@homeflare/site 0.1.0

package/dist/index-dvzn0279.js

@@ -0,0 +1,288 @@
+// src/version.ts
+var VERSION = "0.1.0";
+
+// src/errors.ts
+class SiteError extends Error {
+  name = "SiteError";
+  code;
+  issues;
+  constructor(code, message, issues = []) {
+    super(issues.length === 0 ? message : `${message}
+  ${issues.join(`
+  `)}`);
+    this.code = code;
+    this.issues = issues;
+  }
+}
+function unknownKey(kind, key, declared) {
+  const known = [...declared].sort();
+  const list = known.length === 0 ? "none are declared" : `declared: ${known.join(", ")}`;
+  throw new SiteError("unknown-key", `unknown ${kind} "${key}" (${list})`);
+}
+function lookup(kind, record, key) {
+  if (!Object.hasOwn(record, key))
+    unknownKey(kind, key, Object.keys(record));
+  return record[key];
+}
+
+// src/schema.ts
+import * as Effect from "effect/Effect";
+import * as Schema2 from "effect/Schema";
+
+// src/primitives.ts
+import * as Schema from "effect/Schema";
+var Label = Schema.String.check(Schema.isPattern(/^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/, {
+  message: "Expected a lowercase DNS label (a-z, 0-9, inner hyphens, at most 63)"
+}));
+var Hostname = Schema.String.check(Schema.isPattern(/^(?=.{1,253}$)([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]([a-z0-9-]{0,61}[a-z0-9])?$/, { message: "Expected a lowercase fully qualified hostname such as example.com" }));
+var CertificateName = Schema.String.check(Schema.isPattern(/^(\*\.)?([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]([a-z0-9-]{0,61}[a-z0-9])?$/, { message: "Expected a hostname, optionally with one leading *. wildcard" }));
+var OCTET = "(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])";
+var Ipv4 = Schema.String.check(Schema.isPattern(new RegExp(`^(${OCTET}\\.){3}${OCTET}$`), {
+  message: "Expected an IPv4 address such as 192.0.2.10"
+}));
+function parseCidr(cidr) {
+  const match = new RegExp(`^((${OCTET}\\.){3}${OCTET})/([0-9]{1,2})$`).exec(cidr);
+  if (match === null)
+    return;
+  const prefix = Number(match[match.length - 1]);
+  const base = (match[1] ?? "").split(".").reduce((acc, octet) => acc * 256 + Number(octet), 0);
+  return { base, prefix };
+}
+var Ipv4Cidr = Schema.String.check(Schema.makeFilter((value) => {
+  const parsed = parseCidr(value);
+  if (parsed === undefined)
+    return "Expected an IPv4 network such as 192.0.2.0/24";
+  if (parsed.prefix < 8 || parsed.prefix > 30)
+    return "Expected a prefix between /8 and /30";
+  const hostBits = 2 ** (32 - parsed.prefix);
+  if (parsed.base % hostBits !== 0)
+    return "Expected the network address (host bits zero)";
+  return;
+}, { expected: "an IPv4 network" }));
+var HostNumber = Schema.Number.check(Schema.isInt(), Schema.isBetween({ minimum: 1, maximum: 16777214 }));
+var Port = Schema.Number.check(Schema.isInt(), Schema.isBetween({ minimum: 1, maximum: 65535 }));
+var AccountId = Schema.String.check(Schema.isPattern(/^[0-9a-f]{32}$/, {
+  message: "Expected a 32-character lowercase hex account id"
+}));
+var GithubOwner = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9]([A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/, {
+  message: "Expected a GitHub login (letters, digits, inner hyphens)"
+}));
+var AbsolutePath = Schema.String.check(Schema.isPattern(/^(\/[^/\0]+)+$/, {
+  message: "Expected an absolute path without a trailing slash"
+}));
+var SemVer = Schema.String.check(Schema.isPattern(/^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/, { message: "Expected a semver version" }));
+var PinKey = Schema.String.check(Schema.isPattern(/^[a-z0-9]+([._-][a-z0-9]+)*$/, {
+  message: "Expected a lowercase dotted key such as alerts.d1"
+}));
+var PhysicalName = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9][A-Za-z0-9._-]*$/, {
+  message: "Expected a resource name (letters, digits, dot, dash, underscore)"
+}));
+var ListEntry = Schema.String.check(Schema.isPattern(/^[^\s,]+$/, { message: "Expected one entry with no commas or whitespace" }));
+var NonBlank = Schema.String.check(Schema.isPattern(/^\S(.*\S)?$/, { message: "Expected a non-blank value without edge spaces" }));
+
+// src/schema.ts
+var SITE_FORMAT = 1;
+var emptyRecord = (schema) => schema.pipe(Schema2.withDecodingDefaultKey(Effect.succeed({})));
+var Scheme = Schema2.Literals(["http", "https"]);
+var Host = Schema2.Struct({
+  zone: Schema2.optionalKey(Label),
+  aliases: Schema2.optionalKey(Schema2.Array(Label)),
+  legs: Schema2.optionalKey(Schema2.Record(Label, HostNumber))
+});
+var Product = Schema2.Struct({
+  label: Schema2.optionalKey(Label),
+  domain: Schema2.optionalKey(Hostname)
+});
+var Service = Schema2.Struct({ host: Label, port: Port, scheme: Scheme });
+var Account = Schema2.Struct({
+  id: AccountId,
+  zones: Schema2.Array(Hostname),
+  surfaces: Schema2.Array(Label)
+});
+var Vault = Schema2.Struct({
+  label: Label,
+  apiLabel: Label,
+  clusterName: NonBlank,
+  namespace: Schema2.String.pipe(Schema2.withDecodingDefaultKey(Effect.succeed(""))),
+  port: Port.pipe(Schema2.withDecodingDefaultKey(Effect.succeed(8200))),
+  meshAddress: Ipv4,
+  lan: Schema2.Struct({ host: Label, port: Port, scheme: Scheme }),
+  oidcMount: Label.pipe(Schema2.withDecodingDefaultKey(Effect.succeed("oidc"))),
+  cliCallbackPort: Port.pipe(Schema2.withDecodingDefaultKey(Effect.succeed(8250)))
+});
+var Pinned = Schema2.Struct({
+  names: emptyRecord(Schema2.Record(PinKey, PhysicalName)),
+  certificates: emptyRecord(Schema2.Record(PinKey, Schema2.NonEmptyArray(CertificateName))),
+  adopted: emptyRecord(Schema2.Record(PinKey, NonBlank)),
+  policies: emptyRecord(Schema2.Record(PinKey, Schema2.Array(ListEntry))),
+  sshPrincipals: emptyRecord(Schema2.Record(PinKey, Schema2.Array(ListEntry)))
+});
+var SiteSchema = Schema2.Struct({
+  version: Schema2.Literal(SITE_FORMAT),
+  deriveVersion: SemVer,
+  kind: Schema2.Literals(["live", "testing", "example"]),
+  apex: Hostname,
+  zones: Schema2.StructWithRest(Schema2.Struct({ mgmt: Label }), [Schema2.Record(Label, Label)]),
+  networks: Schema2.Record(Label, Ipv4Cidr),
+  hosts: Schema2.Record(Label, Host),
+  clusters: emptyRecord(Schema2.Record(Label, Schema2.Struct({ members: Schema2.Array(Label) }))),
+  products: emptyRecord(Schema2.Record(Label, Product)),
+  services: emptyRecord(Schema2.Record(Label, Service)),
+  cloudflare: Schema2.Struct({
+    accounts: Schema2.Record(Label, Account),
+    access: Schema2.Struct({ team: Label })
+  }),
+  github: Schema2.Struct({ owner: GithubOwner }),
+  paths: Schema2.Struct({ estateRoot: AbsolutePath }),
+  vault: Vault,
+  pinned: Pinned.pipe(Schema2.withDecodingDefaultKey(Effect.succeed({})))
+});
+
+// src/guards.ts
+function checkDeriveVersion(site, installed) {
+  if (site.deriveVersion === installed)
+    return;
+  throw new SiteError("derive-version", `the site file was reviewed against @homeflare/site ${site.deriveVersion}, ` + `but ${installed} is installed. Read the CHANGELOG between them for derive changes, ` + `then set "deriveVersion": "${installed}" — or install ${site.deriveVersion}.`);
+}
+function assertStage(site, stage) {
+  if (stage !== "live" || site.kind === "live")
+    return;
+  throw new SiteError("stage", `stage "live" needs a live site; this one is kind "${site.kind}". ` + `Point HF_SITE_FILE at the live site file, or plan a non-live stage.`);
+}
+
+// src/decode.ts
+import * as Cause from "effect/Cause";
+import * as Exit from "effect/Exit";
+import * as Schema3 from "effect/Schema";
+import * as SchemaIssue from "effect/SchemaIssue";
+
+// src/net.ts
+function dotted(value) {
+  return [24, 16, 8, 0].map((shift) => Math.floor(value / 2 ** shift) % 256).join(".");
+}
+function lastHostNumber(cidr) {
+  const parsed = parseCidr(cidr);
+  if (parsed === undefined)
+    throw new Error(`not an IPv4 network: ${cidr}`);
+  return 2 ** (32 - parsed.prefix) - 2;
+}
+function addressOn(cidr, hostNumber) {
+  const parsed = parseCidr(cidr);
+  if (parsed === undefined)
+    throw new Error(`not an IPv4 network: ${cidr}`);
+  if (hostNumber < 1 || hostNumber > lastHostNumber(cidr)) {
+    throw new Error(`host number ${hostNumber} does not fit ${cidr}`);
+  }
+  return dotted(parsed.base + hostNumber);
+}
+
+// src/references.ts
+var APEX_ZONE = "apex";
+function hostHasZone(site, host) {
+  return Object.hasOwn(site.hosts, host) && site.hosts[host]?.zone !== undefined;
+}
+function checkHosts(site, issues) {
+  for (const [key, host] of Object.entries(site.hosts)) {
+    const zone = host.zone;
+    if (zone !== undefined && zone !== APEX_ZONE && !Object.hasOwn(site.zones, zone)) {
+      issues.push(`hosts.${key}.zone: "${zone}" is not a declared zone or "${APEX_ZONE}"`);
+    }
+    for (const [network, number] of Object.entries(host.legs ?? {})) {
+      const cidr = site.networks[network];
+      if (cidr === undefined) {
+        issues.push(`hosts.${key}.legs.${network}: "${network}" is not a declared network`);
+      } else if (number > lastHostNumber(cidr)) {
+        issues.push(`hosts.${key}.legs.${network}: host number ${number} does not fit ${network}`);
+      }
+    }
+  }
+}
+function checkZonedHost(site, path, host, issues) {
+  if (!Object.hasOwn(site.hosts, host)) {
+    issues.push(`${path}: "${host}" is not a declared host`);
+  } else if (!hostHasZone(site, host)) {
+    issues.push(`${path}: host "${host}" has no zone, so it has no hostname`);
+  }
+}
+function checkAccounts(site, issues) {
+  for (const [alias, account] of Object.entries(site.cloudflare.accounts)) {
+    const seen = new Set;
+    for (const surface of account.surfaces) {
+      if (seen.has(surface)) {
+        issues.push(`cloudflare.accounts.${alias}.surfaces: "${surface}" is listed twice`);
+      }
+      seen.add(surface);
+    }
+  }
+}
+function referenceIssues(site) {
+  const issues = [];
+  if (Object.hasOwn(site.zones, APEX_ZONE)) {
+    issues.push(`zones.${APEX_ZONE}: reserved — a host with zone "${APEX_ZONE}" sits on the apex`);
+  }
+  checkHosts(site, issues);
+  for (const [key, cluster] of Object.entries(site.clusters)) {
+    for (const [i, member] of cluster.members.entries()) {
+      checkZonedHost(site, `clusters.${key}.members.${i}`, member, issues);
+    }
+  }
+  for (const [key, product] of Object.entries(site.products)) {
+    if (product.label !== undefined && product.domain !== undefined) {
+      issues.push(`products.${key}: set label OR domain, not both`);
+    }
+  }
+  for (const [key, service] of Object.entries(site.services)) {
+    checkZonedHost(site, `services.${key}.host`, service.host, issues);
+  }
+  checkZonedHost(site, "vault.lan.host", site.vault.lan.host, issues);
+  checkAccounts(site, issues);
+  return issues;
+}
+
+// src/decode.ts
+var strict = Schema3.decodeUnknownExit(SiteSchema, { onExcessProperty: "error", errors: "all" });
+var standard = SchemaIssue.makeFormatterStandardSchemaV1();
+var EXCESS = "Expected no excess property";
+function joinPath(segments) {
+  return segments.map((segment, i) => {
+    if (segment.includes("."))
+      return `[${JSON.stringify(segment)}]`;
+    return i === 0 ? segment : `.${segment}`;
+  }).join("");
+}
+function formatIssues(issue, skip) {
+  return standard(issue).issues.map((entry) => {
+    const segments = (entry.path ?? []).map((part) => typeof part === "object" && part !== null ? String(part.key) : String(part));
+    if (skip !== undefined && segments[0] === skip)
+      segments.shift();
+    const path = segments.length === 0 ? "(root)" : joinPath(segments);
+    const message = entry.message === EXCESS ? "unknown key (a misspelt field, or a record key that is not a lowercase label)" : entry.message;
+    return `${path}: ${message}`;
+  });
+}
+function decodeStrict(input) {
+  const exit = strict(input);
+  if (Exit.isSuccess(exit))
+    return exit.value;
+  const error = Cause.squash(exit.cause);
+  if (Schema3.isSchemaError(error)) {
+    throw new SiteError("decode", "the site file does not match the schema", formatIssues(error.issue));
+  }
+  throw error;
+}
+function validateSite(site, options = {}) {
+  const issues = referenceIssues(site);
+  if (issues.length > 0) {
+    throw new SiteError("reference", "the site file names things it does not declare", issues);
+  }
+  checkDeriveVersion(site, options.installed ?? VERSION);
+  return site;
+}
+function decodeSite(input, options = {}) {
+  return validateSite(decodeStrict(input), options);
+}
+
+export { VERSION, SiteError, unknownKey, lookup, SITE_FORMAT, SiteSchema, checkDeriveVersion, assertStage, addressOn, APEX_ZONE, joinPath, formatIssues, decodeStrict, validateSite, decodeSite };
+
+//# debugId=F23FD3C4E59FE45C64756E2164756E21
+//# sourceMappingURL=index-dvzn0279.js.map

package/dist/index-dvzn0279.js.map

@@ -0,0 +1,17 @@
+{
+  "version": 3,
+  "sources": ["../src/version.ts", "../src/errors.ts", "../src/schema.ts", "../src/primitives.ts", "../src/guards.ts", "../src/decode.ts", "../src/net.ts", "../src/references.ts"],
+  "sourcesContent": [
+    "// ⛔ GENERATED by scripts/sync-versions.ts — do not edit. Source: package.json.\nexport const VERSION: string = '0.1.0';\n",
+    "/**\n * The one error this package throws.\n *\n * ★ ONE CLASS, A `code` TO SWITCH ON. Callers mostly print the message and stop; the few\n *   that branch (a scaffold harness skipping `derive-version` in a dry run, say) branch on\n *   `code`, which is stable, rather than on message text, which is not.\n *\n * ⛔ Messages name paths, keys and the fix — never a value from a live file beyond the\n *   one being complained about. A site file is private, and an error string ends up in CI\n *   logs.\n */\n\nexport type SiteErrorCode =\n  /** The file does not match the schema. `issues` lists `path: problem`. */\n  | 'decode'\n  /** A value points at something the file does not declare (a zone, host, network). */\n  | 'reference'\n  /** A consumer asked for a product, service, zone, host or pin nobody declared. */\n  | 'unknown-key'\n  /** The file was reviewed against a different `@homeflare/site` version. */\n  | 'derive-version'\n  /** A non-live site was asked to plan stage `live`. */\n  | 'stage'\n  /** The observed vault or account is not the one the site describes. */\n  | 'identity'\n  /** The file could not be located, read or parsed. */\n  | 'load'\n  /** The file is not committed on `main` and `siteDev` was not set. */\n  | 'checkout'\n  /** An environment override was refused. */\n  | 'override';\n\nexport class SiteError extends Error {\n  override readonly name = 'SiteError';\n  readonly code: SiteErrorCode;\n  /** One line per problem, each naming its path. Empty when the message says it all. */\n  readonly issues: readonly string[];\n\n  constructor(code: SiteErrorCode, message: string, issues: readonly string[] = []) {\n    super(issues.length === 0 ? message : `${message}\\n  ${issues.join('\\n  ')}`);\n    this.code = code;\n    this.issues = issues;\n  }\n}\n\n/** Throw `unknown-key`, listing what IS declared so the fix is one glance away. */\nexport function unknownKey(kind: string, key: string, declared: Iterable<string>): never {\n  const known = [...declared].sort();\n  const list = known.length === 0 ? 'none are declared' : `declared: ${known.join(', ')}`;\n  throw new SiteError('unknown-key', `unknown ${kind} \"${key}\" (${list})`);\n}\n\n/**\n * Look a key up in a record, or throw `unknown-key`.\n * ⛔ No fallback, ever. A plausible default host is how a typo becomes a live DNS record.\n */\nexport function lookup<V>(kind: string, record: Readonly<Record<string, V>>, key: string): V {\n  if (!Object.hasOwn(record, key)) unknownKey(kind, key, Object.keys(record));\n  return record[key] as V;\n}\n",
+    "/**\n * The site file: BASE VALUES and PINNED values, nothing derived.\n *\n * ★ BASE VALUES are the few things every name is relative to — the apex, a handful of\n *   labels, networks and hosts. `derive()` builds hostnames and addresses from them, so\n *   swapping the apex changes every derived name by substitution and nothing else.\n *\n * ⛔ PINNED VALUES ARE NEVER DERIVED. Physical names (Workers, D1, KV, R2, Durable Objects)\n *   follow no rule, and deriving one would REPLACE it: a derived D1 name deletes the data\n *   behind the old one. Certificate hostnames on adopted certificates reissue and revoke\n *   the certificate a host is still serving if they change. Adopted ids name objects that\n *   already exist. Policy and SSH principal lists are explicit so a break-glass principal\n *   can never vanish because a network leg was renamed.\n *\n * ⛔ UNKNOWN KEYS ARE REFUSED (see decode.ts). A misspelt optional field would otherwise\n *   decode as \"absent\" and the file would look valid while saying less than its author\n *   meant.\n */\nimport * as Effect from 'effect/Effect';\nimport * as Schema from 'effect/Schema';\nimport {\n  AbsolutePath,\n  AccountId,\n  CertificateName,\n  GithubOwner,\n  HostNumber,\n  Hostname,\n  Ipv4,\n  Ipv4Cidr,\n  Label,\n  ListEntry,\n  NonBlank,\n  PhysicalName,\n  PinKey,\n  Port,\n  SemVer,\n} from './primitives.ts';\n\n/** The site file format this package reads. A new format is a new literal, never a reuse. */\nexport const SITE_FORMAT = 1;\n\nconst emptyRecord = <S extends Schema.Top>(schema: S) =>\n  schema.pipe(Schema.withDecodingDefaultKey(Effect.succeed({})));\n\nconst Scheme = Schema.Literals(['http', 'https']);\n\n/**\n * A machine. Its FQDN is `<key>.<zone>`; its address on a network is that network's base\n * plus `legs[network]`.\n * ★ `zone: \"apex\"` places the host directly under the apex (`docs.<apex>`).\n */\nconst Host = Schema.Struct({\n  zone: Schema.optionalKey(Label),\n  aliases: Schema.optionalKey(Schema.Array(Label)),\n  legs: Schema.optionalKey(Schema.Record(Label, HostNumber)),\n});\n\n/** A public product: `<label ?? key>.<apex>`, or its own `domain`. Never both. */\nconst Product = Schema.Struct({\n  label: Schema.optionalKey(Label),\n  domain: Schema.optionalKey(Hostname),\n});\n\n/** An internal endpoint on a declared host. ⛔ The scheme is explicit, never guessed. */\nconst Service = Schema.Struct({ host: Label, port: Port, scheme: Scheme });\n\nconst Account = Schema.Struct({\n  id: AccountId,\n  zones: Schema.Array(Hostname),\n  /** Each surface becomes an OpenBao mount `cloudflare-<alias>-<surface>`. */\n  surfaces: Schema.Array(Label),\n});\n\nconst Vault = Schema.Struct({\n  /** `<vault-host>` = `<label>.<apex>`. */\n  label: Label,\n  /**\n   * `<vault-api-host>` = `<apiLabel>.<vault-host>`.\n   * ⚠️ NOT `vaultApi` beside a `vault` label. Measured 2026-09-21 on effect 4.0.0-rc.115:\n   *   constant-cased env names nest by prefix, so `HF_SITE_VAULT_API` made the provider\n   *   read `vault` as a record and the whole decode failed \"Expected string\". No field\n   *   name here may be another's name plus `_…`; tests/overrides.test.ts asserts it.\n   */\n  apiLabel: Label,\n  /**\n   * ⛔ PINNED IDENTITY: the `cluster_name` the vault reports on `sys/health`. Set at init,\n   *   never derived; plans compare it before touching anything (see identity.ts).\n   */\n  clusterName: NonBlank,\n  namespace: Schema.String.pipe(Schema.withDecodingDefaultKey(Effect.succeed(''))),\n  port: Port.pipe(Schema.withDecodingDefaultKey(Effect.succeed(8200))),\n  /** The vault's address on the private Mesh path. Machines use it; strict TLS applies. */\n  meshAddress: Ipv4,\n  /** The LAN pass-through proxy: a declared host, its port, and its scheme. */\n  lan: Schema.Struct({ host: Label, port: Port, scheme: Scheme }),\n  oidcMount: Label.pipe(Schema.withDecodingDefaultKey(Effect.succeed('oidc'))),\n  /** The port `bao login -method=oidc` listens on for its localhost callback. */\n  cliCallbackPort: Port.pipe(Schema.withDecodingDefaultKey(Effect.succeed(8250))),\n});\n\nconst Pinned = Schema.Struct({\n  names: emptyRecord(Schema.Record(PinKey, PhysicalName)),\n  certificates: emptyRecord(Schema.Record(PinKey, Schema.NonEmptyArray(CertificateName))),\n  adopted: emptyRecord(Schema.Record(PinKey, NonBlank)),\n  policies: emptyRecord(Schema.Record(PinKey, Schema.Array(ListEntry))),\n  sshPrincipals: emptyRecord(Schema.Record(PinKey, Schema.Array(ListEntry))),\n});\n\nexport const SiteSchema = Schema.Struct({\n  /** The file format. Only {@link SITE_FORMAT} decodes. */\n  version: Schema.Literal(SITE_FORMAT),\n  /**\n   * The `@homeflare/site` version whose derive rules this file was reviewed against.\n   * ⛔ A repo refuses to load when its installed package differs (see guards.ts), so a\n   *   derive change can never rename live objects without someone bumping this line.\n   */\n  deriveVersion: SemVer,\n  /** ⛔ Only a `live` site may plan stage `live` (see guards.ts). */\n  kind: Schema.Literals(['live', 'testing', 'example']),\n  apex: Hostname,\n  /**\n   * Zone suffixes under the apex: `{ \"mgmt\": \"mgmt\" }` gives `mgmt.<apex>`.\n   * ⛔ `mgmt` is required (it is `<mgmt-zone>`), and the key `apex` is reserved.\n   */\n  zones: Schema.StructWithRest(Schema.Struct({ mgmt: Label }), [Schema.Record(Label, Label)]),\n  networks: Schema.Record(Label, Ipv4Cidr),\n  hosts: Schema.Record(Label, Host),\n  clusters: emptyRecord(Schema.Record(Label, Schema.Struct({ members: Schema.Array(Label) }))),\n  products: emptyRecord(Schema.Record(Label, Product)),\n  services: emptyRecord(Schema.Record(Label, Service)),\n  cloudflare: Schema.Struct({\n    accounts: Schema.Record(Label, Account),\n    access: Schema.Struct({ team: Label }),\n  }),\n  github: Schema.Struct({ owner: GithubOwner }),\n  paths: Schema.Struct({ estateRoot: AbsolutePath }),\n  vault: Vault,\n  pinned: Pinned.pipe(Schema.withDecodingDefaultKey(Effect.succeed({}))),\n});\n\n/** A decoded site: defaults applied, every value checked. */\nexport type Site = typeof SiteSchema.Type;\n/** What a site file may contain before defaults are applied. */\nexport type SiteInput = typeof SiteSchema.Encoded;\n",
+    "/**\n * The value shapes a site file is made of. Each one refuses at decode time, naming its path,\n * so a typo fails when the file is read rather than when a plan renames something.\n *\n * ⛔ LOWERCASE ONLY for DNS names. Cloudflare, OpenBao and ssh compare names as strings in\n *   places, and `Mgmt.Example.com` is not `mgmt.example.com` to a principal list.\n */\nimport * as Schema from 'effect/Schema';\n\n/** One DNS label: `v`, `mgmt`, `n1`. Also the shape of every key a consumer looks up. */\nexport const Label = Schema.String.check(\n  Schema.isPattern(/^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/, {\n    message: 'Expected a lowercase DNS label (a-z, 0-9, inner hyphens, at most 63)',\n  }),\n);\n\n/** A fully qualified name with at least two labels: `example.com`, `shop.example.net`. */\nexport const Hostname = Schema.String.check(\n  Schema.isPattern(\n    /^(?=.{1,253}$)([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z]([a-z0-9-]{0,61}[a-z0-9])?$/,\n    { message: 'Expected a lowercase fully qualified hostname such as example.com' },\n  ),\n);\n\n/** A certificate name: a hostname, or one leading wildcard label. */\nexport const CertificateName = Schema.String.check(\n  Schema.isPattern(\n    /^(\\*\\.)?([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z]([a-z0-9-]{0,61}[a-z0-9])?$/,\n    { message: 'Expected a hostname, optionally with one leading *. wildcard' },\n  ),\n);\n\nconst OCTET = '(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])';\n\n/** A dotted-quad IPv4 address, every octet 0–255. */\nexport const Ipv4 = Schema.String.check(\n  Schema.isPattern(new RegExp(`^(${OCTET}\\\\.){3}${OCTET}$`), {\n    message: 'Expected an IPv4 address such as 192.0.2.10',\n  }),\n);\n\n/** Parse `a.b.c.d/p` into a 32-bit base and a prefix length. `undefined` when malformed. */\nexport function parseCidr(cidr: string): { base: number; prefix: number } | undefined {\n  const match = new RegExp(`^((${OCTET}\\\\.){3}${OCTET})/([0-9]{1,2})$`).exec(cidr);\n  if (match === null) return undefined;\n  const prefix = Number(match[match.length - 1]);\n  const base = (match[1] ?? '').split('.').reduce((acc, octet) => acc * 256 + Number(octet), 0);\n  return { base, prefix };\n}\n\n/**\n * An IPv4 network, `/8` to `/30`, written at its network address.\n *\n * ⚠️ `192.0.2.5/24` is refused, not normalised. A host address with a prefix usually means\n *   someone pasted an interface address where a network belongs; normalising it would hide\n *   the mistake and derive every leg address from the wrong idea of the network.\n */\nexport const Ipv4Cidr = Schema.String.check(\n  Schema.makeFilter(\n    (value: string) => {\n      const parsed = parseCidr(value);\n      if (parsed === undefined) return 'Expected an IPv4 network such as 192.0.2.0/24';\n      if (parsed.prefix < 8 || parsed.prefix > 30) return 'Expected a prefix between /8 and /30';\n      const hostBits = 2 ** (32 - parsed.prefix);\n      if (parsed.base % hostBits !== 0) return 'Expected the network address (host bits zero)';\n      return undefined;\n    },\n    { expected: 'an IPv4 network' },\n  ),\n);\n\n/** A host's number on a network: `.11` on a /24 is 11. Checked against the prefix later. */\nexport const HostNumber = Schema.Number.check(\n  Schema.isInt(),\n  Schema.isBetween({ minimum: 1, maximum: 16_777_214 }),\n);\n\nexport const Port = Schema.Number.check(\n  Schema.isInt(),\n  Schema.isBetween({ minimum: 1, maximum: 65_535 }),\n);\n\n/** A Cloudflare account id: 32 lowercase hex characters. */\nexport const AccountId = Schema.String.check(\n  Schema.isPattern(/^[0-9a-f]{32}$/, {\n    message: 'Expected a 32-character lowercase hex account id',\n  }),\n);\n\n/** A GitHub user or organisation login. GitHub itself allows uppercase here. */\nexport const GithubOwner = Schema.String.check(\n  Schema.isPattern(/^[A-Za-z0-9]([A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/, {\n    message: 'Expected a GitHub login (letters, digits, inner hyphens)',\n  }),\n);\n\n/** An absolute POSIX path with no trailing slash: `/opt/example`. */\nexport const AbsolutePath = Schema.String.check(\n  Schema.isPattern(/^(\\/[^/\\0]+)+$/, {\n    message: 'Expected an absolute path without a trailing slash',\n  }),\n);\n\n/** A semver version, as npm writes one: `0.1.0`, `1.0.0-rc.1`. */\nexport const SemVer = Schema.String.check(\n  Schema.isPattern(/^\\d+\\.\\d+\\.\\d+(-[0-9A-Za-z.-]+)?$/, { message: 'Expected a semver version' }),\n);\n\n/** A key into a `pinned` table: `alerts.d1`, `ssh-host.host`. Dotted, lowercase. */\nexport const PinKey = Schema.String.check(\n  Schema.isPattern(/^[a-z0-9]+([._-][a-z0-9]+)*$/, {\n    message: 'Expected a lowercase dotted key such as alerts.d1',\n  }),\n);\n\n/**\n * A physical resource name: Worker, D1, KV, R2, Durable Object class.\n * ★ Case is allowed because Durable Object bindings name PascalCase classes.\n */\nexport const PhysicalName = Schema.String.check(\n  Schema.isPattern(/^[A-Za-z0-9][A-Za-z0-9._-]*$/, {\n    message: 'Expected a resource name (letters, digits, dot, dash, underscore)',\n  }),\n);\n\n/**\n * One SSH principal or policy entry.\n * ⛔ No commas and no whitespace. OpenBao stores principal lists comma-joined, so an entry\n *   holding a comma silently becomes two principals, and a stray space becomes a name no\n *   host will ever present.\n */\nexport const ListEntry = Schema.String.check(\n  Schema.isPattern(/^[^\\s,]+$/, { message: 'Expected one entry with no commas or whitespace' }),\n);\n\n/** A free-form identifier that must not be blank: cluster names, adopted ids, CNs. */\nexport const NonBlank = Schema.String.check(\n  Schema.isPattern(/^\\S(.*\\S)?$/, { message: 'Expected a non-blank value without edge spaces' }),\n);\n",
+    "/**\n * Guards that refuse a plan before it can touch the wrong thing.\n *\n * ⛔ EACH ONE FAILS CLOSED. A guard that warns is a guard nobody reads in a CI log.\n */\nimport { SiteError } from './errors.ts';\nimport type { Site } from './schema.ts';\n\n/**\n * Refuse a site reviewed against a different `@homeflare/site` than the one installed.\n *\n * ★ WHY EXACT EQUALITY. Derive rules are this package's behaviour. If a new version builds\n *   one hostname differently, every repo on it would plan a rename — a REPLACE — without\n *   anyone having looked. Holding `deriveVersion` equal to the installed version makes that\n *   a deliberate, reviewed one-line bump in the site file instead.\n */\nexport function checkDeriveVersion(site: Site, installed: string): void {\n  if (site.deriveVersion === installed) return;\n  throw new SiteError(\n    'derive-version',\n    `the site file was reviewed against @homeflare/site ${site.deriveVersion}, ` +\n      `but ${installed} is installed. Read the CHANGELOG between them for derive changes, ` +\n      `then set \"deriveVersion\": \"${installed}\" — or install ${site.deriveVersion}.`,\n  );\n}\n\n/** Stages as a deploy tool names them. Only `live` is special here. */\nexport type Stage = string;\n\n/**\n * ⛔ STAGE `live` ONLY WITH A LIVE SITE. An example or testing site can never plan\n *   against live state — its account ids and cluster name are placeholders, and a plan\n *   against real state would read every live object as \"not declared: delete\".\n */\nexport function assertStage(site: Site, stage: Stage): void {\n  if (stage !== 'live' || site.kind === 'live') return;\n  throw new SiteError(\n    'stage',\n    `stage \"live\" needs a live site; this one is kind \"${site.kind}\". ` +\n      `Point HF_SITE_FILE at the live site file, or plan a non-live stage.`,\n  );\n}\n",
+    "/**\n * Decode a site from plain data. Runtime-neutral: no filesystem, no environment.\n *\n * ★ Workers and scripts that already hold the JSON (a binding, a fetched file) call\n *   `decodeSite`. Scripts that read `HF_SITE_FILE` call `loadSite` from\n *   `@homeflare/site/load`, which ends up here too.\n */\nimport * as Cause from 'effect/Cause';\nimport * as Exit from 'effect/Exit';\nimport * as Schema from 'effect/Schema';\nimport * as SchemaIssue from 'effect/SchemaIssue';\nimport { SiteError } from './errors.ts';\nimport { checkDeriveVersion } from './guards.ts';\nimport { referenceIssues } from './references.ts';\nimport { type Site, SiteSchema } from './schema.ts';\nimport { VERSION } from './version.ts';\n\n/**\n * ⛔ `onExcessProperty: 'error'` IS LOAD-BEARING, twice over. Measured 2026-09-21 on\n *   effect 4.0.0-rc.115: with the default (`ignore`), a misspelt field is dropped, AND a\n *   record entry whose key fails the key schema (`\"Mgmt\"` in `networks`) is dropped too —\n *   the file decodes, one network short, with no error at all.\n * ⚠️ With it on, that bad record key reports as \"excess property\", which reads oddly.\n *   `formatIssues` rewrites it to say what it actually means.\n */\nconst strict = Schema.decodeUnknownExit(SiteSchema, { onExcessProperty: 'error', errors: 'all' });\nconst standard = SchemaIssue.makeFormatterStandardSchemaV1();\n\nconst EXCESS = 'Expected no excess property';\n\n/**\n * `pinned.certificates[\"vault.origin\"].0` — a key that itself holds a dot is bracketed,\n * or the path would read as two levels that do not exist.\n */\nexport function joinPath(segments: readonly string[]): string {\n  return segments\n    .map((segment, i) => {\n      if (segment.includes('.')) return `[${JSON.stringify(segment)}]`;\n      return i === 0 ? segment : `.${segment}`;\n    })\n    .join('');\n}\n\n/** Render a schema issue as `path: problem` lines, dropping a leading `skip` segment. */\nexport function formatIssues(issue: SchemaIssue.Issue, skip?: string): readonly string[] {\n  return standard(issue).issues.map((entry) => {\n    const segments = (entry.path ?? []).map((part) =>\n      typeof part === 'object' && part !== null ? String(part.key) : String(part),\n    );\n    if (skip !== undefined && segments[0] === skip) segments.shift();\n    const path = segments.length === 0 ? '(root)' : joinPath(segments);\n    const message =\n      entry.message === EXCESS\n        ? 'unknown key (a misspelt field, or a record key that is not a lowercase label)'\n        : entry.message;\n    return `${path}: ${message}`;\n  });\n}\n\n/** Schema-only decode. Throws `decode` listing every problem, each with its path. */\nexport function decodeStrict(input: unknown): Site {\n  const exit = strict(input);\n  if (Exit.isSuccess(exit)) return exit.value;\n  const error = Cause.squash(exit.cause);\n  if (Schema.isSchemaError(error)) {\n    throw new SiteError(\n      'decode',\n      'the site file does not match the schema',\n      formatIssues(error.issue),\n    );\n  }\n  throw error;\n}\n\nexport interface ValidateOptions {\n  /**\n   * The `@homeflare/site` version to hold `deriveVersion` against. Defaults to the\n   * installed one — which is the point; override only to test the refusal.\n   */\n  readonly installed?: string;\n}\n\n/** Cross-field references, then the derive-version guard. Returns the same site. */\nexport function validateSite(site: Site, options: ValidateOptions = {}): Site {\n  const issues = referenceIssues(site);\n  if (issues.length > 0) {\n    throw new SiteError('reference', 'the site file names things it does not declare', issues);\n  }\n  checkDeriveVersion(site, options.installed ?? VERSION);\n  return site;\n}\n\n/**\n * Decode and validate a site from plain data (already-parsed JSON).\n * Throws {@link SiteError}: `decode`, `reference` or `derive-version`.\n */\nexport function decodeSite(input: unknown, options: ValidateOptions = {}): Site {\n  return validateSite(decodeStrict(input), options);\n}\n",
+    "/**\n * IPv4 arithmetic for leg addresses: a network's base plus a host number.\n *\n * ★ WHY A HOST NUMBER AND NOT A LAST OCTET. On a /24 they are the same thing, and that is\n *   the common case. On a /23 or a /16 a \"last octet\" is ambiguous, while \"the 11th\n *   address after the network address\" is not. The /24 reading stays exact.\n */\nimport { parseCidr } from './primitives.ts';\n\nfunction dotted(value: number): string {\n  return [24, 16, 8, 0].map((shift) => Math.floor(value / 2 ** shift) % 256).join('.');\n}\n\n/** The largest usable host number on a network (the broadcast address is excluded). */\nexport function lastHostNumber(cidr: string): number {\n  const parsed = parseCidr(cidr);\n  if (parsed === undefined) throw new Error(`not an IPv4 network: ${cidr}`);\n  return 2 ** (32 - parsed.prefix) - 2;\n}\n\n/** `addressOn('192.0.2.0/24', 11)` is `192.0.2.11`. */\nexport function addressOn(cidr: string, hostNumber: number): string {\n  const parsed = parseCidr(cidr);\n  if (parsed === undefined) throw new Error(`not an IPv4 network: ${cidr}`);\n  if (hostNumber < 1 || hostNumber > lastHostNumber(cidr)) {\n    throw new Error(`host number ${hostNumber} does not fit ${cidr}`);\n  }\n  return dotted(parsed.base + hostNumber);\n}\n",
+    "/**\n * Checks that span fields: every zone, host and network a value names is declared.\n *\n * ★ WHY NOT IN THE SCHEMA. A struct-level filter reports one issue at the struct's own\n *   path; these checks want to name the exact field (`services.grafana.host`), and they\n *   want to report every broken reference at once rather than the first.\n */\nimport { lastHostNumber } from './net.ts';\nimport type { Site } from './schema.ts';\n\n/** The zone key that means the apex itself. Reserved: a site may not declare it. */\nexport const APEX_ZONE = 'apex';\n\nfunction hostHasZone(site: Site, host: string): boolean {\n  return Object.hasOwn(site.hosts, host) && site.hosts[host]?.zone !== undefined;\n}\n\nfunction checkHosts(site: Site, issues: string[]): void {\n  for (const [key, host] of Object.entries(site.hosts)) {\n    const zone = host.zone;\n    if (zone !== undefined && zone !== APEX_ZONE && !Object.hasOwn(site.zones, zone)) {\n      issues.push(`hosts.${key}.zone: \"${zone}\" is not a declared zone or \"${APEX_ZONE}\"`);\n    }\n    for (const [network, number] of Object.entries(host.legs ?? {})) {\n      const cidr = site.networks[network];\n      if (cidr === undefined) {\n        issues.push(`hosts.${key}.legs.${network}: \"${network}\" is not a declared network`);\n      } else if (number > lastHostNumber(cidr)) {\n        issues.push(`hosts.${key}.legs.${network}: host number ${number} does not fit ${network}`);\n      }\n    }\n  }\n}\n\nfunction checkZonedHost(site: Site, path: string, host: string, issues: string[]): void {\n  if (!Object.hasOwn(site.hosts, host)) {\n    issues.push(`${path}: \"${host}\" is not a declared host`);\n  } else if (!hostHasZone(site, host)) {\n    issues.push(`${path}: host \"${host}\" has no zone, so it has no hostname`);\n  }\n}\n\nfunction checkAccounts(site: Site, issues: string[]): void {\n  for (const [alias, account] of Object.entries(site.cloudflare.accounts)) {\n    const seen = new Set<string>();\n    for (const surface of account.surfaces) {\n      // ⚠️ A repeated surface derives the same mount name twice; the second declaration\n      //   would silently be the same mount, so a typo'd duplicate is refused here.\n      if (seen.has(surface)) {\n        issues.push(`cloudflare.accounts.${alias}.surfaces: \"${surface}\" is listed twice`);\n      }\n      seen.add(surface);\n    }\n  }\n}\n\n/** Every broken reference in `site`, each naming its path. Empty when the site is sound. */\nexport function referenceIssues(site: Site): readonly string[] {\n  const issues: string[] = [];\n\n  if (Object.hasOwn(site.zones, APEX_ZONE)) {\n    issues.push(`zones.${APEX_ZONE}: reserved — a host with zone \"${APEX_ZONE}\" sits on the apex`);\n  }\n  checkHosts(site, issues);\n  for (const [key, cluster] of Object.entries(site.clusters)) {\n    for (const [i, member] of cluster.members.entries()) {\n      checkZonedHost(site, `clusters.${key}.members.${i}`, member, issues);\n    }\n  }\n  for (const [key, product] of Object.entries(site.products)) {\n    if (product.label !== undefined && product.domain !== undefined) {\n      issues.push(`products.${key}: set label OR domain, not both`);\n    }\n  }\n  for (const [key, service] of Object.entries(site.services)) {\n    checkZonedHost(site, `services.${key}.host`, service.host, issues);\n  }\n  checkZonedHost(site, 'vault.lan.host', site.vault.lan.host, issues);\n  checkAccounts(site, issues);\n\n  return issues;\n}\n"
+  ],
+  "mappings": ";AACO,IAAM,UAAkB;;;AC+BxB,MAAM,kBAAkB,MAAM;AAAA,EACjB,OAAO;AAAA,EAChB;AAAA,EAEA;AAAA,EAET,WAAW,CAAC,MAAqB,SAAiB,SAA4B,CAAC,GAAG;AAAA,IAChF,MAAM,OAAO,WAAW,IAAI,UAAU,GAAG;AAAA,IAAc,OAAO,KAAK;AAAA,GAAM,GAAG;AAAA,IAC5E,KAAK,OAAO;AAAA,IACZ,KAAK,SAAS;AAAA;AAElB;AAGO,SAAS,UAAU,CAAC,MAAc,KAAa,UAAmC;AAAA,EACvF,MAAM,QAAQ,CAAC,GAAG,QAAQ,EAAE,KAAK;AAAA,EACjC,MAAM,OAAO,MAAM,WAAW,IAAI,sBAAsB,aAAa,MAAM,KAAK,IAAI;AAAA,EACpF,MAAM,IAAI,UAAU,eAAe,WAAW,SAAS,SAAS,OAAO;AAAA;AAOlE,SAAS,MAAS,CAAC,MAAc,QAAqC,KAAgB;AAAA,EAC3F,IAAI,CAAC,OAAO,OAAO,QAAQ,GAAG;AAAA,IAAG,WAAW,MAAM,KAAK,OAAO,KAAK,MAAM,CAAC;AAAA,EAC1E,OAAO,OAAO;AAAA;;;ACxChB;AACA;;;ACZA;AAGO,IAAM,QAAe,cAAO,MAC1B,iBAAU,wCAAwC;AAAA,EACvD,SAAS;AACX,CAAC,CACH;AAGO,IAAM,WAAkB,cAAO,MAC7B,iBACL,yFACA,EAAE,SAAS,oEAAoE,CACjF,CACF;AAGO,IAAM,kBAAyB,cAAO,MACpC,iBACL,mFACA,EAAE,SAAS,+DAA+D,CAC5E,CACF;AAEA,IAAM,QAAQ;AAGP,IAAM,OAAc,cAAO,MACzB,iBAAU,IAAI,OAAO,KAAK,eAAe,QAAQ,GAAG;AAAA,EACzD,SAAS;AACX,CAAC,CACH;AAGO,SAAS,SAAS,CAAC,MAA4D;AAAA,EACpF,MAAM,QAAQ,IAAI,OAAO,MAAM,eAAe,sBAAsB,EAAE,KAAK,IAAI;AAAA,EAC/E,IAAI,UAAU;AAAA,IAAM;AAAA,EACpB,MAAM,SAAS,OAAO,MAAM,MAAM,SAAS,EAAE;AAAA,EAC7C,MAAM,QAAQ,MAAM,MAAM,IAAI,MAAM,GAAG,EAAE,OAAO,CAAC,KAAK,UAAU,MAAM,MAAM,OAAO,KAAK,GAAG,CAAC;AAAA,EAC5F,OAAO,EAAE,MAAM,OAAO;AAAA;AAUjB,IAAM,WAAkB,cAAO,MAC7B,kBACL,CAAC,UAAkB;AAAA,EACjB,MAAM,SAAS,UAAU,KAAK;AAAA,EAC9B,IAAI,WAAW;AAAA,IAAW,OAAO;AAAA,EACjC,IAAI,OAAO,SAAS,KAAK,OAAO,SAAS;AAAA,IAAI,OAAO;AAAA,EACpD,MAAM,WAAW,MAAM,KAAK,OAAO;AAAA,EACnC,IAAI,OAAO,OAAO,aAAa;AAAA,IAAG,OAAO;AAAA,EACzC;AAAA,GAEF,EAAE,UAAU,kBAAkB,CAChC,CACF;AAGO,IAAM,aAAoB,cAAO,MAC/B,aAAM,GACN,iBAAU,EAAE,SAAS,GAAG,SAAS,SAAW,CAAC,CACtD;AAEO,IAAM,OAAc,cAAO,MACzB,aAAM,GACN,iBAAU,EAAE,SAAS,GAAG,SAAS,MAAO,CAAC,CAClD;AAGO,IAAM,YAAmB,cAAO,MAC9B,iBAAU,kBAAkB;AAAA,EACjC,SAAS;AACX,CAAC,CACH;AAGO,IAAM,cAAqB,cAAO,MAChC,iBAAU,iDAAiD;AAAA,EAChE,SAAS;AACX,CAAC,CACH;AAGO,IAAM,eAAsB,cAAO,MACjC,iBAAU,kBAAkB;AAAA,EACjC,SAAS;AACX,CAAC,CACH;AAGO,IAAM,SAAgB,cAAO,MAC3B,iBAAU,qCAAqC,EAAE,SAAS,4BAA4B,CAAC,CAChG;AAGO,IAAM,SAAgB,cAAO,MAC3B,iBAAU,gCAAgC;AAAA,EAC/C,SAAS;AACX,CAAC,CACH;AAMO,IAAM,eAAsB,cAAO,MACjC,iBAAU,gCAAgC;AAAA,EAC/C,SAAS;AACX,CAAC,CACH;AAQO,IAAM,YAAmB,cAAO,MAC9B,iBAAU,aAAa,EAAE,SAAS,kDAAkD,CAAC,CAC9F;AAGO,IAAM,WAAkB,cAAO,MAC7B,iBAAU,eAAe,EAAE,SAAS,iDAAiD,CAAC,CAC/F;;;ADnGO,IAAM,cAAc;AAE3B,IAAM,cAAc,CAAuB,WACzC,OAAO,KAAY,+BAA8B,eAAQ,CAAC,CAAC,CAAC,CAAC;AAE/D,IAAM,SAAgB,iBAAS,CAAC,QAAQ,OAAO,CAAC;AAOhD,IAAM,OAAc,eAAO;AAAA,EACzB,MAAa,oBAAY,KAAK;AAAA,EAC9B,SAAgB,oBAAmB,cAAM,KAAK,CAAC;AAAA,EAC/C,MAAa,oBAAmB,eAAO,OAAO,UAAU,CAAC;AAC3D,CAAC;AAGD,IAAM,UAAiB,eAAO;AAAA,EAC5B,OAAc,oBAAY,KAAK;AAAA,EAC/B,QAAe,oBAAY,QAAQ;AACrC,CAAC;AAGD,IAAM,UAAiB,eAAO,EAAE,MAAM,OAAO,MAAM,MAAM,QAAQ,OAAO,CAAC;AAEzE,IAAM,UAAiB,eAAO;AAAA,EAC5B,IAAI;AAAA,EACJ,OAAc,cAAM,QAAQ;AAAA,EAE5B,UAAiB,cAAM,KAAK;AAC9B,CAAC;AAED,IAAM,QAAe,eAAO;AAAA,EAE1B,OAAO;AAAA,EAQP,UAAU;AAAA,EAKV,aAAa;AAAA,EACb,WAAkB,eAAO,KAAY,+BAA8B,eAAQ,EAAE,CAAC,CAAC;AAAA,EAC/E,MAAM,KAAK,KAAY,+BAA8B,eAAQ,IAAI,CAAC,CAAC;AAAA,EAEnE,aAAa;AAAA,EAEb,KAAY,eAAO,EAAE,MAAM,OAAO,MAAM,MAAM,QAAQ,OAAO,CAAC;AAAA,EAC9D,WAAW,MAAM,KAAY,+BAA8B,eAAQ,MAAM,CAAC,CAAC;AAAA,EAE3E,iBAAiB,KAAK,KAAY,+BAA8B,eAAQ,IAAI,CAAC,CAAC;AAChF,CAAC;AAED,IAAM,SAAgB,eAAO;AAAA,EAC3B,OAAO,YAAmB,eAAO,QAAQ,YAAY,CAAC;AAAA,EACtD,cAAc,YAAmB,eAAO,QAAe,sBAAc,eAAe,CAAC,CAAC;AAAA,EACtF,SAAS,YAAmB,eAAO,QAAQ,QAAQ,CAAC;AAAA,EACpD,UAAU,YAAmB,eAAO,QAAe,cAAM,SAAS,CAAC,CAAC;AAAA,EACpE,eAAe,YAAmB,eAAO,QAAe,cAAM,SAAS,CAAC,CAAC;AAC3E,CAAC;AAEM,IAAM,aAAoB,eAAO;AAAA,EAEtC,SAAgB,gBAAQ,WAAW;AAAA,EAMnC,eAAe;AAAA,EAEf,MAAa,iBAAS,CAAC,QAAQ,WAAW,SAAS,CAAC;AAAA,EACpD,MAAM;AAAA,EAKN,OAAc,uBAAsB,eAAO,EAAE,MAAM,MAAM,CAAC,GAAG,CAAQ,eAAO,OAAO,KAAK,CAAC,CAAC;AAAA,EAC1F,UAAiB,eAAO,OAAO,QAAQ;AAAA,EACvC,OAAc,eAAO,OAAO,IAAI;AAAA,EAChC,UAAU,YAAmB,eAAO,OAAc,eAAO,EAAE,SAAgB,cAAM,KAAK,EAAE,CAAC,CAAC,CAAC;AAAA,EAC3F,UAAU,YAAmB,eAAO,OAAO,OAAO,CAAC;AAAA,EACnD,UAAU,YAAmB,eAAO,OAAO,OAAO,CAAC;AAAA,EACnD,YAAmB,eAAO;AAAA,IACxB,UAAiB,eAAO,OAAO,OAAO;AAAA,IACtC,QAAe,eAAO,EAAE,MAAM,MAAM,CAAC;AAAA,EACvC,CAAC;AAAA,EACD,QAAe,eAAO,EAAE,OAAO,YAAY,CAAC;AAAA,EAC5C,OAAc,eAAO,EAAE,YAAY,aAAa,CAAC;AAAA,EACjD,OAAO;AAAA,EACP,QAAQ,OAAO,KAAY,+BAA8B,eAAQ,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;;;AE1HM,SAAS,kBAAkB,CAAC,MAAY,WAAyB;AAAA,EACtE,IAAI,KAAK,kBAAkB;AAAA,IAAW;AAAA,EACtC,MAAM,IAAI,UACR,kBACA,sDAAsD,KAAK,oBACzD,OAAO,iFACP,8BAA8B,2BAA2B,KAAK,gBAClE;AAAA;AAWK,SAAS,WAAW,CAAC,MAAY,OAAoB;AAAA,EAC1D,IAAI,UAAU,UAAU,KAAK,SAAS;AAAA,IAAQ;AAAA,EAC9C,MAAM,IAAI,UACR,SACA,qDAAqD,KAAK,YACxD,qEACJ;AAAA;;;ACjCF;AACA;AACA;AACA;;;ACDA,SAAS,MAAM,CAAC,OAAuB;AAAA,EACrC,OAAO,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,CAAC,UAAU,KAAK,MAAM,QAAQ,KAAK,KAAK,IAAI,GAAG,EAAE,KAAK,GAAG;AAAA;AAI9E,SAAS,cAAc,CAAC,MAAsB;AAAA,EACnD,MAAM,SAAS,UAAU,IAAI;AAAA,EAC7B,IAAI,WAAW;AAAA,IAAW,MAAM,IAAI,MAAM,wBAAwB,MAAM;AAAA,EACxE,OAAO,MAAM,KAAK,OAAO,UAAU;AAAA;AAI9B,SAAS,SAAS,CAAC,MAAc,YAA4B;AAAA,EAClE,MAAM,SAAS,UAAU,IAAI;AAAA,EAC7B,IAAI,WAAW;AAAA,IAAW,MAAM,IAAI,MAAM,wBAAwB,MAAM;AAAA,EACxE,IAAI,aAAa,KAAK,aAAa,eAAe,IAAI,GAAG;AAAA,IACvD,MAAM,IAAI,MAAM,eAAe,2BAA2B,MAAM;AAAA,EAClE;AAAA,EACA,OAAO,OAAO,OAAO,OAAO,UAAU;AAAA;;;AChBjC,IAAM,YAAY;AAEzB,SAAS,WAAW,CAAC,MAAY,MAAuB;AAAA,EACtD,OAAO,OAAO,OAAO,KAAK,OAAO,IAAI,KAAK,KAAK,MAAM,OAAO,SAAS;AAAA;AAGvE,SAAS,UAAU,CAAC,MAAY,QAAwB;AAAA,EACtD,YAAY,KAAK,SAAS,OAAO,QAAQ,KAAK,KAAK,GAAG;AAAA,IACpD,MAAM,OAAO,KAAK;AAAA,IAClB,IAAI,SAAS,aAAa,SAAS,aAAa,CAAC,OAAO,OAAO,KAAK,OAAO,IAAI,GAAG;AAAA,MAChF,OAAO,KAAK,SAAS,cAAc,oCAAoC,YAAY;AAAA,IACrF;AAAA,IACA,YAAY,SAAS,WAAW,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,GAAG;AAAA,MAC/D,MAAM,OAAO,KAAK,SAAS;AAAA,MAC3B,IAAI,SAAS,WAAW;AAAA,QACtB,OAAO,KAAK,SAAS,YAAY,aAAa,oCAAoC;AAAA,MACpF,EAAO,SAAI,SAAS,eAAe,IAAI,GAAG;AAAA,QACxC,OAAO,KAAK,SAAS,YAAY,wBAAwB,uBAAuB,SAAS;AAAA,MAC3F;AAAA,IACF;AAAA,EACF;AAAA;AAGF,SAAS,cAAc,CAAC,MAAY,MAAc,MAAc,QAAwB;AAAA,EACtF,IAAI,CAAC,OAAO,OAAO,KAAK,OAAO,IAAI,GAAG;AAAA,IACpC,OAAO,KAAK,GAAG,UAAU,8BAA8B;AAAA,EACzD,EAAO,SAAI,CAAC,YAAY,MAAM,IAAI,GAAG;AAAA,IACnC,OAAO,KAAK,GAAG,eAAe,0CAA0C;AAAA,EAC1E;AAAA;AAGF,SAAS,aAAa,CAAC,MAAY,QAAwB;AAAA,EACzD,YAAY,OAAO,YAAY,OAAO,QAAQ,KAAK,WAAW,QAAQ,GAAG;AAAA,IACvE,MAAM,OAAO,IAAI;AAAA,IACjB,WAAW,WAAW,QAAQ,UAAU;AAAA,MAGtC,IAAI,KAAK,IAAI,OAAO,GAAG;AAAA,QACrB,OAAO,KAAK,uBAAuB,oBAAoB,0BAA0B;AAAA,MACnF;AAAA,MACA,KAAK,IAAI,OAAO;AAAA,IAClB;AAAA,EACF;AAAA;AAIK,SAAS,eAAe,CAAC,MAA+B;AAAA,EAC7D,MAAM,SAAmB,CAAC;AAAA,EAE1B,IAAI,OAAO,OAAO,KAAK,OAAO,SAAS,GAAG;AAAA,IACxC,OAAO,KAAK,SAAS,2CAA2C,6BAA6B;AAAA,EAC/F;AAAA,EACA,WAAW,MAAM,MAAM;AAAA,EACvB,YAAY,KAAK,YAAY,OAAO,QAAQ,KAAK,QAAQ,GAAG;AAAA,IAC1D,YAAY,GAAG,WAAW,QAAQ,QAAQ,QAAQ,GAAG;AAAA,MACnD,eAAe,MAAM,YAAY,eAAe,KAAK,QAAQ,MAAM;AAAA,IACrE;AAAA,EACF;AAAA,EACA,YAAY,KAAK,YAAY,OAAO,QAAQ,KAAK,QAAQ,GAAG;AAAA,IAC1D,IAAI,QAAQ,UAAU,aAAa,QAAQ,WAAW,WAAW;AAAA,MAC/D,OAAO,KAAK,YAAY,oCAAoC;AAAA,IAC9D;AAAA,EACF;AAAA,EACA,YAAY,KAAK,YAAY,OAAO,QAAQ,KAAK,QAAQ,GAAG;AAAA,IAC1D,eAAe,MAAM,YAAY,YAAY,QAAQ,MAAM,MAAM;AAAA,EACnE;AAAA,EACA,eAAe,MAAM,kBAAkB,KAAK,MAAM,IAAI,MAAM,MAAM;AAAA,EAClE,cAAc,MAAM,MAAM;AAAA,EAE1B,OAAO;AAAA;;;AFvDT,IAAM,SAAgB,0BAAkB,YAAY,EAAE,kBAAkB,SAAS,QAAQ,MAAM,CAAC;AAChG,IAAM,WAAuB,0CAA8B;AAE3D,IAAM,SAAS;AAMR,SAAS,QAAQ,CAAC,UAAqC;AAAA,EAC5D,OAAO,SACJ,IAAI,CAAC,SAAS,MAAM;AAAA,IACnB,IAAI,QAAQ,SAAS,GAAG;AAAA,MAAG,OAAO,IAAI,KAAK,UAAU,OAAO;AAAA,IAC5D,OAAO,MAAM,IAAI,UAAU,IAAI;AAAA,GAChC,EACA,KAAK,EAAE;AAAA;AAIL,SAAS,YAAY,CAAC,OAA0B,MAAkC;AAAA,EACvF,OAAO,SAAS,KAAK,EAAE,OAAO,IAAI,CAAC,UAAU;AAAA,IAC3C,MAAM,YAAY,MAAM,QAAQ,CAAC,GAAG,IAAI,CAAC,SACvC,OAAO,SAAS,YAAY,SAAS,OAAO,OAAO,KAAK,GAAG,IAAI,OAAO,IAAI,CAC5E;AAAA,IACA,IAAI,SAAS,aAAa,SAAS,OAAO;AAAA,MAAM,SAAS,MAAM;AAAA,IAC/D,MAAM,OAAO,SAAS,WAAW,IAAI,WAAW,SAAS,QAAQ;AAAA,IACjE,MAAM,UACJ,MAAM,YAAY,SACd,kFACA,MAAM;AAAA,IACZ,OAAO,GAAG,SAAS;AAAA,GACpB;AAAA;AAII,SAAS,YAAY,CAAC,OAAsB;AAAA,EACjD,MAAM,OAAO,OAAO,KAAK;AAAA,EACzB,IAAS,eAAU,IAAI;AAAA,IAAG,OAAO,KAAK;AAAA,EACtC,MAAM,QAAc,aAAO,KAAK,KAAK;AAAA,EACrC,IAAW,sBAAc,KAAK,GAAG;AAAA,IAC/B,MAAM,IAAI,UACR,UACA,2CACA,aAAa,MAAM,KAAK,CAC1B;AAAA,EACF;AAAA,EACA,MAAM;AAAA;AAYD,SAAS,YAAY,CAAC,MAAY,UAA2B,CAAC,GAAS;AAAA,EAC5E,MAAM,SAAS,gBAAgB,IAAI;AAAA,EACnC,IAAI,OAAO,SAAS,GAAG;AAAA,IACrB,MAAM,IAAI,UAAU,aAAa,kDAAkD,MAAM;AAAA,EAC3F;AAAA,EACA,mBAAmB,MAAM,QAAQ,aAAa,OAAO;AAAA,EACrD,OAAO;AAAA;AAOF,SAAS,UAAU,CAAC,OAAgB,UAA2B,CAAC,GAAS;AAAA,EAC9E,OAAO,aAAa,aAAa,KAAK,GAAG,OAAO;AAAA;",
+  "debugId": "F23FD3C4E59FE45C64756E2164756E21",
+  "names": []
+}

package/dist/index.d.ts

@@ -0,0 +1,25 @@
+/**
+ * @homeflare/site — one typed site config, and every name derived from it.
+ *
+ * ★ WHY. A public stack that types a hostname cannot be run by anyone else, and a stack
+ *   that re-derives a name its own way drifts from its siblings. Here the site file holds
+ *   the base values once; `derive()` builds every hostname, address and mount name the
+ *   same way in every repo; and names that must never follow a rule are PINNED.
+ *
+ *     import { decodeSite, derive } from '@homeflare/site';        // runtime-neutral
+ *     import { loadSite } from '@homeflare/site/load';              // Node / Bun: HF_SITE_FILE
+ *
+ * ⛔ RUNTIME-NEUTRAL. Nothing reachable from this file touches `node:*`, `bun:*`, the
+ *   filesystem or the environment. File and env reading live in `./load.ts`.
+ */
+export { VERSION } from './version.ts';
+export { SiteError, type SiteErrorCode } from './errors.ts';
+export { SITE_FORMAT, type Site, type SiteInput, SiteSchema } from './schema.ts';
+export { type ValidateOptions, decodeSite, validateSite } from './decode.ts';
+export { type Derived, type DerivedAccess, type DerivedHost, type DerivedVault, derive, } from './derive.ts';
+export { type Pins, pins } from './pins.ts';
+export { inventory, pinnedPrincipalIssues, unknownPrincipals } from './inventory.ts';
+export { type Stage, assertStage, checkDeriveVersion } from './guards.ts';
+export { type ExpectedIdentityOptions, type Identity, type IdentityMismatch, assertIdentity, compareIdentity, expectedIdentity, } from './identity.ts';
+export { SITE_TOKENS, type SiteToken, type ValuedToken, renderTokens, tokenValues, } from './tokens.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE,KAAK,SAAS,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,KAAK,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,EACL,KAAK,OAAO,EACZ,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,MAAM,GACP,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,KAAK,IAAI,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACrF,OAAO,EAAE,KAAK,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,cAAc,EACd,eAAe,EACf,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,WAAW,EACX,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,YAAY,EACZ,WAAW,GACZ,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,238 @@
+import {
+  APEX_ZONE,
+  SITE_FORMAT,
+  SiteError,
+  SiteSchema,
+  VERSION,
+  addressOn,
+  assertStage,
+  checkDeriveVersion,
+  decodeSite,
+  joinPath,
+  lookup,
+  unknownKey,
+  validateSite
+} from "./index-dvzn0279.js";
+// src/derive.ts
+function zoneOf(site, key) {
+  if (key === APEX_ZONE)
+    return site.apex;
+  return `${lookup("zone", site.zones, key)}.${site.apex}`;
+}
+function deriveHosts(site) {
+  const out = {};
+  for (const [key, host] of Object.entries(site.hosts)) {
+    const addresses = {};
+    for (const [network, number] of Object.entries(host.legs ?? {})) {
+      addresses[network] = addressOn(lookup("network", site.networks, network), number);
+    }
+    out[key] = {
+      ...host.zone === undefined ? {} : { fqdn: `${key}.${zoneOf(site, host.zone)}` },
+      addresses
+    };
+  }
+  return out;
+}
+function mapRecord(record, f) {
+  const out = {};
+  for (const [key, value] of Object.entries(record))
+    out[key] = f(value, key);
+  return out;
+}
+function derive(site) {
+  const hosts = deriveHosts(site);
+  const hostFqdn = (key) => {
+    const fqdn = lookup("host", hosts, key).fqdn;
+    if (fqdn === undefined) {
+      throw new SiteError("unknown-key", `host "${key}" has no zone, so it has no hostname`);
+    }
+    return fqdn;
+  };
+  const vaultHost = `${site.vault.label}.${site.apex}`;
+  const apiHost = `${site.vault.apiLabel}.${vaultHost}`;
+  const { lan } = site.vault;
+  const teamDomain = `https://${site.cloudflare.access.team}.cloudflareaccess.com`;
+  const products = mapRecord(site.products, (p, key) => p.domain ?? `${p.label ?? key}.${site.apex}`);
+  const services = mapRecord(site.services, (s) => `${s.scheme}://${hostFqdn(s.host)}:${s.port}`);
+  const clusters = mapRecord(site.clusters, (c) => c.members.map(hostFqdn));
+  const accounts = site.cloudflare.accounts;
+  const cloudflareMounts = Object.entries(accounts).flatMap(([alias, account]) => account.surfaces.map((surface) => `cloudflare-${alias}-${surface}`));
+  return {
+    apex: site.apex,
+    zones: mapRecord(site.zones, (_label, key) => zoneOf(site, key)),
+    mgmtZone: zoneOf(site, "mgmt"),
+    vault: {
+      host: vaultHost,
+      apiHost,
+      publicAddr: `https://${apiHost}`,
+      meshAddr: `https://${site.vault.meshAddress}:${site.vault.port}`,
+      lanAddr: `${lan.scheme}://${hostFqdn(lan.host)}:${lan.port}`,
+      namespace: site.vault.namespace,
+      oidcRedirects: [
+        `https://${vaultHost}/ui/vault/auth/${site.vault.oidcMount}/oidc/callback`,
+        `http://localhost:${site.vault.cliCallbackPort}/oidc/callback`
+      ]
+    },
+    access: {
+      team: site.cloudflare.access.team,
+      teamDomain,
+      certsUrl: `${teamDomain}/cdn-cgi/access/certs`
+    },
+    hosts,
+    products,
+    services,
+    clusters,
+    cloudflareMounts,
+    zone: (key) => zoneOf(site, key),
+    host: hostFqdn,
+    address: (host, network) => {
+      const addresses = lookup("host", hosts, host).addresses;
+      if (!Object.hasOwn(addresses, network))
+        unknownKey(`network leg of host "${host}"`, network, Object.keys(addresses));
+      return addresses[network];
+    },
+    productHost: (key) => lookup("product", products, key),
+    productUrl: (key) => `https://${lookup("product", products, key)}`,
+    serviceUrl: (key) => lookup("service", services, key),
+    clusterMembers: (key) => lookup("cluster", clusters, key),
+    cloudflareMount: (alias, surface) => {
+      const account = lookup("cloudflare account", accounts, alias);
+      if (!account.surfaces.includes(surface)) {
+        unknownKey(`surface of account "${alias}"`, surface, account.surfaces);
+      }
+      return `cloudflare-${alias}-${surface}`;
+    },
+    accountId: (alias) => lookup("cloudflare account", accounts, alias).id
+  };
+}
+// src/pins.ts
+function pins(site) {
+  const { pinned } = site;
+  return {
+    name: (key) => lookup("pinned name", pinned.names, key),
+    certificate: (key) => lookup("pinned certificate", pinned.certificates, key),
+    adopted: (key) => lookup("adopted id", pinned.adopted, key),
+    policy: (key) => lookup("pinned policy list", pinned.policies, key),
+    principals: (key) => lookup("pinned principal list", pinned.sshPrincipals, key)
+  };
+}
+// src/inventory.ts
+function inventory(site) {
+  const derived = derive(site);
+  const names = new Set([
+    site.apex,
+    ...Object.values(derived.zones),
+    derived.vault.host,
+    derived.vault.apiHost,
+    site.vault.meshAddress
+  ]);
+  for (const [key, host] of Object.entries(site.hosts)) {
+    names.add(key);
+    for (const alias of host.aliases ?? [])
+      names.add(alias);
+    const built = derived.hosts[key];
+    if (built?.fqdn !== undefined)
+      names.add(built.fqdn);
+    for (const address of Object.values(built?.addresses ?? {}))
+      names.add(address);
+  }
+  return names;
+}
+function unknownPrincipals(site, list) {
+  const known = inventory(site);
+  return list.filter((entry) => !known.has(entry));
+}
+function pinnedPrincipalIssues(site) {
+  const issues = [];
+  for (const [key, list] of Object.entries(site.pinned.sshPrincipals)) {
+    for (const entry of unknownPrincipals(site, list)) {
+      const path = joinPath(["pinned", "sshPrincipals", key]);
+      issues.push(`${path}: "${entry}" is not in the inventory`);
+    }
+  }
+  return issues;
+}
+// src/identity.ts
+function expectedIdentity(site, options = {}) {
+  const account = options.account === undefined ? undefined : lookup("cloudflare account", site.cloudflare.accounts, options.account).id;
+  return {
+    vaultClusterName: site.vault.clusterName,
+    vaultNamespace: site.vault.namespace,
+    ...account === undefined ? {} : { cloudflareAccountId: account }
+  };
+}
+var FIELDS = ["vaultClusterName", "vaultNamespace", "cloudflareAccountId"];
+function compareIdentity(expected, observed) {
+  if (FIELDS.every((field) => expected[field] === undefined)) {
+    throw new SiteError("identity", "refusing to plan: the expected identity names no field, so it would match any system");
+  }
+  const mismatches = [];
+  for (const field of FIELDS) {
+    const want = expected[field];
+    if (want === undefined)
+      continue;
+    const got = observed[field];
+    if (got !== want)
+      mismatches.push({ field, expected: want, observed: got });
+  }
+  return mismatches;
+}
+function assertIdentity(expected, observed) {
+  const mismatches = compareIdentity(expected, observed);
+  if (mismatches.length === 0)
+    return;
+  throw new SiteError("identity", "refusing to plan: the live system is not the one this site describes", mismatches.map((m) => `${m.field}: expected "${m.expected}", observed ${m.observed === undefined ? "nothing" : `"${m.observed}"`}`));
+}
+// src/tokens.ts
+var SITE_TOKENS = {
+  "<apex>": "the apex domain every derived name hangs off",
+  "<vault-host>": "the vault UI hostname: <vault label>.<apex>",
+  "<vault-api-host>": "the vault public API hostname: <api label>.<vault-host>",
+  "<mgmt-zone>": "the management zone: <mgmt label>.<apex>",
+  "<access-team>": "the Cloudflare Access team name (<access-team>.cloudflareaccess.com)",
+  "<github-owner>": "the GitHub user or organisation that owns the repos",
+  "<estate-root>": "the absolute directory holding host-local estate files",
+  "<cluster>": "any key of site.clusters — a variable, never substituted"
+};
+function tokenValues(site) {
+  const derived = derive(site);
+  return {
+    "<apex>": site.apex,
+    "<vault-host>": derived.vault.host,
+    "<vault-api-host>": derived.vault.apiHost,
+    "<mgmt-zone>": derived.mgmtZone,
+    "<access-team>": site.cloudflare.access.team,
+    "<github-owner>": site.github.owner,
+    "<estate-root>": site.paths.estateRoot
+  };
+}
+function renderTokens(text, site) {
+  const values = tokenValues(site);
+  const tokens = Object.keys(values).sort((a, b) => b.length - a.length);
+  const pattern = new RegExp(tokens.map((t) => t.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|"), "g");
+  return text.replaceAll(pattern, (token) => values[token] ?? token);
+}
+export {
+  SITE_FORMAT,
+  SITE_TOKENS,
+  SiteError,
+  SiteSchema,
+  VERSION,
+  assertIdentity,
+  assertStage,
+  checkDeriveVersion,
+  compareIdentity,
+  decodeSite,
+  derive,
+  expectedIdentity,
+  inventory,
+  pinnedPrincipalIssues,
+  pins,
+  renderTokens,
+  tokenValues,
+  unknownPrincipals,
+  validateSite
+};
+
+//# debugId=6A231AADB000E4A864756E2164756E21
+//# sourceMappingURL=index.js.map