ninedeploy 0.10.6 → 0.16.0

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 NineDeploy
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 NineDeploy
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -135,6 +135,7 @@ ninedeploy env list <serviceId>                    # List environment variables
 ninedeploy env set <serviceId> KEY VALUE           # Set encrypted secret
 ninedeploy env set <serviceId> KEY VALUE --public  # Set public env variable
 ninedeploy env rm <serviceId> KEY                  # Remove variable
+ninedeploy env set <serviceId> KEY VALUE --preview # Value only this service's PR previews receive (also: list/rm --preview)
 ```
 
 ### 🌐 Domains & Routing

package/dist/client.d.ts

@@ -6,8 +6,42 @@ export type { NineDeployClient };
  * r193: every `/auth/` path used to be skipped, so the authenticated ones
  * (`/auth/me`, `/auth/tokens`, `/auth/sessions`, 2FA, passkey registration)
  * failed permanently once the 15-minute access token expired.
+ * Keep byte-identical to apps/web/src/lib/api.ts — the web copy also exempts
+ * `oidc/<slug>/link` (an authenticated route); this copy had drifted and
+ * would have re-inherited the r193 failure the moment a CLI command wired
+ * auth.oidc.link().
  */
 export declare const NO_REFRESH_PATH: RegExp;
+/**
+ * r550: join the configured base URL and an API path by string concatenation.
+ * `new URL('/v1/…', base)` resolves the path against the ORIGIN, silently
+ * dropping a sub-path prefix (`https://host/ninedeploy` → `https://host/v1/…`)
+ * — a panel published behind a path prefix answered every raw call with the
+ * front proxy's 404. The SDK has always concatenated; this keeps the raw
+ * paths (exports, imports, the log WebSocket) in line with it.
+ */
+export declare function apiUrl(path: string, baseUrl?: string): string;
+/**
+ * Mint a fresh access token from the saved refresh token (single-flight,
+ * persisted). Resolves false when there is no refresh token or the server
+ * refused it — the caller then surfaces its original 401.
+ */
+export declare function refreshAccessToken(baseUrl?: string): Promise<boolean>;
+/**
+ * r550: authenticated raw fetch for the endpoints the SDK cannot model
+ * (binary exports, the octet-stream import). These used to call fetch()
+ * directly with the saved bearer and no refresh: once the 15-minute access
+ * token expired, `system export` / `system import` / `services export` failed
+ * with a bare 401 while every SDK-backed command kept working. Same base-URL
+ * join and refresh-and-retry as getClient().
+ */
+export declare function authedFetch(path: string, init?: RequestInit): Promise<Response>;
+/**
+ * True when `token` is a JWT whose `exp` falls within `skewMs` from now.
+ * Opaque API tokens (and anything undecodable) report false — they carry no
+ * client-visible expiry, so the server's answer is the only authority.
+ */
+export declare function tokenExpiresSoon(token: string | undefined, skewMs?: number, now?: number): boolean;
 /**
  * Build an SDK client configured from the saved CLI config.
  *

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAGtE,YAAY,EAAE,gBAAgB,EAAE,CAAC;AASjC;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,QACyH,CAAC;AAqBtJ;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,IAAI,gBAAgB,CAwB5C"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAGtE,YAAY,EAAE,gBAAgB,EAAE,CAAC;AASjC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe,QAC6I,CAAC;AAE1K;;;;;;;GAOG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,MAA6B,GAAG,MAAM,CAEnF;AAqBD;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,GAAE,MAA6B,GAAG,OAAO,CAAC,OAAO,CAAC,CAOjG;AAcD;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAKzF;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,SAAS,EAAE,GAAG,SAAa,GAAG,OAAO,CAUtG;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,IAAI,gBAAgB,CAU5C"}

package/dist/client.js

@@ -12,11 +12,26 @@ let refreshInflight = null;
  * r193: every `/auth/` path used to be skipped, so the authenticated ones
  * (`/auth/me`, `/auth/tokens`, `/auth/sessions`, 2FA, passkey registration)
  * failed permanently once the 15-minute access token expired.
+ * Keep byte-identical to apps/web/src/lib/api.ts — the web copy also exempts
+ * `oidc/<slug>/link` (an authenticated route); this copy had drifted and
+ * would have re-inherited the r193 failure the moment a CLI command wired
+ * auth.oidc.link().
  */
-export const NO_REFRESH_PATH = /\/(?:v1\/setup|v1\/auth\/(?:login|refresh|register|logout|forgot-password|reset-password|status|oidc\/(?!providers(?:\/|$|\?))|passkey\/login\/))/;
+export const NO_REFRESH_PATH = /\/(?:v1\/setup|v1\/auth\/(?:login|refresh|register|logout|forgot-password|reset-password|status|oidc\/(?!providers(?:\/|$|\?)|[^/]+\/link(?:$|\?))|passkey\/login\/))/;
+/**
+ * r550: join the configured base URL and an API path by string concatenation.
+ * `new URL('/v1/…', base)` resolves the path against the ORIGIN, silently
+ * dropping a sub-path prefix (`https://host/ninedeploy` → `https://host/v1/…`)
+ * — a panel published behind a path prefix answered every raw call with the
+ * front proxy's 404. The SDK has always concatenated; this keeps the raw
+ * paths (exports, imports, the log WebSocket) in line with it.
+ */
+export function apiUrl(path, baseUrl = loadConfig().baseUrl) {
+    return `${baseUrl.replace(/\/+$/, '')}${path}`;
+}
 async function refreshSession(baseUrl, refreshToken) {
     try {
-        const res = await fetch(`${baseUrl}/v1/auth/refresh`, {
+        const res = await fetch(apiUrl('/v1/auth/refresh', baseUrl), {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({ refreshToken }),
@@ -35,6 +50,69 @@ async function refreshSession(baseUrl, refreshToken) {
         return false;
     }
 }
+/**
+ * Mint a fresh access token from the saved refresh token (single-flight,
+ * persisted). Resolves false when there is no refresh token or the server
+ * refused it — the caller then surfaces its original 401.
+ */
+export async function refreshAccessToken(baseUrl = loadConfig().baseUrl) {
+    const refreshToken = loadConfig().refreshToken;
+    if (!refreshToken)
+        return false;
+    refreshInflight ??= refreshSession(baseUrl, refreshToken).finally(() => {
+        refreshInflight = null;
+    });
+    return refreshInflight;
+}
+/** fetch() with the dashboard's 401 → refresh → retry-once semantics. */
+async function fetchWithRefresh(baseUrl, input, init) {
+    const res = await fetch(input, init);
+    if (res.status !== 401)
+        return res;
+    if (NO_REFRESH_PATH.test(input))
+        return res;
+    if (!(await refreshAccessToken(baseUrl)))
+        return res;
+    const headers = new Headers(init?.headers);
+    const fresh = loadConfig().token;
+    if (fresh)
+        headers.set('Authorization', `Bearer ${fresh}`);
+    return fetch(input, { ...init, headers });
+}
+/**
+ * r550: authenticated raw fetch for the endpoints the SDK cannot model
+ * (binary exports, the octet-stream import). These used to call fetch()
+ * directly with the saved bearer and no refresh: once the 15-minute access
+ * token expired, `system export` / `system import` / `services export` failed
+ * with a bare 401 while every SDK-backed command kept working. Same base-URL
+ * join and refresh-and-retry as getClient().
+ */
+export async function authedFetch(path, init = {}) {
+    const cfg = loadConfig();
+    const headers = new Headers(init.headers);
+    if (cfg.token)
+        headers.set('Authorization', `Bearer ${cfg.token}`);
+    return fetchWithRefresh(cfg.baseUrl, apiUrl(path, cfg.baseUrl), { ...init, headers });
+}
+/**
+ * True when `token` is a JWT whose `exp` falls within `skewMs` from now.
+ * Opaque API tokens (and anything undecodable) report false — they carry no
+ * client-visible expiry, so the server's answer is the only authority.
+ */
+export function tokenExpiresSoon(token, skewMs = 60_000, now = Date.now()) {
+    if (!token)
+        return false;
+    const part = token.split('.')[1];
+    if (!part)
+        return false;
+    try {
+        const payload = JSON.parse(Buffer.from(part, 'base64url').toString('utf8'));
+        return typeof payload.exp === 'number' && payload.exp * 1000 - skewMs <= now;
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Build an SDK client configured from the saved CLI config.
  *
@@ -54,26 +132,7 @@ export function getClient() {
         // Volume-file uploads and log tailing can be slow; still bounded so a
         // stalled backend cannot hang a CI runner forever.
         timeoutMs: 120_000,
-        fetch: async (input, init) => {
-            const res = await fetch(input, init);
-            if (res.status !== 401)
-                return res;
-            if (NO_REFRESH_PATH.test(input))
-                return res;
-            const refreshToken = loadConfig().refreshToken;
-            if (!refreshToken)
-                return res;
-            refreshInflight ??= refreshSession(cfg.baseUrl, refreshToken).finally(() => {
-                refreshInflight = null;
-            });
-            if (!(await refreshInflight))
-                return res;
-            const headers = new Headers(init?.headers);
-            const fresh = loadConfig().token;
-            if (fresh)
-                headers.set('Authorization', `Bearer ${fresh}`);
-            return fetch(input, { ...init, headers });
-        },
+        fetch: (input, init) => fetchWithRefresh(cfg.baseUrl, input, init),
     });
 }
 //# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAyB,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIrD;;;;GAIG;AACH,IAAI,eAAe,GAA4B,IAAI,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAC1B,mJAAmJ,CAAC;AAEtJ,KAAK,UAAU,cAAc,CAAC,OAAe,EAAE,YAAoB;IACjE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,kBAAkB,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;YACtC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QAC1B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiE,CAAC;QAChG,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,MAAM,EAAE,WAAW,IAAI,CAAC,MAAM,CAAC,YAAY;YAAE,OAAO,KAAK,CAAC;QAC/D,UAAU,CAAC,EAAE,GAAG,UAAU,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QAC9F,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,SAAS;IACvB,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,OAAO,YAAY,CAAC;QAClB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,QAAQ,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC,KAAK;QAClC,sEAAsE;QACtE,mDAAmD;QACnD,SAAS,EAAE,OAAO;QAClB,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC3B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACrC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,GAAG,CAAC;YACnC,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,GAAG,CAAC;YAC5C,MAAM,YAAY,GAAG,UAAU,EAAE,CAAC,YAAY,CAAC;YAC/C,IAAI,CAAC,YAAY;gBAAE,OAAO,GAAG,CAAC;YAC9B,eAAe,KAAK,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;gBACzE,eAAe,GAAG,IAAI,CAAC;YACzB,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC;gBAAE,OAAO,GAAG,CAAC;YACzC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC3C,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC,KAAK,CAAC;YACjC,IAAI,KAAK;gBAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5C,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAyB,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIrD;;;;GAIG;AACH,IAAI,eAAe,GAA4B,IAAI,CAAC;AAEpD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,eAAe,GAC1B,uKAAuK,CAAC;AAE1K;;;;;;;GAOG;AACH,MAAM,UAAU,MAAM,CAAC,IAAY,EAAE,OAAO,GAAW,UAAU,EAAE,CAAC,OAAO;IACzE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,OAAe,EAAE,YAAoB;IACjE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,kBAAkB,EAAE,OAAO,CAAC,EAAE;YAC3D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;YACtC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QAC1B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiE,CAAC;QAChG,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,MAAM,EAAE,WAAW,IAAI,CAAC,MAAM,CAAC,YAAY;YAAE,OAAO,KAAK,CAAC;QAC/D,UAAU,CAAC,EAAE,GAAG,UAAU,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QAC9F,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAO,GAAW,UAAU,EAAE,CAAC,OAAO;IAC7E,MAAM,YAAY,GAAG,UAAU,EAAE,CAAC,YAAY,CAAC;IAC/C,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAChC,eAAe,KAAK,cAAc,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;QACrE,eAAe,GAAG,IAAI,CAAC;IACzB,CAAC,CAAC,CAAC;IACH,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,yEAAyE;AACzE,KAAK,UAAU,gBAAgB,CAAC,OAAe,EAAE,KAAa,EAAE,IAAkB;IAChF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACrC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,GAAG,CAAC;IACnC,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IAC5C,IAAI,CAAC,CAAC,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC,KAAK,CAAC;IACjC,IAAI,KAAK;QAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,IAAI,GAAgB,EAAE;IACpE,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,GAAG,CAAC,KAAK;QAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IACnE,OAAO,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AACxF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAyB,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC3F,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAsB,CAAC;QACjG,OAAO,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,GAAG,MAAM,IAAI,GAAG,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,SAAS;IACvB,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,OAAO,YAAY,CAAC;QAClB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,QAAQ,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC,KAAK;QAClC,sEAAsE;QACtE,mDAAmD;QACnD,SAAS,EAAE,OAAO;QAClB,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;KACnE,CAAC,CAAC;AACL,CAAC"}

package/dist/commands/backupPolicy.d.ts

@@ -0,0 +1,29 @@
+/**
+ * `ninedeploy databases backup-policy get|set <dbId>` — 0.12 per-database
+ * backup policy: cron schedule, retention and destination. A database with
+ * no saved policy is on the built-in schedule (daily, 7 kept, active
+ * destination).
+ */
+import type { BackupPolicy, BackupPolicyInput } from '@ninedeploy/sdk';
+import type { NineDeployClient } from '../client.js';
+/** The presets the web card offers. */
+export declare const BACKUP_CRON_PRESETS: Record<string, string>;
+/** `ninedeploy databases backup-policy get <dbId>` */
+export declare function backupPolicyGet(client: NineDeployClient, idStr: string): Promise<void>;
+export interface BackupPolicySetOpts {
+    cron?: string;
+    preset?: string;
+    keep?: string;
+    keepRemote?: string;
+    destination?: string;
+    enable?: boolean;
+    disable?: boolean;
+}
+/**
+ * Build the PUT body: the current policy (or the built-in defaults) with the
+ * given flags applied — PUT replaces, so unset flags keep today's values.
+ */
+export declare function mergePolicyInput(current: BackupPolicy, opts: BackupPolicySetOpts): BackupPolicyInput;
+/** `ninedeploy databases backup-policy set <dbId> [--cron|--preset] [--keep] [--keep-remote] [--destination] [--enable|--disable]` */
+export declare function backupPolicySet(client: NineDeployClient, idStr: string, opts: BackupPolicySetOpts): Promise<void>;
+//# sourceMappingURL=backupPolicy.d.ts.map

package/dist/commands/backupPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backupPolicy.d.ts","sourceRoot":"","sources":["../../src/commands/backupPolicy.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAcrD,uCAAuC;AACvC,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAItD,CAAC;AAiBF,sDAAsD;AACtD,wBAAsB,eAAe,CAAC,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO5F;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAQD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,mBAAmB,GAAG,iBAAiB,CAmCpG;AAED,sIAAsI;AACtI,wBAAsB,eAAe,CAAC,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAWvH"}

package/dist/commands/backupPolicy.js

@@ -0,0 +1,111 @@
+import { c, error, header, info, spinner, success } from '../lib/format.js';
+/** Canonical decimal ids only — the server's `parseId` rule (F537). */
+const CANONICAL_ID = /^[1-9]\d*$/;
+const num = (v, usage) => {
+    const n = CANONICAL_ID.test(v) ? Number(v) : Number.NaN;
+    if (!Number.isSafeInteger(n)) {
+        error(usage);
+        throw new Error(usage);
+    }
+    return n;
+};
+/** The presets the web card offers. */
+export const BACKUP_CRON_PRESETS = {
+    daily: '0 3 * * *',
+    '6h': '0 */6 * * *',
+    weekly: '0 3 * * 0',
+};
+function printPolicy(p) {
+    header('Backup policy');
+    if (!p.configured) {
+        info(`Schedule:    built-in (daily, ${p.retainCount} kept, active destination)`);
+        info(c.dim('No policy saved — `ninedeploy databases backup-policy set` creates one.'));
+        return;
+    }
+    info(`Enabled:     ${p.enabled ? 'yes' : c.yellow('no — no scheduled backups')}`);
+    info(`Cron:        ${p.cron}`);
+    info(`Keep:        ${p.retainCount} local`);
+    info(`Remote keep: ${p.localOnly ? '—' : (p.retainRemoteCount ?? `same as local (${p.retainCount})`)}`);
+    info(`Destination: ${p.localOnly ? 'local only' : p.destinationId != null ? `#${p.destinationId}` : 'active destination'}`);
+    if (p.nextRunAt)
+        info(`Next run:    ${p.nextRunAt}`);
+}
+/** `ninedeploy databases backup-policy get <dbId>` */
+export async function backupPolicyGet(client, idStr) {
+    const id = num(idStr, 'Usage: ninedeploy databases backup-policy get <dbId>');
+    try {
+        printPolicy(await spinner('Reading backup policy', () => client.backups.getPolicy(id)));
+    }
+    catch (err) {
+        error(err instanceof Error ? err.message : String(err));
+    }
+}
+const intOpt = (v, flag) => {
+    if (v === undefined)
+        return undefined;
+    if (!/^\d+$/.test(v))
+        throw new Error(`${flag} must be a whole number`);
+    return Number(v);
+};
+/**
+ * Build the PUT body: the current policy (or the built-in defaults) with the
+ * given flags applied — PUT replaces, so unset flags keep today's values.
+ */
+export function mergePolicyInput(current, opts) {
+    if (opts.enable && opts.disable)
+        throw new Error('Use either --enable or --disable, not both');
+    if (opts.cron && opts.preset)
+        throw new Error('Use either --cron or --preset, not both');
+    let cron = opts.cron ?? current.cron ?? undefined;
+    if (opts.preset) {
+        cron = BACKUP_CRON_PRESETS[opts.preset];
+        if (!cron)
+            throw new Error(`--preset must be one of: ${Object.keys(BACKUP_CRON_PRESETS).join(', ')}`);
+    }
+    if (!cron)
+        throw new Error('No schedule yet: pass --cron "<5-field expression>" or --preset daily|6h|weekly');
+    let destinationId = current.destinationId;
+    let localOnly = current.localOnly;
+    if (opts.destination !== undefined) {
+        const d = opts.destination.trim().toLowerCase();
+        if (d === 'local') {
+            localOnly = true;
+            destinationId = null;
+        }
+        else if (d === 'active' || d === 'default') {
+            localOnly = false;
+            destinationId = null;
+        }
+        else if (CANONICAL_ID.test(d)) {
+            localOnly = false;
+            destinationId = Number(d);
+        }
+        else {
+            throw new Error('--destination must be a destination id, "active" or "local"');
+        }
+    }
+    const keepRemote = intOpt(opts.keepRemote, '--keep-remote');
+    return {
+        enabled: opts.disable ? false : opts.enable ? true : current.enabled,
+        cron,
+        retainCount: intOpt(opts.keep, '--keep') ?? current.retainCount,
+        retainRemoteCount: localOnly ? null : (keepRemote ?? current.retainRemoteCount),
+        destinationId,
+        localOnly,
+    };
+}
+/** `ninedeploy databases backup-policy set <dbId> [--cron|--preset] [--keep] [--keep-remote] [--destination] [--enable|--disable]` */
+export async function backupPolicySet(client, idStr, opts) {
+    const id = num(idStr, 'Usage: ninedeploy databases backup-policy set <dbId> [options]');
+    try {
+        const current = await client.backups.getPolicy(id);
+        const input = mergePolicyInput(current, opts);
+        const saved = await spinner('Saving backup policy', () => client.backups.setPolicy(id, input));
+        success('Backup policy saved.');
+        printPolicy(saved);
+    }
+    catch (err) {
+        error(err instanceof Error ? err.message : String(err));
+    }
+}
+//# sourceMappingURL=backupPolicy.js.map

package/dist/commands/backupPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backupPolicy.js","sourceRoot":"","sources":["../../src/commands/backupPolicy.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAE5E,uEAAuE;AACvE,MAAM,YAAY,GAAG,YAAY,CAAC;AAClC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,KAAa,EAAU,EAAE;IAC/C,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,KAAK,CAAC,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAEF,uCAAuC;AACvC,MAAM,CAAC,MAAM,mBAAmB,GAA2B;IACzD,KAAK,EAAE,WAAW;IAClB,IAAI,EAAE,aAAa;IACnB,MAAM,EAAE,WAAW;CACpB,CAAC;AAEF,SAAS,WAAW,CAAC,CAAe;IAClC,MAAM,CAAC,eAAe,CAAC,CAAC;IACxB,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;QAClB,IAAI,CAAC,iCAAiC,CAAC,CAAC,WAAW,4BAA4B,CAAC,CAAC;QACjF,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC,CAAC;QACvF,OAAO;IACT,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,2BAA2B,CAAC,EAAE,CAAC,CAAC;IAClF,IAAI,CAAC,gBAAgB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,gBAAgB,CAAC,CAAC,WAAW,QAAQ,CAAC,CAAC;IAC5C,IAAI,CAAC,gBAAgB,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,IAAI,kBAAkB,CAAC,CAAC,WAAW,GAAG,CAAC,EAAE,CAAC,CAAC;IACxG,IAAI,CAAC,gBAAgB,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC;IAC5H,IAAI,CAAC,CAAC,SAAS;QAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;AACvD,CAAC;AAED,sDAAsD;AACtD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAwB,EAAE,KAAa;IAC3E,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,EAAE,sDAAsD,CAAC,CAAC;IAC9E,IAAI,CAAC;QACH,WAAW,CAAC,MAAM,OAAO,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAYD,MAAM,MAAM,GAAG,CAAC,CAAqB,EAAE,IAAY,EAAsB,EAAE;IACzE,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,yBAAyB,CAAC,CAAC;IACxE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAqB,EAAE,IAAyB;IAC/E,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAC/F,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACzF,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,IAAI,SAAS,CAAC;IAClD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IAC9G,IAAI,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC1C,IAAI,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IAClC,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAChD,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC;YAClB,SAAS,GAAG,IAAI,CAAC;YACjB,aAAa,GAAG,IAAI,CAAC;QACvB,CAAC;aAAM,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YAC7C,SAAS,GAAG,KAAK,CAAC;YAClB,aAAa,GAAG,IAAI,CAAC;QACvB,CAAC;aAAM,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAChC,SAAS,GAAG,KAAK,CAAC;YAClB,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IAC5D,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO;QACpE,IAAI;QACJ,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,OAAO,CAAC,WAAW;QAC/D,iBAAiB,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,OAAO,CAAC,iBAAiB,CAAC;QAC/E,aAAa;QACb,SAAS;KACV,CAAC;AACJ,CAAC;AAED,sIAAsI;AACtI,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAwB,EAAE,KAAa,EAAE,IAAyB;IACtG,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,EAAE,gEAAgE,CAAC,CAAC;IACxF,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;QAC/F,OAAO,CAAC,sBAAsB,CAAC,CAAC;QAChC,WAAW,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC"}

package/dist/commands/certificates.d.ts

@@ -1,10 +1,3 @@
-/**
- * `ninedeploy certificates {list,expiring}` — G-15 cert
- * inventory CLI. The server-side surface is in
- * `lib/certificateInventory.ts`; the CLI is a thin
- * renderer around `client.traefik.{certificateInventory,
- * expiringCertificates}`.
- */
 import type { NineDeployClient } from '../client.js';
 export declare function certificatesList(client: NineDeployClient, opts?: {
     threshold?: string;
@@ -12,4 +5,22 @@ export declare function certificatesList(client: NineDeployClient, opts?: {
 export declare function certificatesExpiring(client: NineDeployClient, opts?: {
     days?: string;
 }): Promise<void>;
+/** `ninedeploy certificates custom list` */
+export declare function certificatesCustomList(client: NineDeployClient): Promise<void>;
+/** `ninedeploy certificates custom upload --name <n> --cert <path> --key <path>` */
+export declare function certificatesCustomUpload(client: NineDeployClient, opts?: {
+    name?: string;
+    cert?: string;
+    key?: string;
+}): Promise<void>;
+/** `ninedeploy certificates custom replace <id> --cert <path> --key <path> [--name <n>]` */
+export declare function certificatesCustomReplace(client: NineDeployClient, idArg: string, opts?: {
+    name?: string;
+    cert?: string;
+    key?: string;
+}): Promise<void>;
+/** `ninedeploy certificates custom delete <id> [--yes]` */
+export declare function certificatesCustomDelete(client: NineDeployClient, idArg: string, opts?: {
+    yes?: boolean;
+}): Promise<void>;
 //# sourceMappingURL=certificates.d.ts.map

package/dist/commands/certificates.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"certificates.d.ts","sourceRoot":"","sources":["../../src/commands/certificates.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAmBrD,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,gBAAgB,EACxB,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAChC,OAAO,CAAC,IAAI,CAAC,CA4Bf;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,gBAAgB,EACxB,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GAC3B,OAAO,CAAC,IAAI,CAAC,CAqBf"}
+{"version":3,"file":"certificates.d.ts","sourceRoot":"","sources":["../../src/commands/certificates.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAqBrD,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,gBAAgB,EACxB,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAChC,OAAO,CAAC,IAAI,CAAC,CA4Bf;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,gBAAgB,EACxB,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GAC3B,OAAO,CAAC,IAAI,CAAC,CAqBf;AAoCD,4CAA4C;AAC5C,wBAAsB,sBAAsB,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBpF;AAED,oFAAoF;AACpF,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,gBAAgB,EACxB,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GACxD,OAAO,CAAC,IAAI,CAAC,CAaf;AAED,4FAA4F;AAC5F,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,gBAAgB,EACxB,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GACxD,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED,2DAA2D;AAC3D,wBAAsB,wBAAwB,CAAC,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBnI"}

package/dist/commands/certificates.js

@@ -1,4 +1,14 @@
-import { c, error, header, info, spinner, table } from '../lib/format.js';
+/**
+ * `ninedeploy certificates {list,expiring}` — G-15 cert
+ * inventory CLI. The server-side surface is in
+ * `lib/certificateInventory.ts`; the CLI is a thin
+ * renderer around `client.traefik.{certificateInventory,
+ * expiringCertificates}`.
+ */
+import { readFileSync } from 'node:fs';
+import { prompt } from '../prompts.js';
+import { c, error, header, info, kv, spinner, success, table } from '../lib/format.js';
+import { plain } from './sources.js';
 const num = (v, usage) => {
     const n = Number(v);
     if (Number.isNaN(n)) {
@@ -54,4 +64,114 @@ export async function certificatesExpiring(client, opts = {}) {
         expiresAt: cert.notAfter ? new Date(cert.notAfter).toLocaleString() : c.dim('—'),
     })), ['host', 'status', 'daysToExpiry', 'expiresAt']);
 }
+// ── Custom certificates (0.14) ─────────────────────────────────────────────
+// `ninedeploy certificates custom list|upload|replace|delete` — operator-only
+// uploaded certificates (`/v1/traefik/certificates/custom`). The PEM files are
+// read from paths; no response carries a private key. Names, hostnames,
+// subjects and issuers come from the certificate itself, so they go through
+// the F1011 sanitiser.
+const certMessage = (err) => plain(err instanceof Error ? err.message : String(err));
+function certId(raw) {
+    const t = (raw ?? '').trim();
+    return /^[1-9]\d*$/.test(t) && Number.isSafeInteger(Number(t)) ? Number(t) : 0;
+}
+function readPemPair(opts, usage) {
+    if (!opts.cert || !opts.key) {
+        error(usage);
+        return null;
+    }
+    try {
+        return { certPem: readFileSync(opts.cert, 'utf8').trim(), keyPem: readFileSync(opts.key, 'utf8').trim() };
+    }
+    catch (err) {
+        error(`Could not read the PEM files: ${certMessage(err)}`);
+        return null;
+    }
+}
+function printSaved(cert) {
+    kv('Hostnames', cert.hostnames.map(plain).join(', '));
+    kv('Expires', new Date(cert.notAfter).toLocaleString());
+    kv('Covers', cert.coveredDomains.length > 0 ? cert.coveredDomains.map((d) => plain(d.hostname)).join(', ') : c.gray('no domains yet'));
+    for (const w of cert.warnings)
+        console.log(`  ${c.yellow('!')} ${c.yellow(plain(w))}`);
+}
+/** `ninedeploy certificates custom list` */
+export async function certificatesCustomList(client) {
+    try {
+        const certs = await spinner('Reading uploaded certificates', () => client.traefik.customCertificates.list());
+        header('Uploaded certificates');
+        if (certs.length === 0) {
+            info('No certificates uploaded. Add one with `ninedeploy certificates custom upload --name <n> --cert <path> --key <path>`.');
+            return;
+        }
+        table(certs.map((cert) => ({
+            id: cert.id,
+            name: plain(cert.name),
+            hostnames: cert.hostnames.map(plain).join(', '),
+            expires: cert.expired ? c.red(`expired ${new Date(cert.notAfter).toLocaleDateString()}`) : new Date(cert.notAfter).toLocaleDateString(),
+            issuer: cert.issuer ? plain(cert.issuer) : c.dim('—'),
+            covers: cert.coveredDomains.length > 0 ? cert.coveredDomains.map((d) => plain(d.hostname)).join(', ') : c.dim('—'),
+        })), ['id', 'name', 'hostnames', 'expires', 'issuer', 'covers']);
+    }
+    catch (err) {
+        error(certMessage(err));
+    }
+}
+/** `ninedeploy certificates custom upload --name <n> --cert <path> --key <path>` */
+export async function certificatesCustomUpload(client, opts = {}) {
+    const usage = 'Usage: ninedeploy certificates custom upload --name <name> --cert <chain.pem> --key <key.pem>';
+    const name = opts.name?.trim();
+    if (!name)
+        return error(usage);
+    const pem = readPemPair(opts, usage);
+    if (!pem)
+        return;
+    try {
+        const cert = await spinner('Verifying and uploading', () => client.traefik.customCertificates.upload({ name, ...pem }));
+        success(`Certificate "${plain(cert.name)}" uploaded (id: ${cert.id})`);
+        printSaved(cert);
+    }
+    catch (err) {
+        error(certMessage(err));
+    }
+}
+/** `ninedeploy certificates custom replace <id> --cert <path> --key <path> [--name <n>]` */
+export async function certificatesCustomReplace(client, idArg, opts = {}) {
+    const usage = 'Usage: ninedeploy certificates custom replace <id> --cert <chain.pem> --key <key.pem> [--name <name>]';
+    const id = certId(idArg);
+    if (!id)
+        return error(usage);
+    const pem = readPemPair(opts, usage);
+    if (!pem)
+        return;
+    const name = opts.name?.trim();
+    try {
+        const cert = await spinner('Verifying and replacing', () => client.traefik.customCertificates.replace(id, { ...(name ? { name } : {}), ...pem }));
+        success(`Certificate #${id} replaced`);
+        printSaved(cert);
+    }
+    catch (err) {
+        error(certMessage(err));
+    }
+}
+/** `ninedeploy certificates custom delete <id> [--yes]` */
+export async function certificatesCustomDelete(client, idArg, opts = {}) {
+    const id = certId(idArg);
+    if (!id)
+        return error('Usage: ninedeploy certificates custom delete <id> [--yes]');
+    if (!opts.yes) {
+        const confirm = await prompt(`Type "delete" to remove certificate #${id} (covered domains fall back to ACME)`, '');
+        if (confirm.trim() !== 'delete') {
+            info('Aborted.');
+            return;
+        }
+    }
+    try {
+        await spinner('Deleting the certificate', () => client.traefik.customCertificates.delete(id));
+        success(`Certificate #${id} deleted`);
+    }
+    catch (err) {
+        error(certMessage(err));
+    }
+}
 //# sourceMappingURL=certificates.js.map

package/dist/commands/certificates.js.map

@@ -1 +1 @@
-{"version":3,"file":"certificates.js","sourceRoot":"","sources":["../../src/commands/certificates.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE1E,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,KAAa,EAAU,EAAE;IAC/C,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACpB,KAAK,CAAC,KAAK,CAAC,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAEF,MAAM,YAAY,GAA0C;IAC1D,KAAK,EAAE,CAAC,CAAC,KAAK;IACd,eAAe,EAAE,CAAC,CAAC,MAAM;IACzB,OAAO,EAAE,CAAC,CAAC,GAAG;IACd,OAAO,EAAE,CAAC,CAAC,GAAG;CACf,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAwB,EACxB,IAAI,GAA2B,EAAE;IAEjC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,2BAA2B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,mBAAmB,EAAE,GAAG,EAAE,CACrD,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,SAAS,EAAE,CAAC,CACnD,CAAC;IACF,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAChC,IAAI,CAAC,eAAe,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAC5C,IAAI,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,YAAY,MAAM,CAAC,OAAO,CAAC,qBAAqB,IAAI,CAAC,CAAC;IACvH,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;QAC/B,IAAI,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IAC3E,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACxC,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,KAAK,CACH,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACjC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;QACzD,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAChF,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAChF,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;KAChD,CAAC,CAAC,EACH,CAAC,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAwB,EACxB,IAAI,GAAsB,EAAE;IAE5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAClD,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,CAAC,CAC9C,CAAC;IACF,MAAM,CAAC,gCAAgC,IAAI,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,UAAU,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IAC5B,IAAI,GAAG,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;QACpB,IAAI,CAAC,QAAQ,CAAC,CAAC;QACf,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,KAAK,CACH,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC9B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;QACzD,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAChF,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;KACjF,CAAC,CAAC,EACH,CAAC,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,CAAC,CAChD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"certificates.js","sourceRoot":"","sources":["../../src/commands/certificates.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAGvC,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvF,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAErC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,KAAa,EAAU,EAAE;IAC/C,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACpB,KAAK,CAAC,KAAK,CAAC,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAEF,MAAM,YAAY,GAA0C;IAC1D,KAAK,EAAE,CAAC,CAAC,KAAK;IACd,eAAe,EAAE,CAAC,CAAC,MAAM;IACzB,OAAO,EAAE,CAAC,CAAC,GAAG;IACd,OAAO,EAAE,CAAC,CAAC,GAAG;CACf,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAwB,EACxB,IAAI,GAA2B,EAAE;IAEjC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,2BAA2B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,mBAAmB,EAAE,GAAG,EAAE,CACrD,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,SAAS,EAAE,CAAC,CACnD,CAAC;IACF,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAChC,IAAI,CAAC,eAAe,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAC5C,IAAI,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,YAAY,MAAM,CAAC,OAAO,CAAC,qBAAqB,IAAI,CAAC,CAAC;IACvH,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;QAC/B,IAAI,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IAC3E,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACxC,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,KAAK,CACH,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACjC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;QACzD,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAChF,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAChF,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;KAChD,CAAC,CAAC,EACH,CAAC,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAwB,EACxB,IAAI,GAAsB,EAAE;IAE5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAClD,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,CAAC,CAC9C,CAAC;IACF,MAAM,CAAC,gCAAgC,IAAI,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,UAAU,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IAC5B,IAAI,GAAG,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;QACpB,IAAI,CAAC,QAAQ,CAAC,CAAC;QACf,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,KAAK,CACH,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC9B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;QACzD,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAChF,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;KACjF,CAAC,CAAC,EACH,CAAC,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,CAAC,CAChD,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,8EAA8E;AAC9E,+EAA+E;AAC/E,wEAAwE;AACxE,4EAA4E;AAC5E,uBAAuB;AAEvB,MAAM,WAAW,GAAG,CAAC,GAAY,EAAU,EAAE,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AAEtG,SAAS,MAAM,CAAC,GAAuB;IACrC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,WAAW,CAAC,IAAqC,EAAE,KAAa;IACvE,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5B,KAAK,CAAC,KAAK,CAAC,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IAC5G,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,iCAAiC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAA4B;IAC9C,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,EAAE,CAAC,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;IACxD,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACvI,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ;QAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACzF,CAAC;AAED,4CAA4C;AAC5C,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,MAAwB;IACnE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,+BAA+B,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7G,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,uHAAuH,CAAC,CAAC;YAC9H,OAAO;QACT,CAAC;QACD,KAAK,CACH,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACnB,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;YACtB,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC/C,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,kBAAkB,EAAE;YACvI,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;YACrD,MAAM,EAAE,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;SACnH,CAAC,CAAC,EACH,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAC3D,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAwB,EACxB,IAAI,GAAmD,EAAE;IAEzD,MAAM,KAAK,GAAG,+FAA+F,CAAC;IAC9G,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG;QAAE,OAAO;IACjB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,yBAAyB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;QACxH,OAAO,CAAC,gBAAgB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QACvE,UAAU,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAwB,EACxB,KAAa,EACb,IAAI,GAAmD,EAAE;IAEzD,MAAM,KAAK,GAAG,uGAAuG,CAAC;IACtH,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG;QAAE,OAAO;IACjB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,yBAAyB,EAAE,GAAG,EAAE,CACzD,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CACrF,CAAC;QACF,OAAO,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;QACvC,UAAU,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,2DAA2D;AAC3D,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,MAAwB,EAAE,KAAa,EAAE,IAAI,GAAsB,EAAE;IAClH,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC,2DAA2D,CAAC,CAAC;IACnF,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,wCAAwC,EAAE,sCAAsC,EAAE,EAAE,CAAC,CAAC;QACnH,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;YAChC,IAAI,CAAC,UAAU,CAAC,CAAC;YACjB,OAAO;QACT,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,0BAA0B,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9F,OAAO,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC"}

package/dist/commands/databaseAccess.d.ts

@@ -0,0 +1,37 @@
+import type { DatabaseImportOptions } from '@ninedeploy/sdk';
+import type { NineDeployClient } from '../client.js';
+export interface PublicAccessOptions {
+    enable?: boolean;
+    disable?: boolean;
+    port?: string;
+    allow?: string[];
+    tls?: string;
+    tlsHost?: string;
+}
+/** `ninedeploy databases public-access <id> [...]` — show, enable/update, or disable. */
+export declare function databasePublicAccess(client: NineDeployClient, idArg: string, opts?: PublicAccessOptions): Promise<void>;
+export interface ImportCliOptions {
+    file?: string;
+    fromS3?: string;
+    key?: string;
+    clean?: boolean;
+    /** commander `--no-single-transaction`: false only when the flag is given. */
+    singleTransaction?: boolean;
+    drop?: boolean;
+    confirmReplace?: boolean;
+    /** commander `--no-safety-backup`: false only when the flag is given. */
+    safetyBackup?: boolean;
+    resume?: string;
+    /** commander `--no-wait`. */
+    wait?: boolean;
+}
+/** Only the keys the user set: the server refuses keys that do not apply to the engine. */
+export declare function importOptionsFrom(opts: ImportCliOptions): DatabaseImportOptions;
+/** `ninedeploy databases import <id> --file <path> | --from-s3 <destId> --key <key>` */
+export declare function databaseImport(client: NineDeployClient, idArg: string, opts?: ImportCliOptions): Promise<void>;
+/** `ninedeploy databases imports <id> [--watch]` */
+export declare function databaseImports(client: NineDeployClient, idArg: string, opts?: {
+    watch?: boolean;
+    intervalMs?: number;
+}): Promise<void>;
+//# sourceMappingURL=databaseAccess.d.ts.map