@rmartz/envctl 3.1.1

package/dist/lib/deployments.js

@@ -0,0 +1,83 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.triggerAndWaitRedeployments = triggerAndWaitRedeployments;
+exports.refreshPreviewDeployments = refreshPreviewDeployments;
+const logger_1 = require("./logger");
+// ─── Helpers ──────────────────────────────────────────────────────────────────
+function targetEnvs(targetEnv) {
+    if (targetEnv === "all")
+        return ["production", "preview", "development"];
+    return [targetEnv];
+}
+// Poll one redeployment and report its outcome. A `canceled` result is benign
+// (#125): Vercel auto-cancels a redeploy when a newer build supersedes it, so
+// verification simply didn't complete on this deployment — the pushed variables
+// are already saved on the target and take effect on its next successful build.
+// It is a warning, not a failure; only a genuine ERROR/timeout throws (from
+// pollDeploymentStatus).
+async function pollAndReport(client, id) {
+    (0, logger_1.log)(`  Polling ${id}...`);
+    const status = await client.pollDeploymentStatus(id, 60, 10_000);
+    if (status === "canceled") {
+        (0, logger_1.warn)(`  ${id} → CANCELED (superseded by a newer build or auto-canceled). The pushed variables are saved on the target and apply on its next successful build; verification did not complete for this deployment.`);
+    }
+    else {
+        (0, logger_1.log)(`  ${id} → READY`);
+    }
+    return status;
+}
+// ─── Redeployment ─────────────────────────────────────────────────────────────
+async function triggerAndWaitRedeployments(targetEnv, client) {
+    (0, logger_1.log)("Triggering redeployments...");
+    const deploymentIds = [];
+    for (const vercelEnv of targetEnvs(targetEnv)) {
+        if (vercelEnv === "development") {
+            (0, logger_1.log)(`  [${vercelEnv}] No remote deployment target — skipping`);
+            continue;
+        }
+        const deployTarget = vercelEnv === "production" ? "production" : "staging";
+        const latest = await client.getLatestDeployment(deployTarget);
+        if (!latest) {
+            (0, logger_1.warn)(`No READY deployment found for '${vercelEnv}' — skipping redeployment`);
+            continue;
+        }
+        (0, logger_1.log)(`  Redeploying ${vercelEnv} (${latest.url})...`);
+        const newId = await client.triggerRedeployment(latest.uid, latest.name, deployTarget);
+        deploymentIds.push(newId);
+        (0, logger_1.log)(`  Queued: ${newId}`);
+    }
+    if (deploymentIds.length === 0)
+        return;
+    (0, logger_1.log)(`Waiting for ${deploymentIds.length} deployment(s) to finish...`);
+    let allReady = true;
+    for (const id of deploymentIds) {
+        if ((await pollAndReport(client, id)) === "canceled")
+            allReady = false;
+    }
+    (0, logger_1.log)(allReady ? "All deployments ready." : "Redeployment polling complete.");
+}
+async function refreshPreviewDeployments(client) {
+    const previews = await client.listPreviewDeployments();
+    if (previews.length === 0) {
+        (0, logger_1.log)("No active preview deployments found — skipping preview refresh.");
+        return;
+    }
+    (0, logger_1.log)(`Refreshing ${previews.length} active preview deployment(s)...`);
+    const newIds = [];
+    for (const preview of previews) {
+        (0, logger_1.log)(`  Redeploying ${preview.url}...`);
+        const newId = await client.triggerRedeployment(preview.uid, preview.name);
+        newIds.push(newId);
+        (0, logger_1.log)(`  Queued: ${newId}`);
+    }
+    (0, logger_1.log)(`Waiting for ${newIds.length} preview deployment(s) to finish...`);
+    let allReady = true;
+    for (const id of newIds) {
+        if ((await pollAndReport(client, id)) === "canceled")
+            allReady = false;
+    }
+    (0, logger_1.log)(allReady
+        ? "Preview deployments refreshed."
+        : "Preview redeployment polling complete.");
+}
+//# sourceMappingURL=deployments.js.map

package/dist/lib/deployments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployments.js","sourceRoot":"","sources":["../../src/lib/deployments.ts"],"names":[],"mappings":";;AAkCA,kEAuCC;AAED,8DA4BC;AAvGD,qCAAqC;AAGrC,iFAAiF;AAEjF,SAAS,UAAU,CAAC,SAAiB;IACnC,IAAI,SAAS,KAAK,KAAK;QAAE,OAAO,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;IACzE,OAAO,CAAC,SAAS,CAAC,CAAC;AACrB,CAAC;AAED,8EAA8E;AAC9E,8EAA8E;AAC9E,gFAAgF;AAChF,gFAAgF;AAChF,4EAA4E;AAC5E,yBAAyB;AACzB,KAAK,UAAU,aAAa,CAC1B,MAAoB,EACpB,EAAU;IAEV,IAAA,YAAG,EAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IAC1B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IACjE,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;QAC1B,IAAA,aAAI,EACF,KAAK,EAAE,qMAAqM,CAC7M,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,IAAA,YAAG,EAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,iFAAiF;AAE1E,KAAK,UAAU,2BAA2B,CAC/C,SAAiB,EACjB,MAAoB;IAEpB,IAAA,YAAG,EAAC,6BAA6B,CAAC,CAAC;IAEnC,MAAM,aAAa,GAAa,EAAE,CAAC;IAEnC,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9C,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;YAChC,IAAA,YAAG,EAAC,MAAM,SAAS,0CAA0C,CAAC,CAAC;YAC/D,SAAS;QACX,CAAC;QACD,MAAM,YAAY,GAAG,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAA,aAAI,EACF,kCAAkC,SAAS,2BAA2B,CACvE,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAA,YAAG,EAAC,iBAAiB,SAAS,KAAK,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAC5C,MAAM,CAAC,GAAG,EACV,MAAM,CAAC,IAAI,EACX,YAAY,CACb,CAAC;QACF,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAA,YAAG,EAAC,aAAa,KAAK,EAAE,CAAC,CAAC;IAC5B,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACvC,IAAA,YAAG,EAAC,eAAe,aAAa,CAAC,MAAM,6BAA6B,CAAC,CAAC;IAEtE,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,KAAK,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;QAC/B,IAAI,CAAC,MAAM,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,UAAU;YAAE,QAAQ,GAAG,KAAK,CAAC;IACzE,CAAC;IACD,IAAA,YAAG,EAAC,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC;AAC9E,CAAC;AAEM,KAAK,UAAU,yBAAyB,CAC7C,MAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,sBAAsB,EAAE,CAAC;IACvD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,IAAA,YAAG,EAAC,iEAAiE,CAAC,CAAC;QACvE,OAAO;IACT,CAAC;IACD,IAAA,YAAG,EAAC,cAAc,QAAQ,CAAC,MAAM,kCAAkC,CAAC,CAAC;IAErE,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAA,YAAG,EAAC,iBAAiB,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1E,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,IAAA,YAAG,EAAC,aAAa,KAAK,EAAE,CAAC,CAAC;IAC5B,CAAC;IAED,IAAA,YAAG,EAAC,eAAe,MAAM,CAAC,MAAM,qCAAqC,CAAC,CAAC;IACvE,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QACxB,IAAI,CAAC,MAAM,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,UAAU;YAAE,QAAQ,GAAG,KAAK,CAAC;IACzE,CAAC;IACD,IAAA,YAAG,EACD,QAAQ;QACN,CAAC,CAAC,gCAAgC;QAClC,CAAC,CAAC,wCAAwC,CAC7C,CAAC;AACJ,CAAC"}

package/dist/lib/environments.d.ts

@@ -0,0 +1,4 @@
+export declare function listActiveEnvs(deploymentDir: string): string[];
+export declare function parseDeploymentEnv(deploymentDir: string, envName: string): Record<string, string>;
+export declare function vercelTarget(envName: string): string;
+//# sourceMappingURL=environments.d.ts.map

package/dist/lib/environments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"environments.d.ts","sourceRoot":"","sources":["../../src/lib/environments.ts"],"names":[],"mappings":"AAiBA,wBAAgB,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,CAI9D;AAED,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,GACd,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA8BxB;AAgBD,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEpD"}

package/dist/lib/environments.js

@@ -0,0 +1,97 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.listActiveEnvs = listActiveEnvs;
+exports.parseDeploymentEnv = parseDeploymentEnv;
+exports.vercelTarget = vercelTarget;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const yaml = __importStar(require("js-yaml"));
+// js-yaml 5 throws "expected a document, but the input is empty" on blank
+// input, where v4 returned undefined. Treat a blank file as null so empty
+// configs degrade to the empty result instead of raising.
+function loadYamlFile(filePath) {
+    const content = fs.readFileSync(filePath, "utf-8");
+    return content.trim() === "" ? null : yaml.load(content);
+}
+function listActiveEnvs(deploymentDir) {
+    const envFile = path.join(deploymentDir, "environments.yml");
+    const data = loadYamlFile(envFile);
+    return data?.active ?? [];
+}
+function parseDeploymentEnv(deploymentDir, envName) {
+    const envFile = path.join(deploymentDir, `${envName}.yml`);
+    if (!fs.existsSync(envFile))
+        return {};
+    const data = loadYamlFile(envFile);
+    if (!data || typeof data !== "object" || Array.isArray(data))
+        return {};
+    // Support nested `variables:` format ({ environment: "staging", variables: { KEY: val } })
+    // as well as flat format ({ KEY: val }).
+    const vars = data.variables !== null &&
+        data.variables !== undefined &&
+        typeof data.variables === "object" &&
+        !Array.isArray(data.variables)
+        ? data.variables
+        : data;
+    const result = {};
+    for (const [key, value] of Object.entries(vars)) {
+        if (typeof value !== "string" &&
+            typeof value !== "number" &&
+            typeof value !== "boolean")
+            continue;
+        const strValue = typeof value === "boolean" ? String(value).toLowerCase() : String(value);
+        if (strValue)
+            result[key] = strValue;
+    }
+    return result;
+}
+// The name→target convention. As of #87 this is the **fallback** used only when
+// the manifest's authoritative `deployments[].targets` map does not declare a
+// target for an environment (a legacy config with no `targets:` block, or an env
+// omitted from the map). Manifest-aware resolution lives in `targets.ts`
+// (`resolveEnvTarget` / `envTargetResolver`); prefer it over calling this
+// directly. It is also the basis parseManifest uses to derive targets for a
+// legacy config, so back-compat resolution is unchanged.
+const TARGET_MAP = {
+    production: "production",
+    staging: "preview",
+    preview: "preview",
+    development: "development",
+};
+function vercelTarget(envName) {
+    return TARGET_MAP[envName] ?? envName;
+}
+//# sourceMappingURL=environments.js.map

package/dist/lib/environments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"environments.js","sourceRoot":"","sources":["../../src/lib/environments.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiBA,wCAIC;AAED,gDAiCC;AAgBD,oCAEC;AA1ED,uCAAyB;AACzB,2CAA6B;AAE7B,8CAAgC;AAMhC,0EAA0E;AAC1E,0EAA0E;AAC1E,0DAA0D;AAC1D,SAAS,YAAY,CAAC,QAAgB;IACpC,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnD,OAAO,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC3D,CAAC;AAED,SAAgB,cAAc,CAAC,aAAqB;IAClD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAA8B,CAAC;IAChE,OAAO,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,SAAgB,kBAAkB,CAChC,aAAqB,EACrB,OAAe;IAEf,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,OAAO,MAAM,CAAC,CAAC;IAC3D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IAEvC,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAmC,CAAC;IACrE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAExE,2FAA2F;IAC3F,yCAAyC;IACzC,MAAM,IAAI,GACR,IAAI,CAAC,SAAS,KAAK,IAAI;QACvB,IAAI,CAAC,SAAS,KAAK,SAAS;QAC5B,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;QAClC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;QAC5B,CAAC,CAAE,IAAI,CAAC,SAAqC;QAC7C,CAAC,CAAC,IAAI,CAAC;IAEX,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,IACE,OAAO,KAAK,KAAK,QAAQ;YACzB,OAAO,KAAK,KAAK,QAAQ;YACzB,OAAO,KAAK,KAAK,SAAS;YAE1B,SAAS;QACX,MAAM,QAAQ,GACZ,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3E,IAAI,QAAQ;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,gFAAgF;AAChF,8EAA8E;AAC9E,iFAAiF;AACjF,yEAAyE;AACzE,0EAA0E;AAC1E,4EAA4E;AAC5E,yDAAyD;AACzD,MAAM,UAAU,GAA2B;IACzC,UAAU,EAAE,YAAY;IACxB,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;IAClB,WAAW,EAAE,aAAa;CAC3B,CAAC;AAEF,SAAgB,YAAY,CAAC,OAAe;IAC1C,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC;AACxC,CAAC"}

package/dist/lib/firebase-credential.d.ts

@@ -0,0 +1,28 @@
+import type { ServiceDecl } from "./manifest/types";
+/** The provider's logical credential fields. */
+export type FirebaseField = "projectId" | "clientEmail" | "privateKey" | "privateKeyId";
+/** The default var name for each field — the back-compat naming envctl assumed. */
+export declare const DEFAULT_FIREBASE_VAR_NAMES: Record<FirebaseField, string>;
+export interface FirebaseCredentialSpec {
+    /** Resolved var name for every field (declared override ?? default). */
+    readonly names: Readonly<Record<FirebaseField, string>>;
+}
+/**
+ * Resolve a `firebase` service declaration into a concrete credential contract:
+ * the resolved var name for every field. A missing declaration (or missing
+ * fields) falls back to the default names.
+ *
+ * Throws if any override value is empty or if two fields resolve to the same
+ * var name — both produce unusable Vercel credentials.
+ */
+export declare function resolveFirebaseCredential(service?: ServiceDecl): FirebaseCredentialSpec;
+/**
+ * Keys whose presence in Vercel means Firebase is provisioned under the
+ * declared contract. Uses only the resolved names so the presence check is
+ * consistent with what the readers ({@link firebase-vars}) look for —
+ * advertising a legacy default name for a custom-named contract would cause
+ * `rotation.run` to detect Firebase as present but then fail inside
+ * `rotateFirebase` when the custom var can't be resolved.
+ */
+export declare function firebasePresenceKeys(spec: FirebaseCredentialSpec): string[];
+//# sourceMappingURL=firebase-credential.d.ts.map

package/dist/lib/firebase-credential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"firebase-credential.d.ts","sourceRoot":"","sources":["../../src/lib/firebase-credential.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAQpD,gDAAgD;AAChD,MAAM,MAAM,aAAa,GACvB,WAAW,GAAG,aAAa,GAAG,YAAY,GAAG,cAAc,CAAC;AAE9D,mFAAmF;AACnF,eAAO,MAAM,0BAA0B,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAKpE,CAAC;AAIF,MAAM,WAAW,sBAAsB;IACrC,wEAAwE;IACxE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;CACzD;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,CAAC,EAAE,WAAW,GACpB,sBAAsB,CA2BxB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,sBAAsB,GAAG,MAAM,EAAE,CAE3E"}

package/dist/lib/firebase-credential.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_FIREBASE_VAR_NAMES = void 0;
+exports.resolveFirebaseCredential = resolveFirebaseCredential;
+exports.firebasePresenceKeys = firebasePresenceKeys;
+/** The default var name for each field — the back-compat naming envctl assumed. */
+exports.DEFAULT_FIREBASE_VAR_NAMES = {
+    projectId: "FIREBASE_PROJECT_ID",
+    clientEmail: "FIREBASE_CLIENT_EMAIL",
+    privateKey: "FIREBASE_PRIVATE_KEY",
+    privateKeyId: "FIREBASE_PRIVATE_KEY_ID",
+};
+const ALL_FIELDS = Object.keys(exports.DEFAULT_FIREBASE_VAR_NAMES);
+/**
+ * Resolve a `firebase` service declaration into a concrete credential contract:
+ * the resolved var name for every field. A missing declaration (or missing
+ * fields) falls back to the default names.
+ *
+ * Throws if any override value is empty or if two fields resolve to the same
+ * var name — both produce unusable Vercel credentials.
+ */
+function resolveFirebaseCredential(service) {
+    const overrides = service?.variables ?? {};
+    for (const [field, name] of Object.entries(overrides)) {
+        if (!name || !name.trim())
+            throw new Error(`Firebase credential override for '${field}' must not be empty`);
+    }
+    const names = {};
+    for (const field of ALL_FIELDS)
+        names[field] = overrides[field] ?? exports.DEFAULT_FIREBASE_VAR_NAMES[field];
+    const seen = new Set();
+    for (const [field, name] of Object.entries(names)) {
+        if (seen.has(name))
+            throw new Error(`Firebase credential var names must be unique; '${name}' is mapped to multiple fields (including '${field}')`);
+        seen.add(name);
+    }
+    return { names };
+}
+/**
+ * Keys whose presence in Vercel means Firebase is provisioned under the
+ * declared contract. Uses only the resolved names so the presence check is
+ * consistent with what the readers ({@link firebase-vars}) look for —
+ * advertising a legacy default name for a custom-named contract would cause
+ * `rotation.run` to detect Firebase as present but then fail inside
+ * `rotateFirebase` when the custom var can't be resolved.
+ */
+function firebasePresenceKeys(spec) {
+    return [spec.names.privateKey];
+}
+//# sourceMappingURL=firebase-credential.js.map

package/dist/lib/firebase-credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"firebase-credential.js","sourceRoot":"","sources":["../../src/lib/firebase-credential.ts"],"names":[],"mappings":";;;AAmCA,8DA6BC;AAUD,oDAEC;AAhED,mFAAmF;AACtE,QAAA,0BAA0B,GAAkC;IACvE,SAAS,EAAE,qBAAqB;IAChC,WAAW,EAAE,uBAAuB;IACpC,UAAU,EAAE,sBAAsB;IAClC,YAAY,EAAE,yBAAyB;CACxC,CAAC;AAEF,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,kCAA0B,CAAoB,CAAC;AAO9E;;;;;;;GAOG;AACH,SAAgB,yBAAyB,CACvC,OAAqB;IAErB,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,EAAE,CAAC;IAE3C,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACtD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YACvB,MAAM,IAAI,KAAK,CACb,qCAAqC,KAAK,qBAAqB,CAChE,CAAC;IACN,CAAC;IAED,MAAM,KAAK,GAAG,EAAmC,CAAC;IAClD,KAAK,MAAM,KAAK,IAAI,UAAU;QAC5B,KAAK,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,kCAA0B,CAAC,KAAK,CAAC,CAAC;IAEvE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAG7C,EAAE,CAAC;QACJ,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,kDAAkD,IAAI,8CAA8C,KAAK,IAAI,CAC9G,CAAC;QACJ,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,oBAAoB,CAAC,IAA4B;IAC/D,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;AACjC,CAAC"}

package/dist/lib/firebase-invalidate.d.ts

@@ -0,0 +1,4 @@
+import type { FirebaseIdentity } from "./firebase";
+import type { DeploymentProvider } from "./providers/deployment";
+export declare function invalidateFirebaseKeys(client: DeploymentProvider, fp: FirebaseIdentity): Promise<void>;
+//# sourceMappingURL=firebase-invalidate.d.ts.map

package/dist/lib/firebase-invalidate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"firebase-invalidate.d.ts","sourceRoot":"","sources":["../../src/lib/firebase-invalidate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAQnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAMjE,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,kBAAkB,EAC1B,EAAE,EAAE,gBAAgB,GACnB,OAAO,CAAC,IAAI,CAAC,CAiEf"}

package/dist/lib/firebase-invalidate.js

@@ -0,0 +1,61 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.invalidateFirebaseKeys = invalidateFirebaseKeys;
+const firebase_vars_1 = require("./firebase-vars");
+const gcp_1 = require("./gcp");
+const logger_1 = require("./logger");
+// Post-redeploy cleanup: once a rotation's new key is proven live, sweep every
+// non-active user-managed key for each service account so old credentials can't
+// be used. Kept separate from the mint/rotate/init flow (firebase.ts) as its own
+// concern.
+async function invalidateFirebaseKeys(client, fp) {
+    (0, logger_1.log)("Invalidating old Firebase keys (sweeping all non-active user-managed keys)...");
+    const allEnvs = await client.listEnvVars();
+    const activeKeys = new Set();
+    const saPairs = new Map(); // email → gcpProject
+    const unsweepable = new Set();
+    for (const checkEnv of ["production", "preview", "development"]) {
+        if (!(0, firebase_vars_1.hasFirebaseCredentialForEnv)(allEnvs.envs, fp.names, checkEnv))
+            continue;
+        const kid = await (0, firebase_vars_1.getFirebaseKeyIdForEnv)(checkEnv, allEnvs.envs, fp.names, client);
+        const saInfo = await (0, firebase_vars_1.getFirebaseSaForEnv)(checkEnv, allEnvs.envs, fp.names, client);
+        if (kid) {
+            activeKeys.add(kid);
+            (0, logger_1.log)(`  Active key [${checkEnv}]: ${kid}`);
+        }
+        if (saInfo) {
+            saPairs.set(saInfo.email, saInfo.gcpProject);
+            if (!kid)
+                unsweepable.add(saInfo.email);
+        }
+    }
+    for (const [saEmail, gcpProject] of saPairs) {
+        if (unsweepable.has(saEmail)) {
+            (0, logger_1.warn)(`Skipping stray-key sweep for ${saEmail} — not all environments have the key id tracked.`);
+            (0, logger_1.warn)("  Rotate all environments first, then re-run to sweep old keys.");
+            continue;
+        }
+        (0, logger_1.log)(`  Sweeping SA: ${saEmail}`);
+        const allKeys = (0, gcp_1.listUserManagedGcpKeys)(saEmail, gcpProject);
+        let deleted = 0;
+        for (const keyId of allKeys) {
+            if (activeKeys.has(keyId))
+                continue;
+            (0, logger_1.log)(`  Deleting stray key: ${keyId}`);
+            try {
+                (0, gcp_1.deleteGcpKey)(keyId, saEmail, gcpProject);
+                (0, logger_1.log)(`  Deleted: ${keyId}`);
+                deleted++;
+            }
+            catch {
+                (0, logger_1.warn)(`Failed to delete key ${keyId} — remove manually:`);
+                (0, logger_1.warn)(`  gcloud iam service-accounts keys delete ${keyId} --iam-account=${saEmail}`);
+            }
+        }
+        if (deleted === 0)
+            (0, logger_1.log)(`  No stray keys for ${saEmail}.`);
+        else
+            (0, logger_1.log)(`  Deleted ${deleted} stray key(s) for ${saEmail}.`);
+    }
+}
+//# sourceMappingURL=firebase-invalidate.js.map

package/dist/lib/firebase-invalidate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"firebase-invalidate.js","sourceRoot":"","sources":["../../src/lib/firebase-invalidate.ts"],"names":[],"mappings":";;AAcA,wDAoEC;AAjFD,mDAIyB;AACzB,+BAA6D;AAC7D,qCAAqC;AAGrC,+EAA+E;AAC/E,gFAAgF;AAChF,iFAAiF;AACjF,WAAW;AACJ,KAAK,UAAU,sBAAsB,CAC1C,MAA0B,EAC1B,EAAoB;IAEpB,IAAA,YAAG,EACD,+EAA+E,CAChF,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,qBAAqB;IAChE,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IAEtC,KAAK,MAAM,QAAQ,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC;YAChE,SAAS;QAEX,MAAM,GAAG,GAAG,MAAM,IAAA,sCAAsB,EACtC,QAAQ,EACR,OAAO,CAAC,IAAI,EACZ,EAAE,CAAC,KAAK,EACR,MAAM,CACP,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAmB,EACtC,QAAQ,EACR,OAAO,CAAC,IAAI,EACZ,EAAE,CAAC,KAAK,EACR,MAAM,CACP,CAAC;QAEF,IAAI,GAAG,EAAE,CAAC;YACR,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACpB,IAAA,YAAG,EAAC,iBAAiB,QAAQ,MAAM,GAAG,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;YAC7C,IAAI,CAAC,GAAG;gBAAE,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,OAAO,EAAE,CAAC;QAC5C,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,IAAA,aAAI,EACF,gCAAgC,OAAO,kDAAkD,CAC1F,CAAC;YACF,IAAA,aAAI,EAAC,iEAAiE,CAAC,CAAC;YACxE,SAAS;QACX,CAAC;QACD,IAAA,YAAG,EAAC,kBAAkB,OAAO,EAAE,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,IAAA,4BAAsB,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC5D,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,SAAS;YACpC,IAAA,YAAG,EAAC,yBAAyB,KAAK,EAAE,CAAC,CAAC;YACtC,IAAI,CAAC;gBACH,IAAA,kBAAY,EAAC,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;gBACzC,IAAA,YAAG,EAAC,cAAc,KAAK,EAAE,CAAC,CAAC;gBAC3B,OAAO,EAAE,CAAC;YACZ,CAAC;YAAC,MAAM,CAAC;gBACP,IAAA,aAAI,EAAC,wBAAwB,KAAK,qBAAqB,CAAC,CAAC;gBACzD,IAAA,aAAI,EACF,6CAA6C,KAAK,kBAAkB,OAAO,EAAE,CAC9E,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,OAAO,KAAK,CAAC;YAAE,IAAA,YAAG,EAAC,uBAAuB,OAAO,GAAG,CAAC,CAAC;;YACrD,IAAA,YAAG,EAAC,aAAa,OAAO,qBAAqB,OAAO,GAAG,CAAC,CAAC;IAChE,CAAC;AACH,CAAC"}

package/dist/lib/firebase-vars.d.ts

@@ -0,0 +1,14 @@
+import type { FirebaseCredentialSpec } from "./firebase-credential";
+import type { DeploymentProvider } from "./providers/deployment";
+import type { VercelEnvVar } from "./vercel-api";
+type FieldNames = FirebaseCredentialSpec["names"];
+export interface FirebaseSaInfo {
+    email: string;
+    gcpProject: string;
+}
+export declare function getFirebaseSaForEnv(vercelEnv: string, envs: VercelEnvVar[], names: FieldNames, client: DeploymentProvider): Promise<FirebaseSaInfo | null>;
+export declare function getFirebaseKeyIdForEnv(vercelEnv: string, envs: VercelEnvVar[], names: FieldNames, client: DeploymentProvider): Promise<string>;
+export declare function hasFirebaseCredential(envs: VercelEnvVar[], names: FieldNames): boolean;
+export declare function hasFirebaseCredentialForEnv(envs: VercelEnvVar[], names: FieldNames, vercelEnv: string): boolean;
+export {};
+//# sourceMappingURL=firebase-vars.d.ts.map

package/dist/lib/firebase-vars.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"firebase-vars.d.ts","sourceRoot":"","sources":["../../src/lib/firebase-vars.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAMjD,KAAK,UAAU,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAElD,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB;AAKD,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,YAAY,EAAE,EACpB,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAehC;AAID,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,YAAY,EAAE,EACpB,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,MAAM,CAAC,CAMjB;AAGD,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,YAAY,EAAE,EACpB,KAAK,EAAE,UAAU,GAChB,OAAO,CAET;AAID,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,YAAY,EAAE,EACpB,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAIT"}

package/dist/lib/firebase-vars.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getFirebaseSaForEnv = getFirebaseSaForEnv;
+exports.getFirebaseKeyIdForEnv = getFirebaseKeyIdForEnv;
+exports.hasFirebaseCredential = hasFirebaseCredential;
+exports.hasFirebaseCredentialForEnv = hasFirebaseCredentialForEnv;
+// The service-account identity (email + GCP project) for an environment, read
+// from the discrete `clientEmail` / `projectId` vars. Returns null when the
+// credential is absent for that environment.
+async function getFirebaseSaForEnv(vercelEnv, envs, names, client) {
+    const ceRecord = envs.find((e) => e.key === names.clientEmail && e.target.includes(vercelEnv));
+    if (!ceRecord)
+        return null;
+    const email = await client.getEnvVarValue(ceRecord.id);
+    let gcpProject = "";
+    const pidRecord = envs.find((e) => e.key === names.projectId && e.target.includes(vercelEnv));
+    if (pidRecord)
+        gcpProject = await client.getEnvVarValue(pidRecord.id);
+    if (!gcpProject)
+        gcpProject = process.env.GCLOUD_PROJECT ?? "";
+    return { email, gcpProject };
+}
+// The active key id for an environment, from the tracked privateKeyId var.
+// "" when untracked.
+async function getFirebaseKeyIdForEnv(vercelEnv, envs, names, client) {
+    const record = envs.find((e) => e.key === names.privateKeyId && e.target.includes(vercelEnv));
+    if (!record)
+        return "";
+    return client.getEnvVarValue(record.id);
+}
+// Whether the credential is present anywhere in Vercel (by the resolved names).
+function hasFirebaseCredential(envs, names) {
+    return envs.some((e) => e.key === names.privateKey);
+}
+// Whether the credential is present in one environment — so per-env reads and
+// sweeps skip a target that has no credential.
+function hasFirebaseCredentialForEnv(envs, names, vercelEnv) {
+    return envs.some((e) => e.key === names.privateKey && e.target.includes(vercelEnv));
+}
+//# sourceMappingURL=firebase-vars.js.map

package/dist/lib/firebase-vars.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"firebase-vars.js","sourceRoot":"","sources":["../../src/lib/firebase-vars.ts"],"names":[],"mappings":";;AAkBA,kDAoBC;AAID,wDAWC;AAGD,sDAKC;AAID,kEAQC;AA1DD,8EAA8E;AAC9E,4EAA4E;AAC5E,6CAA6C;AACtC,KAAK,UAAU,mBAAmB,CACvC,SAAiB,EACjB,IAAoB,EACpB,KAAiB,EACjB,MAA0B;IAE1B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CACxB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CACnE,CAAC;IACF,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAEvD,IAAI,UAAU,GAAG,EAAE,CAAC;IACpB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CACzB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CACjE,CAAC;IACF,IAAI,SAAS;QAAE,UAAU,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACtE,IAAI,CAAC,UAAU;QAAE,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;IAE/D,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAC/B,CAAC;AAED,2EAA2E;AAC3E,qBAAqB;AACd,KAAK,UAAU,sBAAsB,CAC1C,SAAiB,EACjB,IAAoB,EACpB,KAAiB,EACjB,MAA0B;IAE1B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CACtB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,YAAY,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CACpE,CAAC;IACF,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,OAAO,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,gFAAgF;AAChF,SAAgB,qBAAqB,CACnC,IAAoB,EACpB,KAAiB;IAEjB,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,UAAU,CAAC,CAAC;AACtD,CAAC;AAED,8EAA8E;AAC9E,+CAA+C;AAC/C,SAAgB,2BAA2B,CACzC,IAAoB,EACpB,KAAiB,EACjB,SAAiB;IAEjB,OAAO,IAAI,CAAC,IAAI,CACd,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAClE,CAAC;AACJ,CAAC"}

package/dist/lib/firebase.d.ts

@@ -0,0 +1,20 @@
+import { type FirebaseCredentialSpec } from "./firebase-credential";
+import type { DeploymentProvider } from "./providers/deployment";
+export interface FirebaseIdentity {
+    saEmail: string;
+    gcpProject: string;
+    /** Resolved credential var names for this project (#98). */
+    names: FirebaseCredentialSpec["names"];
+}
+export interface OldFirebaseKey {
+    vercelEnv: string;
+    keyId: string;
+    saEmail: string;
+    gcpProject: string;
+}
+export declare function rotateFirebase(targetEnv: string, client: DeploymentProvider, tempDir: string, spec?: FirebaseCredentialSpec, allowedTargets?: string[]): Promise<{
+    oldKeys: OldFirebaseKey[];
+    fp: FirebaseIdentity;
+}>;
+export declare function initFirebase(targetEnv: string, client: DeploymentProvider, tempDir: string, saEmailOverride?: string, gcpProjectOverride?: string, spec?: FirebaseCredentialSpec, allowedTargets?: string[]): Promise<void>;
+//# sourceMappingURL=firebase.d.ts.map

package/dist/lib/firebase.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"firebase.d.ts","sourceRoot":"","sources":["../../src/lib/firebase.ts"],"names":[],"mappings":"AAKA,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,uBAAuB,CAAC;AAQ/B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAKjE,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,KAAK,EAAE,sBAAsB,CAAC,OAAO,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAmFD,wBAAsB,cAAc,CAClC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,kBAAkB,EAC1B,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,sBAAoD,EAC1D,cAAc,CAAC,EAAE,MAAM,EAAE,GACxB,OAAO,CAAC;IAAE,OAAO,EAAE,cAAc,EAAE,CAAC;IAAC,EAAE,EAAE,gBAAgB,CAAA;CAAE,CAAC,CA2G9D;AAID,wBAAsB,YAAY,CAChC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,kBAAkB,EAC1B,OAAO,EAAE,MAAM,EACf,eAAe,CAAC,EAAE,MAAM,EACxB,kBAAkB,CAAC,EAAE,MAAM,EAC3B,IAAI,GAAE,sBAAoD,EAC1D,cAAc,CAAC,EAAE,MAAM,EAAE,GACxB,OAAO,CAAC,IAAI,CAAC,CA4Df"}