@catladder/cli 0.0.0-next-88a07ab6 → 0.0.0-next-51dc9c2b

package/dist/bundles/cli/index.js

@@ -587,6 +587,580 @@ exports.projectConfigSecrets = projectConfigSecrets;
 
 /***/ }),
 
+/***/ 88089:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.DoctorReport = void 0;
+/**
+ * collects the results of all doctor checks: each check logs
+ * immediately (progressive output like `project setup`) and problems
+ * are repeated in the final summary together with the command that
+ * heals them. The report itself never mutates anything — doctor
+ * diagnoses, setup heals.
+ */
+class DoctorReport {
+  constructor(io) {
+    this.io = io;
+    this.passed = 0;
+    this.warnings = [];
+    this.problems = [];
+    this.currentSection = "";
+  }
+  section(title) {
+    this.currentSection = title;
+    this.io.log("");
+    this.io.log("🩺 " + title);
+  }
+  ok(message) {
+    this.passed++;
+    this.io.log("  ✅ " + message);
+  }
+  warn(message, remediation) {
+    this.warnings.push({
+      section: this.currentSection,
+      message,
+      remediation
+    });
+    this.io.log("  ⚠️ " + message);
+    if (remediation) this.io.log("     ↳ " + remediation);
+  }
+  fail(message, remediation) {
+    this.problems.push({
+      section: this.currentSection,
+      message,
+      remediation
+    });
+    this.io.log("  ❌ " + message);
+    if (remediation) this.io.log("     ↳ " + remediation);
+  }
+  get hasProblems() {
+    return this.problems.length > 0;
+  }
+  summarize() {
+    const {
+      io
+    } = this;
+    io.log("");
+    io.log("==================================================================================");
+    io.log(`🩺 doctor summary: ${this.passed} checks passed, ` + `${this.warnings.length} warnings, ${this.problems.length} problems`);
+    if (!this.hasProblems) {
+      io.log("");
+      io.log("everything looks healthy 😻");
+      return;
+    }
+    io.log("");
+    for (const {
+      section,
+      message,
+      remediation
+    } of this.problems) {
+      io.log(`❌ [${section}] ${message}`);
+      if (remediation) io.log(`   ↳ ${remediation}`);
+    }
+  }
+}
+exports.DoctorReport = DoctorReport;
+
+/***/ }),
+
+/***/ 44952:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.GcloudProjectInspector = void 0;
+const child_process_promise_1 = __nccwpck_require__(51748);
+const artifactsRegistry_1 = __nccwpck_require__(41624);
+/**
+ * read-only gcloud queries for the doctor, cached per project: checking
+ * many component/env contexts of the same gcloud project costs one
+ * `get-iam-policy` / `services list` call, not one per context
+ */
+class GcloudProjectInspector {
+  constructor() {
+    this.iamBindings = new Map();
+    this.enabledServices = new Map();
+  }
+  async isAuthenticated() {
+    try {
+      await (0, child_process_promise_1.exec)("gcloud auth print-access-token");
+      return true;
+    } catch (_a) {
+      return false;
+    }
+  }
+  getIamBindings(projectId) {
+    if (!this.iamBindings.has(projectId)) {
+      this.iamBindings.set(projectId, (0, child_process_promise_1.exec)(`gcloud projects get-iam-policy ${projectId} --format=json`).then(result => {
+        var _a;
+        return (_a = JSON.parse(result.stdout).bindings) !== null && _a !== void 0 ? _a : [];
+      }));
+    }
+    return this.iamBindings.get(projectId);
+  }
+  /** all roles bound to the given member (e.g. "serviceAccount:<email>") */
+  async getRolesOfMember(projectId, member) {
+    const bindings = await this.getIamBindings(projectId);
+    return bindings.filter(binding => {
+      var _a;
+      return (_a = binding.members) === null || _a === void 0 ? void 0 : _a.includes(member);
+    }).map(binding => binding.role);
+  }
+  getEnabledServices(projectId) {
+    if (!this.enabledServices.has(projectId)) {
+      this.enabledServices.set(projectId, (0, child_process_promise_1.exec)(`gcloud services list --enabled --project=${projectId} --format="value(config.name)"`).then(result => new Set(result.stdout.split("\n").map(line => line.trim()).filter(Boolean))));
+    }
+    return this.enabledServices.get(projectId);
+  }
+  async hasArtifactsRegistry(projectId, region) {
+    try {
+      await (0, child_process_promise_1.exec)(`gcloud artifacts repositories describe ${artifactsRegistry_1.CATLADDER_REGISTRY_NAME} --project="${projectId}" --location=${region}`);
+      return true;
+    } catch (_a) {
+      return false;
+    }
+  }
+}
+exports.GcloudProjectInspector = GcloudProjectInspector;
+
+/***/ }),
+
+/***/ 65424:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.checkCloudRun = void 0;
+const pipeline_1 = __nccwpck_require__(60241);
+const artifactsRegistry_1 = __nccwpck_require__(41624);
+const serviceAccountNames_1 = __nccwpck_require__(83798);
+const serviceAccounts_1 = __nccwpck_require__(35611);
+const concurrency_1 = __nccwpck_require__(5092);
+const setupCloudRun_1 = __nccwpck_require__(51629);
+const GcloudProjectInspector_1 = __nccwpck_require__(44952);
+const getCloudRunConfig = context => {
+  var _a;
+  const config = (_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config;
+  if (!(0, pipeline_1.isOfDeployType)(config, "google-cloudrun")) {
+    throw new Error("not a cloud run context");
+  }
+  return config;
+};
+/**
+ * compares the gcloud state `setupCloudRun` would provision for the
+ * CURRENT config against what is actually there: enabled services and
+ * artifacts registry per project, deploy service account existence and
+ * IAM roles per component/env.
+ *
+ * The motivating case (#70): a component gets `cloudSql` after its
+ * setup ran — deploys keep working and only the review teardown hits
+ * the missing `roles/cloudsql.admin` as a 403 in ci.
+ */
+const checkCloudRun = async (report, contexts) => {
+  var _a;
+  const cloudRunContexts = contexts.filter(context => {
+    var _a;
+    return (0, pipeline_1.isOfDeployType)((_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config, "google-cloudrun");
+  });
+  if (cloudRunContexts.length === 0) return;
+  report.section("google cloud run infrastructure");
+  const inspector = new GcloudProjectInspector_1.GcloudProjectInspector();
+  if (!(await inspector.isAuthenticated())) {
+    report.fail("gcloud is not authenticated — all google cloud checks skipped", "run: gcloud auth login");
+    return;
+  }
+  // project-level: enabled services + artifacts registry. The required
+  // services are the union over all components deploying to the project
+  // (cloudSql on any of them requires the sql services).
+  const byProject = new Map();
+  for (const context of cloudRunContexts) {
+    const {
+      projectId
+    } = getCloudRunConfig(context);
+    byProject.set(projectId, [...((_a = byProject.get(projectId)) !== null && _a !== void 0 ? _a : []), context]);
+  }
+  for (const [projectId, projectContexts] of byProject) {
+    const requiredServices = new Set(projectContexts.flatMap(context => (0, setupCloudRun_1.getCloudRunRequiredServices)(getCloudRunConfig(context))));
+    try {
+      const enabled = await inspector.getEnabledServices(projectId);
+      const missing = [...requiredServices].filter(service => !enabled.has(service));
+      if (missing.length === 0) {
+        report.ok(`${projectId}: all ${requiredServices.size} required services enabled`);
+      } else {
+        report.fail(`${projectId}: services not enabled: ${missing.join(", ")}`, "run: catladder project setup");
+      }
+    } catch (e) {
+      report.warn(`${projectId}: could not list enabled services (${e.message})`);
+    }
+    const regions = new Set(projectContexts.map(context => getCloudRunConfig(context).region));
+    for (const region of regions) {
+      if (await inspector.hasArtifactsRegistry(projectId, region)) {
+        report.ok(`${projectId}: artifacts registry '${artifactsRegistry_1.CATLADDER_REGISTRY_NAME}' exists in ${region}`);
+      } else {
+        report.fail(`${projectId}: artifacts registry '${artifactsRegistry_1.CATLADDER_REGISTRY_NAME}' missing in ${region}`, "run: catladder project setup");
+      }
+    }
+  }
+  // per component/env: deploy service account exists and carries every
+  // role the current config implies
+  const results = await (0, concurrency_1.mapWithConcurrency)(cloudRunContexts, 5, async context => {
+    const config = getCloudRunConfig(context);
+    const {
+      fullIdentifier
+    } = (0, serviceAccountNames_1.getGcloudServiceAccountNames)(context, {
+      name: setupCloudRun_1.CLOUD_RUN_DEPLOY_SA_NAME,
+      projectId: config.projectId
+    });
+    if (!(await (0, serviceAccounts_1.accountExists)(fullIdentifier))) {
+      return {
+        context,
+        fullIdentifier,
+        exists: false,
+        missingRoles: []
+      };
+    }
+    const boundRoles = await inspector.getRolesOfMember(config.projectId, `serviceAccount:${fullIdentifier}`);
+    const missingRoles = (0, setupCloudRun_1.getCloudRunDeployRoles)(config).filter(role => !boundRoles.includes(role));
+    return {
+      context,
+      fullIdentifier,
+      exists: true,
+      missingRoles
+    };
+  });
+  for (const {
+    context,
+    fullIdentifier,
+    exists,
+    missingRoles
+  } of results) {
+    const label = `${context.env}:${context.name}`;
+    if (!exists) {
+      report.fail(`${label}: deploy service account ${fullIdentifier} does not exist`, `run: catladder project setup ${context.name}`);
+    } else if (missingRoles.length > 0) {
+      report.fail(`${label}: service account is missing roles: ${missingRoles.join(", ")}`, `run: catladder project setup ${context.name}`);
+    } else {
+      report.ok(`${label}: service account exists with all config-implied roles`);
+    }
+  }
+};
+exports.checkCloudRun = checkCloudRun;
+
+/***/ }),
+
+/***/ 93265:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.checkGithub = void 0;
+const pipeline_1 = __nccwpck_require__(60241);
+const commandSecretsSyncGithub_1 = __nccwpck_require__(50962);
+const concurrency_1 = __nccwpck_require__(5092);
+const github_1 = __nccwpck_require__(18036);
+/** marker for repo-level (environment-less) targets, see collectSecretTargets */
+const REPO_LEVEL = "";
+/**
+ * compares the secret/variable NAMES the generated github workflows
+ * reference against what is actually set — per github environment, the
+ * same mapping `project secrets-sync-github` writes. Values cannot be
+ * compared: github secrets are write-only by design (the vault stays
+ * the source of truth).
+ */
+const checkGithub = async (report, config) => {
+  if (!(0, pipeline_1.getEnabledPipelineTypes)(config).includes("github")) return;
+  report.section("github environments & secrets");
+  if (!(await (0, github_1.isGhAuthenticated)())) {
+    report.warn("github cli (gh) not authenticated — github checks skipped", "run: gh auth login");
+    return;
+  }
+  const repo = await (0, commandSecretsSyncGithub_1.getConfiguredGithubRepo)();
+  if (!repo) {
+    report.fail(`no github repository found on the '${(0, pipeline_1.getPipelineGitRemote)(config, "github")}' remote`);
+    return;
+  }
+  let targets;
+  try {
+    targets = await (0, commandSecretsSyncGithub_1.collectSecretTargets)(config);
+  } catch (e) {
+    report.warn(`could not generate the github workflows to derive secret references (${e.message})`);
+    return;
+  }
+  const referencedNamesOf = environment => [...targets.entries()].filter(([, envs]) => envs.has(environment)).map(([name]) => name);
+  const environmentsNeeded = [...new Set([...targets.values()].flatMap(envs => [...envs]))].filter(environment => environment !== REPO_LEVEL).sort();
+  let existingEnvironments;
+  try {
+    existingEnvironments = new Set(await (0, github_1.listGithubEnvironments)(repo));
+  } catch (e) {
+    report.warn(`could not list environments of ${repo} (${e.message})`);
+    return;
+  }
+  const perEnvironment = await (0, concurrency_1.mapWithConcurrency)(environmentsNeeded, 8, async environment => {
+    const referenced = referencedNamesOf(environment);
+    if (!existingEnvironments.has(environment)) {
+      return {
+        environment,
+        referenced,
+        exists: false
+      };
+    }
+    const [secrets, variables] = await Promise.all([(0, github_1.listGithubSecretNames)(repo, environment), (0, github_1.listGithubVariableNames)(repo, environment)]);
+    // github secret names are case-insensitive and the api returns
+    // them uppercased — compare accordingly
+    const present = new Set([...secrets, ...variables].map(name => name.toUpperCase()));
+    const referencedUpper = new Set(referenced.map(name => name.toUpperCase()));
+    return {
+      environment,
+      referenced,
+      exists: true,
+      missing: referenced.filter(name => !present.has(name.toUpperCase())),
+      stale: [...present].filter(name => !referencedUpper.has(name))
+    };
+  });
+  for (const result of perEnvironment) {
+    const {
+      environment,
+      referenced
+    } = result;
+    if (!result.exists) {
+      report.fail(`environment '${environment}' does not exist (${referenced.length} referenced secrets have nowhere to live)`, "run: catladder project secrets-sync-github");
+      continue;
+    }
+    if (result.missing.length > 0) {
+      report.fail(`${environment}: missing ${result.missing.length}/${referenced.length} referenced secrets: ${result.missing.join(", ")}`, "run: catladder project secrets-sync-github");
+    } else {
+      report.ok(`${environment}: all ${referenced.length} referenced secrets/variables present`);
+    }
+    if (result.stale.length > 0) {
+      report.warn(`${environment}: ${result.stale.length} set but not referenced by any workflow (stale?): ${result.stale.join(", ")}`);
+    }
+  }
+  const repoLevelReferenced = referencedNamesOf(REPO_LEVEL);
+  if (repoLevelReferenced.length > 0) {
+    const [secrets, variables] = await Promise.all([(0, github_1.listGithubSecretNames)(repo), (0, github_1.listGithubVariableNames)(repo)]);
+    const present = new Set([...secrets, ...variables].map(name => name.toUpperCase()));
+    const missing = repoLevelReferenced.filter(name => !present.has(name.toUpperCase()));
+    if (missing.length > 0) {
+      report.fail(`repo level: missing ${missing.length}/${repoLevelReferenced.length} referenced secrets: ${missing.join(", ")}`, "run: catladder project secrets-sync-github");
+    } else {
+      report.ok(`repo level: all ${repoLevelReferenced.length} referenced secrets/variables present`);
+    }
+  }
+};
+exports.checkGithub = checkGithub;
+
+/***/ }),
+
+/***/ 47273:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.checkGitlab = void 0;
+const pipeline_1 = __nccwpck_require__(60241);
+const date_fns_1 = __nccwpck_require__(84022);
+const gitlab_1 = __nccwpck_require__(4508);
+const EXPIRY_WARNING_DAYS = 30;
+/**
+ * the gitlab-side outputs of `project setup`: the semantic-release
+ * access token (+ its GL_TOKEN ci variable), the catladder topic and —
+ * for kubernetes deploys — the registry deploy token.
+ *
+ * Kubernetes namespace/rbac checks are deliberately skipped: they would
+ * require connecting kubectl to every cluster, which switches the local
+ * kubeconfig context — doctor must not change anything.
+ */
+const checkGitlab = async (instance, report, contexts) => {
+  report.section("gitlab project setup");
+  let projectId;
+  try {
+    projectId = (await (0, gitlab_1.getProjectInfo)(instance)).id;
+  } catch (e) {
+    report.warn(`could not reach the gitlab api — gitlab checks skipped (${e.message})`);
+    return;
+  }
+  try {
+    const tokens = await (0, gitlab_1.doGitlabRequestAllPages)(instance, `projects/${projectId}/access_tokens`);
+    const activeTokens = tokens.filter(t => t.name === "semantic-release" && t.active === true);
+    // the GL_TOKEN ci variable holds exactly one of them — judge by the
+    // one that lives longest
+    const token = activeTokens.sort((a, b) => String(b.expires_at).localeCompare(String(a.expires_at)))[0];
+    if (activeTokens.length > 1) {
+      report.warn(`${activeTokens.length} active 'semantic-release' tokens exist — duplicates from earlier setups, consider revoking the old ones`);
+    }
+    if (!token) {
+      report.fail("no active 'semantic-release' project access token", "run: catladder project setup");
+    } else {
+      const daysLeft = (0, date_fns_1.differenceInCalendarDays)(new Date(token.expires_at), new Date());
+      if (daysLeft < 0) {
+        report.fail(`'semantic-release' token expired on ${token.expires_at}`, "run: catladder project setup (rotates the token)");
+      } else if (daysLeft <= EXPIRY_WARNING_DAYS) {
+        report.warn(`'semantic-release' token expires in ${daysLeft} days (${token.expires_at})`, "run: catladder project setup (rotates the token)");
+      } else {
+        report.ok(`'semantic-release' token active (expires ${token.expires_at})`);
+      }
+    }
+    try {
+      await (0, gitlab_1.doGitlabRequest)(instance, `projects/${projectId}/variables/GL_TOKEN`);
+      report.ok("GL_TOKEN ci variable present");
+    } catch (_a) {
+      report.fail("GL_TOKEN ci variable missing", "run: catladder project setup");
+    }
+    const {
+      topics
+    } = await (0, gitlab_1.doGitlabRequest)(instance, `projects/${projectId}`);
+    if (topics === null || topics === void 0 ? void 0 : topics.includes("catladder")) {
+      report.ok("'catladder' project topic set");
+    } else {
+      report.fail("'catladder' project topic missing", "run: catladder project setup");
+    }
+    if (contexts.some(context => {
+      var _a;
+      return (0, pipeline_1.isOfDeployType)((_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config, "kubernetes");
+    })) {
+      const deployTokens = await (0, gitlab_1.doGitlabRequestAllPages)(instance, `projects/${projectId}/deploy_tokens`);
+      if (deployTokens.find(t => t.name === "gitlab-deploy-token")) {
+        report.ok("'gitlab-deploy-token' registry deploy token present");
+      } else {
+        report.fail("'gitlab-deploy-token' registry deploy token missing (kubernetes cannot pull images)", "run: catladder project setup");
+      }
+    }
+  } catch (e) {
+    report.warn(`gitlab checks aborted (${e.message})`);
+  }
+};
+exports.checkGitlab = checkGitlab;
+
+/***/ }),
+
+/***/ 21141:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.checkStore = void 0;
+const pipeline_1 = __nccwpck_require__(60241);
+const getProjectConfig_1 = __nccwpck_require__(50001);
+const projects_1 = __nccwpck_require__(57414);
+/**
+ * every google-cloudrun project in the config needs its project number
+ * in the committed store — the deterministic cloud run urls
+ * (<service>-<projectNumber>.<region>.run.app) are computed from it at
+ * generation time. This check is fully offline.
+ */
+const checkStore = async report => {
+  var _a, _b, _c;
+  const config = await (0, getProjectConfig_1.getProjectConfig)();
+  const projectIds = new Set();
+  for (const {
+    componentName,
+    env
+  } of await (0, getProjectConfig_1.getAllComponentsWithAllEnvsFlat)()) {
+    const {
+      deploy
+    } = (0, pipeline_1.getEnvConfig)(config, componentName, env);
+    if (deploy && deploy.type === "google-cloudrun") {
+      projectIds.add(deploy.projectId);
+    }
+  }
+  if (projectIds.size === 0) return;
+  report.section("catladder store (.catladder-store/store.yml)");
+  const root = (_a = await (0, projects_1.getGitRoot)()) !== null && _a !== void 0 ? _a : process.cwd();
+  const store = (0, pipeline_1.readCatladderStore)(root);
+  for (const projectId of projectIds) {
+    const projectNumber = (_c = (_b = store.gcloudProjects) === null || _b === void 0 ? void 0 : _b[projectId]) === null || _c === void 0 ? void 0 : _c.projectNumber;
+    if (projectNumber) {
+      report.ok(`project number for ${projectId}: ${projectNumber}`);
+    } else {
+      report.fail(`missing project number for ${projectId}`, "run: catladder project setup");
+    }
+  }
+};
+exports.checkStore = checkStore;
+
+/***/ }),
+
+/***/ 96270:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.doctorProject = void 0;
+const pipeline_1 = __nccwpck_require__(60241);
+const getProjectConfig_1 = __nccwpck_require__(50001);
+const checkCloudRun_1 = __nccwpck_require__(65424);
+const checkGithub_1 = __nccwpck_require__(93265);
+const checkGitlab_1 = __nccwpck_require__(47273);
+const checkStore_1 = __nccwpck_require__(21141);
+const DoctorReport_1 = __nccwpck_require__(88089);
+/**
+ * read-only health check: compares the state `project setup` (and
+ * `project secrets-sync-github`) would provision for the CURRENT config
+ * against what is actually there, and reports drift together with the
+ * command that heals it. `project setup` is a point-in-time
+ * provisioner, so config edits that change required infrastructure
+ * (IAM roles, services, secrets) drift silently until something breaks
+ * in ci — the doctor surfaces that before it does.
+ *
+ * The component filter only narrows the per-component checks; the
+ * cheap project-global checks (store, gitlab, github) always run.
+ */
+const doctorProject = async (instance, onlyComponents) => {
+  const config = await (0, getProjectConfig_1.getProjectConfig)();
+  if (!config) {
+    throw new Error("no catladder config found");
+  }
+  instance.log("🐱 🩺 checking project health — read-only, nothing will be changed");
+  const report = new DoctorReport_1.DoctorReport(instance);
+  await (0, checkStore_1.checkStore)(report);
+  let contexts = [];
+  try {
+    contexts = await (0, getProjectConfig_1.getAllPipelineContexts)(onlyComponents);
+  } catch (e) {
+    report.section("pipeline contexts");
+    report.fail(`could not create pipeline contexts: ${e.message}`, "run: catladder project setup");
+  }
+  if ((0, pipeline_1.getEnabledPipelineTypes)(config).includes("gitlab")) {
+    await (0, checkGitlab_1.checkGitlab)(instance, report, contexts);
+  }
+  await (0, checkCloudRun_1.checkCloudRun)(report, contexts);
+  await (0, checkGithub_1.checkGithub)(report, config);
+  report.summarize();
+};
+exports.doctorProject = doctorProject;
+
+/***/ }),
+
 /***/ 22661:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
@@ -746,7 +1320,10 @@ const setupAccessTokens = async instance => {
   const {
     id: projectId
   } = await (0, gitlab_1.getProjectInfo)(instance);
-  const projectTokens = await (0, gitlab_1.doGitlabRequest)(instance, `projects/${projectId}/access_tokens`);
+  // all pages: rotated tokens accumulate one (inactive) entry per
+  // rotation, so the active one quickly moves past the first page —
+  // missing it here created a brand-new duplicate token on every setup
+  const projectTokens = await (0, gitlab_1.doGitlabRequestAllPages)(instance, `projects/${projectId}/access_tokens`);
   const token = projectTokens.find(t => t.name === TOKEN_NAME && t.active === true);
   const expires_at = (0, date_fns_1.format)((0, date_fns_1.add)(new Date(), {
     years: 1,
@@ -963,13 +1540,40 @@ exports.setupAgents = setupAgents;
 Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
-exports.setupCloudRun = void 0;
+exports.setupCloudRun = exports.getCloudRunDeployRoles = exports.getCloudRunRequiredServices = exports.CLOUD_RUN_DEPLOY_SA_NAME = void 0;
 const pipeline_1 = __nccwpck_require__(60241);
 const artifactsRegistry_1 = __nccwpck_require__(41624);
 const enableServices_1 = __nccwpck_require__(96761);
 const getProjectNumber_1 = __nccwpck_require__(68666);
 const serviceAccounts_1 = __nccwpck_require__(35611);
 const updateCatladderStore_1 = __nccwpck_require__(66487);
+exports.CLOUD_RUN_DEPLOY_SA_NAME = "cl-d";
+/**
+ * the gcloud services the given deploy config requires.
+ *
+ * Shared with `project doctor`: setup enables them, doctor compares
+ * them against what is actually enabled — config edits after setup
+ * (e.g. adding `cloudSql`) would otherwise drift silently.
+ */
+const getCloudRunRequiredServices = config => ["run.googleapis.com", "artifactregistry.googleapis.com", "cloudscheduler.googleapis.com",
+// for scheduling jobs
+"cloudresourcemanager.googleapis.com",
+// only required to get google cloud project number
+...(config.cloudSql ? ["sqladmin.googleapis.com", "sql-component.googleapis.com"] : [])];
+exports.getCloudRunRequiredServices = getCloudRunRequiredServices;
+/**
+ * the IAM roles the deploy service account needs for the given deploy
+ * config. Shared with `project doctor` (same rationale as
+ * {@link getCloudRunRequiredServices}) — the motivating case: a
+ * component gets `cloudSql` after its setup ran, deploys keep working,
+ * and only the review teardown hits the missing `cloudsql.admin`.
+ */
+const getCloudRunDeployRoles = config => [
+// TODO: run.admin is a bit much, would be better to follow https://stackoverflow.com/questions/55788714/deploying-to-cloud-run-with-a-custom-service-account-failed-with-iam-serviceacco
+"roles/artifactregistry.repoAdmin", "roles/run.admin", "roles/iam.serviceAccountUser", "roles/cloudscheduler.admin",
+// for scheduling
+...(config.cloudSql ? ["roles/cloudsql.admin"] : [])];
+exports.getCloudRunDeployRoles = getCloudRunDeployRoles;
 const setupCloudRun = async (instance, context) => {
   var _a, _b;
   if (!(0, pipeline_1.isOfDeployType)((_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config, "google-cloudrun")) {
@@ -978,11 +1582,7 @@ const setupCloudRun = async (instance, context) => {
   const config = (_b = context.deploy) === null || _b === void 0 ? void 0 : _b.config;
   // enable services
   instance.log("enable required services...");
-  await (0, enableServices_1.enableGCloudServices)(["run.googleapis.com", "artifactregistry.googleapis.com", "cloudscheduler.googleapis.com",
-  // for scheduling jobs
-  "cloudresourcemanager.googleapis.com",
-  // only required to get google cloud project number
-  ...(config.cloudSql ? ["sqladmin.googleapis.com", "sql-component.googleapis.com"] : [])], config);
+  await (0, enableServices_1.enableGCloudServices)((0, exports.getCloudRunRequiredServices)(config), config);
   instance.log("upsert artifacts registry...");
   await (0, artifactsRegistry_1.upsertGcloudArtifactsRegistry)(config);
   instance.log("upsert deploy service account...");
@@ -990,11 +1590,8 @@ const setupCloudRun = async (instance, context) => {
     projectId: config.projectId,
     displayName: "Catladder gcloud deploy",
     description: "This service account deploys to google cloud",
-    name: "cl-d",
-    // TODO: run.admin is a bit much, would be better to follow https://stackoverflow.com/questions/55788714/deploying-to-cloud-run-with-a-custom-service-account-failed-with-iam-serviceacco
-    roles: ["roles/artifactregistry.repoAdmin", "roles/run.admin", "roles/iam.serviceAccountUser", "roles/cloudscheduler.admin",
-    // for scheduling
-    ...(config.cloudSql ? ["roles/cloudsql.admin"] : [])]
+    name: exports.CLOUD_RUN_DEPLOY_SA_NAME,
+    roles: (0, exports.getCloudRunDeployRoles)(config)
   }, pipeline_1.GCLOUD_DEPLOY_CREDENTIALS_KEY);
   // the project number is needed at generation time to construct cloud
   // run's deterministic urls (<service>-<projectNumber>.<region>.run.app)
@@ -2064,7 +2661,7 @@ exports.commandKubeStopPortforward = (0, defineCommand_1.defineCommand)({
 Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
-exports.commandStarwars = exports.commandDadjoke = exports.commandSecurityAuditCreate = exports.commandSecurityAuditEvaluate = exports.commandSecurityAuditCiJob = exports.commandRestoreDb = exports.commandMongoDestroyMember = exports.commandMongoPortForward = exports.commandMongoGetShell = exports.commandTriggerCronjobProject = exports.commandDeleteProject = exports.commandPauseProject = exports.commandDeletePods = exports.commandGetShell = exports.commandListPods = exports.commandNamespace = exports.commandSecurityEvaluate = exports.commandProjectRestoreDb = exports.commandCiJobLog = exports.commandCiJobOpen = exports.commandSetup = exports.commandGetMyTotalWorktime = exports.commandRenewToken = exports.commandTriggerCronjobGeneral = exports.commandOpenLogs = exports.commandSecretsSyncGithub = exports.commandSecretsClearBackups = exports.commandConfigSecrets = exports.commandCloudSqlProxy = exports.commandOpenGit = exports.commandOpenEnv = exports.commandPortForward = exports.commandEnvVars = exports.commandKubePortForward = exports.commandKubeGetShell = exports.commandKubeStopPortforward = exports.commandKubeListPods = exports.commandKubeListSecrets = exports.commandKubeListNamespaces = exports.commandKubeCurrentContext = void 0;
+exports.commandStarwars = exports.commandDadjoke = exports.commandSecurityAuditCreate = exports.commandSecurityAuditEvaluate = exports.commandSecurityAuditCiJob = exports.commandRestoreDb = exports.commandMongoDestroyMember = exports.commandMongoPortForward = exports.commandMongoGetShell = exports.commandTriggerCronjobProject = exports.commandDeleteProject = exports.commandPauseProject = exports.commandDeletePods = exports.commandGetShell = exports.commandListPods = exports.commandNamespace = exports.commandSecurityEvaluate = exports.commandProjectRestoreDb = exports.commandCiJobLog = exports.commandCiJobOpen = exports.commandDoctor = exports.commandSetup = exports.commandGetMyTotalWorktime = exports.commandRenewToken = exports.commandTriggerCronjobGeneral = exports.commandOpenLogs = exports.commandSecretsSyncGithub = exports.commandSecretsClearBackups = exports.commandConfigSecrets = exports.commandCloudSqlProxy = exports.commandOpenGit = exports.commandOpenEnv = exports.commandPortForward = exports.commandEnvVars = exports.commandKubePortForward = exports.commandKubeGetShell = exports.commandKubeStopPortforward = exports.commandKubeListPods = exports.commandKubeListSecrets = exports.commandKubeListNamespaces = exports.commandKubeCurrentContext = void 0;
 // General commands
 var commandKubeCurrentContext_1 = __nccwpck_require__(70243);
 Object.defineProperty(exports, "commandKubeCurrentContext", ({
@@ -2207,6 +2804,13 @@ Object.defineProperty(exports, "commandSetup", ({
     return commandSetup_1.commandSetup;
   }
 }));
+var commandDoctor_1 = __nccwpck_require__(80248);
+Object.defineProperty(exports, "commandDoctor", ({
+  enumerable: true,
+  get: function () {
+    return commandDoctor_1.commandDoctor;
+  }
+}));
 var commandGitlabCi_1 = __nccwpck_require__(57076);
 Object.defineProperty(exports, "commandCiJobOpen", ({
   enumerable: true,
@@ -2750,6 +3354,38 @@ exports.commandConfigSecrets = (0, defineCommand_1.defineCommand)({
 
 /***/ }),
 
+/***/ 80248:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.commandDoctor = void 0;
+const doctor_1 = __nccwpck_require__(96270);
+const defineCommand_1 = __nccwpck_require__(39489);
+exports.commandDoctor = (0, defineCommand_1.defineCommand)({
+  name: "project doctor",
+  description: "Checks for drift between the config and the provisioned infrastructure (read-only): service accounts, IAM roles, gitlab tokens, github secrets, store entries.",
+  group: "project",
+  inputs: {
+    component: {
+      type: "string",
+      message: "component name",
+      positional: true,
+      required: false
+    }
+  },
+  execute: async ctx => {
+    const component = await ctx.get("component");
+    await (0, doctor_1.doctorProject)(ctx, component);
+  }
+});
+
+/***/ }),
+
 /***/ 47838:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
@@ -4743,11 +5379,12 @@ exports.MissingInputError = MissingInputError;
 Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
-exports.upsertGcloudArtifactsRegistry = void 0;
+exports.upsertGcloudArtifactsRegistry = exports.CATLADDER_REGISTRY_NAME = void 0;
 const child_process_promise_1 = __nccwpck_require__(51748);
+exports.CATLADDER_REGISTRY_NAME = "catladder-deploy";
 const upsertGcloudArtifactsRegistry = async config => {
   try {
-    await (0, child_process_promise_1.exec)(`gcloud artifacts repositories create catladder-deploy --project="${config.projectId}" --repository-format=docker --location=${config.region}`);
+    await (0, child_process_promise_1.exec)(`gcloud artifacts repositories create ${exports.CATLADDER_REGISTRY_NAME} --project="${config.projectId}" --repository-format=docker --location=${config.region}`);
   } catch (e) {
     // probably already exists
     //
@@ -5006,7 +5643,7 @@ exports.openGoogleCloudDashboard = openGoogleCloudDashboard;
 
 /***/ }),
 
-/***/ 35611:
+/***/ 83798:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
@@ -5015,26 +5652,21 @@ exports.openGoogleCloudDashboard = openGoogleCloudDashboard;
 Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
-exports.upsertGcloudServiceAccountAndSaveSecret = exports.accountExists = void 0;
-const child_process_promise_1 = __nccwpck_require__(51748);
+exports.getGcloudServiceAccountNames = void 0;
 const crypto_1 = __nccwpck_require__(76982);
-const gitlab_1 = __nccwpck_require__(4508);
-const accountExists = async fullIdentifier => {
-  try {
-    await (0, child_process_promise_1.exec)(`gcloud iam service-accounts describe ${fullIdentifier}`);
-    return true;
-  } catch (_a) {
-    return false;
-  }
-};
-exports.accountExists = accountExists;
-const upsertGcloudServiceAccount = async (context, account) => {
+/**
+ * the deterministic gcloud service account naming used by
+ * `project setup`. Extracted so `project doctor` can compute the
+ * expected identifier of an account without creating anything.
+ *
+ * gcloud limits account ids to 30 chars: the customer/app middle part
+ * (and, if even that is not enough, the env/component suffix) is
+ * replaced by a hash when the full name would not fit.
+ */
+const getGcloudServiceAccountNames = (context, account) => {
   const {
     projectId,
-    name,
-    displayName,
-    roles,
-    description
+    name
   } = account;
   // name has limit of 30
   const namePrefix = `${name}`;
@@ -5055,8 +5687,54 @@ const upsertGcloudServiceAccount = async (context, account) => {
     nameSuffix = nameSuffixRaw;
   }
   const fullName = `${namePrefix}-${nameMiddle}-${nameSuffix}`;
-  const fullDisplayName = `${context.fullConfig.customerName}-${context.fullConfig.appName} ${context.env}:${context.name} | ${displayName}`;
   const fullIdentifier = `${fullName}@${projectId}.iam.gserviceaccount.com`;
+  return {
+    fullName,
+    fullIdentifier
+  };
+};
+exports.getGcloudServiceAccountNames = getGcloudServiceAccountNames;
+const hashIfNessecary = (str, maxLength) => str.length > maxLength ? hash(str, maxLength) : str;
+const hash = (str, length) => {
+  return (0, crypto_1.createHmac)("sha256", str).digest("hex").substring(0, length);
+};
+
+/***/ }),
+
+/***/ 35611:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.upsertGcloudServiceAccountAndSaveSecret = exports.accountExists = void 0;
+const child_process_promise_1 = __nccwpck_require__(51748);
+const gitlab_1 = __nccwpck_require__(4508);
+const serviceAccountNames_1 = __nccwpck_require__(83798);
+const accountExists = async fullIdentifier => {
+  try {
+    await (0, child_process_promise_1.exec)(`gcloud iam service-accounts describe ${fullIdentifier}`);
+    return true;
+  } catch (_a) {
+    return false;
+  }
+};
+exports.accountExists = accountExists;
+const upsertGcloudServiceAccount = async (context, account) => {
+  const {
+    projectId,
+    displayName,
+    roles,
+    description
+  } = account;
+  const {
+    fullName,
+    fullIdentifier
+  } = (0, serviceAccountNames_1.getGcloudServiceAccountNames)(context, account);
+  const fullDisplayName = `${context.fullConfig.customerName}-${context.fullConfig.appName} ${context.env}:${context.name} | ${displayName}`;
   const existing = await (0, exports.accountExists)(fullIdentifier);
   if (!existing) {
     await (0, child_process_promise_1.exec)(`gcloud iam service-accounts create ${fullName} --display-name="${fullDisplayName}" --project="${projectId}"  --description="${description}"`);
@@ -5084,10 +5762,6 @@ const upsertGcloudServiceAccountAndSaveSecret = async (instance, context, accoun
   instance.log("done!");
 };
 exports.upsertGcloudServiceAccountAndSaveSecret = upsertGcloudServiceAccountAndSaveSecret;
-const hashIfNessecary = (str, maxLength) => str.length > maxLength ? hash(str, maxLength) : str;
-const hash = (str, length) => {
-  return (0, crypto_1.createHmac)("sha256", str).digest("hex").substring(0, length);
-};
 
 /***/ }),
 
@@ -5665,6 +6339,40 @@ exports.connectToCluster = connectToCluster;
 
 /***/ }),
 
+/***/ 5092:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.mapWithConcurrency = void 0;
+/**
+ * maps over items with at most `limit` calls in flight, preserving the
+ * input order in the result (unlike reporting-as-you-go, this lets
+ * callers run slow per-item lookups in parallel and still log the
+ * outcomes in a stable order)
+ */
+const mapWithConcurrency = async (items, limit, fn) => {
+  const results = new Array(items.length);
+  let next = 0;
+  const workers = Array.from({
+    length: Math.max(1, Math.min(limit, items.length))
+  }, async () => {
+    while (next < items.length) {
+      const index = next++;
+      results[index] = await fn(items[index], index);
+    }
+  });
+  await Promise.all(workers);
+  return results;
+};
+exports.mapWithConcurrency = mapWithConcurrency;
+
+/***/ }),
+
 /***/ 82805:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
@@ -5778,7 +6486,7 @@ exports["default"] = async () => {
 Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
-exports.ensureGithubEnvironment = exports.setGithubVariable = exports.setGithubSecret = exports.getGithubRepoFromRemote = exports.isGhAuthenticated = void 0;
+exports.ensureGithubEnvironment = exports.setGithubVariable = exports.setGithubSecret = exports.listGithubVariableNames = exports.listGithubSecretNames = exports.listGithubEnvironments = exports.getGithubRepoFromRemote = exports.isGhAuthenticated = void 0;
 const child_process_1 = __nccwpck_require__(35317);
 const util_1 = __nccwpck_require__(39023);
 const execFile = (0, util_1.promisify)(child_process_1.execFile);
@@ -5811,6 +6519,31 @@ const getGithubRepoFromRemote = async remoteName => {
   }
 };
 exports.getGithubRepoFromRemote = getGithubRepoFromRemote;
+/**
+ * runs a paginated `gh api` query and returns the jq-extracted lines
+ * (one value per line, e.g. names)
+ */
+const ghApiLines = async (path, jq) => {
+  const {
+    stdout
+  } = await execFile("gh", ["api", "--paginate", path, "--jq", jq], {
+    maxBuffer: 10 * 1024 * 1024
+  });
+  return stdout.split("\n").map(line => line.trim()).filter(Boolean);
+};
+/** names of all deployment environments of the repository */
+const listGithubEnvironments = repo => ghApiLines(`repos/${repo}/environments?per_page=100`, ".environments[].name");
+exports.listGithubEnvironments = listGithubEnvironments;
+/**
+ * names of the actions secrets — of an environment, or of the repo
+ * level when no environment is given. Github secrets are write-only:
+ * names are all that can ever be inspected.
+ */
+const listGithubSecretNames = (repo, environment) => ghApiLines(environment ? `repos/${repo}/environments/${encodeURIComponent(environment)}/secrets?per_page=100` : `repos/${repo}/actions/secrets?per_page=100`, ".secrets[].name");
+exports.listGithubSecretNames = listGithubSecretNames;
+/** names of the actions variables (environment or repo level) */
+const listGithubVariableNames = (repo, environment) => ghApiLines(environment ? `repos/${repo}/environments/${encodeURIComponent(environment)}/variables?per_page=100` : `repos/${repo}/actions/variables?per_page=100`, ".variables[].name");
+exports.listGithubVariableNames = listGithubVariableNames;
 const ghSetViaStdin = (kind, repo, name, value, environment) => new Promise((resolve, reject) => {
   var _a, _b;
   const child = (0, child_process_1.spawn)("gh", [kind, "set", name, "--repo", repo, ...(environment ? ["--env", environment] : [])], {
@@ -5866,7 +6599,7 @@ var __importDefault = this && this.__importDefault || function (mod) {
 Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
-exports.upsertAllVariables = exports.clearBackups = exports.getVariableValueByRawName = exports.getAllVariables = exports.getProjectInfo = exports.doGitlabRequest = exports.getGitlabToken = exports.setupGitlabToken = exports.hasGitlabToken = void 0;
+exports.upsertAllVariables = exports.clearBackups = exports.getVariableValueByRawName = exports.getAllVariables = exports.getProjectInfo = exports.doGitlabRequestAllPages = exports.doGitlabRequest = exports.getGitlabToken = exports.setupGitlabToken = exports.hasGitlabToken = void 0;
 const pipeline_1 = __nccwpck_require__(60241);
 const lodash_es_1 = __nccwpck_require__(64284);
 const memoizee_1 = __importDefault(__nccwpck_require__(57009));
@@ -5937,6 +6670,24 @@ const doGitlabRequest = async (io, path, data = undefined, method = "GET") => {
   throw new Error(`Could not send request to gitlab api ${path}: ${result.status} "${result.statusText}".\nResponse: ${JSON.stringify(await result.json(), null, 2)}`);
 };
 exports.doGitlabRequest = doGitlabRequest;
+/**
+ * GET a list endpoint across ALL pages (gitlab returns 20 items per
+ * page by default — long-lived projects easily exceed that, e.g.
+ * rotated access tokens accumulate one entry per rotation)
+ */
+const doGitlabRequestAllPages = async (io, path) => {
+  const PER_PAGE = 100;
+  const separator = path.includes("?") ? "&" : "?";
+  const all = [];
+  for (let page = 1;; page++) {
+    const items = await (0, exports.doGitlabRequest)(io, `${path}${separator}per_page=${PER_PAGE}&page=${page}`);
+    if (!(items === null || items === void 0 ? void 0 : items.length)) break;
+    all.push(...items);
+    if (items.length < PER_PAGE) break;
+  }
+  return all;
+};
+exports.doGitlabRequestAllPages = doGitlabRequestAllPages;
 const getProjectInfo = async io => {
   const {
     gitRemotePath
@@ -10640,7 +11391,7 @@ Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
 exports.DOCKER_REGISTRY = exports.PIPELINE_IMAGE_TAG = void 0;
-exports.PIPELINE_IMAGE_TAG = "next-88a07ab6" || 0;
+exports.PIPELINE_IMAGE_TAG = "next-51dc9c2b" || 0;
 exports.DOCKER_REGISTRY = "git.panter.ch:5001/catladder/catladder" || 0;
 
 /***/ }),
@@ -12953,6 +13704,18 @@ exports.GCLOUD_RUN_DEPLOY_TYPE = {
       DEPLOY_CLOUD_RUN_PROJECT_ID: deployConfigRaw ? deployConfigRaw.projectId : undefined,
       DEPLOY_CLOUD_RUN_REGION: deployConfigRaw ? deployConfigRaw.region : undefined
     };
+  },
+  verifyJobSetupScript: context => {
+    var _a;
+    const deployConfig = (_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config;
+    const service = deployConfig === null || deployConfig === void 0 ? void 0 : deployConfig.service;
+    const serviceConfig = typeof service === "object" ? service : undefined;
+    if ((serviceConfig === null || serviceConfig === void 0 ? void 0 : serviceConfig.allowUnauthenticated) !== false) {
+      return [];
+    }
+    // the service requires IAM auth: provide application default credentials
+    // so the verify command can fetch identity tokens for the deployed service
+    return (0, gitlab_1.collapseableSection)("verifygcloudauth", "Setup google application credentials")([`echo "$${exports.GCLOUD_DEPLOY_CREDENTIALS_KEY}" > "$CI_PROJECT_DIR/.gcloud-sa.json"`, `export GOOGLE_APPLICATION_CREDENTIALS="$CI_PROJECT_DIR/.gcloud-sa.json"`]);
   }
 };
 
@@ -14076,6 +14839,7 @@ __exportStar(__nccwpck_require__(20623), exports);
 __exportStar(__nccwpck_require__(38045), exports);
 __exportStar(__nccwpck_require__(51398), exports);
 __exportStar(__nccwpck_require__(88025), exports);
+__exportStar(__nccwpck_require__(39871), exports);
 __exportStar(__nccwpck_require__(45585), exports);
 __exportStar(__nccwpck_require__(47666), exports);
 __exportStar(__nccwpck_require__(60250), exports);
@@ -14705,6 +15469,7 @@ exports.createJobsForComponentContext = void 0;
 const build_1 = __nccwpck_require__(51398);
 const deploy_1 = __nccwpck_require__(88025);
 const jobs_1 = __nccwpck_require__(41507);
+const createVerifyJobs_1 = __nccwpck_require__(69134);
 const injectDefaultVarsInCustomJobs = (context, jobs) => jobs.map(({
   variables,
   ...job
@@ -14726,9 +15491,9 @@ const getCustomJobs = context => {
   return injectDefaultVarsInCustomJobs(context, rawJobs);
 };
 const createJobsForComponentContext = async context => {
-  const [buildJobs, deployJobs] = await Promise.all([context.build.type !== "disabled" ? build_1.BUILD_TYPES[context.build.buildType].jobs(context) : [], context.componentConfig.deploy !== false ? deploy_1.DEPLOY_TYPES[context.componentConfig.deploy.type].jobs(context) : []]);
+  const [buildJobs, deployJobs, verifyJobs] = await Promise.all([context.build.type !== "disabled" ? build_1.BUILD_TYPES[context.build.buildType].jobs(context) : [], context.componentConfig.deploy !== false ? deploy_1.DEPLOY_TYPES[context.componentConfig.deploy.type].jobs(context) : [], (0, createVerifyJobs_1.createVerifyJobs)(context)]);
   const customJobs = getCustomJobs(context);
-  return [...buildJobs, ...deployJobs, ...customJobs];
+  return [...buildJobs, ...deployJobs, ...verifyJobs, ...customJobs];
 };
 exports.createJobsForComponentContext = createJobsForComponentContext;
 
@@ -15872,6 +16637,121 @@ exports.resolveReferencesOnce = resolveReferencesOnce;
 
 /***/ }),
 
+/***/ 69134:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.createVerifyJobs = exports.VERIFY_JOB_NAME = void 0;
+const createArtifactsConfig_1 = __nccwpck_require__(43983);
+const createJobCache_1 = __nccwpck_require__(65644);
+const cache_1 = __nccwpck_require__(34189);
+const constants_1 = __nccwpck_require__(37878);
+const yarn_1 = __nccwpck_require__(78897);
+const deploy_1 = __nccwpck_require__(88025);
+const runner_1 = __nccwpck_require__(92348);
+const utils_1 = __nccwpck_require__(20595);
+exports.VERIFY_JOB_NAME = "🔍 verify";
+const createVerifyJobs = async context => {
+  var _a, _b, _c, _d, _e, _f, _g;
+  const verifyConfig = context.componentConfig.verify;
+  if (!verifyConfig) {
+    return [];
+  }
+  const deployConfig = (_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config;
+  if (!deployConfig) {
+    // nothing is deployed, so there is nothing to verify
+    return [];
+  }
+  const isNodeBuild = context.build.type !== "disabled" && context.build.buildType === "node";
+  const [yarnInstall, nodeCache] = isNodeBuild ? await Promise.all([(0, yarn_1.getYarnInstall)(context), (0, cache_1.getNodeCache)(context, "pull")]) : [null, null];
+  const setupScript = (_d = (_c = (_b = deploy_1.DEPLOY_TYPES[deployConfig.type]).verifyJobSetupScript) === null || _c === void 0 ? void 0 : _c.call(_b, context)) !== null && _d !== void 0 ? _d : [];
+  return [{
+    name: exports.VERIFY_JOB_NAME,
+    stage: "verify",
+    envMode: "stagePerEnv",
+    requires: [
+    // wait for this component's own deploy
+    {
+      capability: "deployment",
+      artifacts: false
+    },
+    // ...and for the deploys of the components listed in waitFor
+    ...((_e = verifyConfig.waitFor) !== null && _e !== void 0 ? _e : []).map(componentName => ({
+      capability: "deployment",
+      from: {
+        component: componentName
+      },
+      artifacts: false,
+      strict: true
+    }))],
+    image: (_f = verifyConfig.jobImage) !== null && _f !== void 0 ? _f : (0, runner_1.getRunnerImage)("jobs-testing-chrome"),
+    cache: nodeCache ? (0, createJobCache_1.createJobCacheFromCacheConfigs)(context, nodeCache) : undefined,
+    variables: {
+      ...context.environment.envVars
+    },
+    runnerVariables: {
+      ...constants_1.NODE_RUNNER_BUILD_VARIABLES,
+      ...((_g = verifyConfig.runnerVariables) !== null && _g !== void 0 ? _g : {})
+    },
+    script: [...setupScript, ...(yarnInstall ? (0, yarn_1.ensureNodeVersion)(context) : []), `cd ${context.build.dir}`, ...(yarnInstall !== null && yarnInstall !== void 0 ? yarnInstall : []), ...(0, utils_1.ensureArray)(verifyConfig.command)],
+    allow_failure: verifyConfig.allowFailure,
+    ...(0, createArtifactsConfig_1.createArtifactsConfig)(context.build.dir, verifyConfig.artifactsReports, verifyConfig.artifacts)
+  }];
+};
+exports.createVerifyJobs = createVerifyJobs;
+
+/***/ }),
+
+/***/ 39871:
+/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
+
+"use strict";
+
+
+var __createBinding = this && this.__createBinding || (Object.create ? function (o, m, k, k2) {
+  if (k2 === undefined) k2 = k;
+  var desc = Object.getOwnPropertyDescriptor(m, k);
+  if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+    desc = {
+      enumerable: true,
+      get: function () {
+        return m[k];
+      }
+    };
+  }
+  Object.defineProperty(o, k2, desc);
+} : function (o, m, k, k2) {
+  if (k2 === undefined) k2 = k;
+  o[k2] = m[k];
+});
+var __exportStar = this && this.__exportStar || function (m, exports) {
+  for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+__exportStar(__nccwpck_require__(99318), exports);
+__exportStar(__nccwpck_require__(69134), exports);
+
+/***/ }),
+
+/***/ 99318:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+
+/***/ }),
+
 /***/ 29879:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {