@caelo-cms/provisioning 0.11.13 → 0.11.14
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/admin-domain.d.ts +4 -46
- package/dist/admin-domain.d.ts.map +1 -1
- package/dist/admin-domain.js +4 -101
- package/dist/admin-domain.js.map +1 -1
- package/dist/agent-db.js +29 -5
- package/dist/audit-job-setup.d.ts.map +1 -1
- package/dist/audit-job-setup.js +14 -19
- package/dist/audit-job-setup.js.map +1 -1
- package/dist/caddy.d.ts +2 -1
- package/dist/caddy.d.ts.map +1 -1
- package/dist/caddy.js +21 -3
- package/dist/caddy.js.map +1 -1
- package/dist/cli.js +111 -62
- package/dist/cli.js.map +1 -1
- package/dist/compose.d.ts +22 -2
- package/dist/compose.d.ts.map +1 -1
- package/dist/compose.js +53 -3
- package/dist/compose.js.map +1 -1
- package/dist/converge-checkpoint.d.ts +1 -0
- package/dist/converge-checkpoint.d.ts.map +1 -1
- package/dist/converge-checkpoint.js +1 -0
- package/dist/converge-checkpoint.js.map +1 -1
- package/dist/deployed-release.d.ts.map +1 -1
- package/dist/deployed-release.js +40 -8
- package/dist/deployed-release.js.map +1 -1
- package/dist/gcp-names.d.ts +33 -14
- package/dist/gcp-names.d.ts.map +1 -1
- package/dist/gcp-names.js +43 -0
- package/dist/gcp-names.js.map +1 -1
- package/dist/gcp-url-map.d.ts +19 -4
- package/dist/gcp-url-map.d.ts.map +1 -1
- package/dist/gcp-url-map.js +33 -5
- package/dist/gcp-url-map.js.map +1 -1
- package/dist/infra-contract.d.ts +1 -1
- package/dist/infra-contract.d.ts.map +1 -1
- package/dist/infra-contract.js +18 -1
- package/dist/infra-contract.js.map +1 -1
- package/dist/lifecycle.d.ts.map +1 -1
- package/dist/lifecycle.js +5 -39
- package/dist/lifecycle.js.map +1 -1
- package/dist/mcp-auth-proxy-setup.d.ts +8 -2
- package/dist/mcp-auth-proxy-setup.d.ts.map +1 -1
- package/dist/mcp-auth-proxy-setup.js +4 -0
- package/dist/mcp-auth-proxy-setup.js.map +1 -1
- package/dist/release-manifest.d.ts +1 -1
- package/dist/release-manifest.d.ts.map +1 -1
- package/dist/release-manifest.js +2 -0
- package/dist/release-manifest.js.map +1 -1
- package/dist/remote-mcp.d.ts.map +1 -1
- package/dist/remote-mcp.js +11 -1
- package/dist/remote-mcp.js.map +1 -1
- package/dist/runtime-secrets.d.ts +10 -0
- package/dist/runtime-secrets.d.ts.map +1 -1
- package/dist/runtime-secrets.js +10 -1
- package/dist/runtime-secrets.js.map +1 -1
- package/dist/stack-contract.d.ts +61 -20
- package/dist/stack-contract.d.ts.map +1 -1
- package/dist/stack-contract.js +173 -35
- package/dist/stack-contract.js.map +1 -1
- package/dist/stack-converge.d.ts.map +1 -1
- package/dist/stack-converge.js +4 -2
- package/dist/stack-converge.js.map +1 -1
- package/dist/staging-admin.d.ts +2 -2
- package/dist/staging-admin.d.ts.map +1 -1
- package/dist/staging-gateway-setup.d.ts +140 -0
- package/dist/staging-gateway-setup.d.ts.map +1 -0
- package/dist/staging-gateway-setup.js +848 -0
- package/dist/staging-gateway-setup.js.map +1 -0
- package/dist/upgrade/app-roll.d.ts +4 -4
- package/dist/upgrade/app-roll.d.ts.map +1 -1
- package/dist/upgrade/app-roll.js +7 -5
- package/dist/upgrade/app-roll.js.map +1 -1
- package/dist/upgrade/converge.d.ts.map +1 -1
- package/dist/upgrade/converge.js +36 -27
- package/dist/upgrade/converge.js.map +1 -1
- package/dist/upgrade/image-forms.d.ts +3 -3
- package/dist/upgrade/image-forms.d.ts.map +1 -1
- package/dist/upgrade/image-forms.js +2 -2
- package/dist/upgrade/image-forms.js.map +1 -1
- package/dist/upgrade/release-images.d.ts +20 -0
- package/dist/upgrade/release-images.d.ts.map +1 -1
- package/dist/upgrade/release-images.js +28 -0
- package/dist/upgrade/release-images.js.map +1 -1
- package/dist/upgrade/upgrade.d.ts +3 -1
- package/dist/upgrade/upgrade.d.ts.map +1 -1
- package/dist/upgrade/upgrade.js +22 -1
- package/dist/upgrade/upgrade.js.map +1 -1
- package/dist/upgrader-job.d.ts.map +1 -1
- package/dist/upgrader-job.js +30 -5
- package/dist/upgrader-job.js.map +1 -1
- package/dist/upgrader-records.d.ts +2 -2
- package/dist/upgrader-records.d.ts.map +1 -1
- package/dist/upgrader-records.js +2 -2
- package/dist/upgrader-records.js.map +1 -1
- package/dist/wizard.d.ts.map +1 -1
- package/dist/wizard.js +3 -3
- package/dist/wizard.js.map +1 -1
- package/dist/wizards/gcp.d.ts.map +1 -1
- package/dist/wizards/gcp.js +48 -9
- package/dist/wizards/gcp.js.map +1 -1
- package/package.json +2 -2
- package/src/admin-domain.test.ts +0 -156
- package/src/admin-domain.ts +4 -117
- package/src/admin-memory.test.ts +2 -0
- package/src/audit-job-setup.test.ts +11 -11
- package/src/audit-job-setup.ts +14 -19
- package/src/caddy-redirects.docker.test.ts +10 -5
- package/src/caddy-redirects.test.ts +7 -5
- package/src/caddy-validate.test.ts +1 -1
- package/src/caddy.test.ts +12 -6
- package/src/caddy.ts +23 -4
- package/src/cli.ts +138 -77
- package/src/compose.ts +67 -2
- package/src/converge-checkpoint.ts +1 -0
- package/src/database-tls-builders.test.ts +3 -1
- package/src/deployed-release.test.ts +21 -0
- package/src/deployed-release.ts +42 -7
- package/src/gateway-env-isolation.test.ts +2 -0
- package/src/gcp-names.ts +53 -0
- package/src/gcp-url-map.test.ts +26 -2
- package/src/gcp-url-map.ts +36 -5
- package/src/index.test.ts +9 -3
- package/src/infra-contract.test.ts +4 -3
- package/src/infra-contract.ts +18 -1
- package/src/lifecycle.ts +8 -52
- package/src/mcp-auth-proxy-setup.test.ts +15 -6
- package/src/mcp-auth-proxy-setup.ts +14 -2
- package/src/release-manifest.ts +3 -1
- package/src/remote-mcp-stack-config.test.ts +1 -0
- package/src/remote-mcp.test.ts +5 -1
- package/src/remote-mcp.ts +10 -1
- package/src/runtime-secrets.test.ts +10 -1
- package/src/runtime-secrets.ts +21 -0
- package/src/self-hosted-backup.test.ts +6 -4
- package/src/self-hosted-compose.test.ts +2 -0
- package/src/stack-contract-parity.test.ts +7 -3
- package/src/stack-contract.test.ts +73 -13
- package/src/stack-contract.ts +195 -42
- package/src/stack-converge-secrets.test.ts +7 -2
- package/src/stack-converge.test.ts +37 -9
- package/src/stack-converge.ts +4 -1
- package/src/staging-admin.ts +2 -2
- package/src/staging-gateway-setup.test.ts +361 -0
- package/src/staging-gateway-setup.ts +1083 -0
- package/src/upgrade/app-roll.ts +7 -4
- package/src/upgrade/converge.ts +40 -26
- package/src/upgrade/image-forms.ts +7 -7
- package/src/upgrade/release-images.test.ts +28 -0
- package/src/upgrade/release-images.ts +44 -0
- package/src/upgrade/upgrade.test.ts +63 -11
- package/src/upgrade/upgrade.ts +29 -2
- package/src/upgrader-job.test.ts +23 -0
- package/src/upgrader-job.ts +45 -11
- package/src/upgrader-records.ts +7 -7
- package/src/wizard.ts +2 -3
- package/src/wizards/gcp.ts +73 -9
- package/stacks/gcp/index.ts +47 -6
- package/stacks/gcp-firebase/index.ts +44 -12
- package/stacks/self-hosted/index.ts +9 -2
package/dist/admin-domain.d.ts
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* `cms-provision admin-domain enable` — serve a gcp-firebase admin at
|
|
3
|
-
* `admin.<domain>` instead of its `*.run.app` URL
|
|
4
|
-
*
|
|
5
|
-
*
|
|
3
|
+
* `admin.<domain>` instead of its `*.run.app` URL. (The staging host has no
|
|
4
|
+
* Cloud Run domain mapping any more since #1330: it is a custom domain of
|
|
5
|
+
* the staging Hosting site, staging-gateway-setup.ts.)
|
|
6
6
|
*
|
|
7
7
|
* The gcp-firebase stack only creates that Cloud Run domain mapping behind
|
|
8
8
|
* `provisionAdminDomain=true`, off by default: Google refuses a mapping
|
|
@@ -46,8 +46,6 @@ export type AdminDomainResult = {
|
|
|
46
46
|
status: "failed";
|
|
47
47
|
error: string;
|
|
48
48
|
};
|
|
49
|
-
/** What `staging-domain enable` reports; same shape as the admin's. */
|
|
50
|
-
export type StagingDomainResult = AdminDomainResult;
|
|
51
49
|
interface DomainOpts {
|
|
52
50
|
projectId: string;
|
|
53
51
|
region: string;
|
|
@@ -59,7 +57,7 @@ interface DomainOpts {
|
|
|
59
57
|
/**
|
|
60
58
|
* The one deployed Cloud Run service playing `slug` on a gcp-firebase
|
|
61
59
|
* install (stack-contract.ts cloudRunServicePrefix: since #1328 the visitor
|
|
62
|
-
* gateway is `caelo-production-data-gateway`)
|
|
60
|
+
* gateway is `caelo-production-data-gateway`).
|
|
63
61
|
*/
|
|
64
62
|
export declare function findService(run: Run, scope: string[], slug: "admin" | "gateway"): Promise<{
|
|
65
63
|
ok: true;
|
|
@@ -69,46 +67,6 @@ export declare function findService(run: Run, scope: string[], slug: "admin" | "
|
|
|
69
67
|
error: string;
|
|
70
68
|
}>;
|
|
71
69
|
export declare function enableAdminDomain(opts: DomainOpts): Promise<AdminDomainResult>;
|
|
72
|
-
/**
|
|
73
|
-
* #650 — map the install's staging host (its setting, default
|
|
74
|
-
* `staging.<domain>`; any FQDN) to the gateway, which serves the protected
|
|
75
|
-
* staging site. Cloud Run refuses domain-mapped requests while a service's
|
|
76
|
-
* ingress is internal-only, so the gateway's ingress is opened first (the
|
|
77
|
-
* stack declares the same since #650; installs from before keep the old
|
|
78
|
-
* value until this runs). Idempotent like the admin mapping.
|
|
79
|
-
*
|
|
80
|
-
* #1328 — a new mapping goes to the data gateway, which runs the gate. A
|
|
81
|
-
* mapping made before stays on the service that was the gateway (now the
|
|
82
|
-
* MCP-Auth-Proxy, which forwards it there) until the staging cutover moves
|
|
83
|
-
* it (#1330, #1331); an existing mapping is only reported here.
|
|
84
|
-
*/
|
|
85
|
-
export declare function enableStagingDomain(opts: DomainOpts & {
|
|
86
|
-
stagingHost: string;
|
|
87
|
-
}): Promise<StagingDomainResult>;
|
|
88
|
-
/** What {@link stagingDomainState} found. */
|
|
89
|
-
export type StagingDomainState = {
|
|
90
|
-
readonly status: "mapped";
|
|
91
|
-
} | {
|
|
92
|
-
readonly status: "unmapped";
|
|
93
|
-
} | {
|
|
94
|
-
readonly status: "unknown";
|
|
95
|
-
readonly reason: string;
|
|
96
|
-
};
|
|
97
|
-
/**
|
|
98
|
-
* Whether the install's staging host already has its Cloud Run domain
|
|
99
|
-
* mapping, read-only. The upgrade asks before it tells the operator to run
|
|
100
|
-
* `staging-domain enable`, so an install that serves its staging host is
|
|
101
|
-
* not sent to set it up again. It never installs the gcloud `beta`
|
|
102
|
-
* component (an upgrade should not pause for a download to print a hint):
|
|
103
|
-
* without it, or on any error but gcloud's NOT_FOUND, the state is unknown
|
|
104
|
-
* and says why.
|
|
105
|
-
*/
|
|
106
|
-
export declare function stagingDomainState(opts: {
|
|
107
|
-
projectId: string;
|
|
108
|
-
region: string;
|
|
109
|
-
stagingHost: string;
|
|
110
|
-
run?: Run;
|
|
111
|
-
}): Promise<StagingDomainState>;
|
|
112
70
|
/** What {@link setAdminStagingHostEnv} did. */
|
|
113
71
|
export type AdminStagingEnvResult = {
|
|
114
72
|
readonly status: "set";
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"admin-domain.d.ts","sourceRoot":"","sources":["../src/admin-domain.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAA2B,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAMzE,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;AAErD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,cAAc,EAAE,CAAA;CAAE,GACnF;IAAE,MAAM,EAAE,oBAAoB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACxE;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;
|
|
1
|
+
{"version":3,"file":"admin-domain.d.ts","sourceRoot":"","sources":["../src/admin-domain.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAA2B,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAMzE,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;AAErD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,cAAc,EAAE,CAAA;CAAE,GACnF;IAAE,MAAM,EAAE,oBAAoB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACxE;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAexC,UAAU,UAAU;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,GAAG,CAAC;IACV,kFAAkF;IAClF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC;AAMD;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,GAAG,EACR,KAAK,EAAE,MAAM,EAAE,EACf,IAAI,EAAE,OAAO,GAAG,SAAS,GACxB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CA8BvE;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAMpF;AAED,+CAA+C;AAC/C,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACtF;IAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1D;;;;;;;;;;;;GAYG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,GAAG,QAAQ,GAAG,KAAK,CAAC,GAAG;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,GAC/E,OAAO,CAAC,qBAAqB,CAAC,CA8ChC"}
|
package/dist/admin-domain.js
CHANGED
|
@@ -1,9 +1,9 @@
|
|
|
1
1
|
// SPDX-License-Identifier: MPL-2.0
|
|
2
2
|
/**
|
|
3
3
|
* `cms-provision admin-domain enable` — serve a gcp-firebase admin at
|
|
4
|
-
* `admin.<domain>` instead of its `*.run.app` URL
|
|
5
|
-
*
|
|
6
|
-
*
|
|
4
|
+
* `admin.<domain>` instead of its `*.run.app` URL. (The staging host has no
|
|
5
|
+
* Cloud Run domain mapping any more since #1330: it is a custom domain of
|
|
6
|
+
* the staging Hosting site, staging-gateway-setup.ts.)
|
|
7
7
|
*
|
|
8
8
|
* The gcp-firebase stack only creates that Cloud Run domain mapping behind
|
|
9
9
|
* `provisionAdminDomain=true`, off by default: Google refuses a mapping
|
|
@@ -46,7 +46,7 @@ function logOf(opts) {
|
|
|
46
46
|
/**
|
|
47
47
|
* The one deployed Cloud Run service playing `slug` on a gcp-firebase
|
|
48
48
|
* install (stack-contract.ts cloudRunServicePrefix: since #1328 the visitor
|
|
49
|
-
* gateway is `caelo-production-data-gateway`)
|
|
49
|
+
* gateway is `caelo-production-data-gateway`).
|
|
50
50
|
*/
|
|
51
51
|
export async function findService(run, scope, slug) {
|
|
52
52
|
const prefix = cloudRunServicePrefix("gcp-firebase", GCP_STACK_ENV, slug);
|
|
@@ -86,103 +86,6 @@ export async function enableAdminDomain(opts) {
|
|
|
86
86
|
return { status: "failed", error: found.error };
|
|
87
87
|
return mapDomain(run, logOf(opts), scope, opts.domain, `admin.${opts.domain}`, found.service);
|
|
88
88
|
}
|
|
89
|
-
/**
|
|
90
|
-
* #650 — map the install's staging host (its setting, default
|
|
91
|
-
* `staging.<domain>`; any FQDN) to the gateway, which serves the protected
|
|
92
|
-
* staging site. Cloud Run refuses domain-mapped requests while a service's
|
|
93
|
-
* ingress is internal-only, so the gateway's ingress is opened first (the
|
|
94
|
-
* stack declares the same since #650; installs from before keep the old
|
|
95
|
-
* value until this runs). Idempotent like the admin mapping.
|
|
96
|
-
*
|
|
97
|
-
* #1328 — a new mapping goes to the data gateway, which runs the gate. A
|
|
98
|
-
* mapping made before stays on the service that was the gateway (now the
|
|
99
|
-
* MCP-Auth-Proxy, which forwards it there) until the staging cutover moves
|
|
100
|
-
* it (#1330, #1331); an existing mapping is only reported here.
|
|
101
|
-
*/
|
|
102
|
-
export async function enableStagingDomain(opts) {
|
|
103
|
-
const run = opts.run ?? defaultGcloud;
|
|
104
|
-
const scope = [`--region=${opts.region}`, `--project=${opts.projectId}`];
|
|
105
|
-
const found = await findService(run, scope, "gateway");
|
|
106
|
-
if (!found.ok)
|
|
107
|
-
return { status: "failed", error: found.error };
|
|
108
|
-
const ingress = await run([
|
|
109
|
-
"run",
|
|
110
|
-
"services",
|
|
111
|
-
"describe",
|
|
112
|
-
found.service,
|
|
113
|
-
...scope,
|
|
114
|
-
'--format=value(metadata.annotations["run.googleapis.com/ingress"])',
|
|
115
|
-
]);
|
|
116
|
-
if (!ingress.ok) {
|
|
117
|
-
return { status: "failed", error: `read the gateway's ingress: ${ingress.stderr.trim()}` };
|
|
118
|
-
}
|
|
119
|
-
if (ingress.stdout.trim() !== "all") {
|
|
120
|
-
const update = await run([
|
|
121
|
-
"run",
|
|
122
|
-
"services",
|
|
123
|
-
"update",
|
|
124
|
-
found.service,
|
|
125
|
-
...scope,
|
|
126
|
-
"--ingress=all",
|
|
127
|
-
"--quiet",
|
|
128
|
-
]);
|
|
129
|
-
if (!update.ok) {
|
|
130
|
-
return {
|
|
131
|
-
status: "failed",
|
|
132
|
-
error: `open the gateway's ingress for the domain mapping: ${update.stderr.trim()}`,
|
|
133
|
-
};
|
|
134
|
-
}
|
|
135
|
-
}
|
|
136
|
-
// Search Console verification: the install domain covers its own
|
|
137
|
-
// subdomains; a host on another domain is verified itself.
|
|
138
|
-
const verifyDomain = opts.stagingHost === opts.domain || opts.stagingHost.endsWith(`.${opts.domain}`)
|
|
139
|
-
? opts.domain
|
|
140
|
-
: opts.stagingHost;
|
|
141
|
-
return mapDomain(run, logOf(opts), scope, verifyDomain, opts.stagingHost, found.service);
|
|
142
|
-
}
|
|
143
|
-
/**
|
|
144
|
-
* Whether the install's staging host already has its Cloud Run domain
|
|
145
|
-
* mapping, read-only. The upgrade asks before it tells the operator to run
|
|
146
|
-
* `staging-domain enable`, so an install that serves its staging host is
|
|
147
|
-
* not sent to set it up again. It never installs the gcloud `beta`
|
|
148
|
-
* component (an upgrade should not pause for a download to print a hint):
|
|
149
|
-
* without it, or on any error but gcloud's NOT_FOUND, the state is unknown
|
|
150
|
-
* and says why.
|
|
151
|
-
*/
|
|
152
|
-
export async function stagingDomainState(opts) {
|
|
153
|
-
const run = opts.run ?? defaultGcloud;
|
|
154
|
-
const listed = await run([
|
|
155
|
-
"components",
|
|
156
|
-
"list",
|
|
157
|
-
"--only-local-state",
|
|
158
|
-
"--filter=id=beta",
|
|
159
|
-
"--format=value(id)",
|
|
160
|
-
]);
|
|
161
|
-
if (!listed.ok) {
|
|
162
|
-
return {
|
|
163
|
-
status: "unknown",
|
|
164
|
-
reason: `check the gcloud "beta" component: ${listed.stderr.trim() || `exit ${listed.exitCode}`}`,
|
|
165
|
-
};
|
|
166
|
-
}
|
|
167
|
-
if (!listed.stdout.split("\n").some((s) => s.trim() === "beta")) {
|
|
168
|
-
return { status: "unknown", reason: 'the gcloud "beta" component is not installed' };
|
|
169
|
-
}
|
|
170
|
-
const described = await run([
|
|
171
|
-
"beta",
|
|
172
|
-
"run",
|
|
173
|
-
"domain-mappings",
|
|
174
|
-
"describe",
|
|
175
|
-
`--domain=${opts.stagingHost}`,
|
|
176
|
-
`--region=${opts.region}`,
|
|
177
|
-
`--project=${opts.projectId}`,
|
|
178
|
-
"--format=value(metadata.name)",
|
|
179
|
-
]);
|
|
180
|
-
if (described.ok)
|
|
181
|
-
return { status: "mapped" };
|
|
182
|
-
if (/\bNOT_FOUND\b/.test(described.stderr))
|
|
183
|
-
return { status: "unmapped" };
|
|
184
|
-
return { status: "unknown", reason: described.stderr.trim() };
|
|
185
|
-
}
|
|
186
89
|
/**
|
|
187
90
|
* #1058 — point the admin's `CAELO_STAGING_HOST` at the host
|
|
188
91
|
* `staging-domain enable` just mapped. The database row
|
package/dist/admin-domain.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"admin-domain.js","sourceRoot":"","sources":["../src/admin-domain.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,MAAM,IAAI,aAAa,EAAqB,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;
|
|
1
|
+
{"version":3,"file":"admin-domain.js","sourceRoot":"","sources":["../src/admin-domain.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,MAAM,IAAI,aAAa,EAAqB,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAmBvD,SAAS,SAAS,CAAC,IAAY,EAAE,QAAgB;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAsB,CAAC;IACrD,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ;QAC/E,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,OAAO;QACvB,KAAK,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE;KACtB,CAAC,CAAC,CAAC;AACN,CAAC;AAWD,SAAS,KAAK,CAAC,IAAgB;IAC7B,OAAO,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAQ,EACR,KAAe,EACf,IAAyB;IAEzB,MAAM,MAAM,GAAG,qBAAqB,CAAC,cAAc,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;QACzB,KAAK;QACL,UAAU;QACV,MAAM;QACN,GAAG,KAAK;QACR,2BAA2B,MAAM,EAAE;QACnC,+BAA+B;KAChC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACpF,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM;SAC5B,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,2EAA2E;IAC3E,4EAA4E;IAC5E,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EACH,OAAO,CAAC,MAAM,KAAK,CAAC;gBAClB,CAAC,CAAC,GAAG,IAAI,oCAAoC,MAAM,WAAW;gBAC9D,CAAC,CAAC,wBAAwB,MAAM,8BAA8B,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B;SACvI,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAgB;IACtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,YAAY,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IAC/D,OAAO,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,IAAI,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;AAChG,CAAC;AAQD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAgF;IAEhF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,YAAY,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IAC/D,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC;QAC1B,KAAK;QACL,UAAU;QACV,UAAU;QACV,KAAK,CAAC,OAAO;QACb,GAAG,KAAK;QACR,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAClB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,yBAAyB,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACzF,CAAC;IACD,IAAI,IAAyC,CAAC;IAC9C,IAAI,CAAC;QACH,IAAI,GAAG,gBAAgB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,mDAAmD,EAAE,CAAC;IAC1F,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC3C,IAAI,OAAO,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,mBAAmB,gBAAgB,gBAAgB,OAAO,CAAC,MAAM,uGAAuG;SAChL,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,EAAE,KAAK,KAAK,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IAChG,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;QACvB,KAAK;QACL,UAAU;QACV,QAAQ;QACR,KAAK,CAAC,OAAO;QACb,GAAG,KAAK;QACR,qBAAqB,gBAAgB,IAAI,IAAI,CAAC,WAAW,EAAE;QAC3D,SAAS;KACV,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,OAAO,gBAAgB,kBAAkB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;SACvE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC;AACrF,CAAC;AAED,8DAA8D;AAC9D,KAAK,UAAU,SAAS,CACtB,GAAQ,EACR,GAA8B,EAC9B,KAAe,EACf,MAAc,EACd,QAAgB,EAChB,OAAe;IAEf,4EAA4E;IAC5E,4EAA4E;IAC5E,uEAAuE;IACvE,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/D,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IAE7D,MAAM,YAAY,GAAG;QACnB,MAAM;QACN,KAAK;QACL,iBAAiB;QACjB,UAAU;QACV,YAAY,QAAQ,EAAE;QACtB,GAAG,KAAK;QACR,eAAe;KAChB,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,QAAQ;YACR,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;SAC9C,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,oBAAoB,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACpF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,wEAAwE;QACxE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,0BAA0B,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACzF,CAAC;IACD,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACrE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,iCAAiC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;aAC1E,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;IAC1E,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;QACvB,MAAM;QACN,KAAK;QACL,iBAAiB;QACjB,QAAQ;QACR,aAAa,OAAO,EAAE;QACtB,YAAY,QAAQ,EAAE;QACtB,GAAG,KAAK;QACR,SAAS;KACV,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,0BAA0B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACvF,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,CAAC;IACxC,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,QAAQ;QACR,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;KAC/D,CAAC;AACJ,CAAC"}
|
package/dist/agent-db.js
CHANGED
|
@@ -9447,7 +9447,36 @@ var stageStatusRunSchema = object({
|
|
|
9447
9447
|
eta: stageEtaSchema.nullable(),
|
|
9448
9448
|
etaUnavailable: string2().nullable()
|
|
9449
9449
|
});
|
|
9450
|
+
// ../shared/src/static-cache-policy.ts
|
|
9451
|
+
var PINNED_FONT_SLICE_FILE_PATTERN = "[0-9a-f]{64}\\.[0-9a-f]{12}\\.[a-z]+(?:-[a-z]+)?\\.[0-9a-f]{12}\\.woff2";
|
|
9452
|
+
var PINNED_FONT_SLICE_FILE_RE = new RegExp(`^${PINNED_FONT_SLICE_FILE_PATTERN}$`);
|
|
9453
|
+
var CONTENT_HASHED_PATH_PATTERN = `^/(?:_app/immutable/.+|_assets/fonts/[^/]+/[0-9a-f]{16}\\.woff2|_assets/fonts/pinned/${PINNED_FONT_SLICE_FILE_PATTERN}|_assets/[a-z0-9][a-z0-9-]*(?:/[a-z][a-z0-9-]*)?\\.[0-9a-f]{16}\\.[a-z0-9]{2,5}|_caelo/plugin/[^/]+/[^/]+\\.[0-9a-f]{12}\\.(?:js|css))$`;
|
|
9454
|
+
var CONTENT_HASHED_PATH_RE = new RegExp(CONTENT_HASHED_PATH_PATTERN);
|
|
9455
|
+
|
|
9456
|
+
// ../shared/src/staged-site.ts
|
|
9457
|
+
function isSafeStagedPath(path) {
|
|
9458
|
+
if (path.length === 0 || path.length > 1024 || path.startsWith("/"))
|
|
9459
|
+
return false;
|
|
9460
|
+
if (path.includes("\\") || /[\u0000-\u001f\u007f]/.test(path))
|
|
9461
|
+
return false;
|
|
9462
|
+
return path.split("/").every((s) => s.length > 0 && s !== "." && s !== "..");
|
|
9463
|
+
}
|
|
9464
|
+
var stagedFileSchema = object({
|
|
9465
|
+
type: string2().min(1).max(200),
|
|
9466
|
+
hash: string2().min(1).max(200)
|
|
9467
|
+
});
|
|
9468
|
+
var stagedManifestSchema = object({
|
|
9469
|
+
version: literal(1),
|
|
9470
|
+
runId: string2().uuid(),
|
|
9471
|
+
pageUrlStyle: _enum(["directory", "no-extension"]),
|
|
9472
|
+
files: record(string2(), stagedFileSchema).refine((files) => Object.keys(files).every(isSafeStagedPath), {
|
|
9473
|
+
message: "every path must be a plain build-relative path"
|
|
9474
|
+
})
|
|
9475
|
+
});
|
|
9476
|
+
var AFTER_ORIGIN = String.raw`(?=[/"'?#\s<>),;\\\]}&|]|$)`;
|
|
9450
9477
|
// ../shared/src/staging-gate.ts
|
|
9478
|
+
var STAGING_SESSION_ENTRY = SESSION_ENTRY.staging;
|
|
9479
|
+
var STAGING_RUN_TOKEN_MAX_TTL_SECONDS = 15 * 60;
|
|
9451
9480
|
var STAGING_SESSION_TTL_SECONDS = 12 * 60 * 60;
|
|
9452
9481
|
var ENCODER = new TextEncoder;
|
|
9453
9482
|
// ../shared/src/staging-plugin-stub.ts
|
|
@@ -9456,11 +9485,6 @@ var STAGING_PLUGIN_STUB_BODY = JSON.stringify({
|
|
|
9456
9485
|
ok: false,
|
|
9457
9486
|
error: { kind: STAGING_PREVIEW_ERROR_KIND }
|
|
9458
9487
|
});
|
|
9459
|
-
// ../shared/src/static-cache-policy.ts
|
|
9460
|
-
var PINNED_FONT_SLICE_FILE_PATTERN = "[0-9a-f]{64}\\.[0-9a-f]{12}\\.[a-z]+(?:-[a-z]+)?\\.[0-9a-f]{12}\\.woff2";
|
|
9461
|
-
var PINNED_FONT_SLICE_FILE_RE = new RegExp(`^${PINNED_FONT_SLICE_FILE_PATTERN}$`);
|
|
9462
|
-
var CONTENT_HASHED_PATH_PATTERN = `^/(?:_app/immutable/.+|_assets/fonts/[^/]+/[0-9a-f]{16}\\.woff2|_assets/fonts/pinned/${PINNED_FONT_SLICE_FILE_PATTERN}|_assets/[a-z0-9][a-z0-9-]*(?:/[a-z][a-z0-9-]*)?\\.[0-9a-f]{16}\\.[a-z0-9]{2,5}|_caelo/plugin/[^/]+/[^/]+\\.[0-9a-f]{12}\\.(?:js|css))$`;
|
|
9463
|
-
var CONTENT_HASHED_PATH_RE = new RegExp(CONTENT_HASHED_PATH_PATTERN);
|
|
9464
9488
|
// ../shared/src/subagents.ts
|
|
9465
9489
|
var expectedReturnShape = _enum(["verdict", "tree", "freeform", "rebuild"]);
|
|
9466
9490
|
var EXPECTED_RETURN_SHAPES = expectedReturnShape.options;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"audit-job-setup.d.ts","sourceRoot":"","sources":["../src/audit-job-setup.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"audit-job-setup.d.ts","sourceRoot":"","sources":["../src/audit-job-setup.ts"],"names":[],"mappings":"AAkDA,OAAO,EAAE,KAAK,YAAY,EAA2B,KAAK,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAS3F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGvD,0DAA0D;AAC1D,eAAO,MAAM,iBAAiB,uDAAuD,CAAC;AAEtF,qEAAqE;AACrE,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAS5C;;;GAGG;AACH,eAAO,MAAM,qBAAqB,6OAYxB,CAAC;AAEX,uEAAuE;AACvE,eAAO,MAAM,uBAAuB;;;;;;;;;CAEnC,CAAC;AAEF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GAC9C;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E,uFAAuF;AACvF,wBAAsB,cAAc,CAClC,MAAM,EAAE,cAAc,EACtB,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAO,GAC/C,OAAO,CAAC,cAAc,CAAC,CAyNzB;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EACnF,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAA;CAAO,GAChC,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAQxE"}
|
package/dist/audit-job-setup.js
CHANGED
|
@@ -21,10 +21,12 @@
|
|
|
21
21
|
*
|
|
22
22
|
* - `roles/storage.objectCreator` on the audit results bucket — create
|
|
23
23
|
* only: it can neither read results back nor overwrite one;
|
|
24
|
-
* -
|
|
25
|
-
*
|
|
26
|
-
*
|
|
27
|
-
*
|
|
24
|
+
* - `roles/storage.objectViewer` on the staging bucket: it serves the
|
|
25
|
+
* staged build to its own browser from the served build slot, which
|
|
26
|
+
* holds the complete build (#1330, admin-core quality/staged-origin.ts),
|
|
27
|
+
* so Lighthouse never goes through the staging gateway (#875). Both
|
|
28
|
+
* providers since #1330 (gcp-firebase had no bucket and audited the
|
|
29
|
+
* preview channel before); no read on the static bucket any more;
|
|
28
30
|
* - `roles/logging.logWriter`.
|
|
29
31
|
*
|
|
30
32
|
* Nothing else: no Secret Manager, no Cloud SQL, and no VPC egress, so the
|
|
@@ -188,18 +190,16 @@ export async function ensureAuditJob(target, deps = {}) {
|
|
|
188
190
|
rmSync(dir, { recursive: true, force: true });
|
|
189
191
|
}
|
|
190
192
|
done.push(`bucket ${resultsUrl} (results deleted after 1 day)`);
|
|
191
|
-
// 3. Bucket grants: the job creates results and
|
|
193
|
+
// 3. Bucket grants: the job creates results and reads the staged build;
|
|
192
194
|
// the admin reads results.
|
|
193
195
|
const bucketGrants = [
|
|
194
196
|
{ bucket: results, member, role: "roles/storage.objectCreator", why: "tasks write results" },
|
|
195
|
-
|
|
196
|
-
|
|
197
|
-
|
|
198
|
-
|
|
199
|
-
|
|
200
|
-
|
|
201
|
-
}))
|
|
202
|
-
: []),
|
|
197
|
+
{
|
|
198
|
+
bucket: gcpBucketName(projectId, env, "staging"),
|
|
199
|
+
member,
|
|
200
|
+
role: "roles/storage.objectViewer",
|
|
201
|
+
why: "tasks serve the staged build to their browser",
|
|
202
|
+
},
|
|
203
203
|
{
|
|
204
204
|
bucket: results,
|
|
205
205
|
member: runSaMember,
|
|
@@ -254,12 +254,7 @@ export async function ensureAuditJob(target, deps = {}) {
|
|
|
254
254
|
const envVars = [
|
|
255
255
|
`CAELO_PROVIDER=${provider}`,
|
|
256
256
|
`CAELO_AUDIT_RESULTS_BUCKET=${results}`,
|
|
257
|
-
|
|
258
|
-
? [
|
|
259
|
-
`CAELO_STAGING_BUCKET=${gcpBucketName(projectId, env, "staging")}`,
|
|
260
|
-
`CAELO_STATIC_BUCKET=${gcpBucketName(projectId, env, "static")}`,
|
|
261
|
-
]
|
|
262
|
-
: []),
|
|
257
|
+
`CAELO_STAGING_BUCKET=${gcpBucketName(projectId, env, "staging")}`,
|
|
263
258
|
];
|
|
264
259
|
const deploy = await run([
|
|
265
260
|
"run",
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"audit-job-setup.js","sourceRoot":"","sources":["../src/audit-job-setup.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC
|
|
1
|
+
{"version":3,"file":"audit-job-setup.js","sourceRoot":"","sources":["../src/audit-job-setup.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,IAAI,aAAa,EAAqB,MAAM,aAAa,CAAC;AACzE,OAAO,EAAqB,SAAS,EAAE,YAAY,EAAc,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EACL,YAAY,EACZ,wBAAwB,EACxB,qBAAqB,EACrB,aAAa,EACb,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEjE,0DAA0D;AAC1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,oDAAoD,CAAC;AAEtF,qEAAqE;AACrE,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAE5C;;;;GAIG;AACH,MAAM,YAAY,GAAG,IAAI,CAAC;AAE1B;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,aAAa;IACb,cAAc;IACd,YAAY;IACZ,YAAY;IACZ,sBAAsB;IACtB,iBAAiB;IACjB,gBAAgB;IAChB,wBAAwB;IACxB,qBAAqB;IACrB,2BAA2B;IAC3B,0BAA0B;CAClB,CAAC;AAEX,uEAAuE;AACvE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;CAC9D,CAAC;AAuBF,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAsB,EACtB,OAA8C,EAAE;IAEhD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACjE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IACpD,MAAM,OAAO,GAAG,aAAa,SAAS,EAAE,CAAC;IACzC,MAAM,EAAE,GAAG,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,kBAAkB,EAAE,EAAE,CAAC;IACtC,MAAM,WAAW,GAAG,kBAAkB,sBAAsB,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC;IAC/E,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,QAAQ,OAAO,EAAE,CAAC;IACrC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,CAAe,EAAkB,EAAE,CAAC,CAAC;QAC/D,EAAE,EAAE,KAAK;QACT,IAAI;QACJ,KAAK,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;KACrC,CAAC,CAAC;IAEH,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QACxD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI;YACJ,KAAK,EAAE,uDAAuD,MAAM,CAAC,aAAa,EAAE;SACrF,CAAC;IACJ,CAAC;IACD,IACE,MAAM,CAAC,WAAW,KAAK,SAAS;QAChC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,WAAW,GAAG,CAAC,IAAI,MAAM,CAAC,WAAW,GAAG,EAAE,CAAC,EAC5F,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI;YACJ,KAAK,EAAE,6DAA6D,MAAM,CAAC,WAAW,EAAE;SACzF,CAAC;IACJ,CAAC;IAED,oCAAoC;IACpC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;QACzB,KAAK;QACL,kBAAkB;QAClB,UAAU;QACV,EAAE;QACF,OAAO;QACP,uBAAuB;KACxB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;YACvB,KAAK;YACL,kBAAkB;YAClB,QAAQ;YACR,qBAAqB,CAAC,GAAG,CAAC;YAC1B,oCAAoC;YACpC,iIAAiI;YACjI,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;IAEnC,+DAA+D;IAC/D,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACzF,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,+BAA+B,SAAS,EAAE,EAAE,KAAK,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/C,CAAC;SACE,IAAI,EAAE;SACN,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACtB,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC;YACxB,SAAS;YACT,SAAS;YACT,QAAQ;YACR,UAAU;YACV,OAAO;YACP,cAAc,MAAM,EAAE;YACtB,kCAAkC;YAClC,+BAA+B;YAC/B,4BAA4B;YAC5B,0BAA0B;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI;gBACJ,KAAK,EAAE,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;oBAC/C,CAAC,CAAC,GAAG,UAAU,0CAA0C,SAAS,6DAA6D;oBAC/H,CAAC,CAAC,UAAU,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;aACrD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,wEAAwE;IACxE,mCAAmC;IACnC,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACzC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC;YAC1B,SAAS;YACT,SAAS;YACT,QAAQ;YACR,UAAU;YACV,OAAO;YACP,oBAAoB,IAAI,EAAE;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,wBAAwB,UAAU,EAAE,EAAE,SAAS,CAAC,CAAC;IAClF,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,UAAU,UAAU,gCAAgC,CAAC,CAAC;IAEhE,wEAAwE;IACxE,8BAA8B;IAC9B,MAAM,YAAY,GAAoE;QACpF,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,EAAE,GAAG,EAAE,qBAAqB,EAAE;QAC5F;YACE,MAAM,EAAE,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC;YAChD,MAAM;YACN,IAAI,EAAE,4BAA4B;YAClC,GAAG,EAAE,+CAA+C;SACrD;QACD;YACE,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,WAAW;YACnB,IAAI,EAAE,4BAA4B;YAClC,GAAG,EAAE,6BAA6B;SACnC;KACF,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,SAAS;YACT,SAAS;YACT,wBAAwB;YACxB,QAAQ,CAAC,CAAC,MAAM,EAAE;YAClB,YAAY,CAAC,CAAC,MAAM,EAAE;YACtB,UAAU,CAAC,CAAC,IAAI,EAAE;YAClB,uEAAuE;YACvE,iEAAiE;YACjE,kBAAkB;YAClB,OAAO;YACP,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;QAC5E,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED,WAAW;IACX,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC;QACvB,UAAU;QACV,wBAAwB;QACxB,SAAS;QACT,YAAY,MAAM,EAAE;QACpB,gCAAgC;QAChC,kBAAkB;QAClB,SAAS;QACT,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,6CAA6C,EAAE,IAAI,CAAC,CAAC;IAC/E,IAAI,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;IAE/D,qEAAqE;IACrE,wEAAwE;IACxE,yCAAyC;IACzC,IAAI,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IACrC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9E,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,GAAG,KAAK,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;QAC1F,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI;YAAE,WAAW,GAAG,yBAAyB,CAAC;IACvE,CAAC;IACD,MAAM,OAAO,GAAG;QACd,kBAAkB,QAAQ,EAAE;QAC5B,8BAA8B,OAAO,EAAE;QACvC,wBAAwB,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,EAAE;KACnE,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;QACvB,KAAK;QACL,MAAM;QACN,QAAQ;QACR,GAAG;QACH,WAAW,MAAM,CAAC,aAAa,EAAE;QACjC,YAAY,MAAM,EAAE;QACpB,OAAO;QACP,qBAAqB,EAAE,EAAE;QACzB,eAAe;QACf,gBAAgB,iBAAiB,EAAE;QACnC,kBAAkB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACrC,iBAAiB;QACjB,kBAAkB,YAAY,EAAE;QAChC,oEAAoE;QACpE,SAAS;QACT,cAAc;QACd,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,iBAAiB,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,SAAS;KACV,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,cAAc,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IACzD,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,KAAK,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IAEjF,kEAAkE;IAClE,KAAK,MAAM,IAAI,IAAI,CAAC,qCAAqC,EAAE,kBAAkB,CAAC,EAAE,CAAC;QAC/E,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,KAAK;YACL,MAAM;YACN,wBAAwB;YACxB,GAAG;YACH,YAAY,MAAM,EAAE;YACpB,OAAO;YACP,YAAY,WAAW,EAAE;YACzB,UAAU,IAAI,EAAE;YAChB,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,mBAAmB,IAAI,OAAO,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,OAAO,GAAG,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAmF,EACnF,OAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC,CAAC;IACnE,IAAI,CAAC,GAAG;QACN,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,mEAAmE;SAC3E,CAAC;IACJ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;AAC9C,CAAC"}
|
package/dist/caddy.d.ts
CHANGED
|
@@ -19,7 +19,8 @@ export interface CaddyfileSpec {
|
|
|
19
19
|
readonly ownerEmail: string;
|
|
20
20
|
readonly tls: CaddyTlsMode;
|
|
21
21
|
readonly publicSiteRoot: string;
|
|
22
|
-
|
|
22
|
+
/** #1330 — `host:port` of the staging gateway as Caddy reaches it (Compose: `caelo-staging-gateway:8091`). */
|
|
23
|
+
readonly stagingGatewayUpstream: string;
|
|
23
24
|
/** `host:port` of the admin as Caddy reaches it (Compose: `caelo-admin:5173`). */
|
|
24
25
|
readonly adminUpstream: string;
|
|
25
26
|
/** `host:port` of the API gateway as Caddy reaches it (Compose: `caelo-gateway:8090`). */
|
package/dist/caddy.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"caddy.d.ts","sourceRoot":"","sources":["../src/caddy.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"caddy.d.ts","sourceRoot":"","sources":["../src/caddy.ts"],"names":[],"mappings":"AA4EA,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,GAAG,KAAK,CAAC;IAC1C,QAAQ,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,CAAC;CACxC;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,UAAU,CAAC;AAE/C,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,8GAA8G;IAC9G,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,kFAAkF;IAClF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,0FAA0F;IAC1F,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,oGAAoG;IACpG,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;CAClD;AAED,uFAAuF;AACvF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,eAAe,EAAE,CAM9F;AAYD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,GAAG,MAAM,GAAG,IAAI,CAOzF;AAWD,iFAAiF;AACjF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CA6C7D"}
|
package/dist/caddy.js
CHANGED
|
@@ -14,6 +14,9 @@
|
|
|
14
14
|
* # MCP-Auth-Proxy on its own host, never the site's origin)
|
|
15
15
|
* # public → /api/* → <gatewayUpstream>; everything else is the
|
|
16
16
|
* # static site (try_files + file_server, 404 → /404.html)
|
|
17
|
+
* # staging → reverse_proxy <stagingGatewayUpstream> for every path
|
|
18
|
+
* # (#1330: the staging gateway serves the staged build
|
|
19
|
+
* # behind the staging gate, and staging's own /api)
|
|
17
20
|
* }
|
|
18
21
|
*
|
|
19
22
|
* Upstreams are `host:port` as seen FROM CADDY. In the Compose install
|
|
@@ -26,7 +29,10 @@
|
|
|
26
29
|
* run in CI) — issue #566 shipped a `try_files` nested inside
|
|
27
30
|
* `file_server { }`, which Caddy 2.11 refuses, so no vhost came up.
|
|
28
31
|
*
|
|
29
|
-
* Staging vhosts force `X-Robots-Tag: noindex`.
|
|
32
|
+
* Staging vhosts force `X-Robots-Tag: noindex`. Caddy serves no staging
|
|
33
|
+
* file itself (#1330): the staging gateway mounts the staged builds
|
|
34
|
+
* read-only, and Caddy has no other path to them, so nothing reaches a
|
|
35
|
+
* staged page without passing the gate.
|
|
30
36
|
*
|
|
31
37
|
* Public vhosts import the redirect snippet of the build they serve
|
|
32
38
|
* (`_redirects.caddy`, #587); the Caddy container reloads itself when a
|
|
@@ -124,7 +130,7 @@ function assertSafeCaddyToken(label, value, kind) {
|
|
|
124
130
|
export function generateCaddyfile(spec) {
|
|
125
131
|
assertSafeCaddyToken("ownerEmail", spec.ownerEmail, "token");
|
|
126
132
|
assertSafeCaddyToken("publicSiteRoot", spec.publicSiteRoot, "token");
|
|
127
|
-
assertSafeCaddyToken("
|
|
133
|
+
assertSafeCaddyToken("stagingGatewayUpstream", spec.stagingGatewayUpstream, "token");
|
|
128
134
|
assertSafeCaddyToken("adminUpstream", spec.adminUpstream, "token");
|
|
129
135
|
assertSafeCaddyToken("gatewayUpstream", spec.gatewayUpstream, "token");
|
|
130
136
|
assertSafeCaddyToken("mcpAuthProxyUpstream", spec.mcpAuthProxyUpstream, "token");
|
|
@@ -174,12 +180,24 @@ function vhost(d, spec) {
|
|
|
174
180
|
header X-Content-Type-Options "${NOSNIFF}"
|
|
175
181
|
reverse_proxy ${spec.mcpAuthProxyUpstream}
|
|
176
182
|
}
|
|
183
|
+
`;
|
|
184
|
+
}
|
|
185
|
+
if (d.env === "staging") {
|
|
186
|
+
// #1330 — every path to the staging gateway: it runs the gate first and
|
|
187
|
+
// serves the staged build and staging's /api itself. The #891 security
|
|
188
|
+
// headers stay on as a second layer over the gateway's own.
|
|
189
|
+
return `${d.hostname} {${noindex}
|
|
190
|
+
header X-Content-Type-Options "${NOSNIFF}"
|
|
191
|
+
@svg path *.svg
|
|
192
|
+
header @svg Content-Security-Policy "${SVG_DOCUMENT_CSP}"
|
|
193
|
+
reverse_proxy ${spec.stagingGatewayUpstream}
|
|
194
|
+
}
|
|
177
195
|
`;
|
|
178
196
|
}
|
|
179
197
|
// public — API routes go to the gateway, the rest is the static site.
|
|
180
198
|
// `try_files` is its own directive (a rewrite), never a file_server
|
|
181
199
|
// subdirective (#566).
|
|
182
|
-
const root =
|
|
200
|
+
const root = spec.publicSiteRoot;
|
|
183
201
|
// #587 — the redirects table of the build this vhost serves.
|
|
184
202
|
return `${d.hostname} {${noindex}
|
|
185
203
|
root * ${root}
|
package/dist/caddy.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"caddy.js","sourceRoot":"","sources":["../src/caddy.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC
|
|
1
|
+
{"version":3,"file":"caddy.js","sourceRoot":"","sources":["../src/caddy.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AAEH,OAAO,EACL,2BAA2B,EAC3B,oBAAoB,EACpB,uBAAuB,EACvB,OAAO,EACP,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAoC3B,uFAAuF;AACvF,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO,SAAS,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,OAAO,MAAM,EAAE,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,aAAqB;IACzE,OAAO;QACL,EAAE,QAAQ,EAAE,mBAAmB,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE;QAC3E,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE;QACvD,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE;KAC5D,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAG,cAAc,CAAC;AAC7C,MAAM,uBAAuB,GAAG,eAAe,CAAC;AAEhD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,IAAyB;IACxE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,qBAAqB,CAAC;IACpF,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,2DAA2D,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC1G,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa,EAAE,KAAa,EAAE,IAAyB;IACnF,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,sBAAsB,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,OAAO,4FAA4F,CAC9J,CAAC;IACJ,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,iBAAiB,CAAC,IAAmB;IACnD,oBAAoB,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC7D,oBAAoB,CAAC,gBAAgB,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACrE,oBAAoB,CAAC,wBAAwB,EAAE,IAAI,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAC;IACrF,oBAAoB,CAAC,eAAe,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACnE,oBAAoB,CAAC,iBAAiB,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IACvE,oBAAoB,CAAC,sBAAsB,EAAE,IAAI,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC;IAEjF,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,oBAAoB,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACxD,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,oEAAoE;YACpE,4DAA4D;YAC5D,MAAM,IAAI,KAAK,CACb,cAAc,CAAC,CAAC,QAAQ,iFAAiF,CAC1G,CAAC;QACJ,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,kBAAkB;IAClB,MAAM,CAAC,IAAI,CAAC;UACJ,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE;;CAE3E,CAAC,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9B,CAAC;IAED,oEAAoE;IACpE,8DAA8D;IAC9D,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC;;;kBAGE,IAAI,CAAC,aAAa;;CAEnC,CAAC,CAAC;IACD,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,KAAK,CAAC,CAAkB,EAAE,IAAmB;IACpD,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO;kBAClB,IAAI,CAAC,aAAa;;CAEnC,CAAC;IACA,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACrB,sEAAsE;QACtE,OAAO,GAAG,CAAC,CAAC,QAAQ;;mCAEW,OAAO;kBACxB,IAAI,CAAC,oBAAoB;;CAE1C,CAAC;IACA,CAAC;IACD,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACxB,wEAAwE;QACxE,uEAAuE;QACvE,4DAA4D;QAC5D,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO;mCACD,OAAO;;yCAED,gBAAgB;kBACvC,IAAI,CAAC,sBAAsB;;CAE5C,CAAC;IACA,CAAC;IACD,sEAAsE;IACtE,oEAAoE;IACpE,uBAAuB;IACvB,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC;IACjC,6DAA6D;IAC7D,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO;WACvB,IAAI;IACX,oBAAoB,CAAC,IAAI,CAAC;;iCAEG,2BAA2B;;;0CAGlB,uBAAuB;;;mCAG9B,OAAO;;yCAED,gBAAgB;;oBAErC,IAAI,CAAC,eAAe;;;;;;;;;;;CAWvC,CAAC;AACF,CAAC"}
|