pyric-tools 0.1.0-alpha.7

package/dist/deploy/scope.d.ts

@@ -0,0 +1,81 @@
+/**
+ * `ProjectScope`, `Outcome`, `AdminApiError` — the foundation
+ * primitives every control-plane operation in `pyric-tools/deploy` (and
+ * the factories built on top) shares.
+ *
+ * See the design rationale,
+ * conventions F1–F8.
+ *
+ * - F2: Identity is a value; lifecycle is a resolver.
+ * - F3: `ProjectScope = { projectId, resolveToken }`.
+ * - F4: Resolvers fire per-dispatch. Hosts memoize via `memoizeTtl`.
+ */
+/**
+ * Project-level credentials threaded through every control-plane
+ * call. One scope object instead of `(token, projectId, …)`
+ * signatures everywhere.
+ *
+ * `projectId` is stable identity — doesn't change for the life of
+ * an agent session. `resolveToken` is the host's promise to deliver
+ * a fresh-enough OAuth access token (with the `firebase` scope) on
+ * demand. Per F4, callers invoke `resolveToken()` inside each
+ * primitive call, not at construction time; hosts that care about
+ * cost wrap the resolver in `memoizeTtl` (which `fromServiceAccount`
+ * does internally).
+ *
+ * @example
+ * ```ts
+ * // Browser host — wraps Firebase Auth.
+ * const scope: ProjectScope = {
+ *   projectId,
+ *   resolveToken: () => firebaseAuth.currentUser!.getIdToken(),
+ * };
+ *
+ * // Node host — wraps service-account JWT exchange (already
+ * // memoized internally).
+ * const scope = await fromServiceAccount(saJsonPath);
+ * ```
+ */
+export interface ProjectScope {
+    readonly projectId: string;
+    resolveToken(): Promise<string>;
+}
+/**
+ * Outcome of an orchestrator. `ok: true` carries result data;
+ * `ok: false` carries a coarse code (with two universal members:
+ * `permission-denied` and `unknown`) plus an optional `partial`
+ * for batch ops that succeeded on some entries and failed on
+ * others.
+ *
+ * Primitives throw `AdminApiError` on non-2xx; orchestrators catch
+ * and bucket into `Outcome.code`. See F4 + `withResolvedScope` for
+ * the standard wrapping.
+ */
+export type Outcome<TData, TErrCode extends string = never> = {
+    ok: true;
+    data: TData;
+} | {
+    ok: false;
+    code: TErrCode | 'permission-denied' | 'unknown';
+    message: string;
+    partial?: unknown;
+};
+/**
+ * Thrown by primitive (non-orchestrator) functions for non-2xx
+ * responses from Firebase REST APIs. Orchestrators bucket these
+ * into `Outcome.code`; consumers reaching for the primitive shape
+ * can catch directly.
+ *
+ * `status` carries the HTTP status so callers can branch on
+ * permission (`401` / `403`), not-found (`404`), conflict (`409`),
+ * etc.; `body` carries the (capped) response payload for
+ * diagnostics. Bodies larger than 8 KiB are truncated with a
+ * `[truncated, N bytes]` suffix so callers can still tell when the
+ * full payload was bigger than what they're seeing.
+ */
+export declare class AdminApiError extends Error {
+    readonly status: number;
+    readonly body: string;
+    constructor(status: number, body: string, message: string);
+}
+//# sourceMappingURL=scope.d.ts.map

package/dist/deploy/scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../src/deploy/scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACjC;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,OAAO,CAAC,KAAK,EAAE,QAAQ,SAAS,MAAM,GAAG,KAAK,IACtD;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,KAAK,CAAA;CAAE,GACzB;IACE,EAAE,EAAE,KAAK,CAAC;IACV,IAAI,EAAE,QAAQ,GAAG,mBAAmB,GAAG,SAAS,CAAC;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAQN;;;;;;;;;;;;GAYG;AACH,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAS1D"}

package/dist/deploy/scope.js

@@ -0,0 +1,44 @@
+/**
+ * `ProjectScope`, `Outcome`, `AdminApiError` — the foundation
+ * primitives every control-plane operation in `pyric-tools/deploy` (and
+ * the factories built on top) shares.
+ *
+ * See the design rationale,
+ * conventions F1–F8.
+ *
+ * - F2: Identity is a value; lifecycle is a resolver.
+ * - F3: `ProjectScope = { projectId, resolveToken }`.
+ * - F4: Resolvers fire per-dispatch. Hosts memoize via `memoizeTtl`.
+ */
+/** Maximum size (bytes) we keep of an upstream error body. Large
+ *  responses (Cloudflare HTML error pages, multi-MB stack traces
+ *  from buggy proxies) would otherwise balloon error chains and
+ *  structured event logs. */
+const ADMIN_API_ERROR_BODY_CAP = 8 * 1024;
+/**
+ * Thrown by primitive (non-orchestrator) functions for non-2xx
+ * responses from Firebase REST APIs. Orchestrators bucket these
+ * into `Outcome.code`; consumers reaching for the primitive shape
+ * can catch directly.
+ *
+ * `status` carries the HTTP status so callers can branch on
+ * permission (`401` / `403`), not-found (`404`), conflict (`409`),
+ * etc.; `body` carries the (capped) response payload for
+ * diagnostics. Bodies larger than 8 KiB are truncated with a
+ * `[truncated, N bytes]` suffix so callers can still tell when the
+ * full payload was bigger than what they're seeing.
+ */
+export class AdminApiError extends Error {
+    status;
+    body;
+    constructor(status, body, message) {
+        super(message);
+        this.name = 'AdminApiError';
+        this.status = status;
+        this.body =
+            body.length > ADMIN_API_ERROR_BODY_CAP
+                ? `${body.slice(0, ADMIN_API_ERROR_BODY_CAP)}…[truncated, ${body.length - ADMIN_API_ERROR_BODY_CAP} bytes]`
+                : body;
+    }
+}
+//# sourceMappingURL=scope.js.map

package/dist/deploy/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../src/deploy/scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAqDH;;;6BAG6B;AAC7B,MAAM,wBAAwB,GAAG,CAAC,GAAG,IAAI,CAAC;AAE1C;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,aAAc,SAAQ,KAAK;IAC7B,MAAM,CAAS;IACf,IAAI,CAAS;IACtB,YAAY,MAAc,EAAE,IAAY,EAAE,OAAe;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;QAC5B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI;YACP,IAAI,CAAC,MAAM,GAAG,wBAAwB;gBACpC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,wBAAwB,CAAC,gBAAgB,IAAI,CAAC,MAAM,GAAG,wBAAwB,SAAS;gBAC3G,CAAC,CAAC,IAAI,CAAC;IACb,CAAC;CACF"}

package/dist/deploy/tools.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Tool factories for `pyric-tools/deploy` per F1.
+ *
+ * Each factory wraps the namespaced primitives (firestore, hosting,
+ * functions, storage) as `ToolHandler[]` consumable by
+ * `@inbrowser/agent`'s registry. Every handler takes the scope from
+ * factory closure (F2) and `signal` from ctx (F8).
+ *
+ * Together these factories close the Deployment Agent's critical
+ * path (per the proposal's "Deployment Agent critical path"
+ * section: Slices 1, 2, 3, 4 + 9).
+ *
+ * Pre-mortem M8 note: every handler checks `ctx.signal.aborted`
+ * before starting work — that's the best the factory layer can do
+ * without plumbing AbortSignal through every namespace primitive's
+ * fetch call. Wave B (`firebase-admin` → REST rewrite) is the
+ * natural place to thread signals end-to-end; until then, the
+ * pre-call abort check at least prevents the deploy from STARTING
+ * if the agent already cancelled.
+ */
+import type { ToolHandler } from '@inbrowser/agent';
+import type { ProjectScope } from './scope.js';
+import type { RtdbIR } from 'pyric/rules/rtdb';
+import type { DeployIndexesOutcome, GetIndexStatusOutcome, IndexOperation } from './firestore/indexes.js';
+import type { EnsureRuleOutcome } from './firestore/rules.js';
+import type { ProvisionDatabaseOutcome } from './firestore/databases.js';
+import type { DeployHostingResult } from './hosting/spec.js';
+import type { EnsureSiteResult } from './hosting/sites.js';
+import type { DeployFunctionsResult } from './functions/spec.js';
+export interface DeployToolData {
+    firestore_get_rules: {
+        source: string | null;
+    };
+    firestore_deploy_rules: undefined;
+    firestore_ensure_rules: EnsureRuleOutcome;
+    firestore_provision_database: ProvisionDatabaseOutcome;
+    firestore_deploy_indexes: DeployIndexesOutcome;
+    firestore_create_index: IndexOperation;
+    firestore_get_index_status: GetIndexStatusOutcome;
+    hosting_deploy: DeployHostingResult;
+    hosting_ensure_site: EnsureSiteResult;
+    functions_deploy: DeployFunctionsResult;
+    rtdb_get_rules: {
+        ir: RtdbIR;
+    };
+    rtdb_deploy_rules: undefined;
+}
+export interface ProjectScopedDeps {
+    scope: ProjectScope;
+}
+export declare function createRtdbDeployTools(deps: ProjectScopedDeps): ToolHandler[];
+export declare function createFirestoreDeployTools(deps: ProjectScopedDeps): ToolHandler[];
+export declare function createHostingDeployTools(deps: ProjectScopedDeps): ToolHandler[];
+export declare function createFunctionsDeployTools(deps: ProjectScopedDeps): ToolHandler[];
+//# sourceMappingURL=tools.d.ts.map

package/dist/deploy/tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../src/deploy/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAGV,oBAAoB,EACpB,qBAAqB,EACrB,cAAc,EACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,KAAK,EAAqB,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAwB,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAoBvF,MAAM,WAAW,cAAc;IAC7B,mBAAmB,EAAE;QAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC/C,sBAAsB,EAAE,SAAS,CAAC;IAClC,sBAAsB,EAAE,iBAAiB,CAAC;IAC1C,4BAA4B,EAAE,wBAAwB,CAAC;IACvD,wBAAwB,EAAE,oBAAoB,CAAC;IAC/C,sBAAsB,EAAE,cAAc,CAAC;IACvC,0BAA0B,EAAE,qBAAqB,CAAC;IAClD,cAAc,EAAE,mBAAmB,CAAC;IACpC,mBAAmB,EAAE,gBAAgB,CAAC;IACtC,gBAAgB,EAAE,qBAAqB,CAAC;IACxC,cAAc,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/B,iBAAiB,EAAE,SAAS,CAAC;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,YAAY,CAAC;CACrB;AAID,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,iBAAiB,GAAG,WAAW,EAAE,CA4C5E;AAID,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,iBAAiB,GAAG,WAAW,EAAE,CA4IjF;AAID,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,iBAAiB,GAAG,WAAW,EAAE,CA6F/E;AAID,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,iBAAiB,GAAG,WAAW,EAAE,CA8BjF"}

package/dist/deploy/tools.js

@@ -0,0 +1,329 @@
+/**
+ * Tool factories for `pyric-tools/deploy` per F1.
+ *
+ * Each factory wraps the namespaced primitives (firestore, hosting,
+ * functions, storage) as `ToolHandler[]` consumable by
+ * `@inbrowser/agent`'s registry. Every handler takes the scope from
+ * factory closure (F2) and `signal` from ctx (F8).
+ *
+ * Together these factories close the Deployment Agent's critical
+ * path (per the proposal's "Deployment Agent critical path"
+ * section: Slices 1, 2, 3, 4 + 9).
+ *
+ * Pre-mortem M8 note: every handler checks `ctx.signal.aborted`
+ * before starting work — that's the best the factory layer can do
+ * without plumbing AbortSignal through every namespace primitive's
+ * fetch call. Wave B (`firebase-admin` → REST rewrite) is the
+ * natural place to thread signals end-to-end; until then, the
+ * pre-call abort check at least prevents the deploy from STARTING
+ * if the agent already cancelled.
+ */
+import { firestore, hosting, functions, rtdb } from './namespaces.js';
+// ─── Realtime Database deploy tools ─────────────────────────────────
+export function createRtdbDeployTools(deps) {
+    const { scope } = deps;
+    return [
+        {
+            name: 'rtdb_get_rules',
+            description: 'Fetch the deployed Realtime Database rules for this project or an explicit database URL.',
+            parameters: {
+                type: 'object',
+                properties: {
+                    databaseUrl: { type: 'string' },
+                },
+            },
+            async execute(args) {
+                const { databaseUrl } = args;
+                try {
+                    const ir = await rtdb.rules.fetch(scope, { databaseUrl });
+                    return { ok: true, summary: `Fetched RTDB rules from ${ir.databaseUrl}`, data: { ir } };
+                }
+                catch (e) {
+                    return { ok: false, summary: e instanceof Error ? e.message : String(e) };
+                }
+            },
+        },
+        {
+            name: 'rtdb_deploy_rules',
+            description: 'Deploy Realtime Database security rules JSON. Pass databaseUrl or let the tool discover the single default RTDB instance.',
+            parameters: {
+                type: 'object',
+                properties: {
+                    rulesJson: { type: 'object' },
+                    databaseUrl: { type: 'string' },
+                },
+                required: ['rulesJson'],
+            },
+            async execute(args) {
+                const { rulesJson, databaseUrl } = args;
+                try {
+                    await rtdb.rules.deploy(scope, { rulesJson, databaseUrl });
+                    return { ok: true, summary: 'Deployed Realtime Database rules' };
+                }
+                catch (e) {
+                    return { ok: false, summary: e instanceof Error ? e.message : String(e) };
+                }
+            },
+        },
+    ];
+}
+// ─── Firestore deploy tools ──────────────────────────────────────────
+export function createFirestoreDeployTools(deps) {
+    const { scope } = deps;
+    return [
+        {
+            name: 'firestore_get_rules',
+            description: 'Fetch the deployed Firestore rules source for this project. Returns null when no release exists yet.',
+            parameters: { type: 'object', properties: {} },
+            async execute() {
+                try {
+                    const source = await firestore.rules.fetch(scope);
+                    return { ok: true, summary: source === null ? 'No deployed ruleset' : 'Fetched ruleset', data: { source } };
+                }
+                catch (e) {
+                    return { ok: false, summary: e instanceof Error ? e.message : String(e) };
+                }
+            },
+        },
+        {
+            name: 'firestore_deploy_rules',
+            description: 'Deploy a Firestore rules source. Creates a new ruleset and binds the cloud.firestore release to it.',
+            parameters: {
+                type: 'object',
+                properties: { source: { type: 'string' } },
+                required: ['source'],
+            },
+            async execute(args) {
+                const { source } = args;
+                try {
+                    await firestore.rules.deploy(scope, source);
+                    return { ok: true, summary: 'Deployed Firestore rules' };
+                }
+                catch (e) {
+                    return { ok: false, summary: e instanceof Error ? e.message : String(e) };
+                }
+            },
+        },
+        {
+            name: 'firestore_ensure_rules',
+            description: 'Idempotently ensure a rule snippet is deployed. Merges into existing rules or writes fresh.',
+            parameters: {
+                type: 'object',
+                properties: {
+                    marker: { type: 'string' },
+                    snippet: { type: 'string' },
+                    freshTemplate: { type: 'string' },
+                },
+                required: ['marker', 'snippet', 'freshTemplate'],
+            },
+            async execute(args) {
+                const config = args;
+                const result = await firestore.rules.ensure(scope, config);
+                return {
+                    ok: result.ok,
+                    summary: result.ok ? `Rule ensure: ${result.status}` : `Rule ensure failed: ${result.code}`,
+                    data: result,
+                };
+            },
+        },
+        {
+            name: 'firestore_provision_database',
+            description: 'Idempotently provision the (default) Firestore database. Skips if it already exists.',
+            parameters: {
+                type: 'object',
+                properties: {
+                    databaseId: { type: 'string' },
+                    locationId: { type: 'string' },
+                    type: { type: 'string', enum: ['FIRESTORE_NATIVE', 'DATASTORE_MODE'] },
+                },
+            },
+            async execute(args) {
+                const options = args;
+                const result = await firestore.databases.provision(scope, options);
+                return {
+                    ok: result.ok,
+                    summary: result.ok ? `Database: ${result.status}` : `Provision failed: ${result.code}`,
+                    data: result,
+                };
+            },
+        },
+        {
+            name: 'firestore_deploy_indexes',
+            description: 'Batch-deploy a firestore.indexes.json config. Returns per-index status (started / already-exists / failed).',
+            parameters: {
+                type: 'object',
+                properties: {
+                    config: { type: 'object' },
+                    databaseId: { type: 'string' },
+                },
+                required: ['config'],
+            },
+            async execute(args) {
+                const { config, databaseId } = args;
+                const result = await firestore.indexes.deployAll(scope, config, databaseId ? { databaseId } : undefined);
+                return {
+                    ok: result.ok,
+                    summary: result.ok
+                        ? `Indexes: ${result.operationsStarted.length} started, ${result.alreadyExists} already exist`
+                        : `Deploy failed: ${result.code}`,
+                    data: result,
+                };
+            },
+        },
+        {
+            name: 'firestore_create_index',
+            description: 'Create a single composite index. Returns the long-running-operation handle.',
+            parameters: {
+                type: 'object',
+                properties: {
+                    entry: { type: 'object' },
+                    databaseId: { type: 'string' },
+                },
+                required: ['entry'],
+            },
+            async execute(args) {
+                const { entry, databaseId } = args;
+                try {
+                    const op = await firestore.indexes.create(scope, entry, databaseId ? { databaseId } : undefined);
+                    return { ok: true, summary: `Index create started: ${op.name}`, data: op };
+                }
+                catch (e) {
+                    return { ok: false, summary: e instanceof Error ? e.message : String(e) };
+                }
+            },
+        },
+        {
+            name: 'firestore_get_index_status',
+            description: 'Poll a long-running index build operation. Returns CREATING / READY / NEEDS_REPAIR / NOT_FOUND.',
+            parameters: {
+                type: 'object',
+                properties: { operationName: { type: 'string' } },
+                required: ['operationName'],
+            },
+            async execute(args) {
+                const { operationName } = args;
+                const result = await firestore.indexes.getStatus(scope, operationName);
+                return {
+                    ok: result.ok,
+                    summary: result.ok ? `Index status: ${result.state}` : `Status fetch failed: ${result.code}`,
+                    data: result,
+                };
+            },
+        },
+    ];
+}
+// ─── Hosting deploy tools ────────────────────────────────────────────
+export function createHostingDeployTools(deps) {
+    const { scope } = deps;
+    return [
+        {
+            name: 'hosting_deploy',
+            description: 'Deploy files to a Firebase Hosting site. Supply EITHER `localDir` (Node walks the directory from disk) OR `files` (pre-walked, suitable for browser hosts). Server-side content-hash dedup uploads only changed files.',
+            parameters: {
+                type: 'object',
+                properties: {
+                    siteId: { type: 'string' },
+                    localDir: { type: 'string', description: 'Node-only.' },
+                    files: {
+                        type: 'array',
+                        description: 'Pre-walked file list — for browser hosts (pre-mortem M7).',
+                    },
+                    ignore: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        description: "firebase.json `ignore` globs applied while walking localDir. Omit for the firebase-tools defaults ('firebase.json', '**/.*', '**/node_modules/**'). Not applied to pre-walked `files`.",
+                    },
+                    config: {
+                        type: 'object',
+                        description: 'firebase.json hosting block (rewrites / redirects / headers / cleanUrls / trailingSlash / appAssociation / i18n). Translated to the Hosting REST ServingConfig; invalid entries fail before anything uploads; non-serving keys come back as configWarnings.',
+                    },
+                    channelId: {
+                        type: 'string',
+                        description: "Preview-channel id. Omit (or 'live') for a live release.",
+                    },
+                    channelTtl: {
+                        type: 'string',
+                        description: "Channel TTL as a protobuf Duration (e.g. '604800s') — applies on channel creation only.",
+                    },
+                },
+                required: ['siteId'],
+            },
+            async execute(args) {
+                const a = args;
+                const result = await hosting.deployFiles(scope, {
+                    siteId: a.siteId,
+                    ...(a.localDir ? { localDir: a.localDir } : {}),
+                    ...(a.files ? { files: a.files } : {}),
+                    ...(a.ignore ? { ignore: a.ignore } : {}),
+                    ...(a.config ? { config: a.config } : {}),
+                    ...(a.channelId ? { channelId: a.channelId } : {}),
+                    ...(a.channelTtl ? { channelTtl: a.channelTtl } : {}),
+                });
+                return {
+                    ok: result.success,
+                    summary: result.success
+                        ? result.data.channelUrl
+                            ? `Hosting deploy ok — ${result.data.uploadedCount}/${result.data.fileCount} files uploaded; preview at ${result.data.channelUrl}${result.data.channelExpireTime ? ` (expires ${result.data.channelExpireTime})` : ''}`
+                            : `Hosting deploy ok — ${result.data.uploadedCount}/${result.data.fileCount} files uploaded; live at ${result.data.hostingUrl}`
+                        : `Hosting deploy failed: ${result.error.code}`,
+                    data: result,
+                };
+            },
+        },
+        {
+            name: 'hosting_ensure_site',
+            description: 'Create-or-get a Hosting site. Treats 409 (already exists) as success.',
+            parameters: {
+                type: 'object',
+                properties: {
+                    siteId: { type: 'string' },
+                    appId: { type: 'string' },
+                },
+                required: ['siteId'],
+            },
+            async execute(args) {
+                const { siteId, appId } = args;
+                const result = await hosting.sites.ensure(scope, { siteId, ...(appId ? { appId } : {}) });
+                return {
+                    ok: result.kind === 'created' || result.kind === 'existed',
+                    summary: result.kind === 'created'
+                        ? `Site created: ${siteId}`
+                        : result.kind === 'existed'
+                            ? `Site already existed: ${siteId}`
+                            : `Ensure failed: ${result.kind}`,
+                    data: result,
+                };
+            },
+        },
+    ];
+}
+// ─── Functions deploy tools ──────────────────────────────────────────
+export function createFunctionsDeployTools(deps) {
+    const { scope } = deps;
+    return [
+        {
+            name: 'functions_deploy',
+            description: 'Bundle + deploy Cloud Functions Gen 2 from a local directory. Node-only (uses bundler).',
+            parameters: {
+                type: 'object',
+                properties: {
+                    localDir: { type: 'string' },
+                    functions: { type: 'array' },
+                },
+                required: ['localDir', 'functions'],
+            },
+            async execute(args) {
+                const { localDir, functions: fns } = args;
+                const result = await functions.deployLocal(scope, { localDir, functions: fns });
+                return {
+                    ok: result.success,
+                    summary: result.success
+                        ? `Functions deployed: ${result.data.deployed.length}`
+                        : `Functions deploy failed: ${result.error.code}`,
+                    data: result,
+                };
+            },
+        },
+    ];
+}
+//# sourceMappingURL=tools.js.map

package/dist/deploy/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../src/deploy/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAqDtE,uEAAuE;AAEvE,MAAM,UAAU,qBAAqB,CAAC,IAAuB;IAC3D,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IACvB,OAAO;QACL;YACE,IAAI,EAAE,gBAAgB;YACtB,WAAW,EAAE,0FAA0F;YACvG,UAAU,EAAE;gBACV,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;iBAChC;aACF;YACD,KAAK,CAAC,OAAO,CAAC,IAAI;gBAChB,MAAM,EAAE,WAAW,EAAE,GAAG,IAAgC,CAAC;gBACzD,IAAI,CAAC;oBACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;oBAC1D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;gBAC1F,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5E,CAAC;YACH,CAAC;SACF;QACD;YACE,IAAI,EAAE,mBAAmB;YACzB,WAAW,EAAE,2HAA2H;YACxI,UAAU,EAAE;gBACV,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC7B,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;iBAChC;gBACD,QAAQ,EAAE,CAAC,WAAW,CAAC;aACxB;YACD,KAAK,CAAC,OAAO,CAAC,IAAI;gBAChB,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,IAAoD,CAAC;gBACxF,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;oBAC3D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC;gBACnE,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5E,CAAC;YACH,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED,wEAAwE;AAExE,MAAM,UAAU,0BAA0B,CAAC,IAAuB;IAChE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IACvB,OAAO;QACL;YACE,IAAI,EAAE,qBAAqB;YAC3B,WAAW,EAAE,sGAAsG;YACnH,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;YAC9C,KAAK,CAAC,OAAO;gBACX,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBAClD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,iBAAiB,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;gBAC9G,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5E,CAAC;YACH,CAAC;SACF;QACD;YACE,IAAI,EAAE,wBAAwB;YAC9B,WAAW,EAAE,qGAAqG;YAClH,UAAU,EAAE;gBACV,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;gBAC1C,QAAQ,EAAE,CAAC,QAAQ,CAAC;aACrB;YACD,KAAK,CAAC,OAAO,CAAC,IAAI;gBAChB,MAAM,EAAE,MAAM,EAAE,GAAG,IAA0B,CAAC;gBAC9C,IAAI,CAAC;oBACH,MAAM,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;oBAC5C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;gBAC3D,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5E,CAAC;YACH,CAAC;SACF;QACD;YACE,IAAI,EAAE,wBAAwB;YAC9B,WAAW,EAAE,6FAA6F;YAC1G,UAAU,EAAE;gBACV,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC1B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC3B,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;iBAClC;gBACD,QAAQ,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,eAAe,CAAC;aACjD;YACD,KAAK,CAAC,OAAO,CAAC,IAAI;gBAChB,MAAM,MAAM,GAAG,IAAkE,CAAC;gBAClF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gBAC3D,OAAO;oBACL,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,uBAAuB,MAAM,CAAC,IAAI,EAAE;oBAC3F,IAAI,EAAE,MAAM;iBACb,CAAC;YACJ,CAAC;SACF;QACD;YACE,IAAI,EAAE,8BAA8B;YACpC,WAAW,EAAE,sFAAsF;YACnG,UAAU,EAAE;gBACV,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC9B,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC9B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,EAAE;iBACvE;aACF;YACD,KAAK,CAAC,OAAO,CAAC,IAAI;gBAChB,MAAM,OAAO,GAAG,IAAkG,CAAC;gBACnH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBACnE,OAAO;oBACL,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,qBAAqB,MAAM,CAAC,IAAI,EAAE;oBACtF,IAAI,EAAE,MAAM;iBACb,CAAC;YACJ,CAAC;SACF;QACD;YACE,IAAI,EAAE,0BAA0B;YAChC,WAAW,EAAE,6GAA6G;YAC1H,UAAU,EAAE;gBACV,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC1B,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;iBAC/B;gBACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;aACrB;YACD,KAAK,CAAC,OAAO,CAAC,IAAI;gBAChB,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,IAAsD,CAAC;gBACtF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBACzG,OAAO;oBACL,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,OAAO,EAAE,MAAM,CAAC,EAAE;wBAChB,CAAC,CAAC,YAAY,MAAM,CAAC,iBAAiB,CAAC,MAAM,aAAa,MAAM,CAAC,aAAa,gBAAgB;wBAC9F,CAAC,CAAC,kBAAkB,MAAM,CAAC,IAAI,EAAE;oBACnC,IAAI,EAAE,MAAM;iBACb,CAAC;YACJ,CAAC;SACF;QACD;YACE,IAAI,EAAE,wBAAwB;YAC9B,WAAW,EAAE,6EAA6E;YAC1F,UAAU,EAAE;gBACV,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACzB,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;iBAC/B;gBACD,QAAQ,EAAE,CAAC,OAAO,CAAC;aACpB;YACD,KAAK,CAAC,OAAO,CAAC,IAAI;gBAChB,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,IAA0D,CAAC;gBACzF,IAAI,CAAC;oBACH,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;oBACjG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;gBAC7E,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5E,CAAC;YACH,CAAC;SACF;QACD;YACE,IAAI,EAAE,4BAA4B;YAClC,WAAW,EAAE,iGAAiG;YAC9G,UAAU,EAAE;gBACV,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;gBACjD,QAAQ,EAAE,CAAC,eAAe,CAAC;aAC5B;YACD,KAAK,CAAC,OAAO,CAAC,IAAI;gBAChB,MAAM,EAAE,aAAa,EAAE,GAAG,IAAiC,CAAC;gBAC5D,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;gBACvE,OAAO;oBACL,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,wBAAwB,MAAM,CAAC,IAAI,EAAE;oBAC5F,IAAI,EAAE,MAAM;iBACb,CAAC;YACJ,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED,wEAAwE;AAExE,MAAM,UAAU,wBAAwB,CAAC,IAAuB;IAC9D,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IACvB,OAAO;QACL;YACE,IAAI,EAAE,gBAAgB;YACtB,WAAW,EAAE,wNAAwN;YACrO,UAAU,EAAE;gBACV,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC1B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE;oBACvD,KAAK,EAAE;wBACL,IAAI,EAAE,OAAO;wBACb,WAAW,EAAE,2DAA2D;qBACzE;oBACD,MAAM,EAAE;wBACN,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,WAAW,EACT,wLAAwL;qBAC3L;oBACD,MAAM,EAAE;wBACN,IAAI,EAAE,QAAQ;wBACd,WAAW,EACT,6PAA6P;qBAChQ;oBACD,SAAS,EAAE;wBACT,IAAI,EAAE,QAAQ;wBACd,WAAW,EAAE,0DAA0D;qBACxE;oBACD,UAAU,EAAE;wBACV,IAAI,EAAE,QAAQ;wBACd,WAAW,EAAE,yFAAyF;qBACvG;iBACF;gBACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;aACrB;YACD,KAAK,CAAC,OAAO,CAAC,IAAI;gBAChB,MAAM,CAAC,GAAG,IAQT,CAAC;gBACF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE;oBAC9C,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/C,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClD,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACtD,CAAC,CAAC;gBACH,OAAO;oBACL,EAAE,EAAE,MAAM,CAAC,OAAO;oBAClB,OAAO,EAAE,MAAM,CAAC,OAAO;wBACrB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU;4BACtB,CAAC,CAAC,uBAAuB,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,+BAA+B,MAAM,CAAC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,IAAI,CAAC,iBAAiB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;4BACvN,CAAC,CAAC,uBAAuB,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,4BAA4B,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE;wBACjI,CAAC,CAAC,0BAA0B,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;oBACjD,IAAI,EAAE,MAAM;iBACb,CAAC;YACJ,CAAC;SACF;QACD;YACE,IAAI,EAAE,qBAAqB;YAC3B,WAAW,EAAE,uEAAuE;YACpF,UAAU,EAAE;gBACV,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC1B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;iBAC1B;gBACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;aACrB;YACD,KAAK,CAAC,OAAO,CAAC,IAAI;gBAChB,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAA0C,CAAC;gBACrE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC1F,OAAO;oBACL,EAAE,EAAE,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;oBAC1D,OAAO,EAAE,MAAM,CAAC,IAAI,KAAK,SAAS;wBAChC,CAAC,CAAC,iBAAiB,MAAM,EAAE;wBAC3B,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;4BACzB,CAAC,CAAC,yBAAyB,MAAM,EAAE;4BACnC,CAAC,CAAC,kBAAkB,MAAM,CAAC,IAAI,EAAE;oBACrC,IAAI,EAAE,MAAM;iBACb,CAAC;YACJ,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED,wEAAwE;AAExE,MAAM,UAAU,0BAA0B,CAAC,IAAuB;IAChE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IACvB,OAAO;QACL;YACE,IAAI,EAAE,kBAAkB;YACxB,WAAW,EAAE,yFAAyF;YACtG,UAAU,EAAE;gBACV,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC5B,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;iBAC7B;gBACD,QAAQ,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC;aACpC;YACD,KAAK,CAAC,OAAO,CAAC,IAAI;gBAChB,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,IAGpC,CAAC;gBACF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;gBAChF,OAAO;oBACL,EAAE,EAAE,MAAM,CAAC,OAAO;oBAClB,OAAO,EAAE,MAAM,CAAC,OAAO;wBACrB,CAAC,CAAC,uBAAuB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;wBACtD,CAAC,CAAC,4BAA4B,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;oBACnD,IAAI,EAAE,MAAM;iBACb,CAAC;YACJ,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/deploy/with-resolved-scope.d.ts

@@ -0,0 +1,31 @@
+/**
+ * `withResolvedScope` — standard wrapper for the resolver + try /
+ * catch shape primitives use to surface auth failures as structured
+ * `Outcome` values instead of thrown exceptions.
+ *
+ * Per F4, every primitive that needs an access token calls
+ * `scope.resolveToken()` inside its execute path. The resolver can
+ * fail (network down, SA invalid, OAuth flow timed out, etc.). The
+ * convention is: bucket those failures into `Outcome` so the
+ * dispatcher doesn't have to catch + stringify.
+ */
+import { type Outcome, type ProjectScope } from './scope.js';
+/**
+ * Run `fn` with a freshly-resolved token + the scope's projectId.
+ * Buckets:
+ *
+ * - Resolver throws `AdminApiError` with 401/403 → `permission-denied`.
+ * - Resolver throws anything else (network, DNS, offline) → `unknown`.
+ *   (Not `permission-denied` — that mislabels transport failures and
+ *   sends consumers hunting for IAM issues that don't exist.)
+ * - `fn` throws `AdminApiError` → bucketed by HTTP status.
+ * - `fn` throws anything else → `unknown`.
+ * - `fn` returns a value → `{ ok: true, data: value }`.
+ *
+ * Factories whose tools need finer-grained error buckets (e.g.
+ * `'invalid-config'`, `'create-failed'`) wrap the result of
+ * `withResolvedScope` and re-bucket; this helper handles the
+ * resolver-throw + happy-path / AdminApiError-aware wrapping.
+ */
+export declare function withResolvedScope<TData>(scope: ProjectScope, fn: (token: string, projectId: string) => Promise<TData>): Promise<Outcome<TData, 'not-found'>>;
+//# sourceMappingURL=with-resolved-scope.d.ts.map

package/dist/deploy/with-resolved-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"with-resolved-scope.d.ts","sourceRoot":"","sources":["../../src/deploy/with-resolved-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAiB,KAAK,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AA4B5E;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAC3C,KAAK,EAAE,YAAY,EACnB,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC,GACvD,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAmBtC"}

package/dist/deploy/with-resolved-scope.js

@@ -0,0 +1,73 @@
+/**
+ * `withResolvedScope` — standard wrapper for the resolver + try /
+ * catch shape primitives use to surface auth failures as structured
+ * `Outcome` values instead of thrown exceptions.
+ *
+ * Per F4, every primitive that needs an access token calls
+ * `scope.resolveToken()` inside its execute path. The resolver can
+ * fail (network down, SA invalid, OAuth flow timed out, etc.). The
+ * convention is: bucket those failures into `Outcome` so the
+ * dispatcher doesn't have to catch + stringify.
+ */
+import { AdminApiError } from './scope.js';
+/**
+ * Bucket a thrown error from a resolver or REST call into the right
+ * outcome code. Inspects `AdminApiError` for HTTP-status-aware
+ * bucketing; falls back to `'unknown'` for everything else so
+ * transport / network failures don't get mislabeled as
+ * `'permission-denied'`.
+ */
+function bucketError(e) {
+    if (e instanceof AdminApiError) {
+        const code = e.status === 401 || e.status === 403
+            ? 'permission-denied'
+            : e.status === 404
+                ? 'not-found'
+                : 'unknown';
+        return { code, message: e.message };
+    }
+    return {
+        code: 'unknown',
+        message: e instanceof Error ? e.message : String(e),
+    };
+}
+/**
+ * Run `fn` with a freshly-resolved token + the scope's projectId.
+ * Buckets:
+ *
+ * - Resolver throws `AdminApiError` with 401/403 → `permission-denied`.
+ * - Resolver throws anything else (network, DNS, offline) → `unknown`.
+ *   (Not `permission-denied` — that mislabels transport failures and
+ *   sends consumers hunting for IAM issues that don't exist.)
+ * - `fn` throws `AdminApiError` → bucketed by HTTP status.
+ * - `fn` throws anything else → `unknown`.
+ * - `fn` returns a value → `{ ok: true, data: value }`.
+ *
+ * Factories whose tools need finer-grained error buckets (e.g.
+ * `'invalid-config'`, `'create-failed'`) wrap the result of
+ * `withResolvedScope` and re-bucket; this helper handles the
+ * resolver-throw + happy-path / AdminApiError-aware wrapping.
+ */
+export async function withResolvedScope(scope, fn) {
+    let token;
+    try {
+        token = await scope.resolveToken();
+    }
+    catch (e) {
+        const { code, message } = bucketError(e);
+        return {
+            ok: false,
+            code,
+            message: `Auth refresh failed: ${message}`,
+        };
+    }
+    try {
+        const data = await fn(token, scope.projectId);
+        return { ok: true, data };
+    }
+    catch (e) {
+        const { code, message } = bucketError(e);
+        return { ok: false, code, message };
+    }
+}
+//# sourceMappingURL=with-resolved-scope.js.map

package/dist/deploy/with-resolved-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"with-resolved-scope.js","sourceRoot":"","sources":["../../src/deploy/with-resolved-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,aAAa,EAAmC,MAAM,YAAY,CAAC;AAE5E;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,CAAU;IAI7B,IAAI,CAAC,YAAY,aAAa,EAAE,CAAC;QAC/B,MAAM,IAAI,GACR,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;YAClC,CAAC,CAAC,mBAAmB;YACrB,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG;gBAChB,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,SAAS,CAAC;QAClB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IACtC,CAAC;IACD,OAAO;QACL,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;KACpD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAmB,EACnB,EAAwD;IAExD,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE,CAAC;IACrC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QACzC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI;YACJ,OAAO,EAAE,wBAAwB,OAAO,EAAE;SAC3C,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACtC,CAAC;AACH,CAAC"}