@caelo-cms/provisioning 0.11.8 → 0.11.10

package/dist/mcp-auth-proxy-setup.js

@@ -0,0 +1,280 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * #1328 — the Cloud Run services an upgrade to the MCP-Auth-Proxy release
+ * must find before it plans its rolls, created through gcloud on installs
+ * whose stack predates them (`cms-provision upgrade` and the converge job
+ * never run Pulumi). Run as the operator's or the provisioner's identity,
+ * before the upgrade's plan: each step only ADDS a service, account or grant
+ * that serves no traffic yet, so a failure leaves the running install as it
+ * was (converge release 1 of the hardening plan, #763, is additive).
+ *
+ *   - Both providers: the proxy's own service account and its
+ *     `secretAccessor` on exactly its two secrets — before any service runs
+ *     as it, because Cloud Run checks a revision's secret access at deploy.
+ *   - `gcp-firebase` (E13 a): the visitor gateway's new service
+ *     `caelo-<env>-data-gateway`, a copy of the service that was the gateway
+ *     (same image, env, secrets, VPC, account), so the app-roll can then roll
+ *     it like any other service and turn the old one into the proxy. Copied,
+ *     not built from the contract, so the health baseline sees the release
+ *     that serves today on all three services.
+ *   - `gcp`: the proxy's own service `caelo-<env>-mcp-auth-proxy`, deployed
+ *     with the release's proxy image (there is no older proxy to copy). Its
+ *     load-balancer part is remote-mcp.ts `ensureRemoteMcpEdge`, later in
+ *     the converge.
+ *
+ * Fresh installs get the same from their stack (gcp-firebase) or from the
+ * wizard after the first `pulumi up` (gcp, like the jobs: CLI-owned).
+ */
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { gcloud as defaultGcloud } from "./gcloud.js";
+import { gcpSecretId, mcpAuthProxyServiceAccountEmail } from "./gcp-names.js";
+import { ensureMcpAuthProxyServiceAccount } from "./runtime-secrets.js";
+import { cloudRunServicePrefix, DEFAULT_MCP_AUTH_PROXY_MAX_INSTANCES, fixedCloudRunServiceName, MCP_AUTH_PROXY_TIMEOUT_SECONDS, mcpAuthProxyEnvContract, OPERATOR_OAUTH_CLIENT_FILE, remoteMcpIdentity, remoteMcpIdentityEnv, secretFilePath, serviceSecrets, } from "./stack-contract.js";
+import { listFlag } from "./stack-converge.js";
+import { lookupFailure, resolveGcpResourceName } from "./upgrade/gcp-lookup.js";
+const NOT_FOUND = /NOT_FOUND|not found|does not exist|could not be found/i;
+/** Ensure everything {@link ReleaseServicesTarget} needs; outcomes in order, failures included. */
+export async function ensureReleaseServices(target, deps = {}) {
+    const run = deps.run ?? defaultGcloud;
+    const outcomes = [];
+    const account = await ensureMcpAuthProxyServiceAccount(target, { run });
+    outcomes.push(account);
+    if (account.status === "failed")
+        return outcomes;
+    outcomes.push(...(await ensureMcpAuthProxySecretAccess(target, run)));
+    if (outcomes.some((o) => o.status === "failed"))
+        return outcomes;
+    outcomes.push(target.provider === "gcp-firebase"
+        ? await ensureDataGatewayService(target, run, deps.writeSpecFile ?? writeTempSpec)
+        : await ensureMcpAuthProxyServiceGcp(target, run));
+    return outcomes;
+}
+/**
+ * `secretAccessor` for the proxy's account on each secret it reads
+ * (stack-contract.ts `serviceSecrets("mcp-auth-proxy")`) and nothing else.
+ * `add-iam-policy-binding` is idempotent; the stack invariants ensure the
+ * same bindings again later in the converge.
+ */
+async function ensureMcpAuthProxySecretAccess(target, run) {
+    const member = `serviceAccount:${mcpAuthProxyServiceAccountEmail(target.projectId, target.env)}`;
+    const outcomes = [];
+    for (const secret of serviceSecrets("mcp-auth-proxy")) {
+        const id = `secretAccessor → MCP-Auth-Proxy on ${secret}`;
+        const r = await run([
+            "secrets",
+            "add-iam-policy-binding",
+            gcpSecretId(target.env, secret),
+            `--project=${target.projectId}`,
+            `--member=${member}`,
+            "--role=roles/secretmanager.secretAccessor",
+            "--condition=None",
+            "--quiet",
+        ]);
+        outcomes.push(r.ok ? { id, status: "present" } : { id, status: "failed", error: r.stderr.trim() });
+    }
+    return outcomes;
+}
+// ===========================================================================
+// gcp-firebase: the data gateway
+// ===========================================================================
+/**
+ * The Knative service spec of `serviceJson` (`gcloud run services describe
+ * --format=json`) as a new service named `name`, for `gcloud run services
+ * replace`: the configuration only — image, env, secrets, volumes, VPC,
+ * scaling, account, ingress — without the source's identity (uid, revision
+ * names, status), its tool stamps or its traffic pins.
+ *
+ * @throws when the source is not a gateway image (a re-run must never copy
+ *   the MCP-Auth-Proxy the old service became)
+ */
+export function cloneServiceSpec(serviceJson, name) {
+    const svc = JSON.parse(serviceJson);
+    const image = svc.spec?.template?.spec?.containers?.[0]?.image ?? "";
+    if (!/\/gateway[@:]/.test(image)) {
+        throw new Error(`the source service runs ${image || "no image"}, not a Caelo gateway image — the visitor gateway cannot be copied from it`);
+    }
+    const keepLabels = (labels) => Object.fromEntries(Object.entries(labels ?? {}).filter(([k]) => !k.startsWith("cloud.googleapis.com/") &&
+        !k.startsWith("run.googleapis.com/") &&
+        !k.startsWith("client.knative.dev/") &&
+        !k.startsWith("serving.knative.dev/") &&
+        !k.startsWith("goog-")));
+    // Service-level: only the settings; the rest are server stamps.
+    const KEEP_SERVICE_ANNOTATIONS = [
+        "run.googleapis.com/ingress",
+        "run.googleapis.com/launch-stage",
+    ];
+    const annotations = Object.fromEntries(Object.entries(svc.metadata?.annotations ?? {}).filter(([k]) => KEEP_SERVICE_ANNOTATIONS.includes(k)));
+    const templateAnnotations = Object.fromEntries(Object.entries(svc.spec?.template?.metadata?.annotations ?? {}).filter(([k]) => k !== "run.googleapis.com/client-name" && k !== "run.googleapis.com/client-version"));
+    return JSON.stringify({
+        apiVersion: svc.apiVersion ?? "serving.knative.dev/v1",
+        kind: svc.kind ?? "Service",
+        metadata: { name, labels: keepLabels(svc.metadata?.labels), annotations },
+        spec: {
+            template: {
+                metadata: {
+                    labels: keepLabels(svc.spec?.template?.metadata?.labels),
+                    annotations: templateAnnotations,
+                },
+                spec: svc.spec?.template?.spec ?? {},
+            },
+            traffic: [{ percent: 100, latestRevision: true }],
+        },
+    });
+}
+function writeTempSpec(json) {
+    const dir = mkdtempSync(join(tmpdir(), "caelo-service-"));
+    const path = join(dir, "service.json");
+    writeFileSync(path, json, { mode: 0o600 });
+    return { path, cleanup: () => rmSync(dir, { recursive: true, force: true }) };
+}
+/**
+ * The gcp-firebase data gateway (`caelo-<env>-data-gateway`): present, or
+ * created as a copy of the `caelo-<env>-gateway*` service. Its public invoker
+ * and the admin's `run.viewer` (the Firebase rewrite) follow from the stack
+ * invariants later in the converge.
+ */
+async function ensureDataGatewayService(target, run, writeSpecFile) {
+    const name = fixedCloudRunServiceName(target.provider, target.env, "gateway");
+    const id = `Cloud Run service ${name} (the visitor gateway)`;
+    const where = [`--region=${target.region}`, `--project=${target.projectId}`];
+    const existing = await run([
+        "run",
+        "services",
+        "describe",
+        name,
+        ...where,
+        "--format=value(metadata.name)",
+    ]);
+    if (existing.ok)
+        return { id, status: "present" };
+    if (!NOT_FOUND.test(existing.stderr)) {
+        return { id, status: "failed", error: existing.stderr.trim() };
+    }
+    // The source: the service that was the gateway and becomes the proxy.
+    const sourcePrefix = cloudRunServicePrefix(target.provider, target.env, "mcp-auth-proxy");
+    const source = await resolveGcpResourceName(run, "run-service", sourcePrefix, target.projectId, target.region);
+    if (source.status !== "found") {
+        return {
+            id,
+            status: "failed",
+            error: lookupFailure(source, `${sourcePrefix}* Cloud Run service`, "operator"),
+        };
+    }
+    const described = await run([
+        "run",
+        "services",
+        "describe",
+        source.name,
+        ...where,
+        "--format=json",
+    ]);
+    if (!described.ok) {
+        return { id, status: "failed", error: `describe ${source.name}: ${described.stderr.trim()}` };
+    }
+    let spec;
+    try {
+        spec = cloneServiceSpec(described.stdout, name);
+    }
+    catch (e) {
+        return {
+            id,
+            status: "failed",
+            error: `${e instanceof Error ? e.message : String(e)}. Re-run the installer (it creates ${name} from the stack), then upgrade again.`,
+        };
+    }
+    const file = writeSpecFile(spec);
+    try {
+        const replaced = await run(["run", "services", "replace", file.path, ...where, "--quiet"]);
+        return replaced.ok
+            ? { id, status: "applied", detail: `copied from ${source.name}` }
+            : { id, status: "failed", error: replaced.stderr.trim() };
+    }
+    finally {
+        file.cleanup();
+    }
+}
+// ===========================================================================
+// gcp: the proxy's service
+// ===========================================================================
+/**
+ * The full env the `gcp` proxy is deployed with: its contract plus the
+ * remote-MCP identity it can derive without a lookup (its public origin is
+ * the site's host, the admin's is `admin.<domain>`). The IAP audience is
+ * the admin's alone.
+ */
+function gcpProxyEnv(target) {
+    const identity = remoteMcpIdentityEnv(remoteMcpIdentity({
+        provider: "gcp",
+        domain: target.domain,
+        // Only the admin's audience uses these; the proxy's env does not.
+        projectNumber: "0",
+        adminBackendServiceId: "0",
+    }))["mcp-auth-proxy"];
+    return [...mcpAuthProxyEnvContract({ provider: "gcp", env: target.env }), ...identity];
+}
+/**
+ * The `gcloud run deploy` argv of the `gcp` proxy: load-balancer-only
+ * ingress (its two hops, stack-contract.ts MCP_AUTH_PROXY_TRUSTED_PROXY_HOPS),
+ * invokable without a Google identity (MCP clients have none), request-based
+ * CPU, no VPC, and its Google sign-in client file as a secret volume.
+ */
+export function gcpProxyDeployArgs(target) {
+    const name = fixedCloudRunServiceName("gcp", target.env, "mcp-auth-proxy");
+    const env = gcpProxyEnv(target);
+    const plain = env.flatMap((e) => ("value" in e ? [`${e.name}=${e.value}`] : []));
+    const secrets = [
+        ...env.flatMap((e) => "valueSource" in e
+            ? [`${e.name}=${e.valueSource.secretKeyRef.secret}:${e.valueSource.secretKeyRef.version}`]
+            : []),
+        `${secretFilePath(OPERATOR_OAUTH_CLIENT_FILE)}=${gcpSecretId(target.env, OPERATOR_OAUTH_CLIENT_FILE.secret)}:${OPERATOR_OAUTH_CLIENT_FILE.version}`,
+    ];
+    return [
+        "run",
+        "deploy",
+        name,
+        `--image=${target.mcpAuthProxyImageRef}`,
+        `--region=${target.region}`,
+        `--project=${target.projectId}`,
+        `--service-account=${mcpAuthProxyServiceAccountEmail(target.projectId, target.env)}`,
+        "--ingress=internal-and-cloud-load-balancing",
+        "--allow-unauthenticated",
+        "--min-instances=0",
+        `--max-instances=${DEFAULT_MCP_AUTH_PROXY_MAX_INSTANCES}`,
+        "--cpu=1",
+        "--memory=512Mi",
+        "--cpu-throttling",
+        `--timeout=${MCP_AUTH_PROXY_TIMEOUT_SECONDS}`,
+        listFlag("--set-env-vars", plain),
+        listFlag("--set-secrets", secrets),
+        "--quiet",
+    ];
+}
+/**
+ * The `gcp` proxy service: present, or deployed. Deployed once; the
+ * app-roll moves it onto each release's image after that.
+ */
+export async function ensureMcpAuthProxyServiceGcp(target, run) {
+    const name = fixedCloudRunServiceName("gcp", target.env, "mcp-auth-proxy");
+    const id = `Cloud Run service ${name} (the MCP-Auth-Proxy)`;
+    const existing = await run([
+        "run",
+        "services",
+        "describe",
+        name,
+        `--region=${target.region}`,
+        `--project=${target.projectId}`,
+        "--format=value(metadata.name)",
+    ]);
+    if (existing.ok)
+        return { id, status: "present" };
+    if (!NOT_FOUND.test(existing.stderr)) {
+        return { id, status: "failed", error: existing.stderr.trim() };
+    }
+    const deployed = await run(gcpProxyDeployArgs(target));
+    return deployed.ok
+        ? { id, status: "applied" }
+        : { id, status: "failed", error: deployed.stderr.trim() };
+}
+//# sourceMappingURL=mcp-auth-proxy-setup.js.map

package/dist/mcp-auth-proxy-setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-auth-proxy-setup.js","sourceRoot":"","sources":["../src/mcp-auth-proxy-setup.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,WAAW,EAAE,+BAA+B,EAAE,MAAM,gBAAgB,CAAC;AAC9E,OAAO,EAAsB,gCAAgC,EAAE,MAAM,sBAAsB,CAAC;AAC5F,OAAO,EAEL,qBAAqB,EACrB,oCAAoC,EACpC,wBAAwB,EAExB,8BAA8B,EAC9B,uBAAuB,EACvB,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,cAAc,EACd,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAuBhF,MAAM,SAAS,GAAG,wDAAwD,CAAC;AAE3E,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAA6B,EAC7B,OAA4B,EAAE;IAE9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,MAAM,gCAAgC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACxE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvB,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACjD,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,8BAA8B,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACtE,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IACjE,QAAQ,CAAC,IAAI,CACX,MAAM,CAAC,QAAQ,KAAK,cAAc;QAChC,CAAC,CAAC,MAAM,wBAAwB,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC;QAClF,CAAC,CAAC,MAAM,4BAA4B,CAAC,MAAM,EAAE,GAAG,CAAC,CACpD,CAAC;IACF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,8BAA8B,CAC3C,MAAwD,EACxD,GAAiB;IAEjB,MAAM,MAAM,GAAG,kBAAkB,+BAA+B,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IACjG,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,KAAK,MAAM,MAAM,IAAI,cAAc,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACtD,MAAM,EAAE,GAAG,sCAAsC,MAAM,EAAE,CAAC;QAC1D,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC;YAClB,SAAS;YACT,wBAAwB;YACxB,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC;YAC/B,aAAa,MAAM,CAAC,SAAS,EAAE;YAC/B,YAAY,MAAM,EAAE;YACpB,2CAA2C;YAC3C,kBAAkB;YAClB,SAAS;SACV,CAAC,CAAC;QACH,QAAQ,CAAC,IAAI,CACX,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAAmB,EAAE,IAAY;IAChE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAUjC,CAAC;IACF,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;IACrE,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,2BAA2B,KAAK,IAAI,UAAU,4EAA4E,CAC3H,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,MAA0C,EAAE,EAAE,CAChE,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CACjC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CACN,CAAC,CAAC,CAAC,UAAU,CAAC,uBAAuB,CAAC;QACtC,CAAC,CAAC,CAAC,UAAU,CAAC,qBAAqB,CAAC;QACpC,CAAC,CAAC,CAAC,UAAU,CAAC,qBAAqB,CAAC;QACpC,CAAC,CAAC,CAAC,UAAU,CAAC,sBAAsB,CAAC;QACrC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CACzB,CACF,CAAC;IACJ,gEAAgE;IAChE,MAAM,wBAAwB,GAAG;QAC/B,4BAA4B;QAC5B,iCAAiC;KAClC,CAAC;IACF,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CACpC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7D,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CACrC,CACF,CAAC;IACF,MAAM,mBAAmB,GAAG,MAAM,CAAC,WAAW,CAC5C,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,MAAM,CACpE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,gCAAgC,IAAI,CAAC,KAAK,mCAAmC,CAC7F,CACF,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,wBAAwB;QACtD,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,SAAS;QAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE;QACzE,IAAI,EAAE;YACJ,QAAQ,EAAE;gBACR,QAAQ,EAAE;oBACR,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC;oBACxD,WAAW,EAAE,mBAAmB;iBACjC;gBACD,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE;aACrC;YACD,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;SAClD;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IACvC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAChF,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,wBAAwB,CACrC,MAA6B,EAC7B,GAAiB,EACjB,aAAgE;IAEhE,MAAM,IAAI,GAAG,wBAAwB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,CAAW,CAAC;IACxF,MAAM,EAAE,GAAG,qBAAqB,IAAI,wBAAwB,CAAC;IAC7D,MAAM,KAAK,GAAG,CAAC,YAAY,MAAM,CAAC,MAAM,EAAE,EAAE,aAAa,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;QACzB,KAAK;QACL,UAAU;QACV,UAAU;QACV,IAAI;QACJ,GAAG,KAAK;QACR,+BAA+B;KAChC,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAClD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;IACjE,CAAC;IACD,sEAAsE;IACtE,MAAM,YAAY,GAAG,qBAAqB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,MAAM,sBAAsB,CACzC,GAAG,EACH,aAAa,EACb,YAAY,EACZ,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,MAAM,CACd,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC9B,OAAO;YACL,EAAE;YACF,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,aAAa,CAAC,MAAM,EAAE,GAAG,YAAY,qBAAqB,EAAE,UAAU,CAAC;SAC/E,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC;QAC1B,KAAK;QACL,UAAU;QACV,UAAU;QACV,MAAM,CAAC,IAAI;QACX,GAAG,KAAK;QACR,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IAChG,CAAC;IACD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,gBAAgB,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,EAAE;YACF,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,sCAAsC,IAAI,uCAAuC;SACtI,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;QAC3F,OAAO,QAAQ,CAAC,EAAE;YAChB,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,MAAM,CAAC,IAAI,EAAE,EAAE;YACjE,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;IAC9D,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E;;;;;GAKG;AACH,SAAS,WAAW,CAAC,MAAqD;IACxE,MAAM,QAAQ,GAAG,oBAAoB,CACnC,iBAAiB,CAAC;QAChB,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,kEAAkE;QAClE,aAAa,EAAE,GAAG;QAClB,qBAAqB,EAAE,GAAG;KAC3B,CAAC,CACH,CAAC,gBAAgB,CAAC,CAAC;IACpB,OAAO,CAAC,GAAG,uBAAuB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC;AACzF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAA6B;IAC9D,MAAM,IAAI,GAAG,wBAAwB,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,gBAAgB,CAAW,CAAC;IACrF,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjF,MAAM,OAAO,GAAG;QACd,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CACnB,aAAa,IAAI,CAAC;YAChB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC,MAAM,IAAI,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YAC1F,CAAC,CAAC,EAAE,CACP;QACD,GAAG,cAAc,CAAC,0BAA0B,CAAC,IAAI,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,0BAA0B,CAAC,MAAM,CAAC,IAAI,0BAA0B,CAAC,OAAO,EAAE;KACpJ,CAAC;IACF,OAAO;QACL,KAAK;QACL,QAAQ;QACR,IAAI;QACJ,WAAW,MAAM,CAAC,oBAAoB,EAAE;QACxC,YAAY,MAAM,CAAC,MAAM,EAAE;QAC3B,aAAa,MAAM,CAAC,SAAS,EAAE;QAC/B,qBAAqB,+BAA+B,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE;QACpF,6CAA6C;QAC7C,yBAAyB;QACzB,mBAAmB;QACnB,mBAAmB,oCAAoC,EAAE;QACzD,SAAS;QACT,gBAAgB;QAChB,kBAAkB;QAClB,aAAa,8BAA8B,EAAE;QAC7C,QAAQ,CAAC,gBAAgB,EAAE,KAAK,CAAC;QACjC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;QAClC,SAAS;KACV,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,MAA6B,EAC7B,GAAiB;IAEjB,MAAM,IAAI,GAAG,wBAAwB,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,gBAAgB,CAAW,CAAC;IACrF,MAAM,EAAE,GAAG,qBAAqB,IAAI,uBAAuB,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;QACzB,KAAK;QACL,UAAU;QACV,UAAU;QACV,IAAI;QACJ,YAAY,MAAM,CAAC,MAAM,EAAE;QAC3B,aAAa,MAAM,CAAC,SAAS,EAAE;QAC/B,+BAA+B;KAChC,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAClD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;IACjE,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;IACvD,OAAO,QAAQ,CAAC,EAAE;QAChB,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;QAC3B,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;AAC9D,CAAC"}

package/dist/release-manifest.d.ts

@@ -63,10 +63,34 @@ export interface DigestMismatch {
     readonly image: ReleaseImage;
     /** Which digest differs: the image index, or its linux/amd64 manifest (#1025). */
     readonly form: "index" | "platform";
-    /** The manifest's digest; null when the manifest has no platform digests. */
+    /**
+     * The manifest's digest; null when the manifest names none for this form
+     * (no platform digests, or an image the release predates —
+     * OPTIONAL_RELEASE_IMAGES).
+     */
     readonly expected: string | null;
     readonly actual: string | null;
 }
+/** One service's digest-pinned image in the public mirror. */
+export interface ManifestServiceImage {
+    readonly digest: string;
+    readonly imageRef: string;
+}
+/**
+ * The images the app-roll moves the Cloud Run services onto, from the signed
+ * manifest's digests — never a registry tag lookup.
+ *
+ * Fails for a manifest without an MCP-Auth-Proxy digest: such a release
+ * predates #1328, and this code rolls three services, so installing it
+ * would leave the proxy on an image of another release.
+ */
+export declare function manifestServiceImages(m: Pick<ReleaseManifest, "version" | "digests">): {
+    readonly ok: true;
+    readonly images: Readonly<Record<"admin" | "gateway" | "mcp-auth-proxy", ManifestServiceImage>>;
+} | {
+    readonly ok: false;
+    readonly error: string;
+};
 /**
  * Compare the digests a registry resolved for the release's tags with the
  * signed manifest. Only images present in `resolved` (or `resolvedPlatform`)

package/dist/release-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"release-manifest.d.ts","sourceRoot":"","sources":["../src/release-manifest.ts"],"names":[],"mappings":"AA0BA,OAAO,EAML,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,eAAe,EACrB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,mBAAmB,EAAyB,MAAM,6BAA6B,CAAC;AAKzF,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAC3B,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAE/B;;;;GAIG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAErE;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CA2B1D;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAMxE;AAED,mDAAmD;AACnD,MAAM,MAAM,wBAAwB,GAChC,UAAU,GACV,gBAAgB,GAChB,aAAa,GACb,WAAW,GACX,QAAQ,GACR,kBAAkB,CAAC;AAEvB,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,gHAAgH;IAChH,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC;CAC3B;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAA;CAAE,GACzD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAEjE,kFAAkF;AAClF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvE,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5F,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAyBD;;;;;;;GAOG;AACH,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,mBAAiC,GACtC,OAAO,CAAC,qBAAqB,CAAC,CAmChC;AAED,mEAAmE;AACnE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,kFAAkF;IAClF,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,CAAC;IACpC,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,EACtD,gBAAgB,GAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC,CAAM,GAClE,cAAc,EAAE,CAgBlB;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;CACvC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;AAExD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,+FAA+F;IAC/F,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,eAAe,EACzB,SAAS,EAAE,gBAAgB,GAC1B,iBAAiB,CA8BnB"}
+{"version":3,"file":"release-manifest.d.ts","sourceRoot":"","sources":["../src/release-manifest.ts"],"names":[],"mappings":"AA0BA,OAAO,EAML,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,eAAe,EACrB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,mBAAmB,EAGpB,MAAM,6BAA6B,CAAC;AAKrC,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAC3B,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAE/B;;;;GAIG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAErE;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CA2B1D;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAMxE;AAED,mDAAmD;AACnD,MAAM,MAAM,wBAAwB,GAChC,UAAU,GACV,gBAAgB,GAChB,aAAa,GACb,WAAW,GACX,QAAQ,GACR,kBAAkB,CAAC;AAEvB,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,gHAAgH;IAChH,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC;CAC3B;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAA;CAAE,GACzD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAEjE,kFAAkF;AAClF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvE,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5F,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAyBD;;;;;;;GAOG;AACH,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,mBAAiC,GACtC,OAAO,CAAC,qBAAqB,CAAC,CAmChC;AAED,mEAAmE;AACnE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,kFAAkF;IAClF,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,8DAA8D;AAC9D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,SAAS,CAAC,GACjF;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CACvB,MAAM,CAAC,OAAO,GAAG,SAAS,GAAG,gBAAgB,EAAE,oBAAoB,CAAC,CACrE,CAAC;CACH,GACD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAoBjD;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,EACtD,gBAAgB,GAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC,CAAM,GAClE,cAAc,EAAE,CAoBlB;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;CACvC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;AAExD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,+FAA+F;IAC/F,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,eAAe,EACzB,SAAS,EAAE,gBAAgB,GAC1B,iBAAiB,CA8BnB"}

package/dist/release-manifest.js

@@ -24,7 +24,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { fetchReleaseArtifact, isSecurityRelease, parseReleaseManifest, RELEASE_CHANNELS, RELEASE_IMAGES, } from "@caelo-cms/shared";
 import { infraStepsText } from "./infra-contract.js";
-import { RELEASE_OIDC_ISSUER, RELEASE_WORKFLOWS_URL } from "./upgrade/release-images.js";
+import { RELEASE_OIDC_ISSUER, RELEASE_WORKFLOWS_URL, releaseImageRef, } from "./upgrade/release-images.js";
 // The manifest's shape and location live in @caelo-cms/shared (the admin's
 // auto-update scheduler reads them too); re-exported so this module stays
 // the CLI's one import for release manifests.
@@ -160,6 +160,35 @@ export async function fetchVerifiedReleaseManifest(version, deps = defaultDeps)
         return fail(parsed.code, `signed manifest: ${parsed.message}`);
     return { ok: true, manifest: parsed.manifest };
 }
+/**
+ * The images the app-roll moves the Cloud Run services onto, from the signed
+ * manifest's digests — never a registry tag lookup.
+ *
+ * Fails for a manifest without an MCP-Auth-Proxy digest: such a release
+ * predates #1328, and this code rolls three services, so installing it
+ * would leave the proxy on an image of another release.
+ */
+export function manifestServiceImages(m) {
+    const proxy = m.digests["mcp-auth-proxy"];
+    if (!proxy) {
+        return {
+            ok: false,
+            error: `the signed manifest of ${m.version} names no mcp-auth-proxy image: that release predates the MCP-Auth-Proxy (#1328) and cannot be installed by this release's upgrader. Install it from a terminal with the version's own CLI (bunx @caelo-cms/provisioning@${m.version} upgrade).`,
+        };
+    }
+    const image = (slug, digest) => ({
+        digest,
+        imageRef: releaseImageRef(slug, digest),
+    });
+    return {
+        ok: true,
+        images: {
+            admin: image("admin", m.digests.admin),
+            gateway: image("gateway", m.digests.gateway),
+            "mcp-auth-proxy": image("mcp-auth-proxy", proxy),
+        },
+    };
+}
 /**
  * Compare the digests a registry resolved for the release's tags with the
  * signed manifest. Only images present in `resolved` (or `resolvedPlatform`)
@@ -174,9 +203,13 @@ export function compareImageDigests(manifest, resolved, resolvedPlatform = {}) {
     const out = [];
     for (const image of RELEASE_IMAGES) {
         if (image in resolved) {
+            // An image the signed manifest does not name (a release from before
+            // the image existed) can never match: a caller that resolved it is
+            // asking about an image the signature does not cover.
             const actual = resolved[image] ?? null;
-            if (actual !== manifest.digests[image]) {
-                out.push({ image, form: "index", expected: manifest.digests[image], actual });
+            const expected = manifest.digests[image] ?? null;
+            if (actual === null || actual !== expected) {
+                out.push({ image, form: "index", expected, actual });
             }
         }
         if (image in resolvedPlatform) {

package/dist/release-manifest.js.map

@@ -1 +1 @@
-{"version":3,"file":"release-manifest.js","sourceRoot":"","sources":["../src/release-manifest.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,GAIf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAEzF,2EAA2E;AAC3E,0EAA0E;AAC1E,8CAA8C;AAC9C,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAI3B,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,GAAG,6CAA6C,CAAC;AAE7D,4EAA4E;AAC5E,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAE/B;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAAe;IAC3D,OAAO,GAAG,qBAAqB,2BAA2B,OAAO,EAAE,CAAC;AACtE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,CAAS,EAAE,CAAS;IAChD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACvE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACjB,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACjB,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACxD,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC;QAC9B,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACtE,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACxC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B,OAAQ,gBAAsC,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAqB,CAAC,CAAC,CAAC,IAAI,CAAC;AACpG,CAAC;AAgCD,sEAAsE;AACtE,KAAK,UAAU,SAAS,CAAC,IAAuB;IAC9C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAClF,MAAM,MAAM,GAAG,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,QAAQ,EAAE,GAAG;YACb,MAAM,EAAE,gCAAgC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,sDAAsD;SACzI,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,WAAW,GAAwB;IACvC,KAAK,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC;IACtC,MAAM,EAAE,SAAS;CAClB,CAAC;AAEF,SAAS,IAAI,CAAC,IAA8B,EAAE,OAAe;IAC3D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAe,EACf,OAA4B,WAAW;IAEvC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,IAAI,OAAO,2BAA2B,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3D,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;IAE9D,sEAAsE;IACtE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,qCAAqC,CAAC,CAAC;QACpE,MAAM,SAAS,CAAC,YAAY,EAAE,QAAQ,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvE,MAAM,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC;YAC/B,aAAa;YACb,UAAU;YACV,UAAU;YACV,wBAAwB;YACxB,6BAA6B,CAAC,OAAO,CAAC;YACtC,2BAA2B;YAC3B,mBAAmB;YACnB,YAAY;SACb,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CACT,WAAW,EACX,oBAAoB,OAAO,qBAAqB,6BAA6B,CAAC,OAAO,CAAC,iCAAiC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC5J,CAAC;QACJ,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACrE,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,oBAAoB,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;AACjD,CAAC;AAYD;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAyB,EACzB,QAAsD,EACtD,mBAAiE,EAAE;IAEnE,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,IAAI,KAAK,IAAI,QAAQ,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;YACvC,IAAI,MAAM,KAAK,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;QACD,IAAI,KAAK,IAAI,gBAAgB,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;YAC/C,MAAM,QAAQ,GAAG,QAAQ,CAAC,eAAe,EAAE,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;YAC3D,IAAI,MAAM,KAAK,QAAQ;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAwBD;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAyB,EACzB,SAA2B;IAE3B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,aAAa,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,OAAO,qCAAqC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,aAAa,CAAC,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,OAAO,CAAC,IAAI,CACV,IAAI,QAAQ,CAAC,OAAO,oBAAoB,QAAQ,CAAC,cAAc,iCAAiC,SAAS,CAAC,OAAO,GAAG,CACrH,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAErF,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,QAAQ,CAAC,oBAAoB,GAAG,SAAS,CAAC,oBAAoB,EAAE,CAAC;QACnE,MAAM,CAAC,IAAI,CACT,oDAAoD,SAAS,CAAC,oBAAoB,MAAM,QAAQ,CAAC,oBAAoB,KAAK,cAAc,CAAC,SAAS,CAAC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,CAAC,iDAAiD,CACzP,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,QAAQ,CAAC,UAAU,CAAC,mBAAmB,CAAC;IAC7D,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;IACvE,CAAC;SAAM,IAAI,YAAY,KAAK,IAAI,IAAI,aAAa,CAAC,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;QACvF,MAAM,CAAC,IAAI,CACT,sBAAsB,YAAY,8DAA8D,SAAS,CAAC,OAAO,uBAAuB,CACzI,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClF,iEAAiE;IACjE,0EAA0E;IAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AAClG,CAAC"}
+{"version":3,"file":"release-manifest.js","sourceRoot":"","sources":["../src/release-manifest.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,GAIf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,GAChB,MAAM,6BAA6B,CAAC;AAErC,2EAA2E;AAC3E,0EAA0E;AAC1E,8CAA8C;AAC9C,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAI3B,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,GAAG,6CAA6C,CAAC;AAE7D,4EAA4E;AAC5E,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAE/B;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAAe;IAC3D,OAAO,GAAG,qBAAqB,2BAA2B,OAAO,EAAE,CAAC;AACtE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,CAAS,EAAE,CAAS;IAChD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACvE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACjB,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACjB,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACxD,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC;QAC9B,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACtE,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACxC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B,OAAQ,gBAAsC,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAqB,CAAC,CAAC,CAAC,IAAI,CAAC;AACpG,CAAC;AAgCD,sEAAsE;AACtE,KAAK,UAAU,SAAS,CAAC,IAAuB;IAC9C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAClF,MAAM,MAAM,GAAG,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,QAAQ,EAAE,GAAG;YACb,MAAM,EAAE,gCAAgC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,sDAAsD;SACzI,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,WAAW,GAAwB;IACvC,KAAK,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC;IACtC,MAAM,EAAE,SAAS;CAClB,CAAC;AAEF,SAAS,IAAI,CAAC,IAA8B,EAAE,OAAe;IAC3D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAe,EACf,OAA4B,WAAW;IAEvC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,IAAI,OAAO,2BAA2B,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3D,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;IAE9D,sEAAsE;IACtE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,qCAAqC,CAAC,CAAC;QACpE,MAAM,SAAS,CAAC,YAAY,EAAE,QAAQ,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvE,MAAM,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC;YAC/B,aAAa;YACb,UAAU;YACV,UAAU;YACV,wBAAwB;YACxB,6BAA6B,CAAC,OAAO,CAAC;YACtC,2BAA2B;YAC3B,mBAAmB;YACnB,YAAY;SACb,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CACT,WAAW,EACX,oBAAoB,OAAO,qBAAqB,6BAA6B,CAAC,OAAO,CAAC,iCAAiC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC5J,CAAC;QACJ,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACrE,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,oBAAoB,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;AACjD,CAAC;AAsBD;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,CAA+C;IAQnF,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,0BAA0B,CAAC,CAAC,OAAO,4NAA4N,CAAC,CAAC,OAAO,YAAY;SAC5R,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,MAAc,EAAE,EAAE,CAAC,CAAC;QAC/C,MAAM;QACN,QAAQ,EAAE,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC;KACxC,CAAC,CAAC;IACH,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE;YACN,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;YACtC,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;YAC5C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC;SACjD;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAyB,EACzB,QAAsD,EACtD,mBAAiE,EAAE;IAEnE,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,IAAI,KAAK,IAAI,QAAQ,EAAE,CAAC;YACtB,oEAAoE;YACpE,mEAAmE;YACnE,sDAAsD;YACtD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;YACvC,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;YACjD,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC3C,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;QACD,IAAI,KAAK,IAAI,gBAAgB,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;YAC/C,MAAM,QAAQ,GAAG,QAAQ,CAAC,eAAe,EAAE,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;YAC3D,IAAI,MAAM,KAAK,QAAQ;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAwBD;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAyB,EACzB,SAA2B;IAE3B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,aAAa,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,OAAO,qCAAqC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,aAAa,CAAC,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,OAAO,CAAC,IAAI,CACV,IAAI,QAAQ,CAAC,OAAO,oBAAoB,QAAQ,CAAC,cAAc,iCAAiC,SAAS,CAAC,OAAO,GAAG,CACrH,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAErF,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,QAAQ,CAAC,oBAAoB,GAAG,SAAS,CAAC,oBAAoB,EAAE,CAAC;QACnE,MAAM,CAAC,IAAI,CACT,oDAAoD,SAAS,CAAC,oBAAoB,MAAM,QAAQ,CAAC,oBAAoB,KAAK,cAAc,CAAC,SAAS,CAAC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,CAAC,iDAAiD,CACzP,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,QAAQ,CAAC,UAAU,CAAC,mBAAmB,CAAC;IAC7D,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;IACvE,CAAC;SAAM,IAAI,YAAY,KAAK,IAAI,IAAI,aAAa,CAAC,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;QACvF,MAAM,CAAC,IAAI,CACT,sBAAsB,YAAY,8DAA8D,SAAS,CAAC,OAAO,uBAAuB,CACzI,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClF,iEAAiE;IACjE,0EAA0E;IAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AAClG,CAAC"}

package/dist/remote-mcp.d.ts

@@ -109,36 +109,41 @@ export interface LiveUrlMap {
 export type UrlMapPathsPlan = {
     readonly ok: true;
     readonly map: LiveUrlMap;
-    readonly added: string[];
+    /** What changed, for the log; empty when the map was already right. */
+    readonly changes: string[];
 } | {
     readonly ok: false;
     readonly error: string;
 };
 /**
- * The URL map with every {@link GCP_PUBLIC_BASE_PATHS} entry routed like
- * `/api/*` (to the gateway). Only the rule that carries `/api/*` changes;
- * redirect rules the admin wrote stay as they are. `added` is empty when the
- * map is already complete.
+ * #1328 — the URL map with the remote-MCP paths ({@link GCP_MCP_AUTH_PROXY_PATHS})
+ * on their own rule to the MCP-Auth-Proxy's backend, and none of them left
+ * on the gateway's `/api/*` rule (#806 put the discovery paths there). Only
+ * those two rules change; redirect rules the admin wrote stay as they are.
+ *
+ * @param proxyBackend the proxy backend's self-link
  */
-export declare function planUrlMapPaths(maps: readonly LiveUrlMap[], siteHost: string): UrlMapPathsPlan;
+export declare function planUrlMapPaths(maps: readonly LiveUrlMap[], siteHost: string, proxyBackend: string): UrlMapPathsPlan;
 /**
- * Route the remote-MCP discovery paths to the gateway on an existing `gcp`
- * install: read the URL map, add the missing paths to its `/api/*` rule and
- * write it back through the Compute API (`urlMaps.update` carries the map's
- * fingerprint, so a concurrent write — the admin publishing redirects —
- * fails instead of being lost; a re-run then succeeds).
+ * Route the remote-MCP paths to the MCP-Auth-Proxy on a `gcp` install: read
+ * the URL map, apply {@link planUrlMapPaths} and write it back through the
+ * Compute API (`urlMaps.update` carries the map's fingerprint, so a
+ * concurrent write — the admin publishing redirects — fails instead of
+ * being lost; a re-run then succeeds).
  */
-export declare function ensureUrlMapRemoteMcpPaths(target: Pick<RemoteMcpTarget, "projectId" | "domain">, deps?: {
+export declare function ensureUrlMapRemoteMcpPaths(target: Pick<RemoteMcpTarget, "projectId" | "domain">, proxyBackend: string, deps?: {
     run?: GcloudRunner;
     http?: HttpFetch;
     sleep?: (ms: number) => Promise<void>;
 }): Promise<RemoteMcpResult<{
-    readonly added: string[];
+    readonly changes: string[];
 }>>;
 /**
- * Give the gateway's Cloud Armor policy the `/api/mcp/*` rule
- * ({@link MCP_ARMOR_RULE}): create it, or bring a rule at its priority back
- * to spec.
+ * #1328 — the MCP-Auth-Proxy's own Cloud Armor policy with the `/api/mcp/*`
+ * rule ({@link MCP_ARMOR_RULE}; remote-mcp-edge.ts says why): created when
+ * missing, a rule at its priority brought back to spec. Everything else the
+ * policy's default rule allows: the proxy rate-limits every route itself
+ * (apps/mcp-auth-proxy rate-limit.ts).
  */
 export declare function ensureMcpArmorRule(target: Pick<RemoteMcpTarget, "projectId" | "env">, deps?: {
     run?: GcloudRunner;
@@ -146,8 +151,40 @@ export declare function ensureMcpArmorRule(target: Pick<RemoteMcpTarget, "projec
     readonly policy: string;
     readonly action: "present" | "created" | "updated";
 }>>;
-/** Both load-balancer parts on `gcp`; a no-op success on `gcp-firebase`. */
-export declare function ensureRemoteMcpEdge(target: Pick<RemoteMcpTarget, "provider" | "projectId" | "env" | "domain">, deps?: {
+/**
+ * #1328 — drop the `/api/mcp/*` rule #806 put on the gateway's policy, once
+ * the URL map no longer sends those paths to the gateway: there it would
+ * only exempt matching paths from the OWASP packs and the ban. A rule at the
+ * priority that is not exactly the MCP rule is someone's own and stays.
+ */
+export declare function retireGatewayMcpArmorRule(target: Pick<RemoteMcpTarget, "projectId" | "env">, deps?: {
+    run?: GcloudRunner;
+}): Promise<RemoteMcpResult<{
+    readonly removed: string | null;
+}>>;
+/**
+ * #1328 — the proxy's serverless NEG and backend service (EXTERNAL_MANAGED,
+ * its own Cloud Armor policy), created when missing. Returns the backend's
+ * self-link for the URL map.
+ */
+export declare function ensureMcpAuthProxyBackend(target: Pick<RemoteMcpTarget, "projectId" | "region" | "env">, deps?: {
+    run?: GcloudRunner;
+}): Promise<RemoteMcpResult<{
+    readonly backend: string;
+    readonly done: string[];
+}>>;
+/**
+ * The MCP-Auth-Proxy's load-balancer part on `gcp`, in the order that never
+ * routes a request to something that is not there yet: its service (created
+ * once with the release's image; mcp-auth-proxy-setup.ts), its Cloud Armor
+ * policy, NEG and backend, the URL map's MCP rule, and last the old MCP rule
+ * off the gateway's policy. A no-op success on `gcp-firebase`, where the
+ * proxy is reached on its own run.app URL.
+ */
+export declare function ensureRemoteMcpEdge(target: Pick<RemoteMcpTarget, "provider" | "projectId" | "region" | "env" | "domain"> & {
+    /** The release's digest-pinned proxy image, for a proxy service that does not exist yet. */
+    readonly mcpAuthProxyImageRef: string;
+}, deps?: {
     run?: GcloudRunner;
     http?: HttpFetch;
     sleep?: (ms: number) => Promise<void>;

package/dist/remote-mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-mcp.d.ts","sourceRoot":"","sources":["../src/remote-mcp.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAQtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,WAAW,EAEhB,KAAK,iBAAiB,EAGvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,KAAK,SAAS,EAAmC,MAAM,qBAAqB,CAAC;AAGtF,2CAA2C;AAC3C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,0DAA0D;IAC1D,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;CAC3D;AAED,MAAM,MAAM,eAAe,CAAC,CAAC,IACzB,CAAC;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG,CAAC,CAAC,GAC3B;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAsBnD;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAA;CAAO,GAChC,OAAO,CAAC,eAAe,CAAC;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAmBvD;AAED,4GAA4G;AAC5G,eAAO,MAAM,sBAAsB,SAAS,CAAC;AAE7C;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,eAAe,EACvB,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAA;CAAO,GAChC,OAAO,CACR,eAAe,CAAC;IAAE,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAC5F,CAOA;AA0GD;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC,EACvC,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAA;CAAO,GAChC,OAAO,CAAC,eAAe,CAAC;IAAE,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;CAAE,CAAC,CAAC,CAwBhE;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,6BAA6B,CACjD,MAAM,EAAE,eAAe,EACvB,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAA;CAAO,GAChC,OAAO,CACR,eAAe,CAAC;IAAE,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAC5F,CAeA;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAA;CAAO,GAChC,OAAO,CAAC,eAAe,CAAC;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,CAAC,CAAA;CAAE,CAAC,CAAC,CAYjF;AAMD,6FAA6F;AAC7F,UAAU,cAAc;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;CAChC;AACD,UAAU,iBAAiB;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,CAAC;CACvC;AACD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAClF,QAAQ,CAAC,YAAY,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC5C,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CACnC;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GACzE;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,UAAU,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,eAAe,CAuC9F;AAKD;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,GAAG,QAAQ,CAAC,EACrD,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAC;IAAC,IAAI,CAAC,EAAE,SAAS,CAAC;IAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAAO,GACzF,OAAO,CAAC,eAAe,CAAC;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC,CAuDxD;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,GAAG,KAAK,CAAC,EAClD,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAA;CAAO,GAChC,OAAO,CACR,eAAe,CAAC;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAAA;CAAE,CAAC,CACjG,CAqDA;AAED,4EAA4E;AAC5E,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,UAAU,GAAG,WAAW,GAAG,KAAK,GAAG,QAAQ,CAAC,EAC1E,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAC;IAAC,IAAI,CAAC,EAAE,SAAS,CAAC;IAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAAO,GACzF,OAAO,CAAC,eAAe,CAAC;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC,CAcvD"}
+{"version":3,"file":"remote-mcp.d.ts","sourceRoot":"","sources":["../src/remote-mcp.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAStD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAEL,KAAK,YAAY,EAGjB,KAAK,WAAW,EAEhB,KAAK,iBAAiB,EAGvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,KAAK,SAAS,EAAmC,MAAM,qBAAqB,CAAC;AAGtF,2CAA2C;AAC3C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,0DAA0D;IAC1D,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;CAC3D;AAED,MAAM,MAAM,eAAe,CAAC,CAAC,IACzB,CAAC;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG,CAAC,CAAC,GAC3B;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAsBnD;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAA;CAAO,GAChC,OAAO,CAAC,eAAe,CAAC;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAmBvD;AAED,4GAA4G;AAC5G,eAAO,MAAM,sBAAsB,SAAS,CAAC;AAE7C;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,eAAe,EACvB,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAA;CAAO,GAChC,OAAO,CACR,eAAe,CAAC;IAAE,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAC5F,CAOA;AA6GD;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC,EACvC,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAA;CAAO,GAChC,OAAO,CAAC,eAAe,CAAC;IAAE,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;CAAE,CAAC,CAAC,CA+BhE;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,6BAA6B,CACjD,MAAM,EAAE,eAAe,EACvB,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAA;CAAO,GAChC,OAAO,CACR,eAAe,CAAC;IAAE,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAC5F,CAeA;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAA;CAAO,GAChC,OAAO,CAAC,eAAe,CAAC;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,CAAC,CAAA;CAAE,CAAC,CAAC,CAYjF;AAMD,6FAA6F;AAC7F,UAAU,cAAc;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;CAChC;AACD,UAAU,iBAAiB;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,CAAC;CACvC;AACD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAClF,QAAQ,CAAC,YAAY,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC5C,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CACnC;AAED,MAAM,MAAM,eAAe,GACvB;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,uEAAuE;IACvE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;CAC5B,GACD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAOnD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,SAAS,UAAU,EAAE,EAC3B,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GACnB,eAAe,CA4DjB;AAKD;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,GAAG,QAAQ,CAAC,EACrD,YAAY,EAAE,MAAM,EACpB,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAC;IAAC,IAAI,CAAC,EAAE,SAAS,CAAC;IAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAAO,GACzF,OAAO,CAAC,eAAe,CAAC;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC,CAuD1D;AA8BD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,GAAG,KAAK,CAAC,EAClD,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAA;CAAO,GAChC,OAAO,CACR,eAAe,CAAC;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAAA;CAAE,CAAC,CACjG,CAuCA;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,GAAG,KAAK,CAAC,EAClD,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAA;CAAO,GAChC,OAAO,CAAC,eAAe,CAAC;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAAC,CA0C/D;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,GAAG,QAAQ,GAAG,KAAK,CAAC,EAC7D,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAA;CAAO,GAChC,OAAO,CAAC,eAAe,CAAC;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC,CAyGjF;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,UAAU,GAAG,WAAW,GAAG,QAAQ,GAAG,KAAK,GAAG,QAAQ,CAAC,GAAG;IACtF,4FAA4F;IAC5F,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;CACvC,EACD,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAC;IAAC,IAAI,CAAC,EAAE,SAAS,CAAC;IAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAAO,GACzF,OAAO,CAAC,eAAe,CAAC;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC,CA2BvD"}