fix: YAML-first 治理 CI/CD target (#919)

* docs: specify cicd yaml target governance

* fix: resolve cicd targets from yaml

---------

Co-authored-by: Codex <codex@noreply.local>
This commit is contained in:
Lyon
2026-06-26 01:14:38 +08:00
committed by GitHub
parent 3777577df4
commit edfddd2445
35 changed files with 1079 additions and 181 deletions
@@ -1,4 +1,5 @@
// SPEC: PJ2026-01060307 控制面模块化 draft-2026-06-25-p0. compose-deploy module for scripts/src/artifact-registry.ts.
// SPEC: PJ2026-01060308 cicd-yaml-targets draft-2026-06-25-cicd-yaml-targets.
// Moved mechanically from scripts/src/artifact-registry.ts:2579-3153 for #903.
@@ -23,7 +24,7 @@ import {
import { d601K3sGuardShellLines } from "../d601-k3s-guard";
import { composeRuntimeEnvValue } from "../runtime-env";
import type { ArtifactConsumerSpec, ArtifactConsumerTarget, ArtifactRegistryOptions } from "./types";
import { artifactRegistryOptionsTargetSummary, type ArtifactConsumerSpec, type ArtifactConsumerTarget, type ArtifactRegistryOptions } from "./types";
import { composeArtifactEnvValues, registryArtifactMissingMessage, registryArtifactProbeScript, syntheticComposeHealthDeployScript, verifyLocalArtifactLabels } from "./artifact-probe";
import { base64, safeName, shellQuote } from "./bundle";
import { artifactConsumerSpecs } from "./catalog";
@@ -439,6 +440,7 @@ export function dryRunArtifactConsumerPlan(options: ArtifactRegistryOptions, spe
error: verificationBlocked ? "runtime-verification-blocked" : undefined,
environment,
providerId: effectiveOptions.providerId,
artifactRegistryTarget: artifactRegistryOptionsTargetSummary(effectiveOptions),
serviceId: spec.serviceId,
commit,
sourceRepo: sourceRepoFor(effectiveOptions, spec),
+28 -27
View File
@@ -1,4 +1,5 @@
// SPEC: PJ2026-01060307 控制面模块化 draft-2026-06-25-p0. entry module for scripts/src/artifact-registry.ts.
// SPEC: PJ2026-01060308 cicd-yaml-targets draft-2026-06-25-cicd-yaml-targets.
// Moved mechanically from scripts/src/artifact-registry.ts:3448-3700 for #903.
@@ -85,33 +86,33 @@ export function localHelp(): Record<string, unknown> {
command: "artifact-registry plan|render|status|health|install|deploy-backend-core|deploy-service",
output: "json",
usage: [
"bun scripts/cli.ts artifact-registry plan [--provider-id D601]",
"bun scripts/cli.ts artifact-registry render [--provider-id D601]",
"bun scripts/cli.ts artifact-registry status [--provider-id D601]",
"bun scripts/cli.ts artifact-registry health [--provider-id D601]",
"bun scripts/cli.ts artifact-registry install [--provider-id D601]",
"bun scripts/cli.ts artifact-registry deploy-service --service baidu-netdisk --commit <full-sha> [--dry-run] [--run-now] [--provider-id D601]",
"bun scripts/cli.ts artifact-registry deploy-service --service frontend --env prod --commit <full-sha> [--dry-run] [--run-now] [--provider-id D601]",
"bun scripts/cli.ts artifact-registry deploy-service --service frontend --env dev --commit <full-sha> [--dry-run] [--run-now] [--provider-id D601]",
"bun scripts/cli.ts artifact-registry deploy-service --env dev --service decision-center --commit <full-sha> [--dry-run] [--run-now] [--provider-id D601]",
"bun scripts/cli.ts artifact-registry deploy-service --env prod --service decision-center --commit <full-sha> [--dry-run] [--run-now] [--provider-id D601]",
"bun scripts/cli.ts artifact-registry deploy-service --env prod --service project-manager --commit <full-sha> [--dry-run] [--run-now] [--provider-id D601]",
"bun scripts/cli.ts artifact-registry deploy-service --env prod --service oa-event-flow --commit <full-sha> [--dry-run] [--run-now] [--provider-id D601]",
"bun scripts/cli.ts artifact-registry deploy-service --env prod --service code-queue-mgr --commit <full-sha> --dry-run [--provider-id D601]",
"bun scripts/cli.ts artifact-registry deploy-service --env prod --service todo-note --commit <full-sha> [--dry-run] [--run-now] [--provider-id D601]",
"bun scripts/cli.ts artifact-registry deploy-service --env dev --service todo-note --commit <full-sha> [--dry-run] [--run-now] [--provider-id D601]",
"bun scripts/cli.ts artifact-registry deploy-service --env dev --service findjob --commit <full-sha> [--dry-run] [--run-now] [--provider-id D601]",
"bun scripts/cli.ts artifact-registry deploy-service --env prod --service findjob --commit <full-sha> [--dry-run] [--run-now] [--provider-id D601]",
"bun scripts/cli.ts artifact-registry deploy-service --env dev --service pipeline --commit <full-sha> [--dry-run] [--run-now] [--provider-id D601]",
"bun scripts/cli.ts artifact-registry deploy-service --env prod --service pipeline --commit <full-sha> [--dry-run] [--run-now] [--provider-id D601]",
"bun scripts/cli.ts artifact-registry deploy-service --env dev --service met-nonlinear --commit <full-sha> --dry-run [--provider-id D601]",
"bun scripts/cli.ts artifact-registry deploy-service --env prod --service met-nonlinear --commit <full-sha> --dry-run [--provider-id D601]",
"bun scripts/cli.ts artifact-registry deploy-service --env prod --service k3sctl-adapter --commit <full-sha> --dry-run [--provider-id D601]",
"bun scripts/cli.ts artifact-registry deploy-service --env dev --service mdtodo --commit <full-sha> [--dry-run] [--run-now] [--provider-id D601]",
"bun scripts/cli.ts artifact-registry deploy-service --env prod --service mdtodo --commit <full-sha> [--dry-run] [--run-now] [--provider-id D601]",
"bun scripts/cli.ts artifact-registry deploy-service --env dev --service claudeqq --commit <full-sha> [--dry-run] [--run-now] [--provider-id D601]",
"bun scripts/cli.ts artifact-registry deploy-service --env prod --service claudeqq --commit <full-sha> [--dry-run] [--run-now] [--provider-id D601]",
"bun scripts/cli.ts artifact-registry deploy-service --env dev --service code-queue --commit <full-sha> --dry-run [--provider-id D601]",
"bun scripts/cli.ts artifact-registry plan [--target D601]",
"bun scripts/cli.ts artifact-registry render [--target D601]",
"bun scripts/cli.ts artifact-registry status [--target D601]",
"bun scripts/cli.ts artifact-registry health [--target D601]",
"bun scripts/cli.ts artifact-registry install [--target D601]",
"bun scripts/cli.ts artifact-registry deploy-service --service baidu-netdisk --commit <full-sha> [--dry-run] [--run-now] [--target D601]",
"bun scripts/cli.ts artifact-registry deploy-service --service frontend --env prod --commit <full-sha> [--dry-run] [--run-now] [--target D601]",
"bun scripts/cli.ts artifact-registry deploy-service --service frontend --env dev --commit <full-sha> [--dry-run] [--run-now] [--target D601]",
"bun scripts/cli.ts artifact-registry deploy-service --env dev --service decision-center --commit <full-sha> [--dry-run] [--run-now] [--target D601]",
"bun scripts/cli.ts artifact-registry deploy-service --env prod --service decision-center --commit <full-sha> [--dry-run] [--run-now] [--target D601]",
"bun scripts/cli.ts artifact-registry deploy-service --env prod --service project-manager --commit <full-sha> [--dry-run] [--run-now] [--target D601]",
"bun scripts/cli.ts artifact-registry deploy-service --env prod --service oa-event-flow --commit <full-sha> [--dry-run] [--run-now] [--target D601]",
"bun scripts/cli.ts artifact-registry deploy-service --env prod --service code-queue-mgr --commit <full-sha> --dry-run [--target D601]",
"bun scripts/cli.ts artifact-registry deploy-service --env prod --service todo-note --commit <full-sha> [--dry-run] [--run-now] [--target D601]",
"bun scripts/cli.ts artifact-registry deploy-service --env dev --service todo-note --commit <full-sha> [--dry-run] [--run-now] [--target D601]",
"bun scripts/cli.ts artifact-registry deploy-service --env dev --service findjob --commit <full-sha> [--dry-run] [--run-now] [--target D601]",
"bun scripts/cli.ts artifact-registry deploy-service --env prod --service findjob --commit <full-sha> [--dry-run] [--run-now] [--target D601]",
"bun scripts/cli.ts artifact-registry deploy-service --env dev --service pipeline --commit <full-sha> [--dry-run] [--run-now] [--target D601]",
"bun scripts/cli.ts artifact-registry deploy-service --env prod --service pipeline --commit <full-sha> [--dry-run] [--run-now] [--target D601]",
"bun scripts/cli.ts artifact-registry deploy-service --env dev --service met-nonlinear --commit <full-sha> --dry-run [--target D601]",
"bun scripts/cli.ts artifact-registry deploy-service --env prod --service met-nonlinear --commit <full-sha> --dry-run [--target D601]",
"bun scripts/cli.ts artifact-registry deploy-service --env prod --service k3sctl-adapter --commit <full-sha> --dry-run [--target D601]",
"bun scripts/cli.ts artifact-registry deploy-service --env dev --service mdtodo --commit <full-sha> [--dry-run] [--run-now] [--target D601]",
"bun scripts/cli.ts artifact-registry deploy-service --env prod --service mdtodo --commit <full-sha> [--dry-run] [--run-now] [--target D601]",
"bun scripts/cli.ts artifact-registry deploy-service --env dev --service claudeqq --commit <full-sha> [--dry-run] [--run-now] [--target D601]",
"bun scripts/cli.ts artifact-registry deploy-service --env prod --service claudeqq --commit <full-sha> [--dry-run] [--run-now] [--target D601]",
"bun scripts/cli.ts artifact-registry deploy-service --env dev --service code-queue --commit <full-sha> --dry-run [--target D601]",
],
firstStage: "install now writes the rendered systemd/Compose/config files and starts the registry",
artifactConsumers: {
+55 -25
View File
@@ -1,4 +1,5 @@
// SPEC: PJ2026-01060307 控制面模块化 draft-2026-06-25-p0. options module for scripts/src/artifact-registry.ts.
// SPEC: PJ2026-01060308 cicd-yaml-targets draft-2026-06-25-cicd-yaml-targets.
// Moved mechanically from scripts/src/artifact-registry.ts:881-978 for #903.
@@ -24,7 +25,8 @@ import { d601K3sGuardShellLines } from "../d601-k3s-guard";
import { composeRuntimeEnvValue } from "../runtime-env";
import type { ArtifactDeployEnvironment, ArtifactRegistryOptions } from "./types";
import { defaultOptions } from "./types";
import { artifactRegistryOptionsFromTarget } from "./types";
import { resolveArtifactRegistryTarget } from "../ops/targets";
export function isHelpArg(value: string | undefined): boolean {
return value === undefined || value === "help" || value === "--help" || value === "-h";
@@ -60,65 +62,93 @@ export function environmentValue(value: string, option: string): ArtifactDeployE
}
export function parseArtifactRegistryOptions(args: string[]): ArtifactRegistryOptions {
const options = { ...defaultOptions };
let targetSelection: string | null = null;
let environment: ArtifactDeployEnvironment | null = null;
let host: string | null = null;
let port: number | null = null;
let image: string | null = null;
let baseDir: string | null = null;
let storageDir: string | null = null;
let timeoutMs: number | null = null;
let dryRun = false;
let runNow = false;
let commit: string | null = null;
let targetImage: string | null = null;
let serviceId: string | null = null;
let sourceRepo: string | null = null;
let sourceRepoExplicit = false;
let deployRef: string | null = null;
let deployJsonService: ArtifactRegistryOptions["deployJsonService"] = null;
for (let index = 0; index < args.length; index += 1) {
const arg = args[index];
if (arg === "--dry-run") {
options.dryRun = true;
dryRun = true;
} else if (arg === "--run-now") {
options.runNow = true;
runNow = true;
} else if (arg === "--env" || arg === "--environment") {
const environment = requireValue(args, index, arg);
if (environment !== "dev" && environment !== "prod") throw new Error(`${arg} must be dev or prod`);
options.environment = environment;
environment = environmentValue(requireValue(args, index, arg), arg);
index += 1;
} else if (arg === "--provider-id") {
options.providerId = requireValue(args, index, arg);
} else if (arg === "--target" || arg === "--provider-id") {
targetSelection = requireValue(args, index, arg);
index += 1;
} else if (arg === "--host") {
options.host = requireValue(args, index, arg);
host = requireValue(args, index, arg);
index += 1;
} else if (arg === "--port") {
options.port = positiveInt(requireValue(args, index, arg), arg);
port = positiveInt(requireValue(args, index, arg), arg);
index += 1;
} else if (arg === "--image") {
options.image = requireValue(args, index, arg);
image = requireValue(args, index, arg);
index += 1;
} else if (arg === "--base-dir") {
options.baseDir = absolutePath(requireValue(args, index, arg), arg);
baseDir = absolutePath(requireValue(args, index, arg), arg);
index += 1;
} else if (arg === "--storage-dir") {
options.storageDir = absolutePath(requireValue(args, index, arg), arg);
storageDir = absolutePath(requireValue(args, index, arg), arg);
index += 1;
} else if (arg === "--timeout-ms") {
options.timeoutMs = positiveInt(requireValue(args, index, arg), arg);
timeoutMs = positiveInt(requireValue(args, index, arg), arg);
index += 1;
} else if (arg === "--commit") {
options.commit = commitValue(requireValue(args, index, arg), arg);
commit = commitValue(requireValue(args, index, arg), arg);
index += 1;
} else if (arg === "--target-image") {
options.targetImage = requireValue(args, index, arg);
targetImage = requireValue(args, index, arg);
index += 1;
} else if (arg === "--service" || arg === "--service-id") {
options.serviceId = requireValue(args, index, arg);
serviceId = requireValue(args, index, arg);
index += 1;
} else if (arg === "--source-repo") {
options.sourceRepo = requireValue(args, index, arg);
options.sourceRepoExplicit = true;
sourceRepo = requireValue(args, index, arg);
sourceRepoExplicit = true;
index += 1;
} else if (arg === "--deploy-ref") {
options.deployRef = requireValue(args, index, arg);
deployRef = requireValue(args, index, arg);
index += 1;
} else if (arg === "--deploy-json-service") {
options.deployJsonService = parseDeployJsonServiceContractBase64(requireValue(args, index, arg));
index += 1;
} else if (arg === "--env" || arg === "--environment") {
options.environment = environmentValue(requireValue(args, index, arg), arg);
deployJsonService = parseDeployJsonServiceContractBase64(requireValue(args, index, arg));
index += 1;
} else {
throw new Error(`unknown artifact-registry option: ${arg}`);
}
}
const options = artifactRegistryOptionsFromTarget(resolveArtifactRegistryTarget(targetSelection));
options.environment = environment;
options.host = host ?? options.host;
options.port = port ?? options.port;
options.image = image ?? options.image;
options.baseDir = baseDir ?? options.baseDir;
options.storageDir = storageDir ?? options.storageDir;
options.timeoutMs = timeoutMs ?? options.timeoutMs;
options.dryRun = dryRun;
options.runNow = runNow;
options.commit = commit;
options.targetImage = targetImage;
options.serviceId = serviceId;
options.sourceRepo = sourceRepo ?? options.sourceRepo;
options.sourceRepoExplicit = sourceRepoExplicit;
options.deployRef = deployRef;
options.deployJsonService = deployJsonService;
if (options.host !== "127.0.0.1") throw new Error("--host is first-stage restricted to 127.0.0.1");
if (options.port !== 5000) throw new Error("--port is first-stage restricted to 5000");
return options;
+6 -4
View File
@@ -1,4 +1,5 @@
// SPEC: PJ2026-01060307 控制面模块化 draft-2026-06-25-p0. readonly module for scripts/src/artifact-registry.ts.
// SPEC: PJ2026-01060308 cicd-yaml-targets draft-2026-06-25-cicd-yaml-targets.
// Moved mechanically from scripts/src/artifact-registry.ts:1934-2116 for #903.
@@ -23,7 +24,7 @@ import {
import { d601K3sGuardShellLines } from "../d601-k3s-guard";
import { composeRuntimeEnvValue } from "../runtime-env";
import type { ArtifactRegistryCommandRuntime, ArtifactRegistryOptions, ArtifactRegistryReadonlyProbe } from "./types";
import { artifactRegistryOptionsTargetSummary, type ArtifactRegistryCommandRuntime, type ArtifactRegistryOptions, type ArtifactRegistryReadonlyProbe } from "./types";
import { renderBundle } from "./bundle";
import { commandTail } from "./consumer";
import { annotateRemoteFirstReadonlyResult, annotateRemoteReadonlyResult, controlPlaneMissingResult, parsedCliData, readonlyCommandFailureResult, remoteFrontendHostFromEnv, runRemoteScript, unwrapRemoteArtifactRegistryResult } from "./remote";
@@ -41,7 +42,7 @@ export function artifactRegistryReadonlyAutoRemotePlan(
providerId: options.providerId,
host: remoteHost,
transport: "frontend",
command: remoteHost === null ? null : `bun scripts/cli.ts --main-server-ip ${remoteHost} artifact-registry ${action} --provider-id ${options.providerId}`,
command: remoteHost === null ? null : `bun scripts/cli.ts --main-server-ip ${remoteHost} artifact-registry ${action} --target ${options.targetId}`,
failureClassification: remoteHost === null ? "control-plane-missing" : null,
};
}
@@ -81,8 +82,8 @@ export function runReadonlyStatusViaRemoteFrontend(
remoteHost,
"artifact-registry",
action,
"--provider-id",
options.providerId,
"--target",
options.targetId,
"--timeout-ms",
String(options.timeoutMs),
];
@@ -146,6 +147,7 @@ export function statusFromValues(options: ArtifactRegistryOptions, values: Recor
installed,
healthy,
...decision,
target: artifactRegistryOptionsTargetSummary(options),
remoteCommandShape: readonlyRemoteCommandShape(healthMode ? "health" : "status", options),
checks,
observed: {
+3 -2
View File
@@ -1,4 +1,5 @@
// SPEC: PJ2026-01060307 控制面模块化 draft-2026-06-25-p0. remote module for scripts/src/artifact-registry.ts.
// SPEC: PJ2026-01060308 cicd-yaml-targets draft-2026-06-25-cicd-yaml-targets.
// Moved mechanically from scripts/src/artifact-registry.ts:1659-1933 for #903.
@@ -228,8 +229,8 @@ export function controlPlaneMissingResult(
localBackendCoreMissing: true,
classification: "control-plane-missing",
retryCommand: remoteHost === null
? `bun scripts/cli.ts --main-server-ip <host> artifact-registry ${action} --provider-id ${options.providerId}`
: `bun scripts/cli.ts --main-server-ip ${remoteHost} artifact-registry ${action} --provider-id ${options.providerId}`,
? `bun scripts/cli.ts --main-server-ip <host> artifact-registry ${action} --target ${options.targetId}`
: `bun scripts/cli.ts --main-server-ip ${remoteHost} artifact-registry ${action} --target ${options.targetId}`,
},
localObservation: localResult,
remoteObservation: remoteResult,
+3 -1
View File
@@ -1,4 +1,5 @@
// SPEC: PJ2026-01060307 控制面模块化 draft-2026-06-25-p0. status module for scripts/src/artifact-registry.ts.
// SPEC: PJ2026-01060308 cicd-yaml-targets draft-2026-06-25-cicd-yaml-targets.
// Moved mechanically from scripts/src/artifact-registry.ts:1081-1318 for #903.
@@ -23,13 +24,14 @@ import {
import { d601K3sGuardShellLines } from "../d601-k3s-guard";
import { composeRuntimeEnvValue } from "../runtime-env";
import type { ArtifactRegistryFailureClassification, ArtifactRegistryOptions, RenderedBundle } from "./types";
import { artifactRegistryOptionsTargetSummary, type ArtifactRegistryFailureClassification, type ArtifactRegistryOptions, type RenderedBundle } from "./types";
import { renderBundle, shellQuote } from "./bundle";
export function plan(options: ArtifactRegistryOptions): Record<string, unknown> {
const bundle = renderBundle(options);
return {
ok: true,
target: artifactRegistryOptionsTargetSummary(options),
providerId: options.providerId,
mode: "d601-host-managed",
firstStage: true,
+65 -23
View File
@@ -1,4 +1,5 @@
// SPEC: PJ2026-01060307 控制面模块化 draft-2026-06-25-p0. types module for scripts/src/artifact-registry.ts.
// SPEC: PJ2026-01060308 cicd-yaml-targets draft-2026-06-25-cicd-yaml-targets.
// Moved mechanically from scripts/src/artifact-registry.ts:1-248 for #903.
@@ -22,6 +23,7 @@ import {
} from "../deploy-json-contract";
import { d601K3sGuardShellLines } from "../d601-k3s-guard";
import { composeRuntimeEnvValue } from "../runtime-env";
import { artifactRegistryTargetSummary, resolveArtifactRegistryTarget, type TargetConfigSource } from "../ops/targets";
import { composeFile, sha256 } from "./bundle";
@@ -30,11 +32,14 @@ export type ArtifactRegistryAction = "plan" | "render" | "status" | "health" | "
export type ArtifactDeployEnvironment = "prod" | "dev";
export interface ArtifactRegistryOptions {
targetId: string;
environment: ArtifactDeployEnvironment | null;
providerId: string;
mode: string;
host: string;
port: number;
image: string;
repositoryPrefix: string;
baseDir: string;
storageDir: string;
unitName: string;
@@ -51,6 +56,9 @@ export interface ArtifactRegistryOptions {
sourceRepoExplicit: boolean;
deployRef: string | null;
deployJsonService: DeployJsonServiceContract | null;
consumerTarget: Record<string, unknown>;
consumerCatalogRef: string;
configSource: TargetConfigSource;
}
export interface ArtifactRegistryCommandRuntime {
@@ -96,29 +104,63 @@ export type ArtifactRegistryFailureClassification =
| "registry-not-installed"
| "registry-unhealthy";
export const defaultOptions: ArtifactRegistryOptions = {
environment: null,
providerId: "D601",
host: "127.0.0.1",
port: 5000,
image: "registry:2.8.3",
baseDir: "/home/ubuntu/.unidesk/artifact-registry",
storageDir: "/home/ubuntu/.unidesk/registry-storage",
unitName: "unidesk-artifact-registry.service",
composeProject: "unidesk-artifact-registry",
serviceName: "registry",
containerName: "unidesk-artifact-registry",
timeoutMs: 30_000,
dryRun: false,
runNow: false,
commit: null,
targetImage: null,
serviceId: null,
sourceRepo: "https://github.com/pikasTech/unidesk",
sourceRepoExplicit: false,
deployRef: null,
deployJsonService: null,
};
export function artifactRegistryOptionsFromTarget(target = resolveArtifactRegistryTarget(null)): ArtifactRegistryOptions {
return {
targetId: target.targetId,
environment: null,
providerId: target.providerId,
mode: target.mode,
host: target.host,
port: target.port,
image: target.image,
repositoryPrefix: target.repositoryPrefix,
baseDir: target.baseDir,
storageDir: target.storageDir,
unitName: target.unitName,
composeProject: target.composeProject,
serviceName: target.serviceName,
containerName: target.containerName,
timeoutMs: target.timeoutMs,
dryRun: false,
runNow: false,
commit: null,
targetImage: null,
serviceId: null,
sourceRepo: target.sourceRepo,
sourceRepoExplicit: false,
deployRef: null,
deployJsonService: null,
consumerTarget: target.consumerTarget,
consumerCatalogRef: target.consumerCatalogRef,
configSource: target.configSource,
};
}
export const defaultOptions: ArtifactRegistryOptions = artifactRegistryOptionsFromTarget();
export function artifactRegistryOptionsTargetSummary(options: ArtifactRegistryOptions): Record<string, unknown> {
return artifactRegistryTargetSummary({
targetId: options.targetId,
providerId: options.providerId,
mode: options.mode,
host: options.host,
port: options.port,
endpoint: `http://${options.host}:${options.port}`,
image: options.image,
repositoryPrefix: options.repositoryPrefix,
baseDir: options.baseDir,
storageDir: options.storageDir,
unitName: options.unitName,
composeProject: options.composeProject,
serviceName: options.serviceName,
containerName: options.containerName,
timeoutMs: options.timeoutMs,
sourceRepo: options.sourceRepo,
consumerTarget: options.consumerTarget,
consumerCatalogRef: options.consumerCatalogRef,
configSource: options.configSource,
});
}
export const supportedArtifactConsumerServices = [
"auth-broker",