gcb-host 0.0.0 → 0.0.1

package/lib/commands/init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAEhD,OAAO,EACL,aAAa,EACb,SAAS,EACT,UAAU,EACV,iBAAiB,EACjB,OAAO,EACP,cAAc,GAEf,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,aAAa,EACb,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,SAAS,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AA4DvG;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,MAAoB;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,KAAK,EAAE,QAAQ,KAAK,YAAY,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,QAA2B,EAAE,KAAgB;IAC1E,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;IACpC,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,mEAAmE,CACpG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClG,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5B,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,gHAAgH,CACjH,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAgB;IAChD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,IAAI,MAAM,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IACjF,OAAO,cAAc,CAAC;QACpB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS;QAC7C,KAAK,EAAE;YACL,YAAY,EAAE;gBACZ,QAAQ,EAAE,YAAY;gBACtB,KAAK,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;gBAC/B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,WAAW,EAAE,KAAK,CAAC,WAAW;aACD;SAChC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAsB,EAAE,KAAgB,EAAE,KAAkB;IAC5F,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACjC,OAAO,cAAc,CAAC;QACpB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE;YACL,GAAG,QAAQ,CAAC,KAAK;YACjB,YAAY,EAAE;gBACZ,QAAQ,EAAE,YAAY;gBACtB,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC;gBACzC,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ;gBAC1C,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK;gBACjC,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW;aACtB;SAChC;KACF,CAAC,CAAC;AACL,CAAC;AAeD;;;;;;;;GAQG;AACH,SAAS,WAAW,CAClB,UAAkB,EAClB,MAAoB,EACpB,KAAc,EACd,OAAgC;IAEhC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACxC,eAAe,CAAC,UAAU,EAAE,mDAAmD,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACtH,OAAO;IACT,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACjC,MAAM,QAAQ,GAAG,aAAa,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE;QAClE,MAAM,EAAE,MAAM;QACd,UAAU,EAAE,IAAI;QAChB,YAAY,EAAE,IAAI;KACnB,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,iBAAiB,UAAU,KAAK,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9G,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,OAAO;QAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC;IACjC,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,KAAgB;IAC1C,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,yBAAyB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED,MAAM,eAAe,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,iBAAiB,IAAI,iBAAiB,CAAC,EAAE,CAAC;IAC9E,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;IACtG,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACtE,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,GAAG,cAAc,OAAO,sFAAsF,CACxH,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,SAAS,CAAC,UAAU,CAAC;IAC5D,2FAA2F;IAC3F,gDAAgD;IAChD,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAErE,mFAAmF;IACnF,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,YAAY,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QACzC,2FAA2F;QAC3F,2FAA2F;QAC3F,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,YAAY,CAAC;QACxC,MAAM,SAAS,GAAG,IAAI,KAAK,YAAY,CAAC;QAExC,IAAI,SAAS,IAAI,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,uCAAuC,QAAQ,CAAC,UAAU,uCAAuC;gBAC5G,6EAA6E,CAChF,CAAC;QACJ,CAAC;QACD,qBAAqB,CAAC,eAAe,EAAE,KAAK,CAAC,cAAc,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACvF,qBAAqB,CAAC,cAAc,EAAE,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAEhF,6FAA6F;QAC7F,sFAAsF;QACtF,iDAAiD;QACjD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,eAAe,CAAC,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACjE,CAAC;aAAM,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,CAAC,OAAO,6CAA6C,CAAC,CAAC;QACrF,CAAC;QAED,IAAI,KAAkB,CAAC;QACvB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,KAAK,GAAG,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACN,2FAA2F;YAC3F,0FAA0F;YAC1F,0DAA0D;YAC1D,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;YACjD,KAAK,GAAG,WAAW,CACjB,MAAM,EACN,KAAK,CAAC,GAAG,EACT,KAAK,CAAC,cAAc,IAAI,OAAO,EAAE,UAAU,IAAI,wBAAwB,CACxE,CAAC;YACF,MAAM,YAAY,GAAG,OAAO,EAAE,SAAS,IAAI,SAAS,CAAC;YACrD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;gBAAE,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;iBAC/E,IAAI,YAAY,KAAK,SAAS;gBAAE,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;QACrF,CAAC;QAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,YAAY,GAChB,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC;QACxG,MAAM,OAAO,GAAmB,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;QAC9G,IAAI,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1G,IAAI,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,EAAE,CAAC;YAClD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,gBAAgB,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,YAAY,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACvE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;YACtE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;YAC7D,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;YAChG,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,aAAa,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACtD,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5E,CAAC;IAED,0FAA0F;IAC1F,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,4GAA4G,CAC7G,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,mEAAmE,CACpG,CAAC;QACJ,CAAC;IACH,CAAC;IACD,0FAA0F;IAC1F,iFAAiF;IACjF,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC;IAC5B,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAChC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,IAAI,QAAQ,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IAClG,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IAED,qBAAqB,CAAC,eAAe,EAAE,KAAK,CAAC,cAAc,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACvF,qBAAqB,CAAC,cAAc,EAAE,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAEhF,MAAM,GAAG,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,iBAAiB,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IACtF,eAAe,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACxC,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACjD,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAClE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uCAAuC,CAAC,CAAC;IAClG,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6BAA6B;AAC7B,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgCxB,OAAO,CAAC,UAAU,oBAAoB,OAAO,CAAC,OAAO,eAAe,OAAO,CAAC,SAAS;;CAEtF,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAuB;IACtD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,MAAM,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC3G,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,WAAyD;IAClF,MAAM,SAAS,GAAG,WAAW,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACvD,OAAO,CACL,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;SACtB,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;SACpD,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC;SAC1C,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,CACzB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,IAAI,CAAC,IAAkC,EAAE,IAAY;IAC5D,OAAO,IAAI;SACR,MAAM,CAAC,IAAI,CAAC;SACZ,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;SACpC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAyD,EACzD,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACzF,MAAM,UAAU,GACd,IAAI,CAAC,MAAM,KAAK,SAAS;QACvB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;QAC3B,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS;YACtB,CAAC,CAAC,iBAAiB,CAAC,SAAS,EAAE,GAAG,CAAC;YACnC,CAAC,CAAC,SAAS,CAAC;IAClB,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAuB;IACnD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAC/E,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,GAAG,CAAC,UAAU,CAAC,CAAC;QAChB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpE,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC;QACpE,IAAI,CAAC,qCAAqC,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAsB,CAAC,EAAE,CAAC;QAC7E,IAAI,CAAC,yBAAyB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,SAAS,GAAG,oBAAoB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjG,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,WAAW,CAAC;YACzB,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YACxB,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;YAC1B,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC;YACvC,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC;YACvC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;YACzC,IAAI,EAAE,IAAkC;YACxC,QAAQ;YACR,KAAK;YACL,WAAW,EAAE,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YACxD,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;YACnC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;SACzB,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzE,MAAM,SAAS,GAAG,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;QAClH,GAAG,CAAC,oBAAoB,SAAS,EAAE,CAAC,CAAC;QACrC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,MAAM,CAAC,UAAU,gCAAgC,CAAC,CAAC;QAC9E,GAAG,CAAC,oBAAoB,MAAM,CAAC,OAAO,aAAa,CAAC,CAAC;QAErD,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpB,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC9C,GAAG,CAAC,EAAE,CAAC,CAAC;YACR,GAAG,CAAC,oBAAoB,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACvD,GAAG,CAAC,oBAAoB,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,oBAAoB,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,iGAAiG;QACjG,kGAAkG;QAClG,GAAG,CAAC,oBAAoB,iBAAiB,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAE5G,GAAG,CAAC,EAAE,CAAC,CAAC;QACR,GAAG,CAAC,mEAAmE,CAAC,CAAC;QACzE,GAAG,CAAC,sBAAsB,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QACtD,GAAG,CACD,sBAAsB,KAAK,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,KAAK,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,MAAM,CAAC,OAAO,eAAe,EAAE,CACpI,CAAC;QACF,GAAG,CAAC,sBAAsB,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QACrD,GAAG,CAAC,EAAE,CAAC,CAAC;QACR,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpB,GAAG,CAAC,qCAAqC,CAAC,CAAC;YAC3C,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9B,GAAG,CAAC,kEAAkE,CAAC,CAAC;YAC1E,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,yBAAyB,MAAM,CAAC,UAAU,oBAAoB,CAAC,CAAC;YACtE,CAAC;YACD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;gBACrD,GAAG,CAAC,EAAE,CAAC,CAAC;gBACR,GAAG,CAAC,6CAA6C,OAAO,kBAAkB,MAAM,CAAC,IAAI,UAAU,CAAC,CAAC;gBACjG,GAAG,CACD,MAAM,CAAC,IAAI,KAAK,MAAM;oBACpB,CAAC,CAAC,qFAAqF;oBACvF,CAAC,CAAC,qFAAqF,CAC1F,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,6BAA6B,CAAC,CAAC;YACnC,GAAG,CAAC,iGAAiG,CAAC,CAAC;YACvG,GAAG,CAAC,yFAAyF,CAAC,CAAC;YAC/F,GAAG,CAAC,+FAA+F,CAAC,CAAC;YACrG,GAAG,CAAC,EAAE,CAAC,CAAC;YACR,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9B,GAAG,CAAC,uEAAuE,CAAC,CAAC;gBAC7E,GAAG,CACD,uBAAuB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,MAAM,CAAC,UAAU,kDAAkD,CACpI,CAAC;gBACF,GAAG,CAAC,sFAAsF,CAAC,CAAC;YAC9F,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,0CAA0C,CAAC,CAAC;gBAChD,GAAG,CAAC,yBAAyB,MAAM,CAAC,UAAU,qCAAqC,CAAC,CAAC;gBACrF,GAAG,CAAC,yBAAyB,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;AACH,CAAC"}

package/lib/commands/stage.d.ts

@@ -0,0 +1,44 @@
+/** The record `stage` leaves behind, so the running code is identifiable afterwards. */
+export declare const STAGED_RECORD = "STAGED.json";
+/** Everything `stage` needs, resolved. */
+export interface StageInput {
+    /** The repository to export from. */
+    readonly repo: string;
+    /** Where the broker will run from. Must be outside every container mount. */
+    readonly to: string;
+    /** The commit to export. A commit, never the working tree. */
+    readonly ref: string;
+    /** The home whose mounts the target must not be inside. */
+    readonly home?: string;
+    /** The directories the container shares, when the caller already has them. */
+    readonly mounts?: readonly string[];
+    /** Replace a target that this command did not stage itself. */
+    readonly force?: boolean;
+}
+/** What `stage` produced. */
+export interface StageResult {
+    readonly to: string;
+    readonly sha: string;
+    readonly subject: string;
+    readonly files: number;
+    /** Uncommitted changes existed and are therefore *not* part of what was staged. */
+    readonly dirtyWorkingTree: boolean;
+}
+/**
+ * Export a commit into the directory the broker will run from.
+ *
+ * @param input - the resolved options.
+ * @returns what was staged.
+ * @throws {Error} for any guard-rail violation.
+ */
+export declare function performStage(input: StageInput): StageResult;
+/** Usage text for `stage`. */
+export declare const STAGE_USAGE = "Usage: gcb stage [options]\n\nExport the broker from a reviewed commit into the directory it will run from.\n\n  --repo <path>    Repository to export from (default: the current directory)\n  --to <path>      Where the broker will run from   [required: outside every container mount]\n  --ref <commit>   Commit to export (default: HEAD; never the working tree)\n  --force          Replace a target this command did not stage itself\n  -h, --help       Show this help\n\nRun this from the repository root you intend to export, or pass --repo. The broker reads the App\nprivate key, so it must not execute code the agent can rewrite. Exporting from a commit rather than\ncopying the working tree is what makes the staged code reviewable; the\nsha is printed so you can check it against your own clone or the remote, because a repository the\nagent can write to is a repository whose commits the agent can rewrite.\n\nThen run it from there \u2014 Node strips types, so there is nothing to build:\n\n  corepack yarn install   # in <to>; stage itself does not run commit code\n  node --conditions=development <to>/packages/host/bin/gcb.js daemon --config <deployment directory>/broker.config.yml\n";
+/**
+ * Run the `stage` command.
+ *
+ * @param argv - arguments after the command name.
+ * @returns the process exit code.
+ */
+export declare function runStage(argv: readonly string[]): number;
+//# sourceMappingURL=stage.d.ts.map

package/lib/commands/stage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stage.d.ts","sourceRoot":"","sources":["../../src/commands/stage.ts"],"names":[],"mappings":"AA0BA,wFAAwF;AACxF,eAAO,MAAM,aAAa,gBAAgB,CAAC;AAE3C,0CAA0C;AAC1C,MAAM,WAAW,UAAU;IACzB,qCAAqC;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,+DAA+D;IAC/D,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,6BAA6B;AAC7B,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,mFAAmF;IACnF,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACpC;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,WAAW,CAgG3D;AAED,8BAA8B;AAC9B,eAAO,MAAM,WAAW,8qCAoBvB,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CA0BxD"}

package/lib/commands/stage.js

@@ -0,0 +1,165 @@
+/**
+ * `stage` — export the broker from a reviewed commit into the directory it will run from.
+ *
+ * Why this exists: the broker must read the App private key, so whatever code it executes has that
+ * key's privileges. It can mint installation tokens for anything the App can see, and it can read
+ * the key file itself. Keeping the *key* outside every container mount is necessary but not
+ * sufficient: if the code comes from a directory the agent can write, then the agent decides what
+ * the broker does — and the broker is the process holding the key. The boundary that matters is
+ * control of the code, not the location of the key.
+ *
+ * So: export from a **commit** (not from the working tree, which is agent-writable and may be
+ * dirty), into a directory outside every mount, and record what was exported next to it, so
+ * "which code is running with my key?" has an answer.
+ *
+ * What this does not do is make the repository trustworthy. The same agent can rewrite commits, so
+ * the sha being staged is printed for you to check against a clone or the remote. Stage a sha you
+ * have looked at, not merely whatever HEAD happens to be.
+ */
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { canonicalPath } from 'gcb-core';
+import { fail, insideMountedPath, parseArgs, say, warn, writeSecretFile } from 'gcb-core';
+/** The record `stage` leaves behind, so the running code is identifiable afterwards. */
+export const STAGED_RECORD = 'STAGED.json';
+/**
+ * Export a commit into the directory the broker will run from.
+ *
+ * @param input - the resolved options.
+ * @returns what was staged.
+ * @throws {Error} for any guard-rail violation.
+ */
+export function performStage(input) {
+    const repo = path.resolve(input.repo);
+    const to = path.resolve(input.to);
+    const home = input.home ?? process.env['HOME'] ?? '';
+    const mounted = insideMountedPath(to, home, input.mounts);
+    if (mounted) {
+        throw new Error(`${to} is inside ${mounted}, which is mounted into the container. The broker runs with the ` +
+            'private key in reach, so code there is code the agent can rewrite — stage outside every mount.');
+    }
+    // Canonical, for the same reason the mount check is: a `--to` that is a symlink into the repository
+    // *is* the repository, and comparing the spellings would miss it.
+    const realRepo = canonicalPath(repo);
+    const realTo = canonicalPath(to);
+    if (realTo === realRepo ||
+        realTo.startsWith(realRepo + path.sep) ||
+        realRepo.startsWith(realTo + path.sep)) {
+        throw new Error(`refusing to stage ${repo} into ${to}: the repository and the target overlap`);
+    }
+    // The deployment directory holds the key and the configuration. A `--to` typo pointing at it
+    // would clear both, so refuse before anything is removed.
+    const deploymentFiles = [
+        'app.pem',
+        'broker.config.yml',
+        'broker.config.yaml',
+        'broker.config.toml',
+        'broker.config.json',
+        'log',
+    ].filter((name) => fs.existsSync(path.join(to, name)));
+    if (deploymentFiles.length > 0) {
+        throw new Error(`${to} looks like the deployment directory itself, not a place for code: it holds ` +
+            `${deploymentFiles.join(', ')}. Stage into a subdirectory of it, for example ${path.join(to, 'app')}.`);
+    }
+    const record = path.join(to, STAGED_RECORD);
+    const entries = fs.existsSync(to) ? fs.readdirSync(to) : [];
+    if (entries.length > 0 && !fs.existsSync(record) && input.force !== true) {
+        throw new Error(`${to} is not empty and does not carry a ${STAGED_RECORD} from a previous run, so it is not ` +
+            'ours to clear. Remove it yourself, or pass --force to replace its contents.');
+    }
+    const git = (args, extraEnv = {}) => {
+        const result = spawnSync('git', args, {
+            cwd: repo,
+            encoding: 'utf8',
+            env: { ...process.env, ...extraEnv },
+        });
+        if (result.status !== 0) {
+            throw new Error(`git ${args.join(' ')} failed: ${(result.stderr ?? '').trim() || `exit ${String(result.status)}`}`);
+        }
+        return (result.stdout ?? '').trim();
+    };
+    const sha = git(['rev-parse', '--verify', `${input.ref}^{commit}`]);
+    const subject = git(['log', '-1', '--format=%s', sha]);
+    const dirtyWorkingTree = git(['status', '--porcelain']).length > 0;
+    const files = git(['ls-tree', '-r', '--name-only', sha])
+        .split('\n')
+        .filter((line) => line.length > 0).length;
+    // Exported with git alone. `git archive | tar` would add a dependency on a system `tar`, which is
+    // not a given on Windows, and there is no need for one: a temporary index can address the commit
+    // and `checkout-index` writes it out. The prefix is given with forward slashes because that is
+    // what git accepts on every platform.
+    const indexFile = path.join(os.tmpdir(), `gcb-stage-${process.pid}-${Date.now()}`);
+    const prefix = `${to.replace(/\\/g, '/')}/`;
+    try {
+        git(['read-tree', sha], { GIT_INDEX_FILE: indexFile });
+        // Cleared rather than merely overwritten: a file deleted since the last stage must not linger
+        // and be imported by surprise.
+        if (entries.length > 0)
+            fs.rmSync(to, { recursive: true, force: true });
+        fs.mkdirSync(to, { recursive: true, mode: 0o755 });
+        git(['checkout-index', '-a', '-f', `--prefix=${prefix}`], { GIT_INDEX_FILE: indexFile });
+    }
+    finally {
+        fs.rmSync(indexFile, { force: true });
+    }
+    writeSecretFile(record, `${JSON.stringify({ ref: input.ref, sha, subject, stagedAt: new Date().toISOString() }, null, 2)}\n`, 0o644);
+    return { to, sha, subject, files, dirtyWorkingTree };
+}
+/** Usage text for `stage`. */
+export const STAGE_USAGE = `Usage: gcb stage [options]
+
+Export the broker from a reviewed commit into the directory it will run from.
+
+  --repo <path>    Repository to export from (default: the current directory)
+  --to <path>      Where the broker will run from   [required: outside every container mount]
+  --ref <commit>   Commit to export (default: HEAD; never the working tree)
+  --force          Replace a target this command did not stage itself
+  -h, --help       Show this help
+
+Run this from the repository root you intend to export, or pass --repo. The broker reads the App
+private key, so it must not execute code the agent can rewrite. Exporting from a commit rather than
+copying the working tree is what makes the staged code reviewable; the
+sha is printed so you can check it against your own clone or the remote, because a repository the
+agent can write to is a repository whose commits the agent can rewrite.
+
+Then run it from there — Node strips types, so there is nothing to build:
+
+  corepack yarn install   # in <to>; stage itself does not run commit code
+  node --conditions=development <to>/packages/host/bin/gcb.js daemon --config <deployment directory>/broker.config.yml
+`;
+/**
+ * Run the `stage` command.
+ *
+ * @param argv - arguments after the command name.
+ * @returns the process exit code.
+ */
+export function runStage(argv) {
+    const args = parseArgs(argv, { booleans: ['force', 'help'] });
+    if (args.has('help') || args.has('h')) {
+        say(STAGE_USAGE);
+        return 0;
+    }
+    const to = args.value('to');
+    if (!to)
+        fail('--to is required (a directory outside every container mount, e.g. /volume1/docker/git-cred-broker/app)');
+    const repo = args.value('repo') ?? process.cwd();
+    try {
+        const result = performStage({ repo, to, ref: args.value('ref') ?? 'HEAD', force: args.has('force') });
+        say(`staged    : ${result.to}`);
+        say(`from      : ${result.sha.slice(0, 12)}  ${result.subject}`);
+        say(`contents  : ${result.files} files, from the commit — nothing from the working tree`);
+        if (result.dirtyWorkingTree) {
+            warn('the working tree has uncommitted changes; they are NOT staged, which is the point');
+        }
+        say('');
+        say('Verify that sha against your own clone or the remote before trusting it: a repository the');
+        say('agent can write to is one whose commits the agent can rewrite.');
+        return 0;
+    }
+    catch (error) {
+        fail(error.message);
+    }
+}
+//# sourceMappingURL=stage.js.map

package/lib/commands/stage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stage.js","sourceRoot":"","sources":["../../src/commands/stage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAE1F,wFAAwF;AACxF,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAC;AA4B3C;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,KAAiB;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAErD,MAAM,OAAO,GAAG,iBAAiB,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1D,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,GAAG,EAAE,cAAc,OAAO,kEAAkE;YAC1F,gGAAgG,CACnG,CAAC;IACJ,CAAC;IACD,oGAAoG;IACpG,kEAAkE;IAClE,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;IACjC,IACE,MAAM,KAAK,QAAQ;QACnB,MAAM,CAAC,UAAU,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC;QACtC,QAAQ,CAAC,UAAU,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,EACtC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,SAAS,EAAE,yCAAyC,CAAC,CAAC;IACjG,CAAC;IAED,6FAA6F;IAC7F,0DAA0D;IAC1D,MAAM,eAAe,GAAG;QACtB,SAAS;QACT,mBAAmB;QACnB,oBAAoB;QACpB,oBAAoB;QACpB,oBAAoB;QACpB,KAAK;KACN,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAChB,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CACnC,CAAC;IACF,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,GAAG,EAAE,8EAA8E;YACjF,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,kDAAkD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,CACzG,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CACb,GAAG,EAAE,sCAAsC,aAAa,qCAAqC;YAC3F,6EAA6E,CAChF,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,CAAC,IAAuB,EAAE,QAAQ,GAAsB,EAAE,EAAU,EAAE;QAChF,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;YACpC,GAAG,EAAE,IAAI;YACT,QAAQ,EAAE,MAAM;YAChB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE;SACrC,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,QAAQ,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,CACnG,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,CAAC,CAAC;IAEF,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC;IACvD,MAAM,gBAAgB,GAAG,GAAG,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;SACrD,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;IAE5C,kGAAkG;IAClG,iGAAiG;IACjG,+FAA+F;IAC/F,sCAAsC;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,aAAa,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACnF,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC;IAC5C,IAAI,CAAC;QACH,GAAG,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC;QACvD,8FAA8F;QAC9F,+BAA+B;QAC/B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,GAAG,CAAC,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,MAAM,EAAE,CAAC,EAAE,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC;IAC3F,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,eAAe,CACb,MAAM,EACN,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EACpG,KAAK,CACN,CAAC;IACF,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;AACvD,CAAC;AAED,8BAA8B;AAC9B,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;CAoB1B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAuB;IAC9C,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9D,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,GAAG,CAAC,WAAW,CAAC,CAAC;QACjB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,wGAAwG,CAAC,CAAC;IAExH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACtG,GAAG,CAAC,eAAe,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAChC,GAAG,CAAC,eAAe,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QACjE,GAAG,CAAC,eAAe,MAAM,CAAC,KAAK,yDAAyD,CAAC,CAAC;QAC1F,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC5B,IAAI,CAAC,mFAAmF,CAAC,CAAC;QAC5F,CAAC;QACD,GAAG,CAAC,EAAE,CAAC,CAAC;QACR,GAAG,CAAC,2FAA2F,CAAC,CAAC;QACjG,GAAG,CAAC,gEAAgE,CAAC,CAAC;QACtE,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;AACH,CAAC"}

package/lib/config.d.ts

@@ -0,0 +1,110 @@
+import type { BrokerConfig } from 'gcb-core';
+/** The file every command looks for when no configuration path is given. */
+export declare const DEFAULT_CONFIG_FILE = "broker.config.yml";
+/**
+ * Where the configuration lives when nothing says otherwise.
+ *
+ * This convention is what makes the commands usable without repeating paths: run them from the
+ * deployment directory and `./broker.config.yml` is found, or export `GIT_BROKER_CONFIG` once.
+ * An explicit `--config` always wins.
+ *
+ * @param explicit - the `--config` argument, if any.
+ * @param env - the environment to read.
+ * @returns an absolute path.
+ */
+export declare function resolveConfigPath(explicit?: string, env?: NodeJS.ProcessEnv): string;
+/**
+ * The deployment directory implied by a configuration path.
+ *
+ * The key, the configuration and the log directory are siblings, so the file's own location says
+ * where the deployment is.
+ *
+ * @param configPath - the configuration path.
+ * @returns the absolute directory.
+ */
+export declare function deploymentDir(configPath: string): string;
+/** The two supported deployments. Which one a configuration suits is decided by its paths. */
+export type DeploymentMode = 'host' | 'sidecar';
+/**
+ * Fixed paths inside the sidecar.
+ *
+ * A contract with the compose file `compose` prints: it and `init --mode sidecar` both read these
+ * from here, because a mismatch is a broker that starts and then cannot find its own key.
+ */
+/**
+ * The file name the authorized person's refresh token is kept under.
+ *
+ * It sits beside the private key, because the broker reads the key and can find the token without being
+ * told anything else — one rule, used by the writer, the reader and the mount, so they cannot drift.
+ */
+export declare const USER_TOKEN_FILE = "user.refresh";
+/**
+ * Where the authorized person's refresh token is, given the key it sits beside.
+ *
+ * posix, not path: these are paths inside the deployment, and the process reading them need not be the
+ * platform they belong to.
+ *
+ * @param privateKeyPath - the key, as the process that reads it sees the path.
+ * @returns the refresh token path.
+ */
+export declare function userTokenPath(privateKeyPath: string): string;
+export declare const SIDECAR: {
+    readonly configPath: '/etc/git-cred-broker/broker.config.yml';
+    readonly keyPath: '/etc/git-cred-broker/app.pem';
+    readonly userTokenPath: string;
+    readonly auditDir: '/var/log/git-cred-broker';
+    readonly auditPath: '/var/log/git-cred-broker/audit.jsonl';
+    readonly socketDir: '/run/git-broker';
+    readonly socketPath: '/run/git-broker/broker.sock';
+};
+/**
+ * Which deployment a configuration was written for.
+ *
+ * Derived from the paths rather than stored, because the paths are what decide whether the broker
+ * can find its key. This lives here, not with the CLI, so the daemon can use it to explain a
+ * mismatch instead of reporting a bare ENOENT about a path that only exists in the other layout.
+ *
+ * @param config - a validated configuration.
+ * @returns the deployment it suits.
+ */
+export declare function inferMode(config: BrokerConfig): DeploymentMode;
+/**
+ * Refuse to start when a person's token is named but not there.
+ *
+ * Same reasoning as the key: a path that does not resolve is a deployment mistake, and the process
+ * that runs the broker is the one whose paths count.
+ *
+ * @param config - the loaded configuration.
+ */
+export declare function assertUserTokensReadable(config: BrokerConfig): void;
+/**
+ * Check that each recorded private key is readable, before the caller tries to read it.
+ *
+ * Both the daemon and `diagnose` need this, because both read the key, and a bare
+ * `ENOENT ... /etc/git-cred-broker/app.pem` says nothing: that path exists only inside the sidecar,
+ * so the mistake is where the command was run, not that the key is missing. The layout is
+ * recoverable from the configuration itself, so name it and give the way out.
+ *
+ * @param config - the validated configuration.
+ * @throws {Error} when a key file is missing, with the remedy in the message.
+ */
+export declare function assertKeysReadable(config: BrokerConfig): void;
+/** Providers this build knows how to construct. */
+export declare const KNOWN_PROVIDERS: readonly ['github-app', 'static'];
+/**
+ * Validate a parsed configuration object.
+ *
+ * @param raw - the parsed JSON.
+ * @param source - where it came from, for error messages.
+ * @returns the validated configuration with defaults applied.
+ * @throws {Error} when any field is missing or malformed.
+ */
+export declare function validateConfig(raw: unknown, source?: string): BrokerConfig;
+/**
+ * Read and validate a configuration file.
+ *
+ * @param path - path to the YAML config.
+ * @returns the validated configuration.
+ */
+export declare function loadConfig(path: string): BrokerConfig;
+//# sourceMappingURL=config.d.ts.map

package/lib/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,YAAY,EAAqD,MAAM,UAAU,CAAC;AAEhG,4EAA4E;AAC5E,eAAO,MAAM,mBAAmB,sBAAsB,CAAC;AAEvD;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAEjG;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,8FAA8F;AAC9F,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,SAAS,CAAC;AAEhD;;;;;GAKG;AACH;;;;;GAKG;AACH,eAAO,MAAM,eAAe,iBAAiB,CAAC;AAE9C;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,eAAO,MAAM,OAAO;aAClB,UAAU,EAAE,wCAAwC;aACpD,OAAO,EAAE,8BAA8B;aAGvC,aAAa;aACb,QAAQ,EAAE,0BAA0B;aACpC,SAAS,EAAE,sCAAsC;aACjD,SAAS,EAAE,iBAAiB;aAC5B,UAAU,EAAE,6BAA6B;CACjC,CAAC;AAEX;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,YAAY,GAAG,cAAc,CAI9D;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAanE;AAED;;;;;;;;;;GAUG;AAEH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAgB7D;AAED,mDAAmD;AACnD,eAAO,MAAM,eAAe,YAAI,YAAY,EAAE,QAAQ,CAAU,CAAC;AA0JjE;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,SAAa,GAAG,YAAY,CAuH9E;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAgBrD"}