@caelo-cms/provisioning 0.10.26 → 0.10.28

package/dist/dns/index.d.ts

@@ -1,5 +1,5 @@
 import type { DnsAdapter } from "./types.js";
-export type { DnsAdapter, DnsRecord } from "./types.js";
+export type { DnsAdapter } from "./types.js";
 /**
  * Pick the right DNS adapter based on environment + interactive
  * detection. The CLI's wizard calls this; if a registrar's API is

package/dist/dns/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dns/index.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAExD;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,OAAO,CAAC,UAAU,CAAC,CAoBtB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dns/index.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,YAAY,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,OAAO,CAAC,UAAU,CAAC,CAoBtB"}

package/dist/lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../src/lifecycle.ts"],"names":[],"mappings":"AAyGA,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAWnD;AAyGD,UAAU,WAAW;IACnB,uEAAuE;IACvE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,GAAG,IAAI,GAAG,MAAM,CAAC;IAC5C;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAmHD,wBAAsB,cAAc,CAAC,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuN1E;AAuJD,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAmCnD;AAMD,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAoCjF;AAMD;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CA0DrD;AAED,wBAAsB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CA6CpD"}
+{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../src/lifecycle.ts"],"names":[],"mappings":"AA0GA,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAWnD;AAyGD,UAAU,WAAW;IACnB,uEAAuE;IACvE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,GAAG,IAAI,GAAG,MAAM,CAAC;IAC5C;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AA4ID,wBAAsB,cAAc,CAAC,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuP1E;AAuJD,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAmCnD;AAMD,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAoCjF;AAMD;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CA0DrD;AAED,wBAAsB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CA6CpD"}

package/dist/lifecycle.js

@@ -19,6 +19,7 @@ import { cancel, confirm, isCancel, log, note, spinner } from "@clack/prompts";
 import { bold, cyan, dim, green, red, yellow } from "kleur/colors";
 import { gcloud } from "./gcloud.js";
 import { installRoot, readMetadata, readSecret } from "./install-state.js";
+import { ensureMcpIapAccess } from "./mcp-iap.js";
 /** Find the single install on this machine — or warn if 0/multiple. */
 function findActiveInstall() {
     const home = homedir();
@@ -252,6 +253,26 @@ async function rollbackTraffic(projectId, region, serviceName, priorRevision) {
     ]);
     return r.ok;
 }
+/**
+ * The admin's IAP resource: the Cloud Run service itself on gcp-firebase
+ * (native IAP), the LB backend service on gcp (Pulumi-suffixed name).
+ */
+async function resolveAdminIapResource(meta, region, adminServiceName) {
+    if (meta.provider === "gcp-firebase") {
+        return { kind: "cloud-run", service: adminServiceName, region };
+    }
+    const r = await gcloud([
+        "compute",
+        "backend-services",
+        "list",
+        "--global",
+        `--project=${meta.projectId}`,
+        "--filter=name~^caelo-production-admin-backend",
+        "--format=value(name)",
+    ]);
+    const name = r.ok ? r.stdout.trim().split("\n")[0]?.trim() : "";
+    return name ? { kind: "backend-services", service: name } : null;
+}
 export async function upgradeCommand(opts = {}) {
     const { meta } = requireInstall();
     // v0.5.15 — extended to cover gcp-firebase too. Both providers share
@@ -377,6 +398,31 @@ export async function upgradeCommand(opts = {}) {
     }
     sMig.stop(green("Migrations applied"));
     // ────────────────────────────────────────────────────────────────
+    // Issue #37 — MCP through IAP. Idempotently ensure the MCP service
+    // account + its IAP/token-creator bindings, then hand its email to the
+    // new admin revision (CAELO_MCP_IAP_SERVICE_ACCOUNT) so /security/mcp
+    // shows a working `claude mcp add` command. Installs provisioned before
+    // this existed get it here, with no operator config. A failure only
+    // costs MCP access, so it warns instead of aborting the upgrade.
+    // ────────────────────────────────────────────────────────────────
+    let mcpServiceAccount = null;
+    if (adminPlan) {
+        const sMcp = spinner();
+        sMcp.start("Ensuring MCP access through IAP...");
+        const resource = await resolveAdminIapResource(meta, region, adminPlan.serviceName);
+        const mcp = resource
+            ? await ensureMcpIapAccess({ projectId: meta.projectId, resource })
+            : { ok: false, error: "admin IAP backend service not found" };
+        if (mcp.ok) {
+            mcpServiceAccount = mcp.serviceAccount;
+            sMcp.stop(green(`MCP access ready (${mcp.serviceAccount}; ${mcp.operators.length} operator(s))`));
+        }
+        else {
+            sMcp.stop(yellow(`MCP access not configured: ${mcp.error}`));
+            log.warn("The upgrade continues; external MCP clients stay blocked by IAP until this succeeds.");
+        }
+    }
+    // ────────────────────────────────────────────────────────────────
     // Phase 2: roll each service, probe health, auto-rollback on fail.
     // If admin succeeds but gateway fails, also roll admin back so the
     // operator never ends up on a mismatched-version pair.
@@ -396,6 +442,9 @@ export async function upgradeCommand(opts = {}) {
             meta.projectId,
             "--image",
             plan.imageRef,
+            ...(plan.slug === "admin" && mcpServiceAccount
+                ? [`--update-env-vars=CAELO_MCP_IAP_SERVICE_ACCOUNT=${mcpServiceAccount}`]
+                : []),
             "--quiet",
         ]);
         if (!upd.ok) {

package/dist/lifecycle.js.map

@@ -1 +1 @@
-{"version":3,"file":"lifecycle.js","sourceRoot":"","sources":["../src/lifecycle.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAwB,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEjG,uEAAuE;AACvE,SAAS,iBAAiB;IACxB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC;SACjC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;SAC9C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;IAClD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,IAAI;YAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACvC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc;IACrB,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;IAClC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC,CAAC;QAC1D,GAAG,CAAC,IAAI,CACN,OAAO,IAAI,CAAC,8BAA8B,CAAC,2CAA2C,GAAG,CAAC,wBAAwB,CAAC,iCAAiC,CACrJ,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,sBAAsB,CACnC,IAAoC,EACpC,MAAc,EACd,SAAiB,EACjB,MAAe;IAEf,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI,CACP,KAAK,EACL,UAAU,EACV,MAAM,EACN,UAAU,EACV,MAAM,IAAI,cAAc,EACxB,WAAW,EACX,SAAS,EACT,UAAU,EACV,kBAAkB,MAAM,EAAE,EAC1B,+BAA+B,CAChC,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,IAAI,CACP,KAAK,EACL,WAAW,EACX,MAAM,EACN,WAAW,EACX,SAAS,EACT,UAAU,EACV,SAAS,MAAM,EAAE,EACjB,sBAAsB,CACvB,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM;SACrB,IAAI,EAAE;SACN,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED,4EAA4E;AAC5E,uCAAuC;AACvC,4EAA4E;AAE5E,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,CAAC;IAC7C,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC,CAAC;IACrE,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1C,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,eAAe,CAAC,EAAE,CAAC,CAAC;IAEhE,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC5B,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,CAAC,+BAA+B,IAAI,CAAC,QAAQ,uBAAuB,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,IAAI,iBAAiB,GAAwD,IAAI,CAAC;AAClF,KAAK,UAAU,mBAAmB;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,iBAAiB,IAAI,GAAG,GAAG,iBAAiB,CAAC,SAAS,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;QAC5E,OAAO,iBAAiB,CAAC,MAAM,CAAC;IAClC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,kEAAkE,EAAE;YAC1F,OAAO,EAAE,EAAE,MAAM,EAAE,6BAA6B,EAAE;SACnD,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,iBAAiB,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAC;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC;QACrC,iBAAiB,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QAC/C,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAqB;IAC5C,IAAI,CAAC,IAAI,CAAC,SAAS;QAAE,OAAO;IAC5B,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;IACpB,CAAC,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAE7D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC;IAC7C,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAC5C,aAAa,EACb,wBAAwB,EACxB,IAAI,CAAC,SAAS,EACd,MAAM,CACP,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAC1C,cAAc,EACd,qBAAqB,EACrB,IAAI,CAAC,SAAS,CACf,CAAC;IACF,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC,CAAC;QAChF,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC;QAC5B,KAAK;QACL,UAAU;QACV,UAAU;QACV,SAAS;QACT,UAAU;QACV,MAAM;QACN,WAAW;QACX,IAAI,CAAC,SAAS;QACd,4BAA4B;KAC7B,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC;QAC5B,KAAK;QACL,WAAW;QACX,UAAU;QACV,OAAO;QACP,WAAW;QACX,IAAI,CAAC,SAAS;QACd,uBAAuB;KACxB,CAAC,CAAC;IACH,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAEvC,iEAAiE;IACjE,mEAAmE;IACnE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAC9C,MAAM,YAAY,GAAG,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC;IAC1D,MAAM,WAAW,GACf,YAAY,IAAI,YAAY,KAAK,aAAa;QAC5C,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,YAAY,YAAY,CAAC,iDAAiD;QAC1F,CAAC,CAAC,YAAY,KAAK,aAAa;YAC9B,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;YACrB,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAEhC,IAAI,CACF;QACE,GAAG,GAAG,CAAC,qBAAqB,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;QAC7F,GAAG,GAAG,CAAC,iBAAiB,CAAC,QAAQ,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;QAC5F,GAAG,GAAG,CAAC,aAAa,CAAC,aAAa,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE;QAClE,GAAG,GAAG,CAAC,mBAAmB,CAAC,OAAO,IAAI,CAAC,iBAAiB,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE;QACxE,GAAG,GAAG,CAAC,aAAa,CAAC,cAAc,aAAa,KAAK,WAAW,EAAE;KACnE,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,QAAQ,CACT,CAAC;AACJ,CAAC;AA2BD;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAC7B,MAAc,EACd,OAAe,EACf,IAAY,EACZ,KAAa,EACb,GAAW;IAEX,MAAM,GAAG,GAAG,WAAW,MAAM,sBAAsB,OAAO,IAAI,IAAI,IAAI,KAAK,cAAc,GAAG,EAAE,CAAC;IAC/F,qEAAqE;IACrE,mEAAmE;IACnE,iEAAiE;IACjE,+CAA+C;IAC/C,MAAM,MAAM,GAAG;QACb,sDAAsD;QACtD,4CAA4C;QAC5C,2DAA2D;QAC3D,yCAAyC;KAC1C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACZ,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC;QACvE,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,MAAM,IAAI,WAAW,EAAE,EAAE,CAAC;QACrF,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,KAAK,UAAU,mBAAmB,CAChC,SAAiB,EACjB,MAAc,EACd,WAAmB;IAEnB,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC;QACrB,KAAK;QACL,UAAU;QACV,UAAU;QACV,WAAW;QACX,UAAU;QACV,MAAM;QACN,WAAW;QACX,SAAS;QACT,gDAAgD;KACjD,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACnD,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,2EAA2E;AAC3E,KAAK,UAAU,cAAc,CAC3B,SAAiB,EACjB,MAAc,EACd,WAAmB;IAEnB,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC;QACrB,KAAK;QACL,UAAU;QACV,UAAU;QACV,WAAW;QACX,UAAU;QACV,MAAM;QACN,WAAW;QACX,SAAS;QACT,4BAA4B;KAC7B,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,SAAiB,EACjB,MAAc,EACd,WAAmB,EACnB,aAAqB;IAErB,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC;QACrB,KAAK;QACL,UAAU;QACV,gBAAgB;QAChB,WAAW;QACX,UAAU;QACV,MAAM;QACN,WAAW;QACX,SAAS;QACT,gBAAgB;QAChB,GAAG,aAAa,MAAM;QACtB,SAAS;KACV,CAAC,CAAC;IACH,OAAO,CAAC,CAAC,EAAE,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAoB,EAAE;IACzD,MAAM,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,CAAC;IAClC,qEAAqE;IACrE,6DAA6D;IAC7D,qEAAqE;IACrE,mEAAmE;IACnE,mEAAmE;IACnE,4DAA4D;IAC5D,0BAA0B;IAC1B,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;QAChE,GAAG,CAAC,IAAI,CAAC,wBAAwB,IAAI,CAAC,QAAQ,uBAAuB,CAAC,CAAC;QACvE,OAAO;IACT,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,SAAS;QAAE,OAAO;IAE5B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC;IAC7C,MAAM,eAAe,GAAG,eAAe,CAAC;IACxC,MAAM,cAAc,GAAG,cAAc,CAAC;IACtC,MAAM,YAAY,GAAG,kBAAkB,CAAC;IAExC,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE;QACtB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;QAC7F,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACvC,IAAI,IAAI,CAAC,OAAO,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC;QAC3C,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC,EAAE,CAAC;IACL,GAAG,CAAC,IAAI,CAAC,gCAAgC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAE5D,mEAAmE;IACnE,iEAAiE;IACjE,kEAAkE;IAClE,qEAAqE;IACrE,mEAAmE;IACnE,MAAM,KAAK,GAAkB,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,KAAK,CAAC,uEAAuE,CAAC,CAAC;IACpF,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,SAAS,CAAU,EAAE,CAAC;QACjD,MAAM,WAAW,GAAG,MAAM,sBAAsB,CAC9C,aAAa,EACb,oBAAoB,IAAI,EAAE,EAC1B,IAAI,CAAC,SAAS,EACd,MAAM,CACP,CAAC;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,mCAAmC,IAAI,qBAAqB,CAAC,CAAC,CAAC;YAC7E,OAAO;QACT,CAAC;QACD,kEAAkE;QAClE,oEAAoE;QACpE,iEAAiE;QACjE,+DAA+D;QAC/D,gEAAgE;QAChE,8DAA8D;QAC9D,6DAA6D;QAC7D,8DAA8D;QAC9D,2DAA2D;QAC3D,MAAM,SAAS,GAAG,MAAM,gBAAgB,CACtC,cAAc,EACd,eAAe,EACf,YAAY,EACZ,IAAI,EACJ,SAAS,CACV,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,qCAAqC,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC;YACzE,GAAG,CAAC,KAAK,CACP,4BAA4B,SAAS,CAAC,MAAM,KAAK;gBAC/C,oCAAoC,cAAc,mBAAmB,eAAe,IAAI,YAAY,IAAI,IAAI,IAAI,SAAS,IAAI;gBAC7H,2GAA2G,CAC9G,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;QAChC,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACrF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,0CAA0C,IAAI,qBAAqB,CAAC,CAAC,CAAC;YACpF,OAAO;QACT,CAAC;QACD,KAAK,CAAC,IAAI,CAAC;YACT,IAAI;YACJ,WAAW;YACX,MAAM;YACN,QAAQ,EAAE,GAAG,cAAc,mBAAmB,eAAe,IAAI,YAAY,IAAI,IAAI,IAAI,MAAM,EAAE;YACjG,aAAa;SACd,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,KAAK,CAAC,MAAM,mBAAmB,CAAC,CAAC,CAAC;IAErE,mEAAmE;IACnE,8DAA8D;IAC9D,kEAAkE;IAClE,kEAAkE;IAClE,0CAA0C;IAC1C,EAAE;IACF,mEAAmE;IACnE,mEAAmE;IACnE,gEAAgE;IAChE,0BAA0B;IAC1B,mEAAmE;IACnE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC;QAC7F,IAAI,CAAC,QAAQ;YAAE,OAAO;IACxB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,oDAAoD,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,mEAAmE;IACnE,+DAA+D;IAC/D,iEAAiE;IACjE,2DAA2D;IAC3D,uDAAuD;IACvD,mEAAmE;IACnE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACrD,MAAM,EAAE,2BAA2B,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAC9E,qEAAqE;IACrE,+DAA+D;IAC/D,kEAAkE;IAClE,kEAAkE;IAClE,iEAAiE;IACjE,6DAA6D;IAC7D,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,MAAM,2BAA2B,CAAC;QAC5C,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,MAAM;QACN,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5D,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,sBAAsB,GAAG,CAAC,KAAK,IAAI,SAAS,sBAAsB,CAAC,CAAC,CAAC;QACnF,GAAG,CAAC,IAAI,CACN,2DAA2D;YACzD,yDAAyD;YACzD,iDAAiD;YACjD,aAAa,IAAI,CAAC,SAAS,aAAa,CAC3C,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAEvC,mEAAmE;IACnE,mEAAmE;IACnE,mEAAmE;IACnE,uDAAuD;IACvD,mEAAmE;IACnE,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;QACpB,CAAC,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QACjE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC;YACvB,KAAK;YACL,UAAU;YACV,QAAQ;YACR,IAAI,CAAC,WAAW;YAChB,UAAU;YACV,MAAM;YACN,WAAW;YACX,IAAI,CAAC,SAAS;YACd,SAAS;YACT,IAAI,CAAC,QAAQ;YACb,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;YAC5C,MAAM,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,mEAAmE;QACnE,kEAAkE;QAClE,+DAA+D;QAC/D,oEAAoE;QACpE,kEAAkE;QAClE,mEAAmE;QACnE,mEAAmE;QACnE,iEAAiE;QACjE,8CAA8C;QAC9C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC;YACxB,KAAK;YACL,UAAU;YACV,gBAAgB;YAChB,IAAI,CAAC,WAAW;YAChB,UAAU;YACV,MAAM;YACN,WAAW;YACX,IAAI,CAAC,SAAS;YACd,aAAa;YACb,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,kCAAkC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;YACpE,MAAM,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YACtE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,qCAAqC,IAAI,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC;YAC7E,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YACpF,MAAM,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,mEAAmE;QACnE,kEAAkE;QAClE,iEAAiE;QACjE,mEAAmE;QACnE,kEAAkE;QAClE,oEAAoE;QACpE,oEAAoE;QACpE,iEAAiE;QACjE,kEAAkE;QAClE,kEAAkE;QAClE,gEAAgE;QAChE,iEAAiE;QACjE,mCAAmC;QACnC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,cAAc,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QACzE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IACD,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,8CAA8C,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;GAKG;AACH,+EAA+E;AAC/E,SAAS,WAAW,CAAC,IAAc;IACjC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAClE,OAAO,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,qBAAqB;IAClC,IAAI,WAAW,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpD,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC,CAAC;IAExF,iEAAiE;IACjE,6DAA6D;IAC7D,kEAAkE;IAClE,wCAAwC;IACxC,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,WAAW,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;QACxE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC;YAC5B,OAAO,EAAE,8DAA8D;YACvE,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YAC3C,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;YACpB,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;YAC/B,MAAM,aAAa,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE;gBACjE,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;YACH,IAAI,aAAa,CAAC,QAAQ,KAAK,CAAC,IAAI,WAAW,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;gBACvE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;gBACpC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAC9D,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC,CAAC;YAC1C,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,GAAG,CAAC,IAAI,CACN,mBAAmB;QACjB,6CAA6C;QAC7C,+DAA+D;QAC/D,0FAA0F,CAC7F,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,eAAe,CAC5B,KAAoB,EACpB,cAAsB,EACtB,eAAuB,EACvB,YAAoB;IAEpB,+DAA+D;IAC/D,+DAA+D;IAC/D,gEAAgE;IAChE,kEAAkE;IAClE,yBAAyB;IACzB,IAAI,CAAC,CAAC,MAAM,qBAAqB,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAEnD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;QACpB,CAAC,CAAC,KAAK,CAAC,kCAAkC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QACtF,MAAM,OAAO,GAAG,GAAG,cAAc,mBAAmB,eAAe,IAAI,YAAY,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAClH,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS,CAC1B;YACE,QAAQ;YACR,QAAQ;YACR,OAAO;YACP,+BAA+B;YAC/B,2DAA2D;YAC3D,0DAA0D;YAC1D,oDAAoD;YACpD,0FAA0F;YAC1F,2BAA2B;YAC3B,6CAA6C;SAC9C,EACD,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CACnC,CAAC;QACF,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACvD,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,4BAA4B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACrD,GAAG,CAAC,KAAK,CACP,GAAG,CACD,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,kEAAkE;gBACxG,WAAW;gBACX,wCAAwC;gBACxC,iFAAiF;gBACjF,yDAAyD;gBACzD,kBAAkB,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAClD,CACF,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,uBAAuB,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,SAAiB,EACjB,MAAc,EACd,MAAqB;IAErB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAChC,GAAG,CAAC,IAAI,CACN,MAAM,CAAC,gBAAgB,MAAM,CAAC,MAAM,mDAAmD,CAAC,CACzF,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1F,GAAG,CAAC,IAAI,CACN,EAAE;YACA,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,IAAI,wBAAwB,IAAI,CAAC,aAAa,EAAE,CAAC;YACnE,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,IAAI,wCAAwC,CAAC,CAChE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,4DAA4D;AAC5D,4EAA4E;AAE5E,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,CAAC;IAClC,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC5B,GAAG,CAAC,IAAI,CAAC,uBAAuB,IAAI,CAAC,QAAQ,uBAAuB,CAAC,CAAC;QACtE,OAAO;IACT,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,SAAS;QAAE,OAAO;IAE5B,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;IACpB,CAAC,CAAC,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAC1C,cAAc,EACd,qBAAqB,EACrB,IAAI,CAAC,SAAS,CACf,CAAC;IACF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC,CAAC;QACtE,OAAO;IACT,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC;QACrB,KAAK;QACL,SAAS;QACT,QAAQ;QACR,YAAY;QACZ,OAAO;QACP,WAAW;QACX,IAAI,CAAC,SAAS;QACd,eAAe;QACf,oBAAoB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;KAC/C,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACV,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1C,OAAO;IACT,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,kEAAkE,OAAO,KAAK,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,4EAA4E;AAC5E,uBAAuB;AACvB,4EAA4E;AAE5E,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAwB;IAChE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC,CAAC;QACxD,GAAG,CAAC,IAAI,CACN,UAAU;YACR,mBAAmB;YACnB,aAAa;YACb,eAAe;YACf,YAAY;YACZ,mBAAmB;YACnB,gBAAgB;SACjB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACf,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,CAAC;IAClC,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC5B,GAAG,CAAC,IAAI,CAAC,8BAA8B,IAAI,CAAC,QAAQ,uBAAuB,CAAC,CAAC;QAC7E,OAAO;IACT,CAAC;IACD,GAAG,CAAC,IAAI,CACN,MAAM,CACJ,oGAAoG,CACrG,CACF,CAAC;IACF,IAAI,CACF;QACE,IAAI,CAAC,8BAA8B,CAAC;QACpC,EAAE;QACF,KAAK,IAAI,CAAC,wEAAwE,IAAI,4BAA4B,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE;QACrI,EAAE;QACF,yDAAyD;QACzD,KAAK,IAAI,CAAC,sCAAsC,CAAC,EAAE;KACpD,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,eAAe,CAChB,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,oDAAoD;AACpD,4EAA4E;AAE5E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,CAAC;IAElC,GAAG,CAAC,IAAI,CACN,MAAM,CACJ,GAAG,IAAI,CAAC,UAAU,CAAC,2JAA2J,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK;QAClM,2FAA2F,CAC9F,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC;QAC7B,OAAO,EAAE,uBAAuB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,aAAa,CAAC,IAAI;QAC/F,YAAY,EAAE,KAAK;KACpB,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,MAAM,CAAC,YAAY,CAAC,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACtD,CAAC,CAAC,IAAI,CAAC;QACL,OAAO,EAAE,+BAA+B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;QAC3D,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iCAAiC,CAAC;KACrF,CAAC,CACH,CAAC;IACF,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,CAAC,YAAY,CAAC,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;QACpC,GAAG,CAAC,IAAI,CACN,+DAA+D;YAC7D,GAAG,IAAI,CAAC,wFAAwF,CAAC,GAAG;YACpG,2CAA2C,CAC9C,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,cAAc,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACpF,MAAM,EAAE,sBAAsB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACzE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC;QAC7C,MAAM,CAAC,GAAG,MAAM,sBAAsB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,CAAC,oBAAoB,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;YACvC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,CACF;YACE,KAAK,CAAC,0BAA0B,IAAI,CAAC,MAAM,GAAG,CAAC;YAC/C,EAAE;YACF,0EAA0E;YAC1E,yEAAyE;SAC1E,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,MAAM,CACP,CAAC;QACF,OAAO;IACT,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,yCAAyC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,CAAC;IAE7C,GAAG,CAAC,IAAI,CACN,GAAG,CACD,GAAG,IAAI,CAAC,iCAAiC,CAAC,iGAAiG,CAC5I,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC;QAC7B,OAAO,EAAE,2BAA2B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,aAAa,CAAC,IAAI;QACnG,YAAY,EAAE,KAAK;KACpB,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,MAAM,CAAC,YAAY,CAAC,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACtD,CAAC,CAAC,IAAI,CAAC;QACL,OAAO,EAAE,+BAA+B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;QAC3D,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iCAAiC,CAAC;KACrF,CAAC,CACH,CAAC;IACF,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,CAAC,YAAY,CAAC,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QAC9C,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;QACpB,CAAC,CAAC,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,KAAK,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QAC1E,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;YAC1C,GAAG,CAAC,IAAI,CACN,0HAA0H,IAAI,CAAC,SAAS,EAAE,CAC3I,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,SAAS,gDAAgD,CAAC,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAED,GAAG,CAAC,IAAI,CACN,kBAAkB,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,0DAA0D,IAAI,CAAC,UAAU,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,CACnJ,CAAC;IACF,KAAK,UAAU,CAAC,CAAC,sBAAsB;AACzC,CAAC"}
+{"version":3,"file":"lifecycle.js","sourceRoot":"","sources":["../src/lifecycle.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAwB,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACjG,OAAO,EAAE,kBAAkB,EAAoB,MAAM,cAAc,CAAC;AAEpE,uEAAuE;AACvE,SAAS,iBAAiB;IACxB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC;SACjC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;SAC9C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;IAClD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,IAAI;YAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACvC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc;IACrB,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;IAClC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC,CAAC;QAC1D,GAAG,CAAC,IAAI,CACN,OAAO,IAAI,CAAC,8BAA8B,CAAC,2CAA2C,GAAG,CAAC,wBAAwB,CAAC,iCAAiC,CACrJ,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,sBAAsB,CACnC,IAAoC,EACpC,MAAc,EACd,SAAiB,EACjB,MAAe;IAEf,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI,CACP,KAAK,EACL,UAAU,EACV,MAAM,EACN,UAAU,EACV,MAAM,IAAI,cAAc,EACxB,WAAW,EACX,SAAS,EACT,UAAU,EACV,kBAAkB,MAAM,EAAE,EAC1B,+BAA+B,CAChC,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,IAAI,CACP,KAAK,EACL,WAAW,EACX,MAAM,EACN,WAAW,EACX,SAAS,EACT,UAAU,EACV,SAAS,MAAM,EAAE,EACjB,sBAAsB,CACvB,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM;SACrB,IAAI,EAAE;SACN,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED,4EAA4E;AAC5E,uCAAuC;AACvC,4EAA4E;AAE5E,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,CAAC;IAC7C,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC,CAAC;IACrE,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1C,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,eAAe,CAAC,EAAE,CAAC,CAAC;IAEhE,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC5B,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,CAAC,+BAA+B,IAAI,CAAC,QAAQ,uBAAuB,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,IAAI,iBAAiB,GAAwD,IAAI,CAAC;AAClF,KAAK,UAAU,mBAAmB;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,iBAAiB,IAAI,GAAG,GAAG,iBAAiB,CAAC,SAAS,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;QAC5E,OAAO,iBAAiB,CAAC,MAAM,CAAC;IAClC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,kEAAkE,EAAE;YAC1F,OAAO,EAAE,EAAE,MAAM,EAAE,6BAA6B,EAAE;SACnD,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,iBAAiB,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAC;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC;QACrC,iBAAiB,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QAC/C,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAqB;IAC5C,IAAI,CAAC,IAAI,CAAC,SAAS;QAAE,OAAO;IAC5B,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;IACpB,CAAC,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAE7D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC;IAC7C,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAC5C,aAAa,EACb,wBAAwB,EACxB,IAAI,CAAC,SAAS,EACd,MAAM,CACP,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAC1C,cAAc,EACd,qBAAqB,EACrB,IAAI,CAAC,SAAS,CACf,CAAC;IACF,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC,CAAC;QAChF,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC;QAC5B,KAAK;QACL,UAAU;QACV,UAAU;QACV,SAAS;QACT,UAAU;QACV,MAAM;QACN,WAAW;QACX,IAAI,CAAC,SAAS;QACd,4BAA4B;KAC7B,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC;QAC5B,KAAK;QACL,WAAW;QACX,UAAU;QACV,OAAO;QACP,WAAW;QACX,IAAI,CAAC,SAAS;QACd,uBAAuB;KACxB,CAAC,CAAC;IACH,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAEvC,iEAAiE;IACjE,mEAAmE;IACnE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAC9C,MAAM,YAAY,GAAG,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC;IAC1D,MAAM,WAAW,GACf,YAAY,IAAI,YAAY,KAAK,aAAa;QAC5C,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,YAAY,YAAY,CAAC,iDAAiD;QAC1F,CAAC,CAAC,YAAY,KAAK,aAAa;YAC9B,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;YACrB,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAEhC,IAAI,CACF;QACE,GAAG,GAAG,CAAC,qBAAqB,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;QAC7F,GAAG,GAAG,CAAC,iBAAiB,CAAC,QAAQ,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;QAC5F,GAAG,GAAG,CAAC,aAAa,CAAC,aAAa,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE;QAClE,GAAG,GAAG,CAAC,mBAAmB,CAAC,OAAO,IAAI,CAAC,iBAAiB,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE;QACxE,GAAG,GAAG,CAAC,aAAa,CAAC,cAAc,aAAa,KAAK,WAAW,EAAE;KACnE,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,QAAQ,CACT,CAAC;AACJ,CAAC;AA2BD;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAC7B,MAAc,EACd,OAAe,EACf,IAAY,EACZ,KAAa,EACb,GAAW;IAEX,MAAM,GAAG,GAAG,WAAW,MAAM,sBAAsB,OAAO,IAAI,IAAI,IAAI,KAAK,cAAc,GAAG,EAAE,CAAC;IAC/F,qEAAqE;IACrE,mEAAmE;IACnE,iEAAiE;IACjE,+CAA+C;IAC/C,MAAM,MAAM,GAAG;QACb,sDAAsD;QACtD,4CAA4C;QAC5C,2DAA2D;QAC3D,yCAAyC;KAC1C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACZ,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC;QACvE,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,MAAM,IAAI,WAAW,EAAE,EAAE,CAAC;QACrF,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,KAAK,UAAU,mBAAmB,CAChC,SAAiB,EACjB,MAAc,EACd,WAAmB;IAEnB,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC;QACrB,KAAK;QACL,UAAU;QACV,UAAU;QACV,WAAW;QACX,UAAU;QACV,MAAM;QACN,WAAW;QACX,SAAS;QACT,gDAAgD;KACjD,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACnD,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,2EAA2E;AAC3E,KAAK,UAAU,cAAc,CAC3B,SAAiB,EACjB,MAAc,EACd,WAAmB;IAEnB,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC;QACrB,KAAK;QACL,UAAU;QACV,UAAU;QACV,WAAW;QACX,UAAU;QACV,MAAM;QACN,WAAW;QACX,SAAS;QACT,4BAA4B;KAC7B,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,SAAiB,EACjB,MAAc,EACd,WAAmB,EACnB,aAAqB;IAErB,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC;QACrB,KAAK;QACL,UAAU;QACV,gBAAgB;QAChB,WAAW;QACX,UAAU;QACV,MAAM;QACN,WAAW;QACX,SAAS;QACT,gBAAgB;QAChB,GAAG,aAAa,MAAM;QACtB,SAAS;KACV,CAAC,CAAC;IACH,OAAO,CAAC,CAAC,EAAE,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,uBAAuB,CACpC,IAAqB,EACrB,MAAc,EACd,gBAAwB;IAExB,IAAI,IAAI,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC;QACrB,SAAS;QACT,kBAAkB;QAClB,MAAM;QACN,UAAU;QACV,aAAa,IAAI,CAAC,SAAS,EAAE;QAC7B,+CAA+C;QAC/C,sBAAsB;KACvB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACnE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAoB,EAAE;IACzD,MAAM,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,CAAC;IAClC,qEAAqE;IACrE,6DAA6D;IAC7D,qEAAqE;IACrE,mEAAmE;IACnE,mEAAmE;IACnE,4DAA4D;IAC5D,0BAA0B;IAC1B,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;QAChE,GAAG,CAAC,IAAI,CAAC,wBAAwB,IAAI,CAAC,QAAQ,uBAAuB,CAAC,CAAC;QACvE,OAAO;IACT,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,SAAS;QAAE,OAAO;IAE5B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC;IAC7C,MAAM,eAAe,GAAG,eAAe,CAAC;IACxC,MAAM,cAAc,GAAG,cAAc,CAAC;IACtC,MAAM,YAAY,GAAG,kBAAkB,CAAC;IAExC,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE;QACtB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;QAC7F,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACvC,IAAI,IAAI,CAAC,OAAO,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC;QAC3C,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC,EAAE,CAAC;IACL,GAAG,CAAC,IAAI,CAAC,gCAAgC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAE5D,mEAAmE;IACnE,iEAAiE;IACjE,kEAAkE;IAClE,qEAAqE;IACrE,mEAAmE;IACnE,MAAM,KAAK,GAAkB,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,KAAK,CAAC,uEAAuE,CAAC,CAAC;IACpF,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,SAAS,CAAU,EAAE,CAAC;QACjD,MAAM,WAAW,GAAG,MAAM,sBAAsB,CAC9C,aAAa,EACb,oBAAoB,IAAI,EAAE,EAC1B,IAAI,CAAC,SAAS,EACd,MAAM,CACP,CAAC;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,mCAAmC,IAAI,qBAAqB,CAAC,CAAC,CAAC;YAC7E,OAAO;QACT,CAAC;QACD,kEAAkE;QAClE,oEAAoE;QACpE,iEAAiE;QACjE,+DAA+D;QAC/D,gEAAgE;QAChE,8DAA8D;QAC9D,6DAA6D;QAC7D,8DAA8D;QAC9D,2DAA2D;QAC3D,MAAM,SAAS,GAAG,MAAM,gBAAgB,CACtC,cAAc,EACd,eAAe,EACf,YAAY,EACZ,IAAI,EACJ,SAAS,CACV,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,qCAAqC,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC;YACzE,GAAG,CAAC,KAAK,CACP,4BAA4B,SAAS,CAAC,MAAM,KAAK;gBAC/C,oCAAoC,cAAc,mBAAmB,eAAe,IAAI,YAAY,IAAI,IAAI,IAAI,SAAS,IAAI;gBAC7H,2GAA2G,CAC9G,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;QAChC,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACrF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,0CAA0C,IAAI,qBAAqB,CAAC,CAAC,CAAC;YACpF,OAAO;QACT,CAAC;QACD,KAAK,CAAC,IAAI,CAAC;YACT,IAAI;YACJ,WAAW;YACX,MAAM;YACN,QAAQ,EAAE,GAAG,cAAc,mBAAmB,eAAe,IAAI,YAAY,IAAI,IAAI,IAAI,MAAM,EAAE;YACjG,aAAa;SACd,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,KAAK,CAAC,MAAM,mBAAmB,CAAC,CAAC,CAAC;IAErE,mEAAmE;IACnE,8DAA8D;IAC9D,kEAAkE;IAClE,kEAAkE;IAClE,0CAA0C;IAC1C,EAAE;IACF,mEAAmE;IACnE,mEAAmE;IACnE,gEAAgE;IAChE,0BAA0B;IAC1B,mEAAmE;IACnE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC;QAC7F,IAAI,CAAC,QAAQ;YAAE,OAAO;IACxB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,oDAAoD,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,mEAAmE;IACnE,+DAA+D;IAC/D,iEAAiE;IACjE,2DAA2D;IAC3D,uDAAuD;IACvD,mEAAmE;IACnE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACrD,MAAM,EAAE,2BAA2B,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAC9E,qEAAqE;IACrE,+DAA+D;IAC/D,kEAAkE;IAClE,kEAAkE;IAClE,iEAAiE;IACjE,6DAA6D;IAC7D,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,MAAM,2BAA2B,CAAC;QAC5C,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,MAAM;QACN,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5D,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,sBAAsB,GAAG,CAAC,KAAK,IAAI,SAAS,sBAAsB,CAAC,CAAC,CAAC;QACnF,GAAG,CAAC,IAAI,CACN,2DAA2D;YACzD,yDAAyD;YACzD,iDAAiD;YACjD,aAAa,IAAI,CAAC,SAAS,aAAa,CAC3C,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAEvC,mEAAmE;IACnE,mEAAmE;IACnE,uEAAuE;IACvE,sEAAsE;IACtE,wEAAwE;IACxE,oEAAoE;IACpE,iEAAiE;IACjE,mEAAmE;IACnE,IAAI,iBAAiB,GAAkB,IAAI,CAAC;IAC5C,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC;QACpF,MAAM,GAAG,GAAG,QAAQ;YAClB,CAAC,CAAC,MAAM,kBAAkB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC;YACnE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAc,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC;QACzE,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,iBAAiB,GAAG,GAAG,CAAC,cAAc,CAAC;YACvC,IAAI,CAAC,IAAI,CACP,KAAK,CAAC,qBAAqB,GAAG,CAAC,cAAc,KAAK,GAAG,CAAC,SAAS,CAAC,MAAM,eAAe,CAAC,CACvF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,8BAA8B,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAC7D,GAAG,CAAC,IAAI,CACN,sFAAsF,CACvF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,mEAAmE;IACnE,mEAAmE;IACnE,uDAAuD;IACvD,mEAAmE;IACnE,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;QACpB,CAAC,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QACjE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC;YACvB,KAAK;YACL,UAAU;YACV,QAAQ;YACR,IAAI,CAAC,WAAW;YAChB,UAAU;YACV,MAAM;YACN,WAAW;YACX,IAAI,CAAC,SAAS;YACd,SAAS;YACT,IAAI,CAAC,QAAQ;YACb,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,iBAAiB;gBAC5C,CAAC,CAAC,CAAC,mDAAmD,iBAAiB,EAAE,CAAC;gBAC1E,CAAC,CAAC,EAAE,CAAC;YACP,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;YAC5C,MAAM,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,mEAAmE;QACnE,kEAAkE;QAClE,+DAA+D;QAC/D,oEAAoE;QACpE,kEAAkE;QAClE,mEAAmE;QACnE,mEAAmE;QACnE,iEAAiE;QACjE,8CAA8C;QAC9C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC;YACxB,KAAK;YACL,UAAU;YACV,gBAAgB;YAChB,IAAI,CAAC,WAAW;YAChB,UAAU;YACV,MAAM;YACN,WAAW;YACX,IAAI,CAAC,SAAS;YACd,aAAa;YACb,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,kCAAkC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;YACpE,MAAM,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YACtE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,qCAAqC,IAAI,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC;YAC7E,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YACpF,MAAM,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,mEAAmE;QACnE,kEAAkE;QAClE,iEAAiE;QACjE,mEAAmE;QACnE,kEAAkE;QAClE,oEAAoE;QACpE,oEAAoE;QACpE,iEAAiE;QACjE,kEAAkE;QAClE,kEAAkE;QAClE,gEAAgE;QAChE,iEAAiE;QACjE,mCAAmC;QACnC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,cAAc,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QACzE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IACD,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,8CAA8C,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;GAKG;AACH,+EAA+E;AAC/E,SAAS,WAAW,CAAC,IAAc;IACjC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAClE,OAAO,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,qBAAqB;IAClC,IAAI,WAAW,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpD,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC,CAAC;IAExF,iEAAiE;IACjE,6DAA6D;IAC7D,kEAAkE;IAClE,wCAAwC;IACxC,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,WAAW,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;QACxE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC;YAC5B,OAAO,EAAE,8DAA8D;YACvE,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YAC3C,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;YACpB,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;YAC/B,MAAM,aAAa,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE;gBACjE,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;YACH,IAAI,aAAa,CAAC,QAAQ,KAAK,CAAC,IAAI,WAAW,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;gBACvE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;gBACpC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAC9D,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC,CAAC;YAC1C,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,GAAG,CAAC,IAAI,CACN,mBAAmB;QACjB,6CAA6C;QAC7C,+DAA+D;QAC/D,0FAA0F,CAC7F,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,eAAe,CAC5B,KAAoB,EACpB,cAAsB,EACtB,eAAuB,EACvB,YAAoB;IAEpB,+DAA+D;IAC/D,+DAA+D;IAC/D,gEAAgE;IAChE,kEAAkE;IAClE,yBAAyB;IACzB,IAAI,CAAC,CAAC,MAAM,qBAAqB,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAEnD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;QACpB,CAAC,CAAC,KAAK,CAAC,kCAAkC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QACtF,MAAM,OAAO,GAAG,GAAG,cAAc,mBAAmB,eAAe,IAAI,YAAY,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAClH,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS,CAC1B;YACE,QAAQ;YACR,QAAQ;YACR,OAAO;YACP,+BAA+B;YAC/B,2DAA2D;YAC3D,0DAA0D;YAC1D,oDAAoD;YACpD,0FAA0F;YAC1F,2BAA2B;YAC3B,6CAA6C;SAC9C,EACD,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CACnC,CAAC;QACF,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACvD,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,4BAA4B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACrD,GAAG,CAAC,KAAK,CACP,GAAG,CACD,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,kEAAkE;gBACxG,WAAW;gBACX,wCAAwC;gBACxC,iFAAiF;gBACjF,yDAAyD;gBACzD,kBAAkB,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAClD,CACF,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,uBAAuB,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,SAAiB,EACjB,MAAc,EACd,MAAqB;IAErB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAChC,GAAG,CAAC,IAAI,CACN,MAAM,CAAC,gBAAgB,MAAM,CAAC,MAAM,mDAAmD,CAAC,CACzF,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1F,GAAG,CAAC,IAAI,CACN,EAAE;YACA,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,IAAI,wBAAwB,IAAI,CAAC,aAAa,EAAE,CAAC;YACnE,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,IAAI,wCAAwC,CAAC,CAChE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,4DAA4D;AAC5D,4EAA4E;AAE5E,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,CAAC;IAClC,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC5B,GAAG,CAAC,IAAI,CAAC,uBAAuB,IAAI,CAAC,QAAQ,uBAAuB,CAAC,CAAC;QACtE,OAAO;IACT,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,SAAS;QAAE,OAAO;IAE5B,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;IACpB,CAAC,CAAC,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAC1C,cAAc,EACd,qBAAqB,EACrB,IAAI,CAAC,SAAS,CACf,CAAC;IACF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC,CAAC;QACtE,OAAO;IACT,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC;QACrB,KAAK;QACL,SAAS;QACT,QAAQ;QACR,YAAY;QACZ,OAAO;QACP,WAAW;QACX,IAAI,CAAC,SAAS;QACd,eAAe;QACf,oBAAoB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;KAC/C,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACV,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1C,OAAO;IACT,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,kEAAkE,OAAO,KAAK,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,4EAA4E;AAC5E,uBAAuB;AACvB,4EAA4E;AAE5E,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAwB;IAChE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC,CAAC;QACxD,GAAG,CAAC,IAAI,CACN,UAAU;YACR,mBAAmB;YACnB,aAAa;YACb,eAAe;YACf,YAAY;YACZ,mBAAmB;YACnB,gBAAgB;SACjB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACf,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,CAAC;IAClC,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC5B,GAAG,CAAC,IAAI,CAAC,8BAA8B,IAAI,CAAC,QAAQ,uBAAuB,CAAC,CAAC;QAC7E,OAAO;IACT,CAAC;IACD,GAAG,CAAC,IAAI,CACN,MAAM,CACJ,oGAAoG,CACrG,CACF,CAAC;IACF,IAAI,CACF;QACE,IAAI,CAAC,8BAA8B,CAAC;QACpC,EAAE;QACF,KAAK,IAAI,CAAC,wEAAwE,IAAI,4BAA4B,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE;QACrI,EAAE;QACF,yDAAyD;QACzD,KAAK,IAAI,CAAC,sCAAsC,CAAC,EAAE;KACpD,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,eAAe,CAChB,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,oDAAoD;AACpD,4EAA4E;AAE5E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,CAAC;IAElC,GAAG,CAAC,IAAI,CACN,MAAM,CACJ,GAAG,IAAI,CAAC,UAAU,CAAC,2JAA2J,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK;QAClM,2FAA2F,CAC9F,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC;QAC7B,OAAO,EAAE,uBAAuB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,aAAa,CAAC,IAAI;QAC/F,YAAY,EAAE,KAAK;KACpB,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,MAAM,CAAC,YAAY,CAAC,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACtD,CAAC,CAAC,IAAI,CAAC;QACL,OAAO,EAAE,+BAA+B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;QAC3D,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iCAAiC,CAAC;KACrF,CAAC,CACH,CAAC;IACF,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,CAAC,YAAY,CAAC,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;QACpC,GAAG,CAAC,IAAI,CACN,+DAA+D;YAC7D,GAAG,IAAI,CAAC,wFAAwF,CAAC,GAAG;YACpG,2CAA2C,CAC9C,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,cAAc,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACpF,MAAM,EAAE,sBAAsB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACzE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC;QAC7C,MAAM,CAAC,GAAG,MAAM,sBAAsB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,CAAC,oBAAoB,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;YACvC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,CACF;YACE,KAAK,CAAC,0BAA0B,IAAI,CAAC,MAAM,GAAG,CAAC;YAC/C,EAAE;YACF,0EAA0E;YAC1E,yEAAyE;SAC1E,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,MAAM,CACP,CAAC;QACF,OAAO;IACT,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,yCAAyC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,CAAC;IAE7C,GAAG,CAAC,IAAI,CACN,GAAG,CACD,GAAG,IAAI,CAAC,iCAAiC,CAAC,iGAAiG,CAC5I,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC;QAC7B,OAAO,EAAE,2BAA2B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,aAAa,CAAC,IAAI;QACnG,YAAY,EAAE,KAAK;KACpB,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,MAAM,CAAC,YAAY,CAAC,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACtD,CAAC,CAAC,IAAI,CAAC;QACL,OAAO,EAAE,+BAA+B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;QAC3D,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iCAAiC,CAAC;KACrF,CAAC,CACH,CAAC;IACF,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,CAAC,YAAY,CAAC,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QAC9C,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;QACpB,CAAC,CAAC,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,KAAK,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QAC1E,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;YAC1C,GAAG,CAAC,IAAI,CACN,0HAA0H,IAAI,CAAC,SAAS,EAAE,CAC3I,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,SAAS,gDAAgD,CAAC,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAED,GAAG,CAAC,IAAI,CACN,kBAAkB,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,0DAA0D,IAAI,CAAC,UAAU,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,CACnJ,CAAC;IACF,KAAK,UAAU,CAAC,CAAC,sBAAsB;AACzC,CAAC"}

package/dist/mcp-iap.d.ts

@@ -0,0 +1,49 @@
+/**
+ * MCP access through IAP (issue #37), for installs that exist already.
+ *
+ * External MCP clients reach the IAP-protected admin with a JWT signed by a
+ * dedicated service account (see packages/mcp-server/src/ingress-auth.ts).
+ * New installs get that SA from the Pulumi stacks; `cms-provision upgrade`
+ * calls {@link ensureMcpIapAccess} so installs provisioned before it get the
+ * same setup on their next upgrade, with no operator config:
+ *
+ *   1. service account `caelo-mcp@<project>` (created if missing)
+ *   2. `roles/iap.httpsResourceAccessor` for that SA on the admin's IAP
+ *      resource (Cloud Run service on gcp-firebase, LB backend on gcp)
+ *   3. `roles/iam.serviceAccountTokenCreator` on that SA for every user /
+ *      group the IAP policy already lets in — exactly the people who can
+ *      open the admin in a browser can also drive it over MCP
+ *
+ * Every step is an additive IAM binding or a create-if-missing, so re-running
+ * is a no-op. The caller puts the returned email into the admin's
+ * `CAELO_MCP_IAP_SERVICE_ACCOUNT` env var, which /security/mcp shows in the
+ * `claude mcp add` command.
+ */
+import { type GcloudResult } from "./gcloud.js";
+export declare const MCP_IAP_SERVICE_ACCOUNT_ID = "caelo-mcp";
+export declare function mcpIapServiceAccountEmail(projectId: string): string;
+/** The admin's IAP resource, as `gcloud iap web` addresses it. */
+export type IapResource = {
+    readonly kind: "cloud-run";
+    readonly service: string;
+    readonly region: string;
+} | {
+    readonly kind: "backend-services";
+    readonly service: string;
+};
+/** Users and groups IAP lets into the admin (service accounts excluded). */
+export declare function iapOperators(policyJson: string): string[];
+export declare function ensureMcpIapAccess(opts: {
+    projectId: string;
+    resource: IapResource;
+    run?: (args: string[]) => Promise<GcloudResult>;
+    sleep?: (ms: number) => Promise<void>;
+}): Promise<{
+    ok: true;
+    serviceAccount: string;
+    operators: string[];
+} | {
+    ok: false;
+    error: string;
+}>;
+//# sourceMappingURL=mcp-iap.d.ts.map

package/dist/mcp-iap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-iap.d.ts","sourceRoot":"","sources":["../src/mcp-iap.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAA2B,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAEzE,eAAO,MAAM,0BAA0B,cAAc,CAAC;AAEtD,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,kEAAkE;AAClE,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACjF;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAQpE,4EAA4E;AAC5E,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAQzD;AAKD,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,WAAW,CAAC;IACtB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAChD,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC,GAAG,OAAO,CACT;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CACzF,CAgFA"}

package/dist/mcp-iap.js

@@ -0,0 +1,122 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * MCP access through IAP (issue #37), for installs that exist already.
+ *
+ * External MCP clients reach the IAP-protected admin with a JWT signed by a
+ * dedicated service account (see packages/mcp-server/src/ingress-auth.ts).
+ * New installs get that SA from the Pulumi stacks; `cms-provision upgrade`
+ * calls {@link ensureMcpIapAccess} so installs provisioned before it get the
+ * same setup on their next upgrade, with no operator config:
+ *
+ *   1. service account `caelo-mcp@<project>` (created if missing)
+ *   2. `roles/iap.httpsResourceAccessor` for that SA on the admin's IAP
+ *      resource (Cloud Run service on gcp-firebase, LB backend on gcp)
+ *   3. `roles/iam.serviceAccountTokenCreator` on that SA for every user /
+ *      group the IAP policy already lets in — exactly the people who can
+ *      open the admin in a browser can also drive it over MCP
+ *
+ * Every step is an additive IAM binding or a create-if-missing, so re-running
+ * is a no-op. The caller puts the returned email into the admin's
+ * `CAELO_MCP_IAP_SERVICE_ACCOUNT` env var, which /security/mcp shows in the
+ * `claude mcp add` command.
+ */
+import { gcloud as defaultGcloud } from "./gcloud.js";
+export const MCP_IAP_SERVICE_ACCOUNT_ID = "caelo-mcp";
+export function mcpIapServiceAccountEmail(projectId) {
+    return `${MCP_IAP_SERVICE_ACCOUNT_ID}@${projectId}.iam.gserviceaccount.com`;
+}
+function iapResourceArgs(resource) {
+    return resource.kind === "cloud-run"
+        ? ["--resource-type=cloud-run", `--service=${resource.service}`, `--region=${resource.region}`]
+        : ["--resource-type=backend-services", `--service=${resource.service}`];
+}
+/** Users and groups IAP lets into the admin (service accounts excluded). */
+export function iapOperators(policyJson) {
+    const policy = JSON.parse(policyJson);
+    const members = (policy.bindings ?? [])
+        .filter((b) => b.role === "roles/iap.httpsResourceAccessor" && !b.condition)
+        .flatMap((b) => b.members ?? []);
+    return [...new Set(members.filter((m) => m.startsWith("user:") || m.startsWith("group:")))];
+}
+const SA_NOT_YET_VISIBLE = /does not exist|not found|NOT_FOUND/i;
+const RETRY_DELAYS_MS = [2_000, 4_000, 8_000, 16_000];
+export async function ensureMcpIapAccess(opts) {
+    const run = opts.run ?? defaultGcloud;
+    const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const project = `--project=${opts.projectId}`;
+    const sa = mcpIapServiceAccountEmail(opts.projectId);
+    // A freshly created SA takes a few seconds to become bindable.
+    const withRetry = async (args) => {
+        let r = await run(args);
+        for (const delay of RETRY_DELAYS_MS) {
+            if (r.ok || !SA_NOT_YET_VISIBLE.test(r.stderr))
+                break;
+            await sleep(delay);
+            r = await run(args);
+        }
+        return r;
+    };
+    const describe = await run([
+        "iam",
+        "service-accounts",
+        "describe",
+        sa,
+        project,
+        "--format=value(email)",
+    ]);
+    if (!describe.ok) {
+        const create = await run([
+            "iam",
+            "service-accounts",
+            "create",
+            MCP_IAP_SERVICE_ACCOUNT_ID,
+            "--display-name=Caelo MCP (IAP ingress)",
+            "--description=Signs the IAP credential external MCP clients use to reach the admin (issue #37).",
+            project,
+        ]);
+        if (!create.ok && !/already exists/i.test(create.stderr)) {
+            return { ok: false, error: `create ${sa}: ${create.stderr.trim()}` };
+        }
+    }
+    const policy = await run([
+        "iap",
+        "web",
+        "get-iam-policy",
+        ...iapResourceArgs(opts.resource),
+        project,
+        "--format=json",
+    ]);
+    if (!policy.ok)
+        return { ok: false, error: `read IAP policy: ${policy.stderr.trim()}` };
+    const operators = iapOperators(policy.stdout);
+    const allow = await withRetry([
+        "iap",
+        "web",
+        "add-iam-policy-binding",
+        ...iapResourceArgs(opts.resource),
+        `--member=serviceAccount:${sa}`,
+        "--role=roles/iap.httpsResourceAccessor",
+        "--condition=None",
+        project,
+        "--quiet",
+    ]);
+    if (!allow.ok)
+        return { ok: false, error: `allow ${sa} on IAP: ${allow.stderr.trim()}` };
+    for (const member of operators) {
+        const grant = await withRetry([
+            "iam",
+            "service-accounts",
+            "add-iam-policy-binding",
+            sa,
+            `--member=${member}`,
+            "--role=roles/iam.serviceAccountTokenCreator",
+            "--condition=None",
+            project,
+            "--quiet",
+        ]);
+        if (!grant.ok)
+            return { ok: false, error: `let ${member} sign as ${sa}: ${grant.stderr.trim()}` };
+    }
+    return { ok: true, serviceAccount: sa, operators };
+}
+//# sourceMappingURL=mcp-iap.js.map

package/dist/mcp-iap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-iap.js","sourceRoot":"","sources":["../src/mcp-iap.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,MAAM,IAAI,aAAa,EAAqB,MAAM,aAAa,CAAC;AAEzE,MAAM,CAAC,MAAM,0BAA0B,GAAG,WAAW,CAAC;AAEtD,MAAM,UAAU,yBAAyB,CAAC,SAAiB;IACzD,OAAO,GAAG,0BAA0B,IAAI,SAAS,0BAA0B,CAAC;AAC9E,CAAC;AAOD,SAAS,eAAe,CAAC,QAAqB;IAC5C,OAAO,QAAQ,CAAC,IAAI,KAAK,WAAW;QAClC,CAAC,CAAC,CAAC,2BAA2B,EAAE,aAAa,QAAQ,CAAC,OAAO,EAAE,EAAE,YAAY,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC/F,CAAC,CAAC,CAAC,kCAAkC,EAAE,aAAa,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,YAAY,CAAC,UAAkB;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAEnC,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;SACpC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,iCAAiC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;SAC3E,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9F,CAAC;AAED,MAAM,kBAAkB,GAAG,qCAAqC,CAAC;AACjE,MAAM,eAAe,GAAsB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAEzE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAKxC;IAGC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1F,MAAM,OAAO,GAAG,aAAa,IAAI,CAAC,SAAS,EAAE,CAAC;IAC9C,MAAM,EAAE,GAAG,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAErD,+DAA+D;IAC/D,MAAM,SAAS,GAAG,KAAK,EAAE,IAAc,EAAyB,EAAE;QAChE,IAAI,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;YACpC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;gBAAE,MAAM;YACtD,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;YACnB,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;QACzB,KAAK;QACL,kBAAkB;QAClB,UAAU;QACV,EAAE;QACF,OAAO;QACP,uBAAuB;KACxB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;YACvB,KAAK;YACL,kBAAkB;YAClB,QAAQ;YACR,0BAA0B;YAC1B,wCAAwC;YACxC,iGAAiG;YACjG,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QACvE,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;QACvB,KAAK;QACL,KAAK;QACL,gBAAgB;QAChB,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC;QACjC,OAAO;QACP,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACxF,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAE9C,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC;QAC5B,KAAK;QACL,KAAK;QACL,wBAAwB;QACxB,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC;QACjC,2BAA2B,EAAE,EAAE;QAC/B,wCAAwC;QACxC,kBAAkB;QAClB,OAAO;QACP,SAAS;KACV,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IAEzF,KAAK,MAAM,MAAM,IAAI,SAAS,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC;YAC5B,KAAK;YACL,kBAAkB;YAClB,wBAAwB;YACxB,EAAE;YACF,YAAY,MAAM,EAAE;YACpB,6CAA6C;YAC7C,kBAAkB;YAClB,OAAO;YACP,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,EAAE;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,MAAM,YAAY,EAAE,KAAK,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACvF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;AACrD,CAAC"}

package/dist/wizards/gcp-pulumi.d.ts

@@ -33,6 +33,16 @@ export interface PulumiUpResult {
         deleted: number;
     };
 }
+/**
+ * Pick the stack's `secretReplication` (see stacks/<provider>/index.ts).
+ * A value already in config wins. Otherwise secrets that already exist
+ * in state with `auto` replication keep it — switching would replace
+ * them — and everything else (new stacks) gets `regional`.
+ */
+export declare function resolveSecretReplication(configured: string | undefined, stateResources: ReadonlyArray<{
+    type?: string;
+    outputs?: Record<string, unknown>;
+}>): "auto" | "regional";
 /**
  * Run `pulumi up` against the GCP stack via the Automation SDK.
  * Streams resource-create events to the supplied onEvent callback so

package/dist/wizards/gcp-pulumi.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gcp-pulumi.d.ts","sourceRoot":"","sources":["../../src/wizards/gcp-pulumi.ts"],"names":[],"mappings":"AAeA,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB;;yEAEqE;IACrE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,KAAK,GAAG,cAAc,CAAC;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,aAAa,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACtE;AAeD;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,GAAG,KAAK,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,GACrE,OAAO,CAAC,cAAc,CAAC,CA8FzB"}
+{"version":3,"file":"gcp-pulumi.d.ts","sourceRoot":"","sources":["../../src/wizards/gcp-pulumi.ts"],"names":[],"mappings":"AAeA,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB;;yEAEqE;IACrE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,KAAK,GAAG,cAAc,CAAC;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,aAAa,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACtE;AAeD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,cAAc,EAAE,aAAa,CAAC;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,GAClF,MAAM,GAAG,UAAU,CAWrB;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,GAAG,KAAK,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,GACrE,OAAO,CAAC,cAAc,CAAC,CAgHzB"}

package/dist/wizards/gcp-pulumi.js

@@ -22,6 +22,26 @@ function gcpStackWorkDir(provider = "gcp") {
     // levels up + into the provider-specific stack folder.
     return resolvePath(import.meta.dir, `../../stacks/${provider}`);
 }
+/**
+ * Pick the stack's `secretReplication` (see stacks/<provider>/index.ts).
+ * A value already in config wins. Otherwise secrets that already exist
+ * in state with `auto` replication keep it — switching would replace
+ * them — and everything else (new stacks) gets `regional`.
+ */
+export function resolveSecretReplication(configured, stateResources) {
+    if (configured === "auto" || configured === "regional")
+        return configured;
+    if (configured !== undefined) {
+        throw new Error(`secretReplication must be "auto" or "regional", got "${configured}"`);
+    }
+    const hasAutoSecret = stateResources.some((r) => {
+        if (r.type !== "gcp:secretmanager/secret:Secret")
+            return false;
+        const replication = r.outputs?.replication;
+        return replication?.auto != null;
+    });
+    return hasAutoSecret ? "auto" : "regional";
+}
 /**
  * Run `pulumi up` against the GCP stack via the Automation SDK.
  * Streams resource-create events to the supplied onEvent callback so
@@ -76,6 +96,15 @@ export async function pulumiUpGcp(inputs, onEvent) {
             { value: digest },
         ])),
     });
+    // Read back only after the required keys are set: `pulumi config` refuses to
+    // list a stack that lacks them, which is every fresh stack.
+    const configuredReplication = await stack.getConfig(`${ns}:secretReplication`).then((v) => v.value, (e) => {
+        if (/not found/i.test(String(e)))
+            return undefined;
+        throw e;
+    });
+    const secretReplication = resolveSecretReplication(configuredReplication, ((await stack.exportStack()).deployment?.resources ?? []));
+    await stack.setConfig(`${ns}:secretReplication`, { value: secretReplication });
     // Refresh state first to detect drift from any out-of-band changes.
     await stack.refresh({ onOutput: (msg) => onEvent("log", msg) });
     // Run `up`. The onEvent callback receives the same JSON-RPC events

package/dist/wizards/gcp-pulumi.js.map

@@ -1 +1 @@
-{"version":3,"file":"gcp-pulumi.js","sourceRoot":"","sources":["../../src/wizards/gcp-pulumi.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;GAQG;AAEH,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,KAAK,MAAM,MAAM,2BAA2B,CAAC;AAmCpD;;;;GAIG;AACH,SAAS,eAAe,CAAC,WAAmC,KAAK;IAC/D,+DAA+D;IAC/D,mEAAmE;IACnE,6DAA6D;IAC7D,uDAAuD;IACvD,OAAO,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,QAAQ,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAsB,EACtB,OAAsE;IAEtE,mDAAmD;IACnD,mEAAmE;IACnE,sEAAsE;IACtE,MAAM,GAAG,GAA2B;QAClC,GAAI,OAAO,CAAC,GAA8B;QAC1C,wBAAwB,EAAE,MAAM,CAAC,gBAAgB;QACjD,8BAA8B,EAAE,MAAM,CAAC,SAAS;QAChD,kEAAkE;QAClE,kBAAkB,EAAE,UAAU,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE;KAClE,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC;IAC1C,MAAM,SAAS,GAAG,YAAY,CAAC;IAC/B,MAAM,OAAO,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC1C,+DAA+D;IAC/D,iDAAiD;IACjD,MAAM,EAAE,GAAG,SAAS,QAAQ,EAAE,CAAC;IAE/B,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,mBAAmB,CAC3D;QACE,SAAS;QACT,OAAO;KACR,EACD;QACE,OAAO,EAAE,GAAG;KACb,CACF,CAAC;IAEF,qEAAqE;IACrE,wDAAwD;IACxD,mEAAmE;IACnE,8DAA8D;IAC9D,MAAM,KAAK,CAAC,YAAY,CAAC;QACvB,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE;QAC9C,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE;QAC1C,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE;QAClD,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE;QAC1C,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE;QACtD,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE;QAC1D,CAAC,GAAG,EAAE,oBAAoB,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE;QACxE,CAAC,GAAG,EAAE,sBAAsB,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE;QAC5E,GAAG,CAAC,QAAQ,KAAK,KAAK;YACpB,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,wBAAwB,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,EAAE,EAAE;YACtF,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QAChE,2DAA2D;QAC3D,8DAA8D;QAC9D,8DAA8D;QAC9D,wCAAwC;QACxC,GAAG,MAAM,CAAC,WAAW,CACnB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;YAC7D,GAAG,EAAE,iBAAiB,OAAO,EAAE;YAC/B,EAAE,KAAK,EAAE,MAAM,EAAE;SAClB,CAAC,CACH;KACF,CAAC,CAAC;IAEH,oEAAoE;IACpE,MAAM,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhE,mEAAmE;IACnE,0CAA0C;IAC1C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;QACtC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YACjB,0DAA0D;YAC1D,0DAA0D;YAC1D,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;gBAC3B,OAAO,CACL,OAAO,EACP,GAAG,KAAK,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,KAAK,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAC3E,CAAC;YACJ,CAAC;iBAAM,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;gBACjC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC;IAC9C,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;IACvB,CAAC;IAED,OAAO;QACL,OAAO;QACP,aAAa,EAAE;YACb,OAAO,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC;YAC5B,OAAO,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC;YAC5B,OAAO,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC;SAC7B;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"gcp-pulumi.js","sourceRoot":"","sources":["../../src/wizards/gcp-pulumi.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;GAQG;AAEH,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,KAAK,MAAM,MAAM,2BAA2B,CAAC;AAmCpD;;;;GAIG;AACH,SAAS,eAAe,CAAC,WAAmC,KAAK;IAC/D,+DAA+D;IAC/D,mEAAmE;IACnE,6DAA6D;IAC7D,uDAAuD;IACvD,OAAO,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,QAAQ,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAA8B,EAC9B,cAAmF;IAEnF,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,UAAU;QAAE,OAAO,UAAU,CAAC;IAC1E,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,wDAAwD,UAAU,GAAG,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,aAAa,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAC9C,IAAI,CAAC,CAAC,IAAI,KAAK,iCAAiC;YAAE,OAAO,KAAK,CAAC;QAC/D,MAAM,WAAW,GAAG,CAAC,CAAC,OAAO,EAAE,WAA6C,CAAC;QAC7E,OAAO,WAAW,EAAE,IAAI,IAAI,IAAI,CAAC;IACnC,CAAC,CAAC,CAAC;IACH,OAAO,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAsB,EACtB,OAAsE;IAEtE,mDAAmD;IACnD,mEAAmE;IACnE,sEAAsE;IACtE,MAAM,GAAG,GAA2B;QAClC,GAAI,OAAO,CAAC,GAA8B;QAC1C,wBAAwB,EAAE,MAAM,CAAC,gBAAgB;QACjD,8BAA8B,EAAE,MAAM,CAAC,SAAS;QAChD,kEAAkE;QAClE,kBAAkB,EAAE,UAAU,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE;KAClE,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC;IAC1C,MAAM,SAAS,GAAG,YAAY,CAAC;IAC/B,MAAM,OAAO,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC1C,+DAA+D;IAC/D,iDAAiD;IACjD,MAAM,EAAE,GAAG,SAAS,QAAQ,EAAE,CAAC;IAE/B,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,mBAAmB,CAC3D;QACE,SAAS;QACT,OAAO;KACR,EACD;QACE,OAAO,EAAE,GAAG;KACb,CACF,CAAC;IAEF,qEAAqE;IACrE,wDAAwD;IACxD,mEAAmE;IACnE,8DAA8D;IAC9D,MAAM,KAAK,CAAC,YAAY,CAAC;QACvB,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE;QAC9C,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE;QAC1C,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE;QAClD,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE;QAC1C,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE;QACtD,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE;QAC1D,CAAC,GAAG,EAAE,oBAAoB,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE;QACxE,CAAC,GAAG,EAAE,sBAAsB,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE;QAC5E,GAAG,CAAC,QAAQ,KAAK,KAAK;YACpB,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,wBAAwB,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,EAAE,EAAE;YACtF,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QAChE,2DAA2D;QAC3D,8DAA8D;QAC9D,8DAA8D;QAC9D,wCAAwC;QACxC,GAAG,MAAM,CAAC,WAAW,CACnB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;YAC7D,GAAG,EAAE,iBAAiB,OAAO,EAAE;YAC/B,EAAE,KAAK,EAAE,MAAM,EAAE;SAClB,CAAC,CACH;KACF,CAAC,CAAC;IAEH,6EAA6E;IAC7E,4DAA4D;IAC5D,MAAM,qBAAqB,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC,IAAI,CACjF,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EACd,CAAC,CAAU,EAAE,EAAE;QACb,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QACnD,MAAM,CAAC,CAAC;IACV,CAAC,CACF,CAAC;IACF,MAAM,iBAAiB,GAAG,wBAAwB,CAChD,qBAAqB,EACrB,CAAC,CAAC,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,UAAU,EAAE,SAAS,IAAI,EAAE,CAGtD,CACH,CAAC;IACF,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,oBAAoB,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAE/E,oEAAoE;IACpE,MAAM,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhE,mEAAmE;IACnE,0CAA0C;IAC1C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;QACtC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YACjB,0DAA0D;YAC1D,0DAA0D;YAC1D,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;gBAC3B,OAAO,CACL,OAAO,EACP,GAAG,KAAK,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,KAAK,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAC3E,CAAC;YACJ,CAAC;iBAAM,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;gBACjC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC;IAC9C,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;IACvB,CAAC;IAED,OAAO;QACL,OAAO;QACP,aAAa,EAAE;YACb,OAAO,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC;YAC5B,OAAO,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC;YAC5B,OAAO,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC;SAC7B;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@caelo-cms/provisioning",
-  "version": "0.10.26",
+  "version": "0.10.28",
   "private": false,
   "license": "MPL-2.0",
   "description": "Pulumi-driven provisioning for Caelo CMS — `bunx @caelo-cms/provisioning --provider <self-hosted|gcp|aws|azure>` brings up a TLS-served install with Postgres + storage + secrets manager + the admin + the API gateway.",
@@ -38,16 +38,16 @@
     "prepublishOnly": "tsc -b --force && tsc --project stacks/gcp/tsconfig.json && tsc --project stacks/gcp-firebase/tsconfig.json"
   },
   "dependencies": {
-    "@caelo-cms/edge-router": "^0.10.26",
-    "@caelo-cms/shared": "^0.10.26",
-    "@clack/prompts": "1.7.0",
+    "@caelo-cms/edge-router": "^0.10.28",
+    "@caelo-cms/shared": "^0.10.28",
+    "@clack/prompts": "1.8.1",
     "@pulumi/aws": "^7",
     "@pulumi/awsx": "^3",
     "@pulumi/azure-native": "^3",
     "@pulumi/command": "^1",
     "@pulumi/gcp": "^9",
     "@pulumi/pulumi": "^3",
-    "@pulumi/random": "^4.21.1",
+    "@pulumi/random": "^4.21.2",
     "kleur": "4.1.5",
     "ts-node": "^10",
     "typescript": "^5"

package/stacks/gcp/index.ts

@@ -29,6 +29,20 @@ const ownerEmail = cfg.require("ownerEmail");
 const project = cfg.require("project");
 const region = cfg.get("region") ?? "us-central1";
 
+// Where Secret Manager keeps the secret payloads. Fixed at create time —
+// changing it replaces every secret — so the wizard pins it per stack:
+// `regional` (the install region) for new stacks, because orgs with a
+// `gcp.resourceLocations` policy reject `auto` (it resolves to location
+// "global"); `auto` for stacks whose secrets already exist that way.
+const secretReplicationMode = cfg.require("secretReplication");
+if (secretReplicationMode !== "auto" && secretReplicationMode !== "regional") {
+  throw new Error(`secretReplication must be "auto" or "regional", got "${secretReplicationMode}"`);
+}
+const secretReplication =
+  secretReplicationMode === "regional"
+    ? { userManaged: { replicas: [{ location: region }] } }
+    : { auto: {} };
+
 // === Operator-tunable knobs (defaults: minimal viable; scale-up later) ===
 const cloudSqlTier = cfg.get("cloudSqlTier") ?? "db-f1-micro";
 const cloudSqlHa = cfg.getBoolean("cloudSqlHa") ?? false;
@@ -180,7 +194,7 @@ interface MadeSecret {
 function makeSecret(name: string, value: pulumi.Output<string> | null): MadeSecret {
   const resource = new gcp.secretmanager.Secret(
     `${namePrefix}-${name}`,
-    { secretId: `${namePrefix}-${name}`, replication: { auto: {} } },
+    { secretId: `${namePrefix}-${name}`, replication: secretReplication },
     opts,
   );
   if (value === null) {
@@ -589,6 +603,9 @@ function cloudRunService(args: CloudRunArgs): gcp.cloudrunv2.Service {
   );
 }
 
+// Issue #37 — deterministic, so the admin env can carry it as a plain string.
+const mcpServiceAccountEmail = `caelo-mcp@${project}.iam.gserviceaccount.com`;
+
 const adminSvc = cloudRunService({
   serviceName: "admin",
   minInstances: adminMinInstances,
@@ -616,6 +633,8 @@ const adminSvc = cloudRunService({
     { name: "CAELO_STATIC_BUCKET", value: staticBucket.name },
     { name: "CAELO_STAGING_BUCKET", value: stagingBucket.name },
     { name: "CAELO_GENERATOR_CLI", value: "/app/apps/static-generator/src/cli.ts" },
+    // Issue #37 — shown in the /security/mcp `claude mcp add` command.
+    { name: "CAELO_MCP_IAP_SERVICE_ACCOUNT", value: mcpServiceAccountEmail },
   ],
 });
 const gatewaySvc = cloudRunService({
@@ -809,6 +828,58 @@ for (const principal of iapAllowlist) {
   );
 }
 
+// =========================================================================
+// MCP through IAP (issue #37)
+// =========================================================================
+//
+// External MCP clients (`@caelo-cms/mcp-server`) can't use the browser's IAP
+// login, and IAP's Google-managed OAuth client allows no programmatic user
+// tokens. They present a JWT signed by this service account instead (signed
+// via IAM Credentials `signJwt` with the operator's own ADC — no keys).
+// Everyone on the IAP allowlist may sign as it, so MCP access matches admin
+// browser access. `cms-provision upgrade` ensures the same for installs that
+// predate this (packages/provisioning/src/mcp-iap.ts), hence
+// createIgnoreAlreadyExists.
+const mcpServiceAccount = new gcp.serviceaccount.Account(
+  `${namePrefix}-mcp-sa`,
+  {
+    project,
+    accountId: "caelo-mcp",
+    displayName: "Caelo MCP (IAP ingress)",
+    description:
+      "Signs the IAP credential external MCP clients use to reach the admin (issue #37).",
+    createIgnoreAlreadyExists: true,
+  },
+  opts,
+);
+
+for (const principal of iapAllowlist) {
+  const slug = principal
+    .replace(/[^a-z0-9]/gi, "-")
+    .slice(0, 40)
+    .toLowerCase();
+  new gcp.serviceaccount.IAMMember(
+    `${namePrefix}-mcp-token-creator-${slug}`,
+    {
+      serviceAccountId: mcpServiceAccount.name,
+      role: "roles/iam.serviceAccountTokenCreator",
+      member: principal,
+    },
+    opts,
+  );
+}
+
+new gcp.iap.WebBackendServiceIamMember(
+  `${namePrefix}-admin-iap-mcp`,
+  {
+    project,
+    webBackendService: adminBackendService.name,
+    role: "roles/iap.httpsResourceAccessor",
+    member: pulumi.interpolate`serviceAccount:${mcpServiceAccount.email}`,
+  },
+  opts,
+);
+
 // URL map: routes by host header.
 //   admin.<domain>  → admin backend (IAP-gated)
 //   <domain>        → default static bucket; /api/* → gateway

package/stacks/gcp-firebase/index.ts

@@ -37,6 +37,20 @@ const ownerEmail = cfg.require("ownerEmail");
 const project = cfg.require("project");
 const region = cfg.get("region") ?? "us-central1";
 
+// Where Secret Manager keeps the secret payloads. Fixed at create time —
+// changing it replaces every secret — so the wizard pins it per stack:
+// `regional` (the install region) for new stacks, because orgs with a
+// `gcp.resourceLocations` policy reject `auto` (it resolves to location
+// "global"); `auto` for stacks whose secrets already exist that way.
+const secretReplicationMode = cfg.require("secretReplication");
+if (secretReplicationMode !== "auto" && secretReplicationMode !== "regional") {
+  throw new Error(`secretReplication must be "auto" or "regional", got "${secretReplicationMode}"`);
+}
+const secretReplication =
+  secretReplicationMode === "regional"
+    ? { userManaged: { replicas: [{ location: region }] } }
+    : { auto: {} };
+
 // === Operator-tunable knobs ===
 const cloudSqlTier = cfg.get("cloudSqlTier") ?? "db-f1-micro";
 const cloudSqlHa = cfg.getBoolean("cloudSqlHa") ?? false;
@@ -157,7 +171,7 @@ interface MadeSecret {
 function makeSecret(name: string, value: pulumi.Output<string> | null): MadeSecret {
   const resource = new gcp.secretmanager.Secret(
     `${namePrefix}-${name}`,
-    { secretId: `${namePrefix}-${name}`, replication: { auto: {} } },
+    { secretId: `${namePrefix}-${name}`, replication: secretReplication },
     opts,
   );
   if (value === null) return { resource, version: null };
@@ -479,6 +493,9 @@ const gatewaySvc = cloudRunService({
   extraEnv: [{ name: "PUBLIC_DATABASE_URL", value: publicDatabaseUrl }],
 });
 
+// Issue #37 — deterministic, so the admin env can carry it as a plain string.
+const mcpServiceAccountEmail = `caelo-mcp@${project}.iam.gserviceaccount.com`;
+
 const adminSvc = cloudRunService({
   serviceName: "admin",
   minInstances: adminMinInstances,
@@ -500,6 +517,8 @@ const adminSvc = cloudRunService({
     // version.
     { name: "CAELO_GATEWAY_SERVICE", value: gatewaySvc.name },
     { name: "CAELO_GATEWAY_REGION", value: region },
+    // Issue #37 — shown in the /security/mcp `claude mcp add` command.
+    { name: "CAELO_MCP_IAP_SERVICE_ACCOUNT", value: mcpServiceAccountEmail },
   ],
 });
 
@@ -699,6 +718,59 @@ for (const principal of iapAllowlist) {
   );
 }
 
+// =========================================================================
+// MCP through IAP (issue #37)
+// =========================================================================
+//
+// External MCP clients (`@caelo-cms/mcp-server`) can't use the browser's IAP
+// login, and IAP's Google-managed OAuth client allows no programmatic user
+// tokens. They present a JWT signed by this service account instead (signed
+// via IAM Credentials `signJwt` with the operator's own ADC — no keys).
+// Everyone on the IAP allowlist may sign as it, so MCP access matches admin
+// browser access. `cms-provision upgrade` ensures the same for installs that
+// predate this (packages/provisioning/src/mcp-iap.ts), hence
+// createIgnoreAlreadyExists.
+const mcpServiceAccount = new gcp.serviceaccount.Account(
+  `${namePrefix}-mcp-sa`,
+  {
+    project,
+    accountId: "caelo-mcp",
+    displayName: "Caelo MCP (IAP ingress)",
+    description:
+      "Signs the IAP credential external MCP clients use to reach the admin (issue #37).",
+    createIgnoreAlreadyExists: true,
+  },
+  opts,
+);
+
+for (const principal of iapAllowlist) {
+  const slug = principal
+    .replace(/[^a-z0-9]/gi, "-")
+    .slice(0, 40)
+    .toLowerCase();
+  new gcp.serviceaccount.IAMMember(
+    `${namePrefix}-mcp-token-creator-${slug}`,
+    {
+      serviceAccountId: mcpServiceAccount.name,
+      role: "roles/iam.serviceAccountTokenCreator",
+      member: principal,
+    },
+    opts,
+  );
+}
+
+new gcp.iap.WebCloudRunServiceIamMember(
+  `${namePrefix}-admin-iap-mcp`,
+  {
+    project,
+    location: region,
+    cloudRunServiceName: adminSvc.name,
+    role: "roles/iap.httpsResourceAccessor",
+    member: pulumi.interpolate`serviceAccount:${mcpServiceAccount.email}`,
+  },
+  opts,
+);
+
 // =========================================================================
 // Outputs — DNS records the operator wires manually
 // =========================================================================