@cat-factory/cli 0.6.2 → 0.7.1

package/dist/envCommand.js

@@ -0,0 +1,128 @@
+import { dirname, join, resolve } from 'node:path';
+import { OPTION_DEFAULTS } from './args.js';
+import { buildLocalEnv } from './env.js';
+import { ALL_NATIVE_HARNESSES, NATIVE_HARNESS_INFO } from './execution.js';
+import { realFs } from './fs.js';
+import { buildGitignore, mergeGitignore } from './gitignore.js';
+import { createConsoleIo } from './io.js';
+import { resolveContainerRuntime, resolveExecution, resolveProvider, resolveSecrets, resolveToken, } from './resolve.js';
+import {} from './secrets.js';
+import { patEnvVar, providerLabel } from './vcs.js';
+export class EnvCommandError extends Error {
+}
+/**
+ * Generate a ready-to-run local-mode `.env` (and nothing else). Unlike `init` (which scaffolds a
+ * whole project), this writes ONE `.env` into the target directory (default: the cwd), populated
+ * so `@cat-factory/local-server` boots with no manual edits: all three required crypto secrets
+ * (`AUTH_SESSION_SECRET`, `ENCRYPTION_KEY`, `HARNESS_SHARED_SECRET`) generated in the server's
+ * required formats, the chosen VCS PAT (minted via the pre-scoped browser flow), and the
+ * execution mode (prewarmed Docker pool vs native host agents). Model-provider keys are left as
+ * commented hints — they are added through the UI after boot, so the file is runnable without
+ * them. Returns the absolute path of the written `.env`.
+ */
+export async function generateEnv(options, deps = {}) {
+    const io = deps.io ?? createConsoleIo();
+    const fs = deps.fs ?? realFs;
+    const cwd = deps.cwd ?? process.cwd();
+    io.info('\ncat-factory — generate a ready-to-run local-mode .env\n');
+    const outDir = resolve(cwd, options.dir ?? '.');
+    const envPath = join(outDir, '.env');
+    // A `.env` holds secrets — never clobber an existing one silently. Refuse loudly (with the
+    // --force escape hatch) rather than overwrite generated secrets a developer is relying on.
+    if (fs.existsSync(envPath) && !options.force) {
+        throw new EnvCommandError(`${envPath} already exists — pass --force to overwrite it.`);
+    }
+    const provider = await resolveProvider(options, io);
+    const databaseUrl = options.databaseUrl ??
+        (options.yes
+            ? OPTION_DEFAULTS.databaseUrl
+            : await io.question('Postgres DATABASE_URL', OPTION_DEFAULTS.databaseUrl));
+    const port = options.port ?? OPTION_DEFAULTS.port;
+    const harnessImage = options.harnessImage ?? OPTION_DEFAULTS.harnessImage;
+    const containerRuntime = await resolveContainerRuntime(options, io);
+    const corsAllowedOrigins = 'http://localhost:3000';
+    const execution = await resolveExecution(options, io);
+    const token = await resolveToken(options, provider, io);
+    const secrets = await resolveSecrets(options, io, deps.randomBytes);
+    const content = buildLocalEnv({
+        databaseUrl,
+        authSessionSecret: secrets.authSessionSecret,
+        encryptionKey: secrets.encryptionKey,
+        harnessSharedSecret: secrets.harnessSharedSecret,
+        harnessImage,
+        port,
+        corsAllowedOrigins,
+        provider,
+        containerRuntime,
+        executionMode: execution.mode,
+        nativeHarnesses: execution.nativeHarnesses,
+        harnessEntry: execution.harnessEntry,
+        token,
+    });
+    fs.mkdirSync(dirname(envPath), { recursive: true });
+    fs.writeFileSync(envPath, content);
+    io.info(`\nWrote ${envPath}  (secret — gitignore it, never commit it)`);
+    // A `.env` written into a bare dir is only safe if something ignores it. Rather than rely on a
+    // printed reminder (or a parent `.gitignore` that may not exist), guarantee it the same way
+    // `init` does: create/merge the required ignore rules into the target dir's own `.gitignore`.
+    const gitignoreWritten = ensureGitignore(fs, io, outDir);
+    printNextSteps(io, {
+        gitignoreWritten,
+        envPath,
+        provider,
+        port,
+        tokenProvided: token !== '',
+        execution,
+    });
+    return envPath;
+}
+/**
+ * Guarantee the freshly written `.env` can't be committed: create the target dir's `.gitignore`
+ * (or merge the required rules into an existing one). Idempotent — merging into a dir that already
+ * ignores `.env` (e.g. `deploy/local`) appends nothing. Returns whether the file was (re)written.
+ */
+function ensureGitignore(fs, io, outDir) {
+    const gitignorePath = join(outDir, '.gitignore');
+    const existing = fs.existsSync(gitignorePath) ? fs.readFileSync(gitignorePath, 'utf8') : undefined;
+    const next = existing === undefined ? buildGitignore() : mergeGitignore(existing);
+    if (next === existing)
+        return false;
+    fs.writeFileSync(gitignorePath, next);
+    io.info(`Ensured ${gitignorePath} ignores .env`);
+    return true;
+}
+function printNextSteps(io, input) {
+    const lines = [
+        '',
+        'Done. Your local-mode .env is ready to run from a scaffolded deployment dir',
+        '(one made by `cat-factory init`, or deploy/local in the repo) that provides these scripts:',
+        '',
+        '  npm run db:up      # start local Postgres (docker compose)',
+        '  npm start          # migrate + serve the API on :' + String(input.port),
+        '',
+        'If you ran this in a bare directory, wire up a deployment first (see `cat-factory init`).',
+        '',
+        'Reminders:',
+        `  - Pull the executor image:  docker pull ${OPTION_DEFAULTS.harnessImage}`,
+        '  - No model-provider key is needed to boot — add providers/keys in the UI after sign-in',
+        '    (or uncomment CLOUDFLARE_* / ANTHROPIC_API_KEY / OPENAI_API_KEY in the .env).',
+    ];
+    if (input.execution.mode === 'native') {
+        const clis = (input.execution.nativeHarnesses ?? [...ALL_NATIVE_HARNESSES])
+            .map((h) => NATIVE_HARNESS_INFO[h].cli)
+            .join(' / ');
+        lines.push(`  - Native mode: install + log in to the ${clis} CLI on this host (the harness server`, '    is bundled; the image above still runs non-native steps).');
+    }
+    else {
+        lines.push('  - Warm pool (faster starts) is optional — configure it in the UI under Integrations >', '    "Local mode" (recommended to start: size 3, pre-warm 1).');
+    }
+    if (!input.tokenProvided) {
+        lines.push(`  - Set your ${providerLabel(input.provider)} token (${patEnvVar(input.provider)}) in the ` +
+            '.env before running agents.');
+    }
+    lines.push(input.gitignoreWritten
+        ? '  - The .env holds secrets; the .gitignore now keeps it out of git — never commit it.'
+        : '  - The .env holds secrets and must stay gitignored — never commit it.');
+    io.info(lines.join('\n'));
+}
+//# sourceMappingURL=envCommand.js.map

package/dist/envCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envCommand.js","sourceRoot":"","sources":["../src/envCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EAAmB,eAAe,EAAE,MAAM,WAAW,CAAA;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AAC1E,OAAO,EAAmB,MAAM,EAAE,MAAM,SAAS,CAAA;AACjD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC/D,OAAO,EAAE,eAAe,EAAW,MAAM,SAAS,CAAA;AAClD,OAAO,EAEL,uBAAuB,EACvB,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,YAAY,GACb,MAAM,cAAc,CAAA;AACrB,OAAO,EAAoB,MAAM,cAAc,CAAA;AAC/C,OAAO,EAAE,SAAS,EAAE,aAAa,EAAoB,MAAM,UAAU,CAAA;AAUrE,MAAM,OAAO,eAAgB,SAAQ,KAAK;CAAG;AAE7C;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAmB,EAAE,IAAI,GAAmB,EAAE;IAC9E,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,eAAe,EAAE,CAAA;IACvC,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,MAAM,CAAA;IAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAA;IAErC,EAAE,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAA;IAEpE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAA;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACpC,2FAA2F;IAC3F,2FAA2F;IAC3F,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAC7C,MAAM,IAAI,eAAe,CAAC,GAAG,OAAO,iDAAiD,CAAC,CAAA;IACxF,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;IACnD,MAAM,WAAW,GACf,OAAO,CAAC,WAAW;QACnB,CAAC,OAAO,CAAC,GAAG;YACV,CAAC,CAAC,eAAe,CAAC,WAAW;YAC7B,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uBAAuB,EAAE,eAAe,CAAC,WAAW,CAAC,CAAC,CAAA;IAC9E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,eAAe,CAAC,IAAI,CAAA;IACjD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,eAAe,CAAC,YAAY,CAAA;IACzE,MAAM,gBAAgB,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;IACnE,MAAM,kBAAkB,GAAG,uBAAuB,CAAA;IAClD,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;IACrD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAA;IACvD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,CAAA;IAEnE,MAAM,OAAO,GAAG,aAAa,CAAC;QAC5B,WAAW;QACX,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,YAAY;QACZ,IAAI;QACJ,kBAAkB;QAClB,QAAQ;QACR,gBAAgB;QAChB,aAAa,EAAE,SAAS,CAAC,IAAI;QAC7B,eAAe,EAAE,SAAS,CAAC,eAAe;QAC1C,YAAY,EAAE,SAAS,CAAC,YAAY;QACpC,KAAK;KACN,CAAC,CAAA;IAEF,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACnD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IAClC,EAAE,CAAC,IAAI,CAAC,WAAW,OAAO,4CAA4C,CAAC,CAAA;IAEvE,+FAA+F;IAC/F,4FAA4F;IAC5F,8FAA8F;IAC9F,MAAM,gBAAgB,GAAG,eAAe,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,CAAA;IAExD,cAAc,CAAC,EAAE,EAAE;QACjB,gBAAgB;QAChB,OAAO;QACP,QAAQ;QACR,IAAI;QACJ,aAAa,EAAE,KAAK,KAAK,EAAE;QAC3B,SAAS;KACV,CAAC,CAAA;IACF,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,EAAc,EAAE,EAAM,EAAE,MAAc;IAC7D,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IAChD,MAAM,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAClG,MAAM,IAAI,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAA;IACjF,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACnC,EAAE,CAAC,aAAa,CAAC,aAAa,EAAE,IAAI,CAAC,CAAA;IACrC,EAAE,CAAC,IAAI,CAAC,WAAW,aAAa,eAAe,CAAC,CAAA;IAChD,OAAO,IAAI,CAAA;AACb,CAAC;AAWD,SAAS,cAAc,CAAC,EAAM,EAAE,KAAqB;IACnD,MAAM,KAAK,GAAG;QACZ,EAAE;QACF,6EAA6E;QAC7E,4FAA4F;QAC5F,EAAE;QACF,8DAA8D;QAC9D,qDAAqD,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;QAC1E,EAAE;QACF,2FAA2F;QAC3F,EAAE;QACF,YAAY;QACZ,6CAA6C,eAAe,CAAC,YAAY,EAAE;QAC3E,0FAA0F;QAC1F,mFAAmF;KACpF,CAAA;IACD,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,eAAe,IAAI,CAAC,GAAG,oBAAoB,CAAC,CAAC;aACxE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;aACtC,IAAI,CAAC,KAAK,CAAC,CAAA;QACd,KAAK,CAAC,IAAI,CACR,4CAA4C,IAAI,uCAAuC,EACvF,+DAA+D,CAChE,CAAA;IACH,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CACR,yFAAyF,EACzF,8DAA8D,CAC/D,CAAA;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CACR,gBAAgB,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW;YAC1F,6BAA6B,CAChC,CAAA;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CACR,KAAK,CAAC,gBAAgB;QACpB,CAAC,CAAC,uFAAuF;QACzF,CAAC,CAAC,wEAAwE,CAC7E,CAAA;IACD,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;AAC3B,CAAC"}

package/dist/fs.d.ts

@@ -0,0 +1,12 @@
+/** The filesystem operations the writers need — injectable so the flows are testable. */
+export interface FileSystem {
+    existsSync(path: string): boolean;
+    mkdirSync(path: string, options: {
+        recursive: true;
+    }): void;
+    readFileSync(path: string, encoding: 'utf8'): string;
+    writeFileSync(path: string, data: string): void;
+}
+/** The real, `node:fs`-backed {@link FileSystem}. */
+export declare const realFs: FileSystem;
+//# sourceMappingURL=fs.d.ts.map

package/dist/fs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../src/fs.ts"],"names":[],"mappings":"AAEA,yFAAyF;AACzF,MAAM,WAAW,UAAU;IACzB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;IACjC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,SAAS,EAAE,IAAI,CAAA;KAAE,GAAG,IAAI,CAAA;IAC3D,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAA;IACpD,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD;AAED,qDAAqD;AACrD,eAAO,MAAM,MAAM,EAAE,UASpB,CAAA"}

package/dist/fs.js

@@ -0,0 +1,13 @@
+import * as nodeFs from 'node:fs';
+/** The real, `node:fs`-backed {@link FileSystem}. */
+export const realFs = {
+    existsSync: (p) => nodeFs.existsSync(p),
+    mkdirSync: (p, o) => {
+        nodeFs.mkdirSync(p, o);
+    },
+    readFileSync: (p, e) => nodeFs.readFileSync(p, e),
+    writeFileSync: (p, d) => {
+        nodeFs.writeFileSync(p, d);
+    },
+};
+//# sourceMappingURL=fs.js.map

package/dist/fs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs.js","sourceRoot":"","sources":["../src/fs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,SAAS,CAAA;AAUjC,qDAAqD;AACrD,MAAM,CAAC,MAAM,MAAM,GAAe;IAChC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IACvC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAClB,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IACxB,CAAC;IACD,YAAY,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC;IACjD,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACtB,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IAC5B,CAAC;CACF,CAAA"}

package/dist/index.d.ts

@@ -1,5 +1,7 @@
 export { type CliOptions, HELP_TEXT, K3S_RUNTIMES, type K3sRuntime, OPTION_DEFAULTS, parseArgs, ArgError, } from './args.js';
-export { bootstrap, type BootstrapDeps, type FileSystem, BootstrapError } from './bootstrap.js';
+export { bootstrap, type BootstrapDeps, BootstrapError } from './bootstrap.js';
+export { type EnvCommandDeps, EnvCommandError, generateEnv } from './envCommand.js';
+export { type FileSystem } from './fs.js';
 export { COMMAND_NOT_FOUND, COMMAND_TIMED_OUT, createNodeShell, DEFAULT_COMMAND_TIMEOUT_MS, type HostShell, type ShellResult, } from './host-shell.js';
 export { K3S_INSTALL_COMMAND, type K3sDeps, type K3sResult, setupK3s } from './k3s.js';
 export { buildK3sHandler, buildK3sSetupUrl, DEFAULT_INGRESS_HOST_TEMPLATE, DEFAULT_NAMESPACE_TEMPLATE, handlerLabel, type K3sHandlerInput, KUBERNETES_ENV_TOKEN_SECRET_KEY, } from './k3s-handler.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,KAAK,UAAU,EACf,SAAS,EACT,YAAY,EACZ,KAAK,UAAU,EACf,eAAe,EACf,SAAS,EACT,QAAQ,GACT,MAAM,WAAW,CAAA;AAClB,OAAO,EAAE,SAAS,EAAE,KAAK,aAAa,EAAE,KAAK,UAAU,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC/F,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,KAAK,SAAS,EACd,KAAK,WAAW,GACjB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,mBAAmB,EAAE,KAAK,OAAO,EAAE,KAAK,SAAS,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AACtF,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,6BAA6B,EAC7B,0BAA0B,EAC1B,YAAY,EACZ,KAAK,eAAe,EACpB,+BAA+B,GAChC,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,KAAK,EACV,KAAK,OAAO,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,SAAS,EACT,KAAK,aAAa,GACnB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,aAAa,GACd,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAA;AACzF,OAAO,EAAE,KAAK,EAAE,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,KAAK,cAAc,EAAE,SAAS,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAA;AAC5E,OAAO,EAAE,eAAe,EAAE,KAAK,gBAAgB,EAAE,KAAK,WAAW,EAAE,MAAM,cAAc,CAAA;AACvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAC9C,OAAO,EACL,kBAAkB,EAClB,KAAK,gBAAgB,EACrB,qBAAqB,EACrB,eAAe,EACf,KAAK,aAAa,EAClB,gBAAgB,EAChB,KAAK,aAAa,GACnB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,aAAa,EACb,eAAe,EACf,kBAAkB,GACnB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,EACd,SAAS,EACT,aAAa,EACb,aAAa,EACb,KAAK,WAAW,GACjB,MAAM,UAAU,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,KAAK,UAAU,EACf,SAAS,EACT,YAAY,EACZ,KAAK,UAAU,EACf,eAAe,EACf,SAAS,EACT,QAAQ,GACT,MAAM,WAAW,CAAA;AAClB,OAAO,EAAE,SAAS,EAAE,KAAK,aAAa,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC9E,OAAO,EAAE,KAAK,cAAc,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AACnF,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,SAAS,CAAA;AACzC,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,KAAK,SAAS,EACd,KAAK,WAAW,GACjB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,mBAAmB,EAAE,KAAK,OAAO,EAAE,KAAK,SAAS,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AACtF,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,6BAA6B,EAC7B,0BAA0B,EAC1B,YAAY,EACZ,KAAK,eAAe,EACpB,+BAA+B,GAChC,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,KAAK,EACV,KAAK,OAAO,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,SAAS,EACT,KAAK,aAAa,GACnB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,aAAa,GACd,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAA;AACzF,OAAO,EAAE,KAAK,EAAE,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,KAAK,cAAc,EAAE,SAAS,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAA;AAC5E,OAAO,EAAE,eAAe,EAAE,KAAK,gBAAgB,EAAE,KAAK,WAAW,EAAE,MAAM,cAAc,CAAA;AACvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAC9C,OAAO,EACL,kBAAkB,EAClB,KAAK,gBAAgB,EACrB,qBAAqB,EACrB,eAAe,EACf,KAAK,aAAa,EAClB,gBAAgB,EAChB,KAAK,aAAa,GACnB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,aAAa,EACb,eAAe,EACf,kBAAkB,GACnB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,EACd,SAAS,EACT,aAAa,EACb,aAAa,EACb,KAAK,WAAW,GACjB,MAAM,UAAU,CAAA"}

package/dist/index.js

@@ -2,6 +2,8 @@
 // shell over these; they are also exported so the bootstrap can be embedded in other tooling.
 export { HELP_TEXT, K3S_RUNTIMES, OPTION_DEFAULTS, parseArgs, ArgError, } from './args.js';
 export { bootstrap, BootstrapError } from './bootstrap.js';
+export { EnvCommandError, generateEnv } from './envCommand.js';
+export {} from './fs.js';
 export { COMMAND_NOT_FOUND, COMMAND_TIMED_OUT, createNodeShell, DEFAULT_COMMAND_TIMEOUT_MS, } from './host-shell.js';
 export { K3S_INSTALL_COMMAND, setupK3s } from './k3s.js';
 export { buildK3sHandler, buildK3sSetupUrl, DEFAULT_INGRESS_HOST_TEMPLATE, DEFAULT_NAMESPACE_TEMPLATE, handlerLabel, KUBERNETES_ENV_TOKEN_SECRET_KEY, } from './k3s-handler.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,8FAA8F;AAC9F,OAAO,EAEL,SAAS,EACT,YAAY,EAEZ,eAAe,EACf,SAAS,EACT,QAAQ,GACT,MAAM,WAAW,CAAA;AAClB,OAAO,EAAE,SAAS,EAAuC,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC/F,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,GAG3B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,mBAAmB,EAAgC,QAAQ,EAAE,MAAM,UAAU,CAAA;AACtF,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,6BAA6B,EAC7B,0BAA0B,EAC1B,YAAY,EAEZ,+BAA+B,GAChC,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,YAAY,EACZ,gBAAgB,EAKhB,gBAAgB,EAChB,iBAAiB,EACjB,SAAS,GAEV,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,gBAAgB,EAChB,aAAa,EAIb,aAAa,GACd,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAA;AACzF,OAAO,EAAW,eAAe,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAuB,SAAS,EAAoB,MAAM,WAAW,CAAA;AAC5E,OAAO,EAAE,eAAe,EAA2C,MAAM,cAAc,CAAA;AACvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAC9C,OAAO,EACL,kBAAkB,EAElB,qBAAqB,EACrB,eAAe,EAEf,gBAAgB,GAEjB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EAGnB,aAAa,EACb,eAAe,EACf,kBAAkB,GACnB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,EACd,SAAS,EACT,aAAa,EACb,aAAa,GAEd,MAAM,UAAU,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,8FAA8F;AAC9F,OAAO,EAEL,SAAS,EACT,YAAY,EAEZ,eAAe,EACf,SAAS,EACT,QAAQ,GACT,MAAM,WAAW,CAAA;AAClB,OAAO,EAAE,SAAS,EAAsB,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC9E,OAAO,EAAuB,eAAe,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AACnF,OAAO,EAAmB,MAAM,SAAS,CAAA;AACzC,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,GAG3B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,mBAAmB,EAAgC,QAAQ,EAAE,MAAM,UAAU,CAAA;AACtF,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,6BAA6B,EAC7B,0BAA0B,EAC1B,YAAY,EAEZ,+BAA+B,GAChC,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,YAAY,EACZ,gBAAgB,EAKhB,gBAAgB,EAChB,iBAAiB,EACjB,SAAS,GAEV,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,gBAAgB,EAChB,aAAa,EAIb,aAAa,GACd,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAA;AACzF,OAAO,EAAW,eAAe,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAuB,SAAS,EAAoB,MAAM,WAAW,CAAA;AAC5E,OAAO,EAAE,eAAe,EAA2C,MAAM,cAAc,CAAA;AACvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAC9C,OAAO,EACL,kBAAkB,EAElB,qBAAqB,EACrB,eAAe,EAEf,gBAAgB,GAEjB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EAGnB,aAAa,EACb,eAAe,EACf,kBAAkB,GACnB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,EACd,SAAS,EACT,aAAa,EACb,aAAa,GAEd,MAAM,UAAU,CAAA"}

package/dist/k3s-provision.d.ts

@@ -5,9 +5,6 @@ import { type HostState, type OfferId } from './k3s-probe.js';
 /** The namespace + ServiceAccount + long-lived token Secret the guided setup creates. */
 export declare const CAT_FACTORY_NAMESPACE = "cat-factory";
 export declare const SERVICE_ACCOUNT_NAME = "cat-factory";
-export declare const TOKEN_SECRET_NAME = "cat-factory-token";
-/** The apiserver port k3d/kind is asked to publish (the kube default). */
-export declare const DEFAULT_API_PORT = 6443;
 /**
  * Watchdog budget (ms) for `k3d cluster create` / `kind create cluster`. These pull node images on
  * the first run and routinely take 30–90s, so they need far more than the {@link HostShell} default
@@ -97,8 +94,6 @@ export interface ProvisionDeps {
      */
     tokenReadAttempts?: number;
 }
-/** Default poll budget for {@link readSaToken}: 20 attempts × 500ms = 10s. */
-export declare const DEFAULT_TOKEN_READ_ATTEMPTS = 20;
 /**
  * Provision (or reuse) a local cluster for the chosen offer, create the least-privilege
  * ServiceAccount + RBAC, mint a long-lived token, and read the apiserver URL — returning the

package/dist/k3s-provision.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"k3s-provision.d.ts","sourceRoot":"","sources":["../src/k3s-provision.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,UAAU,EAAmB,MAAM,WAAW,CAAA;AAC5D,OAAO,EAAE,KAAK,SAAS,EAAoB,MAAM,iBAAiB,CAAA;AAClE,OAAO,EAAE,KAAK,EAAE,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAE7D,yFAAyF;AACzF,eAAO,MAAM,qBAAqB,gBAAgB,CAAA;AAClD,eAAO,MAAM,oBAAoB,gBAAgB,CAAA;AACjD,eAAO,MAAM,iBAAiB,sBAAsB,CAAA;AACpD,0EAA0E;AAC1E,eAAO,MAAM,gBAAgB,OAAO,CAAA;AAEpC;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,SAAU,CAAA;AAEhD,4FAA4F;AAC5F,MAAM,WAAW,OAAO;IACtB,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,0FAA0F;IAC1F,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,WAAW,CAAA;IACnB,kFAAkF;IAClF,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,qBAAqB,EAAE,IAAI,CAAA;CAC5B;AAED,iGAAiG;AACjG,qBAAa,cAAe,SAAQ,KAAK;CAAG;AAE5C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,aAAa,o1DA8DzB,CAAA;AAMD,gGAAgG;AAChG,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,MAAyB,GAAG,OAAO,CAM1F;AAED,2CAA2C;AAC3C,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMvD;AAED,4EAA4E;AAC5E,wBAAgB,WAAW,CAAC,OAAO,EAAE,KAAK,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzE;AAYD,8FAA8F;AAC9F,wBAAgB,gBAAgB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED,0FAA0F;AAC1F,wBAAgB,gBAAgB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAgB1D;AAED,mEAAmE;AACnE,wBAAgB,oBAAoB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAQ9D;AAED,iGAAiG;AACjG,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAElD;AAeD,oGAAoG;AACpG,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAY5F;AAMD,kFAAkF;AAClF,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,SAAS,CAAA;IAChB,EAAE,EAAE,EAAE,CAAA;IACN,oFAAoF;IACpF,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,8EAA8E;AAC9E,eAAO,MAAM,2BAA2B,KAAK,CAAA;AA4D7C;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC,EACvC,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,UAAU,EACnB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,kBAAkB,CAAC,CA0E7B"}
+{"version":3,"file":"k3s-provision.d.ts","sourceRoot":"","sources":["../src/k3s-provision.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,UAAU,EAAmB,MAAM,WAAW,CAAA;AAC5D,OAAO,EAAE,KAAK,SAAS,EAAoB,MAAM,iBAAiB,CAAA;AAClE,OAAO,EAAE,KAAK,EAAE,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAE7D,yFAAyF;AACzF,eAAO,MAAM,qBAAqB,gBAAgB,CAAA;AAClD,eAAO,MAAM,oBAAoB,gBAAgB,CAAA;AAKjD;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,SAAU,CAAA;AAEhD,4FAA4F;AAC5F,MAAM,WAAW,OAAO;IACtB,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,0FAA0F;IAC1F,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,WAAW,CAAA;IACnB,kFAAkF;IAClF,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,qBAAqB,EAAE,IAAI,CAAA;CAC5B;AAED,iGAAiG;AACjG,qBAAa,cAAe,SAAQ,KAAK;CAAG;AAE5C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,aAAa,o1DA8DzB,CAAA;AAMD,gGAAgG;AAChG,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,MAAyB,GAAG,OAAO,CAM1F;AAED,2CAA2C;AAC3C,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMvD;AAED,4EAA4E;AAC5E,wBAAgB,WAAW,CAAC,OAAO,EAAE,KAAK,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzE;AAYD,8FAA8F;AAC9F,wBAAgB,gBAAgB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED,0FAA0F;AAC1F,wBAAgB,gBAAgB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAgB1D;AAED,mEAAmE;AACnE,wBAAgB,oBAAoB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAQ9D;AAED,iGAAiG;AACjG,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAElD;AAeD,oGAAoG;AACpG,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAY5F;AAMD,kFAAkF;AAClF,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,SAAS,CAAA;IAChB,EAAE,EAAE,EAAE,CAAA;IACN,oFAAoF;IACpF,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B;AA+DD;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC,EACvC,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE,UAAU,EACnB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,kBAAkB,CAAC,CA0E7B"}

package/dist/k3s-provision.js

@@ -5,9 +5,9 @@ import {} from './k3s-probe.js';
 /** The namespace + ServiceAccount + long-lived token Secret the guided setup creates. */
 export const CAT_FACTORY_NAMESPACE = 'cat-factory';
 export const SERVICE_ACCOUNT_NAME = 'cat-factory';
-export const TOKEN_SECRET_NAME = 'cat-factory-token';
+const TOKEN_SECRET_NAME = 'cat-factory-token';
 /** The apiserver port k3d/kind is asked to publish (the kube default). */
-export const DEFAULT_API_PORT = 6443;
+const DEFAULT_API_PORT = 6443;
 /**
  * Watchdog budget (ms) for `k3d cluster create` / `kind create cluster`. These pull node images on
  * the first run and routinely take 30–90s, so they need far more than the {@link HostShell} default
@@ -202,7 +202,7 @@ export function looksLocalCluster(context, apiServerUrl) {
     return host.endsWith('.local') || host.endsWith('.localhost') || host.endsWith('.nip.io');
 }
 /** Default poll budget for {@link readSaToken}: 20 attempts × 500ms = 10s. */
-export const DEFAULT_TOKEN_READ_ATTEMPTS = 20;
+const DEFAULT_TOKEN_READ_ATTEMPTS = 20;
 const realSleep = (ms) => new Promise((r) => setTimeout(r, ms));
 /** Run a command, throwing a {@link ProvisionError} with the captured stderr on a non-zero exit. */
 async function runOrThrow(shell, command, what, hint) {

package/dist/k3s-provision.js.map

@@ -1 +1 @@
-{"version":3,"file":"k3s-provision.js","sourceRoot":"","sources":["../src/k3s-provision.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,eAAe,EAAE,MAAM,WAAW,CAAA;AAC5D,OAAO,EAAoC,MAAM,iBAAiB,CAAA;AAClE,OAAO,EAAW,MAAM,SAAS,CAAA;AACjC,OAAO,EAAgC,MAAM,gBAAgB,CAAA;AAE7D,yFAAyF;AACzF,MAAM,CAAC,MAAM,qBAAqB,GAAG,aAAa,CAAA;AAClD,MAAM,CAAC,MAAM,oBAAoB,GAAG,aAAa,CAAA;AACjD,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAA;AACpD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAA;AAEpC;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,OAAO,CAAA;AA0BhD,iGAAiG;AACjG,MAAM,OAAO,cAAe,SAAQ,KAAK;CAAG;AAE5C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;;;UAGnB,qBAAqB;;;;;UAKrB,oBAAoB;eACf,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YA0CxB,oBAAoB;iBACf,qBAAqB;;;;;UAK5B,iBAAiB;eACZ,qBAAqB;;0CAEM,oBAAoB;;CAE7D,CAAA;AAED,8EAA8E;AAC9E,gFAAgF;AAChF,8EAA8E;AAE9E,gGAAgG;AAChG,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,OAAO,GAAW,gBAAgB;IAC/E,OAAO;QACL,GAAG,EAAE,KAAK;QACV,IAAI,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAChE,SAAS,EAAE,yBAAyB;KACrC,CAAA;AACH,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO;QACL,GAAG,EAAE,MAAM;QACX,IAAI,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC;QAC3C,SAAS,EAAE,yBAAyB;KACrC,CAAA;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,WAAW,CAAC,OAAuB,EAAE,IAAY;IAC/D,OAAO,GAAG,OAAO,IAAI,IAAI,EAAE,CAAA;AAC7B,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,IAAc,EAAE,OAAgB;IACnD,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACzD,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,gBAAgB,CAAC,OAAgB;IAC/C,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAA;AACnG,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,gBAAgB,CAAC,OAAgB;IAC/C,OAAO;QACL,GAAG,EAAE,SAAS;QACd,IAAI,EAAE,WAAW,CACf;YACE,IAAI;YACJ,qBAAqB;YACrB,KAAK;YACL,QAAQ;YACR,iBAAiB;YACjB,IAAI;YACJ,wBAAwB;SACzB,EACD,OAAO,CACR;KACF,CAAA;AACH,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,OAAO;QACL,GAAG,EAAE,SAAS;QACd,IAAI,EAAE,WAAW,CACf,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,wCAAwC,CAAC,EAC9E,OAAO,CACR;KACF,CAAA;AACH,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;AACrE,CAAC;AAED,0EAA0E;AAC1E,MAAM,sBAAsB,GAAG,CAAC,MAAM,EAAE,OAAO,CAAU,CAAA;AACzD,MAAM,mBAAmB,GAAG,CAAC,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAA;AACnG,kFAAkF;AAClF,MAAM,eAAe,GAAG;IACtB,WAAW;IACX,WAAW;IACX,SAAS;IACT,KAAK;IACL,OAAO;IACP,sBAAsB;CACvB,CAAA;AAED,oGAAoG;AACpG,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,OAAO,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,cAAc,CAAC,CAAA;AAClD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA2B,EAAE,YAAoB;IACjF,MAAM,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;IACzC,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IACtE,IAAI,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAClD,IAAI,IAAI,GAAG,EAAE,CAAA;IACb,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,EAAE,CAAA;IACX,CAAC;IACD,IAAI,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAC/C,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;AAC3F,CAAC;AAqBD,8EAA8E;AAC9E,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAA;AAE7C,MAAM,SAAS,GAAG,CAAC,EAAU,EAAiB,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;AAEtF,oGAAoG;AACpG,KAAK,UAAU,UAAU,CACvB,KAAgB,EAChB,OAAgB,EAChB,IAAY,EACZ,IAAiC;IAEjC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE;QACxD,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAA;IACF,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;QACtD,MAAM,IAAI,GAAG,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,WAAW,MAAM,CAAC,IAAI,EAAE,CAAA;QAC7D,MAAM,IAAI,cAAc,CAAC,GAAG,IAAI,YAAY,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAC9E,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,8FAA8F;AAC9F,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAO,oEAAoE,CAAC,IAAI,CAAC,MAAM,CAAC;QACtF,CAAC,CAAC,wBAAwB,gBAAgB,mFAAmF;QAC7H,CAAC,CAAC,EAAE,CAAA;AACR,CAAC;AAED,wFAAwF;AACxF,KAAK,UAAU,WAAW,CAAC,EAAM,EAAE,OAAmB,EAAE,MAAc;IACpE,IAAI,OAAO,CAAC,GAAG;QAAE,OAAM;IACvB,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IACzC,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,cAAc,CAAC,uDAAuD,CAAC,CAAA;AAC5F,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,WAAW,CAAC,IAAmB,EAAE,OAAgB;IAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAA;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,IAAI,2BAA2B,CAAA;IACtE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,UAAU,CAC7B,IAAI,CAAC,KAAK,EACV,gBAAgB,CAAC,OAAO,CAAC,EACzB,kCAAkC,CACnC,CAAA;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACxC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAA;QAClC,IAAI,CAAC,GAAG,QAAQ,GAAG,CAAC;YAAE,MAAM,KAAK,CAAC,GAAG,CAAC,CAAA;IACxC,CAAC;IACD,MAAM,IAAI,cAAc,CACtB,oCAAoC,iBAAiB,4EAA4E,CAClI,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAuC,EACvC,KAAgB,EAChB,OAAmB,EACnB,IAAmB;IAEnB,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,IAAI,CAAA;IAE1B,wFAAwF;IACxF,4FAA4F;IAC5F,yCAAyC;IACzC,IAAI,aAAiC,CAAA;IACrC,IAAI,WAA+B,CAAA;IACnC,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QACxD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,eAAe,CAAC,cAAc,CAAA;QACzE,MAAM,OAAO,GAAG,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAA;QACzD,MAAM,QAAQ,GACZ,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAA;QACnF,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACnC,EAAE,CAAC,IAAI,CAAC,wBAAwB,OAAO,aAAa,WAAW,IAAI,CAAC,CAAA;QACtE,CAAC;aAAM,CAAC;YACN,MAAM,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,kBAAkB,OAAO,aAAa,WAAW,IAAI,CAAC,CAAA;YACrF,EAAE,CAAC,IAAI,CAAC,gBAAgB,OAAO,aAAa,WAAW,6BAA6B,CAAC,CAAA;YACrF,MAAM,MAAM,GACV,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAA;YACrF,MAAM,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,OAAO,UAAU,EAAE,iBAAiB,CAAC,CAAA;QACvF,CAAC;QACD,aAAa,GAAG,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;QACjD,WAAW,GAAG,WAAW,CAAA;IAC3B,CAAC;SAAM,CAAC;QACN,sFAAsF;QACtF,aAAa,GAAG,SAAS,CAAA;IAC3B,CAAC;IAED,8FAA8F;IAC9F,0EAA0E;IAC1E,MAAM,SAAS,GAAG,MAAM,UAAU,CAChC,KAAK,EACL,oBAAoB,CAAC,aAAa,CAAC,EACnC,2BAA2B,CAC5B,CAAA;IACD,MAAM,YAAY,GAAG,qBAAqB,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;IACnE,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,cAAc,CAAC,wDAAwD,CAAC,CAAA;IACpF,CAAC;IAED,MAAM,YAAY,GAAG,KAAK,CAAC,UAAU,CAAC,cAAc,CAAA;IACpD,MAAM,iBAAiB,GAAG,WAAW;QACnC,CAAC,CAAC,OAAO,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,aAAa,WAAW,MAAM,YAAY,GAAG;QAC/F,CAAC,CAAC,YAAY;YACZ,CAAC,CAAC,YAAY,YAAY,MAAM,YAAY,GAAG;YAC/C,CAAC,CAAC,wBAAwB,YAAY,GAAG,CAAA;IAE7C,+FAA+F;IAC/F,6FAA6F;IAC7F,IAAI,MAAM,KAAK,cAAc,IAAI,OAAO,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC;QAC/F,MAAM,IAAI,cAAc,CACtB,6CAA6C,iBAAiB,uIAAuI,CACtM,CAAA;IACH,CAAC;IAED,MAAM,WAAW,CACf,EAAE,EACF,OAAO,EACP,kDAAkD,iBAAiB,GAAG,CACvE,CAAA;IACD,EAAE,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAA;IAC9C,MAAM,UAAU,CAAC,KAAK,EAAE,gBAAgB,CAAC,aAAa,CAAC,EAAE,4BAA4B,CAAC,CAAA;IAEtF,EAAE,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAA;IAC5C,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;IAEvD,OAAO;QACL,MAAM,EAAE,WAAW;QACnB,WAAW,EAAE,WAAW;QACxB,YAAY;QACZ,QAAQ;QACR,qBAAqB,EAAE,IAAI;KAC5B,CAAA;AACH,CAAC"}
+{"version":3,"file":"k3s-provision.js","sourceRoot":"","sources":["../src/k3s-provision.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,eAAe,EAAE,MAAM,WAAW,CAAA;AAC5D,OAAO,EAAoC,MAAM,iBAAiB,CAAA;AAClE,OAAO,EAAW,MAAM,SAAS,CAAA;AACjC,OAAO,EAAgC,MAAM,gBAAgB,CAAA;AAE7D,yFAAyF;AACzF,MAAM,CAAC,MAAM,qBAAqB,GAAG,aAAa,CAAA;AAClD,MAAM,CAAC,MAAM,oBAAoB,GAAG,aAAa,CAAA;AACjD,MAAM,iBAAiB,GAAG,mBAAmB,CAAA;AAC7C,0EAA0E;AAC1E,MAAM,gBAAgB,GAAG,IAAI,CAAA;AAE7B;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,OAAO,CAAA;AA0BhD,iGAAiG;AACjG,MAAM,OAAO,cAAe,SAAQ,KAAK;CAAG;AAE5C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;;;UAGnB,qBAAqB;;;;;UAKrB,oBAAoB;eACf,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YA0CxB,oBAAoB;iBACf,qBAAqB;;;;;UAK5B,iBAAiB;eACZ,qBAAqB;;0CAEM,oBAAoB;;CAE7D,CAAA;AAED,8EAA8E;AAC9E,gFAAgF;AAChF,8EAA8E;AAE9E,gGAAgG;AAChG,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,OAAO,GAAW,gBAAgB;IAC/E,OAAO;QACL,GAAG,EAAE,KAAK;QACV,IAAI,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAChE,SAAS,EAAE,yBAAyB;KACrC,CAAA;AACH,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO;QACL,GAAG,EAAE,MAAM;QACX,IAAI,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC;QAC3C,SAAS,EAAE,yBAAyB;KACrC,CAAA;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,WAAW,CAAC,OAAuB,EAAE,IAAY;IAC/D,OAAO,GAAG,OAAO,IAAI,IAAI,EAAE,CAAA;AAC7B,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,IAAc,EAAE,OAAgB;IACnD,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACzD,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,gBAAgB,CAAC,OAAgB;IAC/C,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAA;AACnG,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,gBAAgB,CAAC,OAAgB;IAC/C,OAAO;QACL,GAAG,EAAE,SAAS;QACd,IAAI,EAAE,WAAW,CACf;YACE,IAAI;YACJ,qBAAqB;YACrB,KAAK;YACL,QAAQ;YACR,iBAAiB;YACjB,IAAI;YACJ,wBAAwB;SACzB,EACD,OAAO,CACR;KACF,CAAA;AACH,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,OAAO;QACL,GAAG,EAAE,SAAS;QACd,IAAI,EAAE,WAAW,CACf,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,wCAAwC,CAAC,EAC9E,OAAO,CACR;KACF,CAAA;AACH,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;AACrE,CAAC;AAED,0EAA0E;AAC1E,MAAM,sBAAsB,GAAG,CAAC,MAAM,EAAE,OAAO,CAAU,CAAA;AACzD,MAAM,mBAAmB,GAAG,CAAC,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAA;AACnG,kFAAkF;AAClF,MAAM,eAAe,GAAG;IACtB,WAAW;IACX,WAAW;IACX,SAAS;IACT,KAAK;IACL,OAAO;IACP,sBAAsB;CACvB,CAAA;AAED,oGAAoG;AACpG,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,OAAO,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,cAAc,CAAC,CAAA;AAClD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA2B,EAAE,YAAoB;IACjF,MAAM,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;IACzC,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IACtE,IAAI,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAClD,IAAI,IAAI,GAAG,EAAE,CAAA;IACb,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,EAAE,CAAA;IACX,CAAC;IACD,IAAI,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAC/C,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;AAC3F,CAAC;AAqBD,8EAA8E;AAC9E,MAAM,2BAA2B,GAAG,EAAE,CAAA;AAEtC,MAAM,SAAS,GAAG,CAAC,EAAU,EAAiB,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;AAEtF,oGAAoG;AACpG,KAAK,UAAU,UAAU,CACvB,KAAgB,EAChB,OAAgB,EAChB,IAAY,EACZ,IAAiC;IAEjC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE;QACxD,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAA;IACF,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;QACtD,MAAM,IAAI,GAAG,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,WAAW,MAAM,CAAC,IAAI,EAAE,CAAA;QAC7D,MAAM,IAAI,cAAc,CAAC,GAAG,IAAI,YAAY,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAC9E,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,8FAA8F;AAC9F,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAO,oEAAoE,CAAC,IAAI,CAAC,MAAM,CAAC;QACtF,CAAC,CAAC,wBAAwB,gBAAgB,mFAAmF;QAC7H,CAAC,CAAC,EAAE,CAAA;AACR,CAAC;AAED,wFAAwF;AACxF,KAAK,UAAU,WAAW,CAAC,EAAM,EAAE,OAAmB,EAAE,MAAc;IACpE,IAAI,OAAO,CAAC,GAAG;QAAE,OAAM;IACvB,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IACzC,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,cAAc,CAAC,uDAAuD,CAAC,CAAA;AAC5F,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,WAAW,CAAC,IAAmB,EAAE,OAAgB;IAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAA;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,IAAI,2BAA2B,CAAA;IACtE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,UAAU,CAC7B,IAAI,CAAC,KAAK,EACV,gBAAgB,CAAC,OAAO,CAAC,EACzB,kCAAkC,CACnC,CAAA;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACxC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAA;QAClC,IAAI,CAAC,GAAG,QAAQ,GAAG,CAAC;YAAE,MAAM,KAAK,CAAC,GAAG,CAAC,CAAA;IACxC,CAAC;IACD,MAAM,IAAI,cAAc,CACtB,oCAAoC,iBAAiB,4EAA4E,CAClI,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAuC,EACvC,KAAgB,EAChB,OAAmB,EACnB,IAAmB;IAEnB,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,IAAI,CAAA;IAE1B,wFAAwF;IACxF,4FAA4F;IAC5F,yCAAyC;IACzC,IAAI,aAAiC,CAAA;IACrC,IAAI,WAA+B,CAAA;IACnC,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QACxD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,eAAe,CAAC,cAAc,CAAA;QACzE,MAAM,OAAO,GAAG,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAA;QACzD,MAAM,QAAQ,GACZ,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAA;QACnF,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACnC,EAAE,CAAC,IAAI,CAAC,wBAAwB,OAAO,aAAa,WAAW,IAAI,CAAC,CAAA;QACtE,CAAC;aAAM,CAAC;YACN,MAAM,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,kBAAkB,OAAO,aAAa,WAAW,IAAI,CAAC,CAAA;YACrF,EAAE,CAAC,IAAI,CAAC,gBAAgB,OAAO,aAAa,WAAW,6BAA6B,CAAC,CAAA;YACrF,MAAM,MAAM,GACV,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAA;YACrF,MAAM,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,OAAO,UAAU,EAAE,iBAAiB,CAAC,CAAA;QACvF,CAAC;QACD,aAAa,GAAG,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;QACjD,WAAW,GAAG,WAAW,CAAA;IAC3B,CAAC;SAAM,CAAC;QACN,sFAAsF;QACtF,aAAa,GAAG,SAAS,CAAA;IAC3B,CAAC;IAED,8FAA8F;IAC9F,0EAA0E;IAC1E,MAAM,SAAS,GAAG,MAAM,UAAU,CAChC,KAAK,EACL,oBAAoB,CAAC,aAAa,CAAC,EACnC,2BAA2B,CAC5B,CAAA;IACD,MAAM,YAAY,GAAG,qBAAqB,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;IACnE,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,cAAc,CAAC,wDAAwD,CAAC,CAAA;IACpF,CAAC;IAED,MAAM,YAAY,GAAG,KAAK,CAAC,UAAU,CAAC,cAAc,CAAA;IACpD,MAAM,iBAAiB,GAAG,WAAW;QACnC,CAAC,CAAC,OAAO,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,aAAa,WAAW,MAAM,YAAY,GAAG;QAC/F,CAAC,CAAC,YAAY;YACZ,CAAC,CAAC,YAAY,YAAY,MAAM,YAAY,GAAG;YAC/C,CAAC,CAAC,wBAAwB,YAAY,GAAG,CAAA;IAE7C,+FAA+F;IAC/F,6FAA6F;IAC7F,IAAI,MAAM,KAAK,cAAc,IAAI,OAAO,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC;QAC/F,MAAM,IAAI,cAAc,CACtB,6CAA6C,iBAAiB,uIAAuI,CACtM,CAAA;IACH,CAAC;IAED,MAAM,WAAW,CACf,EAAE,EACF,OAAO,EACP,kDAAkD,iBAAiB,GAAG,CACvE,CAAA;IACD,EAAE,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAA;IAC9C,MAAM,UAAU,CAAC,KAAK,EAAE,gBAAgB,CAAC,aAAa,CAAC,EAAE,4BAA4B,CAAC,CAAA;IAEtF,EAAE,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAA;IAC5C,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;IAEvD,OAAO;QACL,MAAM,EAAE,WAAW;QACnB,WAAW,EAAE,WAAW;QACxB,YAAY;QACZ,QAAQ;QACR,qBAAqB,EAAE,IAAI;KAC5B,CAAA;AACH,CAAC"}

package/dist/plan.d.ts

@@ -27,6 +27,8 @@ export interface BootstrapInput {
     harnessEntry?: string;
     authSessionSecret: string;
     encryptionKey: string;
+    /** Shared HMAC secret between the backend and the executor-harness (`HARNESS_SHARED_SECRET`). */
+    harnessSharedSecret: string;
     /** Existing root `.gitignore` content, if the target dir already has one (rules are merged in). */
     existingGitignore?: string;
 }

package/dist/plan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plan.d.ts","sourceRoot":"","sources":["../src/plan.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AACpF,OAAO,EAA4C,KAAK,WAAW,EAAE,MAAM,UAAU,CAAA;AAErF,8FAA8F;AAC9F,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,kGAAkG;IAClG,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AAED,mGAAmG;AACnG,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,WAAW,CAAA;IACrB,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,kBAAkB,EAAE,MAAM,CAAA;IAC1B,YAAY,EAAE,MAAM,CAAA;IACpB,gBAAgB,EAAE,gBAAgB,CAAA;IAClC,uFAAuF;IACvF,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,4FAA4F;IAC5F,eAAe,CAAC,EAAE,aAAa,EAAE,CAAA;IACjC,wFAAwF;IACxF,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,iBAAiB,EAAE,MAAM,CAAA;IACzB,aAAa,EAAE,MAAM,CAAA;IACrB,mGAAmG;IACnG,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,0FAA0F;AAC1F,wBAAgB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,WAAW,EAAE,CAmD9D"}
+{"version":3,"file":"plan.d.ts","sourceRoot":"","sources":["../src/plan.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AACpF,OAAO,EAA4C,KAAK,WAAW,EAAE,MAAM,UAAU,CAAA;AAErF,8FAA8F;AAC9F,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,kGAAkG;IAClG,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AAED,mGAAmG;AACnG,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,WAAW,CAAA;IACrB,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,kBAAkB,EAAE,MAAM,CAAA;IAC1B,YAAY,EAAE,MAAM,CAAA;IACpB,gBAAgB,EAAE,gBAAgB,CAAA;IAClC,uFAAuF;IACvF,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,4FAA4F;IAC5F,eAAe,CAAC,EAAE,aAAa,EAAE,CAAA;IACjC,wFAAwF;IACxF,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,iBAAiB,EAAE,MAAM,CAAA;IACzB,aAAa,EAAE,MAAM,CAAA;IACrB,iGAAiG;IACjG,mBAAmB,EAAE,MAAM,CAAA;IAC3B,mGAAmG;IACnG,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,0FAA0F;AAC1F,wBAAgB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,WAAW,EAAE,CAoD9D"}

package/dist/plan.js

@@ -8,6 +8,7 @@ export function buildPlan(input) {
         databaseUrl: input.databaseUrl,
         authSessionSecret: input.authSessionSecret,
         encryptionKey: input.encryptionKey,
+        harnessSharedSecret: input.harnessSharedSecret,
         harnessImage: input.harnessImage,
         port: input.port,
         corsAllowedOrigins: input.corsAllowedOrigins,
@@ -86,7 +87,8 @@ with \`cat-factory init\`. It has two parts:
   via a personal access token.
 - **\`frontend/\`** — the board SPA (extends the \`@cat-factory/app\` Nuxt layer).
 
-> The \`.env\` files hold generated secrets (\`AUTH_SESSION_SECRET\`, \`ENCRYPTION_KEY\`) and your
+> The \`.env\` files hold generated secrets (\`AUTH_SESSION_SECRET\`, \`ENCRYPTION_KEY\`,
+> \`HARNESS_SHARED_SECRET\`) and your
 > ${label} token (\`${tokenVar}\`). They are gitignored — **keep the values stable and never
 > commit them.** Regenerating \`AUTH_SESSION_SECRET\` forces a re-login; regenerating
 > \`ENCRYPTION_KEY\` orphans every encrypted credential.

package/dist/plan.js.map

@@ -1 +1 @@
-{"version":3,"file":"plan.js","sourceRoot":"","sources":["../src/plan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAC1D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC/D,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,YAAY,GACb,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,aAAa,EAAoB,MAAM,UAAU,CAAA;AAkCrF,0FAA0F;AAC1F,MAAM,UAAU,SAAS,CAAC,KAAqB;IAC7C,MAAM,QAAQ,GAAG,aAAa,CAAC;QAC7B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC,CAAA;IACF,MAAM,WAAW,GAAG,gBAAgB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;IAChE,MAAM,SAAS,GACb,KAAK,CAAC,iBAAiB,KAAK,SAAS;QACnC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,iBAAiB,CAAC;QACzC,CAAC,CAAC,cAAc,EAAE,CAAA;IAEtB,OAAO;QACL,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE;QAC1C,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE;QAEpD,sBAAsB;QACtB,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE;QAC5E,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,WAAW,EAAE;QACnD,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE;QAC/E,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,YAAY,EAAE;QACtD;YACE,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,eAAe,CAAC;gBACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;gBACxC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,eAAe,EAAE,KAAK,CAAC,eAAe;aACvC,CAAC;SACH;QACD,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE;QAEvD,gBAAgB;QAChB,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE;QAClF,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE;QAChF,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,oBAAoB,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE;QACpF,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE;QAC7E,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE;KAC9D,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,OAAyB;IAChD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,OAAO;;;;CAIV,CAAA;IACC,CAAC;IACD,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO;;;;CAIV,CAAA;IACC,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED,SAAS,aAAa,CAAC,KAAqB;IAC1C,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IAC3C,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IAC1C,OAAO,KAAK,KAAK,CAAC,QAAQ;;;;;;gFAMoD,KAAK;;;;;IAKjF,KAAK,aAAa,QAAQ;;;;;;;;;;gBAUd,KAAK,CAAC,YAAY;;;;;;;;;;;;;;mDAciB,KAAK,CAAC,IAAI;;EAE3D,eAAe,CAAC,KAAK,CAAC,gBAAgB,CAAC;;;;;;;;;;;;;IAarC,KAAK,CAAC,OAAO;;;IAGb,QAAQ,iEAAiE,KAAK;2BACvD,KAAK;;;;kBAId,KAAK;;iCAEU,QAAQ;;;MAGnC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC;;;;;;;IAOhC,QAAQ;;;;CAIX,CAAA;AACD,CAAC"}
+{"version":3,"file":"plan.js","sourceRoot":"","sources":["../src/plan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAC1D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC/D,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,YAAY,GACb,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,aAAa,EAAoB,MAAM,UAAU,CAAA;AAoCrF,0FAA0F;AAC1F,MAAM,UAAU,SAAS,CAAC,KAAqB;IAC7C,MAAM,QAAQ,GAAG,aAAa,CAAC;QAC7B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC,CAAA;IACF,MAAM,WAAW,GAAG,gBAAgB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;IAChE,MAAM,SAAS,GACb,KAAK,CAAC,iBAAiB,KAAK,SAAS;QACnC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,iBAAiB,CAAC;QACzC,CAAC,CAAC,cAAc,EAAE,CAAA;IAEtB,OAAO;QACL,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE;QAC1C,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE;QAEpD,sBAAsB;QACtB,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE;QAC5E,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,WAAW,EAAE;QACnD,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE;QAC/E,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,YAAY,EAAE;QACtD;YACE,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,eAAe,CAAC;gBACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;gBACxC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,eAAe,EAAE,KAAK,CAAC,eAAe;aACvC,CAAC;SACH;QACD,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE;QAEvD,gBAAgB;QAChB,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE;QAClF,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE;QAChF,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,oBAAoB,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE;QACpF,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE;QAC7E,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE;KAC9D,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,OAAyB;IAChD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,OAAO;;;;CAIV,CAAA;IACC,CAAC;IACD,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO;;;;CAIV,CAAA;IACC,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED,SAAS,aAAa,CAAC,KAAqB;IAC1C,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IAC3C,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IAC1C,OAAO,KAAK,KAAK,CAAC,QAAQ;;;;;;gFAMoD,KAAK;;;;;;IAMjF,KAAK,aAAa,QAAQ;;;;;;;;;;gBAUd,KAAK,CAAC,YAAY;;;;;;;;;;;;;;mDAciB,KAAK,CAAC,IAAI;;EAE3D,eAAe,CAAC,KAAK,CAAC,gBAAgB,CAAC;;;;;;;;;;;;;IAarC,KAAK,CAAC,OAAO;;;IAGb,QAAQ,iEAAiE,KAAK;2BACvD,KAAK;;;;kBAId,KAAK;;iCAEU,QAAQ;;;MAGnC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC;;;;;;;IAOhC,QAAQ;;;;CAIX,CAAA;AACD,CAAC"}

package/dist/resolve.d.ts

@@ -0,0 +1,33 @@
+import { type CliOptions } from './args.js';
+import type { Io } from './io.js';
+import { type GeneratedSecrets, type RandomBytes } from './secrets.js';
+import { type ContainerRuntime, type ExecutionMode, type NativeHarness } from './templates.js';
+import { type VcsProvider } from './vcs.js';
+export declare function resolveProvider(options: CliOptions, io: Io): Promise<VcsProvider>;
+export declare function resolveContainerRuntime(options: CliOptions, io: Io): Promise<ContainerRuntime>;
+/** The resolved execution configuration threaded into the env. */
+export interface ExecutionChoice {
+    mode: ExecutionMode;
+    nativeHarnesses?: NativeHarness[];
+    harnessEntry?: string;
+}
+/**
+ * Resolve how agent jobs execute — a prewarmed Docker pool (default) or native host agents —
+ * plus, for native mode, which harnesses run natively and the harness server entry path. In
+ * interactive mode the tradeoffs of each mode are printed before the choice, and (native only)
+ * the developer can list which models actually run natively before committing.
+ */
+export declare function resolveExecution(options: CliOptions, io: Io): Promise<ExecutionChoice>;
+/**
+ * Resolve the three mandatory crypto secrets. By default (and always in `--yes` mode) they are
+ * generated for the developer in the server's required formats. Interactively the developer can
+ * decline (e.g. to paste their own), leaving them blank with a note on how to fill them in.
+ */
+export declare function resolveSecrets(options: CliOptions, io: Io, randomBytes: RandomBytes | undefined): Promise<GeneratedSecrets>;
+/**
+ * Resolve the PAT: an explicit `--token` wins; otherwise (interactive only) print the pre-scoped
+ * creation URL, open the browser at it, and read the pasted token back. In `--yes` mode with no
+ * token, leave it blank (the var is still written, present-but-empty).
+ */
+export declare function resolveToken(options: CliOptions, provider: VcsProvider, io: Io): Promise<string>;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../src/resolve.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,UAAU,EAAmB,MAAM,WAAW,CAAA;AAO5D,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAmB,KAAK,gBAAgB,EAAE,KAAK,WAAW,EAAE,MAAM,cAAc,CAAA;AACvF,OAAO,EAEL,KAAK,gBAAgB,EAErB,KAAK,aAAa,EAClB,KAAK,aAAa,EACnB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAgD,KAAK,WAAW,EAAE,MAAM,UAAU,CAAA;AAEzF,wBAAsB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,CAQvF;AAED,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,UAAU,EACnB,EAAE,EAAE,EAAE,GACL,OAAO,CAAC,gBAAgB,CAAC,CAQ3B;AAED,kEAAkE;AAClE,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,aAAa,CAAA;IACnB,eAAe,CAAC,EAAE,aAAa,EAAE,CAAA;IACjC,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAOD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAgB5F;AAgFD;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,UAAU,EACnB,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,WAAW,GAAG,SAAS,GACnC,OAAO,CAAC,gBAAgB,CAAC,CAmB3B;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,UAAU,EACnB,QAAQ,EAAE,WAAW,EACrB,EAAE,EAAE,EAAE,GACL,OAAO,CAAC,MAAM,CAAC,CAiBjB"}

package/dist/resolve.js

@@ -0,0 +1,153 @@
+// Shared interactive resolvers — the prompt-or-flag logic that turns partial {@link CliOptions}
+// into the concrete values a local-mode `.env` needs. Extracted from the `init` orchestrator so
+// the `env` command (which writes only the `.env`, not a whole scaffold) reuses the SAME prompts
+// rather than duplicating them. Every resolver is IO-seam driven, so the flows stay testable.
+import { OPTION_DEFAULTS } from './args.js';
+import { ALL_NATIVE_HARNESSES, EXECUTION_MODE_TRADEOFFS, NATIVE_HARNESS_INFO, nativeModelsFor, } from './execution.js';
+import { generateSecrets } from './secrets.js';
+import { CONTAINER_RUNTIMES, EXECUTION_MODES, } from './templates.js';
+import { patCreationUrl, providerLabel, VCS_PROVIDERS } from './vcs.js';
+export async function resolveProvider(options, io) {
+    if (options.provider)
+        return options.provider;
+    if (options.yes)
+        return OPTION_DEFAULTS.provider;
+    return io.select('Source control', VCS_PROVIDERS.map((value) => ({ value, label: providerLabel(value) })), OPTION_DEFAULTS.provider);
+}
+export async function resolveContainerRuntime(options, io) {
+    if (options.containerRuntime)
+        return options.containerRuntime;
+    if (options.yes)
+        return OPTION_DEFAULTS.containerRuntime;
+    return io.select('Container runtime that spawns agent jobs', CONTAINER_RUNTIMES.map((value) => ({ value, label: value })), OPTION_DEFAULTS.containerRuntime);
+}
+/** Whether any native-only flag (`--native-harnesses` / `--harness-entry`) was supplied. */
+function nativeFlagsProvided(options) {
+    return Boolean(options.nativeHarnesses?.length) || options.harnessEntry !== undefined;
+}
+/**
+ * Resolve how agent jobs execute — a prewarmed Docker pool (default) or native host agents —
+ * plus, for native mode, which harnesses run natively and the harness server entry path. In
+ * interactive mode the tradeoffs of each mode are printed before the choice, and (native only)
+ * the developer can list which models actually run natively before committing.
+ */
+export async function resolveExecution(options, io) {
+    const mode = await resolveExecutionMode(options, io);
+    if (mode !== 'native') {
+        // Native-only flags carry no meaning in pool mode; warn rather than silently drop them so a
+        // `--execution-mode pool --native-harnesses …` (or the same via prompt) isn't a quiet no-op.
+        if (nativeFlagsProvided(options))
+            io.warn('Ignoring --native-harnesses / --harness-entry: they only apply to --execution-mode native.');
+        return { mode };
+    }
+    const nativeHarnesses = await resolveNativeHarnesses(options, io);
+    if (!options.yes)
+        await maybeShowNativeModels(io, nativeHarnesses);
+    const harnessEntry = await resolveHarnessEntry(options, io);
+    return { mode, nativeHarnesses, harnessEntry };
+}
+async function resolveExecutionMode(options, io) {
+    if (options.executionMode)
+        return options.executionMode;
+    // A native-only flag with no explicit --execution-mode clearly means native: infer it rather
+    // than defaulting to pool and dropping the flag on the floor.
+    if (nativeFlagsProvided(options)) {
+        io.info('Assuming --execution-mode native (a native-only flag was provided).');
+        return 'native';
+    }
+    if (options.yes)
+        return OPTION_DEFAULTS.executionMode;
+    // Print both modes' tradeoffs so the choice is informed, not a bare two-item menu.
+    io.info(['\nHow should agent jobs run locally?', '', ...EXECUTION_MODES.flatMap(tradeoffBlock)].join('\n'));
+    return io.select('Execution mode', [
+        { value: 'pool', label: 'Prewarmed Docker pool (recommended)' },
+        { value: 'native', label: 'Native host agents (your own claude/codex CLI)' },
+    ], OPTION_DEFAULTS.executionMode);
+}
+/** Render one execution mode's tradeoff bullet block for the pre-prompt info. */
+function tradeoffBlock(mode) {
+    return [...EXECUTION_MODE_TRADEOFFS[mode], ''];
+}
+async function resolveNativeHarnesses(options, io) {
+    if (options.nativeHarnesses?.length)
+        return options.nativeHarnesses;
+    if (options.yes)
+        return [...ALL_NATIVE_HARNESSES];
+    const choice = await io.select('Which installed CLI(s) should run agents natively?', [
+        { value: 'both', label: 'Both — Claude Code and Codex' },
+        { value: 'claude-code', label: NATIVE_HARNESS_INFO['claude-code'].label },
+        { value: 'codex', label: NATIVE_HARNESS_INFO.codex.label },
+    ], 'both');
+    return choice === 'both' ? [...ALL_NATIVE_HARNESSES] : [choice];
+}
+/** Offer to list the models that will actually run natively for the chosen harnesses. */
+async function maybeShowNativeModels(io, harnesses) {
+    const show = await io.confirm('List the models that will run natively in this mode?', true);
+    if (!show)
+        return;
+    const models = nativeModelsFor(harnesses);
+    const lines = [
+        '\nModels that run natively (through your ambient CLI):',
+        ...models.map((m) => `  - ${m.label}  [id: ${m.id}]  via ${m.harness}`),
+        '',
+        'Any OTHER model a step selects (Cloudflare, direct keys, or GLM/Kimi/DeepSeek — which',
+        'reuse the claude-code harness against their own endpoint) still runs in a container,',
+        'so the executor image is still used for those steps.',
+    ];
+    io.info(lines.join('\n'));
+}
+/**
+ * Resolve the executor-harness server entry path for native mode. Optional: when left blank,
+ * native mode defaults to the bundled `@cat-factory/executor-harness` (a dependency of
+ * `@cat-factory/local-server`), so no configuration is needed. A value is only used to point at
+ * a custom or source-checkout build.
+ */
+async function resolveHarnessEntry(options, io) {
+    if (options.harnessEntry !== undefined)
+        return options.harnessEntry;
+    // Non-interactive (--yes): leave it blank; the bundled harness default kicks in at boot.
+    if (options.yes)
+        return '';
+    return (await io.question('Path to a custom executor-harness server entry (LOCAL_HARNESS_ENTRY; blank = bundled default)')).trim();
+}
+/**
+ * Resolve the three mandatory crypto secrets. By default (and always in `--yes` mode) they are
+ * generated for the developer in the server's required formats. Interactively the developer can
+ * decline (e.g. to paste their own), leaving them blank with a note on how to fill them in.
+ */
+export async function resolveSecrets(options, io, randomBytes) {
+    const generate = options.yes ||
+        (await io.confirm('Generate AUTH_SESSION_SECRET, ENCRYPTION_KEY and HARNESS_SHARED_SECRET for you?', true));
+    if (!generate) {
+        io.warn('Left AUTH_SESSION_SECRET / ENCRYPTION_KEY / HARNESS_SHARED_SECRET blank — fill them in ' +
+            'before starting (see .env.example for the generate commands). Keep all three stable once set.');
+        return { authSessionSecret: '', encryptionKey: '', harnessSharedSecret: '' };
+    }
+    const secrets = generateSecrets(randomBytes);
+    io.info('\nGenerated AUTH_SESSION_SECRET (hex), ENCRYPTION_KEY (base64) and HARNESS_SHARED_SECRET (hex).');
+    return secrets;
+}
+/**
+ * Resolve the PAT: an explicit `--token` wins; otherwise (interactive only) print the pre-scoped
+ * creation URL, open the browser at it, and read the pasted token back. In `--yes` mode with no
+ * token, leave it blank (the var is still written, present-but-empty).
+ */
+export async function resolveToken(options, provider, io) {
+    if (options.token !== undefined)
+        return options.token;
+    if (options.yes)
+        return '';
+    const url = patCreationUrl(provider);
+    const label = providerLabel(provider);
+    io.info(`\nCreate a ${label} personal access token (scopes pre-selected):\n  ${url}`);
+    if (!options.noOpen) {
+        const open = await io.confirm('Open this URL in your browser now?', true);
+        if (open)
+            await io.openBrowser(url);
+    }
+    const token = await io.secret(`Paste your ${label} token here (or leave blank to add later)`);
+    if (token === '')
+        io.warn('No token entered — the var will be written blank; set it before running agents.');
+    return token;
+}
+//# sourceMappingURL=resolve.js.map

package/dist/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../src/resolve.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,gGAAgG;AAChG,iGAAiG;AACjG,8FAA8F;AAC9F,OAAO,EAAmB,eAAe,EAAE,MAAM,WAAW,CAAA;AAC5D,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,mBAAmB,EACnB,eAAe,GAChB,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,eAAe,EAA2C,MAAM,cAAc,CAAA;AACvF,OAAO,EACL,kBAAkB,EAElB,eAAe,GAGhB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAoB,MAAM,UAAU,CAAA;AAEzF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAmB,EAAE,EAAM;IAC/D,IAAI,OAAO,CAAC,QAAQ;QAAE,OAAO,OAAO,CAAC,QAAQ,CAAA;IAC7C,IAAI,OAAO,CAAC,GAAG;QAAE,OAAO,eAAe,CAAC,QAAQ,CAAA;IAChD,OAAO,EAAE,CAAC,MAAM,CACd,gBAAgB,EAChB,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EACtE,eAAe,CAAC,QAAQ,CACzB,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAmB,EACnB,EAAM;IAEN,IAAI,OAAO,CAAC,gBAAgB;QAAE,OAAO,OAAO,CAAC,gBAAgB,CAAA;IAC7D,IAAI,OAAO,CAAC,GAAG;QAAE,OAAO,eAAe,CAAC,gBAAgB,CAAA;IACxD,OAAO,EAAE,CAAC,MAAM,CACd,0CAA0C,EAC1C,kBAAkB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,EAC5D,eAAe,CAAC,gBAAgB,CACjC,CAAA;AACH,CAAC;AASD,4FAA4F;AAC5F,SAAS,mBAAmB,CAAC,OAAmB;IAC9C,OAAO,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,CAAA;AACvF,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAmB,EAAE,EAAM;IAChE,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;IACpD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,4FAA4F;QAC5F,6FAA6F;QAC7F,IAAI,mBAAmB,CAAC,OAAO,CAAC;YAC9B,EAAE,CAAC,IAAI,CACL,4FAA4F,CAC7F,CAAA;QACH,OAAO,EAAE,IAAI,EAAE,CAAA;IACjB,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;IACjE,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,MAAM,qBAAqB,CAAC,EAAE,EAAE,eAAe,CAAC,CAAA;IAClE,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;IAC3D,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,YAAY,EAAE,CAAA;AAChD,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,OAAmB,EAAE,EAAM;IAC7D,IAAI,OAAO,CAAC,aAAa;QAAE,OAAO,OAAO,CAAC,aAAa,CAAA;IACvD,6FAA6F;IAC7F,8DAA8D;IAC9D,IAAI,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,EAAE,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAA;QAC9E,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,IAAI,OAAO,CAAC,GAAG;QAAE,OAAO,eAAe,CAAC,aAAa,CAAA;IACrD,mFAAmF;IACnF,EAAE,CAAC,IAAI,CACL,CAAC,sCAAsC,EAAE,EAAE,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAC1F,IAAI,CACL,CACF,CAAA;IACD,OAAO,EAAE,CAAC,MAAM,CACd,gBAAgB,EAChB;QACE,EAAE,KAAK,EAAE,MAAe,EAAE,KAAK,EAAE,qCAAqC,EAAE;QACxE,EAAE,KAAK,EAAE,QAAiB,EAAE,KAAK,EAAE,gDAAgD,EAAE;KACtF,EACD,eAAe,CAAC,aAAa,CAC9B,CAAA;AACH,CAAC;AAED,iFAAiF;AACjF,SAAS,aAAa,CAAC,IAAmB;IACxC,OAAO,CAAC,GAAG,wBAAwB,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;AAChD,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,OAAmB,EAAE,EAAM;IAC/D,IAAI,OAAO,CAAC,eAAe,EAAE,MAAM;QAAE,OAAO,OAAO,CAAC,eAAe,CAAA;IACnE,IAAI,OAAO,CAAC,GAAG;QAAE,OAAO,CAAC,GAAG,oBAAoB,CAAC,CAAA;IACjD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAC5B,oDAAoD,EACpD;QACE,EAAE,KAAK,EAAE,MAAe,EAAE,KAAK,EAAE,8BAA8B,EAAE;QACjE,EAAE,KAAK,EAAE,aAAsB,EAAE,KAAK,EAAE,mBAAmB,CAAC,aAAa,CAAC,CAAC,KAAK,EAAE;QAClF,EAAE,KAAK,EAAE,OAAgB,EAAE,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,EAAE;KACpE,EACD,MAAM,CACP,CAAA;IACD,OAAO,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;AACjE,CAAC;AAED,yFAAyF;AACzF,KAAK,UAAU,qBAAqB,CAAC,EAAM,EAAE,SAA0B;IACrE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,sDAAsD,EAAE,IAAI,CAAC,CAAA;IAC3F,IAAI,CAAC,IAAI;QAAE,OAAM;IACjB,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,CAAA;IACzC,MAAM,KAAK,GAAG;QACZ,wDAAwD;QACxD,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC;QACvE,EAAE;QACF,uFAAuF;QACvF,sFAAsF;QACtF,sDAAsD;KACvD,CAAA;IACD,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;AAC3B,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,mBAAmB,CAAC,OAAmB,EAAE,EAAM;IAC5D,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,YAAY,CAAA;IACnE,yFAAyF;IACzF,IAAI,OAAO,CAAC,GAAG;QAAE,OAAO,EAAE,CAAA;IAC1B,OAAO,CACL,MAAM,EAAE,CAAC,QAAQ,CACf,+FAA+F,CAChG,CACF,CAAC,IAAI,EAAE,CAAA;AACV,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAmB,EACnB,EAAM,EACN,WAAoC;IAEpC,MAAM,QAAQ,GACZ,OAAO,CAAC,GAAG;QACX,CAAC,MAAM,EAAE,CAAC,OAAO,CACf,iFAAiF,EACjF,IAAI,CACL,CAAC,CAAA;IACJ,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,EAAE,CAAC,IAAI,CACL,yFAAyF;YACvF,+FAA+F,CAClG,CAAA;QACD,OAAO,EAAE,iBAAiB,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,mBAAmB,EAAE,EAAE,EAAE,CAAA;IAC9E,CAAC;IACD,MAAM,OAAO,GAAG,eAAe,CAAC,WAAW,CAAC,CAAA;IAC5C,EAAE,CAAC,IAAI,CACL,iGAAiG,CAClG,CAAA;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAmB,EACnB,QAAqB,EACrB,EAAM;IAEN,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,KAAK,CAAA;IACrD,IAAI,OAAO,CAAC,GAAG;QAAE,OAAO,EAAE,CAAA;IAE1B,MAAM,GAAG,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAA;IACpC,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAA;IACrC,EAAE,CAAC,IAAI,CAAC,cAAc,KAAK,oDAAoD,GAAG,EAAE,CAAC,CAAA;IAErF,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,oCAAoC,EAAE,IAAI,CAAC,CAAA;QACzE,IAAI,IAAI;YAAE,MAAM,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACrC,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,KAAK,2CAA2C,CAAC,CAAA;IAC7F,IAAI,KAAK,KAAK,EAAE;QACd,EAAE,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAA;IAC5F,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/secrets.d.ts

@@ -1,6 +1,7 @@
 /**
- * The two mandatory crypto secrets a cat-factory deployment needs, in the EXACT formats
- * the server's config loader expects:
+ * The three mandatory crypto secrets a cat-factory deployment needs, in the EXACT formats
+ * the server's config loader expects (all validated by `requireStableSecret` in
+ * `@cat-factory/local-server`'s config loader — a deployment missing any of them fails to boot):
  *
  * - `authSessionSecret` — signs the session JWT. The loader requires `>= 32` characters;
  *   we emit 32 random bytes as **hex** (64 chars), matching `deploy/local`'s
@@ -9,17 +10,21 @@
  *   The cipher requires valid **base64 of at least 32 decoded bytes** (a non-base64 value
  *   like `dummy` fails the cipher at boot with `InvalidCharacterError`); we emit 32 random
  *   bytes as base64.
+ * - `harnessSharedSecret` — the shared HMAC secret the backend and the executor-harness sign
+ *   their traffic with (`HARNESS_SHARED_SECRET`). The loader requires `>= 16` characters; we
+ *   emit 32 random bytes as **hex** (64 chars), matching `deploy/local`'s `generate-secrets.mjs`.
  *
- * Both MUST stay STABLE once chosen: regenerating `authSessionSecret` forces a re-login and
+ * All three MUST stay STABLE once chosen: regenerating `authSessionSecret` forces a re-login and
  * regenerating `encryptionKey` orphans every encrypted-at-rest credential. The CLI generates
- * them once at scaffold time and writes them into `.env` so the developer keeps the values.
+ * them once and writes them into `.env` so the developer keeps the values.
  */
 export interface GeneratedSecrets {
     authSessionSecret: string;
     encryptionKey: string;
+    harnessSharedSecret: string;
 }
 /** Injectable RNG seam so the generator is deterministic in tests. */
 export type RandomBytes = (size: number) => Buffer;
-/** Generate a fresh {@link GeneratedSecrets} pair in the server's required formats. */
+/** Generate a fresh {@link GeneratedSecrets} set in the server's required formats. */
 export declare function generateSecrets(randomBytes?: RandomBytes): GeneratedSecrets;
 //# sourceMappingURL=secrets.d.ts.map

package/dist/secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,gBAAgB;IAC/B,iBAAiB,EAAE,MAAM,CAAA;IACzB,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,sEAAsE;AACtE,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;AAElD,uFAAuF;AACvF,wBAAgB,eAAe,CAAC,WAAW,GAAE,WAA6B,GAAG,gBAAgB,CAK5F"}
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,gBAAgB;IAC/B,iBAAiB,EAAE,MAAM,CAAA;IACzB,aAAa,EAAE,MAAM,CAAA;IACrB,mBAAmB,EAAE,MAAM,CAAA;CAC5B;AAED,sEAAsE;AACtE,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;AAElD,sFAAsF;AACtF,wBAAgB,eAAe,CAAC,WAAW,GAAE,WAA6B,GAAG,gBAAgB,CAM5F"}