@styleflow.app/flowpress-deploy 1.0.0-beta.2 → 1.0.0-beta.4

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 1.0.0-beta.4 — 2026-10-19
+
+- Add published FlowPress Ops CLI, readable deployment manifests, shared MariaDB bindings, reusable container runtimes, isolated environment loading, immutable releases, backup verification and on-demand preview.
+- [Canonical report](https://github.com/StyleFlow-App/styleflow-docs/blob/main/dev/rapporti/2026-10-19-piattaforma-container-flowpress.md).
+
+## Unreleased
+
+- Agent rules only, no runtime or API change: `AGENTS.md` names the canonical
+  docs vault path (2026-10-18) and requires every published change to be
+  merged into `main`, with its branches, worktrees and stashes removed in the
+  same task.
+  [Canonical report](https://github.com/StyleFlow-App/styleflow-docs/blob/main/dev/rapporti/2026-10-19-branch-residui-e-regole-di-chiusura.md).
+
+## 1.0.0-beta.3 — 2026-10-14
+
+- Queue complete builds for term-only changes to published content, including withdrawal after a visibility change. Keep unchanged assignments idle and avoid private data in the queue.
+- Verified public → private → public on disposable WordPress with all outbound HTTP intercepted.
+- [Canonical integration report](https://github.com/StyleFlow-App/styleflow-docs/blob/main/dev/rapporti/2026-10-14-consolidamento-tessari.md).
+
 ## 1.0.0-beta.2 — 2026-10-14
 
 - Automatic debounced editorial builds and public asset validation/history.

package/README.md

@@ -4,3 +4,8 @@ Official npm/Composer integration for FlowPress.
 
 - [Canonical guide](https://github.com/StyleFlow-App/styleflow-docs/blob/main/wiki/flowpress-routing-deploy.md)
 - [Release and verification report](https://github.com/StyleFlow-App/styleflow-docs/blob/main/dev/rapporti/2026-10-14-consolidamento-tessari.md)
+
+- [Container platform and FlowPress Ops](https://github.com/StyleFlow-App/styleflow-docs/blob/main/wiki/piattaforma-container-flowpress.md)
+
+The npm package also provides the flowpress-ops binary, reusable container
+recipes and the ./ops/environment API. Run flowpress-ops --help for commands.

package/containers/cms/Dockerfile

@@ -0,0 +1,35 @@
+# syntax=docker/dockerfile:1.7
+# The reusable PHP runtime is built once by platform build-base.
+ARG FLOWPRESS_PHP_IMAGE
+FROM $FLOWPRESS_PHP_IMAGE AS build
+USER root
+RUN apt-get update && apt-get install -y --no-install-recommends git && rm -rf /var/lib/apt/lists/*
+COPY --from=composer:2 /usr/bin/composer /usr/local/bin/composer
+WORKDIR /srv/cms
+COPY apps/cms/ ./
+RUN --mount=type=secret,id=composer_auth,required=true \
+    --mount=type=cache,target=/root/.composer/cache \
+    COMPOSER_AUTH="$(cat /run/secrets/composer_auth)" \
+    composer install --no-dev --no-interaction --prefer-dist --optimize-autoloader --no-progress
+COPY --from=flowpress /cms/install-languages.sh /usr/local/bin/install-languages
+RUN sh /usr/local/bin/install-languages /srv/cms/web
+ARG WP_CLI_VERSION=2.12.0
+ARG WP_CLI_SHA256=ce34ddd838f7351d6759068d09793f26755463b4a4610a5a5c0a97b68220d85c
+RUN curl -fsSL "https://github.com/wp-cli/wp-cli/releases/download/v$WP_CLI_VERSION/wp-cli-$WP_CLI_VERSION.phar" -o /wp-cli.phar \
+ && echo "$WP_CLI_SHA256  /wp-cli.phar" | sha256sum -c - && chmod 755 /wp-cli.phar
+FROM $FLOWPRESS_PHP_IMAGE
+WORKDIR /srv/cms
+COPY --from=build /srv/cms/ ./
+COPY --from=build /wp-cli.phar /usr/local/bin/wp
+COPY --from=flowpress /cms/wp-cli.yml /srv/cms/wp-cli.yml
+COPY --from=flowpress /cms/healthz.php /srv/cms/web/healthz.php
+COPY --from=flowpress /cms/smtp.php /usr/local/share/flowpress-smtp.php
+RUN mkdir -p web/app/uploads web/app/webp-express web/app/cache web/app/upgrade \
+ && chown -R www-data:www-data web/app/uploads web/app/webp-express web/app/cache web/app/upgrade \
+ && echo 'auto_prepend_file=/usr/local/share/flowpress-smtp.php' > /usr/local/etc/php/conf.d/zz-smtp.ini
+ARG RELEASE_SHA=unknown
+ENV RELEASE_SHA=$RELEASE_SHA
+LABEL org.opencontainers.image.revision=$RELEASE_SHA
+USER www-data
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=5 CMD curl -fsS http://127.0.0.1:8080/healthz.php > /dev/null || exit 1
+CMD ["apache2-foreground"]

package/containers/cms/Dockerfile.dockerignore

@@ -0,0 +1,20 @@
+.git
+node_modules
+.env*
+.secrets
+.local
+.styleflow
+apps/web
+packages
+docs
+apps/cms/vendor
+apps/cms/auth.json
+apps/cms/.env*
+apps/cms/web/wp
+apps/cms/web/app/plugins
+apps/cms/web/app/uploads
+apps/cms/web/app/webp-express
+apps/cms/web/app/cache
+apps/cms/web/app/upgrade
+apps/cms/web/app/mu-plugins/flowpress-*
+apps/cms/web/app/mu-plugins/flowpress-core

package/containers/cms/healthz.php

@@ -0,0 +1,17 @@
+<?php
+declare(strict_types=1);
+header('Content-Type: application/json');
+header('Cache-Control: no-store');
+try {
+    define('SHORTINIT', true);
+    require __DIR__ . '/wp/wp-load.php';
+    global $wpdb;
+    $installed = $wpdb->get_var("SELECT option_value FROM {$wpdb->options} WHERE option_name = 'siteurl'");
+    if (!$installed || !is_readable(__DIR__ . '/app/mu-plugins/flowpress-core/flowpress-core.php')) {
+        throw new RuntimeException('CMS not initialized.');
+    }
+    echo json_encode(['status' => 'ok', 'environment' => getenv('APP_ENV'), 'release' => getenv('RELEASE_SHA')]);
+} catch (Throwable $error) {
+    http_response_code(503);
+    echo json_encode(['status' => 'error', 'release' => getenv('RELEASE_SHA')]);
+}

package/containers/cms/install-languages.sh

@@ -0,0 +1,16 @@
+#!/bin/sh
+# Installs the Italian WordPress core translation matching the installed core.
+# Languages are gitignored and DISALLOW_FILE_MODS blocks installing them at
+# runtime, so they are part of the image.
+set -eu
+web_root="$1"
+version="$(php -r "include '$web_root/wp/wp-includes/version.php'; echo \$wp_version;")"
+package="$(curl -fsSL "https://api.wordpress.org/translations/core/1.0/?version=$version" \
+  | php -r '$d = json_decode(stream_get_contents(STDIN), true);
+            foreach ($d["translations"] ?? [] as $t) { if ($t["language"] === "it_IT") { echo $t["package"]; exit; } }
+            exit(1);')"
+mkdir -p "$web_root/app/languages"
+curl -fsSL "$package" -o /tmp/it_IT.zip
+unzip -oq /tmp/it_IT.zip -d "$web_root/app/languages"
+rm /tmp/it_IT.zip
+echo "Installed it_IT core translation for WordPress $version."

package/containers/cms/mpm.conf

@@ -0,0 +1,10 @@
+# Sized for a 1536m container limit: 8 workers at up to 256M PHP memory each,
+# typical WordPress requests use far less.
+<IfModule mpm_prefork_module>
+    StartServers             2
+    MinSpareServers          2
+    MaxSpareServers          4
+    ServerLimit              8
+    MaxRequestWorkers        8
+    MaxConnectionsPerChild 500
+</IfModule>

package/containers/cms/php.ini

@@ -0,0 +1,16 @@
+expose_php = Off
+display_errors = Off
+log_errors = On
+error_log = /proc/self/fd/2
+memory_limit = 256M
+upload_max_filesize = 64M
+post_max_size = 68M
+max_execution_time = 120
+max_input_vars = 3000
+session.save_path = /tmp
+; Code is immutable inside the image: never stat files for changes.
+opcache.enable = 1
+opcache.validate_timestamps = 0
+opcache.memory_consumption = 128
+opcache.interned_strings_buffer = 16
+opcache.max_accelerated_files = 20000

package/containers/cms/sanitize.php

@@ -0,0 +1,37 @@
+<?php
+// Executed only against a disposable copy, never against the source.
+declare(strict_types=1);
+if (getenv('FLOWPRESS_RUNTIME_POLICY') !== 'container' || getenv('APP_ENV') === 'production') {
+    throw new RuntimeException('Refusing to sanitize a production database.');
+}
+global $wpdb;
+foreach (get_users(['fields' => 'ID']) as $user_id) {
+    $wpdb->update($wpdb->users, ['user_pass' => wp_hash_password(wp_generate_password(64, true, true)), 'user_activation_key' => ''], ['ID' => $user_id]);
+    delete_user_meta((int) $user_id, 'session_tokens');
+    delete_user_meta((int) $user_id, '_application_passwords');
+}
+$plugins = get_option('active_plugins', []);
+update_option('active_plugins', array_values(array_filter($plugins, static fn (string $plugin): bool
+    => !preg_match('~^(advanced-media-offloader|wp-mail-smtp|wp-migrate-db-pro)/~', $plugin))));
+foreach (['advmo_settings', 'wp_mail_smtp', 'cron'] as $option) {
+    delete_option($option);
+}
+update_option('home', getenv('WP_HOME'));
+update_option('siteurl', getenv('WP_SITEURL'));
+update_option('blog_public', '0');
+$wpdb->query("DELETE FROM {$wpdb->options} WHERE option_name LIKE 'flowpress%queue%' OR option_name LIKE '%_transient_%'");
+$attachments = get_posts(['post_type' => 'attachment', 'post_status' => 'any', 'numberposts' => -1, 'fields' => 'ids']);
+foreach ($attachments as $id) {
+    $relative = get_post_meta($id, '_wp_attached_file', true);
+    if (is_string($relative) && $relative !== '' && !str_contains($relative, '..') && !str_contains($relative, '://')) {
+        $wpdb->update($wpdb->posts, ['guid' => rtrim(getenv('WP_HOME'), '/') . '/app/uploads/' . ltrim($relative, '/')], ['ID' => $id]);
+    }
+    foreach (array_keys(get_post_meta($id)) as $key) {
+        if (preg_match('/advmo|offload/i', $key)) delete_post_meta($id, $key);
+    }
+}
+echo json_encode([
+    'tables' => count($wpdb->get_col($wpdb->prepare('SHOW TABLES LIKE %s', $wpdb->esc_like($wpdb->prefix) . '%'))),
+    'published' => (int) $wpdb->get_var("SELECT COUNT(*) FROM {$wpdb->posts} WHERE post_status='publish'"),
+    'attachments' => count($attachments),
+]) . "\n";

package/containers/cms/smtp.php

@@ -0,0 +1,13 @@
+<?php
+// Runs before Bedrock without reading any project file or persisted option.
+if (getenv('FLOWPRESS_RUNTIME_POLICY') === 'container' && getenv('FLOWPRESS_MAIL_MODE') === 'smtp' && getenv('APP_ENV') === 'production') {
+    foreach ([
+        'WPMS_ON' => true, 'WPMS_MAILER' => 'smtp',
+        'WPMS_SMTP_HOST' => getenv('SMTP_HOST'), 'WPMS_SMTP_PORT' => (int) getenv('SMTP_PORT'),
+        'WPMS_SMTP_SSL' => getenv('SMTP_ENCRYPTION'), 'WPMS_SMTP_AUTH' => true,
+        'WPMS_SMTP_USER' => getenv('SMTP_USER'), 'WPMS_SMTP_PASS' => getenv('SMTP_PASSWORD'),
+        'WPMS_MAIL_FROM' => getenv('SMTP_FROM'), 'WPMS_MAIL_FROM_NAME' => getenv('SMTP_FROM_NAME'),
+    ] as $key => $value) {
+        if (!defined($key)) define($key, $value);
+    }
+}

package/containers/cms/vhost.conf

@@ -0,0 +1,58 @@
+# Apache vhost for the container CMS. .htaccess files are ignored
+# (AllowOverride None): every rule WordPress needs is declared here.
+<VirtualHost *:8080>
+    ServerName localhost
+    DocumentRoot /srv/cms/web
+
+    <Directory /srv/cms/web>
+        AllowOverride None
+        Options +FollowSymLinks -Indexes
+        Require all granted
+        DirectoryIndex index.php
+
+        RewriteEngine On
+        # Application Passwords (cms:template) and Bearer callbacks need the
+        # Authorization header inside PHP.
+        RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
+        RewriteRule ^index\.php$ - [L]
+        RewriteCond %{REQUEST_FILENAME} !-f
+        RewriteCond %{REQUEST_FILENAME} !-d
+        RewriteRule . /index.php [L]
+    </Directory>
+
+    # Uploaded files are data, never code.
+    <Directory /srv/cms/web/app/uploads>
+        <FilesMatch "\.(php[0-9]?|phtml|phar|pht)$">
+            Require all denied
+        </FilesMatch>
+    </Directory>
+    <FilesMatch "^\.|^(auth\.json|composer\.(json|lock)|wp-cli\.yml)$">
+        Require all denied
+    </FilesMatch>
+    <Files "xmlrpc.php">
+        Require all denied
+    </Files>
+
+    # Traefik (Docker network) sits in front; Cloudflare adds CF-Connecting-IP.
+    # Only the private proxy hop is trusted, see docs/wiki/deploy/07-sicurezza-e-accessi.md.
+    RemoteIPHeader CF-Connecting-IP
+    RemoteIPInternalProxy 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
+    SetEnvIfNoCase X-Forwarded-Proto "^https$" HTTPS=on
+
+    <IfModule mod_expires.c>
+        ExpiresActive On
+        ExpiresByType image/webp "access plus 30 days"
+        ExpiresByType image/avif "access plus 30 days"
+        ExpiresByType image/jpeg "access plus 30 days"
+        ExpiresByType image/png "access plus 30 days"
+        ExpiresByType image/svg+xml "access plus 30 days"
+        ExpiresByType font/woff2 "access plus 1 year"
+    </IfModule>
+
+    Header always set X-Content-Type-Options "nosniff"
+    Header always set Referrer-Policy "strict-origin-when-cross-origin"
+
+    LogFormat "%a %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\" %D" container
+    ErrorLog /proc/self/fd/2
+    CustomLog /proc/self/fd/1 container
+</VirtualHost>

package/containers/cms/wp-cli.yml

@@ -0,0 +1 @@
+path: web/wp

package/containers/php-runtime/Dockerfile

@@ -0,0 +1,21 @@
+# syntax=docker/dockerfile:1.7
+FROM php:8.3-apache-bookworm
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates curl default-mysql-client libicu-dev libjpeg62-turbo-dev \
+    libpng-dev libwebp-dev libzip-dev unzip webp \
+ && docker-php-ext-configure gd --with-jpeg --with-webp \
+ && docker-php-ext-install exif gd intl mysqli opcache pdo_mysql zip \
+ && a2enmod expires headers remoteip rewrite \
+ && rm -rf /var/lib/apt/lists/*
+COPY cms/vhost.conf /etc/apache2/sites-available/000-default.conf
+COPY cms/mpm.conf /etc/apache2/mods-available/mpm_prefork.conf
+COPY cms/php.ini /usr/local/etc/php/conf.d/zz-container.ini
+RUN sed -i 's/^Listen 80$/Listen 8080/' /etc/apache2/ports.conf \
+ && sed -i '/Listen 443/d' /etc/apache2/ports.conf \
+ && echo 'ServerName localhost' > /etc/apache2/conf-available/servername.conf \
+ && a2enconf servername \
+ && mkdir -p /tmp/apache2 \
+ && chown www-data:www-data /tmp/apache2 \
+ && find / -xdev -perm /6000 -type f -exec chmod a-s {} + 2>/dev/null
+ENV APACHE_RUN_DIR=/tmp/apache2 APACHE_PID_FILE=/tmp/apache2/apache2.pid APACHE_LOCK_DIR=/tmp/apache2
+EXPOSE 8080

package/containers/web-ssr/Dockerfile

@@ -0,0 +1,25 @@
+# syntax=docker/dockerfile:1.7
+FROM node:22-bookworm-slim AS dependencies
+RUN corepack enable && corepack prepare pnpm@9.15.4 --activate
+WORKDIR /workspace
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc ./
+COPY apps/web/package.json apps/web/package.json
+COPY apps/cms/package.json apps/cms/package.json
+COPY packages/ui packages/ui
+ARG WEB_PACKAGE
+RUN --mount=type=cache,target=/root/.local/share/pnpm/store pnpm --filter $WEB_PACKAGE --prod deploy /deploy
+FROM node:22-bookworm-slim
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl \
+ && rm -rf /var/lib/apt/lists/* \
+ && find / -xdev -perm /6000 -type f -exec chmod a-s {} + 2>/dev/null
+WORKDIR /srv/web
+COPY --from=dependencies /deploy/node_modules ./node_modules
+ARG DIST_DIR
+COPY $DIST_DIR/ ./dist/
+ARG RELEASE_SHA=unknown
+ENV NODE_ENV=production HOST=0.0.0.0 PORT=8080 RELEASE_SHA=$RELEASE_SHA
+LABEL org.opencontainers.image.revision=$RELEASE_SHA
+USER node
+EXPOSE 8080
+HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 CMD curl -fsS http://127.0.0.1:8080/healthz.json > /dev/null || exit 1
+CMD ["node", "dist/server/entry.mjs"]

package/containers/web-ssr/Dockerfile.dockerignore

@@ -0,0 +1,10 @@
+.git
+node_modules
+.env*
+.secrets
+.local
+apps/cms/vendor
+apps/cms/auth.json
+apps/cms/.env*
+apps/cms/web
+docs

package/containers/web-static/Caddyfile

@@ -0,0 +1,40 @@
+# Static production frontend. Cloudflare terminates TLS and caches at the edge;
+# Traefik forwards plain HTTP to port 8080.
+{
+	admin off
+	auto_https off
+	persist_config off
+	servers {
+		trusted_proxies static private_ranges
+	}
+}
+
+:8080 {
+	header X-Content-Type-Options nosniff
+	header Referrer-Policy strict-origin-when-cross-origin
+	@internal path /.container* /.flowpress* /.env* /server/*
+	respond @internal 404
+	root * /srv/site
+	encode zstd gzip
+
+	# Redirects, headers and media proxies generated from the Astro build.
+	import /srv/site/.container/routes.caddy
+
+	header /healthz.json Cache-Control "no-store"
+	header /_astro/* Cache-Control "public, max-age=31536000, immutable"
+	# HTML revalidates in browsers; Cloudflare keeps it at the edge until the
+	# deploy purge (see docs/wiki/deploy/06-cloudflare.md).
+	@html path / *.html */
+	header @html Cache-Control "public, max-age=0, must-revalidate"
+
+	file_server {
+		hide .container .flowpress-baseline.json .flowpress-fingerprint _redirects _headers _routes.json
+	}
+
+	handle_errors 404 {
+		header Cache-Control "no-store"
+		header CDN-Cache-Control "no-store"
+		rewrite * /404.html
+		file_server
+	}
+}

package/containers/web-static/Dockerfile

@@ -0,0 +1,15 @@
+# syntax=docker/dockerfile:1.7
+FROM caddy:2.10-alpine
+RUN apk add --no-cache libcap && setcap -r /usr/bin/caddy && apk del libcap \
+ && find / -xdev -perm /6000 -type f -exec chmod a-s {} + 2>/dev/null
+COPY --from=flowpress /web-static/Caddyfile /etc/caddy/Caddyfile
+ARG DIST_DIR
+COPY $DIST_DIR/ /srv/site/
+RUN test -f /srv/site/.container/routes.caddy && caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile
+ARG RELEASE_SHA=unknown
+ENV RELEASE_SHA=$RELEASE_SHA
+LABEL org.opencontainers.image.revision=$RELEASE_SHA
+USER 65534:65534
+EXPOSE 8080
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 CMD wget -q -O /dev/null http://127.0.0.1:8080/healthz.json || exit 1
+CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]

package/containers/web-static/Dockerfile.dockerignore

@@ -0,0 +1,7 @@
+.git
+node_modules
+.env*
+.secrets
+.local
+apps/cms
+docs

package/dist/ops/bootstrap.d.ts

@@ -0,0 +1,21 @@
+export function provisionRegistry(root: any, manifest: any, { file, apply }?: {
+    apply?: boolean | undefined;
+}): Promise<{
+    changes: string[];
+    applied: boolean;
+    credentials?: undefined;
+} | {
+    changes: string[];
+    applied: boolean;
+    credentials: string;
+}>;
+export function provisionDns(root: any, manifest: any, name: any, { file, apply }?: {
+    apply?: boolean | undefined;
+}): Promise<{
+    host: string;
+    exists: boolean;
+    applied: boolean;
+    target: any;
+    frontendChanged: boolean;
+}>;
+//# sourceMappingURL=bootstrap.d.ts.map

package/dist/ops/bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../src/ops/bootstrap.js"],"names":[],"mappings":"AAIA;;;;;;;;;;GA8DC;AACD;;;;;;;;GAqBC"}

package/dist/ops/bootstrap.js

@@ -0,0 +1,106 @@
+import { mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { identity, operatorEnvironment, platformConfig, publicPlatform, writeJson, readJson } from "./config.js";
+export async function provisionRegistry(root, manifest, { file, apply = false } = {}) {
+    const platform = platformConfig(root, manifest, file), operator = operatorEnvironment(root);
+    const username = operator.HARBOR_ADMIN_USER, password = operator.HARBOR_ADMIN_PASSWORD;
+    if (!username || !password || !operator.HARBOR_API_URL)
+        throw new Error("Set private HARBOR_API_URL/HARBOR_ADMIN_USER/HARBOR_ADMIN_PASSWORD.");
+    const api = async (method, path, body) => {
+        const response = await fetch(operator.HARBOR_API_URL.replace(/\/$/, "") + "/api/v2.0" + path, {
+            method, redirect: "error", signal: AbortSignal.timeout(30000),
+            headers: { authorization: "Basic " + Buffer.from(username + ":" + password).toString("base64"), "content-type": "application/json" },
+            ...(body ? { body: JSON.stringify(body) } : {}),
+        });
+        if (!response.ok)
+            throw new Error("Harbor " + method + " " + path + " refused (HTTP " + response.status + ").");
+        const text = await response.text();
+        return text ? JSON.parse(text) : {};
+    };
+    const projects = [platform.registryProject, "flowpress"];
+    const changes = [];
+    const existing = await api("GET", "/projects?page_size=100");
+    for (const name of projects) {
+        if (!/^[a-z0-9][a-z0-9_.-]+$/.test(name))
+            throw new Error("Invalid Harbor project.");
+        if (!existing.some(project => project.name === name)) {
+            changes.push("Create private Harbor project " + name);
+            if (apply)
+                await api("POST", "/projects", { project_name: name, public: false, storage_limit: (name === "flowpress" ? 2 : 5) * 1024 ** 3 });
+        }
+    }
+    if (!apply)
+        return { changes, applied: false };
+    const current = await api("GET", "/projects?page_size=100");
+    const robots = await api("GET", "/robots?page_size=100");
+    const privateFile = join(root, ".secrets/registry-created.json");
+    const created = readJson(privateFile, {});
+    for (const name of projects) {
+        const project = current.find(item => item.name === name);
+        const robotName = name === "flowpress" ? "flowpress-ci" : "ci";
+        const expected = "robot$" + name + "+" + robotName;
+        if (!robots.some(robot => robot.name === expected)) {
+            const robot = await api("POST", "/robots", {
+                name: robotName, description: "FlowPress build/push for " + name, duration: 365, level: "project",
+                permissions: [{ kind: "project", namespace: name, access: [{ resource: "repository", action: "pull" }, { resource: "repository", action: "push" }] }],
+            });
+            created[name] = { name: robot.name, secret: robot.secret };
+            writeJson(privateFile, created, 0o600);
+        }
+        const metadata = await api("GET", "/projects/" + project.project_id);
+        if (!metadata.metadata?.retention_id)
+            await api("POST", "/retentions", {
+                algorithm: "or", scope: { level: "project", ref: project.project_id },
+                trigger: { kind: "Schedule", settings: { cron: "0 0 1 * * *" } },
+                rules: [
+                    { id: 0, priority: 0, disabled: false, action: "retain", template: "always", tag_selectors: [{ kind: "doublestar", decoration: "matches", pattern: "{staging,production,preview,latest}" }], scope_selectors: { repository: [{ kind: "doublestar", decoration: "repoMatches", pattern: "**" }] } },
+                    { id: 0, priority: 0, disabled: false, action: "retain", template: "latestPushedK", params: { latestPushedK: 3 }, tag_selectors: [{ kind: "doublestar", decoration: "matches", pattern: "**" }], scope_selectors: { repository: [{ kind: "doublestar", decoration: "repoMatches", pattern: "**" }] } },
+                ],
+            });
+    }
+    // Add pull scope without replacing permissions belonging to existing installations.
+    const nodes = robots.find(robot => robot.name === "robot$nodes-pull");
+    if (!nodes)
+        throw new Error("The existing nodes-pull robot was not found.");
+    const detail = await api("GET", "/robots/" + nodes.id);
+    let changed = false;
+    for (const name of projects)
+        if (!detail.permissions.some(permission => permission.namespace === name)) {
+            detail.permissions.push({ kind: "project", namespace: name, access: [{ resource: "repository", action: "pull" }] });
+            changed = true;
+        }
+    if (changed)
+        await api("PUT", "/robots/" + nodes.id, { name: detail.name, description: detail.description, duration: detail.duration, disable: detail.disable, permissions: detail.permissions });
+    if (Object.keys(created).length)
+        writeJson(privateFile, created, 0o600);
+    return { changes, applied: true, credentials: Object.keys(created).length ? ".secrets/registry-created.json" : "existing" };
+}
+export async function provisionDns(root, manifest, name, { file, apply = false } = {}) {
+    const target = manifest.environments[name];
+    if (!target?.publish.includes("cms"))
+        throw new Error("CMS publication is disabled.");
+    const platform = platformConfig(root, manifest, file), operator = operatorEnvironment(root);
+    const { coolifyClient } = await import("./coolify.js");
+    const server = await coolifyClient(platform.coolifyUrl, operator.COOLIFY_TOKEN)("GET", "/servers/" + platform.serverUuid);
+    const host = new URL(target.backendUrl).hostname;
+    const api = async (method, path, body) => {
+        const res = await fetch("https://api.cloudflare.com/client/v4" + path, { method, redirect: "error", signal: AbortSignal.timeout(30000), headers: { authorization: "Bearer " + operator.CLOUDFLARE_API_TOKEN, "content-type": "application/json" }, ...(body ? { body: JSON.stringify(body) } : {}) });
+        const data = await res.json();
+        if (!res.ok || !data.success)
+            throw new Error("DNS API refused " + method + " (HTTP " + res.status + ").");
+        return data.result;
+    };
+    let zone;
+    const labels = host.split(".");
+    for (let offset = 0; offset < labels.length - 1 && !zone; offset++)
+        zone = (await api("GET", "/zones?name=" + labels.slice(offset).join(".")))[0];
+    if (!zone)
+        throw new Error("No accessible DNS zone for the staging backend.");
+    const existing = await api("GET", "/zones/" + zone.id + "/dns_records?name=" + host);
+    if (existing.length && !existing.some(item => item.type === "A" && item.content === server.ip))
+        throw new Error("An existing DNS record has a different target; no record was changed.");
+    if (!existing.length && apply)
+        await api("POST", "/zones/" + zone.id + "/dns_records", { type: "A", name: host, content: server.ip, proxied: true, ttl: 1, comment: "FlowPress staging backend" });
+    return { host, exists: Boolean(existing.length), applied: apply, target: server.ip, frontendChanged: false };
+}
+//# sourceMappingURL=bootstrap.js.map

package/dist/ops/bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../src/ops/bootstrap.js"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,cAAc,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEjH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,GAAG,KAAK,EAAE,GAAG,EAAE;IAClF,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC5F,MAAM,QAAQ,GAAG,QAAQ,CAAC,iBAAiB,EAAE,QAAQ,GAAG,QAAQ,CAAC,qBAAqB,CAAC;IACvF,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IAC/I,MAAM,GAAG,GAAG,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QACvC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,WAAW,GAAG,IAAI,EAAE;YAC5F,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;YAC7D,OAAO,EAAE,EAAE,aAAa,EAAE,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,GAAG,GAAG,GAAG,QAAQ,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACpI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,SAAS,GAAG,MAAM,GAAG,GAAG,GAAG,IAAI,GAAG,iBAAiB,GAAG,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;QAChH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtC,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,QAAQ,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,EAAE,CAAC;IACnB,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC;IAC7D,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACrF,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YACrD,OAAO,CAAC,IAAI,CAAC,gCAAgC,GAAG,IAAI,CAAC,CAAC;YACtD,IAAI,KAAK;gBAAE,MAAM,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9I,CAAC;IACH,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,gCAAgC,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/D,MAAM,QAAQ,GAAG,QAAQ,GAAG,IAAI,GAAG,GAAG,GAAG,SAAS,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;YACnD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE;gBACzC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,2BAA2B,GAAG,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS;gBACjG,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;aACtJ,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3D,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;QACrE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,YAAY;YAAE,MAAM,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE;gBACrE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,UAAU,EAAE;gBACrE,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;gBAChE,KAAK,EAAE;oBACL,EAAE,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC,EAAE,eAAe,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE;oBAClS,EAAE,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,eAAe,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE;iBACvS;aACF,CAAC,CAAC;IACL,CAAC;IACD,oFAAoF;IACpF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC;IACtE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;IACvD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,IAAI,IAAI,QAAQ;QAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,KAAK,IAAI,CAAC,EAAE,CAAC;YACvG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;QACtI,CAAC;IACD,IAAI,OAAO;QAAE,MAAM,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG,KAAK,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IAClM,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM;QAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACxE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;AAC9H,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,GAAG,KAAK,EAAE,GAAG,EAAE;IACnF,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACtF,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC5F,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC,KAAK,EAAE,WAAW,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC1H,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC;IACjD,MAAM,GAAG,GAAG,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,sCAAsC,GAAG,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,GAAG,QAAQ,CAAC,oBAAoB,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACtS,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,MAAM,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;QAC3G,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC,CAAC;IACF,IAAI,IAAI,CAAC;IACT,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE;QAAE,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClJ,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAC9E,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI,CAAC,EAAE,GAAG,oBAAoB,GAAG,IAAI,CAAC,CAAC;IACrF,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,CAAC,OAAO,KAAK,MAAM,CAAC,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IACzL,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,KAAK;QAAE,MAAM,GAAG,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC,EAAE,GAAG,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC,CAAC;IACnM,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;AAC/G,CAAC"}

package/dist/ops/build.d.ts

@@ -0,0 +1,30 @@
+export function registryLogin(platform: any, operator: any): void;
+export function inspectDigest(image: any): any;
+export function buildBase(root: any, platform: any, { push }?: {
+    push?: boolean | undefined;
+}): {
+    image: string;
+};
+export function frontendBuild(root: any, manifest: any, name: any, { sha, buildId }: {
+    sha: any;
+    buildId: any;
+}): {
+    env: any;
+    dist: any;
+};
+export function build(root: any, manifest: any, name: any, component: any, { sha, buildId, push, file, skipFrontend }?: {
+    push?: boolean | undefined;
+    skipFrontend?: boolean | undefined;
+}): {
+    component: any;
+    environment: any;
+    repository: string;
+    tag: string;
+    digest: any;
+    sha: any;
+    buildId: any;
+    pushed: boolean;
+};
+export const packageRoot: string;
+export const containers: string;
+//# sourceMappingURL=build.d.ts.map

package/dist/ops/build.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../src/ops/build.js"],"names":[],"mappings":"AAUA,kEAGC;AACD,+CAKC;AACD;;;;EAMC;AACD;;;;;;EAqBC;AACD;;;;;;;;;;;;EAqCC;AA9ED,iCAA6E;AAC7E,gCAA0D"}