@caelo-cms/provisioning 0.10.29 → 0.10.31

package/dist/operator-access.js

@@ -0,0 +1,562 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * Set up (and converge) the operator-access sync job on a Google IAP install
+ * (`gcp`, `gcp-firebase`). Run by the wizard after migrations and by
+ * `cms-provision upgrade`, both as the operator's own gcloud identity.
+ *
+ * Trust boundary. Who may pass the admin's IAP gate and sign as `caelo-mcp`
+ * follows the Caelo user list. The admin does NOT write that: its runtime
+ * service account holds no IAM-policy rights. A Cloud Run job with its own
+ * service account (admin-core security/operator-access/sync-job.ts) is the
+ * only principal that may change those two bindings, and it only ever grants
+ * individual `user:` emails read from the database. The admin may only start
+ * the job (`roles/run.jobsExecutor` on that job: `run.jobs.run`, not
+ * `run.jobs.runWithOverrides`, so it cannot change the job's command, env or
+ * arguments — cloud.google.com/run/docs/reference/iam/roles) and read its
+ * runs (`roles/run.viewer` on the job). An admin compromise can add users to
+ * the database, but cannot make IAP public or grant any other role.
+ *
+ * What this ensures, every step idempotent:
+ *   1. the Cloud Scheduler API;
+ *   2. the custom role `caeloOperatorAccess` (get/setIamPolicy only);
+ *   3. the job's service account, bound to that role on exactly the admin's
+ *      IAP resource and the `caelo-mcp` service account, plus
+ *      `cloudsql.instanceUser` + `logging.logWriter`;
+ *   4. removal of the admin run SA's operator-access grants an earlier
+ *      revision of this feature gave it;
+ *   5. Cloud SQL IAM database authentication (flag + the job's IAM database
+ *      user, assigned the read-only `operator_access_reader` role that
+ *      migration 0239 creates);
+ *   6. the job itself (admin image, its own SA, its env), the admin's
+ *      execute/view grant on it, and an hourly Cloud Scheduler run.
+ *
+ * The CLI owns all of this rather than the stacks: the database user can only
+ * be given its role once migrations created the role, and a project custom
+ * role id is project-global, so a Pulumi-declared copy would collide with
+ * the one `upgrade` creates on older installs.
+ */
+import { gcloud as defaultGcloud } from "./gcloud.js";
+import { realSleep, runWithRetry } from "./gcloud-retry.js";
+import { gcpNamePrefix, mcpIapServiceAccountEmail, operatorAccessJobName, operatorAccessScheduleName, operatorAccessServiceAccountEmail, operatorAccessServiceAccountId, runServiceAccountEmail, } from "./gcp-names.js";
+import { iapResourceArgs } from "./mcp-iap.js";
+/** The only IAM-writing rights in this feature, held by the sync job's SA alone. */
+export const OPERATOR_ACCESS_ROLE = {
+    roleId: "caeloOperatorAccess",
+    title: "Caelo operator access",
+    description: "Lets the Caelo operator-access sync job set who passes the admin's IAP gate and who may sign as caelo-mcp. Bound only on those two resources, only to the job's service account.",
+    permissions: [
+        "iap.webServices.getIamPolicy",
+        "iap.webServices.setIamPolicy",
+        "iam.serviceAccounts.getIamPolicy",
+        "iam.serviceAccounts.setIamPolicy",
+    ],
+};
+/** Custom role an earlier revision bound to the admin run SA on `gcp`; its binding is removed. */
+const LEGACY_LOOKUP_ROLE_ID = "caeloAdminIapLookup";
+/** `projects/<project>/roles/<roleId>` — the name IAM bindings reference. */
+export function customRoleName(projectId, roleId) {
+    return `projects/${projectId}/roles/${roleId}`;
+}
+/**
+ * The install's IAP allowlist: who passes IAP regardless of the user list.
+ * The wizard passes the same list to the stacks (`iapAllowlist`), and the
+ * job keeps these members instead of removing them, so `pulumi up` and the
+ * job never fight.
+ */
+export function installIapAllowlist(ownerEmail) {
+    return [`user:${ownerEmail.trim().toLowerCase()}`];
+}
+/** Database role migration 0239 creates for the job. */
+export const OPERATOR_ACCESS_DB_ROLE = "operator_access_reader";
+/** Where the admin image ships the job's entry point. */
+const SYNC_JOB_SCRIPT = "/app/packages/admin-core/src/security/operator-access/sync-job.ts";
+/** The `iap_web` path of an IAP resource, as the IAP REST API names it. */
+export function iapWebPath(resource) {
+    return resource.kind === "cloud-run"
+        ? `cloud_run-${resource.region}/services/${resource.service}`
+        : `compute/services/${resource.service}`;
+}
+/** Create the custom role, or bring an existing / soft-deleted one to spec. */
+async function ensureCustomRole(run, projectId, role) {
+    const project = `--project=${projectId}`;
+    const permissions = `--permissions=${role.permissions.join(",")}`;
+    const describe = await run(["iam", "roles", "describe", role.roleId, project, "--format=json"]);
+    if (!describe.ok) {
+        const create = await run([
+            "iam",
+            "roles",
+            "create",
+            role.roleId,
+            project,
+            `--title=${role.title}`,
+            `--description=${role.description}`,
+            permissions,
+            "--stage=GA",
+            "--quiet",
+        ]);
+        return create.ok ? null : `create role ${role.roleId}: ${create.stderr.trim()}`;
+    }
+    const current = JSON.parse(describe.stdout);
+    if (current.deleted) {
+        const undelete = await run(["iam", "roles", "undelete", role.roleId, project, "--quiet"]);
+        if (!undelete.ok)
+            return `undelete role ${role.roleId}: ${undelete.stderr.trim()}`;
+    }
+    const have = [...(current.includedPermissions ?? [])].sort().join(",");
+    if (have === [...role.permissions].sort().join(","))
+        return null;
+    const update = await run([
+        "iam",
+        "roles",
+        "update",
+        role.roleId,
+        project,
+        permissions,
+        "--quiet",
+    ]);
+    return update.ok ? null : `update role ${role.roleId}: ${update.stderr.trim()}`;
+}
+/** Whether a gcloud IAM policy (JSON) grants `role` to `member` in any binding. */
+function policyHas(policyJson, role, member) {
+    const policy = JSON.parse(policyJson.trim() || "{}");
+    return (policy.bindings ?? []).some((b) => b.role === role && (b.members ?? []).includes(member));
+}
+/** The flags of a Cloud SQL instance with `cloudsql.iam_authentication` on. */
+export function withIamAuthFlag(flags) {
+    if (flags.some((f) => f.name === "cloudsql.iam_authentication" && f.value === "on"))
+        return null;
+    return [
+        ...flags.filter((f) => f.name !== "cloudsql.iam_authentication"),
+        { name: "cloudsql.iam_authentication", value: "on" },
+    ];
+}
+/** Ensure the operator-access sync job and everything it needs. Never throws for a gcloud failure. */
+export async function ensureOperatorAccessSync(target, deps = {}) {
+    const run = deps.run ?? defaultGcloud;
+    const sleep = deps.sleep ?? realSleep;
+    const retry = (args) => runWithRetry(run, sleep, args);
+    const { projectId, region, env } = target;
+    const project = `--project=${projectId}`;
+    const jobSa = operatorAccessServiceAccountEmail(projectId, env);
+    const jobMember = `serviceAccount:${jobSa}`;
+    const runSaMember = `serviceAccount:${runServiceAccountEmail(projectId, env)}`;
+    const mcpSa = mcpIapServiceAccountEmail(projectId);
+    const customRole = customRoleName(projectId, OPERATOR_ACCESS_ROLE.roleId);
+    const jobName = operatorAccessJobName(env);
+    const done = [];
+    const fail = (step, r) => ({
+        ok: false,
+        done,
+        error: `${step}: ${r.stderr.trim()}`,
+    });
+    // 1. Cloud Scheduler API (the hourly self-healing run).
+    const api = await run([
+        "services",
+        "enable",
+        "cloudscheduler.googleapis.com",
+        project,
+        "--quiet",
+    ]);
+    if (!api.ok)
+        return fail("enable cloudscheduler.googleapis.com", api);
+    done.push("Cloud Scheduler API enabled");
+    // 2. The custom role.
+    const roleError = await ensureCustomRole(run, projectId, OPERATOR_ACCESS_ROLE);
+    if (roleError)
+        return { ok: false, done, error: roleError };
+    done.push(`custom role ${OPERATOR_ACCESS_ROLE.roleId}`);
+    // 3. The job's own service account and its grants.
+    const saDescribe = await run([
+        "iam",
+        "service-accounts",
+        "describe",
+        jobSa,
+        project,
+        "--format=value(email)",
+    ]);
+    if (!saDescribe.ok) {
+        const create = await run([
+            "iam",
+            "service-accounts",
+            "create",
+            operatorAccessServiceAccountId(env),
+            "--display-name=Caelo operator-access sync",
+            "--description=The only account that may change who passes the admin's IAP gate; runs the operator-access sync job.",
+            project,
+        ]);
+        if (!create.ok && !/already exists/i.test(create.stderr))
+            return fail(`create ${jobSa}`, create);
+    }
+    done.push(`service account ${jobSa}`);
+    const jobGrants = [
+        {
+            what: `${OPERATOR_ACCESS_ROLE.roleId} on the admin's IAP resource`,
+            args: ["iap", "web", "add-iam-policy-binding", ...iapResourceArgs(target.resource)],
+        },
+        {
+            what: `${OPERATOR_ACCESS_ROLE.roleId} on ${mcpSa}`,
+            args: ["iam", "service-accounts", "add-iam-policy-binding", mcpSa],
+        },
+    ];
+    for (const g of jobGrants) {
+        const r = await retry([
+            ...g.args,
+            `--member=${jobMember}`,
+            `--role=${customRole}`,
+            "--condition=None",
+            project,
+            "--quiet",
+            "--format=none",
+        ]);
+        if (!r.ok)
+            return fail(`grant the job ${g.what}`, r);
+        done.push(`job: ${g.what}`);
+    }
+    for (const role of ["roles/cloudsql.instanceUser", "roles/logging.logWriter"]) {
+        const r = await retry([
+            "projects",
+            "add-iam-policy-binding",
+            projectId,
+            `--member=${jobMember}`,
+            `--role=${role}`,
+            "--condition=None",
+            "--quiet",
+            "--format=none",
+        ]);
+        if (!r.ok)
+            return fail(`grant the job ${role}`, r);
+        done.push(`job: ${role} on the project`);
+    }
+    // 4. The admin's run SA loses every operator-access right an earlier
+    //    revision gave it (it may only start the job now).
+    const legacy = [
+        {
+            what: "the admin's IAP resource",
+            get: [
+                "iap",
+                "web",
+                "get-iam-policy",
+                ...iapResourceArgs(target.resource),
+                project,
+                "--format=json",
+            ],
+            remove: ["iap", "web", "remove-iam-policy-binding", ...iapResourceArgs(target.resource)],
+            role: customRole,
+        },
+        {
+            what: mcpSa,
+            get: ["iam", "service-accounts", "get-iam-policy", mcpSa, project, "--format=json"],
+            remove: ["iam", "service-accounts", "remove-iam-policy-binding", mcpSa],
+            role: customRole,
+        },
+        {
+            what: "the project",
+            get: ["projects", "get-iam-policy", projectId, "--format=json"],
+            remove: ["projects", "remove-iam-policy-binding", projectId],
+            role: customRoleName(projectId, LEGACY_LOOKUP_ROLE_ID),
+        },
+    ];
+    for (const l of legacy) {
+        const policy = await run(l.get);
+        if (!policy.ok)
+            return fail(`read the IAM policy of ${l.what}`, policy);
+        if (!policyHas(policy.stdout, l.role, runSaMember))
+            continue;
+        const r = await retry([
+            ...l.remove,
+            `--member=${runSaMember}`,
+            `--role=${l.role}`,
+            "--all",
+            project,
+            "--quiet",
+            "--format=none",
+        ]);
+        if (!r.ok)
+            return fail(`remove the admin's ${l.role} on ${l.what}`, r);
+        done.push(`admin: removed ${l.role} on ${l.what}`);
+    }
+    // 5. Cloud SQL IAM database authentication for the job.
+    const instances = await run([
+        "sql",
+        "instances",
+        "list",
+        project,
+        `--filter=name~^${gcpNamePrefix(env)}-pg`,
+        "--format=value(name)",
+    ]);
+    if (!instances.ok)
+        return fail("list Cloud SQL instances", instances);
+    const names = instances.stdout
+        .split("\n")
+        .map((s) => s.trim())
+        .filter(Boolean);
+    if (names.length !== 1) {
+        return {
+            ok: false,
+            done,
+            error: `expected exactly one ${gcpNamePrefix(env)}-pg* Cloud SQL instance, found ${names.length} (${names.join(", ")})`,
+        };
+    }
+    const instance = names[0];
+    const flagsJson = await run([
+        "sql",
+        "instances",
+        "describe",
+        instance,
+        project,
+        "--format=json(settings.databaseFlags)",
+    ]);
+    if (!flagsJson.ok)
+        return fail(`read the flags of ${instance}`, flagsJson);
+    const flags = JSON.parse(flagsJson.stdout).settings?.databaseFlags ?? [];
+    const nextFlags = withIamAuthFlag(flags);
+    if (nextFlags) {
+        // `--database-flags` replaces the whole list, so every existing flag is
+        // passed again. cloudsql.iam_authentication needs no restart.
+        const patch = await run([
+            "sql",
+            "instances",
+            "patch",
+            instance,
+            project,
+            `--database-flags=${nextFlags.map((f) => `${f.name}=${f.value}`).join(",")}`,
+            "--quiet",
+        ]);
+        if (!patch.ok)
+            return fail(`enable IAM database authentication on ${instance}`, patch);
+        done.push(`${instance}: cloudsql.iam_authentication=on`);
+    }
+    const dbUser = jobSa.replace(/\.gserviceaccount\.com$/, "");
+    const users = await run([
+        "sql",
+        "users",
+        "list",
+        `--instance=${instance}`,
+        project,
+        "--format=value(name)",
+    ]);
+    if (!users.ok)
+        return fail(`list database users of ${instance}`, users);
+    if (!users.stdout
+        .split("\n")
+        .map((s) => s.trim())
+        .includes(dbUser)) {
+        const create = await run([
+            "sql",
+            "users",
+            "create",
+            dbUser,
+            `--instance=${instance}`,
+            "--type=cloud_iam_service_account",
+            project,
+            "--quiet",
+        ]);
+        if (!create.ok)
+            return fail(`create database user ${dbUser}`, create);
+    }
+    const assign = await run([
+        "sql",
+        "users",
+        "assign-roles",
+        dbUser,
+        `--instance=${instance}`,
+        "--type=cloud_iam_service_account",
+        `--database-roles=${OPERATOR_ACCESS_DB_ROLE}`,
+        project,
+        "--quiet",
+    ]);
+    if (!assign.ok)
+        return fail(`give ${dbUser} the ${OPERATOR_ACCESS_DB_ROLE} database role`, assign);
+    done.push(`database user ${dbUser} (${OPERATOR_ACCESS_DB_ROLE})`);
+    // 6. The job: the admin image with another entry point, the job's own SA,
+    //    and its whole input as env the admin cannot override.
+    const envVars = [
+        `CAELO_OPERATOR_ACCESS_IAP_WEB=${iapWebPath(target.resource)}`,
+        `CAELO_MCP_IAP_SERVICE_ACCOUNT=${mcpSa}`,
+        `CAELO_OPERATOR_ACCESS_STATIC_MEMBERS=${installIapAllowlist(target.ownerEmail).join(",")}`,
+        `CAELO_OPERATOR_ACCESS_DB_HOST=${target.databaseHost}`,
+    ];
+    const deploy = await run([
+        "run",
+        "jobs",
+        "deploy",
+        jobName,
+        `--image=${target.imageRef}`,
+        `--region=${region}`,
+        project,
+        `--service-account=${jobSa}`,
+        `--network=${target.network}`,
+        `--subnet=${target.subnet}`,
+        "--vpc-egress=private-ranges-only",
+        "--command=bun",
+        `--args=--bun,${SYNC_JOB_SCRIPT}`,
+        // `^|^` switches gcloud's list delimiter: the static members contain commas.
+        `--set-env-vars=^|^${envVars.join("|")}`,
+        "--max-retries=1",
+        "--task-timeout=5m",
+        "--quiet",
+    ]);
+    if (!deploy.ok)
+        return fail(`deploy job ${jobName}`, deploy);
+    done.push(`job ${jobName}`);
+    const jobIam = [
+        {
+            member: runSaMember,
+            role: "roles/run.jobsExecutor",
+            why: "the admin starts the job (no overrides)",
+        },
+        { member: runSaMember, role: "roles/run.viewer", why: "the admin reads the job's runs" },
+        {
+            member: jobMember,
+            role: "roles/run.jobsExecutor",
+            why: "the hourly schedule starts the job as its own SA",
+        },
+    ];
+    for (const g of jobIam) {
+        const r = await retry([
+            "run",
+            "jobs",
+            "add-iam-policy-binding",
+            jobName,
+            `--region=${region}`,
+            project,
+            `--member=${g.member}`,
+            `--role=${g.role}`,
+            "--quiet",
+            "--format=none",
+        ]);
+        if (!r.ok)
+            return fail(`grant ${g.role} on ${jobName} (${g.why})`, r);
+        done.push(`${g.member}: ${g.role} on ${jobName}`);
+    }
+    const schedule = operatorAccessScheduleName(env);
+    const scheduleArgs = [
+        schedule,
+        `--location=${region}`,
+        project,
+        "--schedule=17 * * * *",
+        "--time-zone=Etc/UTC",
+        `--uri=https://run.googleapis.com/v2/projects/${projectId}/locations/${region}/jobs/${jobName}:run`,
+        "--http-method=POST",
+        `--oauth-service-account-email=${jobSa}`,
+        "--quiet",
+    ];
+    const existing = await run([
+        "scheduler",
+        "jobs",
+        "describe",
+        schedule,
+        `--location=${region}`,
+        project,
+        "--format=value(name)",
+    ]);
+    const sched = await retry([
+        "scheduler",
+        "jobs",
+        existing.ok ? "update" : "create",
+        "http",
+        ...scheduleArgs,
+    ]);
+    if (!sched.ok)
+        return fail(`schedule ${schedule}`, sched);
+    done.push(`hourly schedule ${schedule}`);
+    return { ok: true, done };
+}
+/**
+ * Everything {@link ensureOperatorAccessSync} needs, read from the deployed
+ * admin service: its network, the database host, and its IAP resource (the
+ * service itself on gcp-firebase, the LB backend service on gcp). `imageRef`
+ * overrides the image the job runs (upgrade passes the release it rolls to).
+ */
+export async function resolveOperatorAccessTarget(opts, deps = {}) {
+    const run = deps.run ?? defaultGcloud;
+    const project = `--project=${opts.projectId}`;
+    const prefix = `${gcpNamePrefix(opts.env)}-admin`;
+    const list = await run([
+        "run",
+        "services",
+        "list",
+        `--region=${opts.region}`,
+        project,
+        `--filter=metadata.name~^${prefix}`,
+        "--format=value(metadata.name)",
+    ]);
+    if (!list.ok)
+        return { ok: false, error: `list Cloud Run services: ${list.stderr.trim()}` };
+    const services = lines(list.stdout);
+    if (services.length !== 1) {
+        return {
+            ok: false,
+            error: `expected exactly one ${prefix}* Cloud Run service, found ${services.length} (${services.join(", ")})`,
+        };
+    }
+    const adminService = services[0];
+    const describe = await run([
+        "run",
+        "services",
+        "describe",
+        adminService,
+        `--region=${opts.region}`,
+        project,
+        "--format=json",
+    ]);
+    if (!describe.ok) {
+        return { ok: false, error: `describe ${adminService}: ${describe.stderr.trim()}` };
+    }
+    const { parseAdminConfig } = await import("./migration-runner.js");
+    const admin = parseAdminConfig(describe.stdout);
+    if (!admin) {
+        return {
+            ok: false,
+            error: `${adminService} lacks an image, database host or VPC network the job can reuse`,
+        };
+    }
+    let resource;
+    if (opts.provider === "gcp-firebase") {
+        resource = { kind: "cloud-run", service: adminService, region: opts.region };
+    }
+    else {
+        const backends = await run([
+            "compute",
+            "backend-services",
+            "list",
+            "--global",
+            project,
+            `--filter=name~^${prefix}-backend AND iap.enabled=true`,
+            "--format=value(name)",
+        ]);
+        if (!backends.ok) {
+            return { ok: false, error: `list backend services: ${backends.stderr.trim()}` };
+        }
+        const names = lines(backends.stdout);
+        if (names.length !== 1) {
+            return {
+                ok: false,
+                error: `expected exactly one IAP-enabled ${prefix}-backend* backend service, found ${names.length} (${names.join(", ")})`,
+            };
+        }
+        resource = { kind: "backend-services", service: names[0] };
+    }
+    const short = (ref) => ref.split("/").pop() ?? ref;
+    return {
+        ok: true,
+        target: {
+            projectId: opts.projectId,
+            region: opts.region,
+            env: opts.env,
+            ownerEmail: opts.ownerEmail,
+            resource,
+            imageRef: opts.imageRef ?? admin.imageRef,
+            network: short(admin.networkRef),
+            subnet: short(admin.subnetRef),
+            databaseHost: admin.databaseHost,
+        },
+    };
+}
+function lines(stdout) {
+    return stdout
+        .split("\n")
+        .map((s) => s.trim())
+        .filter(Boolean);
+}
+//# sourceMappingURL=operator-access.js.map

package/dist/operator-access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operator-access.js","sourceRoot":"","sources":["../src/operator-access.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,MAAM,IAAI,aAAa,EAAqB,MAAM,aAAa,CAAC;AACzE,OAAO,EAAqB,SAAS,EAAE,YAAY,EAAc,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EACL,aAAa,EACb,yBAAyB,EACzB,qBAAqB,EACrB,0BAA0B,EAC1B,iCAAiC,EACjC,8BAA8B,EAC9B,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAoB,eAAe,EAAE,MAAM,cAAc,CAAC;AAYjE,oFAAoF;AACpF,MAAM,CAAC,MAAM,oBAAoB,GAAmB;IAClD,MAAM,EAAE,qBAAqB;IAC7B,KAAK,EAAE,uBAAuB;IAC9B,WAAW,EACT,kLAAkL;IACpL,WAAW,EAAE;QACX,8BAA8B;QAC9B,8BAA8B;QAC9B,kCAAkC;QAClC,kCAAkC;KACnC;CACF,CAAC;AAEF,kGAAkG;AAClG,MAAM,qBAAqB,GAAG,qBAAqB,CAAC;AAEpD,6EAA6E;AAC7E,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,MAAc;IAC9D,OAAO,YAAY,SAAS,UAAU,MAAM,EAAE,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAkB;IACpD,OAAO,CAAC,QAAQ,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,wDAAwD;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,wBAAwB,CAAC;AAEhE,yDAAyD;AACzD,MAAM,eAAe,GAAG,mEAAmE,CAAC;AAE5F,2EAA2E;AAC3E,MAAM,UAAU,UAAU,CAAC,QAAqB;IAC9C,OAAO,QAAQ,CAAC,IAAI,KAAK,WAAW;QAClC,CAAC,CAAC,aAAa,QAAQ,CAAC,MAAM,aAAa,QAAQ,CAAC,OAAO,EAAE;QAC7D,CAAC,CAAC,oBAAoB,QAAQ,CAAC,OAAO,EAAE,CAAC;AAC7C,CAAC;AAED,+EAA+E;AAC/E,KAAK,UAAU,gBAAgB,CAC7B,GAAQ,EACR,SAAiB,EACjB,IAAoB;IAEpB,MAAM,OAAO,GAAG,aAAa,SAAS,EAAE,CAAC;IACzC,MAAM,WAAW,GAAG,iBAAiB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAClE,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC;IAChG,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;YACvB,KAAK;YACL,OAAO;YACP,QAAQ;YACR,IAAI,CAAC,MAAM;YACX,OAAO;YACP,WAAW,IAAI,CAAC,KAAK,EAAE;YACvB,iBAAiB,IAAI,CAAC,WAAW,EAAE;YACnC,WAAW;YACX,YAAY;YACZ,SAAS;SACV,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;IAClF,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAGzC,CAAC;IACF,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QAC1F,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,iBAAiB,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;IACrF,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvE,IAAI,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;QACvB,KAAK;QACL,OAAO;QACP,QAAQ;QACR,IAAI,CAAC,MAAM;QACX,OAAO;QACP,WAAW;QACX,SAAS;KACV,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;AAClF,CAAC;AAED,mFAAmF;AACnF,SAAS,SAAS,CAAC,UAAkB,EAAE,IAAY,EAAE,MAAc;IACjE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,IAAI,CAElD,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AACpG,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,eAAe,CAC7B,KAAiD;IAEjD,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,6BAA6B,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjG,OAAO;QACL,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,6BAA6B,CAAC;QAChE,EAAE,IAAI,EAAE,6BAA6B,EAAE,KAAK,EAAE,IAAI,EAAE;KACrD,CAAC;AACJ,CAAC;AAsBD,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAgC,EAChC,OAA8C,EAAE;IAEhD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACjE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IAC1C,MAAM,OAAO,GAAG,aAAa,SAAS,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,iCAAiC,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,kBAAkB,KAAK,EAAE,CAAC;IAC5C,MAAM,WAAW,GAAG,kBAAkB,sBAAsB,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC;IAC/E,MAAM,KAAK,GAAG,yBAAyB,CAAC,SAAS,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,cAAc,CAAC,SAAS,EAAE,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,CAAe,EAA4B,EAAE,CAAC,CAAC;QACzE,EAAE,EAAE,KAAK;QACT,IAAI;QACJ,KAAK,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;KACrC,CAAC,CAAC;IAEH,wDAAwD;IACxD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC;QACpB,UAAU;QACV,QAAQ;QACR,+BAA+B;QAC/B,OAAO;QACP,SAAS;KACV,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;IACtE,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAEzC,sBAAsB;IACtB,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/E,IAAI,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC5D,IAAI,CAAC,IAAI,CAAC,eAAe,oBAAoB,CAAC,MAAM,EAAE,CAAC,CAAC;IAExD,mDAAmD;IACnD,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC;QAC3B,KAAK;QACL,kBAAkB;QAClB,UAAU;QACV,KAAK;QACL,OAAO;QACP,uBAAuB;KACxB,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;YACvB,KAAK;YACL,kBAAkB;YAClB,QAAQ;YACR,8BAA8B,CAAC,GAAG,CAAC;YACnC,2CAA2C;YAC3C,oHAAoH;YACpH,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YACtD,OAAO,IAAI,CAAC,UAAU,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,mBAAmB,KAAK,EAAE,CAAC,CAAC;IAEtC,MAAM,SAAS,GAAuC;QACpD;YACE,IAAI,EAAE,GAAG,oBAAoB,CAAC,MAAM,8BAA8B;YAClE,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;SACpF;QACD;YACE,IAAI,EAAE,GAAG,oBAAoB,CAAC,MAAM,OAAO,KAAK,EAAE;YAClD,IAAI,EAAE,CAAC,KAAK,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,KAAK,CAAC;SACnE;KACF,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,GAAG,CAAC,CAAC,IAAI;YACT,YAAY,SAAS,EAAE;YACvB,UAAU,UAAU,EAAE;YACtB,kBAAkB;YAClB,OAAO;YACP,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,CAAC,6BAA6B,EAAE,yBAAyB,CAAC,EAAE,CAAC;QAC9E,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,UAAU;YACV,wBAAwB;YACxB,SAAS;YACT,YAAY,SAAS,EAAE;YACvB,UAAU,IAAI,EAAE;YAChB,kBAAkB;YAClB,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,iBAAiB,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,iBAAiB,CAAC,CAAC;IAC3C,CAAC;IAED,qEAAqE;IACrE,uDAAuD;IACvD,MAAM,MAAM,GAAsE;QAChF;YACE,IAAI,EAAE,0BAA0B;YAChC,GAAG,EAAE;gBACH,KAAK;gBACL,KAAK;gBACL,gBAAgB;gBAChB,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC;gBACnC,OAAO;gBACP,eAAe;aAChB;YACD,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACxF,IAAI,EAAE,UAAU;SACjB;QACD;YACE,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,CAAC,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,CAAC;YACnF,MAAM,EAAE,CAAC,KAAK,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,KAAK,CAAC;YACvE,IAAI,EAAE,UAAU;SACjB;QACD;YACE,IAAI,EAAE,aAAa;YACnB,GAAG,EAAE,CAAC,UAAU,EAAE,gBAAgB,EAAE,SAAS,EAAE,eAAe,CAAC;YAC/D,MAAM,EAAE,CAAC,UAAU,EAAE,2BAA2B,EAAE,SAAS,CAAC;YAC5D,IAAI,EAAE,cAAc,CAAC,SAAS,EAAE,qBAAqB,CAAC;SACvD;KACF,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,0BAA0B,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;QACxE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,SAAS;QAC7D,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,GAAG,CAAC,CAAC,MAAM;YACX,YAAY,WAAW,EAAE;YACzB,UAAU,CAAC,CAAC,IAAI,EAAE;YAClB,OAAO;YACP,OAAO;YACP,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,sBAAsB,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,wDAAwD;IACxD,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC;QAC1B,KAAK;QACL,WAAW;QACX,MAAM;QACN,OAAO;QACP,kBAAkB,aAAa,CAAC,GAAG,CAAC,KAAK;QACzC,sBAAsB;KACvB,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,0BAA0B,EAAE,SAAS,CAAC,CAAC;IACtE,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM;SAC3B,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI;YACJ,KAAK,EAAE,wBAAwB,aAAa,CAAC,GAAG,CAAC,kCAAkC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;SACxH,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;IACpC,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC;QAC1B,KAAK;QACL,WAAW;QACX,UAAU;QACV,QAAQ;QACR,OAAO;QACP,uCAAuC;KACxC,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,qBAAqB,QAAQ,EAAE,EAAE,SAAS,CAAC,CAAC;IAC3E,MAAM,KAAK,GAEP,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAG5B,CAAC,QAAQ,EAAE,aAAa,IAAI,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,SAAS,EAAE,CAAC;QACd,wEAAwE;QACxE,8DAA8D;QAC9D,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC;YACtB,KAAK;YACL,WAAW;YACX,OAAO;YACP,QAAQ;YACR,OAAO;YACP,oBAAoB,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;YAC5E,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,yCAAyC,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;QACvF,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,kCAAkC,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,yBAAyB,EAAE,EAAE,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC;QACtB,KAAK;QACL,OAAO;QACP,MAAM;QACN,cAAc,QAAQ,EAAE;QACxB,OAAO;QACP,sBAAsB;KACvB,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,0BAA0B,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;IACxE,IACE,CAAC,KAAK,CAAC,MAAM;SACV,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,QAAQ,CAAC,MAAM,CAAC,EACnB,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;YACvB,KAAK;YACL,OAAO;YACP,QAAQ;YACR,MAAM;YACN,cAAc,QAAQ,EAAE;YACxB,kCAAkC;YAClC,OAAO;YACP,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,wBAAwB,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;QACvB,KAAK;QACL,OAAO;QACP,cAAc;QACd,MAAM;QACN,cAAc,QAAQ,EAAE;QACxB,kCAAkC;QAClC,oBAAoB,uBAAuB,EAAE;QAC7C,OAAO;QACP,SAAS;KACV,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE;QACZ,OAAO,IAAI,CAAC,QAAQ,MAAM,QAAQ,uBAAuB,gBAAgB,EAAE,MAAM,CAAC,CAAC;IACrF,IAAI,CAAC,IAAI,CAAC,iBAAiB,MAAM,KAAK,uBAAuB,GAAG,CAAC,CAAC;IAElE,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,OAAO,GAAG;QACd,iCAAiC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE;QAC9D,iCAAiC,KAAK,EAAE;QACxC,wCAAwC,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QAC1F,iCAAiC,MAAM,CAAC,YAAY,EAAE;KACvD,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;QACvB,KAAK;QACL,MAAM;QACN,QAAQ;QACR,OAAO;QACP,WAAW,MAAM,CAAC,QAAQ,EAAE;QAC5B,YAAY,MAAM,EAAE;QACpB,OAAO;QACP,qBAAqB,KAAK,EAAE;QAC5B,aAAa,MAAM,CAAC,OAAO,EAAE;QAC7B,YAAY,MAAM,CAAC,MAAM,EAAE;QAC3B,kCAAkC;QAClC,eAAe;QACf,gBAAgB,eAAe,EAAE;QACjC,6EAA6E;QAC7E,qBAAqB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACxC,iBAAiB;QACjB,mBAAmB;QACnB,SAAS;KACV,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,cAAc,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;IAC7D,IAAI,CAAC,IAAI,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;IAE5B,MAAM,MAAM,GAAoD;QAC9D;YACE,MAAM,EAAE,WAAW;YACnB,IAAI,EAAE,wBAAwB;YAC9B,GAAG,EAAE,yCAAyC;SAC/C;QACD,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,gCAAgC,EAAE;QACxF;YACE,MAAM,EAAE,SAAS;YACjB,IAAI,EAAE,wBAAwB;YAC9B,GAAG,EAAE,kDAAkD;SACxD;KACF,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,KAAK;YACL,MAAM;YACN,wBAAwB;YACxB,OAAO;YACP,YAAY,MAAM,EAAE;YACpB,OAAO;YACP,YAAY,CAAC,CAAC,MAAM,EAAE;YACtB,UAAU,CAAC,CAAC,IAAI,EAAE;YAClB,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,OAAO,OAAO,KAAK,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,IAAI,OAAO,OAAO,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,QAAQ,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,YAAY,GAAG;QACnB,QAAQ;QACR,cAAc,MAAM,EAAE;QACtB,OAAO;QACP,uBAAuB;QACvB,qBAAqB;QACrB,gDAAgD,SAAS,cAAc,MAAM,SAAS,OAAO,MAAM;QACnG,oBAAoB;QACpB,iCAAiC,KAAK,EAAE;QACxC,SAAS;KACV,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;QACzB,WAAW;QACX,MAAM;QACN,UAAU;QACV,QAAQ;QACR,cAAc,MAAM,EAAE;QACtB,OAAO;QACP,sBAAsB;KACvB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC;QACxB,WAAW;QACX,MAAM;QACN,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;QACjC,MAAM;QACN,GAAG,YAAY;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,YAAY,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;IAC1D,IAAI,CAAC,IAAI,CAAC,mBAAmB,QAAQ,EAAE,CAAC,CAAC;IAEzC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,IAOC,EACD,OAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,OAAO,GAAG,aAAa,IAAI,CAAC,SAAS,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC;QACrB,KAAK;QACL,UAAU;QACV,MAAM;QACN,YAAY,IAAI,CAAC,MAAM,EAAE;QACzB,OAAO;QACP,2BAA2B,MAAM,EAAE;QACnC,+BAA+B;KAChC,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IAC5F,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,wBAAwB,MAAM,8BAA8B,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;SAC9G,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAW,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;QACzB,KAAK;QACL,UAAU;QACV,UAAU;QACV,YAAY;QACZ,YAAY,IAAI,CAAC,MAAM,EAAE;QACzB,OAAO;QACP,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,YAAY,KAAK,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACrF,CAAC;IACD,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,YAAY,iEAAiE;SACxF,CAAC;IACJ,CAAC;IAED,IAAI,QAAqB,CAAC;IAC1B,IAAI,IAAI,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;QACrC,QAAQ,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IAC/E,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;YACzB,SAAS;YACT,kBAAkB;YAClB,MAAM;YACN,UAAU;YACV,OAAO;YACP,kBAAkB,MAAM,+BAA+B;YACvD,sBAAsB;SACvB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QAClF,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,oCAAoC,MAAM,oCAAoC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;aAC1H,CAAC;QACJ,CAAC;QACD,QAAQ,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAW,EAAE,CAAC;IACvE,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC;IAC3D,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE;YACN,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ;YACR,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ;YACzC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;YAChC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;YAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,MAAc;IAC3B,OAAO,MAAM;SACV,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC"}

package/dist/region-data.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Where each cloud service the provider adapters need is offered — the data
+ * behind the region catalogs in regions.ts (#607). Every list cites the
+ * provider documentation it was copied from; update it from there (and
+ * re-run regions.test.ts) when a provider adds regions.
+ */
+/** One installable region. */
+export interface RegionOption {
+    readonly id: string;
+    /** Human-readable location, for the picker. */
+    readonly name: string;
+}
+export declare const GCP_REGION_NAMES: Readonly<Record<string, string>>;
+/**
+ * Where each regional GCP service the stacks and the CLI use is offered.
+ * Global services (load balancer, Cloud CDN, Cloud Armor, IAP, Firebase
+ * Hosting) don't constrain the region and are not listed.
+ */
+export declare const GCP_SERVICE_REGIONS: Readonly<Record<string, readonly string[]>>;
+/**
+ * Regions Google offers only under special terms, so they are never offered
+ * as a general install target even though the services exist there:
+ * me-central2 (Dammam) is for KSA customers through Google's designated
+ * reseller (https://docs.cloud.google.com/docs/dammam-region-access).
+ */
+export declare const GCP_RESTRICTED_REGIONS: readonly string[];
+export declare const GCP_SERVICES: readonly ["Cloud Run", "Cloud SQL", "Secret Manager", "Artifact Registry", "Cloud Scheduler"];
+export declare const AWS_REGIONS: readonly RegionOption[];
+export declare const AZURE_REGIONS: readonly RegionOption[];
+//# sourceMappingURL=region-data.d.ts.map

package/dist/region-data.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"region-data.d.ts","sourceRoot":"","sources":["../src/region-data.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAEH,8BAA8B;AAC9B,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAMD,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA4C7D,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CA4O3E,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAAoB,CAAC;AAEzE,eAAO,MAAM,YAAY,+FAMf,CAAC;AAUX,eAAO,MAAM,WAAW,EAAE,SAAS,YAAY,EAiC9C,CAAC;AAWF,eAAO,MAAM,aAAa,EAAE,SAAS,YAAY,EAkDhD,CAAC"}