@rmartz/envctl 3.1.1

package/dist/lib/providers/deployment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment.js","sourceRoot":"","sources":["../../../src/lib/providers/deployment.ts"],"names":[],"mappings":";;AAgIA,wEAIC;AApID,kCAA6C;AAC7C,gDAGwB;AACxB,sCAAuC;AACvC,wCAA2C;AAC3C,8CAIuB;AA2CvB,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,aAAa;AACb,MAAM,wBAAwB;IACnB,QAAQ,GAAG,QAAQ,CAAC;IACpB,SAAS,CAAS;IAClB,MAAM,CAAqB;IACnB,MAAM,CAAe;IAEtC,YAAY,UAAkB;QAC5B,MAAM,KAAK,GAAG,IAAA,yBAAkB,GAAE,CAAC;QACnC,IAAI,CAAC,KAAK;YACR,MAAM,IAAI,mBAAU,CAClB,gFAAgF,CACjF,CAAC;QACJ,MAAM,OAAO,GAAG,IAAA,uBAAa,EAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,IAAI,yBAAY,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3E,CAAC;IAED,WAAW;QACT,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IACnC,CAAC;IACD,cAAc,CAAC,EAAU;QACvB,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,UAAU,CACR,IAAoB,EACpB,GAAW,EACX,MAAc;QAEd,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACnD,CAAC;IACD,YAAY,CACV,GAAW,EACX,KAAa,EACb,MAAc,EACd,OAAmB,OAAO;QAE1B,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAC5D,CAAC;IACD,YAAY,CAAC,QAAsB,EAAE,KAAa;QAChD,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACnD,CAAC;IACD,eAAe,CACb,GAAW,EACX,KAAa,EACb,MAAc,EACd,IAAoB,EACpB,IAAiB;QAEjB,yEAAyE;QACzE,uEAAuE;QACvE,OAAO,IAAI,KAAK,SAAS;YACvB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC;YACvD,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAClE,CAAC;IACD,sBAAsB,CACpB,EAAU,EACV,eAAyB,EACzB,SAAiB;QAEjB,OAAO,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,EAAE,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;IAC5E,CAAC;IACD,2BAA2B,CAAC,SAAiB;QAC3C,OAAO,IAAA,yCAAe,EAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACjD,CAAC;IACD,yBAAyB;QACvB,OAAO,IAAA,uCAAe,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;CACF;AAED,SAAgB,8BAA8B,CAC5C,UAAkB;IAElB,OAAO,IAAI,wBAAwB,CAAC,UAAU,CAAC,CAAC;AAClD,CAAC"}

package/dist/lib/providers/registry.d.ts

@@ -0,0 +1,5 @@
+import { type DeploymentProvider } from "./deployment";
+export declare const KNOWN_DEPLOYMENT_PROVIDERS: string[];
+export declare function resolveDeploymentProvider(provider: string, workingDir: string): DeploymentProvider;
+export declare function resolveProjectDeployment(deploymentDir: string, workingDir: string): DeploymentProvider;
+//# sourceMappingURL=registry.d.ts.map

package/dist/lib/providers/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/lib/providers/registry.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,cAAc,CAAC;AAYtB,eAAO,MAAM,0BAA0B,UAAoC,CAAC;AAI5E,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,kBAAkB,CAOpB;AAKD,wBAAgB,wBAAwB,CACtC,aAAa,EAAE,MAAM,EACrB,UAAU,EAAE,MAAM,GACjB,kBAAkB,CAGpB"}

package/dist/lib/providers/registry.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KNOWN_DEPLOYMENT_PROVIDERS = void 0;
+exports.resolveDeploymentProvider = resolveDeploymentProvider;
+exports.resolveProjectDeployment = resolveProjectDeployment;
+const manifest_1 = require("../manifest");
+const logger_1 = require("../logger");
+const deployment_1 = require("./deployment");
+// The deployment sinks envctl knows how to drive, keyed by the manifest
+// `provider:` discriminant. Adding a hosting target is a new entry here plus its
+// implementation — no edits threaded through config-push / rotation.
+const DEPLOYMENT_PROVIDERS = {
+    vercel: deployment_1.createVercelDeploymentProvider,
+};
+exports.KNOWN_DEPLOYMENT_PROVIDERS = Object.keys(DEPLOYMENT_PROVIDERS);
+// Resolve a deployment provider by its manifest `provider:` name, erroring with
+// the offending value when it is not registered.
+function resolveDeploymentProvider(provider, workingDir) {
+    const factory = DEPLOYMENT_PROVIDERS[provider];
+    if (!factory)
+        return (0, logger_1.err)(`Unknown deployment provider '${provider}' — envctl supports: ${exports.KNOWN_DEPLOYMENT_PROVIDERS.join(", ")}`);
+    return factory(workingDir);
+}
+// The deployment provider declared by the project's manifest — the first
+// `deployments[]` entry's provider, defaulting to vercel for a legacy config
+// (parseManifest synthesizes a vercel deployment when none is declared).
+function resolveProjectDeployment(deploymentDir, workingDir) {
+    const provider = (0, manifest_1.parseManifest)(deploymentDir).deployments[0]?.provider;
+    return resolveDeploymentProvider(provider ?? "vercel", workingDir);
+}
+//# sourceMappingURL=registry.js.map

package/dist/lib/providers/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/lib/providers/registry.ts"],"names":[],"mappings":";;;AAqBA,8DAUC;AAKD,4DAMC;AA1CD,0CAA4C;AAC5C,sCAAgC;AAChC,6CAGsB;AAEtB,wEAAwE;AACxE,iFAAiF;AACjF,qEAAqE;AACrE,MAAM,oBAAoB,GAGtB;IACF,MAAM,EAAE,2CAA8B;CACvC,CAAC;AAEW,QAAA,0BAA0B,GAAG,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;AAE5E,gFAAgF;AAChF,iDAAiD;AACjD,SAAgB,yBAAyB,CACvC,QAAgB,EAChB,UAAkB;IAElB,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO;QACV,OAAO,IAAA,YAAG,EACR,gCAAgC,QAAQ,wBAAwB,kCAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxG,CAAC;IACJ,OAAO,OAAO,CAAC,UAAU,CAAC,CAAC;AAC7B,CAAC;AAED,yEAAyE;AACzE,6EAA6E;AAC7E,yEAAyE;AACzE,SAAgB,wBAAwB,CACtC,aAAqB,EACrB,UAAkB;IAElB,MAAM,QAAQ,GAAG,IAAA,wBAAa,EAAC,aAAa,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;IACvE,OAAO,yBAAyB,CAAC,QAAQ,IAAI,QAAQ,EAAE,UAAU,CAAC,CAAC;AACrE,CAAC"}

package/dist/lib/providers/service.d.ts

@@ -0,0 +1,35 @@
+import { type FirebaseCredentialSpec } from "../firebase-credential";
+import type { DeploymentProvider } from "./deployment";
+export interface ServiceContext {
+    targetEnv: string;
+    deployment: DeploymentProvider;
+    tempDir: string;
+    firebaseCredential: FirebaseCredentialSpec;
+    firebaseSaEmail?: string;
+    gcpProject?: string;
+    sentryOrg?: string;
+    sentryProject?: string;
+    /**
+     * The provider targets this service is scoped to (#89), from the manifest's
+     * `services[].environments`. Undefined ⇒ all environments (unscoped). init /
+     * rotate skip any target outside this set.
+     */
+    allowedTargets?: string[];
+}
+export interface ServiceRotation {
+    invalidate(): Promise<void>;
+    retiredKeyWarnings(): string[];
+}
+export interface ServiceProvider {
+    readonly provider: string;
+    readonly displayName: string;
+    /** Which slot this provider fills in the fail-fast auth preflight. */
+    readonly authKey: "firebase" | "sentry";
+    /** Env-var keys whose presence in Vercel means this service is provisioned. */
+    presenceKeys(ctx: ServiceContext): string[];
+    init(ctx: ServiceContext): Promise<void>;
+    rotate(ctx: ServiceContext): Promise<ServiceRotation>;
+}
+export declare const serviceProviders: () => ServiceProvider[];
+export declare function resolveServiceProvider(provider: string): ServiceProvider;
+//# sourceMappingURL=service.d.ts.map

package/dist/lib/providers/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/lib/providers/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,wBAAwB,CAAC;AAKhC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAKvD,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,kBAAkB,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,kBAAkB,EAAE,sBAAsB,CAAC;IAC3C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAKD,MAAM,WAAW,eAAe;IAC9B,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,kBAAkB,IAAI,MAAM,EAAE,CAAC;CAChC;AAKD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,UAAU,GAAG,QAAQ,CAAC;IACxC,+EAA+E;IAC/E,YAAY,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,EAAE,CAAC;IAC5C,IAAI,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CACvD;AAqGD,eAAO,MAAM,gBAAgB,QAAO,eAAe,EACjB,CAAC;AAInC,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,eAAe,CAOxE"}

package/dist/lib/providers/service.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.serviceProviders = void 0;
+exports.resolveServiceProvider = resolveServiceProvider;
+const firebase_credential_1 = require("../firebase-credential");
+const firebase_1 = require("../firebase");
+const firebase_invalidate_1 = require("../firebase-invalidate");
+const logger_1 = require("../logger");
+const sentry_1 = require("../sentry");
+const firebaseServiceProvider = {
+    provider: "firebase",
+    displayName: "Firebase",
+    authKey: "firebase",
+    presenceKeys: (ctx) => (0, firebase_credential_1.firebasePresenceKeys)(ctx.firebaseCredential),
+    init: (ctx) => (0, firebase_1.initFirebase)(ctx.targetEnv, ctx.deployment, ctx.tempDir, ctx.firebaseSaEmail, ctx.gcpProject, ctx.firebaseCredential, ctx.allowedTargets),
+    rotate: async (ctx) => {
+        const { oldKeys, fp } = await (0, firebase_1.rotateFirebase)(ctx.targetEnv, ctx.deployment, ctx.tempDir, ctx.firebaseCredential, ctx.allowedTargets);
+        return {
+            invalidate: async () => {
+                if (fp)
+                    await (0, firebase_invalidate_1.invalidateFirebaseKeys)(ctx.deployment, fp);
+            },
+            retiredKeyWarnings: () => oldKeys.map(({ vercelEnv, keyId, saEmail }) => `Old Firebase key to remove: ${keyId} (${vercelEnv}, account: ${saEmail})`),
+        };
+    },
+};
+// Resolve Sentry org/project from the context override or the environment —
+// mirroring rotation's invalidation-time resolution.
+function sentryOrgProject(ctx) {
+    return {
+        org: ctx.sentryOrg ?? process.env.SENTRY_ORG,
+        project: ctx.sentryProject ?? process.env.SENTRY_PROJECT,
+    };
+}
+const sentryServiceProvider = {
+    provider: "sentry",
+    displayName: "Sentry",
+    authKey: "sentry",
+    presenceKeys: () => ["SENTRY_DSN", "NEXT_PUBLIC_SENTRY_DSN"],
+    init: (ctx) => (0, sentry_1.initSentry)(ctx.targetEnv, ctx.deployment, ctx.sentryOrg, ctx.sentryProject, ctx.allowedTargets),
+    rotate: async (ctx) => {
+        const oldKeyId = await (0, sentry_1.rotateSentry)(ctx.targetEnv, ctx.deployment, ctx.sentryOrg, ctx.sentryProject, ctx.allowedTargets);
+        return {
+            invalidate: async () => {
+                if (!oldKeyId)
+                    return;
+                const { org, project } = sentryOrgProject(ctx);
+                if (!org || !project)
+                    return (0, logger_1.err)("SENTRY_ORG and SENTRY_PROJECT are required for key invalidation");
+                await (0, sentry_1.invalidateSentryKey)(oldKeyId, org, project);
+            },
+            retiredKeyWarnings: () => {
+                if (!oldKeyId)
+                    return [];
+                const { org, project } = sentryOrgProject(ctx);
+                return [
+                    `Old Sentry key to remove: ${oldKeyId} (project: ${org}/${project})`,
+                ];
+            },
+        };
+    },
+};
+// The secret sources envctl knows how to rotate, keyed by the manifest
+// `services[].provider` discriminant. Order is significant: providers act in
+// this order, so the fail-fast auth preflight and the rotation sequence stay
+// Firebase-before-Sentry, matching the pre-registry behavior.
+const SERVICE_PROVIDERS = {
+    firebase: firebaseServiceProvider,
+    sentry: sentryServiceProvider,
+};
+const serviceProviders = () => Object.values(SERVICE_PROVIDERS);
+exports.serviceProviders = serviceProviders;
+// Resolve a service provider by its manifest `provider:` name, erroring with the
+// offending value when it is not registered.
+function resolveServiceProvider(provider) {
+    const impl = SERVICE_PROVIDERS[provider];
+    if (!impl)
+        return (0, logger_1.err)(`Unknown service provider '${provider}' — envctl supports: ${Object.keys(SERVICE_PROVIDERS).join(", ")}`);
+    return impl;
+}
+//# sourceMappingURL=service.js.map

package/dist/lib/providers/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../src/lib/providers/service.ts"],"names":[],"mappings":";;;AA4JA,wDAOC;AAnKD,gEAGgC;AAChC,0CAA2D;AAC3D,gEAAgE;AAChE,sCAAgC;AAChC,sCAA0E;AA6C1E,MAAM,uBAAuB,GAAoB;IAC/C,QAAQ,EAAE,UAAU;IACpB,WAAW,EAAE,UAAU;IACvB,OAAO,EAAE,UAAU;IACnB,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAA,0CAAoB,EAAC,GAAG,CAAC,kBAAkB,CAAC;IACnE,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CACZ,IAAA,uBAAY,EACV,GAAG,CAAC,SAAS,EACb,GAAG,CAAC,UAAU,EACd,GAAG,CAAC,OAAO,EACX,GAAG,CAAC,eAAe,EACnB,GAAG,CAAC,UAAU,EACd,GAAG,CAAC,kBAAkB,EACtB,GAAG,CAAC,cAAc,CACnB;IACH,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACpB,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,MAAM,IAAA,yBAAc,EAC1C,GAAG,CAAC,SAAS,EACb,GAAG,CAAC,UAAU,EACd,GAAG,CAAC,OAAO,EACX,GAAG,CAAC,kBAAkB,EACtB,GAAG,CAAC,cAAc,CACnB,CAAC;QACF,OAAO;YACL,UAAU,EAAE,KAAK,IAAI,EAAE;gBACrB,IAAI,EAAE;oBAAE,MAAM,IAAA,4CAAsB,EAAC,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YAC3D,CAAC;YACD,kBAAkB,EAAE,GAAG,EAAE,CACvB,OAAO,CAAC,GAAG,CACT,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAChC,+BAA+B,KAAK,KAAK,SAAS,cAAc,OAAO,GAAG,CAC7E;SACJ,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,4EAA4E;AAC5E,qDAAqD;AACrD,SAAS,gBAAgB,CAAC,GAAmB;IAI3C,OAAO;QACL,GAAG,EAAE,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU;QAC5C,OAAO,EAAE,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc;KACzD,CAAC;AACJ,CAAC;AAED,MAAM,qBAAqB,GAAoB;IAC7C,QAAQ,EAAE,QAAQ;IAClB,WAAW,EAAE,QAAQ;IACrB,OAAO,EAAE,QAAQ;IACjB,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,YAAY,EAAE,wBAAwB,CAAC;IAC5D,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CACZ,IAAA,mBAAU,EACR,GAAG,CAAC,SAAS,EACb,GAAG,CAAC,UAAU,EACd,GAAG,CAAC,SAAS,EACb,GAAG,CAAC,aAAa,EACjB,GAAG,CAAC,cAAc,CACnB;IACH,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACpB,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAY,EACjC,GAAG,CAAC,SAAS,EACb,GAAG,CAAC,UAAU,EACd,GAAG,CAAC,SAAS,EACb,GAAG,CAAC,aAAa,EACjB,GAAG,CAAC,cAAc,CACnB,CAAC;QACF,OAAO;YACL,UAAU,EAAE,KAAK,IAAI,EAAE;gBACrB,IAAI,CAAC,QAAQ;oBAAE,OAAO;gBACtB,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;gBAC/C,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO;oBAClB,OAAO,IAAA,YAAG,EACR,iEAAiE,CAClE,CAAC;gBACJ,MAAM,IAAA,4BAAmB,EAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;YACpD,CAAC;YACD,kBAAkB,EAAE,GAAG,EAAE;gBACvB,IAAI,CAAC,QAAQ;oBAAE,OAAO,EAAE,CAAC;gBACzB,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;gBAC/C,OAAO;oBACL,6BAA6B,QAAQ,cAAc,GAAG,IAAI,OAAO,GAAG;iBACrE,CAAC;YACJ,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,uEAAuE;AACvE,6EAA6E;AAC7E,6EAA6E;AAC7E,8DAA8D;AAC9D,MAAM,iBAAiB,GAAoC;IACzD,QAAQ,EAAE,uBAAuB;IACjC,MAAM,EAAE,qBAAqB;CAC9B,CAAC;AAEK,MAAM,gBAAgB,GAAG,GAAsB,EAAE,CACtD,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;AADtB,QAAA,gBAAgB,oBACM;AAEnC,iFAAiF;AACjF,6CAA6C;AAC7C,SAAgB,sBAAsB,CAAC,QAAgB;IACrD,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI;QACP,OAAO,IAAA,YAAG,EACR,6BAA6B,QAAQ,wBAAwB,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzG,CAAC;IACJ,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lib/rotation-preflight.d.ts

@@ -0,0 +1,11 @@
+export interface ProviderSet {
+    firebase: boolean;
+    sentry: boolean;
+    /** Sentry org slug — falls back to SENTRY_ORG env var. */
+    sentryOrg?: string;
+    /** Sentry project slug — falls back to SENTRY_PROJECT env var. */
+    sentryProject?: string;
+}
+export declare function checkVercelPrereqs(token: string | undefined): asserts token is string;
+export declare function assertProviderAuth(providers: ProviderSet): void;
+//# sourceMappingURL=rotation-preflight.d.ts.map

package/dist/lib/rotation-preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotation-preflight.d.ts","sourceRoot":"","sources":["../../src/lib/rotation-preflight.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAID,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,OAAO,CAAC,KAAK,IAAI,MAAM,CAazB;AAOD,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,WAAW,GAAG,IAAI,CAwB/D"}

package/dist/lib/rotation-preflight.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkVercelPrereqs = checkVercelPrereqs;
+exports.assertProviderAuth = assertProviderAuth;
+const auth_1 = require("./auth");
+const logger_1 = require("./logger");
+const subprocess_1 = require("./subprocess");
+// Vercel is required for every flow: assert the CLI is installed, a token
+// resolves, and the CLI session is authenticated, before any provider work.
+function checkVercelPrereqs(token) {
+    if (!(0, subprocess_1.commandExists)("vercel"))
+        (0, logger_1.err)("Missing required tools: vercel");
+    if (!token)
+        (0, logger_1.err)("No Vercel token found. Set VERCEL_TOKEN or run 'vercel login' to authenticate.");
+    try {
+        (0, subprocess_1.run)("vercel", ["whoami"]);
+    }
+    catch {
+        (0, logger_1.err)("Vercel CLI not authenticated. Run: vercel login");
+    }
+}
+// Fail-fast auth preflight (issue #91): before any mint/push, assert local auth
+// for every provider that will be rotated/initialized, so an unauthenticated
+// provider stops the run up front instead of after a sibling provider has
+// already minted and pushed a new key — which would leave a partial, unverified
+// state. Reports every missing provider at once with an actionable message.
+function assertProviderAuth(providers) {
+    const missing = [];
+    if (providers.firebase && !(0, auth_1.gcpAuthState)().authenticated)
+        missing.push("gcp (Firebase) — install the gcloud CLI and run `gcloud auth login`");
+    if (providers.sentry) {
+        if (!(0, auth_1.sentryAuthState)().authenticated)
+            missing.push("sentry — set SENTRY_AUTH_TOKEN or run `sentry-cli login`");
+        const org = providers.sentryOrg ?? process.env.SENTRY_ORG;
+        const project = providers.sentryProject ?? process.env.SENTRY_PROJECT;
+        if (!org)
+            missing.push("sentry — set SENTRY_ORG (Sentry organization slug)");
+        if (!project)
+            missing.push("sentry — set SENTRY_PROJECT (Sentry project slug)");
+    }
+    if (missing.length > 0)
+        (0, logger_1.err)(`Not authenticated or configured for provider(s) required by this operation:\n` +
+            missing.map((m) => `  - ${m}`).join("\n") +
+            `\nProvide the required credentials (see \`envctl auth status\`), or scope ` +
+            `the run to a ready provider.`);
+}
+//# sourceMappingURL=rotation-preflight.js.map

package/dist/lib/rotation-preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotation-preflight.js","sourceRoot":"","sources":["../../src/lib/rotation-preflight.ts"],"names":[],"mappings":";;AAiBA,gDAeC;AAOD,gDAwBC;AA/DD,iCAAuD;AACvD,qCAA+B;AAC/B,6CAA4D;AAa5D,0EAA0E;AAC1E,4EAA4E;AAC5E,SAAgB,kBAAkB,CAChC,KAAyB;IAEzB,IAAI,CAAC,IAAA,0BAAa,EAAC,QAAQ,CAAC;QAAE,IAAA,YAAG,EAAC,gCAAgC,CAAC,CAAC;IAEpE,IAAI,CAAC,KAAK;QACR,IAAA,YAAG,EACD,gFAAgF,CACjF,CAAC;IAEJ,IAAI,CAAC;QACH,IAAA,gBAAM,EAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,IAAA,YAAG,EAAC,iDAAiD,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,6EAA6E;AAC7E,0EAA0E;AAC1E,gFAAgF;AAChF,4EAA4E;AAC5E,SAAgB,kBAAkB,CAAC,SAAsB;IACvD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,SAAS,CAAC,QAAQ,IAAI,CAAC,IAAA,mBAAY,GAAE,CAAC,aAAa;QACrD,OAAO,CAAC,IAAI,CACV,qEAAqE,CACtE,CAAC;IACJ,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACrB,IAAI,CAAC,IAAA,sBAAe,GAAE,CAAC,aAAa;YAClC,OAAO,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;QAC3E,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QAC1D,MAAM,OAAO,GAAG,SAAS,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QACtE,IAAI,CAAC,GAAG;YACN,OAAO,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;QACrE,IAAI,CAAC,OAAO;YACV,OAAO,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QACpB,IAAA,YAAG,EACD,+EAA+E;YAC7E,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YACzC,4EAA4E;YAC5E,8BAA8B,CACjC,CAAC;AACN,CAAC"}

package/dist/lib/rotation.d.ts

@@ -0,0 +1,33 @@
+import { type FirebaseCredentialSpec } from "./firebase-credential";
+export declare function serviceScopeTargets(configDir: string, provider: string): string[] | undefined;
+export interface RotationOptions {
+    targetEnv: string;
+    invalidateKeys: boolean;
+    /** Project root for `.vercel/project.json` detection. Defaults to CWD. */
+    workingDir?: string;
+    /** Deployment config directory (for resolving the deployment provider). */
+    deploymentDir?: string;
+    init?: "all" | "firebase" | "sentry";
+    /** SA email for --init firebase. Falls back to FIREBASE_SA_EMAIL env var. */
+    firebaseSaEmail?: string;
+    /** GCP project ID for --init firebase. Falls back to GCLOUD_PROJECT env var. */
+    gcpProject?: string;
+    /** Sentry org slug. Falls back to SENTRY_ORG env var. */
+    sentryOrg?: string;
+    /** Sentry project slug. Falls back to SENTRY_PROJECT env var. */
+    sentryProject?: string;
+    /**
+     * Restrict a rotation to a single provider (mirrors `secrets init`'s
+     * positional). Undefined rotates every provider present in the project.
+     * Ignored for `init` flows, which scope via {@link RotationOptions.init}.
+     */
+    provider?: "firebase" | "sentry";
+    /**
+     * The resolved Firebase credential contract (shape + var names) from the
+     * manifest (#97/#98). Defaults to the provider default (split + default names)
+     * when unset, so callers without a manifest keep today's behavior.
+     */
+    firebaseCredential?: FirebaseCredentialSpec;
+}
+export declare function run(opts: RotationOptions): Promise<void>;
+//# sourceMappingURL=rotation.d.ts.map

package/dist/lib/rotation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotation.d.ts","sourceRoot":"","sources":["../../src/lib/rotation.ts"],"names":[],"mappings":"AAMA,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,uBAAuB,CAAC;AAiB/B,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GACf,MAAM,EAAE,GAAG,SAAS,CAOtB;AAID,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,OAAO,CAAC;IACxB,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,KAAK,GAAG,UAAU,GAAG,QAAQ,CAAC;IACrC,6EAA6E;IAC7E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,UAAU,GAAG,QAAQ,CAAC;IACjC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,sBAAsB,CAAC;CAC7C;AAID,wBAAsB,GAAG,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAkI9D"}

package/dist/lib/rotation.js

@@ -0,0 +1,168 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.serviceScopeTargets = serviceScopeTargets;
+exports.run = run;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const auth_1 = require("./auth");
+const deployment_config_1 = require("./commands/deployment-config");
+const firebase_credential_1 = require("./firebase-credential");
+const logger_1 = require("./logger");
+const manifest_1 = require("./manifest");
+const registry_1 = require("./providers/registry");
+const service_1 = require("./providers/service");
+const rotation_preflight_1 = require("./rotation-preflight");
+const targets_1 = require("./targets");
+// The provider targets a service is scoped to (#89), from its manifest
+// `services[].environments` declaration mapped through the env→target model.
+// Undefined ⇒ the service is unscoped and applies to every environment.
+function serviceScopeTargets(configDir, provider) {
+    const service = (0, manifest_1.parseManifest)(configDir).services.find((s) => s.provider === provider);
+    if (!service?.environments)
+        return undefined;
+    const resolveTarget = (0, targets_1.envTargetResolver)(configDir);
+    return [...new Set(service.environments.map((e) => resolveTarget(e)))];
+}
+// ─── Main orchestration ───────────────────────────────────────────────────────
+async function run(opts) {
+    const token = (0, auth_1.resolveVercelToken)();
+    (0, rotation_preflight_1.checkVercelPrereqs)(token);
+    const workingDir = opts.workingDir ?? process.cwd();
+    const configDir = opts.deploymentDir ?? (0, deployment_config_1.deploymentDir)(workingDir);
+    const deployment = (0, registry_1.resolveProjectDeployment)(configDir, workingDir);
+    (0, logger_1.log)(`Project: ${deployment.projectId}${deployment.teamId ? ` (team: ${deployment.teamId})` : ""}`);
+    const ctx = {
+        targetEnv: opts.targetEnv,
+        deployment,
+        tempDir: "",
+        firebaseCredential: opts.firebaseCredential ?? (0, firebase_credential_1.resolveFirebaseCredential)(),
+        firebaseSaEmail: opts.firebaseSaEmail,
+        gcpProject: opts.gcpProject,
+        sentryOrg: opts.sentryOrg,
+        sentryProject: opts.sentryProject,
+    };
+    const allEnvs = await deployment.listEnvVars();
+    // Scope key-existence checks to the specific Vercel target so that
+    // successive per-env --init calls (e.g. preview then production) don't
+    // see secrets created for an earlier target and falsely error.
+    const scopedEnvs = opts.targetEnv === "all"
+        ? allEnvs.envs
+        : allEnvs.envs.filter((e) => e.target.includes(opts.targetEnv));
+    const envKeys = scopedEnvs.map((e) => e.key);
+    const providers = (0, service_1.serviceProviders)();
+    const isPresent = (p) => p.presenceKeys(ctx).some((k) => envKeys.includes(k));
+    const willInit = (p) => opts.init === "all" || opts.init === p.provider;
+    // Environment scoping (#89): the provider targets this run covers, and each
+    // service's declared scope. A service whose scope does not intersect this
+    // run's targets is skipped entirely (silently — not acted on); a service that
+    // partially overlaps acts only on its in-scope targets (enforced per-target
+    // inside init/rotate via `allowedTargets`).
+    const runTargets = opts.targetEnv === "all"
+        ? ["production", "preview", "development"]
+        : [opts.targetEnv];
+    const scopeFor = (p) => serviceScopeTargets(configDir, p.provider);
+    const inScope = (p) => {
+        const scope = scopeFor(p);
+        return scope === undefined || scope.some((t) => runTargets.includes(t));
+    };
+    // Guards, iterating the registry rather than naming providers:
+    //  - init: erroring if a selected provider's secret already exists
+    //  - scoped rotate: erroring if the named provider is absent
+    //  - unscoped rotate: erroring if nothing is present to rotate
+    if (opts.init) {
+        for (const p of providers) {
+            if (willInit(p) && isPresent(p))
+                (0, logger_1.err)(`${p.displayName} keys already exist in this Vercel project — use \`envctl secrets rotate\` to update them, not \`envctl secrets init\`.`);
+        }
+    }
+    else if (opts.provider) {
+        const scoped = (0, service_1.resolveServiceProvider)(opts.provider);
+        if (!isPresent(scoped))
+            (0, logger_1.err)(`No ${scoped.displayName} keys found in this Vercel project — nothing to rotate for \`${opts.provider}\`. To push them for the first time, use \`envctl secrets init ${opts.provider}\`.`);
+    }
+    else if (!providers.some(isPresent)) {
+        (0, logger_1.err)(`No ${providers.map((p) => p.displayName).join(" or ")} keys found in this Vercel project — nothing to rotate. To push secrets for the first time, use \`envctl secrets init\`.`);
+    }
+    // Which providers this run acts on: for init, whichever `opts.init` selects;
+    // for rotate, whichever are present and not excluded by a provider scope.
+    const acting = providers.filter((p) => inScope(p) &&
+        (opts.init
+            ? willInit(p)
+            : isPresent(p) &&
+                (opts.provider === undefined || opts.provider === p.provider)));
+    // Fail fast if a provider we would mint/push for is not authenticated, before
+    // any key is created — so a rotation can never leave a partial state (#91).
+    (0, rotation_preflight_1.assertProviderAuth)({
+        firebase: acting.some((p) => p.authKey === "firebase"),
+        sentry: acting.some((p) => p.authKey === "sentry"),
+        sentryOrg: opts.sentryOrg,
+        sentryProject: opts.sentryProject,
+    });
+    (0, logger_1.log)(`Target: ${opts.targetEnv} | ${opts.init ? "Initializing" : `Invalidate after redeployment: ${opts.invalidateKeys}`}`);
+    const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "rotate-keys-"));
+    ctx.tempDir = tempDir;
+    try {
+        if (opts.init) {
+            for (const p of acting)
+                await p.init({ ...ctx, allowedTargets: scopeFor(p) });
+            await deployment.triggerAndWaitRedeployments(opts.targetEnv);
+            (0, logger_1.log)("Key initialization complete.");
+        }
+        else {
+            const rotations = [];
+            for (const p of acting)
+                rotations.push(await p.rotate({ ...ctx, allowedTargets: scopeFor(p) }));
+            await deployment.triggerAndWaitRedeployments(opts.targetEnv);
+            if (opts.invalidateKeys) {
+                (0, logger_1.log)("Invalidating old keys...");
+                for (const rotation of rotations)
+                    await rotation.invalidate();
+            }
+            else {
+                (0, logger_1.log)("Skipping key invalidation (--no-invalidate)");
+                for (const rotation of rotations)
+                    for (const message of rotation.retiredKeyWarnings())
+                        (0, logger_1.warn)(message);
+            }
+            (0, logger_1.log)("Key rotation complete.");
+        }
+    }
+    finally {
+        fs.rmSync(tempDir, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=rotation.js.map

package/dist/lib/rotation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotation.js","sourceRoot":"","sources":["../../src/lib/rotation.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0BA,kDAUC;AAoCD,kBAkIC;AA1MD,uCAAyB;AACzB,uCAAyB;AACzB,2CAA6B;AAE7B,iCAA4C;AAC5C,oEAA6D;AAC7D,+DAG+B;AAC/B,qCAA0C;AAC1C,yCAA2C;AAC3C,mDAAgE;AAChE,iDAM6B;AAC7B,6DAA8E;AAC9E,uCAA8C;AAE9C,uEAAuE;AACvE,6EAA6E;AAC7E,wEAAwE;AACxE,SAAgB,mBAAmB,CACjC,SAAiB,EACjB,QAAgB;IAEhB,MAAM,OAAO,GAAG,IAAA,wBAAa,EAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,IAAI,CACpD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAC/B,CAAC;IACF,IAAI,CAAC,OAAO,EAAE,YAAY;QAAE,OAAO,SAAS,CAAC;IAC7C,MAAM,aAAa,GAAG,IAAA,2BAAiB,EAAC,SAAS,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC;AAkCD,iFAAiF;AAE1E,KAAK,UAAU,GAAG,CAAC,IAAqB;IAC7C,MAAM,KAAK,GAAG,IAAA,yBAAkB,GAAE,CAAC;IACnC,IAAA,uCAAkB,EAAC,KAAK,CAAC,CAAC;IAE1B,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACpD,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,IAAI,IAAA,iCAAa,EAAC,UAAU,CAAC,CAAC;IAClE,MAAM,UAAU,GAAG,IAAA,mCAAwB,EAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACnE,IAAA,YAAG,EACD,YAAY,UAAU,CAAC,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC9F,CAAC;IAEF,MAAM,GAAG,GAAmB;QAC1B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,UAAU;QACV,OAAO,EAAE,EAAE;QACX,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,IAAI,IAAA,+CAAyB,GAAE;QAC1E,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,aAAa,EAAE,IAAI,CAAC,aAAa;KAClC,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,WAAW,EAAE,CAAC;IAC/C,mEAAmE;IACnE,uEAAuE;IACvE,+DAA+D;IAC/D,MAAM,UAAU,GACd,IAAI,CAAC,SAAS,KAAK,KAAK;QACtB,CAAC,CAAC,OAAO,CAAC,IAAI;QACd,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAE7C,MAAM,SAAS,GAAG,IAAA,0BAAgB,GAAE,CAAC;IACrC,MAAM,SAAS,GAAG,CAAC,CAAkB,EAAW,EAAE,CAChD,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,CAAC,CAAkB,EAAW,EAAE,CAC/C,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC;IAElD,4EAA4E;IAC5E,0EAA0E;IAC1E,8EAA8E;IAC9E,4EAA4E;IAC5E,4CAA4C;IAC5C,MAAM,UAAU,GACd,IAAI,CAAC,SAAS,KAAK,KAAK;QACtB,CAAC,CAAC,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC;QAC1C,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACvB,MAAM,QAAQ,GAAG,CAAC,CAAkB,EAAwB,EAAE,CAC5D,mBAAmB,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,CAAC,CAAkB,EAAW,EAAE;QAC9C,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC1B,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC,CAAC;IAEF,+DAA+D;IAC/D,mEAAmE;IACnE,6DAA6D;IAC7D,+DAA+D;IAC/D,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC;gBAC7B,IAAA,YAAG,EACD,GAAG,CAAC,CAAC,WAAW,yHAAyH,CAC1I,CAAC;QACN,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,IAAA,gCAAsB,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YACpB,IAAA,YAAG,EACD,MAAM,MAAM,CAAC,WAAW,gEAAgE,IAAI,CAAC,QAAQ,kEAAkE,IAAI,CAAC,QAAQ,KAAK,CAC1L,CAAC;IACN,CAAC;SAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,IAAA,YAAG,EACD,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,0HAA0H,CACjL,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAC7B,CAAC,CAAC,EAAE,EAAE,CACJ,OAAO,CAAC,CAAC,CAAC;QACV,CAAC,IAAI,CAAC,IAAI;YACR,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YACb,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;gBACZ,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CACrE,CAAC;IAEF,8EAA8E;IAC9E,4EAA4E;IAC5E,IAAA,uCAAkB,EAAC;QACjB,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,UAAU,CAAC;QACtD,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC;QAClD,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,aAAa,EAAE,IAAI,CAAC,aAAa;KAClC,CAAC,CAAC;IAEH,IAAA,YAAG,EACD,WAAW,IAAI,CAAC,SAAS,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,kCAAkC,IAAI,CAAC,cAAc,EAAE,EAAE,CACtH,CAAC;IAEF,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;IACvE,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC;IACtB,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,KAAK,MAAM,CAAC,IAAI,MAAM;gBACpB,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACxD,MAAM,UAAU,CAAC,2BAA2B,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC7D,IAAA,YAAG,EAAC,8BAA8B,CAAC,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,MAAM,SAAS,GAAsB,EAAE,CAAC;YACxC,KAAK,MAAM,CAAC,IAAI,MAAM;gBACpB,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,GAAG,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAE1E,MAAM,UAAU,CAAC,2BAA2B,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAE7D,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBACxB,IAAA,YAAG,EAAC,0BAA0B,CAAC,CAAC;gBAChC,KAAK,MAAM,QAAQ,IAAI,SAAS;oBAAE,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;YAChE,CAAC;iBAAM,CAAC;gBACN,IAAA,YAAG,EAAC,6CAA6C,CAAC,CAAC;gBACnD,KAAK,MAAM,QAAQ,IAAI,SAAS;oBAC9B,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,kBAAkB,EAAE;wBAAE,IAAA,aAAI,EAAC,OAAO,CAAC,CAAC;YACvE,CAAC;YAED,IAAA,YAAG,EAAC,wBAAwB,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;AACH,CAAC"}

package/dist/lib/sentry.d.ts

@@ -0,0 +1,5 @@
+import type { DeploymentProvider } from "./providers/deployment";
+export declare function rotateSentry(targetEnv: string, client: DeploymentProvider, sentryOrgOverride?: string, sentryProjectOverride?: string, allowedTargets?: string[]): Promise<string>;
+export declare function initSentry(targetEnv: string, client: DeploymentProvider, sentryOrgOverride?: string, sentryProjectOverride?: string, allowedTargets?: string[]): Promise<void>;
+export declare function invalidateSentryKey(oldKeyId: string, org: string, project: string): Promise<void>;
+//# sourceMappingURL=sentry.d.ts.map

package/dist/lib/sentry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sentry.d.ts","sourceRoot":"","sources":["../../src/lib/sentry.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAgDjE,wBAAsB,YAAY,CAChC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,kBAAkB,EAC1B,iBAAiB,CAAC,EAAE,MAAM,EAC1B,qBAAqB,CAAC,EAAE,MAAM,EAC9B,cAAc,CAAC,EAAE,MAAM,EAAE,GACxB,OAAO,CAAC,MAAM,CAAC,CA+EjB;AAID,wBAAsB,UAAU,CAC9B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,kBAAkB,EAC1B,iBAAiB,CAAC,EAAE,MAAM,EAC1B,qBAAqB,CAAC,EAAE,MAAM,EAC9B,cAAc,CAAC,EAAE,MAAM,EAAE,GACxB,OAAO,CAAC,IAAI,CAAC,CAoCf;AAID,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAiBf"}

package/dist/lib/sentry.js

@@ -0,0 +1,132 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rotateSentry = rotateSentry;
+exports.initSentry = initSentry;
+exports.invalidateSentryKey = invalidateSentryKey;
+const auth_1 = require("./auth");
+const logger_1 = require("./logger");
+// ─── Helpers ──────────────────────────────────────────────────────────────────
+function targetEnvs(targetEnv) {
+    if (targetEnv === "all")
+        return ["production", "preview", "development"];
+    return [targetEnv];
+}
+async function sentryRequest(path, method = "GET", body) {
+    const token = (0, auth_1.resolveSentryToken)();
+    if (!token)
+        (0, logger_1.err)("Sentry auth token is required for Sentry key rotation — set SENTRY_AUTH_TOKEN or run `sentry-cli login`");
+    const base = process.env.SENTRY_URL ?? "https://sentry.io";
+    const res = await fetch(`${base}/api/0${path}`, {
+        method,
+        headers: {
+            Authorization: `Bearer ${token}`,
+            "Content-Type": "application/json",
+        },
+        body: body !== undefined ? JSON.stringify(body) : undefined,
+    });
+    if (!res.ok) {
+        const text = await res.text();
+        throw new Error(`Sentry API ${method} ${path} failed (${res.status}): ${text}`);
+    }
+    if (method === "DELETE")
+        return undefined;
+    return res.json();
+}
+// ─── Sentry rotation ──────────────────────────────────────────────────────────
+async function rotateSentry(targetEnv, client, sentryOrgOverride, sentryProjectOverride, allowedTargets) {
+    (0, logger_1.log)("Rotating Sentry client key...");
+    if (!(0, auth_1.resolveSentryToken)())
+        (0, logger_1.err)("Sentry auth token is required for Sentry rotation — set SENTRY_AUTH_TOKEN or run `sentry-cli login`");
+    const org = sentryOrgOverride ?? process.env.SENTRY_ORG;
+    const project = sentryProjectOverride ?? process.env.SENTRY_PROJECT;
+    if (!org)
+        (0, logger_1.err)("SENTRY_ORG is required for Sentry rotation");
+    if (!project)
+        (0, logger_1.err)("SENTRY_PROJECT is required for Sentry rotation");
+    const allEnvs = await client.listEnvVars();
+    let dsnKeyName = "";
+    let currentDsnId = "";
+    for (const candidate of ["NEXT_PUBLIC_SENTRY_DSN", "SENTRY_DSN"]) {
+        const found = allEnvs.envs.find((e) => e.key === candidate);
+        if (found) {
+            dsnKeyName = candidate;
+            currentDsnId = found.id;
+            break;
+        }
+    }
+    if (!dsnKeyName)
+        (0, logger_1.err)("Could not find SENTRY_DSN or NEXT_PUBLIC_SENTRY_DSN in Vercel");
+    (0, logger_1.log)(`  DSN env var: ${dsnKeyName}`);
+    const currentDsn = await client.getEnvVarValue(currentDsnId);
+    const currentKeys = await sentryRequest(`/projects/${org}/${project}/keys/`);
+    const dsnPublicKey = currentDsn.replace(/https?:\/\/([^@]+)@.*/, "$1");
+    const oldKey = currentKeys.find((k) => new RegExp(dsnPublicKey, "i").test(k.dsn.public));
+    if (!oldKey) {
+        (0, logger_1.warn)("Could not match current DSN to a Sentry project key — old key will not be invalidated");
+    }
+    else {
+        (0, logger_1.log)(`  Current Sentry key ID: ${oldKey.id}`);
+    }
+    (0, logger_1.log)("  Creating new Sentry project key...");
+    const label = `rotated-${new Date().toISOString().slice(0, 10).replace(/-/g, "")}`;
+    const newKey = await sentryRequest(`/projects/${org}/${project}/keys/`, "POST", {
+        name: label,
+    });
+    (0, logger_1.log)(`  New Sentry key ID: ${newKey.id}`);
+    for (const vercelEnv of targetEnvs(targetEnv)) {
+        if (allowedTargets && !allowedTargets.includes(vercelEnv))
+            continue;
+        const currentEnvs = await client.listEnvVars();
+        if (targetEnv === "all") {
+            const existing = currentEnvs.envs.find((e) => e.key === dsnKeyName && e.target.includes(vercelEnv));
+            if (!existing) {
+                (0, logger_1.log)(`  [${vercelEnv}] No existing ${dsnKeyName} — skipping (use --env ${vercelEnv} to explicitly add)`);
+                continue;
+            }
+        }
+        await client.setEnvForTarget(dsnKeyName, newKey.dsn.public, vercelEnv, currentEnvs.envs);
+    }
+    (0, logger_1.log)("Sentry key rotation complete.");
+    return oldKey?.id ?? "";
+}
+// ─── Sentry init ──────────────────────────────────────────────────────────────
+async function initSentry(targetEnv, client, sentryOrgOverride, sentryProjectOverride, allowedTargets) {
+    (0, logger_1.log)("Initializing Sentry DSN...");
+    if (!(0, auth_1.resolveSentryToken)())
+        (0, logger_1.err)("Sentry auth token is required for --init sentry — set SENTRY_AUTH_TOKEN or run `sentry-cli login`");
+    const org = sentryOrgOverride ?? process.env.SENTRY_ORG;
+    const project = sentryProjectOverride ?? process.env.SENTRY_PROJECT;
+    if (!org)
+        (0, logger_1.err)("SENTRY_ORG is required for --init sentry");
+    if (!project)
+        (0, logger_1.err)("SENTRY_PROJECT is required for --init sentry");
+    const dsnKeyName = "NEXT_PUBLIC_SENTRY_DSN";
+    (0, logger_1.log)("  Creating new Sentry project key...");
+    const label = `init-${new Date().toISOString().slice(0, 10).replace(/-/g, "")}`;
+    const newKey = await sentryRequest(`/projects/${org}/${project}/keys/`, "POST", { name: label });
+    (0, logger_1.log)(`  New Sentry key ID: ${newKey.id}`);
+    const currentEnvs = await client.listEnvVars();
+    for (const vercelEnv of targetEnvs(targetEnv)) {
+        if (allowedTargets && !allowedTargets.includes(vercelEnv))
+            continue;
+        await client.setEnvForTarget(dsnKeyName, newKey.dsn.public, vercelEnv, currentEnvs.envs);
+        (0, logger_1.log)(`  [${vercelEnv}] Pushed ${dsnKeyName}`);
+    }
+    (0, logger_1.log)("Sentry initialization complete.");
+}
+// ─── Sentry key invalidation ──────────────────────────────────────────────────
+async function invalidateSentryKey(oldKeyId, org, project) {
+    if (!oldKeyId) {
+        (0, logger_1.warn)("No old Sentry key ID recorded — skipping Sentry invalidation");
+        return;
+    }
+    (0, logger_1.log)(`Invalidating old Sentry key: ${oldKeyId}`);
+    try {
+        await sentryRequest(`/projects/${org}/${project}/keys/${oldKeyId}/`, "DELETE");
+        (0, logger_1.log)("  Old Sentry key deleted.");
+    }
+    catch {
+        (0, logger_1.warn)(`Failed to delete Sentry key ${oldKeyId} — remove it manually in Sentry project settings.`);
+    }
+}
+//# sourceMappingURL=sentry.js.map

package/dist/lib/sentry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sentry.js","sourceRoot":"","sources":["../../src/lib/sentry.ts"],"names":[],"mappings":";;AAkDA,oCAqFC;AAID,gCA0CC;AAID,kDAqBC;AA9MD,iCAA4C;AAC5C,qCAA0C;AAU1C,iFAAiF;AAEjF,SAAS,UAAU,CAAC,SAAiB;IACnC,IAAI,SAAS,KAAK,KAAK;QAAE,OAAO,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;IACzE,OAAO,CAAC,SAAS,CAAC,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,IAAY,EACZ,MAAM,GAAG,KAAK,EACd,IAAc;IAEd,MAAM,KAAK,GAAG,IAAA,yBAAkB,GAAE,CAAC;IACnC,IAAI,CAAC,KAAK;QACR,IAAA,YAAG,EACD,yGAAyG,CAC1G,CAAC;IAEJ,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC3D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,SAAS,IAAI,EAAE,EAAE;QAC9C,MAAM;QACN,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;KAC5D,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,cAAc,MAAM,IAAI,IAAI,YAAY,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAC/D,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAc,CAAC;IAC/C,OAAO,GAAG,CAAC,IAAI,EAAgB,CAAC;AAClC,CAAC;AAED,iFAAiF;AAE1E,KAAK,UAAU,YAAY,CAChC,SAAiB,EACjB,MAA0B,EAC1B,iBAA0B,EAC1B,qBAA8B,EAC9B,cAAyB;IAEzB,IAAA,YAAG,EAAC,+BAA+B,CAAC,CAAC;IAErC,IAAI,CAAC,IAAA,yBAAkB,GAAE;QACvB,IAAA,YAAG,EACD,qGAAqG,CACtG,CAAC;IAEJ,MAAM,GAAG,GAAG,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IACxD,MAAM,OAAO,GAAG,qBAAqB,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IACpE,IAAI,CAAC,GAAG;QAAE,IAAA,YAAG,EAAC,4CAA4C,CAAC,CAAC;IAC5D,IAAI,CAAC,OAAO;QAAE,IAAA,YAAG,EAAC,gDAAgD,CAAC,CAAC;IAEpE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;IAC3C,IAAI,UAAU,GAAG,EAAE,CAAC;IACpB,IAAI,YAAY,GAAG,EAAE,CAAC;IACtB,KAAK,MAAM,SAAS,IAAI,CAAC,wBAAwB,EAAE,YAAY,CAAC,EAAE,CAAC;QACjE,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC;QAC5D,IAAI,KAAK,EAAE,CAAC;YACV,UAAU,GAAG,SAAS,CAAC;YACvB,YAAY,GAAG,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,CAAC,UAAU;QACb,IAAA,YAAG,EAAC,+DAA+D,CAAC,CAAC;IACvE,IAAA,YAAG,EAAC,kBAAkB,UAAU,EAAE,CAAC,CAAC;IAEpC,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,MAAM,aAAa,CACrC,aAAa,GAAG,IAAI,OAAO,QAAQ,CACpC,CAAC;IACF,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,uBAAuB,EAAE,IAAI,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACpC,IAAI,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CACjD,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAA,aAAI,EACF,uFAAuF,CACxF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,IAAA,YAAG,EAAC,4BAA4B,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,IAAA,YAAG,EAAC,sCAAsC,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,WAAW,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;IACnF,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,aAAa,GAAG,IAAI,OAAO,QAAQ,EACnC,MAAM,EACN;QACE,IAAI,EAAE,KAAK;KACZ,CACF,CAAC;IACF,IAAA,YAAG,EAAC,wBAAwB,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IAEzC,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9C,IAAI,cAAc,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,SAAS;QACpE,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;QAC/C,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CACpC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAC5D,CAAC;YACF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,IAAA,YAAG,EACD,MAAM,SAAS,iBAAiB,UAAU,0BAA0B,SAAS,qBAAqB,CACnG,CAAC;gBACF,SAAS;YACX,CAAC;QACH,CAAC;QACD,MAAM,MAAM,CAAC,eAAe,CAC1B,UAAU,EACV,MAAM,CAAC,GAAG,CAAC,MAAM,EACjB,SAAS,EACT,WAAW,CAAC,IAAI,CACjB,CAAC;IACJ,CAAC;IAED,IAAA,YAAG,EAAC,+BAA+B,CAAC,CAAC;IACrC,OAAO,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,iFAAiF;AAE1E,KAAK,UAAU,UAAU,CAC9B,SAAiB,EACjB,MAA0B,EAC1B,iBAA0B,EAC1B,qBAA8B,EAC9B,cAAyB;IAEzB,IAAA,YAAG,EAAC,4BAA4B,CAAC,CAAC;IAElC,IAAI,CAAC,IAAA,yBAAkB,GAAE;QACvB,IAAA,YAAG,EACD,mGAAmG,CACpG,CAAC;IAEJ,MAAM,GAAG,GAAG,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IACxD,MAAM,OAAO,GAAG,qBAAqB,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IACpE,IAAI,CAAC,GAAG;QAAE,IAAA,YAAG,EAAC,0CAA0C,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO;QAAE,IAAA,YAAG,EAAC,8CAA8C,CAAC,CAAC;IAClE,MAAM,UAAU,GAAG,wBAAwB,CAAC;IAE5C,IAAA,YAAG,EAAC,sCAAsC,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;IAChF,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,aAAa,GAAG,IAAI,OAAO,QAAQ,EACnC,MAAM,EACN,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;IACF,IAAA,YAAG,EAAC,wBAAwB,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IAEzC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;IAC/C,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9C,IAAI,cAAc,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,SAAS;QACpE,MAAM,MAAM,CAAC,eAAe,CAC1B,UAAU,EACV,MAAM,CAAC,GAAG,CAAC,MAAM,EACjB,SAAS,EACT,WAAW,CAAC,IAAI,CACjB,CAAC;QACF,IAAA,YAAG,EAAC,MAAM,SAAS,YAAY,UAAU,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,IAAA,YAAG,EAAC,iCAAiC,CAAC,CAAC;AACzC,CAAC;AAED,iFAAiF;AAE1E,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,GAAW,EACX,OAAe;IAEf,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,IAAA,aAAI,EAAC,8DAA8D,CAAC,CAAC;QACrE,OAAO;IACT,CAAC;IACD,IAAA,YAAG,EAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,aAAa,CACjB,aAAa,GAAG,IAAI,OAAO,SAAS,QAAQ,GAAG,EAC/C,QAAQ,CACT,CAAC;QACF,IAAA,YAAG,EAAC,2BAA2B,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,IAAA,aAAI,EACF,+BAA+B,QAAQ,mDAAmD,CAC3F,CAAC;IACJ,CAAC;AACH,CAAC"}