@caelo-cms/provisioning 0.10.49 → 0.10.51

package/dist/gateway-credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gateway-credentials.d.ts","sourceRoot":"","sources":["../src/gateway-credentials.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAE7D,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAElB,KAAK,SAAS,EAEf,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,cAAc,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,EACjD,GAAG,EAAE,MAAM,GACV,OAAO,CAIT;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;CAC3B;AAED,yDAAyD;AACzD,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,kBAAkB,EAC1B,IAAI,GAAE,qBAA0B,GAC/B,OAAO,CAAC,aAAa,CAAC,CAExB;AAED,iDAAiD;AACjD,MAAM,WAAW,gBAAgB;IAC/B,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,iEAAiE;IACjE,iBAAiB,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IAC5C;;;OAGG;IACH,sBAAsB,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3C;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,kBAAkB,EAC1B,cAAc,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,EACjD,IAAI,GAAE,qBAA0B,GAC/B,gBAAgB,CAgClB;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EAC7D,IAAI,GAAE;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,YAAY,CAAA;CAAO,GACzC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiBxB"}
+{"version":3,"file":"gateway-credentials.d.ts","sourceRoot":"","sources":["../src/gateway-credentials.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAE7D,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAElB,KAAK,SAAS,EAEf,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,cAAc,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,EACjD,GAAG,EAAE,MAAM,GACV,OAAO,CAIT;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;CAC3B;AAED,yDAAyD;AACzD,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,kBAAkB,EAC1B,IAAI,GAAE,qBAA0B,GAC/B,OAAO,CAAC,aAAa,CAAC,CAExB;AAED,iDAAiD;AACjD,MAAM,WAAW,gBAAgB;IAC/B,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,iEAAiE;IACjE,iBAAiB,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IAC5C;;;OAGG;IACH,sBAAsB,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3C;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,kBAAkB,EAC1B,cAAc,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,EACjD,IAAI,GAAE,qBAA0B,GAC/B,gBAAgB,CAgClB;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EAC7D,IAAI,GAAE;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,YAAY,CAAA;CAAO,GACzC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiBxB"}

package/dist/gateway-credentials.js

@@ -1,9 +1,12 @@
 // SPDX-License-Identifier: MPL-2.0
 /**
  * Moving an existing install's API gateway off admin_role (issue #613),
- * as `cms-provision upgrade` does it. The env side — GATEWAY_DATABASE_URL
- * and the per-role password secrets in, ADMIN_DATABASE_* out — rides the
- * gateway's roll (stack-contract.ts). The database side is ordered around
+ * as `cms-provision upgrade` does it. The env side — the per-role password
+ * secrets in, ADMIN_DATABASE_* out (and, since #635, GATEWAY_DATABASE_* out
+ * too: the gateway has no cms_admin login at all) — rides the gateway's
+ * roll (stack-contract.ts). gateway_role keeps getting its password until
+ * the contract release drops the role, because the previous release's
+ * gateway logs in with it until it is rolled. The database side is ordered around
  * that roll so /api/* keeps working:
  *
  *   1. after migrations (which create `gateway_role` without a password):

package/dist/gateway-credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"gateway-credentials.js","sourceRoot":"","sources":["../src/gateway-credentials.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAGL,0BAA0B,EAE1B,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAG3D;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,cAAiD,EACjD,GAAW;IAEX,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAC/D,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;AAChG,CAAC;AAQD,yDAAyD;AACzD,MAAM,UAAU,yBAAyB,CACvC,MAA0B,EAC1B,OAA8B,EAAE;IAEhC,OAAO,0BAA0B,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;AAClE,CAAC;AAeD,6EAA6E;AAC7E,MAAM,UAAU,oBAAoB,CAClC,MAA0B,EAC1B,cAAiD,EACjD,OAA8B,EAAE;IAEhC,MAAM,KAAK,GAAG,sBAAsB,CAAC,cAAc,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,OAAO;QACL,KAAK;QACL,KAAK,CAAC,iBAAiB;YACrB,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC;YAC9E,QAAQ,GAAG,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC;YACjD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,KAAK,CAAC,sBAAsB;YAC1B,IAAI,CAAC,QAAQ;gBAAE,OAAO,6BAA6B,CAAC;YACpD,kEAAkE;YAClE,MAAM,KAAK,GAAG,MAAM,eAAe,CACjC,IAAI,CAAC,GAAG,IAAI,aAAa,EACzB,MAAM,EACN,oBAAoB,CAAC,UAAU,CAChC,CAAC;YACF,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gBACd,OAAO,+DAA+D,KAAK,CAAC,KAAK,gDAAgD,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,mBAAmB,CAAC,UAAU,CAAC;YAC1L,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,MAAM,EAAE,aAAa,EAAE;gBACvE,GAAG,IAAI;gBACP,QAAQ,EAAE,KAAK,CAAC,KAAK;aACtB,CAAC,CAAC;YACH,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAClC,OAAO,+DAA+D,QAAQ,CAAC,KAAK,IAAI,GAAG,gDAAgD,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,mBAAmB,CAAC,UAAU,CAAC;YACpM,CAAC;YACD,QAAQ,GAAG,KAAK,CAAC;YACjB,OAAO,uEAAuE,CAAC;QACjF,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAA6D,EAC7D,OAAwC,EAAE;IAE1C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC;QAClB,KAAK;QACL,WAAW;QACX,MAAM;QACN,aAAa,OAAO,CAAC,SAAS,EAAE;QAChC,kBAAkB,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK;QACjD,sBAAsB;KACvB,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,CACL,CAAC,CAAC,MAAM;SACL,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,CACrC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"gateway-credentials.js","sourceRoot":"","sources":["../src/gateway-credentials.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAGL,0BAA0B,EAE1B,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAG3D;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,cAAiD,EACjD,GAAW;IAEX,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAC/D,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;AAChG,CAAC;AAQD,yDAAyD;AACzD,MAAM,UAAU,yBAAyB,CACvC,MAA0B,EAC1B,OAA8B,EAAE;IAEhC,OAAO,0BAA0B,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;AAClE,CAAC;AAeD,6EAA6E;AAC7E,MAAM,UAAU,oBAAoB,CAClC,MAA0B,EAC1B,cAAiD,EACjD,OAA8B,EAAE;IAEhC,MAAM,KAAK,GAAG,sBAAsB,CAAC,cAAc,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,OAAO;QACL,KAAK;QACL,KAAK,CAAC,iBAAiB;YACrB,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC;YAC9E,QAAQ,GAAG,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC;YACjD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,KAAK,CAAC,sBAAsB;YAC1B,IAAI,CAAC,QAAQ;gBAAE,OAAO,6BAA6B,CAAC;YACpD,kEAAkE;YAClE,MAAM,KAAK,GAAG,MAAM,eAAe,CACjC,IAAI,CAAC,GAAG,IAAI,aAAa,EACzB,MAAM,EACN,oBAAoB,CAAC,UAAU,CAChC,CAAC;YACF,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gBACd,OAAO,+DAA+D,KAAK,CAAC,KAAK,gDAAgD,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,mBAAmB,CAAC,UAAU,CAAC;YAC1L,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,MAAM,EAAE,aAAa,EAAE;gBACvE,GAAG,IAAI;gBACP,QAAQ,EAAE,KAAK,CAAC,KAAK;aACtB,CAAC,CAAC;YACH,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAClC,OAAO,+DAA+D,QAAQ,CAAC,KAAK,IAAI,GAAG,gDAAgD,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,mBAAmB,CAAC,UAAU,CAAC;YACpM,CAAC;YACD,QAAQ,GAAG,KAAK,CAAC;YACjB,OAAO,uEAAuE,CAAC;QACjF,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAA6D,EAC7D,OAAwC,EAAE;IAE1C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC;QAClB,KAAK;QACL,WAAW;QACX,MAAM;QACN,aAAa,OAAO,CAAC,SAAS,EAAE;QAChC,kBAAkB,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK;QACjD,sBAAsB;KACvB,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,CACL,CAAC,CAAC,MAAM;SACL,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,CACrC,CAAC;AACJ,CAAC"}

package/dist/gcloud.d.ts

@@ -29,9 +29,9 @@ export declare function gcloud(args: string[], opts?: {
 }): Promise<GcloudResult>;
 /**
  * Active gcloud account. Returns `null` when no account is logged in
- * — caller prompts `gcloud auth login`.
+ * — caller prompts `gcloud auth login`. `run` is injectable for tests.
  */
-export declare function activeAccount(): Promise<string | null>;
+export declare function activeAccount(run?: (args: string[]) => Promise<GcloudResult>): Promise<string | null>;
 export interface BillingAccount {
     id: string;
     displayName: string;

package/dist/gcloud.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gcloud.d.ts","sourceRoot":"","sources":["../src/gcloud.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,IAAI,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAAC,UAAU,CAElF;AAED;;;;;GAKG;AACH,wBAAsB,MAAM,CAC1B,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAO,GACrD,OAAO,CAAC,YAAY,CAAC,CAqBvB;AAED;;;GAGG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAK5D;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAiBrE;AAED,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGvE;AAED,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAEjG;AAED,wBAAsB,WAAW,CAC/B,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,YAAY,CAAC,CAEvB;AAqCD,wBAAsB,UAAU,CAC9B,SAAS,EAAE,MAAM,EACjB,QAAQ,GAAE,KAAK,GAAG,cAAsB,GACvC,OAAO,CAAC,YAAY,CAAC,CAIvB;AAED,wBAAsB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAW/F;AAED,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,YAAY,CAAC,CAWvB;AA4DD,UAAU,gBAAgB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IACJ,GAAG,CAAC,EAAE,OAAO,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,sFAAsF;IACtF,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACtB,GACL,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,gBAAgB,EAAE,CAAA;CAAE,CAAC,CA4B1D;AAED,eAAO,MAAM,iBAAiB,mBAAgB,CAAC;AAC/C,eAAO,MAAM,2BAA2B,mBAA0B,CAAC;AACnE,eAAO,MAAM,qBAAqB,mBAAoB,CAAC"}
+{"version":3,"file":"gcloud.d.ts","sourceRoot":"","sources":["../src/gcloud.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,IAAI,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAAC,UAAU,CAElF;AAED;;;;;GAKG;AACH,wBAAsB,MAAM,CAC1B,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAO,GACrD,OAAO,CAAC,YAAY,CAAC,CAqBvB;AAED;;;GAGG;AACH,wBAAsB,aAAa,CACjC,GAAG,GAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,YAAY,CAAU,GACtD,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAKxB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAiBrE;AAED,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGvE;AAED,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAEjG;AAED,wBAAsB,WAAW,CAC/B,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,YAAY,CAAC,CAEvB;AAqCD,wBAAsB,UAAU,CAC9B,SAAS,EAAE,MAAM,EACjB,QAAQ,GAAE,KAAK,GAAG,cAAsB,GACvC,OAAO,CAAC,YAAY,CAAC,CAIvB;AAED,wBAAsB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAW/F;AAED,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,YAAY,CAAC,CAWvB;AA4DD,UAAU,gBAAgB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IACJ,GAAG,CAAC,EAAE,OAAO,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,sFAAsF;IACtF,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACtB,GACL,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,gBAAgB,EAAE,CAAA;CAAE,CAAC,CA4B1D;AAED,eAAO,MAAM,iBAAiB,mBAAgB,CAAC;AAC/C,eAAO,MAAM,2BAA2B,mBAA0B,CAAC;AACnE,eAAO,MAAM,qBAAqB,mBAAoB,CAAC"}

package/dist/gcloud.js

@@ -58,10 +58,10 @@ export async function gcloud(args, opts = {}) {
 }
 /**
  * Active gcloud account. Returns `null` when no account is logged in
- * — caller prompts `gcloud auth login`.
+ * — caller prompts `gcloud auth login`. `run` is injectable for tests.
  */
-export async function activeAccount() {
-    const r = await gcloud(["auth", "list", "--format=value(account)", "--filter=status:ACTIVE"]);
+export async function activeAccount(run = gcloud) {
+    const r = await run(["auth", "list", "--format=value(account)", "--filter=status:ACTIVE"]);
     if (!r.ok)
         return null;
     const value = r.stdout.trim();

package/dist/gcloud.js.map

@@ -1 +1 @@
-{"version":3,"file":"gcloud.js","sourceRoot":"","sources":["../src/gcloud.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAS3C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,SAAS,CAAC,OAA0B,OAAO,CAAC,GAAG;IAC7D,OAAO,EAAE,GAAG,IAAI,EAAE,6BAA6B,EAAE,GAAG,EAAE,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,IAAc,EACd,OAAoD,EAAE;IAEtD,OAAO,IAAI,OAAO,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE;YAClC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;YAC/B,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;SACxC,CAAC,CAAC;QACH,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/D,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CACzB,aAAa,CAAC;YACZ,EAAE,EAAE,IAAI,KAAK,CAAC;YACd,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC9C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC9C,QAAQ,EAAE,IAAI,IAAI,CAAC;SACpB,CAAC,CACH,CAAC;QACF,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,yBAAyB,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAC9F,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;IACzE,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAI9B,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC;YAC9C,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB;IACnD,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,2BAA2B,CAAC,CAAC,CAAC;IACzF,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,SAAS,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB,EAAE,WAAmB;IACxE,OAAO,MAAM,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAiB,EACjB,gBAAwB;IAExB,OAAO,MAAM,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,gBAAgB,CAAC,CAAC,CAAC;AACnG,CAAC;AAED,MAAM,aAAa,GAAsB;IACvC,wBAAwB;IACxB,yBAAyB;IACzB,oBAAoB;IACpB,8BAA8B;IAC9B,kCAAkC;IAClC,oBAAoB;IACpB,wBAAwB;IACxB,qCAAqC;IACrC,oBAAoB;IACpB,2BAA2B;IAC3B,iCAAiC;IACjC,yBAAyB;IACzB,oBAAoB;IACpB,oEAAoE;IACpE,qEAAqE;IACrE,6BAA6B;IAC7B,mEAAmE;IACnE,+BAA+B;IAC/B,uEAAuE;IACvE,mEAAmE;IACnE,+BAA+B;IAC/B,8DAA8D;IAC9D,uEAAuE;IACvE,yBAAyB;CAC1B,CAAC;AAEF,iEAAiE;AACjE,kEAAkE;AAClE,kEAAkE;AAClE,MAAM,uBAAuB,GAAsB;IACjD,yBAAyB;IACzB,gCAAgC;CACjC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,SAAiB,EACjB,WAAmC,KAAK;IAExC,MAAM,IAAI,GACR,QAAQ,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,aAAa,EAAE,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;IAC/F,OAAO,MAAM,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,SAAiB,EAAE,OAAe;IAC3E,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC;QACrB,KAAK;QACL,kBAAkB;QAClB,UAAU;QACV,OAAO;QACP,WAAW;QACX,SAAS;QACT,uBAAuB;KACxB,CAAC,CAAC;IACH,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,OAAO,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,SAAiB,EACjB,SAAiB,EACjB,WAAmB;IAEnB,OAAO,MAAM,CAAC;QACZ,KAAK;QACL,kBAAkB;QAClB,QAAQ;QACR,SAAS;QACT,gBAAgB;QAChB,WAAW;QACX,WAAW;QACX,SAAS;KACV,CAAC,CAAC;AACL,CAAC;AAED,MAAM,iBAAiB,GAAsB;IAC3C,iBAAiB;IACjB,sBAAsB;IACtB,qBAAqB;IACrB,2BAA2B;IAC3B,8BAA8B;IAC9B,4BAA4B;IAC5B,iBAAiB;IACjB,uCAAuC;IACvC,sCAAsC;IACtC,gCAAgC;IAChC,8BAA8B;IAC9B,6BAA6B;IAC7B,+BAA+B;IAC/B,sBAAsB;IACtB,iBAAiB;IACjB,kEAAkE;IAClE,mEAAmE;IACnE,4BAA4B;IAC5B,qBAAqB;IACrB,iEAAiE;IACjE,4BAA4B;IAC5B,iEAAiE;IACjE,mDAAmD;IACnD,sCAAsC;IACtC,8DAA8D;IAC9D,qDAAqD;IACrD,gEAAgE;IAChE,0DAA0D;IAC1D,2DAA2D;IAC3D,0CAA0C;IAC1C,sBAAsB;IACtB,6BAA6B;IAC7B,4DAA4D;IAC5D,gEAAgE;IAChE,4DAA4D;IAC5D,6DAA6D;IAC7D,wDAAwD;IACxD,4DAA4D;IAC5D,8DAA8D;IAC9D,gEAAgE;IAChE,uCAAuC;CACxC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,mBAAmB,GACvB,iFAAiF,CAAC;AAEpF,MAAM,qBAAqB,GAAsB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAQ/E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAAiB,EACjB,OAAe,EACf,OAMI,EAAE;IAEN,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1F,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,qBAAqB,CAAC;IAClE,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,IAAI,iBAAiB,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG;YACX,UAAU;YACV,wBAAwB;YACxB,SAAS;YACT,UAAU;YACV,kBAAkB,OAAO,EAAE;YAC3B,QAAQ;YACR,IAAI;YACJ,kBAAkB;YAClB,SAAS;SACV,CAAC;QACF,IAAI,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;gBAAE,MAAM;YACvD,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;YACnB,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;;YACf,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAC;AAC/C,MAAM,CAAC,MAAM,2BAA2B,GAAG,uBAAuB,CAAC;AACnE,MAAM,CAAC,MAAM,qBAAqB,GAAG,iBAAiB,CAAC;AAEvD,+DAA+D;AAC/D,oDAAoD;AACpD,8DAA8D;AAC9D,8DAA8D;AAC9D,iEAAiE;AACjE,+DAA+D;AAC/D,4DAA4D;AAC5D,gDAAgD"}
+{"version":3,"file":"gcloud.js","sourceRoot":"","sources":["../src/gcloud.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAS3C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,SAAS,CAAC,OAA0B,OAAO,CAAC,GAAG;IAC7D,OAAO,EAAE,GAAG,IAAI,EAAE,6BAA6B,EAAE,GAAG,EAAE,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,IAAc,EACd,OAAoD,EAAE;IAEtD,OAAO,IAAI,OAAO,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE;YAClC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;YAC/B,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;SACxC,CAAC,CAAC;QACH,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/D,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CACzB,aAAa,CAAC;YACZ,EAAE,EAAE,IAAI,KAAK,CAAC;YACd,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC9C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC9C,QAAQ,EAAE,IAAI,IAAI,CAAC;SACpB,CAAC,CACH,CAAC;QACF,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAiD,MAAM;IAEvD,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,yBAAyB,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAC3F,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;IACzE,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAI9B,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC;YAC9C,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB;IACnD,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,2BAA2B,CAAC,CAAC,CAAC;IACzF,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,SAAS,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB,EAAE,WAAmB;IACxE,OAAO,MAAM,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAiB,EACjB,gBAAwB;IAExB,OAAO,MAAM,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,gBAAgB,CAAC,CAAC,CAAC;AACnG,CAAC;AAED,MAAM,aAAa,GAAsB;IACvC,wBAAwB;IACxB,yBAAyB;IACzB,oBAAoB;IACpB,8BAA8B;IAC9B,kCAAkC;IAClC,oBAAoB;IACpB,wBAAwB;IACxB,qCAAqC;IACrC,oBAAoB;IACpB,2BAA2B;IAC3B,iCAAiC;IACjC,yBAAyB;IACzB,oBAAoB;IACpB,oEAAoE;IACpE,qEAAqE;IACrE,6BAA6B;IAC7B,mEAAmE;IACnE,+BAA+B;IAC/B,uEAAuE;IACvE,mEAAmE;IACnE,+BAA+B;IAC/B,8DAA8D;IAC9D,uEAAuE;IACvE,yBAAyB;CAC1B,CAAC;AAEF,iEAAiE;AACjE,kEAAkE;AAClE,kEAAkE;AAClE,MAAM,uBAAuB,GAAsB;IACjD,yBAAyB;IACzB,gCAAgC;CACjC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,SAAiB,EACjB,WAAmC,KAAK;IAExC,MAAM,IAAI,GACR,QAAQ,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,aAAa,EAAE,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;IAC/F,OAAO,MAAM,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,SAAiB,EAAE,OAAe;IAC3E,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC;QACrB,KAAK;QACL,kBAAkB;QAClB,UAAU;QACV,OAAO;QACP,WAAW;QACX,SAAS;QACT,uBAAuB;KACxB,CAAC,CAAC;IACH,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,OAAO,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,SAAiB,EACjB,SAAiB,EACjB,WAAmB;IAEnB,OAAO,MAAM,CAAC;QACZ,KAAK;QACL,kBAAkB;QAClB,QAAQ;QACR,SAAS;QACT,gBAAgB;QAChB,WAAW;QACX,WAAW;QACX,SAAS;KACV,CAAC,CAAC;AACL,CAAC;AAED,MAAM,iBAAiB,GAAsB;IAC3C,iBAAiB;IACjB,sBAAsB;IACtB,qBAAqB;IACrB,2BAA2B;IAC3B,8BAA8B;IAC9B,4BAA4B;IAC5B,iBAAiB;IACjB,uCAAuC;IACvC,sCAAsC;IACtC,gCAAgC;IAChC,8BAA8B;IAC9B,6BAA6B;IAC7B,+BAA+B;IAC/B,sBAAsB;IACtB,iBAAiB;IACjB,kEAAkE;IAClE,mEAAmE;IACnE,4BAA4B;IAC5B,qBAAqB;IACrB,iEAAiE;IACjE,4BAA4B;IAC5B,iEAAiE;IACjE,mDAAmD;IACnD,sCAAsC;IACtC,8DAA8D;IAC9D,qDAAqD;IACrD,gEAAgE;IAChE,0DAA0D;IAC1D,2DAA2D;IAC3D,0CAA0C;IAC1C,sBAAsB;IACtB,6BAA6B;IAC7B,4DAA4D;IAC5D,gEAAgE;IAChE,4DAA4D;IAC5D,6DAA6D;IAC7D,wDAAwD;IACxD,4DAA4D;IAC5D,8DAA8D;IAC9D,gEAAgE;IAChE,uCAAuC;CACxC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,mBAAmB,GACvB,iFAAiF,CAAC;AAEpF,MAAM,qBAAqB,GAAsB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAQ/E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAAiB,EACjB,OAAe,EACf,OAMI,EAAE;IAEN,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1F,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,qBAAqB,CAAC;IAClE,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,IAAI,iBAAiB,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG;YACX,UAAU;YACV,wBAAwB;YACxB,SAAS;YACT,UAAU;YACV,kBAAkB,OAAO,EAAE;YAC3B,QAAQ;YACR,IAAI;YACJ,kBAAkB;YAClB,SAAS;SACV,CAAC;QACF,IAAI,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;gBAAE,MAAM;YACvD,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;YACnB,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;;YACf,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAC;AAC/C,MAAM,CAAC,MAAM,2BAA2B,GAAG,uBAAuB,CAAC;AACnE,MAAM,CAAC,MAAM,qBAAqB,GAAG,iBAAiB,CAAC;AAEvD,+DAA+D;AAC/D,oDAAoD;AACpD,8DAA8D;AAC9D,8DAA8D;AAC9D,iEAAiE;AACjE,+DAA+D;AAC/D,4DAA4D;AAC5D,gDAAgD"}

package/dist/gcp-names.d.ts

@@ -70,4 +70,16 @@ export declare function upgraderJobResource(projectId: string, region: string, e
 export declare function upgraderServiceAccountId(env: string): string;
 /** Email of the upgrader job's service account. */
 export declare function upgraderServiceAccountEmail(projectId: string, env: string): string;
+/**
+ * #587 — id of the project custom role that lets the admin write the
+ * redirect rules into the `gcp` stack's URL map (url-map-redirects.ts).
+ * Role ids allow letters, digits, `_` and `.`.
+ */
+export declare function urlMapRedirectsRoleId(env: string): string;
+/**
+ * #587 — permissions of {@link urlMapRedirectsRoleId}: read-modify-write of
+ * the URL map and waiting for the operation. A URL-map update must be
+ * allowed to "use" every backend the map references, hence the `.use` pair.
+ */
+export declare const URL_MAP_REDIRECTS_PERMISSIONS: readonly string[];
 //# sourceMappingURL=gcp-names.d.ts.map

package/dist/gcp-names.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gcp-names.d.ts","sourceRoot":"","sources":["../src/gcp-names.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;GAaG;AAEH,6EAA6E;AAC7E,eAAO,MAAM,aAAa,eAAe,CAAC;AAE1C,kFAAkF;AAClF,eAAO,MAAM,0BAA0B,cAAc,CAAC;AAEtD,uDAAuD;AACvD,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,0DAA0D;AAC1D,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,wEAAwE;AACxE,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,mEAAmE;AACnE,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,wDAAwD;AACxD,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGnE;AAED,mEAAmE;AACnE,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,GACrC,MAAM,CAER;AAED,uEAAuE;AACvE,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wFAAwF;AACxF,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,yFAAyF;AACzF,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhG;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,+CAA+C;AAC/C,wBAAgB,iCAAiC,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAExF;AAED,wEAAwE;AACxE,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE1F;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,mDAAmD;AACnD,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAElF"}
+{"version":3,"file":"gcp-names.d.ts","sourceRoot":"","sources":["../src/gcp-names.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;GAaG;AAEH,6EAA6E;AAC7E,eAAO,MAAM,aAAa,eAAe,CAAC;AAE1C,kFAAkF;AAClF,eAAO,MAAM,0BAA0B,cAAc,CAAC;AAEtD,uDAAuD;AACvD,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,0DAA0D;AAC1D,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,wEAAwE;AACxE,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,mEAAmE;AACnE,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,wDAAwD;AACxD,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGnE;AAED,mEAAmE;AACnE,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,GACrC,MAAM,CAER;AAED,uEAAuE;AACvE,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wFAAwF;AACxF,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,yFAAyF;AACzF,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhG;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,+CAA+C;AAC/C,wBAAgB,iCAAiC,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAExF;AAED,wEAAwE;AACxE,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE1F;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,mDAAmD;AACnD,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAElF;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAAS,MAAM,EAO1D,CAAC"}

package/dist/gcp-names.js

@@ -108,4 +108,25 @@ export function upgraderServiceAccountId(env) {
 export function upgraderServiceAccountEmail(projectId, env) {
     return `${upgraderServiceAccountId(env)}@${projectId}.iam.gserviceaccount.com`;
 }
+/**
+ * #587 — id of the project custom role that lets the admin write the
+ * redirect rules into the `gcp` stack's URL map (url-map-redirects.ts).
+ * Role ids allow letters, digits, `_` and `.`.
+ */
+export function urlMapRedirectsRoleId(env) {
+    return `caelo_${env.replace(/[^A-Za-z0-9]/g, "_")}_urlMapRedirects`;
+}
+/**
+ * #587 — permissions of {@link urlMapRedirectsRoleId}: read-modify-write of
+ * the URL map and waiting for the operation. A URL-map update must be
+ * allowed to "use" every backend the map references, hence the `.use` pair.
+ */
+export const URL_MAP_REDIRECTS_PERMISSIONS = [
+    "compute.urlMaps.list",
+    "compute.urlMaps.get",
+    "compute.urlMaps.update",
+    "compute.backendBuckets.use",
+    "compute.backendServices.use",
+    "compute.globalOperations.get",
+];
 //# sourceMappingURL=gcp-names.js.map

package/dist/gcp-names.js.map

@@ -1 +1 @@
-{"version":3,"file":"gcp-names.js","sourceRoot":"","sources":["../src/gcp-names.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;GAaG;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CAAC;AAE1C,kFAAkF;AAClF,MAAM,CAAC,MAAM,0BAA0B,GAAG,WAAW,CAAC;AAEtD,uDAAuD;AACvD,MAAM,UAAU,yBAAyB,CAAC,SAAiB;IACzD,OAAO,GAAG,0BAA0B,IAAI,SAAS,0BAA0B,CAAC;AAC9E,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,OAAO,SAAS,GAAG,EAAE,CAAC;AACxB,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC;AACxC,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,sBAAsB,CAAC,SAAiB,EAAE,GAAW;IACnE,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC;AAC5C,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,0BAA0B,CAAC,SAAiB,EAAE,GAAW;IACvE,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AAChF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,+BAA+B,CAAC,GAAW;IACzD,MAAM,KAAK,GAAG,GAAG,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAChF,OAAO,SAAS,KAAK,YAAY,CAAC;AACpC,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,aAAa,CAC3B,SAAiB,EACjB,GAAW,EACX,MAAsC;IAEtC,OAAO,GAAG,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;AACxD,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,IAAY;IACnD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;AACzC,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,uBAAuB,CAAC;AACtD,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,yBAAyB,CAAC,SAAiB,EAAE,MAAc,EAAE,GAAW;IACtF,OAAO,YAAY,SAAS,cAAc,MAAM,SAAS,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;AACxF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,GAAW;IACxD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC;AAC1C,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,iCAAiC,CAAC,SAAiB,EAAE,GAAW;IAC9E,OAAO,GAAG,8BAA8B,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AACvF,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,0BAA0B,CAAC,GAAW;IACpD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,yBAAyB,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC;AAC1C,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,MAAc,EAAE,GAAW;IAChF,OAAO,YAAY,SAAS,cAAc,MAAM,SAAS,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;AAClF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAClD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC;AAC1C,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,2BAA2B,CAAC,SAAiB,EAAE,GAAW;IACxE,OAAO,GAAG,wBAAwB,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AACjF,CAAC"}
+{"version":3,"file":"gcp-names.js","sourceRoot":"","sources":["../src/gcp-names.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;GAaG;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CAAC;AAE1C,kFAAkF;AAClF,MAAM,CAAC,MAAM,0BAA0B,GAAG,WAAW,CAAC;AAEtD,uDAAuD;AACvD,MAAM,UAAU,yBAAyB,CAAC,SAAiB;IACzD,OAAO,GAAG,0BAA0B,IAAI,SAAS,0BAA0B,CAAC;AAC9E,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,OAAO,SAAS,GAAG,EAAE,CAAC;AACxB,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC;AACxC,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,sBAAsB,CAAC,SAAiB,EAAE,GAAW;IACnE,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC;AAC5C,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,0BAA0B,CAAC,SAAiB,EAAE,GAAW;IACvE,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AAChF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,+BAA+B,CAAC,GAAW;IACzD,MAAM,KAAK,GAAG,GAAG,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAChF,OAAO,SAAS,KAAK,YAAY,CAAC;AACpC,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,aAAa,CAC3B,SAAiB,EACjB,GAAW,EACX,MAAsC;IAEtC,OAAO,GAAG,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;AACxD,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,IAAY;IACnD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;AACzC,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,uBAAuB,CAAC;AACtD,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,yBAAyB,CAAC,SAAiB,EAAE,MAAc,EAAE,GAAW;IACtF,OAAO,YAAY,SAAS,cAAc,MAAM,SAAS,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;AACxF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,GAAW;IACxD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC;AAC1C,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,iCAAiC,CAAC,SAAiB,EAAE,GAAW;IAC9E,OAAO,GAAG,8BAA8B,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AACvF,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,0BAA0B,CAAC,GAAW;IACpD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,yBAAyB,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC;AAC1C,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,MAAc,EAAE,GAAW;IAChF,OAAO,YAAY,SAAS,cAAc,MAAM,SAAS,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;AAClF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAClD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC;AAC1C,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,2BAA2B,CAAC,SAAiB,EAAE,GAAW;IACxE,OAAO,GAAG,wBAAwB,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AACjF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,OAAO,SAAS,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,kBAAkB,CAAC;AACtE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAsB;IAC9D,sBAAsB;IACtB,qBAAqB;IACrB,wBAAwB;IACxB,4BAA4B;IAC5B,6BAA6B;IAC7B,8BAA8B;CAC/B,CAAC"}

package/dist/gcp-url-map.d.ts

@@ -0,0 +1,27 @@
+import * as gcp from "@pulumi/gcp";
+import type * as pulumi from "@pulumi/pulumi";
+/** Name of the site host's path matcher. */
+export declare const PUBLIC_PATH_MATCHER = "public";
+/**
+ * The URL map's `ignoreChanges`: the public path matcher (index 0, see
+ * {@link siteUrlMapArgs}) holds the admin-managed redirect rules.
+ */
+export declare const SITE_URL_MAP_IGNORE_CHANGES: readonly string[];
+/** Inputs of {@link siteUrlMapArgs}. */
+export interface SiteUrlMapInputs {
+    readonly domain: string;
+    readonly adminDomain: string;
+    readonly staticBackend: pulumi.Input<string>;
+    readonly gatewayBackend: pulumi.Input<string>;
+    readonly adminBackend: pulumi.Input<string>;
+}
+/**
+ * The URL map's arguments: the site host to the static bucket with `/api/*`
+ * to the gateway; the admin host to the IAP-gated admin. The public path
+ * matcher comes first — {@link SITE_URL_MAP_IGNORE_CHANGES} addresses it by
+ * index.
+ */
+export declare function siteUrlMapArgs(i: SiteUrlMapInputs): gcp.compute.URLMapArgs;
+/** The stack's URL map (see the module comment for the ignored field). */
+export declare function createSiteUrlMap(name: string, inputs: SiteUrlMapInputs, opts: pulumi.CustomResourceOptions): gcp.compute.URLMap;
+//# sourceMappingURL=gcp-url-map.d.ts.map

package/dist/gcp-url-map.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gcp-url-map.d.ts","sourceRoot":"","sources":["../src/gcp-url-map.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AACnC,OAAO,KAAK,KAAK,MAAM,MAAM,gBAAgB,CAAC;AAE9C,4CAA4C;AAC5C,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAE5C;;;GAGG;AACH,eAAO,MAAM,2BAA2B,EAAE,SAAS,MAAM,EAAkC,CAAC;AAE5F,wCAAwC;AACxC,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;CAC7C;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,gBAAgB,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAmB1E;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,MAAM,CAAC,qBAAqB,GACjC,GAAG,CAAC,OAAO,CAAC,MAAM,CAKpB"}

package/dist/gcp-url-map.js

@@ -0,0 +1,62 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * The `gcp` stack's URL map, and who may write its redirect rules (#587).
+ *
+ * The admin writes the redirects table into the site host's path matcher
+ * as `urlRedirect` path rules on every Confirm-publish (admin-core
+ * deploy/gcp-url-map-redirects.ts). Those rules change at runtime, not with
+ * `pulumi up`, so the stack must not own them: the URL map ignores changes
+ * to the public path matcher's `pathRules` after creation. Otherwise a
+ * `pulumi refresh` + `up` would wipe every redirect until the next publish.
+ * The admin's writer keeps every non-redirect rule (`/api/*`) as it finds
+ * it.
+ *
+ * The admin's run SA gets a project custom role with only the permissions
+ * that read-modify-write needs (`URL_MAP_REDIRECTS_PERMISSIONS`, gcp-names.ts);
+ * the CLI creates it (url-map-redirects-access.ts), not the stack.
+ *
+ * Imported by the stack from `dist/`; keep it free of CLI dependencies.
+ */
+import { GCP_PUBLIC_BASE_PATHS } from "@caelo-cms/shared";
+import * as gcp from "@pulumi/gcp";
+/** Name of the site host's path matcher. */
+export const PUBLIC_PATH_MATCHER = "public";
+/**
+ * The URL map's `ignoreChanges`: the public path matcher (index 0, see
+ * {@link siteUrlMapArgs}) holds the admin-managed redirect rules.
+ */
+export const SITE_URL_MAP_IGNORE_CHANGES = ["pathMatchers[0].pathRules"];
+/**
+ * The URL map's arguments: the site host to the static bucket with `/api/*`
+ * to the gateway; the admin host to the IAP-gated admin. The public path
+ * matcher comes first — {@link SITE_URL_MAP_IGNORE_CHANGES} addresses it by
+ * index.
+ */
+export function siteUrlMapArgs(i) {
+    return {
+        defaultService: i.staticBackend,
+        hostRules: [
+            { hosts: [i.domain], pathMatcher: PUBLIC_PATH_MATCHER },
+            { hosts: [i.adminDomain], pathMatcher: "admin" },
+        ],
+        pathMatchers: [
+            {
+                name: PUBLIC_PATH_MATCHER,
+                defaultService: i.staticBackend,
+                pathRules: [{ paths: [...GCP_PUBLIC_BASE_PATHS], service: i.gatewayBackend }],
+            },
+            {
+                name: "admin",
+                defaultService: i.adminBackend,
+            },
+        ],
+    };
+}
+/** The stack's URL map (see the module comment for the ignored field). */
+export function createSiteUrlMap(name, inputs, opts) {
+    return new gcp.compute.URLMap(name, siteUrlMapArgs(inputs), {
+        ...opts,
+        ignoreChanges: [...(opts.ignoreChanges ?? []), ...SITE_URL_MAP_IGNORE_CHANGES],
+    });
+}
+//# sourceMappingURL=gcp-url-map.js.map

package/dist/gcp-url-map.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gcp-url-map.js","sourceRoot":"","sources":["../src/gcp-url-map.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AAGnC,4CAA4C;AAC5C,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAQ,CAAC;AAE5C;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsB,CAAC,2BAA2B,CAAC,CAAC;AAW5F;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,CAAmB;IAChD,OAAO;QACL,cAAc,EAAE,CAAC,CAAC,aAAa;QAC/B,SAAS,EAAE;YACT,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,mBAAmB,EAAE;YACvD,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE;SACjD;QACD,YAAY,EAAE;YACZ;gBACE,IAAI,EAAE,mBAAmB;gBACzB,cAAc,EAAE,CAAC,CAAC,aAAa;gBAC/B,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,qBAAqB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC;aAC9E;YACD;gBACE,IAAI,EAAE,OAAO;gBACb,cAAc,EAAE,CAAC,CAAC,YAAY;aAC/B;SACF;KACF,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,MAAwB,EACxB,IAAkC;IAElC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE;QAC1D,GAAG,IAAI;QACP,aAAa,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,EAAE,GAAG,2BAA2B,CAAC;KAC/E,CAAC,CAAC;AACL,CAAC"}

package/dist/index.d.ts

@@ -20,7 +20,6 @@ export { type CaddyDomainSpec, type CaddyfileSpec, generateCaddyfile, } from "./
 export { type CdnCopyAdapter, loadCdnCopyAdapter, selfHostedCdnCopy, } from "./cdn-copy.js";
 export { type ComposeSpec, generateDockerCompose, type RolePasswords } from "./compose.js";
 export { INFRA_CONTRACT_VERSION } from "./infra-contract.js";
-export { type CloudFrontRedirectArtifact, emitRedirectsAzureFrontDoor, emitRedirectsCloudFront, emitRedirectsCloudflare, type FrontDoorRule, type RedirectRow, type RedirectStatusCode, } from "./redirects-emit.js";
 export { INFRA_CONTRACT_PATHS, isInfraContractPath, RELEASE_MIN_FROM_VERSION, } from "./release-contract.js";
 export { assessAutoInstall, channelForVersion, compareImageDigests, compareSemver, type DigestMismatch, fetchVerifiedReleaseManifest, type InstallAssessment, type InstalledRelease, type InstallMode, RELEASE_CHANNELS, RELEASE_IMAGES, RELEASE_MANIFEST_ARTIFACT_TYPE, RELEASE_MANIFEST_MEDIA_TYPE, RELEASE_MANIFEST_REGISTRY, RELEASE_MANIFEST_REPOSITORY, RELEASE_OIDC_ISSUER, type ReleaseChannel, type ReleaseImage, type ReleaseManifest, type ReleaseManifestDeps, type ReleaseManifestError, type ReleaseManifestErrorCode, type ReleaseManifestResult, ReleaseManifestSchema, releaseManifestSignerIdentity, SIGSTORE_BUNDLE_MEDIA_TYPE, } from "./release-manifest.js";
 export { AGENT_DB_ROLE, roleConvergenceScript } from "./self-hosted-roles.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AAEH,YAAY,EACV,kBAAkB,EAClB,mBAAmB,EACnB,SAAS,EACT,WAAW,EACX,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,iBAAiB,EACjB,cAAc,EACd,UAAU,EACV,cAAc,EACd,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,KAAK,cAAc,EACnB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,KAAK,cAAc,EACnB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,KAAK,WAAW,EAAE,qBAAqB,EAAE,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EACL,KAAK,0BAA0B,EAC/B,2BAA2B,EAC3B,uBAAuB,EACvB,uBAAuB,EACvB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,kBAAkB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,KAAK,cAAc,EACnB,4BAA4B,EAC5B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,gBAAgB,EAChB,cAAc,EACd,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAC3B,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,qBAAqB,EACrB,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EACL,oBAAoB,EACpB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,eAAe,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,eAAe,EACf,KAAK,iBAAiB,EACtB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,aAAa,EAClB,cAAc,EACd,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AAEH,YAAY,EACV,kBAAkB,EAClB,mBAAmB,EACnB,SAAS,EACT,WAAW,EACX,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,iBAAiB,EACjB,cAAc,EACd,UAAU,EACV,cAAc,EACd,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,KAAK,cAAc,EACnB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,KAAK,cAAc,EACnB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,KAAK,WAAW,EAAE,qBAAqB,EAAE,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,KAAK,cAAc,EACnB,4BAA4B,EAC5B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,gBAAgB,EAChB,cAAc,EACd,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAC3B,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,qBAAqB,EACrB,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EACL,oBAAoB,EACpB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,eAAe,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,eAAe,EACf,KAAK,iBAAiB,EACtB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,aAAa,EAClB,cAAc,EACd,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/index.js

@@ -4,7 +4,6 @@ export { generateCaddyfile, } from "./caddy.js";
 export { loadCdnCopyAdapter, selfHostedCdnCopy, } from "./cdn-copy.js";
 export { generateDockerCompose } from "./compose.js";
 export { INFRA_CONTRACT_VERSION } from "./infra-contract.js";
-export { emitRedirectsAzureFrontDoor, emitRedirectsCloudFront, emitRedirectsCloudflare, } from "./redirects-emit.js";
 export { INFRA_CONTRACT_PATHS, isInfraContractPath, RELEASE_MIN_FROM_VERSION, } from "./release-contract.js";
 export { assessAutoInstall, channelForVersion, compareImageDigests, compareSemver, fetchVerifiedReleaseManifest, RELEASE_CHANNELS, RELEASE_IMAGES, RELEASE_MANIFEST_ARTIFACT_TYPE, RELEASE_MANIFEST_MEDIA_TYPE, RELEASE_MANIFEST_REGISTRY, RELEASE_MANIFEST_REPOSITORY, RELEASE_OIDC_ISSUER, ReleaseManifestSchema, releaseManifestSignerIdentity, SIGSTORE_BUNDLE_MEDIA_TYPE, } from "./release-manifest.js";
 export { AGENT_DB_ROLE, roleConvergenceScript } from "./self-hosted-roles.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAiCnC,OAAO,EAEL,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAGL,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAEL,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAoB,qBAAqB,EAAsB,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAEL,2BAA2B,EAC3B,uBAAuB,EACvB,uBAAuB,GAIxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EAEb,4BAA4B,EAI5B,gBAAgB,EAChB,cAAc,EACd,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAC3B,mBAAmB,EAQnB,qBAAqB,EACrB,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EACL,oBAAoB,GAIrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,eAAe,EAEf,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAEL,cAAc,GAOf,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAiCnC,OAAO,EAEL,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAGL,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAEL,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAoB,qBAAqB,EAAsB,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EAEb,4BAA4B,EAI5B,gBAAgB,EAChB,cAAc,EACd,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAC3B,mBAAmB,EAQnB,qBAAqB,EACrB,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EACL,oBAAoB,GAIrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,eAAe,EAEf,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAEL,cAAc,GAOf,MAAM,mBAAmB,CAAC"}

package/dist/infra-contract.d.ts

@@ -20,5 +20,24 @@
  * whose app-roll references infrastructure an install does not have yet fails
  * at roll time, after migrations ran.
  */
-export declare const INFRA_CONTRACT_VERSION = 2;
+export declare const INFRA_CONTRACT_VERSION = 5;
+/**
+ * What each contract version adds, in operator terms — the upgrader's
+ * refusal names the steps an install is missing. Keep one entry per version
+ * (the history above says why each bump happened).
+ */
+export declare const INFRA_CONTRACT_STEPS: Readonly<Record<number, string>>;
+/**
+ * The steps an install at contract `installed` lacks for `target`, oldest
+ * first. A release newer than this code can carry versions it does not know
+ * (the upgrader reads the NEW release's manifest); those are named by number.
+ *
+ * @example
+ *   pendingInfraSteps(2, 4)
+ *   // → ["public_role out of the Cloud SQL superuser group (#633)",
+ *   //    "the admin's permission to serve redirects from the load balancer (#587)"]
+ */
+export declare function pendingInfraSteps(installed: number, target: number): string[];
+/** {@link pendingInfraSteps} as one sentence fragment for messages. */
+export declare function infraStepsText(installed: number, target: number): string;
 //# sourceMappingURL=infra-contract.d.ts.map

package/dist/infra-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"infra-contract.d.ts","sourceRoot":"","sources":["../src/infra-contract.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,sBAAsB,IAAI,CAAC"}
+{"version":3,"file":"infra-contract.d.ts","sourceRoot":"","sources":["../src/infra-contract.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAmBxC;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMjE,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAM7E;AAED,uEAAuE;AACvE,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAExE"}

package/dist/infra-contract.js

@@ -21,11 +21,54 @@
  * whose app-roll references infrastructure an install does not have yet fails
  * at roll time, after migrations ran.
  */
-export const INFRA_CONTRACT_VERSION = 2;
+export const INFRA_CONTRACT_VERSION = 5;
 // History (why each bump happened — an install below a number needs the
 // converge that introduced it):
 //   1 — epic #696 split: converge vs app-roll.
 //   2 — the upgrader job (#696 Phase 2): its service account + scoped
 //       grants, the Cloud SQL backup role, its IAM database user, the job,
 //       the admin's run-only grant and CAELO_UPGRADER_JOB on the admin.
+//   3 — public_role out of cloudsqlsuperuser (#633): the Admin API revoke
+//       runs as the operator; migration 0278's role audit refuses an install
+//       that has not had it, so the in-cloud upgrader must not get there
+//       first.
+//   4 — #587: on `gcp`, the admin's custom role for writing the redirects
+//       table into the URL map (url-map-redirects-access.ts).
+//   5 — #635: the gateway has no cms_admin login. Its GATEWAY_DATABASE_URL /
+//       GATEWAY_DATABASE_PASSWORD go, and its SA loses access to the
+//       gateway-role-password secret (a retired IAM binding, removed after
+//       the roll — the in-cloud upgrader cannot change IAM).
+/**
+ * What each contract version adds, in operator terms — the upgrader's
+ * refusal names the steps an install is missing. Keep one entry per version
+ * (the history above says why each bump happened).
+ */
+export const INFRA_CONTRACT_STEPS = {
+    1: "the converge/app-roll split",
+    2: "the in-cloud upgrader job and its scoped permissions",
+    3: "public_role out of the Cloud SQL superuser group (#633)",
+    4: "the admin's permission to serve redirects from the load balancer (#587)",
+    5: "the gateway's cms_admin login removed from its env and IAM (#635)",
+};
+/**
+ * The steps an install at contract `installed` lacks for `target`, oldest
+ * first. A release newer than this code can carry versions it does not know
+ * (the upgrader reads the NEW release's manifest); those are named by number.
+ *
+ * @example
+ *   pendingInfraSteps(2, 4)
+ *   // → ["public_role out of the Cloud SQL superuser group (#633)",
+ *   //    "the admin's permission to serve redirects from the load balancer (#587)"]
+ */
+export function pendingInfraSteps(installed, target) {
+    const steps = [];
+    for (let v = Math.max(installed, 0) + 1; v <= target; v += 1) {
+        steps.push(INFRA_CONTRACT_STEPS[v] ?? `infrastructure step ${v} (see that release's notes)`);
+    }
+    return steps;
+}
+/** {@link pendingInfraSteps} as one sentence fragment for messages. */
+export function infraStepsText(installed, target) {
+    return pendingInfraSteps(installed, target).join("; ");
+}
 //# sourceMappingURL=infra-contract.js.map

package/dist/infra-contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"infra-contract.js","sourceRoot":"","sources":["../src/infra-contract.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAExC,wEAAwE;AACxE,gCAAgC;AAChC,+CAA+C;AAC/C,sEAAsE;AACtE,2EAA2E;AAC3E,wEAAwE"}
+{"version":3,"file":"infra-contract.js","sourceRoot":"","sources":["../src/infra-contract.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAExC,wEAAwE;AACxE,gCAAgC;AAChC,+CAA+C;AAC/C,sEAAsE;AACtE,2EAA2E;AAC3E,wEAAwE;AACxE,0EAA0E;AAC1E,6EAA6E;AAC7E,yEAAyE;AACzE,eAAe;AACf,0EAA0E;AAC1E,8DAA8D;AAC9D,6EAA6E;AAC7E,qEAAqE;AACrE,2EAA2E;AAC3E,6DAA6D;AAE7D;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAqC;IACpE,CAAC,EAAE,6BAA6B;IAChC,CAAC,EAAE,sDAAsD;IACzD,CAAC,EAAE,yDAAyD;IAC5D,CAAC,EAAE,yEAAyE;IAC5E,CAAC,EAAE,mEAAmE;CACvE,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,MAAc;IACjE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,uBAAuB,CAAC,6BAA6B,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,MAAc;IAC9D,OAAO,iBAAiB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzD,CAAC"}

package/dist/owner-reset.d.ts

@@ -0,0 +1,37 @@
+/**
+ * #769 — `cms-provision owner-reset` — get an Owner back into a locked-out admin
+ * when the install cannot email a reset link (no email transport set up).
+ *
+ * The root of trust is the operator's cloud identity: whoever may read the
+ * install's internal secret and pass the admin's IAP already controls its
+ * database and deploys, so issuing them a reset link grants nothing new. The
+ * admin issues the one-hour, single-use token (`auth.issue_owner_reset`,
+ * audited) and hands it back over the admin-internal.ts channel; the CLI
+ * prints the link once. It is never logged, so it does not land in the
+ * project's Cloud Logging the way a "log the link" fallback would.
+ *
+ * The request carries the operator's gcloud account so the admin's audit row
+ * names who asked. That account is self-asserted (the admin sees the shared
+ * `caelo-mcp` identity and the shared internal secret), and labelled so; the
+ * authoritative record is Google's Data Access audit log for the IAM
+ * Credentials and Secret Manager calls this command makes as the operator.
+ */
+import { type AdminInternalDeps, type AdminInternalResult, type AdminInternalTarget } from "./admin-internal.js";
+/** Token scope the admin endpoint checks (apps/admin …/api/internal/owner-reset). */
+export declare const OWNER_RESET_SCOPE = "auth.owner_reset";
+/** What the admin issued: whose account, the link to open, and until when it works. */
+export interface OwnerReset {
+    readonly email: string;
+    readonly resetUrl: string;
+    readonly expiresAt: string;
+}
+/**
+ * Ask the admin for a reset link for the install's Owner (or the Owner named
+ * by `email` when there are several).
+ */
+export declare function requestOwnerReset(target: AdminInternalTarget, request: {
+    readonly email?: string;
+}, deps?: AdminInternalDeps): Promise<AdminInternalResult<OwnerReset>>;
+/** The lines the command prints. Pure — the CLI prints them and stores nothing. */
+export declare function describeOwnerReset(r: OwnerReset): string[];
+//# sourceMappingURL=owner-reset.d.ts.map

package/dist/owner-reset.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-reset.d.ts","sourceRoot":"","sources":["../src/owner-reset.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EAEzB,MAAM,qBAAqB,CAAC;AAG7B,qFAAqF;AACrF,eAAO,MAAM,iBAAiB,qBAAqB,CAAC;AAGpD,uFAAuF;AACvF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,mBAAmB,EAC3B,OAAO,EAAE;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,EACpC,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC,CAwB1C;AAsBD,mFAAmF;AACnF,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,UAAU,GAAG,MAAM,EAAE,CAU1D"}

package/dist/owner-reset.js

@@ -0,0 +1,80 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * #769 — `cms-provision owner-reset` — get an Owner back into a locked-out admin
+ * when the install cannot email a reset link (no email transport set up).
+ *
+ * The root of trust is the operator's cloud identity: whoever may read the
+ * install's internal secret and pass the admin's IAP already controls its
+ * database and deploys, so issuing them a reset link grants nothing new. The
+ * admin issues the one-hour, single-use token (`auth.issue_owner_reset`,
+ * audited) and hands it back over the admin-internal.ts channel; the CLI
+ * prints the link once. It is never logged, so it does not land in the
+ * project's Cloud Logging the way a "log the link" fallback would.
+ *
+ * The request carries the operator's gcloud account so the admin's audit row
+ * names who asked. That account is self-asserted (the admin sees the shared
+ * `caelo-mcp` identity and the shared internal secret), and labelled so; the
+ * authoritative record is Google's Data Access audit log for the IAM
+ * Credentials and Secret Manager calls this command makes as the operator.
+ */
+import { callAdminInternal, } from "./admin-internal.js";
+import { activeAccount, gcloud as defaultGcloud } from "./gcloud.js";
+/** Token scope the admin endpoint checks (apps/admin …/api/internal/owner-reset). */
+export const OWNER_RESET_SCOPE = "auth.owner_reset";
+const ENDPOINT = "/api/internal/owner-reset";
+/**
+ * Ask the admin for a reset link for the install's Owner (or the Owner named
+ * by `email` when there are several).
+ */
+export async function requestOwnerReset(target, request, deps = {}) {
+    const account = await readGcloudAccount(deps.run ?? defaultGcloud);
+    if (!account.ok)
+        return account;
+    const r = await callAdminInternal(target, {
+        endpoint: ENDPOINT,
+        scope: OWNER_RESET_SCOPE,
+        body: {
+            ...(request.email !== undefined ? { email: request.email } : {}),
+            requestedBy: account.value,
+        },
+        introducedBy: "#769",
+    }, deps);
+    if (!r.ok)
+        return r;
+    const { answer, adminUrl } = r.value;
+    const { email, token, expiresAt } = answer;
+    if (!email || !token || !expiresAt) {
+        return { ok: false, error: "the admin answered without an email, token or expiry" };
+    }
+    const resetUrl = new URL(`/reset?token=${encodeURIComponent(token)}`, adminUrl).toString();
+    return { ok: true, value: { email, resetUrl, expiresAt } };
+}
+/**
+ * The gcloud account this command runs as, for the admin's audit row. Without
+ * one there is nobody to name, and the IAP step after this would fail anyway.
+ */
+async function readGcloudAccount(run) {
+    // `auth list --filter=status:ACTIVE`, not `config get-value account`: the
+    // latter prints the sentinel `(unset)` and exits 0 when no account is set.
+    const account = await activeAccount(run);
+    if (!account || /\s/.test(account)) {
+        return {
+            ok: false,
+            error: "read the active gcloud account: none is signed in. Run `gcloud auth login` with the account you provisioned with.",
+        };
+    }
+    return { ok: true, value: account };
+}
+/** The lines the command prints. Pure — the CLI prints them and stores nothing. */
+export function describeOwnerReset(r) {
+    return [
+        `Reset link for ${r.email} — open it to set a new password:`,
+        "",
+        `  ${r.resetUrl}`,
+        "",
+        `It works once and expires at ${r.expiresAt}. Setting the password signs out every`,
+        "other session of this account. The link is not saved anywhere; run the command",
+        "again for a new one.",
+    ];
+}
+//# sourceMappingURL=owner-reset.js.map

package/dist/owner-reset.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-reset.js","sourceRoot":"","sources":["../src/owner-reset.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAIL,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,aAAa,CAAC;AAErE,qFAAqF;AACrF,MAAM,CAAC,MAAM,iBAAiB,GAAG,kBAAkB,CAAC;AACpD,MAAM,QAAQ,GAAG,2BAA2B,CAAC;AAS7C;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAA2B,EAC3B,OAAoC,EACpC,OAA0B,EAAE;IAE5B,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC,CAAC;IACnE,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC;IAChC,MAAM,CAAC,GAAG,MAAM,iBAAiB,CAC/B,MAAM,EACN;QACE,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,iBAAiB;QACxB,IAAI,EAAE;YACJ,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,WAAW,EAAE,OAAO,CAAC,KAAK;SAC3B;QACD,YAAY,EAAE,MAAM;KACrB,EACD,IAAI,CACL,CAAC;IACF,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,CAAC,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC;IACrC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAC3C,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;QACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sDAAsD,EAAE,CAAC;IACtF,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,gBAAgB,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,iBAAiB,CAC9B,GAA0C;IAE1C,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EACH,mHAAmH;SACtH,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACtC,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,kBAAkB,CAAC,CAAa;IAC9C,OAAO;QACL,kBAAkB,CAAC,CAAC,KAAK,mCAAmC;QAC5D,EAAE;QACF,KAAK,CAAC,CAAC,QAAQ,EAAE;QACjB,EAAE;QACF,gCAAgC,CAAC,CAAC,SAAS,wCAAwC;QACnF,gFAAgF;QAChF,sBAAsB;KACvB,CAAC;AACJ,CAAC"}

package/dist/public-role-isolation.d.ts

@@ -0,0 +1,19 @@
+import { type GcloudRunner, type Sleep } from "./gcloud-retry.js";
+import type { EnsureOutcome } from "./runtime-secrets.js";
+/** The gcloud call that leaves `public_role` with no database roles. */
+export declare function revokePublicRoleMembershipsArgs(target: {
+    readonly projectId: string;
+    readonly sqlInstance: string;
+}): string[];
+/**
+ * Revoke every database role the Admin API gave `public_role`. Reports
+ * instead of throwing; `failed` names the next step.
+ */
+export declare function revokePublicRoleMemberships(install: {
+    readonly projectId: string;
+    readonly env: string;
+}, deps?: {
+    readonly run?: GcloudRunner;
+    readonly sleep?: Sleep;
+}): Promise<EnsureOutcome>;
+//# sourceMappingURL=public-role-isolation.d.ts.map

package/dist/public-role-isolation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-role-isolation.d.ts","sourceRoot":"","sources":["../src/public-role-isolation.ts"],"names":[],"mappings":"AAkCA,OAAO,EAAE,KAAK,YAAY,EAA2B,KAAK,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D,wEAAwE;AACxE,wBAAgB,+BAA+B,CAAC,MAAM,EAAE;IACtD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,GAAG,MAAM,EAAE,CAYX;AAED;;;GAGG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EAC7D,IAAI,GAAE;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAO,GACjE,OAAO,CAAC,aAAa,CAAC,CAoBxB"}