@caelo-cms/provisioning 0.10.43 → 0.10.46

package/dist/provisioner-identity.js

@@ -0,0 +1,323 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * The keyless provisioner identity (#696, CLAUDE.md §11.C: "No long-lived
+ * service-account keys downloaded to disk on user machines").
+ *
+ * Every GCP install has a `caelo-provisioner` service account holding the
+ * roles Pulumi needs to converge the stack (gcloud.ts PROVISIONER_ROLES).
+ * Installers before #696 minted a JSON key for it into
+ * `~/.caelo-<id>/secrets/sa-key.json` and handed Pulumi that file. Now nobody
+ * holds a key: the operator's own Google login impersonates the account.
+ *
+ *   - The operator's gcloud account gets `roles/iam.serviceAccountTokenCreator`
+ *     on `caelo-provisioner` only (never project-wide), so it can mint
+ *     short-lived tokens for that one account and nothing else
+ *     ({@link ensureProvisionerImpersonation}).
+ *   - Pulumi's GCP provider runs with `GOOGLE_IMPERSONATE_SERVICE_ACCOUNT`
+ *     (wizards/gcp-pulumi.ts `pulumiGcpEnv`). Its source credential is the
+ *     operator's Application Default Credentials, which refresh themselves,
+ *     and the provider re-mints the impersonated token as it expires — so a
+ *     `pulumi up` longer than an hour does not fail on an expired token, as a
+ *     static `GOOGLE_OAUTH_ACCESS_TOKEN` would.
+ *     adc-impersonation.ts verifies that chain before Pulumi starts.
+ *   - An existing install's key is deleted, locally and in IAM, on its next
+ *     `upgrade` or installer run ({@link removeLegacyProvisionerKey}). Only the
+ *     IAM key whose id matches the local file is deleted; other user-managed
+ *     keys of the account are reported, never deleted blindly.
+ *
+ * Nothing here handles a token or private key material: the key file is
+ * read only for its id and account, and the file is then deleted.
+ */
+import { existsSync, readFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { gcloud as defaultGcloud } from "./gcloud.js";
+import { realSleep, runWithRetry } from "./gcloud-retry.js";
+/** Account id of the service account Pulumi converges the stack as. */
+export const PROVISIONER_ACCOUNT_ID = "caelo-provisioner";
+/** The role that lets the operator impersonate the provisioner. */
+export const TOKEN_CREATOR_ROLE = "roles/iam.serviceAccountTokenCreator";
+/** File name of the JSON key installers before #696 kept in `secrets/`. */
+export const LEGACY_SA_KEY_FILE = "sa-key.json";
+/**
+ * Environment variables that would make Google's client libraries use a
+ * credential other than the operator's Application Default Credentials —
+ * a key file (perhaps the deleted `sa-key.json`), a static token that expires
+ * after an hour, or another impersonation target. Removed from every
+ * infrastructure run so the chain is always ADC → impersonated provisioner.
+ */
+export const AMBIENT_GOOGLE_CREDENTIAL_ENV = [
+    "GOOGLE_APPLICATION_CREDENTIALS",
+    "GOOGLE_CREDENTIALS",
+    "GOOGLE_CLOUD_KEYFILE_JSON",
+    "GCLOUD_KEYFILE_JSON",
+    "GOOGLE_OAUTH_ACCESS_TOKEN",
+    "GOOGLE_IMPERSONATE_SERVICE_ACCOUNT",
+];
+/** `caelo-provisioner@<project>.iam.gserviceaccount.com`. */
+export function provisionerServiceAccountEmail(projectId) {
+    return `${PROVISIONER_ACCOUNT_ID}@${projectId}.iam.gserviceaccount.com`;
+}
+/** `base` without the credential variables {@link AMBIENT_GOOGLE_CREDENTIAL_ENV} lists. */
+export function withoutAmbientGoogleCredentials(base) {
+    const out = {};
+    for (const [k, v] of Object.entries(base)) {
+        if (v !== undefined && !AMBIENT_GOOGLE_CREDENTIAL_ENV.includes(k))
+            out[k] = v;
+    }
+    return out;
+}
+/** IAM member for a gcloud account: a service account when it is one, else a user. */
+export function operatorMember(account) {
+    const email = account.trim().toLowerCase();
+    return email.endsWith(".gserviceaccount.com") ? `serviceAccount:${email}` : `user:${email}`;
+}
+/**
+ * Give the operator's gcloud account `roles/iam.serviceAccountTokenCreator`
+ * on the provisioner service account (and on nothing else). Reads the
+ * account's IAM policy first, so an operator who was granted the role by
+ * someone else needs no IAM-write permission. Never throws for a gcloud
+ * failure.
+ */
+export async function ensureProvisionerImpersonation(target, deps = {}) {
+    const run = deps.run ?? defaultGcloud;
+    const sleep = deps.sleep ?? realSleep;
+    const sa = provisionerServiceAccountEmail(target.projectId);
+    const member = operatorMember(target.operatorAccount);
+    const project = `--project=${target.projectId}`;
+    const policy = await runWithRetry(run, sleep, [
+        "iam",
+        "service-accounts",
+        "get-iam-policy",
+        sa,
+        project,
+        "--format=json",
+    ]);
+    if (policy.ok) {
+        let parsed = {};
+        try {
+            parsed = JSON.parse(policy.stdout || "{}");
+        }
+        catch {
+            parsed = {};
+        }
+        // Only an unconditional binding counts: a conditional one (e.g. an
+        // expired time-limited grant) may not allow impersonation at all.
+        const has = (parsed.bindings ?? []).some((b) => b.role === TOKEN_CREATOR_ROLE &&
+            b.condition == null &&
+            (b.members ?? []).some((m) => m.toLowerCase() === member));
+        if (has)
+            return { ok: true, status: "already" };
+    }
+    const grant = await runWithRetry(run, sleep, [
+        "iam",
+        "service-accounts",
+        "add-iam-policy-binding",
+        sa,
+        project,
+        `--member=${member}`,
+        `--role=${TOKEN_CREATOR_ROLE}`,
+        "--condition=None",
+        "--quiet",
+    ]);
+    if (grant.ok)
+        return { ok: true, status: "granted" };
+    return { ok: false, error: grantError(target.projectId, sa, member, grant.stderr) };
+}
+function grantError(projectId, sa, member, stderr) {
+    const denied = /PERMISSION_DENIED|permission|403|not authorized/i.test(stderr);
+    return [
+        `Could not let ${member.replace(/^\w+:/, "")} impersonate ${sa}: ${stderr.trim() || "(no output)"}`,
+        denied
+            ? "Your gcloud account may not change that service account's IAM policy (it needs iam.serviceAccounts.setIamPolicy, e.g. roles/iam.serviceAccountAdmin or Owner on the project)."
+            : "",
+        "Ask a project Owner to run this once, then re-run:",
+        `  gcloud iam service-accounts add-iam-policy-binding ${sa} --project=${projectId} --member=${member} --role=${TOKEN_CREATOR_ROLE} --condition=None`,
+    ]
+        .filter(Boolean)
+        .join("\n");
+}
+/**
+ * Delete the provisioner's JSON key an installer before #696 minted: first
+ * the IAM key whose id matches the local file's `private_key_id`, then the
+ * file. The file is only removed once its key is gone from IAM, so a failed
+ * IAM delete can be retried on the next run. Other user-managed keys of the
+ * account are listed in `lines` with the command to delete them — never
+ * deleted here. Idempotent: no local file means nothing to do. Never throws
+ * for a gcloud failure.
+ */
+export async function removeLegacyProvisionerKey(target, deps = {}) {
+    const run = deps.run ?? defaultGcloud;
+    const sa = provisionerServiceAccountEmail(target.projectId);
+    const project = `--project=${target.projectId}`;
+    const keyPath = join(target.secretsDir, LEGACY_SA_KEY_FILE);
+    if (!existsSync(keyPath))
+        return { ok: true, status: "none", lines: [] };
+    const key = readKeyIdentity(keyPath);
+    if (!key.ok)
+        return { ok: false, error: key.error };
+    if (key.clientEmail !== sa) {
+        return {
+            ok: false,
+            error: `${keyPath} is a key for ${key.clientEmail}, not for ${sa}. It was left in place: check where it came from, delete it yourself, then re-run.`,
+        };
+    }
+    const list = await run([
+        "iam",
+        "service-accounts",
+        "keys",
+        "list",
+        `--iam-account=${sa}`,
+        project,
+        "--managed-by=user",
+        "--format=json",
+    ]);
+    if (!list.ok) {
+        return {
+            ok: false,
+            error: `Could not list the keys of ${sa}: ${list.stderr.trim()}\nYour gcloud account needs iam.serviceAccountKeys.list (e.g. roles/iam.serviceAccountKeyAdmin). ${keyPath} was left in place; re-run once fixed.`,
+        };
+    }
+    let ids;
+    try {
+        ids = JSON.parse(list.stdout || "[]")
+            .filter((k) => k.keyType === undefined || k.keyType === "USER_MANAGED")
+            .map((k) => (k.name ?? "").split("/").pop() ?? "")
+            .filter((id) => id.length > 0);
+    }
+    catch {
+        return { ok: false, error: `Could not read the key list of ${sa} (not JSON).` };
+    }
+    const lines = [];
+    let deletedKeyId;
+    if (ids.includes(key.keyId)) {
+        const del = await run([
+            "iam",
+            "service-accounts",
+            "keys",
+            "delete",
+            key.keyId,
+            `--iam-account=${sa}`,
+            project,
+            "--quiet",
+        ]);
+        if (!del.ok) {
+            return {
+                ok: false,
+                error: `Could not delete key ${key.keyId} of ${sa}: ${del.stderr.trim()}\nYour gcloud account needs iam.serviceAccountKeys.delete (e.g. roles/iam.serviceAccountKeyAdmin). ${keyPath} was left in place so the next run can match it; re-run once fixed.`,
+            };
+        }
+        deletedKeyId = key.keyId;
+        lines.push(`Deleted key ${key.keyId} of ${sa} in IAM.`);
+    }
+    else {
+        lines.push(`Key ${key.keyId} of ${sa} was already deleted in IAM.`);
+    }
+    rmSync(keyPath, { force: true });
+    lines.push(`Deleted ${keyPath}.`);
+    const others = ids.filter((id) => id !== key.keyId);
+    if (others.length > 0) {
+        lines.push(`${sa} has ${others.length} other user-managed key(s) Caelo did not record, left in place: ${others.join(", ")}.`, "Caelo no longer uses keys for this account. If nothing else does, delete them with:", ...others.map((id) => `  gcloud iam service-accounts keys delete ${id} --iam-account=${sa} ${project}`));
+    }
+    return { ok: true, status: "removed", ...(deletedKeyId ? { deletedKeyId } : {}), lines };
+}
+/** The key id + account of a JSON key file, without keeping its private key. */
+function readKeyIdentity(keyPath) {
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(keyPath, "utf8"));
+    }
+    catch {
+        return {
+            ok: false,
+            error: `${keyPath} is not a readable JSON key, so its IAM key can't be matched. Check the keys with \`gcloud iam service-accounts keys list --iam-account=<caelo-provisioner email> --managed-by=user\`, delete the one that file held, remove the file, then re-run.`,
+        };
+    }
+    const keyId = typeof parsed.private_key_id === "string" ? parsed.private_key_id : "";
+    const clientEmail = typeof parsed.client_email === "string" ? parsed.client_email : "";
+    if (!/^[0-9a-f]{40}$/i.test(keyId) || clientEmail === "") {
+        return {
+            ok: false,
+            error: `${keyPath} has no service-account key id or account, so its IAM key can't be matched. Check the keys with \`gcloud iam service-accounts keys list --iam-account=<caelo-provisioner email> --managed-by=user\`, delete the one that file held, remove the file, then re-run.`,
+        };
+    }
+    return { ok: true, keyId: keyId.toLowerCase(), clientEmail: clientEmail.toLowerCase() };
+}
+/** Delays between impersonation probes while a fresh TokenCreator grant propagates. */
+export const PROPAGATION_DELAYS_MS = [
+    5_000, 10_000, 15_000, 30_000, 60_000, 60_000,
+];
+/**
+ * Prove the operator's gcloud account can impersonate `sa` by having gcloud
+ * mint a short-lived token for it. The token on stdout is dropped unread.
+ * After a fresh grant, waits out IAM propagation.
+ */
+async function verifyGcloudImpersonation(run, sleep, sa, freshGrant) {
+    const delays = freshGrant ? PROPAGATION_DELAYS_MS : [];
+    const args = ["auth", "print-access-token", `--impersonate-service-account=${sa}`, "--quiet"];
+    let r = await run(args);
+    for (const delay of delays) {
+        if (r.ok)
+            break;
+        await sleep(delay);
+        r = await run(args);
+    }
+    if (r.ok)
+        return { ok: true };
+    return {
+        ok: false,
+        error: `Your gcloud account can't impersonate ${sa} yet, so its key was kept: ${r.stderr.trim() || "(no output)"}\nA grant made moments ago can take a few minutes to apply: wait, then re-run. If it persists, check that your account holds ${TOKEN_CREATOR_ROLE} on ${sa} without a condition.`,
+    };
+}
+/**
+ * Bring an install to the keyless provisioner (#696): the operator's gcloud
+ * account may impersonate `caelo-provisioner`, and a key an older installer
+ * minted is gone, locally and in IAM. The grant comes first, so a run that
+ * cannot set it up stops before the key — today's only working credential
+ * for older tooling — is deleted. Shared by the installer and `upgrade`;
+ * idempotent; never throws for a gcloud failure.
+ */
+export async function convergeKeylessProvisioner(target, deps = {}) {
+    const run = deps.run ?? defaultGcloud;
+    const sleep = deps.sleep ?? realSleep;
+    const sa = provisionerServiceAccountEmail(target.projectId);
+    const keyOnDisk = existsSync(join(target.secretsDir, LEGACY_SA_KEY_FILE));
+    const describeArgs = [
+        "iam",
+        "service-accounts",
+        "describe",
+        sa,
+        `--project=${target.projectId}`,
+        "--format=value(email)",
+    ];
+    const describe = target.justCreated
+        ? await runWithRetry(run, sleep, describeArgs)
+        : await run(describeArgs);
+    if (!describe.ok && !/NOT_FOUND|does not exist|not found/i.test(describe.stderr)) {
+        return { ok: false, error: `Could not read ${sa}: ${describe.stderr.trim()}` };
+    }
+    const exists = describe.ok && describe.stdout.trim().toLowerCase() === sa;
+    if (!exists && !keyOnDisk) {
+        return { ok: true, grant: "no-provisioner", legacyKey: "none", lines: [] };
+    }
+    if (!exists) {
+        return {
+            ok: false,
+            error: `${join(target.secretsDir, LEGACY_SA_KEY_FILE)} holds a key for ${sa}, but that service account does not exist in ${target.projectId}. The key is unusable: delete the file, then re-run.`,
+        };
+    }
+    const grant = await ensureProvisionerImpersonation({ projectId: target.projectId, operatorAccount: target.operatorAccount }, deps);
+    if (!grant.ok)
+        return grant;
+    // The key is still the install's working credential: delete it only once
+    // impersonation demonstrably works, not merely because a binding exists.
+    if (keyOnDisk) {
+        const works = await verifyGcloudImpersonation(run, sleep, sa, grant.status === "granted");
+        if (!works.ok)
+            return works;
+    }
+    const legacy = await removeLegacyProvisionerKey({ projectId: target.projectId, secretsDir: target.secretsDir }, { run });
+    if (!legacy.ok)
+        return legacy;
+    return { ok: true, grant: grant.status, legacyKey: legacy.status, lines: legacy.lines };
+}
+//# sourceMappingURL=provisioner-identity.js.map

package/dist/provisioner-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisioner-identity.js","sourceRoot":"","sources":["../src/provisioner-identity.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAqB,SAAS,EAAE,YAAY,EAAc,MAAM,mBAAmB,CAAC;AAE3F,uEAAuE;AACvE,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAE1D,mEAAmE;AACnE,MAAM,CAAC,MAAM,kBAAkB,GAAG,sCAAsC,CAAC;AAEzE,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAC;AAEhD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAsB;IAC9D,gCAAgC;IAChC,oBAAoB;IACpB,2BAA2B;IAC3B,qBAAqB;IACrB,2BAA2B;IAC3B,oCAAoC;CACrC,CAAC;AAEF,6DAA6D;AAC7D,MAAM,UAAU,8BAA8B,CAAC,SAAiB;IAC9D,OAAO,GAAG,sBAAsB,IAAI,SAAS,0BAA0B,CAAC;AAC1E,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,+BAA+B,CAAC,IAAuB;IACrE,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,6BAA6B,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,OAAO,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,EAAE,CAAC;AAC9F,CAAC;AAUD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,MAAwE,EACxE,OAA8C,EAAE;IAEhD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,EAAE,GAAG,8BAA8B,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,aAAa,MAAM,CAAC,SAAS,EAAE,CAAC;IAEhD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE;QAC5C,KAAK;QACL,kBAAkB;QAClB,gBAAgB;QAChB,EAAE;QACF,OAAO;QACP,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,IAAI,MAAM,GAAc,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAc,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,EAAE,CAAC;QACd,CAAC;QACD,mEAAmE;QACnE,kEAAkE;QAClE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CACtC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,IAAI,KAAK,kBAAkB;YAC7B,CAAC,CAAC,SAAS,IAAI,IAAI;YACnB,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAC5D,CAAC;QACF,IAAI,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAClD,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE;QAC3C,KAAK;QACL,kBAAkB;QAClB,wBAAwB;QACxB,EAAE;QACF,OAAO;QACP,YAAY,MAAM,EAAE;QACpB,UAAU,kBAAkB,EAAE;QAC9B,kBAAkB;QAClB,SAAS;KACV,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;AACtF,CAAC;AAED,SAAS,UAAU,CAAC,SAAiB,EAAE,EAAU,EAAE,MAAc,EAAE,MAAc;IAC/E,MAAM,MAAM,GAAG,kDAAkD,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/E,OAAO;QACL,iBAAiB,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,gBAAgB,EAAE,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,aAAa,EAAE;QACnG,MAAM;YACJ,CAAC,CAAC,+KAA+K;YACjL,CAAC,CAAC,EAAE;QACN,oDAAoD;QACpD,wDAAwD,EAAE,cAAc,SAAS,aAAa,MAAM,WAAW,kBAAkB,mBAAmB;KACrJ;SACE,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAmBD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAAmE,EACnE,OAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,EAAE,GAAG,8BAA8B,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,aAAa,MAAM,CAAC,SAAS,EAAE,CAAC;IAChD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;IAC5D,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAEzE,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;IACpD,IAAI,GAAG,CAAC,WAAW,KAAK,EAAE,EAAE,CAAC;QAC3B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,OAAO,iBAAiB,GAAG,CAAC,WAAW,aAAa,EAAE,oFAAoF;SACrJ,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC;QACrB,KAAK;QACL,kBAAkB;QAClB,MAAM;QACN,MAAM;QACN,iBAAiB,EAAE,EAAE;QACrB,OAAO;QACP,mBAAmB;QACnB,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,8BAA8B,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,oGAAoG,OAAO,wCAAwC;SAClN,CAAC;IACJ,CAAC;IACD,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAA4B;aAC9D,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,KAAK,cAAc,CAAC;aACtE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;aACjD,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kCAAkC,EAAE,cAAc,EAAE,CAAC;IAClF,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,YAAgC,CAAC;IACrC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC;YACpB,KAAK;YACL,kBAAkB;YAClB,MAAM;YACN,QAAQ;YACR,GAAG,CAAC,KAAK;YACT,iBAAiB,EAAE,EAAE;YACrB,OAAO;YACP,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,wBAAwB,GAAG,CAAC,KAAK,OAAO,EAAE,KAAK,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,sGAAsG,OAAO,qEAAqE;aAC1P,CAAC;QACJ,CAAC;QACD,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,eAAe,GAAG,CAAC,KAAK,OAAO,EAAE,UAAU,CAAC,CAAC;IAC1D,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,KAAK,OAAO,EAAE,8BAA8B,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACjC,KAAK,CAAC,IAAI,CAAC,WAAW,OAAO,GAAG,CAAC,CAAC;IAElC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CACR,GAAG,EAAE,QAAQ,MAAM,CAAC,MAAM,mEAAmE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EACjH,qFAAqF,EACrF,GAAG,MAAM,CAAC,GAAG,CACX,CAAC,EAAE,EAAE,EAAE,CAAC,6CAA6C,EAAE,kBAAkB,EAAE,IAAI,OAAO,EAAE,CACzF,CACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;AAC3F,CAAC;AAED,gFAAgF;AAChF,SAAS,eAAe,CACtB,OAAe;IAEf,IAAI,MAA4D,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAkB,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,OAAO,qPAAqP;SACvQ,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;IACrF,MAAM,WAAW,GAAG,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IACvF,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;QACzD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,OAAO,mQAAmQ;SACrR,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC;AAC1F,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAC9C,CAAC;AAEF;;;;GAIG;AACH,KAAK,UAAU,yBAAyB,CACtC,GAAiB,EACjB,KAAY,EACZ,EAAU,EACV,UAAmB;IAEnB,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,oBAAoB,EAAE,iCAAiC,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9F,IAAI,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,EAAE;YAAE,MAAM;QAChB,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC9B,OAAO;QACL,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,yCAAyC,EAAE,8BAA8B,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,aAAa,gIAAgI,kBAAkB,OAAO,EAAE,uBAAuB;KACnS,CAAC;AACJ,CAAC;AAYD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MASC,EACD,OAA8C,EAAE;IAEhD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,EAAE,GAAG,8BAA8B,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC1E,MAAM,YAAY,GAAG;QACnB,KAAK;QACL,kBAAkB;QAClB,UAAU;QACV,EAAE;QACF,aAAa,MAAM,CAAC,SAAS,EAAE;QAC/B,uBAAuB;KACxB,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW;QACjC,CAAC,CAAC,MAAM,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC;QAC9C,CAAC,CAAC,MAAM,GAAG,CAAC,YAAY,CAAC,CAAC;IAC5B,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,qCAAqC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACjF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACjF,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC;IAC1E,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,kBAAkB,CAAC,oBAAoB,EAAE,gDAAgD,MAAM,CAAC,SAAS,sDAAsD;SAClM,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,8BAA8B,CAChD,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,EACxE,IAAI,CACL,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC5B,yEAAyE;IACzE,yEAAyE;IACzE,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;QAC1F,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;IAC9B,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAC7C,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,EAC9D,EAAE,GAAG,EAAE,CACR,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAC9B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AAC1F,CAAC"}

package/dist/regions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"regions.d.ts","sourceRoot":"","sources":["../src/regions.ts"],"names":[],"mappings":"AA0BA,OAAO,EAOL,KAAK,YAAY,EAClB,MAAM,kBAAkB,CAAC;AAE1B,8EAA8E;AAC9E,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,cAAc,GAAG,KAAK,GAAG,OAAO,CAAC;AAExE,wCAAwC;AACxC,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,0EAA0E;AAC1E,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;AAErF,yFAAyF;AACzF,eAAO,MAAM,MAAM,EAAE,SAiBjB,CAAC;AA+CL,+EAA+E;AAC/E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,wEAAwE;IACxE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;IAC1C,iFAAiF;IACjF,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,iFAAiF;IACjF,QAAQ,CAAC,WAAW,CAAC,EAAE,CACrB,GAAG,EAAE,SAAS,KACX,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjF;AAYD,yCAAyC;AACzC,wBAAgB,aAAa,CAAC,QAAQ,EAAE,gBAAgB,GAAG,aAAa,CAqBvE;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,gBAAgB,EAC1B,GAAG,GAAE,SAAkB,GACtB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,YAAY,EAAE,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAM/E;AAED,mDAAmD;AACnD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,GAAG,MAAM,CAEzE;AAED;;;GAGG;AACH,wBAAgB,WAAW,CACzB,QAAQ,EAAE,gBAAgB,EAC1B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,SAAS,YAAY,EAAE,GAC/B;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAO7C;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,gBAAgB,EAC1B,GAAG,GAAE,SAAkB,EACvB,GAAG,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAe,GAC9D,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAuBxB;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,gBAAgB,EAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,EAAE,SAAS,YAAY,EAAE,GAC/B;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,KAAK,GAAG,YAAY,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAcjE;AAED,mEAAmE;AACnE,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAChB,MAAM,CAMR;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,cAAc,GAAG,UAAU,CAAA;CAAE,GAC9F;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAExD,6DAA6D;AAC7D,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAClC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;CAC3C,GAAG,cAAc,CAmCjB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC,GAAG,MAAM,CAOT;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EACpE,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,MAAM,CAMR"}
+{"version":3,"file":"regions.d.ts","sourceRoot":"","sources":["../src/regions.ts"],"names":[],"mappings":"AA0BA,OAAO,EAOL,KAAK,YAAY,EAClB,MAAM,kBAAkB,CAAC;AAG1B,8EAA8E;AAC9E,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,cAAc,GAAG,KAAK,GAAG,OAAO,CAAC;AAExE,wCAAwC;AACxC,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,0EAA0E;AAC1E,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;AAErF,yFAAyF;AACzF,eAAO,MAAM,MAAM,EAAE,SAiBjB,CAAC;AA+CL,+EAA+E;AAC/E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,wEAAwE;IACxE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;IAC1C,iFAAiF;IACjF,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,iFAAiF;IACjF,QAAQ,CAAC,WAAW,CAAC,EAAE,CACrB,GAAG,EAAE,SAAS,KACX,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjF;AAYD,yCAAyC;AACzC,wBAAgB,aAAa,CAAC,QAAQ,EAAE,gBAAgB,GAAG,aAAa,CAqBvE;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,gBAAgB,EAC1B,GAAG,GAAE,SAAkB,GACtB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,YAAY,EAAE,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAM/E;AAED,mDAAmD;AACnD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,GAAG,MAAM,CAEzE;AAED;;;GAGG;AACH,wBAAgB,WAAW,CACzB,QAAQ,EAAE,gBAAgB,EAC1B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,SAAS,YAAY,EAAE,GAC/B;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAO7C;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,gBAAgB,EAC1B,GAAG,GAAE,SAAkB,EACvB,GAAG,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAe,GAC9D,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAuBxB;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,gBAAgB,EAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,EAAE,SAAS,YAAY,EAAE,GAC/B;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,KAAK,GAAG,YAAY,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAcjE;AAED,mEAAmE;AACnE,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAChB,MAAM,CAMR;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,cAAc,GAAG,UAAU,CAAA;CAAE,GAC9F;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAExD,6DAA6D;AAC7D,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAClC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;CAC3C,GAAG,cAAc,CAmCjB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC,GAAG,MAAM,CAOT;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EACpE,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,MAAM,CAMR"}

package/dist/regions.js

@@ -23,6 +23,7 @@
 import { spawn } from "node:child_process";
 import { gcloudEnv } from "./gcloud.js";
 import { AWS_REGIONS, AZURE_REGIONS, GCP_REGION_NAMES, GCP_RESTRICTED_REGIONS, GCP_SERVICE_REGIONS, GCP_SERVICES, } from "./region-data.js";
+import { selfCommand } from "./self-command.js";
 /** Default {@link CliRunner}: spawns the binary; a missing binary is a failed result. */
 export const runCli = (cmd, args) => new Promise((resolve) => {
     // gcloudEnv: a hidden gcloud prompt would hang this captured run; the
@@ -232,7 +233,7 @@ export function decideRegion(input) {
  */
 export function requireInstallRegion(meta) {
     if (!meta.region) {
-        throw new Error(`install ${meta.installId} has no region recorded in install.json. Re-run the installer (\`bunx @caelo-cms/provisioning\`, pick "Resume wizard"): it reads the region from the deployed services and records it.`);
+        throw new Error(`install ${meta.installId} has no region recorded in install.json. Re-run the installer (\`${selfCommand()}\`, pick "Resume wizard"): it reads the region from the deployed services and records it.`);
     }
     return meta.region;
 }

package/dist/regions.js.map

@@ -1 +1 @@
-{"version":3,"file":"regions.js","sourceRoot":"","sources":["../src/regions.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EACL,WAAW,EACX,aAAa,EACb,gBAAgB,EAChB,sBAAsB,EACtB,mBAAmB,EACnB,YAAY,GAEb,MAAM,kBAAkB,CAAC;AAe1B,yFAAyF;AACzF,MAAM,CAAC,MAAM,MAAM,GAAc,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAC7C,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;IACtB,sEAAsE;IACtE,sCAAsC;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAC7F,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAChF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CACzB,OAAO,CAAC;QACN,EAAE,EAAE,IAAI,KAAK,CAAC;QACd,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC3C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;KAC5C,CAAC,CACH,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL;;;;GAIG;AACH,KAAK,UAAU,8BAA8B,CAC3C,GAAc;IAEd,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE;QACxB,UAAU;QACV,MAAM;QACN,aAAa;QACb,eAAe;QACf,SAAS;QACT,qEAAqE;QACrE,UAAU;QACV,MAAM;KACP,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACV,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,uGAAuG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,WAAW,4DAA4D;SACzM,CAAC;IACJ,CAAC;IACD,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iDAAiD,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IAClG,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oDAAoD,EAAE,CAAC;IACpF,CAAC;IACD,oEAAoE;IACpE,kDAAkD;IAClD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;KAChF,CAAC;AACJ,CAAC;AAoBD,SAAS,UAAU,CAAC,QAAgC;IAClD,MAAM,QAAQ,GAAa,CAAC,GAAG,YAAY,CAAC,CAAC;IAC7C,IAAI,QAAQ,KAAK,cAAc;QAAE,QAAQ,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC;SAC1C,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,sBAAsB,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;SACrF,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,gBAAgB,CAAC,EAAE,CAAW,EAAE,CAAC,CAAC,CAAC;IAC/D,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AACpE,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,aAAa,CAAC,QAA0B;IACtD,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,KAAK,CAAC;QACX,KAAK,cAAc;YACjB,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC9B,KAAK,KAAK;YACR,OAAO;gBACL,QAAQ;gBACR,SAAS,EAAE,cAAc;gBACzB,OAAO,EAAE,WAAW;gBACpB,QAAQ,EAAE,CAAC,aAAa,EAAE,oBAAoB,EAAE,IAAI,EAAE,iBAAiB,CAAC;aACzE,CAAC;QACJ,KAAK,OAAO;YACV,OAAO;gBACL,QAAQ;gBACR,SAAS,EAAE,YAAY;gBACvB,OAAO,EAAE,aAAa;gBACtB,QAAQ,EAAE,CAAC,gBAAgB,EAAE,yCAAyC,EAAE,WAAW,CAAC;gBACpF,WAAW,EAAE,8BAA8B;aAC5C,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAA0B,EAC1B,MAAiB,MAAM;IAEvB,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,CAAC,WAAW;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7E,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AACtF,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,gBAAgB,CAAC,OAAgC;IAC/D,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CACzB,QAA0B,EAC1B,MAAc,EACd,OAAgC;IAEhC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC9D,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7D,OAAO;QACL,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,IAAI,MAAM,yBAAyB,QAAQ,8BAA8B,QAAQ,wCAAwC,gBAAgB,CAAC,OAAO,CAAC,GAAG;KAC7J,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAA0B,EAC1B,MAAiB,MAAM,EACvB,MAAoD,OAAO,CAAC,GAAG;IAE/D,MAAM,KAAK,GAAG,CAAC,CAAY,EAAE,EAAE;QAC7B,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC,CAAC;IACF,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,KAAK,CAAC;QACX,KAAK,cAAc;YACjB,OAAO,CACL,KAAK,CAAC,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC;gBACjE,KAAK,CAAC,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC,CAAC,CACtE,CAAC;QACJ,KAAK,KAAK;YACR,OAAO,CACL,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE;gBACtB,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE;gBAC9B,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CACxD,CAAC;QACJ,KAAK,OAAO;YACV,OAAO,KAAK,CACV,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CACzF,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,QAA0B,EAC1B,SAAwB,EACxB,OAAgC;IAEhC,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC;IACpD,IAAI,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,EAAE,CAAC;QACzD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC9C,CAAC;IACD,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,YAAY;QACpB,GAAG,CAAC,SAAS;YACX,CAAC,CAAC;gBACE,IAAI,EAAE,6BAA6B,SAAS,wCAAwC,aAAa,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,SAAS,WAAW;aACrK;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,mBAAmB,CACjC,SAAiB,EACjB,QAAgB,EAChB,SAAiB;IAEjB,OAAO,CACL,WAAW,SAAS,YAAY,QAAQ,2CAA2C,SAAS,qBAAqB;QACjH,iEAAiE,QAAQ,sDAAsD;QAC/H,6CAA6C,QAAQ,uDAAuD,CAC7G,CAAC;AACJ,CAAC;AAmBD,6DAA6D;AAC7D,MAAM,UAAU,YAAY,CAAC,KAc5B;IACC,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC1E,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,+BAA+B,KAAK,CAAC,QAAQ,QAAQ,KAAK,CAAC,SAAS,6BAA6B,KAAK,CAAC,QAAQ,oEAAoE;SAC3L,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC;IAC/C,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;YACjD,OAAO;gBACL,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC;aACpE,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;IAC7F,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1E,OAAO,KAAK,CAAC,EAAE;YACb,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,EAAE;YAC1C,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IAC7C,CAAC;IACD,MAAM,WAAW,GACf,KAAK,CAAC,WAAW,IAAI,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE;QACnF,CAAC,CAAC,KAAK,CAAC,WAAW;QACnB,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,IAAI,WAAW;YAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAC7D,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,mIAAmI,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG;SAC7K,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAGpC;IACC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,CAAC,SAAS,wLAAwL,CAClN,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAoE,EACpE,SAA6B;IAE7B,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,SAAS,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"regions.js","sourceRoot":"","sources":["../src/regions.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EACL,WAAW,EACX,aAAa,EACb,gBAAgB,EAChB,sBAAsB,EACtB,mBAAmB,EACnB,YAAY,GAEb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAehD,yFAAyF;AACzF,MAAM,CAAC,MAAM,MAAM,GAAc,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAC7C,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;IACtB,sEAAsE;IACtE,sCAAsC;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAC7F,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAChF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CACzB,OAAO,CAAC;QACN,EAAE,EAAE,IAAI,KAAK,CAAC;QACd,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC3C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;KAC5C,CAAC,CACH,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL;;;;GAIG;AACH,KAAK,UAAU,8BAA8B,CAC3C,GAAc;IAEd,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE;QACxB,UAAU;QACV,MAAM;QACN,aAAa;QACb,eAAe;QACf,SAAS;QACT,qEAAqE;QACrE,UAAU;QACV,MAAM;KACP,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACV,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,uGAAuG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,WAAW,4DAA4D;SACzM,CAAC;IACJ,CAAC;IACD,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iDAAiD,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IAClG,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oDAAoD,EAAE,CAAC;IACpF,CAAC;IACD,oEAAoE;IACpE,kDAAkD;IAClD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;KAChF,CAAC;AACJ,CAAC;AAoBD,SAAS,UAAU,CAAC,QAAgC;IAClD,MAAM,QAAQ,GAAa,CAAC,GAAG,YAAY,CAAC,CAAC;IAC7C,IAAI,QAAQ,KAAK,cAAc;QAAE,QAAQ,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC;SAC1C,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,sBAAsB,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;SACrF,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,gBAAgB,CAAC,EAAE,CAAW,EAAE,CAAC,CAAC,CAAC;IAC/D,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AACpE,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,aAAa,CAAC,QAA0B;IACtD,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,KAAK,CAAC;QACX,KAAK,cAAc;YACjB,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC9B,KAAK,KAAK;YACR,OAAO;gBACL,QAAQ;gBACR,SAAS,EAAE,cAAc;gBACzB,OAAO,EAAE,WAAW;gBACpB,QAAQ,EAAE,CAAC,aAAa,EAAE,oBAAoB,EAAE,IAAI,EAAE,iBAAiB,CAAC;aACzE,CAAC;QACJ,KAAK,OAAO;YACV,OAAO;gBACL,QAAQ;gBACR,SAAS,EAAE,YAAY;gBACvB,OAAO,EAAE,aAAa;gBACtB,QAAQ,EAAE,CAAC,gBAAgB,EAAE,yCAAyC,EAAE,WAAW,CAAC;gBACpF,WAAW,EAAE,8BAA8B;aAC5C,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAA0B,EAC1B,MAAiB,MAAM;IAEvB,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,CAAC,WAAW;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7E,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AACtF,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,gBAAgB,CAAC,OAAgC;IAC/D,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CACzB,QAA0B,EAC1B,MAAc,EACd,OAAgC;IAEhC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC9D,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7D,OAAO;QACL,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,IAAI,MAAM,yBAAyB,QAAQ,8BAA8B,QAAQ,wCAAwC,gBAAgB,CAAC,OAAO,CAAC,GAAG;KAC7J,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAA0B,EAC1B,MAAiB,MAAM,EACvB,MAAoD,OAAO,CAAC,GAAG;IAE/D,MAAM,KAAK,GAAG,CAAC,CAAY,EAAE,EAAE;QAC7B,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC,CAAC;IACF,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,KAAK,CAAC;QACX,KAAK,cAAc;YACjB,OAAO,CACL,KAAK,CAAC,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC;gBACjE,KAAK,CAAC,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC,CAAC,CACtE,CAAC;QACJ,KAAK,KAAK;YACR,OAAO,CACL,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE;gBACtB,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE;gBAC9B,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CACxD,CAAC;QACJ,KAAK,OAAO;YACV,OAAO,KAAK,CACV,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CACzF,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,QAA0B,EAC1B,SAAwB,EACxB,OAAgC;IAEhC,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC;IACpD,IAAI,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,EAAE,CAAC;QACzD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC9C,CAAC;IACD,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,YAAY;QACpB,GAAG,CAAC,SAAS;YACX,CAAC,CAAC;gBACE,IAAI,EAAE,6BAA6B,SAAS,wCAAwC,aAAa,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,SAAS,WAAW;aACrK;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,mBAAmB,CACjC,SAAiB,EACjB,QAAgB,EAChB,SAAiB;IAEjB,OAAO,CACL,WAAW,SAAS,YAAY,QAAQ,2CAA2C,SAAS,qBAAqB;QACjH,iEAAiE,QAAQ,sDAAsD;QAC/H,6CAA6C,QAAQ,uDAAuD,CAC7G,CAAC;AACJ,CAAC;AAmBD,6DAA6D;AAC7D,MAAM,UAAU,YAAY,CAAC,KAc5B;IACC,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC1E,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,+BAA+B,KAAK,CAAC,QAAQ,QAAQ,KAAK,CAAC,SAAS,6BAA6B,KAAK,CAAC,QAAQ,oEAAoE;SAC3L,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC;IAC/C,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;YACjD,OAAO;gBACL,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC;aACpE,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;IAC7F,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1E,OAAO,KAAK,CAAC,EAAE;YACb,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,EAAE;YAC1C,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IAC7C,CAAC;IACD,MAAM,WAAW,GACf,KAAK,CAAC,WAAW,IAAI,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE;QACnF,CAAC,CAAC,KAAK,CAAC,WAAW;QACnB,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,IAAI,WAAW;YAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAC7D,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,mIAAmI,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG;SAC7K,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAGpC;IACC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,CAAC,SAAS,oEAAoE,WAAW,EAAE,2FAA2F,CACtM,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAoE,EACpE,SAA6B;IAE7B,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,SAAS,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/release-contract.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Release-contract constants that every signed release manifest carries
+ * (epic #696). The infrastructure contract number itself lives in
+ * infra-contract.ts (shared with the upgrade split's `needsConverge`);
+ * this module says which files can change it and the min-from version. They tell an upgrader, without running any code from the
+ * new release, whether the release can be installed as an app-roll or
+ * needs the operator's own identity.
+ *
+ * The admin's upgrader job (Phase 2) only rolls images: it holds no IAM
+ * write, no secret create, no resource create. Anything a release needs
+ * beyond "new image digests + expand-only migrations" must therefore be
+ * declared here, so the upgrader refuses it and sends the Owner to the
+ * "Run in Cloud Shell" path instead of half-applying it.
+ */
+/**
+ * Oldest installed version a release can be applied to directly. An
+ * install below it has to step through an intermediate release first.
+ *
+ * Raise it when a release depends on a migration or runtime change that
+ * an older install has not been through (the expand/contract rule only
+ * guarantees N-1 → N).
+ */
+export declare const RELEASE_MIN_FROM_VERSION = "0.10.0";
+/**
+ * Repo-relative paths (a trailing `/` means "everything below") whose
+ * changes can alter the infrastructure contract. Tests and READMEs under
+ * them are ignored — see {@link isInfraContractPath}.
+ */
+export declare const INFRA_CONTRACT_PATHS: readonly string[];
+/**
+ * Whether a changed repo-relative path can alter the infrastructure
+ * contract.
+ *
+ * @param path - a path as `git diff --name-only` prints it.
+ */
+export declare function isInfraContractPath(path: string): boolean;
+//# sourceMappingURL=release-contract.d.ts.map

package/dist/release-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-contract.d.ts","sourceRoot":"","sources":["../src/release-contract.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;GAaG;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,WAAW,CAAC;AAEjD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAajD,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGzD"}

package/dist/release-contract.js

@@ -0,0 +1,55 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * Release-contract constants that every signed release manifest carries
+ * (epic #696). The infrastructure contract number itself lives in
+ * infra-contract.ts (shared with the upgrade split's `needsConverge`);
+ * this module says which files can change it and the min-from version. They tell an upgrader, without running any code from the
+ * new release, whether the release can be installed as an app-roll or
+ * needs the operator's own identity.
+ *
+ * The admin's upgrader job (Phase 2) only rolls images: it holds no IAM
+ * write, no secret create, no resource create. Anything a release needs
+ * beyond "new image digests + expand-only migrations" must therefore be
+ * declared here, so the upgrader refuses it and sends the Owner to the
+ * "Run in Cloud Shell" path instead of half-applying it.
+ */
+/**
+ * Oldest installed version a release can be applied to directly. An
+ * install below it has to step through an intermediate release first.
+ *
+ * Raise it when a release depends on a migration or runtime change that
+ * an older install has not been through (the expand/contract rule only
+ * guarantees N-1 → N).
+ */
+export const RELEASE_MIN_FROM_VERSION = "0.10.0";
+/**
+ * Repo-relative paths (a trailing `/` means "everything below") whose
+ * changes can alter the infrastructure contract. Tests and READMEs under
+ * them are ignored — see {@link isInfraContractPath}.
+ */
+export const INFRA_CONTRACT_PATHS = [
+    "packages/provisioning/stacks/",
+    "packages/provisioning/src/stack-contract.ts",
+    "packages/provisioning/src/stack-converge.ts",
+    "packages/provisioning/src/runtime-secrets.ts",
+    "packages/provisioning/src/operator-access.ts",
+    "packages/provisioning/src/gcp-names.ts",
+    // Upgrade-time mutators outside stack-converge: the converge half of the
+    // upgrade (it decides which ensure* steps run), the MCP IAP service
+    // account + bindings, the default firewall policy.
+    "packages/provisioning/src/upgrade/converge.ts",
+    "packages/provisioning/src/mcp-iap.ts",
+    "packages/provisioning/src/default-firewall.ts",
+];
+/**
+ * Whether a changed repo-relative path can alter the infrastructure
+ * contract.
+ *
+ * @param path - a path as `git diff --name-only` prints it.
+ */
+export function isInfraContractPath(path) {
+    if (/\.test\.ts$/.test(path) || /(^|\/)README\.md$/.test(path))
+        return false;
+    return INFRA_CONTRACT_PATHS.some((p) => (p.endsWith("/") ? path.startsWith(p) : path === p));
+}
+//# sourceMappingURL=release-contract.js.map

package/dist/release-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-contract.js","sourceRoot":"","sources":["../src/release-contract.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;GAaG;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,QAAQ,CAAC;AAEjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,+BAA+B;IAC/B,6CAA6C;IAC7C,6CAA6C;IAC7C,8CAA8C;IAC9C,8CAA8C;IAC9C,wCAAwC;IACxC,yEAAyE;IACzE,oEAAoE;IACpE,mDAAmD;IACnD,+CAA+C;IAC/C,sCAAsC;IACtC,+CAA+C;CAChD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7E,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC"}