@caelo-cms/provisioning 0.10.65 → 0.10.66

package/dist/release-manifest.js.map

@@ -1 +1 @@
-{"version":3,"file":"release-manifest.js","sourceRoot":"","sources":["../src/release-manifest.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,GAIf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAEzF,2EAA2E;AAC3E,0EAA0E;AAC1E,8CAA8C;AAC9C,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAI3B,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,GAAG,6CAA6C,CAAC;AAE7D,4EAA4E;AAC5E,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAE/B;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAAe;IAC3D,OAAO,GAAG,qBAAqB,2BAA2B,OAAO,EAAE,CAAC;AACtE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,CAAS,EAAE,CAAS;IAChD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACvE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACjB,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACjB,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACxD,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC;QAC9B,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACtE,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACxC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B,OAAQ,gBAAsC,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAqB,CAAC,CAAC,CAAC,IAAI,CAAC;AACpG,CAAC;AAgCD,sEAAsE;AACtE,KAAK,UAAU,SAAS,CAAC,IAAuB;IAC9C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAClF,MAAM,MAAM,GAAG,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,QAAQ,EAAE,GAAG;YACb,MAAM,EAAE,gCAAgC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,sDAAsD;SACzI,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,WAAW,GAAwB;IACvC,KAAK,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC;IACtC,MAAM,EAAE,SAAS;CAClB,CAAC;AAEF,SAAS,IAAI,CAAC,IAA8B,EAAE,OAAe;IAC3D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAe,EACf,OAA4B,WAAW;IAEvC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,IAAI,OAAO,2BAA2B,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3D,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;IAE9D,sEAAsE;IACtE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,qCAAqC,CAAC,CAAC;QACpE,MAAM,SAAS,CAAC,YAAY,EAAE,QAAQ,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvE,MAAM,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC;YAC/B,aAAa;YACb,UAAU;YACV,UAAU;YACV,wBAAwB;YACxB,6BAA6B,CAAC,OAAO,CAAC;YACtC,2BAA2B;YAC3B,mBAAmB;YACnB,YAAY;SACb,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CACT,WAAW,EACX,oBAAoB,OAAO,qBAAqB,6BAA6B,CAAC,OAAO,CAAC,iCAAiC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC5J,CAAC;QACJ,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACrE,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,oBAAoB,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;AACjD,CAAC;AASD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAyB,EACzB,QAAsD;IAEtD,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,IAAI,CAAC,CAAC,KAAK,IAAI,QAAQ,CAAC;YAAE,SAAS;QACnC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;QACvC,IAAI,MAAM,KAAK,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAwBD;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAyB,EACzB,SAA2B;IAE3B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,aAAa,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,OAAO,qCAAqC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,aAAa,CAAC,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,OAAO,CAAC,IAAI,CACV,IAAI,QAAQ,CAAC,OAAO,oBAAoB,QAAQ,CAAC,cAAc,iCAAiC,SAAS,CAAC,OAAO,GAAG,CACrH,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAErF,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,QAAQ,CAAC,oBAAoB,GAAG,SAAS,CAAC,oBAAoB,EAAE,CAAC;QACnE,MAAM,CAAC,IAAI,CACT,oDAAoD,SAAS,CAAC,oBAAoB,MAAM,QAAQ,CAAC,oBAAoB,KAAK,cAAc,CAAC,SAAS,CAAC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,CAAC,iDAAiD,CACzP,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,QAAQ,CAAC,UAAU,CAAC,mBAAmB,CAAC;IAC7D,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;IACvE,CAAC;SAAM,IAAI,YAAY,KAAK,IAAI,IAAI,aAAa,CAAC,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;QACvF,MAAM,CAAC,IAAI,CACT,sBAAsB,YAAY,8DAA8D,SAAS,CAAC,OAAO,uBAAuB,CACzI,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClF,iEAAiE;IACjE,0EAA0E;IAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AAClG,CAAC"}
+{"version":3,"file":"release-manifest.js","sourceRoot":"","sources":["../src/release-manifest.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,GAIf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAEzF,2EAA2E;AAC3E,0EAA0E;AAC1E,8CAA8C;AAC9C,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAI3B,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,GAAG,6CAA6C,CAAC;AAE7D,4EAA4E;AAC5E,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAE/B;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAAe;IAC3D,OAAO,GAAG,qBAAqB,2BAA2B,OAAO,EAAE,CAAC;AACtE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,CAAS,EAAE,CAAS;IAChD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACvE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACjB,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACjB,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACxD,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC;QAC9B,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACtE,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACxC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B,OAAQ,gBAAsC,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAqB,CAAC,CAAC,CAAC,IAAI,CAAC;AACpG,CAAC;AAgCD,sEAAsE;AACtE,KAAK,UAAU,SAAS,CAAC,IAAuB;IAC9C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAClF,MAAM,MAAM,GAAG,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,QAAQ,EAAE,GAAG;YACb,MAAM,EAAE,gCAAgC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,sDAAsD;SACzI,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,WAAW,GAAwB;IACvC,KAAK,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC;IACtC,MAAM,EAAE,SAAS;CAClB,CAAC;AAEF,SAAS,IAAI,CAAC,IAA8B,EAAE,OAAe;IAC3D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAe,EACf,OAA4B,WAAW;IAEvC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,IAAI,OAAO,2BAA2B,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3D,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;IAE9D,sEAAsE;IACtE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,qCAAqC,CAAC,CAAC;QACpE,MAAM,SAAS,CAAC,YAAY,EAAE,QAAQ,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvE,MAAM,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC;YAC/B,aAAa;YACb,UAAU;YACV,UAAU;YACV,wBAAwB;YACxB,6BAA6B,CAAC,OAAO,CAAC;YACtC,2BAA2B;YAC3B,mBAAmB;YACnB,YAAY;SACb,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CACT,WAAW,EACX,oBAAoB,OAAO,qBAAqB,6BAA6B,CAAC,OAAO,CAAC,iCAAiC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC5J,CAAC;QACJ,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACrE,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,oBAAoB,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;AACjD,CAAC;AAYD;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAyB,EACzB,QAAsD,EACtD,mBAAiE,EAAE;IAEnE,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,IAAI,KAAK,IAAI,QAAQ,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;YACvC,IAAI,MAAM,KAAK,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;QACD,IAAI,KAAK,IAAI,gBAAgB,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;YAC/C,MAAM,QAAQ,GAAG,QAAQ,CAAC,eAAe,EAAE,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;YAC3D,IAAI,MAAM,KAAK,QAAQ;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAwBD;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAyB,EACzB,SAA2B;IAE3B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,aAAa,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,OAAO,qCAAqC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,aAAa,CAAC,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,OAAO,CAAC,IAAI,CACV,IAAI,QAAQ,CAAC,OAAO,oBAAoB,QAAQ,CAAC,cAAc,iCAAiC,SAAS,CAAC,OAAO,GAAG,CACrH,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAErF,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,QAAQ,CAAC,oBAAoB,GAAG,SAAS,CAAC,oBAAoB,EAAE,CAAC;QACnE,MAAM,CAAC,IAAI,CACT,oDAAoD,SAAS,CAAC,oBAAoB,MAAM,QAAQ,CAAC,oBAAoB,KAAK,cAAc,CAAC,SAAS,CAAC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,CAAC,iDAAiD,CACzP,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,QAAQ,CAAC,UAAU,CAAC,mBAAmB,CAAC;IAC7D,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;IACvE,CAAC;SAAM,IAAI,YAAY,KAAK,IAAI,IAAI,aAAa,CAAC,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;QACvF,MAAM,CAAC,IAAI,CACT,sBAAsB,YAAY,8DAA8D,SAAS,CAAC,OAAO,uBAAuB,CACzI,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClF,iEAAiE;IACjE,0EAA0E;IAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AAClG,CAAC"}

package/dist/upgrade/__tests__/live-indexes.d.ts

@@ -0,0 +1,23 @@
+/** v0.10.64 admin: the index the signed manifest names, and what it lists. */
+export declare const ADMIN_INDEX = "sha256:bcda1725a5390c910c56cfedb6f55bc4f38cebb0231e9e9b4297bb5c08aec3e0";
+export declare const ADMIN_AMD64 = "sha256:2e75b714662ec6b17d32666b546378e2850920950076c4e911deddc05596e656";
+export declare const ADMIN_ATTESTATION = "sha256:06f9defdb92e8252e9faab8fcb8fb340d3949d5cdec09e06b42905ade7ba30c0";
+/** v0.10.64 gateway. */
+export declare const GATEWAY_INDEX = "sha256:fbb0be7a106f75c25e44bca1898fd56af27d11fa599659afe55e4f6ffaeca4a3";
+export declare const GATEWAY_AMD64 = "sha256:d24f2675d43e7891f217938c74475e9c31a64ffda0c96cf4fbb0a3f73e31367e";
+/** The index bytes, by digest. */
+export declare const LIVE_INDEXES: Readonly<Record<string, Uint8Array<ArrayBuffer>>>;
+/** How the fake registry answers. */
+export interface FakeRegistryOptions {
+    /** Answer every request with this HTTP status instead. */
+    readonly status?: number;
+    /** Throw (network failure) instead of answering. */
+    readonly unreachable?: boolean;
+    /** Serve these bytes for every digest (a tampering registry). */
+    readonly tampered?: Uint8Array<ArrayBuffer>;
+    /** Index bytes to serve besides {@link LIVE_INDEXES}. */
+    readonly extra?: Readonly<Record<string, Uint8Array<ArrayBuffer>>>;
+}
+/** A `fetch` serving the mirror's `/v2/<repo>/manifests/<digest>`; records each URL in `calls`. */
+export declare function fakeRegistryFetch(calls: string[], opts?: FakeRegistryOptions): typeof fetch;
+//# sourceMappingURL=live-indexes.d.ts.map

package/dist/upgrade/__tests__/live-indexes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-indexes.d.ts","sourceRoot":"","sources":["../../../src/upgrade/__tests__/live-indexes.ts"],"names":[],"mappings":"AAgBA,8EAA8E;AAC9E,eAAO,MAAM,WAAW,4EACmD,CAAC;AAC5E,eAAO,MAAM,WAAW,4EACmD,CAAC;AAC5E,eAAO,MAAM,iBAAiB,4EAC6C,CAAC;AAC5E,wBAAwB;AACxB,eAAO,MAAM,aAAa,4EACiD,CAAC;AAC5E,eAAO,MAAM,aAAa,4EACiD,CAAC;AAE5E,kCAAkC;AAClC,eAAO,MAAM,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,CAG1E,CAAC;AAEF,qCAAqC;AACrC,MAAM,WAAW,mBAAmB;IAClC,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,oDAAoD;IACpD,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IAC5C,yDAAyD;IACzD,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;CACpE;AAED,mGAAmG;AACnG,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,GAAE,mBAAwB,GAAG,OAAO,KAAK,CAY/F"}

package/dist/upgrade/__tests__/live-indexes.js

@@ -0,0 +1,41 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * The v0.10.64 admin + gateway image indexes exactly as the release mirror
+ * serves them (fixtures/, byte for byte), and a fake `fetch` that serves
+ * them by digest — the shapes of #1025: each index lists its linux/amd64
+ * manifest plus one buildx attestation manifest, and Cloud Run records the
+ * linux/amd64 digest for a serving revision.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+const fixture = (name) => new Uint8Array(readFileSync(join(import.meta.dir, "fixtures", name)));
+/** v0.10.64 admin: the index the signed manifest names, and what it lists. */
+export const ADMIN_INDEX = "sha256:bcda1725a5390c910c56cfedb6f55bc4f38cebb0231e9e9b4297bb5c08aec3e0";
+export const ADMIN_AMD64 = "sha256:2e75b714662ec6b17d32666b546378e2850920950076c4e911deddc05596e656";
+export const ADMIN_ATTESTATION = "sha256:06f9defdb92e8252e9faab8fcb8fb340d3949d5cdec09e06b42905ade7ba30c0";
+/** v0.10.64 gateway. */
+export const GATEWAY_INDEX = "sha256:fbb0be7a106f75c25e44bca1898fd56af27d11fa599659afe55e4f6ffaeca4a3";
+export const GATEWAY_AMD64 = "sha256:d24f2675d43e7891f217938c74475e9c31a64ffda0c96cf4fbb0a3f73e31367e";
+/** The index bytes, by digest. */
+export const LIVE_INDEXES = {
+    [ADMIN_INDEX]: fixture("admin-0.10.64-index.json"),
+    [GATEWAY_INDEX]: fixture("gateway-0.10.64-index.json"),
+};
+/** A `fetch` serving the mirror's `/v2/<repo>/manifests/<digest>`; records each URL in `calls`. */
+export function fakeRegistryFetch(calls, opts = {}) {
+    const impl = async (input) => {
+        const url = String(input instanceof Request ? input.url : input);
+        calls.push(url);
+        if (opts.unreachable)
+            throw new Error("getaddrinfo ENOTFOUND");
+        if (opts.status)
+            return new Response("", { status: opts.status });
+        const digest = url.split("/manifests/")[1] ?? "";
+        const bytes = opts.tampered ?? opts.extra?.[digest] ?? LIVE_INDEXES[digest];
+        if (!bytes)
+            return new Response("", { status: 404 });
+        return new Response(bytes, { status: 200 });
+    };
+    return impl;
+}
+//# sourceMappingURL=live-indexes.js.map

package/dist/upgrade/__tests__/live-indexes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-indexes.js","sourceRoot":"","sources":["../../../src/upgrade/__tests__/live-indexes.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;GAMG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,OAAO,GAAG,CAAC,IAAY,EAA2B,EAAE,CACxD,IAAI,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AAExE,8EAA8E;AAC9E,MAAM,CAAC,MAAM,WAAW,GACtB,yEAAyE,CAAC;AAC5E,MAAM,CAAC,MAAM,WAAW,GACtB,yEAAyE,CAAC;AAC5E,MAAM,CAAC,MAAM,iBAAiB,GAC5B,yEAAyE,CAAC;AAC5E,wBAAwB;AACxB,MAAM,CAAC,MAAM,aAAa,GACxB,yEAAyE,CAAC;AAC5E,MAAM,CAAC,MAAM,aAAa,GACxB,yEAAyE,CAAC;AAE5E,kCAAkC;AAClC,MAAM,CAAC,MAAM,YAAY,GAAsD;IAC7E,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,0BAA0B,CAAC;IAClD,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC,4BAA4B,CAAC;CACvD,CAAC;AAcF,mGAAmG;AACnG,MAAM,UAAU,iBAAiB,CAAC,KAAe,EAAE,OAA4B,EAAE;IAC/E,MAAM,IAAI,GAAG,KAAK,EAAE,KAA6B,EAAqB,EAAE;QACtE,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACjE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,IAAI,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC/D,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,QAAQ,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;QAC5E,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,QAAQ,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACrD,OAAO,IAAI,QAAQ,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC;IACF,OAAO,IAAoB,CAAC;AAC9B,CAAC"}

package/dist/upgrade/gcp-lookup.d.ts

@@ -50,30 +50,39 @@ export declare function findCurrentRevision(run: GcloudRunner, projectId: string
  * by (not the service template's: after a rollback the template names the
  * failed image while traffic stays on the previous revision).
  *
- * Why two digests (#860): Caelo's release images are OCI image *indexes*
- * (buildx adds a provenance/SBOM attestation manifest even to a
- * single-platform build), and the signed release manifest, install.json
- * and every deploy pin the index digest. Cloud Run's `status.imageDigest`
- * names what it resolved and pulled, the linux/amd64 *platform manifest*
- * inside that index, so comparing it with a recorded index digest never
- * matches. The digest the revision was deployed with
- * (`spec.containers[0].image`, `…@sha256:<index>`) is the form everything
- * else records; it is content-addressed, so the revision necessarily runs
- * that index's image.
+ * Which form these digests take (#860, corrected by #1025): Caelo's release
+ * images are OCI image *indexes* (buildx adds a provenance/SBOM attestation
+ * manifest even to a single-platform build), and the signed release
+ * manifest, install.json and every deploy pin the index digest. Cloud Run
+ * resolves that index to its linux/amd64 *platform manifest* and records
+ * the platform digest — in `status.imageDigest` AND, contrary to what #860
+ * assumed, in the revision's `spec.containers[0].image` too: a revision
+ * deployed as `admin@sha256:bcda…` (the v0.10.64 index) reads back as
+ * `admin@sha256:2e75…` in both fields (live installs, 2026-10-23). Only the
+ * service template keeps the index. So these digests are matched against a
+ * release's index AND the platform manifests inside it
+ * (upgrade/image-forms.ts), never against the index alone.
  */
 export interface ServingImage {
-    /** The digest the revision was deployed with; null when deployed by tag. */
-    readonly deployedDigest: string | null;
+    /** The digest the revision's `spec.containers[0].image` names; null when it names a tag. */
+    readonly specDigest: string | null;
     /** The digest Cloud Run resolved and runs (`status.imageDigest`); null when not reported. */
     readonly resolvedDigest: string | null;
 }
-/** Every digest `image` is known by, deployed form first. */
+/** Every digest `image` is known by, spec form first. */
 export declare function servingImageDigests(image: ServingImage): string[];
 /**
  * The serving revision's {@link ServingImage}, or null when the revision or
  * any digest of it cannot be read.
  */
 export declare function findServingImage(run: GcloudRunner, projectId: string, region: string, serviceName: string): Promise<ServingImage | null>;
+/**
+ * The digest the service's template pins (the index a deploy named, #1025),
+ * or null when it cannot be read or names a tag. NOT what serves — after a
+ * rollback the template names the failed image — so only a hint for which
+ * release to check (upgrader-records.ts).
+ */
+export declare function findTemplateImageDigest(run: GcloudRunner, projectId: string, region: string, serviceName: string): Promise<string | null>;
 /** The service's own `run.app` URL. */
 export declare function findServiceUrl(run: GcloudRunner, projectId: string, region: string, serviceName: string): Promise<string | null>;
 /** Pin all of a service's traffic to `revision`. */

package/dist/upgrade/gcp-lookup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gcp-lookup.d.ts","sourceRoot":"","sources":["../../src/upgrade/gcp-lookup.ts"],"names":[],"mappings":"AAUA,OAAO,EAEL,KAAK,YAAY,EAGlB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,KAAK,CAAC;AAEnD;;;;GAIG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GAChC;IAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;CAAE,CAAC;AAEzF,+CAA+C;AAC/C,MAAM,MAAM,aAAa,GAAG,OAAO,CAAC,SAAS,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC;AAE7E,uFAAuF;AACvF,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,YAAY,GAAG,SAAS,CAS5D;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,iBAAiB,GAC7B,MAAM,CAOR;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,aAAa,GAAG,cAAc,EACpC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,SAAS,CAAC,CA0BpB;AAsBD,uFAAuF;AACvF,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,YAAY,EACjB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAGxB;AAED,4EAA4E;AAC5E,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,YAAY,EACjB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAMxB;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,YAAY;IAC3B,4EAA4E;IAC5E,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,6FAA6F;IAC7F,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC;AAED,6DAA6D;AAC7D,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,EAAE,CAMjE;AAYD;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,YAAY,EACjB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAgC9B;AAED,uCAAuC;AACvC,wBAAsB,cAAc,CAClC,GAAG,EAAE,YAAY,EACjB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAIxB;AAED,oDAAoD;AACpD,wBAAsB,UAAU,CAC9B,GAAG,EAAE,YAAY,EACjB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC,CAelB"}
+{"version":3,"file":"gcp-lookup.d.ts","sourceRoot":"","sources":["../../src/upgrade/gcp-lookup.ts"],"names":[],"mappings":"AAUA,OAAO,EAEL,KAAK,YAAY,EAGlB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,KAAK,CAAC;AAEnD;;;;GAIG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GAChC;IAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;CAAE,CAAC;AAEzF,+CAA+C;AAC/C,MAAM,MAAM,aAAa,GAAG,OAAO,CAAC,SAAS,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC;AAE7E,uFAAuF;AACvF,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,YAAY,GAAG,SAAS,CAS5D;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,iBAAiB,GAC7B,MAAM,CAOR;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,aAAa,GAAG,cAAc,EACpC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,SAAS,CAAC,CA0BpB;AAsBD,uFAAuF;AACvF,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,YAAY,EACjB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAGxB;AAED,4EAA4E;AAC5E,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,YAAY,EACjB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAMxB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,YAAY;IAC3B,4FAA4F;IAC5F,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,6FAA6F;IAC7F,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC;AAED,yDAAyD;AACzD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,EAAE,CAMjE;AAYD;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,YAAY,EACjB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAgC9B;AAmBD;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,YAAY,EACjB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAaxB;AAED,uCAAuC;AACvC,wBAAsB,cAAc,CAClC,GAAG,EAAE,YAAY,EACjB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAIxB;AAED,oDAAoD;AACpD,wBAAsB,UAAU,CAC9B,GAAG,EAAE,YAAY,EACjB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC,CAelB"}

package/dist/upgrade/gcp-lookup.js

@@ -97,10 +97,10 @@ export async function findCurrentRevision(run, projectId, region, serviceName) {
         return null;
     return r.stdout.trim().split("\n")[0]?.trim() || null;
 }
-/** Every digest `image` is known by, deployed form first. */
+/** Every digest `image` is known by, spec form first. */
 export function servingImageDigests(image) {
     const out = [];
-    for (const d of [image.deployedDigest, image.resolvedDigest]) {
+    for (const d of [image.specDigest, image.resolvedDigest]) {
         if (d && !out.includes(d))
             out.push(d);
     }
@@ -149,11 +149,50 @@ export async function findServingImage(run, projectId, region, serviceName) {
         return null;
     const digestOf = (ref) => ref === undefined ? null : (PINNED_DIGEST.exec(ref.trim())?.[1] ?? null);
     const image = {
-        deployedDigest: digestOf(parsed.data.spec?.containers?.[0]?.image),
+        specDigest: digestOf(parsed.data.spec?.containers?.[0]?.image),
         resolvedDigest: digestOf(parsed.data.status?.imageDigest),
     };
     return servingImageDigests(image).length > 0 ? image : null;
 }
+/** The fields of `gcloud run services describe --format=json` {@link findTemplateImageDigest} reads. */
+const ServiceJsonSchema = z.object({
+    spec: z
+        .object({
+        template: z
+            .object({
+            spec: z
+                .object({
+                containers: z.array(z.object({ image: z.string().optional() })).optional(),
+            })
+                .optional(),
+        })
+            .optional(),
+    })
+        .optional(),
+});
+/**
+ * The digest the service's template pins (the index a deploy named, #1025),
+ * or null when it cannot be read or names a tag. NOT what serves — after a
+ * rollback the template names the failed image — so only a hint for which
+ * release to check (upgrader-records.ts).
+ */
+export async function findTemplateImageDigest(run, projectId, region, serviceName) {
+    const stdout = await describeServiceJson(run, projectId, region, serviceName);
+    if (stdout === null)
+        return null;
+    let json;
+    try {
+        json = JSON.parse(stdout);
+    }
+    catch {
+        return null;
+    }
+    const parsed = ServiceJsonSchema.safeParse(json);
+    if (!parsed.success)
+        return null;
+    const ref = parsed.data.spec?.template?.spec?.containers?.[0]?.image;
+    return ref === undefined ? null : (PINNED_DIGEST.exec(ref.trim())?.[1] ?? null);
+}
 /** The service's own `run.app` URL. */
 export async function findServiceUrl(run, projectId, region, serviceName) {
     const r = await run(describeArgs(serviceName, region, projectId, "value(status.url)"));

package/dist/upgrade/gcp-lookup.js.map

@@ -1 +1 @@
-{"version":3,"file":"gcp-lookup.js","sourceRoot":"","sources":["../../src/upgrade/gcp-lookup.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,kBAAkB,EAElB,eAAe,EACf,iBAAiB,GAClB,MAAM,cAAc,CAAC;AAuBtB,uFAAuF;AACvF,MAAM,UAAU,iBAAiB,CAAC,CAAe;IAC/C,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACV,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;IACzF,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM;SAClB,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7B,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACpE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAqB,EACrB,IAAY,EACZ,WAA8B;IAE9B,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW;QAAE,OAAO,sBAAsB,IAAI,EAAE,CAAC;IACvE,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,WAAW;QAAE,OAAO,sBAAsB,IAAI,oBAAoB,IAAI,GAAG,CAAC;IACtF,OAAO,WAAW,KAAK,UAAU;QAC/B,CAAC,CAAC,yBAAyB,IAAI,KAAK,kBAAkB,aAAa,IAAI,GAAG;QAC1E,CAAC,CAAC,yBAAyB,IAAI,6CAA6C,IAAI,yJAAyJ,CAAC;AAC9O,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAiB,EACjB,IAAoC,EACpC,MAAc,EACd,SAAiB,EACjB,MAAe;IAEf,MAAM,IAAI,GACR,IAAI,KAAK,aAAa;QACpB,CAAC,CAAC;YACE,KAAK;YACL,UAAU;YACV,MAAM;YACN,UAAU;YACV,cAAc,CAAC,MAAM,CAAC;YACtB,WAAW;YACX,SAAS;YACT,UAAU;YACV,kBAAkB,MAAM,EAAE;YAC1B,+BAA+B;SAChC;QACH,CAAC,CAAC;YACE,KAAK;YACL,WAAW;YACX,MAAM;YACN,WAAW;YACX,SAAS;YACT,UAAU;YACV,SAAS,MAAM,EAAE;YACjB,sBAAsB;SACvB,CAAC;IACR,OAAO,iBAAiB,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,2EAA2E;AAC3E,SAAS,cAAc,CAAC,MAA0B;IAChD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAC3F,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,WAAmB,EAAE,MAAc,EAAE,SAAiB,EAAE,MAAc;IAC1F,OAAO;QACL,KAAK;QACL,UAAU;QACV,UAAU;QACV,WAAW;QACX,UAAU;QACV,MAAM;QACN,WAAW;QACX,SAAS;QACT,YAAY,MAAM,EAAE;KACrB,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAiB,EACjB,SAAiB,EACjB,MAAc,EACd,WAAmB;IAEnB,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1E,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAiB,EACjB,SAAiB,EACjB,MAAc,EACd,WAAmB;IAEnB,MAAM,CAAC,GAAG,MAAM,GAAG,CACjB,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,uCAAuC,CAAC,CACtF,CAAC;IACF,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AACxD,CAAC;AAyBD,6DAA6D;AAC7D,MAAM,UAAU,mBAAmB,CAAC,KAAmB;IACrD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;QAC7D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,aAAa,GAAG,yBAAyB,CAAC;AAEhD,oFAAoF;AACpF,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,IAAI,EAAE,CAAC;SACJ,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;SACtF,QAAQ,EAAE;IACb,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;CACpE,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAiB,EACjB,SAAiB,EACjB,MAAc,EACd,WAAmB;IAEnB,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IAChF,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC;QAClB,KAAK;QACL,WAAW;QACX,UAAU;QACV,QAAQ;QACR,UAAU;QACV,MAAM;QACN,WAAW;QACX,SAAS;QACT,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,2EAA2E;IAC3E,wEAAwE;IACxE,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,QAAQ,GAAG,CAAC,GAAuB,EAAiB,EAAE,CAC1D,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAiB;QAC1B,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;QAClE,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC;KAC1D,CAAC;IACF,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC;AAED,uCAAuC;AACvC,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAiB,EACjB,SAAiB,EACjB,MAAc,EACd,WAAmB;IAEnB,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACvF,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;AACjC,CAAC;AAED,oDAAoD;AACpD,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAiB,EACjB,SAAiB,EACjB,MAAc,EACd,WAAmB,EACnB,QAAgB;IAEhB,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC;QAClB,KAAK;QACL,UAAU;QACV,gBAAgB;QAChB,WAAW;QACX,UAAU;QACV,MAAM;QACN,WAAW;QACX,SAAS;QACT,gBAAgB;QAChB,GAAG,QAAQ,MAAM;QACjB,SAAS;KACV,CAAC,CAAC;IACH,OAAO,CAAC,CAAC,EAAE,CAAC;AACd,CAAC"}
+{"version":3,"file":"gcp-lookup.js","sourceRoot":"","sources":["../../src/upgrade/gcp-lookup.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,kBAAkB,EAElB,eAAe,EACf,iBAAiB,GAClB,MAAM,cAAc,CAAC;AAuBtB,uFAAuF;AACvF,MAAM,UAAU,iBAAiB,CAAC,CAAe;IAC/C,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACV,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;IACzF,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM;SAClB,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7B,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACpE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAqB,EACrB,IAAY,EACZ,WAA8B;IAE9B,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW;QAAE,OAAO,sBAAsB,IAAI,EAAE,CAAC;IACvE,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,WAAW;QAAE,OAAO,sBAAsB,IAAI,oBAAoB,IAAI,GAAG,CAAC;IACtF,OAAO,WAAW,KAAK,UAAU;QAC/B,CAAC,CAAC,yBAAyB,IAAI,KAAK,kBAAkB,aAAa,IAAI,GAAG;QAC1E,CAAC,CAAC,yBAAyB,IAAI,6CAA6C,IAAI,yJAAyJ,CAAC;AAC9O,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAiB,EACjB,IAAoC,EACpC,MAAc,EACd,SAAiB,EACjB,MAAe;IAEf,MAAM,IAAI,GACR,IAAI,KAAK,aAAa;QACpB,CAAC,CAAC;YACE,KAAK;YACL,UAAU;YACV,MAAM;YACN,UAAU;YACV,cAAc,CAAC,MAAM,CAAC;YACtB,WAAW;YACX,SAAS;YACT,UAAU;YACV,kBAAkB,MAAM,EAAE;YAC1B,+BAA+B;SAChC;QACH,CAAC,CAAC;YACE,KAAK;YACL,WAAW;YACX,MAAM;YACN,WAAW;YACX,SAAS;YACT,UAAU;YACV,SAAS,MAAM,EAAE;YACjB,sBAAsB;SACvB,CAAC;IACR,OAAO,iBAAiB,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,2EAA2E;AAC3E,SAAS,cAAc,CAAC,MAA0B;IAChD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAC3F,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,WAAmB,EAAE,MAAc,EAAE,SAAiB,EAAE,MAAc;IAC1F,OAAO;QACL,KAAK;QACL,UAAU;QACV,UAAU;QACV,WAAW;QACX,UAAU;QACV,MAAM;QACN,WAAW;QACX,SAAS;QACT,YAAY,MAAM,EAAE;KACrB,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAiB,EACjB,SAAiB,EACjB,MAAc,EACd,WAAmB;IAEnB,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1E,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAiB,EACjB,SAAiB,EACjB,MAAc,EACd,WAAmB;IAEnB,MAAM,CAAC,GAAG,MAAM,GAAG,CACjB,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,uCAAuC,CAAC,CACtF,CAAC;IACF,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AACxD,CAAC;AA2BD,yDAAyD;AACzD,MAAM,UAAU,mBAAmB,CAAC,KAAmB;IACrD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,aAAa,GAAG,yBAAyB,CAAC;AAEhD,oFAAoF;AACpF,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,IAAI,EAAE,CAAC;SACJ,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;SACtF,QAAQ,EAAE;IACb,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;CACpE,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAiB,EACjB,SAAiB,EACjB,MAAc,EACd,WAAmB;IAEnB,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IAChF,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC;QAClB,KAAK;QACL,WAAW;QACX,UAAU;QACV,QAAQ;QACR,UAAU;QACV,MAAM;QACN,WAAW;QACX,SAAS;QACT,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,2EAA2E;IAC3E,wEAAwE;IACxE,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,QAAQ,GAAG,CAAC,GAAuB,EAAiB,EAAE,CAC1D,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAiB;QAC1B,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;QAC9D,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC;KAC1D,CAAC;IACF,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC;AAED,wGAAwG;AACxG,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,IAAI,EAAE,CAAC;SACJ,MAAM,CAAC;QACN,QAAQ,EAAE,CAAC;aACR,MAAM,CAAC;YACN,IAAI,EAAE,CAAC;iBACJ,MAAM,CAAC;gBACN,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;aAC3E,CAAC;iBACD,QAAQ,EAAE;SACd,CAAC;aACD,QAAQ,EAAE;KACd,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAiB,EACjB,SAAiB,EACjB,MAAc,EACd,WAAmB;IAEnB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IAC9E,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;IACrE,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;AAClF,CAAC;AAED,uCAAuC;AACvC,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAiB,EACjB,SAAiB,EACjB,MAAc,EACd,WAAmB;IAEnB,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACvF,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;AACjC,CAAC;AAED,oDAAoD;AACpD,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAiB,EACjB,SAAiB,EACjB,MAAc,EACd,WAAmB,EACnB,QAAgB;IAEhB,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC;QAClB,KAAK;QACL,UAAU;QACV,gBAAgB;QAChB,WAAW;QACX,UAAU;QACV,MAAM;QACN,WAAW;QACX,SAAS;QACT,gBAAgB;QAChB,GAAG,QAAQ,MAAM;QACjB,SAAS;KACV,CAAC,CAAC;IACH,OAAO,CAAC,CAAC,EAAE,CAAC;AACd,CAAC"}

package/dist/upgrade/image-forms.d.ts

@@ -0,0 +1,55 @@
+import type { ImageDigests } from "../install-state.js";
+import type { ReleaseManifest } from "../release-manifest.js";
+import type { RollSlug } from "./app-roll.js";
+/** The digests one release image is known by. */
+export type ImageFormsResult = {
+    readonly ok: true;
+    /** The index digest first, then each platform manifest it lists. */
+    readonly digests: readonly string[];
+    /**
+     * The linux/amd64 form Cloud Run runs: the signed platform digest, the
+     * index's linux/amd64 entry, or the digest itself when it names a plain
+     * image manifest. Null when the index lists no linux/amd64 manifest.
+     */
+    readonly amd64: string | null;
+} | {
+    readonly ok: false;
+    /** A retry may cure it (registry unreachable, 5xx, 429). */
+    readonly transient: boolean;
+    readonly message: string;
+};
+/** Finds every form of a release image; see the file comment. */
+export interface ReleaseImageForms {
+    /** The forms of release `m`'s image `slug` (signed platform digests win). */
+    of(m: Pick<ReleaseManifest, "version" | "digests" | "platformDigests">, slug: RollSlug): Promise<ImageFormsResult>;
+    /** The forms of the index `indexDigest` of image `slug`, read from the mirror. */
+    ofIndex(slug: RollSlug, indexDigest: string): Promise<ImageFormsResult>;
+}
+/**
+ * Read the forms out of index bytes already checked against `indexDigest`.
+ * Exported for tests; production code goes through {@link createReleaseImageForms}.
+ */
+export declare function formsFromIndexJson(indexDigest: string, json: unknown): ImageFormsResult;
+/**
+ * The lookup against the fixed public mirror ({@link RELEASE_REGISTRY}),
+ * anonymous, cached per instance.
+ *
+ * @param fetchImpl - injectable for tests; the real one by default
+ */
+export declare function createReleaseImageForms(fetchImpl?: typeof fetch): ReleaseImageForms;
+/**
+ * The linux/amd64 form of each image in `digests`, to record next to them
+ * in install.json (#1025). Taken from `manifest`'s signed platform digests
+ * when it signs these very indexes, else from the content-checked index.
+ *
+ * @returns the forms, or why they are not known (the caller records the
+ *   index digests without them; the upgrader then reads the index itself)
+ */
+export declare function platformDigestsOf(digests: ImageDigests, forms: ReleaseImageForms, manifest?: Pick<ReleaseManifest, "version" | "digests" | "platformDigests"> | null): Promise<{
+    readonly ok: true;
+    readonly platformDigests: ImageDigests;
+} | {
+    readonly ok: false;
+    readonly message: string;
+}>;
+//# sourceMappingURL=image-forms.d.ts.map

package/dist/upgrade/image-forms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-forms.d.ts","sourceRoot":"","sources":["../../src/upgrade/image-forms.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAG9C,iDAAiD;AACjD,MAAM,MAAM,gBAAgB,GACxB;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,oEAAoE;IACpE,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B,GACD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,4DAA4D;IAC5D,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEN,iEAAiE;AACjE,MAAM,WAAW,iBAAiB;IAChC,6EAA6E;IAC7E,EAAE,CACA,CAAC,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,SAAS,GAAG,iBAAiB,CAAC,EACnE,IAAI,EAAE,QAAQ,GACb,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC7B,kFAAkF;IAClF,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACzE;AA4BD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,gBAAgB,CA2BvF;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,GAAE,OAAO,KAAa,GAAG,iBAAiB,CAyD1F;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,YAAY,EACrB,KAAK,EAAE,iBAAiB,EACxB,QAAQ,CAAC,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,SAAS,GAAG,iBAAiB,CAAC,GAAG,IAAI,GACjF,OAAO,CACN;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,eAAe,EAAE,YAAY,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CACnD,CAoBA"}

package/dist/upgrade/image-forms.js

@@ -0,0 +1,164 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * Every digest a release image is known by (#1025).
+ *
+ * Caelo's release images are OCI image *indexes*: buildx adds a
+ * provenance/SBOM attestation manifest even to a single-platform build. The
+ * signed release manifest, install.json and every deploy pin the index
+ * digest, but Cloud Run resolves the index to its linux/amd64 *platform
+ * manifest* and records that digest — in the revision's `status.imageDigest`
+ * AND in its `spec.containers[0].image` (verified on live installs,
+ * 2026-10-23: a revision deployed as `admin@sha256:bcda…` (the v0.10.64
+ * index) reads back as `admin@sha256:2e75…`, its linux/amd64 manifest). So
+ * "does release X serve?" must compare the serving digest with every form of
+ * X's images, not just the index.
+ *
+ * Where the forms come from, in order of trust:
+ *   1. the release manifest's signed `platformDigests` (releases cut after
+ *      #1025) — no registry round trip;
+ *   2. otherwise the index itself, fetched BY DIGEST from the fixed public
+ *      mirror and checked against that digest before it is read. Content
+ *      addressing makes it as unforgeable as the signature that named the
+ *      index: a registry or proxy that altered it fails the check.
+ *
+ * Only platform manifests count, never the attestation manifests listed next
+ * to them (Cloud Run cannot run those). Lookups are cached per instance, so
+ * one upgrader run fetches each index at most once.
+ */
+import { z } from "zod";
+import { fetchRegistryManifest, IMAGE_DIGEST, RELEASE_REGISTRY } from "./release-images.js";
+const INDEX_MEDIA_TYPES = new Set([
+    "application/vnd.oci.image.index.v1+json",
+    "application/vnd.docker.distribution.manifest.list.v2+json",
+]);
+const digest = z.string().regex(IMAGE_DIGEST);
+/** The fields of an image index (or plain image manifest) the lookup reads. */
+const ManifestJsonSchema = z.object({
+    mediaType: z.string().optional(),
+    manifests: z
+        .array(z.object({
+        digest,
+        platform: z.object({ os: z.string(), architecture: z.string() }).optional(),
+        annotations: z.record(z.string(), z.string()).optional(),
+    }))
+        .optional(),
+});
+async function sha256Digest(bytes) {
+    const hash = new Uint8Array(await crypto.subtle.digest("SHA-256", bytes));
+    return `sha256:${[...hash].map((b) => b.toString(16).padStart(2, "0")).join("")}`;
+}
+/**
+ * Read the forms out of index bytes already checked against `indexDigest`.
+ * Exported for tests; production code goes through {@link createReleaseImageForms}.
+ */
+export function formsFromIndexJson(indexDigest, json) {
+    const parsed = ManifestJsonSchema.safeParse(json);
+    if (!parsed.success) {
+        return {
+            ok: false,
+            transient: false,
+            message: `${indexDigest} is not an image index or manifest: ${parsed.error.message}`,
+        };
+    }
+    const { mediaType, manifests } = parsed.data;
+    const isIndex = mediaType ? INDEX_MEDIA_TYPES.has(mediaType) : manifests !== undefined;
+    // A plain image manifest is its own platform form.
+    if (!isIndex)
+        return { ok: true, digests: [indexDigest], amd64: indexDigest };
+    const platforms = (manifests ?? []).filter((m) => m.annotations?.["vnd.docker.reference.type"] !== "attestation-manifest" &&
+        m.platform !== undefined &&
+        m.platform.os !== "unknown");
+    const amd64 = platforms.filter((m) => m.platform?.os === "linux" && m.platform.architecture === "amd64");
+    return {
+        ok: true,
+        digests: [indexDigest, ...platforms.map((m) => m.digest).filter((d) => d !== indexDigest)],
+        amd64: amd64.length === 1 ? (amd64[0]?.digest ?? null) : null,
+    };
+}
+/**
+ * The lookup against the fixed public mirror ({@link RELEASE_REGISTRY}),
+ * anonymous, cached per instance.
+ *
+ * @param fetchImpl - injectable for tests; the real one by default
+ */
+export function createReleaseImageForms(fetchImpl = fetch) {
+    const cache = new Map();
+    const { region, project, repo } = RELEASE_REGISTRY;
+    async function lookup(slug, indexDigest) {
+        const where = `the ${slug} image index ${indexDigest} in the release mirror`;
+        const fetched = await fetchRegistryManifest(`${region}-docker.pkg.dev`, `${project}/${repo}/${slug}`, indexDigest, fetchImpl);
+        if (!fetched.ok) {
+            return {
+                ok: false,
+                transient: fetched.transient,
+                message: `${where} could not be read (${fetched.reason})`,
+            };
+        }
+        const actual = await sha256Digest(fetched.bytes);
+        if (actual !== indexDigest) {
+            return {
+                ok: false,
+                transient: false,
+                message: `${where} does not match its digest (${actual} served): the registry or a proxy altered it`,
+            };
+        }
+        let json;
+        try {
+            json = JSON.parse(new TextDecoder().decode(fetched.bytes));
+        }
+        catch {
+            return { ok: false, transient: false, message: `${where} is not JSON` };
+        }
+        return formsFromIndexJson(indexDigest, json);
+    }
+    const ofIndex = (slug, indexDigest) => {
+        const key = `${slug}@${indexDigest}`;
+        let pending = cache.get(key);
+        if (!pending) {
+            pending = lookup(slug, indexDigest);
+            cache.set(key, pending);
+        }
+        return pending;
+    };
+    return {
+        ofIndex,
+        of: async (m, slug) => {
+            const signed = m.platformDigests?.[slug];
+            if (signed) {
+                const index = m.digests[slug];
+                return { ok: true, digests: [index, ...(signed === index ? [] : [signed])], amd64: signed };
+            }
+            return ofIndex(slug, m.digests[slug]);
+        },
+    };
+}
+/**
+ * The linux/amd64 form of each image in `digests`, to record next to them
+ * in install.json (#1025). Taken from `manifest`'s signed platform digests
+ * when it signs these very indexes, else from the content-checked index.
+ *
+ * @returns the forms, or why they are not known (the caller records the
+ *   index digests without them; the upgrader then reads the index itself)
+ */
+export async function platformDigestsOf(digests, forms, manifest) {
+    const out = {};
+    for (const slug of ["admin", "gateway"]) {
+        const found = manifest && manifest.digests[slug] === digests[slug]
+            ? await forms.of(manifest, slug)
+            : await forms.ofIndex(slug, digests[slug]);
+        if (!found.ok)
+            return { ok: false, message: found.message };
+        if (!found.amd64) {
+            return {
+                ok: false,
+                message: `the ${slug} image index ${digests[slug]} lists no single linux/amd64 manifest`,
+            };
+        }
+        out[slug] = found.amd64;
+    }
+    const { admin, gateway } = out;
+    return admin && gateway
+        ? { ok: true, platformDigests: { admin, gateway } }
+        : { ok: false, message: "the platform digests could not be read" };
+}
+//# sourceMappingURL=image-forms.js.map

package/dist/upgrade/image-forms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-forms.js","sourceRoot":"","sources":["../../src/upgrade/image-forms.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAiC5F,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,yCAAyC;IACzC,2DAA2D;CAC5D,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;AAE9C,+EAA+E;AAC/E,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC;SACT,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,MAAM;QACN,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC3E,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KACzD,CAAC,CACH;SACA,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH,KAAK,UAAU,YAAY,CAAC,KAA8B;IACxD,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;IAC1E,OAAO,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AACpF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAmB,EAAE,IAAa;IACnE,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,GAAG,WAAW,uCAAuC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE;SACrF,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;IAC7C,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC;IACvF,mDAAmD;IACnD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAC9E,MAAM,SAAS,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,MAAM,CACxC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,WAAW,EAAE,CAAC,2BAA2B,CAAC,KAAK,sBAAsB;QACvE,CAAC,CAAC,QAAQ,KAAK,SAAS;QACxB,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,SAAS,CAC9B,CAAC;IACF,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC,YAAY,KAAK,OAAO,CACzE,CAAC;IACF,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,CAAC,WAAW,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC;QAC1F,KAAK,EAAE,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;KAC9D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,YAA0B,KAAK;IACrE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqC,CAAC;IAC3D,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC;IAEnD,KAAK,UAAU,MAAM,CAAC,IAAc,EAAE,WAAmB;QACvD,MAAM,KAAK,GAAG,OAAO,IAAI,gBAAgB,WAAW,wBAAwB,CAAC;QAC7E,MAAM,OAAO,GAAG,MAAM,qBAAqB,CACzC,GAAG,MAAM,iBAAiB,EAC1B,GAAG,OAAO,IAAI,IAAI,IAAI,IAAI,EAAE,EAC5B,WAAW,EACX,SAAS,CACV,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,GAAG,KAAK,uBAAuB,OAAO,CAAC,MAAM,GAAG;aAC1D,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;YAC3B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,SAAS,EAAE,KAAK;gBAChB,OAAO,EAAE,GAAG,KAAK,+BAA+B,MAAM,8CAA8C;aACrG,CAAC;QACJ,CAAC;QACD,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,cAAc,EAAE,CAAC;QAC1E,CAAC;QACD,OAAO,kBAAkB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,IAAc,EAAE,WAAmB,EAA6B,EAAE;QACjF,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YACpC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC1B,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,OAAO;QACL,OAAO;QACP,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YACpB,MAAM,MAAM,GAAG,CAAC,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBAC9B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAC9F,CAAC;YACD,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACxC,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAqB,EACrB,KAAwB,EACxB,QAAkF;IAKlF,MAAM,GAAG,GAAsC,EAAE,CAAC;IAClD,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,SAAS,CAAU,EAAE,CAAC;QACjD,MAAM,KAAK,GACT,QAAQ,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC;YAClD,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC;YAChC,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QAC5D,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,OAAO,IAAI,gBAAgB,OAAO,CAAC,IAAI,CAAC,uCAAuC;aACzF,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;IAC/B,OAAO,KAAK,IAAI,OAAO;QACrB,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACnD,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC;AACvE,CAAC"}

package/dist/upgrade/release-images.d.ts

@@ -84,6 +84,30 @@ export type DigestResult = {
  * @param repository - path below the host, e.g. `caelo-cms/admin`.
  */
 export declare function resolveRegistryDigest(registryHost: string, repository: string, tag: string, fetchImpl?: typeof fetch): Promise<DigestResult>;
+/** What {@link fetchRegistryManifest} read. */
+export type RegistryManifestResult = {
+    readonly ok: true;
+    readonly bytes: Uint8Array<ArrayBuffer>;
+} | {
+    readonly ok: false;
+    /**
+     * True when a retry may cure it: the registry could not be reached,
+     * timed out, rate-limited (429/408), failed (5xx) or would not hand
+     * out a pull token. False when it answered that the manifest does not
+     * exist (404 and other 4xx).
+     */
+    readonly transient: boolean;
+    readonly reason: string;
+};
+/**
+ * GET the manifest (or index) `<registryHost>/<repository>@<reference>`
+ * anonymously, through the same Bearer-challenge handling as
+ * {@link resolveRegistryDigest}. Returns the raw bytes: a caller that asked
+ * by digest checks them against it (content addressing is the trust here).
+ *
+ * @example fetchRegistryManifest("europe-west1-docker.pkg.dev", "caelo-website/caelo-cms-images/admin", "sha256:…")
+ */
+export declare function fetchRegistryManifest(registryHost: string, repository: string, reference: string, fetchImpl?: typeof fetch): Promise<RegistryManifestResult>;
 /**
  * The key/value pairs of a `Bearer k="v",k2="v2"` challenge, or null when
  * it is not a Bearer challenge.

package/dist/upgrade/release-images.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"release-images.d.ts","sourceRoot":"","sources":["../../src/upgrade/release-images.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAIjD,wDAAwD;AACxD,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,SAAS,CAAC;AAEjD,kFAAkF;AAClF,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,EAAyB,CAAC;AAEhF,uFAAuF;AACvF,eAAO,MAAM,aAAa,YAAY,CAAC;AACvC,eAAO,MAAM,cAAc,cAAc,CAAC;AAE1C,mFAAmF;AACnF,wBAAgB,cAAc,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAE9D;AAED,+EAA+E;AAC/E,eAAO,MAAM,qBAAqB,6DAA6D,CAAC;AAEhG;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,6FAA6D,CAAC;AAEzG,mGAAmG;AACnG,eAAO,MAAM,mBAAmB,gDAAgD,CAAC;AAEjF;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAU3D;AAID,OAAO,EAAE,YAAY,EAAE,CAAC;AAExB,6DAA6D;AAC7D,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAEhD;AAID;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIxD;AAKD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG5D;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,GAAG,IAAI,GAAG,MAAM,CAAC;CAC7C,GAAG,MAAM,CAKT;AAED,MAAM,MAAM,YAAY,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAUxF;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,EACX,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,YAAY,CAAC,CAsBvB;AAwBD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAQzF;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAepE;AAED,yEAAyE;AACzE,eAAO,MAAM,gBAAgB;;;;CAInB,CAAC;AAEX,kGAAkG;AAClG,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAGpE;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,EACjE,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiBxB;AAED,wFAAwF;AACxF,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAG5E;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAGlF;AAWD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAQnE;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC,CAiC9D;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,SAAS;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAAE,GACnE,OAAO,CAAC,OAAO,CAAC,CA+BlB"}
+{"version":3,"file":"release-images.d.ts","sourceRoot":"","sources":["../../src/upgrade/release-images.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAIjD,wDAAwD;AACxD,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,SAAS,CAAC;AAEjD,kFAAkF;AAClF,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,EAAyB,CAAC;AAEhF,uFAAuF;AACvF,eAAO,MAAM,aAAa,YAAY,CAAC;AACvC,eAAO,MAAM,cAAc,cAAc,CAAC;AAE1C,mFAAmF;AACnF,wBAAgB,cAAc,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAE9D;AAED,+EAA+E;AAC/E,eAAO,MAAM,qBAAqB,6DAA6D,CAAC;AAEhG;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,6FAA6D,CAAC;AAEzG,mGAAmG;AACnG,eAAO,MAAM,mBAAmB,gDAAgD,CAAC;AAEjF;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAU3D;AAID,OAAO,EAAE,YAAY,EAAE,CAAC;AAExB,6DAA6D;AAC7D,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAEhD;AAID;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIxD;AAKD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG5D;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,GAAG,IAAI,GAAG,MAAM,CAAC;CAC7C,GAAG,MAAM,CAKT;AAED,MAAM,MAAM,YAAY,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAUxF;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,EACX,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,YAAY,CAAC,CAsBvB;AAED,+CAA+C;AAC/C,MAAM,MAAM,sBAAsB,GAC9B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;CAAE,GAC9D;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEN;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,sBAAsB,CAAC,CAmBjC;AAwBD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAQzF;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAepE;AAED,yEAAyE;AACzE,eAAO,MAAM,gBAAgB;;;;CAInB,CAAC;AAEX,kGAAkG;AAClG,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAGpE;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,EACjE,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiBxB;AAED,wFAAwF;AACxF,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAG5E;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAGlF;AAWD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAQnE;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC,CAiC9D;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,SAAS;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAAE,GACnE,OAAO,CAAC,OAAO,CAAC,CA+BlB"}

package/dist/upgrade/release-images.js

@@ -143,6 +143,36 @@ export async function resolveRegistryDigest(registryHost, repository, tag, fetch
         return { ok: false, reason: e instanceof Error ? e.message : String(e) };
     }
 }
+/**
+ * GET the manifest (or index) `<registryHost>/<repository>@<reference>`
+ * anonymously, through the same Bearer-challenge handling as
+ * {@link resolveRegistryDigest}. Returns the raw bytes: a caller that asked
+ * by digest checks them against it (content addressing is the trust here).
+ *
+ * @example fetchRegistryManifest("europe-west1-docker.pkg.dev", "caelo-website/caelo-cms-images/admin", "sha256:…")
+ */
+export async function fetchRegistryManifest(registryHost, repository, reference, fetchImpl = fetch) {
+    const url = `https://${registryHost}/v2/${repository}/manifests/${reference}`;
+    try {
+        let res = await fetchImpl(url, { headers: { Accept: MANIFEST_ACCEPT } });
+        if (res.status === 401) {
+            const token = await anonymousPullToken(res.headers.get("www-authenticate"), fetchImpl);
+            if (!token.ok)
+                return { ok: false, transient: true, reason: token.reason };
+            res = await fetchImpl(url, {
+                headers: { Accept: MANIFEST_ACCEPT, Authorization: `Bearer ${token.token}` },
+            });
+        }
+        if (!res.ok) {
+            const transient = res.status >= 500 || res.status === 429 || res.status === 408;
+            return { ok: false, transient, reason: `${url}: HTTP ${res.status} ${res.statusText}` };
+        }
+        return { ok: true, bytes: new Uint8Array(await res.arrayBuffer()) };
+    }
+    catch (e) {
+        return { ok: false, transient: true, reason: e instanceof Error ? e.message : String(e) };
+    }
+}
 /** Follow a registry's Bearer challenge to an anonymous pull token. */
 async function anonymousPullToken(challenge, fetchImpl) {
     const params = parseBearerChallenge(challenge);