@caelo-cms/shared 0.10.49 → 0.10.51

package/dist/index.d.ts

@@ -30,6 +30,11 @@ export * from "./preview-compose.js";
 export * from "./preview-scanner.js";
 export * from "./proposal-status.js";
 export * from "./provisioning-command.js";
+export * from "./redirect-emit-caddy.js";
+export * from "./redirect-emit-cloudfront.js";
+export * from "./redirect-emit-front-door.js";
+export * from "./redirect-emit-gcp.js";
+export * from "./redirect-plan.js";
 export * from "./redirect-target.js";
 export * from "./release-manifest.js";
 export * from "./responsive-images.js";
@@ -56,6 +61,7 @@ export * from "./theme-ramp.js";
 export * from "./theme-render.js";
 export * from "./themes.js";
 export * from "./themes-errors.js";
+export * from "./untrusted-tool-result.js";
 export * from "./url.js";
 export { CAELO_VERSION, CALEO_VERSION, type CaeloVersion, isNewerVersion, parseVersion, } from "./version.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,YAAY,cAAc,CAAC;AAExC,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,0BAA0B,CAAC;AACzC,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,wBAAwB,CAAC;AACvC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,yBAAyB,CAAC;AACxC,cAAc,wBAAwB,CAAC;AACvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,wBAAwB,CAAC;AACvC,cAAc,oBAAoB,CAAC;AACnC,cAAc,yBAAyB,CAAC;AACxC,cAAc,mBAAmB,CAAC;AAClC,OAAO,EACL,KAAK,UAAU,EACf,KAAK,MAAM,EACX,KAAK,aAAa,EAClB,KAAK,QAAQ,EACb,UAAU,EACV,aAAa,EACb,MAAM,EACN,KAAK,WAAW,EAChB,KAAK,kBAAkB,GACxB,MAAM,aAAa,CAAC;AACrB,cAAc,YAAY,CAAC;AAC3B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,wBAAwB,CAAC;AACvC,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC;AACjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,kCAAkC,CAAC;AACjD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,uCAAuC,CAAC;AACtD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,UAAU,CAAC;AACzB,OAAO,EACL,aAAa,EACb,aAAa,EACb,KAAK,YAAY,EACjB,cAAc,EACd,YAAY,GACb,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,YAAY,cAAc,CAAC;AAExC,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,0BAA0B,CAAC;AACzC,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,wBAAwB,CAAC;AACvC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,yBAAyB,CAAC;AACxC,cAAc,wBAAwB,CAAC;AACvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,wBAAwB,CAAC;AACvC,cAAc,oBAAoB,CAAC;AACnC,cAAc,yBAAyB,CAAC;AACxC,cAAc,mBAAmB,CAAC;AAClC,OAAO,EACL,KAAK,UAAU,EACf,KAAK,MAAM,EACX,KAAK,aAAa,EAClB,KAAK,QAAQ,EACb,UAAU,EACV,aAAa,EACb,MAAM,EACN,KAAK,WAAW,EAChB,KAAK,kBAAkB,GACxB,MAAM,aAAa,CAAC;AACrB,cAAc,YAAY,CAAC;AAC3B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC;AACzC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,wBAAwB,CAAC;AACvC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,wBAAwB,CAAC;AACvC,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC;AACjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,kCAAkC,CAAC;AACjD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,uCAAuC,CAAC;AACtD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,UAAU,CAAC;AACzB,OAAO,EACL,aAAa,EACb,aAAa,EACb,KAAK,YAAY,EACjB,cAAc,EACd,YAAY,GACb,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -31,6 +31,11 @@ export * from "./preview-compose.js";
 export * from "./preview-scanner.js";
 export * from "./proposal-status.js";
 export * from "./provisioning-command.js";
+export * from "./redirect-emit-caddy.js";
+export * from "./redirect-emit-cloudfront.js";
+export * from "./redirect-emit-front-door.js";
+export * from "./redirect-emit-gcp.js";
+export * from "./redirect-plan.js";
 export * from "./redirect-target.js";
 export * from "./release-manifest.js";
 export * from "./responsive-images.js";
@@ -57,6 +62,7 @@ export * from "./theme-ramp.js";
 export * from "./theme-render.js";
 export * from "./themes.js";
 export * from "./themes-errors.js";
+export * from "./untrusted-tool-result.js";
 export * from "./url.js";
 export { CAELO_VERSION, CALEO_VERSION, isNewerVersion, parseVersion, } from "./version.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC,MAAM,CAAC,MAAM,YAAY,GAAG,WAAW,CAAC;AAExC,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,0BAA0B,CAAC;AACzC,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,wBAAwB,CAAC;AACvC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,yBAAyB,CAAC;AACxC,cAAc,wBAAwB,CAAC;AACvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,wBAAwB,CAAC;AACvC,cAAc,oBAAoB,CAAC;AACnC,cAAc,yBAAyB,CAAC;AACxC,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAKL,UAAU,EACV,aAAa,EACb,MAAM,GAGP,MAAM,aAAa,CAAC;AACrB,cAAc,YAAY,CAAC;AAC3B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,wBAAwB,CAAC;AACvC,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC;AACjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,kCAAkC,CAAC;AACjD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,uCAAuC,CAAC;AACtD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,UAAU,CAAC;AACzB,OAAO,EACL,aAAa,EACb,aAAa,EAEb,cAAc,EACd,YAAY,GACb,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC,MAAM,CAAC,MAAM,YAAY,GAAG,WAAW,CAAC;AAExC,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,0BAA0B,CAAC;AACzC,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,wBAAwB,CAAC;AACvC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,yBAAyB,CAAC;AACxC,cAAc,wBAAwB,CAAC;AACvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,wBAAwB,CAAC;AACvC,cAAc,oBAAoB,CAAC;AACnC,cAAc,yBAAyB,CAAC;AACxC,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAKL,UAAU,EACV,aAAa,EACb,MAAM,GAGP,MAAM,aAAa,CAAC;AACrB,cAAc,YAAY,CAAC;AAC3B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC;AACzC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,wBAAwB,CAAC;AACvC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,wBAAwB,CAAC;AACvC,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC;AACjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,kCAAkC,CAAC;AACjD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,uCAAuC,CAAC;AACtD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,UAAU,CAAC;AACzB,OAAO,EACL,aAAa,EACb,aAAa,EAEb,cAAc,EACd,YAAY,GACb,MAAM,cAAc,CAAC"}

package/dist/platform-updates.d.ts

@@ -119,13 +119,14 @@ export interface AutoInstallCandidate {
  */
 export declare function autoInstallRefusal(policy: Pick<StoredUpdatePolicy, "mode" | "autoSecurity" | "autoPatch" | "autoMinor" | "paused" | "pausedUntil" | "windowStart" | "windowEnd" | "windowTimezone">, candidate: AutoInstallCandidate, at: Date): string | null;
 /**
- * How long a verified Google sign-in authorizes one guarded action. Long
- * enough to read the confirmation dialog, short enough that an unattended
- * browser is useless soon after.
+ * How long a password confirmation authorizes one guarded action (#757). The
+ * admin confirms and acts in the same request, so the window only has to
+ * cover that request; anything longer would let an unattended browser reuse
+ * a confirmation the Owner made for an action that then failed.
  */
-export declare const STEP_UP_MAX_AGE_SECONDS = 600;
-/** What a step-up is for (`step_up_challenges.purpose`). */
-export declare const STEP_UP_PURPOSES: readonly ["platform_update", "update_policy", "step_up_client"];
+export declare const STEP_UP_MAX_AGE_SECONDS = 60;
+/** What a step-up is for (`sessions.step_up_purpose`). */
+export declare const STEP_UP_PURPOSES: readonly ["platform_update", "update_policy"];
 export type StepUpPurpose = (typeof STEP_UP_PURPOSES)[number];
 /**
  * Self-hosted installs (#696 Phase 4c): the host agent (`caelo-agent`, a

package/dist/platform-updates.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform-updates.d.ts","sourceRoot":"","sources":["../src/platform-updates.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,4EAA4E;AAC5E,eAAO,MAAM,wBAAwB,oHAS3B,CAAC;AACX,MAAM,MAAM,yBAAyB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAElF,4EAA4E;AAC5E,eAAO,MAAM,sBAAsB,EAAE,SAAS,yBAAyB,EAA2B,CAAC;AAEnG,wCAAwC;AACxC,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAEjF;AAED;;;GAGG;AACH,eAAO,MAAM,sBAAsB,8JAczB,CAAC;AACX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E,qCAAqC;AACrC,eAAO,MAAM,4BAA4B,+CAAgD,CAAC;AAC1F,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,4BAA4B,CAAC,CAAC,MAAM,CAAC,CAAC;AAErF,0EAA0E;AAC1E,eAAO,MAAM,wBAAwB,6BAA8B,CAAC;AACpE,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAEhD;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,uRACmO,CAAC;AAE7Q,kDAAkD;AAClD,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAI9C,gFAAgF;AAChF,eAAO,MAAM,oBAAoB,aAEwC,CAAC;AAE1E,iEAAiE;AACjE,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;AAErD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CActE;AAoBD,kCAAkC;AAClC,eAAO,MAAM,mBAAmB,oCAAqC,CAAC;AACtE,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpE,mFAAmF;AACnF,eAAO,MAAM,sBAAsB,4CAA6C,CAAC;AAIjF,4DAA4D;AAC5D,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAOnD;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;kBA8B3B,CAAC;AACL,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,kDAAkD;AAClD,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACtD,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,kFAAkF;IAClF,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAgBD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,aAAa,GAAG,WAAW,GAAG,gBAAgB,CAAC,EAC1E,EAAE,EAAE,IAAI,GACP,OAAO,CAOT;AAED,uFAAuF;AACvF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,sEAAsE;IACtE,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC,6BAA6B;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,IAAI,CACV,kBAAkB,EAChB,MAAM,GACN,cAAc,GACd,WAAW,GACX,WAAW,GACX,QAAQ,GACR,aAAa,GACb,aAAa,GACb,WAAW,GACX,gBAAgB,CACnB,EACD,SAAS,EAAE,oBAAoB,EAC/B,EAAE,EAAE,IAAI,GACP,MAAM,GAAG,IAAI,CAwBf;AAED;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAE3C,4DAA4D;AAC5D,eAAO,MAAM,gBAAgB,iEAAkE,CAAC;AAChG,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,KAAK,CAAC;AAErD;;;;GAIG;AACH,eAAO,MAAM,mCAAmC,MAAM,CAAC;AAEvD,uFAAuF;AACvF,MAAM,WAAW,yBAAyB;IACxC,iDAAiD;IACjD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,0CAA0C;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,wFAAwF;IACxF,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;CACrC;AAED,6EAA6E;AAC7E,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,IAAI,GAAG,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAKpF"}
+{"version":3,"file":"platform-updates.d.ts","sourceRoot":"","sources":["../src/platform-updates.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,4EAA4E;AAC5E,eAAO,MAAM,wBAAwB,oHAS3B,CAAC;AACX,MAAM,MAAM,yBAAyB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAElF,4EAA4E;AAC5E,eAAO,MAAM,sBAAsB,EAAE,SAAS,yBAAyB,EAA2B,CAAC;AAEnG,wCAAwC;AACxC,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAEjF;AAED;;;GAGG;AACH,eAAO,MAAM,sBAAsB,8JAczB,CAAC;AACX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E,qCAAqC;AACrC,eAAO,MAAM,4BAA4B,+CAAgD,CAAC;AAC1F,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,4BAA4B,CAAC,CAAC,MAAM,CAAC,CAAC;AAErF,0EAA0E;AAC1E,eAAO,MAAM,wBAAwB,6BAA8B,CAAC;AACpE,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAEhD;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,uRACmO,CAAC;AAE7Q,kDAAkD;AAClD,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAI9C,gFAAgF;AAChF,eAAO,MAAM,oBAAoB,aAEwC,CAAC;AAE1E,iEAAiE;AACjE,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;AAErD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CActE;AAoBD,kCAAkC;AAClC,eAAO,MAAM,mBAAmB,oCAAqC,CAAC;AACtE,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpE,mFAAmF;AACnF,eAAO,MAAM,sBAAsB,4CAA6C,CAAC;AAIjF,4DAA4D;AAC5D,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAOnD;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;kBA8B3B,CAAC;AACL,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,kDAAkD;AAClD,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACtD,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,kFAAkF;IAClF,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAgBD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,aAAa,GAAG,WAAW,GAAG,gBAAgB,CAAC,EAC1E,EAAE,EAAE,IAAI,GACP,OAAO,CAOT;AAED,uFAAuF;AACvF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,sEAAsE;IACtE,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC,6BAA6B;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,IAAI,CACV,kBAAkB,EAChB,MAAM,GACN,cAAc,GACd,WAAW,GACX,WAAW,GACX,QAAQ,GACR,aAAa,GACb,aAAa,GACb,WAAW,GACX,gBAAgB,CACnB,EACD,SAAS,EAAE,oBAAoB,EAC/B,EAAE,EAAE,IAAI,GACP,MAAM,GAAG,IAAI,CAwBf;AAED;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C,0DAA0D;AAC1D,eAAO,MAAM,gBAAgB,+CAAgD,CAAC;AAC9E,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,KAAK,CAAC;AAErD;;;;GAIG;AACH,eAAO,MAAM,mCAAmC,MAAM,CAAC;AAEvD,uFAAuF;AACvF,MAAM,WAAW,yBAAyB;IACxC,iDAAiD;IACjD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,0CAA0C;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,wFAAwF;IACxF,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;CACrC;AAED,6EAA6E;AAC7E,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,IAAI,GAAG,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAKpF"}

package/dist/platform-updates.js

@@ -226,13 +226,14 @@ export function autoInstallRefusal(policy, candidate, at) {
     return null;
 }
 /**
- * How long a verified Google sign-in authorizes one guarded action. Long
- * enough to read the confirmation dialog, short enough that an unattended
- * browser is useless soon after.
+ * How long a password confirmation authorizes one guarded action (#757). The
+ * admin confirms and acts in the same request, so the window only has to
+ * cover that request; anything longer would let an unattended browser reuse
+ * a confirmation the Owner made for an action that then failed.
  */
-export const STEP_UP_MAX_AGE_SECONDS = 600;
-/** What a step-up is for (`step_up_challenges.purpose`). */
-export const STEP_UP_PURPOSES = ["platform_update", "update_policy", "step_up_client"];
+export const STEP_UP_MAX_AGE_SECONDS = 60;
+/** What a step-up is for (`sessions.step_up_purpose`). */
+export const STEP_UP_PURPOSES = ["platform_update", "update_policy"];
 /**
  * Self-hosted installs (#696 Phase 4c): the host agent (`caelo-agent`, a
  * systemd timer on the install's host) polls for update requests this

package/dist/platform-updates.js.map

@@ -1 +1 @@
-{"version":3,"file":"platform-updates.js","sourceRoot":"","sources":["../src/platform-updates.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,4EAA4E;AAC5E,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,SAAS;IACT,SAAS;IACT,WAAW;IACX,aAAa;IACb,QAAQ;IACR,SAAS;IACT,mBAAmB;IACnB,WAAW;CACH,CAAC;AAGX,4EAA4E;AAC5E,MAAM,CAAC,MAAM,sBAAsB,GAAyC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AAEnG,wCAAwC;AACxC,MAAM,UAAU,sBAAsB,CAAC,MAAiC;IACtE,OAAO,CAAC,sBAAsB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,iBAAiB;IACjB,YAAY;IACZ,MAAM;IACN,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,aAAa;IACb,QAAQ;CACA,CAAC;AAGX,qCAAqC;AACrC,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAU,CAAC;AAG1F,0EAA0E;AAC1E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAU,CAAC;AAGpE;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEhD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GACvC,0QAA0Q,CAAC;AAE7Q,kDAAkD;AAClD,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAE9C,MAAM,MAAM,GAAG,6CAA6C,CAAC;AAE7D,gFAAgF;AAChF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,EAAE;KACR,KAAK,CAAC,MAAM,EAAE,uDAAuD,CAAC,CAAC;AAK1E;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,EAAU;IACjD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,oEAAoE;IACpE,wCAAwC;IACxC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IACvC,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5D,CAAC;AAED,iEAAiE;AACjE,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxB,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACxD,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC;QAC9B,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACtE,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,kCAAkC;AAClC,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAU,CAAC;AAGtE,mFAAmF;AACnF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAU,CAAC;AAEjF,MAAM,UAAU,GAAG,2BAA2B,CAAC;AAE/C,4DAA4D;AAC5D,MAAM,UAAU,eAAe,CAAC,EAAU;IACxC,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC;IACjC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IACvC,sFAAsF;IACtF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IACtE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IACpE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,mBAAmB,CAAC;IACtF,oFAAoF;IACpF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3C;;;;;OAKG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACpD,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,EAAE;IAClE,OAAO,EAAE,qDAAqD;CAC/D,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,OAAO,KAAK,QAAQ,EAAE;IAC1D,OAAO,EAAE,mDAAmD;CAC7D,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB,IAAI,CAAC,CAAC,SAAS,EAAE;IACjD,OAAO,EAAE,uDAAuD;CACjE,CAAC,CAAC;AAeL,0DAA0D;AAC1D,SAAS,YAAY,CAAC,EAAQ,EAAE,QAAgB;IAC9C,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE;QAC7C,QAAQ;QACR,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IACrB,MAAM,CAAC,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,KAAK,IAAI,GAAG,CAAC,CAAC;IAC/E,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAE7F;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAA0E,EAC1E,EAAQ;IAER,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC1E,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC/B,OAAO,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,IAAI,GAAG,GAAG,GAAG,CAAC;AAC7E,CAAC;AAaD;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAWC,EACD,SAA+B,EAC/B,EAAQ;IAER,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,0DAA0D,CAAC;IAC9F,kEAAkE;IAClE,uEAAuE;IACvE,IACE,MAAM,CAAC,MAAM;QACb,CAAC,MAAM,CAAC,WAAW,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,EAC9E,CAAC;QACD,OAAO,+BAA+B,CAAC;IACzC,CAAC;IACD,IAAI,SAAS,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,4CAA4C,CAAC;IACxF,IAAI,SAAS,CAAC,kBAAkB,EAAE,CAAC;QACjC,OAAO,iFAAiF,CAAC;IAC3F,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,4CAA4C,CAAC;IACpF,MAAM,OAAO,GACX,CAAC,SAAS,CAAC,QAAQ,IAAI,MAAM,CAAC,YAAY,CAAC;QAC3C,CAAC,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,SAAS,CAAC;QAChD,CAAC,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,+BAA+B,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,GAAG,SAAS,CAAC,IAAI,yBAAyB,CAAC;IACjI,CAAC;IACD,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,EAAE,CAAC;QAAE,OAAO,gCAAgC,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAE3C,4DAA4D;AAC5D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,iBAAiB,EAAE,eAAe,EAAE,gBAAgB,CAAU,CAAC;AAGhG;;;;GAIG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,EAAE,CAAC;AAErD;;;;GAIG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,GAAG,CAAC;AAkBvD,6EAA6E;AAC7E,MAAM,UAAU,sBAAsB,CAAC,UAAyB,EAAE,GAAS;IACzE,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5C,OAAO,CACL,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,mCAAmC,GAAG,IAAI,CAC5F,CAAC;AACJ,CAAC"}
+{"version":3,"file":"platform-updates.js","sourceRoot":"","sources":["../src/platform-updates.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,4EAA4E;AAC5E,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,SAAS;IACT,SAAS;IACT,WAAW;IACX,aAAa;IACb,QAAQ;IACR,SAAS;IACT,mBAAmB;IACnB,WAAW;CACH,CAAC;AAGX,4EAA4E;AAC5E,MAAM,CAAC,MAAM,sBAAsB,GAAyC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AAEnG,wCAAwC;AACxC,MAAM,UAAU,sBAAsB,CAAC,MAAiC;IACtE,OAAO,CAAC,sBAAsB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,iBAAiB;IACjB,YAAY;IACZ,MAAM;IACN,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,aAAa;IACb,QAAQ;CACA,CAAC;AAGX,qCAAqC;AACrC,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAU,CAAC;AAG1F,0EAA0E;AAC1E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAU,CAAC;AAGpE;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEhD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GACvC,0QAA0Q,CAAC;AAE7Q,kDAAkD;AAClD,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAE9C,MAAM,MAAM,GAAG,6CAA6C,CAAC;AAE7D,gFAAgF;AAChF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,EAAE;KACR,KAAK,CAAC,MAAM,EAAE,uDAAuD,CAAC,CAAC;AAK1E;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,EAAU;IACjD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,oEAAoE;IACpE,wCAAwC;IACxC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IACvC,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5D,CAAC;AAED,iEAAiE;AACjE,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxB,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACxD,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC;QAC9B,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACtE,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,kCAAkC;AAClC,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAU,CAAC;AAGtE,mFAAmF;AACnF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAU,CAAC;AAEjF,MAAM,UAAU,GAAG,2BAA2B,CAAC;AAE/C,4DAA4D;AAC5D,MAAM,UAAU,eAAe,CAAC,EAAU;IACxC,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC;IACjC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IACvC,sFAAsF;IACtF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IACtE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IACpE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,mBAAmB,CAAC;IACtF,oFAAoF;IACpF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3C;;;;;OAKG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACpD,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,EAAE;IAClE,OAAO,EAAE,qDAAqD;CAC/D,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,OAAO,KAAK,QAAQ,EAAE;IAC1D,OAAO,EAAE,mDAAmD;CAC7D,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB,IAAI,CAAC,CAAC,SAAS,EAAE;IACjD,OAAO,EAAE,uDAAuD;CACjE,CAAC,CAAC;AAeL,0DAA0D;AAC1D,SAAS,YAAY,CAAC,EAAQ,EAAE,QAAgB;IAC9C,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE;QAC7C,QAAQ;QACR,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IACrB,MAAM,CAAC,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,KAAK,IAAI,GAAG,CAAC,CAAC;IAC/E,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAE7F;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAA0E,EAC1E,EAAQ;IAER,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC1E,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC/B,OAAO,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,IAAI,GAAG,GAAG,GAAG,CAAC;AAC7E,CAAC;AAaD;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAWC,EACD,SAA+B,EAC/B,EAAQ;IAER,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,0DAA0D,CAAC;IAC9F,kEAAkE;IAClE,uEAAuE;IACvE,IACE,MAAM,CAAC,MAAM;QACb,CAAC,MAAM,CAAC,WAAW,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,EAC9E,CAAC;QACD,OAAO,+BAA+B,CAAC;IACzC,CAAC;IACD,IAAI,SAAS,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,4CAA4C,CAAC;IACxF,IAAI,SAAS,CAAC,kBAAkB,EAAE,CAAC;QACjC,OAAO,iFAAiF,CAAC;IAC3F,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,4CAA4C,CAAC;IACpF,MAAM,OAAO,GACX,CAAC,SAAS,CAAC,QAAQ,IAAI,MAAM,CAAC,YAAY,CAAC;QAC3C,CAAC,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,SAAS,CAAC;QAChD,CAAC,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,+BAA+B,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,GAAG,SAAS,CAAC,IAAI,yBAAyB,CAAC;IACjI,CAAC;IACD,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,EAAE,CAAC;QAAE,OAAO,gCAAgC,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAE1C,0DAA0D;AAC1D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,iBAAiB,EAAE,eAAe,CAAU,CAAC;AAG9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,EAAE,CAAC;AAErD;;;;GAIG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,GAAG,CAAC;AAkBvD,6EAA6E;AAC7E,MAAM,UAAU,sBAAsB,CAAC,UAAyB,EAAE,GAAS;IACzE,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5C,OAAO,CACL,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,mCAAmC,GAAG,IAAI,CAC5F,CAAC;AACJ,CAAC"}

package/dist/redirect-emit-caddy.d.ts

@@ -0,0 +1,44 @@
+/**
+ * The redirect plan as a Caddyfile snippet (self-hosted, #587).
+ *
+ * The static generator writes it to `<build>/_redirects.caddy`; each public
+ * Caddy site block imports the file of the build it serves, and the Caddy
+ * container reloads itself when a deploy changes it (caddy-redirects.ts in
+ * @caelo-cms/provisioning). A redirect is answered by Caddy itself with no
+ * compute on the request path and no channel from the admin into Caddy. A
+ * snippet Caddy rejects leaves the previous config running.
+ *
+ * Shape: one `map` from the request path to the target and status, then one
+ * `redir` per status keyed on the mapped status. `map` is an exact,
+ * case-sensitive string lookup — unlike Caddy's `path` matcher, which is
+ * case-insensitive and would let `/About` shadow a live `/about`. One map
+ * keeps the config O(1) in directives however many rows the table holds.
+ * `redir` sorts before `try_files` / `file_server` / `handle`, so the
+ * directive order inside the site block does not matter.
+ */
+import type { RedirectPlan } from "./redirect-plan.js";
+/** The file name the generator writes the snippet to, at the build root. */
+export declare const CADDY_REDIRECTS_FILE = "_redirects.caddy";
+/**
+ * The `import` line for a site block serving `siteRoot`. The trailing `*`
+ * (Caddy's import globs allow exactly one) lets a site root without a build
+ * yet — fresh install, nothing published — import nothing instead of failing
+ * Caddy's start; Caddy only errors on a missing import without a wildcard.
+ * Every build the generator writes carries the file.
+ */
+export declare function caddyRedirectsImport(siteRoot: string): string;
+/**
+ * Render the plan as a Caddyfile snippet for a site block.
+ *
+ * @example
+ *   emitCaddyRedirects({ redirects: [{ fromPath: "/old", matchPaths: ["/old", "/old/"],
+ *     location: "/new/", statusCode: 301, preserveQuery: true }], gone: [], shadowedByBuild: [] })
+ *   // map {path} {caelo_redirect_to} {caelo_redirect_status} {
+ *   //   /old /new/{?query} 301
+ *   //   /old/ /new/{?query} 301
+ *   // }
+ *   // @caelo_redirect_301 vars {caelo_redirect_status} 301
+ *   // redir @caelo_redirect_301 {caelo_redirect_to} 301
+ */
+export declare function emitCaddyRedirects(plan: RedirectPlan): string;
+//# sourceMappingURL=redirect-emit-caddy.d.ts.map

package/dist/redirect-emit-caddy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect-emit-caddy.d.ts","sourceRoot":"","sources":["../src/redirect-emit-caddy.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,4EAA4E;AAC5E,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AAEvD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE7D;AAaD;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CA8B7D"}

package/dist/redirect-emit-caddy.js

@@ -0,0 +1,76 @@
+// SPDX-License-Identifier: MPL-2.0
+import { trimTrailingSlashes } from "./url.js";
+/** The file name the generator writes the snippet to, at the build root. */
+export const CADDY_REDIRECTS_FILE = "_redirects.caddy";
+/**
+ * The `import` line for a site block serving `siteRoot`. The trailing `*`
+ * (Caddy's import globs allow exactly one) lets a site root without a build
+ * yet — fresh install, nothing published — import nothing instead of failing
+ * Caddy's start; Caddy only errors on a missing import without a wildcard.
+ * Every build the generator writes carries the file.
+ */
+export function caddyRedirectsImport(siteRoot) {
+    return `import ${trimTrailingSlashes(siteRoot)}/${CADDY_REDIRECTS_FILE}*`;
+}
+const PLACEHOLDER_TARGET = "caelo_redirect_to";
+const PLACEHOLDER_STATUS = "caelo_redirect_status";
+/**
+ * Characters a Caddyfile token cannot carry literally: `{`/`}` start a
+ * placeholder, quotes and backticks delimit tokens. Stored paths are
+ * percent-encoded URLs, so these never occur in practice; a row that has
+ * them fails the build rather than becoming a different rule.
+ */
+const CADDY_UNSAFE = /[{}"`\\]/;
+/**
+ * Render the plan as a Caddyfile snippet for a site block.
+ *
+ * @example
+ *   emitCaddyRedirects({ redirects: [{ fromPath: "/old", matchPaths: ["/old", "/old/"],
+ *     location: "/new/", statusCode: 301, preserveQuery: true }], gone: [], shadowedByBuild: [] })
+ *   // map {path} {caelo_redirect_to} {caelo_redirect_status} {
+ *   //   /old /new/{?query} 301
+ *   //   /old/ /new/{?query} 301
+ *   // }
+ *   // @caelo_redirect_301 vars {caelo_redirect_status} 301
+ *   // redir @caelo_redirect_301 {caelo_redirect_to} 301
+ */
+export function emitCaddyRedirects(plan) {
+    const lines = [
+        "# Auto-generated by Caelo static-generator from the redirects table. Do not edit.",
+    ];
+    if (plan.redirects.length === 0 && plan.gone.length === 0)
+        return `${lines[0]}\n`;
+    lines.push(`map {path} {${PLACEHOLDER_TARGET}} {${PLACEHOLDER_STATUS}} {`);
+    for (const r of plan.redirects) {
+        assertCaddySafe(r.fromPath, r.location);
+        const target = r.preserveQuery ? `${r.location}{?query}` : r.location;
+        for (const path of r.matchPaths)
+            lines.push(`\t${path} ${target} ${r.statusCode}`);
+    }
+    for (const g of plan.gone) {
+        assertCaddySafe(g.fromPath, "");
+        for (const path of g.matchPaths)
+            lines.push(`\t${path} - 410`);
+    }
+    lines.push("}");
+    const statuses = [...new Set(plan.redirects.map((r) => r.statusCode))].sort();
+    for (const status of statuses) {
+        lines.push(`@caelo_redirect_${status} vars {${PLACEHOLDER_STATUS}} ${status}`);
+        lines.push(`redir @caelo_redirect_${status} {${PLACEHOLDER_TARGET}} ${status}`);
+    }
+    if (plan.gone.length > 0) {
+        // `handle` (not a bare `respond`): `respond` sorts after `handle`, so a
+        // catch-all `handle { file_server }` in the site block would win.
+        lines.push(`@caelo_gone vars {${PLACEHOLDER_STATUS}} 410`);
+        lines.push("handle @caelo_gone {", "\trespond 410", "}");
+    }
+    return `${lines.join("\n")}\n`;
+}
+function assertCaddySafe(fromPath, location) {
+    for (const value of [fromPath, location]) {
+        if (CADDY_UNSAFE.test(value)) {
+            throw new Error(`redirect-emit-caddy: the redirect for ${JSON.stringify(fromPath)} contains one of { } " \` \\ in ${JSON.stringify(value)}, which a Caddyfile cannot carry literally. Percent-encode the character in the stored path (e.g. '{' is '%7B') with bulk_create_redirects (upsert), then rebuild.`);
+        }
+    }
+}
+//# sourceMappingURL=redirect-emit-caddy.js.map

package/dist/redirect-emit-caddy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect-emit-caddy.js","sourceRoot":"","sources":["../src/redirect-emit-caddy.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAsBnC,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAE/C,4EAA4E;AAC5E,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAEvD;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,OAAO,UAAU,mBAAmB,CAAC,QAAQ,CAAC,IAAI,oBAAoB,GAAG,CAAC;AAC5E,CAAC;AAED,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AAC/C,MAAM,kBAAkB,GAAG,uBAAuB,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,YAAY,GAAG,UAAU,CAAC;AAEhC;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAkB;IACnD,MAAM,KAAK,GAAG;QACZ,mFAAmF;KACpF,CAAC;IACF,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAElF,KAAK,CAAC,IAAI,CAAC,eAAe,kBAAkB,MAAM,kBAAkB,KAAK,CAAC,CAAC;IAC3E,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,eAAe,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QACtE,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,UAAU;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,MAAM,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,eAAe,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,UAAU;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,CAAC;IACjE,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEhB,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9E,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,mBAAmB,MAAM,UAAU,kBAAkB,KAAK,MAAM,EAAE,CAAC,CAAC;QAC/E,KAAK,CAAC,IAAI,CAAC,yBAAyB,MAAM,KAAK,kBAAkB,KAAK,MAAM,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,wEAAwE;QACxE,kEAAkE;QAClE,KAAK,CAAC,IAAI,CAAC,qBAAqB,kBAAkB,OAAO,CAAC,CAAC;QAC3D,KAAK,CAAC,IAAI,CAAC,sBAAsB,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB,EAAE,QAAgB;IACzD,KAAK,MAAM,KAAK,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;QACzC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,yCAAyC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,mCAAmC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,oKAAoK,CAC9R,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/redirect-emit-cloudfront.d.ts

@@ -0,0 +1,55 @@
+/**
+ * The redirect plan for CloudFront (provider `aws`, #587).
+ *
+ * CloudFront has no static redirect rules; the edge-native way is a
+ * CloudFront Function on viewer-request reading a CloudFront KeyValueStore.
+ * The function is a sub-millisecond lookup that runs at the edge before the
+ * S3 origin (no Lambda, no origin round-trip), and the store is updated by
+ * the deploy without republishing the function. S3 website routing rules are
+ * not an option: they are capped at 50 and need the website endpoint, while
+ * the stack serves S3 through an origin access identity.
+ *
+ * One key per request path the plan answers (`/old`, `/old/`), value a small
+ * JSON document. Store limits (CloudFront quotas, fixed): 5 MB per store,
+ * keys up to 512 bytes, values up to 1 KB. A plan that does not fit is
+ * refused with {@link CloudFrontKvsLimitError}; nothing is written.
+ */
+import type { RedirectPlan } from "./redirect-plan.js";
+/** CloudFront KeyValueStore limits. */
+export declare const CLOUDFRONT_KVS_MAX_TOTAL_BYTES: number;
+export declare const CLOUDFRONT_KVS_MAX_KEY_BYTES = 512;
+export declare const CLOUDFRONT_KVS_MAX_VALUE_BYTES = 1024;
+/** One KeyValueStore entry. */
+export interface CloudFrontKvsEntry {
+    readonly key: string;
+    readonly value: string;
+}
+/**
+ * The value stored per path: `s` status, `l` Location, `q` 1 when the
+ * visitor's query string is appended. A 410 entry carries only `s`.
+ */
+export interface CloudFrontRedirectValue {
+    readonly s: number;
+    readonly l?: string;
+    readonly q?: 1;
+}
+/** The plan does not fit a CloudFront KeyValueStore; nothing was written. */
+export declare class CloudFrontKvsLimitError extends Error {
+    constructor(detail: string);
+}
+/**
+ * The KeyValueStore entries for a plan, sorted by key.
+ *
+ * @throws {CloudFrontKvsLimitError} when a key, a value or the whole set is
+ *         over the store's limits.
+ */
+export declare function cloudFrontKeyValueEntries(plan: RedirectPlan): CloudFrontKvsEntry[];
+/**
+ * Source of the viewer-request CloudFront Function (runtime
+ * `cloudfront-js-2.0`) that answers the store's entries. A path without an
+ * entry passes through to the origin unchanged.
+ *
+ * @param kvsId The KeyValueStore's id (the last segment of its ARN).
+ */
+export declare function cloudFrontRedirectFunctionCode(kvsId: string): string;
+//# sourceMappingURL=redirect-emit-cloudfront.d.ts.map

package/dist/redirect-emit-cloudfront.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect-emit-cloudfront.d.ts","sourceRoot":"","sources":["../src/redirect-emit-cloudfront.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,uCAAuC;AACvC,eAAO,MAAM,8BAA8B,QAAkB,CAAC;AAC9D,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAChD,eAAO,MAAM,8BAA8B,OAAO,CAAC;AAEnD,+BAA+B;AAC/B,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;CAChB;AAED,6EAA6E;AAC7E,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,MAAM,EAAE,MAAM;CAM3B;AAID;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,YAAY,GAAG,kBAAkB,EAAE,CAmClF;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAwCpE"}

package/dist/redirect-emit-cloudfront.js

@@ -0,0 +1,99 @@
+// SPDX-License-Identifier: MPL-2.0
+/** CloudFront KeyValueStore limits. */
+export const CLOUDFRONT_KVS_MAX_TOTAL_BYTES = 5 * 1024 * 1024;
+export const CLOUDFRONT_KVS_MAX_KEY_BYTES = 512;
+export const CLOUDFRONT_KVS_MAX_VALUE_BYTES = 1024;
+/** The plan does not fit a CloudFront KeyValueStore; nothing was written. */
+export class CloudFrontKvsLimitError extends Error {
+    constructor(detail) {
+        super(`redirect-emit-cloudfront: ${detail} Nothing was published and the live redirects are unchanged. Delete redirects nobody links to any more (find_redirects lists them, bulk_delete_redirects removes them), then publish again.`);
+        this.name = "CloudFrontKvsLimitError";
+    }
+}
+const utf8Length = (s) => new TextEncoder().encode(s).length;
+/**
+ * The KeyValueStore entries for a plan, sorted by key.
+ *
+ * @throws {CloudFrontKvsLimitError} when a key, a value or the whole set is
+ *         over the store's limits.
+ */
+export function cloudFrontKeyValueEntries(plan) {
+    const entries = [];
+    for (const r of plan.redirects) {
+        const value = {
+            s: r.statusCode,
+            l: r.location,
+            ...(r.preserveQuery ? { q: 1 } : {}),
+        };
+        for (const key of r.matchPaths)
+            entries.push({ key, value: JSON.stringify(value) });
+    }
+    for (const g of plan.gone) {
+        for (const key of g.matchPaths)
+            entries.push({ key, value: JSON.stringify({ s: 410 }) });
+    }
+    entries.sort((a, b) => (a.key < b.key ? -1 : a.key > b.key ? 1 : 0));
+    let total = 0;
+    for (const e of entries) {
+        if (utf8Length(e.key) > CLOUDFRONT_KVS_MAX_KEY_BYTES) {
+            throw new CloudFrontKvsLimitError(`the redirect path ${JSON.stringify(e.key)} is longer than the ${CLOUDFRONT_KVS_MAX_KEY_BYTES}-byte key limit.`);
+        }
+        if (utf8Length(e.value) > CLOUDFRONT_KVS_MAX_VALUE_BYTES) {
+            throw new CloudFrontKvsLimitError(`the redirect target for ${JSON.stringify(e.key)} is longer than the ${CLOUDFRONT_KVS_MAX_VALUE_BYTES}-byte value limit.`);
+        }
+        total += utf8Length(e.key) + utf8Length(e.value);
+    }
+    if (total > CLOUDFRONT_KVS_MAX_TOTAL_BYTES) {
+        throw new CloudFrontKvsLimitError(`the ${entries.length} redirect path(s) need ${total} bytes; a store holds ${CLOUDFRONT_KVS_MAX_TOTAL_BYTES}.`);
+    }
+    return entries;
+}
+/**
+ * Source of the viewer-request CloudFront Function (runtime
+ * `cloudfront-js-2.0`) that answers the store's entries. A path without an
+ * entry passes through to the origin unchanged.
+ *
+ * @param kvsId The KeyValueStore's id (the last segment of its ARN).
+ */
+export function cloudFrontRedirectFunctionCode(kvsId) {
+    if (!/^[A-Za-z0-9-]+$/.test(kvsId)) {
+        throw new Error(`redirect-emit-cloudfront: ${JSON.stringify(kvsId)} is not a KeyValueStore id`);
+    }
+    return `import cf from 'cloudfront';
+
+// Generated by @caelo-cms/shared (redirect-emit-cloudfront.ts). Answers the
+// redirects table from the KeyValueStore the deploy writes (#587).
+const kvs = cf.kvs('${kvsId}');
+const REASON = {
+  301: 'Moved Permanently',
+  302: 'Found',
+  307: 'Temporary Redirect',
+  308: 'Permanent Redirect',
+};
+
+async function handler(event) {
+  const request = event.request;
+  let hit;
+  try {
+    hit = await kvs.get(request.uri, { format: 'json' });
+  } catch (e) {
+    // kvs.get throws for a key that is not in the store: no redirect.
+    return request;
+  }
+  if (hit.s === 410) {
+    return { statusCode: 410, statusDescription: 'Gone' };
+  }
+  let location = hit.l;
+  if (hit.q === 1) {
+    const query = request.rawQueryString();
+    if (query) location += '?' + query;
+  }
+  return {
+    statusCode: hit.s,
+    statusDescription: REASON[hit.s],
+    headers: { location: { value: location } },
+  };
+}
+`;
+}
+//# sourceMappingURL=redirect-emit-cloudfront.js.map

package/dist/redirect-emit-cloudfront.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect-emit-cloudfront.js","sourceRoot":"","sources":["../src/redirect-emit-cloudfront.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAqBnC,uCAAuC;AACvC,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAC9D,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAChD,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,CAAC;AAkBnD,6EAA6E;AAC7E,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,MAAc;QACxB,KAAK,CACH,6BAA6B,MAAM,6LAA6L,CACjO,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,MAAM,UAAU,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAE7E;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAkB;IAC1D,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,KAAK,GAA4B;YACrC,CAAC,EAAE,CAAC,CAAC,UAAU;YACf,CAAC,EAAE,CAAC,CAAC,QAAQ;YACb,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9C,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,UAAU;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,UAAU;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAErE,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,4BAA4B,EAAE,CAAC;YACrD,MAAM,IAAI,uBAAuB,CAC/B,qBAAqB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,uBAAuB,4BAA4B,kBAAkB,CAChH,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,8BAA8B,EAAE,CAAC;YACzD,MAAM,IAAI,uBAAuB,CAC/B,2BAA2B,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,uBAAuB,8BAA8B,oBAAoB,CAC1H,CAAC;QACJ,CAAC;QACD,KAAK,IAAI,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,KAAK,GAAG,8BAA8B,EAAE,CAAC;QAC3C,MAAM,IAAI,uBAAuB,CAC/B,OAAO,OAAO,CAAC,MAAM,0BAA0B,KAAK,yBAAyB,8BAA8B,GAAG,CAC/G,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAAC,KAAa;IAC1D,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAClG,CAAC;IACD,OAAO;;;;sBAIa,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+B1B,CAAC;AACF,CAAC"}

package/dist/redirect-emit-front-door.d.ts

@@ -0,0 +1,63 @@
+/**
+ * The redirect plan as Azure Front Door (Standard) rules-engine rules
+ * (provider `azure`, #587).
+ *
+ * Front Door's rules engine answers a `UrlRedirect` action at the edge,
+ * before the Blob static-website origin, so no compute sits on the request
+ * path. Each planned redirect is one rule: a `UrlPath` condition (Front Door
+ * matches the path WITHOUT its leading slash) and a `UrlRedirect` action.
+ *
+ * Limit (Front Door Standard and Premium, fixed): 100 rules per rule set and
+ * per route. A plan with more redirects is refused with
+ * {@link FrontDoorRuleLimitError} before anything is written — never a
+ * partial set. Front Door cannot answer a bare 410, so `gone` entries get
+ * the origin's 404. Writing the rules at deploy time is tracked in #750.
+ */
+import type { RedirectPlan } from "./redirect-plan.js";
+/** Rules per rule set / per route on Front Door Standard and Premium. */
+export declare const FRONT_DOOR_MAX_RULES = 100;
+type FrontDoorRedirectType = "Moved" | "Found" | "TemporaryRedirect" | "PermanentRedirect";
+/** One rule, in the shape of `azure-native` `cdn.Rule` arguments (ARM). */
+export interface FrontDoorRedirectRule {
+    readonly ruleName: string;
+    readonly order: number;
+    readonly matchProcessingBehavior: "Stop";
+    readonly conditions: readonly [
+        {
+            readonly name: "UrlPath";
+            readonly parameters: {
+                readonly typeName: "DeliveryRuleUrlPathMatchConditionParameters";
+                readonly operator: "Equal";
+                readonly negateCondition: false;
+                readonly matchValues: readonly string[];
+                readonly transforms: readonly [];
+            };
+        }
+    ];
+    readonly actions: readonly [
+        {
+            readonly name: "UrlRedirect";
+            readonly parameters: {
+                readonly typeName: "DeliveryRuleUrlRedirectActionParameters";
+                readonly redirectType: FrontDoorRedirectType;
+                readonly destinationProtocol: "MatchRequest";
+                readonly customPath: string;
+                readonly customQueryString?: string;
+                readonly customFragment?: string;
+            };
+        }
+    ];
+}
+/** The plan has more redirects than a Front Door route can hold. */
+export declare class FrontDoorRuleLimitError extends Error {
+    readonly redirectCount: number;
+    constructor(redirectCount: number);
+}
+/**
+ * One rule per planned redirect, ordered as the plan.
+ *
+ * @throws {FrontDoorRuleLimitError} over {@link FRONT_DOOR_MAX_RULES}.
+ */
+export declare function frontDoorRedirectRules(plan: RedirectPlan): FrontDoorRedirectRule[];
+export {};
+//# sourceMappingURL=redirect-emit-front-door.d.ts.map

package/dist/redirect-emit-front-door.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect-emit-front-door.d.ts","sourceRoot":"","sources":["../src/redirect-emit-front-door.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAmB,YAAY,EAAsB,MAAM,oBAAoB,CAAC;AAE5F,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,MAAM,CAAC;AAExC,KAAK,qBAAqB,GAAG,OAAO,GAAG,OAAO,GAAG,mBAAmB,GAAG,mBAAmB,CAAC;AAS3F,2EAA2E;AAC3E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,SAAS;QAC5B;YACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;YACzB,QAAQ,CAAC,UAAU,EAAE;gBACnB,QAAQ,CAAC,QAAQ,EAAE,6CAA6C,CAAC;gBACjE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;gBAC3B,QAAQ,CAAC,eAAe,EAAE,KAAK,CAAC;gBAChC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;gBACxC,QAAQ,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;aAClC,CAAC;SACH;KACF,CAAC;IACF,QAAQ,CAAC,OAAO,EAAE,SAAS;QACzB;YACE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;YAC7B,QAAQ,CAAC,UAAU,EAAE;gBACnB,QAAQ,CAAC,QAAQ,EAAE,yCAAyC,CAAC;gBAC7D,QAAQ,CAAC,YAAY,EAAE,qBAAqB,CAAC;gBAC7C,QAAQ,CAAC,mBAAmB,EAAE,cAAc,CAAC;gBAC7C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;gBAC5B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;gBACpC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;aAClC,CAAC;SACH;KACF,CAAC;CACH;AAED,oEAAoE;AACpE,qBAAa,uBAAwB,SAAQ,KAAK;IACpC,QAAQ,CAAC,aAAa,EAAE,MAAM;gBAArB,aAAa,EAAE,MAAM;CAM3C;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,YAAY,GAAG,qBAAqB,EAAE,CAKlF"}

package/dist/redirect-emit-front-door.js

@@ -0,0 +1,79 @@
+// SPDX-License-Identifier: MPL-2.0
+/** Rules per rule set / per route on Front Door Standard and Premium. */
+export const FRONT_DOOR_MAX_RULES = 100;
+const REDIRECT_TYPE = {
+    301: "Moved",
+    302: "Found",
+    307: "TemporaryRedirect",
+    308: "PermanentRedirect",
+};
+/** The plan has more redirects than a Front Door route can hold. */
+export class FrontDoorRuleLimitError extends Error {
+    redirectCount;
+    constructor(redirectCount) {
+        super(`Azure Front Door serves at most ${FRONT_DOOR_MAX_RULES} redirect rules per site (a fixed rules-engine limit); this site has ${redirectCount}. Nothing was published and the live redirects are unchanged. Delete redirects nobody links to any more (find_redirects lists them, bulk_delete_redirects removes them), then publish again. Larger sets on Azure are tracked in https://github.com/caelo-cms/caelo-cms/issues/750.`);
+        this.redirectCount = redirectCount;
+        this.name = "FrontDoorRuleLimitError";
+    }
+}
+/**
+ * One rule per planned redirect, ordered as the plan.
+ *
+ * @throws {FrontDoorRuleLimitError} over {@link FRONT_DOOR_MAX_RULES}.
+ */
+export function frontDoorRedirectRules(plan) {
+    if (plan.redirects.length > FRONT_DOOR_MAX_RULES) {
+        throw new FrontDoorRuleLimitError(plan.redirects.length);
+    }
+    return plan.redirects.map((r, i) => toRule(r, i + 1));
+}
+function toRule(r, order) {
+    const { path, query, fragment } = splitLocation(r.location);
+    return {
+        // Rule names: letters and digits only, starting with a letter.
+        ruleName: `caeloRedirect${order}`,
+        order,
+        matchProcessingBehavior: "Stop",
+        conditions: [
+            {
+                name: "UrlPath",
+                parameters: {
+                    typeName: "DeliveryRuleUrlPathMatchConditionParameters",
+                    operator: "Equal",
+                    negateCondition: false,
+                    matchValues: r.matchPaths.map((p) => p.slice(1)),
+                    transforms: [],
+                },
+            },
+        ],
+        actions: [
+            {
+                name: "UrlRedirect",
+                parameters: {
+                    typeName: "DeliveryRuleUrlRedirectActionParameters",
+                    redirectType: REDIRECT_TYPE[r.statusCode],
+                    destinationProtocol: "MatchRequest",
+                    customPath: path,
+                    // Without customQueryString Front Door keeps the visitor's query,
+                    // which is the plan's preserveQuery semantics.
+                    ...(query !== null ? { customQueryString: query } : {}),
+                    ...(fragment !== null ? { customFragment: fragment } : {}),
+                },
+            },
+        ],
+    };
+}
+function splitLocation(location) {
+    const hashAt = location.indexOf("#");
+    const beforeHash = hashAt === -1 ? location : location.slice(0, hashAt);
+    const fragment = hashAt === -1 ? null : location.slice(hashAt + 1);
+    const queryAt = beforeHash.indexOf("?");
+    return {
+        path: queryAt === -1 ? beforeHash : beforeHash.slice(0, queryAt),
+        // A target with only a fragment still replaces the visitor's query, as
+        // on every other provider (preserveQuery is false for it).
+        query: queryAt === -1 ? (fragment === null ? null : "") : beforeHash.slice(queryAt + 1),
+        fragment,
+    };
+}
+//# sourceMappingURL=redirect-emit-front-door.js.map

package/dist/redirect-emit-front-door.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect-emit-front-door.js","sourceRoot":"","sources":["../src/redirect-emit-front-door.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAoBnC,yEAAyE;AACzE,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAIxC,MAAM,aAAa,GAAsD;IACvE,GAAG,EAAE,OAAO;IACZ,GAAG,EAAE,OAAO;IACZ,GAAG,EAAE,mBAAmB;IACxB,GAAG,EAAE,mBAAmB;CACzB,CAAC;AAkCF,oEAAoE;AACpE,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAC3B;IAArB,YAAqB,aAAqB;QACxC,KAAK,CACH,mCAAmC,oBAAoB,wEAAwE,aAAa,qRAAqR,CACla,CAAC;QAHiB,kBAAa,GAAb,aAAa,CAAQ;QAIxC,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAkB;IACvD,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;QACjD,MAAM,IAAI,uBAAuB,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,MAAM,CAAC,CAAkB,EAAE,KAAa;IAC/C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC5D,OAAO;QACL,+DAA+D;QAC/D,QAAQ,EAAE,gBAAgB,KAAK,EAAE;QACjC,KAAK;QACL,uBAAuB,EAAE,MAAM;QAC/B,UAAU,EAAE;YACV;gBACE,IAAI,EAAE,SAAS;gBACf,UAAU,EAAE;oBACV,QAAQ,EAAE,6CAA6C;oBACvD,QAAQ,EAAE,OAAO;oBACjB,eAAe,EAAE,KAAK;oBACtB,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBAChD,UAAU,EAAE,EAAE;iBACf;aACF;SACF;QACD,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,aAAa;gBACnB,UAAU,EAAE;oBACV,QAAQ,EAAE,yCAAyC;oBACnD,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC;oBACzC,mBAAmB,EAAE,cAAc;oBACnC,UAAU,EAAE,IAAI;oBAChB,kEAAkE;oBAClE,+CAA+C;oBAC/C,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvD,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC3D;aACF;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IAKrC,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACxC,OAAO;QACL,IAAI,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC;QAChE,uEAAuE;QACvE,2DAA2D;QAC3D,KAAK,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;QACvF,QAAQ;KACT,CAAC;AACJ,CAAC"}