@caelo-cms/provisioning 0.10.49 → 0.10.51

package/dist/stack-contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"stack-contract.js","sourceRoot":"","sources":["../src/stack-contract.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EACL,0BAA0B,EAC1B,aAAa,EACb,aAAa,EACb,WAAW,EACX,yBAAyB,EACzB,yBAAyB,EACzB,sBAAsB,EACtB,+BAA+B,EAC/B,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAoDxB,uDAAuD;AACvD,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAU,EAAE,EAAE,CACvC,gBAAgB,IAAI,IAAI,IAAI,IAAI,aAAa,IAAI,EAAE,kBAAkB,CAAC;IACxE,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,YAAY,EAAE,WAAW,CAAC;QACrC,WAAW,EAAE,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC;QAC5C,MAAM,EAAE,GAAG,CAAC,aAAa,EAAE,YAAY,CAAC;QACxC,OAAO,EAAE,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC;KAC1C,CAAC;AACJ,CAAC;AAsBD,qFAAqF;AACrF,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,OAAO,WAAW,MAAM,EAAE,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,OAAO,WAAW,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;AACrE,CAAC;AAED,6DAA6D;AAC7D,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAErD;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,+BAA+B,CAAC;AAE3D;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,2BAA2B,CAAC;AAEvE;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;AAEzD,4DAA4D;AAC5D,MAAM,aAAa,GAAG,uCAAuC,CAAC;AAE9D,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;AAE7D,gDAAgD;AAChD,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAoBzC,8CAA8C;AAC9C,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,GAAW;IAC7D,OAAO;QACL,UAAU,EAAE,iBAAiB;QAC7B,MAAM,EAAE,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC;QAC9C,SAAS,EAAE,gBAAgB;KAC5B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAA2B;IAClE,OAAO;QACL,oBAAoB,EAAE,4BAA4B;QAClD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC;QACvF,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;KAChE,CAAC;AACb,CAAC;AAsBD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAkD;IACjF,UAAU,EAAE,mBAAmB;IAC/B,WAAW,EAAE,sBAAsB;IACnC,YAAY,EAAE,uBAAuB;CACtC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,iBAAiB;IACjB,sBAAsB;IACtB,wEAAwE;IACxE,kEAAkE;IAClE,sBAAsB;IACtB,uBAAuB;IACvB,uEAAuE;IACvE,sEAAsE;IACtE,uCAAuC;IACvC,qBAAqB;CACsB,CAAC;AAE9C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAE3B;IACF,KAAK,EAAE;QACL,uBAAuB,EAAE,mBAAmB;QAC5C,8BAA8B,EAAE,mBAAmB;QACnD,0EAA0E;QAC1E,gBAAgB,EAAE,YAAY;QAC9B,2EAA2E;QAC3E,qBAAqB,EAAE,iBAAiB;QACxC,oEAAoE;QACpE,4CAA4C;QAC5C,0BAA0B,EAAE,sBAAsB;QAClD,kEAAkE;QAClE,kDAAkD;QAClD,yBAAyB,EAAE,qBAAqB;KACjD;IACD,OAAO,EAAE;QACP,uEAAuE;QACvE,qEAAqE;QACrE,yBAAyB,EAAE,uBAAuB;QAClD,wBAAwB,EAAE,sBAAsB;QAChD,wEAAwE;QACxE,yBAAyB,EAAE,qBAAqB;KACjD;CACF,CAAC;AAEF,+DAA+D;AAC/D,MAAM,UAAU,cAAc,CAAC,OAAqB;IAClD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAsD;IACpF,KAAK,EAAE,EAAE;IACT,OAAO,EAAE,CAAC,kBAAkB,EAAE,oBAAoB,EAAE,yBAAyB,CAAC;CAC/E,CAAC;AAEF,SAAS,SAAS,CAAC,OAAqB,EAAE,GAAW;IACnD,OAAO,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,IAAI;QACJ,WAAW,EAAE,EAAE,YAAY,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;KACvF,CAAC,CAAC,CAAC;AACN,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,oCAAoC;AACpC,SAAS,SAAS,CAAC,MAAwB;IACzC,OAAO;QACL,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE;QAClD,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE;QACxC;YACE,IAAI,EAAE,mBAAmB;YACzB,KAAK,EAAE,QAAQ,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE;SACtE;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAI,MAA2B;IAC/D,OAAO;QACL,GAAG,SAAS,CAAC,MAAM,CAAC;QACpB,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE;QAClE,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE;QACpE,GAAG,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC;KACpC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAI,MAAyB;IAC3D,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAC1C,MAAM,KAAK,GAAiC;QAC1C,GAAG,SAAS,CAAC,MAAM,CAAC;QACpB,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE;QAChE,oEAAoE;QACpE,mCAAmC;QACnC,EAAE,IAAI,EAAE,2BAA2B,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE;QAC7E,yEAAyE;QACzE,kDAAkD;QAClD,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE;QACxD,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,aAAa,EAAE;QACrD,uEAAuE;QACvE,0DAA0D;QAC1D,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,EAAE;QACnD,mEAAmE;QACnE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,yBAAyB,CAAC,SAAS,CAAC,EAAE;QAClE,wEAAwE;QACxE,4DAA4D;QAC5D;YACE,IAAI,EAAE,2BAA2B;YACjC,KAAK,EAAE,yBAAyB,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;SAChE;QACD,wEAAwE;QACxE,sCAAsC;QACtC,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE;KAC1F,CAAC;IACF,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC9B,+DAA+D;QAC/D,oCAAoC;QACpC,KAAK,CAAC,IAAI,CACR,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,EAC/E,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,EAAE,CAClF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,oEAAoE;QACpE,8CAA8C;QAC9C,KAAK,CAAC,IAAI,CACR,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,CAAC,cAAc,EAAE,EAC7D,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,MAAM,CAAC,cAAc,EAAE,EAC/D,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE;QACtD,uEAAuE;QACvE,mEAAmE;QACnE,gDAAgD;QAChD,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,CACtD,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IACvC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,SAAS,EAAE,kBAAkB;IAC7B,UAAU,EAAE,IAAI;IAChB,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,QAAQ;CACX,CAAC;AA0CX,MAAM,eAAe,GAAG,oCAAoC,CAAC;AAU7D;;;GAGG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAQ,CAAC,OAAO,EAAE,SAAS,CAAW,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CACzD,cAAc,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvC,OAAO;QACP,MAAM;QACN,+DAA+D;QAC/D,aAAa,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,UAAU,CAAC,CAAC,CAAC,WAAW,MAAM,UAAU;KACvF,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,qBAAqB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzC,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;QACvD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAC1C,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,OAAO,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,8BAA8B;KACtE,CAAC,CAAC,CAAC;AACN,CAAC;AAED,uEAAuE;AACvE,MAAM,SAAS,GAA4B;IACzC;QACE,aAAa,EAAE,gBAAgB;QAC/B,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3B,SAAS,EAAE,MAAM;QACjB,GAAG,EAAE,oCAAoC;KAC1C;IACD;QACE,aAAa,EAAE,mBAAmB;QAClC,IAAI,EAAE,+BAA+B;QACrC,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3B,SAAS,EAAE,MAAM;QACjB,GAAG,EAAE,iEAAiE;KACvE;IACD;QACE,aAAa,EAAE,oBAAoB;QACnC,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3B,SAAS,EAAE,MAAM;QACjB,GAAG,EAAE,4CAA4C;KAClD;IACD;QACE,aAAa,EAAE,uBAAuB;QACtC,IAAI,EAAE,+BAA+B;QACrC,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3B,SAAS,EAAE,MAAM;QACjB,GAAG,EAAE,yEAAyE;KAC/E;CACF,CAAC;AAEF,MAAM,QAAQ,GAA4B;IACxC;QACE,aAAa,EAAE,oBAAoB;QACnC,IAAI,EAAE,4BAA4B;QAClC,MAAM,EAAE,UAAU;QAClB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE;QAC5C,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,0DAA0D;KAChE;IACD;QACE,aAAa,EAAE,UAAU;QACzB,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE;QAC3C,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,mCAAmC;KACzC;IACD;QACE,aAAa,EAAE,iBAAiB;QAChC,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE;QAC5C,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,gEAAgE;KACtE;IACD;QACE,aAAa,EAAE,kBAAkB;QACjC,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE;QAC7C,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,8DAA8D;KACpE;IACD;QACE,aAAa,EAAE,qBAAqB;QACpC,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,qBAAqB;QAC7B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE;QAC5C,SAAS,EAAE,MAAM;QACjB,GAAG,EAAE,qFAAqF;KAC3F;IACD;QACE,aAAa,EAAE,kBAAkB;QACjC,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,mBAAmB;QAC3B,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE;QACjD,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,8DAA8D;KACpE;CACF,CAAC;AAEF,MAAM,iBAAiB,GAA4B;IACjD;QACE,aAAa,EAAE,UAAU;QACzB,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE;QAC3C,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,mCAAmC;KACzC;IACD;QACE,aAAa,EAAE,sBAAsB;QACrC,IAAI,EAAE,6BAA6B;QACnC,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3B,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,kDAAkD;KACxD;IACD;QACE,aAAa,EAAE,wBAAwB;QACvC,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,UAAU;QAClB,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE;QACnD,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,yDAAyD;KAC/D;IACD;QACE,aAAa,EAAE,6BAA6B;QAC5C,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE;QACnD,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,uHAAuH;KAC7H;IACD;QACE,aAAa,EAAE,sBAAsB;QACrC,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,mBAAmB;QAC3B,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE;QACjD,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,8DAA8D;KACpE;CACF,CAAC;AAcF;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAiC;IAChE;QACE,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,mBAAmB,EAAE;QACrD,GAAG,EAAE,sGAAsG;KAC5G;CACF,CAAC;AAEF,qEAAqE;AACrE,MAAM,UAAU,kBAAkB,CAAC,QAAqB;IACtD,OAAO;QACL,GAAG,eAAe,EAAE;QACpB,GAAG,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC;QACtD,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA0D;IAC1F,GAAG,EAAE;QACH,mBAAmB,EACjB,0HAA0H;QAC5H,qBAAqB,EAAE,6CAA6C;QACpE,eAAe,EAAE,6CAA6C;QAC9D,wBAAwB,EACtB,8FAA8F;KACjG;IACD,cAAc,EAAE;QACd,aAAa,EACX,0HAA0H;QAC5H,iBAAiB,EACf,kFAAkF;QACpF,qBAAqB,EAAE,6CAA6C;QACpE,eAAe,EAAE,6CAA6C;KAC/D;CACF,CAAC;AAEF,mEAAmE;AACnE,MAAM,UAAU,SAAS,CACvB,SAAuB,EACvB,OAA6F;IAE7F,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO,kBAAkB,sBAAsB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACpF,KAAK,YAAY;YACf,OAAO,kBAAkB,0BAA0B,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxF,KAAK,qBAAqB;YACxB,OAAO,kBAAkB,+BAA+B,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,SAAS,0BAA0B,CAAC;QACvH,KAAK,mBAAmB;YACtB,OAAO,0BAA0B,OAAO,CAAC,aAAa,qCAAqC,CAAC;QAC9F,KAAK,UAAU;YACb,OAAO,UAAU,CAAC;IACtB,CAAC;AACH,CAAC;AAkCD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAC;AAE7C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAyC;IACjF;QACE,IAAI,EAAE,mBAAmB;QACzB,YAAY,EAAE,CAAC,WAAW,CAAC;QAC3B,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,qBAAqB,EAAE,KAAK;QAC5B,GAAG,EAAE,iEAAiE;KACvE;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,YAAY,EAAE,CAAC,WAAW,CAAC;QAC3B,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;QACjD,qBAAqB,EAAE,KAAK;QAC5B,GAAG,EAAE,iEAAiE;KACvE;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,YAAY,EAAE,CAAC,WAAW,CAAC;QAC3B,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QACjC,qBAAqB,EAAE,KAAK;QAC5B,GAAG,EAAE,kEAAkE;KACxE;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,YAAY,EAAE,CAAC,cAAc,CAAC;QAC9B,OAAO,EAAE;YACP,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,EAAE;YACzC,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,EAAE;YACzC,EAAE,UAAU,EAAE,MAAM,EAAE;SACvB;QACD,qBAAqB,EAAE,IAAI;QAC3B,GAAG,EAAE,qFAAqF;KAC3F;CACF,CAAC;AAEF,yEAAyE;AACzE,MAAM,UAAU,qBAAqB,CACnC,OAAuF,EACvF,YAA+B;IAE/B,MAAM,KAAK,GAAG,OAAO;SAClB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;SAC9E,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,OAAO,GAAG,KAAK,IAAI,QAAQ,SAAS,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,aAAa,EAAE,CAAC;AAChF,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,yBAAyB,CAAC,GAAW;IACnD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,iBAAiB,CAAC;AAChD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAE1C;;;GAGG;AACH;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAgB;IAIzD,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,GAAG,GAAG,KAAK,CAAC,IAAI,GAAG,GAAG,GAAG,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CACb,4BAA4B,QAAQ,qFAAqF,CAC1H,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,MAAM,CAAC,GAAG,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAClE,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACb,KAAK,IAAI;YACP,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,KAAK,IAAI;YACP,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC9B,KAAK,GAAG;YACN,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC;QACvD;YACE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC;IAChE,CAAC;AACH,CAAC"}
+{"version":3,"file":"stack-contract.js","sourceRoot":"","sources":["../src/stack-contract.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EACL,0BAA0B,EAC1B,aAAa,EACb,aAAa,EACb,WAAW,EACX,yBAAyB,EACzB,yBAAyB,EACzB,sBAAsB,EACtB,+BAA+B,EAC/B,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAkDxB,uDAAuD;AACvD,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAU,EAAE,EAAE,CACvC,gBAAgB,IAAI,IAAI,IAAI,IAAI,aAAa,IAAI,EAAE,kBAAkB,CAAC;IACxE,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,YAAY,EAAE,WAAW,CAAC;QACrC,WAAW,EAAE,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC;QAC5C,MAAM,EAAE,GAAG,CAAC,aAAa,EAAE,YAAY,CAAC;KACzC,CAAC;AACJ,CAAC;AAsBD,qFAAqF;AACrF,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,OAAO,WAAW,MAAM,EAAE,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,OAAO,WAAW,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;AACrE,CAAC;AAED,6DAA6D;AAC7D,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAErD;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,+BAA+B,CAAC;AAE3D;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,2BAA2B,CAAC;AAEvE;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;AAEzD,4DAA4D;AAC5D,MAAM,aAAa,GAAG,uCAAuC,CAAC;AAE9D,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;AAE7D,gDAAgD;AAChD,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAoBzC,8CAA8C;AAC9C,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,GAAW;IAC7D,OAAO;QACL,UAAU,EAAE,iBAAiB;QAC7B,MAAM,EAAE,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC;QAC9C,SAAS,EAAE,gBAAgB;KAC5B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAA2B;IAClE,OAAO;QACL,oBAAoB,EAAE,4BAA4B;QAClD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC;QACvF,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;KAChE,CAAC;AACb,CAAC;AAsBD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAkD;IACjF,UAAU,EAAE,mBAAmB;IAC/B,WAAW,EAAE,sBAAsB;IACnC,YAAY,EAAE,uBAAuB;CACtC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,iBAAiB;IACjB,sBAAsB;IACtB,wEAAwE;IACxE,kEAAkE;IAClE,sBAAsB;IACtB,uBAAuB;IACvB,uEAAuE;IACvE,sEAAsE;IACtE,uCAAuC;IACvC,qBAAqB;CACsB,CAAC;AAE9C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAE3B;IACF,KAAK,EAAE;QACL,uBAAuB,EAAE,mBAAmB;QAC5C,8BAA8B,EAAE,mBAAmB;QACnD,0EAA0E;QAC1E,gBAAgB,EAAE,YAAY;QAC9B,2EAA2E;QAC3E,qBAAqB,EAAE,iBAAiB;QACxC,oEAAoE;QACpE,4CAA4C;QAC5C,0BAA0B,EAAE,sBAAsB;QAClD,kEAAkE;QAClE,kDAAkD;QAClD,yBAAyB,EAAE,qBAAqB;KACjD;IACD,OAAO,EAAE;QACP,kEAAkE;QAClE,yDAAyD;QACzD,wBAAwB,EAAE,sBAAsB;QAChD,wEAAwE;QACxE,yBAAyB,EAAE,qBAAqB;KACjD;CACF,CAAC;AAEF,+DAA+D;AAC/D,MAAM,UAAU,cAAc,CAAC,OAAqB;IAClD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAsD;IACpF,KAAK,EAAE,EAAE;IACT,OAAO,EAAE;QACP,kBAAkB;QAClB,oBAAoB;QACpB,yBAAyB;QACzB,0DAA0D;QAC1D,sBAAsB;QACtB,2BAA2B;KAC5B;CACF,CAAC;AAEF,SAAS,SAAS,CAAC,OAAqB,EAAE,GAAW;IACnD,OAAO,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,IAAI;QACJ,WAAW,EAAE,EAAE,YAAY,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;KACvF,CAAC,CAAC,CAAC;AACN,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,oCAAoC;AACpC,SAAS,SAAS,CAAC,MAAwB;IACzC,OAAO;QACL,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE;QAClD,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE;QACxC;YACE,IAAI,EAAE,mBAAmB;YACzB,KAAK,EAAE,QAAQ,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE;SACtE;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAI,MAA2B;IAC/D,OAAO;QACL,GAAG,SAAS,CAAC,MAAM,CAAC;QACpB,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE;QAClE,GAAG,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC;KACpC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAI,MAAyB;IAC3D,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAC1C,MAAM,KAAK,GAAiC;QAC1C,GAAG,SAAS,CAAC,MAAM,CAAC;QACpB,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE;QAChE,oEAAoE;QACpE,mCAAmC;QACnC,EAAE,IAAI,EAAE,2BAA2B,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE;QAC7E,yEAAyE;QACzE,kDAAkD;QAClD,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE;QACxD,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,aAAa,EAAE;QACrD,uEAAuE;QACvE,0DAA0D;QAC1D,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,EAAE;QACnD,mEAAmE;QACnE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,yBAAyB,CAAC,SAAS,CAAC,EAAE;QAClE,wEAAwE;QACxE,4DAA4D;QAC5D;YACE,IAAI,EAAE,2BAA2B;YACjC,KAAK,EAAE,yBAAyB,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;SAChE;QACD,wEAAwE;QACxE,sCAAsC;QACtC,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE;KAC1F,CAAC;IACF,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC9B,+DAA+D;QAC/D,oCAAoC;QACpC,KAAK,CAAC,IAAI,CACR,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,EAC/E,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,EAAE,CAClF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,oEAAoE;QACpE,8CAA8C;QAC9C,KAAK,CAAC,IAAI,CACR,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,CAAC,cAAc,EAAE,EAC7D,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,MAAM,CAAC,cAAc,EAAE,EAC/D,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE;QACtD,uEAAuE;QACvE,mEAAmE;QACnE,gDAAgD;QAChD,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,CACtD,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IACvC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,SAAS,EAAE,kBAAkB;IAC7B,UAAU,EAAE,IAAI;IAChB,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,QAAQ;CACX,CAAC;AA0CX,MAAM,eAAe,GAAG,oCAAoC,CAAC;AAU7D;;;GAGG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAQ,CAAC,OAAO,EAAE,SAAS,CAAW,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CACzD,cAAc,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvC,OAAO;QACP,MAAM;QACN,+DAA+D;QAC/D,aAAa,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,UAAU,CAAC,CAAC,CAAC,WAAW,MAAM,UAAU;KACvF,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,qBAAqB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzC,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;QACvD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAC1C,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,OAAO,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,8BAA8B;KACtE,CAAC,CAAC,CAAC;AACN,CAAC;AAED,uEAAuE;AACvE,MAAM,SAAS,GAA4B;IACzC;QACE,aAAa,EAAE,gBAAgB;QAC/B,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3B,SAAS,EAAE,MAAM;QACjB,GAAG,EAAE,oCAAoC;KAC1C;IACD;QACE,aAAa,EAAE,mBAAmB;QAClC,IAAI,EAAE,+BAA+B;QACrC,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3B,SAAS,EAAE,MAAM;QACjB,GAAG,EAAE,iEAAiE;KACvE;IACD;QACE,aAAa,EAAE,oBAAoB;QACnC,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3B,SAAS,EAAE,MAAM;QACjB,GAAG,EAAE,4CAA4C;KAClD;IACD;QACE,aAAa,EAAE,uBAAuB;QACtC,IAAI,EAAE,+BAA+B;QACrC,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3B,SAAS,EAAE,MAAM;QACjB,GAAG,EAAE,yEAAyE;KAC/E;CACF,CAAC;AAEF,MAAM,QAAQ,GAA4B;IACxC;QACE,aAAa,EAAE,oBAAoB;QACnC,IAAI,EAAE,4BAA4B;QAClC,MAAM,EAAE,UAAU;QAClB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE;QAC5C,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,0DAA0D;KAChE;IACD;QACE,aAAa,EAAE,UAAU;QACzB,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE;QAC3C,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,mCAAmC;KACzC;IACD;QACE,aAAa,EAAE,iBAAiB;QAChC,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE;QAC5C,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,gEAAgE;KACtE;IACD;QACE,aAAa,EAAE,kBAAkB;QACjC,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE;QAC7C,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,8DAA8D;KACpE;IACD;QACE,aAAa,EAAE,qBAAqB;QACpC,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,qBAAqB;QAC7B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE;QAC5C,SAAS,EAAE,MAAM;QACjB,GAAG,EAAE,qFAAqF;KAC3F;IACD;QACE,aAAa,EAAE,kBAAkB;QACjC,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,mBAAmB;QAC3B,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE;QACjD,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,8DAA8D;KACpE;CACF,CAAC;AAEF,MAAM,iBAAiB,GAA4B;IACjD;QACE,aAAa,EAAE,UAAU;QACzB,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE;QAC3C,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,mCAAmC;KACzC;IACD;QACE,aAAa,EAAE,sBAAsB;QACrC,IAAI,EAAE,6BAA6B;QACnC,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3B,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,kDAAkD;KACxD;IACD;QACE,aAAa,EAAE,wBAAwB;QACvC,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,UAAU;QAClB,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE;QACnD,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,yDAAyD;KAC/D;IACD;QACE,aAAa,EAAE,6BAA6B;QAC5C,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE;QACnD,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,uHAAuH;KAC7H;IACD;QACE,aAAa,EAAE,sBAAsB;QACrC,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,mBAAmB;QAC3B,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE;QACjD,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,8DAA8D;KACpE;CACF,CAAC;AAcF;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAiC;IAChE;QACE,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,mBAAmB,EAAE;QACrD,GAAG,EAAE,sGAAsG;KAC5G;IACD;QACE,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,EAAE;QACzD,GAAG,EAAE,qHAAqH;KAC3H;CACF,CAAC;AAEF,qEAAqE;AACrE,MAAM,UAAU,kBAAkB,CAAC,QAAqB;IACtD,OAAO;QACL,GAAG,eAAe,EAAE;QACpB,GAAG,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC;QACtD,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA0D;IAC1F,GAAG,EAAE;QACH,mBAAmB,EACjB,0HAA0H;QAC5H,qBAAqB,EAAE,6CAA6C;QACpE,eAAe,EAAE,6CAA6C;QAC9D,wBAAwB,EACtB,8FAA8F;KACjG;IACD,cAAc,EAAE;QACd,aAAa,EACX,0HAA0H;QAC5H,iBAAiB,EACf,kFAAkF;QACpF,qBAAqB,EAAE,6CAA6C;QACpE,eAAe,EAAE,6CAA6C;KAC/D;CACF,CAAC;AAEF,mEAAmE;AACnE,MAAM,UAAU,SAAS,CACvB,SAAuB,EACvB,OAA6F;IAE7F,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO,kBAAkB,sBAAsB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACpF,KAAK,YAAY;YACf,OAAO,kBAAkB,0BAA0B,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxF,KAAK,qBAAqB;YACxB,OAAO,kBAAkB,+BAA+B,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,SAAS,0BAA0B,CAAC;QACvH,KAAK,mBAAmB;YACtB,OAAO,0BAA0B,OAAO,CAAC,aAAa,qCAAqC,CAAC;QAC9F,KAAK,UAAU;YACb,OAAO,UAAU,CAAC;IACtB,CAAC;AACH,CAAC;AAkCD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAC;AAE7C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAyC;IACjF;QACE,IAAI,EAAE,mBAAmB;QACzB,YAAY,EAAE,CAAC,WAAW,CAAC;QAC3B,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,qBAAqB,EAAE,KAAK;QAC5B,GAAG,EAAE,iEAAiE;KACvE;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,YAAY,EAAE,CAAC,WAAW,CAAC;QAC3B,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;QACjD,qBAAqB,EAAE,KAAK;QAC5B,GAAG,EAAE,iEAAiE;KACvE;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,YAAY,EAAE,CAAC,WAAW,CAAC;QAC3B,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QACjC,qBAAqB,EAAE,KAAK;QAC5B,GAAG,EAAE,kEAAkE;KACxE;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,YAAY,EAAE,CAAC,cAAc,CAAC;QAC9B,OAAO,EAAE;YACP,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,EAAE;YACzC,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,EAAE;YACzC,EAAE,UAAU,EAAE,MAAM,EAAE;SACvB;QACD,qBAAqB,EAAE,IAAI;QAC3B,GAAG,EAAE,qFAAqF;KAC3F;CACF,CAAC;AAEF,yEAAyE;AACzE,MAAM,UAAU,qBAAqB,CACnC,OAAuF,EACvF,YAA+B;IAE/B,MAAM,KAAK,GAAG,OAAO;SAClB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;SAC9E,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,OAAO,GAAG,KAAK,IAAI,QAAQ,SAAS,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,aAAa,EAAE,CAAC;AAChF,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,yBAAyB,CAAC,GAAW;IACnD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,iBAAiB,CAAC;AAChD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAE1C;;;GAGG;AACH;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAgB;IAIzD,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,GAAG,GAAG,KAAK,CAAC,IAAI,GAAG,GAAG,GAAG,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CACb,4BAA4B,QAAQ,qFAAqF,CAC1H,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,MAAM,CAAC,GAAG,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAClE,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACb,KAAK,IAAI;YACP,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,KAAK,IAAI;YACP,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC9B,KAAK,GAAG;YACN,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC;QACvD;YACE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC;IAChE,CAAC;AACH,CAAC"}

package/dist/staging-admin.d.ts

@@ -1,17 +1,16 @@
-import { type GcloudResult } from "./gcloud.js";
-type Run = (args: string[]) => Promise<GcloudResult>;
+/**
+ * #678 — `staging-domain enable` tells the admin itself what the operator
+ * decided, instead of printing "now set the same host in the admin".
+ * It calls `POST /api/internal/staging/provision` through admin-internal.ts
+ * (IAP as caelo-mcp + the internal token, scope `staging.provision`), because
+ * the answer carries the generated basic-auth password back to the CLI, which
+ * prints it once and never stores it.
+ */
+import { type AdminInternalDeps, type AdminInternalResult, type AdminInternalTarget } from "./admin-internal.js";
 /** Token scope the admin endpoint checks (apps/admin …/api/internal/staging/provision). */
 export declare const STAGING_PROVISION_SCOPE = "staging.provision";
-export interface StagingAdminTarget {
-    readonly projectId: string;
-    readonly region: string;
-}
-export interface StagingAdminDeps {
-    readonly run?: Run;
-    readonly fetch?: typeof fetch;
-    /** Seconds since epoch (IAP JWT); tests pin it. */
-    readonly now?: () => number;
-}
+export type StagingAdminTarget = AdminInternalTarget;
+export type StagingAdminDeps = AdminInternalDeps;
 /** Main's draft pages, as the admin reports them. */
 export interface DraftPages {
     readonly count: number;
@@ -46,13 +45,7 @@ export interface StagingApply {
     readonly stageNote: string | null;
     readonly draftPages: DraftPages;
 }
-export type StagingAdminResult<T> = {
-    ok: true;
-    value: T;
-} | {
-    ok: false;
-    error: string;
-};
+export type StagingAdminResult<T> = AdminInternalResult<T>;
 export interface ApplyRequest {
     readonly host?: string;
     readonly rotateBasicAuth?: boolean;
@@ -75,5 +68,4 @@ export declare function describeStagingApply(r: StagingApply): string[];
  * admin's previous host instead (codex review on #681).
  */
 export declare function domainEnableRetryCommand(command: string, requestedHost: string | null): string;
-export {};
 //# sourceMappingURL=staging-admin.d.ts.map

package/dist/staging-admin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"staging-admin.d.ts","sourceRoot":"","sources":["../src/staging-admin.ts"],"names":[],"mappings":"AA2BA,OAAO,EAA2B,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAIzE,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;AAErD,2FAA2F;AAC3F,eAAO,MAAM,uBAAuB,sBAAsB,CAAC;AAK3D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC;IACnB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,mDAAmD;IACnD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED,qDAAqD;AACrD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,SAAS;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC5D;AAED,qEAAqE;AACrE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,gBAAgB,GAAG,cAAc,GAAG,IAAI,CAAC;IAC/D,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAA;KAAE,CAAC;CACjG;AAED,gEAAgE;AAChE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,mBAAmB,GAAG,oBAAoB,CAAC;QACtF,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;KAClC,CAAC;IACF,QAAQ,CAAC,WAAW,EAAE,gBAAgB,GAAG,cAAc,GAAG,IAAI,CAAC;IAC/D,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;CACjC;AAED,MAAM,MAAM,kBAAkB,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1F,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;CACpC;AAED,qFAAqF;AACrF,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,kBAAkB,EAC1B,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC,CAE7C;AAED,+FAA+F;AAC/F,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,kBAAkB,EAC1B,OAAO,EAAE,YAAY,EACrB,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAE3C;AAwJD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,YAAY,GAAG,MAAM,EAAE,CAmD9D;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAE9F"}
+{"version":3,"file":"staging-admin.d.ts","sourceRoot":"","sources":["../src/staging-admin.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AAEH,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EAEzB,MAAM,qBAAqB,CAAC;AAE7B,2FAA2F;AAC3F,eAAO,MAAM,uBAAuB,sBAAsB,CAAC;AAG3D,MAAM,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AACrD,MAAM,MAAM,gBAAgB,GAAG,iBAAiB,CAAC;AAEjD,qDAAqD;AACrD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,SAAS;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC5D;AAED,qEAAqE;AACrE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,gBAAgB,GAAG,cAAc,GAAG,IAAI,CAAC;IAC/D,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAA;KAAE,CAAC;CACjG;AAED,gEAAgE;AAChE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,mBAAmB,GAAG,oBAAoB,CAAC;QACtF,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;KAClC,CAAC;IACF,QAAQ,CAAC,WAAW,EAAE,gBAAgB,GAAG,cAAc,GAAG,IAAI,CAAC;IAC/D,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;CACjC;AAED,MAAM,MAAM,kBAAkB,CAAC,CAAC,IAAI,mBAAmB,CAAC,CAAC,CAAC,CAAC;AAE3D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;CACpC;AAED,qFAAqF;AACrF,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,kBAAkB,EAC1B,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC,CAE7C;AAED,+FAA+F;AAC/F,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,kBAAkB,EAC1B,OAAO,EAAE,YAAY,EACrB,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAE3C;AAeD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,YAAY,GAAG,MAAM,EAAE,CAmD9D;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAE9F"}

package/dist/staging-admin.js

@@ -2,35 +2,15 @@
 /**
  * #678 — `staging-domain enable` tells the admin itself what the operator
  * decided, instead of printing "now set the same host in the admin".
- *
- * Why an HTTP call to the admin (and not a one-shot Cloud Run job like the
- * migrations): the call must hand a result BACK — above all the generated
- * basic-auth password, which the CLI prints once. A job can only report
- * through Cloud Logging, which would put the password into the project's
- * logs. The admin endpoint (`POST /api/internal/staging/provision`) answers
- * over TLS straight to this process, and the password is never written
- * anywhere (CLAUDE.md §7, #659).
- *
- * Getting there, as the operator's own gcloud identity — the same path the
- * Power-MCP shim takes (packages/mcp-server/src/ingress-auth.ts):
- *
- *   1. the admin Cloud Run service and its URL;
- *   2. the install's internal secret from Secret Manager (in memory only),
- *      which signs a 5-minute token for scope `staging.provision`;
- *   3. a JWT signed as `caelo-mcp@<project>` through the IAM Credentials
- *      API — the admin's IAP lets that service account in, and every
- *      IAP-allowlisted operator may sign as it (`cms-provision upgrade`
- *      grants it) — so the request passes IAP first, then Caelo's token.
+ * It calls `POST /api/internal/staging/provision` through admin-internal.ts
+ * (IAP as caelo-mcp + the internal token, scope `staging.provision`), because
+ * the answer carries the generated basic-auth password back to the CLI, which
+ * prints it once and never stores it.
  */
-import { findService } from "./admin-domain.js";
-import { gcloud as defaultGcloud } from "./gcloud.js";
-import { GCP_STACK_ENV, gcpSecretId, mcpIapServiceAccountEmail } from "./gcp-names.js";
-import { mintInternalToken } from "./internal-token.js";
+import { callAdminInternal, } from "./admin-internal.js";
 /** Token scope the admin endpoint checks (apps/admin …/api/internal/staging/provision). */
 export const STAGING_PROVISION_SCOPE = "staging.provision";
 const ENDPOINT = "/api/internal/staging/provision";
-/** Signed JWTs live at most 1 hour; one call needs a few seconds. */
-const IAP_JWT_LIFETIME_S = 600;
 /** Read the admin's stored staging host (the truth `staging-domain enable` maps). */
 export function inspectStagingAdmin(target, deps = {}) {
     return callStagingAdmin(target, { mode: "inspect" }, deps);
@@ -40,140 +20,8 @@ export function applyStagingAdmin(target, request, deps = {}) {
     return callStagingAdmin(target, { mode: "apply", ...request }, deps);
 }
 async function callStagingAdmin(target, body, deps) {
-    const run = deps.run ?? defaultGcloud;
-    const doFetch = deps.fetch ?? fetch;
-    const scope = [`--region=${target.region}`, `--project=${target.projectId}`];
-    const found = await findService(run, scope, "admin");
-    if (!found.ok)
-        return { ok: false, error: found.error };
-    const url = await run([
-        "run",
-        "services",
-        "describe",
-        found.service,
-        ...scope,
-        "--format=value(status.url)",
-    ]);
-    const adminUrl = url.stdout.trim();
-    if (!url.ok || !adminUrl) {
-        return { ok: false, error: `read the admin's URL: ${url.stderr.trim() || "empty"}` };
-    }
-    const secretId = gcpSecretId(GCP_STACK_ENV, "internal-secret");
-    const secret = await run([
-        "secrets",
-        "versions",
-        "access",
-        "latest",
-        `--secret=${secretId}`,
-        `--project=${target.projectId}`,
-    ]);
-    const internalSecret = secret.stdout.trim();
-    if (!secret.ok || internalSecret.length < 32) {
-        return {
-            ok: false,
-            error: `read the install's internal secret (${secretId}) from Secret Manager: ${secret.stderr.trim() || "missing or too short"}. Your gcloud account needs secretmanager.versions.access on the project.`,
-        };
-    }
-    // Installs from before #678 may not have the IAM Credentials API on;
-    // enabling an enabled API is a no-op (codex review on #681).
-    const api = await run([
-        "services",
-        "enable",
-        "iamcredentials.googleapis.com",
-        `--project=${target.projectId}`,
-    ]);
-    if (!api.ok) {
-        return {
-            ok: false,
-            error: `enable the IAM Credentials API (iamcredentials.googleapis.com), needed to pass the admin's IAP: ${api.stderr.trim()}`,
-        };
-    }
-    const iap = await signIapJwt(run, doFetch, target.projectId, adminUrl, deps.now);
-    if (!iap.ok)
-        return iap;
-    const token = await mintInternalToken(internalSecret, STAGING_PROVISION_SCOPE);
-    let res;
-    try {
-        res = await doFetch(`${adminUrl}${ENDPOINT}`, {
-            method: "POST",
-            headers: {
-                authorization: `Bearer ${iap.value}`,
-                "x-caelo-internal-token": token,
-                "content-type": "application/json",
-            },
-            body: JSON.stringify(body),
-        });
-    }
-    catch (e) {
-        return { ok: false, error: `reach the admin at ${adminUrl}: ${String(e)}` };
-    }
-    const text = await res.text();
-    if (res.headers.get("x-goog-iap-generated-response") === "true") {
-        return {
-            ok: false,
-            error: `Google IAP refused the request (HTTP ${res.status}: ${text.trim().slice(0, 200)}) — ${mcpIapServiceAccountEmail(target.projectId)} is not allowed on the admin's IAP yet. Run \`cms-provision upgrade\` (it allowlists that service account), then run this command again.`,
-        };
-    }
-    if (res.status === 404) {
-        return {
-            ok: false,
-            error: `the admin has no ${ENDPOINT} yet (it runs a release from before #678). Run \`cms-provision upgrade\`, then run this command again.`,
-        };
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(text);
-    }
-    catch {
-        return {
-            ok: false,
-            error: `the admin answered HTTP ${res.status} with a non-JSON body: ${text.slice(0, 200)}`,
-        };
-    }
-    if (!res.ok || parsed.ok !== true) {
-        return {
-            ok: false,
-            error: `the admin refused (HTTP ${res.status}): ${parsed.error ?? text.slice(0, 300)}`,
-        };
-    }
-    return { ok: true, value: parsed };
-}
-/** A JWT signed as the install's MCP service account, for the admin's IAP. */
-async function signIapJwt(run, doFetch, projectId, adminUrl, now) {
-    const access = await run(["auth", "print-access-token"]);
-    const accessToken = access.stdout.trim();
-    if (!access.ok || !accessToken) {
-        return {
-            ok: false,
-            error: `get an access token from gcloud: ${access.stderr.trim() || "empty"}. Run \`gcloud auth login\` with the account you provisioned with.`,
-        };
-    }
-    const serviceAccount = mcpIapServiceAccountEmail(projectId);
-    const iat = now ? now() : Math.floor(Date.now() / 1000);
-    const res = await doFetch(`https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${encodeURIComponent(serviceAccount)}:signJwt`, {
-        method: "POST",
-        headers: { authorization: `Bearer ${accessToken}`, "content-type": "application/json" },
-        body: JSON.stringify({
-            payload: JSON.stringify({
-                iss: serviceAccount,
-                sub: serviceAccount,
-                aud: `${new URL(adminUrl).origin}/*`,
-                iat,
-                exp: iat + IAP_JWT_LIFETIME_S,
-            }),
-        }),
-    });
-    if (!res.ok) {
-        const detail = (await res.text().catch(() => "")).slice(0, 300);
-        return {
-            ok: false,
-            error: `sign an IAP token as ${serviceAccount} (HTTP ${res.status}): ${detail} — your account needs roles/iam.serviceAccountTokenCreator on it; \`cms-provision upgrade\` grants it to everyone the admin's IAP lets in.`,
-        };
-    }
-    const { signedJwt } = (await res.json());
-    if (!signedJwt)
-        return { ok: false, error: "IAM signJwt answered without a signedJwt" };
-    return { ok: true, value: signedJwt };
+    const r = await callAdminInternal(target, { endpoint: ENDPOINT, scope: STAGING_PROVISION_SCOPE, body, introducedBy: "#678" }, deps);
+    return r.ok ? { ok: true, value: r.value.answer } : r;
 }
 /**
  * The lines `staging-domain enable` prints for an apply result: host,

package/dist/staging-admin.js.map

@@ -1 +1 @@
-{"version":3,"file":"staging-admin.js","sourceRoot":"","sources":["../src/staging-admin.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,MAAM,IAAI,aAAa,EAAqB,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAIxD,2FAA2F;AAC3F,MAAM,CAAC,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AAC3D,MAAM,QAAQ,GAAG,iCAAiC,CAAC;AACnD,qEAAqE;AACrE,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAqD/B,qFAAqF;AACrF,MAAM,UAAU,mBAAmB,CACjC,MAA0B,EAC1B,OAAyB,EAAE;IAE3B,OAAO,gBAAgB,CAAiB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,CAAC;AAC7E,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,iBAAiB,CAC/B,MAA0B,EAC1B,OAAqB,EACrB,OAAyB,EAAE;IAE3B,OAAO,gBAAgB,CAAe,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC;AACrF,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,MAA0B,EAC1B,IAA6B,EAC7B,IAAsB;IAEtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACpC,MAAM,KAAK,GAAG,CAAC,YAAY,MAAM,CAAC,MAAM,EAAE,EAAE,aAAa,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAE7E,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IACxD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC;QACpB,KAAK;QACL,UAAU;QACV,UAAU;QACV,KAAK,CAAC,OAAO;QACb,GAAG,KAAK;QACR,4BAA4B;KAC7B,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,OAAO,EAAE,EAAE,CAAC;IACvF,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;QACvB,SAAS;QACT,UAAU;QACV,QAAQ;QACR,QAAQ;QACR,YAAY,QAAQ,EAAE;QACtB,aAAa,MAAM,CAAC,SAAS,EAAE;KAChC,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,cAAc,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC7C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,uCAAuC,QAAQ,0BAA0B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,sBAAsB,2EAA2E;SAC1M,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,6DAA6D;IAC7D,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC;QACpB,UAAU;QACV,QAAQ;QACR,+BAA+B;QAC/B,aAAa,MAAM,CAAC,SAAS,EAAE;KAChC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,mGAAmG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;SAC9H,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACjF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC;IAExB,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAAC;IAC/E,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,QAAQ,GAAG,QAAQ,EAAE,EAAE;YAC5C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,GAAG,CAAC,KAAK,EAAE;gBACpC,wBAAwB,EAAE,KAAK;gBAC/B,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC9E,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,KAAK,MAAM,EAAE,CAAC;QAChE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,wCAAwC,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,yBAAyB,CAAC,MAAM,CAAC,SAAS,CAAC,0IAA0I;SACpR,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,oBAAoB,QAAQ,wGAAwG;SAC5I,CAAC;IACJ,CAAC;IACD,IAAI,MAAkE,CAAC;IACvE,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkB,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,2BAA2B,GAAG,CAAC,MAAM,0BAA0B,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;SAC3F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QAClC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,2BAA2B,GAAG,CAAC,MAAM,MAAM,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;SACvF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAsB,EAAE,CAAC;AACrD,CAAC;AAED,8EAA8E;AAC9E,KAAK,UAAU,UAAU,CACvB,GAAQ,EACR,OAAqB,EACrB,SAAiB,EACjB,QAAgB,EAChB,GAA+B;IAE/B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,oCAAoC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,OAAO,oEAAoE;SAC/I,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,yBAAyB,CAAC,SAAS,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,uEAAuE,kBAAkB,CAAC,cAAc,CAAC,UAAU,EACnH;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QACvF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;gBACtB,GAAG,EAAE,cAAc;gBACnB,GAAG,EAAE,cAAc;gBACnB,GAAG,EAAE,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,IAAI;gBACpC,GAAG;gBACH,GAAG,EAAE,GAAG,GAAG,kBAAkB;aAC9B,CAAC;SACH,CAAC;KACH,CACF,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAChE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,wBAAwB,cAAc,UAAU,GAAG,CAAC,MAAM,MAAM,MAAM,4IAA4I;SAC1N,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2B,CAAC;IACnE,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC;IACxF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,CAAe;IAClD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CACR,CAAC,CAAC,WAAW;QACX,CAAC,CAAC,sBAAsB,CAAC,CAAC,IAAI,6BAA6B,CAAC,CAAC,YAAY,IAAI,OAAO,4BAA4B;QAChH,CAAC,CAAC,+BAA+B,CAAC,CAAC,IAAI,GAAG,CAC7C,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC;IACtB,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;QAChF,KAAK,CAAC,IAAI,CACR,EAAE,EACF,CAAC,CAAC,MAAM,KAAK,WAAW;YACtB,CAAC,CAAC,2FAA2F;YAC7F,CAAC,CAAC,6FAA6F,EACjG,eAAe,CAAC,CAAC,IAAI,EAAE,EACvB,eAAe,CAAC,CAAC,QAAQ,EAAE,EAC3B,6FAA6F,EAC7F,0FAA0F,CAC3F,CAAC;IACJ,CAAC;SAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CACR,EAAE,EACF,iBAAiB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iCAAiC,6CAA6C,EAClH,eAAe,CAAC,CAAC,IAAI,EAAE,EACvB,eAAe,CAAC,CAAC,QAAQ,EAAE,CAC5B,CAAC;IACJ,CAAC;SAAM,IAAI,CAAC,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;QAC5C,KAAK,CAAC,IAAI,CACR,EAAE,EACF,+CAA+C,CAAC,CAAC,IAAI,qGAAqG,CAC3J,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CACR,EAAE,EACF,gJAAgJ,CACjJ,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClF,MAAM,IAAI,GACR,CAAC,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM;YAC5C,CAAC,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,OAAO;YAC/D,CAAC,CAAC,EAAE,CAAC;QACT,KAAK,CAAC,IAAI,CACR,EAAE,EACF,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,kDAAkD,MAAM,GAAG,IAAI,GAAG,EACvF,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAe,EAAE,aAA4B;IACpF,OAAO,iBAAiB,OAAO,UAAU,aAAa,CAAC,CAAC,CAAC,qBAAqB,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACvG,CAAC"}
+{"version":3,"file":"staging-admin.js","sourceRoot":"","sources":["../src/staging-admin.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;GAOG;AAEH,OAAO,EAIL,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAE7B,2FAA2F;AAC3F,MAAM,CAAC,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AAC3D,MAAM,QAAQ,GAAG,iCAAiC,CAAC;AA4CnD,qFAAqF;AACrF,MAAM,UAAU,mBAAmB,CACjC,MAA0B,EAC1B,OAAyB,EAAE;IAE3B,OAAO,gBAAgB,CAAiB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,CAAC;AAC7E,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,iBAAiB,CAC/B,MAA0B,EAC1B,OAAqB,EACrB,OAAyB,EAAE;IAE3B,OAAO,gBAAgB,CAAe,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC;AACrF,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,MAA0B,EAC1B,IAA6B,EAC7B,IAAsB;IAEtB,MAAM,CAAC,GAAG,MAAM,iBAAiB,CAC/B,MAAM,EACN,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,uBAAuB,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,EAClF,IAAI,CACL,CAAC;IACF,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,CAAe;IAClD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CACR,CAAC,CAAC,WAAW;QACX,CAAC,CAAC,sBAAsB,CAAC,CAAC,IAAI,6BAA6B,CAAC,CAAC,YAAY,IAAI,OAAO,4BAA4B;QAChH,CAAC,CAAC,+BAA+B,CAAC,CAAC,IAAI,GAAG,CAC7C,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC;IACtB,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;QAChF,KAAK,CAAC,IAAI,CACR,EAAE,EACF,CAAC,CAAC,MAAM,KAAK,WAAW;YACtB,CAAC,CAAC,2FAA2F;YAC7F,CAAC,CAAC,6FAA6F,EACjG,eAAe,CAAC,CAAC,IAAI,EAAE,EACvB,eAAe,CAAC,CAAC,QAAQ,EAAE,EAC3B,6FAA6F,EAC7F,0FAA0F,CAC3F,CAAC;IACJ,CAAC;SAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CACR,EAAE,EACF,iBAAiB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iCAAiC,6CAA6C,EAClH,eAAe,CAAC,CAAC,IAAI,EAAE,EACvB,eAAe,CAAC,CAAC,QAAQ,EAAE,CAC5B,CAAC;IACJ,CAAC;SAAM,IAAI,CAAC,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;QAC5C,KAAK,CAAC,IAAI,CACR,EAAE,EACF,+CAA+C,CAAC,CAAC,IAAI,qGAAqG,CAC3J,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CACR,EAAE,EACF,gJAAgJ,CACjJ,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClF,MAAM,IAAI,GACR,CAAC,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM;YAC5C,CAAC,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,OAAO;YAC/D,CAAC,CAAC,EAAE,CAAC;QACT,KAAK,CAAC,IAAI,CACR,EAAE,EACF,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,kDAAkD,MAAM,GAAG,IAAI,GAAG,EACvF,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAe,EAAE,aAA4B;IACpF,OAAO,iBAAiB,OAAO,UAAU,aAAa,CAAC,CAAC,CAAC,qBAAqB,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACvG,CAAC"}

package/dist/tar-entries.d.ts

@@ -0,0 +1,14 @@
+export type TarEntryType = "file" | "directory" | "symlink" | "other";
+export interface TarEntry {
+    readonly name: string;
+    readonly type: TarEntryType;
+    /** The link target, for symlinks. */
+    readonly linkTarget?: string;
+}
+/** Every member of an (uncompressed) tar archive, in archive order. */
+export declare function listTarEntries(tar: Uint8Array): TarEntry[];
+/** `./a/b/` → `a/b`; the archive root (`./`) → "". */
+export declare function normalizeMemberName(name: string): string;
+/** Whether a member name could write outside the extraction directory. */
+export declare function escapesRoot(name: string): boolean;
+//# sourceMappingURL=tar-entries.d.ts.map

package/dist/tar-entries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tar-entries.d.ts","sourceRoot":"","sources":["../src/tar-entries.ts"],"names":[],"mappings":"AAeA,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC;AAEtE,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,qCAAqC;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,uEAAuE;AACvE,wBAAgB,cAAc,CAAC,GAAG,EAAE,UAAU,GAAG,QAAQ,EAAE,CAgD1D;AAED,sDAAsD;AACtD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEjD"}

package/dist/tar-entries.js

@@ -0,0 +1,104 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * Read the member list of a tar archive WITHOUT extracting it, so a restore
+ * can refuse an archive before `tar -x` writes anything (PR #755 review: an
+ * absolute or `../` member, or a member written through a symlink, would
+ * otherwise land outside the target directory).
+ *
+ * Parses ustar headers plus the two extensions GNU tar and bsdtar emit for
+ * long names: GNU `L`/`K` records and pax `x`/`g` records (`path=`,
+ * `linkpath=`). Anything it cannot read is an error, never a skipped member.
+ */
+const BLOCK = 512;
+/** Every member of an (uncompressed) tar archive, in archive order. */
+export function listTarEntries(tar) {
+    const entries = [];
+    let offset = 0;
+    let longName = null;
+    let longLink = null;
+    let paxPath = null;
+    let paxLink = null;
+    while (offset + BLOCK <= tar.length) {
+        const header = tar.subarray(offset, offset + BLOCK);
+        if (header.every((b) => b === 0))
+            break; // end-of-archive marker
+        const size = octal(header.subarray(124, 136));
+        const typeflag = String.fromCharCode(header[156] ?? 0);
+        const body = tar.subarray(offset + BLOCK, offset + BLOCK + size);
+        if (body.length < size)
+            throw new Error("truncated tar archive");
+        offset += BLOCK + Math.ceil(size / BLOCK) * BLOCK;
+        if (typeflag === "L") {
+            longName = cString(body);
+            continue;
+        }
+        if (typeflag === "K") {
+            longLink = cString(body);
+            continue;
+        }
+        if (typeflag === "x" || typeflag === "g") {
+            const pax = paxRecords(body);
+            if (typeflag === "x") {
+                paxPath = pax.path ?? null;
+                paxLink = pax.linkpath ?? null;
+            }
+            continue;
+        }
+        const prefix = cString(header.subarray(345, 500));
+        const shortName = cString(header.subarray(0, 100));
+        const name = paxPath ?? longName ?? (prefix ? `${prefix}/${shortName}` : shortName);
+        const link = paxLink ?? longLink ?? cString(header.subarray(157, 257));
+        longName = longLink = paxPath = paxLink = null;
+        const type = typeflag === "0" || typeflag === "\0" || typeflag === "7"
+            ? "file"
+            : typeflag === "5"
+                ? "directory"
+                : typeflag === "2"
+                    ? "symlink"
+                    : "other";
+        entries.push(type === "symlink" ? { name, type, linkTarget: link } : { name, type });
+    }
+    return entries;
+}
+/** `./a/b/` → `a/b`; the archive root (`./`) → "". */
+export function normalizeMemberName(name) {
+    return name.replace(/^(\.\/)+/, "").replace(/\/+$/, "");
+}
+/** Whether a member name could write outside the extraction directory. */
+export function escapesRoot(name) {
+    return name.startsWith("/") || name.split("/").some((part) => part === "..");
+}
+function octal(field) {
+    const text = cString(field).trim();
+    if (text === "")
+        return 0;
+    if (!/^[0-7]+$/.test(text))
+        throw new Error(`unreadable tar header size ${JSON.stringify(text)}`);
+    return Number.parseInt(text, 8);
+}
+function cString(bytes) {
+    const end = bytes.indexOf(0);
+    return new TextDecoder().decode(end === -1 ? bytes : bytes.subarray(0, end));
+}
+/** pax records: `<len> <key>=<value>\n`, repeated; `<len>` counts bytes. */
+function paxRecords(body) {
+    const out = {};
+    const decode = (b) => new TextDecoder().decode(b);
+    let i = 0;
+    while (i < body.length && body[i] !== 0) {
+        const space = body.indexOf(0x20, i);
+        if (space === -1)
+            throw new Error("unreadable pax header");
+        const len = Number.parseInt(decode(body.subarray(i, space)), 10);
+        if (!Number.isFinite(len) || len <= 0 || i + len > body.length) {
+            throw new Error("unreadable pax header");
+        }
+        const record = decode(body.subarray(space + 1, i + len - 1));
+        const eq = record.indexOf("=");
+        if (eq !== -1)
+            out[record.slice(0, eq)] = record.slice(eq + 1);
+        i += len;
+    }
+    return out;
+}
+//# sourceMappingURL=tar-entries.js.map

package/dist/tar-entries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tar-entries.js","sourceRoot":"","sources":["../src/tar-entries.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;GASG;AAEH,MAAM,KAAK,GAAG,GAAG,CAAC;AAWlB,uEAAuE;AACvE,MAAM,UAAU,cAAc,CAAC,GAAe;IAC5C,MAAM,OAAO,GAAe,EAAE,CAAC;IAC/B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,OAAO,MAAM,GAAG,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC;QACpD,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YAAE,MAAM,CAAC,wBAAwB;QACjE,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,KAAK,EAAE,MAAM,GAAG,KAAK,GAAG,IAAI,CAAC,CAAC;QACjE,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,KAAK,CAAC;QAElD,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;YACrB,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YACzB,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;YACrB,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YACzB,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;gBACrB,OAAO,GAAG,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC;gBAC3B,OAAO,GAAG,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC;YACjC,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,OAAO,IAAI,QAAQ,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACpF,MAAM,IAAI,GAAG,OAAO,IAAI,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QACvE,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,GAAG,IAAI,CAAC;QAC/C,MAAM,IAAI,GACR,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,GAAG;YACvD,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,QAAQ,KAAK,GAAG;gBAChB,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,QAAQ,KAAK,GAAG;oBAChB,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,OAAO,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,KAAK,CAAC,KAAiB;IAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,CAAC,CAAC;IAC1B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClG,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,OAAO,CAAC,KAAiB;IAChC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7B,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,4EAA4E;AAC5E,SAAS,UAAU,CAAC,IAAgB;IAClC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,MAAM,MAAM,GAAG,CAAC,CAAa,EAAE,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAC7D,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC/D,CAAC,IAAI,GAAG,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/upgrade/converge.d.ts

@@ -31,8 +31,8 @@ export interface ConvergeDeps {
 }
 export interface ConvergeSession {
     /**
-     * Before the app-roll: runtime identities + secrets, stack invariants, MCP
-     * access. False when a step the install cannot work without failed —
+     * Before the app-roll: runtime identities + secrets, stack invariants,
+     * public_role's Cloud SQL role memberships (#633), MCP access. False when a step the install cannot work without failed —
      * nothing app-side changed then.
      */
     beforeAppRoll(): Promise<boolean>;

package/dist/upgrade/converge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"converge.d.ts","sourceRoot":"","sources":["../../src/upgrade/converge.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAG3D,OAAO,EAGL,KAAK,SAAS,EAGf,MAAM,uBAAuB,CAAC;AAa/B,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAsB,MAAM,eAAe,CAAC;AACnF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,sBAAsB,CAAC,EACtD,aAAa,EAAE,MAAM,GACpB,OAAO,CAET;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,2DAA2D;IAC3D,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACtD;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AAED,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,mDAAmD;IACnD,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,2EAA2E;IAC3E,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B;;;OAGG;IACH,QAAQ,IAAI,OAAO,CAAC;CACrB;AAED,qDAAqD;AACrD,wBAAgB,aAAa,CAC3B,IAAI,EAAE,WAAW,EACjB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,YAAY,GACjB,eAAe,CAmUjB"}
+{"version":3,"file":"converge.d.ts","sourceRoot":"","sources":["../../src/upgrade/converge.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAI3D,OAAO,EAGL,KAAK,SAAS,EAGf,MAAM,uBAAuB,CAAC;AAc/B,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAsB,MAAM,eAAe,CAAC;AACnF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,sBAAsB,CAAC,EACtD,aAAa,EAAE,MAAM,GACpB,OAAO,CAET;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,2DAA2D;IAC3D,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACtD;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AAED,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,mDAAmD;IACnD,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,2EAA2E;IAC3E,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B;;;OAGG;IACH,QAAQ,IAAI,OAAO,CAAC;CACrB;AAED,qDAAqD;AACrD,wBAAgB,aAAa,CAC3B,IAAI,EAAE,WAAW,EACjB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,YAAY,GACjB,eAAe,CA+WjB"}

package/dist/upgrade/converge.js

@@ -4,8 +4,9 @@
  * service accounts, secrets or other cloud resources so the install matches
  * what the release's stacks declare — the gateway's run SA and the
  * CLI-generated runtime secrets, the stack's IAM/CDN/firewall invariants,
- * MCP access through IAP, the gateway's and public_role's database logins,
- * the operator-access sync job, and dropping bindings nothing reads any more.
+ * MCP access through IAP, public_role's Cloud SQL role memberships (#633),
+ * the gateway's and public_role's database logins, the operator-access sync
+ * job, and dropping bindings nothing reads any more.
  *
  * It needs the rights of whoever provisioned the install, so only
  * `cms-provision upgrade` (the operator's own identity) runs it — never the
@@ -25,11 +26,13 @@ import { ensureGatewayRolePassword, findSqlInstance, planPublicRoleSwitch, } fro
 import { upgraderServiceAccountEmail } from "../gcp-names.js";
 import { ensureMcpIapAccess } from "../mcp-iap.js";
 import { ensureOperatorAccessSync, resolveOperatorAccessTarget } from "../operator-access.js";
+import { revokePublicRoleMemberships } from "../public-role-isolation.js";
 import { ensureGatewayServiceAccount, ensureGeneratedSecrets, plainGeneratedSecretSeed, readSecretReplication, } from "../runtime-secrets.js";
 import { selfCommand } from "../self-command.js";
 import { MCP_ENV_VAR, OPERATOR_ACCESS_JOB_ENV_VAR, UPGRADER_JOB_ENV_VAR, } from "../stack-contract.js";
 import { ensureStackInvariants, liveEnvHasInlinePassword, removeRetiredIamBindings, } from "../stack-converge.js";
 import { ensureUpgraderJob, resolveUpgraderTarget } from "../upgrader-setup.js";
+import { ensureUrlMapRedirectsAccess } from "../url-map-redirects-access.js";
 /**
  * Whether the install must converge before an app-roll to a release that
  * expects infrastructure contract `targetVersion` (infra-contract.ts). An
@@ -120,6 +123,21 @@ export function startConverge(plan, ownerEmail, deps) {
         }
         return true;
     }
+    async function publicRoleIsolation() {
+        // #633 — the Admin API made public_role a member of cloudsqlsuperuser.
+        // Revoked here, before migrations, because the migration job's role
+        // audit is what verifies it and fails the upgrade while it remains.
+        const s = r.step("Removing public_role from the Cloud SQL superuser group...");
+        const outcome = await revokePublicRoleMemberships({ projectId: install.projectId, env: install.env }, runDeps);
+        if (outcome.status === "failed") {
+            s.failed("public_role's role memberships could not be revoked. Aborting upgrade.");
+            r.error(`  ${outcome.error ?? ""}`);
+            r.warn("No traffic was shifted and no migrations ran. Fix the above and re-run.");
+            return false;
+        }
+        s.done(`public_role holds no database roles (${outcome.detail ?? "revoked"})`);
+        return true;
+    }
     async function mcpAccess() {
         // Issue #37 — the MCP service account + its IAP/token-creator bindings.
         // Also what the deep health check signs its IAP credential as. A failure
@@ -151,6 +169,27 @@ export function startConverge(plan, ownerEmail, deps) {
         incomplete = true;
         leaveUntouched.push(MCP_ENV_VAR);
     }
+    async function urlMapRedirectsAccess() {
+        // #587 — on `gcp` the admin writes the redirects table into the URL map
+        // on Confirm-publish, through a custom role the stack declares. Without
+        // it Confirm-publish fails loudly (403); the rest of the install works,
+        // so a failure here warns.
+        if (install.provider !== "gcp")
+            return;
+        const s = r.step("Ensuring the admin may write redirects into the URL map...");
+        const access = await ensureUrlMapRedirectsAccess({
+            projectId: install.projectId,
+            env: install.env,
+            ...runDeps,
+        });
+        if (access.ok) {
+            s.done(`URL-map redirects role ready (${access.role})`);
+            return;
+        }
+        s.warned(`URL-map redirects role not set up: ${access.error}`);
+        r.warn("The upgrade continues; Confirm-publish fails with a permission error until this succeeds. Re-run upgrade with an account that may manage IAM roles.");
+        incomplete = true;
+    }
     /** The admin's IAP resource: the service on gcp-firebase, the LB backend on gcp. */
     async function adminIapResource() {
         if (install.provider === "gcp-firebase") {
@@ -281,7 +320,10 @@ export function startConverge(plan, ownerEmail, deps) {
                 return false;
             if (!(await stackInvariants()))
                 return false;
+            if (!(await publicRoleIsolation()))
+                return false;
             await mcpAccess();
+            await urlMapRedirectsAccess();
             return true;
         },
         hooks: {