@catladder/cli 0.0.0-next-71c49b28 → 0.0.0-next-5dc1f907

package/dist/cli/src/apps/cli/commands/project/doctor/DoctorReport.d.ts

@@ -0,0 +1,22 @@
+import type { IO } from "../../../../../core/types";
+/**
+ * collects the results of all doctor checks: each check logs
+ * immediately (progressive output like `project setup`) and problems
+ * are repeated in the final summary together with the command that
+ * heals them. The report itself never mutates anything — doctor
+ * diagnoses, setup heals.
+ */
+export declare class DoctorReport {
+  private readonly io;
+  private passed;
+  private readonly warnings;
+  private readonly problems;
+  private currentSection;
+  constructor(io: IO);
+  section(title: string): void;
+  ok(message: string): void;
+  warn(message: string, remediation?: string): void;
+  fail(message: string, remediation?: string): void;
+  get hasProblems(): boolean;
+  summarize(): void;
+}

package/dist/cli/src/apps/cli/commands/project/doctor/DoctorReport.js

@@ -0,0 +1,75 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.DoctorReport = void 0;
+/**
+ * collects the results of all doctor checks: each check logs
+ * immediately (progressive output like `project setup`) and problems
+ * are repeated in the final summary together with the command that
+ * heals them. The report itself never mutates anything — doctor
+ * diagnoses, setup heals.
+ */
+class DoctorReport {
+  constructor(io) {
+    this.io = io;
+    this.passed = 0;
+    this.warnings = [];
+    this.problems = [];
+    this.currentSection = "";
+  }
+  section(title) {
+    this.currentSection = title;
+    this.io.log("");
+    this.io.log("🩺 " + title);
+  }
+  ok(message) {
+    this.passed++;
+    this.io.log("  ✅ " + message);
+  }
+  warn(message, remediation) {
+    this.warnings.push({
+      section: this.currentSection,
+      message,
+      remediation
+    });
+    this.io.log("  ⚠️ " + message);
+    if (remediation) this.io.log("     ↳ " + remediation);
+  }
+  fail(message, remediation) {
+    this.problems.push({
+      section: this.currentSection,
+      message,
+      remediation
+    });
+    this.io.log("  ❌ " + message);
+    if (remediation) this.io.log("     ↳ " + remediation);
+  }
+  get hasProblems() {
+    return this.problems.length > 0;
+  }
+  summarize() {
+    const {
+      io
+    } = this;
+    io.log("");
+    io.log("==================================================================================");
+    io.log(`🩺 doctor summary: ${this.passed} checks passed, ` + `${this.warnings.length} warnings, ${this.problems.length} problems`);
+    if (!this.hasProblems) {
+      io.log("");
+      io.log("everything looks healthy 😻");
+      return;
+    }
+    io.log("");
+    for (const {
+      section,
+      message,
+      remediation
+    } of this.problems) {
+      io.log(`❌ [${section}] ${message}`);
+      if (remediation) io.log(`   ↳ ${remediation}`);
+    }
+  }
+}
+exports.DoctorReport = DoctorReport;

package/dist/cli/src/apps/cli/commands/project/doctor/DoctorReport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DoctorReport.js","sourceRoot":"","sources":["../../../../../../../../src/apps/cli/commands/project/doctor/DoctorReport.ts"],"names":[],"mappings":";;;AAQA;;;;;;GAMG;AACH,MAAa,YAAY;IAMvB,YAA6B,EAAM;QAAN,OAAE,GAAF,EAAE,CAAI;QAL3B,WAAM,GAAG,CAAC,CAAC;QACF,aAAQ,GAAc,EAAE,CAAC;QACzB,aAAQ,GAAc,EAAE,CAAC;QAClC,mBAAc,GAAG,EAAE,CAAC;IAEU,CAAC;IAEvC,OAAO,CAAC,KAAa;QACnB,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC;QAC5B,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC;IAC7B,CAAC;IAED,EAAE,CAAC,OAAe;QAChB,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC;IAChC,CAAC;IAED,IAAI,CAAC,OAAe,EAAE,WAAoB;QACxC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC,CAAC;QAC/B,IAAI,WAAW;YAAE,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,GAAG,WAAW,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,CAAC,OAAe,EAAE,WAAoB;QACxC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC;QAC9B,IAAI,WAAW;YAAE,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,GAAG,WAAW,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAClC,CAAC;IAED,SAAS;QACP,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;QACpB,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACX,EAAE,CAAC,GAAG,CACJ,oFAAoF,CACrF,CAAC;QACF,EAAE,CAAC,GAAG,CACJ,sBAAsB,IAAI,CAAC,MAAM,kBAAkB;YACjD,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,cAAc,IAAI,CAAC,QAAQ,CAAC,MAAM,WAAW,CACvE,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACX,EAAE,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QACD,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACX,KAAK,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9D,EAAE,CAAC,GAAG,CAAC,MAAM,OAAO,KAAK,OAAO,EAAE,CAAC,CAAC;YACpC,IAAI,WAAW;gBAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,WAAW,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;CACF;AAxDD,oCAwDC"}

package/dist/cli/src/apps/cli/commands/project/doctor/GcloudProjectInspector.d.ts

@@ -0,0 +1,15 @@
+/**
+ * read-only gcloud queries for the doctor, cached per project: checking
+ * many component/env contexts of the same gcloud project costs one
+ * `get-iam-policy` / `services list` call, not one per context
+ */
+export declare class GcloudProjectInspector {
+  private readonly iamBindings;
+  private readonly enabledServices;
+  isAuthenticated(): Promise<boolean>;
+  private getIamBindings;
+  /** all roles bound to the given member (e.g. "serviceAccount:<email>") */
+  getRolesOfMember(projectId: string, member: string): Promise<string[]>;
+  getEnabledServices(projectId: string): Promise<Set<string>>;
+  hasArtifactsRegistry(projectId: string, region: string): Promise<boolean>;
+}

package/dist/cli/src/apps/cli/commands/project/doctor/GcloudProjectInspector.js

@@ -0,0 +1,59 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.GcloudProjectInspector = void 0;
+const child_process_promise_1 = require("child-process-promise");
+const artifactsRegistry_1 = require("../../../../../gcloud/artifactsRegistry");
+/**
+ * read-only gcloud queries for the doctor, cached per project: checking
+ * many component/env contexts of the same gcloud project costs one
+ * `get-iam-policy` / `services list` call, not one per context
+ */
+class GcloudProjectInspector {
+  constructor() {
+    this.iamBindings = new Map();
+    this.enabledServices = new Map();
+  }
+  async isAuthenticated() {
+    try {
+      await (0, child_process_promise_1.exec)("gcloud auth print-access-token");
+      return true;
+    } catch (_a) {
+      return false;
+    }
+  }
+  getIamBindings(projectId) {
+    if (!this.iamBindings.has(projectId)) {
+      this.iamBindings.set(projectId, (0, child_process_promise_1.exec)(`gcloud projects get-iam-policy ${projectId} --format=json`).then(result => {
+        var _a;
+        return (_a = JSON.parse(result.stdout).bindings) !== null && _a !== void 0 ? _a : [];
+      }));
+    }
+    return this.iamBindings.get(projectId);
+  }
+  /** all roles bound to the given member (e.g. "serviceAccount:<email>") */
+  async getRolesOfMember(projectId, member) {
+    const bindings = await this.getIamBindings(projectId);
+    return bindings.filter(binding => {
+      var _a;
+      return (_a = binding.members) === null || _a === void 0 ? void 0 : _a.includes(member);
+    }).map(binding => binding.role);
+  }
+  getEnabledServices(projectId) {
+    if (!this.enabledServices.has(projectId)) {
+      this.enabledServices.set(projectId, (0, child_process_promise_1.exec)(`gcloud services list --enabled --project=${projectId} --format="value(config.name)"`).then(result => new Set(result.stdout.split("\n").map(line => line.trim()).filter(Boolean))));
+    }
+    return this.enabledServices.get(projectId);
+  }
+  async hasArtifactsRegistry(projectId, region) {
+    try {
+      await (0, child_process_promise_1.exec)(`gcloud artifacts repositories describe ${artifactsRegistry_1.CATLADDER_REGISTRY_NAME} --project="${projectId}" --location=${region}`);
+      return true;
+    } catch (_a) {
+      return false;
+    }
+  }
+}
+exports.GcloudProjectInspector = GcloudProjectInspector;

package/dist/cli/src/apps/cli/commands/project/doctor/GcloudProjectInspector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GcloudProjectInspector.js","sourceRoot":"","sources":["../../../../../../../../src/apps/cli/commands/project/doctor/GcloudProjectInspector.ts"],"names":[],"mappings":";;;AAAA,iEAA6C;AAC7C,+EAAkF;AAIlF;;;;GAIG;AACH,MAAa,sBAAsB;IAAnC;QACmB,gBAAW,GAAG,IAAI,GAAG,EAAiC,CAAC;QACvD,oBAAe,GAAG,IAAI,GAAG,EAAgC,CAAC;IAgE7E,CAAC;IA9DC,KAAK,CAAC,eAAe;QACnB,IAAI,CAAC;YACH,MAAM,IAAA,4BAAI,EAAC,gCAAgC,CAAC,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,SAAiB;QACtC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,WAAW,CAAC,GAAG,CAClB,SAAS,EACT,IAAA,4BAAI,EAAC,kCAAkC,SAAS,gBAAgB,CAAC,CAAC,IAAI,CACpE,CAAC,MAAM,EAAE,EAAE,WAAC,OAAA,MAAA,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,mCAAI,EAAE,CAAA,EAAA,CACrD,CACF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC;IAC1C,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,gBAAgB,CAAC,SAAiB,EAAE,MAAc;QACtD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QACtD,OAAO,QAAQ;aACZ,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,WAAC,OAAA,MAAA,OAAO,CAAC,OAAO,0CAAE,QAAQ,CAAC,MAAM,CAAC,CAAA,EAAA,CAAC;aACtD,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,kBAAkB,CAAC,SAAiB;QAClC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACzC,IAAI,CAAC,eAAe,CAAC,GAAG,CACtB,SAAS,EACT,IAAA,4BAAI,EACF,4CAA4C,SAAS,gCAAgC,CACtF,CAAC,IAAI,CACJ,CAAC,MAAM,EAAE,EAAE,CACT,IAAI,GAAG,CACL,MAAM,CAAC,MAAM;iBACV,KAAK,CAAC,IAAI,CAAC;iBACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;iBAC1B,MAAM,CAAC,OAAO,CAAC,CACnB,CACJ,CACF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,SAAiB,EACjB,MAAc;QAEd,IAAI,CAAC;YACH,MAAM,IAAA,4BAAI,EACR,0CAA0C,2CAAuB,eAAe,SAAS,gBAAgB,MAAM,EAAE,CAClH,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;AAlED,wDAkEC"}

package/dist/cli/src/apps/cli/commands/project/doctor/checkCloudRun.d.ts

@@ -0,0 +1,13 @@
+import type { ComponentContext } from "../../../../../../../pipeline/src/index.js";
+import type { DoctorReport } from "./DoctorReport";
+/**
+ * compares the gcloud state `setupCloudRun` would provision for the
+ * CURRENT config against what is actually there: enabled services and
+ * artifacts registry per project, deploy service account existence and
+ * IAM roles per component/env.
+ *
+ * The motivating case (#70): a component gets `cloudSql` after its
+ * setup ran — deploys keep working and only the review teardown hits
+ * the missing `roles/cloudsql.admin` as a 403 in ci.
+ */
+export declare const checkCloudRun: (report: DoctorReport, contexts: ComponentContext[]) => Promise<void>;

package/dist/cli/src/apps/cli/commands/project/doctor/checkCloudRun.js

@@ -0,0 +1,120 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.checkCloudRun = void 0;
+const pipeline_1 = require("../../../../../../../pipeline/src/index.js");
+const artifactsRegistry_1 = require("../../../../../gcloud/artifactsRegistry");
+const serviceAccountNames_1 = require("../../../../../gcloud/serviceAccountNames");
+const serviceAccounts_1 = require("../../../../../gcloud/serviceAccounts");
+const concurrency_1 = require("../../../../../utils/concurrency");
+const setupCloudRun_1 = require("../setup/setupCloudRun");
+const GcloudProjectInspector_1 = require("./GcloudProjectInspector");
+const getCloudRunConfig = context => {
+  var _a;
+  const config = (_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config;
+  if (!(0, pipeline_1.isOfDeployType)(config, "google-cloudrun")) {
+    throw new Error("not a cloud run context");
+  }
+  return config;
+};
+/**
+ * compares the gcloud state `setupCloudRun` would provision for the
+ * CURRENT config against what is actually there: enabled services and
+ * artifacts registry per project, deploy service account existence and
+ * IAM roles per component/env.
+ *
+ * The motivating case (#70): a component gets `cloudSql` after its
+ * setup ran — deploys keep working and only the review teardown hits
+ * the missing `roles/cloudsql.admin` as a 403 in ci.
+ */
+const checkCloudRun = async (report, contexts) => {
+  var _a;
+  const cloudRunContexts = contexts.filter(context => {
+    var _a;
+    return (0, pipeline_1.isOfDeployType)((_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config, "google-cloudrun");
+  });
+  if (cloudRunContexts.length === 0) return;
+  report.section("google cloud run infrastructure");
+  const inspector = new GcloudProjectInspector_1.GcloudProjectInspector();
+  if (!(await inspector.isAuthenticated())) {
+    report.fail("gcloud is not authenticated — all google cloud checks skipped", "run: gcloud auth login");
+    return;
+  }
+  // project-level: enabled services + artifacts registry. The required
+  // services are the union over all components deploying to the project
+  // (cloudSql on any of them requires the sql services).
+  const byProject = new Map();
+  for (const context of cloudRunContexts) {
+    const {
+      projectId
+    } = getCloudRunConfig(context);
+    byProject.set(projectId, [...((_a = byProject.get(projectId)) !== null && _a !== void 0 ? _a : []), context]);
+  }
+  for (const [projectId, projectContexts] of byProject) {
+    const requiredServices = new Set(projectContexts.flatMap(context => (0, setupCloudRun_1.getCloudRunRequiredServices)(getCloudRunConfig(context))));
+    try {
+      const enabled = await inspector.getEnabledServices(projectId);
+      const missing = [...requiredServices].filter(service => !enabled.has(service));
+      if (missing.length === 0) {
+        report.ok(`${projectId}: all ${requiredServices.size} required services enabled`);
+      } else {
+        report.fail(`${projectId}: services not enabled: ${missing.join(", ")}`, "run: catladder project setup");
+      }
+    } catch (e) {
+      report.warn(`${projectId}: could not list enabled services (${e.message})`);
+    }
+    const regions = new Set(projectContexts.map(context => getCloudRunConfig(context).region));
+    for (const region of regions) {
+      if (await inspector.hasArtifactsRegistry(projectId, region)) {
+        report.ok(`${projectId}: artifacts registry '${artifactsRegistry_1.CATLADDER_REGISTRY_NAME}' exists in ${region}`);
+      } else {
+        report.fail(`${projectId}: artifacts registry '${artifactsRegistry_1.CATLADDER_REGISTRY_NAME}' missing in ${region}`, "run: catladder project setup");
+      }
+    }
+  }
+  // per component/env: deploy service account exists and carries every
+  // role the current config implies
+  const results = await (0, concurrency_1.mapWithConcurrency)(cloudRunContexts, 5, async context => {
+    const config = getCloudRunConfig(context);
+    const {
+      fullIdentifier
+    } = (0, serviceAccountNames_1.getGcloudServiceAccountNames)(context, {
+      name: setupCloudRun_1.CLOUD_RUN_DEPLOY_SA_NAME,
+      projectId: config.projectId
+    });
+    if (!(await (0, serviceAccounts_1.accountExists)(fullIdentifier))) {
+      return {
+        context,
+        fullIdentifier,
+        exists: false,
+        missingRoles: []
+      };
+    }
+    const boundRoles = await inspector.getRolesOfMember(config.projectId, `serviceAccount:${fullIdentifier}`);
+    const missingRoles = (0, setupCloudRun_1.getCloudRunDeployRoles)(config).filter(role => !boundRoles.includes(role));
+    return {
+      context,
+      fullIdentifier,
+      exists: true,
+      missingRoles
+    };
+  });
+  for (const {
+    context,
+    fullIdentifier,
+    exists,
+    missingRoles
+  } of results) {
+    const label = `${context.env}:${context.name}`;
+    if (!exists) {
+      report.fail(`${label}: deploy service account ${fullIdentifier} does not exist`, `run: catladder project setup ${context.name}`);
+    } else if (missingRoles.length > 0) {
+      report.fail(`${label}: service account is missing roles: ${missingRoles.join(", ")}`, `run: catladder project setup ${context.name}`);
+    } else {
+      report.ok(`${label}: service account exists with all config-implied roles`);
+    }
+  }
+};
+exports.checkCloudRun = checkCloudRun;

package/dist/cli/src/apps/cli/commands/project/doctor/checkCloudRun.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkCloudRun.js","sourceRoot":"","sources":["../../../../../../../../src/apps/cli/commands/project/doctor/checkCloudRun.ts"],"names":[],"mappings":";;;AACA,kDAAqD;AACrD,+EAAkF;AAClF,mFAAyF;AACzF,2EAAsE;AACtE,kEAAsE;AACtE,0DAIgC;AAEhC,qEAAkE;AAElE,MAAM,iBAAiB,GAAG,CAAC,OAAyB,EAAE,EAAE;;IACtD,MAAM,MAAM,GAAG,MAAA,OAAO,CAAC,MAAM,0CAAE,MAAM,CAAC;IACtC,IAAI,CAAC,IAAA,yBAAc,EAAC,MAAM,EAAE,iBAAiB,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACI,MAAM,aAAa,GAAG,KAAK,EAChC,MAAoB,EACpB,QAA4B,EAC5B,EAAE;;IACF,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,WACnD,OAAA,IAAA,yBAAc,EAAC,MAAA,OAAO,CAAC,MAAM,0CAAE,MAAM,EAAE,iBAAiB,CAAC,CAAA,EAAA,CAC1D,CAAC;IACF,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAE1C,MAAM,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,IAAI,+CAAsB,EAAE,CAAC;IAC/C,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,eAAe,EAAE,CAAC,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CACT,+DAA+D,EAC/D,wBAAwB,CACzB,CAAC;QACF,OAAO;IACT,CAAC;IAED,qEAAqE;IACrE,sEAAsE;IACtE,uDAAuD;IACvD,MAAM,SAAS,GAAG,IAAI,GAAG,EAA8B,CAAC;IACxD,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,MAAM,EAAE,SAAS,EAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACjD,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,MAAA,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,mCAAI,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC,IAAI,SAAS,EAAE,CAAC;QACrD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAC9B,eAAe,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAClC,IAAA,2CAA2B,EAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CACxD,CACF,CAAC;QACF,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAG,CAAC,GAAG,gBAAgB,CAAC,CAAC,MAAM,CAC1C,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CACnC,CAAC;YACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,CAAC,EAAE,CACP,GAAG,SAAS,SAAS,gBAAgB,CAAC,IAAI,4BAA4B,CACvE,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CACT,GAAG,SAAS,2BAA2B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC3D,8BAA8B,CAC/B,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CACT,GAAG,SAAS,sCAAsC,CAAC,CAAC,OAAO,GAAG,CAC/D,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,eAAe,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CACpE,CAAC;QACF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,MAAM,SAAS,CAAC,oBAAoB,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;gBAC5D,MAAM,CAAC,EAAE,CACP,GAAG,SAAS,yBAAyB,2CAAuB,eAAe,MAAM,EAAE,CACpF,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CACT,GAAG,SAAS,yBAAyB,2CAAuB,gBAAgB,MAAM,EAAE,EACpF,8BAA8B,CAC/B,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,kCAAkC;IAClC,MAAM,OAAO,GAAG,MAAM,IAAA,gCAAkB,EACtC,gBAAgB,EAChB,CAAC,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,EAAE,cAAc,EAAE,GAAG,IAAA,kDAA4B,EAAC,OAAO,EAAE;YAC/D,IAAI,EAAE,wCAAwB;YAC9B,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,MAAM,IAAA,+BAAa,EAAC,cAAc,CAAC,CAAC,EAAE,CAAC;YAC3C,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;QACtE,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,gBAAgB,CACjD,MAAM,CAAC,SAAS,EAChB,kBAAkB,cAAc,EAAE,CACnC,CAAC;QACF,MAAM,YAAY,GAAG,IAAA,sCAAsB,EAAC,MAAM,CAAC,CAAC,MAAM,CACxD,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CACrC,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IACjE,CAAC,CACF,CAAC;IAEF,KAAK,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,OAAO,EAAE,CAAC;QACxE,MAAM,KAAK,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CACT,GAAG,KAAK,4BAA4B,cAAc,iBAAiB,EACnE,gCAAgC,OAAO,CAAC,IAAI,EAAE,CAC/C,CAAC;QACJ,CAAC;aAAM,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CACT,GAAG,KAAK,uCAAuC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACxE,gCAAgC,OAAO,CAAC,IAAI,EAAE,CAC/C,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,EAAE,CACP,GAAG,KAAK,wDAAwD,CACjE,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAnHW,QAAA,aAAa,iBAmHxB"}

package/dist/cli/src/apps/cli/commands/project/doctor/checkGithub.d.ts

@@ -0,0 +1,10 @@
+import type { Config } from "../../../../../../../pipeline/src/index.js";
+import type { DoctorReport } from "./DoctorReport";
+/**
+ * compares the secret/variable NAMES the generated github workflows
+ * reference against what is actually set — per github environment, the
+ * same mapping `project secrets-sync-github` writes. Values cannot be
+ * compared: github secrets are write-only by design (the vault stays
+ * the source of truth).
+ */
+export declare const checkGithub: (report: DoctorReport, config: Config) => Promise<void>;

package/dist/cli/src/apps/cli/commands/project/doctor/checkGithub.js

@@ -0,0 +1,100 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.checkGithub = void 0;
+const pipeline_1 = require("../../../../../../../pipeline/src/index.js");
+const commandSecretsSyncGithub_1 = require("../../../../../commands/project/commandSecretsSyncGithub");
+const concurrency_1 = require("../../../../../utils/concurrency");
+const github_1 = require("../../../../../utils/github");
+/** marker for repo-level (environment-less) targets, see collectSecretTargets */
+const REPO_LEVEL = "";
+/**
+ * compares the secret/variable NAMES the generated github workflows
+ * reference against what is actually set — per github environment, the
+ * same mapping `project secrets-sync-github` writes. Values cannot be
+ * compared: github secrets are write-only by design (the vault stays
+ * the source of truth).
+ */
+const checkGithub = async (report, config) => {
+  if (!(0, pipeline_1.getEnabledPipelineTypes)(config).includes("github")) return;
+  report.section("github environments & secrets");
+  if (!(await (0, github_1.isGhAuthenticated)())) {
+    report.warn("github cli (gh) not authenticated — github checks skipped", "run: gh auth login");
+    return;
+  }
+  const repo = await (0, commandSecretsSyncGithub_1.getConfiguredGithubRepo)();
+  if (!repo) {
+    report.fail(`no github repository found on the '${(0, pipeline_1.getPipelineGitRemote)(config, "github")}' remote`);
+    return;
+  }
+  let targets;
+  try {
+    targets = await (0, commandSecretsSyncGithub_1.collectSecretTargets)(config);
+  } catch (e) {
+    report.warn(`could not generate the github workflows to derive secret references (${e.message})`);
+    return;
+  }
+  const referencedNamesOf = environment => [...targets.entries()].filter(([, envs]) => envs.has(environment)).map(([name]) => name);
+  const environmentsNeeded = [...new Set([...targets.values()].flatMap(envs => [...envs]))].filter(environment => environment !== REPO_LEVEL).sort();
+  let existingEnvironments;
+  try {
+    existingEnvironments = new Set(await (0, github_1.listGithubEnvironments)(repo));
+  } catch (e) {
+    report.warn(`could not list environments of ${repo} (${e.message})`);
+    return;
+  }
+  const perEnvironment = await (0, concurrency_1.mapWithConcurrency)(environmentsNeeded, 8, async environment => {
+    const referenced = referencedNamesOf(environment);
+    if (!existingEnvironments.has(environment)) {
+      return {
+        environment,
+        referenced,
+        exists: false
+      };
+    }
+    const [secrets, variables] = await Promise.all([(0, github_1.listGithubSecretNames)(repo, environment), (0, github_1.listGithubVariableNames)(repo, environment)]);
+    // github secret names are case-insensitive and the api returns
+    // them uppercased — compare accordingly
+    const present = new Set([...secrets, ...variables].map(name => name.toUpperCase()));
+    const referencedUpper = new Set(referenced.map(name => name.toUpperCase()));
+    return {
+      environment,
+      referenced,
+      exists: true,
+      missing: referenced.filter(name => !present.has(name.toUpperCase())),
+      stale: [...present].filter(name => !referencedUpper.has(name))
+    };
+  });
+  for (const result of perEnvironment) {
+    const {
+      environment,
+      referenced
+    } = result;
+    if (!result.exists) {
+      report.fail(`environment '${environment}' does not exist (${referenced.length} referenced secrets have nowhere to live)`, "run: catladder project secrets-sync-github");
+      continue;
+    }
+    if (result.missing.length > 0) {
+      report.fail(`${environment}: missing ${result.missing.length}/${referenced.length} referenced secrets: ${result.missing.join(", ")}`, "run: catladder project secrets-sync-github");
+    } else {
+      report.ok(`${environment}: all ${referenced.length} referenced secrets/variables present`);
+    }
+    if (result.stale.length > 0) {
+      report.warn(`${environment}: ${result.stale.length} set but not referenced by any workflow (stale?): ${result.stale.join(", ")}`);
+    }
+  }
+  const repoLevelReferenced = referencedNamesOf(REPO_LEVEL);
+  if (repoLevelReferenced.length > 0) {
+    const [secrets, variables] = await Promise.all([(0, github_1.listGithubSecretNames)(repo), (0, github_1.listGithubVariableNames)(repo)]);
+    const present = new Set([...secrets, ...variables].map(name => name.toUpperCase()));
+    const missing = repoLevelReferenced.filter(name => !present.has(name.toUpperCase()));
+    if (missing.length > 0) {
+      report.fail(`repo level: missing ${missing.length}/${repoLevelReferenced.length} referenced secrets: ${missing.join(", ")}`, "run: catladder project secrets-sync-github");
+    } else {
+      report.ok(`repo level: all ${repoLevelReferenced.length} referenced secrets/variables present`);
+    }
+  }
+};
+exports.checkGithub = checkGithub;

package/dist/cli/src/apps/cli/commands/project/doctor/checkGithub.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkGithub.js","sourceRoot":"","sources":["../../../../../../../../src/apps/cli/commands/project/doctor/checkGithub.ts"],"names":[],"mappings":";;;AACA,kDAG6B;AAC7B,uGAGkE;AAClE,kEAAsE;AACtE,wDAKqC;AAGrC,iFAAiF;AACjF,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB;;;;;;GAMG;AACI,MAAM,WAAW,GAAG,KAAK,EAAE,MAAoB,EAAE,MAAc,EAAE,EAAE;IACxE,IAAI,CAAC,IAAA,kCAAuB,EAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO;IAChE,MAAM,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC;IAEhD,IAAI,CAAC,CAAC,MAAM,IAAA,0BAAiB,GAAE,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CACT,2DAA2D,EAC3D,oBAAoB,CACrB,CAAC;QACF,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,IAAA,kDAAuB,GAAE,CAAC;IAC7C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,CAAC,IAAI,CACT,sCAAsC,IAAA,+BAAoB,EAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,CACvF,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,OAAiC,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,IAAA,+CAAoB,EAAC,MAAM,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CACT,wEAAwE,CAAC,CAAC,OAAO,GAAG,CACrF,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,iBAAiB,GAAG,CAAC,WAAmB,EAAE,EAAE,CAChD,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;SACnB,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;SAC3C,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IAE3B,MAAM,kBAAkB,GAAG;QACzB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;KAC/D;SACE,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,KAAK,UAAU,CAAC;SACnD,IAAI,EAAE,CAAC;IAEV,IAAI,oBAAiC,CAAC;IACtC,IAAI,CAAC;QACH,oBAAoB,GAAG,IAAI,GAAG,CAAC,MAAM,IAAA,+BAAsB,EAAC,IAAI,CAAC,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,kCAAkC,IAAI,KAAK,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;QACrE,OAAO;IACT,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,IAAA,gCAAkB,EAC7C,kBAAkB,EAClB,CAAC,EACD,KAAK,EAAE,WAAW,EAAE,EAAE;QACpB,MAAM,UAAU,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3C,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,KAAc,EAAE,CAAC;QAC7D,CAAC;QACD,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC7C,IAAA,8BAAqB,EAAC,IAAI,EAAE,WAAW,CAAC;YACxC,IAAA,gCAAuB,EAAC,IAAI,EAAE,WAAW,CAAC;SAC3C,CAAC,CAAC;QACH,+DAA+D;QAC/D,wCAAwC;QACxC,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,CAAC,GAAG,OAAO,EAAE,GAAG,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAC7D,CAAC;QACF,MAAM,eAAe,GAAG,IAAI,GAAG,CAC7B,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAC7C,CAAC;QACF,OAAO;YACL,WAAW;YACX,UAAU;YACV,MAAM,EAAE,IAAa;YACrB,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YACtE,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;SACjE,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;QACpC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CACT,gBAAgB,WAAW,qBAAqB,UAAU,CAAC,MAAM,2CAA2C,EAC5G,4CAA4C,CAC7C,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CACT,GAAG,WAAW,aAAa,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,wBAAwB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACxH,4CAA4C,CAC7C,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,EAAE,CACP,GAAG,WAAW,SAAS,UAAU,CAAC,MAAM,uCAAuC,CAChF,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CACT,GAAG,WAAW,KAAK,MAAM,CAAC,KAAK,CAAC,MAAM,qDAAqD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACrH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,mBAAmB,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC1D,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC7C,IAAA,8BAAqB,EAAC,IAAI,CAAC;YAC3B,IAAA,gCAAuB,EAAC,IAAI,CAAC;SAC9B,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,CAAC,GAAG,OAAO,EAAE,GAAG,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAC7D,CAAC;QACF,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CACxC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAC3C,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CACT,uBAAuB,OAAO,CAAC,MAAM,IAAI,mBAAmB,CAAC,MAAM,wBAAwB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC/G,4CAA4C,CAC7C,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,EAAE,CACP,mBAAmB,mBAAmB,CAAC,MAAM,uCAAuC,CACrF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AA/HW,QAAA,WAAW,eA+HtB"}

package/dist/cli/src/apps/cli/commands/project/doctor/checkGitlab.d.ts

@@ -0,0 +1,13 @@
+import type { ComponentContext } from "../../../../../../../pipeline/src/index.js";
+import type { IO } from "../../../../../core/types";
+import type { DoctorReport } from "./DoctorReport";
+/**
+ * the gitlab-side outputs of `project setup`: the semantic-release
+ * access token (+ its GL_TOKEN ci variable), the catladder topic and —
+ * for kubernetes deploys — the registry deploy token.
+ *
+ * Kubernetes namespace/rbac checks are deliberately skipped: they would
+ * require connecting kubectl to every cluster, which switches the local
+ * kubeconfig context — doctor must not change anything.
+ */
+export declare const checkGitlab: (instance: IO, report: DoctorReport, contexts: ComponentContext[]) => Promise<void>;

package/dist/cli/src/apps/cli/commands/project/doctor/checkGitlab.js

@@ -0,0 +1,79 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.checkGitlab = void 0;
+const pipeline_1 = require("../../../../../../../pipeline/src/index.js");
+const date_fns_1 = require("date-fns");
+const gitlab_1 = require("../../../../../utils/gitlab");
+const EXPIRY_WARNING_DAYS = 30;
+/**
+ * the gitlab-side outputs of `project setup`: the semantic-release
+ * access token (+ its GL_TOKEN ci variable), the catladder topic and —
+ * for kubernetes deploys — the registry deploy token.
+ *
+ * Kubernetes namespace/rbac checks are deliberately skipped: they would
+ * require connecting kubectl to every cluster, which switches the local
+ * kubeconfig context — doctor must not change anything.
+ */
+const checkGitlab = async (instance, report, contexts) => {
+  report.section("gitlab project setup");
+  let projectId;
+  try {
+    projectId = (await (0, gitlab_1.getProjectInfo)(instance)).id;
+  } catch (e) {
+    report.warn(`could not reach the gitlab api — gitlab checks skipped (${e.message})`);
+    return;
+  }
+  try {
+    const tokens = await (0, gitlab_1.doGitlabRequestAllPages)(instance, `projects/${projectId}/access_tokens`);
+    const activeTokens = tokens.filter(t => t.name === "semantic-release" && t.active === true);
+    // the GL_TOKEN ci variable holds exactly one of them — judge by the
+    // one that lives longest
+    const token = activeTokens.sort((a, b) => String(b.expires_at).localeCompare(String(a.expires_at)))[0];
+    if (activeTokens.length > 1) {
+      report.warn(`${activeTokens.length} active 'semantic-release' tokens exist — duplicates from earlier setups, consider revoking the old ones`);
+    }
+    if (!token) {
+      report.fail("no active 'semantic-release' project access token", "run: catladder project setup");
+    } else {
+      const daysLeft = (0, date_fns_1.differenceInCalendarDays)(new Date(token.expires_at), new Date());
+      if (daysLeft < 0) {
+        report.fail(`'semantic-release' token expired on ${token.expires_at}`, "run: catladder project setup (rotates the token)");
+      } else if (daysLeft <= EXPIRY_WARNING_DAYS) {
+        report.warn(`'semantic-release' token expires in ${daysLeft} days (${token.expires_at})`, "run: catladder project setup (rotates the token)");
+      } else {
+        report.ok(`'semantic-release' token active (expires ${token.expires_at})`);
+      }
+    }
+    try {
+      await (0, gitlab_1.doGitlabRequest)(instance, `projects/${projectId}/variables/GL_TOKEN`);
+      report.ok("GL_TOKEN ci variable present");
+    } catch (_a) {
+      report.fail("GL_TOKEN ci variable missing", "run: catladder project setup");
+    }
+    const {
+      topics
+    } = await (0, gitlab_1.doGitlabRequest)(instance, `projects/${projectId}`);
+    if (topics === null || topics === void 0 ? void 0 : topics.includes("catladder")) {
+      report.ok("'catladder' project topic set");
+    } else {
+      report.fail("'catladder' project topic missing", "run: catladder project setup");
+    }
+    if (contexts.some(context => {
+      var _a;
+      return (0, pipeline_1.isOfDeployType)((_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config, "kubernetes");
+    })) {
+      const deployTokens = await (0, gitlab_1.doGitlabRequestAllPages)(instance, `projects/${projectId}/deploy_tokens`);
+      if (deployTokens.find(t => t.name === "gitlab-deploy-token")) {
+        report.ok("'gitlab-deploy-token' registry deploy token present");
+      } else {
+        report.fail("'gitlab-deploy-token' registry deploy token missing (kubernetes cannot pull images)", "run: catladder project setup");
+      }
+    }
+  } catch (e) {
+    report.warn(`gitlab checks aborted (${e.message})`);
+  }
+};
+exports.checkGitlab = checkGitlab;

package/dist/cli/src/apps/cli/commands/project/doctor/checkGitlab.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkGitlab.js","sourceRoot":"","sources":["../../../../../../../../src/apps/cli/commands/project/doctor/checkGitlab.ts"],"names":[],"mappings":";;;AACA,kDAAqD;AACrD,uCAAoD;AAEpD,wDAIqC;AAGrC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B;;;;;;;;GAQG;AACI,MAAM,WAAW,GAAG,KAAK,EAC9B,QAAY,EACZ,MAAoB,EACpB,QAA4B,EAC5B,EAAE;IACF,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAEvC,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,CAAC,MAAM,IAAA,uBAAc,EAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAClD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CACT,2DAA2D,CAAC,CAAC,OAAO,GAAG,CACxE,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAA,gCAAuB,EAC1C,QAAQ,EACR,YAAY,SAAS,gBAAgB,CACtC,CAAC;QACF,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAChC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,CAC1D,CAAC;QACF,oEAAoE;QACpE,yBAAyB;QACzB,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACvC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CACzD,CAAC,CAAC,CAAC,CAAC;QACL,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CACT,GAAG,YAAY,CAAC,MAAM,0GAA0G,CACjI,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CACT,mDAAmD,EACnD,8BAA8B,CAC/B,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,GAAG,IAAA,mCAAwB,EACvC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAC1B,IAAI,IAAI,EAAE,CACX,CAAC;YACF,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,CACT,uCAAuC,KAAK,CAAC,UAAU,EAAE,EACzD,kDAAkD,CACnD,CAAC;YACJ,CAAC;iBAAM,IAAI,QAAQ,IAAI,mBAAmB,EAAE,CAAC;gBAC3C,MAAM,CAAC,IAAI,CACT,uCAAuC,QAAQ,UAAU,KAAK,CAAC,UAAU,GAAG,EAC5E,kDAAkD,CACnD,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,EAAE,CACP,4CAA4C,KAAK,CAAC,UAAU,GAAG,CAChE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAA,wBAAe,EACnB,QAAQ,EACR,YAAY,SAAS,qBAAqB,CAC3C,CAAC;YACF,MAAM,CAAC,EAAE,CAAC,8BAA8B,CAAC,CAAC;QAC5C,CAAC;QAAC,WAAM,CAAC;YACP,MAAM,CAAC,IAAI,CACT,8BAA8B,EAC9B,8BAA8B,CAC/B,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,wBAAe,EAAC,QAAQ,EAAE,YAAY,SAAS,EAAE,CAAC,CAAC;QAC5E,IAAI,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,EAAE,CAAC,+BAA+B,CAAC,CAAC;QAC7C,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CACT,mCAAmC,EACnC,8BAA8B,CAC/B,CAAC;QACJ,CAAC;QAED,IACE,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,WACxB,OAAA,IAAA,yBAAc,EAAC,MAAA,OAAO,CAAC,MAAM,0CAAE,MAAM,EAAE,YAAY,CAAC,CAAA,EAAA,CACrD,EACD,CAAC;YACD,MAAM,YAAY,GAAG,MAAM,IAAA,gCAAuB,EAChD,QAAQ,EACR,YAAY,SAAS,gBAAgB,CACtC,CAAC;YACF,IACE,YAAY,CAAC,IAAI,CACf,CAAC,CAAmB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,qBAAqB,CAC1D,EACD,CAAC;gBACD,MAAM,CAAC,EAAE,CAAC,qDAAqD,CAAC,CAAC;YACnE,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CACT,qFAAqF,EACrF,8BAA8B,CAC/B,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;IACtD,CAAC;AACH,CAAC,CAAC;AA9GW,QAAA,WAAW,eA8GtB"}

package/dist/cli/src/apps/cli/commands/project/doctor/checkStore.d.ts

@@ -0,0 +1,8 @@
+import type { DoctorReport } from "./DoctorReport";
+/**
+ * every google-cloudrun project in the config needs its project number
+ * in the committed store — the deterministic cloud run urls
+ * (<service>-<projectNumber>.<region>.run.app) are computed from it at
+ * generation time. This check is fully offline.
+ */
+export declare const checkStore: (report: DoctorReport) => Promise<void>;

package/dist/cli/src/apps/cli/commands/project/doctor/checkStore.js

@@ -0,0 +1,44 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.checkStore = void 0;
+const pipeline_1 = require("../../../../../../../pipeline/src/index.js");
+const getProjectConfig_1 = require("../../../../../config/getProjectConfig");
+const projects_1 = require("../../../../../utils/projects");
+/**
+ * every google-cloudrun project in the config needs its project number
+ * in the committed store — the deterministic cloud run urls
+ * (<service>-<projectNumber>.<region>.run.app) are computed from it at
+ * generation time. This check is fully offline.
+ */
+const checkStore = async report => {
+  var _a, _b, _c;
+  const config = await (0, getProjectConfig_1.getProjectConfig)();
+  const projectIds = new Set();
+  for (const {
+    componentName,
+    env
+  } of await (0, getProjectConfig_1.getAllComponentsWithAllEnvsFlat)()) {
+    const {
+      deploy
+    } = (0, pipeline_1.getEnvConfig)(config, componentName, env);
+    if (deploy && deploy.type === "google-cloudrun") {
+      projectIds.add(deploy.projectId);
+    }
+  }
+  if (projectIds.size === 0) return;
+  report.section("catladder store (.catladder-store/store.yml)");
+  const root = (_a = await (0, projects_1.getGitRoot)()) !== null && _a !== void 0 ? _a : process.cwd();
+  const store = (0, pipeline_1.readCatladderStore)(root);
+  for (const projectId of projectIds) {
+    const projectNumber = (_c = (_b = store.gcloudProjects) === null || _b === void 0 ? void 0 : _b[projectId]) === null || _c === void 0 ? void 0 : _c.projectNumber;
+    if (projectNumber) {
+      report.ok(`project number for ${projectId}: ${projectNumber}`);
+    } else {
+      report.fail(`missing project number for ${projectId}`, "run: catladder project setup");
+    }
+  }
+};
+exports.checkStore = checkStore;

package/dist/cli/src/apps/cli/commands/project/doctor/checkStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkStore.js","sourceRoot":"","sources":["../../../../../../../../src/apps/cli/commands/project/doctor/checkStore.ts"],"names":[],"mappings":";;;AAAA,kDAAuE;AACvE,6EAGgD;AAChD,4DAA2D;AAG3D;;;;;GAKG;AACI,MAAM,UAAU,GAAG,KAAK,EAAE,MAAoB,EAAE,EAAE;;IACvD,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAgB,GAAE,CAAC;IACxC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,EACT,aAAa,EACb,GAAG,GACJ,IAAI,MAAM,IAAA,kDAA+B,GAAE,EAAE,CAAC;QAC7C,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,uBAAY,EAAC,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;QAC5D,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAChD,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO;IAElC,MAAM,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,MAAA,CAAC,MAAM,IAAA,qBAAU,GAAE,CAAC,mCAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACnD,MAAM,KAAK,GAAG,IAAA,6BAAkB,EAAC,IAAI,CAAC,CAAC;IACvC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,aAAa,GAAG,MAAA,MAAA,KAAK,CAAC,cAAc,0CAAG,SAAS,CAAC,0CAAE,aAAa,CAAC;QACvE,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,CAAC,EAAE,CAAC,sBAAsB,SAAS,KAAK,aAAa,EAAE,CAAC,CAAC;QACjE,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CACT,8BAA8B,SAAS,EAAE,EACzC,8BAA8B,CAC/B,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AA5BW,QAAA,UAAU,cA4BrB"}

package/dist/cli/src/apps/cli/commands/project/doctor/index.d.ts

@@ -0,0 +1,14 @@
+import type { IO } from "../../../../../core/types";
+/**
+ * read-only health check: compares the state `project setup` (and
+ * `project secrets-sync-github`) would provision for the CURRENT config
+ * against what is actually there, and reports drift together with the
+ * command that heals it. `project setup` is a point-in-time
+ * provisioner, so config edits that change required infrastructure
+ * (IAM roles, services, secrets) drift silently until something breaks
+ * in ci — the doctor surfaces that before it does.
+ *
+ * The component filter only narrows the per-component checks; the
+ * cheap project-global checks (store, gitlab, github) always run.
+ */
+export declare const doctorProject: (instance: IO, onlyComponents?: string | string[]) => Promise<void>;