@caelo-cms/provisioning 0.10.27 → 0.10.29

package/caddy/Caddyfile.production

@@ -12,6 +12,22 @@
 
 :80 {
 	root * /srv/current
+	# Content-hashed build outputs (fonts, plugin bundles) never change
+	# under the same URL — cache them for a year. Keep this pattern in
+	# sync with CONTENT_HASHED_PATH_PATTERN in @caelo-cms/shared
+	# (enforced by packages/provisioning/src/index.test.ts). Pages and
+	# slug-addressed media keep file_server's ETag/Last-Modified default.
+	# `file` gates the header on the file existing: a 404 for a hashed
+	# URL (old page after a deploy switch) must not be cached for a year.
+	@content_hashed {
+		path_regexp content_hashed ^/(?:_app/immutable/.+|_assets/fonts/[^/]+/[0-9a-f]{16,64}\.(?:woff2|woff|ttf|otf)|_caelo/plugin/[^/]+/[^/]+\.[0-9a-f]{12}\.(?:js|css))$
+		file
+	}
+	header @content_hashed Cache-Control "public, max-age=31536000, immutable"
+	# Favicons ship as the one icon MIME the media library stores and the
+	# page's <link rel="icon" type> declares, not the host mime.types name.
+	@ico path *.ico
+	header @ico Content-Type "image/x-icon"
 	encode gzip
 	try_files {path} {path}/index.html
 	file_server

package/caddy/Caddyfile.staging

@@ -14,6 +14,22 @@
 
 :80 {
 	root * /srv/current
+	# Content-hashed build outputs (fonts, plugin bundles) never change
+	# under the same URL — cache them for a year. Keep this pattern in
+	# sync with CONTENT_HASHED_PATH_PATTERN in @caelo-cms/shared
+	# (enforced by packages/provisioning/src/index.test.ts). Pages and
+	# slug-addressed media keep file_server's ETag/Last-Modified default.
+	# `file` gates the header on the file existing: a 404 for a hashed
+	# URL (old page after a deploy switch) must not be cached for a year.
+	@content_hashed {
+		path_regexp content_hashed ^/(?:_app/immutable/.+|_assets/fonts/[^/]+/[0-9a-f]{16,64}\.(?:woff2|woff|ttf|otf)|_caelo/plugin/[^/]+/[^/]+\.[0-9a-f]{12}\.(?:js|css))$
+		file
+	}
+	header @content_hashed Cache-Control "public, max-age=31536000, immutable"
+	# Favicons ship as the one icon MIME the media library stores and the
+	# page's <link rel="icon" type> declares, not the host mime.types name.
+	@ico path *.ico
+	header @ico Content-Type "image/x-icon"
 	encode gzip
 	header X-Robots-Tag "noindex, nofollow"
 	try_files {path} {path}/index.html

package/dist/caddy.d.ts

@@ -1,20 +1,3 @@
-/**
- * P14 — Caddyfile generator.
- *
- * Reads the `domains` table + the deploy targets and emits a
- * deterministic Caddyfile string. The CLI's `regenerate-caddy`
- * sub-command writes this to `/etc/caddy/Caddyfile` and runs
- * `caddy reload`.
- *
- * Per-vhost shape:
- *   <hostname> {
- *     # admin   → reverse_proxy localhost:5173
- *     # public  → root + try_files (static), with /api/* → gateway
- *     tls <ownerEmail>
- *   }
- *
- * Staging vhosts force `X-Robots-Tag: noindex`.
- */
 export interface CaddyDomainSpec {
     readonly hostname: string;
     readonly kind: "admin" | "public";

package/dist/caddy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"caddy.d.ts","sourceRoot":"","sources":["../src/caddy.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAC;IAClC,QAAQ,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,CAAC;CACxC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;CAClD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAyB7D"}
+{"version":3,"file":"caddy.d.ts","sourceRoot":"","sources":["../src/caddy.ts"],"names":[],"mappings":"AAoCA,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAC;IAClC,QAAQ,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,CAAC;CACxC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;CAClD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAyB7D"}

package/dist/caddy.js

@@ -1,4 +1,36 @@
 // SPDX-License-Identifier: MPL-2.0
+/**
+ * P14 — Caddyfile generator.
+ *
+ * Reads the `domains` table + the deploy targets and emits a
+ * deterministic Caddyfile string. The CLI's `regenerate-caddy`
+ * sub-command writes this to `/etc/caddy/Caddyfile` and runs
+ * `caddy reload`.
+ *
+ * Per-vhost shape:
+ *   <hostname> {
+ *     # admin   → reverse_proxy localhost:5173
+ *     # public  → root + try_files (static), with /api/* → gateway
+ *     tls <ownerEmail>
+ *   }
+ *
+ * Staging vhosts force `X-Robots-Tag: noindex`.
+ *
+ * Public vhosts mark content-hashed build outputs (fonts, plugin
+ * bundles — `CONTENT_HASHED_PATH_PATTERN` in @caelo-cms/shared)
+ * `immutable` for a year. Everything else keeps Caddy's file_server
+ * default (no Cache-Control; ETag + Last-Modified for revalidation),
+ * so pages and slug-addressed media are never pinned in caches. The
+ * matcher also requires the file to exist (`file`), so a 404 for a
+ * hashed URL (an old page requesting an asset the new build dropped)
+ * is never cached for a year.
+ *
+ * `.ico` files (theme favicons) are served as `image/x-icon`, the one
+ * icon MIME the media library stores and `<link rel="icon" type>`
+ * declares. file_server only fills Content-Type when no earlier handler
+ * set it, so the `header` line wins over the host's mime.types name.
+ */
+import { CONTENT_HASHED_PATH_PATTERN, IMMUTABLE_CACHE_CONTROL } from "@caelo-cms/shared";
 export function generateCaddyfile(spec) {
     const blocks = [];
     // Global options.
@@ -34,6 +66,13 @@ function vhost(d, spec) {
     const root = d.env === "staging" ? spec.stagingSiteRoot : spec.publicSiteRoot;
     return `${d.hostname} {${noindex}
   root * ${root}
+  @content_hashed {
+    path_regexp content_hashed ${CONTENT_HASHED_PATH_PATTERN}
+    file
+  }
+  header @content_hashed Cache-Control "${IMMUTABLE_CACHE_CONTROL}"
+  @ico path *.ico
+  header @ico Content-Type "image/x-icon"
   handle /api/* {
     reverse_proxy localhost:${spec.gatewayPort}
   }

package/dist/caddy.js.map

@@ -1 +1 @@
-{"version":3,"file":"caddy.js","sourceRoot":"","sources":["../src/caddy.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAmCnC,MAAM,UAAU,iBAAiB,CAAC,IAAmB;IACnD,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,kBAAkB;IAClB,MAAM,CAAC,IAAI,CAAC;UACJ,IAAI,CAAC,UAAU;;CAExB,CAAC,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9B,CAAC;IAED,oEAAoE;IACpE,8DAA8D;IAC9D,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC;;;4BAGY,IAAI,CAAC,SAAS;;CAEzC,CAAC,CAAC;IACD,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,KAAK,CAAC,CAAkB,EAAE,IAAmB;IACpD,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO;4BACR,IAAI,CAAC,SAAS;;CAEzC,CAAC;IACA,CAAC;IACD,yCAAyC;IACzC,6DAA6D;IAC7D,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IAC9E,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO;WACvB,IAAI;;8BAEe,IAAI,CAAC,WAAW;;;8BAGhB,IAAI,CAAC,SAAS;;;;;;;;CAQ3C,CAAC;AACF,CAAC"}
+{"version":3,"file":"caddy.js","sourceRoot":"","sources":["../src/caddy.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAiBzF,MAAM,UAAU,iBAAiB,CAAC,IAAmB;IACnD,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,kBAAkB;IAClB,MAAM,CAAC,IAAI,CAAC;UACJ,IAAI,CAAC,UAAU;;CAExB,CAAC,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9B,CAAC;IAED,oEAAoE;IACpE,8DAA8D;IAC9D,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC;;;4BAGY,IAAI,CAAC,SAAS;;CAEzC,CAAC,CAAC;IACD,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,KAAK,CAAC,CAAkB,EAAE,IAAmB;IACpD,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO;4BACR,IAAI,CAAC,SAAS;;CAEzC,CAAC;IACA,CAAC;IACD,yCAAyC;IACzC,6DAA6D;IAC7D,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IAC9E,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO;WACvB,IAAI;;iCAEkB,2BAA2B;;;0CAGlB,uBAAuB;;;;8BAInC,IAAI,CAAC,WAAW;;;8BAGhB,IAAI,CAAC,SAAS;;;;;;;;CAQ3C,CAAC;AACF,CAAC"}

package/dist/compose.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compose.d.ts","sourceRoot":"","sources":["../src/compose.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AAEH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAiG/D"}
+{"version":3,"file":"compose.d.ts","sourceRoot":"","sources":["../src/compose.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AAEH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAkG/D"}

package/dist/compose.js

@@ -68,6 +68,7 @@ services:
       ADMIN_DATABASE_URL: "postgres://caelo:${escapeYaml(spec.postgresPassword)}@postgres:5432/cms_admin"
       PUBLIC_ADMIN_DATABASE_URL: "postgres://caelo:${escapeYaml(spec.postgresPassword)}@postgres:5432/cms_public"
       CAELO_SECRET_KEK: "${escapeYaml(spec.caeloSecretKek)}"
+      CAELO_SITE_URL: "https://${escapeYaml(spec.domain)}"
       NODE_ENV: production
 ${env("ANTHROPIC_API_KEY", spec.anthropicApiKey)}
 ${env("RESEND_API_KEY", spec.resendApiKey)}

package/dist/compose.js.map

@@ -1 +1 @@
-{"version":3,"file":"compose.js","sourceRoot":"","sources":["../src/compose.ts"],"names":[],"mappings":"AAAA,mCAAmC;AA6BnC,MAAM,UAAU,qBAAqB,CAAC,IAAiB;IACrD,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,CAAqB,EAAU,EAAE,CACvD,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,OAAO;;YAEG,IAAI,CAAC,MAAM;;;;;;;;4BAQK,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;0BA2BnC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC;8BAC1B,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;8CA0BlB,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC;qDAC1B,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC;2BAC3D,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC;;EAExD,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,eAAe,CAAC;EAC9C,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,YAAY,CAAC;;;;;;;;;;;;;8CAaI,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC;+CAChC,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC;;;;;;;;;;CAU/E,CAAC;AACF,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,sDAAsD;IACtD,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACvD,CAAC"}
+{"version":3,"file":"compose.js","sourceRoot":"","sources":["../src/compose.ts"],"names":[],"mappings":"AAAA,mCAAmC;AA6BnC,MAAM,UAAU,qBAAqB,CAAC,IAAiB;IACrD,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,CAAqB,EAAU,EAAE,CACvD,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,OAAO;;YAEG,IAAI,CAAC,MAAM;;;;;;;;4BAQK,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;0BA2BnC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC;8BAC1B,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;8CA0BlB,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC;qDAC1B,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC;2BAC3D,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC;iCACzB,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;;EAEtD,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,eAAe,CAAC;EAC9C,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,YAAY,CAAC;;;;;;;;;;;;;8CAaI,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC;+CAChC,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC;;;;;;;;;;CAU/E,CAAC;AACF,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,sDAAsD;IACtD,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACvD,CAAC"}

package/dist/lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../src/lifecycle.ts"],"names":[],"mappings":"AAyGA,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAWnD;AAyGD,UAAU,WAAW;IACnB,uEAAuE;IACvE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,GAAG,IAAI,GAAG,MAAM,CAAC;IAC5C;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAmHD,wBAAsB,cAAc,CAAC,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuN1E;AAuJD,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAmCnD;AAMD,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAoCjF;AAMD;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CA0DrD;AAED,wBAAsB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CA6CpD"}
+{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../src/lifecycle.ts"],"names":[],"mappings":"AA0GA,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAWnD;AAyGD,UAAU,WAAW;IACnB,uEAAuE;IACvE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,GAAG,IAAI,GAAG,MAAM,CAAC;IAC5C;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AA4ID,wBAAsB,cAAc,CAAC,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuP1E;AAuJD,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAmCnD;AAMD,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAoCjF;AAMD;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CA0DrD;AAED,wBAAsB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CA6CpD"}

package/dist/lifecycle.js

@@ -19,6 +19,7 @@ import { cancel, confirm, isCancel, log, note, spinner } from "@clack/prompts";
 import { bold, cyan, dim, green, red, yellow } from "kleur/colors";
 import { gcloud } from "./gcloud.js";
 import { installRoot, readMetadata, readSecret } from "./install-state.js";
+import { ensureMcpIapAccess } from "./mcp-iap.js";
 /** Find the single install on this machine — or warn if 0/multiple. */
 function findActiveInstall() {
     const home = homedir();
@@ -252,6 +253,26 @@ async function rollbackTraffic(projectId, region, serviceName, priorRevision) {
     ]);
     return r.ok;
 }
+/**
+ * The admin's IAP resource: the Cloud Run service itself on gcp-firebase
+ * (native IAP), the LB backend service on gcp (Pulumi-suffixed name).
+ */
+async function resolveAdminIapResource(meta, region, adminServiceName) {
+    if (meta.provider === "gcp-firebase") {
+        return { kind: "cloud-run", service: adminServiceName, region };
+    }
+    const r = await gcloud([
+        "compute",
+        "backend-services",
+        "list",
+        "--global",
+        `--project=${meta.projectId}`,
+        "--filter=name~^caelo-production-admin-backend",
+        "--format=value(name)",
+    ]);
+    const name = r.ok ? r.stdout.trim().split("\n")[0]?.trim() : "";
+    return name ? { kind: "backend-services", service: name } : null;
+}
 export async function upgradeCommand(opts = {}) {
     const { meta } = requireInstall();
     // v0.5.15 — extended to cover gcp-firebase too. Both providers share
@@ -377,6 +398,31 @@ export async function upgradeCommand(opts = {}) {
     }
     sMig.stop(green("Migrations applied"));
     // ────────────────────────────────────────────────────────────────
+    // Issue #37 — MCP through IAP. Idempotently ensure the MCP service
+    // account + its IAP/token-creator bindings, then hand its email to the
+    // new admin revision (CAELO_MCP_IAP_SERVICE_ACCOUNT) so /security/mcp
+    // shows a working `claude mcp add` command. Installs provisioned before
+    // this existed get it here, with no operator config. A failure only
+    // costs MCP access, so it warns instead of aborting the upgrade.
+    // ────────────────────────────────────────────────────────────────
+    let mcpServiceAccount = null;
+    if (adminPlan) {
+        const sMcp = spinner();
+        sMcp.start("Ensuring MCP access through IAP...");
+        const resource = await resolveAdminIapResource(meta, region, adminPlan.serviceName);
+        const mcp = resource
+            ? await ensureMcpIapAccess({ projectId: meta.projectId, resource })
+            : { ok: false, error: "admin IAP backend service not found" };
+        if (mcp.ok) {
+            mcpServiceAccount = mcp.serviceAccount;
+            sMcp.stop(green(`MCP access ready (${mcp.serviceAccount}; ${mcp.operators.length} operator(s))`));
+        }
+        else {
+            sMcp.stop(yellow(`MCP access not configured: ${mcp.error}`));
+            log.warn("The upgrade continues; external MCP clients stay blocked by IAP until this succeeds.");
+        }
+    }
+    // ────────────────────────────────────────────────────────────────
     // Phase 2: roll each service, probe health, auto-rollback on fail.
     // If admin succeeds but gateway fails, also roll admin back so the
     // operator never ends up on a mismatched-version pair.
@@ -396,6 +442,9 @@ export async function upgradeCommand(opts = {}) {
             meta.projectId,
             "--image",
             plan.imageRef,
+            ...(plan.slug === "admin" && mcpServiceAccount
+                ? [`--update-env-vars=CAELO_MCP_IAP_SERVICE_ACCOUNT=${mcpServiceAccount}`]
+                : []),
             "--quiet",
         ]);
         if (!upd.ok) {

package/dist/lifecycle.js.map

@@ -1 +1 @@
-{"version":3,"file":"lifecycle.js","sourceRoot":"","sources":["../src/lifecycle.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAwB,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEjG,uEAAuE;AACvE,SAAS,iBAAiB;IACxB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC;SACjC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;SAC9C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;IAClD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,IAAI;YAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACvC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc;IACrB,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;IAClC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC,CAAC;QAC1D,GAAG,CAAC,IAAI,CACN,OAAO,IAAI,CAAC,8BAA8B,CAAC,2CAA2C,GAAG,CAAC,wBAAwB,CAAC,iCAAiC,CACrJ,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,sBAAsB,CACnC,IAAoC,EACpC,MAAc,EACd,SAAiB,EACjB,MAAe;IAEf,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI,CACP,KAAK,EACL,UAAU,EACV,MAAM,EACN,UAAU,EACV,MAAM,IAAI,cAAc,EACxB,WAAW,EACX,SAAS,EACT,UAAU,EACV,kBAAkB,MAAM,EAAE,EAC1B,+BAA+B,CAChC,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,IAAI,CACP,KAAK,EACL,WAAW,EACX,MAAM,EACN,WAAW,EACX,SAAS,EACT,UAAU,EACV,SAAS,MAAM,EAAE,EACjB,sBAAsB,CACvB,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM;SACrB,IAAI,EAAE;SACN,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED,4EAA4E;AAC5E,uCAAuC;AACvC,4EAA4E;AAE5E,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,CAAC;IAC7C,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC,CAAC;IACrE,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1C,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,eAAe,CAAC,EAAE,CAAC,CAAC;IAEhE,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC5B,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,CAAC,+BAA+B,IAAI,CAAC,QAAQ,uBAAuB,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,IAAI,iBAAiB,GAAwD,IAAI,CAAC;AAClF,KAAK,UAAU,mBAAmB;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,iBAAiB,IAAI,GAAG,GAAG,iBAAiB,CAAC,SAAS,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;QAC5E,OAAO,iBAAiB,CAAC,MAAM,CAAC;IAClC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,kEAAkE,EAAE;YAC1F,OAAO,EAAE,EAAE,MAAM,EAAE,6BAA6B,EAAE;SACnD,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,iBAAiB,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAC;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC;QACrC,iBAAiB,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QAC/C,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAqB;IAC5C,IAAI,CAAC,IAAI,CAAC,SAAS;QAAE,OAAO;IAC5B,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;IACpB,CAAC,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAE7D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC;IAC7C,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAC5C,aAAa,EACb,wBAAwB,EACxB,IAAI,CAAC,SAAS,EACd,MAAM,CACP,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAC1C,cAAc,EACd,qBAAqB,EACrB,IAAI,CAAC,SAAS,CACf,CAAC;IACF,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC,CAAC;QAChF,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC;QAC5B,KAAK;QACL,UAAU;QACV,UAAU;QACV,SAAS;QACT,UAAU;QACV,MAAM;QACN,WAAW;QACX,IAAI,CAAC,SAAS;QACd,4BAA4B;KAC7B,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC;QAC5B,KAAK;QACL,WAAW;QACX,UAAU;QACV,OAAO;QACP,WAAW;QACX,IAAI,CAAC,SAAS;QACd,uBAAuB;KACxB,CAAC,CAAC;IACH,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAEvC,iEAAiE;IACjE,mEAAmE;IACnE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAC9C,MAAM,YAAY,GAAG,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC;IAC1D,MAAM,WAAW,GACf,YAAY,IAAI,YAAY,KAAK,aAAa;QAC5C,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,YAAY,YAAY,CAAC,iDAAiD;QAC1F,CAAC,CAAC,YAAY,KAAK,aAAa;YAC9B,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;YACrB,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAEhC,IAAI,CACF;QACE,GAAG,GAAG,CAAC,qBAAqB,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;QAC7F,GAAG,GAAG,CAAC,iBAAiB,CAAC,QAAQ,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;QAC5F,GAAG,GAAG,CAAC,aAAa,CAAC,aAAa,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE;QAClE,GAAG,GAAG,CAAC,mBAAmB,CAAC,OAAO,IAAI,CAAC,iBAAiB,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE;QACxE,GAAG,GAAG,CAAC,aAAa,CAAC,cAAc,aAAa,KAAK,WAAW,EAAE;KACnE,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,QAAQ,CACT,CAAC;AACJ,CAAC;AA2BD;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAC7B,MAAc,EACd,OAAe,EACf,IAAY,EACZ,KAAa,EACb,GAAW;IAEX,MAAM,GAAG,GAAG,WAAW,MAAM,sBAAsB,OAAO,IAAI,IAAI,IAAI,KAAK,cAAc,GAAG,EAAE,CAAC;IAC/F,qEAAqE;IACrE,mEAAmE;IACnE,iEAAiE;IACjE,+CAA+C;IAC/C,MAAM,MAAM,GAAG;QACb,sDAAsD;QACtD,4CAA4C;QAC5C,2DAA2D;QAC3D,yCAAyC;KAC1C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACZ,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC;QACvE,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,MAAM,IAAI,WAAW,EAAE,EAAE,CAAC;QACrF,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,KAAK,UAAU,mBAAmB,CAChC,SAAiB,EACjB,MAAc,EACd,WAAmB;IAEnB,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC;QACrB,KAAK;QACL,UAAU;QACV,UAAU;QACV,WAAW;QACX,UAAU;QACV,MAAM;QACN,WAAW;QACX,SAAS;QACT,gDAAgD;KACjD,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACnD,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,2EAA2E;AAC3E,KAAK,UAAU,cAAc,CAC3B,SAAiB,EACjB,MAAc,EACd,WAAmB;IAEnB,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC;QACrB,KAAK;QACL,UAAU;QACV,UAAU;QACV,WAAW;QACX,UAAU;QACV,MAAM;QACN,WAAW;QACX,SAAS;QACT,4BAA4B;KAC7B,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,SAAiB,EACjB,MAAc,EACd,WAAmB,EACnB,aAAqB;IAErB,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC;QACrB,KAAK;QACL,UAAU;QACV,gBAAgB;QAChB,WAAW;QACX,UAAU;QACV,MAAM;QACN,WAAW;QACX,SAAS;QACT,gBAAgB;QAChB,GAAG,aAAa,MAAM;QACtB,SAAS;KACV,CAAC,CAAC;IACH,OAAO,CAAC,CAAC,EAAE,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAoB,EAAE;IACzD,MAAM,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,CAAC;IAClC,qEAAqE;IACrE,6DAA6D;IAC7D,qEAAqE;IACrE,mEAAmE;IACnE,mEAAmE;IACnE,4DAA4D;IAC5D,0BAA0B;IAC1B,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;QAChE,GAAG,CAAC,IAAI,CAAC,wBAAwB,IAAI,CAAC,QAAQ,uBAAuB,CAAC,CAAC;QACvE,OAAO;IACT,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,SAAS;QAAE,OAAO;IAE5B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC;IAC7C,MAAM,eAAe,GAAG,eAAe,CAAC;IACxC,MAAM,cAAc,GAAG,cAAc,CAAC;IACtC,MAAM,YAAY,GAAG,kBAAkB,CAAC;IAExC,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE;QACtB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;QAC7F,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACvC,IAAI,IAAI,CAAC,OAAO,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC;QAC3C,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC,EAAE,CAAC;IACL,GAAG,CAAC,IAAI,CAAC,gCAAgC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAE5D,mEAAmE;IACnE,iEAAiE;IACjE,kEAAkE;IAClE,qEAAqE;IACrE,mEAAmE;IACnE,MAAM,KAAK,GAAkB,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,KAAK,CAAC,uEAAuE,CAAC,CAAC;IACpF,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,SAAS,CAAU,EAAE,CAAC;QACjD,MAAM,WAAW,GAAG,MAAM,sBAAsB,CAC9C,aAAa,EACb,oBAAoB,IAAI,EAAE,EAC1B,IAAI,CAAC,SAAS,EACd,MAAM,CACP,CAAC;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,mCAAmC,IAAI,qBAAqB,CAAC,CAAC,CAAC;YAC7E,OAAO;QACT,CAAC;QACD,kEAAkE;QAClE,oEAAoE;QACpE,iEAAiE;QACjE,+DAA+D;QAC/D,gEAAgE;QAChE,8DAA8D;QAC9D,6DAA6D;QAC7D,8DAA8D;QAC9D,2DAA2D;QAC3D,MAAM,SAAS,GAAG,MAAM,gBAAgB,CACtC,cAAc,EACd,eAAe,EACf,YAAY,EACZ,IAAI,EACJ,SAAS,CACV,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,qCAAqC,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC;YACzE,GAAG,CAAC,KAAK,CACP,4BAA4B,SAAS,CAAC,MAAM,KAAK;gBAC/C,oCAAoC,cAAc,mBAAmB,eAAe,IAAI,YAAY,IAAI,IAAI,IAAI,SAAS,IAAI;gBAC7H,2GAA2G,CAC9G,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;QAChC,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACrF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,0CAA0C,IAAI,qBAAqB,CAAC,CAAC,CAAC;YACpF,OAAO;QACT,CAAC;QACD,KAAK,CAAC,IAAI,CAAC;YACT,IAAI;YACJ,WAAW;YACX,MAAM;YACN,QAAQ,EAAE,GAAG,cAAc,mBAAmB,eAAe,IAAI,YAAY,IAAI,IAAI,IAAI,MAAM,EAAE;YACjG,aAAa;SACd,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,KAAK,CAAC,MAAM,mBAAmB,CAAC,CAAC,CAAC;IAErE,mEAAmE;IACnE,8DAA8D;IAC9D,kEAAkE;IAClE,kEAAkE;IAClE,0CAA0C;IAC1C,EAAE;IACF,mEAAmE;IACnE,mEAAmE;IACnE,gEAAgE;IAChE,0BAA0B;IAC1B,mEAAmE;IACnE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC;QAC7F,IAAI,CAAC,QAAQ;YAAE,OAAO;IACxB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,oDAAoD,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,mEAAmE;IACnE,+DAA+D;IAC/D,iEAAiE;IACjE,2DAA2D;IAC3D,uDAAuD;IACvD,mEAAmE;IACnE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACrD,MAAM,EAAE,2BAA2B,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAC9E,qEAAqE;IACrE,+DAA+D;IAC/D,kEAAkE;IAClE,kEAAkE;IAClE,iEAAiE;IACjE,6DAA6D;IAC7D,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,MAAM,2BAA2B,CAAC;QAC5C,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,MAAM;QACN,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5D,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,sBAAsB,GAAG,CAAC,KAAK,IAAI,SAAS,sBAAsB,CAAC,CAAC,CAAC;QACnF,GAAG,CAAC,IAAI,CACN,2DAA2D;YACzD,yDAAyD;YACzD,iDAAiD;YACjD,aAAa,IAAI,CAAC,SAAS,aAAa,CAC3C,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAEvC,mEAAmE;IACnE,mEAAmE;IACnE,mEAAmE;IACnE,uDAAuD;IACvD,mEAAmE;IACnE,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;QACpB,CAAC,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QACjE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC;YACvB,KAAK;YACL,UAAU;YACV,QAAQ;YACR,IAAI,CAAC,WAAW;YAChB,UAAU;YACV,MAAM;YACN,WAAW;YACX,IAAI,CAAC,SAAS;YACd,SAAS;YACT,IAAI,CAAC,QAAQ;YACb,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;YAC5C,MAAM,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,mEAAmE;QACnE,kEAAkE;QAClE,+DAA+D;QAC/D,oEAAoE;QACpE,kEAAkE;QAClE,mEAAmE;QACnE,mEAAmE;QACnE,iEAAiE;QACjE,8CAA8C;QAC9C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC;YACxB,KAAK;YACL,UAAU;YACV,gBAAgB;YAChB,IAAI,CAAC,WAAW;YAChB,UAAU;YACV,MAAM;YACN,WAAW;YACX,IAAI,CAAC,SAAS;YACd,aAAa;YACb,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,kCAAkC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;YACpE,MAAM,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YACtE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,qCAAqC,IAAI,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC;YAC7E,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YACpF,MAAM,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,mEAAmE;QACnE,kEAAkE;QAClE,iEAAiE;QACjE,mEAAmE;QACnE,kEAAkE;QAClE,oEAAoE;QACpE,oEAAoE;QACpE,iEAAiE;QACjE,kEAAkE;QAClE,kEAAkE;QAClE,gEAAgE;QAChE,iEAAiE;QACjE,mCAAmC;QACnC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,cAAc,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QACzE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IACD,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,8CAA8C,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;GAKG;AACH,+EAA+E;AAC/E,SAAS,WAAW,CAAC,IAAc;IACjC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAClE,OAAO,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,qBAAqB;IAClC,IAAI,WAAW,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpD,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC,CAAC;IAExF,iEAAiE;IACjE,6DAA6D;IAC7D,kEAAkE;IAClE,wCAAwC;IACxC,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,WAAW,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;QACxE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC;YAC5B,OAAO,EAAE,8DAA8D;YACvE,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YAC3C,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;YACpB,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;YAC/B,MAAM,aAAa,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE;gBACjE,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;YACH,IAAI,aAAa,CAAC,QAAQ,KAAK,CAAC,IAAI,WAAW,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;gBACvE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;gBACpC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAC9D,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC,CAAC;YAC1C,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,GAAG,CAAC,IAAI,CACN,mBAAmB;QACjB,6CAA6C;QAC7C,+DAA+D;QAC/D,0FAA0F,CAC7F,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,eAAe,CAC5B,KAAoB,EACpB,cAAsB,EACtB,eAAuB,EACvB,YAAoB;IAEpB,+DAA+D;IAC/D,+DAA+D;IAC/D,gEAAgE;IAChE,kEAAkE;IAClE,yBAAyB;IACzB,IAAI,CAAC,CAAC,MAAM,qBAAqB,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAEnD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;QACpB,CAAC,CAAC,KAAK,CAAC,kCAAkC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QACtF,MAAM,OAAO,GAAG,GAAG,cAAc,mBAAmB,eAAe,IAAI,YAAY,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAClH,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS,CAC1B;YACE,QAAQ;YACR,QAAQ;YACR,OAAO;YACP,+BAA+B;YAC/B,2DAA2D;YAC3D,0DAA0D;YAC1D,oDAAoD;YACpD,0FAA0F;YAC1F,2BAA2B;YAC3B,6CAA6C;SAC9C,EACD,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CACnC,CAAC;QACF,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACvD,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,4BAA4B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACrD,GAAG,CAAC,KAAK,CACP,GAAG,CACD,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,kEAAkE;gBACxG,WAAW;gBACX,wCAAwC;gBACxC,iFAAiF;gBACjF,yDAAyD;gBACzD,kBAAkB,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAClD,CACF,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,uBAAuB,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,SAAiB,EACjB,MAAc,EACd,MAAqB;IAErB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAChC,GAAG,CAAC,IAAI,CACN,MAAM,CAAC,gBAAgB,MAAM,CAAC,MAAM,mDAAmD,CAAC,CACzF,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1F,GAAG,CAAC,IAAI,CACN,EAAE;YACA,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,IAAI,wBAAwB,IAAI,CAAC,aAAa,EAAE,CAAC;YACnE,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,IAAI,wCAAwC,CAAC,CAChE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,4DAA4D;AAC5D,4EAA4E;AAE5E,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,CAAC;IAClC,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC5B,GAAG,CAAC,IAAI,CAAC,uBAAuB,IAAI,CAAC,QAAQ,uBAAuB,CAAC,CAAC;QACtE,OAAO;IACT,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,SAAS;QAAE,OAAO;IAE5B,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;IACpB,CAAC,CAAC,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAC1C,cAAc,EACd,qBAAqB,EACrB,IAAI,CAAC,SAAS,CACf,CAAC;IACF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC,CAAC;QACtE,OAAO;IACT,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC;QACrB,KAAK;QACL,SAAS;QACT,QAAQ;QACR,YAAY;QACZ,OAAO;QACP,WAAW;QACX,IAAI,CAAC,SAAS;QACd,eAAe;QACf,oBAAoB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;KAC/C,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACV,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1C,OAAO;IACT,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,kEAAkE,OAAO,KAAK,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,4EAA4E;AAC5E,uBAAuB;AACvB,4EAA4E;AAE5E,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAwB;IAChE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC,CAAC;QACxD,GAAG,CAAC,IAAI,CACN,UAAU;YACR,mBAAmB;YACnB,aAAa;YACb,eAAe;YACf,YAAY;YACZ,mBAAmB;YACnB,gBAAgB;SACjB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACf,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,CAAC;IAClC,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC5B,GAAG,CAAC,IAAI,CAAC,8BAA8B,IAAI,CAAC,QAAQ,uBAAuB,CAAC,CAAC;QAC7E,OAAO;IACT,CAAC;IACD,GAAG,CAAC,IAAI,CACN,MAAM,CACJ,oGAAoG,CACrG,CACF,CAAC;IACF,IAAI,CACF;QACE,IAAI,CAAC,8BAA8B,CAAC;QACpC,EAAE;QACF,KAAK,IAAI,CAAC,wEAAwE,IAAI,4BAA4B,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE;QACrI,EAAE;QACF,yDAAyD;QACzD,KAAK,IAAI,CAAC,sCAAsC,CAAC,EAAE;KACpD,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,eAAe,CAChB,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,oDAAoD;AACpD,4EAA4E;AAE5E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,CAAC;IAElC,GAAG,CAAC,IAAI,CACN,MAAM,CACJ,GAAG,IAAI,CAAC,UAAU,CAAC,2JAA2J,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK;QAClM,2FAA2F,CAC9F,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC;QAC7B,OAAO,EAAE,uBAAuB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,aAAa,CAAC,IAAI;QAC/F,YAAY,EAAE,KAAK;KACpB,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,MAAM,CAAC,YAAY,CAAC,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACtD,CAAC,CAAC,IAAI,CAAC;QACL,OAAO,EAAE,+BAA+B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;QAC3D,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iCAAiC,CAAC;KACrF,CAAC,CACH,CAAC;IACF,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,CAAC,YAAY,CAAC,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;QACpC,GAAG,CAAC,IAAI,CACN,+DAA+D;YAC7D,GAAG,IAAI,CAAC,wFAAwF,CAAC,GAAG;YACpG,2CAA2C,CAC9C,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,cAAc,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACpF,MAAM,EAAE,sBAAsB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACzE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC;QAC7C,MAAM,CAAC,GAAG,MAAM,sBAAsB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,CAAC,oBAAoB,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;YACvC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,CACF;YACE,KAAK,CAAC,0BAA0B,IAAI,CAAC,MAAM,GAAG,CAAC;YAC/C,EAAE;YACF,0EAA0E;YAC1E,yEAAyE;SAC1E,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,MAAM,CACP,CAAC;QACF,OAAO;IACT,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,yCAAyC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,CAAC;IAE7C,GAAG,CAAC,IAAI,CACN,GAAG,CACD,GAAG,IAAI,CAAC,iCAAiC,CAAC,iGAAiG,CAC5I,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC;QAC7B,OAAO,EAAE,2BAA2B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,aAAa,CAAC,IAAI;QACnG,YAAY,EAAE,KAAK;KACpB,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,MAAM,CAAC,YAAY,CAAC,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACtD,CAAC,CAAC,IAAI,CAAC;QACL,OAAO,EAAE,+BAA+B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;QAC3D,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iCAAiC,CAAC;KACrF,CAAC,CACH,CAAC;IACF,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,CAAC,YAAY,CAAC,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QAC9C,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;QACpB,CAAC,CAAC,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,KAAK,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QAC1E,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;YAC1C,GAAG,CAAC,IAAI,CACN,0HAA0H,IAAI,CAAC,SAAS,EAAE,CAC3I,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,SAAS,gDAAgD,CAAC,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAED,GAAG,CAAC,IAAI,CACN,kBAAkB,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,0DAA0D,IAAI,CAAC,UAAU,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,CACnJ,CAAC;IACF,KAAK,UAAU,CAAC,CAAC,sBAAsB;AACzC,CAAC"}
+{"version":3,"file":"lifecycle.js","sourceRoot":"","sources":["../src/lifecycle.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAwB,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACjG,OAAO,EAAE,kBAAkB,EAAoB,MAAM,cAAc,CAAC;AAEpE,uEAAuE;AACvE,SAAS,iBAAiB;IACxB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC;SACjC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;SAC9C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;IAClD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,IAAI;YAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACvC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc;IACrB,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;IAClC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC,CAAC;QAC1D,GAAG,CAAC,IAAI,CACN,OAAO,IAAI,CAAC,8BAA8B,CAAC,2CAA2C,GAAG,CAAC,wBAAwB,CAAC,iCAAiC,CACrJ,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,sBAAsB,CACnC,IAAoC,EACpC,MAAc,EACd,SAAiB,EACjB,MAAe;IAEf,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI,CACP,KAAK,EACL,UAAU,EACV,MAAM,EACN,UAAU,EACV,MAAM,IAAI,cAAc,EACxB,WAAW,EACX,SAAS,EACT,UAAU,EACV,kBAAkB,MAAM,EAAE,EAC1B,+BAA+B,CAChC,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,IAAI,CACP,KAAK,EACL,WAAW,EACX,MAAM,EACN,WAAW,EACX,SAAS,EACT,UAAU,EACV,SAAS,MAAM,EAAE,EACjB,sBAAsB,CACvB,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM;SACrB,IAAI,EAAE;SACN,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED,4EAA4E;AAC5E,uCAAuC;AACvC,4EAA4E;AAE5E,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,CAAC;IAC7C,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC,CAAC;IACrE,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1C,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,eAAe,CAAC,EAAE,CAAC,CAAC;IAEhE,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC5B,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,CAAC,+BAA+B,IAAI,CAAC,QAAQ,uBAAuB,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,IAAI,iBAAiB,GAAwD,IAAI,CAAC;AAClF,KAAK,UAAU,mBAAmB;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,iBAAiB,IAAI,GAAG,GAAG,iBAAiB,CAAC,SAAS,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;QAC5E,OAAO,iBAAiB,CAAC,MAAM,CAAC;IAClC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,kEAAkE,EAAE;YAC1F,OAAO,EAAE,EAAE,MAAM,EAAE,6BAA6B,EAAE;SACnD,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,iBAAiB,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAC;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC;QACrC,iBAAiB,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QAC/C,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAqB;IAC5C,IAAI,CAAC,IAAI,CAAC,SAAS;QAAE,OAAO;IAC5B,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;IACpB,CAAC,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAE7D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC;IAC7C,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAC5C,aAAa,EACb,wBAAwB,EACxB,IAAI,CAAC,SAAS,EACd,MAAM,CACP,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAC1C,cAAc,EACd,qBAAqB,EACrB,IAAI,CAAC,SAAS,CACf,CAAC;IACF,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC,CAAC;QAChF,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC;QAC5B,KAAK;QACL,UAAU;QACV,UAAU;QACV,SAAS;QACT,UAAU;QACV,MAAM;QACN,WAAW;QACX,IAAI,CAAC,SAAS;QACd,4BAA4B;KAC7B,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC;QAC5B,KAAK;QACL,WAAW;QACX,UAAU;QACV,OAAO;QACP,WAAW;QACX,IAAI,CAAC,SAAS;QACd,uBAAuB;KACxB,CAAC,CAAC;IACH,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAEvC,iEAAiE;IACjE,mEAAmE;IACnE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAC9C,MAAM,YAAY,GAAG,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC;IAC1D,MAAM,WAAW,GACf,YAAY,IAAI,YAAY,KAAK,aAAa;QAC5C,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,YAAY,YAAY,CAAC,iDAAiD;QAC1F,CAAC,CAAC,YAAY,KAAK,aAAa;YAC9B,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;YACrB,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAEhC,IAAI,CACF;QACE,GAAG,GAAG,CAAC,qBAAqB,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;QAC7F,GAAG,GAAG,CAAC,iBAAiB,CAAC,QAAQ,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;QAC5F,GAAG,GAAG,CAAC,aAAa,CAAC,aAAa,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE;QAClE,GAAG,GAAG,CAAC,mBAAmB,CAAC,OAAO,IAAI,CAAC,iBAAiB,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE;QACxE,GAAG,GAAG,CAAC,aAAa,CAAC,cAAc,aAAa,KAAK,WAAW,EAAE;KACnE,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,QAAQ,CACT,CAAC;AACJ,CAAC;AA2BD;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAC7B,MAAc,EACd,OAAe,EACf,IAAY,EACZ,KAAa,EACb,GAAW;IAEX,MAAM,GAAG,GAAG,WAAW,MAAM,sBAAsB,OAAO,IAAI,IAAI,IAAI,KAAK,cAAc,GAAG,EAAE,CAAC;IAC/F,qEAAqE;IACrE,mEAAmE;IACnE,iEAAiE;IACjE,+CAA+C;IAC/C,MAAM,MAAM,GAAG;QACb,sDAAsD;QACtD,4CAA4C;QAC5C,2DAA2D;QAC3D,yCAAyC;KAC1C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACZ,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC;QACvE,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,MAAM,IAAI,WAAW,EAAE,EAAE,CAAC;QACrF,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,KAAK,UAAU,mBAAmB,CAChC,SAAiB,EACjB,MAAc,EACd,WAAmB;IAEnB,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC;QACrB,KAAK;QACL,UAAU;QACV,UAAU;QACV,WAAW;QACX,UAAU;QACV,MAAM;QACN,WAAW;QACX,SAAS;QACT,gDAAgD;KACjD,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACnD,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,2EAA2E;AAC3E,KAAK,UAAU,cAAc,CAC3B,SAAiB,EACjB,MAAc,EACd,WAAmB;IAEnB,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC;QACrB,KAAK;QACL,UAAU;QACV,UAAU;QACV,WAAW;QACX,UAAU;QACV,MAAM;QACN,WAAW;QACX,SAAS;QACT,4BAA4B;KAC7B,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,SAAiB,EACjB,MAAc,EACd,WAAmB,EACnB,aAAqB;IAErB,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC;QACrB,KAAK;QACL,UAAU;QACV,gBAAgB;QAChB,WAAW;QACX,UAAU;QACV,MAAM;QACN,WAAW;QACX,SAAS;QACT,gBAAgB;QAChB,GAAG,aAAa,MAAM;QACtB,SAAS;KACV,CAAC,CAAC;IACH,OAAO,CAAC,CAAC,EAAE,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,uBAAuB,CACpC,IAAqB,EACrB,MAAc,EACd,gBAAwB;IAExB,IAAI,IAAI,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC;QACrB,SAAS;QACT,kBAAkB;QAClB,MAAM;QACN,UAAU;QACV,aAAa,IAAI,CAAC,SAAS,EAAE;QAC7B,+CAA+C;QAC/C,sBAAsB;KACvB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACnE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAoB,EAAE;IACzD,MAAM,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,CAAC;IAClC,qEAAqE;IACrE,6DAA6D;IAC7D,qEAAqE;IACrE,mEAAmE;IACnE,mEAAmE;IACnE,4DAA4D;IAC5D,0BAA0B;IAC1B,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;QAChE,GAAG,CAAC,IAAI,CAAC,wBAAwB,IAAI,CAAC,QAAQ,uBAAuB,CAAC,CAAC;QACvE,OAAO;IACT,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,SAAS;QAAE,OAAO;IAE5B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC;IAC7C,MAAM,eAAe,GAAG,eAAe,CAAC;IACxC,MAAM,cAAc,GAAG,cAAc,CAAC;IACtC,MAAM,YAAY,GAAG,kBAAkB,CAAC;IAExC,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE;QACtB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;QAC7F,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACvC,IAAI,IAAI,CAAC,OAAO,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC;QAC3C,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC,EAAE,CAAC;IACL,GAAG,CAAC,IAAI,CAAC,gCAAgC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAE5D,mEAAmE;IACnE,iEAAiE;IACjE,kEAAkE;IAClE,qEAAqE;IACrE,mEAAmE;IACnE,MAAM,KAAK,GAAkB,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,KAAK,CAAC,uEAAuE,CAAC,CAAC;IACpF,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,SAAS,CAAU,EAAE,CAAC;QACjD,MAAM,WAAW,GAAG,MAAM,sBAAsB,CAC9C,aAAa,EACb,oBAAoB,IAAI,EAAE,EAC1B,IAAI,CAAC,SAAS,EACd,MAAM,CACP,CAAC;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,mCAAmC,IAAI,qBAAqB,CAAC,CAAC,CAAC;YAC7E,OAAO;QACT,CAAC;QACD,kEAAkE;QAClE,oEAAoE;QACpE,iEAAiE;QACjE,+DAA+D;QAC/D,gEAAgE;QAChE,8DAA8D;QAC9D,6DAA6D;QAC7D,8DAA8D;QAC9D,2DAA2D;QAC3D,MAAM,SAAS,GAAG,MAAM,gBAAgB,CACtC,cAAc,EACd,eAAe,EACf,YAAY,EACZ,IAAI,EACJ,SAAS,CACV,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,qCAAqC,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC;YACzE,GAAG,CAAC,KAAK,CACP,4BAA4B,SAAS,CAAC,MAAM,KAAK;gBAC/C,oCAAoC,cAAc,mBAAmB,eAAe,IAAI,YAAY,IAAI,IAAI,IAAI,SAAS,IAAI;gBAC7H,2GAA2G,CAC9G,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;QAChC,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACrF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,0CAA0C,IAAI,qBAAqB,CAAC,CAAC,CAAC;YACpF,OAAO;QACT,CAAC;QACD,KAAK,CAAC,IAAI,CAAC;YACT,IAAI;YACJ,WAAW;YACX,MAAM;YACN,QAAQ,EAAE,GAAG,cAAc,mBAAmB,eAAe,IAAI,YAAY,IAAI,IAAI,IAAI,MAAM,EAAE;YACjG,aAAa;SACd,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,KAAK,CAAC,MAAM,mBAAmB,CAAC,CAAC,CAAC;IAErE,mEAAmE;IACnE,8DAA8D;IAC9D,kEAAkE;IAClE,kEAAkE;IAClE,0CAA0C;IAC1C,EAAE;IACF,mEAAmE;IACnE,mEAAmE;IACnE,gEAAgE;IAChE,0BAA0B;IAC1B,mEAAmE;IACnE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC;QAC7F,IAAI,CAAC,QAAQ;YAAE,OAAO;IACxB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,oDAAoD,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,mEAAmE;IACnE,+DAA+D;IAC/D,iEAAiE;IACjE,2DAA2D;IAC3D,uDAAuD;IACvD,mEAAmE;IACnE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACrD,MAAM,EAAE,2BAA2B,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAC9E,qEAAqE;IACrE,+DAA+D;IAC/D,kEAAkE;IAClE,kEAAkE;IAClE,iEAAiE;IACjE,6DAA6D;IAC7D,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,MAAM,2BAA2B,CAAC;QAC5C,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,MAAM;QACN,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5D,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,sBAAsB,GAAG,CAAC,KAAK,IAAI,SAAS,sBAAsB,CAAC,CAAC,CAAC;QACnF,GAAG,CAAC,IAAI,CACN,2DAA2D;YACzD,yDAAyD;YACzD,iDAAiD;YACjD,aAAa,IAAI,CAAC,SAAS,aAAa,CAC3C,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAEvC,mEAAmE;IACnE,mEAAmE;IACnE,uEAAuE;IACvE,sEAAsE;IACtE,wEAAwE;IACxE,oEAAoE;IACpE,iEAAiE;IACjE,mEAAmE;IACnE,IAAI,iBAAiB,GAAkB,IAAI,CAAC;IAC5C,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC;QACpF,MAAM,GAAG,GAAG,QAAQ;YAClB,CAAC,CAAC,MAAM,kBAAkB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC;YACnE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAc,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC;QACzE,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,iBAAiB,GAAG,GAAG,CAAC,cAAc,CAAC;YACvC,IAAI,CAAC,IAAI,CACP,KAAK,CAAC,qBAAqB,GAAG,CAAC,cAAc,KAAK,GAAG,CAAC,SAAS,CAAC,MAAM,eAAe,CAAC,CACvF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,8BAA8B,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAC7D,GAAG,CAAC,IAAI,CACN,sFAAsF,CACvF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,mEAAmE;IACnE,mEAAmE;IACnE,uDAAuD;IACvD,mEAAmE;IACnE,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;QACpB,CAAC,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QACjE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC;YACvB,KAAK;YACL,UAAU;YACV,QAAQ;YACR,IAAI,CAAC,WAAW;YAChB,UAAU;YACV,MAAM;YACN,WAAW;YACX,IAAI,CAAC,SAAS;YACd,SAAS;YACT,IAAI,CAAC,QAAQ;YACb,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,iBAAiB;gBAC5C,CAAC,CAAC,CAAC,mDAAmD,iBAAiB,EAAE,CAAC;gBAC1E,CAAC,CAAC,EAAE,CAAC;YACP,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;YAC5C,MAAM,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,mEAAmE;QACnE,kEAAkE;QAClE,+DAA+D;QAC/D,oEAAoE;QACpE,kEAAkE;QAClE,mEAAmE;QACnE,mEAAmE;QACnE,iEAAiE;QACjE,8CAA8C;QAC9C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC;YACxB,KAAK;YACL,UAAU;YACV,gBAAgB;YAChB,IAAI,CAAC,WAAW;YAChB,UAAU;YACV,MAAM;YACN,WAAW;YACX,IAAI,CAAC,SAAS;YACd,aAAa;YACb,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,kCAAkC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;YACpE,MAAM,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YACtE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,qCAAqC,IAAI,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC;YAC7E,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YACpF,MAAM,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,mEAAmE;QACnE,kEAAkE;QAClE,iEAAiE;QACjE,mEAAmE;QACnE,kEAAkE;QAClE,oEAAoE;QACpE,oEAAoE;QACpE,iEAAiE;QACjE,kEAAkE;QAClE,kEAAkE;QAClE,gEAAgE;QAChE,iEAAiE;QACjE,mCAAmC;QACnC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,cAAc,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QACzE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IACD,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,8CAA8C,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;GAKG;AACH,+EAA+E;AAC/E,SAAS,WAAW,CAAC,IAAc;IACjC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAClE,OAAO,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,qBAAqB;IAClC,IAAI,WAAW,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpD,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC,CAAC;IAExF,iEAAiE;IACjE,6DAA6D;IAC7D,kEAAkE;IAClE,wCAAwC;IACxC,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,WAAW,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;QACxE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC;YAC5B,OAAO,EAAE,8DAA8D;YACvE,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YAC3C,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;YACpB,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;YAC/B,MAAM,aAAa,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE;gBACjE,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;YACH,IAAI,aAAa,CAAC,QAAQ,KAAK,CAAC,IAAI,WAAW,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;gBACvE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;gBACpC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAC9D,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC,CAAC;YAC1C,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,GAAG,CAAC,IAAI,CACN,mBAAmB;QACjB,6CAA6C;QAC7C,+DAA+D;QAC/D,0FAA0F,CAC7F,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,eAAe,CAC5B,KAAoB,EACpB,cAAsB,EACtB,eAAuB,EACvB,YAAoB;IAEpB,+DAA+D;IAC/D,+DAA+D;IAC/D,gEAAgE;IAChE,kEAAkE;IAClE,yBAAyB;IACzB,IAAI,CAAC,CAAC,MAAM,qBAAqB,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAEnD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;QACpB,CAAC,CAAC,KAAK,CAAC,kCAAkC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QACtF,MAAM,OAAO,GAAG,GAAG,cAAc,mBAAmB,eAAe,IAAI,YAAY,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAClH,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS,CAC1B;YACE,QAAQ;YACR,QAAQ;YACR,OAAO;YACP,+BAA+B;YAC/B,2DAA2D;YAC3D,0DAA0D;YAC1D,oDAAoD;YACpD,0FAA0F;YAC1F,2BAA2B;YAC3B,6CAA6C;SAC9C,EACD,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CACnC,CAAC;QACF,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACvD,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,4BAA4B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACrD,GAAG,CAAC,KAAK,CACP,GAAG,CACD,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,kEAAkE;gBACxG,WAAW;gBACX,wCAAwC;gBACxC,iFAAiF;gBACjF,yDAAyD;gBACzD,kBAAkB,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAClD,CACF,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,uBAAuB,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,SAAiB,EACjB,MAAc,EACd,MAAqB;IAErB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAChC,GAAG,CAAC,IAAI,CACN,MAAM,CAAC,gBAAgB,MAAM,CAAC,MAAM,mDAAmD,CAAC,CACzF,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1F,GAAG,CAAC,IAAI,CACN,EAAE;YACA,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,IAAI,wBAAwB,IAAI,CAAC,aAAa,EAAE,CAAC;YACnE,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,IAAI,wCAAwC,CAAC,CAChE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,4DAA4D;AAC5D,4EAA4E;AAE5E,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,CAAC;IAClC,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC5B,GAAG,CAAC,IAAI,CAAC,uBAAuB,IAAI,CAAC,QAAQ,uBAAuB,CAAC,CAAC;QACtE,OAAO;IACT,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,SAAS;QAAE,OAAO;IAE5B,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;IACpB,CAAC,CAAC,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAC1C,cAAc,EACd,qBAAqB,EACrB,IAAI,CAAC,SAAS,CACf,CAAC;IACF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC,CAAC;QACtE,OAAO;IACT,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC;QACrB,KAAK;QACL,SAAS;QACT,QAAQ;QACR,YAAY;QACZ,OAAO;QACP,WAAW;QACX,IAAI,CAAC,SAAS;QACd,eAAe;QACf,oBAAoB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;KAC/C,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACV,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1C,OAAO;IACT,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,kEAAkE,OAAO,KAAK,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,4EAA4E;AAC5E,uBAAuB;AACvB,4EAA4E;AAE5E,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAwB;IAChE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC,CAAC;QACxD,GAAG,CAAC,IAAI,CACN,UAAU;YACR,mBAAmB;YACnB,aAAa;YACb,eAAe;YACf,YAAY;YACZ,mBAAmB;YACnB,gBAAgB;SACjB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACf,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,CAAC;IAClC,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC5B,GAAG,CAAC,IAAI,CAAC,8BAA8B,IAAI,CAAC,QAAQ,uBAAuB,CAAC,CAAC;QAC7E,OAAO;IACT,CAAC;IACD,GAAG,CAAC,IAAI,CACN,MAAM,CACJ,oGAAoG,CACrG,CACF,CAAC;IACF,IAAI,CACF;QACE,IAAI,CAAC,8BAA8B,CAAC;QACpC,EAAE;QACF,KAAK,IAAI,CAAC,wEAAwE,IAAI,4BAA4B,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE;QACrI,EAAE;QACF,yDAAyD;QACzD,KAAK,IAAI,CAAC,sCAAsC,CAAC,EAAE;KACpD,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,eAAe,CAChB,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,oDAAoD;AACpD,4EAA4E;AAE5E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,CAAC;IAElC,GAAG,CAAC,IAAI,CACN,MAAM,CACJ,GAAG,IAAI,CAAC,UAAU,CAAC,2JAA2J,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK;QAClM,2FAA2F,CAC9F,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC;QAC7B,OAAO,EAAE,uBAAuB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,aAAa,CAAC,IAAI;QAC/F,YAAY,EAAE,KAAK;KACpB,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,MAAM,CAAC,YAAY,CAAC,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACtD,CAAC,CAAC,IAAI,CAAC;QACL,OAAO,EAAE,+BAA+B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;QAC3D,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iCAAiC,CAAC;KACrF,CAAC,CACH,CAAC;IACF,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,CAAC,YAAY,CAAC,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;QACpC,GAAG,CAAC,IAAI,CACN,+DAA+D;YAC7D,GAAG,IAAI,CAAC,wFAAwF,CAAC,GAAG;YACpG,2CAA2C,CAC9C,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,cAAc,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACpF,MAAM,EAAE,sBAAsB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACzE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC;QAC7C,MAAM,CAAC,GAAG,MAAM,sBAAsB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,CAAC,oBAAoB,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;YACvC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,CACF;YACE,KAAK,CAAC,0BAA0B,IAAI,CAAC,MAAM,GAAG,CAAC;YAC/C,EAAE;YACF,0EAA0E;YAC1E,yEAAyE;SAC1E,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,MAAM,CACP,CAAC;QACF,OAAO;IACT,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,yCAAyC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,CAAC;IAE7C,GAAG,CAAC,IAAI,CACN,GAAG,CACD,GAAG,IAAI,CAAC,iCAAiC,CAAC,iGAAiG,CAC5I,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC;QAC7B,OAAO,EAAE,2BAA2B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,aAAa,CAAC,IAAI;QACnG,YAAY,EAAE,KAAK;KACpB,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,MAAM,CAAC,YAAY,CAAC,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACtD,CAAC,CAAC,IAAI,CAAC;QACL,OAAO,EAAE,+BAA+B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;QAC3D,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iCAAiC,CAAC;KACrF,CAAC,CACH,CAAC;IACF,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,CAAC,YAAY,CAAC,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QAC9C,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;QACpB,CAAC,CAAC,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,KAAK,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QAC1E,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;YAC1C,GAAG,CAAC,IAAI,CACN,0HAA0H,IAAI,CAAC,SAAS,EAAE,CAC3I,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,SAAS,gDAAgD,CAAC,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAED,GAAG,CAAC,IAAI,CACN,kBAAkB,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,0DAA0D,IAAI,CAAC,UAAU,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,CACnJ,CAAC;IACF,KAAK,UAAU,CAAC,CAAC,sBAAsB;AACzC,CAAC"}

package/dist/mcp-iap.d.ts

@@ -0,0 +1,49 @@
+/**
+ * MCP access through IAP (issue #37), for installs that exist already.
+ *
+ * External MCP clients reach the IAP-protected admin with a JWT signed by a
+ * dedicated service account (see packages/mcp-server/src/ingress-auth.ts).
+ * New installs get that SA from the Pulumi stacks; `cms-provision upgrade`
+ * calls {@link ensureMcpIapAccess} so installs provisioned before it get the
+ * same setup on their next upgrade, with no operator config:
+ *
+ *   1. service account `caelo-mcp@<project>` (created if missing)
+ *   2. `roles/iap.httpsResourceAccessor` for that SA on the admin's IAP
+ *      resource (Cloud Run service on gcp-firebase, LB backend on gcp)
+ *   3. `roles/iam.serviceAccountTokenCreator` on that SA for every user /
+ *      group the IAP policy already lets in — exactly the people who can
+ *      open the admin in a browser can also drive it over MCP
+ *
+ * Every step is an additive IAM binding or a create-if-missing, so re-running
+ * is a no-op. The caller puts the returned email into the admin's
+ * `CAELO_MCP_IAP_SERVICE_ACCOUNT` env var, which /security/mcp shows in the
+ * `claude mcp add` command.
+ */
+import { type GcloudResult } from "./gcloud.js";
+export declare const MCP_IAP_SERVICE_ACCOUNT_ID = "caelo-mcp";
+export declare function mcpIapServiceAccountEmail(projectId: string): string;
+/** The admin's IAP resource, as `gcloud iap web` addresses it. */
+export type IapResource = {
+    readonly kind: "cloud-run";
+    readonly service: string;
+    readonly region: string;
+} | {
+    readonly kind: "backend-services";
+    readonly service: string;
+};
+/** Users and groups IAP lets into the admin (service accounts excluded). */
+export declare function iapOperators(policyJson: string): string[];
+export declare function ensureMcpIapAccess(opts: {
+    projectId: string;
+    resource: IapResource;
+    run?: (args: string[]) => Promise<GcloudResult>;
+    sleep?: (ms: number) => Promise<void>;
+}): Promise<{
+    ok: true;
+    serviceAccount: string;
+    operators: string[];
+} | {
+    ok: false;
+    error: string;
+}>;
+//# sourceMappingURL=mcp-iap.d.ts.map

package/dist/mcp-iap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-iap.d.ts","sourceRoot":"","sources":["../src/mcp-iap.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAA2B,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAEzE,eAAO,MAAM,0BAA0B,cAAc,CAAC;AAEtD,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,kEAAkE;AAClE,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACjF;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAQpE,4EAA4E;AAC5E,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAQzD;AAKD,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,WAAW,CAAC;IACtB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAChD,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC,GAAG,OAAO,CACT;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CACzF,CAgFA"}

package/dist/mcp-iap.js

@@ -0,0 +1,122 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * MCP access through IAP (issue #37), for installs that exist already.
+ *
+ * External MCP clients reach the IAP-protected admin with a JWT signed by a
+ * dedicated service account (see packages/mcp-server/src/ingress-auth.ts).
+ * New installs get that SA from the Pulumi stacks; `cms-provision upgrade`
+ * calls {@link ensureMcpIapAccess} so installs provisioned before it get the
+ * same setup on their next upgrade, with no operator config:
+ *
+ *   1. service account `caelo-mcp@<project>` (created if missing)
+ *   2. `roles/iap.httpsResourceAccessor` for that SA on the admin's IAP
+ *      resource (Cloud Run service on gcp-firebase, LB backend on gcp)
+ *   3. `roles/iam.serviceAccountTokenCreator` on that SA for every user /
+ *      group the IAP policy already lets in — exactly the people who can
+ *      open the admin in a browser can also drive it over MCP
+ *
+ * Every step is an additive IAM binding or a create-if-missing, so re-running
+ * is a no-op. The caller puts the returned email into the admin's
+ * `CAELO_MCP_IAP_SERVICE_ACCOUNT` env var, which /security/mcp shows in the
+ * `claude mcp add` command.
+ */
+import { gcloud as defaultGcloud } from "./gcloud.js";
+export const MCP_IAP_SERVICE_ACCOUNT_ID = "caelo-mcp";
+export function mcpIapServiceAccountEmail(projectId) {
+    return `${MCP_IAP_SERVICE_ACCOUNT_ID}@${projectId}.iam.gserviceaccount.com`;
+}
+function iapResourceArgs(resource) {
+    return resource.kind === "cloud-run"
+        ? ["--resource-type=cloud-run", `--service=${resource.service}`, `--region=${resource.region}`]
+        : ["--resource-type=backend-services", `--service=${resource.service}`];
+}
+/** Users and groups IAP lets into the admin (service accounts excluded). */
+export function iapOperators(policyJson) {
+    const policy = JSON.parse(policyJson);
+    const members = (policy.bindings ?? [])
+        .filter((b) => b.role === "roles/iap.httpsResourceAccessor" && !b.condition)
+        .flatMap((b) => b.members ?? []);
+    return [...new Set(members.filter((m) => m.startsWith("user:") || m.startsWith("group:")))];
+}
+const SA_NOT_YET_VISIBLE = /does not exist|not found|NOT_FOUND/i;
+const RETRY_DELAYS_MS = [2_000, 4_000, 8_000, 16_000];
+export async function ensureMcpIapAccess(opts) {
+    const run = opts.run ?? defaultGcloud;
+    const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const project = `--project=${opts.projectId}`;
+    const sa = mcpIapServiceAccountEmail(opts.projectId);
+    // A freshly created SA takes a few seconds to become bindable.
+    const withRetry = async (args) => {
+        let r = await run(args);
+        for (const delay of RETRY_DELAYS_MS) {
+            if (r.ok || !SA_NOT_YET_VISIBLE.test(r.stderr))
+                break;
+            await sleep(delay);
+            r = await run(args);
+        }
+        return r;
+    };
+    const describe = await run([
+        "iam",
+        "service-accounts",
+        "describe",
+        sa,
+        project,
+        "--format=value(email)",
+    ]);
+    if (!describe.ok) {
+        const create = await run([
+            "iam",
+            "service-accounts",
+            "create",
+            MCP_IAP_SERVICE_ACCOUNT_ID,
+            "--display-name=Caelo MCP (IAP ingress)",
+            "--description=Signs the IAP credential external MCP clients use to reach the admin (issue #37).",
+            project,
+        ]);
+        if (!create.ok && !/already exists/i.test(create.stderr)) {
+            return { ok: false, error: `create ${sa}: ${create.stderr.trim()}` };
+        }
+    }
+    const policy = await run([
+        "iap",
+        "web",
+        "get-iam-policy",
+        ...iapResourceArgs(opts.resource),
+        project,
+        "--format=json",
+    ]);
+    if (!policy.ok)
+        return { ok: false, error: `read IAP policy: ${policy.stderr.trim()}` };
+    const operators = iapOperators(policy.stdout);
+    const allow = await withRetry([
+        "iap",
+        "web",
+        "add-iam-policy-binding",
+        ...iapResourceArgs(opts.resource),
+        `--member=serviceAccount:${sa}`,
+        "--role=roles/iap.httpsResourceAccessor",
+        "--condition=None",
+        project,
+        "--quiet",
+    ]);
+    if (!allow.ok)
+        return { ok: false, error: `allow ${sa} on IAP: ${allow.stderr.trim()}` };
+    for (const member of operators) {
+        const grant = await withRetry([
+            "iam",
+            "service-accounts",
+            "add-iam-policy-binding",
+            sa,
+            `--member=${member}`,
+            "--role=roles/iam.serviceAccountTokenCreator",
+            "--condition=None",
+            project,
+            "--quiet",
+        ]);
+        if (!grant.ok)
+            return { ok: false, error: `let ${member} sign as ${sa}: ${grant.stderr.trim()}` };
+    }
+    return { ok: true, serviceAccount: sa, operators };
+}
+//# sourceMappingURL=mcp-iap.js.map

package/dist/mcp-iap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-iap.js","sourceRoot":"","sources":["../src/mcp-iap.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,MAAM,IAAI,aAAa,EAAqB,MAAM,aAAa,CAAC;AAEzE,MAAM,CAAC,MAAM,0BAA0B,GAAG,WAAW,CAAC;AAEtD,MAAM,UAAU,yBAAyB,CAAC,SAAiB;IACzD,OAAO,GAAG,0BAA0B,IAAI,SAAS,0BAA0B,CAAC;AAC9E,CAAC;AAOD,SAAS,eAAe,CAAC,QAAqB;IAC5C,OAAO,QAAQ,CAAC,IAAI,KAAK,WAAW;QAClC,CAAC,CAAC,CAAC,2BAA2B,EAAE,aAAa,QAAQ,CAAC,OAAO,EAAE,EAAE,YAAY,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC/F,CAAC,CAAC,CAAC,kCAAkC,EAAE,aAAa,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,YAAY,CAAC,UAAkB;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAEnC,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;SACpC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,iCAAiC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;SAC3E,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9F,CAAC;AAED,MAAM,kBAAkB,GAAG,qCAAqC,CAAC;AACjE,MAAM,eAAe,GAAsB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAEzE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAKxC;IAGC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1F,MAAM,OAAO,GAAG,aAAa,IAAI,CAAC,SAAS,EAAE,CAAC;IAC9C,MAAM,EAAE,GAAG,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAErD,+DAA+D;IAC/D,MAAM,SAAS,GAAG,KAAK,EAAE,IAAc,EAAyB,EAAE;QAChE,IAAI,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;YACpC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;gBAAE,MAAM;YACtD,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;YACnB,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;QACzB,KAAK;QACL,kBAAkB;QAClB,UAAU;QACV,EAAE;QACF,OAAO;QACP,uBAAuB;KACxB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;YACvB,KAAK;YACL,kBAAkB;YAClB,QAAQ;YACR,0BAA0B;YAC1B,wCAAwC;YACxC,iGAAiG;YACjG,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QACvE,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;QACvB,KAAK;QACL,KAAK;QACL,gBAAgB;QAChB,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC;QACjC,OAAO;QACP,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACxF,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAE9C,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC;QAC5B,KAAK;QACL,KAAK;QACL,wBAAwB;QACxB,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC;QACjC,2BAA2B,EAAE,EAAE;QAC/B,wCAAwC;QACxC,kBAAkB;QAClB,OAAO;QACP,SAAS;KACV,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IAEzF,KAAK,MAAM,MAAM,IAAI,SAAS,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC;YAC5B,KAAK;YACL,kBAAkB;YAClB,wBAAwB;YACxB,EAAE;YACF,YAAY,MAAM,EAAE;YACpB,6CAA6C;YAC7C,kBAAkB;YAClB,OAAO;YACP,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,EAAE;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,MAAM,YAAY,EAAE,KAAK,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACvF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;AACrD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@caelo-cms/provisioning",
-  "version": "0.10.27",
+  "version": "0.10.29",
   "private": false,
   "license": "MPL-2.0",
   "description": "Pulumi-driven provisioning for Caelo CMS — `bunx @caelo-cms/provisioning --provider <self-hosted|gcp|aws|azure>` brings up a TLS-served install with Postgres + storage + secrets manager + the admin + the API gateway.",
@@ -38,8 +38,8 @@
     "prepublishOnly": "tsc -b --force && tsc --project stacks/gcp/tsconfig.json && tsc --project stacks/gcp-firebase/tsconfig.json"
   },
   "dependencies": {
-    "@caelo-cms/edge-router": "^0.10.27",
-    "@caelo-cms/shared": "^0.10.27",
+    "@caelo-cms/edge-router": "^0.10.29",
+    "@caelo-cms/shared": "^0.10.29",
     "@clack/prompts": "1.8.1",
     "@pulumi/aws": "^7",
     "@pulumi/awsx": "^3",

package/stacks/azure/index.ts

@@ -243,7 +243,12 @@ function containerApp(args: ContainerAppArgs): azure.app.ContainerApp {
   });
 }
 
-const adminApp = containerApp({ serviceName: "admin" });
+const adminApp = containerApp({
+  serviceName: "admin",
+  // #551 — the public site URL; the admin seeds site_defaults.site_base_url
+  // from it (canonical, og:url, sitemap) when it is not configured yet.
+  extraEnv: [{ name: "CAELO_SITE_URL", value: `https://${domain}` }],
+});
 const _gatewayApp = containerApp({ serviceName: "gateway" });
 const _orchestratorApp = containerApp({ serviceName: "orchestrator" });
 const _runnerApp = containerApp({ serviceName: "runner" });

package/stacks/gcp/index.ts

@@ -603,6 +603,9 @@ function cloudRunService(args: CloudRunArgs): gcp.cloudrunv2.Service {
   );
 }
 
+// Issue #37 — deterministic, so the admin env can carry it as a plain string.
+const mcpServiceAccountEmail = `caelo-mcp@${project}.iam.gserviceaccount.com`;
+
 const adminSvc = cloudRunService({
   serviceName: "admin",
   minInstances: adminMinInstances,
@@ -627,9 +630,14 @@ const adminSvc = cloudRunService({
   // sit where the walk expects.
   extraEnv: [
     { name: "PUBLIC_ADMIN_DATABASE_URL", value: publicAdminDatabaseUrl },
+    // #551 — the public site URL; the admin seeds site_defaults.site_base_url
+    // from it (canonical, og:url, sitemap) when it is not configured yet.
+    { name: "CAELO_SITE_URL", value: `https://${domain}` },
     { name: "CAELO_STATIC_BUCKET", value: staticBucket.name },
     { name: "CAELO_STAGING_BUCKET", value: stagingBucket.name },
     { name: "CAELO_GENERATOR_CLI", value: "/app/apps/static-generator/src/cli.ts" },
+    // Issue #37 — shown in the /security/mcp `claude mcp add` command.
+    { name: "CAELO_MCP_IAP_SERVICE_ACCOUNT", value: mcpServiceAccountEmail },
   ],
 });
 const gatewaySvc = cloudRunService({
@@ -718,6 +726,15 @@ const wafPolicy = new gcp.compute.SecurityPolicy(
 );
 
 // Tier 1 backend — static GCS bucket via Cloud CDN
+//
+// The GCS publisher sets an explicit Cache-Control on every object
+// (static-publisher-gcs.ts): content-hashed fonts / plugin bundles are
+// `max-age=31536000, immutable`, pages `max-age=60` + SWR. In
+// CACHE_ALL_STATIC mode `clientTtl` CLAMPS the max-age sent to
+// browsers and `maxTtl` caps the edge TTL, so both must allow a year
+// or the immutable policy is silently cut back to the old 1h. Objects
+// that state a shorter max-age keep it; `defaultTtl` still applies only
+// to responses without one.
 const staticBackendBucket = new gcp.compute.BackendBucket(
   `${namePrefix}-static-backend`,
   {
@@ -726,8 +743,8 @@ const staticBackendBucket = new gcp.compute.BackendBucket(
     cdnPolicy: {
       cacheMode: "CACHE_ALL_STATIC",
       defaultTtl: 3600,
-      maxTtl: 86400,
-      clientTtl: 3600,
+      maxTtl: 31536000,
+      clientTtl: 31536000,
     },
   },
   opts,
@@ -823,6 +840,58 @@ for (const principal of iapAllowlist) {
   );
 }
 
+// =========================================================================
+// MCP through IAP (issue #37)
+// =========================================================================
+//
+// External MCP clients (`@caelo-cms/mcp-server`) can't use the browser's IAP
+// login, and IAP's Google-managed OAuth client allows no programmatic user
+// tokens. They present a JWT signed by this service account instead (signed
+// via IAM Credentials `signJwt` with the operator's own ADC — no keys).
+// Everyone on the IAP allowlist may sign as it, so MCP access matches admin
+// browser access. `cms-provision upgrade` ensures the same for installs that
+// predate this (packages/provisioning/src/mcp-iap.ts), hence
+// createIgnoreAlreadyExists.
+const mcpServiceAccount = new gcp.serviceaccount.Account(
+  `${namePrefix}-mcp-sa`,
+  {
+    project,
+    accountId: "caelo-mcp",
+    displayName: "Caelo MCP (IAP ingress)",
+    description:
+      "Signs the IAP credential external MCP clients use to reach the admin (issue #37).",
+    createIgnoreAlreadyExists: true,
+  },
+  opts,
+);
+
+for (const principal of iapAllowlist) {
+  const slug = principal
+    .replace(/[^a-z0-9]/gi, "-")
+    .slice(0, 40)
+    .toLowerCase();
+  new gcp.serviceaccount.IAMMember(
+    `${namePrefix}-mcp-token-creator-${slug}`,
+    {
+      serviceAccountId: mcpServiceAccount.name,
+      role: "roles/iam.serviceAccountTokenCreator",
+      member: principal,
+    },
+    opts,
+  );
+}
+
+new gcp.iap.WebBackendServiceIamMember(
+  `${namePrefix}-admin-iap-mcp`,
+  {
+    project,
+    webBackendService: adminBackendService.name,
+    role: "roles/iap.httpsResourceAccessor",
+    member: pulumi.interpolate`serviceAccount:${mcpServiceAccount.email}`,
+  },
+  opts,
+);
+
 // URL map: routes by host header.
 //   admin.<domain>  → admin backend (IAP-gated)
 //   <domain>        → default static bucket; /api/* → gateway

package/stacks/gcp-firebase/index.ts

@@ -493,6 +493,9 @@ const gatewaySvc = cloudRunService({
   extraEnv: [{ name: "PUBLIC_DATABASE_URL", value: publicDatabaseUrl }],
 });
 
+// Issue #37 — deterministic, so the admin env can carry it as a plain string.
+const mcpServiceAccountEmail = `caelo-mcp@${project}.iam.gserviceaccount.com`;
+
 const adminSvc = cloudRunService({
   serviceName: "admin",
   minInstances: adminMinInstances,
@@ -507,6 +510,9 @@ const adminSvc = cloudRunService({
     { name: "PUBLIC_ADMIN_DATABASE_URL", value: publicAdminDatabaseUrl },
     // Use the input string (known at config time) — resource output
     // is Output<string | undefined> which Input<string> rejects.
+    // #551 — the public site URL; the admin seeds site_defaults.site_base_url
+    // from it (canonical, og:url, sitemap) when it is not configured yet.
+    { name: "CAELO_SITE_URL", value: `https://${domain}` },
     { name: "CAELO_FIREBASE_SITE", value: firebaseSiteId },
     { name: "CAELO_GENERATOR_CLI", value: "/app/apps/static-generator/src/cli.ts" },
     // v0.3.1 — Firebase publisher needs the gateway service name +
@@ -514,6 +520,8 @@ const adminSvc = cloudRunService({
     // version.
     { name: "CAELO_GATEWAY_SERVICE", value: gatewaySvc.name },
     { name: "CAELO_GATEWAY_REGION", value: region },
+    // Issue #37 — shown in the /security/mcp `claude mcp add` command.
+    { name: "CAELO_MCP_IAP_SERVICE_ACCOUNT", value: mcpServiceAccountEmail },
   ],
 });
 
@@ -713,6 +721,59 @@ for (const principal of iapAllowlist) {
   );
 }
 
+// =========================================================================
+// MCP through IAP (issue #37)
+// =========================================================================
+//
+// External MCP clients (`@caelo-cms/mcp-server`) can't use the browser's IAP
+// login, and IAP's Google-managed OAuth client allows no programmatic user
+// tokens. They present a JWT signed by this service account instead (signed
+// via IAM Credentials `signJwt` with the operator's own ADC — no keys).
+// Everyone on the IAP allowlist may sign as it, so MCP access matches admin
+// browser access. `cms-provision upgrade` ensures the same for installs that
+// predate this (packages/provisioning/src/mcp-iap.ts), hence
+// createIgnoreAlreadyExists.
+const mcpServiceAccount = new gcp.serviceaccount.Account(
+  `${namePrefix}-mcp-sa`,
+  {
+    project,
+    accountId: "caelo-mcp",
+    displayName: "Caelo MCP (IAP ingress)",
+    description:
+      "Signs the IAP credential external MCP clients use to reach the admin (issue #37).",
+    createIgnoreAlreadyExists: true,
+  },
+  opts,
+);
+
+for (const principal of iapAllowlist) {
+  const slug = principal
+    .replace(/[^a-z0-9]/gi, "-")
+    .slice(0, 40)
+    .toLowerCase();
+  new gcp.serviceaccount.IAMMember(
+    `${namePrefix}-mcp-token-creator-${slug}`,
+    {
+      serviceAccountId: mcpServiceAccount.name,
+      role: "roles/iam.serviceAccountTokenCreator",
+      member: principal,
+    },
+    opts,
+  );
+}
+
+new gcp.iap.WebCloudRunServiceIamMember(
+  `${namePrefix}-admin-iap-mcp`,
+  {
+    project,
+    location: region,
+    cloudRunServiceName: adminSvc.name,
+    role: "roles/iap.httpsResourceAccessor",
+    member: pulumi.interpolate`serviceAccount:${mcpServiceAccount.email}`,
+  },
+  opts,
+);
+
 // =========================================================================
 // Outputs — DNS records the operator wires manually
 // =========================================================================