAS,CAAC;YACxC,GAAG,CAAC,oBAAoB,GAAG,EAAE,CAAC,SAAS,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC,CAAC;IAE7F,OAAO;IACP,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE;QACnD,GAAG,EAAE,QAAQ;QACb,GAAG;QACH,OAAO,EAAE,2BAA2B;KACrC,CAAC,CAAC;IACH,IAAI,UAAU,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO;IACP,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,MAAM,UAAU,CACnC,WAAW,EACX,CAAC,MAAM,EAAE,aAAa,UAAU,EAAE,EAAE,aAAa,CAAC,EAClD,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,CACvB,CAAC;IACF,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IAED,QAAQ;IACR,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,MAAM,aAAa,GAAG,MAAM,UAAU,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;IACjG,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;IAE3D,kEAAkE;IAClE,mEAAmE;IACnE,gEAAgE;IAChE,6DAA6D;IAC7D,IACE,SAAS,EAAE,QAAQ,KAAK,YAAY;QACpC,SAAS,CAAC,iBAAiB;QAC3B,SAAS,CAAC,iBAAiB,EAC3B,CAAC;QACD,MAAM,iCAAiC,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,iCAAiC,CAC9C,QAAgB,EAChB,GAA2B,EAC3B,SAAoB;IAEpB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE;QACvD,GAAG,EAAE,QAAQ;QACb,GAAG;QACH,MAAM,EAAE,IAAI;KACb,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,gEAAgE,CAAC,CAAC,CAAC;QAC5F,OAAO;IACT,CAAC;IAGD,IAAI,MAIH,CAAC;IACF,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CAAC,yEAAyE,CAAC,CACxF,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC;IACnD,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC;IACxC,MAAM,WAAW,GAAG,MAAM,CAAC,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC;IAExD,IAAI,eAAe,KAAK,YAAY,EAAE,CAAC;QACrC,qEAAqE;QACrE,qEAAqE;QACrE,OAAO;IACT,CAAC;IAED,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxC,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CAAC,6EAA6E,CAAC,CAC5F,CAAC;QACF,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC,CAAC;IAC3F,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,MAAM,EAAE,CAAC,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAE/D,oEAAoE;IACpE,+CAA+C;IAC/C,IAAI,CAAC,SAAS,CAAC,iBAAiB,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC;QACjE,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC;QACvB,QAAQ,EAAE,SAAS,CAAC,iBAAiB;QACrC,QAAQ,EAAE,SAAS,CAAC,iBAAiB;QACrC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,GAAG;KAC1C,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,KAAK,CACT,aAAa,MAAM,qBAAqB,WAAW,CAAC,MAAM,yBAAyB,CACpF,CACF,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC,CAAC;IAChF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,oEAAoE;QACpE,qEAAqE;QACrE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,8BAA+B,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACpF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,mDAAmD,MAAM,EAAE,CAAC,CAAC,CAAC;IACtF,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACtC,CAAC;AACH,CAAC"}
+{"version":3,"file":"terraform.js","sourceRoot":"","sources":["../../src/deploy/terraform.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,WAAW,EAAE,MAAM,UAAU,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAEL,YAAY,EACZ,eAAe,EACf,WAAW,EACX,+BAA+B,GAChC,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAoB/C,qCAAqC;AACrC,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAqB,EACrB,QAAgB;IAEhB,MAAM,YAAY,GAAG,MAAM,eAAe,EAAE,CAAC;IAC7C,MAAM,SAAS,GAAG,MAAM,YAAY,EAAE,CAAC;IACvC,MAAM,WAAW,GAAG,CAAC,SAAS,EAAE,QAAQ,IAAI,MAAM,CAAqC,CAAC;IAExF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC,CAAC;IAE7F,iEAAiE;IACjE,IAAI,MAAM,CAAC,YAAY,KAAK,UAAU,IAAI,WAAW,KAAK,QAAQ,EAAE,CAAC;QACnE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC,CAAC;QAChG,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IAC7E,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC,CAAC;QACpE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,UAAU,GAAG,GAAG,QAAQ,IAAI,MAAM,CAAC,IAAI,SAAS,CAAC;IAEvD,mEAAmE;IACnE,MAAM,GAAG,GAA2B,EAAE,CAAC;IAEvC,IAAI,YAAY,EAAE,CAAC;QACjB,GAAG,CAAC,mBAAmB,GAAG,YAAY,CAAC;IACzC,CAAC;IAED,qEAAqE;IACrE,kEAAkE;IAClE,gEAAgE;IAChE,oEAAoE;IACpE,wCAAwC;IACxC,IAAI,aAAa,GAAyB,IAAI,CAAC;IAC/C,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,SAAS,EAAE,QAAQ,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,uGAAuG,CACxG,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,oBAAoB,GAAG,SAAS,CAAC,QAAQ,CAAC;QAC9C,GAAG,CAAC,oBAAoB,GAAG,SAAS,CAAC,QAAQ,CAAC;IAChD,CAAC;SAAM,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;QACxC,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,8FAA8F,CAC/F,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,2BAA2B,GAAG,SAAS,CAAC,QAAQ,CAAC;QAErD,6DAA6D;QAC7D,iEAAiE;QACjE,oDAAoD;QACpD,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;YAClC,IAAI,SAAS,CAAC,iBAAiB,IAAI,SAAS,CAAC,iBAAiB,EAAE,CAAC;gBAC/D,GAAG,CAAC,oBAAoB,GAAG,SAAS,CAAC,iBAAiB,CAAC;gBACvD,GAAG,CAAC,oBAAoB,GAAG,SAAS,CAAC,iBAAiB,CAAC;YACzD,CAAC;QACH,CAAC;aAAM,CAAC;YACN,iEAAiE;YACjE,iEAAiE;YACjE,kEAAkE;YAClE,4DAA4D;YAC5D,aAAa,GAAG,MAAM,sBAAsB,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED,IACE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC9B,MAAM,CAAC,UAAU,KAAK,UAAU;QAChC,MAAM,CAAC,UAAU,KAAK,MAAM,EAC5B,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,EAAE,EAAE,CAAC;YACP,GAAG,CAAC,oBAAoB,GAAG,EAAE,CAAC,SAAS,CAAC;YACxC,GAAG,CAAC,oBAAoB,GAAG,EAAE,CAAC,SAAS,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,OAAO;IACP,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE;QACnD,GAAG,EAAE,QAAQ;QACb,GAAG;QACH,OAAO,EAAE,2BAA2B;KACrC,CAAC,CAAC;IACH,IAAI,UAAU,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO;IACP,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,MAAM,UAAU,CACnC,WAAW,EACX,CAAC,MAAM,EAAE,aAAa,UAAU,EAAE,EAAE,aAAa,CAAC,EAClD,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,CACvB,CAAC;IACF,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IAED,QAAQ;IACR,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,MAAM,aAAa,GAAG,MAAM,UAAU,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;IACjG,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;IAE3D,kEAAkE;IAClE,qEAAqE;IACrE,yCAAyC;IACzC,IAAI,aAAa,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;QACrC,MAAM,iCAAiC,CAAC,QAAQ,EAAE,GAAG,EAAE;YACrD,QAAQ,EAAE,aAAa,CAAC,iBAAiB;YACzC,QAAQ,EAAE,aAAa,CAAC,iBAAiB;SAC1C,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,aAAa,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,kCAAkC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACpF,CAAC;SAAM,IACL,MAAM,CAAC,YAAY,KAAK,KAAK;QAC7B,WAAW,KAAK,YAAY;QAC5B,SAAS,EAAE,iBAAiB;QAC5B,SAAS,CAAC,iBAAiB,EAC3B,CAAC;QACD,8DAA8D;QAC9D,MAAM,iCAAiC,CAAC,QAAQ,EAAE,GAAG,EAAE;YACrD,QAAQ,EAAE,SAAS,CAAC,iBAAiB;YACrC,QAAQ,EAAE,SAAS,CAAC,iBAAiB;SACtC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,sBAAsB,CACnC,MAAc,EACd,SAAoB;IAEpB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC,CAAC;IAElF,yDAAyD;IACzD,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAEhC,IAAI,UAAoB,CAAC;IACzB,IAAI,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;YACxB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;QAC3E,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,aAAa,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC;QAC5F,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,GAAG,IAAI,mEAAmE;aACnF,CAAC;QACJ,CAAC;QACD,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,6BAA8B,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IAC3F,CAAC;IAED,IAAI,SAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7C,SAAS,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;QAC9D,4BAA4B;QAC5B,SAAS,GAAG,EAAE,CAAC;IACjB,CAAC;IAED,MAAM,IAAI,GACR,SAAS,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IACtE,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,oBAAoB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACpE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,oBAAoB,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAEjG,sCAAsC;IACtC,IAAI,SAAS,CAAC,iBAAiB,IAAI,SAAS,CAAC,iBAAiB,EAAE,CAAC;QAC/D,OAAO;YACL,MAAM,EAAE,MAAM;YACd,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;YAC9C,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;SAC/C,CAAC;IACJ,CAAC;IAED,+BAA+B;IAC/B,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CACV,OAAO,IAAI,4FAA4F,CACxG,CACF,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAqB;QAC9C,OAAO,EAAE,gCAAgC;QACzC,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,sEAAsE;gBAC5E,KAAK,EAAE,SAAS;aACjB;YACD;gBACE,IAAI,EAAE,0EAA0E;gBAChF,KAAK,EAAE,MAAM;aACd;SACF;KACF,CAAC,CAAC;IAEH,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IACtE,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,+BAA+B,EAAE,CAAC;IACtD,OAAO;QACL,MAAM,EAAE,MAAM;QACd,iBAAiB,EAAE,KAAK,CAAC,QAAQ;QACjC,iBAAiB,EAAE,KAAK,CAAC,QAAQ;KAClC,CAAC;AACJ,CAAC;AAED;;;;uBAIuB;AACvB,SAAS,UAAU,CAAC,MAAc;IAChC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IACrC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,iCAAiC,CAC9C,QAAgB,EAChB,GAA2B,EAC3B,cAAsD;IAEtD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE;QACvD,GAAG,EAAE,QAAQ;QACb,GAAG;QACH,MAAM,EAAE,IAAI;KACb,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,gEAAgE,CAAC,CAAC,CAAC;QAC5F,OAAO;IACT,CAAC;IAGD,IAAI,MAIH,CAAC;IACF,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CAAC,yEAAyE,CAAC,CACxF,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC;IACnD,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC;IACxC,MAAM,WAAW,GAAG,MAAM,CAAC,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC;IAExD,IAAI,eAAe,KAAK,YAAY,EAAE,CAAC;QACrC,qEAAqE;QACrE,qEAAqE;QACrE,OAAO;IACT,CAAC;IAED,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxC,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CAAC,6EAA6E,CAAC,CAC5F,CAAC;QACF,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC,CAAC;IAC3F,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,MAAM,EAAE,CAAC,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAE/D,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC;QACvB,QAAQ,EAAE,cAAc,CAAC,QAAQ;QACjC,QAAQ,EAAE,cAAc,CAAC,QAAQ;QACjC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,GAAG;KAC1C,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,KAAK,CACT,aAAa,MAAM,qBAAqB,WAAW,CAAC,MAAM,yBAAyB,CACpF,CACF,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC,CAAC;IAChF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,oEAAoE;QACpE,qEAAqE;QACrE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,8BAA+B,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACpF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,mDAAmD,MAAM,EAAE,CAAC,CAAC,CAAC;IACtF,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACtC,CAAC;AACH,CAAC"}

package/dist/doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAsBA,UAAU,WAAW;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAkVD,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAYnE;AAED,wBAAsB,SAAS,CAAC,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CA8C5E"}
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAsBA,UAAU,WAAW;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AA6WD,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAanE;AAED,wBAAsB,SAAS,CAAC,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CA8C5E"}