@genoacms/adapter-gcp 0.8.2 → 0.10.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023-2026 Filip Holčík
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/authentication/identity-platform/descriptor.d.ts

@@ -0,0 +1,18 @@
+import { type Secret } from '@genoacms/contracts';
+import { type ServiceAccount } from '../../shared/serviceAccount.js';
+export interface GcpIdentityPlatformOptions {
+    projectId: string;
+    /** An Identity Platform tenant. Omit for the project's own user pool. */
+    tenantId?: string;
+    /** An API key restricted to the Identity Toolkit API. Omit to sign in with the runtime identity. */
+    apiKey?: Secret<string>;
+    /** Omit for Application Default Credentials; only for running outside GCP. */
+    credentials?: Secret<ServiceAccount>;
+}
+declare module '@genoacms/contracts' {
+    interface AuthenticationAdapters {
+        '@genoacms/adapter-gcp/authentication/identity-platform': GcpIdentityPlatformOptions;
+    }
+}
+declare const _default: import("@genoacms/contracts").AdapterDescriptor<"authentication", GcpIdentityPlatformOptions>;
+export default _default;

package/dist/authentication/identity-platform/descriptor.js

@@ -0,0 +1,14 @@
+import { defineAuthenticationAdapter } from '@genoacms/contracts';
+import { unknownOptions, requireString } from '../../shared/serviceAccount.js';
+const OPTIONS = ['projectId', 'tenantId', 'apiKey', 'credentials'];
+// AUTH-1
+function optionalString(options, key) {
+    const value = options?.[key];
+    return value === undefined || (typeof value === 'string' && value !== '') ? [] : [`${key} must be a non-empty string`];
+}
+// AUTH-1, COM-2, COM-3
+export default defineAuthenticationAdapter({
+    runtime: '@genoacms/adapter-gcp/authentication/identity-platform/runtime',
+    secretOptions: { apiKey: 'string', credentials: 'json' },
+    validate: options => [...unknownOptions(options, OPTIONS), ...requireString(options, 'projectId'), ...optionalString(options, 'tenantId')]
+});

package/dist/authentication/identity-platform/runtime.d.ts

@@ -0,0 +1,4 @@
+import type { Adapter } from '@genoacms/contracts/authentication';
+import type { GcpIdentityPlatformOptions } from './descriptor.js';
+declare const _default: import("@genoacms/contracts").AdapterRuntime<GcpIdentityPlatformOptions, Adapter>;
+export default _default;

package/dist/authentication/identity-platform/runtime.js

@@ -0,0 +1,140 @@
+import { defineRuntime } from '@genoacms/contracts';
+import { GoogleAuth } from 'google-auth-library';
+/**
+ * The GenoaCMS `authentication` service backed by Identity Platform, or plain Firebase
+ * Authentication: one service behind one API (GU10). Users are managed there, not in the CMS.
+ */
+const ENDPOINT = 'https://identitytoolkit.googleapis.com/v1/accounts';
+const SCOPE = 'https://www.googleapis.com/auth/identitytoolkit';
+// AUTH-2
+const TIMEOUT_MS = 10_000;
+// AUTH-5
+const CREDENTIAL_CODES = new Set(['INVALID_LOGIN_CREDENTIALS', 'EMAIL_NOT_FOUND', 'INVALID_PASSWORD', 'INVALID_EMAIL', 'MISSING_PASSWORD', 'USER_DISABLED']);
+// AUTH-6
+const THROTTLED_CODE = 'TOO_MANY_ATTEMPTS_TRY_LATER';
+const CREDENTIALS_REJECTED = Object.freeze({ rejected: 'credentials' });
+const SECOND_FACTOR_REQUIRED = Object.freeze({ rejected: 'second-factor-required' });
+// AUTH-3, AUTH-10, GF32
+const MALFORMED = 'malformed response';
+const messageOf = (error) => error instanceof Error ? error.message : String(error);
+const isObject = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+const isNonEmptyString = (value) => typeof value === 'string' && value !== '';
+// AUTH-7
+function providerFailed(status, message) {
+    return new Error(`authentication/provider-failed: ${status} ${message}`);
+}
+function errorMessage(body) {
+    return isObject(body) && isObject(body.error) && typeof body.error.message === 'string' ? body.error.message : '';
+}
+// AUTH-5
+function errorCode(body) {
+    return errorMessage(body).split(' : ')[0];
+}
+function parsed(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+}
+// AUTH-2
+async function untilAborted(work, signal) {
+    signal.throwIfAborted();
+    return await new Promise((resolve, reject) => {
+        const abort = () => { reject(signal.reason); };
+        signal.addEventListener('abort', abort, { once: true });
+        work.then(resolve, reject).finally(() => { signal.removeEventListener('abort', abort); });
+    });
+}
+// AUTH-2, AUTH-7
+async function send(url, headers, body, signal) {
+    try {
+        const response = await fetch(url, { method: 'POST', headers, body: JSON.stringify(body), signal });
+        return { status: response.status, body: parsed(await response.text()) };
+    }
+    catch (error) {
+        throw providerFailed('network', messageOf(error));
+    }
+}
+// AUTH-3, AUTH-4, AUTH-8
+function signedIn(body) {
+    if (!isObject(body))
+        throw providerFailed(200, MALFORMED);
+    if (body.mfaPendingCredential !== undefined)
+        return SECOND_FACTOR_REQUIRED;
+    if (!isNonEmptyString(body.localId) || !isNonEmptyString(body.email))
+        throw providerFailed(200, MALFORMED);
+    return { subject: body.localId, email: body.email };
+}
+// AUTH-5, AUTH-6, AUTH-7
+function refused({ status, body }) {
+    const code = errorCode(body);
+    if (status === 400 && CREDENTIAL_CODES.has(code))
+        return CREDENTIALS_REJECTED;
+    if (status === 400 && code === THROTTLED_CODE)
+        throw new Error('authentication/throttled');
+    throw providerFailed(status, errorMessage(body));
+}
+// AUTH-10
+function foundIn(body) {
+    if (!isObject(body))
+        throw providerFailed(200, MALFORMED);
+    if (body.users === undefined)
+        return null;
+    if (!Array.isArray(body.users))
+        throw providerFailed(200, MALFORMED);
+    const user = body.users[0];
+    if (user === undefined)
+        return null;
+    if (!isObject(user) || !isNonEmptyString(user.localId))
+        throw providerFailed(200, MALFORMED);
+    if (user.disabled === true || typeof user.email !== 'string')
+        return null;
+    return { subject: user.localId, email: user.email };
+}
+export default defineRuntime({
+    create({ projectId, tenantId, apiKey, credentials }) {
+        const auth = new GoogleAuth({ scopes: [SCOPE], projectId, ...(credentials === undefined ? {} : { credentials }) });
+        const tenant = tenantId === undefined ? {} : { tenantId };
+        // AUTH-7
+        async function accessToken(signal) {
+            try {
+                const token = await untilAborted(auth.getAccessToken(), signal);
+                if (typeof token !== 'string' || token === '')
+                    throw new Error('no access token');
+                return token;
+            }
+            catch (error) {
+                throw providerFailed('network', messageOf(error));
+            }
+        }
+        async function withToken(signal) {
+            return { 'content-type': 'application/json', authorization: `Bearer ${await accessToken(signal)}` };
+        }
+        // AUTH-2
+        async function signInRequest(signal) {
+            const url = new URL(`${ENDPOINT}:signInWithPassword`);
+            if (apiKey === undefined)
+                return { url, headers: await withToken(signal) };
+            url.searchParams.set('key', apiKey);
+            return { url, headers: { 'content-type': 'application/json' } };
+        }
+        return {
+            async authenticate(email, password) {
+                const signal = AbortSignal.timeout(TIMEOUT_MS);
+                const { url, headers } = await signInRequest(signal);
+                const answer = await send(url, headers, { email, password, returnSecureToken: true, ...tenant }, signal);
+                return answer.status === 200 ? signedIn(answer.body) : refused(answer);
+            },
+            // AUTH-10
+            async getIdentity(subject) {
+                const signal = AbortSignal.timeout(TIMEOUT_MS);
+                const answer = await send(new URL(`${ENDPOINT}:lookup`), await withToken(signal), { localId: [subject], targetProjectId: projectId, ...tenant }, signal);
+                if (answer.status !== 200)
+                    throw providerFailed(answer.status, errorMessage(answer.body));
+                return foundIn(answer.body);
+            }
+        };
+    }
+});

package/dist/database/descriptor.d.ts

@@ -0,0 +1,16 @@
+import { type Secret } from '@genoacms/contracts';
+import { type ServiceAccount } from '../shared/serviceAccount.js';
+export interface GcpDatabaseOptions {
+    projectId: string;
+    /** Default '(default)'. */
+    databaseId?: string;
+    /** Omitted: Application Default Credentials, i.e. the runtime's own identity. */
+    credentials?: Secret<ServiceAccount>;
+}
+declare module '@genoacms/contracts' {
+    interface DatabaseAdapters {
+        '@genoacms/adapter-gcp/database': GcpDatabaseOptions;
+    }
+}
+declare const _default: import("@genoacms/contracts").AdapterDescriptor<"database", GcpDatabaseOptions>;
+export default _default;

package/dist/database/descriptor.js

@@ -0,0 +1,7 @@
+import { defineDatabaseAdapter } from '@genoacms/contracts';
+import { unknownOptions, requireString } from '../shared/serviceAccount.js';
+export default defineDatabaseAdapter({
+    runtime: '@genoacms/adapter-gcp/database/runtime',
+    secretOptions: { credentials: 'json' },
+    validate: options => [...unknownOptions(options, ['projectId', 'databaseId', 'credentials']), ...requireString(options, 'projectId')]
+});

package/dist/database/runtime.d.ts

@@ -0,0 +1,5 @@
+import type { Adapter } from '@genoacms/contracts/database';
+import type { GcpDatabaseOptions } from './descriptor.js';
+/** One Firestore provider, with its own client and credential. */
+declare const _default: import("@genoacms/contracts").AdapterRuntime<GcpDatabaseOptions, Adapter>;
+export default _default;

package/dist/database/runtime.js

@@ -0,0 +1,68 @@
+import { defineRuntime } from '@genoacms/contracts';
+import { Firestore } from '@google-cloud/firestore';
+/** One Firestore provider, with its own client and credential. */
+export default defineRuntime({
+    create({ projectId, databaseId, credentials }) {
+        const firestore = new Firestore({
+            projectId,
+            databaseId: databaseId ?? '(default)',
+            ...(credentials === undefined ? {} : { credentials })
+        });
+        const createDocument = async (reference, data) => {
+            const document = await firestore.collection(reference.name).add(data);
+            const documentReference = {
+                collection: reference,
+                id: document.id
+            };
+            return {
+                reference: documentReference,
+                data
+            };
+        };
+        const getCollection = async (reference) => {
+            const collection = await firestore.collection(reference.name).get();
+            const documents = [];
+            collection.forEach(document => {
+                documents.push({
+                    reference: {
+                        collection: reference,
+                        id: document.id
+                    },
+                    data: document.data()
+                });
+            });
+            return documents;
+        };
+        const getDocument = async ({ collection, id }) => {
+            const document = await firestore.collection(collection.name).doc(id).get();
+            if (!document.exists)
+                return undefined;
+            const documentReference = {
+                collection,
+                id
+            };
+            const documentSnapshot = {
+                reference: documentReference,
+                data: document.data()
+            };
+            return documentSnapshot;
+        };
+        const updateDocument = async (reference, document) => {
+            await firestore.collection(reference.collection.name).doc(reference.id).update(document);
+            return {
+                reference,
+                data: document
+            };
+        };
+        const deleteDocument = async (reference) => {
+            await firestore.collection(reference.collection.name).doc(reference.id).delete();
+        };
+        return {
+            createDocument,
+            getDocument,
+            getCollection,
+            updateDocument,
+            deleteDocument
+        };
+    }
+});

package/dist/deployment/archive.d.ts

@@ -0,0 +1,4 @@
+declare const FUNCTION_ENTRY = "import { handler } from './index.js'\n\n/** Cloud Run functions entry point. The name must match buildConfig.entryPoint. */\nexport function genoacms (req, res) {\n  handler(req, res, undefined)\n}\n";
+declare function stageArtifact(buildDir: string, app: string): Promise<string>;
+declare function zipDirectory(dir: string, out: string): Promise<string>;
+export { stageArtifact, zipDirectory, FUNCTION_ENTRY };

package/dist/deployment/archive.js

@@ -0,0 +1,46 @@
+import { cp, readFile, writeFile, access } from 'node:fs/promises';
+import { createWriteStream } from 'node:fs';
+import { join } from 'node:path';
+import archiver from 'archiver';
+// DEP-6, DEP-10
+const FUNCTION_ENTRY = `import { handler } from './index.js'
+
+/** Cloud Run functions entry point. The name must match buildConfig.entryPoint. */
+export function genoacms (req, res) {
+  handler(req, res, undefined)
+}
+`;
+async function requireRuntimePackage(buildDir) {
+    try {
+        await access(join(buildDir, 'package.json'));
+    }
+    catch {
+        throw new Error(`deploy/no-runtime-package: ${buildDir}/package.json is missing; build with genoa build`);
+    }
+}
+async function setMain(packageJsonPath, main) {
+    const pkg = JSON.parse(await readFile(packageJsonPath, 'utf-8'));
+    await writeFile(packageJsonPath, `${JSON.stringify({ ...pkg, main }, null, 2)}\n`);
+}
+// DEP-6
+async function stageArtifact(buildDir, app) {
+    await requireRuntimePackage(buildDir);
+    await cp(buildDir, app, { recursive: true });
+    await setMain(join(app, 'package.json'), 'function.js');
+    await writeFile(join(app, 'function.js'), FUNCTION_ENTRY);
+    return app;
+}
+// DEP-7
+async function zipDirectory(dir, out) {
+    await new Promise((resolve, reject) => {
+        const output = createWriteStream(out);
+        const archive = archiver('zip', { zlib: { level: 9 } });
+        output.on('close', () => { resolve(); });
+        archive.on('error', (err) => { reject(err); });
+        archive.pipe(output);
+        archive.directory(dir, false);
+        void archive.finalize();
+    });
+    return out;
+}
+export { stageArtifact, zipDirectory, FUNCTION_ENTRY };

package/dist/deployment/descriptor.d.ts

@@ -0,0 +1,24 @@
+import { type Secret } from '@genoacms/contracts';
+import { type ServiceAccount } from '../shared/serviceAccount.js';
+import { type FunctionSettings } from './settings.js';
+/** The function's settings; each defaults to today's behavior except `runtime` (architecture GD3). */
+export interface GcpDeploymentOptions extends FunctionSettings {
+    projectId: string;
+    region: string;
+    /** Default 'genoacms'. */
+    functionName?: string;
+    /** Used by `genoa deploy` on the operator's machine only. Never embedded in the build. */
+    credentials?: Secret<ServiceAccount>;
+}
+declare module '@genoacms/contracts' {
+    interface DeploymentTargets {
+        '@genoacms/adapter-gcp/deployment': GcpDeploymentOptions;
+    }
+}
+/**
+ * SDK-free: the build loads this to choose the SvelteKit adapter. Both loaders are lazy imports
+ * resolved from this package, so neither the SvelteKit adapter nor the Cloud Functions SDK loads
+ * until it is needed.
+ */
+declare const _default: import("@genoacms/contracts").DeploymentDescriptor<GcpDeploymentOptions>;
+export default _default;

package/dist/deployment/descriptor.js

@@ -0,0 +1,20 @@
+import { defineDeploymentTarget } from '@genoacms/contracts';
+import { unknownOptions, requireString } from '../shared/serviceAccount.js';
+import { SETTING_KEYS, validateSettings } from './settings.js';
+/**
+ * SDK-free: the build loads this to choose the SvelteKit adapter. Both loaders are lazy imports
+ * resolved from this package, so neither the SvelteKit adapter nor the Cloud Functions SDK loads
+ * until it is needed.
+ */
+export default defineDeploymentTarget({
+    svelteKitAdapter: async () => await import('@genoacms/sveltekit-adapter-cloud-run-functions'),
+    svelteKitOptions: (_options, { outDir }) => ({ out: outDir }),
+    procedure: async () => await import('./procedure.js'),
+    secretOptions: { credentials: 'json' },
+    validate: options => [
+        ...unknownOptions(options, ['projectId', 'region', 'functionName', 'credentials', ...SETTING_KEYS]),
+        ...requireString(options, 'projectId'),
+        ...requireString(options, 'region'),
+        ...validateSettings(options)
+    ]
+});

package/dist/deployment/functions.d.ts

@@ -0,0 +1,16 @@
+import type { google } from '@google-cloud/functions/build/protos/protos.js';
+import { v2 } from '@google-cloud/functions';
+import type { ServiceAccount } from '../shared/serviceAccount.js';
+import { type FunctionSettings } from './settings.js';
+type IStorageSource = google.cloud.functions.v2.IStorageSource;
+type FunctionServiceClient = InstanceType<typeof v2.FunctionServiceClient>;
+interface FunctionTarget {
+    projectId: string;
+    region: string;
+    functionName: string;
+}
+declare function createFunctionsClient(credentials?: ServiceAccount): FunctionServiceClient;
+declare function uploadArchive(client: FunctionServiceClient, projectId: string, region: string, archivePath: string): Promise<IStorageSource>;
+declare function deployFunction(client: FunctionServiceClient, { projectId, region, functionName }: FunctionTarget, storageSource: IStorageSource, settings: FunctionSettings): Promise<string | undefined>;
+export { createFunctionsClient, uploadArchive, deployFunction };
+export type { FunctionTarget, FunctionServiceClient };

package/dist/deployment/functions.js

@@ -0,0 +1,66 @@
+import { createReadStream } from 'node:fs';
+import { v2 } from '@google-cloud/functions';
+import { buildConfig, serviceConfig } from './settings.js';
+const GRPC_NOT_FOUND = 5;
+// DEP-13
+function createFunctionsClient(credentials) {
+    return new v2.FunctionServiceClient(credentials === undefined ? {} : { credentials });
+}
+async function uploadArchive(client, projectId, region, archivePath) {
+    const location = client.locationPath(projectId, region);
+    const [urlResponse] = await client.generateUploadUrl({ parent: location });
+    const uploadUrl = urlResponse.uploadUrl;
+    const storageSource = urlResponse.storageSource;
+    if (!uploadUrl || !storageSource)
+        throw new Error('Upload URL not found');
+    const sourceArchiveStream = createReadStream(archivePath);
+    const response = await fetch(uploadUrl, {
+        method: 'PUT',
+        // @ts-expect-error: invalid typings
+        body: sourceArchiveStream,
+        duplex: 'half',
+        headers: {
+            'Content-Type': 'application/zip'
+        }
+    });
+    if (!response.ok)
+        throw new Error(`deploy/upload-failed: ${response.status} ${response.statusText}`);
+    return storageSource;
+}
+// DEP-9
+async function functionExists(client, name) {
+    try {
+        await client.getFunction({ name });
+        return true;
+    }
+    catch (error) {
+        if (error.code === GRPC_NOT_FOUND)
+            return false;
+        throw error;
+    }
+}
+// DEP-11, GD1
+async function completeOperation(operation) {
+    try {
+        const [result] = await operation.promise();
+        return result;
+    }
+    catch (error) {
+        throw new Error(`deploy/function-failed: ${error.message}`, { cause: error });
+    }
+}
+// DEP-10, DEP-12, GD1
+async function deployFunction(client, { projectId, region, functionName }, storageSource, settings) {
+    const name = client.functionPath(projectId, region, functionName);
+    const request = {
+        functionId: functionName,
+        parent: client.locationPath(projectId, region),
+        function: { name, buildConfig: buildConfig(settings, storageSource), serviceConfig: serviceConfig(settings) }
+    };
+    const [operation] = await functionExists(client, name)
+        ? await client.updateFunction(request)
+        : await client.createFunction(request);
+    const result = await completeOperation(operation);
+    return result.url ?? result.serviceConfig?.uri ?? undefined;
+}
+export { createFunctionsClient, uploadArchive, deployFunction };

package/dist/deployment/procedure.d.ts

@@ -0,0 +1,4 @@
+import type { GcpDeploymentOptions } from './descriptor.js';
+/** Uploads the build artifact, then creates or updates the Cloud Run function and waits for it. */
+declare const _default: import("@genoacms/contracts").DeployProcedure<GcpDeploymentOptions>;
+export default _default;

package/dist/deployment/procedure.js

@@ -0,0 +1,16 @@
+import { join } from 'node:path';
+import { defineDeployProcedure } from '@genoacms/contracts';
+import { stageArtifact, zipDirectory } from './archive.js';
+import { createFunctionsClient, uploadArchive, deployFunction } from './functions.js';
+const DEFAULT_FUNCTION_NAME = 'genoacms';
+/** Uploads the build artifact, then creates or updates the Cloud Run function and waits for it. */
+export default defineDeployProcedure(async (options, ctx) => {
+    const app = await stageArtifact(ctx.buildDir, join(ctx.workDir, 'app'));
+    const archive = await zipDirectory(app, join(ctx.workDir, 'build.zip'));
+    const client = createFunctionsClient(options.credentials);
+    const storageSource = await uploadArchive(client, options.projectId, options.region, archive);
+    const target = { projectId: options.projectId, region: options.region, functionName: options.functionName ?? DEFAULT_FUNCTION_NAME };
+    const url = await deployFunction(client, target, storageSource, options);
+    if (url !== undefined)
+        console.info(`Function URL: ${url}`);
+});

package/dist/deployment/settings.d.ts

@@ -0,0 +1,22 @@
+type Ingress = 'all' | 'internal' | 'internal-and-gclb';
+/** The function's settings, as the gcp target's options name them (architecture GD3). */
+export interface FunctionSettings {
+    runtime?: string;
+    memory?: string;
+    timeoutSeconds?: number;
+    minInstances?: number;
+    maxInstances?: number;
+    ingress?: Ingress;
+    serviceAccount?: string;
+    /** Set as ORIGIN: the origin browsers use, when a proxy rewrites the forwarded host (architecture GD5). */
+    origin?: string;
+    /** Set as XFF_DEPTH: which X-Forwarded-For entry, from the right, is the client (architecture GD5). */
+    xffDepth?: number;
+}
+declare const SETTING_KEYS: readonly string[];
+declare const DEFAULT_RUNTIME = "nodejs22";
+declare function validateSettings(options: unknown): string[];
+declare function buildConfig(settings: FunctionSettings, storageSource: object): object;
+declare function serviceConfig(settings: FunctionSettings): object;
+export { SETTING_KEYS, DEFAULT_RUNTIME, validateSettings, buildConfig, serviceConfig };
+export type { Ingress };

package/dist/deployment/settings.js

@@ -0,0 +1,58 @@
+const SETTING_KEYS = ['runtime', 'memory', 'timeoutSeconds', 'minInstances', 'maxInstances', 'ingress', 'serviceAccount', 'origin', 'xffDepth'];
+const DEFAULT_RUNTIME = 'nodejs22';
+// DEP-1, DEP-3
+const INGRESS_SETTING_BY_OPTION = { all: 1, internal: 2, 'internal-and-gclb': 3 };
+const isInteger = (value, min, max = Number.MAX_SAFE_INTEGER) => Number.isInteger(value) && value >= min && value <= max;
+const matches = (value, pattern) => typeof value === 'string' && pattern.test(value);
+// DEP-4, DEP-14
+const RULES = {
+    runtime: [value => matches(value, /^nodejs\d+$/), "runtime must be a Node.js runtime such as 'nodejs22'"],
+    memory: [value => matches(value, /^\d+(M|Mi|G|Gi)$/), "memory must be a size such as '512Mi' or '1Gi'"],
+    timeoutSeconds: [value => isInteger(value, 1, 3600), 'timeoutSeconds must be an integer from 1 to 3600'],
+    minInstances: [value => isInteger(value, 0), 'minInstances must be an integer of at least 0'],
+    maxInstances: [value => isInteger(value, 1), 'maxInstances must be an integer of at least 1'],
+    ingress: [value => typeof value === 'string' && Object.hasOwn(INGRESS_SETTING_BY_OPTION, value), "ingress must be 'all', 'internal' or 'internal-and-gclb'"],
+    serviceAccount: [value => matches(value, /^[^@\s]+@[^@\s]+$/), 'serviceAccount must be a service account email'],
+    origin: [value => matches(value, /^https?:\/\/[^/\s]+$/), "origin must be an absolute http(s) origin such as 'https://cms.example.com'"],
+    xffDepth: [value => isInteger(value, 1), 'xffDepth must be an integer of at least 1']
+};
+function instanceOrder(options) {
+    const { minInstances: min, maxInstances: max } = options;
+    if (!isInteger(min, 0) || !isInteger(max, 1))
+        return [];
+    return min > max ? ['minInstances must not exceed maxInstances'] : [];
+}
+// DEP-4, DEP-14
+function validateSettings(options) {
+    const record = typeof options === 'object' && options !== null ? options : {};
+    const reasons = SETTING_KEYS
+        .filter(key => record[key] !== undefined && !RULES[key][0](record[key]))
+        .map(key => RULES[key][1]);
+    return [...reasons, ...instanceOrder(record)];
+}
+// DEP-3, DEP-10
+function buildConfig(settings, storageSource) {
+    return { entryPoint: 'genoacms', runtime: settings.runtime ?? DEFAULT_RUNTIME, source: { storageSource } };
+}
+// DEP-10, DEP-14, GQ1, GD8
+function environmentVariables(settings) {
+    return {
+        NODE_ENV: 'production',
+        IGNORED_ROUTES: '',
+        ...(settings.origin === undefined ? {} : { ORIGIN: settings.origin }),
+        ...(settings.xffDepth === undefined ? {} : { XFF_DEPTH: String(settings.xffDepth) })
+    };
+}
+// DEP-3, DEP-10, GD3
+function serviceConfig(settings) {
+    return {
+        minInstanceCount: settings.minInstances ?? 0,
+        maxInstanceCount: settings.maxInstances ?? 1,
+        ingressSettings: INGRESS_SETTING_BY_OPTION[settings.ingress ?? 'all'],
+        environmentVariables: environmentVariables(settings),
+        ...(settings.memory === undefined ? {} : { availableMemory: settings.memory }),
+        ...(settings.timeoutSeconds === undefined ? {} : { timeoutSeconds: settings.timeoutSeconds }),
+        ...(settings.serviceAccount === undefined ? {} : { serviceAccountEmail: settings.serviceAccount })
+    };
+}
+export { SETTING_KEYS, DEFAULT_RUNTIME, validateSettings, buildConfig, serviceConfig };

package/dist/secrets/descriptor.d.ts

@@ -0,0 +1,14 @@
+import { type BootstrapSecret } from '@genoacms/contracts';
+import { type ServiceAccount } from '../shared/serviceAccount.js';
+export interface GcpSecretsOptions {
+    projectId: string;
+    /** Bootstrap: env() or inline() only. Omit for Application Default Credentials (recommended). */
+    credentials?: BootstrapSecret<ServiceAccount>;
+}
+declare module '@genoacms/contracts' {
+    interface SecretsAdapters {
+        '@genoacms/adapter-gcp/secrets': GcpSecretsOptions;
+    }
+}
+declare const _default: import("@genoacms/contracts").AdapterDescriptor<"secrets", GcpSecretsOptions>;
+export default _default;

package/dist/secrets/descriptor.js

@@ -0,0 +1,7 @@
+import { defineSecretsAdapter } from '@genoacms/contracts';
+import { unknownOptions, requireString } from '../shared/serviceAccount.js';
+export default defineSecretsAdapter({
+    runtime: '@genoacms/adapter-gcp/secrets/runtime',
+    secretOptions: { credentials: 'json' },
+    validate: options => [...unknownOptions(options, ['projectId', 'credentials']), ...requireString(options, 'projectId')]
+});

package/dist/secrets/runtime.d.ts

@@ -0,0 +1,14 @@
+import type { Adapter } from '@genoacms/contracts/secrets';
+import type { GcpSecretsOptions } from './descriptor.js';
+/**
+ * The GenoaCMS `secrets` service backed by GCP Secret Manager.
+ *
+ * Secret Manager is versioned; this contract is not. Writes add a version and reads always take
+ * `latest`, so version history exists but is never consulted. That is deliberate — building the
+ * contract on a provider-specific behavior would leave the abstraction unimplementable elsewhere.
+ * `setSecret` therefore destroys the versions it supersedes (architecture GD4). Secrets created here
+ * keep a destroyed version disabled for seven days before it is gone, so a bad overwrite can be undone
+ * by hand.
+ */
+declare const _default: import("@genoacms/contracts").AdapterRuntime<GcpSecretsOptions, Adapter>;
+export default _default;