@indigoai-us/hq-cloud 6.15.4 → 6.15.6

package/dist/outposts/replica-sync.test.js

@@ -0,0 +1,224 @@
+import { Command } from "commander";
+import { afterEach, beforeEach, describe, expect, it, vi, } from "vitest";
+import { registerOutpostsCommand } from "./command.js";
+import { parseReposManifest } from "./replica-sync.js";
+// The command tree now needs full host deps; replica-sync is the only surface
+// these tests drive, and it makes no control-plane call, so stub the transport
+// and token minimally and route the test host deps through `.host`.
+function outpostsDepsWithHost(host) {
+    return {
+        transport: async () => new Response("{}", { status: 200 }),
+        getToken: async () => "test-token",
+        loadCachedTokens: () => ({ refreshToken: "rt_test" }),
+        resolveCallerPersonUid: async () => "prs_test",
+        defaultApiBaseUrl: "https://hqapi.test.invalid",
+        host,
+    };
+}
+const HQ_ROOT = "/home/ec2-user/hq";
+const SECRET = "refresh-token-that-must-never-be-printed";
+const REPOS_YAML = `repos:
+  - url: https://github.com/indigoai-us/hq-pro.git
+    visibility: private
+    name: hq-pro
+  - url: https://github.com/indigoai-us/public-widget.git
+    visibility: public
+  - url: https://github.com/indigoai-us/hq-cli.git
+    visibility: private
+    name: hq-cli
+`;
+function ok(stdout = "") {
+    return {
+        status: 0,
+        stdout,
+        stderr: "",
+        error: undefined,
+    };
+}
+function replicaDependencies(input = {}) {
+    const calls = [];
+    const existing = input.existing ?? new Set();
+    const mkdirp = vi.fn();
+    const deps = {
+        defaultHqRoot: () => HQ_ROOT,
+        loadCachedTokens: () => "session" in input ? input.session : { refreshToken: SECRET },
+        readTextFile: (file) => {
+            if (file.endsWith("repos.yaml")) {
+                if (input.reposYaml === null)
+                    throw new Error("ENOENT");
+                return input.reposYaml ?? REPOS_YAML;
+            }
+            throw new Error(`unexpected readTextFile(${file})`);
+        },
+        pathExists: (p) => existing.has(p),
+        mkdirp: mkdirp,
+        spawnSync: ((command, args, options) => {
+            calls.push({ command, args, options });
+            if (input.failRescue && command === "hq" && args[0] === "rescue") {
+                return { ...ok(), status: 1 };
+            }
+            if (input.failAuthRefresh &&
+                command === "hq" &&
+                args[0] === "auth" &&
+                args[1] === "refresh") {
+                return { ...ok(), status: 1 };
+            }
+            return ok();
+        }),
+    };
+    return { deps, calls, mkdirp };
+}
+function buildProgram(deps) {
+    const program = new Command();
+    program.name("hq").exitOverride();
+    registerOutpostsCommand(program, outpostsDepsWithHost(deps));
+    return program;
+}
+async function run(deps, args) {
+    await buildProgram(deps).parseAsync(["node", "hq", ...args]);
+}
+let logSpy;
+let warnSpy;
+let fetchSpy;
+beforeEach(() => {
+    logSpy = vi.spyOn(console, "log").mockImplementation(() => { });
+    warnSpy = vi.spyOn(console, "warn").mockImplementation(() => { });
+    fetchSpy = vi.spyOn(globalThis, "fetch");
+});
+afterEach(() => {
+    vi.restoreAllMocks();
+});
+function printed() {
+    return [
+        ...logSpy.mock.calls.map((c) => c.map(String).join(" ")),
+        ...warnSpy.mock.calls.map((c) => c.map(String).join(" ")),
+    ].join("\n");
+}
+function hqArgs(calls) {
+    return calls.filter((c) => c.command === "hq").map((c) => c.args);
+}
+describe("parseReposManifest", () => {
+    it("resolves visibility + name, defaulting to public + URL basename", () => {
+        expect(parseReposManifest(REPOS_YAML)).toEqual([
+            { url: "https://github.com/indigoai-us/hq-pro.git", visibility: "private", name: "hq-pro" },
+            { url: "https://github.com/indigoai-us/public-widget.git", visibility: "public", name: "public-widget" },
+            { url: "https://github.com/indigoai-us/hq-cli.git", visibility: "private", name: "hq-cli" },
+        ]);
+    });
+    it("returns [] for junk, empty, or repo-less YAML", () => {
+        expect(parseReposManifest("not: valid: [")).toEqual([]);
+        expect(parseReposManifest("")).toEqual([]);
+        expect(parseReposManifest("other: 1")).toEqual([]);
+    });
+    it("skips entries with no url", () => {
+        expect(parseReposManifest("repos:\n  - visibility: public\n  - url: https://x/y.git")).toEqual([
+            { url: "https://x/y.git", visibility: "public", name: "y" },
+        ]);
+    });
+    it("rejects names that would escape repos/<visibility>/ (path traversal)", () => {
+        const yaml = "repos:\n" +
+            "  - url: https://x/evil.git\n    name: ../../etc\n" +
+            "  - url: https://x/evil2.git\n    name: sub/dir\n" +
+            "  - url: https://x/ok.git\n    name: ok\n";
+        expect(parseReposManifest(yaml)).toEqual([
+            { url: "https://x/ok.git", visibility: "public", name: "ok" },
+        ]);
+    });
+});
+describe("hq outposts replica-sync", () => {
+    it("is hidden from outposts help but remains invokable", async () => {
+        const { deps } = replicaDependencies();
+        const program = buildProgram(deps);
+        const outposts = program.commands.find((c) => c.name() === "outposts");
+        expect(outposts?.helpInformation()).not.toContain("replica-sync");
+        await run(deps, ["outposts", "replica-sync"]);
+    });
+    it("no HQ session → replicates nothing and runs no commands", async () => {
+        const { deps, calls } = replicaDependencies({ session: undefined });
+        await run(deps, ["outposts", "replica-sync"]);
+        expect(calls).toEqual([]);
+        expect(printed()).toContain("nothing to replicate");
+    });
+    it("runs the full replica chain in order on a signed-in box", async () => {
+        const { deps, calls, mkdirp } = replicaDependencies();
+        await run(deps, ["outposts", "replica-sync"]);
+        const args = hqArgs(calls);
+        expect(args).toContainEqual(["auth", "refresh"]);
+        // The pull is pinned to the SAME --hq-root the command was invoked with,
+        // not the default root.
+        expect(args).toContainEqual([
+            "sync",
+            "pull",
+            "--personal",
+            "--hq-root",
+            HQ_ROOT,
+            "--on-conflict",
+            "keep",
+        ]);
+        expect(args).toContainEqual(["rescue", "--hq-root", HQ_ROOT, "--yes"]);
+        // rescue needs companies/ to pre-exist.
+        expect(mkdirp).toHaveBeenCalledWith(`${HQ_ROOT}/companies`);
+    });
+    it("clones only the missing repos, gh-authing via the vault for privates", async () => {
+        const { deps, calls } = replicaDependencies({
+            // hq-cli already present → should be skipped.
+            existing: new Set([`${HQ_ROOT}/repos/private/hq-cli/.git`]),
+        });
+        await run(deps, ["outposts", "replica-sync"]);
+        const clones = calls
+            .filter((c) => c.command === "git" && c.args[0] === "clone")
+            .map((c) => c.args[c.args.length - 1]);
+        expect(clones).toContain(`${HQ_ROOT}/repos/private/hq-pro`);
+        expect(clones).toContain(`${HQ_ROOT}/repos/public/public-widget`);
+        expect(clones).not.toContain(`${HQ_ROOT}/repos/private/hq-cli`);
+        // A private repo is missing → gh auth flows through the vault (token in ENV,
+        // never argv).
+        const vaultAuth = calls.find((c) => c.command === "hq" && c.args[0] === "secrets" && c.args.includes("GITHUB_TOKEN"));
+        expect(vaultAuth).toBeTruthy();
+        expect(vaultAuth?.args).toContain("--personal");
+        expect(vaultAuth?.args).toContain("--only");
+    });
+    it("skips the vault gh auth when every missing repo is public", async () => {
+        const { deps, calls } = replicaDependencies({
+            reposYaml: "repos:\n  - url: https://github.com/x/pub.git\n    visibility: public\n",
+        });
+        await run(deps, ["outposts", "replica-sync"]);
+        const vaultAuth = calls.find((c) => c.command === "hq" && c.args[0] === "secrets");
+        expect(vaultAuth).toBeUndefined();
+    });
+    it("no repos.yaml → skips the clone step without error", async () => {
+        const { deps, calls } = replicaDependencies({ reposYaml: null });
+        await run(deps, ["outposts", "replica-sync"]);
+        expect(calls.some((c) => c.command === "git")).toBe(false);
+        expect(printed()).toContain("skipping repo clone");
+    });
+    it("aborts the cycle when auth refresh fails — no pull, rescue, or clone", async () => {
+        const { deps, calls } = replicaDependencies({ failAuthRefresh: true });
+        await run(deps, ["outposts", "replica-sync"]);
+        const args = hqArgs(calls);
+        expect(args).toContainEqual(["auth", "refresh"]);
+        expect(args.some((a) => a[0] === "sync")).toBe(false);
+        expect(args.some((a) => a[0] === "rescue")).toBe(false);
+        expect(calls.some((c) => c.command === "git")).toBe(false);
+        expect(printed()).toContain("auth refresh failed");
+    });
+    it("a failed step never throws or hard-fails the unit", async () => {
+        const { deps } = replicaDependencies({ failRescue: true });
+        await expect(run(deps, ["outposts", "replica-sync"])).resolves.toBeUndefined();
+        expect(printed()).toContain("HQ kernel rescue did not complete cleanly");
+    });
+    it("never leaks the session token or makes hq-pro requests", async () => {
+        const { deps, calls } = replicaDependencies();
+        await run(deps, ["outposts", "replica-sync"]);
+        expect(JSON.stringify(calls)).not.toContain(SECRET);
+        expect(printed()).not.toContain(SECRET);
+        expect(fetchSpy).not.toHaveBeenCalled();
+        // The GITHUB_TOKEN never appears as a bare argv value — only the var name
+        // inside the bash script and the --only selector.
+        const bashScripts = calls
+            .filter((c) => c.command === "hq" && c.args.includes("bash"))
+            .flatMap((c) => c.args);
+        expect(bashScripts.some((a) => a.includes("gh auth login --with-token"))).toBe(true);
+    });
+});
+//# sourceMappingURL=replica-sync.test.js.map

package/dist/outposts/replica-sync.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"replica-sync.test.js","sourceRoot":"","sources":["../../src/outposts/replica-sync.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EACL,SAAS,EACT,UAAU,EACV,QAAQ,EACR,MAAM,EACN,EAAE,EACF,EAAE,GAEH,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAGvD,8EAA8E;AAC9E,+EAA+E;AAC/E,oEAAoE;AACpE,SAAS,oBAAoB,CAAC,IAAsC;IAClE,OAAO;QACL,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAC1D,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,YAAY;QAClC,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;QACrD,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,UAAU;QAC9C,iBAAiB,EAAE,4BAA4B;QAC/C,IAAI;KACL,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,GAAG,mBAAmB,CAAC;AACpC,MAAM,MAAM,GAAG,0CAA0C,CAAC;AAE1D,MAAM,UAAU,GAAG;;;;;;;;;CASlB,CAAC;AAQF,SAAS,EAAE,CAAC,MAAM,GAAG,EAAE;IACrB,OAAO;QACL,MAAM,EAAE,CAAC;QACT,MAAM;QACN,MAAM,EAAE,EAAE;QACV,KAAK,EAAE,SAAS;KACmC,CAAC;AACxD,CAAC;AAED,SAAS,mBAAmB,CAAC,QAMzB,EAAE;IAKJ,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,GAAG,EAAU,CAAC;IACrD,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;IACvB,MAAM,IAAI,GAAqC;QAC7C,aAAa,EAAE,GAAG,EAAE,CAAC,OAAO;QAC5B,gBAAgB,EAAE,GAAG,EAAE,CACrB,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE;QAC/D,YAAY,EAAE,CAAC,IAAY,EAAE,EAAE;YAC7B,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBAChC,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACxD,OAAO,KAAK,CAAC,SAAS,IAAI,UAAU,CAAC;YACvC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,GAAG,CAAC,CAAC;QACtD,CAAC;QACD,UAAU,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1C,MAAM,EAAE,MAAsD;QAC9D,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;YACrC,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YACvC,IAAI,KAAK,CAAC,UAAU,IAAI,OAAO,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACjE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;YAChC,CAAC;YACD,IACE,KAAK,CAAC,eAAe;gBACrB,OAAO,KAAK,IAAI;gBAChB,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM;gBAClB,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,EACrB,CAAC;gBACD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;YAChC,CAAC;YACD,OAAO,EAAE,EAAE,CAAC;QACd,CAAC,CAAyC;KAC3C,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,YAAY,CAAC,IAAsC;IAC1D,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;IAClC,uBAAuB,CAAC,OAAO,EAAE,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,GAAG,CAChB,IAAsC,EACtC,IAAc;IAEd,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,IAAI,MAAwC,CAAC;AAC7C,IAAI,OAA0C,CAAC;AAC/C,IAAI,QAAoC,CAAC;AAEzC,UAAU,CAAC,GAAG,EAAE;IACd,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC/D,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACjE,QAAQ,GAAG,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,GAAG,EAAE;IACb,EAAE,CAAC,eAAe,EAAE,CAAC;AACvB,CAAC,CAAC,CAAC;AAEH,SAAS,OAAO;IACd,OAAO;QACL,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxD,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;KAC1D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,KAAkB;IAChC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACpE,CAAC;AAED,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;YAC7C,EAAE,GAAG,EAAE,2CAA2C,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC3F,EAAE,GAAG,EAAE,kDAAkD,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE;YACxG,EAAE,GAAG,EAAE,2CAA2C,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE;SAC5F,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACxD,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,CAAC,kBAAkB,CAAC,0DAA0D,CAAC,CAAC,CAAC,OAAO,CAAC;YAC7F,EAAE,GAAG,EAAE,iBAAiB,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE;SAC5D,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,IAAI,GACR,UAAU;YACV,oDAAoD;YACpD,mDAAmD;YACnD,2CAA2C,CAAC;QAC9C,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;YACvC,EAAE,GAAG,EAAE,kBAAkB,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE;SAC9D,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,EAAE,IAAI,EAAE,GAAG,mBAAmB,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,UAAU,CAAC,CAAC;QACvE,MAAM,CAAC,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAClE,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,mBAAmB,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QACpE,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC1B,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,mBAAmB,EAAE,CAAC;QACtD,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;QAE9C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;QACjD,yEAAyE;QACzE,wBAAwB;QACxB,MAAM,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC;YAC1B,MAAM;YACN,MAAM;YACN,YAAY;YACZ,WAAW;YACX,OAAO;YACP,eAAe;YACf,MAAM;SACP,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QACvE,wCAAwC;QACxC,MAAM,CAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,GAAG,OAAO,YAAY,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,mBAAmB,CAAC;YAC1C,8CAA8C;YAC9C,QAAQ,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,4BAA4B,CAAC,CAAC;SAC5D,CAAC,CAAC;QACH,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;QAE9C,MAAM,MAAM,GAAG,KAAK;aACjB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC;aAC3D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,GAAG,OAAO,uBAAuB,CAAC,CAAC;QAC5D,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,GAAG,OAAO,6BAA6B,CAAC,CAAC;QAClE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,OAAO,uBAAuB,CAAC,CAAC;QAEhE,6EAA6E;QAC7E,eAAe;QACf,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAC1B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CACxF,CAAC;QACF,MAAM,CAAC,SAAS,CAAC,CAAC,UAAU,EAAE,CAAC;QAC/B,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAChD,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,mBAAmB,CAAC;YAC1C,SAAS,EAAE,yEAAyE;SACrF,CAAC,CAAC;QACH,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;QACnF,MAAM,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,mBAAmB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3D,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,mBAAmB,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QACvE,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3D,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,EAAE,IAAI,EAAE,GAAG,mBAAmB,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,MAAM,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QAC/E,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,2CAA2C,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,mBAAmB,EAAE,CAAC;QAC9C,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACxC,0EAA0E;QAC1E,kDAAkD;QAClD,MAAM,WAAW,GAAG,KAAK;aACtB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;aAC5D,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1B,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/outposts/self-deploy.d.ts

@@ -0,0 +1,47 @@
+/**
+ * `outposts self-deploy` — turn the CURRENT machine into a locally self-hosted
+ * HQ outpost.
+ *
+ * This is the unmanaged path. Unlike a box provisioned through
+ * `outposts provision`, a self-deployed host is not registered with hq-pro: no
+ * console entry, no remote management, no metering. It runs a systemd service
+ * that watches and syncs ALL of the operator's company vaults under the
+ * operator's own identity.
+ *
+ * Node-only: reads `/etc/os-release`, shells out to `systemctl`/`sudo`/`tee`, and
+ * writes into `/usr/local/bin` and `/etc/systemd/system`.
+ */
+import { type SelfDeployDependencies } from "./host-deps.js";
+/**
+ * Describe the cached session in the confirmation banner.
+ *
+ * Informational only, so a token that cannot be parsed degrades to a generic
+ * phrase rather than surfacing a parse failure — a cache holding a refresh token
+ * is still valid for this setup regardless of whether the id token decodes.
+ */
+export declare function hqIdentityFromSession(session: {
+    refreshToken?: string;
+    idToken?: string;
+}): string;
+export declare function renderSelfDeploySyncScript(hqRoot: string): string;
+export declare function renderSelfDeployService(hqRoot: string, user: string): string;
+/**
+ * Refuse to proceed unless the host is one this installer actually supports, and
+ * a usable HQ session exists. Returns the cached session on success.
+ */
+export declare function selfDeployPreflight(deps: SelfDeployDependencies): {
+    refreshToken?: string;
+    idToken?: string;
+};
+/**
+ * Configure this host as a self-hosted outpost.
+ *
+ * Prompts before doing anything, because the consequence is severe and easy to
+ * understate: anyone with root on the machine can subsequently act as the
+ * operator. `--yes` skips the prompt for non-interactive installs.
+ */
+export declare function selfDeployOutpost(opts: {
+    yes?: boolean;
+    hqRoot?: string;
+}, deps: SelfDeployDependencies): Promise<void>;
+//# sourceMappingURL=self-deploy.d.ts.map

package/dist/outposts/self-deploy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-deploy.d.ts","sourceRoot":"","sources":["../../src/outposts/self-deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAKL,KAAK,sBAAsB,EAC5B,MAAM,gBAAgB,CAAC;AA0BxB;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE;IAC7C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,MAAM,CAsBT;AAUD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAqBjE;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAe5E;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,sBAAsB,GAAG;IACjE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CA6CA;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EACxC,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAiFf"}

package/dist/outposts/self-deploy.js

@@ -0,0 +1,188 @@
+/**
+ * `outposts self-deploy` — turn the CURRENT machine into a locally self-hosted
+ * HQ outpost.
+ *
+ * This is the unmanaged path. Unlike a box provisioned through
+ * `outposts provision`, a self-deployed host is not registered with hq-pro: no
+ * console entry, no remote management, no metering. It runs a systemd service
+ * that watches and syncs ALL of the operator's company vaults under the
+ * operator's own identity.
+ *
+ * Node-only: reads `/etc/os-release`, shells out to `systemctl`/`sudo`/`tee`, and
+ * writes into `/usr/local/bin` and `/etc/systemd/system`.
+ */
+import chalk from "chalk";
+import { commandOutput, commandSucceeded, runChecked, runPrivileged, } from "./host-deps.js";
+/**
+ * The hq-cloud artifact the box-side sync launcher pins to.
+ *
+ * Outpost launchers must stay reproducible: `@latest` could silently opt a
+ * long-lived box into a different sync protocol before its server-side
+ * eligibility has been evaluated.
+ */
+const OUTPOST_HQ_CLOUD_VERSION = "6.15.1";
+function selfDeployError(message) {
+    return new Error(`Self-deploy preflight failed: ${message}`);
+}
+function parseOsRelease(source) {
+    const values = new Map();
+    for (const line of source.split("\n")) {
+        const match = /^([A-Z_]+)=(.*)$/.exec(line);
+        if (!match)
+            continue;
+        const [, key, rawValue] = match;
+        values.set(key, rawValue.replace(/^['"]|['"]$/g, ""));
+    }
+    return values;
+}
+/**
+ * Describe the cached session in the confirmation banner.
+ *
+ * Informational only, so a token that cannot be parsed degrades to a generic
+ * phrase rather than surfacing a parse failure — a cache holding a refresh token
+ * is still valid for this setup regardless of whether the id token decodes.
+ */
+export function hqIdentityFromSession(session) {
+    if (!session.idToken)
+        return "your cached HQ session";
+    try {
+        const payload = session.idToken.split(".")[1];
+        if (!payload)
+            return "your cached HQ session";
+        const claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+        for (const key of [
+            "email",
+            "preferred_username",
+            "cognito:username",
+            "username",
+            "sub",
+        ]) {
+            const value = claims[key];
+            if (typeof value === "string" && value)
+                return value;
+        }
+    }
+    catch {
+        // Never expose a token parse failure — see the doc comment above.
+    }
+    return "your cached HQ session";
+}
+function bashSingleQuote(value) {
+    return `'${value.replace(/'/g, "'\\''")}'`;
+}
+function systemdQuoted(value) {
+    return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+export function renderSelfDeploySyncScript(hqRoot) {
+    return `#!/usr/bin/env bash
+set -u
+# Persistent all-membership sync for a locally self-hosted HQ outpost. The
+# watch runner event-pushes local changes and polls remote changes every minute.
+HQ_ROOT=${bashSingleQuote(hqRoot)}
+cd "$HQ_ROOT"
+while true; do
+  hq auth refresh || echo "[outpost-sync] auth refresh failed, continuing"
+  npx -y --package=@indigoai-us/hq-cloud@${OUTPOST_HQ_CLOUD_VERSION} hq-sync-runner \\
+    --companies \\
+    --direction both \\
+    --on-conflict keep \\
+    --hq-root "$HQ_ROOT" \\
+    --watch \\
+    --event-push \\
+    --poll-remote-ms 60000
+  echo "[outpost-sync] watch runner exited; restarting in 10 seconds"
+  sleep 10
+done
+`;
+}
+export function renderSelfDeployService(hqRoot, user) {
+    return `[Unit]
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+User=${user}
+WorkingDirectory=${systemdQuoted(hqRoot)}
+ExecStart=/usr/local/bin/outpost-sync.sh
+Restart=always
+RestartSec=10s
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+/**
+ * Refuse to proceed unless the host is one this installer actually supports, and
+ * a usable HQ session exists. Returns the cached session on success.
+ */
+export function selfDeployPreflight(deps) {
+    let osRelease;
+    try {
+        osRelease = deps.readTextFile("/etc/os-release");
+    }
+    catch {
+        throw selfDeployError("could not read /etc/os-release. This command only supports Amazon Linux 2023 x86_64.");
+    }
+    const release = parseOsRelease(osRelease);
+    if (release.get("ID") !== "amzn" ||
+        !release.get("VERSION_ID")?.startsWith("2023")) {
+        throw selfDeployError("this command only supports Amazon Linux 2023 x86_64. Use an Amazon Linux 2023 EC2 instance.");
+    }
+    const architecture = commandOutput(deps, "uname", ["-m"]);
+    if (architecture !== "x86_64") {
+        throw selfDeployError("this command only supports x86_64 EC2 instances. Use an Amazon Linux 2023 x86_64 instance.");
+    }
+    if (!commandSucceeded(deps, "systemctl", ["--version"])) {
+        throw selfDeployError("systemd is required but `systemctl --version` failed. Run this on an Amazon Linux 2023 EC2 host with systemd.");
+    }
+    if (deps.getUid() !== 0 && !commandSucceeded(deps, "sudo", ["-n", "true"])) {
+        throw selfDeployError("root or passwordless sudo is required. Configure passwordless sudo or run this command as root.");
+    }
+    const session = deps.loadCachedTokens();
+    if (!session?.refreshToken) {
+        throw selfDeployError("no HQ login session was found. Run `hq login`, then re-run this command.");
+    }
+    return session;
+}
+/**
+ * Configure this host as a self-hosted outpost.
+ *
+ * Prompts before doing anything, because the consequence is severe and easy to
+ * understate: anyone with root on the machine can subsequently act as the
+ * operator. `--yes` skips the prompt for non-interactive installs.
+ */
+export async function selfDeployOutpost(opts, deps) {
+    const session = selfDeployPreflight(deps);
+    const hqRoot = opts.hqRoot ?? deps.defaultHqRoot();
+    const user = deps.invokingUser();
+    if (!opts.yes) {
+        console.log(`HQ identity: ${hqIdentityFromSession(session)}`);
+        console.log(chalk.yellow("This machine will run as a SELF-HOSTED HQ outpost under YOUR identity, continuously syncing ALL your company vaults. " +
+            "It is NOT registered with or managed by hq-pro (no console entry, no remote management, no metering). " +
+            "Anyone with root on this box can act as you. Continue? [y/N]"));
+        if (!deps.isStdinTty()) {
+            throw new Error("Confirmation requires a TTY. Pass --yes to continue non-interactively.");
+        }
+        if (!(await deps.confirm())) {
+            throw new Error("Self-deploy cancelled.");
+        }
+    }
+    runChecked(deps, "hq", ["rescue", "--hq-root", hqRoot, "--yes"], "HQ kernel rescue", { stdio: "inherit" });
+    runPrivileged(deps, "tee", ["/usr/local/bin/outpost-sync.sh"], "Writing /usr/local/bin/outpost-sync.sh", {
+        encoding: "utf8",
+        input: renderSelfDeploySyncScript(hqRoot),
+        stdio: ["pipe", "ignore", "pipe"],
+    });
+    runPrivileged(deps, "chmod", ["+x", "/usr/local/bin/outpost-sync.sh"], "Making /usr/local/bin/outpost-sync.sh executable");
+    runPrivileged(deps, "tee", ["/etc/systemd/system/outpost-sync.service"], "Writing /etc/systemd/system/outpost-sync.service", {
+        encoding: "utf8",
+        input: renderSelfDeployService(hqRoot, user),
+        stdio: ["pipe", "ignore", "pipe"],
+    });
+    runPrivileged(deps, "systemctl", ["daemon-reload"], "Reloading systemd");
+    runPrivileged(deps, "systemctl", ["enable", "--now", "outpost-sync.service"], "Enabling outpost-sync.service");
+    console.log(chalk.green("This box is now a self-hosted HQ outpost and will sync all your company vaults continuously."));
+    console.log(chalk.dim("Check it with: systemctl status outpost-sync.service"));
+    console.log(chalk.dim("It is unregistered and unmanaged by hq-pro (no console entry or remote management)."));
+}
+//# sourceMappingURL=self-deploy.js.map

package/dist/outposts/self-deploy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-deploy.js","sourceRoot":"","sources":["../../src/outposts/self-deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,UAAU,EACV,aAAa,GAEd,MAAM,gBAAgB,CAAC;AAExB;;;;;;GAMG;AACH,MAAM,wBAAwB,GAAG,QAAQ,CAAC;AAE1C,SAAS,eAAe,CAAC,OAAe;IACtC,OAAO,IAAI,KAAK,CAAC,iCAAiC,OAAO,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,cAAc,CAAC,MAAc;IACpC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAGrC;IACC,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,OAAO,wBAAwB,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO;YAAE,OAAO,wBAAwB,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CACvB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACxB,CAAC;QAC7B,KAAK,MAAM,GAAG,IAAI;YAChB,OAAO;YACP,oBAAoB;YACpB,kBAAkB;YAClB,UAAU;YACV,KAAK;SACN,EAAE,CAAC;YACF,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QACvD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;IACpE,CAAC;IACD,OAAO,wBAAwB,CAAC;AAClC,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC7C,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,MAAc;IACvD,OAAO;;;;UAIC,eAAe,CAAC,MAAM,CAAC;;;;2CAIU,wBAAwB;;;;;;;;;;;CAWlE,CAAC;AACF,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,MAAc,EAAE,IAAY;IAClE,OAAO;;;;;OAKF,IAAI;mBACQ,aAAa,CAAC,MAAM,CAAC;;;;;;;CAOvC,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAA4B;IAI9D,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,eAAe,CACnB,sFAAsF,CACvF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IAC1C,IACE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,MAAM;QAC5B,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,EAC9C,CAAC;QACD,MAAM,eAAe,CACnB,6FAA6F,CAC9F,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,IAAI,YAAY,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,eAAe,CACnB,4FAA4F,CAC7F,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QACxD,MAAM,eAAe,CACnB,+GAA+G,CAChH,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QAC3E,MAAM,eAAe,CACnB,iGAAiG,CAClG,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC;QAC3B,MAAM,eAAe,CACnB,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAwC,EACxC,IAA4B;IAE5B,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;IAEjC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,gBAAgB,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CACV,uHAAuH;YACrH,wGAAwG;YACxG,8DAA8D,CACjE,CACF,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,wEAAwE,CACzE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,UAAU,CACR,IAAI,EACJ,IAAI,EACJ,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EACxC,kBAAkB,EAClB,EAAE,KAAK,EAAE,SAAS,EAAE,CACrB,CAAC;IAEF,aAAa,CACX,IAAI,EACJ,KAAK,EACL,CAAC,gCAAgC,CAAC,EAClC,wCAAwC,EACxC;QACE,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,0BAA0B,CAAC,MAAM,CAAC;QACzC,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC;KAClC,CACF,CAAC;IACF,aAAa,CACX,IAAI,EACJ,OAAO,EACP,CAAC,IAAI,EAAE,gCAAgC,CAAC,EACxC,kDAAkD,CACnD,CAAC;IACF,aAAa,CACX,IAAI,EACJ,KAAK,EACL,CAAC,0CAA0C,CAAC,EAC5C,kDAAkD,EAClD;QACE,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,uBAAuB,CAAC,MAAM,EAAE,IAAI,CAAC;QAC5C,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC;KAClC,CACF,CAAC;IACF,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,eAAe,CAAC,EAAE,mBAAmB,CAAC,CAAC;IACzE,aAAa,CACX,IAAI,EACJ,WAAW,EACX,CAAC,QAAQ,EAAE,OAAO,EAAE,sBAAsB,CAAC,EAC3C,+BAA+B,CAChC,CAAC;IAEF,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,KAAK,CACT,8FAA8F,CAC/F,CACF,CAAC;IACF,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAClE,CAAC;IACF,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CACP,qFAAqF,CACtF,CACF,CAAC;AACJ,CAAC"}

package/dist/outposts/self-deploy.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=self-deploy.test.d.ts.map

package/dist/outposts/self-deploy.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-deploy.test.d.ts","sourceRoot":"","sources":["../../src/outposts/self-deploy.test.ts"],"names":[],"mappings":""}