@caelo-cms/provisioning 0.10.46 → 0.10.48

package/dist/adc-impersonation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adc-impersonation.d.ts","sourceRoot":"","sources":["../src/adc-impersonation.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,KAAK,YAAY,EAAa,KAAK,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAS7E,MAAM,MAAM,QAAQ,GAChB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GACrB;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,sFAAsF;IACtF,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;AAEN;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,EAC7F,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAO,GAC9F,OAAO,CAAC,QAAQ,CAAC,CA6EnB"}
+{"version":3,"file":"adc-impersonation.d.ts","sourceRoot":"","sources":["../src/adc-impersonation.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,KAAK,YAAY,EAAa,KAAK,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAa7E,MAAM,MAAM,QAAQ,GAChB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GACrB;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,sFAAsF;IACtF,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;AAEN;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,EAC7F,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAO,GAC9F,OAAO,CAAC,QAAQ,CAAC,CAqGnB"}

package/dist/adc-impersonation.js

@@ -13,6 +13,8 @@
 import { gcloud as defaultGcloud } from "./gcloud.js";
 import { realSleep } from "./gcloud-retry.js";
 import { operatorMember, PROPAGATION_DELAYS_MS, provisionerServiceAccountEmail, TOKEN_CREATOR_ROLE, withoutAmbientGoogleCredentials, } from "./provisioner-identity.js";
+/** A user-managed service account's email, as IAM reports it. */
+const SERVICE_ACCOUNT_EMAIL = /^[a-z][a-z0-9-]{4,28}[a-z0-9]@[a-z][a-z0-9.:-]*[a-z0-9]\.iam\.gserviceaccount\.com$/;
 /**
  * Verify the credential chain Pulumi will use: the operator's Application
  * Default Credentials exist and may mint a token for the provisioner. Run
@@ -40,12 +42,32 @@ export async function checkAdcImpersonation(target, deps = {}) {
             ].join("\n"),
         };
     }
+    // The account to impersonate is the one IAM reports, not a string
+    // assembled from install.json: what goes into the request is an email
+    // Google confirmed exists in the project (CodeQL js/file-access-to-http:
+    // local file data never reaches the network unchecked).
+    const described = await run([
+        "iam",
+        "service-accounts",
+        "describe",
+        sa,
+        `--project=${target.projectId}`,
+        "--format=value(email)",
+    ], { env });
+    const confirmed = described.ok ? described.stdout.trim().toLowerCase() : "";
+    if (!SERVICE_ACCOUNT_EMAIL.test(confirmed) || confirmed !== sa.toLowerCase()) {
+        return {
+            ok: false,
+            reason: "error",
+            error: `Could not find ${sa} in project ${target.projectId}${described.ok ? "" : `: ${described.stderr.trim().split("\n").slice(-1)[0] ?? ""}`}. Re-run the installer so it creates the provisioner service account.`,
+        };
+    }
     const delays = target.freshGrant ? PROPAGATION_DELAYS_MS : [];
     let status = 0;
     let detail = "";
     for (let attempt = 0;; attempt++) {
         try {
-            const res = await doFetch(`https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${encodeURIComponent(sa)}:generateAccessToken`, {
+            const res = await doFetch(`https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${encodeURIComponent(confirmed)}:generateAccessToken`, {
                 method: "POST",
                 headers: {
                     authorization: `Bearer ${sourceToken}`,

package/dist/adc-impersonation.js.map

@@ -1 +1 @@
-{"version":3,"file":"adc-impersonation.js","sourceRoot":"","sources":["../src/adc-impersonation.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAqB,SAAS,EAAc,MAAM,mBAAmB,CAAC;AAC7E,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,8BAA8B,EAC9B,kBAAkB,EAClB,+BAA+B,GAChC,MAAM,2BAA2B,CAAC;AAWnC;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAA6F,EAC7F,OAA6F,EAAE;IAE/F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACpC,MAAM,EAAE,GAAG,8BAA8B,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,+BAA+B,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IAErE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,qBAAqB,EAAE,oBAAoB,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACtF,MAAM,WAAW,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE;gBACL,qDAAqD;gBACrD,+EAA+E,EAAE,wBAAwB;gBACzG,6DAA6D,MAAM,CAAC,eAAe,iBAAiB;aACrG,CAAC,IAAI,CAAC,IAAI,CAAC;SACb,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,uEAAuE,kBAAkB,CAAC,EAAE,CAAC,sBAAsB,EACnH;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,WAAW,EAAE;oBACtC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,KAAK,EAAE,CAAC,gDAAgD,CAAC;oBACzD,QAAQ,EAAE,MAAM;iBACjB,CAAC;aACH,CACF,CAAC;YACF,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;YACpB,gFAAgF;YAChF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,GAAG,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YAChC,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,OAAO;gBACf,KAAK,EAAE,4CAA4C,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;aAChG,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,MAAM,KAAK,GAAG,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM;QACjD,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAED,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,OAAO;YACf,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,MAAM,MAAM,MAAM,EAAE;SAChE,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC5D,MAAM,QAAQ,GACZ,UAAU,IAAI,UAAU,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzF,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE;YACL,uCAAuC,UAAU,CAAC,CAAC,CAAC,KAAK,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,KAAK,MAAM,EAAE;YAClH,QAAQ;gBACN,CAAC,CAAC,+CAA+C,MAAM,CAAC,eAAe,kBAAkB,kBAAkB,4DAA4D,MAAM,CAAC,eAAe,gBAAgB;gBAC7M,CAAC,CAAC,qBAAqB,kBAAkB,OAAO,EAAE,8KAA8K,EAAE,cAAc,MAAM,CAAC,SAAS,aAAa,cAAc,CAAC,UAAU,IAAI,MAAM,CAAC,eAAe,CAAC,WAAW,kBAAkB,mBAAmB;SACpX,CAAC,IAAI,CAAC,IAAI,CAAC;KACb,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqC,CAAC;QACpE,IAAI,MAAM,CAAC,KAAK,EAAE,OAAO;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,0CAA0C;IAC5C,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,WAAW,CAAC;AAClD,CAAC;AAED,qFAAqF;AACrF,KAAK,UAAU,YAAY,CAAC,OAAqB,EAAE,WAAmB;IACpE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,yCAAyC,EAAE;YACnE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,QAAQ,EAAE;SACpE,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAC;QACvD,OAAO,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}
+{"version":3,"file":"adc-impersonation.js","sourceRoot":"","sources":["../src/adc-impersonation.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAqB,SAAS,EAAc,MAAM,mBAAmB,CAAC;AAC7E,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,8BAA8B,EAC9B,kBAAkB,EAClB,+BAA+B,GAChC,MAAM,2BAA2B,CAAC;AAEnC,iEAAiE;AACjE,MAAM,qBAAqB,GACzB,qFAAqF,CAAC;AAWxF;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAA6F,EAC7F,OAA6F,EAAE;IAE/F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACpC,MAAM,EAAE,GAAG,8BAA8B,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,+BAA+B,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IAErE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,qBAAqB,EAAE,oBAAoB,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACtF,MAAM,WAAW,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE;gBACL,qDAAqD;gBACrD,+EAA+E,EAAE,wBAAwB;gBACzG,6DAA6D,MAAM,CAAC,eAAe,iBAAiB;aACrG,CAAC,IAAI,CAAC,IAAI,CAAC;SACb,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,sEAAsE;IACtE,yEAAyE;IACzE,wDAAwD;IACxD,MAAM,SAAS,GAAG,MAAM,GAAG,CACzB;QACE,KAAK;QACL,kBAAkB;QAClB,UAAU;QACV,EAAE;QACF,aAAa,MAAM,CAAC,SAAS,EAAE;QAC/B,uBAAuB;KACxB,EACD,EAAE,GAAG,EAAE,CACR,CAAC;IACF,MAAM,SAAS,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,SAAS,KAAK,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,OAAO;YACf,KAAK,EAAE,kBAAkB,EAAE,eAAe,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,uEAAuE;SACtN,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,uEAAuE,kBAAkB,CAAC,SAAS,CAAC,sBAAsB,EAC1H;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,WAAW,EAAE;oBACtC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,KAAK,EAAE,CAAC,gDAAgD,CAAC;oBACzD,QAAQ,EAAE,MAAM;iBACjB,CAAC;aACH,CACF,CAAC;YACF,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;YACpB,gFAAgF;YAChF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,GAAG,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YAChC,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,OAAO;gBACf,KAAK,EAAE,4CAA4C,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;aAChG,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,MAAM,KAAK,GAAG,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM;QACjD,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAED,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,OAAO;YACf,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,MAAM,MAAM,MAAM,EAAE;SAChE,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC5D,MAAM,QAAQ,GACZ,UAAU,IAAI,UAAU,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzF,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE;YACL,uCAAuC,UAAU,CAAC,CAAC,CAAC,KAAK,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,KAAK,MAAM,EAAE;YAClH,QAAQ;gBACN,CAAC,CAAC,+CAA+C,MAAM,CAAC,eAAe,kBAAkB,kBAAkB,4DAA4D,MAAM,CAAC,eAAe,gBAAgB;gBAC7M,CAAC,CAAC,qBAAqB,kBAAkB,OAAO,EAAE,8KAA8K,EAAE,cAAc,MAAM,CAAC,SAAS,aAAa,cAAc,CAAC,UAAU,IAAI,MAAM,CAAC,eAAe,CAAC,WAAW,kBAAkB,mBAAmB;SACpX,CAAC,IAAI,CAAC,IAAI,CAAC;KACb,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqC,CAAC;QACpE,IAAI,MAAM,CAAC,KAAK,EAAE,OAAO;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,0CAA0C;IAC5C,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,WAAW,CAAC;AAClD,CAAC;AAED,qFAAqF;AACrF,KAAK,UAAU,YAAY,CAAC,OAAqB,EAAE,WAAmB;IACpE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,yCAAyC,EAAE;YACnE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,QAAQ,EAAE;SACpE,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAC;QACvD,OAAO,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/agent/apply.d.ts

@@ -0,0 +1,45 @@
+/**
+ * `agent apply` — the target release's half of a self-hosted update (#696
+ * Phase 4c). The polling agent (agent/run.ts) claimed the request, verified
+ * the release's signed manifest and ran the refusal checks; it then starts
+ * THIS release's CLI, which performs the upgrade exactly like a hand-run
+ * `cms-provision upgrade` (self-hosted-upgrade.ts: verified digests, pg_dump
+ * backup, pull, migrations with the new admin image, health-checked roll,
+ * rollback) — narrated into the request's timeline — records how it ended,
+ * and re-pins the agent's systemd service to this release.
+ *
+ * It is never started by hand: it acts on a request the parent already
+ * claimed and holds the install's upgrade lock for.
+ */
+import type { PlatformUpdateTrigger } from "@caelo-cms/shared";
+import type { SelfHostedUpgradeResult, UpgradeLog } from "../self-hosted-upgrade.js";
+import { type UpdateEnd, type UpdateQueue } from "../upgrader-job.js";
+import { type JobLog } from "../upgrader-reporter.js";
+export interface AgentApplyDeps {
+    readonly queue: UpdateQueue;
+    readonly request: {
+        readonly id: string;
+        readonly targetVersion: string;
+        readonly trigger: PlatformUpdateTrigger;
+    };
+    /** This CLI's own release; must be the target. */
+    readonly agentVersion: string;
+    /** upgradeSelfHosted for the target, with the manifest's digests. */
+    readonly upgrade: (log: UpgradeLog) => Promise<SelfHostedUpgradeResult>;
+    /** Re-pin the agent's service to this release (agent/systemd.ts). */
+    readonly selfUpdate: () => Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        error: string;
+    }>;
+    readonly log: JobLog;
+    readonly sleep?: (ms: number) => Promise<void>;
+}
+/** The request's end state for an upgrade result. */
+export declare function endForResult(result: SelfHostedUpgradeResult, trigger: PlatformUpdateTrigger): UpdateEnd;
+/** Run the upgrade for the claimed request. Never throws. */
+export declare function applyAgentUpdate(deps: AgentApplyDeps): Promise<{
+    exitCode: number;
+}>;
+//# sourceMappingURL=apply.d.ts.map

package/dist/agent/apply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.d.ts","sourceRoot":"","sources":["../../src/agent/apply.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,KAAK,EAAE,uBAAuB,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACrF,OAAO,EAAmB,KAAK,SAAS,EAAE,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,EAAiB,KAAK,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAErE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;KACzC,CAAC;IACF,kDAAkD;IAClD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,qEAAqE;IACrE,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,UAAU,KAAK,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACxE,qEAAqE;IACrE,QAAQ,CAAC,UAAU,EAAE,MAAM,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED,qDAAqD;AACrD,wBAAgB,YAAY,CAC1B,MAAM,EAAE,uBAAuB,EAC/B,OAAO,EAAE,qBAAqB,GAC7B,SAAS,CAgBX;AAED,6DAA6D;AAC7D,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CA8D1F"}

package/dist/agent/apply.js

@@ -0,0 +1,83 @@
+// SPDX-License-Identifier: MPL-2.0
+import { recordUpdateEnd } from "../upgrader-job.js";
+import { eventReporter } from "../upgrader-reporter.js";
+/** The request's end state for an upgrade result. */
+export function endForResult(result, trigger) {
+    if (result.ok)
+        return { status: "succeeded", reason: null, codes: [], pauseAutoUpdates: false };
+    const rolled = result.stage === "roll-admin" || result.stage === "roll-gateway";
+    const status = rolled && result.previousRunning ? "rolled_back" : "failed";
+    const lead = status === "rolled_back"
+        ? "The new release did not pass its health check, so the previous release serves again."
+        : result.previousRunning
+            ? "Nothing was changed; the previous release keeps serving."
+            : "The update stopped half-way and the previous release did not come back healthy — check `docker compose ps` on the server.";
+    return {
+        status,
+        reason: `${lead}\n${result.error}`.slice(0, 4000),
+        codes: [rolled && !result.previousRunning ? "rollback" : result.stage],
+        pauseAutoUpdates: trigger === "auto",
+    };
+}
+/** Run the upgrade for the claimed request. Never throws. */
+export async function applyAgentUpdate(deps) {
+    const { queue, request, log } = deps;
+    const r = eventReporter((phase, level, message) => queue.event(request.id, phase, level, message), log, request.id);
+    const finish = async (end) => {
+        r.phase("finish");
+        if (end.status === "succeeded")
+            r.success(`Caelo ${request.targetVersion} is installed.`);
+        else
+            r.error(end.reason ?? end.status);
+        await r.flush();
+        const recorded = await recordUpdateEnd(queue, request.id, end, log, deps.sleep);
+        return { exitCode: recorded && end.status === "succeeded" ? 0 : 1 };
+    };
+    if (deps.agentVersion !== request.targetVersion) {
+        return finish({
+            status: "failed",
+            reason: `Nothing was changed: the installer of Caelo ${deps.agentVersion} was started for ${request.targetVersion}.`,
+            codes: ["apply"],
+            pauseAutoUpdates: request.trigger === "auto",
+        });
+    }
+    let result;
+    try {
+        r.phase("start");
+        r.info(`The Caelo ${request.targetVersion} installer took over.`);
+        result = await deps.upgrade({
+            step: (m) => {
+                r.step(m);
+            },
+            info: (m) => r.info(m),
+            warn: (m) => r.warn(m),
+            error: (m) => r.error(m),
+            phase: (p) => r.phase(p),
+        });
+    }
+    catch (e) {
+        return finish({
+            status: "failed",
+            reason: `The installer stopped unexpectedly: ${e instanceof Error ? e.message : String(e)}. Check \`docker compose ps\` on the server.`,
+            codes: ["internal"],
+            pauseAutoUpdates: request.trigger === "auto",
+        });
+    }
+    if (result.ok) {
+        if (result.status === "already-current") {
+            r.info(`Caelo ${result.version} was already installed; the containers are healthy.`);
+        }
+        r.phase("self-update");
+        const pinned = await deps.selfUpdate().catch((e) => ({
+            ok: false,
+            error: e instanceof Error ? e.message : String(e),
+        }));
+        if (pinned.ok)
+            r.info(`The update agent itself now runs ${request.targetVersion}.`);
+        else {
+            r.warn(`The update agent could not update itself (${pinned.error}); it keeps working with its current version.`);
+        }
+    }
+    return finish(endForResult(result, request.trigger));
+}
+//# sourceMappingURL=apply.js.map

package/dist/agent/apply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.js","sourceRoot":"","sources":["../../src/agent/apply.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAkBnC,OAAO,EAAE,eAAe,EAAoC,MAAM,oBAAoB,CAAC;AACvF,OAAO,EAAE,aAAa,EAAe,MAAM,yBAAyB,CAAC;AAmBrE,qDAAqD;AACrD,MAAM,UAAU,YAAY,CAC1B,MAA+B,EAC/B,OAA8B;IAE9B,IAAI,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC;IAChG,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,KAAK,YAAY,IAAI,MAAM,CAAC,KAAK,KAAK,cAAc,CAAC;IAChF,MAAM,MAAM,GAAG,MAAM,IAAI,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC3E,MAAM,IAAI,GACR,MAAM,KAAK,aAAa;QACtB,CAAC,CAAC,sFAAsF;QACxF,CAAC,CAAC,MAAM,CAAC,eAAe;YACtB,CAAC,CAAC,0DAA0D;YAC5D,CAAC,CAAC,2HAA2H,CAAC;IACpI,OAAO;QACL,MAAM;QACN,MAAM,EAAE,GAAG,IAAI,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;QACjD,KAAK,EAAE,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QACtE,gBAAgB,EAAE,OAAO,KAAK,MAAM;KACrC,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAoB;IACzD,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACrC,MAAM,CAAC,GAAG,aAAa,CACrB,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,EACzE,GAAG,EACH,OAAO,CAAC,EAAE,CACX,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,EAAE,GAAc,EAAiC,EAAE;QACrE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClB,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW;YAAE,CAAC,CAAC,OAAO,CAAC,SAAS,OAAO,CAAC,aAAa,gBAAgB,CAAC,CAAC;;YACrF,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAChF,OAAO,EAAE,QAAQ,EAAE,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,CAAC,CAAC;IAEF,IAAI,IAAI,CAAC,YAAY,KAAK,OAAO,CAAC,aAAa,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC;YACZ,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,+CAA+C,IAAI,CAAC,YAAY,oBAAoB,OAAO,CAAC,aAAa,GAAG;YACpH,KAAK,EAAE,CAAC,OAAO,CAAC;YAChB,gBAAgB,EAAE,OAAO,CAAC,OAAO,KAAK,MAAM;SAC7C,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjB,CAAC,CAAC,IAAI,CAAC,aAAa,OAAO,CAAC,aAAa,uBAAuB,CAAC,CAAC;QAClE,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAC1B,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE;gBACV,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACZ,CAAC;YACD,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACtB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACtB,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YACxB,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;SACzB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,MAAM,CAAC;YACZ,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,uCAAuC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,8CAA8C;YACvI,KAAK,EAAE,CAAC,UAAU,CAAC;YACnB,gBAAgB,EAAE,OAAO,CAAC,OAAO,KAAK,MAAM;SAC7C,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,IAAI,MAAM,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;YACxC,CAAC,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,OAAO,qDAAqD,CAAC,CAAC;QACvF,CAAC;QACD,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC;YAC5D,EAAE,EAAE,KAAc;YAClB,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;SAClD,CAAC,CAAC,CAAC;QACJ,IAAI,MAAM,CAAC,EAAE;YAAE,CAAC,CAAC,IAAI,CAAC,oCAAoC,OAAO,CAAC,aAAa,GAAG,CAAC,CAAC;aAC/E,CAAC;YACJ,CAAC,CAAC,IAAI,CACJ,6CAA6C,MAAM,CAAC,KAAK,+CAA+C,CACzG,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;AACvD,CAAC"}

package/dist/agent/cli-provenance.d.ts

@@ -0,0 +1,42 @@
+import type { HostRunner } from "../self-hosted-release.js";
+/** Where Caelo's packages are built (the provenance's workflow repository). */
+export declare const SOURCE_REPOSITORY = "https://github.com/caelo-cms/caelo-cms";
+/** The Caelo packages the CLI runs; both must carry the release's provenance. */
+export declare const CAELO_CLI_PACKAGES: readonly ["@caelo-cms/provisioning", "@caelo-cms/shared"];
+/** Why the CLI of a release was not trusted. */
+export interface CliProvenanceError {
+    readonly code: "npm-missing" | "npm-install" | "audit-signatures" | "version" | "provenance";
+    readonly message: string;
+}
+export type VerifiedCli = {
+    readonly ok: true;
+    readonly cliPath: string;
+    readonly dir: string;
+} | {
+    readonly ok: false;
+    readonly error: CliProvenanceError;
+};
+/** `.caelo/agent/cli/` — the verified CLI installs, one folder per release. */
+export declare function verifiedCliRoot(caeloDir: string): string;
+/** The folder of release `version`'s verified CLI. */
+export declare function verifiedCliDir(caeloDir: string, version: string): string;
+/** The CLI entry point inside {@link verifiedCliDir}. */
+export declare function verifiedCliPath(dir: string): string;
+/**
+ * Check one package's npm provenance attestation: SLSA v1, built from
+ * {@link SOURCE_REPOSITORY} at `refs/tags/v<version>`, for this exact
+ * package version.
+ *
+ * @returns null when it checks out, else why not
+ */
+export declare function provenanceProblem(name: string, version: string, fetchImpl?: typeof fetch): Promise<string | null>;
+/**
+ * Install release `version`'s CLI into `dir` (replacing what is there) and
+ * verify it. Nothing in it runs before the checks passed: npm's lifecycle
+ * scripts are off.
+ */
+export declare function installVerifiedCli(version: string, dir: string, deps: {
+    readonly runner: HostRunner;
+    readonly fetchImpl?: typeof fetch;
+}): Promise<VerifiedCli>;
+//# sourceMappingURL=cli-provenance.d.ts.map

package/dist/agent/cli-provenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-provenance.d.ts","sourceRoot":"","sources":["../../src/agent/cli-provenance.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAE5D,+EAA+E;AAC/E,eAAO,MAAM,iBAAiB,2CAA2C,CAAC;AAE1E,iFAAiF;AACjF,eAAO,MAAM,kBAAkB,2DAA4D,CAAC;AAE5F,gDAAgD;AAChD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,aAAa,GAAG,kBAAkB,GAAG,SAAS,GAAG,YAAY,CAAC;IAC7F,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACrE;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAA;CAAE,CAAC;AAE/D,+EAA+E;AAC/E,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,sDAAsD;AACtD,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAExE;AAED,yDAAyD;AACzD,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnD;AASD;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAuCxB;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CAAE,GACvE,OAAO,CAAC,WAAW,CAAC,CAkEtB"}

package/dist/agent/cli-provenance.js

@@ -0,0 +1,138 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * The target release's provisioning CLI, installed and VERIFIED before the
+ * update agent runs it (#696 Phase 4c, maintainer decision on #721). The
+ * signed release manifest proves a release exists and is installable; this
+ * proves the code that installs it is that release's: the same checks the
+ * Cloud Shell runner (`run.sh` in caelo-cms/install) makes.
+ *
+ *   1. `npm install` of exactly `@caelo-cms/provisioning@<v>` (with
+ *      `@caelo-cms/shared` pinned to the same version, lifecycle scripts
+ *      off) into a private folder under `.caelo/agent/cli/`;
+ *   2. `npm audit signatures` — the registry signatures and Sigstore
+ *      provenance attestations of every installed package;
+ *   3. both Caelo packages are the asked-for version, and their SLSA
+ *      provenance names caelo-cms/caelo-cms at `refs/tags/v<v>`.
+ *
+ * Any failure is a structured {@link CliProvenanceError}; there is no
+ * fallback to an unverified `bunx` run.
+ */
+import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+/** Where Caelo's packages are built (the provenance's workflow repository). */
+export const SOURCE_REPOSITORY = "https://github.com/caelo-cms/caelo-cms";
+/** The Caelo packages the CLI runs; both must carry the release's provenance. */
+export const CAELO_CLI_PACKAGES = ["@caelo-cms/provisioning", "@caelo-cms/shared"];
+/** `.caelo/agent/cli/` — the verified CLI installs, one folder per release. */
+export function verifiedCliRoot(caeloDir) {
+    return join(caeloDir, "agent", "cli");
+}
+/** The folder of release `version`'s verified CLI. */
+export function verifiedCliDir(caeloDir, version) {
+    return join(verifiedCliRoot(caeloDir), `caelo-${version}`);
+}
+/** The CLI entry point inside {@link verifiedCliDir}. */
+export function verifiedCliPath(dir) {
+    return join(dir, "node_modules", "@caelo-cms", "provisioning", "dist", "cli.js");
+}
+const fail = (code, message) => ({
+    ok: false,
+    error: { code, message },
+});
+const tail = (s) => s.trim().split("\n").slice(-6).join("\n").slice(0, 800);
+/**
+ * Check one package's npm provenance attestation: SLSA v1, built from
+ * {@link SOURCE_REPOSITORY} at `refs/tags/v<version>`, for this exact
+ * package version.
+ *
+ * @returns null when it checks out, else why not
+ */
+export async function provenanceProblem(name, version, fetchImpl = fetch) {
+    const url = `https://registry.npmjs.org/-/npm/v1/attestations/${encodeURIComponent(name)}@${version}`;
+    let body;
+    try {
+        const res = await fetchImpl(url);
+        if (!res.ok)
+            return `${name}@${version}: no provenance attestation (${url}: HTTP ${res.status})`;
+        body = (await res.json());
+    }
+    catch (e) {
+        return `${name}@${version}: the attestations could not be fetched (${e instanceof Error ? e.message : String(e)})`;
+    }
+    const slsa = body.attestations?.find((a) => a.predicateType === "https://slsa.dev/provenance/v1");
+    const payload = slsa?.bundle
+        ?.dsseEnvelope?.payload;
+    if (!payload)
+        return `${name}@${version}: no SLSA provenance`;
+    let statement;
+    try {
+        statement = JSON.parse(Buffer.from(payload, "base64").toString("utf8"));
+    }
+    catch {
+        return `${name}@${version}: the provenance statement is not JSON`;
+    }
+    const workflow = statement.predicate?.buildDefinition?.externalParameters?.workflow ?? {};
+    const subjects = (statement.subject ?? []).map((s) => s.name);
+    const wantSubject = `pkg:npm/${name.replaceAll("@", "%40")}@${version}`;
+    if (workflow.repository !== SOURCE_REPOSITORY ||
+        workflow.ref !== `refs/tags/v${version}` ||
+        !subjects.includes(wantSubject)) {
+        return `${name}@${version} was not built by ${SOURCE_REPOSITORY} at refs/tags/v${version} (provenance: ${workflow.repository ?? "?"} ${workflow.ref ?? "?"}, ${subjects.join(",")})`;
+    }
+    return null;
+}
+/**
+ * Install release `version`'s CLI into `dir` (replacing what is there) and
+ * verify it. Nothing in it runs before the checks passed: npm's lifecycle
+ * scripts are off.
+ */
+export async function installVerifiedCli(version, dir, deps) {
+    const probe = await deps.runner.run(["npm", "--version"]);
+    if (probe.exitCode !== 0) {
+        return fail("npm-missing", "npm is not installed on the server (or not on the agent's PATH); the update agent needs it to verify the provenance of the Caelo release it installs. Install Node.js + npm, then run `agent install` again.");
+    }
+    rmSync(dir, { recursive: true, force: true });
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    // Exact versions for both Caelo packages: provisioning depends on
+    // ^<version> of shared, which could otherwise resolve to a newer one.
+    writeFileSync(join(dir, "package.json"), JSON.stringify({
+        name: "caelo-agent-cli",
+        private: true,
+        dependencies: { "@caelo-cms/provisioning": version },
+        overrides: { "@caelo-cms/shared": version },
+    }, null, 2));
+    const install = await deps.runner.run([
+        "npm",
+        "install",
+        "--prefix",
+        dir,
+        "--ignore-scripts",
+        "--no-audit",
+        "--no-fund",
+        "--loglevel=error",
+    ]);
+    if (install.exitCode !== 0) {
+        return fail("npm-install", `npm could not install @caelo-cms/provisioning@${version}: ${tail(install.stderr || install.stdout)}`);
+    }
+    const audit = await deps.runner.run(["npm", "audit", "signatures", "--prefix", dir]);
+    if (audit.exitCode !== 0) {
+        return fail("audit-signatures", `npm audit signatures rejected the packages of Caelo ${version}: ${tail(audit.stderr || audit.stdout)}`);
+    }
+    for (const name of CAELO_CLI_PACKAGES) {
+        let installed;
+        try {
+            installed = JSON.parse(readFileSync(join(dir, "node_modules", name, "package.json"), "utf8")).version;
+        }
+        catch {
+            installed = undefined;
+        }
+        if (installed !== version) {
+            return fail("version", `${name}: installed ${installed ?? "nothing"}, expected ${version}`);
+        }
+        const problem = await provenanceProblem(name, version, deps.fetchImpl);
+        if (problem)
+            return fail("provenance", problem);
+    }
+    return { ok: true, cliPath: verifiedCliPath(dir), dir };
+}
+//# sourceMappingURL=cli-provenance.js.map

package/dist/agent/cli-provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-provenance.js","sourceRoot":"","sources":["../../src/agent/cli-provenance.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACzE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,+EAA+E;AAC/E,MAAM,CAAC,MAAM,iBAAiB,GAAG,wCAAwC,CAAC;AAE1E,iFAAiF;AACjF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,yBAAyB,EAAE,mBAAmB,CAAU,CAAC;AAY5F,+EAA+E;AAC/E,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,OAAO,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AACxC,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,OAAe;IAC9D,OAAO,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;AACnF,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,IAAgC,EAAE,OAAe,EAAe,EAAE,CAAC,CAAC;IAChF,EAAE,EAAE,KAAK;IACT,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;CACzB,CAAC,CAAC;AAEH,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAEpF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAY,EACZ,OAAe,EACf,YAA0B,KAAK;IAE/B,MAAM,GAAG,GAAG,oDAAoD,kBAAkB,CAAC,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC;IACtG,IAAI,IAAuE,CAAC;IAC5E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG,CAAC,EAAE;YACT,OAAO,GAAG,IAAI,IAAI,OAAO,gCAAgC,GAAG,UAAU,GAAG,CAAC,MAAM,GAAG,CAAC;QACtF,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAgB,CAAC;IAC3C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,GAAG,IAAI,IAAI,OAAO,4CAA4C,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;IACrH,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,gCAAgC,CAAC,CAAC;IAClG,MAAM,OAAO,GAAI,IAAI,EAAE,MAA8D;QACnF,EAAE,YAAY,EAAE,OAAO,CAAC;IAC1B,IAAI,CAAC,OAAO;QAAE,OAAO,GAAG,IAAI,IAAI,OAAO,sBAAsB,CAAC;IAC9D,IAAI,SAOH,CAAC;IACF,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,IAAI,IAAI,OAAO,wCAAwC,CAAC;IACpE,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,EAAE,eAAe,EAAE,kBAAkB,EAAE,QAAQ,IAAI,EAAE,CAAC;IAC1F,MAAM,QAAQ,GAAG,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,WAAW,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;IACxE,IACE,QAAQ,CAAC,UAAU,KAAK,iBAAiB;QACzC,QAAQ,CAAC,GAAG,KAAK,cAAc,OAAO,EAAE;QACxC,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,EAC/B,CAAC;QACD,OAAO,GAAG,IAAI,IAAI,OAAO,qBAAqB,iBAAiB,kBAAkB,OAAO,iBAAiB,QAAQ,CAAC,UAAU,IAAI,GAAG,IAAI,QAAQ,CAAC,GAAG,IAAI,GAAG,KAAK,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACvL,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAe,EACf,GAAW,EACX,IAAwE;IAExE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;IAC1D,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CACT,aAAa,EACb,8MAA8M,CAC/M,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,kEAAkE;IAClE,sEAAsE;IACtE,aAAa,CACX,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EACzB,IAAI,CAAC,SAAS,CACZ;QACE,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,IAAI;QACb,YAAY,EAAE,EAAE,yBAAyB,EAAE,OAAO,EAAE;QACpD,SAAS,EAAE,EAAE,mBAAmB,EAAE,OAAO,EAAE;KAC5C,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;QACpC,KAAK;QACL,SAAS;QACT,UAAU;QACV,GAAG;QACH,kBAAkB;QAClB,YAAY;QACZ,WAAW;QACX,kBAAkB;KACnB,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,CACT,aAAa,EACb,iDAAiD,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,CACtG,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;IACrF,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CACT,kBAAkB,EAClB,uDAAuD,OAAO,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,CACxG,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;QACtC,IAAI,SAA6B,CAAC;QAClC,IAAI,CAAC;YACH,SAAS,GACP,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAGjF,CAAC,OAAO,CAAC;QACZ,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,GAAG,SAAS,CAAC;QACxB,CAAC;QACD,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,eAAe,SAAS,IAAI,SAAS,cAAc,OAAO,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACvE,IAAI,OAAO;YAAE,OAAO,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC;AAC1D,CAAC"}

package/dist/agent/command.d.ts

@@ -0,0 +1,79 @@
+import type { ReleaseImages } from "../compose.js";
+import { type HostRunner } from "../self-hosted-release.js";
+import type { ConvergeOutcome } from "../self-hosted-roles.js";
+import { type AgentConfig } from "./config.js";
+import { type AgentHost } from "./systemd.js";
+/** What the CLI owns that the agent commands need. */
+export interface AgentCliContext {
+    readonly caeloDir: string;
+    readonly domain: string;
+    readonly imageMode: "release" | "dev" | undefined;
+    /** config.json → agent. */
+    agent(): AgentConfig | undefined;
+    /** Persist config.json → agent (undefined removes it). */
+    saveAgent(agent: AgentConfig | undefined): void;
+    /** Re-write the Compose file (with the agent's port) and bootstrap.sh. */
+    emitConfig(): void;
+    /** The role convergence as the superuser, including the agent's login. */
+    convergeRoles(): Promise<ConvergeOutcome>;
+    /** The Compose file for `images` from config.json. */
+    renderCompose(images: ReleaseImages): string;
+    randomSecret(): string;
+}
+/** The notice printed before the one restart Postgres gets for the agent. */
+export declare const POSTGRES_RESTART_NOTICE = "Postgres restarts once, a few seconds of downtime: it is now also published on 127.0.0.1 for the update agent. The admin reconnects by itself.";
+/**
+ * Whether the running Postgres container already publishes `port` on the
+ * loopback interface (`docker compose port postgres 5432`).
+ */
+export declare function postgresPublishedOnLoopback(ctx: Pick<AgentCliContext, "caeloDir">, runner: HostRunner, port: number): Promise<boolean>;
+/**
+ * Apply the agent's database side to a RUNNING install: the login, then —
+ * only the first time, when the container does not publish the agent's
+ * port yet — one `up -d postgres` to publish it (#721: Postgres restarts
+ * once, announced first). Re-running finds the port published and leaves
+ * Postgres alone; `agent run` / `agent apply` never get here.
+ */
+export declare function applyDatabaseSide(ctx: Pick<AgentCliContext, "caeloDir" | "convergeRoles">, runner: HostRunner, port: number, opts?: {
+    readonly notice?: (m: string) => void;
+    readonly sleep?: (ms: number) => Promise<void>;
+}): Promise<{
+    ok: true;
+    restarted: boolean;
+} | {
+    ok: false;
+    error: string;
+}>;
+export type SetUpAgentResult = {
+    readonly kind: "installed";
+    readonly unit: string;
+    readonly version: string;
+    readonly warnings: readonly string[];
+} | {
+    readonly kind: "skipped";
+    readonly reason: string;
+} | {
+    readonly kind: "failed";
+    readonly error: string;
+};
+/**
+ * Set the agent up, or bring it up to date — idempotent, for `agent
+ * install`, `init` and `upgrade`. With `database: "live"` the install's
+ * Postgres runs and gets the login + port now; with `"fresh"` (init) the
+ * volume is new and bootstrap.sh creates the login on first start.
+ *
+ * Never pins an older release than the one already installed.
+ */
+export declare function setUpAgent(ctx: AgentCliContext, opts: {
+    readonly database: "live" | "fresh";
+    readonly requestedPort?: number;
+    /** `agent install` re-enables an uninstalled agent; init/upgrade respect it. */
+    readonly explicit: boolean;
+    readonly runner?: HostRunner;
+    readonly host?: AgentHost;
+}): Promise<SetUpAgentResult>;
+/** Print what {@link setUpAgent} did, for init / upgrade / agent install. */
+export declare function reportAgentSetup(result: SetUpAgentResult): void;
+/** `agent <sub>`. */
+export declare function agentCommand(argv: readonly string[], ctx: AgentCliContext): Promise<number>;
+//# sourceMappingURL=command.d.ts.map

package/dist/agent/command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../../src/agent/command.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAGnD,OAAO,EAAiB,KAAK,UAAU,EAAe,MAAM,2BAA2B,CAAC;AACxF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAS/D,OAAO,EAAE,KAAK,WAAW,EAAqC,MAAM,aAAa,CAAC;AAIlF,OAAO,EACL,KAAK,SAAS,EASf,MAAM,cAAc,CAAC;AAGtB,sDAAsD;AACtD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,KAAK,GAAG,SAAS,CAAC;IAClD,2BAA2B;IAC3B,KAAK,IAAI,WAAW,GAAG,SAAS,CAAC;IACjC,0DAA0D;IAC1D,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,GAAG,IAAI,CAAC;IAChD,0EAA0E;IAC1E,UAAU,IAAI,IAAI,CAAC;IACnB,0EAA0E;IAC1E,aAAa,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IAC1C,sDAAsD;IACtD,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAAC;IAC7C,YAAY,IAAI,MAAM,CAAC;CACxB;AA8CD,6EAA6E;AAC7E,eAAO,MAAM,uBAAuB,mJAC8G,CAAC;AAEnJ;;;GAGG;AACH,wBAAsB,2BAA2B,CAC/C,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC,EACtC,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,OAAO,CAAC,CAGlB;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,UAAU,GAAG,eAAe,CAAC,EACxD,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IACJ,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3C,GACL,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAoB1E;AAED,MAAM,MAAM,gBAAgB,GACxB;IACE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAExD;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAC9B,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE;IACJ,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IACpC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,gFAAgF;IAChF,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;CAC3B,GACA,OAAO,CAAC,gBAAgB,CAAC,CAyD3B;AAED,6EAA6E;AAC7E,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI,CAa/D;AAED,qBAAqB;AACrB,wBAAsB,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAsBjG"}