indraq_cli 1.9.1 → 2.0.0

package/dist/modules/users/providers/jenkins-user.provider.d.ts

@@ -1,6 +1,13 @@
-export declare const buildJenkinsUserScript: (operation: "create" | "update" | "delete", username: string, password?: string, roles?: string[]) => string;
-export declare const createJenkinsUser: (username: string, password: string, roles: string[]) => Promise<void>;
-export declare const updateJenkinsUser: (username: string, password: string | undefined, roles: string[]) => Promise<void>;
+import type { IndraQRole } from '../../cloud/services/cloud-aws.service';
+export declare const buildJenkinsUserScript: (operation: "create" | "update" | "delete", username: string, password?: string, roles?: string[], indraqRole?: IndraQRole) => string;
+export type ManagedJenkinsProvider = 'jenkins-dev' | 'jenkins-prod';
+export declare const configuredManagedJenkinsProviders: () => Promise<ManagedJenkinsProvider[]>;
+export declare const createJenkinsUserForProvider: (provider: ManagedJenkinsProvider, username: string, password: string, indraqRole: IndraQRole, roles: string[]) => Promise<"created" | "reconciled">;
+export declare const createJenkinsUser: (username: string, password: string, indraqRole: IndraQRole, roles: string[]) => Promise<void>;
+export declare const updateJenkinsUserForProvider: (provider: ManagedJenkinsProvider, username: string, password: string | undefined, indraqRole: IndraQRole | undefined, roles: string[]) => Promise<void>;
+export declare const updateJenkinsUser: (username: string, password: string | undefined, indraqRole: IndraQRole | undefined, roles: string[]) => Promise<void>;
+export declare const deleteJenkinsUserForProvider: (provider: ManagedJenkinsProvider, username: string) => Promise<"deleted" | "already-absent">;
 export declare const deleteJenkinsUser: (username: string) => Promise<void>;
-export declare const preflightJenkinsUserManagement: (roles?: string[]) => Promise<void>;
+export declare const preflightJenkinsUserManagementForProvider: (provider: ManagedJenkinsProvider, roles?: string[]) => Promise<void>;
+export declare const preflightJenkinsUserManagement: (roles?: string[]) => Promise<ManagedJenkinsProvider[]>;
 //# sourceMappingURL=jenkins-user.provider.d.ts.map

package/dist/modules/users/providers/jenkins-user.provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jenkins-user.provider.d.ts","sourceRoot":"","sources":["../../../../src/modules/users/providers/jenkins-user.provider.ts"],"names":[],"mappings":"AAqCA,eAAO,MAAM,sBAAsB,GAAI,WAAW,QAAQ,GAAG,QAAQ,GAAG,QAAQ,EAAE,UAAU,MAAM,EAAE,WAAW,MAAM,EAAE,QAAO,MAAM,EAAO,KAAG,MA+B7I,CAAC;AAQF,eAAO,MAAM,iBAAiB,GAAU,UAAU,MAAM,EAAE,UAAU,MAAM,EAAE,OAAO,MAAM,EAAE,KAAG,OAAO,CAAC,IAAI,CAAsH,CAAC;AACjO,eAAO,MAAM,iBAAiB,GAAU,UAAU,MAAM,EAAE,UAAU,MAAM,GAAG,SAAS,EAAE,OAAO,MAAM,EAAE,KAAG,OAAO,CAAC,IAAI,CAAsH,CAAC;AAC7O,eAAO,MAAM,iBAAiB,GAAU,UAAU,MAAM,KAAG,OAAO,CAAC,IAAI,CAAqG,CAAC;AAE7K,eAAO,MAAM,8BAA8B,GAAU,QAAO,MAAM,EAAO,KAAG,OAAO,CAAC,IAAI,CAWvF,CAAC"}
+{"version":3,"file":"jenkins-user.provider.d.ts","sourceRoot":"","sources":["../../../../src/modules/users/providers/jenkins-user.provider.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AA0EzE,eAAO,MAAM,sBAAsB,GACjC,WAAW,QAAQ,GAAG,QAAQ,GAAG,QAAQ,EACzC,UAAU,MAAM,EAChB,WAAW,MAAM,EACjB,QAAO,MAAM,EAAO,EACpB,aAAa,UAAU,KACtB,MAkDF,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,aAAa,GAAG,cAAc,CAAC;AAEpE,eAAO,MAAM,iCAAiC,QAAa,OAAO,CAAC,sBAAsB,EAAE,CAK1F,CAAC;AAYF,eAAO,MAAM,4BAA4B,GACvC,UAAU,sBAAsB,EAChC,UAAU,MAAM,EAChB,UAAU,MAAM,EAChB,YAAY,UAAU,EACtB,OAAO,MAAM,EAAE,KACd,OAAO,CAAC,SAAS,GAAG,YAAY,CAKlC,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAU,UAAU,MAAM,EAAE,UAAU,MAAM,EAAE,YAAY,UAAU,EAAE,OAAO,MAAM,EAAE,KAAG,OAAO,CAAC,IAAI,CAEjI,CAAC;AACF,eAAO,MAAM,4BAA4B,GAAU,UAAU,sBAAsB,EAAE,UAAU,MAAM,EAAE,UAAU,MAAM,GAAG,SAAS,EAAE,YAAY,UAAU,GAAG,SAAS,EAAE,OAAO,MAAM,EAAE,KAAG,OAAO,CAAC,IAAI,CAEtM,CAAC;AACF,eAAO,MAAM,iBAAiB,GAAU,UAAU,MAAM,EAAE,UAAU,MAAM,GAAG,SAAS,EAAE,YAAY,UAAU,GAAG,SAAS,EAAE,OAAO,MAAM,EAAE,KAAG,OAAO,CAAC,IAAI,CAEzJ,CAAC;AACF,eAAO,MAAM,4BAA4B,GAAU,UAAU,sBAAsB,EAAE,UAAU,MAAM,KAAG,OAAO,CAAC,SAAS,GAAG,gBAAgB,CAG3I,CAAC;AACF,eAAO,MAAM,iBAAiB,GAAU,UAAU,MAAM,KAAG,OAAO,CAAC,IAAI,CAEtE,CAAC;AAaF,eAAO,MAAM,yCAAyC,GAAU,UAAU,sBAAsB,EAAE,QAAO,MAAM,EAAO,KAAG,OAAO,CAAC,IAAI,CAUpI,CAAC;AAEF,eAAO,MAAM,8BAA8B,GAAU,QAAO,MAAM,EAAO,KAAG,OAAO,CAAC,sBAAsB,EAAE,CAK3G,CAAC"}

package/dist/modules/users/providers/jenkins-user.provider.js

@@ -1,97 +1,199 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.preflightJenkinsUserManagement = exports.deleteJenkinsUser = exports.updateJenkinsUser = exports.createJenkinsUser = exports.buildJenkinsUserScript = void 0;
+exports.preflightJenkinsUserManagement = exports.preflightJenkinsUserManagementForProvider = exports.deleteJenkinsUser = exports.deleteJenkinsUserForProvider = exports.updateJenkinsUser = exports.updateJenkinsUserForProvider = exports.createJenkinsUser = exports.createJenkinsUserForProvider = exports.configuredManagedJenkinsProviders = exports.buildJenkinsUserScript = void 0;
 const cloud_jenkins_service_1 = require("../../cloud/services/cloud-jenkins.service");
 const user_provider_service_1 = require("../../cloud/services/user-provider.service");
 const literal = (value) => JSON.stringify(value);
 const hash = (value) => Math.abs([...value].reduce((total, char) => ((total * 31) + char.charCodeAt(0)) | 0, 0));
-const imports = `import hudson.security.HudsonPrivateSecurityRealm
-import com.michelin.cio.hudson.plugins.rolestrategy.AuthorizationType
-import com.michelin.cio.hudson.plugins.rolestrategy.PermissionEntry
-import com.michelin.cio.hudson.plugins.rolestrategy.RoleBasedAuthorizationStrategy
-import com.michelin.cio.hudson.plugins.rolestrategy.Role
-import com.synopsys.arc.jenkins.plugins.rolestrategy.RoleType
-import hudson.model.Item
-import hudson.security.Permission
+const imports = `import hudson.security.HudsonPrivateSecurityRealm
+import com.michelin.cio.hudson.plugins.rolestrategy.AuthorizationType
+import com.michelin.cio.hudson.plugins.rolestrategy.PermissionEntry
+import com.michelin.cio.hudson.plugins.rolestrategy.RoleBasedAuthorizationStrategy
+import com.michelin.cio.hudson.plugins.rolestrategy.Role
+import com.synopsys.arc.jenkins.plugins.rolestrategy.RoleType
+import hudson.model.Item
+import hudson.security.Permission
 import jenkins.model.Jenkins`;
-const seedRole = (username) => `
-def strategy = Jenkins.get().authorizationStrategy
-if (!(strategy instanceof RoleBasedAuthorizationStrategy)) throw new IllegalStateException('Role Strategy plugin must be the active Jenkins authorization strategy')
-def itemMap = strategy.getRoleMap(RoleType.Project)
-def seedRole = itemMap.getRole('indraq-create-deployment')
-if (seedRole == null) {
-  Set<Permission> seedPermissions = new HashSet<Permission>()
-  seedPermissions.add(Item.DISCOVER)
-  seedPermissions.add(Item.READ)
-  seedPermissions.add(Item.BUILD)
-  seedPermissions.add(Item.CANCEL)
-  seedRole = new Role('indraq-create-deployment', '^CREATE-DEPLOYMENT$', seedPermissions)
-  itemMap.addRole(seedRole)
-}
-itemMap.assignRole(seedRole, new PermissionEntry(AuthorizationType.USER, ${literal(username)}))
+const clearManagedProjectRoles = (username) => `
+def managedPrincipal = new PermissionEntry(AuthorizationType.USER, ${literal(username)})
+def managedProjectMap = Jenkins.get().authorizationStrategy instanceof RoleBasedAuthorizationStrategy
+  ? Jenkins.get().authorizationStrategy.getRoleMap(RoleType.Project)
+  : null
+if (managedProjectMap != null) {
+  managedProjectMap.getRoles().keySet().toList().findAll { it.name.startsWith('indraq-') }.each { existingRole ->
+    managedProjectMap.unAssignRole(existingRole, managedPrincipal)
+  }
+  Jenkins.get().save()
+}`;
+const seedRole = (username) => `
+def strategy = Jenkins.get().authorizationStrategy
+if (!(strategy instanceof RoleBasedAuthorizationStrategy)) throw new IllegalStateException('Role Strategy plugin must be the active Jenkins authorization strategy')
+def itemMap = strategy.getRoleMap(RoleType.Project)
+def seedRole = itemMap.getRole('indraq-create-deployment')
+if (seedRole == null) {
+  Set<Permission> seedPermissions = new HashSet<Permission>()
+  seedPermissions.add(Item.DISCOVER)
+  seedPermissions.add(Item.READ)
+  seedPermissions.add(Item.BUILD)
+  seedPermissions.add(Item.CANCEL)
+  seedRole = new Role('indraq-create-deployment', '^CREATE-DEPLOYMENT$', seedPermissions)
+  itemMap.addRole(seedRole)
+}
+itemMap.assignRole(seedRole, new PermissionEntry(AuthorizationType.USER, ${literal(username)}))
 Jenkins.get().save()`;
-const globalRoleBody = (username, roles) => roles.length ? `${roles.map((role) => `def role_${hash(role)} = strategy.getRoleMap(RoleType.Global).getRole(${literal(role)})
-if (role_${hash(role)} == null) throw new IllegalArgumentException('Unknown Jenkins global role: ' + ${literal(role)})
-strategy.getRoleMap(RoleType.Global).assignRole(role_${hash(role)}, new PermissionEntry(AuthorizationType.USER, ${literal(username)}))`).join('\n')}
+const additionalGlobalRolesBody = (username, roles) => roles.length ? `${roles.map((role) => `def role_${hash(role)} = strategy.getRoleMap(RoleType.Global).getRole(${literal(role)})
+if (role_${hash(role)} == null) throw new IllegalArgumentException('Unknown Jenkins global role: ' + ${literal(role)})
+strategy.getRoleMap(RoleType.Global).assignRole(role_${hash(role)}, new PermissionEntry(AuthorizationType.USER, ${literal(username)}))`).join('\n')}
 Jenkins.get().save()` : '';
-const buildJenkinsUserScript = (operation, username, password, roles = []) => {
+const managedGlobalRoleBody = (username, role, extraRoles) => {
+    const managedRole = `indraq-${role}`;
+    const permissions = role === 'user'
+        ? `managedPermissions.add(Jenkins.READ)`
+        : `managedPermissions.add(Jenkins.ADMINISTER)`;
+    return `def strategy = Jenkins.get().authorizationStrategy
+if (!(strategy instanceof RoleBasedAuthorizationStrategy)) throw new IllegalStateException('Role Strategy plugin is required for Jenkins role synchronization')
+def globalMap = strategy.getRoleMap(RoleType.Global)
+def principal = new PermissionEntry(AuthorizationType.USER, ${literal(username)})
+// The unified IndraQ role is authoritative. Remove stale global roles first so
+// a demoted manager/admin cannot keep an older elevated Jenkins assignment.
+globalMap.getRoles().keySet().toList().each { existingRole -> globalMap.unAssignRole(existingRole, principal) }
+def managedRole = globalMap.getRole(${literal(managedRole)})
+if (managedRole == null) {
+  Set<Permission> managedPermissions = new HashSet<Permission>()
+  ${permissions}
+  managedRole = new Role(${literal(managedRole)}, '.*', managedPermissions)
+  globalMap.addRole(managedRole)
+}
+globalMap.assignRole(managedRole, principal)
+${extraRoles.map((extra) => `def extra_${hash(extra)} = globalMap.getRole(${literal(extra)})
+if (extra_${hash(extra)} == null) throw new IllegalArgumentException('Unknown Jenkins global role: ' + ${literal(extra)})
+globalMap.assignRole(extra_${hash(extra)}, principal)`).join('\n')}
+Jenkins.get().save()`;
+};
+const buildJenkinsUserScript = (operation, username, password, roles = [], indraqRole) => {
     if (operation === 'delete')
-        return `${imports}
-def user = hudson.model.User.getById(${literal(username)}, false)
-if (user == null) throw new IllegalStateException('Jenkins user not found')
-def strategy = Jenkins.get().authorizationStrategy
-if (strategy instanceof RoleBasedAuthorizationStrategy) {
-  def itemMap = strategy.getRoleMap(RoleType.Project)
-  def seed = itemMap.getRole('indraq-create-deployment')
-  if (seed != null) itemMap.unAssignRole(seed, new PermissionEntry(AuthorizationType.USER, ${literal(username)}))
-  Jenkins.get().save()
-}
-user.delete()
+        return `${imports}
+def user = hudson.model.User.getById(${literal(username)}, false)
+if (user == null) { println 'already-absent'; return }
+def strategy = Jenkins.get().authorizationStrategy
+if (strategy instanceof RoleBasedAuthorizationStrategy) {
+  def principal = new PermissionEntry(AuthorizationType.USER, ${literal(username)})
+  [RoleType.Global, RoleType.Project].each { roleType ->
+    def roleMap = strategy.getRoleMap(roleType)
+    roleMap.getRoles().keySet().toList().each { role -> roleMap.unAssignRole(role, principal) }
+  }
+  Jenkins.get().save()
+}
+user.delete()
 println 'deleted'`;
-    const roleSetup = roles.length ? `def strategy = Jenkins.get().authorizationStrategy
-if (!(strategy instanceof RoleBasedAuthorizationStrategy)) throw new IllegalStateException('Role Strategy plugin is required for Jenkins role assignment')
-${globalRoleBody(username, roles)}` : '';
+    const roleSetup = indraqRole
+        ? managedGlobalRoleBody(username, indraqRole, roles)
+        : roles.length
+            ? `def strategy = Jenkins.get().authorizationStrategy
+if (!(strategy instanceof RoleBasedAuthorizationStrategy)) throw new IllegalStateException('Role Strategy plugin is required for Jenkins role assignment')
+${additionalGlobalRolesBody(username, roles)}`
+            : '';
     if (operation === 'create')
-        return `${imports}
-def realm = Jenkins.get().securityRealm
-if (!(realm instanceof HudsonPrivateSecurityRealm)) throw new IllegalStateException('Jenkins must use its private security realm to create users')
-if (hudson.model.User.getById(${literal(username)}, false) != null) throw new IllegalStateException('Jenkins user already exists')
-realm.createAccount(${literal(username)}, ${literal(password || '')})
-${seedRole(username)}
-${roleSetup}
-println 'created'`;
-    return `${imports}
-def user = hudson.model.User.getById(${literal(username)}, false)
-if (user == null) throw new IllegalStateException('Jenkins user not found')
-${password ? `user.addProperty(HudsonPrivateSecurityRealm.Details.fromPlainPassword(${literal(password)})); user.save()` : ''}
-${seedRole(username)}
-${roleSetup}
+        return `${imports}
+def realm = Jenkins.get().securityRealm
+if (!(realm instanceof HudsonPrivateSecurityRealm)) throw new IllegalStateException('Jenkins must use its private security realm to create users')
+def existing = hudson.model.User.getById(${literal(username)}, false)
+def reconciled = existing != null
+if (!reconciled) {
+  realm.createAccount(${literal(username)}, ${literal(password || '')})
+} else {
+  // v2.0 creation is deliberately idempotent for identities left behind by an
+  // older CLI release. Reclaim the same username, rotate its password, and
+  // rebuild only IndraQ-managed role assignments instead of failing forever.
+  existing.addProperty(HudsonPrivateSecurityRealm.Details.fromPlainPassword(${literal(password || '')}))
+  existing.save()
+}
+${clearManagedProjectRoles(username)}
+${seedRole(username)}
+${roleSetup}
+println reconciled ? 'reconciled' : 'created'`;
+    return `${imports}
+def user = hudson.model.User.getById(${literal(username)}, false)
+if (user == null) throw new IllegalStateException('Jenkins user not found')
+${password ? `user.addProperty(HudsonPrivateSecurityRealm.Details.fromPlainPassword(${literal(password)})); user.save()` : ''}
+${seedRole(username)}
+${roleSetup}
 println 'updated'`;
 };
 exports.buildJenkinsUserScript = buildJenkinsUserScript;
+const configuredManagedJenkinsProviders = async () => {
+    const profiles = await (0, user_provider_service_1.listUserProviders)();
+    return ['jenkins-dev', 'jenkins-prod'].filter((provider) => profiles.some((profile) => profile.provider === provider && profile.has_secret));
+};
+exports.configuredManagedJenkinsProviders = configuredManagedJenkinsProviders;
+const connectionFor = async (provider) => (0, cloud_jenkins_service_1.getCloudJenkins)(provider === 'jenkins-prod' ? 'prod' : 'dev', 'Manage Jenkins user from unified CLI');
 const connection = async () => {
-    const providers = await (0, user_provider_service_1.listUserProviders)();
-    const environment = providers.some((p) => p.provider === 'jenkins-prod' && p.has_secret) ? 'prod' : 'dev';
-    return (0, cloud_jenkins_service_1.getCloudJenkins)(environment, 'Manage Jenkins user from unified CLI');
+    const providers = await (0, exports.configuredManagedJenkinsProviders)();
+    const provider = providers.includes('jenkins-prod') ? 'jenkins-prod' : providers[0];
+    if (!provider)
+        throw new Error('No Jenkins user-management provider is configured. Configure jenkins-dev and/or jenkins-prod first.');
+    return connectionFor(provider);
+};
+const createJenkinsUserForProvider = async (provider, username, password, indraqRole, roles) => {
+    const output = await (0, cloud_jenkins_service_1.runCloudJenkinsGroovy)(await connectionFor(provider), (0, exports.buildJenkinsUserScript)('create', username, password, roles, indraqRole));
+    if (output.split(/\r?\n/).some((line) => line.trim() === 'reconciled'))
+        return 'reconciled';
+    if (output.split(/\r?\n/).some((line) => line.trim() === 'created'))
+        return 'created';
+    throw new Error(`${provider} did not confirm Jenkins user creation/reconciliation. Response: ${output.slice(-800) || '(empty response)'}`);
+};
+exports.createJenkinsUserForProvider = createJenkinsUserForProvider;
+const createJenkinsUser = async (username, password, indraqRole, roles) => {
+    await (0, cloud_jenkins_service_1.runCloudJenkinsGroovy)(await connection(), (0, exports.buildJenkinsUserScript)('create', username, password, roles, indraqRole));
 };
-const createJenkinsUser = async (username, password, roles) => { await (0, cloud_jenkins_service_1.runCloudJenkinsGroovy)(await connection(), (0, exports.buildJenkinsUserScript)('create', username, password, roles)); };
 exports.createJenkinsUser = createJenkinsUser;
-const updateJenkinsUser = async (username, password, roles) => { await (0, cloud_jenkins_service_1.runCloudJenkinsGroovy)(await connection(), (0, exports.buildJenkinsUserScript)('update', username, password, roles)); };
+const updateJenkinsUserForProvider = async (provider, username, password, indraqRole, roles) => {
+    await (0, cloud_jenkins_service_1.runCloudJenkinsGroovy)(await connectionFor(provider), (0, exports.buildJenkinsUserScript)('update', username, password, roles, indraqRole));
+};
+exports.updateJenkinsUserForProvider = updateJenkinsUserForProvider;
+const updateJenkinsUser = async (username, password, indraqRole, roles) => {
+    await (0, cloud_jenkins_service_1.runCloudJenkinsGroovy)(await connection(), (0, exports.buildJenkinsUserScript)('update', username, password, roles, indraqRole));
+};
 exports.updateJenkinsUser = updateJenkinsUser;
-const deleteJenkinsUser = async (username) => { await (0, cloud_jenkins_service_1.runCloudJenkinsGroovy)(await connection(), (0, exports.buildJenkinsUserScript)('delete', username)); };
+const deleteJenkinsUserForProvider = async (provider, username) => {
+    const output = await (0, cloud_jenkins_service_1.runCloudJenkinsGroovy)(await connectionFor(provider), (0, exports.buildJenkinsUserScript)('delete', username));
+    return output.split(/\r?\n/).some((line) => line.trim() === 'already-absent') ? 'already-absent' : 'deleted';
+};
+exports.deleteJenkinsUserForProvider = deleteJenkinsUserForProvider;
+const deleteJenkinsUser = async (username) => {
+    await (0, cloud_jenkins_service_1.runCloudJenkinsGroovy)(await connection(), (0, exports.buildJenkinsUserScript)('delete', username));
+};
 exports.deleteJenkinsUser = deleteJenkinsUser;
-const preflightJenkinsUserManagement = async (roles = []) => {
+const preflightScript = (roles) => {
     const roleCheck = roles.length ? `${roles.map((role) => `if (strategy.getRoleMap(RoleType.Global).getRole(${literal(role)}) == null) throw new IllegalArgumentException('Unknown Jenkins global role: ' + ${literal(role)})`).join('\n')}` : '';
-    const script = `${imports}
-def realm = Jenkins.get().securityRealm
-if (!(realm instanceof HudsonPrivateSecurityRealm)) throw new IllegalStateException('Jenkins must use its private security realm to create users')
-def strategy = Jenkins.get().authorizationStrategy
-if (!(strategy instanceof RoleBasedAuthorizationStrategy)) throw new IllegalStateException('Role Strategy plugin must be the active Jenkins authorization strategy')
-${roleCheck}
+    return `${imports}
+def realm = Jenkins.get().securityRealm
+if (!(realm instanceof HudsonPrivateSecurityRealm)) throw new IllegalStateException('Jenkins must use its private security realm to create users')
+def strategy = Jenkins.get().authorizationStrategy
+if (!(strategy instanceof RoleBasedAuthorizationStrategy)) throw new IllegalStateException('Role Strategy plugin must be the active Jenkins authorization strategy')
+${roleCheck}
 println 'indraq-user-management-ready'`;
-    const output = await (0, cloud_jenkins_service_1.runCloudJenkinsGroovy)(await connection(), script);
-    if (!output.includes('indraq-user-management-ready'))
-        throw new Error('Jenkins Groovy administration preflight did not return the expected response.');
+};
+const preflightJenkinsUserManagementForProvider = async (provider, roles = []) => {
+    let output = '';
+    try {
+        output = await (0, cloud_jenkins_service_1.runCloudJenkinsGroovy)(await connectionFor(provider), preflightScript(roles));
+    }
+    catch (error) {
+        throw new Error(`${provider} user-management preflight failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (!output.includes('indraq-user-management-ready')) {
+        throw new Error(`${provider} Groovy preflight did not confirm readiness. Jenkins returned: ${output.slice(-1200) || '(empty response)'}`);
+    }
+};
+exports.preflightJenkinsUserManagementForProvider = preflightJenkinsUserManagementForProvider;
+const preflightJenkinsUserManagement = async (roles = []) => {
+    const providers = await (0, exports.configuredManagedJenkinsProviders)();
+    if (!providers.length)
+        throw new Error('No configured Jenkins controller was found. Configure jenkins-dev and/or jenkins-prod first.');
+    for (const provider of providers)
+        await (0, exports.preflightJenkinsUserManagementForProvider)(provider, roles);
+    return providers;
 };
 exports.preflightJenkinsUserManagement = preflightJenkinsUserManagement;
 //# sourceMappingURL=jenkins-user.provider.js.map

package/dist/modules/users/providers/jenkins-user.provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"jenkins-user.provider.js","sourceRoot":"","sources":["../../../../src/modules/users/providers/jenkins-user.provider.ts"],"names":[],"mappings":";;;AAAA,sFAAoG;AACpG,sFAA+E;AAE/E,MAAM,OAAO,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AACjE,MAAM,IAAI,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACjI,MAAM,OAAO,GAAG;;;;;;;;6BAQa,CAAC;AAE9B,MAAM,QAAQ,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC;;;;;;;;;;;;;;2EAc4B,OAAO,CAAC,QAAQ,CAAC;qBACvE,CAAC;AAEtB,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAE,KAAe,EAAU,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,mDAAmD,OAAO,CAAC,IAAI,CAAC;WACvL,IAAI,CAAC,IAAI,CAAC,kFAAkF,OAAO,CAAC,IAAI,CAAC;uDAC7D,IAAI,CAAC,IAAI,CAAC,iDAAiD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;qBAC9H,CAAC,CAAC,CAAC,EAAE,CAAC;AAEpB,MAAM,sBAAsB,GAAG,CAAC,SAAyC,EAAE,QAAgB,EAAE,QAAiB,EAAE,QAAkB,EAAE,EAAU,EAAE;IACrJ,IAAI,SAAS,KAAK,QAAQ;QAAE,OAAO,GAAG,OAAO;uCACR,OAAO,CAAC,QAAQ,CAAC;;;;;;6FAMqC,OAAO,CAAC,QAAQ,CAAC;;;;kBAI5F,CAAC;IACjB,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;;EAEjC,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvC,IAAI,SAAS,KAAK,QAAQ;QAAE,OAAO,GAAG,OAAO;;;gCAGf,OAAO,CAAC,QAAQ,CAAC;sBAC3B,OAAO,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;EACjE,QAAQ,CAAC,QAAQ,CAAC;EAClB,SAAS;kBACO,CAAC;IACjB,OAAO,GAAG,OAAO;uCACoB,OAAO,CAAC,QAAQ,CAAC;;EAEtD,QAAQ,CAAC,CAAC,CAAC,yEAAyE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE;EAC3H,QAAQ,CAAC,QAAQ,CAAC;EAClB,SAAS;kBACO,CAAC;AACnB,CAAC,CAAC;AA/BW,QAAA,sBAAsB,0BA+BjC;AAEF,MAAM,UAAU,GAAG,KAAK,IAAI,EAAE;IAC5B,MAAM,SAAS,GAAG,MAAM,IAAA,yCAAiB,GAAE,CAAC;IAC5C,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,cAAc,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;IAC1G,OAAO,IAAA,uCAAe,EAAC,WAAW,EAAE,sCAAsC,CAAC,CAAC;AAC9E,CAAC,CAAC;AAEK,MAAM,iBAAiB,GAAG,KAAK,EAAE,QAAgB,EAAE,QAAgB,EAAE,KAAe,EAAiB,EAAE,GAAG,MAAM,IAAA,6CAAqB,EAAC,MAAM,UAAU,EAAE,EAAE,IAAA,8BAAsB,EAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAApN,QAAA,iBAAiB,qBAAmM;AAC1N,MAAM,iBAAiB,GAAG,KAAK,EAAE,QAAgB,EAAE,QAA4B,EAAE,KAAe,EAAiB,EAAE,GAAG,MAAM,IAAA,6CAAqB,EAAC,MAAM,UAAU,EAAE,EAAE,IAAA,8BAAsB,EAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAAhO,QAAA,iBAAiB,qBAA+M;AACtO,MAAM,iBAAiB,GAAG,KAAK,EAAE,QAAgB,EAAiB,EAAE,GAAG,MAAM,IAAA,6CAAqB,EAAC,MAAM,UAAU,EAAE,EAAE,IAAA,8BAAsB,EAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAAhK,QAAA,iBAAiB,qBAA+I;AAEtK,MAAM,8BAA8B,GAAG,KAAK,EAAE,QAAkB,EAAE,EAAiB,EAAE;IAC1F,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,oDAAoD,OAAO,CAAC,IAAI,CAAC,mFAAmF,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChP,MAAM,MAAM,GAAG,GAAG,OAAO;;;;;EAKzB,SAAS;uCAC4B,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,IAAA,6CAAqB,EAAC,MAAM,UAAU,EAAE,EAAE,MAAM,CAAC,CAAC;IACvE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,8BAA8B,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;AACzJ,CAAC,CAAC;AAXW,QAAA,8BAA8B,kCAWzC"}
+{"version":3,"file":"jenkins-user.provider.js","sourceRoot":"","sources":["../../../../src/modules/users/providers/jenkins-user.provider.ts"],"names":[],"mappings":";;;AAAA,sFAAoG;AACpG,sFAA+E;AAG/E,MAAM,OAAO,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AACjE,MAAM,IAAI,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACjI,MAAM,OAAO,GAAG;;;;;;;;6BAQa,CAAC;AAE9B,MAAM,wBAAwB,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC;qEACM,OAAO,CAAC,QAAQ,CAAC;;;;;;;;;EASpF,CAAC;AAEH,MAAM,QAAQ,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC;;;;;;;;;;;;;;2EAc4B,OAAO,CAAC,QAAQ,CAAC;qBACvE,CAAC;AAEtB,MAAM,yBAAyB,GAAG,CAAC,QAAgB,EAAE,KAAe,EAAU,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,mDAAmD,OAAO,CAAC,IAAI,CAAC;WAClM,IAAI,CAAC,IAAI,CAAC,kFAAkF,OAAO,CAAC,IAAI,CAAC;uDAC7D,IAAI,CAAC,IAAI,CAAC,iDAAiD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;qBAC9H,CAAC,CAAC,CAAC,EAAE,CAAC;AAE3B,MAAM,qBAAqB,GAAG,CAAC,QAAgB,EAAE,IAAgB,EAAE,UAAoB,EAAU,EAAE;IACjG,MAAM,WAAW,GAAG,UAAU,IAAI,EAAE,CAAC;IACrC,MAAM,WAAW,GAAG,IAAI,KAAK,MAAM;QACjC,CAAC,CAAC,sCAAsC;QACxC,CAAC,CAAC,4CAA4C,CAAC;IACjD,OAAO;;;8DAGqD,OAAO,CAAC,QAAQ,CAAC;;;;sCAIzC,OAAO,CAAC,WAAW,CAAC;;;IAGtD,WAAW;2BACY,OAAO,CAAC,WAAW,CAAC;;;;EAI7C,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,wBAAwB,OAAO,CAAC,KAAK,CAAC;YAC9E,IAAI,CAAC,KAAK,CAAC,kFAAkF,OAAO,CAAC,KAAK,CAAC;6BAC1F,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;qBAC7C,CAAC;AACtB,CAAC,CAAC;AAEK,MAAM,sBAAsB,GAAG,CACpC,SAAyC,EACzC,QAAgB,EAChB,QAAiB,EACjB,QAAkB,EAAE,EACpB,UAAuB,EACf,EAAE;IACV,IAAI,SAAS,KAAK,QAAQ;QAAE,OAAO,GAAG,OAAO;uCACR,OAAO,CAAC,QAAQ,CAAC;;;;gEAIQ,OAAO,CAAC,QAAQ,CAAC;;;;;;;;kBAQ/D,CAAC;IAEjB,MAAM,SAAS,GAAG,UAAU;QAC1B,CAAC,CAAC,qBAAqB,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC;QACpD,CAAC,CAAC,KAAK,CAAC,MAAM;YACZ,CAAC,CAAC;;EAEN,yBAAyB,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE;YACxC,CAAC,CAAC,EAAE,CAAC;IAET,IAAI,SAAS,KAAK,QAAQ;QAAE,OAAO,GAAG,OAAO;;;2CAGJ,OAAO,CAAC,QAAQ,CAAC;;;wBAGpC,OAAO,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;;;;;8EAKS,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;;;EAGnG,wBAAwB,CAAC,QAAQ,CAAC;EAClC,QAAQ,CAAC,QAAQ,CAAC;EAClB,SAAS;8CACmC,CAAC;IAE7C,OAAO,GAAG,OAAO;uCACoB,OAAO,CAAC,QAAQ,CAAC;;EAEtD,QAAQ,CAAC,CAAC,CAAC,yEAAyE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE;EAC3H,QAAQ,CAAC,QAAQ,CAAC;EAClB,SAAS;kBACO,CAAC;AACnB,CAAC,CAAC;AAxDW,QAAA,sBAAsB,0BAwDjC;AAIK,MAAM,iCAAiC,GAAG,KAAK,IAAuC,EAAE;IAC7F,MAAM,QAAQ,GAAG,MAAM,IAAA,yCAAiB,GAAE,CAAC;IAC3C,OAAQ,CAAC,aAAa,EAAE,cAAc,CAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CACpE,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,CAAC,CAChF,CAAC;AACJ,CAAC,CAAC;AALW,QAAA,iCAAiC,qCAK5C;AAEF,MAAM,aAAa,GAAG,KAAK,EAAE,QAAgC,EAAE,EAAE,CAC/D,IAAA,uCAAe,EAAC,QAAQ,KAAK,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,sCAAsC,CAAC,CAAC;AAExG,MAAM,UAAU,GAAG,KAAK,IAAI,EAAE;IAC5B,MAAM,SAAS,GAAG,MAAM,IAAA,yCAAiC,GAAE,CAAC;IAC5D,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACpF,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,qGAAqG,CAAC,CAAC;IACtI,OAAO,aAAa,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC,CAAC;AAEK,MAAM,4BAA4B,GAAG,KAAK,EAC/C,QAAgC,EAChC,QAAgB,EAChB,QAAgB,EAChB,UAAsB,EACtB,KAAe,EACoB,EAAE;IACrC,MAAM,MAAM,GAAG,MAAM,IAAA,6CAAqB,EAAC,MAAM,aAAa,CAAC,QAAQ,CAAC,EAAE,IAAA,8BAAsB,EAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;IACnJ,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,YAAY,CAAC;QAAE,OAAO,YAAY,CAAC;IAC5F,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IACtF,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,oEAAoE,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,kBAAkB,EAAE,CAAC,CAAC;AAC7I,CAAC,CAAC;AAXW,QAAA,4BAA4B,gCAWvC;AAEK,MAAM,iBAAiB,GAAG,KAAK,EAAE,QAAgB,EAAE,QAAgB,EAAE,UAAsB,EAAE,KAAe,EAAiB,EAAE;IACpI,MAAM,IAAA,6CAAqB,EAAC,MAAM,UAAU,EAAE,EAAE,IAAA,8BAAsB,EAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;AAC3H,CAAC,CAAC;AAFW,QAAA,iBAAiB,qBAE5B;AACK,MAAM,4BAA4B,GAAG,KAAK,EAAE,QAAgC,EAAE,QAAgB,EAAE,QAA4B,EAAE,UAAkC,EAAE,KAAe,EAAiB,EAAE;IACzM,MAAM,IAAA,6CAAqB,EAAC,MAAM,aAAa,CAAC,QAAQ,CAAC,EAAE,IAAA,8BAAsB,EAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;AACtI,CAAC,CAAC;AAFW,QAAA,4BAA4B,gCAEvC;AACK,MAAM,iBAAiB,GAAG,KAAK,EAAE,QAAgB,EAAE,QAA4B,EAAE,UAAkC,EAAE,KAAe,EAAiB,EAAE;IAC5J,MAAM,IAAA,6CAAqB,EAAC,MAAM,UAAU,EAAE,EAAE,IAAA,8BAAsB,EAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;AAC3H,CAAC,CAAC;AAFW,QAAA,iBAAiB,qBAE5B;AACK,MAAM,4BAA4B,GAAG,KAAK,EAAE,QAAgC,EAAE,QAAgB,EAAyC,EAAE;IAC9I,MAAM,MAAM,GAAG,MAAM,IAAA,6CAAqB,EAAC,MAAM,aAAa,CAAC,QAAQ,CAAC,EAAE,IAAA,8BAAsB,EAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IACtH,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,gBAAgB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/G,CAAC,CAAC;AAHW,QAAA,4BAA4B,gCAGvC;AACK,MAAM,iBAAiB,GAAG,KAAK,EAAE,QAAgB,EAAiB,EAAE;IACzE,MAAM,IAAA,6CAAqB,EAAC,MAAM,UAAU,EAAE,EAAE,IAAA,8BAAsB,EAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC9F,CAAC,CAAC;AAFW,QAAA,iBAAiB,qBAE5B;AAEF,MAAM,eAAe,GAAG,CAAC,KAAe,EAAU,EAAE;IAClD,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,oDAAoD,OAAO,CAAC,IAAI,CAAC,mFAAmF,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChP,OAAO,GAAG,OAAO;;;;;EAKjB,SAAS;uCAC4B,CAAC;AACxC,CAAC,CAAC;AAEK,MAAM,yCAAyC,GAAG,KAAK,EAAE,QAAgC,EAAE,QAAkB,EAAE,EAAiB,EAAE;IACvI,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAA,6CAAqB,EAAC,MAAM,aAAa,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,sCAAsC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7H,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,8BAA8B,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,kEAAkE,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,kBAAkB,EAAE,CAAC,CAAC;IAC5I,CAAC;AACH,CAAC,CAAC;AAVW,QAAA,yCAAyC,6CAUpD;AAEK,MAAM,8BAA8B,GAAG,KAAK,EAAE,QAAkB,EAAE,EAAqC,EAAE;IAC9G,MAAM,SAAS,GAAG,MAAM,IAAA,yCAAiC,GAAE,CAAC;IAC5D,IAAI,CAAC,SAAS,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,8FAA8F,CAAC,CAAC;IACvI,KAAK,MAAM,QAAQ,IAAI,SAAS;QAAE,MAAM,IAAA,iDAAyC,EAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACnG,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AALW,QAAA,8BAA8B,kCAKzC"}

package/dist/modules/users/providers/npm-user.provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"npm-user.provider.d.ts","sourceRoot":"","sources":["../../../../src/modules/users/providers/npm-user.provider.ts"],"names":[],"mappings":"AAsBA,eAAO,MAAM,oBAAoB,GAAU,UAAU,MAAM,EAAE,OAAO,MAAM,EAAE,UAAU,MAAM,EAAE,MAAM,MAAM,KAAG,OAAO,CAAC,IAAI,CAIxH,CAAC;AAEF,eAAO,MAAM,oBAAoB,GAAU,UAAU,MAAM,EAAE,OAAO,MAAM,GAAG,SAAS,EAAE,UAAU,MAAM,GAAG,SAAS,EAAE,MAAM,MAAM,GAAG,SAAS,KAAG,OAAO,CAAC,IAAI,CAO5J,CAAC;AAEF,eAAO,MAAM,oBAAoB,GAAU,UAAU,MAAM,KAAG,OAAO,CAAC,IAAI,CAIzE,CAAC"}
+{"version":3,"file":"npm-user.provider.d.ts","sourceRoot":"","sources":["../../../../src/modules/users/providers/npm-user.provider.ts"],"names":[],"mappings":"AAsBA,eAAO,MAAM,oBAAoB,GAAU,UAAU,MAAM,EAAE,OAAO,MAAM,EAAE,UAAU,MAAM,EAAE,MAAM,MAAM,KAAG,OAAO,CAAC,IAAI,CAIxH,CAAC;AAEF,eAAO,MAAM,oBAAoB,GAAU,UAAU,MAAM,EAAE,OAAO,MAAM,GAAG,SAAS,EAAE,UAAU,MAAM,GAAG,SAAS,EAAE,MAAM,MAAM,GAAG,SAAS,KAAG,OAAO,CAAC,IAAI,CAO5J,CAAC;AAEF,eAAO,MAAM,oBAAoB,GAAU,UAAU,MAAM,KAAG,OAAO,CAAC,IAAI,CAKzE,CAAC"}

package/dist/modules/users/providers/npm-user.provider.js

@@ -40,7 +40,9 @@ const updateNpmUnifiedUser = async (identity, email, password, role) => {
 exports.updateNpmUnifiedUser = updateNpmUnifiedUser;
 const deleteNpmUnifiedUser = async (identity) => {
     const api = await (0, cloud_npm_service_1.createCloudNpmApi)('Delete Nginx Proxy Manager user');
-    const user = await lookup(api, identity);
+    const user = (await api.listUsers()).find((item) => item.email.toLowerCase() === identity.toLowerCase() || item.nickname.toLowerCase() === identity.toLowerCase());
+    if (!user)
+        return; // idempotent delete: already absent is the desired state
     await api.deleteUser(user.id);
 };
 exports.deleteNpmUnifiedUser = deleteNpmUnifiedUser;

package/dist/modules/users/providers/npm-user.provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"npm-user.provider.js","sourceRoot":"","sources":["../../../../src/modules/users/providers/npm-user.provider.ts"],"names":[],"mappings":";;;AACA,8EAA2E;AAE3E,MAAM,MAAM,GAAG,KAAK,EAAE,GAAkB,EAAE,QAAgB,EAAE,EAAE;IAC5D,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1J,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAClD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,8EAA8E;AAC9E,+EAA+E;AAC/E,uCAAuC;AACvC,MAAM,mBAAmB,GAAuB;IAC9C,UAAU,EAAE,MAAM;IAClB,WAAW,EAAE,QAAQ;IACrB,YAAY,EAAE,QAAQ;IACtB,YAAY,EAAE,MAAM;IACpB,iBAAiB,EAAE,QAAQ;IAC3B,UAAU,EAAE,QAAQ;IACpB,OAAO,EAAE,QAAQ;CAClB,CAAC;AAEK,MAAM,oBAAoB,GAAG,KAAK,EAAE,QAAgB,EAAE,KAAa,EAAE,QAAgB,EAAE,IAAY,EAAiB,EAAE;IAC3H,MAAM,GAAG,GAAG,MAAM,IAAA,qCAAiB,EAAC,iCAAiC,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IACjI,IAAI,IAAI,KAAK,OAAO;QAAE,MAAM,GAAG,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC;AACzF,CAAC,CAAC;AAJW,QAAA,oBAAoB,wBAI/B;AAEK,MAAM,oBAAoB,GAAG,KAAK,EAAE,QAAgB,EAAE,KAAyB,EAAE,QAA4B,EAAE,IAAwB,EAAiB,EAAE;IAC/J,MAAM,GAAG,GAAG,MAAM,IAAA,qCAAiB,EAAC,iCAAiC,CAAC,CAAC;IACvE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACzC,MAAM,aAAa,GAAG,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;IACtD,MAAM,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,aAAa,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/J,IAAI,QAAQ;QAAE,MAAM,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9D,IAAI,aAAa,KAAK,OAAO;QAAE,MAAM,GAAG,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC;AAC/F,CAAC,CAAC;AAPW,QAAA,oBAAoB,wBAO/B;AAEK,MAAM,oBAAoB,GAAG,KAAK,EAAE,QAAgB,EAAiB,EAAE;IAC5E,MAAM,GAAG,GAAG,MAAM,IAAA,qCAAiB,EAAC,iCAAiC,CAAC,CAAC;IACvE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACzC,MAAM,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAChC,CAAC,CAAC;AAJW,QAAA,oBAAoB,wBAI/B"}
+{"version":3,"file":"npm-user.provider.js","sourceRoot":"","sources":["../../../../src/modules/users/providers/npm-user.provider.ts"],"names":[],"mappings":";;;AACA,8EAA2E;AAE3E,MAAM,MAAM,GAAG,KAAK,EAAE,GAAkB,EAAE,QAAgB,EAAE,EAAE;IAC5D,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1J,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAClD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,8EAA8E;AAC9E,+EAA+E;AAC/E,uCAAuC;AACvC,MAAM,mBAAmB,GAAuB;IAC9C,UAAU,EAAE,MAAM;IAClB,WAAW,EAAE,QAAQ;IACrB,YAAY,EAAE,QAAQ;IACtB,YAAY,EAAE,MAAM;IACpB,iBAAiB,EAAE,QAAQ;IAC3B,UAAU,EAAE,QAAQ;IACpB,OAAO,EAAE,QAAQ;CAClB,CAAC;AAEK,MAAM,oBAAoB,GAAG,KAAK,EAAE,QAAgB,EAAE,KAAa,EAAE,QAAgB,EAAE,IAAY,EAAiB,EAAE;IAC3H,MAAM,GAAG,GAAG,MAAM,IAAA,qCAAiB,EAAC,iCAAiC,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IACjI,IAAI,IAAI,KAAK,OAAO;QAAE,MAAM,GAAG,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC;AACzF,CAAC,CAAC;AAJW,QAAA,oBAAoB,wBAI/B;AAEK,MAAM,oBAAoB,GAAG,KAAK,EAAE,QAAgB,EAAE,KAAyB,EAAE,QAA4B,EAAE,IAAwB,EAAiB,EAAE;IAC/J,MAAM,GAAG,GAAG,MAAM,IAAA,qCAAiB,EAAC,iCAAiC,CAAC,CAAC;IACvE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACzC,MAAM,aAAa,GAAG,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;IACtD,MAAM,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,aAAa,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/J,IAAI,QAAQ;QAAE,MAAM,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9D,IAAI,aAAa,KAAK,OAAO;QAAE,MAAM,GAAG,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC;AAC/F,CAAC,CAAC;AAPW,QAAA,oBAAoB,wBAO/B;AAEK,MAAM,oBAAoB,GAAG,KAAK,EAAE,QAAgB,EAAiB,EAAE;IAC5E,MAAM,GAAG,GAAG,MAAM,IAAA,qCAAiB,EAAC,iCAAiC,CAAC,CAAC;IACvE,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IACnK,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,yDAAyD;IAC5E,MAAM,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAChC,CAAC,CAAC;AALW,QAAA,oBAAoB,wBAK/B"}

package/dist/shared/config/config-files.js

@@ -22,13 +22,13 @@ const ROOT_LOCAL_RULES = ['.indraq/jenkins.local.json', '.indraq/aws.local.json'
 // This was generated by older IndraQ CLI releases. It ignored every file in
 // .indraq/, which prevented safe project configuration from being shared.
 const LEGACY_INNER_GITIGNORE = '*\n!.gitignore\n';
-const LEGACY_ROOT_SHARED_BLOCK = `# IndraQ CLI shared project configuration
-# These files are safe and intentionally shared with the project.
-!.indraq/
-!.indraq/.gitignore
-!.indraq/jenkins.json
-!.indraq/docker.json
-!.indraq/mobile.json
+const LEGACY_ROOT_SHARED_BLOCK = `# IndraQ CLI shared project configuration
+# These files are safe and intentionally shared with the project.
+!.indraq/
+!.indraq/.gitignore
+!.indraq/jenkins.json
+!.indraq/docker.json
+!.indraq/mobile.json
 `;
 const normaliseLines = (content) => content.replace(/\r\n/g, '\n').split('\n');
 const hasExactRule = (lines, rule) => lines.some((line) => line.trim() === rule);

package/docs/ARCHITECTURE.md

@@ -1,29 +1,29 @@
-# IndraQ Architecture
-
-## Control plane
-
-IndraQ CLI communicates with IndraQ Cloud API. PostgreSQL stores identities, roles, projects, shared environments, encrypted user provider credentials, infrastructure associations, managed AWS IAM credentials, and audit logs.
-
-## Credential ownership
-
-AWS, NPM, Jenkins, and GHCR credentials belong to an individual IndraQ user and are reusable across that user's projects.
-
-They are not organization-wide global secrets and are not copied into each project folder.
-
-## Shared environments
-
-Admins can create any number of shared environments with arbitrary names. An environment is a reusable named target containing an IP and optional region. Health-check protocol, endpoint, port, path, interval, threshold, latency measurement, and SNI are Route53-resource settings selected when DNS is configured.
-
-PRIMARY/SECONDARY is not an environment property. A FAILOVER DNS resource chooses which environment is PRIMARY and which is SECONDARY for that particular Route53 record.
-
-## Project resources
-
-Projects keep intent and external-resource associations, including GHCR image repositories, Jenkins jobs, Route53 routing/health checks, and NPM proxy hosts. Project membership controls who can discover/re-link a project. Resource grants record access to individual AWS, NPM, and Jenkins resources and are audited.
-
-## Prebuild
-
-Prebuild reconciles rather than blindly creates. It validates user provider configuration, checks existing project associations, asks for the Route53 routing policy first (SIMPLE, FAILOVER, WEIGHTED, or LATENCY), validates Jenkins host ports, configures/repairs Route53 according to that policy, verifies DNS before NPM, and creates/repairs NPM proxy hosts. SIMPLE records never receive a health check; FAILOVER uses PRIMARY/SECONDARY health checks; WEIGHTED/LATENCY may use health checks when requested.
-
-## Local state
-
-The project folder stores the Cloud project ID in `.indraq/project.json`. Reusable provider secrets are resolved from the authenticated user's Cloud account only when required.
+# IndraQ Architecture
+
+## Control plane
+
+IndraQ CLI communicates with IndraQ Cloud API. PostgreSQL stores identities, roles, projects, shared environments, encrypted user provider credentials, infrastructure associations, managed AWS IAM credentials, and audit logs.
+
+## Credential ownership
+
+AWS, NPM, Jenkins, and GHCR credentials belong to an individual IndraQ user and are reusable across that user's projects.
+
+They are not organization-wide global secrets and are not copied into each project folder.
+
+## Shared environments
+
+Admins can create any number of shared environments with arbitrary names. An environment is a reusable named target containing an IP and optional region. Health-check protocol, endpoint, port, path, interval, threshold, latency measurement, and SNI are Route53-resource settings selected when DNS is configured.
+
+PRIMARY/SECONDARY is not an environment property. A FAILOVER DNS resource chooses which environment is PRIMARY and which is SECONDARY for that particular Route53 record.
+
+## Project resources
+
+Projects keep intent and external-resource associations, including GHCR image repositories, Jenkins jobs, Route53 routing/health checks, and NPM proxy hosts. Project membership controls who can discover/re-link a project. Resource grants record access to individual AWS, NPM, and Jenkins resources and are audited.
+
+## Prebuild
+
+Prebuild reconciles rather than blindly creates. It validates user provider configuration, checks existing project associations, asks for the Route53 routing policy first (SIMPLE, FAILOVER, WEIGHTED, or LATENCY), validates Jenkins host ports, configures/repairs Route53 according to that policy, verifies DNS before NPM, and creates/repairs NPM proxy hosts. SIMPLE records never receive a health check; FAILOVER uses PRIMARY/SECONDARY health checks; WEIGHTED/LATENCY may use health checks when requested.
+
+## Local state
+
+The project folder stores the Cloud project ID in `.indraq/project.json`. Reusable provider secrets are resolved from the authenticated user's Cloud account only when required.