npm - @catladder/cli - Versions diffs - 0.0.0-main-2355fd7c → 0.0.0-main-018e2dee - Mend

@catladder/cli 0.0.0-main-2355fd7c → 0.0.0-main-018e2dee

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (83) hide show

package/dist/apps/cli/src/apps/catenv/catenv.js CHANGED Viewed

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const getProjectConfig_1 = require("../../config/getProjectConfig");
+const keyFiles_1 = require("../../localAccess/keyFiles");
 const printVariables_1 = require("./printVariables");
 const verboseBanner_1 = require("./verboseBanner");
 const writeDotEnvFiles_1 = require("./writeDotEnvFiles");
@@ -26,6 +27,8 @@ exports.default = async (choice, options) => {
     if (options === null || options === void 0 ? void 0 : options.verbose) {
         (0, verboseBanner_1.printVerboseBanner)();
     }
+    // before the env vars are resolved: they point at the key files
+    await (0, keyFiles_1.writeLocalAccessKeyFiles)(io, config);
     await Promise.all([
         (0, pipeline_1.generatePipelineFiles)(context),
         (0, writeDotEnvFiles_1.writeDotEnvFiles)(context, choice),

package/dist/apps/cli/src/apps/catenv/catenv.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"catenv.js","sourceRoot":"","sources":["../../../../../../src/apps/catenv/catenv.ts"],"names":[],"mappings":";;AAAA,oEAAiE;AACjE,qDAAkD;AAElD,mDAAqD;AACrD,yDAAsD;AACtD,+CAA8C;AAC9C,kDAG6B;AAE7B,kEAAuE;AACvE,sDAA2D;AAY3D,kBAAe,KAAK,EAAE,MAAe,EAAE,OAAiB,EAAE,EAAE;IAC1D,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAgB,GAAE,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;IACT,CAAC;IAED,MAAM,EAAE,GAAG,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,WAAW;QAC7B,CAAC,CAAC,iEAAiE;YACjE,4CAA4C;YAC5C,IAAA,2BAAgB,EAAC;gBACf,WAAW,EAAE,IAAI;gBACjB,WAAW,EAAE,IAAI;gBACjB,SAAS,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS;aAC9B,CAAC;QACJ,CAAC,CAAC,IAAA,uCAAsB,EAAC,EAAE,SAAS,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS,EAAE,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,EAAE,GAAG,IAAA,8BAAmB,EAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC;IACvD,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,EAAE,CAAC;QACrB,IAAA,kCAAkB,GAAE,CAAC;IACvB,CAAC;IAED,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,IAAA,gCAAqB,EAAC,OAAO,CAAC;QAC9B,IAAA,mCAAgB,EAAC,OAAO,EAAE,MAAM,CAAC;QAEjC,IAAA,2BAAa,EAAC,OAAO,EAAE,MAAM,CAAC;QAC9B,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,cAAc;YACrB,CAAC,CAAC,IAAA,+BAAc,EAAC,OAAO,EAAE,MAAM,CAAC;YACjC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE;KACtB,CAAC,CAAC;AACL,CAAC,CAAC"}
1	+ {"version":3,"file":"catenv.js","sourceRoot":"","sources":["../../../../../../src/apps/catenv/catenv.ts"],"names":[],"mappings":";;AAAA,oEAAiE;AACjE,yDAAsE;AACtE,qDAAkD;AAElD,mDAAqD;AACrD,yDAAsD;AACtD,+CAA8C;AAC9C,kDAG6B;AAE7B,kEAAuE;AACvE,sDAA2D;AAY3D,kBAAe,KAAK,EAAE,MAAe,EAAE,OAAiB,EAAE,EAAE;IAC1D,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAgB,GAAE,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;IACT,CAAC;IAED,MAAM,EAAE,GAAG,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,WAAW;QAC7B,CAAC,CAAC,iEAAiE;YACjE,4CAA4C;YAC5C,IAAA,2BAAgB,EAAC;gBACf,WAAW,EAAE,IAAI;gBACjB,WAAW,EAAE,IAAI;gBACjB,SAAS,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS;aAC9B,CAAC;QACJ,CAAC,CAAC,IAAA,uCAAsB,EAAC,EAAE,SAAS,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS,EAAE,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,EAAE,GAAG,IAAA,8BAAmB,EAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC;IACvD,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,EAAE,CAAC;QACrB,IAAA,kCAAkB,GAAE,CAAC;IACvB,CAAC;IAED,gEAAgE;IAChE,MAAM,IAAA,mCAAwB,EAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAE3C,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,IAAA,gCAAqB,EAAC,OAAO,CAAC;QAC9B,IAAA,mCAAgB,EAAC,OAAO,EAAE,MAAM,CAAC;QAEjC,IAAA,2BAAa,EAAC,OAAO,EAAE,MAAM,CAAC;QAC9B,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,cAAc;YACrB,CAAC,CAAC,IAAA,+BAAc,EAAC,OAAO,EAAE,MAAM,CAAC;YACjC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE;KACtB,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/apps/cli/src/apps/cli/commands/project/doctor/GcloudProjectInspector.d.ts CHANGED Viewed

@@ -10,6 +10,10 @@ export declare class GcloudProjectInspector {
     private getIamBindings;
     /** all roles bound to the given member (e.g. "serviceAccount:<email>") */
     getRolesOfMember(projectId: string, member: string): Promise<string[]>;
+    /** roles bound to the member without an iam condition */
+    getUnconditionalRolesOfMember(projectId: string, member: string): Promise<string[]>;
+    /** roles bound to the member under an iam condition */
+    getConditionalRolesOfMember(projectId: string, member: string): Promise<string[]>;
     getEnabledServices(projectId: string): Promise<Set<string>>;
     hasArtifactsRegistry(projectId: string, region: string): Promise<boolean>;
 }

package/dist/apps/cli/src/apps/cli/commands/project/doctor/GcloudProjectInspector.js CHANGED Viewed

@@ -35,6 +35,18 @@ class GcloudProjectInspector {
             .filter((binding) => { var _a; return (_a = binding.members) === null || _a === void 0 ? void 0 : _a.includes(member); })
             .map((binding) => binding.role);
     }
+    /** roles bound to the member without an iam condition */
+    async getUnconditionalRolesOfMember(projectId, member) {
+        return (await this.getIamBindings(projectId))
+            .filter((b) => { var _a; return !b.condition && ((_a = b.members) === null || _a === void 0 ? void 0 : _a.includes(member)); })
+            .map((b) => b.role);
+    }
+    /** roles bound to the member under an iam condition */
+    async getConditionalRolesOfMember(projectId, member) {
+        return (await this.getIamBindings(projectId))
+            .filter((b) => { var _a; return b.condition && ((_a = b.members) === null || _a === void 0 ? void 0 : _a.includes(member)); })
+            .map((b) => b.role);
+    }
     getEnabledServices(projectId) {
         if (!this.enabledServices.has(projectId)) {
             this.enabledServices.set(projectId, (0, child_process_promise_1.exec)(`gcloud services list --enabled --project=${projectId} --format="value(config.name)"`).then((result) => new Set(result.stdout

package/dist/apps/cli/src/apps/cli/commands/project/doctor/GcloudProjectInspector.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"GcloudProjectInspector.js","sourceRoot":"","sources":["../../../../../../../../../src/apps/cli/commands/project/doctor/GcloudProjectInspector.ts"],"names":[],"mappings":";;;AAAA,iEAA6C;AAC7C,+EAAkF;~~AAIlF~~;;;;GAIG;AACH,MAAa,sBAAsB;IAAnC;QACmB,gBAAW,GAAG,IAAI,GAAG,EAAiC,CAAC;QACvD,oBAAe,GAAG,IAAI,GAAG,EAAgC,CAAC;~~IAgE7E~~,CAAC;~~IA9DC~~,KAAK,CAAC,eAAe;QACnB,IAAI,CAAC;YACH,MAAM,IAAA,4BAAI,EAAC,gCAAgC,CAAC,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,SAAiB;QACtC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,WAAW,CAAC,GAAG,CAClB,SAAS,EACT,IAAA,4BAAI,EAAC,kCAAkC,SAAS,gBAAgB,CAAC,CAAC,IAAI,CACpE,CAAC,MAAM,EAAE,EAAE,WAAC,OAAA,MAAA,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,mCAAI,EAAE,CAAA,EAAA,CACrD,CACF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC;IAC1C,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,gBAAgB,CAAC,SAAiB,EAAE,MAAc;QACtD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QACtD,OAAO,QAAQ;aACZ,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,WAAC,OAAA,MAAA,OAAO,CAAC,OAAO,0CAAE,QAAQ,CAAC,MAAM,CAAC,CAAA,EAAA,CAAC;aACtD,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,kBAAkB,CAAC,SAAiB;QAClC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACzC,IAAI,CAAC,eAAe,CAAC,GAAG,CACtB,SAAS,EACT,IAAA,4BAAI,EACF,4CAA4C,SAAS,gCAAgC,CACtF,CAAC,IAAI,CACJ,CAAC,MAAM,EAAE,EAAE,CACT,IAAI,GAAG,CACL,MAAM,CAAC,MAAM;iBACV,KAAK,CAAC,IAAI,CAAC;iBACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;iBAC1B,MAAM,CAAC,OAAO,CAAC,CACnB,CACJ,CACF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,SAAiB,EACjB,MAAc;QAEd,IAAI,CAAC;YACH,MAAM,IAAA,4BAAI,EACR,0CAA0C,2CAAuB,eAAe,SAAS,gBAAgB,MAAM,EAAE,CAClH,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;~~AAlED~~,~~wDAkEC~~"}
1	+ {"version":3,"file":"GcloudProjectInspector.js","sourceRoot":"","sources":["../../../../../../../../../src/apps/cli/commands/project/doctor/GcloudProjectInspector.ts"],"names":[],"mappings":";;;AAAA,iEAA6C;AAC7C,+EAAkF;AAQlF;;;;GAIG;AACH,MAAa,sBAAsB;IAAnC;QACmB,gBAAW,GAAG,IAAI,GAAG,EAAiC,CAAC;QACvD,oBAAe,GAAG,IAAI,GAAG,EAAgC,CAAC;IAoF7E,CAAC;IAlFC,KAAK,CAAC,eAAe;QACnB,IAAI,CAAC;YACH,MAAM,IAAA,4BAAI,EAAC,gCAAgC,CAAC,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,SAAiB;QACtC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,WAAW,CAAC,GAAG,CAClB,SAAS,EACT,IAAA,4BAAI,EAAC,kCAAkC,SAAS,gBAAgB,CAAC,CAAC,IAAI,CACpE,CAAC,MAAM,EAAE,EAAE,WAAC,OAAA,MAAA,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,mCAAI,EAAE,CAAA,EAAA,CACrD,CACF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC;IAC1C,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,gBAAgB,CAAC,SAAiB,EAAE,MAAc;QACtD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QACtD,OAAO,QAAQ;aACZ,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,WAAC,OAAA,MAAA,OAAO,CAAC,OAAO,0CAAE,QAAQ,CAAC,MAAM,CAAC,CAAA,EAAA,CAAC;aACtD,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,yDAAyD;IACzD,KAAK,CAAC,6BAA6B,CACjC,SAAiB,EACjB,MAAc;QAEd,OAAO,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;aAC1C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,WAAC,OAAA,CAAC,CAAC,CAAC,SAAS,KAAI,MAAA,CAAC,CAAC,OAAO,0CAAE,QAAQ,CAAC,MAAM,CAAC,CAAA,CAAA,EAAA,CAAC;aAC1D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,uDAAuD;IACvD,KAAK,CAAC,2BAA2B,CAC/B,SAAiB,EACjB,MAAc;QAEd,OAAO,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;aAC1C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,WAAC,OAAA,CAAC,CAAC,SAAS,KAAI,MAAA,CAAC,CAAC,OAAO,0CAAE,QAAQ,CAAC,MAAM,CAAC,CAAA,CAAA,EAAA,CAAC;aACzD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,kBAAkB,CAAC,SAAiB;QAClC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACzC,IAAI,CAAC,eAAe,CAAC,GAAG,CACtB,SAAS,EACT,IAAA,4BAAI,EACF,4CAA4C,SAAS,gCAAgC,CACtF,CAAC,IAAI,CACJ,CAAC,MAAM,EAAE,EAAE,CACT,IAAI,GAAG,CACL,MAAM,CAAC,MAAM;iBACV,KAAK,CAAC,IAAI,CAAC;iBACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;iBAC1B,MAAM,CAAC,OAAO,CAAC,CACnB,CACJ,CACF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,SAAiB,EACjB,MAAc;QAEd,IAAI,CAAC;YACH,MAAM,IAAA,4BAAI,EACR,0CAA0C,2CAAuB,eAAe,SAAS,gBAAgB,MAAM,EAAE,CAClH,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;AAtFD,wDAsFC"}

package/dist/apps/cli/src/apps/cli/commands/project/doctor/checkCloudRun.d.ts CHANGED Viewed

@@ -1,4 +1,4 @@
-import type { ComponentContext } from "../../../../../../../../packages/pipeline/src/index.js";
+import type { ComponentContext, Config } from "../../../../../../../../packages/pipeline/src/index.js";
 import type { DoctorReport } from "./DoctorReport";
 /**
  * compares the gcloud state `setupCloudRun` would provision for the
@@ -10,4 +10,4 @@ import type { DoctorReport } from "./DoctorReport";
  * setup ran — deploys keep working and only the review teardown hits
  * the missing `roles/cloudsql.admin` as a 403 in ci.
  */
-export declare const checkCloudRun: (report: DoctorReport, contexts: ComponentContext[]) => Promise<void>;
+export declare const checkCloudRun: (report: DoctorReport, contexts: ComponentContext[], config: Config) => Promise<void>;

package/dist/apps/cli/src/apps/cli/commands/project/doctor/checkCloudRun.js CHANGED Viewed

@@ -7,6 +7,7 @@ const serviceAccountNames_1 = require("../../../../../gcloud/serviceAccountNames
 const serviceAccounts_1 = require("../../../../../gcloud/serviceAccounts");
 const concurrency_1 = require("../../../../../utils/concurrency");
 const setupCloudRun_1 = require("../setup/setupCloudRun");
+const checkLocalAccess_1 = require("./checkLocalAccess");
 const GcloudProjectInspector_1 = require("./GcloudProjectInspector");
 const getCloudRunConfig = (context) => {
     var _a;
@@ -26,7 +27,7 @@ const getCloudRunConfig = (context) => {
  * setup ran — deploys keep working and only the review teardown hits
  * the missing `roles/cloudsql.admin` as a 403 in ci.
  */
-const checkCloudRun = async (report, contexts) => {
+const checkCloudRun = async (report, contexts, config) => {
     var _a;
     const cloudRunContexts = contexts.filter((context) => { var _a; return (0, pipeline_1.isOfDeployType)((_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config, "google-cloudrun"); });
     if (cloudRunContexts.length === 0)
@@ -97,6 +98,7 @@ const checkCloudRun = async (report, contexts) => {
             report.ok(`${label}: service account exists with all config-implied roles`);
         }
     }
+    await (0, checkLocalAccess_1.checkLocalAccess)(report, config, cloudRunContexts, inspector);
 };
 exports.checkCloudRun = checkCloudRun;
 //# sourceMappingURL=checkCloudRun.js.map

package/dist/apps/cli/src/apps/cli/commands/project/doctor/checkCloudRun.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"checkCloudRun.js","sourceRoot":"","sources":["../../../../../../../../../src/apps/cli/commands/project/doctor/checkCloudRun.ts"],"names":[],"mappings":";;;AACA,kDAAqD;AACrD,+EAAkF;AAClF,mFAAyF;AACzF,2EAAsE;AACtE,kEAAsE;AACtE,0DAIgC;~~AAEhC~~,qEAAkE;AAElE,MAAM,iBAAiB,GAAG,CAAC,OAAyB,EAAE,EAAE;;IACtD,MAAM,MAAM,GAAG,MAAA,OAAO,CAAC,MAAM,0CAAE,MAAM,CAAC;IACtC,IAAI,CAAC,IAAA,yBAAc,EAAC,MAAM,EAAE,iBAAiB,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACI,MAAM,aAAa,GAAG,KAAK,EAChC,MAAoB,EACpB,QAA4B,EAC5B,EAAE;;IACF,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,WACnD,OAAA,IAAA,yBAAc,EAAC,MAAA,OAAO,CAAC,MAAM,0CAAE,MAAM,EAAE,iBAAiB,CAAC,CAAA,EAAA,CAC1D,CAAC;IACF,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAE1C,MAAM,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,IAAI,+CAAsB,EAAE,CAAC;IAC/C,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,eAAe,EAAE,CAAC,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CACT,+DAA+D,EAC/D,wBAAwB,CACzB,CAAC;QACF,OAAO;IACT,CAAC;IAED,qEAAqE;IACrE,sEAAsE;IACtE,uDAAuD;IACvD,MAAM,SAAS,GAAG,IAAI,GAAG,EAA8B,CAAC;IACxD,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,MAAM,EAAE,SAAS,EAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACjD,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,MAAA,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,mCAAI,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC,IAAI,SAAS,EAAE,CAAC;QACrD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAC9B,eAAe,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAClC,IAAA,2CAA2B,EAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CACxD,CACF,CAAC;QACF,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAG,CAAC,GAAG,gBAAgB,CAAC,CAAC,MAAM,CAC1C,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CACnC,CAAC;YACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,CAAC,EAAE,CACP,GAAG,SAAS,SAAS,gBAAgB,CAAC,IAAI,4BAA4B,CACvE,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CACT,GAAG,SAAS,2BAA2B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC3D,8BAA8B,CAC/B,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CACT,GAAG,SAAS,sCAAsC,CAAC,CAAC,OAAO,GAAG,CAC/D,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,eAAe,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CACpE,CAAC;QACF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,MAAM,SAAS,CAAC,oBAAoB,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;gBAC5D,MAAM,CAAC,EAAE,CACP,GAAG,SAAS,yBAAyB,2CAAuB,eAAe,MAAM,EAAE,CACpF,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CACT,GAAG,SAAS,yBAAyB,2CAAuB,gBAAgB,MAAM,EAAE,EACpF,8BAA8B,CAC/B,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,kCAAkC;IAClC,MAAM,OAAO,GAAG,MAAM,IAAA,gCAAkB,EACtC,gBAAgB,EAChB,CAAC,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,EAAE,cAAc,EAAE,GAAG,IAAA,kDAA4B,EAAC,OAAO,EAAE;YAC/D,IAAI,EAAE,wCAAwB;YAC9B,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,MAAM,IAAA,+BAAa,EAAC,cAAc,CAAC,CAAC,EAAE,CAAC;YAC3C,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;QACtE,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,gBAAgB,CACjD,MAAM,CAAC,SAAS,EAChB,kBAAkB,cAAc,EAAE,CACnC,CAAC;QACF,MAAM,YAAY,GAAG,IAAA,sCAAsB,EAAC,MAAM,CAAC,CAAC,MAAM,CACxD,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CACrC,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IACjE,CAAC,CACF,CAAC;IAEF,KAAK,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,OAAO,EAAE,CAAC;QACxE,MAAM,KAAK,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CACT,GAAG,KAAK,4BAA4B,cAAc,iBAAiB,EACnE,gCAAgC,OAAO,CAAC,IAAI,EAAE,CAC/C,CAAC;QACJ,CAAC;aAAM,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CACT,GAAG,KAAK,uCAAuC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACxE,gCAAgC,OAAO,CAAC,IAAI,EAAE,CAC/C,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,EAAE,CACP,GAAG,KAAK,wDAAwD,CACjE,CAAC;QACJ,CAAC;IACH,CAAC;~~AACH~~,CAAC,CAAC;~~AAnHW~~,QAAA,aAAa,~~iBAmHxB~~"}
1	+ {"version":3,"file":"checkCloudRun.js","sourceRoot":"","sources":["../../../../../../../../../src/apps/cli/commands/project/doctor/checkCloudRun.ts"],"names":[],"mappings":";;;AACA,kDAAqD;AACrD,+EAAkF;AAClF,mFAAyF;AACzF,2EAAsE;AACtE,kEAAsE;AACtE,0DAIgC;AAChC,yDAAsD;AAEtD,qEAAkE;AAElE,MAAM,iBAAiB,GAAG,CAAC,OAAyB,EAAE,EAAE;;IACtD,MAAM,MAAM,GAAG,MAAA,OAAO,CAAC,MAAM,0CAAE,MAAM,CAAC;IACtC,IAAI,CAAC,IAAA,yBAAc,EAAC,MAAM,EAAE,iBAAiB,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACI,MAAM,aAAa,GAAG,KAAK,EAChC,MAAoB,EACpB,QAA4B,EAC5B,MAAc,EACd,EAAE;;IACF,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,WACnD,OAAA,IAAA,yBAAc,EAAC,MAAA,OAAO,CAAC,MAAM,0CAAE,MAAM,EAAE,iBAAiB,CAAC,CAAA,EAAA,CAC1D,CAAC;IACF,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAE1C,MAAM,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,IAAI,+CAAsB,EAAE,CAAC;IAC/C,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,eAAe,EAAE,CAAC,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CACT,+DAA+D,EAC/D,wBAAwB,CACzB,CAAC;QACF,OAAO;IACT,CAAC;IAED,qEAAqE;IACrE,sEAAsE;IACtE,uDAAuD;IACvD,MAAM,SAAS,GAAG,IAAI,GAAG,EAA8B,CAAC;IACxD,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,MAAM,EAAE,SAAS,EAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACjD,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,MAAA,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,mCAAI,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC,IAAI,SAAS,EAAE,CAAC;QACrD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAC9B,eAAe,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAClC,IAAA,2CAA2B,EAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CACxD,CACF,CAAC;QACF,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAG,CAAC,GAAG,gBAAgB,CAAC,CAAC,MAAM,CAC1C,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CACnC,CAAC;YACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,CAAC,EAAE,CACP,GAAG,SAAS,SAAS,gBAAgB,CAAC,IAAI,4BAA4B,CACvE,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CACT,GAAG,SAAS,2BAA2B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC3D,8BAA8B,CAC/B,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CACT,GAAG,SAAS,sCAAsC,CAAC,CAAC,OAAO,GAAG,CAC/D,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,eAAe,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CACpE,CAAC;QACF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,MAAM,SAAS,CAAC,oBAAoB,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;gBAC5D,MAAM,CAAC,EAAE,CACP,GAAG,SAAS,yBAAyB,2CAAuB,eAAe,MAAM,EAAE,CACpF,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CACT,GAAG,SAAS,yBAAyB,2CAAuB,gBAAgB,MAAM,EAAE,EACpF,8BAA8B,CAC/B,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,kCAAkC;IAClC,MAAM,OAAO,GAAG,MAAM,IAAA,gCAAkB,EACtC,gBAAgB,EAChB,CAAC,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,EAAE,cAAc,EAAE,GAAG,IAAA,kDAA4B,EAAC,OAAO,EAAE;YAC/D,IAAI,EAAE,wCAAwB;YAC9B,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,MAAM,IAAA,+BAAa,EAAC,cAAc,CAAC,CAAC,EAAE,CAAC;YAC3C,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;QACtE,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,gBAAgB,CACjD,MAAM,CAAC,SAAS,EAChB,kBAAkB,cAAc,EAAE,CACnC,CAAC;QACF,MAAM,YAAY,GAAG,IAAA,sCAAsB,EAAC,MAAM,CAAC,CAAC,MAAM,CACxD,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CACrC,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IACjE,CAAC,CACF,CAAC;IAEF,KAAK,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,OAAO,EAAE,CAAC;QACxE,MAAM,KAAK,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CACT,GAAG,KAAK,4BAA4B,cAAc,iBAAiB,EACnE,gCAAgC,OAAO,CAAC,IAAI,EAAE,CAC/C,CAAC;QACJ,CAAC;aAAM,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CACT,GAAG,KAAK,uCAAuC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACxE,gCAAgC,OAAO,CAAC,IAAI,EAAE,CAC/C,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,EAAE,CACP,GAAG,KAAK,wDAAwD,CACjE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,IAAA,mCAAgB,EAAC,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,SAAS,CAAC,CAAC;AACtE,CAAC,CAAC;AAtHW,QAAA,aAAa,iBAsHxB"}

package/dist/apps/cli/src/apps/cli/commands/project/doctor/checkLocalAccess.d.ts ADDED Viewed

@@ -0,0 +1,10 @@
+import type { ComponentContext, Config } from "../../../../../../../../packages/pipeline/src/index.js";
+import type { DoctorReport } from "./DoctorReport";
+import type { GcloudProjectInspector } from "./GcloudProjectInspector";
+/**
+ * compares the read-only local access service accounts (`localAccess`
+ * in catladder.ts) with their declaration: missing account, missing and
+ * extra bindings, and an account that exists although nothing is
+ * declared any more. Expects an authenticated inspector.
+ */
+export declare const checkLocalAccess: (report: DoctorReport, config: Config, contexts: ComponentContext[], inspector: GcloudProjectInspector) => Promise<void>;

package/dist/apps/cli/src/apps/cli/commands/project/doctor/checkLocalAccess.js ADDED Viewed

@@ -0,0 +1,98 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkLocalAccess = void 0;
+const pipeline_1 = require("../../../../../../../../packages/pipeline/src/index.js");
+const localAccess_1 = require("../../../../../gcloud/localAccess");
+const serviceAccounts_1 = require("../../../../../gcloud/serviceAccounts");
+const concurrency_1 = require("../../../../../utils/concurrency");
+/**
+ * compares the read-only local access service accounts (`localAccess`
+ * in catladder.ts) with their declaration: missing account, missing and
+ * extra bindings, and an account that exists although nothing is
+ * declared any more. Expects an authenticated inspector.
+ */
+const checkLocalAccess = async (report, config, contexts, inspector) => {
+    const results = await (0, concurrency_1.mapWithConcurrency)(contexts, 5, async (context) => {
+        var _a;
+        const deployConfig = (_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config;
+        if (!(0, pipeline_1.isOfDeployType)(deployConfig, "google-cloudrun"))
+            return null;
+        const label = `${context.env}:${context.name}`;
+        let declared;
+        try {
+            declared = (0, pipeline_1.getLocalAccessGcpRoles)(config, context.env);
+            (0, pipeline_1.getLocalAccessGcpCredentialsEnvVars)(config, context.name);
+        }
+        catch (e) {
+            return { label, invalid: e.message };
+        }
+        const { fullIdentifier } = (0, localAccess_1.getLocalAccessServiceAccountNames)(context, deployConfig.projectId);
+        const exists = await (0, serviceAccounts_1.accountExists)(fullIdentifier);
+        const member = `serviceAccount:${fullIdentifier}`;
+        const bound = exists
+            ? await inspector.getUnconditionalRolesOfMember(deployConfig.projectId, member)
+            : [];
+        const conditional = exists
+            ? await inspector.getConditionalRolesOfMember(deployConfig.projectId, member)
+            : [];
+        const keyCount = exists
+            ? (await (0, localAccess_1.listUserManagedKeyIds)(fullIdentifier)).length
+            : 0;
+        return {
+            label,
+            declared,
+            fullIdentifier,
+            exists,
+            bound,
+            conditional,
+            keyCount,
+        };
+    });
+    const relevant = results.filter((r) => r && ("invalid" in r || r.declared.length > 0 || r.exists));
+    if (relevant.length === 0)
+        return;
+    report.section("local access (read-only service accounts)");
+    for (const result of relevant) {
+        if (!result)
+            continue;
+        if ("invalid" in result) {
+            report.fail(`${result.label}: ${result.invalid}`);
+            continue;
+        }
+        const { label, declared, fullIdentifier, exists, bound, conditional, keyCount, } = result;
+        if (declared.length > 0 && (0, pipeline_1.getVaultConfig)(config).type === "gitlab") {
+            report.fail(`${label}: localAccess needs a vault that is not a CI variable store (the gitlab vault would expose the key to every CI job)`);
+            continue;
+        }
+        const heal = `run: catladder project setup`;
+        if (declared.length === 0) {
+            report.warn(`${label}: ${fullIdentifier} exists although no local access is declared`, heal);
+        }
+        else if (!exists) {
+            report.fail(`${label}: ${fullIdentifier} does not exist`, heal);
+        }
+        else {
+            const { missing, extra } = (0, pipeline_1.diffRoleBindings)(declared, bound);
+            if (missing.length > 0) {
+                report.fail(`${label}: local access account is missing roles: ${missing.join(", ")}`, heal);
+            }
+            if (extra.length > 0) {
+                report.fail(`${label}: local access account has undeclared roles: ${extra.join(", ")}`, heal);
+            }
+            if (conditional.length > 0) {
+                report.fail(`${label}: local access account has conditional roles (${conditional.join(", ")}) that setup does not remove`, "remove them by hand");
+            }
+            if (keyCount !== 1) {
+                report.fail(`${label}: local access account has ${keyCount} user-managed keys, expected exactly 1`, heal);
+            }
+            if (missing.length === 0 &&
+                extra.length === 0 &&
+                conditional.length === 0 &&
+                keyCount === 1) {
+                report.ok(`${label}: local access account has exactly the declared roles`);
+            }
+        }
+    }
+};
+exports.checkLocalAccess = checkLocalAccess;
+//# sourceMappingURL=checkLocalAccess.js.map

package/dist/apps/cli/src/apps/cli/commands/project/doctor/checkLocalAccess.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"checkLocalAccess.js","sourceRoot":"","sources":["../../../../../../../../../src/apps/cli/commands/project/doctor/checkLocalAccess.ts"],"names":[],"mappings":";;;AACA,kDAM6B;AAC7B,mEAG2C;AAC3C,2EAAsE;AACtE,kEAAsE;AAItE;;;;;GAKG;AACI,MAAM,gBAAgB,GAAG,KAAK,EACnC,MAAoB,EACpB,MAAc,EACd,QAA4B,EAC5B,SAAiC,EACjC,EAAE;IACF,MAAM,OAAO,GAAG,MAAM,IAAA,gCAAkB,EAAC,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;;QACtE,MAAM,YAAY,GAAG,MAAA,OAAO,CAAC,MAAM,0CAAE,MAAM,CAAC;QAC5C,IAAI,CAAC,IAAA,yBAAc,EAAC,YAAY,EAAE,iBAAiB,CAAC;YAAE,OAAO,IAAI,CAAC;QAClE,MAAM,KAAK,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QAC/C,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,IAAA,iCAAsB,EAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YACvD,IAAA,8CAAmC,EAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAiB,EAAE,CAAC;QACjD,CAAC;QACD,MAAM,EAAE,cAAc,EAAE,GAAG,IAAA,+CAAiC,EAC1D,OAAO,EACP,YAAY,CAAC,SAAS,CACvB,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,IAAA,+BAAa,EAAC,cAAc,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,kBAAkB,cAAc,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,MAAM;YAClB,CAAC,CAAC,MAAM,SAAS,CAAC,6BAA6B,CAC3C,YAAY,CAAC,SAAS,EACtB,MAAM,CACP;YACH,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,WAAW,GAAG,MAAM;YACxB,CAAC,CAAC,MAAM,SAAS,CAAC,2BAA2B,CACzC,YAAY,CAAC,SAAS,EACtB,MAAM,CACP;YACH,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,QAAQ,GAAG,MAAM;YACrB,CAAC,CAAC,CAAC,MAAM,IAAA,mCAAqB,EAAC,cAAc,CAAC,CAAC,CAAC,MAAM;YACtD,CAAC,CAAC,CAAC,CAAC;QACN,OAAO;YACL,KAAK;YACL,QAAQ;YACR,cAAc;YACd,MAAM;YACN,KAAK;YACL,WAAW;YACX,QAAQ;SACT,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAClE,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAElC,MAAM,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC;IAC5D,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YAClD,SAAS;QACX,CAAC;QACD,MAAM,EACJ,KAAK,EACL,QAAQ,EACR,cAAc,EACd,MAAM,EACN,KAAK,EACL,WAAW,EACX,QAAQ,GACT,GAAG,MAAM,CAAC;QACX,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,IAAA,yBAAc,EAAC,MAAM,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACpE,MAAM,CAAC,IAAI,CACT,GAAG,KAAK,qHAAqH,CAC9H,CAAC;YACF,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,8BAA8B,CAAC;QAC5C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CACT,GAAG,KAAK,KAAK,cAAc,8CAA8C,EACzE,IAAI,CACL,CAAC;QACJ,CAAC;aAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,cAAc,iBAAiB,EAAE,IAAI,CAAC,CAAC;QAClE,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,IAAA,2BAAgB,EAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC7D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,CAAC,IAAI,CACT,GAAG,KAAK,4CAA4C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACxE,IAAI,CACL,CAAC;YACJ,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,MAAM,CAAC,IAAI,CACT,GAAG,KAAK,gDAAgD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC1E,IAAI,CACL,CAAC;YACJ,CAAC;YACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,CAAC,IAAI,CACT,GAAG,KAAK,iDAAiD,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,8BAA8B,EAC7G,qBAAqB,CACtB,CAAC;YACJ,CAAC;YACD,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;gBACnB,MAAM,CAAC,IAAI,CACT,GAAG,KAAK,8BAA8B,QAAQ,wCAAwC,EACtF,IAAI,CACL,CAAC;YACJ,CAAC;YACD,IACE,OAAO,CAAC,MAAM,KAAK,CAAC;gBACpB,KAAK,CAAC,MAAM,KAAK,CAAC;gBAClB,WAAW,CAAC,MAAM,KAAK,CAAC;gBACxB,QAAQ,KAAK,CAAC,EACd,CAAC;gBACD,MAAM,CAAC,EAAE,CACP,GAAG,KAAK,uDAAuD,CAChE,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AA1HW,QAAA,gBAAgB,oBA0H3B"}

package/dist/apps/cli/src/apps/cli/commands/project/doctor/index.js CHANGED Viewed

@@ -41,7 +41,7 @@ const doctorProject = async (instance, onlyComponents) => {
     if ((0, pipeline_1.getEnabledPipelineTypes)(config).includes("gitlab")) {
         await (0, checkGitlab_1.checkGitlab)(instance, report, contexts);
     }
-    await (0, checkCloudRun_1.checkCloudRun)(report, contexts);
+    await (0, checkCloudRun_1.checkCloudRun)(report, contexts, config);
     await (0, checkGithubImageCasing_1.checkGithubImageCasing)(report, config);
     await (0, checkGithubReleaseWorkflow_1.checkGithubReleaseWorkflow)(report, config);
     await (0, checkGithub_1.checkGithub)(report, config);

package/dist/apps/cli/src/apps/cli/commands/project/doctor/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../../../src/apps/cli/commands/project/doctor/index.ts"],"names":[],"mappings":";;;AACA,kDAA8D;AAC9D,6EAGgD;AAEhD,mDAAgD;AAChD,+CAA4C;AAC5C,qEAAkE;AAClE,6EAA0E;AAC1E,+CAA4C;AAC5C,6CAA0C;AAC1C,iDAA8C;AAE9C;;;;;;;;;;;GAWG;AACI,MAAM,aAAa,GAAG,KAAK,EAChC,QAAY,EACZ,cAAkC,EAClC,EAAE;IACF,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAgB,GAAE,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,QAAQ,CAAC,GAAG,CACV,oEAAoE,CACrE,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,2BAAY,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,IAAA,uBAAU,EAAC,MAAM,CAAC,CAAC;IAEzB,IAAI,QAAQ,GAAuB,EAAE,CAAC;IACtC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,IAAA,yCAAsB,EAAC,cAAc,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACpC,MAAM,CAAC,IAAI,CACT,uCAAuC,CAAC,CAAC,OAAO,EAAE,EAClD,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IAED,IAAI,IAAA,kCAAuB,EAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,MAAM,IAAA,yBAAW,EAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,IAAA,6BAAa,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;~~IACtC~~,MAAM,IAAA,+CAAsB,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,IAAA,uDAA0B,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,IAAA,yBAAW,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAElC,MAAM,CAAC,SAAS,EAAE,CAAC;AACrB,CAAC,CAAC;AAnCW,QAAA,aAAa,iBAmCxB"}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../../../src/apps/cli/commands/project/doctor/index.ts"],"names":[],"mappings":";;;AACA,kDAA8D;AAC9D,6EAGgD;AAEhD,mDAAgD;AAChD,+CAA4C;AAC5C,qEAAkE;AAClE,6EAA0E;AAC1E,+CAA4C;AAC5C,6CAA0C;AAC1C,iDAA8C;AAE9C;;;;;;;;;;;GAWG;AACI,MAAM,aAAa,GAAG,KAAK,EAChC,QAAY,EACZ,cAAkC,EAClC,EAAE;IACF,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAgB,GAAE,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,QAAQ,CAAC,GAAG,CACV,oEAAoE,CACrE,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,2BAAY,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,IAAA,uBAAU,EAAC,MAAM,CAAC,CAAC;IAEzB,IAAI,QAAQ,GAAuB,EAAE,CAAC;IACtC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,IAAA,yCAAsB,EAAC,cAAc,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACpC,MAAM,CAAC,IAAI,CACT,uCAAuC,CAAC,CAAC,OAAO,EAAE,EAClD,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IAED,IAAI,IAAA,kCAAuB,EAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,MAAM,IAAA,yBAAW,EAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,IAAA,6BAAa,EAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC9C,MAAM,IAAA,+CAAsB,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,IAAA,uDAA0B,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,IAAA,yBAAW,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAElC,MAAM,CAAC,SAAS,EAAE,CAAC;AACrB,CAAC,CAAC;AAnCW,QAAA,aAAa,iBAmCxB"}

package/dist/apps/cli/src/apps/cli/commands/project/setup/setupContext.js CHANGED Viewed

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.setupContext = void 0;
 const pipeline_1 = require("../../../../../../../../packages/pipeline/src/index.js");
 const setupCloudRun_1 = require("./setupCloudRun");
+const setupLocalAccess_1 = require("./setupLocalAccess");
 const setupKubernetes_1 = require("./setupKubernetes");
 const logSection_1 = require("./logSection");
 const setupContext = async (instance, context) => {
@@ -10,6 +11,7 @@ const setupContext = async (instance, context) => {
         var _a, _b;
         if ((0, pipeline_1.isOfDeployType)((_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config, "google-cloudrun")) {
             await (0, setupCloudRun_1.setupCloudRun)(instance, context);
+            await (0, setupLocalAccess_1.setupLocalAccess)(instance, context);
         }
         const deployConfig = (_b = context.deploy) === null || _b === void 0 ? void 0 : _b.config;
         if ((0, pipeline_1.isOfDeployType)(deployConfig, "kubernetes")) {

package/dist/apps/cli/src/apps/cli/commands/project/setup/setupContext.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"setupContext.js","sourceRoot":"","sources":["../../../../../../../../../src/apps/cli/commands/project/setup/setupContext.ts"],"names":[],"mappings":";;;AACA,kDAAqD;AAErD,mDAAgD;~~AAEhD~~,uDAAoD;AACpD,6CAA0C;AAEnC,MAAM,YAAY,GAAG,KAAK,EAAE,QAAY,EAAE,OAAyB,EAAE,EAAE;IAC5E,MAAM,IAAA,uBAAU,EACd,QAAQ,EACR,aAAa,GAAG,OAAO,CAAC,GAAG,GAAG,GAAG,GAAG,OAAO,CAAC,IAAI,EAChD,KAAK,IAAI,EAAE;;QACT,IAAI,IAAA,yBAAc,EAAC,MAAA,OAAO,CAAC,MAAM,0CAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAA,6BAAa,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;~~QACzC~~,CAAC;QAED,MAAM,YAAY,GAAG,MAAA,OAAO,CAAC,MAAM,0CAAE,MAAM,CAAC;QAC5C,IAAI,IAAA,yBAAc,EAAC,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAA,iCAAe,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC,CAAC;~~AAfW~~,QAAA,YAAY,~~gBAevB~~"}
1	+ {"version":3,"file":"setupContext.js","sourceRoot":"","sources":["../../../../../../../../../src/apps/cli/commands/project/setup/setupContext.ts"],"names":[],"mappings":";;;AACA,kDAAqD;AAErD,mDAAgD;AAChD,yDAAsD;AAEtD,uDAAoD;AACpD,6CAA0C;AAEnC,MAAM,YAAY,GAAG,KAAK,EAAE,QAAY,EAAE,OAAyB,EAAE,EAAE;IAC5E,MAAM,IAAA,uBAAU,EACd,QAAQ,EACR,aAAa,GAAG,OAAO,CAAC,GAAG,GAAG,GAAG,GAAG,OAAO,CAAC,IAAI,EAChD,KAAK,IAAI,EAAE;;QACT,IAAI,IAAA,yBAAc,EAAC,MAAA,OAAO,CAAC,MAAM,0CAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAA,6BAAa,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACvC,MAAM,IAAA,mCAAgB,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,YAAY,GAAG,MAAA,OAAO,CAAC,MAAM,0CAAE,MAAM,CAAC;QAC5C,IAAI,IAAA,yBAAc,EAAC,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAA,iCAAe,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC,CAAC;AAhBW,QAAA,YAAY,gBAgBvB"}

package/dist/apps/cli/src/apps/cli/commands/project/setup/setupLocalAccess.d.ts ADDED Viewed

@@ -0,0 +1,9 @@
+import type { ComponentContext } from "../../../../../../../../packages/pipeline/src/index.js";
+import type { IO } from "../../../../../core/types";
+/**
+ * provisions the local access (`localAccess` in catladder.ts)
+ * of a google cloud run component/env: a dedicated service account with
+ * exactly the declared bindings and its key in the secret store. Also
+ * removes what is no longer declared.
+ */
+export declare const setupLocalAccess: (instance: IO, context: ComponentContext) => Promise<void>;

package/dist/apps/cli/src/apps/cli/commands/project/setup/setupLocalAccess.js ADDED Viewed

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setupLocalAccess = void 0;
+const pipeline_1 = require("../../../../../../../../packages/pipeline/src/index.js");
+const getProjectConfig_1 = require("../../../../../config/getProjectConfig");
+const localAccess_1 = require("../../../../../gcloud/localAccess");
+/**
+ * provisions the local access (`localAccess` in catladder.ts)
+ * of a google cloud run component/env: a dedicated service account with
+ * exactly the declared bindings and its key in the secret store. Also
+ * removes what is no longer declared.
+ */
+const setupLocalAccess = async (instance, context) => {
+    var _a;
+    const config = (_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config;
+    if (!(0, pipeline_1.isOfDeployType)(config, "google-cloudrun"))
+        return;
+    const projectConfig = await (0, getProjectConfig_1.getProjectConfig)();
+    const roles = (0, pipeline_1.getLocalAccessGcpRoles)(projectConfig, context.env);
+    // validates `credentialsEnvVar` (catenv silently skips invalid ones)
+    (0, pipeline_1.getLocalAccessGcpCredentialsEnvVars)(projectConfig, context.name);
+    if (roles.length > 0 && (0, pipeline_1.getVaultConfig)(projectConfig).type === "gitlab") {
+        // the gitlab vault stores secrets as CI variables available to every
+        // job on every branch: the key would leak to anyone who can push
+        throw new Error(`localAccess (${context.env}:${context.name}) needs a vault that is not a CI variable store (e.g. bitwarden): the gitlab vault would expose the service account key to every CI job. Configure \`vault\` or remove the localAccess declaration.`);
+    }
+    instance.log("sync local access service account...");
+    await (0, localAccess_1.syncLocalAccessServiceAccount)(instance, context, config.projectId, roles);
+};
+exports.setupLocalAccess = setupLocalAccess;
+//# sourceMappingURL=setupLocalAccess.js.map

package/dist/apps/cli/src/apps/cli/commands/project/setup/setupLocalAccess.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"setupLocalAccess.js","sourceRoot":"","sources":["../../../../../../../../../src/apps/cli/commands/project/setup/setupLocalAccess.ts"],"names":[],"mappings":";;;AACA,kDAK6B;AAC7B,6EAA0E;AAE1E,mEAAkF;AAElF;;;;;GAKG;AACI,MAAM,gBAAgB,GAAG,KAAK,EACnC,QAAY,EACZ,OAAyB,EACzB,EAAE;;IACF,MAAM,MAAM,GAAG,MAAA,OAAO,CAAC,MAAM,0CAAE,MAAM,CAAC;IACtC,IAAI,CAAC,IAAA,yBAAc,EAAC,MAAM,EAAE,iBAAiB,CAAC;QAAE,OAAO;IACvD,MAAM,aAAa,GAAG,MAAM,IAAA,mCAAgB,GAAE,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAA,iCAAsB,EAAC,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACjE,qEAAqE;IACrE,IAAA,8CAAmC,EAAC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,IAAA,yBAAc,EAAC,aAAa,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACxE,qEAAqE;QACrE,iEAAiE;QACjE,MAAM,IAAI,KAAK,CACb,gBAAgB,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,IAAI,qMAAqM,CACjP,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;IACrD,MAAM,IAAA,2CAA6B,EACjC,QAAQ,EACR,OAAO,EACP,MAAM,CAAC,SAAS,EAChB,KAAK,CACN,CAAC;AACJ,CAAC,CAAC;AA1BW,QAAA,gBAAgB,oBA0B3B"}

package/dist/apps/cli/src/config/getProjectConfig.js CHANGED Viewed

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getJobOnlyEnvVarsResolved = exports.getEnvVarsResolved = exports.getGitlabVar = exports.getEnvironment = exports.getAllPipelineContexts = exports.getAllComponentsWithAllEnvsHierarchical = exports.getAllComponentsWithAllEnvsFlat = exports.getPipelineContextByChoice = exports.getProjectComponents = exports.invalidateProjectConfig = exports.getProjectConfig = exports.parseChoice = void 0;
 const pipeline_1 = require("../../../../packages/pipeline/src/index.js");
+const keyFiles_1 = require("../localAccess/keyFiles");
 const gitlab_1 = require("../utils/gitlab");
 const projects_1 = require("../utils/projects");
 var parseChoice_1 = require("./parseChoice");
@@ -122,12 +123,19 @@ const getEnvVarsResolved = async (io, env, componentName) => {
     const envionment = await (0, exports.getEnvironment)(env, componentName);
     // in the pipeline the secrets alreadyy exists  and bash will expand them
     // but here we need to manually load them
-    return resolveSecrets(io, [
+    const resolved = await resolveSecrets(io, [
         {
             envVars: envionment.envVars,
             secretEnvVarKeys: envionment.secretEnvVarKeys,
         },
     ]);
+    if (env !== "local")
+        return resolved;
+    // paths of the local access key files (written by catenv)
+    return {
+        ...resolved,
+        ...(await (0, keyFiles_1.getLocalAccessKeyFileVars)(await (0, exports.getProjectConfig)(), componentName)),
+    };
 };
 exports.getEnvVarsResolved = getEnvVarsResolved;
 /**

package/dist/apps/cli/src/config/getProjectConfig.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"getProjectConfig.js","sourceRoot":"","sources":["../../../../../src/config/getProjectConfig.ts"],"names":[],"mappings":";;;AAKA,kDAO6B;AAG7B,4CAA4D;AAE5D,gDAA+C;AAE/C,6CAA4C;AAAnC,0GAAA,WAAW,OAAA;AAEpB,IAAI,aAAa,GAAkB,IAAI,CAAC;AAExC,MAAM,UAAU,GAAG,KAAK,IAAI,EAAE;IAC5B,MAAM,OAAO,GAAG,MAAM,IAAA,qBAAU,GAAE,CAAC;IACnC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAA,qBAAU,EAAC,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;IACT,CAAC;IACD,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;AAChC,CAAC,CAAC;AAEK,MAAM,gBAAgB,GAAG,KAAK,IAAI,EAAE;IACzC,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,UAAU,EAAE,CAAC;IACrB,CAAC;IACD,OAAO,aAAuB,CAAC;AACjC,CAAC,CAAC;AALW,QAAA,gBAAgB,oBAK3B;AAEF;;;;GAIG;AACI,MAAM,uBAAuB,GAAG,GAAG,EAAE;IAC1C,aAAa,GAAG,IAAI,CAAC;AACvB,CAAC,CAAC;AAFW,QAAA,uBAAuB,2BAElC;AAEK,MAAM,oBAAoB,GAAG,KAAK,IAAI,EAAE;IAC7C,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAgB,GAAE,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AACxC,CAAC,CAAC;AAJW,QAAA,oBAAoB,wBAI/B;AAEK,MAAM,0BAA0B,GAAG,KAAK,EAC7C,GAAW,EACX,aAAqB,EACrB,EAAE;IACF,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAgB,GAAE,CAAC;IACxC,OAAO,MAAM,IAAA,iCAAsB,EAAC;QAClC,MAAM;QACN,aAAa;QACb,GAAG;KACJ,CAAC,CAAC;AACL,CAAC,CAAC;AAVW,QAAA,0BAA0B,8BAUrC;AACK,MAAM,+BAA+B,GAAG,KAAK,IAElD,EAAE;IACF,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAgB,GAAE,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,yCAAyC,CAAC,MAAM,CAAC,CAAC;AAC3D,CAAC,CAAC;AARW,QAAA,+BAA+B,mCAQ1C;AAEK,MAAM,uCAAuC,GAAG,KAAK,IAEzD,EAAE;IACH,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAgB,GAAE,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC;QACpD,aAAa;QACb,IAAA,qBAAU,EAAC,MAAM,EAAE,aAAa,CAAC;KAClC,CAAC,CACH,CAAC;AACJ,CAAC,CAAC;AAdW,QAAA,uCAAuC,2CAclD;AAEK,MAAM,sBAAsB,GAAG,KAAK,EACzC,aAAiC,EACjC,EAAE,YAAY,GAAG,KAAK,KAAiC,EAAE,EACzD,EAAE;IACF,MAAM,mBAAmB,GAAG,aAAa;QACvC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;YAC5B,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,CAAC,aAAa,CAAC;QACnB,CAAC,CAAC,IAAI,CAAC;IACT,OAAO,OAAO,CAAC,GAAG,CAChB,CAAC,MAAM,IAAA,uCAA+B,GAAE,CAAC;SACtC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC;SAChD,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,mBAAmB,IAAI,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CACxE;SACA,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,EAAE,CAC9B,IAAA,kCAA0B,EAAC,GAAG,EAAE,aAAa,CAAC,CAC/C,CACJ,CAAC;AACJ,CAAC,CAAC;AApBW,QAAA,sBAAsB,0BAoBjC;AAEK,MAAM,cAAc,GAAG,KAAK,EAAE,GAAW,EAAE,aAAqB,EAAE,EAAE;IACzE,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAgB,GAAE,CAAC;IAExC,OAAO,IAAA,yBAAe,EAAC,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;AACzD,CAAC,CAAC;AAJW,QAAA,cAAc,kBAIzB;AAEK,MAAM,YAAY,GAAG,KAAK,EAC/B,EAAM,EACN,GAAW,EACX,aAAqB,EACrB,YAAoB,EACpB,EAAE;IACF,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAgB,GAAE,CAAC;IACxC,4EAA4E;IAC5E,MAAM,UAAU,GAAG,IAAA,wBAAa,EAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,YAAY,EAAE,GAAG,CAAC,CAAC;IAC5D,MAAM,eAAe,GAAG,IAAA,2BAAgB,EACtC,UAAU,EACV,aAAa,EACb,YAAY,CACb,CAAC;IACF,OAAO,MAAM,IAAA,kCAAyB,EAAC,EAAE,EAAE,eAAe,CAAC,CAAC;AAC9D,CAAC,CAAC;AAfW,QAAA,YAAY,gBAevB;AAEF,MAAM,cAAc,GAAG,KAAK,EAC1B,EAAM,EACN,OAA6B,EACI,EAAE;IACnC,mEAAmE;IACnE,mEAAmE;IACnE,MAAM,eAAe,GAAG;QACtB,GAAG,IAAI,GAAG,CACR,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAC9B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAC5B,CAAC,KAAK,EAAE,EAAE,WAAC,OAAA,MAAA,GAAG,KAAK,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,mCAAI,EAAE,CAAA,EAAA,CAC/C,CACF,CACF;KACF,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAEzC,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,eAAe,EAAE,CAAC;IAChD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IACpE,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAE9C,OAAO,MAAM,CAAC,WAAW,CACvB,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAChD,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;SACpB,MAAM,CACL,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;;QACf,OAAA,KAAK,KAAK,SAAS;YACnB,KAAK,KAAK,IAAI;YACd,CAAC,CAAA,MAAA,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,0CAAE,MAAM,CAAA,CAAA;KAAA,CACvD;SACA,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QACrB,GAAG;QACH,aAAa,CAAC,MAAM,CAClB,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,EAAE,CAC3B,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,KAAK,GAAG,IAAI,EAAE,GAAG,CAAC,EAAE,WAAW,CAAC,EACzD,GAAG,KAAK,EAAE,CACX;KACF,CAAC,CACL,CACF,CAAC;AACJ,CAAC,CAAC;AAEK,MAAM,kBAAkB,GAAG,KAAK,EACrC,EAAM,EACN,GAAW,EACX,aAA4B,EAC5B,EAAE;IACF,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,IAAA,sBAAc,EAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAE5D,yEAAyE;IACzE,yCAAyC;IACzC,~~OAAO~~,cAAc,CAAC,EAAE,EAAE;~~QACxB~~;YACE,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;SAC9C;KACF,CAAC,CAAC;~~AACL~~,CAAC,CAAC;~~AAnBW~~,QAAA,kBAAkB,~~sBAmB7B~~;AAEF;;;GAGG;AACI,MAAM,yBAAyB,GAAG,KAAK,EAC5C,EAAM,EACN,GAAW,EACX,aAAqB,EACrB,EAAE;IACF,MAAM,UAAU,GAAG,MAAM,IAAA,sBAAc,EAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAC5D,OAAO,cAAc,CAAC,EAAE,EAAE;QACxB,UAAU,CAAC,WAAW,CAAC,KAAK;QAC5B,UAAU,CAAC,WAAW,CAAC,MAAM;KAC9B,CAAC,CAAC;AACL,CAAC,CAAC;AAVW,QAAA,yBAAyB,6BAUpC;AACF,SAAS,yCAAyC,CAChD,MAAc;IAEd,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,EAAE,CAC9D,IAAA,qBAAU,EAAC,MAAM,EAAE,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,CAAC,CACzE,CAAC;AACJ,CAAC"}
1	+ {"version":3,"file":"getProjectConfig.js","sourceRoot":"","sources":["../../../../../src/config/getProjectConfig.ts"],"names":[],"mappings":";;;AAKA,kDAO6B;AAG7B,sDAAoE;AACpE,4CAA4D;AAE5D,gDAA+C;AAE/C,6CAA4C;AAAnC,0GAAA,WAAW,OAAA;AAEpB,IAAI,aAAa,GAAkB,IAAI,CAAC;AAExC,MAAM,UAAU,GAAG,KAAK,IAAI,EAAE;IAC5B,MAAM,OAAO,GAAG,MAAM,IAAA,qBAAU,GAAE,CAAC;IACnC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAA,qBAAU,EAAC,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;IACT,CAAC;IACD,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;AAChC,CAAC,CAAC;AAEK,MAAM,gBAAgB,GAAG,KAAK,IAAI,EAAE;IACzC,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,UAAU,EAAE,CAAC;IACrB,CAAC;IACD,OAAO,aAAuB,CAAC;AACjC,CAAC,CAAC;AALW,QAAA,gBAAgB,oBAK3B;AAEF;;;;GAIG;AACI,MAAM,uBAAuB,GAAG,GAAG,EAAE;IAC1C,aAAa,GAAG,IAAI,CAAC;AACvB,CAAC,CAAC;AAFW,QAAA,uBAAuB,2BAElC;AAEK,MAAM,oBAAoB,GAAG,KAAK,IAAI,EAAE;IAC7C,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAgB,GAAE,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AACxC,CAAC,CAAC;AAJW,QAAA,oBAAoB,wBAI/B;AAEK,MAAM,0BAA0B,GAAG,KAAK,EAC7C,GAAW,EACX,aAAqB,EACrB,EAAE;IACF,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAgB,GAAE,CAAC;IACxC,OAAO,MAAM,IAAA,iCAAsB,EAAC;QAClC,MAAM;QACN,aAAa;QACb,GAAG;KACJ,CAAC,CAAC;AACL,CAAC,CAAC;AAVW,QAAA,0BAA0B,8BAUrC;AACK,MAAM,+BAA+B,GAAG,KAAK,IAElD,EAAE;IACF,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAgB,GAAE,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,yCAAyC,CAAC,MAAM,CAAC,CAAC;AAC3D,CAAC,CAAC;AARW,QAAA,+BAA+B,mCAQ1C;AAEK,MAAM,uCAAuC,GAAG,KAAK,IAEzD,EAAE;IACH,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAgB,GAAE,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC;QACpD,aAAa;QACb,IAAA,qBAAU,EAAC,MAAM,EAAE,aAAa,CAAC;KAClC,CAAC,CACH,CAAC;AACJ,CAAC,CAAC;AAdW,QAAA,uCAAuC,2CAclD;AAEK,MAAM,sBAAsB,GAAG,KAAK,EACzC,aAAiC,EACjC,EAAE,YAAY,GAAG,KAAK,KAAiC,EAAE,EACzD,EAAE;IACF,MAAM,mBAAmB,GAAG,aAAa;QACvC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;YAC5B,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,CAAC,aAAa,CAAC;QACnB,CAAC,CAAC,IAAI,CAAC;IACT,OAAO,OAAO,CAAC,GAAG,CAChB,CAAC,MAAM,IAAA,uCAA+B,GAAE,CAAC;SACtC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC;SAChD,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,mBAAmB,IAAI,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CACxE;SACA,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,EAAE,CAC9B,IAAA,kCAA0B,EAAC,GAAG,EAAE,aAAa,CAAC,CAC/C,CACJ,CAAC;AACJ,CAAC,CAAC;AApBW,QAAA,sBAAsB,0BAoBjC;AAEK,MAAM,cAAc,GAAG,KAAK,EAAE,GAAW,EAAE,aAAqB,EAAE,EAAE;IACzE,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAgB,GAAE,CAAC;IAExC,OAAO,IAAA,yBAAe,EAAC,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;AACzD,CAAC,CAAC;AAJW,QAAA,cAAc,kBAIzB;AAEK,MAAM,YAAY,GAAG,KAAK,EAC/B,EAAM,EACN,GAAW,EACX,aAAqB,EACrB,YAAoB,EACpB,EAAE;IACF,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAgB,GAAE,CAAC;IACxC,4EAA4E;IAC5E,MAAM,UAAU,GAAG,IAAA,wBAAa,EAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,YAAY,EAAE,GAAG,CAAC,CAAC;IAC5D,MAAM,eAAe,GAAG,IAAA,2BAAgB,EACtC,UAAU,EACV,aAAa,EACb,YAAY,CACb,CAAC;IACF,OAAO,MAAM,IAAA,kCAAyB,EAAC,EAAE,EAAE,eAAe,CAAC,CAAC;AAC9D,CAAC,CAAC;AAfW,QAAA,YAAY,gBAevB;AAEF,MAAM,cAAc,GAAG,KAAK,EAC1B,EAAM,EACN,OAA6B,EACI,EAAE;IACnC,mEAAmE;IACnE,mEAAmE;IACnE,MAAM,eAAe,GAAG;QACtB,GAAG,IAAI,GAAG,CACR,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAC9B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAC5B,CAAC,KAAK,EAAE,EAAE,WAAC,OAAA,MAAA,GAAG,KAAK,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,mCAAI,EAAE,CAAA,EAAA,CAC/C,CACF,CACF;KACF,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAEzC,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,eAAe,EAAE,CAAC;IAChD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IACpE,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAE9C,OAAO,MAAM,CAAC,WAAW,CACvB,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAChD,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;SACpB,MAAM,CACL,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;;QACf,OAAA,KAAK,KAAK,SAAS;YACnB,KAAK,KAAK,IAAI;YACd,CAAC,CAAA,MAAA,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,0CAAE,MAAM,CAAA,CAAA;KAAA,CACvD;SACA,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QACrB,GAAG;QACH,aAAa,CAAC,MAAM,CAClB,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,EAAE,CAC3B,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,KAAK,GAAG,IAAI,EAAE,GAAG,CAAC,EAAE,WAAW,CAAC,EACzD,GAAG,KAAK,EAAE,CACX;KACF,CAAC,CACL,CACF,CAAC;AACJ,CAAC,CAAC;AAEK,MAAM,kBAAkB,GAAG,KAAK,EACrC,EAAM,EACN,GAAW,EACX,aAA4B,EAC5B,EAAE;IACF,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,IAAA,sBAAc,EAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAE5D,yEAAyE;IACzE,yCAAyC;IACzC,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE;QACxC;YACE,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;SAC9C;KACF,CAAC,CAAC;IACH,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,QAAQ,CAAC;IACrC,0DAA0D;IAC1D,OAAO;QACL,GAAG,QAAQ;QACX,GAAG,CAAC,MAAM,IAAA,oCAAyB,EACjC,MAAM,IAAA,wBAAgB,GAAE,EACxB,aAAa,CACd,CAAC;KACH,CAAC;AACJ,CAAC,CAAC;AA5BW,QAAA,kBAAkB,sBA4B7B;AAEF;;;GAGG;AACI,MAAM,yBAAyB,GAAG,KAAK,EAC5C,EAAM,EACN,GAAW,EACX,aAAqB,EACrB,EAAE;IACF,MAAM,UAAU,GAAG,MAAM,IAAA,sBAAc,EAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAC5D,OAAO,cAAc,CAAC,EAAE,EAAE;QACxB,UAAU,CAAC,WAAW,CAAC,KAAK;QAC5B,UAAU,CAAC,WAAW,CAAC,MAAM;KAC9B,CAAC,CAAC;AACL,CAAC,CAAC;AAVW,QAAA,yBAAyB,6BAUpC;AACF,SAAS,yCAAyC,CAChD,MAAc;IAEd,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,EAAE,CAC9D,IAAA,qBAAU,EAAC,MAAM,EAAE,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,CAAC,CACzE,CAAC;AACJ,CAAC"}

package/dist/apps/cli/src/gcloud/localAccess.d.ts ADDED Viewed

@@ -0,0 +1,53 @@
+import type { ComponentContext } from "../../../../packages/pipeline/src/index.js";
+import type { IO } from "../core/types";
+/**
+ * the dedicated read-only service account of a component/env that
+ * `project setup` provisions from the `localAccess` declaration.
+ * Shared with `project doctor` and catenv.
+ */
+export declare const getLocalAccessServiceAccountNames: (context: ComponentContext, projectId: string) => {
+    fullName: string;
+    fullIdentifier: string;
+};
+type IamBinding = {
+    role: string;
+    members?: string[];
+    condition?: {
+        title?: string;
+        expression?: string;
+    };
+};
+/**
+ * all unconditional roles bound to `member` in the given iam policy
+ * bindings. Conditional bindings are reported separately, see
+ * {@link getConditionalRolesOfMemberInBindings}.
+ */
+export declare const getRolesOfMemberInBindings: (bindings: IamBinding[], member: string) => string[];
+/**
+ * roles bound to `member` under an iam condition. These cannot be
+ * removed by role name alone, so they are never touched by `project
+ * setup` — only reported.
+ */
+export declare const getConditionalRolesOfMemberInBindings: (bindings: IamBinding[], member: string) => string[];
+/**
+ * parses the output of `gcloud iam service-accounts keys create` and
+ * makes sure it is a usable service account key
+ */
+export declare const parseServiceAccountKey: (raw: string) => {
+    key: string;
+    privateKeyId: string;
+};
+export declare const listUserManagedKeyIds: (fullIdentifier: string) => Promise<string[]>;
+/**
+ * brings the local access service account of a component/env in line
+ * with the declared `roles`:
+ *
+ * - roles declared: account exists, carries exactly these bindings,
+ *   and a key for it is in the secret store (under the `local` env, so
+ *   it is never mirrored to ci). The key is only created when the
+ *   stored one is missing or no longer valid — re-running is a no-op.
+ * - no roles declared: bindings are removed and the account (with its
+ *   keys) deleted if it exists.
+ */
+export declare const syncLocalAccessServiceAccount: (io: IO, context: ComponentContext, projectId: string, roles: string[]) => Promise<void>;
+export {};