@caelo-cms/provisioning 0.10.44 → 0.10.46

package/dist/ops-backend.js

@@ -0,0 +1,370 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * The install's ops bucket + Pulumi state key in its own GCP project (#696,
+ * D2). Ensured by the GCP wizard for every new install (before the cost
+ * confirmation — both are near-free, see gcp-cost.ts) and by
+ * the state migration for an existing one.
+ *
+ *   - `gs://<project>-caelo-ops`, in the install region: object versioning
+ *     on (every Pulumi checkpoint write is recoverable), uniform bucket-level
+ *     access (no per-object ACLs), public access prevention enforced, and a
+ *     lifecycle rule that deletes non-current versions after
+ *     {@link NONCURRENT_VERSION_DAYS} days — Pulumi rewrites its checkpoint on
+ *     every resource step, so unbounded versions would grow without end.
+ *   - Cloud KMS key ring `caelo`, key `pulumi-state` (symmetric, software
+ *     protection, no automatic rotation: each rotation adds a billed key
+ *     version, and the key only wraps Pulumi's data key).
+ *   - IAM: the operator and `caelo-provisioner` get object access on the
+ *     bucket and encrypt/decrypt on the key — nobody else is granted
+ *     anything. The bucket's convenience bindings for project viewers and
+ *     editors are removed; public principals are refused outright. Project
+ *     Owners keep access through their project role (that cannot be taken
+ *     away at the bucket); docs-site/pages/install-gcp.md says so.
+ *
+ * Every step reads before it writes, so a re-run is a no-op and an operator
+ * without IAM-write permission can still run against an ops backend someone
+ * else ensured. Nothing here ever deletes a bucket, an object or a key.
+ */
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { gcloud as defaultGcloud } from "./gcloud.js";
+import { realSleep, runWithRetry } from "./gcloud-retry.js";
+import { operatorMember } from "./provisioner-identity.js";
+import { gcsBackendRecord, OPS_KEY_RING, OPS_STATE_KEY, opsBucketName, } from "./state-backend.js";
+/** Days a superseded Pulumi checkpoint version stays recoverable. */
+export const NONCURRENT_VERSION_DAYS = 30;
+/** Role the operator + provisioner hold on the ops bucket. */
+export const OPS_BUCKET_ROLE = "roles/storage.objectAdmin";
+/** Role the operator + provisioner hold on the state key. */
+export const OPS_KEY_ROLE = "roles/cloudkms.cryptoKeyEncrypterDecrypter";
+/** APIs the ops backend needs. */
+const OPS_APIS = ["storage.googleapis.com", "cloudkms.googleapis.com"];
+/** Principals that must never appear on the ops bucket. */
+const PUBLIC_MEMBERS = new Set(["allUsers", "allAuthenticatedUsers"]);
+/** gcloud's wording for a resource that does not exist (yet). */
+const NOT_FOUND = /NOT_FOUND|NotFound|not found|404|does not exist/i;
+function parseJson(text, fallback) {
+    try {
+        return JSON.parse(text || "null") ?? fallback;
+    }
+    catch {
+        return fallback;
+    }
+}
+/** The lifecycle rule the ops bucket carries — and no other. */
+const OPS_LIFECYCLE_RULE = {
+    action: { type: "Delete" },
+    condition: { daysSinceNoncurrentTime: NONCURRENT_VERSION_DAYS, isLive: false },
+};
+/**
+ * Whether a bucket's lifecycle is exactly {@link OPS_LIFECYCLE_RULE}. Any
+ * other rule — a shorter window, a prefix filter, a rule deleting live
+ * objects — could cut the recovery window or delete the state itself, so
+ * it is replaced, not tolerated.
+ */
+export function isOpsLifecycle(config) {
+    const rules = config?.rule;
+    if (!Array.isArray(rules) || rules.length !== 1)
+        return false;
+    const r = rules[0];
+    const cond = r.condition ?? {};
+    return (r.action?.type === "Delete" &&
+        Object.keys(r.action).length === 1 &&
+        cond.daysSinceNoncurrentTime === NONCURRENT_VERSION_DAYS &&
+        cond.isLive === false &&
+        Object.keys(cond).length === 2);
+}
+const hasBinding = (policy, role, member) => (policy.bindings ?? []).some((b) => b.role === role &&
+    b.condition == null &&
+    (b.members ?? []).some((m) => m.toLowerCase() === member.toLowerCase()));
+const reason = (stderr, exitCode) => stderr.trim().split("\n").slice(-3).join(" ") || `gcloud exited ${exitCode}`;
+/**
+ * Ensure the ops bucket + state key exist with the settings and IAM above.
+ * Idempotent; never throws for a gcloud failure (the result says what
+ * failed and what to run). With `dryRun` it only reads and reports what it
+ * would change.
+ */
+export async function ensureOpsBackend(target, deps = {}) {
+    const run = deps.run ?? defaultGcloud;
+    const sleep = deps.sleep ?? realSleep;
+    const dryRun = deps.dryRun ?? false;
+    const { projectId, region } = target;
+    const project = `--project=${projectId}`;
+    const bucket = opsBucketName(projectId);
+    const bucketUrl = `gs://${bucket}`;
+    const members = [
+        operatorMember(target.operatorAccount),
+        `serviceAccount:${target.provisionerEmail}`,
+    ];
+    const actions = [];
+    const act = (what) => actions.push(dryRun ? `would ${what}` : what);
+    const fail = (what, r) => ({
+        ok: false,
+        error: `${what} failed: ${reason(r.stderr, r.exitCode)}`,
+    });
+    // --- APIs -------------------------------------------------------------
+    // Read first: an operator without serviceusage.services.enable can still
+    // re-run an install whose APIs are on.
+    const enabled = await run([
+        "services",
+        "list",
+        "--enabled",
+        project,
+        "--format=value(config.name)",
+    ]);
+    if (!enabled.ok)
+        return fail(`Listing the enabled APIs of ${projectId}`, enabled);
+    const on = new Set(enabled.stdout.split("\n").map((l) => l.trim()));
+    const missingApis = OPS_APIS.filter((a) => !on.has(a));
+    if (missingApis.length > 0) {
+        act(`enable ${missingApis.join(", ")}`);
+        if (!dryRun) {
+            const apis = await run(["services", "enable", ...missingApis, project]);
+            if (!apis.ok)
+                return fail(`Enabling ${missingApis.join(", ")}`, apis);
+        }
+    }
+    // --- Bucket -----------------------------------------------------------
+    const described = await run([
+        "storage",
+        "buckets",
+        "describe",
+        bucketUrl,
+        project,
+        "--format=json",
+    ]);
+    let bucketExists = described.ok;
+    if (!described.ok && !NOT_FOUND.test(described.stderr)) {
+        return {
+            ok: false,
+            error: `Could not read ${bucketUrl}: ${reason(described.stderr, described.exitCode)}. If the name is taken by a bucket outside project ${projectId}, the install can't use it — tell the maintainers (the name is <project>-caelo-ops).`,
+        };
+    }
+    if (bucketExists) {
+        // Bucket names are global and `--project` does not scope `describe`: a
+        // bucket of that name in a project the operator can also reach would
+        // otherwise receive this install's state.
+        const owned = await run(["storage", "buckets", "list", project, "--format=value(name)"]);
+        if (!owned.ok)
+            return fail(`Listing the buckets of project ${projectId}`, owned);
+        const names = owned.stdout.split("\n").map((l) => l
+            .trim()
+            .replace(/^gs:\/\//, "")
+            .replace(/\/$/, ""));
+        if (!names.includes(bucket)) {
+            return {
+                ok: false,
+                error: `${bucketUrl} exists but does not belong to project ${projectId}. The install's state must live in its own project; delete or rename that bucket, or tell the maintainers (the name is <project>-caelo-ops).`,
+            };
+        }
+    }
+    if (!bucketExists) {
+        act(`create ${bucketUrl} in ${region}`);
+        if (!dryRun) {
+            const created = await run([
+                "storage",
+                "buckets",
+                "create",
+                bucketUrl,
+                project,
+                `--location=${region}`,
+                "--default-storage-class=STANDARD",
+                "--uniform-bucket-level-access",
+                "--public-access-prevention",
+            ]);
+            if (!created.ok)
+                return fail(`Creating ${bucketUrl}`, created);
+            bucketExists = true;
+        }
+    }
+    const desc = described.ok ? parseJson(described.stdout, {}) : {};
+    // A bucket created above already has uniform access + public access
+    // prevention; `buckets create` has no versioning flag.
+    const updates = [];
+    if (desc.versioning_enabled !== true)
+        updates.push("--versioning");
+    if (described.ok && desc.uniform_bucket_level_access !== true) {
+        updates.push("--uniform-bucket-level-access");
+    }
+    if (described.ok && desc.public_access_prevention !== "enforced") {
+        updates.push("--public-access-prevention");
+    }
+    const hasLifecycle = isOpsLifecycle(desc.lifecycle_config);
+    if (updates.length > 0) {
+        act(`set ${updates.map((u) => u.slice(2)).join(", ")} on ${bucketUrl}`);
+        if (!dryRun) {
+            const r = await run(["storage", "buckets", "update", bucketUrl, project, ...updates]);
+            if (!r.ok)
+                return fail(`Updating ${bucketUrl}`, r);
+        }
+    }
+    if (!hasLifecycle) {
+        act(`set the lifecycle of ${bucketUrl} to: delete non-current object versions after ${NONCURRENT_VERSION_DAYS} days (nothing else)`);
+        if (!dryRun) {
+            // A private directory (mkdtemp, mode 700): no other local user can
+            // swap the file between write and read.
+            const dir = mkdtempSync(join(tmpdir(), "caelo-ops-"));
+            const file = join(dir, "lifecycle.json");
+            try {
+                writeFileSync(file, JSON.stringify({ rule: [OPS_LIFECYCLE_RULE] }), { mode: 0o600 });
+                const r = await run([
+                    "storage",
+                    "buckets",
+                    "update",
+                    bucketUrl,
+                    project,
+                    `--lifecycle-file=${file}`,
+                ]);
+                if (!r.ok)
+                    return fail(`Setting the lifecycle rule on ${bucketUrl}`, r);
+            }
+            finally {
+                rmSync(dir, { recursive: true, force: true });
+            }
+        }
+    }
+    // --- Bucket IAM -------------------------------------------------------
+    if (bucketExists) {
+        const got = await run([
+            "storage",
+            "buckets",
+            "get-iam-policy",
+            bucketUrl,
+            project,
+            "--format=json",
+        ]);
+        if (!got.ok)
+            return fail(`Reading the IAM policy of ${bucketUrl}`, got);
+        const policy = parseJson(got.stdout, {});
+        const exposed = (policy.bindings ?? []).flatMap((b) => (b.members ?? []).filter((m) => PUBLIC_MEMBERS.has(m)).map((m) => `${m} (${b.role})`));
+        if (exposed.length > 0) {
+            return {
+                ok: false,
+                error: `${bucketUrl} grants ${exposed.join(", ")}. It holds the install's infrastructure state and must never be public. Remove those bindings (gcloud storage buckets remove-iam-policy-binding ${bucketUrl} --member=<member> --role=<role>) and re-run.`,
+            };
+        }
+        for (const member of members) {
+            if (hasBinding(policy, OPS_BUCKET_ROLE, member))
+                continue;
+            act(`grant ${member} ${OPS_BUCKET_ROLE} on ${bucketUrl}`);
+            if (dryRun)
+                continue;
+            const r = await runWithRetry(run, sleep, [
+                "storage",
+                "buckets",
+                "add-iam-policy-binding",
+                bucketUrl,
+                project,
+                `--member=${member}`,
+                `--role=${OPS_BUCKET_ROLE}`,
+            ]);
+            if (!r.ok)
+                return fail(`Granting ${member} access to ${bucketUrl}`, r);
+        }
+        for (const b of policy.bindings ?? []) {
+            for (const m of b.members ?? []) {
+                if (!/^project(Viewer|Editor):/.test(m) || !b.role)
+                    continue;
+                act(`remove ${m} ${b.role} from ${bucketUrl}`);
+                if (dryRun)
+                    continue;
+                const r = await run([
+                    "storage",
+                    "buckets",
+                    "remove-iam-policy-binding",
+                    bucketUrl,
+                    project,
+                    `--member=${m}`,
+                    `--role=${b.role}`,
+                ]);
+                if (!r.ok)
+                    return fail(`Removing ${m} from ${bucketUrl}`, r);
+            }
+        }
+    }
+    else {
+        for (const member of members)
+            act(`grant ${member} ${OPS_BUCKET_ROLE} on ${bucketUrl}`);
+    }
+    // --- KMS key ring + key -------------------------------------------------
+    const kmsWhere = [`--location=${region}`, project];
+    const ring = await run([
+        "kms",
+        "keyrings",
+        "describe",
+        OPS_KEY_RING,
+        ...kmsWhere,
+        "--format=value(name)",
+    ]);
+    // In a dry run the KMS API may still be disabled; that reads as "not there yet".
+    const ringMissing = !ring.ok && (NOT_FOUND.test(ring.stderr) || dryRun);
+    if (!ring.ok && !ringMissing)
+        return fail(`Reading key ring ${OPS_KEY_RING}`, ring);
+    if (ringMissing) {
+        act(`create KMS key ring ${OPS_KEY_RING} in ${region}`);
+        if (!dryRun) {
+            const r = await run(["kms", "keyrings", "create", OPS_KEY_RING, ...kmsWhere]);
+            if (!r.ok)
+                return fail(`Creating key ring ${OPS_KEY_RING}`, r);
+        }
+    }
+    const keyWhere = [`--keyring=${OPS_KEY_RING}`, ...kmsWhere];
+    const key = ringMissing
+        ? { ok: false, stderr: "NOT_FOUND", stdout: "", exitCode: 1 }
+        : await run(["kms", "keys", "describe", OPS_STATE_KEY, ...keyWhere, "--format=value(name)"]);
+    const keyMissing = !key.ok && NOT_FOUND.test(key.stderr);
+    if (!key.ok && !keyMissing)
+        return fail(`Reading key ${OPS_STATE_KEY}`, key);
+    if (keyMissing) {
+        act(`create KMS key ${OPS_KEY_RING}/${OPS_STATE_KEY}`);
+        if (!dryRun) {
+            const r = await run([
+                "kms",
+                "keys",
+                "create",
+                OPS_STATE_KEY,
+                ...keyWhere,
+                "--purpose=encryption",
+                "--protection-level=software",
+            ]);
+            if (!r.ok)
+                return fail(`Creating key ${OPS_STATE_KEY}`, r);
+        }
+    }
+    // --- Key IAM ------------------------------------------------------------
+    let keyPolicy = {};
+    if (!keyMissing) {
+        const got = await run([
+            "kms",
+            "keys",
+            "get-iam-policy",
+            OPS_STATE_KEY,
+            ...keyWhere,
+            "--format=json",
+        ]);
+        if (!got.ok)
+            return fail(`Reading the IAM policy of key ${OPS_STATE_KEY}`, got);
+        keyPolicy = parseJson(got.stdout, {});
+    }
+    for (const member of members) {
+        if (hasBinding(keyPolicy, OPS_KEY_ROLE, member))
+            continue;
+        act(`grant ${member} ${OPS_KEY_ROLE} on ${OPS_KEY_RING}/${OPS_STATE_KEY}`);
+        if (dryRun)
+            continue;
+        const r = await runWithRetry(run, sleep, [
+            "kms",
+            "keys",
+            "add-iam-policy-binding",
+            OPS_STATE_KEY,
+            ...keyWhere,
+            `--member=${member}`,
+            `--role=${OPS_KEY_ROLE}`,
+        ]);
+        if (!r.ok)
+            return fail(`Granting ${member} use of key ${OPS_STATE_KEY}`, r);
+    }
+    return { ok: true, record: gcsBackendRecord(projectId, region), actions };
+}
+//# sourceMappingURL=ops-backend.js.map

package/dist/ops-backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ops-backend.js","sourceRoot":"","sources":["../src/ops-backend.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAqB,SAAS,EAAE,YAAY,EAAc,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,aAAa,GAEd,MAAM,oBAAoB,CAAC;AAE5B,qEAAqE;AACrE,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAE1C,8DAA8D;AAC9D,MAAM,CAAC,MAAM,eAAe,GAAG,2BAA2B,CAAC;AAC3D,6DAA6D;AAC7D,MAAM,CAAC,MAAM,YAAY,GAAG,4CAA4C,CAAC;AAEzE,kCAAkC;AAClC,MAAM,QAAQ,GAAG,CAAC,wBAAwB,EAAE,yBAAyB,CAAU,CAAC;AAEhF,2DAA2D;AAC3D,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAC,CAAC;AAEtE,iEAAiE;AACjE,MAAM,SAAS,GAAG,kDAAkD,CAAC;AAiCrE,SAAS,SAAS,CAAI,IAAY,EAAE,QAAW;IAC7C,IAAI,CAAC;QACH,OAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,MAAM,CAAc,IAAI,QAAQ,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,gEAAgE;AAChE,MAAM,kBAAkB,GAAG;IACzB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,SAAS,EAAE,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,EAAE,KAAK,EAAE;CACtE,CAAC;AAEX;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,MAAe;IAC5C,MAAM,KAAK,GAAI,MAAgD,EAAE,IAAI,CAAC;IACtE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAA8E,CAAC;IAChG,MAAM,IAAI,GAAG,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC;IAC/B,OAAO,CACL,CAAC,CAAC,MAAM,EAAE,IAAI,KAAK,QAAQ;QAC3B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;QAClC,IAAI,CAAC,uBAAuB,KAAK,uBAAuB;QACxD,IAAI,CAAC,MAAM,KAAK,KAAK;QACrB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAC/B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,MAAiB,EAAE,IAAY,EAAE,MAAc,EAAW,EAAE,CAC9E,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CAC1B,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,IAAI,KAAK,IAAI;IACf,CAAC,CAAC,SAAS,IAAI,IAAI;IACnB,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC,CAC1E,CAAC;AAEJ,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,QAAgB,EAAE,EAAE,CAClD,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,iBAAiB,QAAQ,EAAE,CAAC;AAE/E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAwB,EACxB,OAAgE,EAAE;IAElE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC;IACpC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IACrC,MAAM,OAAO,GAAG,aAAa,SAAS,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,QAAQ,MAAM,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG;QACd,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC;QACtC,kBAAkB,MAAM,CAAC,gBAAgB,EAAE;KAC5C,CAAC;IACF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,CAAuC,EAAoB,EAAE,CAAC,CAAC;QACzF,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,GAAG,IAAI,YAAY,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE;KACzD,CAAC,CAAC;IAEH,yEAAyE;IACzE,yEAAyE;IACzE,uCAAuC;IACvC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC;QACxB,UAAU;QACV,MAAM;QACN,WAAW;QACX,OAAO;QACP,6BAA6B;KAC9B,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,+BAA+B,SAAS,EAAE,EAAE,OAAO,CAAC,CAAC;IAClF,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACpE,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,GAAG,CAAC,UAAU,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,GAAG,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;YACxE,IAAI,CAAC,IAAI,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC,YAAY,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC;QAC1B,SAAS;QACT,SAAS;QACT,UAAU;QACV,SAAS;QACT,OAAO;QACP,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,YAAY,GAAG,SAAS,CAAC,EAAE,CAAC;IAChC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QACvD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,kBAAkB,SAAS,KAAK,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,sDAAsD,SAAS,sFAAsF;SACzO,CAAC;IACJ,CAAC;IACD,IAAI,YAAY,EAAE,CAAC;QACjB,uEAAuE;QACvE,qEAAqE;QACrE,0CAA0C;QAC1C,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAAC;QACzF,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,kCAAkC,SAAS,EAAE,EAAE,KAAK,CAAC,CAAC;QACjF,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/C,CAAC;aACE,IAAI,EAAE;aACN,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;aACvB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACtB,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,GAAG,SAAS,0CAA0C,SAAS,8IAA8I;aACrN,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,GAAG,CAAC,UAAU,SAAS,OAAO,MAAM,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC;gBACxB,SAAS;gBACT,SAAS;gBACT,QAAQ;gBACR,SAAS;gBACT,OAAO;gBACP,cAAc,MAAM,EAAE;gBACtB,kCAAkC;gBAClC,+BAA+B;gBAC/B,4BAA4B;aAC7B,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC,YAAY,SAAS,EAAE,EAAE,OAAO,CAAC,CAAC;YAC/D,YAAY,GAAG,IAAI,CAAC;QACtB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAsB,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpF,oEAAoE;IACpE,uDAAuD;IACvD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,IAAI,CAAC,kBAAkB,KAAK,IAAI;QAAE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACnE,IAAI,SAAS,CAAC,EAAE,IAAI,IAAI,CAAC,2BAA2B,KAAK,IAAI,EAAE,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,SAAS,CAAC,EAAE,IAAI,IAAI,CAAC,wBAAwB,KAAK,UAAU,EAAE,CAAC;QACjE,OAAO,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,SAAS,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC;YACtF,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC,YAAY,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,GAAG,CACD,wBAAwB,SAAS,iDAAiD,uBAAuB,sBAAsB,CAChI,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,mEAAmE;YACnE,wCAAwC;YACxC,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;YACzC,IAAI,CAAC;gBACH,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBACrF,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC;oBAClB,SAAS;oBACT,SAAS;oBACT,QAAQ;oBACR,SAAS;oBACT,OAAO;oBACP,oBAAoB,IAAI,EAAE;iBAC3B,CAAC,CAAC;gBACH,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,OAAO,IAAI,CAAC,iCAAiC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;YAC1E,CAAC;oBAAS,CAAC;gBACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC;YACpB,SAAS;YACT,SAAS;YACT,gBAAgB;YAChB,SAAS;YACT,OAAO;YACP,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,6BAA6B,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,SAAS,CAAY,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CACpD,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CACtF,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,GAAG,SAAS,WAAW,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,mJAAmJ,SAAS,+CAA+C;aAC5P,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,UAAU,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,CAAC;gBAAE,SAAS;YAC1D,GAAG,CAAC,SAAS,MAAM,IAAI,eAAe,OAAO,SAAS,EAAE,CAAC,CAAC;YAC1D,IAAI,MAAM;gBAAE,SAAS;YACrB,MAAM,CAAC,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE;gBACvC,SAAS;gBACT,SAAS;gBACT,wBAAwB;gBACxB,SAAS;gBACT,OAAO;gBACP,YAAY,MAAM,EAAE;gBACpB,UAAU,eAAe,EAAE;aAC5B,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC,YAAY,MAAM,cAAc,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;QACzE,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;YACtC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;gBAChC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;oBAAE,SAAS;gBAC7D,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,SAAS,SAAS,EAAE,CAAC,CAAC;gBAC/C,IAAI,MAAM;oBAAE,SAAS;gBACrB,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC;oBAClB,SAAS;oBACT,SAAS;oBACT,2BAA2B;oBAC3B,SAAS;oBACT,OAAO;oBACP,YAAY,CAAC,EAAE;oBACf,UAAU,CAAC,CAAC,IAAI,EAAE;iBACnB,CAAC,CAAC;gBACH,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,MAAM,IAAI,OAAO;YAAE,GAAG,CAAC,SAAS,MAAM,IAAI,eAAe,OAAO,SAAS,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED,2EAA2E;IAC3E,MAAM,QAAQ,GAAG,CAAC,cAAc,MAAM,EAAE,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC;QACrB,KAAK;QACL,UAAU;QACV,UAAU;QACV,YAAY;QACZ,GAAG,QAAQ;QACX,sBAAsB;KACvB,CAAC,CAAC;IACH,iFAAiF;IACjF,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,CAAC;IACxE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC,oBAAoB,YAAY,EAAE,EAAE,IAAI,CAAC,CAAC;IACpF,IAAI,WAAW,EAAE,CAAC;QAChB,GAAG,CAAC,uBAAuB,YAAY,OAAO,MAAM,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC;YAC9E,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC,qBAAqB,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,aAAa,YAAY,EAAE,EAAE,GAAG,QAAQ,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,WAAW;QACrB,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE;QAC7D,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,QAAQ,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAC/F,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC,eAAe,aAAa,EAAE,EAAE,GAAG,CAAC,CAAC;IAC7E,IAAI,UAAU,EAAE,CAAC;QACf,GAAG,CAAC,kBAAkB,YAAY,IAAI,aAAa,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC;gBAClB,KAAK;gBACL,MAAM;gBACN,QAAQ;gBACR,aAAa;gBACb,GAAG,QAAQ;gBACX,sBAAsB;gBACtB,6BAA6B;aAC9B,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC,gBAAgB,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,IAAI,SAAS,GAAc,EAAE,CAAC;IAC9B,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC;YACpB,KAAK;YACL,MAAM;YACN,gBAAgB;YAChB,aAAa;YACb,GAAG,QAAQ;YACX,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,iCAAiC,aAAa,EAAE,EAAE,GAAG,CAAC,CAAC;QAChF,SAAS,GAAG,SAAS,CAAY,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,UAAU,CAAC,SAAS,EAAE,YAAY,EAAE,MAAM,CAAC;YAAE,SAAS;QAC1D,GAAG,CAAC,SAAS,MAAM,IAAI,YAAY,OAAO,YAAY,IAAI,aAAa,EAAE,CAAC,CAAC;QAC3E,IAAI,MAAM;YAAE,SAAS;QACrB,MAAM,CAAC,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE;YACvC,KAAK;YACL,MAAM;YACN,wBAAwB;YACxB,aAAa;YACb,GAAG,QAAQ;YACX,YAAY,MAAM,EAAE;YACpB,UAAU,YAAY,EAAE;SACzB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,YAAY,MAAM,eAAe,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC;IAC9E,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;AAC5E,CAAC"}

package/dist/provisioner-identity.d.ts

@@ -0,0 +1,103 @@
+import { type GcloudRunner, type Sleep } from "./gcloud-retry.js";
+/** Account id of the service account Pulumi converges the stack as. */
+export declare const PROVISIONER_ACCOUNT_ID = "caelo-provisioner";
+/** The role that lets the operator impersonate the provisioner. */
+export declare const TOKEN_CREATOR_ROLE = "roles/iam.serviceAccountTokenCreator";
+/** File name of the JSON key installers before #696 kept in `secrets/`. */
+export declare const LEGACY_SA_KEY_FILE = "sa-key.json";
+/**
+ * Environment variables that would make Google's client libraries use a
+ * credential other than the operator's Application Default Credentials —
+ * a key file (perhaps the deleted `sa-key.json`), a static token that expires
+ * after an hour, or another impersonation target. Removed from every
+ * infrastructure run so the chain is always ADC → impersonated provisioner.
+ */
+export declare const AMBIENT_GOOGLE_CREDENTIAL_ENV: readonly string[];
+/** `caelo-provisioner@<project>.iam.gserviceaccount.com`. */
+export declare function provisionerServiceAccountEmail(projectId: string): string;
+/** `base` without the credential variables {@link AMBIENT_GOOGLE_CREDENTIAL_ENV} lists. */
+export declare function withoutAmbientGoogleCredentials(base: NodeJS.ProcessEnv): Record<string, string>;
+/** IAM member for a gcloud account: a service account when it is one, else a user. */
+export declare function operatorMember(account: string): string;
+export type ImpersonationGrant = {
+    readonly ok: true;
+    readonly status: "already" | "granted";
+} | {
+    readonly ok: false;
+    readonly error: string;
+};
+/**
+ * Give the operator's gcloud account `roles/iam.serviceAccountTokenCreator`
+ * on the provisioner service account (and on nothing else). Reads the
+ * account's IAM policy first, so an operator who was granted the role by
+ * someone else needs no IAM-write permission. Never throws for a gcloud
+ * failure.
+ */
+export declare function ensureProvisionerImpersonation(target: {
+    readonly projectId: string;
+    readonly operatorAccount: string;
+}, deps?: {
+    run?: GcloudRunner;
+    sleep?: Sleep;
+}): Promise<ImpersonationGrant>;
+export type LegacyKeyReport = {
+    readonly ok: true;
+    /** `none`: no local key file. `removed`: file (and its IAM key, if live) deleted. */
+    readonly status: "none" | "removed";
+    /** The IAM key id deleted, when the key was still live in IAM. */
+    readonly deletedKeyId?: string;
+    /** Lines for the operator: what was removed, other keys found. */
+    readonly lines: string[];
+} | {
+    readonly ok: false;
+    readonly error: string;
+};
+/**
+ * Delete the provisioner's JSON key an installer before #696 minted: first
+ * the IAM key whose id matches the local file's `private_key_id`, then the
+ * file. The file is only removed once its key is gone from IAM, so a failed
+ * IAM delete can be retried on the next run. Other user-managed keys of the
+ * account are listed in `lines` with the command to delete them — never
+ * deleted here. Idempotent: no local file means nothing to do. Never throws
+ * for a gcloud failure.
+ */
+export declare function removeLegacyProvisionerKey(target: {
+    readonly projectId: string;
+    readonly secretsDir: string;
+}, deps?: {
+    run?: GcloudRunner;
+}): Promise<LegacyKeyReport>;
+/** Delays between impersonation probes while a fresh TokenCreator grant propagates. */
+export declare const PROPAGATION_DELAYS_MS: readonly number[];
+export type KeylessConvergence = {
+    readonly ok: true;
+    /** `no-provisioner`: the project has no caelo-provisioner account; nothing to do. */
+    readonly grant: "already" | "granted" | "no-provisioner";
+    readonly legacyKey: "none" | "removed";
+    readonly lines: string[];
+} | {
+    readonly ok: false;
+    readonly error: string;
+};
+/**
+ * Bring an install to the keyless provisioner (#696): the operator's gcloud
+ * account may impersonate `caelo-provisioner`, and a key an older installer
+ * minted is gone, locally and in IAM. The grant comes first, so a run that
+ * cannot set it up stops before the key — today's only working credential
+ * for older tooling — is deleted. Shared by the installer and `upgrade`;
+ * idempotent; never throws for a gcloud failure.
+ */
+export declare function convergeKeylessProvisioner(target: {
+    readonly projectId: string;
+    readonly secretsDir: string;
+    readonly operatorAccount: string;
+    /**
+     * The installer just created the account: wait out IAM's propagation
+     * delay instead of reading a NOT_FOUND as "no provisioner".
+     */
+    readonly justCreated?: boolean;
+}, deps?: {
+    run?: GcloudRunner;
+    sleep?: Sleep;
+}): Promise<KeylessConvergence>;
+//# sourceMappingURL=provisioner-identity.d.ts.map

package/dist/provisioner-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisioner-identity.d.ts","sourceRoot":"","sources":["../src/provisioner-identity.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAE,KAAK,YAAY,EAA2B,KAAK,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAE3F,uEAAuE;AACvE,eAAO,MAAM,sBAAsB,sBAAsB,CAAC;AAE1D,mEAAmE;AACnE,eAAO,MAAM,kBAAkB,yCAAyC,CAAC;AAEzE,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,gBAAgB,CAAC;AAEhD;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAAS,MAAM,EAO1D,CAAC;AAEF,6DAA6D;AAC7D,wBAAgB,8BAA8B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAExE;AAED,2FAA2F;AAC3F,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAM/F;AAED,sFAAsF;AACtF,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGtD;AAMD,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD;;;;;;GAMG;AACH,wBAAsB,8BAA8B,CAClD,MAAM,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;CAAE,EACxE,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAO,GAC/C,OAAO,CAAC,kBAAkB,CAAC,CA8C7B;AAgBD,MAAM,MAAM,eAAe,GACvB;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,qFAAqF;IACrF,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,kEAAkE;IAClE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,kEAAkE;IAClE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;CAC1B,GACD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAOnD;;;;;;;;GAQG;AACH,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EACnE,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAA;CAAO,GAChC,OAAO,CAAC,eAAe,CAAC,CAiF1B;AA0BD,uFAAuF;AACvF,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAElD,CAAC;AA4BF,MAAM,MAAM,kBAAkB,GAC1B;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,qFAAqF;IACrF,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,GAAG,gBAAgB,CAAC;IACzD,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;CAC1B,GACD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD;;;;;;;GAOG;AACH,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE;IACN,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;CAChC,EACD,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAO,GAC/C,OAAO,CAAC,kBAAkB,CAAC,CA+C7B"}