@substrat-run/contracts 0.48.1 → 0.49.0

package/dist/ci.d.ts

@@ -0,0 +1,111 @@
+/**
+ * The builder's CI vocabulary: preview tag conventions, the PR sticky-comment bodies,
+ * and the generated GitHub Actions workflow.
+ *
+ * It lives here — not in the dashboard, not in the CLI — for the same reason the deploy
+ * manifest does: BOTH ends must speak the same shape. Three writers exist for the same
+ * two artifacts and any drift between them is a silent bug:
+ *
+ * - the **dashboard's one-click CI setup** commits the workflow to a customer repo and
+ *   (via `GithubRepoLinkDO`) posts the PR comment from the platform side;
+ * - **`substrat init --ci github`** writes the same workflow for a builder who owns their
+ *   own CI and never connected the GitHub App;
+ * - the **workflow itself** posts the same comment from the CI side, as the fallback for
+ *   an App installation that lacks `pull-requests: write`.
+ *
+ * The comment bodies are generated once here and rendered into the workflow's `printf`
+ * format string, so the platform-written and CI-written comments cannot say different
+ * things about the same PR. One generator, three writers, no drift.
+ *
+ * Pure string building — no zod, no network, no node. Safe in a worker, a CLI, and a
+ * browser bundle alike.
+ */
+/**
+ * The sticky preview tag for a PR — one long-lived fork, REBOUND on every push, so the
+ * URL always serves the PR's latest code. The git analogy is a **branch ref**: a moving
+ * pointer, bookmarked once. Successive pushes roll their migrations forward on the one
+ * fork, which is the rehearsal that de-risks the eventual release.
+ */
+export declare const previewTag: (prNumber: number) => string;
+/**
+ * The per-build preview tag — a FRESH scope per build, bound once and never rebound, so
+ * the URL is frozen to exactly that build forever. The git analogy is a **sha**.
+ *
+ * A moving pointer is only safe when every build is *also* addressable immutably: "the bug
+ * on the PR preview" must always de-reference to a fixed artifact. That is the whole reason
+ * this tag exists alongside the sticky one.
+ */
+export declare const buildPreviewTag: (prNumber: number, runId: string | number) => string;
+/**
+ * The prefix that matches every per-build tag of one PR, and NOTHING else — note that
+ * PR 12's sticky tag (`pr-12`) does not start with PR 1's build prefix (`pr-1-`), so the
+ * two numbering spaces never collide.
+ */
+export declare const buildPreviewTagPrefix: (prNumber: number) => string;
+/**
+ * The sticky-comment marker. Every writer upserts the comment that starts with this
+ * string, so whichever of the platform and CI posts first, the other updates in place
+ * rather than double-posting.
+ */
+export declare const PREVIEW_COMMENT_MARKER = "<!-- substrat-preview -->";
+/**
+ * The sticky comment while the preview is live.
+ *
+ * `build` is the per-build immutable URL and is optional: it is present only when the repo
+ * opted into per-build previews (`SUBSTRAT_PER_BUILD_PREVIEW`), because a frozen scope per
+ * build is a real cost that not every project wants to pay.
+ *
+ * NOTE: keep the prose free of apostrophes. This same text is rendered into the workflow's
+ * single-quoted `printf` format string, where one apostrophe closes the quote and takes the
+ * whole preview job red on what looks like a copy-edit.
+ */
+export declare function previewCommentBody(urls: {
+    sticky: string;
+    build?: string | null;
+}): string;
+/** The sticky comment after the PR closed and the preview forks were deleted. */
+export declare const previewReapedBody: () => string;
+/**
+ * How a merge to the deploy branch turns into a prod release.
+ *
+ * - `trunk` — **every merge releases.** The push carries no `--version`, so the registry
+ *   patch-bumps and `--promote prod` points prod at it in the same run. The simplest thing
+ *   that works, and the default the dashboard commits.
+ * - `changesets` — **the repo owns the version** (`package.json`), so a merge that only
+ *   lands a changeset must NOT release; only the merge that MOVES the version does. The job
+ *   compares `package.json` against the previous commit and no-ops when it did not change.
+ *   This is the workflow the release-train table in the docs describes.
+ *
+ * Both are legitimate; the platform enables workflows rather than encoding one (#509 §3).
+ */
+export type ReleaseMode = 'trunk' | 'changesets';
+export interface DeployWorkflowOptions {
+    /** The branch whose pushes deploy prod. */
+    branch: string;
+    /** The vertical's bare slug — the control plane forms the `<tenant>/` prefix. */
+    slug: string;
+    /** The control-plane API base, e.g. `https://console.substrat.net/api`. */
+    cpUrl: string;
+    /** Defaults to `trunk`. */
+    release?: ReleaseMode;
+}
+/**
+ * The workflow the one-click setup commits and `substrat init --ci github` writes.
+ *
+ * Self-contained on purpose: a committed file is read by humans, so there is no
+ * reusable-workflow indirection to chase. The install step is load-bearing — `substrat
+ * push`/`preview` runs the repo's OWN build (a wrangler custom build), which needs the
+ * repo's devDependencies on disk; corepack picks the package manager from the lockfile.
+ *
+ * Two behaviours are opt-in through **repository variables**, so one generated file serves
+ * every project and enabling them never means regenerating it:
+ *
+ * - `SUBSTRAT_TEST_SCOPE_ID` — a long-lived test scope. Set it and every merge rebinds that
+ *   scope to the just-built version: the "tracks main" environment, kept a CI step rather
+ *   than a platform noun (a "this scope auto-tracks X" setting would be the retired
+ *   dev/staging channel re-buried one layer down).
+ * - `SUBSTRAT_PER_BUILD_PREVIEW` — set it to `1` and each PR push also creates a frozen,
+ *   short-TTL clean-room preview whose URL names exactly that build.
+ */
+export declare function deployWorkflowYaml(opts: DeployWorkflowOptions): string;
+//# sourceMappingURL=ci.d.ts.map

package/dist/ci.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci.d.ts","sourceRoot":"","sources":["../src/ci.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAMH;;;;;GAKG;AACH,eAAO,MAAM,UAAU,aAAc,MAAM,KAAG,MAA0B,CAAC;AAEzE;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,aAAc,MAAM,SAAS,MAAM,GAAG,MAAM,KAAG,MAChD,CAAC;AAE5B;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,aAAc,MAAM,KAAG,MAA2B,CAAC;AAMrF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,8BAA8B,CAAC;AAElE;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,MAAM,CAa1F;AAED,iFAAiF;AACjF,eAAO,MAAM,iBAAiB,QAAO,MACiF,CAAC;AAMvH;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,YAAY,CAAC;AAEjD,MAAM,WAAW,qBAAqB;IACpC,2CAA2C;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,2EAA2E;IAC3E,KAAK,EAAE,MAAM,CAAC;IACd,2BAA2B;IAC3B,OAAO,CAAC,EAAE,WAAW,CAAC;CACvB;AAKD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,qBAAqB,GAAG,MAAM,CA8LtE"}

package/dist/ci.js

@@ -0,0 +1,279 @@
+/**
+ * The builder's CI vocabulary: preview tag conventions, the PR sticky-comment bodies,
+ * and the generated GitHub Actions workflow.
+ *
+ * It lives here — not in the dashboard, not in the CLI — for the same reason the deploy
+ * manifest does: BOTH ends must speak the same shape. Three writers exist for the same
+ * two artifacts and any drift between them is a silent bug:
+ *
+ * - the **dashboard's one-click CI setup** commits the workflow to a customer repo and
+ *   (via `GithubRepoLinkDO`) posts the PR comment from the platform side;
+ * - **`substrat init --ci github`** writes the same workflow for a builder who owns their
+ *   own CI and never connected the GitHub App;
+ * - the **workflow itself** posts the same comment from the CI side, as the fallback for
+ *   an App installation that lacks `pull-requests: write`.
+ *
+ * The comment bodies are generated once here and rendered into the workflow's `printf`
+ * format string, so the platform-written and CI-written comments cannot say different
+ * things about the same PR. One generator, three writers, no drift.
+ *
+ * Pure string building — no zod, no network, no node. Safe in a worker, a CLI, and a
+ * browser bundle alike.
+ */
+// ---------------------------------------------------------------------------
+// Tag conventions
+// ---------------------------------------------------------------------------
+/**
+ * The sticky preview tag for a PR — one long-lived fork, REBOUND on every push, so the
+ * URL always serves the PR's latest code. The git analogy is a **branch ref**: a moving
+ * pointer, bookmarked once. Successive pushes roll their migrations forward on the one
+ * fork, which is the rehearsal that de-risks the eventual release.
+ */
+export const previewTag = (prNumber) => `pr-${prNumber}`;
+/**
+ * The per-build preview tag — a FRESH scope per build, bound once and never rebound, so
+ * the URL is frozen to exactly that build forever. The git analogy is a **sha**.
+ *
+ * A moving pointer is only safe when every build is *also* addressable immutably: "the bug
+ * on the PR preview" must always de-reference to a fixed artifact. That is the whole reason
+ * this tag exists alongside the sticky one.
+ */
+export const buildPreviewTag = (prNumber, runId) => `pr-${prNumber}-${runId}`;
+/**
+ * The prefix that matches every per-build tag of one PR, and NOTHING else — note that
+ * PR 12's sticky tag (`pr-12`) does not start with PR 1's build prefix (`pr-1-`), so the
+ * two numbering spaces never collide.
+ */
+export const buildPreviewTagPrefix = (prNumber) => `pr-${prNumber}-`;
+// ---------------------------------------------------------------------------
+// The PR sticky comment
+// ---------------------------------------------------------------------------
+/**
+ * The sticky-comment marker. Every writer upserts the comment that starts with this
+ * string, so whichever of the platform and CI posts first, the other updates in place
+ * rather than double-posting.
+ */
+export const PREVIEW_COMMENT_MARKER = '<!-- substrat-preview -->';
+/**
+ * The sticky comment while the preview is live.
+ *
+ * `build` is the per-build immutable URL and is optional: it is present only when the repo
+ * opted into per-build previews (`SUBSTRAT_PER_BUILD_PREVIEW`), because a frozen scope per
+ * build is a real cost that not every project wants to pay.
+ *
+ * NOTE: keep the prose free of apostrophes. This same text is rendered into the workflow's
+ * single-quoted `printf` format string, where one apostrophe closes the quote and takes the
+ * whole preview job red on what looks like a copy-edit.
+ */
+export function previewCommentBody(urls) {
+    if (!urls.build) {
+        return (`${PREVIEW_COMMENT_MARKER}\n🔎 **Substrat preview:** ${urls.sticky}\n\n` +
+            '_Runs the code in this PR against a fork of prod, and follows the PR — every push rebinds it. ' +
+            'Reaped when the PR closes._');
+    }
+    return (`${PREVIEW_COMMENT_MARKER}\n🔎 **Substrat preview:** ${urls.sticky}\n📌 **This build:** ${urls.build}\n\n` +
+        '_The preview URL follows the PR — every push rebinds it, so it always serves the latest code. ' +
+        'The build URL is frozen to this one build and never moves. Both are reaped when the PR closes._');
+}
+/** The sticky comment after the PR closed and the preview forks were deleted. */
+export const previewReapedBody = () => `${PREVIEW_COMMENT_MARKER}\n🔎 **Substrat preview:** reaped — this PR is closed and the preview forks were deleted.`;
+/** Render a comment body as a single-quoted `printf` format string (literal `\n`, `%s` holes). */
+const printfFormat = (body) => body.replace(/\n/g, '\\n');
+/**
+ * The workflow the one-click setup commits and `substrat init --ci github` writes.
+ *
+ * Self-contained on purpose: a committed file is read by humans, so there is no
+ * reusable-workflow indirection to chase. The install step is load-bearing — `substrat
+ * push`/`preview` runs the repo's OWN build (a wrangler custom build), which needs the
+ * repo's devDependencies on disk; corepack picks the package manager from the lockfile.
+ *
+ * Two behaviours are opt-in through **repository variables**, so one generated file serves
+ * every project and enabling them never means regenerating it:
+ *
+ * - `SUBSTRAT_TEST_SCOPE_ID` — a long-lived test scope. Set it and every merge rebinds that
+ *   scope to the just-built version: the "tracks main" environment, kept a CI step rather
+ *   than a platform noun (a "this scope auto-tracks X" setting would be the retired
+ *   dev/staging channel re-buried one layer down).
+ * - `SUBSTRAT_PER_BUILD_PREVIEW` — set it to `1` and each PR push also creates a frozen,
+ *   short-TTL clean-room preview whose URL names exactly that build.
+ */
+export function deployWorkflowYaml(opts) {
+    const { branch, slug, cpUrl } = opts;
+    const release = opts.release ?? 'trunk';
+    const cli = 'npx @substrat-run/cli';
+    // The install block repeats across jobs (self-contained file, see above). `fetch-depth: 2`
+    // is what lets the changesets release gate diff package.json against the previous commit.
+    const setup = (fetchDepth) => `      - uses: actions/checkout@v4${fetchDepth ? `\n        with:\n          fetch-depth: ${fetchDepth}` : ''}
+      - uses: actions/setup-node@v4
+        with:
+          # 22+: corepack resolves the latest pnpm for lockfile-only repos, and pnpm 11
+          # needs Node >= 22.13 (node:sqlite).
+          node-version: 22
+      - name: Install dependencies
+        env:
+          COREPACK_ENABLE_DOWNLOAD_PROMPT: '0'
+        run: |
+          if [ -f pnpm-lock.yaml ]; then corepack enable && pnpm install --frozen-lockfile
+          elif [ -f yarn.lock ]; then corepack enable && yarn install --frozen-lockfile
+          elif [ -f package-lock.json ]; then npm ci
+          else npm install
+          fi`;
+    const cpEnv = `        env:
+          SUBSTRAT_SERVICE_TOKEN: \${{ secrets.SUBSTRAT_SERVICE_TOKEN }}
+          SUBSTRAT_CP_URL: ${cpUrl}`;
+    // --- the release step, per mode ------------------------------------------------------
+    //
+    // Both print the pushed version id on the `✓ pushed … version <id> …` line; the test-env
+    // bind below reads it back out of the captured stdout. `set -euo pipefail` means a failed
+    // push fails the step rather than letting a masked non-zero exit reach the bind.
+    const release_ = release === 'changesets'
+        ? `      - name: Release (only when package.json version moved)
+${cpEnv}
+        run: |
+          set -euo pipefail
+          CUR=$(node -p "require('./package.json').version")
+          PREV=$(git show HEAD^:package.json 2>/dev/null | node -pe "JSON.parse(require('fs').readFileSync(0,'utf8')).version" 2>/dev/null || echo '')
+          if [ "$CUR" = "$PREV" ]; then
+            echo "package.json version is still $CUR — this merge landed a changeset, not a release. Skipping prod."
+            exit 0
+          fi
+          echo "releasing $CUR (was \${PREV:-none})"
+          ${cli} push . --slug ${slug} --version "$CUR" --promote prod`
+        : `      - name: Release to prod
+${cpEnv}
+        run: |
+          set -euo pipefail
+          ${cli} push . --slug ${slug} --promote prod`;
+    // --- the "tracks main" test environment ---------------------------------------------
+    //
+    // Runs on EVERY merge, release or not — that is the point of a test env: it is always the
+    // head of the branch, a merge ahead of prod, rehearsing each migration on accumulated data.
+    // It pushes its OWN build rather than reusing the release step's, because in `changesets`
+    // mode most merges produce no release at all and the test env must still move; doing it the
+    // same way in both modes keeps one legible file. The label is a PRERELEASE, so this push can
+    // never claim or advance the release coordinate the repo owns.
+    const testEnv = `      - name: Update the test environment
+        if: vars.SUBSTRAT_TEST_SCOPE_ID != ''
+${cpEnv}
+        run: |
+          set -euo pipefail
+          BASE=$(node -p "require('./package.json').version")
+          ${cli} push . --slug ${slug} --version "$BASE-test.\${{ github.run_number }}" | tee push.out
+          # '|| true' so an unmatched grep does not trip pipefail before the message below —
+          # "could not read the pushed version id" beats a bare exit 1 from grep.
+          VID=$(grep -F '✓ pushed' push.out | grep -oE 'version [A-Za-z0-9]+' | head -1 | cut -d' ' -f2 || true)
+          if [ -z "$VID" ]; then echo "could not read the pushed version id from:" >&2; cat push.out >&2; exit 1; fi
+          ${cli} scope bind \${{ vars.SUBSTRAT_TEST_SCOPE_ID }} --version "$VID" --snapshot`;
+    // --- the PR previews -----------------------------------------------------------------
+    //
+    // Sticky first (it is the URL a reviewer bookmarks and must exist even if the optional
+    // per-build one fails), then the frozen per-build clean room when the repo opted in.
+    const previewSteps = `      - name: Create/update the preview
+${cpEnv}
+        run: |
+          set -euo pipefail
+          ${cli} preview create . --slug ${slug} --tag pr-\${{ github.event.number }} | tee preview.out
+          # Take the URL from the CLI success line (the ✓ marker) only — the push it runs
+          # first also prints an https:// *deploy endpoint* we must never mistake for a preview.
+          grep -F '✓ preview' preview.out | grep -oE 'https://[a-zA-Z0-9.:/_-]+' | tail -1 > preview.url || true
+      - name: Create the per-build preview
+        if: vars.SUBSTRAT_PER_BUILD_PREVIEW != ''
+${cpEnv}
+        run: |
+          set -euo pipefail
+          # A FRESH scope, bound once and never rebound, so this URL is frozen to this build
+          # forever. Clean-room (--empty) rather than a fork: a throwaway per build should not
+          # copy prod data every push. Short TTL — the sticky preview is the one that lives.
+          ${cli} preview create . --slug ${slug} \\
+            --tag pr-\${{ github.event.number }}-\${{ github.run_id }} --empty --ttl 24h | tee build.out
+          grep -F '✓ preview' build.out | grep -oE 'https://[a-zA-Z0-9.:/_-]+' | tail -1 > build.url || true`;
+    // The comment body comes from previewCommentBody() so the CI-written and platform-written
+    // comments cannot diverge. Two formats: with and without the per-build line.
+    const stickyOnlyFmt = printfFormat(previewCommentBody({ sticky: '%s' }));
+    const withBuildFmt = printfFormat(previewCommentBody({ sticky: '%s', build: '%s' }));
+    const commentStep = `      - name: Comment the preview URLs
+        env:
+          GH_TOKEN: \${{ github.token }}
+        run: |
+          set -uo pipefail
+          URL=$(cat preview.url 2>/dev/null || true)
+          [ -z "$URL" ] && exit 0
+          BUILD=$(cat build.url 2>/dev/null || true)
+          if [ -n "$BUILD" ]; then
+            BODY=$(printf '${withBuildFmt}' "$URL" "$BUILD")
+          else
+            BODY=$(printf '${stickyOnlyFmt}' "$URL")
+          fi
+          REPO=\${{ github.repository }}
+          PR=\${{ github.event.number }}
+          ID=$(gh api "repos/$REPO/issues/$PR/comments" --jq '.[] | select(.body | startswith("${PREVIEW_COMMENT_MARKER}")) | .id' | head -1)
+          if [ -n "$ID" ]; then
+            gh api -X PATCH "repos/$REPO/issues/comments/$ID" -f body="$BODY" >/dev/null
+          else
+            gh api -X POST "repos/$REPO/issues/$PR/comments" -f body="$BODY" >/dev/null
+          fi`;
+    // Close ⇒ reap both forks. The per-build tag is unknown at close time (it named a run id),
+    // so the sticky one is deleted by tag and the rest are left to their 24h TTL — the GC sweep
+    // is the backstop the short TTL exists for.
+    const cleanup = `  preview_cleanup:
+    # Reap only — no repo build needed, so skip checkout/install and just run the CLI.
+    if: github.event_name == 'pull_request' && github.event.action == 'closed'
+    runs-on: ubuntu-latest
+    concurrency: substrat-preview-\${{ github.event.number }}
+    steps:
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - name: Reap the preview
+${cpEnv}
+        run: ${cli} preview delete --slug ${slug} --tag pr-\${{ github.event.number }}`;
+    const releaseNote = release === 'changesets'
+        ? `    # Release train: the version lives in package.json and only a version PR moves it, so a
+    # merge releases ONLY when that version changed. Every merge still updates the test env.`
+        : `    # Trunk-based: every merge to ${branch} releases. A private vertical's push lands admitted
+    # and prod is self-serve, so the same run points prod at the new version.`;
+    return `name: Deploy to Substrat
+
+# Generated by Substrat (substrat init --ci github). The workflow this encodes — one prod
+# channel, previews as the only non-prod environment — is documented at
+# https://substrat.net/guide/environments-and-previews
+#
+# Optional repository variables (Settings → Secrets and variables → Actions → Variables):
+#   SUBSTRAT_TEST_SCOPE_ID      a long-lived scope rebound to every merge (the test env)
+#   SUBSTRAT_PER_BUILD_PREVIEW  set to 1 to also mint a frozen per-build preview URL per push
+
+on:
+  push:
+    branches: [${branch}]
+  # Per-PR previews: open/update a PR → a preview instance running the PR's code against a
+  # FORK of prod on its own URL; close the PR → it is reaped (the TTL is the GC backstop).
+  pull_request:
+    types: [opened, synchronize, reopened, closed]
+
+jobs:
+  deploy:
+${releaseNote}
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    steps:
+${setup(release === 'changesets' ? 2 : undefined)}
+${release_}
+${testEnv}
+
+  preview:
+    if: github.event_name == 'pull_request' && github.event.action != 'closed'
+    runs-on: ubuntu-latest
+    # Never overlap two runs for the same PR — a rapid re-push waits for the first.
+    concurrency: substrat-preview-\${{ github.event.number }}
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+${setup()}
+${previewSteps}
+${commentStep}
+
+${cleanup}
+`;
+}
+//# sourceMappingURL=ci.js.map

package/dist/ci.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci.js","sourceRoot":"","sources":["../src/ci.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,MAAM,QAAQ,EAAE,CAAC;AAEzE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,QAAgB,EAAE,KAAsB,EAAU,EAAE,CAClF,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;AAE5B;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,MAAM,QAAQ,GAAG,CAAC;AAErF,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,2BAA2B,CAAC;AAElE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAA+C;IAChF,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAChB,OAAO,CACL,GAAG,sBAAsB,8BAA8B,IAAI,CAAC,MAAM,MAAM;YACxE,gGAAgG;YAChG,6BAA6B,CAC9B,CAAC;IACJ,CAAC;IACD,OAAO,CACL,GAAG,sBAAsB,8BAA8B,IAAI,CAAC,MAAM,wBAAwB,IAAI,CAAC,KAAK,MAAM;QAC1G,gGAAgG;QAChG,iGAAiG,CAClG,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAW,EAAE,CAC5C,GAAG,sBAAsB,2FAA2F,CAAC;AAgCvH,kGAAkG;AAClG,MAAM,YAAY,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAE1E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAA2B;IAC5D,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC;IACxC,MAAM,GAAG,GAAG,uBAAuB,CAAC;IAEpC,2FAA2F;IAC3F,0FAA0F;IAC1F,MAAM,KAAK,GAAG,CAAC,UAAmB,EAAU,EAAE,CAAC,oCAC7C,UAAU,CAAC,CAAC,CAAC,2CAA2C,UAAU,EAAE,CAAC,CAAC,CAAC,EACzE;;;;;;;;;;;;;;aAcW,CAAC;IAEZ,MAAM,KAAK,GAAG;;6BAEa,KAAK,EAAE,CAAC;IAEnC,wFAAwF;IACxF,EAAE;IACF,yFAAyF;IACzF,0FAA0F;IAC1F,iFAAiF;IACjF,MAAM,QAAQ,GAAG,OAAO,KAAK,YAAY;QACvC,CAAC,CAAC;EACJ,KAAK;;;;;;;;;;YAUK,GAAG,kBAAkB,IAAI,kCAAkC;QACnE,CAAC,CAAC;EACJ,KAAK;;;YAGK,GAAG,kBAAkB,IAAI,iBAAiB,CAAC;IAErD,uFAAuF;IACvF,EAAE;IACF,0FAA0F;IAC1F,4FAA4F;IAC5F,0FAA0F;IAC1F,4FAA4F;IAC5F,6FAA6F;IAC7F,+DAA+D;IAC/D,MAAM,OAAO,GAAG;;EAEhB,KAAK;;;;YAIK,GAAG,kBAAkB,IAAI;;;;;YAKzB,GAAG,6EAA6E,CAAC;IAE3F,wFAAwF;IACxF,EAAE;IACF,uFAAuF;IACvF,qFAAqF;IACrF,MAAM,YAAY,GAAG;EACrB,KAAK;;;YAGK,GAAG,4BAA4B,IAAI;;;;;;EAM7C,KAAK;;;;;;YAMK,GAAG,4BAA4B,IAAI;;6GAE8D,CAAC;IAE5G,0FAA0F;IAC1F,6EAA6E;IAC7E,MAAM,aAAa,GAAG,YAAY,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACzE,MAAM,YAAY,GAAG,YAAY,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAErF,MAAM,WAAW,GAAG;;;;;;;;;6BASO,YAAY;;6BAEZ,aAAa;;;;iGAIuD,sBAAsB;;;;;aAK1G,CAAC;IAEZ,2FAA2F;IAC3F,4FAA4F;IAC5F,4CAA4C;IAC5C,MAAM,OAAO,GAAG;;;;;;;;;;EAUhB,KAAK;eACQ,GAAG,0BAA0B,IAAI,uCAAuC,CAAC;IAEtF,MAAM,WAAW,GAAG,OAAO,KAAK,YAAY;QAC1C,CAAC,CAAC;6FACuF;QACzF,CAAC,CAAC,qCAAqC,MAAM;8EAC6B,CAAC;IAE7E,OAAO;;;;;;;;;;;;iBAYQ,MAAM;;;;;;;;EAQrB,WAAW;;;;EAIX,KAAK,CAAC,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;EAC/C,QAAQ;EACR,OAAO;;;;;;;;;;;EAWP,KAAK,EAAE;EACP,YAAY;EACZ,WAAW;;EAEX,OAAO;CACR,CAAC;AACF,CAAC"}

package/dist/deploy.d.ts

@@ -102,6 +102,65 @@ export type BlobStoreHandle = z.infer<typeof blobStoreHandle>;
  * `D1Database`. On the pure adapter there is no binding to name.
  */
 export declare function blobStoreBindingName(binding: string, tenantId: string): string;
+/**
+ * How the runtime routes a request between the vertical's STATIC files and its worker
+ * (#340) — the substrate-vocabulary form of Cloudflare's `assets.config`. Every field is
+ * optional with a runtime default, so a vertical that only wants "serve my SPA" declares
+ * a directory and nothing else.
+ *
+ * The two that matter for a Substrat vertical, and why:
+ * - `notFoundHandling: 'single-page-application'` — a deep client route (`/jobs/123`) is
+ *   not a file, and must resolve to `index.html` rather than 404. This is the inline
+ *   `serveAsset` fallback, expressed as configuration.
+ * - `runWorkerFirst` — SPA fallback would otherwise swallow the vertical's OWN routes,
+ *   which are not files either. Listing `/api/*` + `/internal/*` keeps the worker in
+ *   front of exactly the paths it owns while everything else is served from the edge
+ *   without invoking it. `true` runs the worker in front of every request (asset serving
+ *   still happens behind it) — correct only for a vertical that inspects every path.
+ */
+export declare const assetRouting: z.ZodObject<{
+    htmlHandling: z.ZodOptional<z.ZodEnum<{
+        "auto-trailing-slash": "auto-trailing-slash";
+        "drop-trailing-slash": "drop-trailing-slash";
+        "force-trailing-slash": "force-trailing-slash";
+        none: "none";
+    }>>;
+    notFoundHandling: z.ZodOptional<z.ZodEnum<{
+        "404-page": "404-page";
+        none: "none";
+        "single-page-application": "single-page-application";
+    }>>;
+    runWorkerFirst: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodArray<z.ZodString>]>>;
+}, z.core.$strip>;
+export type AssetRouting = z.infer<typeof assetRouting>;
+/**
+ * The vertical's STATIC files, as a NEED (#340): a directory of built bytes the platform
+ * uploads to the runtime's own asset store, served from the edge without invoking the
+ * worker. Native assets are not a binding — they are a top-level upload path — so this is
+ * a `runtimeNeeds` need and never rides the §4 binding allowlist (see
+ * {@link ADMISSIBLE_BINDING_TYPES}); the platform's own hash verification is what makes
+ * accepting builder-supplied bytes safe (self-serve-deploy.md §4.1).
+ *
+ * Replaces the inline-into-the-worker workaround every demo carried while WfP dispatch had
+ * no asset path: base64 in the bundle costs ~+33 % against the script-size limit, is
+ * re-parsed on every cold start, and invokes the worker for every image.
+ */
+export declare const assetsNeed: z.ZodObject<{
+    htmlHandling: z.ZodOptional<z.ZodEnum<{
+        "auto-trailing-slash": "auto-trailing-slash";
+        "drop-trailing-slash": "drop-trailing-slash";
+        "force-trailing-slash": "force-trailing-slash";
+        none: "none";
+    }>>;
+    notFoundHandling: z.ZodOptional<z.ZodEnum<{
+        "404-page": "404-page";
+        none: "none";
+        "single-page-application": "single-page-application";
+    }>>;
+    runWorkerFirst: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodArray<z.ZodString>]>>;
+    directory: z.ZodString;
+}, z.core.$strip>;
+export type AssetsNeed = z.infer<typeof assetsNeed>;
 /**
  * What a vertical needs from the runtime, in substrate vocabulary (package.json
  * `substrat.runtimeNeeds`). A vertical authored with this section never writes deploy
@@ -127,6 +186,21 @@ export declare const runtimeNeeds: z.ZodObject<{
         binding: z.ZodString;
         kind: z.ZodDefault<z.ZodLiteral<"blob">>;
     }, z.core.$strip>>>;
+    assets: z.ZodOptional<z.ZodObject<{
+        htmlHandling: z.ZodOptional<z.ZodEnum<{
+            "auto-trailing-slash": "auto-trailing-slash";
+            "drop-trailing-slash": "drop-trailing-slash";
+            "force-trailing-slash": "force-trailing-slash";
+            none: "none";
+        }>>;
+        notFoundHandling: z.ZodOptional<z.ZodEnum<{
+            "404-page": "404-page";
+            none: "none";
+            "single-page-application": "single-page-application";
+        }>>;
+        runWorkerFirst: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodArray<z.ZodString>]>>;
+        directory: z.ZodString;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
 export type RuntimeNeeds = z.infer<typeof runtimeNeeds>;
 /**
@@ -145,6 +219,14 @@ export type RuntimeNeeds = z.infer<typeof runtimeNeeds>;
  *   `mtls_certificate`) — the outside world is a connector concern, and outbound policy is an
  *   open question (§6 / #303); least-privilege means these are refused until decided.
  *
+ * NOT on this list because it is not a binding at all: **native static assets** (#340). They
+ * are a top-level upload path (`assets: { jwt, config }` in the script metadata), so they can
+ * neither be allowed nor refused here. They are admitted by a separate, narrower rule written
+ * down in self-serve-deploy.md §4.1: the bytes are inert and public — no code, no authority,
+ * no cross-tenant reach — but their content-address is a namespace-wide dedup key, so the
+ * platform RE-DERIVES every hash from the uploaded bytes ({@link assetHash}) and refuses a
+ * mismatch. What is trusted is the bytes; what is verified is the key.
+ *
  * Caveat on `d1`: admissible as an own relational store (e.g. a Better-Auth `AUTH_DB`), but
  * the check does not yet PROVE the declared `database_id` is the vertical's own rather than
  * another tenant's — trusted under model-B human admission; platform provisioning closes that
@@ -253,6 +335,81 @@ export declare function definePermissions(input: PermissionsInput): PermissionsI
  * of declaration order.
  */
 export declare function buildPermissionRegistry(input: PermissionsInput): PermissionRegistry;
+/**
+ * One static file in the shipped manifest (#340). The trio Cloudflare's asset store keys
+ * on — content-addressed `hash`, `size` — plus the `contentType` the platform attaches at
+ * upload and the runtime serves back.
+ *
+ * `hash` is the platform's DEDUP KEY, and the reason it is re-derived at the trust boundary
+ * rather than trusted: the asset store dedups by hash across the whole dispatch namespace,
+ * so bytes accepted under a hash they do not have would let one push decide what a DIFFERENT
+ * vertical's identical-hash asset serves. The bytes themselves are inert and public; the
+ * *key* is not. The control plane recomputes every hash from the uploaded bytes and refuses
+ * a mismatch (self-serve-deploy.md §4.1).
+ *
+ * The recipe is Cloudflare's, and must stay byte-identical on both ends or nothing dedups:
+ * `sha256(base64(content) + extension)`, first 32 hex chars ({@link assetHash}).
+ */
+export declare const assetEntry: z.ZodObject<{
+    path: z.ZodString;
+    hash: z.ZodString;
+    size: z.ZodNumber;
+    contentType: z.ZodString;
+}, z.core.$strip>;
+export type AssetEntry = z.infer<typeof assetEntry>;
+/**
+ * The multipart part-name prefix static files ride under in a push (#340) —
+ * `asset:/index.html`. Here, with the manifest schema, for the reason this file exists:
+ * both ends must speak the same shape. The prefix is what separates the two kinds of part
+ * in one body — anything unprefixed is a worker module — so an asset called `worker.js`
+ * can never be uploaded as code, and a served path is never constrained to be a legal
+ * module name.
+ */
+export declare const ASSET_PART_PREFIX = "asset:";
+/**
+ * The content-address of one static file — **Cloudflare's recipe, not ours**:
+ * `sha256(base64(content) + extension)` (extension without the dot), first 32 hex chars.
+ * It is reproduced here rather than imported because both ends must compute it identically:
+ * the CLI to build the manifest it ships, the control plane to VERIFY that manifest against
+ * the bytes before either reaches the asset store (see {@link assetEntry}). A divergence
+ * would not merely fail — it would silently defeat dedup, or store bytes under a key that
+ * is not theirs.
+ *
+ * Web Crypto (`globalThis.crypto.subtle`), so the one implementation runs unchanged in node,
+ * workerd, and the browser.
+ */
+export declare function assetHash(content: Uint8Array, path: string): Promise<string>;
+/**
+ * The static-file half of a push (#340): the routing config, plus the full file manifest.
+ *
+ * The manifest is retained (it rides `manifest_json` like the rest of the deploy manifest)
+ * for a load-bearing reason: a promote re-uploads a version onto the STABLE serving script
+ * from its archive (#286), and an asset upload session is driven by the manifest, not by
+ * bytes — content already in the namespace's asset store is skipped, so the retained
+ * manifest is what lets a promote re-attach the same assets without the builder re-pushing.
+ * It is also what the dashboard renders as the per-version asset list.
+ */
+export declare const deployAssets: z.ZodObject<{
+    htmlHandling: z.ZodOptional<z.ZodEnum<{
+        "auto-trailing-slash": "auto-trailing-slash";
+        "drop-trailing-slash": "drop-trailing-slash";
+        "force-trailing-slash": "force-trailing-slash";
+        none: "none";
+    }>>;
+    notFoundHandling: z.ZodOptional<z.ZodEnum<{
+        "404-page": "404-page";
+        none: "none";
+        "single-page-application": "single-page-application";
+    }>>;
+    runWorkerFirst: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodArray<z.ZodString>]>>;
+    files: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        hash: z.ZodString;
+        size: z.ZodNumber;
+        contentType: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type DeployAssets = z.infer<typeof deployAssets>;
 /** The JSON part a `substrat push` sends alongside the module files. */
 export declare const deployManifest: z.ZodObject<{
     version: z.ZodString;
@@ -276,6 +433,26 @@ export declare const deployManifest: z.ZodObject<{
         binding: z.ZodString;
         kind: z.ZodDefault<z.ZodLiteral<"blob">>;
     }, z.core.$strip>>>;
+    assets: z.ZodOptional<z.ZodObject<{
+        htmlHandling: z.ZodOptional<z.ZodEnum<{
+            "auto-trailing-slash": "auto-trailing-slash";
+            "drop-trailing-slash": "drop-trailing-slash";
+            "force-trailing-slash": "force-trailing-slash";
+            none: "none";
+        }>>;
+        notFoundHandling: z.ZodOptional<z.ZodEnum<{
+            "404-page": "404-page";
+            none: "none";
+            "single-page-application": "single-page-application";
+        }>>;
+        runWorkerFirst: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodArray<z.ZodString>]>>;
+        files: z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            hash: z.ZodString;
+            size: z.ZodNumber;
+            contentType: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
     envSpec: z.ZodOptional<z.ZodArray<z.ZodObject<{
         key: z.ZodString;
         label: z.ZodOptional<z.ZodString>;
@@ -348,6 +525,26 @@ export declare const storedDeployManifest: z.ZodObject<{
         binding: z.ZodString;
         kind: z.ZodDefault<z.ZodLiteral<"blob">>;
     }, z.core.$strip>>>;
+    assets: z.ZodOptional<z.ZodObject<{
+        htmlHandling: z.ZodOptional<z.ZodEnum<{
+            "auto-trailing-slash": "auto-trailing-slash";
+            "drop-trailing-slash": "drop-trailing-slash";
+            "force-trailing-slash": "force-trailing-slash";
+            none: "none";
+        }>>;
+        notFoundHandling: z.ZodOptional<z.ZodEnum<{
+            "404-page": "404-page";
+            none: "none";
+            "single-page-application": "single-page-application";
+        }>>;
+        runWorkerFirst: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodArray<z.ZodString>]>>;
+        files: z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            hash: z.ZodString;
+            size: z.ZodNumber;
+            contentType: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
     envSpec: z.ZodOptional<z.ZodArray<z.ZodObject<{
         key: z.ZodString;
         label: z.ZodOptional<z.ZodString>;

package/dist/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../src/deploy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAA0B,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAC5E,OAAO,EAAkB,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAUtE;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,eAAe,CAAC;AAE7C;;;;;;GAMG;AACH,eAAO,MAAM,SAAS;;;iBAKpB,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAElD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,eAAe;;;iBAK1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB;;;;iBAI5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEhF;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,aAAa;;;iBAKxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;GAKG;AACH,eAAO,MAAM,eAAe;;;;iBAI1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE9E;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;iBAevB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,wBAAwB,YACnC,0BAA0B,EAC1B,IAAI,EACJ,cAAc,EACd,OAAO,EACP,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,YAAY,CACJ,CAAC;AACX,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9E;;;wFAGwF;AACxF,eAAO,MAAM,eAAe;;;;;;iBAO1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;;iBAIlC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E;;wEAEwE;AACxE,eAAO,MAAM,gBAAgB;;;iBAG3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;iBAI7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC/B,yFAAyF;IACzF,OAAO,EAAE,SAAS;QAAE,QAAQ,EAAE,cAAc,CAAA;KAAE,EAAE,CAAC;IACjD,+DAA+D;IAC/D,KAAK,EAAE,SAAS,cAAc,EAAE,CAAC;IACjC,2FAA2F;IAC3F,YAAY,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;CAC5C;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,gBAAgB,GAAG,gBAAgB,CAE3E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,gBAAgB,GAAG,kBAAkB,CA6BnF;AAED,wEAAwE;AACxE,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2DzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAE/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../src/deploy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAA0B,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAC5E,OAAO,EAAkB,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAUtE;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,eAAe,CAAC;AAE7C;;;;;;GAMG;AACH,eAAO,MAAM,SAAS;;;iBAKpB,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAElD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,eAAe;;;iBAK1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB;;;;iBAI5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEhF;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,aAAa;;;iBAKxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;GAKG;AACH,eAAO,MAAM,eAAe;;;;iBAI1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE9E;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;;iBASvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;iBAGrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD;;;;;;;;GAQG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAkBvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,wBAAwB,YACnC,0BAA0B,EAC1B,IAAI,EACJ,cAAc,EACd,OAAO,EACP,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,YAAY,CACJ,CAAC;AACX,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9E;;;wFAGwF;AACxF,eAAO,MAAM,eAAe;;;;;;iBAO1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;;iBAIlC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E;;wEAEwE;AACxE,eAAO,MAAM,gBAAgB;;;iBAG3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;iBAI7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC/B,yFAAyF;IACzF,OAAO,EAAE,SAAS;QAAE,QAAQ,EAAE,cAAc,CAAA;KAAE,EAAE,CAAC;IACjD,+DAA+D;IAC/D,KAAK,EAAE,SAAS,cAAc,EAAE,CAAC;IACjC,2FAA2F;IAC3F,YAAY,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;CAC5C;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,gBAAgB,GAAG,gBAAgB,CAE3E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,gBAAgB,GAAG,kBAAkB,CA6BnF;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,UAAU;;;;;iBAQrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAuB1C;;;;;;;;;;;GAWG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAYlF;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;iBAEvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,wEAAwE;AACxE,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+DzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAE/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/deploy.js

@@ -115,6 +115,48 @@ export const blobStoreHandle = z.object({
 export function blobStoreBindingName(binding, tenantId) {
     return `${binding}__${tenantId}`;
 }
+/**
+ * How the runtime routes a request between the vertical's STATIC files and its worker
+ * (#340) — the substrate-vocabulary form of Cloudflare's `assets.config`. Every field is
+ * optional with a runtime default, so a vertical that only wants "serve my SPA" declares
+ * a directory and nothing else.
+ *
+ * The two that matter for a Substrat vertical, and why:
+ * - `notFoundHandling: 'single-page-application'` — a deep client route (`/jobs/123`) is
+ *   not a file, and must resolve to `index.html` rather than 404. This is the inline
+ *   `serveAsset` fallback, expressed as configuration.
+ * - `runWorkerFirst` — SPA fallback would otherwise swallow the vertical's OWN routes,
+ *   which are not files either. Listing `/api/*` + `/internal/*` keeps the worker in
+ *   front of exactly the paths it owns while everything else is served from the edge
+ *   without invoking it. `true` runs the worker in front of every request (asset serving
+ *   still happens behind it) — correct only for a vertical that inspects every path.
+ */
+export const assetRouting = z.object({
+    /** Trailing-slash/`.html` normalisation. Cloudflare's default is `auto-trailing-slash`. */
+    htmlHandling: z
+        .enum(['auto-trailing-slash', 'force-trailing-slash', 'drop-trailing-slash', 'none'])
+        .optional(),
+    /** What a path matching no asset gets. `none` (default) falls through to the worker. */
+    notFoundHandling: z.enum(['none', '404-page', 'single-page-application']).optional(),
+    /** Routes the worker handles BEFORE asset matching — `true` for all, or a glob list. */
+    runWorkerFirst: z.union([z.boolean(), z.array(z.string().min(1)).min(1)]).optional(),
+});
+/**
+ * The vertical's STATIC files, as a NEED (#340): a directory of built bytes the platform
+ * uploads to the runtime's own asset store, served from the edge without invoking the
+ * worker. Native assets are not a binding — they are a top-level upload path — so this is
+ * a `runtimeNeeds` need and never rides the §4 binding allowlist (see
+ * {@link ADMISSIBLE_BINDING_TYPES}); the platform's own hash verification is what makes
+ * accepting builder-supplied bytes safe (self-serve-deploy.md §4.1).
+ *
+ * Replaces the inline-into-the-worker workaround every demo carried while WfP dispatch had
+ * no asset path: base64 in the bundle costs ~+33 % against the script-size limit, is
+ * re-parsed on every cold start, and invokes the worker for every image.
+ */
+export const assetsNeed = assetRouting.extend({
+    /** Directory of built files, relative to the vertical root (e.g. `app/dist`). */
+    directory: z.string().min(1),
+});
 /**
  * What a vertical needs from the runtime, in substrate vocabulary (package.json
  * `substrat.runtimeNeeds`). A vertical authored with this section never writes deploy
@@ -139,6 +181,9 @@ export const runtimeNeeds = z.object({
     /** Per-tenant blob stores for attachment bytes (#473). Same non-binding rule as
      *  `tenantStores`: one bucket per tenant, minted in the tenant lifecycle. */
     blobStores: z.array(blobStoreNeed).default([]),
+    /** Static files served from the edge (#340). Absent ⇒ the vertical serves no static
+     *  files (or still inlines them into the bundle), and nothing about its push changes. */
+    assets: assetsNeed.optional(),
 });
 /**
  * The §4 sandbox allowlist: the binding types a hosted vertical may declare, because each
@@ -156,6 +201,14 @@ export const runtimeNeeds = z.object({
  *   `mtls_certificate`) — the outside world is a connector concern, and outbound policy is an
  *   open question (§6 / #303); least-privilege means these are refused until decided.
  *
+ * NOT on this list because it is not a binding at all: **native static assets** (#340). They
+ * are a top-level upload path (`assets: { jwt, config }` in the script metadata), so they can
+ * neither be allowed nor refused here. They are admitted by a separate, narrower rule written
+ * down in self-serve-deploy.md §4.1: the bytes are inert and public — no code, no authority,
+ * no cross-tenant reach — but their content-address is a namespace-wide dedup key, so the
+ * platform RE-DERIVES every hash from the uploaded bytes ({@link assetHash}) and refuses a
+ * mismatch. What is trusted is the bytes; what is verified is the key.
+ *
  * Caveat on `d1`: admissible as an own relational store (e.g. a Better-Auth `AUTH_DB`), but
  * the check does not yet PROVE the declared `database_id` is the vertical's own rather than
  * another tenant's — trusted under model-B human admission; platform provisioning closes that
@@ -268,6 +321,85 @@ export function buildPermissionRegistry(input) {
         .map((g) => ({ entityType: g.entityType, permissions: sortKeys(g.permissions) }));
     return { permissions, roles, entityGrants };
 }
+/**
+ * One static file in the shipped manifest (#340). The trio Cloudflare's asset store keys
+ * on — content-addressed `hash`, `size` — plus the `contentType` the platform attaches at
+ * upload and the runtime serves back.
+ *
+ * `hash` is the platform's DEDUP KEY, and the reason it is re-derived at the trust boundary
+ * rather than trusted: the asset store dedups by hash across the whole dispatch namespace,
+ * so bytes accepted under a hash they do not have would let one push decide what a DIFFERENT
+ * vertical's identical-hash asset serves. The bytes themselves are inert and public; the
+ * *key* is not. The control plane recomputes every hash from the uploaded bytes and refuses
+ * a mismatch (self-serve-deploy.md §4.1).
+ *
+ * The recipe is Cloudflare's, and must stay byte-identical on both ends or nothing dedups:
+ * `sha256(base64(content) + extension)`, first 32 hex chars ({@link assetHash}).
+ */
+export const assetEntry = z.object({
+    /** Served path, always leading-slash, `/`-separated (e.g. `/assets/app-4f2.js`). */
+    path: z.string().regex(/^\/(?!\/)[^\s]*$/),
+    /** `sha256(base64(content) + extension)`, first 32 hex — Cloudflare's manifest key. */
+    hash: z.string().regex(/^[0-9a-f]{32}$/),
+    size: z.number().int().nonnegative(),
+    /** The MIME type the runtime serves this file as (attached at upload time). */
+    contentType: z.string().min(1),
+});
+/**
+ * The multipart part-name prefix static files ride under in a push (#340) —
+ * `asset:/index.html`. Here, with the manifest schema, for the reason this file exists:
+ * both ends must speak the same shape. The prefix is what separates the two kinds of part
+ * in one body — anything unprefixed is a worker module — so an asset called `worker.js`
+ * can never be uploaded as code, and a served path is never constrained to be a legal
+ * module name.
+ */
+export const ASSET_PART_PREFIX = 'asset:';
+/** Bytes → base64, web-standard only (`btoa` over a binary string, chunked so a large file
+ *  does not blow the argument limit of `String.fromCharCode`). No `Buffer`: this runs in the
+ *  CLI (node), in the control plane (workerd), and in the browser. */
+function toBase64(bytes) {
+    let binary = '';
+    const CHUNK = 0x8000;
+    for (let i = 0; i < bytes.length; i += CHUNK) {
+        binary += String.fromCharCode(...bytes.subarray(i, i + CHUNK));
+    }
+    return btoa(binary);
+}
+/**
+ * The content-address of one static file — **Cloudflare's recipe, not ours**:
+ * `sha256(base64(content) + extension)` (extension without the dot), first 32 hex chars.
+ * It is reproduced here rather than imported because both ends must compute it identically:
+ * the CLI to build the manifest it ships, the control plane to VERIFY that manifest against
+ * the bytes before either reaches the asset store (see {@link assetEntry}). A divergence
+ * would not merely fail — it would silently defeat dedup, or store bytes under a key that
+ * is not theirs.
+ *
+ * Web Crypto (`globalThis.crypto.subtle`), so the one implementation runs unchanged in node,
+ * workerd, and the browser.
+ */
+export async function assetHash(content, path) {
+    const base = path.split('/').pop() ?? '';
+    const dot = base.lastIndexOf('.');
+    const extension = dot > 0 ? base.slice(dot + 1) : '';
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(toBase64(content) + extension));
+    return [...new Uint8Array(digest)]
+        .map((b) => b.toString(16).padStart(2, '0'))
+        .join('')
+        .slice(0, 32);
+}
+/**
+ * The static-file half of a push (#340): the routing config, plus the full file manifest.
+ *
+ * The manifest is retained (it rides `manifest_json` like the rest of the deploy manifest)
+ * for a load-bearing reason: a promote re-uploads a version onto the STABLE serving script
+ * from its archive (#286), and an asset upload session is driven by the manifest, not by
+ * bytes — content already in the namespace's asset store is skipped, so the retained
+ * manifest is what lets a promote re-attach the same assets without the builder re-pushing.
+ * It is also what the dashboard renders as the per-version asset list.
+ */
+export const deployAssets = assetRouting.extend({
+    files: z.array(assetEntry),
+});
 /** The JSON part a `substrat push` sends alongside the module files. */
 export const deployManifest = z.object({
     version: z.string().min(1),
@@ -287,6 +419,10 @@ export const deployManifest = z.object({
     /** Per-tenant blob stores (#473) — same carry-for-provisioning rule as `tenantStores`:
      *  never a static binding; the platform mints one bucket per tenant and injects it. */
     blobStores: z.array(blobStoreNeed).default([]),
+    /** The vertical's static files (#340): routing config + the full path/hash/size/type
+     *  manifest. Never a binding — native assets are a top-level upload path, so they do not
+     *  ride the §4 allowlist. Optional ⇒ a vertical that ships none is unaffected. */
+    assets: deployAssets.optional(),
     /** The vertical's declared env-spec (from its package.json `substrat.envSpec`), stored on
      *  the registry so a host/console renders a config form for it. Optional + validated here. */
     envSpec: z.array(envVarSpec).optional(),

package/dist/deploy.js.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.js","sourceRoot":"","sources":["../src/deploy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAuB,MAAM,eAAe,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAuB,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,6EAA6E;AAC7E,4EAA4E;AAC5E,4EAA4E;AAC5E,0EAA0E;AAC1E,4EAA4E;AAC5E,wBAAwB;AAExB;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAE7C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,oFAAoF;IACpF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC;IAC9C,iDAAiD;IACjD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACzB,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,2FAA2F;IAC3F,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC;IAC9C,0GAA0G;IAC1G,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;CACpD,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IAC7B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACvB,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,QAAgB;IACtE,OAAO,GAAG,OAAO,KAAK,QAAQ,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,kGAAkG;IAClG,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC;IAC9C,oGAAoG;IACpG,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CACxC,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACvB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACvB,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,QAAgB;IACpE,OAAO,GAAG,OAAO,KAAK,QAAQ,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,qFAAqF;IACrF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,iFAAiF;IACjF,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC3C,+FAA+F;IAC/F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtC;;4FAEwF;IACxF,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAClD;iFAC6E;IAC7E,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC/C,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,0BAA0B,EAAE,8DAA8D;IAC1F,IAAI,EAAE,0DAA0D;IAChE,cAAc,EAAE,sBAAsB;IACtC,OAAO,EAAE,kCAAkC;IAC3C,WAAW,EAAE,mBAAmB;IAChC,kBAAkB,EAAE,kCAAkC;IACtD,aAAa,EAAE,2DAA2D;IAC1E,YAAY,EAAE,mDAAmD;CACzD,CAAC;AAGX;;;wFAGwF;AACxF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,8FAA8F;IAC9F,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC1B,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,GAAG,EAAE,aAAa;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACrC,CAAC,CAAC;AAGH;;wEAEwE;AACxE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;CACpC,CAAC,CAAC;AAGH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC;IAC7C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;IAC9B,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACpD,CAAC,CAAC;AAqBH;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAuB;IACvD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAuB;IAC7D,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,CAAmB,IAAkB,EAAO,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEpF,MAAM,UAAU,GAAG,IAAI,GAAG,EAAwH,CAAC;IACnJ,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,IAAI;gBAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;;gBACrC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;SAC3B,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;SACjC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,IAAI,CAAC,CAAC,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC,GAAG,iBAAiB,CAAC,CAAC;QACzF,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IAChF,CAAC,CAAC,CAAC;IAEL,MAAM,WAAW,GAAG,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC;SAC1C,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;SAC9F,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAErC,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;SACjD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;SAC/C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAEpF,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;AAC9C,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,oEAAoE;IACpE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,4DAA4D;IAC5D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1D,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACjD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9C;;;oFAGgF;IAChF,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAClD;2FACuF;IACvF,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9C;kGAC8F;IAC9F,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IACvC;+FAC2F;IAC3F,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC9C,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC5C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IACxC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IACxC;;;4FAGwF;IACxF,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;IAC5C;;;;;;+EAM2E;IAC3E,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAClC;oGACgG;IAChG,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;IAC7C;;;;;4BAKwB;IACxB,QAAQ,EAAE,kBAAkB;IAC5B,mFAAmF;IACnF,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B;;0CAEkC;QAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC7B,CAAC;CACH,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,cAAc,CAAC,MAAM,CAAC;IACxD,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC"}
+{"version":3,"file":"deploy.js","sourceRoot":"","sources":["../src/deploy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAuB,MAAM,eAAe,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAuB,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,6EAA6E;AAC7E,4EAA4E;AAC5E,4EAA4E;AAC5E,0EAA0E;AAC1E,4EAA4E;AAC5E,wBAAwB;AAExB;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAE7C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,oFAAoF;IACpF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC;IAC9C,iDAAiD;IACjD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACzB,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,2FAA2F;IAC3F,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC;IAC9C,0GAA0G;IAC1G,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;CACpD,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IAC7B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACvB,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,QAAgB;IACtE,OAAO,GAAG,OAAO,KAAK,QAAQ,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,kGAAkG;IAClG,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC;IAC9C,oGAAoG;IACpG,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CACxC,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACvB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACvB,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,QAAgB;IACpE,OAAO,GAAG,OAAO,KAAK,QAAQ,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,2FAA2F;IAC3F,YAAY,EAAE,CAAC;SACZ,IAAI,CAAC,CAAC,qBAAqB,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,CAAC,CAAC;SACpF,QAAQ,EAAE;IACb,wFAAwF;IACxF,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,yBAAyB,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpF,wFAAwF;IACxF,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrF,CAAC,CAAC;AAGH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC;IAC5C,iFAAiF;IACjF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,qFAAqF;IACrF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,iFAAiF;IACjF,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC3C,+FAA+F;IAC/F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtC;;4FAEwF;IACxF,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAClD;iFAC6E;IAC7E,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9C;6FACyF;IACzF,MAAM,EAAE,UAAU,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,0BAA0B,EAAE,8DAA8D;IAC1F,IAAI,EAAE,0DAA0D;IAChE,cAAc,EAAE,sBAAsB;IACtC,OAAO,EAAE,kCAAkC;IAC3C,WAAW,EAAE,mBAAmB;IAChC,kBAAkB,EAAE,kCAAkC;IACtD,aAAa,EAAE,2DAA2D;IAC1E,YAAY,EAAE,mDAAmD;CACzD,CAAC;AAGX;;;wFAGwF;AACxF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,8FAA8F;IAC9F,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC1B,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,GAAG,EAAE,aAAa;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACrC,CAAC,CAAC;AAGH;;wEAEwE;AACxE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;CACpC,CAAC,CAAC;AAGH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC;IAC7C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;IAC9B,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACpD,CAAC,CAAC;AAqBH;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAuB;IACvD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAuB;IAC7D,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,CAAmB,IAAkB,EAAO,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEpF,MAAM,UAAU,GAAG,IAAI,GAAG,EAAwH,CAAC;IACnJ,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,IAAI;gBAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;;gBACrC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;SAC3B,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;SACjC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,IAAI,CAAC,CAAC,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC,GAAG,iBAAiB,CAAC,CAAC;QACzF,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IAChF,CAAC,CAAC,CAAC;IAEL,MAAM,WAAW,GAAG,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC;SAC1C,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;SAC9F,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAErC,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;SACjD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;SAC/C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAEpF,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,oFAAoF;IACpF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC;IAC1C,uFAAuF;IACvF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACpC,+EAA+E;IAC/E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAW1C;;sEAEsE;AACtE,SAAS,QAAQ,CAAC,KAAiB;IACjC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,KAAK,GAAG,MAAM,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;QAC7C,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAmB,EAAE,IAAY;IAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACvC,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC,CACxD,CAAC;IACF,OAAO,CAAC,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;SAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC;SACR,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC;CAC3B,CAAC,CAAC;AAGH,wEAAwE;AACxE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,oEAAoE;IACpE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,4DAA4D;IAC5D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1D,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACjD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9C;;;oFAGgF;IAChF,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAClD;2FACuF;IACvF,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9C;;sFAEkF;IAClF,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC/B;kGAC8F;IAC9F,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IACvC;+FAC2F;IAC3F,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC9C,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC5C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IACxC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IACxC;;;4FAGwF;IACxF,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;IAC5C;;;;;;+EAM2E;IAC3E,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAClC;oGACgG;IAChG,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;IAC7C;;;;;4BAKwB;IACxB,QAAQ,EAAE,kBAAkB;IAC5B,mFAAmF;IACnF,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B;;0CAEkC;QAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC7B,CAAC;CACH,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,cAAc,CAAC,MAAM,CAAC;IACxD,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC"}

package/dist/index.d.ts

@@ -31,6 +31,7 @@ export * from './platform-request.js';
 export * from './manifest.js';
 export * from './openapi.js';
 export * from './deploy.js';
+export * from './ci.js';
 export * from './money.js';
 export * from './attachments.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,cAAc,UAAU,CAAC;AACzB,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,uBAAuB,CAAC;AACtC,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,cAAc,UAAU,CAAC;AACzB,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,uBAAuB,CAAC;AACtC,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC"}

package/dist/index.js

@@ -31,6 +31,7 @@ export * from './platform-request.js';
 export * from './manifest.js';
 export * from './openapi.js';
 export * from './deploy.js';
+export * from './ci.js';
 export * from './money.js';
 export * from './attachments.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,cAAc,UAAU,CAAC;AACzB,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,uBAAuB,CAAC;AACtC,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,cAAc,UAAU,CAAC;AACzB,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,uBAAuB,CAAC;AACtC,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@substrat-run/contracts",
-  "version": "0.48.1",
+  "version": "0.49.0",
   "description": "Substrat kernel contract schemas — Zod is the source of truth (master plan D-22); OAS/JSON Schema are emitted artifacts",
   "license": "Apache-2.0",
   "repository": {