orch-mini 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Fabian Giordano
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,191 @@
+# om
+
+Orquestador declarativo mínimo: un `stack.yaml` describe la arquitectura, el CLI renderiza `docker-compose.yaml` + `nginx.conf` + scripts y levanta el stack.
+
+Pensado para stacks chicos donde el orch completo (engine + launcher + profiles + SOPS + k8s + …) es demasiada maquinaria.
+
+## Requisitos
+
+- Node 18+ (Mac / Linux / Windows)
+- Docker Desktop o Docker Engine + Compose plugin
+
+## Instalación
+
+```bash
+npm install
+npm link               # registra el comando `om` globalmente
+```
+
+Funciona igual en Mac, Linux y Windows — `npm link` crea el wrapper apropiado por OS.
+
+## Layout del proyecto
+
+```
+mi-app/
+├── arch/                       # toda la definición de arquitectura
+│   ├── stack.yaml
+│   ├── init/                   # archivos auxiliares montados como volúmenes
+│   ├── certs/                  # claves públicas .pem (versionables)
+│   └── secrets/                # claves privadas .pem (gitignored)
+├── repos/                      # gitignored (clones de los repos del stack)
+└── .stack/                     # gitignored (output del gen)
+```
+
+`om` reconoce `arch/stack.yaml` automáticamente — `repos/` y `.stack/` se anclan al padre. También se puede tener `stack.yaml` en la raíz directamente (sin `arch/`), si el stack es muy simple.
+
+## Flujo end-to-end
+
+```bash
+mkdir mi-app && cd mi-app
+om init                # crea arch/stack.yaml + arch/{init,certs,secrets}/
+om sync                # clone/pull de los repos declarados → repos/
+om gen                 # render → .stack/
+om up                  # docker compose up -d
+om logs api            # seguir logs del service api
+om stop                # parar sin remove
+om restart api         # reiniciar un service
+om down                # tear down completo
+```
+
+Sin path explícito, `om` busca el `stack.yaml` más cercano subiendo desde la carpeta actual.
+
+## Inyectar archivos en env vars
+
+Para PEMs, certs, secrets o cualquier archivo cuyo contenido tenga que ir en una env var del container:
+
+```yaml
+services:
+  api:
+    env:
+      CHAT_OS_SIGNING_PRIVATE_KEY_PEM: ${file:secrets/chat-os-signing-private.pem}
+      CHAT_OS_PUBLIC_KEY_PEM: ${file:certs/chat-os-signing-public.pem}
+```
+
+El path es relativo al `stack.yaml`. El contenido se inline al `environment:` del container en tiempo de render.
+
+## Crear DBs declarativamente
+
+Para services postgres, listá las DBs lógicas en `databases:`. `om` genera un script SQL idempotente y lo auto-monta en `/docker-entrypoint-initdb.d/`:
+
+```yaml
+services:
+  chat-os-db:
+    image: postgres:16-alpine
+    port: 5432
+    env:
+      POSTGRES_USER: chat_os
+      POSTGRES_PASSWORD: chat_os
+    databases:
+      - chat_os_dev
+      - chat_os_implementation_dev
+```
+
+**Limitación**: postgres solo ejecuta `/docker-entrypoint-initdb.d/` cuando el data volume está vacío. Si más adelante agregás una DB nueva al stack y el volume ya existe, el script no se va a ejecutar. Para ese caso, usar `kind: oneshot` (ver abajo).
+
+## Init jobs con `kind: oneshot`
+
+Un service `oneshot` corre una vez, termina, y los services que lo necesitan esperan a que termine OK antes de arrancar (vía docker compose `service_completed_successfully`).
+
+Útil para: seeds de DB, migraciones one-shot, crear DBs en un postgres pre-existente, etc.
+
+```yaml
+services:
+  chat-os-db:
+    image: postgres:16-alpine
+    ...
+
+  chat-os-db-bootstrap:
+    kind: oneshot
+    image: postgres:16-alpine
+    needs: [chat-os-db]
+    command:
+      - sh
+      - -c
+      - |
+        until pg_isready -h chat-os-db -U chat_os; do sleep 1; done
+        psql -h chat-os-db -U chat_os -d postgres -tc \
+          "SELECT 1 FROM pg_database WHERE datname='extra_db'" | grep -q 1 \
+          || psql -h chat-os-db -U chat_os -d postgres -c "CREATE DATABASE extra_db"
+    env:
+      PGPASSWORD: chat_os
+
+  # otros services que dependen de la DB ya bootstrap-eada:
+  app:
+    image: node:20
+    needs: [chat-os-db-bootstrap]   # espera service_completed_successfully
+    ...
+```
+
+## Montar archivos como volúmenes
+
+Para init scripts u otros archivos que el container espera leer del filesystem (ej `/docker-entrypoint-initdb.d/`), usar `${STACK_DIR}` que apunta al dir del `stack.yaml`:
+
+```yaml
+services:
+  db:
+    image: postgres:16
+    volumes:
+      - ${STACK_DIR}/init/init-dbs.sql:/docker-entrypoint-initdb.d/01-init.sql:ro
+```
+
+## Comandos
+
+| comando | descripción |
+|---|---|
+| `init` | crea `stack.yaml` template en la carpeta actual |
+| `sync` | clone/pull de los repos declarados en `services.*.repo` |
+| `gen [path] [--out dir]` | rinde `docker-compose.yaml` + `nginx.conf` + scripts en `.stack/` |
+| `validate [path]` | solo valida el schema del stack |
+| `up [args]` | `docker compose up -d` |
+| `down [args]` | `docker compose down` (remueve containers) |
+| `stop [args]` | `docker compose stop` (preserva containers) |
+| `restart [svc]` | `docker compose restart` |
+| `build [svc]` | `docker compose build` |
+| `logs [svc]` | `docker compose logs -f --tail=200` |
+| `ps` | `docker compose ps` |
+
+## Forma del stack.yaml
+
+```yaml
+name: mi-app
+gateway:
+  port: 8080
+  routes:
+    - path: /api
+      service: api
+    - path: /
+      service: web
+
+services:
+  api:
+    repo: github.com/me/api
+    build: ./Dockerfile
+    port: 3000
+    env:
+      DATABASE_URL: postgres://db:5432/app
+    needs: [db]
+
+  web:
+    repo: github.com/me/web
+    build: ./Dockerfile
+    port: 3001
+    env:
+      API_URL: http://api:3000
+
+  db:
+    image: postgres:16
+    port: 5432
+    expose_host: 5433
+    env:
+      POSTGRES_DB: app
+      POSTGRES_PASSWORD: app
+```
+
+## Output (en `.stack/`)
+
+- `docker-compose.yaml` — listo para `docker compose up`
+- `nginx.conf` — gateway con upstreams resueltos (si declaraste `gateway`)
+- `.env` — vars que el compose interpola
+- `scripts/<svc>.sh` y `scripts/<svc>.ps1` — correr el módulo nativo (sin docker), con env apuntando al resto del stack. Bash para Mac/Linux, PowerShell para Windows.
+
+Para acciones sobre el stack entero (`up`, `down`, `logs`, `ps`) usá el CLI directamente — funciona igual en los tres OS.

package/bin/om.cjs

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+// Shim cross-platform: registra el loader CJS de tsx y require el cli TS directo.
+// Evita spawn-ear `tsx` por path (que se rompe en Windows con .cmd vs binario raw).
+const path = require('node:path');
+
+require('tsx/cjs');
+require(path.join(__dirname, '..', 'src', 'cli.ts'));

package/package.json

@@ -0,0 +1,55 @@
+{
+  "name": "orch-mini",
+  "version": "0.1.0",
+  "description": "Orquestador declarativo mínimo: un stack.yaml describe la arquitectura, om renderiza docker-compose + nginx + scripts y levanta el stack.",
+  "type": "module",
+  "engines": {
+    "node": ">=18"
+  },
+  "bin": {
+    "om": "bin/om.cjs"
+  },
+  "files": [
+    "bin",
+    "src",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "dev": "tsx src/cli.ts",
+    "typecheck": "tsc --noEmit",
+    "gen:example": "tsx src/cli.ts gen examples/simple/stack.yaml"
+  },
+  "keywords": [
+    "docker-compose",
+    "orchestrator",
+    "stack",
+    "nginx",
+    "yaml",
+    "cli",
+    "devops",
+    "monorepo"
+  ],
+  "author": "Fabian Giordano <fgiordano@naturapy.net>",
+  "license": "MIT",
+  "homepage": "https://github.com/logieinc/orch-mini#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/logieinc/orch-mini.git"
+  },
+  "bugs": {
+    "url": "https://github.com/logieinc/orch-mini/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "tsx": "^4.19.0",
+    "yaml": "^2.6.0",
+    "zod": "^3.23.0"
+  },
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "typescript": "^5.6.0"
+  }
+}

package/src/cli.ts

@@ -0,0 +1,262 @@
+import { spawnSync } from 'node:child_process';
+import { chmodSync, existsSync, mkdirSync, writeFileSync } from 'node:fs';
+import { dirname, join, relative, resolve } from 'node:path';
+import { initStack } from './init.js';
+import { loadStack, type LoadedStack } from './parser.js';
+import { renderCompose } from './renderer/compose.js';
+import { renderDbInit } from './renderer/db-init.js';
+import { renderEnv } from './renderer/env.js';
+import { renderNginx } from './renderer/nginx.js';
+import { renderScripts } from './renderer/scripts.js';
+import { renderVscodeLaunch } from './renderer/vscode.js';
+import { syncStack, type SyncResult } from './sync.js';
+
+const COMMANDS = [
+  'init',
+  'sync',
+  'gen',
+  'validate',
+  'vscode',
+  'up',
+  'down',
+  'stop',
+  'restart',
+  'build',
+  'logs',
+  'ps',
+  'help',
+] as const;
+type Command = (typeof COMMANDS)[number];
+
+function printUsage(): void {
+  console.log(`om — orquestador declarativo mínimo
+
+setup:
+  om init                              crea un stack.yaml template en la carpeta actual
+  om sync                              clone/pull de los repos declarados (services.*.repo)
+  om gen [stack.yaml] [--out <dir>]    rinde compose + nginx + scripts en .stack/
+  om validate [stack.yaml]             solo valida el stack
+  om vscode                            genera .vscode/launch.json (attach + browser)
+
+runtime:
+  om up [args...]                      docker compose up -d
+  om down [args...]                    docker compose down (remueve containers)
+  om stop [args...]                    docker compose stop (sin remove)
+  om restart [service]                 docker compose restart
+  om build [service]                   docker compose build
+  om logs [service]                    docker compose logs -f --tail=200
+  om ps                                docker compose ps
+
+  om help                              muestra esta ayuda
+
+Sin path explícito, busca el stack.yaml más cercano subiendo desde la carpeta actual.
+`);
+}
+
+function main(argv: string[]): number {
+  const [cmd, ...rest] = argv;
+
+  if (!cmd || cmd === 'help' || cmd === '--help' || cmd === '-h') {
+    printUsage();
+    return 0;
+  }
+
+  if (!COMMANDS.includes(cmd as Command)) {
+    console.error(`comando desconocido: ${cmd}\n`);
+    printUsage();
+    return 1;
+  }
+
+  try {
+    switch (cmd as Command) {
+      case 'init':
+        return runInit();
+      case 'sync':
+        return runSync();
+      case 'validate':
+        return runValidate(rest);
+      case 'gen':
+        return runGen(rest);
+      case 'vscode':
+        return runVscode();
+      case 'up':
+        return runDockerCompose(['up', '-d', ...rest]);
+      case 'down':
+        return runDockerCompose(['down', ...rest]);
+      case 'stop':
+        return runDockerCompose(['stop', ...rest]);
+      case 'restart':
+        return runDockerCompose(['restart', ...rest]);
+      case 'build':
+        return runDockerCompose(['build', ...rest]);
+      case 'logs':
+        return runDockerCompose(['logs', '-f', '--tail=200', ...rest]);
+      case 'ps':
+        return runDockerCompose(['ps', ...rest]);
+    }
+  } catch (err) {
+    console.error(err instanceof Error ? err.message : String(err));
+    return 1;
+  }
+  return 1;
+}
+
+function parseStackArg(args: string[]): { stackPath: string | undefined; rest: string[] } {
+  if (args[0] && !args[0].startsWith('-')) {
+    return { stackPath: args[0], rest: args.slice(1) };
+  }
+  return { stackPath: undefined, rest: args };
+}
+
+function runInit(): number {
+  const result = initStack(process.cwd());
+  if (result.created) {
+    console.log(`✓ ${result.message}`);
+    return 0;
+  }
+  console.error(result.message);
+  return 1;
+}
+
+function runSync(): number {
+  const loaded = loadStack(undefined);
+  const reposDir = resolve(loaded.workspaceRoot, 'repos');
+  mkdirSync(reposDir, { recursive: true });
+
+  console.log(
+    `sync de ${Object.keys(loaded.stack.services).length} services en ${
+      relative(process.cwd(), reposDir) || '.'
+    }`,
+  );
+
+  const results = syncStack(loaded.stack, { workDir: loaded.workspaceRoot, reposDir });
+
+  let failed = 0;
+  for (const r of results) {
+    const icon = iconFor(r);
+    const detail = r.message ? ` — ${r.message}` : '';
+    console.log(`  ${icon} ${r.service.padEnd(20)} ${r.action}${detail}`);
+    if (r.action === 'failed' || r.action === 'local-missing') failed++;
+  }
+
+  return failed > 0 ? 1 : 0;
+}
+
+function iconFor(r: SyncResult): string {
+  switch (r.action) {
+    case 'cloned':
+    case 'pulled':
+    case 'switched':
+    case 'local-ok':
+      return '✓';
+    case 'skipped-no-repo':
+    case 'skipped-dup':
+      return '·';
+    case 'failed':
+    case 'local-missing':
+      return '✗';
+  }
+}
+
+function runValidate(args: string[]): number {
+  const { stackPath } = parseStackArg(args);
+  const { stack } = loadStack(stackPath);
+  console.log(`✓ ${stack.name} — ${Object.keys(stack.services).length} services`);
+  return 0;
+}
+
+function runVscode(): number {
+  const loaded = loadStack(undefined);
+  const vscodeDir = resolve(loaded.workspaceRoot, '.vscode');
+  mkdirSync(vscodeDir, { recursive: true });
+  const target = join(vscodeDir, 'launch.json');
+  const content = renderVscodeLaunch(loaded.stack);
+  writeFileSync(target, content);
+
+  const debugCount = Object.values(loaded.stack.services).filter((s) => s.debug_port).length;
+  const browserCount = Object.values(loaded.stack.services).filter((s) => s.vscode?.browser).length;
+
+  console.log(`✓ generado ${relative(process.cwd(), target)}`);
+  console.log(`  ${debugCount} attach configs · ${browserCount} browser launchers`);
+  return 0;
+}
+
+function runGen(args: string[]): number {
+  const { stackPath, rest } = parseStackArg(args);
+  const outIdx = rest.indexOf('--out');
+  const explicitOut = outIdx >= 0 ? rest[outIdx + 1] : undefined;
+
+  const loaded = loadStack(stackPath);
+  const outDir = resolve(explicitOut ?? loaded.outDir);
+  const reposDir = resolve(loaded.workspaceRoot, 'repos');
+
+  mkdirSync(outDir, { recursive: true });
+
+  const files: Array<{ path: string; content: string; mode?: number }> = [
+    { path: 'docker-compose.yaml', content: renderCompose(loaded.stack) },
+    { path: '.env', content: renderEnv(loaded.stack, { reposDir, stackDir: loaded.workDir }) },
+  ];
+
+  if (loaded.stack.gateway) {
+    files.push({ path: 'nginx.conf', content: renderNginx(loaded.stack) });
+  }
+
+  for (const dbInit of renderDbInit(loaded.stack)) {
+    files.push({ path: dbInit.path, content: dbInit.content });
+  }
+
+  for (const script of renderScripts(loaded.stack)) {
+    files.push({
+      path: script.path,
+      content: script.content,
+      ...(script.executable ? { mode: 0o755 } : {}),
+    });
+  }
+
+  for (const file of files) {
+    const fullPath = join(outDir, file.path);
+    mkdirSync(dirname(fullPath), { recursive: true });
+    writeFileSync(fullPath, file.content);
+    if (file.mode !== undefined) chmodSync(fullPath, file.mode);
+  }
+
+  console.log(`✓ render completo en ${relative(process.cwd(), outDir) || '.'}`);
+  console.log(
+    `  ${files.length} archivos · ${Object.keys(loaded.stack.services).length} services${
+      loaded.stack.gateway ? ' · gateway' : ''
+    }`,
+  );
+  return 0;
+}
+
+function runDockerCompose(dockerArgs: string[]): number {
+  const loaded = loadStack(undefined);
+  ensureGenerated(loaded);
+
+  const composePath = join(loaded.outDir, 'docker-compose.yaml');
+  const envPath = join(loaded.outDir, '.env');
+
+  const res = spawnSync(
+    'docker',
+    ['compose', '--env-file', envPath, '-f', composePath, ...dockerArgs],
+    { stdio: 'inherit' },
+  );
+
+  if (res.error) {
+    console.error(`error ejecutando docker compose: ${res.error.message}`);
+    return 1;
+  }
+  return res.status ?? 1;
+}
+
+function ensureGenerated(loaded: LoadedStack): void {
+  const composePath = join(loaded.outDir, 'docker-compose.yaml');
+  if (!existsSync(composePath)) {
+    throw new Error(
+      `no se encuentra ${relative(process.cwd(), composePath)}\n` +
+        `correr 'om gen' primero`,
+    );
+  }
+}
+
+process.exit(main(process.argv.slice(2)));

package/src/discover.ts

@@ -0,0 +1,26 @@
+import { existsSync } from 'node:fs';
+import { dirname, join, parse } from 'node:path';
+
+export const STACK_FILENAME = 'stack.yaml';
+// Subdirs convencionales donde el stack.yaml puede vivir agrupado con archivos
+// auxiliares (init scripts, certs, secrets). Si lo encuentra ahí, el padre se
+// trata como workspaceRoot (donde van repos/ y .stack/).
+export const STACK_SUBDIRS = ['arch'] as const;
+
+export function findStack(startDir: string = process.cwd()): string | null {
+  let dir = startDir;
+  const root = parse(dir).root;
+  while (true) {
+    for (const candidate of candidatesIn(dir)) {
+      if (existsSync(candidate)) return candidate;
+    }
+    if (dir === root) return null;
+    const parent = dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+
+function candidatesIn(dir: string): string[] {
+  return [join(dir, STACK_FILENAME), ...STACK_SUBDIRS.map((s) => join(dir, s, STACK_FILENAME))];
+}

package/src/file-refs.ts

@@ -0,0 +1,34 @@
+import { readFileSync } from 'node:fs';
+import { isAbsolute, resolve } from 'node:path';
+
+// Patrón ${file:<path>} — todo el string. No se soporta interpolación parcial
+// (un PEM no se va a embeber en medio de otra cosa).
+const FILE_REF = /^\$\{file:([^}]+)\}$/;
+
+// Reemplaza valores ${file:path} por el contenido del archivo (paths
+// relativos al workDir del stack). Recorre objetos y arrays recursivamente.
+export function expandFileRefs(value: unknown, workDir: string): unknown {
+  if (typeof value === 'string') {
+    const m = FILE_REF.exec(value);
+    if (!m) return value;
+    const rel = m[1]!.trim();
+    const abs = isAbsolute(rel) ? rel : resolve(workDir, rel);
+    try {
+      return readFileSync(abs, 'utf8');
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      throw new Error(`\${file:${rel}}: no se pudo leer ${abs} — ${msg}`);
+    }
+  }
+  if (Array.isArray(value)) {
+    return value.map((v) => expandFileRefs(v, workDir));
+  }
+  if (value !== null && typeof value === 'object') {
+    const out: Record<string, unknown> = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = expandFileRefs(v, workDir);
+    }
+    return out;
+  }
+  return value;
+}

package/src/init.ts

@@ -0,0 +1,91 @@
+import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const TEMPLATE = `# stack.yaml — describí la arquitectura acá, después corré: om sync && om gen && om up
+#
+# Layout: este archivo vive en arch/stack.yaml. om reconoce arch/ automáticamente —
+# repos/ y .stack/ quedan en el padre.
+#   arch/
+#   ├── stack.yaml       (este archivo)
+#   ├── init/            (archivos auxiliares montados como volúmenes, ej init scripts de DB)
+#   ├── certs/           (claves públicas .pem versionables, leídas con \${file:certs/...})
+#   └── secrets/         (claves privadas .pem gitignored, leídas con \${file:secrets/...})
+
+name: mi-stack
+
+# gateway: opcional. Si lo declarás, om levanta nginx y rutea por path.
+# Quitalo si tu stack no necesita un proxy.
+gateway:
+  port: 8080
+  routes:
+    - path: /api
+      service: api
+    - path: /
+      service: web
+
+services:
+  api:
+    repo: github.com/me/api          # se clona en repos/api con 'om sync'
+    build: ./Dockerfile
+    port: 3000
+    env:
+      DATABASE_URL: postgres://app:app@db:5432/app
+      # Referencias a otros services por nombre: el container "db" resuelve internamente.
+    needs:
+      - db
+
+  web:
+    repo: github.com/me/web
+    build: ./Dockerfile
+    port: 3001
+    env:
+      API_URL: http://api:3000
+      # Para hablar desde el browser pasá por el gateway:
+      PUBLIC_API_URL: http://localhost:8080/api
+
+  db:
+    image: postgres:16-alpine
+    port: 5432
+    expose_host: 5433                # opcional: publicar al host (psql -h localhost -p 5433)
+    env:
+      POSTGRES_DB: app
+      POSTGRES_USER: app
+      POSTGRES_PASSWORD: app
+    volumes:
+      - mi-stack-db:/var/lib/postgresql/data
+`;
+
+const SECRETS_GITIGNORE = `# Las claves privadas no se commitean. Solo este archivo queda en git.
+*
+!.gitignore
+`;
+
+const ROOT_GITIGNORE = `repos/
+.stack/
+`;
+
+export function initStack(targetDir: string): { path: string; created: boolean; message: string } {
+  const archDir = join(targetDir, 'arch');
+  const target = join(archDir, 'stack.yaml');
+  if (existsSync(target)) {
+    return { path: target, created: false, message: `ya existe ${target}` };
+  }
+
+  mkdirSync(join(archDir, 'init'), { recursive: true });
+  mkdirSync(join(archDir, 'certs'), { recursive: true });
+  mkdirSync(join(archDir, 'secrets'), { recursive: true });
+
+  writeFileSync(target, TEMPLATE);
+  writeFileSync(join(archDir, 'secrets', '.gitignore'), SECRETS_GITIGNORE);
+
+  const rootGitignore = join(targetDir, '.gitignore');
+  if (!existsSync(rootGitignore)) {
+    writeFileSync(rootGitignore, ROOT_GITIGNORE);
+  }
+
+  return {
+    path: target,
+    created: true,
+    message: `creado ${target} y arch/{init,certs,secrets}/ — editá el yaml y corré 'om sync && om gen && om up'`,
+  };
+}