hikoutei 0.11.101-dev → 0.11.103-dev

package/dist/cli/setupFlow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setupFlow.d.ts","sourceRoot":"","sources":["../../../../../../src/setupFlow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AAGH,OAAO,EAeL,KAAK,MAAM,EAKZ,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAqE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AACnH,OAAO,EAAiD,KAAK,cAAc,EAAE,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAgB5H,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC/F,OAAO,EAAE,sBAAsB,EAAE,KAAK,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC1F,OAAO,EAAoB,KAAK,YAAY,EAAwB,MAAM,mBAAmB,CAAC;AAC9F,OAAO,EAML,KAAK,iBAAiB,EACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAIL,KAAK,cAAc,EACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAKL,KAAK,OAAO,EACb,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAEV,oBAAoB,EAEpB,YAAY,EAEb,MAAM,oBAAoB,CAAC;AAG5B,qFAAqF;AACrF,eAAO,MAAM,qBAAqB,kCAAkC,CAAC;AAErE,2EAA2E;AAC3E,eAAO,MAAM,gCAAgC,kBAAkB,CAAC;AAEhE,+EAA+E;AAC/E,eAAO,MAAM,aAAa,MAAgC,CAAC;AAE3D,+EAA+E;AAC/E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,cAAc,CAAC;IACvC,yDAAyD;IACzD,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAC;IAC9C,gFAAgF;IAChF,QAAQ,CAAC,cAAc,EAAE,gBAAgB,CAAC;IAC1C,qEAAqE;IACrE,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,yEAAyE;IACzE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,yCAAyC;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,iCAAiC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,qEAAqE;IACrE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IACtC,gFAAgF;IAChF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,sDAAsD;AACtD,YAAY,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,0CAA0C;AAC1C,YAAY,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAExD,qEAAqE;AACrE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,uFAAuF;IACvF,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC,YAAY,CAAC,GAAG,WAAW,CAAC;IAChE,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,oDAAoD;IACpD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,2CAA2C;AAC3C,MAAM,MAAM,WAAW,GACnB;IACA,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAC;CAC9C,GACC;IAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAA;CAAE,GAC9F,gBAAgB,CAAC;AAUrB,+CAA+C;AAC/C,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEjE;AAyCD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,MAAmB,EAAE,MAAM,GAAE,MAAM,MAAoB,GAAG,MAAM,CAItG;AAGD;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,cAAc,EAAE,CA6JnG;AAED,sEAAsE;AACtE,wBAAgB,UAAU,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,GAAG,MAAM,CAatE;AAED,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,CA2B3D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC,CAwK7E;AAs4BD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAMzE;AAED,sEAAsE;AACtE,eAAO,MAAM,eAAe,sCAAsC,CAAC;AAEnE,kFAAkF;AAClF,MAAM,MAAM,iBAAiB,GAAG,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAE7D,+DAA+D;AAC/D,MAAM,WAAW,qBAAqB;IACpC,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,+EAA+E;IAC/E,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,uDAAuD;IACvD,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,qDAAqD;IACrD,QAAQ,CAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAC;CACvC;AAED,+DAA+D;AAC/D,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;CAAE,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAuCvG"}
+{"version":3,"file":"setupFlow.d.ts","sourceRoot":"","sources":["../../../../../../src/setupFlow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AAEH,OAAO,EAeL,KAAK,MAAM,EAKZ,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAqE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AACnH,OAAO,EAAiD,KAAK,cAAc,EAAE,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAS5H,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAQ9C,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC/F,OAAO,EAAE,sBAAsB,EAAE,KAAK,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC1F,OAAO,EAAE,WAAW,EAAE,CAAC;AACvB,OAAO,EAAoB,KAAK,YAAY,EAAwB,MAAM,mBAAmB,CAAC;AAC9F,OAAO,EAML,KAAK,iBAAiB,EACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAIL,KAAK,cAAc,EACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAKL,KAAK,OAAO,EACb,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAEV,oBAAoB,EAEpB,YAAY,EAEb,MAAM,oBAAoB,CAAC;AAG5B,qFAAqF;AACrF,eAAO,MAAM,qBAAqB,kCAAkC,CAAC;AAErE,2EAA2E;AAC3E,eAAO,MAAM,gCAAgC,kBAAkB,CAAC;AAEhE,+EAA+E;AAC/E,eAAO,MAAM,aAAa,MAAgC,CAAC;AAE3D,+EAA+E;AAC/E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,cAAc,CAAC;IACvC,yDAAyD;IACzD,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAC;IAC9C,gFAAgF;IAChF,QAAQ,CAAC,cAAc,EAAE,gBAAgB,CAAC;IAC1C,qEAAqE;IACrE,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,yEAAyE;IACzE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,yCAAyC;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,iCAAiC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,qEAAqE;IACrE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IACtC,gFAAgF;IAChF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,sDAAsD;AACtD,YAAY,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,0CAA0C;AAC1C,YAAY,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAExD,qEAAqE;AACrE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,uFAAuF;IACvF,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC,YAAY,CAAC,GAAG,WAAW,CAAC;IAChE,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,oDAAoD;IACpD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,2CAA2C;AAC3C,MAAM,MAAM,WAAW,GACnB;IACA,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAC;CAC9C,GACC;IAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAA;CAAE,GAC9F,gBAAgB,CAAC;AAUrB,+CAA+C;AAC/C,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEjE;AAyCD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,MAAmB,EAAE,MAAM,GAAE,MAAM,MAAoB,GAAG,MAAM,CAItG;AAGD;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,cAAc,EAAE,CA+MnG;AAED,sEAAsE;AACtE,wBAAgB,UAAU,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,GAAG,MAAM,CAatE;AAED,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,CA2B3D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC,CAmL7E;AAmhCD,sEAAsE;AACtE,eAAO,MAAM,eAAe,sCAAsC,CAAC;AAEnE,kFAAkF;AAClF,MAAM,MAAM,iBAAiB,GAAG,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAE7D,+DAA+D;AAC/D,MAAM,WAAW,qBAAqB;IACpC,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,+EAA+E;IAC/E,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,uDAAuD;IACvD,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,qDAAqD;IACrD,QAAQ,CAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAC;CACvC;AAED,+DAA+D;AAC/D,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;CAAE,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAuCvG"}

package/dist/cli/setupFlow.js

@@ -65,18 +65,19 @@
  * lock, checkpoint, key, or env mutation, and manual setup remains
  * available.
  */
-import { basename, dirname, join } from "node:path";
 import { acquireSetupLock, checkStateCompatibility, generateCreationMarker, isValidGcpProjectId, isValidServiceAccountName, loadSetupState, releaseSetupLock, saveSetupState, serviceAccountEmail, SERVICE_ACCOUNT_KEY_FILE_MODE, SETUP_STATE_VERSION, setupLockPath, setupStateTempPath, } from "./checkpoint.js";
 import { MAX_SETUP_SA_COUNT, parseSaCount } from "./args.js";
 import { SETUP_ERROR_CODES, carrierCode, setupFailure } from "./errors.js";
 import { describeGcloudFailure, errorResult, outcomeOf } from "./flowResult.js";
 import { revalidateSetupPaths, writeSetupEnvFile, } from "./envFileWriter.js";
 import { findSetupPathCollision } from "./setupPathCollision.js";
+import { poolKeyPath } from "./setupPaths.js";
 import { readServiceAccountKeyCredentialSecurely, readServiceAccountKeySecurely, } from "./keyMaterial.js";
 // Compat re-exports: the extracted modules are the canonical homes; the
 // setupFlow import path is kept stable for existing importers.
 export { writeSetupEnvFile, atomicWritePrivateFile, SETUP_ENV_KEYS } from "./envFileWriter.js";
 export { findSetupPathCollision } from "./setupPathCollision.js";
+export { poolKeyPath };
 import { createSafeRunner } from "./gcloudRunner.js";
 import { boundedCheckReporter, POOL_EXPANSION_PHASE, safeProgressSink, SETUP_PROGRESS_OPERATIONS, } from "./setupProgress.js";
 import { checkHumanDriveAccess, DRIVE_ACCESS_COMMAND, } from "./humanAuth.js";
@@ -292,7 +293,50 @@ export function planSetupCommands(options, slug) {
         kind: "file",
         label: `write ${options.outputPath}`,
         outcome: "GOOGLE_APPLICATION_CREDENTIALS and HIKOUTEI_SYNC_SPREADSHEET_URL set; unrelated lines preserved; written atomically via a private temp file + rename, never through a symlink alias",
-    }, {
+    });
+    // The requested credential pool is part of the dry-run plan: one
+    // ensure/key/share/verify group per additional account, both pool
+    // checkpoint writes, and the pool .env rewrite. Single-SA runs plan
+    // exactly as before.
+    const dryRunSaCount = options.saCount ?? 1;
+    for (let index = 2; index <= dryRunSaCount; index += 1) {
+        const poolSaName = `${options.saName}-${index}`;
+        const poolEmail = serviceAccountEmail(poolSaName, projectId);
+        const poolPath = poolKeyPath(options.keyPath, index);
+        commands.push({
+            kind: "gcloud",
+            command: ["iam", "service-accounts", "create", poolSaName, "--project", projectId, "--display-name", "hikoutei setup"],
+            outcome: `pool service account ${index} created (reused when it already exists)`,
+        }, {
+            kind: "file",
+            label: `checkpoint ${options.statePath}`,
+            outcome: `pool key ${index} write-ahead marker and baseline persisted before its single create; a resume reconciles and never creates a duplicate`,
+        }, {
+            kind: "gcloud",
+            command: ["iam", "service-accounts", "keys", "create", KEY_STAGE_PLACEHOLDER, "--iam-account", poolEmail, "--project", projectId],
+            outcome: `pool key ${index} created in a private staging directory, validated there, and installed atomically at ${poolPath}`,
+        }, {
+            kind: "api",
+            label: `drive.permissions: share ${poolEmail} as writer`,
+            outcome: `pool service account ${index} granted writer access without a notification email`,
+        }, {
+            kind: "api",
+            label: `spreadsheets.get with the ${poolEmail} key`,
+            outcome: `pool service-account access ${index} verified`,
+        }, {
+            kind: "file",
+            label: `checkpoint ${options.statePath}`,
+            outcome: `verified pool entry ${index} persisted; its in-flight write-ahead is cleared`,
+        });
+    }
+    if (dryRunSaCount > 1) {
+        commands.push({
+            kind: "file",
+            label: `write ${options.outputPath}`,
+            outcome: `HIKOUTEI_SYNC_CREDENTIALS set to the ${dryRunSaCount}-entry credential pool; unrelated lines preserved`,
+        });
+    }
+    commands.push({
         kind: "file",
         label: `release setup lock ${lockPath}`,
         outcome: "released",
@@ -395,14 +439,25 @@ export async function runSetup(options) {
         (!Number.isSafeInteger(options.saCount) || options.saCount < 1 || options.saCount > MAX_SETUP_SA_COUNT)) {
         return errorResult(SETUP_ERROR_CODES.INVALID_ARGS, `invalid sa-count value: expected a positive integer between 1 and ${MAX_SETUP_SA_COUNT}`);
     }
+    // Derived pool identities are validated before anything runs (dry runs
+    // included): an over-long `--sa-name` that cannot expand into N valid
+    // `<saName>-<i>` accounts is a usage error, never a mid-run failure
+    // after the primary resources were already mutated.
+    const poolPlanError = validatePoolPlan(options.saName, options.saCount ?? 1);
+    if (poolPlanError !== null) {
+        return errorResult(SETUP_ERROR_CODES.INVALID_ARGS, poolPlanError);
+    }
     // Reject canonical path collisions before anything else runs: `--output`
     // must never alias the key, checkpoint, checkpoint temp, or lock path, and
-    // the key must never alias the checkpoint, temp, or lock. This is a usage
-    // error, not a runtime failure.
+    // the key must never alias the checkpoint, temp, or lock. Planned
+    // credential-pool key paths (entries 2..N) are reserved too: a pool key
+    // aliasing any reserved path rejects the run before any mutation. This is
+    // a usage error, not a runtime failure.
     const collision = findSetupPathCollision({
         keyPath: options.keyPath,
         outputPath: options.outputPath,
         statePath: options.statePath,
+        poolKeyPaths: plannedPoolKeyPaths(options.keyPath, options.saCount ?? 1),
     });
     if (collision.status === "collision") {
         return errorResult(SETUP_ERROR_CODES.INVALID_ARGS, collision.message);
@@ -532,6 +587,12 @@ async function runSetupLocked(options, executed, human, runner, keySleeper, prog
         return errorResult(SETUP_ERROR_CODES.SETUP_STATE_INVALID, checkpointResult.message);
     }
     const checkpoint = checkpointResult.status === "loaded" ? checkpointResult.state : undefined;
+    if (checkpoint?.status === "complete" &&
+        ((checkpoint.pool?.length ?? 1) > MAX_SETUP_SA_COUNT ||
+            (checkpoint.poolKeyStarted?.index ?? 0) > MAX_SETUP_SA_COUNT)) {
+        return errorResult(SETUP_ERROR_CODES.SETUP_STATE_INVALID, `the credential pool in ${options.statePath} exceeds the supported maximum of ${MAX_SETUP_SA_COUNT}; ` +
+            `remove the setup state and rerun setup`);
+    }
     // Report the resume context once: the phases a checkpoint guarantees as
     // already complete. cloud_auth and drive_access are never
     // checkpoint-complete (every run re-runs them fresh), and the output phase
@@ -542,6 +603,24 @@ async function runSetupLocked(options, executed, human, runner, keySleeper, prog
             completedFromCheckpoint: checkpointCompletedPhases(checkpoint.status),
         });
     }
+    // Stored + planned pool key paths must never alias a reserved path: a
+    // checkpointed pool (or in-flight pool write-ahead) that collides with
+    // the current run's key/output/state/temp/lock rejects the run here,
+    // still before any mutation (the project phase is the first writer).
+    const storedPoolPaths = storedPoolKeyPaths(checkpoint);
+    if (storedPoolPaths.length > 0 || (options.saCount ?? 1) > 1) {
+        const poolCollision = findSetupPathCollision({
+            keyPath: options.keyPath,
+            outputPath: options.outputPath,
+            statePath: options.statePath,
+            poolKeyPaths: [
+                ...new Set([...plannedPoolKeyPaths(options.keyPath, options.saCount ?? 1), ...storedPoolPaths]),
+            ],
+        });
+        if (poolCollision.status === "collision") {
+            return errorResult(SETUP_ERROR_CODES.INVALID_ARGS, poolCollision.message);
+        }
+    }
     // Key file: on resume it must exist and match the checkpoint once the
     // key phase was reached (key_ready and later); a `key_create_started`
     // checkpoint defers key handling to the reconciliation step because the
@@ -1086,8 +1165,15 @@ async function runSetupLocked(options, executed, human, runner, keySleeper, prog
     // spreadsheet URL is derived from the id — never trusted from storage.
     // Revalidate the reserved paths immediately before this write so an alias
     // planted mid-run can never redirect the .env write onto the key or the
-    // checkpoint.
-    const envPreflight = revalidateSetupPaths(options);
+    // checkpoint. A checkpointed pool survives smaller/default reruns: its
+    // paths are preserved in the .env (the writer only emits the pool line
+    // for >= 2 paths, so a fresh single-SA run still strips a stale line)
+    // and reserved against aliasing, exactly like the primary key.
+    const preservedPoolPaths = checkpointPoolEntries(checkpoint).map((entry) => entry.keyPath);
+    const poolReservedPaths = [
+        ...new Set([...plannedPoolKeyPaths(options.keyPath, options.saCount ?? 1), ...storedPoolKeyPaths(checkpoint)]),
+    ];
+    const envPreflight = revalidateSetupPaths(options, poolReservedPaths);
     if (envPreflight !== null) {
         return envPreflight;
     }
@@ -1095,7 +1181,7 @@ async function runSetupLocked(options, executed, human, runner, keySleeper, prog
     progress.report({ type: "operation_started", phase: "output", operation: SETUP_PROGRESS_OPERATIONS.ENV_WRITE });
     let envResult;
     try {
-        envResult = writeSetupEnvFile(options.outputPath, options.keyPath, spreadsheetEditUrl(spreadsheet.spreadsheetId), [options.statePath, setupLockPath(options.statePath), setupStateTempPath(options.statePath)]);
+        envResult = writeSetupEnvFile(options.outputPath, options.keyPath, spreadsheetEditUrl(spreadsheet.spreadsheetId), [options.statePath, setupLockPath(options.statePath), setupStateTempPath(options.statePath), ...poolReservedPaths], preservedPoolPaths);
     }
     catch (error) {
         return errorResult(carrierCode(error) ?? SETUP_ERROR_CODES.OUTPUT_WRITE_FAILED, `could not write ${options.outputPath}: ${messageOf(error)}`);
@@ -1133,10 +1219,28 @@ async function runSetupLocked(options, executed, human, runner, keySleeper, prog
         resumed: checkpoint !== undefined,
     };
     // Single-SA runs return exactly as before (no pool checkpoint key, no
-    // pool env line, no pool progress); the pool expansion below runs only
-    // when more than one service account was requested.
+    // pool env line, no pool progress) — unless a checkpointed pool exists:
+    // resuming a pooled setup with a smaller or default count never removes
+    // entries, so the stored pool (with its kept count) is reported and the
+    // .env above already preserved its pool line. The pool expansion below
+    // runs only when more than one service account was requested.
     const saCount = options.saCount ?? 1;
-    if (saCount <= 1) {
+    const checkpointPool = checkpointPoolEntries(checkpoint);
+    const hasPoolKeyInFlight = checkpoint?.status === "complete" && checkpoint.poolKeyStarted !== undefined;
+    if (saCount <= 1 && !hasPoolKeyInFlight) {
+        if (checkpointPool.length > 0) {
+            return {
+                status: "ok",
+                dryRun: false,
+                commands: executed,
+                summary: {
+                    ...baseSummary,
+                    poolSize: checkpointPool.length,
+                    poolPaths: checkpointPool.map((entry) => entry.keyPath),
+                    poolKeptEntries: checkpointPool.length,
+                },
+            };
+        }
         return {
             status: "ok",
             dryRun: false,
@@ -1259,17 +1363,81 @@ async function ensureServiceAccount(runner, executed, progress, phase, input) {
     return { status: "ok", reused: false };
 }
 /**
- * Derives the key path for pool entry `index` (2-based) next to the
- * primary key path, mirroring the primary naming: `name-2.json` beside
- * `name.json` (or `name-2` beside an extensionless `name`). The directory
- * is preserved and no existing file is ever touched here.
+ * Planned key paths for pool entries 2..N next to the primary key path.
+ *
+ * Empty for single-SA runs, so single-account callers are unchanged.
+ */
+function plannedPoolKeyPaths(primaryKeyPath, saCount) {
+    const paths = [];
+    for (let index = 2; index <= saCount; index += 1) {
+        paths.push(poolKeyPath(primaryKeyPath, index));
+    }
+    return paths;
+}
+/**
+ * Validates every derived `<saName>-<i>` pool account name for entries
+ * 2..N against the canonical service-account format.
+ *
+ * Returns an `invalid_args` message, or null when the plan is valid. Runs
+ * before any subprocess, API call, or file mutation (dry runs included),
+ * so an over-long `--sa-name` that cannot expand into N valid accounts
+ * fails before the primary resources are mutated. Single-SA runs always
+ * validate (the loop is empty).
+ */
+function validatePoolPlan(saName, saCount) {
+    for (let index = 2; index <= saCount; index += 1) {
+        const derived = `${saName}-${index}`;
+        if (!isValidServiceAccountName(derived)) {
+            return (`service-account name "${saName}" is too long to expand into a ${saCount}-account ` +
+                `pool ("${derived}" is not a valid service-account name); use a shorter --sa-name`);
+        }
+    }
+    return null;
+}
+/**
+ * Additional key paths (entries 2..N) stored in a loaded checkpoint plus
+ * any in-flight pool-key write-ahead. Entry 1 is the primary key and is
+ * already reserved separately.
+ *
+ * Empty unless the checkpoint is `complete` with a pool, so single-SA
+ * resumes are unchanged.
  */
-export function poolKeyPath(primaryKeyPath, index) {
-    const base = basename(primaryKeyPath);
-    const dot = base.lastIndexOf(".");
-    const stem = dot > 0 ? base.slice(0, dot) : base;
-    const ext = dot > 0 ? base.slice(dot) : "";
-    return join(dirname(primaryKeyPath), `${stem}-${index}${ext}`);
+function storedPoolKeyPaths(checkpoint) {
+    if (checkpoint?.status !== "complete") {
+        return [];
+    }
+    // Entry 1 is the primary key path, already reserved by `options.keyPath`.
+    const paths = (checkpoint.pool ?? []).slice(1).map((entry) => entry.keyPath);
+    if (checkpoint.poolKeyStarted !== undefined) {
+        paths.push(checkpoint.poolKeyStarted.keyPath);
+    }
+    return paths;
+}
+/**
+ * Additional key paths (entries 2..N) carried by a checkpoint STATE value
+ * plus any in-flight pool-key write-ahead. Entry 1 is reserved separately
+ * as the primary key.
+ *
+ * Empty unless the state is `complete` with a pool.
+ */
+function statePoolPaths(state) {
+    if (state.status !== "complete") {
+        return [];
+    }
+    // Entry 1 is the primary key path, already reserved by `options.keyPath`.
+    const paths = (state.pool ?? []).slice(1).map((entry) => entry.keyPath);
+    if (state.poolKeyStarted !== undefined) {
+        paths.push(state.poolKeyStarted.keyPath);
+    }
+    return paths;
+}
+/**
+ * Pool entries stored in a loaded checkpoint.
+ *
+ * Empty for fresh runs and single-SA checkpoints.
+ */
+function checkpointPoolEntries(checkpoint) {
+    return checkpoint?.status === "complete" ? (checkpoint.pool ?? []) : [];
 }
 /** Prompt text for the interactive service-account count question. */
 export const SA_COUNT_PROMPT = "Service accounts to create? [1]: ";
@@ -1328,22 +1496,23 @@ export async function resolveSaCountForSetup(options) {
  *
  * Runs after the primary flow reached `complete`: for each missing entry
  * it ensures the `<saName>-<i>` service account exists (the same
- * ensure/create path as the primary), issues its key with the same
- * settlement loop (`settleServiceAccountKey` with `fresh` permission and
- * its own marker/baseline), grants it writer access, verifies access with
- * the same verifier, and persists the entry to the `complete` checkpoint
- * IMMEDIATELY — a mid-pool failure keeps entries 1..i-1 so the resume
- * skips them. Failures use the same error codes as the primary path.
+ * ensure/create path as the primary), issues its key under a per-entry
+ * write-ahead (the fresh baseline plus a new marker are persisted as
+ * `poolKeyStarted` on the `complete` checkpoint BEFORE the single create,
+ * and only the invocation that just persisted it may create with `fresh`
+ * permission), grants it writer access, verifies access with the same
+ * verifier, and persists the entry to the `complete` checkpoint
+ * IMMEDIATELY (clearing the write-ahead) — a mid-pool failure keeps
+ * entries 1..i-1 so the resume skips them, and a crash at any pool-key
+ * boundary resumes by reconciling the stored marker/baseline with
+ * `reconcile` permission instead of creating a second key (an unmatched
+ * cloud key fails with `key_create_uncertain`; nothing is ever deleted
+ * automatically). Failures use the same error codes as the primary path.
  * Finally the `.env` file is rewritten with the comma-separated
  * `HIKOUTEI_SYNC_CREDENTIALS` pool line. The bounded key/verify progress
  * reporters stay unwired here (the tracker hosts one bounded kind per
  * phase): only generic operation events are emitted under
  * `pool_expansion`, which never advances the overall ten-phase count.
- *
- * // ponytail: no per-pool-SA key write-ahead checkpoint; a crash between
- * // a pool key create and its pool-entry persist leaves an orphaned cloud
- * // key that the retry treats as baseline (fails uncertain, never
- * // duplicates silently). Persist per-SA key markers if this ever matters.
  */
 async function expandCredentialPool(runner, executed, progress, api, options, keySleeper, context) {
     progress.report({ type: "phase_started", phase: POOL_EXPANSION_PHASE });
@@ -1377,11 +1546,18 @@ async function expandCredentialPool(runner, executed, progress, api, options, ke
         }
     }
     // Keep-all resume: resuming with a smaller --sa-count never removes
-    // entries — the loop below only appends missing entries 2..N, so the
-    // pool only grows and the summary reports the actual (larger) size.
+    // entries, and any existing write-ahead is reconciled before returning.
     const keptPoolEntries = storedPool?.length ?? 0;
     const pool = storedPool !== undefined ? [...storedPool] : [primaryEntry];
-    for (let index = pool.length + 1; index <= context.saCount; index += 1) {
+    // A crashed pool-key run leaves its write-ahead on the complete
+    // checkpoint: the next run reconciles that entry only (stored
+    // marker/baseline, reconcile permission) and never creates a second key
+    // for it. Only the first missing index can carry a write-ahead — every
+    // persisted entry clears it.
+    const resumedPoolKey = reloaded.state.poolKeyStarted;
+    const resumedPoolKeyIndex = pool.length + 1;
+    const targetSaCount = Math.max(context.saCount, resumedPoolKey === undefined ? 0 : resumedPoolKeyIndex);
+    for (let index = pool.length + 1; index <= targetSaCount; index += 1) {
         const saName = `${options.saName}-${index}`;
         if (!isValidServiceAccountName(saName)) {
             return {
@@ -1400,25 +1576,79 @@ async function expandCredentialPool(runner, executed, progress, api, options, ke
         if (ensured.status === "error") {
             return ensured;
         }
-        progress.report({ type: "operation_started", phase: POOL_EXPANSION_PHASE, operation: SETUP_PROGRESS_OPERATIONS.KEY_LIST });
-        const keyList = await listUserManagedServiceAccountKeys(runner, executed, {
-            projectId: context.projectId,
-            saEmail,
-            purpose: "baseline",
-        });
-        progress.report({ type: "operation_completed", phase: POOL_EXPANSION_PHASE, operation: SETUP_PROGRESS_OPERATIONS.KEY_LIST });
-        if (keyList.status === "error") {
-            return { status: "error", error: keyList.error };
+        // Pool-key write-ahead: a resumed write-ahead for THIS index settles
+        // reconcile-only with the stored marker/baseline (no fresh baseline
+        // list — the stored baseline scopes the reconciliation, exactly like
+        // the primary key_create_started resume); otherwise the fresh baseline
+        // is listed and the new marker plus baseline are persisted BEFORE the
+        // single create, and only this invocation (fresh permission) may issue
+        // it.
+        let settled;
+        if (resumedPoolKey !== undefined && index === resumedPoolKeyIndex) {
+            if (resumedPoolKey.index !== index ||
+                resumedPoolKey.saName !== saName ||
+                resumedPoolKey.saEmail !== saEmail ||
+                resumedPoolKey.keyPath !== keyPath) {
+                return {
+                    status: "error",
+                    error: errorResult(SETUP_ERROR_CODES.SETUP_STATE_INVALID, `the in-flight pool key in ${options.statePath} does not match pool entry ${index}; ` +
+                        `remove the setup state and rerun setup`),
+                };
+            }
+            settled = await settleServiceAccountKey(runner, executed, {
+                keyPath,
+                projectId: context.projectId,
+                saEmail,
+                keyMarker: resumedPoolKey.keyMarker,
+                baseline: resumedPoolKey.keyBaseline,
+                createPermission: "reconcile",
+                sleeper: keySleeper,
+            });
+        }
+        else {
+            progress.report({ type: "operation_started", phase: POOL_EXPANSION_PHASE, operation: SETUP_PROGRESS_OPERATIONS.KEY_LIST });
+            const keyList = await listUserManagedServiceAccountKeys(runner, executed, {
+                projectId: context.projectId,
+                saEmail,
+                purpose: "baseline",
+            });
+            progress.report({ type: "operation_completed", phase: POOL_EXPANSION_PHASE, operation: SETUP_PROGRESS_OPERATIONS.KEY_LIST });
+            if (keyList.status === "error") {
+                return { status: "error", error: keyList.error };
+            }
+            const keyMarker = generateCreationMarker();
+            progress.report({ type: "operation_started", phase: POOL_EXPANSION_PHASE, operation: SETUP_PROGRESS_OPERATIONS.CHECKPOINT_PERSIST });
+            const writeAheadBase = spreadsheetState(options, context.projectId, context.ownerEmail, context.title, context.primaryEmail, { spreadsheetId: context.spreadsheetId }, "complete", context.projectMode, context.keyOrigin, context.shareOrigin);
+            if (writeAheadBase.status !== "complete") {
+                // Unreachable: the builder returns the requested status; fail
+                // closed rather than create a key without its write-ahead.
+                return {
+                    status: "error",
+                    error: errorResult(SETUP_ERROR_CODES.SETUP_STATE_INVALID, `could not persist the credential pool in ${options.statePath}; remove the setup state and rerun setup`),
+                };
+            }
+            const writeAheadError = persistState(options, executed, {
+                ...writeAheadBase,
+                pool: [...pool],
+                poolKeyStarted: { index, saName, saEmail, keyPath, keyMarker, keyBaseline: [...keyList.names] },
+            });
+            progress.report({ type: "operation_completed", phase: POOL_EXPANSION_PHASE, operation: SETUP_PROGRESS_OPERATIONS.CHECKPOINT_PERSIST });
+            if (writeAheadError !== null) {
+                return { status: "error", error: writeAheadError };
+            }
+            // This invocation JUST persisted the fresh pool-key write-ahead, so
+            // it is the only one allowed to issue the single key create for
+            // this entry (fresh permission).
+            settled = await settleServiceAccountKey(runner, executed, {
+                keyPath,
+                projectId: context.projectId,
+                saEmail,
+                keyMarker,
+                baseline: keyList.names,
+                createPermission: "fresh",
+                sleeper: keySleeper,
+            });
         }
-        const settled = await settleServiceAccountKey(runner, executed, {
-            keyPath,
-            projectId: context.projectId,
-            saEmail,
-            keyMarker: generateCreationMarker(),
-            baseline: keyList.names,
-            createPermission: "fresh",
-            sleeper: keySleeper,
-        });
         if (settled.status === "error") {
             return settled;
         }
@@ -1509,7 +1739,15 @@ async function expandCredentialPool(runner, executed, progress, api, options, ke
     progress.report({ type: "operation_started", phase: POOL_EXPANSION_PHASE, operation: SETUP_PROGRESS_OPERATIONS.ENV_WRITE });
     let envModified = false;
     try {
-        const poolWrite = writeSetupEnvFile(options.outputPath, options.keyPath, spreadsheetEditUrl(context.spreadsheetId), [options.statePath, setupLockPath(options.statePath), setupStateTempPath(options.statePath)], pool.map((entry) => entry.keyPath));
+        // The pool keys are reserved against aliasing here too: the rewritten
+        // .env must never land on (or be read through) a pool key path.
+        const poolPaths = pool.map((entry) => entry.keyPath);
+        const poolKeyPaths = poolPaths.slice(1);
+        const poolCollision = revalidateSetupPaths(options, poolKeyPaths);
+        if (poolCollision !== null) {
+            return { status: "error", error: poolCollision };
+        }
+        const poolWrite = writeSetupEnvFile(options.outputPath, options.keyPath, spreadsheetEditUrl(context.spreadsheetId), [options.statePath, setupLockPath(options.statePath), setupStateTempPath(options.statePath), ...poolKeyPaths], poolPaths);
         envModified = poolWrite.modified;
     }
     catch (error) {
@@ -1815,8 +2053,16 @@ function uncertainCreateResult(message) {
 function persistState(options, executed, state) {
     // Fail closed if a reserved path alias appeared after the initial
     // preflight: the checkpoint write must never be redirected by a symlink
-    // or hardlink that was not there when the run started.
-    const revalidated = revalidateSetupPaths(options);
+    // or hardlink that was not there when the run started. Planned pool key
+    // paths plus the pool paths carried by the state being saved are
+    // reserved too, so an alias planted mid-run can never redirect a pool
+    // checkpoint write onto a key or the .env.
+    const revalidated = revalidateSetupPaths(options, [
+        ...new Set([
+            ...plannedPoolKeyPaths(options.keyPath, options.saCount ?? 1),
+            ...statePoolPaths(state),
+        ]),
+    ]);
     if (revalidated !== null) {
         return revalidated;
     }