pyric-tools 0.1.0-alpha.7

package/dist/deploy/functions/bundle.js

@@ -0,0 +1,181 @@
+/**
+ * Node-only source bundler. Walks `localDir`, reads `package.json`,
+ * zips eligible files into a `Uint8Array` Cloud Build can consume.
+ *
+ * Imports `node:*` and `fflate` — wired only from the Node adapter
+ * (`deployHandler.ts`), never from `core.ts`.
+ *
+ * Default ignore set keeps the bundle small without a `.gcloudignore`:
+ *   node_modules/, dist/, lib/, build/, out/, coverage/,
+ *   .git/, .DS_Store, *.log, hidden files at any depth.
+ *
+ * Cloud Build's nodejs buildpack handles either pre-compiled JS or a
+ * `"build": "tsc"` script, so we don't run `tsc` here.
+ */
+import { readdirSync, readFileSync, statSync } from 'node:fs';
+import { join, posix, relative, sep } from 'node:path';
+import { zipSync } from 'fflate';
+/**
+ * Directories the bundler skips by default. `lib/` is intentionally
+ * NOT in this list — for Cloud Functions Gen 2 the typical pattern
+ * is to ship pre-compiled JS in `lib/` (matching `package.json`'s
+ * `main`) and skip the buildpack's `npm run build` step. Callers
+ * who prefer to ship TS source and let Cloud Build compile can
+ * keep `lib/` out via a future `.gcloudignore` (not yet honored).
+ */
+const DEFAULT_IGNORE = new Set([
+    'node_modules', 'dist', 'build', 'out', 'coverage', '.git',
+]);
+const DEFAULT_IGNORE_FILES = new Set([
+    '.DS_Store',
+]);
+export function bundleFunctionSource(localDir, options = {}) {
+    const slim = options.slim !== false;
+    // Validate package.json — required for the buildpack.
+    let pkg;
+    try {
+        const raw = readFileSync(join(localDir, 'package.json'), 'utf8');
+        pkg = JSON.parse(raw);
+    }
+    catch (e) {
+        const message = e instanceof Error ? e.message : String(e);
+        throw new Error(`Could not read ${localDir}/package.json: ${message}`);
+    }
+    const collected = [];
+    walk(localDir, localDir, collected, slim);
+    if (collected.length === 0) {
+        throw new Error(`Source directory "${localDir}" contains no files (after applying default ignores)`);
+    }
+    // Slim the bundled package.json before zipping. Original on disk
+    // is untouched; only the in-zip copy is rewritten.
+    if (slim) {
+        const slimPkgBytes = new TextEncoder().encode(JSON.stringify(slimPackageJson(pkg), null, 2));
+        let replaced = false;
+        for (const f of collected) {
+            if (f.path === 'package.json') {
+                f.bytes = slimPkgBytes;
+                replaced = true;
+                break;
+            }
+        }
+        if (!replaced) {
+            // package.json wasn't in the walk (extremely unusual — every
+            // function package has one). Add the slim version so the
+            // buildpack has something to read.
+            collected.push({ path: 'package.json', bytes: slimPkgBytes });
+        }
+    }
+    // Build the fflate Zippable tree from flat path entries.
+    const tree = {};
+    for (const f of collected) {
+        insertIntoTree(tree, f.path.split('/'), f.bytes);
+    }
+    const zip = zipSync(tree);
+    return {
+        zip,
+        files: collected.map((f) => f.path).sort(),
+        runtime: deriveRuntime(pkg.engines?.node),
+    };
+}
+/**
+ * Strip dev-only and build-trigger fields from package.json so the
+ * Cloud Build buildpack runs a minimal `npm install` and skips
+ * compile. Keeps the runtime contract (`name`, `main`, `engines`,
+ * `type`, `dependencies`) verbatim.
+ */
+function slimPackageJson(pkg) {
+    const slim = { ...pkg };
+    delete slim.devDependencies;
+    if (pkg.scripts) {
+        const scripts = { ...pkg.scripts };
+        delete scripts.build;
+        delete scripts['build:watch'];
+        delete scripts.prebuild;
+        delete scripts.postbuild;
+        if (Object.keys(scripts).length > 0)
+            slim.scripts = scripts;
+        else
+            delete slim.scripts;
+    }
+    return slim;
+}
+function walk(root, dir, out, slim) {
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+        if (entry.name.startsWith('.') && entry.name !== '.gcloudignore')
+            continue;
+        if (entry.isSymbolicLink())
+            continue;
+        if (entry.isDirectory()) {
+            if (DEFAULT_IGNORE.has(entry.name))
+                continue;
+            walk(root, join(dir, entry.name), out, slim);
+            continue;
+        }
+        if (DEFAULT_IGNORE_FILES.has(entry.name))
+            continue;
+        if (entry.name.endsWith('.log') || entry.name.endsWith('.tsbuildinfo'))
+            continue;
+        // Lockfiles only matter for `npm ci`, which the buildpack runs
+        // when one is present. With a slimmed package.json the lockfile
+        // is stale by definition (devDeps stripped), so drop it and let
+        // the buildpack fall back to `npm install --omit=dev`.
+        if (slim && (entry.name === 'package-lock.json' || entry.name === 'npm-shrinkwrap.json'))
+            continue;
+        const full = join(dir, entry.name);
+        if (!entry.isFile()) {
+            try {
+                if (!statSync(full).isFile())
+                    continue;
+            }
+            catch {
+                continue;
+            }
+        }
+        const rel = relative(root, full);
+        const posixRel = sep === posix.sep ? rel : rel.split(sep).join(posix.sep);
+        out.push({
+            path: posixRel,
+            bytes: new Uint8Array(readFileSync(full)),
+        });
+    }
+}
+function insertIntoTree(tree, segments, bytes) {
+    // Last segment is the file; everything before it is a directory chain.
+    const file = segments[segments.length - 1];
+    let cursor = tree;
+    for (let i = 0; i < segments.length - 1; i++) {
+        const seg = segments[i];
+        const next = cursor[seg];
+        if (!next || next instanceof Uint8Array || Array.isArray(next)) {
+            // A naming collision (file vs directory at same path) shouldn't
+            // happen with a real filesystem, but guard against it.
+            const child = {};
+            cursor[seg] = child;
+            cursor = child;
+        }
+        else {
+            cursor = next;
+        }
+    }
+    cursor[file] = bytes;
+}
+/**
+ * Map `engines.node` (semver range) to a Cloud Functions runtime
+ * string. We only need the major version; everything else is ignored.
+ * Cloud Functions Gen 2 currently supports nodejs18, nodejs20, nodejs22.
+ * Anything outside that set falls back to nodejs22 (the most current
+ * default). Worst case the deploy fails and the caller learns to set
+ * `engines.node` properly.
+ */
+function deriveRuntime(engines) {
+    if (!engines)
+        return 'nodejs22';
+    const match = engines.match(/(\d+)/);
+    if (!match)
+        return 'nodejs22';
+    const major = parseInt(match[1], 10);
+    if (major === 18 || major === 20 || major === 22)
+        return `nodejs${major}`;
+    return 'nodejs22';
+}
+//# sourceMappingURL=bundle.js.map

package/dist/deploy/functions/bundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../../../src/deploy/functions/bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EAAE,OAAO,EAAiB,MAAM,QAAQ,CAAC;AAuChD;;;;;;;GAOG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM;CAC3D,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,WAAW;CACZ,CAAC,CAAC;AAEH,MAAM,UAAU,oBAAoB,CAClC,QAAgB,EAChB,UAAyB,EAAE;IAE3B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC;IAEpC,sDAAsD;IACtD,IAAI,GAAgB,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;QACjE,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,kBAAkB,OAAO,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,SAAS,GAA0C,EAAE,CAAC;IAC5D,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC1C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,sDAAsD,CAAC,CAAC;IACvG,CAAC;IAED,iEAAiE;IACjE,mDAAmD;IACnD,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7F,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBAC9B,CAAC,CAAC,KAAK,GAAG,YAAY,CAAC;gBACvB,QAAQ,GAAG,IAAI,CAAC;gBAChB,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,6DAA6D;YAC7D,yDAAyD;YACzD,mCAAmC;YACnC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,yDAAyD;IACzD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1B,OAAO;QACL,GAAG;QACH,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE;QAC1C,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC;KAC1C,CAAC;AACJ,CAAC;AAcD;;;;;GAKG;AACH,SAAS,eAAe,CAAC,GAAgB;IACvC,MAAM,IAAI,GAA4B,EAAE,GAAG,GAAG,EAAE,CAAC;IACjD,OAAO,IAAI,CAAC,eAAe,CAAC;IAC5B,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QAChB,MAAM,OAAO,GAA2B,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;QAC3D,OAAO,OAAO,CAAC,KAAK,CAAC;QACrB,OAAO,OAAO,CAAC,aAAa,CAAC,CAAC;QAC9B,OAAO,OAAO,CAAC,QAAQ,CAAC;QACxB,OAAO,OAAO,CAAC,SAAS,CAAC;QACzB,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;;YACvD,OAAO,IAAI,CAAC,OAAO,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,IAAI,CACX,IAAY,EACZ,GAAW,EACX,GAA0C,EAC1C,IAAa;IAEb,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9D,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe;YAAE,SAAS;QAC3E,IAAI,KAAK,CAAC,cAAc,EAAE;YAAE,SAAS;QACrC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC7C,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAC7C,SAAS;QACX,CAAC;QACD,IAAI,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QACnD,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;YAAE,SAAS;QACjF,+DAA+D;QAC/D,gEAAgE;QAChE,gEAAgE;QAChE,uDAAuD;QACvD,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,mBAAmB,IAAI,KAAK,CAAC,IAAI,KAAK,qBAAqB,CAAC;YAAE,SAAS;QAEnG,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACpB,IAAI,CAAC;gBAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE;oBAAE,SAAS;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,SAAS;YAAC,CAAC;QACrE,CAAC;QACD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,GAAG,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1E,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,IAAI,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;SAC1C,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAc,EAAE,QAAkB,EAAE,KAAiB;IAC3E,uEAAuE;IACvE,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3C,IAAI,MAAM,GAAa,IAAI,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,IAAI,IAAI,YAAY,UAAU,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/D,gEAAgE;YAChE,uDAAuD;YACvD,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACpB,MAAM,GAAG,KAAK,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,IAAgB,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;AACvB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,OAA2B;IAChD,IAAI,CAAC,OAAO;QAAE,OAAO,UAAU,CAAC;IAChC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK;QAAE,OAAO,UAAU,CAAC;IAC9B,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,SAAS,KAAK,EAAE,CAAC;IAC1E,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/deploy/functions/core.d.ts

@@ -0,0 +1,18 @@
+import type { DeployFunctionsResult, FunctionDeployConfig } from './spec.js';
+export interface DeployFunctionsCoreInput {
+    projectId: string;
+    /**
+     * Pre-bundled source zip. The Node adapter produces this via
+     * `bundleFunctionSource`; a future browser adapter could supply
+     * a zip from any source.
+     */
+    sourceZip: Uint8Array;
+    /** Functions to deploy in order. */
+    functions: FunctionDeployConfig[];
+    /** Default runtime when a per-function `runtime` isn't set. */
+    defaultRuntime?: string;
+    /** Opaque OAuth 2.0 access token. */
+    accessToken: string;
+}
+export declare function deployFunctions(input: DeployFunctionsCoreInput): Promise<DeployFunctionsResult>;
+//# sourceMappingURL=core.d.ts.map

package/dist/deploy/functions/core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../../../src/deploy/functions/core.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAEV,qBAAqB,EAErB,oBAAoB,EAErB,MAAM,WAAW,CAAC;AAgBnB,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,SAAS,EAAE,UAAU,CAAC;IACtB,oCAAoC;IACpC,SAAS,EAAE,oBAAoB,EAAE,CAAC;IAClC,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,eAAe,CACnC,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,qBAAqB,CAAC,CAmHhC"}

package/dist/deploy/functions/core.js

@@ -0,0 +1,211 @@
+/**
+ * Portable Cloud Functions Gen 2 deploy core. Zero `node:*` imports —
+ * source bundling and token acquisition are pushed to the caller.
+ *
+ * Per function, four-call dance:
+ *
+ *   1. POST /v2/projects/{p}/locations/{r}/functions:generateUploadUrl
+ *   2. PUT  <signedUploadUrl>           (zip bytes)
+ *   3. POST /v2/projects/{p}/locations/{r}/functions?functionId={id}
+ *      (or PATCH if 409)
+ *   4. GET  /v2/{operation}             (poll until done)
+ *
+ * IAM grant for `invoker: 'public'` is deferred to PR 3 — a public
+ * invoker request returns IAM_GRANT_FAILED for now.
+ */
+import { grantPublicInvoker } from './iam.js';
+import { pollOperation } from './operation.js';
+const FUNCTIONS_API = 'https://cloudfunctions.googleapis.com/v2';
+const DEFAULT_REGION = 'us-central1';
+const DEFAULT_RUNTIME = 'nodejs22';
+const DEFAULT_MEMORY = '256Mi';
+const DEFAULT_TIMEOUT = 60;
+const DEFAULT_MIN_INSTANCES = 0;
+const DEFAULT_MAX_INSTANCES = 100;
+export async function deployFunctions(input) {
+    const validation = validateInput(input);
+    if (validation)
+        return { success: false, error: validation };
+    const deployed = [];
+    for (let i = 0; i < input.functions.length; i++) {
+        const fn = input.functions[i];
+        const region = fn.region ?? DEFAULT_REGION;
+        const runtime = fn.runtime ?? input.defaultRuntime ?? DEFAULT_RUNTIME;
+        // 1. Generate upload URL for THIS function. Source is per-call —
+        //    the same zip is uploaded once per function. (Cloud Functions
+        //    binds the storageSource to a build, so even identical zips
+        //    need their own signed URL per function. Tradeoff: O(n)
+        //    uploads, but each ~1MB so it's cheap.)
+        const uploadOut = await safeJsonFetch(`${FUNCTIONS_API}/projects/${input.projectId}/locations/${region}/functions:generateUploadUrl`, { method: 'POST', headers: jsonHeaders(input.accessToken), body: '{}' });
+        if (uploadOut.kind !== 'ok') {
+            return { success: false, error: translate(uploadOut, 'UPLOAD_URL_FAILED', i, `generateUploadUrl for ${fn.id}`) };
+        }
+        const { uploadUrl, storageSource } = uploadOut.value;
+        // 2. PUT zip to the signed URL.
+        const putOut = await safeFetchOnly(uploadUrl, {
+            method: 'PUT',
+            headers: { 'Content-Type': 'application/zip' },
+            body: input.sourceZip,
+        });
+        if (putOut.kind !== 'ok') {
+            return { success: false, error: translate(putOut, 'UPLOAD_FAILED', i, `upload zip for ${fn.id}`) };
+        }
+        // 3. Create or update. Always POST first; on 409 (already exists)
+        //    fall through to PATCH. Avoids a precursor GET on the common
+        //    fresh-deploy path.
+        const body = buildFunctionBody({ projectId: input.projectId, region, runtime, fn, storageSource });
+        const createOut = await safeJsonFetch(`${FUNCTIONS_API}/projects/${input.projectId}/locations/${region}/functions?functionId=${encodeURIComponent(fn.id)}`, { method: 'POST', headers: jsonHeaders(input.accessToken), body: JSON.stringify(body) });
+        let operation;
+        if (createOut.kind === 'ok') {
+            operation = createOut.value;
+        }
+        else if (createOut.kind === 'http_error' && createOut.res.status === 409) {
+            const updateOut = await safeJsonFetch(`${FUNCTIONS_API}/projects/${input.projectId}/locations/${region}/functions/${encodeURIComponent(fn.id)}?updateMask=buildConfig,serviceConfig`, { method: 'PATCH', headers: jsonHeaders(input.accessToken), body: JSON.stringify(body) });
+            if (updateOut.kind !== 'ok') {
+                return { success: false, error: translate(updateOut, 'UPDATE_FAILED', i, `patch ${fn.id}`) };
+            }
+            operation = updateOut.value;
+        }
+        else {
+            return { success: false, error: translate(createOut, 'CREATE_FAILED', i, `create ${fn.id}`) };
+        }
+        // 4. Poll the operation. The serving URL comes back inside
+        //    operation.response.serviceConfig.uri.
+        const pollResult = await pollOperation(operation.name, input.accessToken);
+        if (pollResult.kind === 'timeout') {
+            return { success: false, error: { code: 'OPERATION_TIMED_OUT', message: `Deploy of ${fn.id} did not complete within the polling deadline. The function may still be building — check the Functions console.`, recoverable: true, functionIndex: i } };
+        }
+        if (pollResult.kind === 'failed') {
+            return { success: false, error: { code: 'OPERATION_FAILED', message: `Cloud Functions reported deploy failure for ${fn.id}: ${pollResult.operation.error?.message ?? 'unknown error'}`, recoverable: false, functionIndex: i } };
+        }
+        if (pollResult.kind === 'network_error') {
+            return { success: false, error: { code: 'NETWORK_ERROR', message: `Polling deploy operation for ${fn.id}: ${pollResult.message}`, recoverable: true, functionIndex: i } };
+        }
+        if (pollResult.kind === 'http_error') {
+            return { success: false, error: { code: 'OPERATION_FAILED', message: `Polling deploy operation for ${fn.id}: HTTP ${pollResult.status} ${pollResult.body.slice(0, 300)}`, recoverable: false, functionIndex: i } };
+        }
+        const resource = pollResult.operation.response;
+        const uri = resource?.serviceConfig?.uri;
+        if (!uri) {
+            return { success: false, error: { code: 'OPERATION_FAILED', message: `Deploy of ${fn.id} completed but no serviceConfig.uri returned`, recoverable: false, functionIndex: i } };
+        }
+        // 5. IAM grant for public functions. Cloud Functions Gen 2 = a
+        //    Cloud Run service under the hood, so the binding goes on
+        //    the underlying service. The service name is the function id
+        //    LOWERCASED (per Cloud Functions Gen 2 naming rules) — using
+        //    the camelCase function id verbatim returns 404.
+        let publicInvoker = false;
+        if (fn.invoker === 'public') {
+            const grant = await grantPublicInvoker({
+                projectId: input.projectId,
+                region,
+                serviceId: fn.id.toLowerCase(),
+                accessToken: input.accessToken,
+            });
+            if (grant.kind !== 'ok') {
+                const detail = grant.kind === 'network_error'
+                    ? grant.message
+                    : `HTTP ${grant.status} ${grant.body.slice(0, 300)}`;
+                return {
+                    success: false,
+                    error: {
+                        code: 'IAM_GRANT_FAILED',
+                        message: `Function ${fn.id} deployed at ${uri} but the public-invoker IAM grant failed — service account needs roles/run.admin: ${detail}`,
+                        recoverable: false,
+                        functionIndex: i,
+                    },
+                };
+            }
+            publicInvoker = true;
+        }
+        deployed.push({ id: fn.id, region, uri, publicInvoker });
+    }
+    return { success: true, data: { deployed } };
+}
+function buildFunctionBody(input) {
+    const { projectId, region, runtime, fn, storageSource } = input;
+    return {
+        name: `projects/${projectId}/locations/${region}/functions/${fn.id}`,
+        buildConfig: {
+            runtime,
+            entryPoint: fn.entryPoint,
+            source: { storageSource },
+        },
+        serviceConfig: {
+            availableMemory: fn.memory ?? DEFAULT_MEMORY,
+            timeoutSeconds: fn.timeoutSeconds ?? DEFAULT_TIMEOUT,
+            minInstanceCount: fn.minInstances ?? DEFAULT_MIN_INSTANCES,
+            maxInstanceCount: fn.maxInstances ?? DEFAULT_MAX_INSTANCES,
+        },
+    };
+}
+function jsonHeaders(token) {
+    return {
+        Authorization: `Bearer ${token}`,
+        'Content-Type': 'application/json',
+    };
+}
+async function safeFetchOnly(url, init) {
+    try {
+        const res = await fetch(url, init);
+        return res.ok ? { kind: 'ok' } : { kind: 'http_error', res };
+    }
+    catch (e) {
+        return { kind: 'network_error', message: e instanceof Error ? e.message : String(e) };
+    }
+}
+async function safeJsonFetch(url, init) {
+    try {
+        const res = await fetch(url, init);
+        if (!res.ok)
+            return { kind: 'http_error', res };
+        const value = (await res.json());
+        return { kind: 'ok', value };
+    }
+    catch (e) {
+        return { kind: 'network_error', message: e instanceof Error ? e.message : String(e) };
+    }
+}
+function translate(outcome, defaultCode, functionIndex, context) {
+    if (outcome.kind === 'network_error') {
+        return { code: 'NETWORK_ERROR', message: `network error (${context}): ${outcome.message}`, recoverable: true, functionIndex };
+    }
+    const status = outcome.res.status;
+    if (status === 403) {
+        return {
+            code: 'PERMISSION_DENIED',
+            message: `Cloud Functions denied the request (${context}) — service account needs roles/cloudfunctions.developer + roles/storage.admin on the source bucket`,
+            recoverable: false,
+            functionIndex,
+        };
+    }
+    return { code: defaultCode, message: `HTTP ${status} (${context})`, recoverable: status >= 500, functionIndex };
+}
+function validateInput(input) {
+    if (!input || typeof input !== 'object') {
+        return { code: 'INVALID_INPUT', message: 'input must be an object', recoverable: true };
+    }
+    if (!input.projectId || typeof input.projectId !== 'string') {
+        return { code: 'INVALID_INPUT', message: 'projectId must be a non-empty string', recoverable: true };
+    }
+    if (!input.accessToken || typeof input.accessToken !== 'string') {
+        return { code: 'INVALID_INPUT', message: 'accessToken must be a non-empty string', recoverable: true };
+    }
+    if (!(input.sourceZip instanceof Uint8Array) || input.sourceZip.byteLength === 0) {
+        return { code: 'INVALID_INPUT', message: 'sourceZip must be a non-empty Uint8Array', recoverable: true };
+    }
+    if (!Array.isArray(input.functions) || input.functions.length === 0) {
+        return { code: 'INVALID_INPUT', message: 'functions must be a non-empty array', recoverable: true };
+    }
+    for (let i = 0; i < input.functions.length; i++) {
+        const fn = input.functions[i];
+        if (!fn || typeof fn.id !== 'string' || !fn.id) {
+            return { code: 'INVALID_INPUT', message: `functions[${i}].id must be a non-empty string`, recoverable: true, functionIndex: i };
+        }
+        if (typeof fn.entryPoint !== 'string' || !fn.entryPoint) {
+            return { code: 'INVALID_INPUT', message: `functions[${i}].entryPoint must be a non-empty string`, recoverable: true, functionIndex: i };
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=core.js.map

package/dist/deploy/functions/core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.js","sourceRoot":"","sources":["../../../src/deploy/functions/core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAe/C,MAAM,aAAa,GAAG,0CAA0C,CAAC;AACjE,MAAM,cAAc,GAAG,aAAa,CAAC;AACrC,MAAM,eAAe,GAAG,UAAU,CAAC;AACnC,MAAM,cAAc,GAAG,OAAO,CAAC;AAC/B,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAChC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAkBlC,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAA+B;IAE/B,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,UAAU;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAE7D,MAAM,QAAQ,GAAuB,EAAE,CAAC;IAExC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChD,MAAM,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,IAAI,cAAc,CAAC;QAC3C,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,IAAI,KAAK,CAAC,cAAc,IAAI,eAAe,CAAC;QAEtE,iEAAiE;QACjE,kEAAkE;QAClE,gEAAgE;QAChE,4DAA4D;QAC5D,4CAA4C;QAC5C,MAAM,SAAS,GAAG,MAAM,aAAa,CACnC,GAAG,aAAa,aAAa,KAAK,CAAC,SAAS,cAAc,MAAM,8BAA8B,EAC9F,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CACxE,CAAC;QACF,IAAI,SAAS,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC5B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,SAAS,EAAE,mBAAmB,EAAE,CAAC,EAAE,yBAAyB,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QACnH,CAAC;QACD,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC;QAErD,gCAAgC;QAChC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE;YAC5C,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,cAAc,EAAE,iBAAiB,EAAE;YAC9C,IAAI,EAAE,KAAK,CAAC,SAAqB;SAClC,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACzB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,eAAe,EAAE,CAAC,EAAE,kBAAkB,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QACrG,CAAC;QAED,kEAAkE;QAClE,iEAAiE;QACjE,wBAAwB;QACxB,MAAM,IAAI,GAAG,iBAAiB,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;QACnG,MAAM,SAAS,GAAG,MAAM,aAAa,CACnC,GAAG,aAAa,aAAa,KAAK,CAAC,SAAS,cAAc,MAAM,yBAAyB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EACpH,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CACxF,CAAC;QACF,IAAI,SAAoB,CAAC;QACzB,IAAI,SAAS,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC5B,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC;QAC9B,CAAC;aAAM,IAAI,SAAS,CAAC,IAAI,KAAK,YAAY,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC3E,MAAM,SAAS,GAAG,MAAM,aAAa,CACnC,GAAG,aAAa,aAAa,KAAK,CAAC,SAAS,cAAc,MAAM,cAAc,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,uCAAuC,EAC9I,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CACzF,CAAC;YACF,IAAI,SAAS,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC5B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,SAAS,EAAE,eAAe,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YAC/F,CAAC;YACD,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC;QAC9B,CAAC;aAAM,CAAC;YACN,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,SAAS,EAAE,eAAe,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAChG,CAAC;QAED,2DAA2D;QAC3D,2CAA2C;QAC3C,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QAC1E,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,kHAAkH,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,CAAC;QACxP,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACjC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC,EAAE,KAAK,UAAU,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,IAAI,eAAe,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,CAAC;QACnO,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YACxC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,EAAE,KAAK,UAAU,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5K,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACrC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,EAAE,UAAU,UAAU,CAAC,MAAM,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,CAAC;QACrN,CAAC;QAED,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC;QAC/C,MAAM,GAAG,GAAG,QAAQ,EAAE,aAAa,EAAE,GAAG,CAAC;QACzC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,8CAA8C,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,CAAC;QAClL,CAAC;QAED,+DAA+D;QAC/D,8DAA8D;QAC9D,iEAAiE;QACjE,iEAAiE;QACjE,qDAAqD;QACrD,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,EAAE,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC;gBACrC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM;gBACN,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE;gBAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;aAC/B,CAAC,CAAC;YACH,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBACxB,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,KAAK,eAAe;oBAC3C,CAAC,CAAC,KAAK,CAAC,OAAO;oBACf,CAAC,CAAC,QAAQ,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;gBACvD,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,kBAAkB;wBACxB,OAAO,EAAE,YAAY,EAAE,CAAC,EAAE,gBAAgB,GAAG,qFAAqF,MAAM,EAAE;wBAC1I,WAAW,EAAE,KAAK;wBAClB,aAAa,EAAE,CAAC;qBACjB;iBACF,CAAC;YACJ,CAAC;YACD,aAAa,GAAG,IAAI,CAAC;QACvB,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC;AAC/C,CAAC;AAUD,SAAS,iBAAiB,CAAC,KAAwB;IACjD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;IAChE,OAAO;QACL,IAAI,EAAE,YAAY,SAAS,cAAc,MAAM,cAAc,EAAE,CAAC,EAAE,EAAE;QACpE,WAAW,EAAE;YACX,OAAO;YACP,UAAU,EAAE,EAAE,CAAC,UAAU;YACzB,MAAM,EAAE,EAAE,aAAa,EAAE;SAC1B;QACD,aAAa,EAAE;YACb,eAAe,EAAE,EAAE,CAAC,MAAM,IAAI,cAAc;YAC5C,cAAc,EAAE,EAAE,CAAC,cAAc,IAAI,eAAe;YACpD,gBAAgB,EAAE,EAAE,CAAC,YAAY,IAAI,qBAAqB;YAC1D,gBAAgB,EAAE,EAAE,CAAC,YAAY,IAAI,qBAAqB;SAC3D;KACkC,CAAC;AACxC,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO;QACL,aAAa,EAAE,UAAU,KAAK,EAAE;QAChC,cAAc,EAAE,kBAAkB;KACnC,CAAC;AACJ,CAAC;AAYD,KAAK,UAAU,aAAa,CAAC,GAAW,EAAE,IAAiB;IACzD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC;IAC/D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACxF,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAI,GAAW,EAAE,IAAiB;IAC5D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;QACtC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACxF,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAChB,OAAiG,EACjG,WAA+B,EAC/B,aAAqB,EACrB,OAAe;IAEf,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,kBAAkB,OAAO,MAAM,OAAO,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IAChI,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;IAClC,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO;YACL,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,uCAAuC,OAAO,qGAAqG;YAC5J,WAAW,EAAE,KAAK;YAClB,aAAa;SACd,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,MAAM,KAAK,OAAO,GAAG,EAAE,WAAW,EAAE,MAAM,IAAI,GAAG,EAAE,aAAa,EAAE,CAAC;AAClH,CAAC;AAED,SAAS,aAAa,CAAC,KAA+B;IACpD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,yBAAyB,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC1F,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC5D,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,sCAAsC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACvG,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QAChE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,wCAAwC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACzG,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS,YAAY,UAAU,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;QACjF,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,0CAA0C,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC3G,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,qCAAqC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACtG,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChD,MAAM,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/C,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,aAAa,CAAC,iCAAiC,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;QAClI,CAAC;QACD,IAAI,OAAO,EAAE,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC;YACxD,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,aAAa,CAAC,yCAAyC,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;QAC1I,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/deploy/functions/iam.d.ts

@@ -0,0 +1,17 @@
+export type IamGrantResult = {
+    kind: 'ok';
+} | {
+    kind: 'http_error';
+    status: number;
+    body: string;
+} | {
+    kind: 'network_error';
+    message: string;
+};
+export declare function grantPublicInvoker(input: {
+    projectId: string;
+    region: string;
+    serviceId: string;
+    accessToken: string;
+}): Promise<IamGrantResult>;
+//# sourceMappingURL=iam.d.ts.map

package/dist/deploy/functions/iam.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"iam.d.ts","sourceRoot":"","sources":["../../../src/deploy/functions/iam.ts"],"names":[],"mappings":"AAcA,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,IAAI,CAAA;CAAE,GACd;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/C,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,cAAc,CAAC,CAuB1B"}

package/dist/deploy/functions/iam.js

@@ -0,0 +1,40 @@
+/**
+ * Cloud Run IAM helper. Cloud Functions Gen 2 deploys an underlying
+ * Cloud Run service whose service name matches the function id —
+ * granting public invoke means binding `roles/run.invoker` to
+ * `allUsers` on that service.
+ *
+ * SET semantics over GET-modify-SET on purpose: a fresh function
+ * deploy starts with the default policy, and an SDK-deployed
+ * function isn't expected to have other bindings the caller would
+ * mind being replaced. If that changes, switch to GET-then-PATCH
+ * with the etag.
+ */
+const RUN_API = 'https://run.googleapis.com/v2';
+export async function grantPublicInvoker(input) {
+    const url = `${RUN_API}/projects/${input.projectId}/locations/${input.region}/services/${encodeURIComponent(input.serviceId)}:setIamPolicy`;
+    try {
+        const res = await fetch(url, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${input.accessToken}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+                policy: {
+                    bindings: [
+                        { role: 'roles/run.invoker', members: ['allUsers'] },
+                    ],
+                },
+            }),
+        });
+        if (res.ok)
+            return { kind: 'ok' };
+        const body = await res.text().catch(() => '');
+        return { kind: 'http_error', status: res.status, body };
+    }
+    catch (e) {
+        return { kind: 'network_error', message: e instanceof Error ? e.message : String(e) };
+    }
+}
+//# sourceMappingURL=iam.js.map

package/dist/deploy/functions/iam.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"iam.js","sourceRoot":"","sources":["../../../src/deploy/functions/iam.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,GAAG,+BAA+B,CAAC;AAOhD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAKxC;IACC,MAAM,GAAG,GAAG,GAAG,OAAO,aAAa,KAAK,CAAC,SAAS,cAAc,KAAK,CAAC,MAAM,aAAa,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,eAAe,CAAC;IAC5I,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,CAAC,WAAW,EAAE;gBAC5C,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,MAAM,EAAE;oBACN,QAAQ,EAAE;wBACR,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE;qBACrD;iBACF;aACF,CAAC;SACH,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IAC1D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACxF,CAAC;AACH,CAAC"}

package/dist/deploy/functions/operation.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Polling helper for Cloud Functions long-running operations.
+ *
+ * The deploy POST/PATCH returns immediately with `{ name, done: false }`
+ * — we then GET that operation until `done: true` (success in
+ * `response`, failure in `error`). Backoff is exponential capped at
+ * 10s; total deadline 5 min, which fits the longest cold deploys
+ * we've observed for trivial functions. Bump if real workloads hit
+ * the cap.
+ */
+import type { Operation } from './types.js';
+export type PollResult = {
+    kind: 'ok';
+    operation: Operation;
+} | {
+    kind: 'failed';
+    operation: Operation;
+} | {
+    kind: 'timeout';
+} | {
+    kind: 'http_error';
+    status: number;
+    body: string;
+} | {
+    kind: 'network_error';
+    message: string;
+};
+export interface PollOptions {
+    /** Override the 5-minute deadline. */
+    deadlineMs?: number;
+    /** Override the initial backoff (mostly for tests). */
+    initialBackoffMs?: number;
+    /** Override the cap (mostly for tests). */
+    maxBackoffMs?: number;
+    /** Test seam: replaces the default `setTimeout` sleep. */
+    sleep?: (ms: number) => Promise<void>;
+}
+export declare function pollOperation(operationName: string, accessToken: string, options?: PollOptions): Promise<PollResult>;
+//# sourceMappingURL=operation.d.ts.map

package/dist/deploy/functions/operation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation.d.ts","sourceRoot":"","sources":["../../../src/deploy/functions/operation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAQ5C,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/C,MAAM,WAAW,WAAW;IAC1B,sCAAsC;IACtC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,2CAA2C;IAC3C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0DAA0D;IAC1D,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,wBAAsB,aAAa,CACjC,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,UAAU,CAAC,CA2BrB"}

package/dist/deploy/functions/operation.js

@@ -0,0 +1,37 @@
+const FUNCTIONS_API = 'https://cloudfunctions.googleapis.com/v2';
+const INITIAL_BACKOFF_MS = 2000;
+const MAX_BACKOFF_MS = 10_000;
+const DEFAULT_DEADLINE_MS = 5 * 60 * 1000;
+const BACKOFF_MULTIPLIER = 1.5;
+export async function pollOperation(operationName, accessToken, options = {}) {
+    const deadline = Date.now() + (options.deadlineMs ?? DEFAULT_DEADLINE_MS);
+    const sleep = options.sleep ?? defaultSleep;
+    let backoff = options.initialBackoffMs ?? INITIAL_BACKOFF_MS;
+    const cap = options.maxBackoffMs ?? MAX_BACKOFF_MS;
+    while (Date.now() < deadline) {
+        let res;
+        try {
+            res = await fetch(`${FUNCTIONS_API}/${operationName}`, {
+                headers: { Authorization: `Bearer ${accessToken}` },
+            });
+        }
+        catch (e) {
+            return { kind: 'network_error', message: e instanceof Error ? e.message : String(e) };
+        }
+        if (!res.ok) {
+            const body = await res.text().catch(() => '');
+            return { kind: 'http_error', status: res.status, body };
+        }
+        const op = (await res.json());
+        if (op.done) {
+            return op.error ? { kind: 'failed', operation: op } : { kind: 'ok', operation: op };
+        }
+        await sleep(backoff);
+        backoff = Math.min(backoff * BACKOFF_MULTIPLIER, cap);
+    }
+    return { kind: 'timeout' };
+}
+function defaultSleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+//# sourceMappingURL=operation.js.map

package/dist/deploy/functions/operation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation.js","sourceRoot":"","sources":["../../../src/deploy/functions/operation.ts"],"names":[],"mappings":"AAYA,MAAM,aAAa,GAAG,0CAA0C,CAAC;AACjE,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAChC,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1C,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAoB/B,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,aAAqB,EACrB,WAAmB,EACnB,UAAuB,EAAE;IAEzB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,YAAY,CAAC;IAC5C,IAAI,OAAO,GAAG,OAAO,CAAC,gBAAgB,IAAI,kBAAkB,CAAC;IAC7D,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,IAAI,cAAc,CAAC;IAEnD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,aAAa,IAAI,aAAa,EAAE,EAAE;gBACrD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;aACpD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;QAC1D,CAAC;QACD,MAAM,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAc,CAAC;QAC3C,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YACZ,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QACtF,CAAC;QACD,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;QACrB,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,GAAG,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,YAAY,CAAC,EAAU;IAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}