@caelo-cms/provisioning 0.10.43 → 0.10.46

package/dist/compose.js

@@ -3,12 +3,57 @@
  * P14 — production docker-compose.yml generator.
  *
  * Emits the production stack: Postgres + pgBackRest sidecar + Caddy +
- * MinIO + four Caelo services (admin, gateway, orchestrator, runner).
- * Idempotent: same input → byte-identical output. The CLI's `up`
- * sub-command writes this to `<repo>/.caelo/docker-compose.yml` and
- * runs `docker compose up -d`.
+ * MinIO + the two Caelo services (admin, gateway). Idempotent: same input →
+ * byte-identical output. The CLI's `init` / `up` / `upgrade` sub-commands
+ * write this to `.caelo/docker-compose.yml`.
+ *
+ * #696 — the admin and gateway run the PREBUILT, cosign-verified release
+ * images, pinned by digest (CLAUDE.md §11.C: "a PR that requires the user to
+ * run docker build is a regression"). Nothing of a Caelo source checkout is
+ * mounted. The digest pin is what `upgrade` moves; a tag would let a
+ * `docker compose pull` change the running release behind the operator's
+ * back. Contributors who want their working tree in the containers ask for
+ * {@link DevImages} explicitly (`init --dev`) — never the default.
  */
 import { ADMIN_MEMORY_DEFAULT, memoryQuantityMiB, publicSiteUrl } from "./stack-contract.js";
+import { ghcrRepository, isImageDigest } from "./upgrade/release-images.js";
+/** The admin's HTTP port inside the Compose network (the Caddyfile proxies to it). */
+export const COMPOSE_ADMIN_PORT = 5173;
+/** `.caelo/<this>/` holds the pending Owner-bootstrap token the admin consumes. */
+export const BOOTSTRAP_DIR = "bootstrap";
+/**
+ * Where the host's `.caelo/output/` appears in the admin (read-write, the
+ * generator's output root) and in Caddy (read-only). The seeded deploy
+ * targets' `out_dir` (`output/<env>`) resolves below it, which is where the
+ * Caddyfile's site roots point (`/srv/caelo/output/<env>/current`).
+ */
+export const SITE_OUTPUT_ROOT = "/srv/caelo";
+/** `.caelo/<this>/` holds the uploaded media (the admin's local media adapter root). */
+export const MEDIA_DIR = "media";
+/** Where {@link MEDIA_DIR} appears in the admin container (its `MEDIA_ROOT_DIR`). */
+export const MEDIA_ROOT = "/data/media";
+/** The gateway's HTTP port inside the Compose network. */
+export const COMPOSE_GATEWAY_PORT = 8090;
+/**
+ * `ghcr.io/caelo-cms/<service>@<digest>` — the only image reference shape a
+ * release-mode Compose file accepts.
+ */
+export function ghcrImageRef(service, digest) {
+    if (!isImageDigest(digest))
+        throw new Error(`not an image digest: ${JSON.stringify(digest)}`);
+    return `${ghcrRepository(service)}@${digest}`;
+}
+/**
+ * The digest of a release image reference, or null when `ref` is not a
+ * digest-pinned reference to that service's Caelo repository.
+ */
+export function ghcrImageDigest(service, ref) {
+    const prefix = `${ghcrRepository(service)}@`;
+    if (!ref.startsWith(prefix))
+        return null;
+    const digest = ref.slice(prefix.length);
+    return isImageDigest(digest) ? digest : null;
+}
 export function generateDockerCompose(spec) {
     const adminMemory = spec.adminMemory ?? ADMIN_MEMORY_DEFAULT;
     const adminMemoryMiB = memoryQuantityMiB(adminMemory);
@@ -70,52 +115,90 @@ services:
       - ./Caddyfile:/etc/caddy/Caddyfile:ro
       - caelo-caddy-data:/data
       - caelo-caddy-config:/config
-      - ./output:/srv/caelo:ro
+      - ./output:${SITE_OUTPUT_ROOT}:ro
+
+${adminService(spec, adminMemoryMiB, env)}
 
-  caelo-admin:
-    image: oven/bun:1.3
+${gatewayService(spec)}
+
+volumes:
+  caelo-pg:
+  caelo-pg-backups:
+  caelo-minio:
+  caelo-caddy-data:
+  caelo-caddy-config:
+`;
+}
+/**
+ * How a Caelo service's container starts: its image and, in dev mode, the
+ * checkout. `mounts` are extra bind mounts the service needs in both modes.
+ */
+function serviceRuntime(images, service, devCommand, mounts = []) {
+    const volumes = (list) => list.length === 0 ? [] : ["    volumes:", ...list.map((m) => `      - ${m}`)];
+    if (images.mode === "dev") {
+        return [
+            "    # DEV MODE (cms-provision init --dev): runs the Caelo checkout this",
+            "    # .caelo/ dir lives in. Contributors only — never an end-user install.",
+            "    image: oven/bun:1.4.2",
+            "    working_dir: /app",
+            `    command: ${devCommand}`,
+            ...volumes(["../..:/app", ...mounts]),
+        ].join("\n");
+    }
+    const digest = ghcrImageDigest(service, images[service]);
+    if (!digest) {
+        throw new Error(`${service} image ${JSON.stringify(images[service])} is not ${ghcrRepository(service)}@sha256:<digest>`);
+    }
+    // The image's own CMD starts the service; no source is mounted.
+    return [`    image: ${ghcrImageRef(service, digest)}`, ...volumes(mounts)].join("\n");
+}
+function adminService(spec, adminMemoryMiB, env) {
+    return `  caelo-admin:
+${serviceRuntime(spec.images, "admin", `sh -c "cd apps/admin && bunx svelte-kit sync && bun --bun vite dev --host 0.0.0.0 --port ${COMPOSE_ADMIN_PORT}"`, 
+    // The Owner-bootstrap token handoff: `init` writes the token to
+    // `.caelo/bootstrap/pending-token.json`; the admin reads (and deletes) it
+    // from `/app/.caelo/` on first boot (hooks.server.ts). Only that dir is
+    // mounted — never `.caelo/` itself, which holds config.json's superuser
+    // and MinIO passwords. Without the token /setup accepts any first Owner.
+    // The static site: the admin builds into it (CAELO_OUTPUT_ROOT below),
+    // Caddy serves it read-only from the same host dir. On the host, so a
+    // recreated admin (upgrade) keeps the published site.
+    // Uploaded media (MEDIA_ROOT_DIR below) likewise lives on the host.
+    [
+        `./${BOOTSTRAP_DIR}:/app/.caelo`,
+        `./output:${SITE_OUTPUT_ROOT}`,
+        `./${MEDIA_DIR}:${MEDIA_ROOT}`,
+    ])}
     container_name: caelo-admin
     restart: unless-stopped
     depends_on:
       postgres: { condition: service_healthy }
-    working_dir: /app
-    volumes:
-      - ../..:/app
-    command: bun run --filter @caelo-cms/admin start
     mem_reservation: ${adminMemoryMiB}m
     environment:
       ADMIN_DATABASE_URL: "${dbUrl("admin_role", spec.rolePasswords.admin, "cms_admin")}"
       PUBLIC_ADMIN_DATABASE_URL: "${dbUrl("admin_role", spec.rolePasswords.admin, "cms_public")}"
       CAELO_SECRET_KEK: "${escapeYaml(spec.caeloSecretKek)}"
       CAELO_SITE_URL: "${escapeYaml(publicSiteUrl(spec.domain))}"
+      PORT: "${COMPOSE_ADMIN_PORT}"
+      CAELO_OUTPUT_ROOT: "${SITE_OUTPUT_ROOT}"
+      MEDIA_ROOT_DIR: "${MEDIA_ROOT}"
       NODE_ENV: production
 ${env("ANTHROPIC_API_KEY", spec.anthropicApiKey)}
-${env("RESEND_API_KEY", spec.resendApiKey)}
-
-  caelo-gateway:
-    image: oven/bun:1.3
+${env("RESEND_API_KEY", spec.resendApiKey)}`;
+}
+function gatewayService(spec) {
+    return `  caelo-gateway:
+${serviceRuntime(spec.images, "gateway", "bun run apps/api-gateway/src/server.ts")}
     container_name: caelo-gateway
     restart: unless-stopped
     depends_on:
       postgres: { condition: service_healthy }
-    working_dir: /app
-    volumes:
-      - ../..:/app
-    command: bun run apps/api-gateway/src/server.ts
     environment:
       # Its own two logins only — no authoring credential (#613, CLAUDE.md §2).
       GATEWAY_DATABASE_URL: "${dbUrl("gateway_role", spec.rolePasswords.gateway, "cms_admin")}"
       PUBLIC_DATABASE_URL: "${dbUrl("public_role", spec.rolePasswords.public, "cms_public")}"
-      GATEWAY_PORT: "8090"
-      NODE_ENV: production
-
-volumes:
-  caelo-pg:
-  caelo-pg-backups:
-  caelo-minio:
-  caelo-caddy-data:
-  caelo-caddy-config:
-`;
+      GATEWAY_PORT: "${COMPOSE_GATEWAY_PORT}"
+      NODE_ENV: production`;
 }
 /** A compose-network database URL, password URL-encoded and YAML-escaped. */
 function dbUrl(role, password, database) {

package/dist/compose.js.map

@@ -1 +1 @@
-{"version":3,"file":"compose.js","sourceRoot":"","sources":["../src/compose.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;GAQG;AAEH,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAuC7F,MAAM,UAAU,qBAAqB,CAAC,IAAiB;IACrD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,oBAAoB,CAAC;IAC7D,MAAM,cAAc,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IACtD,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,gBAAgB,WAAW,uCAAuC,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,CAAqB,EAAU,EAAE,CACvD,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,OAAO;;YAEG,IAAI,CAAC,MAAM;;;;;;;;4BAQK,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC;;;8BAG/B,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;+BACnC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;gCACpC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;0BAyB5C,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC;8BAC1B,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;uBAyBzC,cAAc;;6BAER,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,WAAW,CAAC;oCACnD,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,YAAY,CAAC;2BACpE,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC;yBACjC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;;EAE7D,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,eAAe,CAAC;EAC9C,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,YAAY,CAAC;;;;;;;;;;;;;;+BAcX,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,WAAW,CAAC;8BAC/D,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,YAAY,CAAC;;;;;;;;;;CAU1F,CAAC;AACF,CAAC;AAED,6EAA6E;AAC7E,SAAS,KAAK,CAAC,IAAY,EAAE,QAAgB,EAAE,QAAgB;IAC7D,OAAO,UAAU,CAAC,cAAc,IAAI,IAAI,kBAAkB,CAAC,QAAQ,CAAC,kBAAkB,QAAQ,EAAE,CAAC,CAAC;AACpG,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,sDAAsD;IACtD,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACvD,CAAC"}
+{"version":3,"file":"compose.js","sourceRoot":"","sources":["../src/compose.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC7F,OAAO,EAAE,cAAc,EAAE,aAAa,EAAuB,MAAM,6BAA6B,CAAC;AAoBjG,sFAAsF;AACtF,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AACvC,mFAAmF;AACnF,MAAM,CAAC,MAAM,aAAa,GAAG,WAAW,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAE7C,wFAAwF;AACxF,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC;AACjC,qFAAqF;AACrF,MAAM,CAAC,MAAM,UAAU,GAAG,aAAa,CAAC;AAExC,0DAA0D;AAC1D,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAEzC;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,OAAuB,EAAE,MAAc;IAClE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9F,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,MAAM,EAAE,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,OAAuB,EAAE,GAAW;IAClE,MAAM,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC;IAC7C,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAyCD,MAAM,UAAU,qBAAqB,CAAC,IAAiB;IACrD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,oBAAoB,CAAC;IAC7D,MAAM,cAAc,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IACtD,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,gBAAgB,WAAW,uCAAuC,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,CAAqB,EAAU,EAAE,CACvD,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,OAAO;;YAEG,IAAI,CAAC,MAAM;;;;;;;;4BAQK,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC;;;8BAG/B,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;+BACnC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;gCACpC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;0BAyB5C,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC;8BAC1B,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC;;;;;;;;;;;;;mBAa7C,gBAAgB;;EAEjC,YAAY,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,CAAC;;EAEvC,cAAc,CAAC,IAAI,CAAC;;;;;;;;CAQrB,CAAC;AACF,CAAC;AAID;;;GAGG;AACH,SAAS,cAAc,CACrB,MAAqB,EACrB,OAAuB,EACvB,UAAkB,EAClB,SAA4B,EAAE;IAE9B,MAAM,OAAO,GAAG,CAAC,IAAuB,EAAE,EAAE,CAC1C,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAChF,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC1B,OAAO;YACL,yEAAyE;YACzE,4EAA4E;YAC5E,2BAA2B;YAC3B,uBAAuB;YACvB,gBAAgB,UAAU,EAAE;YAC5B,GAAG,OAAO,CAAC,CAAC,YAAY,EAAE,GAAG,MAAM,CAAC,CAAC;SACtC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,UAAU,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,cAAc,CAAC,OAAO,CAAC,kBAAkB,CACxG,CAAC;IACJ,CAAC;IACD,gEAAgE;IAChE,OAAO,CAAC,cAAc,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxF,CAAC;AAED,SAAS,YAAY,CAAC,IAAiB,EAAE,cAAsB,EAAE,GAAY;IAC3E,OAAO;EACP,cAAc,CACd,IAAI,CAAC,MAAM,EACX,OAAO,EACP,4FAA4F,kBAAkB,GAAG;IACjH,gEAAgE;IAChE,0EAA0E;IAC1E,wEAAwE;IACxE,wEAAwE;IACxE,yEAAyE;IACzE,uEAAuE;IACvE,sEAAsE;IACtE,sDAAsD;IACtD,oEAAoE;IACpE;QACE,KAAK,aAAa,cAAc;QAChC,YAAY,gBAAgB,EAAE;QAC9B,KAAK,SAAS,IAAI,UAAU,EAAE;KAC/B,CACF;;;;;uBAKsB,cAAc;;6BAER,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,WAAW,CAAC;oCACnD,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,YAAY,CAAC;2BACpE,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC;yBACjC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;eAChD,kBAAkB;4BACL,gBAAgB;yBACnB,UAAU;;EAEjC,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,eAAe,CAAC;EAC9C,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,cAAc,CAAC,IAAiB;IACvC,OAAO;EACP,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,wCAAwC,CAAC;;;;;;;+BAOnD,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,WAAW,CAAC;8BAC/D,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,YAAY,CAAC;uBACpE,oBAAoB;2BAChB,CAAC;AAC5B,CAAC;AAED,6EAA6E;AAC7E,SAAS,KAAK,CAAC,IAAY,EAAE,QAAgB,EAAE,QAAgB;IAC7D,OAAO,UAAU,CAAC,cAAc,IAAI,IAAI,kBAAkB,CAAC,QAAQ,CAAC,kBAAkB,QAAQ,EAAE,CAAC,CAAC;AACpG,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,sDAAsD;IACtD,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACvD,CAAC"}

package/dist/gcloud-retry.d.ts

@@ -5,9 +5,13 @@
  * PERMISSION_DENIED does not get better by waiting.
  */
 import type { GcloudResult } from "./gcloud.js";
-/** Runs one gcloud command; `stdin` feeds secret payloads (`--data-file=-`). */
+/**
+ * Runs one gcloud command; `stdin` feeds secret payloads (`--data-file=-`),
+ * `env` replaces the base environment (default: this process's).
+ */
 export type GcloudRunner = (args: string[], opts?: {
     readonly stdin?: string;
+    readonly env?: NodeJS.ProcessEnv;
 }) => Promise<GcloudResult>;
 export type Sleep = (ms: number) => Promise<void>;
 export declare const realSleep: Sleep;

package/dist/gcloud-retry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gcloud-retry.d.ts","sourceRoot":"","sources":["../src/gcloud-retry.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,gFAAgF;AAChF,MAAM,MAAM,YAAY,GAAG,CACzB,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,KAC/B,OAAO,CAAC,YAAY,CAAC,CAAC;AAC3B,MAAM,MAAM,KAAK,GAAG,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAMlD,eAAO,MAAM,SAAS,EAAE,KAA2D,CAAC;AAEpF,2EAA2E;AAC3E,wBAAsB,YAAY,CAChC,GAAG,EAAE,YAAY,EACjB,KAAK,EAAE,KAAK,EACZ,IAAI,EAAE,MAAM,EAAE,GACb,OAAO,CAAC,YAAY,CAAC,CAQvB"}
+{"version":3,"file":"gcloud-retry.d.ts","sourceRoot":"","sources":["../src/gcloud-retry.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,KACjE,OAAO,CAAC,YAAY,CAAC,CAAC;AAC3B,MAAM,MAAM,KAAK,GAAG,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAMlD,eAAO,MAAM,SAAS,EAAE,KAA2D,CAAC;AAEpF,2EAA2E;AAC3E,wBAAsB,YAAY,CAChC,GAAG,EAAE,YAAY,EACjB,KAAK,EAAE,KAAK,EACZ,IAAI,EAAE,MAAM,EAAE,GACb,OAAO,CAAC,YAAY,CAAC,CAQvB"}

package/dist/gcloud-retry.js.map

@@ -1 +1 @@
-{"version":3,"file":"gcloud-retry.js","sourceRoot":"","sources":["../src/gcloud-retry.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAkBnC,uEAAuE;AACvE,MAAM,SAAS,GAAG,iEAAiE,CAAC;AACpF,MAAM,eAAe,GAAsB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAEzE,MAAM,CAAC,MAAM,SAAS,GAAU,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAEpF,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAiB,EACjB,KAAY,EACZ,IAAc;IAEd,IAAI,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,MAAM;QAC7C,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"gcloud-retry.js","sourceRoot":"","sources":["../src/gcloud-retry.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAqBnC,uEAAuE;AACvE,MAAM,SAAS,GAAG,iEAAiE,CAAC;AACpF,MAAM,eAAe,GAAsB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAEzE,MAAM,CAAC,MAAM,SAAS,GAAU,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAEpF,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAiB,EACjB,KAAY,EACZ,IAAc;IAEd,IAAI,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,MAAM;QAC7C,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/gcloud.d.ts

@@ -21,9 +21,11 @@ export declare function gcloudEnv(base?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
  * Run a gcloud command. Buffered stdout + stderr (max 4 MB each).
  * Throws on spawn failure but NOT on non-zero exit — caller checks `ok`.
  * stdin is always ended (after `opts.stdin`, if given), so nothing can wait on it.
+ * `opts.env` replaces this process's environment as the base (prompts stay off).
  */
 export declare function gcloud(args: string[], opts?: {
     stdin?: string;
+    env?: NodeJS.ProcessEnv;
 }): Promise<GcloudResult>;
 /**
  * Active gcloud account. Returns `null` when no account is logged in
@@ -60,7 +62,6 @@ export declare function grantProvisionerRoles(projectId: string, saEmail: string
     granted: number;
     failed: RoleGrantFailure[];
 }>;
-export declare function createServiceAccountKey(saEmail: string, outputPath: string): Promise<GcloudResult>;
 export declare const REQUIRED_API_LIST: readonly string[];
 export declare const GCP_FIREBASE_EXTRA_API_LIST: readonly string[];
 export declare const PROVISIONER_ROLE_LIST: readonly string[];

package/dist/gcloud.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gcloud.d.ts","sourceRoot":"","sources":["../src/gcloud.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,IAAI,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAAC,UAAU,CAElF;AAED;;;;GAIG;AACH,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,YAAY,CAAC,CAkBjG;AAED;;;GAGG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAK5D;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAiBrE;AAED,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGvE;AAED,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAEjG;AAED,wBAAsB,WAAW,CAC/B,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,YAAY,CAAC,CAEvB;AAkCD,wBAAsB,UAAU,CAC9B,SAAS,EAAE,MAAM,EACjB,QAAQ,GAAE,KAAK,GAAG,cAAsB,GACvC,OAAO,CAAC,YAAY,CAAC,CAIvB;AAED,wBAAsB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAW/F;AAED,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,YAAY,CAAC,CAWvB;AA4DD,UAAU,gBAAgB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IACJ,GAAG,CAAC,EAAE,OAAO,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9B,GACL,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,gBAAgB,EAAE,CAAA;CAAE,CAAC,CA4B1D;AAED,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,YAAY,CAAC,CAUvB;AAED,eAAO,MAAM,iBAAiB,mBAAgB,CAAC;AAC/C,eAAO,MAAM,2BAA2B,mBAA0B,CAAC;AACnE,eAAO,MAAM,qBAAqB,mBAAoB,CAAC"}
+{"version":3,"file":"gcloud.d.ts","sourceRoot":"","sources":["../src/gcloud.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,IAAI,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAAC,UAAU,CAElF;AAED;;;;;GAKG;AACH,wBAAsB,MAAM,CAC1B,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAO,GACrD,OAAO,CAAC,YAAY,CAAC,CAqBvB;AAED;;;GAGG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAK5D;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAiBrE;AAED,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGvE;AAED,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAEjG;AAED,wBAAsB,WAAW,CAC/B,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,YAAY,CAAC,CAEvB;AAqCD,wBAAsB,UAAU,CAC9B,SAAS,EAAE,MAAM,EACjB,QAAQ,GAAE,KAAK,GAAG,cAAsB,GACvC,OAAO,CAAC,YAAY,CAAC,CAIvB;AAED,wBAAsB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAW/F;AAED,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,YAAY,CAAC,CAWvB;AA4DD,UAAU,gBAAgB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IACJ,GAAG,CAAC,EAAE,OAAO,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9B,GACL,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,gBAAgB,EAAE,CAAA;CAAE,CAAC,CA4B1D;AAED,eAAO,MAAM,iBAAiB,mBAAgB,CAAC;AAC/C,eAAO,MAAM,2BAA2B,mBAA0B,CAAC;AACnE,eAAO,MAAM,qBAAqB,mBAAoB,CAAC"}

package/dist/gcloud.js

@@ -2,7 +2,9 @@
 /**
  * Thin gcloud shell-out wrapper. The wizard composes high-level
  * "create the project + link billing + enable APIs + create SA +
- * grant roles + mint key" flows on top of these primitives.
+ * grant roles" flows on top of these primitives. No key is ever minted
+ * for the provisioner SA: the operator impersonates it
+ * (provisioner-identity.ts, #696).
  *
  * Why shell out instead of using the GCP SDK directly:
  *   - the user's gcloud auth state IS the auth (no separate
@@ -32,10 +34,14 @@ export function gcloudEnv(base = process.env) {
  * Run a gcloud command. Buffered stdout + stderr (max 4 MB each).
  * Throws on spawn failure but NOT on non-zero exit — caller checks `ok`.
  * stdin is always ended (after `opts.stdin`, if given), so nothing can wait on it.
+ * `opts.env` replaces this process's environment as the base (prompts stay off).
  */
 export async function gcloud(args, opts = {}) {
     return new Promise((resolveResult, reject) => {
-        const child = spawn("gcloud", args, { stdio: ["pipe", "pipe", "pipe"], env: gcloudEnv() });
+        const child = spawn("gcloud", args, {
+            stdio: ["pipe", "pipe", "pipe"],
+            env: gcloudEnv(opts.env ?? process.env),
+        });
         const stdout = [];
         const stderr = [];
         child.stdout.on("data", (chunk) => stdout.push(chunk));
@@ -109,6 +115,9 @@ const REQUIRED_APIS = [
     // signJwt as caelo-mcp: how `staging-domain enable` passes the admin's
     // IAP (staging-admin.ts, #678) — the same path the MCP shim takes.
     "iamcredentials.googleapis.com",
+    // #696 — the KMS key Pulumi encrypts the stack's secrets with
+    // (ops-backend.ts; also enabled there for installs that predate this).
+    "cloudkms.googleapis.com",
 ];
 // v0.3.1 — gcp-firebase provider needs the Firebase Management +
 // Firebase Hosting APIs on top of the gcp baseline. Without these
@@ -236,17 +245,6 @@ export async function grantProvisionerRoles(projectId, saEmail, opts = {}) {
     }
     return { granted, failed };
 }
-export async function createServiceAccountKey(saEmail, outputPath) {
-    return gcloud([
-        "iam",
-        "service-accounts",
-        "keys",
-        "create",
-        outputPath,
-        "--iam-account",
-        saEmail,
-    ]);
-}
 export const REQUIRED_API_LIST = REQUIRED_APIS;
 export const GCP_FIREBASE_EXTRA_API_LIST = GCP_FIREBASE_EXTRA_APIS;
 export const PROVISIONER_ROLE_LIST = PROVISIONER_ROLES;

package/dist/gcloud.js.map

@@ -1 +1 @@
-{"version":3,"file":"gcloud.js","sourceRoot":"","sources":["../src/gcloud.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAS3C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,SAAS,CAAC,OAA0B,OAAO,CAAC,GAAG;IAC7D,OAAO,EAAE,GAAG,IAAI,EAAE,6BAA6B,EAAE,GAAG,EAAE,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAc,EAAE,OAA2B,EAAE;IACxE,OAAO,IAAI,OAAO,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAC3F,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/D,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CACzB,aAAa,CAAC;YACZ,EAAE,EAAE,IAAI,KAAK,CAAC;YACd,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC9C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC9C,QAAQ,EAAE,IAAI,IAAI,CAAC;SACpB,CAAC,CACH,CAAC;QACF,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,yBAAyB,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAC9F,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;IACzE,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAI9B,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC;YAC9C,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB;IACnD,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,2BAA2B,CAAC,CAAC,CAAC;IACzF,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,SAAS,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB,EAAE,WAAmB;IACxE,OAAO,MAAM,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAiB,EACjB,gBAAwB;IAExB,OAAO,MAAM,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,gBAAgB,CAAC,CAAC,CAAC;AACnG,CAAC;AAED,MAAM,aAAa,GAAsB;IACvC,wBAAwB;IACxB,yBAAyB;IACzB,oBAAoB;IACpB,8BAA8B;IAC9B,kCAAkC;IAClC,oBAAoB;IACpB,wBAAwB;IACxB,qCAAqC;IACrC,oBAAoB;IACpB,2BAA2B;IAC3B,iCAAiC;IACjC,yBAAyB;IACzB,oBAAoB;IACpB,oEAAoE;IACpE,qEAAqE;IACrE,6BAA6B;IAC7B,mEAAmE;IACnE,+BAA+B;IAC/B,uEAAuE;IACvE,mEAAmE;IACnE,+BAA+B;CAChC,CAAC;AAEF,iEAAiE;AACjE,kEAAkE;AAClE,kEAAkE;AAClE,MAAM,uBAAuB,GAAsB;IACjD,yBAAyB;IACzB,gCAAgC;CACjC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,SAAiB,EACjB,WAAmC,KAAK;IAExC,MAAM,IAAI,GACR,QAAQ,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,aAAa,EAAE,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;IAC/F,OAAO,MAAM,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,SAAiB,EAAE,OAAe;IAC3E,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC;QACrB,KAAK;QACL,kBAAkB;QAClB,UAAU;QACV,OAAO;QACP,WAAW;QACX,SAAS;QACT,uBAAuB;KACxB,CAAC,CAAC;IACH,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,OAAO,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,SAAiB,EACjB,SAAiB,EACjB,WAAmB;IAEnB,OAAO,MAAM,CAAC;QACZ,KAAK;QACL,kBAAkB;QAClB,QAAQ;QACR,SAAS;QACT,gBAAgB;QAChB,WAAW;QACX,WAAW;QACX,SAAS;KACV,CAAC,CAAC;AACL,CAAC;AAED,MAAM,iBAAiB,GAAsB;IAC3C,iBAAiB;IACjB,sBAAsB;IACtB,qBAAqB;IACrB,2BAA2B;IAC3B,8BAA8B;IAC9B,4BAA4B;IAC5B,iBAAiB;IACjB,uCAAuC;IACvC,sCAAsC;IACtC,gCAAgC;IAChC,8BAA8B;IAC9B,6BAA6B;IAC7B,+BAA+B;IAC/B,sBAAsB;IACtB,iBAAiB;IACjB,kEAAkE;IAClE,mEAAmE;IACnE,4BAA4B;IAC5B,qBAAqB;IACrB,iEAAiE;IACjE,4BAA4B;IAC5B,iEAAiE;IACjE,mDAAmD;IACnD,sCAAsC;IACtC,8DAA8D;IAC9D,qDAAqD;IACrD,gEAAgE;IAChE,0DAA0D;IAC1D,2DAA2D;IAC3D,0CAA0C;IAC1C,sBAAsB;IACtB,6BAA6B;IAC7B,4DAA4D;IAC5D,gEAAgE;IAChE,4DAA4D;IAC5D,6DAA6D;IAC7D,wDAAwD;IACxD,4DAA4D;IAC5D,8DAA8D;IAC9D,gEAAgE;IAChE,uCAAuC;CACxC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,mBAAmB,GACvB,iFAAiF,CAAC;AAEpF,MAAM,qBAAqB,GAAsB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAQ/E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAAiB,EACjB,OAAe,EACf,OAII,EAAE;IAEN,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1F,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,qBAAqB,CAAC;IAClE,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG;YACX,UAAU;YACV,wBAAwB;YACxB,SAAS;YACT,UAAU;YACV,kBAAkB,OAAO,EAAE;YAC3B,QAAQ;YACR,IAAI;YACJ,kBAAkB;YAClB,SAAS;SACV,CAAC;QACF,IAAI,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;gBAAE,MAAM;YACvD,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;YACnB,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;;YACf,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAe,EACf,UAAkB;IAElB,OAAO,MAAM,CAAC;QACZ,KAAK;QACL,kBAAkB;QAClB,MAAM;QACN,QAAQ;QACR,UAAU;QACV,eAAe;QACf,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAC;AAC/C,MAAM,CAAC,MAAM,2BAA2B,GAAG,uBAAuB,CAAC;AACnE,MAAM,CAAC,MAAM,qBAAqB,GAAG,iBAAiB,CAAC;AAEvD,+DAA+D;AAC/D,oDAAoD;AACpD,8DAA8D;AAC9D,8DAA8D;AAC9D,iEAAiE;AACjE,+DAA+D;AAC/D,4DAA4D;AAC5D,gDAAgD"}
+{"version":3,"file":"gcloud.js","sourceRoot":"","sources":["../src/gcloud.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAS3C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,SAAS,CAAC,OAA0B,OAAO,CAAC,GAAG;IAC7D,OAAO,EAAE,GAAG,IAAI,EAAE,6BAA6B,EAAE,GAAG,EAAE,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,IAAc,EACd,OAAoD,EAAE;IAEtD,OAAO,IAAI,OAAO,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE;YAClC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;YAC/B,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;SACxC,CAAC,CAAC;QACH,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/D,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CACzB,aAAa,CAAC;YACZ,EAAE,EAAE,IAAI,KAAK,CAAC;YACd,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC9C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC9C,QAAQ,EAAE,IAAI,IAAI,CAAC;SACpB,CAAC,CACH,CAAC;QACF,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,yBAAyB,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAC9F,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;IACzE,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAI9B,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC;YAC9C,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB;IACnD,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,2BAA2B,CAAC,CAAC,CAAC;IACzF,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,SAAS,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB,EAAE,WAAmB;IACxE,OAAO,MAAM,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAiB,EACjB,gBAAwB;IAExB,OAAO,MAAM,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,gBAAgB,CAAC,CAAC,CAAC;AACnG,CAAC;AAED,MAAM,aAAa,GAAsB;IACvC,wBAAwB;IACxB,yBAAyB;IACzB,oBAAoB;IACpB,8BAA8B;IAC9B,kCAAkC;IAClC,oBAAoB;IACpB,wBAAwB;IACxB,qCAAqC;IACrC,oBAAoB;IACpB,2BAA2B;IAC3B,iCAAiC;IACjC,yBAAyB;IACzB,oBAAoB;IACpB,oEAAoE;IACpE,qEAAqE;IACrE,6BAA6B;IAC7B,mEAAmE;IACnE,+BAA+B;IAC/B,uEAAuE;IACvE,mEAAmE;IACnE,+BAA+B;IAC/B,8DAA8D;IAC9D,uEAAuE;IACvE,yBAAyB;CAC1B,CAAC;AAEF,iEAAiE;AACjE,kEAAkE;AAClE,kEAAkE;AAClE,MAAM,uBAAuB,GAAsB;IACjD,yBAAyB;IACzB,gCAAgC;CACjC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,SAAiB,EACjB,WAAmC,KAAK;IAExC,MAAM,IAAI,GACR,QAAQ,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,aAAa,EAAE,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;IAC/F,OAAO,MAAM,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,SAAiB,EAAE,OAAe;IAC3E,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC;QACrB,KAAK;QACL,kBAAkB;QAClB,UAAU;QACV,OAAO;QACP,WAAW;QACX,SAAS;QACT,uBAAuB;KACxB,CAAC,CAAC;IACH,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,OAAO,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,SAAiB,EACjB,SAAiB,EACjB,WAAmB;IAEnB,OAAO,MAAM,CAAC;QACZ,KAAK;QACL,kBAAkB;QAClB,QAAQ;QACR,SAAS;QACT,gBAAgB;QAChB,WAAW;QACX,WAAW;QACX,SAAS;KACV,CAAC,CAAC;AACL,CAAC;AAED,MAAM,iBAAiB,GAAsB;IAC3C,iBAAiB;IACjB,sBAAsB;IACtB,qBAAqB;IACrB,2BAA2B;IAC3B,8BAA8B;IAC9B,4BAA4B;IAC5B,iBAAiB;IACjB,uCAAuC;IACvC,sCAAsC;IACtC,gCAAgC;IAChC,8BAA8B;IAC9B,6BAA6B;IAC7B,+BAA+B;IAC/B,sBAAsB;IACtB,iBAAiB;IACjB,kEAAkE;IAClE,mEAAmE;IACnE,4BAA4B;IAC5B,qBAAqB;IACrB,iEAAiE;IACjE,4BAA4B;IAC5B,iEAAiE;IACjE,mDAAmD;IACnD,sCAAsC;IACtC,8DAA8D;IAC9D,qDAAqD;IACrD,gEAAgE;IAChE,0DAA0D;IAC1D,2DAA2D;IAC3D,0CAA0C;IAC1C,sBAAsB;IACtB,6BAA6B;IAC7B,4DAA4D;IAC5D,gEAAgE;IAChE,4DAA4D;IAC5D,6DAA6D;IAC7D,wDAAwD;IACxD,4DAA4D;IAC5D,8DAA8D;IAC9D,gEAAgE;IAChE,uCAAuC;CACxC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,mBAAmB,GACvB,iFAAiF,CAAC;AAEpF,MAAM,qBAAqB,GAAsB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAQ/E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAAiB,EACjB,OAAe,EACf,OAII,EAAE;IAEN,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1F,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,qBAAqB,CAAC;IAClE,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG;YACX,UAAU;YACV,wBAAwB;YACxB,SAAS;YACT,UAAU;YACV,kBAAkB,OAAO,EAAE;YAC3B,QAAQ;YACR,IAAI;YACJ,kBAAkB;YAClB,SAAS;SACV,CAAC;QACF,IAAI,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;gBAAE,MAAM;YACvD,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;YACnB,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;;YACf,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAC;AAC/C,MAAM,CAAC,MAAM,2BAA2B,GAAG,uBAAuB,CAAC;AACnE,MAAM,CAAC,MAAM,qBAAqB,GAAG,iBAAiB,CAAC;AAEvD,+DAA+D;AAC/D,oDAAoD;AACpD,8DAA8D;AAC9D,8DAA8D;AAC9D,iEAAiE;AACjE,+DAA+D;AAC/D,4DAA4D;AAC5D,gDAAgD"}

package/dist/index.d.ts

@@ -18,5 +18,8 @@ export { type BootstrapToken, generateBootstrapToken, } from "./bootstrap-token.
 export { type CaddyDomainSpec, type CaddyfileSpec, generateCaddyfile, } from "./caddy.js";
 export { type CdnCopyAdapter, loadCdnCopyAdapter, selfHostedCdnCopy, } from "./cdn-copy.js";
 export { type ComposeSpec, generateDockerCompose, type RolePasswords } from "./compose.js";
+export { INFRA_CONTRACT_VERSION } from "./infra-contract.js";
 export { type CloudFrontRedirectArtifact, emitRedirectsAzureFrontDoor, emitRedirectsCloudFront, emitRedirectsCloudflare, type FrontDoorRule, type RedirectRow, type RedirectStatusCode, } from "./redirects-emit.js";
+export { INFRA_CONTRACT_PATHS, isInfraContractPath, RELEASE_MIN_FROM_VERSION, } from "./release-contract.js";
+export { assessAutoInstall, channelForVersion, compareImageDigests, compareSemver, type DigestMismatch, fetchVerifiedReleaseManifest, type InstallAssessment, type InstalledRelease, type InstallMode, RELEASE_CHANNELS, RELEASE_IMAGES, RELEASE_MANIFEST_ARTIFACT_TYPE, RELEASE_MANIFEST_MEDIA_TYPE, RELEASE_MANIFEST_REGISTRY, RELEASE_MANIFEST_REPOSITORY, RELEASE_OIDC_ISSUER, type ReleaseChannel, type ReleaseImage, type ReleaseManifest, type ReleaseManifestDeps, type ReleaseManifestError, type ReleaseManifestErrorCode, type ReleaseManifestResult, ReleaseManifestSchema, releaseManifestSignerIdentity, SIGSTORE_BUNDLE_MEDIA_TYPE, } from "./release-manifest.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AAEH,YAAY,EACV,kBAAkB,EAClB,mBAAmB,EACnB,SAAS,EACT,WAAW,EACX,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,KAAK,cAAc,EACnB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,KAAK,cAAc,EACnB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,KAAK,WAAW,EAAE,qBAAqB,EAAE,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,EACL,KAAK,0BAA0B,EAC/B,2BAA2B,EAC3B,uBAAuB,EACvB,uBAAuB,EACvB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,kBAAkB,GACxB,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AAEH,YAAY,EACV,kBAAkB,EAClB,mBAAmB,EACnB,SAAS,EACT,WAAW,EACX,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,KAAK,cAAc,EACnB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,KAAK,cAAc,EACnB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,KAAK,WAAW,EAAE,qBAAqB,EAAE,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EACL,KAAK,0BAA0B,EAC/B,2BAA2B,EAC3B,uBAAuB,EACvB,uBAAuB,EACvB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,kBAAkB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,KAAK,cAAc,EACnB,4BAA4B,EAC5B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,gBAAgB,EAChB,cAAc,EACd,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAC3B,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,qBAAqB,EACrB,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC"}

package/dist/index.js

@@ -3,5 +3,8 @@ export { generateBootstrapToken, } from "./bootstrap-token.js";
 export { generateCaddyfile, } from "./caddy.js";
 export { loadCdnCopyAdapter, selfHostedCdnCopy, } from "./cdn-copy.js";
 export { generateDockerCompose } from "./compose.js";
+export { INFRA_CONTRACT_VERSION } from "./infra-contract.js";
 export { emitRedirectsAzureFrontDoor, emitRedirectsCloudFront, emitRedirectsCloudflare, } from "./redirects-emit.js";
+export { INFRA_CONTRACT_PATHS, isInfraContractPath, RELEASE_MIN_FROM_VERSION, } from "./release-contract.js";
+export { assessAutoInstall, channelForVersion, compareImageDigests, compareSemver, fetchVerifiedReleaseManifest, RELEASE_CHANNELS, RELEASE_IMAGES, RELEASE_MANIFEST_ARTIFACT_TYPE, RELEASE_MANIFEST_MEDIA_TYPE, RELEASE_MANIFEST_REGISTRY, RELEASE_MANIFEST_REPOSITORY, RELEASE_OIDC_ISSUER, ReleaseManifestSchema, releaseManifestSignerIdentity, SIGSTORE_BUNDLE_MEDIA_TYPE, } from "./release-manifest.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mCAAmC;AA0BnC,OAAO,EAEL,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAGL,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAEL,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAoB,qBAAqB,EAAsB,MAAM,cAAc,CAAC;AAC3F,OAAO,EAEL,2BAA2B,EAC3B,uBAAuB,EACvB,uBAAuB,GAIxB,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mCAAmC;AA0BnC,OAAO,EAEL,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAGL,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAEL,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAoB,qBAAqB,EAAsB,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAEL,2BAA2B,EAC3B,uBAAuB,EACvB,uBAAuB,GAIxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EAEb,4BAA4B,EAI5B,gBAAgB,EAChB,cAAc,EACd,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAC3B,mBAAmB,EAQnB,qBAAqB,EACrB,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC"}

package/dist/infra-contract.d.ts

@@ -0,0 +1,24 @@
+/**
+ * The infrastructure contract version (epic #696).
+ *
+ * An upgrade has two halves (packages/provisioning/src/upgrade/): the
+ * *converge* half changes IAM, service accounts, secrets and other cloud
+ * resources the stacks declare; the *app-roll* half only runs migrations and
+ * moves the two Cloud Run services onto new images. The app-roll half can run
+ * under an identity without IAM-write or secret-create rights (the in-cloud
+ * upgrader job), but only while the install's infrastructure already is what
+ * the release expects.
+ *
+ * This number names that expectation. A release that needs a converge step
+ * the installs out there have not had yet (a new secret, a new IAM binding, a
+ * new service account) bumps it; `cms-provision upgrade` records the version
+ * it converged to in install.json, and the upgrader job refuses an app-roll
+ * while the recorded version is lower (`needsConverge` in upgrade/converge.ts),
+ * sending the operator to the converge path instead.
+ *
+ * Bump it in the same PR that adds the converge step, never later: a release
+ * whose app-roll references infrastructure an install does not have yet fails
+ * at roll time, after migrations ran.
+ */
+export declare const INFRA_CONTRACT_VERSION = 1;
+//# sourceMappingURL=infra-contract.d.ts.map

package/dist/infra-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra-contract.d.ts","sourceRoot":"","sources":["../src/infra-contract.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,sBAAsB,IAAI,CAAC"}

package/dist/infra-contract.js

@@ -0,0 +1,25 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * The infrastructure contract version (epic #696).
+ *
+ * An upgrade has two halves (packages/provisioning/src/upgrade/): the
+ * *converge* half changes IAM, service accounts, secrets and other cloud
+ * resources the stacks declare; the *app-roll* half only runs migrations and
+ * moves the two Cloud Run services onto new images. The app-roll half can run
+ * under an identity without IAM-write or secret-create rights (the in-cloud
+ * upgrader job), but only while the install's infrastructure already is what
+ * the release expects.
+ *
+ * This number names that expectation. A release that needs a converge step
+ * the installs out there have not had yet (a new secret, a new IAM binding, a
+ * new service account) bumps it; `cms-provision upgrade` records the version
+ * it converged to in install.json, and the upgrader job refuses an app-roll
+ * while the recorded version is lower (`needsConverge` in upgrade/converge.ts),
+ * sending the operator to the converge path instead.
+ *
+ * Bump it in the same PR that adds the converge step, never later: a release
+ * whose app-roll references infrastructure an install does not have yet fails
+ * at roll time, after migrations ran.
+ */
+export const INFRA_CONTRACT_VERSION = 1;
+//# sourceMappingURL=infra-contract.js.map

package/dist/infra-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra-contract.js","sourceRoot":"","sources":["../src/infra-contract.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC"}

package/dist/install-state.d.ts

@@ -1,3 +1,5 @@
+import { type StateBackendRecord } from "./state-backend.js";
+import { type StateStore, type SyncGcloud } from "./state-store.js";
 export type Provider = "self-hosted" | "gcp" | "gcp-firebase" | "aws" | "azure";
 export interface InstallMetadata {
     installId: string;
@@ -22,9 +24,32 @@ export interface InstallMetadata {
      * `upgrade` records the default ({@link installStagingHost}).
      */
     stagingDomain?: string;
+    /**
+     * #696 — where Pulumi's state and this metadata live (state-backend.ts).
+     * Absent on installs that predate it: those are `local`.
+     */
+    stateBackend?: StateBackendRecord;
+    /**
+     * #696 — the infrastructure contract version (infra-contract.ts) the last
+     * successful converge brought this install to. Absent until the first
+     * `upgrade` that converged completely; an app-roll-only upgrade refuses to
+     * run while it is lower than the release's (upgrade/converge.ts).
+     */
+    infraContractVersion?: number;
 }
 /** The install's staging host: its recorded setting, else the default. */
 export declare function installStagingHost(meta: Pick<InstallMetadata, "domain" | "stagingDomain">): string;
+/**
+ * The staging host exactly as install.json may record it, or null when
+ * `host` is anything but a bare host name. The host can come from the
+ * admin's HTTP answer (`staging-domain enable` reads the stored host), so
+ * only a value that passes this allow-list is written to disk — never a
+ * URL, path, port, whitespace or other payload.
+ *
+ * @example recordableStagingHost("staging.example.com") // → "staging.example.com"
+ * @example recordableStagingHost("https://x.example.com/") // → null
+ */
+export declare function recordableStagingHost(host: string): string | null;
 /** Release image digest per Cloud Run service. */
 export interface ImageDigests {
     readonly admin: string;
@@ -48,10 +73,15 @@ export declare function resumedMetadata(existing: InstallMetadata, inputs: {
 }): InstallMetadata;
 /** Record the image digests an install now runs (see {@link InstallMetadata.imageDigests}). */
 export declare function recordImageDigests(installId: string, digests: ImageDigests): void;
+/**
+ * Record the infrastructure contract version a converge just brought the
+ * install to (see {@link InstallMetadata.infraContractVersion}).
+ */
+export declare function recordInfraContractVersion(installId: string, version: number): void;
 export interface ProgressCheckpoint {
     /** Last completed wizard step. Used for resume-after-failure. */
     lastCompletedStep: string | null;
-    /** Per-step state (e.g. createdProjectId, mintedSaKeyAt, etc.). */
+    /** Per-step state (e.g. createdProjectId, billingAccountId, etc.). */
     steps: Record<string, unknown>;
     /** ISO timestamp of last successful update. */
     updatedAt: string;
@@ -73,7 +103,8 @@ export declare function ensureInstallDir(installId: string): {
     stateDir: string;
 };
 /**
- * Scan `~/.caelo-*` for every install with a readable `install.json`.
+ * Scan `~/.caelo-*` for every install with a readable `install.json` (the
+ * local copy; see {@link currentMetadata}).
  * Used by the wizard to offer "resume X" before prompting for the
  * domain / owner / project again. Silently skips dirs that fail to
  * parse — partial / orphaned dirs don't block the new-install flow.
@@ -106,8 +137,43 @@ export type InstallSelection = {
  * @param wanted the `--install` value, if given
  */
 export declare function selectInstall(installs: readonly InstallMetadata[], wanted: string | undefined): InstallSelection;
+/**
+ * Replace the gcloud runner bucket-backed stores use. Test seam only: the
+ * CLI always uses the real `gcloud`.
+ */
+export declare function setStateStoreGcloud(run: SyncGcloud): void;
+/**
+ * The install.json copy in `~/.caelo-<id>/`, without consulting the bucket.
+ * For listing installs and for deciding which store to use.
+ */
+export declare function readLocalMetadata(installId: string): InstallMetadata | null;
+/**
+ * The store holding the install's metadata: its ops bucket when the local
+ * install.json says the install's state lives there, else `~/.caelo-<id>/`.
+ * One bucket store per install and process, so a run reads each document
+ * from the bucket once.
+ */
+export declare function stateStoreFor(installId: string): StateStore;
+/**
+ * The authoritative metadata of an install picked from {@link listInstalls}:
+ * for an install whose state lives in its ops bucket, the bucket's copy
+ * (another machine may have upgraded it since). Throws when that copy can't
+ * be read — acting on a stale mirror could roll an install back.
+ */
+export declare function currentMetadata(meta: InstallMetadata): InstallMetadata;
 export declare function readMetadata(installId: string): InstallMetadata | null;
 export declare function writeMetadata(installId: string, meta: InstallMetadata): void;
+/**
+ * Move the install's metadata to `backend`'s store and record the backend
+ * in install.json (#696). progress.json is written first and install.json
+ * last: install.json naming the new backend is the commit point, so an
+ * interrupted switch leaves the install on its old store. When the install
+ * leaves the bucket, the bucket's install.json is updated too, so a machine
+ * that attaches later learns where the state went.
+ *
+ * @returns the metadata as now recorded
+ */
+export declare function adoptStateBackend(installId: string, backend: StateBackendRecord): InstallMetadata;
 export declare function readProgress(installId: string): ProgressCheckpoint;
 export declare function writeProgress(installId: string, checkpoint: ProgressCheckpoint): void;
 /**

package/dist/install-state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"install-state.d.ts","sourceRoot":"","sources":["../src/install-state.ts"],"names":[],"mappings":"AA6CA,MAAM,MAAM,QAAQ,GAAG,aAAa,GAAG,KAAK,GAAG,cAAc,GAAG,KAAK,GAAG,OAAO,CAAC;AAEhF,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,QAAQ,CAAC;IACnB,4EAA4E;IAC5E,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,0EAA0E;AAC1E,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,QAAQ,GAAG,eAAe,CAAC,GACtD,MAAM,CAER;AAED,kDAAkD;AAClD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAID;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,eAAe,GAAG,YAAY,GAAG,IAAI,CAS/E;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACvE,eAAe,CAOjB;AAED,+FAA+F;AAC/F,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,IAAI,CAOjF;AAED,MAAM,WAAW,kBAAkB;IACjC,iEAAiE;IACjE,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,mEAAmE;IACnE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;CACnB;AAID,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,GAAG,MAAM,CAOrF;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG;IACnD,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB,CAeA;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,IAAI,eAAe,EAAE,CAiBhD;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAqBvE;AAED,wCAAwC;AACxC,MAAM,MAAM,gBAAgB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,eAAe,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpG;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,SAAS,eAAe,EAAE,EACpC,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB,gBAAgB,CA4BlB;AAED,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAItE;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,IAAI,CAI5E;AAED,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,kBAAkB,CAMlE;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,kBAAkB,GAAG,IAAI,CAMrF;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI,CAMzF;AAED,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEvE;AAED,wBAAgB,cAAc,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,CAAC,GAAG,IAAI,CAG/E;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAOhE;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMzE;AAED,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAIhF"}
+{"version":3,"file":"install-state.d.ts","sourceRoot":"","sources":["../src/install-state.ts"],"names":[],"mappings":"AAoDA,OAAO,EAAqB,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAIL,KAAK,UAAU,EACf,KAAK,UAAU,EAChB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,MAAM,QAAQ,GAAG,aAAa,GAAG,KAAK,GAAG,cAAc,GAAG,KAAK,GAAG,OAAO,CAAC;AAEhF,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,QAAQ,CAAC;IACnB,4EAA4E;IAC5E,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,0EAA0E;AAC1E,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,QAAQ,GAAG,eAAe,CAAC,GACtD,MAAM,CAER;AAcD;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGjE;AAED,kDAAkD;AAClD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAID;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,eAAe,GAAG,YAAY,GAAG,IAAI,CAS/E;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACvE,eAAe,CAOjB;AAED,+FAA+F;AAC/F,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,IAAI,CAOjF;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAInF;AAED,MAAM,WAAW,kBAAkB;IACjC,iEAAiE;IACjE,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;CACnB;AAID,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,GAAG,MAAM,CAOrF;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG;IACnD,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB,CAkBA;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,IAAI,eAAe,EAAE,CAoBhD;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAqBvE;AAED,wCAAwC;AACxC,MAAM,MAAM,gBAAgB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,eAAe,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpG;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,SAAS,eAAe,EAAE,EACpC,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB,gBAAgB,CA4BlB;AAKD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAGzD;AAWD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAG3E;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,CAW3D;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,eAAe,GAAG,eAAe,CAStE;AAED,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAItE;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,IAAI,CAE5E;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,eAAe,CAqBjG;AAED,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,kBAAkB,CAMlE;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,kBAAkB,GAAG,IAAI,CAKrF;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI,CAMzF;AAED,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEvE;AAED,wBAAgB,cAAc,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,CAAC,GAAG,IAAI,CAG/E;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAOhE;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMzE;AAED,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAIhF"}