@caelo-cms/provisioning 0.10.47 → 0.10.49

package/dist/upgrader-assess.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Whether the upgrader job may install the release an update request names
+ * (epic #696). Pure: the job fetches the signed manifest and reads the
+ * install's own state, this decides.
+ *
+ * The request row comes from the admin, so it is untrusted input: it only
+ * names a version and who asked. Everything that decides — the digests, the
+ * minimum version to upgrade from, whether the release changes the
+ * infrastructure or carries destructive migrations, whether it is a
+ * security release — comes from the manifest Caelo's release workflow
+ * signed, and the installed version from install.json in the install's ops
+ * bucket (which the admin cannot write). So a compromised admin can at most
+ * ask for "the newest signed release" again; it cannot pick an older one,
+ * skip a required intermediate release or get an infrastructure change past
+ * the Owner.
+ *
+ * Refusal matrix (table-tested in upgrader-assess.test.ts):
+ *
+ * | Condition                                           | Status            |
+ * |-----------------------------------------------------|-------------------|
+ * | registry unreachable                                | failed (retry)    |
+ * | bad signature / tampered blob / replayed manifest   | refused           |
+ * | manifest too new for this upgrader                  | needs_cloud_shell |
+ * | installed version unknown (never upgraded via CLI)  | needs_cloud_shell |
+ * | target not newer than installed (downgrade/same)    | refused           |
+ * | installed below the release's minFromVersion        | refused           |
+ * | release raises the infrastructure contract          | needs_cloud_shell |
+ * | contract (destructive) migrations, automatic run    | refused           |
+ * | contract migrations, Owner's click                  | proceed + warning |
+ * | automatic run the update policy does not allow      | refused           |
+ * | automatic "security" run, signed manifest disagrees | refused           |
+ *
+ * Self-hosted installs (the host agent, #696 Phase 4c) have no separately
+ * converged infrastructure: their Compose file, roles and bootstrap script
+ * are rendered by the target release's own provisioning CLI in the same run
+ * that rolls the images. So for them `installed.infraContractVersion` is
+ * null and the infra-contract row never applies; every "needs_cloud_shell"
+ * stop names the upgrade command on the server instead of Cloud Shell.
+ */
+import { type AutoUpdateBasis, type PlatformUpdateTrigger, type StoredUpdatePolicy } from "@caelo-cms/shared";
+import { type ReleaseManifest, type ReleaseManifestResult } from "./release-manifest.js";
+/** Machine-readable reason codes (`platform_update_requests.refusal_codes`). */
+export type RefusalCode = "registry" | "signature" | "manifest-unreadable" | "install-version-unknown" | "not-newer" | "min-from-version" | "infra-contract" | "contract-migrations" | "policy";
+export type RequestDecision = {
+    readonly kind: "proceed";
+    readonly manifest: ReleaseManifest;
+    /** Notes for the timeline (e.g. destructive migrations the Owner accepted). */
+    readonly warnings: readonly string[];
+} | {
+    readonly kind: "stop";
+    readonly status: "refused" | "needs_cloud_shell" | "failed";
+    readonly codes: readonly RefusalCode[];
+    /** Plain words for the Owner. */
+    readonly reason: string;
+    /** The manifest, when it verified (for the facts the page explains). */
+    readonly manifest?: ReleaseManifest;
+};
+/** What the install's own state says it runs. */
+export interface InstalledState {
+    /** install.json `releaseVersion` (self-hosted: release.json); null when never recorded. */
+    readonly version: string | null;
+    /**
+     * install.json `infraContractVersion` (0 when never converged); null for
+     * an install without separately converged infrastructure (self-hosted).
+     */
+    readonly infraContractVersion: number | null;
+}
+/** Where the Owner runs an upgrade by hand when the automatic path cannot. */
+export type ManualUpgradePath = "cloud-shell" | "server";
+/** Decide what the job does with a request. See the file comment for the matrix. */
+export declare function assessUpgradeRequest(input: {
+    readonly request: {
+        readonly targetVersion: string;
+        readonly trigger: PlatformUpdateTrigger;
+        /** Why the admin's scheduler queued an automatic request (Phase 5). */
+        readonly autoBasis?: AutoUpdateBasis | null;
+    };
+    readonly manifest: ReleaseManifestResult;
+    readonly installed: InstalledState;
+    readonly policy: StoredUpdatePolicy;
+    readonly now: Date;
+    /** Default `cloud-shell` (the GCP upgrader job). */
+    readonly manualPath?: ManualUpgradePath;
+}): RequestDecision;
+//# sourceMappingURL=upgrader-assess.d.ts.map

package/dist/upgrader-assess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upgrader-assess.d.ts","sourceRoot":"","sources":["../src/upgrader-assess.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,EACL,KAAK,eAAe,EAEpB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAIL,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC3B,MAAM,uBAAuB,CAAC;AAG/B,gFAAgF;AAChF,MAAM,MAAM,WAAW,GACnB,UAAU,GACV,WAAW,GACX,qBAAqB,GACrB,yBAAyB,GACzB,WAAW,GACX,kBAAkB,GAClB,gBAAgB,GAChB,qBAAqB,GACrB,QAAQ,CAAC;AAEb,MAAM,MAAM,eAAe,GACvB;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,+EAA+E;IAC/E,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,mBAAmB,GAAG,QAAQ,CAAC;IAC5D,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC,iCAAiC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC;CACrC,CAAC;AAEN,iDAAiD;AACjD,MAAM,WAAW,cAAc;IAC7B,2FAA2F;IAC3F,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9C;AAED,8EAA8E;AAC9E,MAAM,MAAM,iBAAiB,GAAG,aAAa,GAAG,QAAQ,CAAC;AAsBzD,oFAAoF;AACpF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;QACxC,uEAAuE;QACvE,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;KAC7C,CAAC;IACF,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;IACnB,oDAAoD;IACpD,QAAQ,CAAC,UAAU,CAAC,EAAE,iBAAiB,CAAC;CACzC,GAAG,eAAe,CAkHlB"}

package/dist/upgrader-assess.js

@@ -0,0 +1,122 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * Whether the upgrader job may install the release an update request names
+ * (epic #696). Pure: the job fetches the signed manifest and reads the
+ * install's own state, this decides.
+ *
+ * The request row comes from the admin, so it is untrusted input: it only
+ * names a version and who asked. Everything that decides — the digests, the
+ * minimum version to upgrade from, whether the release changes the
+ * infrastructure or carries destructive migrations, whether it is a
+ * security release — comes from the manifest Caelo's release workflow
+ * signed, and the installed version from install.json in the install's ops
+ * bucket (which the admin cannot write). So a compromised admin can at most
+ * ask for "the newest signed release" again; it cannot pick an older one,
+ * skip a required intermediate release or get an infrastructure change past
+ * the Owner.
+ *
+ * Refusal matrix (table-tested in upgrader-assess.test.ts):
+ *
+ * | Condition                                           | Status            |
+ * |-----------------------------------------------------|-------------------|
+ * | registry unreachable                                | failed (retry)    |
+ * | bad signature / tampered blob / replayed manifest   | refused           |
+ * | manifest too new for this upgrader                  | needs_cloud_shell |
+ * | installed version unknown (never upgraded via CLI)  | needs_cloud_shell |
+ * | target not newer than installed (downgrade/same)    | refused           |
+ * | installed below the release's minFromVersion        | refused           |
+ * | release raises the infrastructure contract          | needs_cloud_shell |
+ * | contract (destructive) migrations, automatic run    | refused           |
+ * | contract migrations, Owner's click                  | proceed + warning |
+ * | automatic run the update policy does not allow      | refused           |
+ * | automatic "security" run, signed manifest disagrees | refused           |
+ *
+ * Self-hosted installs (the host agent, #696 Phase 4c) have no separately
+ * converged infrastructure: their Compose file, roles and bootstrap script
+ * are rendered by the target release's own provisioning CLI in the same run
+ * that rolls the images. So for them `installed.infraContractVersion` is
+ * null and the infra-contract row never applies; every "needs_cloud_shell"
+ * stop names the upgrade command on the server instead of Cloud Shell.
+ */
+import { autoInstallRefusal, updateKind, } from "@caelo-cms/shared";
+import { assessAutoInstall, channelForVersion, compareSemver, } from "./release-manifest.js";
+import { needsConverge } from "./upgrade/converge.js";
+/** "…once with Cloud Shell" / "…once on the server": the hand-run upgrade, in words. */
+function manualRun(path) {
+    return path === "server"
+        ? "with the upgrade command on the server (Settings → Updates shows it)"
+        : "with Cloud Shell";
+}
+const stop = (status, code, reason, manifest) => ({
+    kind: "stop",
+    status,
+    codes: [code],
+    reason,
+    ...(manifest ? { manifest } : {}),
+});
+/** Decide what the job does with a request. See the file comment for the matrix. */
+export function assessUpgradeRequest(input) {
+    const { request, installed } = input;
+    const by = manualRun(input.manualPath ?? "cloud-shell");
+    const target = request.targetVersion;
+    if (!input.manifest.ok) {
+        const e = input.manifest.error;
+        switch (e.code) {
+            case "registry":
+                return stop("failed", "registry", `Could not reach the Caelo release registry to verify v${target} (${e.message}). Nothing was changed; try again later.`);
+            case "schema":
+                return stop("needs_cloud_shell", "manifest-unreadable", `This upgrader is too old to read the release information of v${target}. Install it once ${by}; afterwards the admin can install updates again. (${e.message})`);
+            default:
+                return stop("refused", "signature", `The release information of v${target} is not signed by Caelo's release workflow, so it was not installed. Nothing was changed. (${e.message})`);
+        }
+    }
+    const manifest = input.manifest.manifest;
+    if (installed.version === null) {
+        return stop("needs_cloud_shell", "install-version-unknown", `This install has not recorded which Caelo release it runs yet. Upgrade it once ${by}; that records it, and the admin can install updates from then on.`, manifest);
+    }
+    if (compareSemver(target, installed.version) <= 0) {
+        return stop("refused", "not-newer", `v${target} is not newer than the installed v${installed.version}; Caelo never installs an older release over a newer one.`, manifest);
+    }
+    if (compareSemver(installed.version, manifest.minFromVersion) < 0) {
+        return stop("refused", "min-from-version", `v${target} can only be installed over v${manifest.minFromVersion} or newer; this install runs v${installed.version}. Install v${manifest.minFromVersion} first.`, manifest);
+    }
+    // Self-hosted: the target's own CLI renders the host setup in this run.
+    const infraContractVersion = installed.infraContractVersion ?? manifest.infraContractVersion;
+    if (installed.infraContractVersion !== null &&
+        needsConverge({ infraContractVersion }, manifest.infraContractVersion)) {
+        return stop("needs_cloud_shell", "infra-contract", `v${target} changes this install's cloud setup (infrastructure contract ${infraContractVersion} → ${manifest.infraContractVersion}). The admin may not change cloud permissions, so this release is installed once with your own Google account in Cloud Shell.`, manifest);
+    }
+    const assessment = assessAutoInstall(manifest, {
+        version: installed.version,
+        infraContractVersion,
+    });
+    const destructive = assessment.mode === "manual";
+    const warnings = [];
+    if (destructive) {
+        if (request.trigger === "auto") {
+            return stop("refused", "contract-migrations", `v${target} makes database changes the previous release cannot run on (${assessment.reasons.join("; ")}), so it never installs automatically. Install it from Settings → Updates.`, manifest);
+        }
+        warnings.push(`This release makes database changes the previous release cannot run on (${assessment.reasons.join("; ")}). If it has to roll back, the pre-upgrade backup must be restored.`);
+    }
+    if (request.trigger === "auto") {
+        const kind = updateKind(installed.version, target);
+        const refusal = kind === null
+            ? "the release is not a newer version"
+            : autoInstallRefusal(input.policy, {
+                kind,
+                security: assessment.kind === "security",
+                contractMigrations: destructive,
+                channel: channelForVersion(target) ?? "unknown",
+            }, input.now);
+        if (refusal) {
+            return stop("refused", "policy", `Not installed automatically: ${refusal}.`, manifest);
+        }
+        // The scheduler read the manifest unverified; it may only have used the
+        // security fix's shorter soak period if the SIGNED manifest backs it.
+        if (request.autoBasis === "security" && assessment.kind !== "security") {
+            return stop("refused", "policy", `Not installed automatically: v${target} was queued as a security fix, but its signed release information names no published security advisory. Install it from Settings → Updates.`, manifest);
+        }
+    }
+    return { kind: "proceed", manifest, warnings };
+}
+//# sourceMappingURL=upgrader-assess.js.map

package/dist/upgrader-assess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upgrader-assess.js","sourceRoot":"","sources":["../src/upgrader-assess.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,EAEL,kBAAkB,EAGlB,UAAU,GACX,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,GAGd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AA6CtD,wFAAwF;AACxF,SAAS,SAAS,CAAC,IAAuB;IACxC,OAAO,IAAI,KAAK,QAAQ;QACtB,CAAC,CAAC,sEAAsE;QACxE,CAAC,CAAC,kBAAkB,CAAC;AACzB,CAAC;AAED,MAAM,IAAI,GAAG,CACX,MAAkD,EAClD,IAAiB,EACjB,MAAc,EACd,QAA0B,EACT,EAAE,CAAC,CAAC;IACrB,IAAI,EAAE,MAAM;IACZ,MAAM;IACN,KAAK,EAAE,CAAC,IAAI,CAAC;IACb,MAAM;IACN,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CAClC,CAAC,CAAC;AAEH,oFAAoF;AACpF,MAAM,UAAU,oBAAoB,CAAC,KAapC;IACC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IACrC,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,IAAI,aAAa,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC/B,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;YACf,KAAK,UAAU;gBACb,OAAO,IAAI,CACT,QAAQ,EACR,UAAU,EACV,yDAAyD,MAAM,KAAK,CAAC,CAAC,OAAO,0CAA0C,CACxH,CAAC;YACJ,KAAK,QAAQ;gBACX,OAAO,IAAI,CACT,mBAAmB,EACnB,qBAAqB,EACrB,gEAAgE,MAAM,qBAAqB,EAAE,sDAAsD,CAAC,CAAC,OAAO,GAAG,CAChK,CAAC;YACJ;gBACE,OAAO,IAAI,CACT,SAAS,EACT,WAAW,EACX,+BAA+B,MAAM,8FAA8F,CAAC,CAAC,OAAO,GAAG,CAChJ,CAAC;QACN,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;IACzC,IAAI,SAAS,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC/B,OAAO,IAAI,CACT,mBAAmB,EACnB,yBAAyB,EACzB,kFAAkF,EAAE,oEAAoE,EACxJ,QAAQ,CACT,CAAC;IACJ,CAAC;IACD,IAAI,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAClD,OAAO,IAAI,CACT,SAAS,EACT,WAAW,EACX,IAAI,MAAM,qCAAqC,SAAS,CAAC,OAAO,2DAA2D,EAC3H,QAAQ,CACT,CAAC;IACJ,CAAC;IACD,IAAI,aAAa,CAAC,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,OAAO,IAAI,CACT,SAAS,EACT,kBAAkB,EAClB,IAAI,MAAM,gCAAgC,QAAQ,CAAC,cAAc,iCAAiC,SAAS,CAAC,OAAO,cAAc,QAAQ,CAAC,cAAc,SAAS,EACjK,QAAQ,CACT,CAAC;IACJ,CAAC;IACD,wEAAwE;IACxE,MAAM,oBAAoB,GAAG,SAAS,CAAC,oBAAoB,IAAI,QAAQ,CAAC,oBAAoB,CAAC;IAC7F,IACE,SAAS,CAAC,oBAAoB,KAAK,IAAI;QACvC,aAAa,CAAC,EAAE,oBAAoB,EAAE,EAAE,QAAQ,CAAC,oBAAoB,CAAC,EACtE,CAAC;QACD,OAAO,IAAI,CACT,mBAAmB,EACnB,gBAAgB,EAChB,IAAI,MAAM,gEAAgE,oBAAoB,MAAM,QAAQ,CAAC,oBAAoB,+HAA+H,EAChQ,QAAQ,CACT,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,iBAAiB,CAAC,QAAQ,EAAE;QAC7C,OAAO,EAAE,SAAS,CAAC,OAAO;QAC1B,oBAAoB;KACrB,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,KAAK,QAAQ,CAAC;IACjD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YAC/B,OAAO,IAAI,CACT,SAAS,EACT,qBAAqB,EACrB,IAAI,MAAM,+DAA+D,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,4EAA4E,EAClL,QAAQ,CACT,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,IAAI,CACX,2EAA2E,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,qEAAqE,CAC9K,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACnD,MAAM,OAAO,GACX,IAAI,KAAK,IAAI;YACX,CAAC,CAAC,oCAAoC;YACtC,CAAC,CAAC,kBAAkB,CAChB,KAAK,CAAC,MAAM,EACZ;gBACE,IAAI;gBACJ,QAAQ,EAAE,UAAU,CAAC,IAAI,KAAK,UAAU;gBACxC,kBAAkB,EAAE,WAAW;gBAC/B,OAAO,EAAE,iBAAiB,CAAC,MAAM,CAAC,IAAI,SAAS;aAChD,EACD,KAAK,CAAC,GAAG,CACV,CAAC;QACR,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,gCAAgC,OAAO,GAAG,EAAE,QAAQ,CAAC,CAAC;QACzF,CAAC;QACD,wEAAwE;QACxE,sEAAsE;QACtE,IAAI,OAAO,CAAC,SAAS,KAAK,UAAU,IAAI,UAAU,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACvE,OAAO,IAAI,CACT,SAAS,EACT,QAAQ,EACR,iCAAiC,MAAM,6IAA6I,EACpL,QAAQ,CACT,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AACjD,CAAC"}

package/dist/upgrader-gcp.d.ts

@@ -0,0 +1,17 @@
+import { type GcloudRunner } from "./gcloud-retry.js";
+import type { UpdateQueue, UpgraderJobDeps } from "./upgrader-job.js";
+import type { JobLog } from "./upgrader-reporter.js";
+/** Where the job runs, from the metadata server. */
+export interface UpgraderPlacement {
+    readonly projectId: string;
+    readonly region: string;
+    readonly execution: string | null;
+}
+/**
+ * The Cloud SQL private IP the admin connects to — the job connects there
+ * too (as its own IAM database user). Read from the deployed admin service.
+ */
+export declare function upgraderDatabaseHost(placement: Pick<UpgraderPlacement, "projectId" | "region">, run?: GcloudRunner): Promise<string>;
+/** Every dependency of {@link runUpgraderJob} except the database and the log. */
+export declare function gcpUpgraderDeps(placement: UpgraderPlacement, queue: UpdateQueue, log: JobLog): UpgraderJobDeps;
+//# sourceMappingURL=upgrader-gcp.d.ts.map

package/dist/upgrader-gcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upgrader-gcp.d.ts","sourceRoot":"","sources":["../src/upgrader-gcp.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,KAAK,YAAY,EAAa,MAAM,mBAAmB,CAAC;AAWjE,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAErD,oDAAoD;AACpD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,IAAI,CAAC,iBAAiB,EAAE,WAAW,GAAG,QAAQ,CAAC,EAC1D,GAAG,GAAE,YAAqB,GACzB,OAAO,CAAC,MAAM,CAAC,CAQjB;AA4BD,kFAAkF;AAClF,wBAAgB,eAAe,CAC7B,SAAS,EAAE,iBAAiB,EAC5B,KAAK,EAAE,WAAW,EAClB,GAAG,EAAE,MAAM,GACV,eAAe,CAkCjB"}

package/dist/upgrader-gcp.js

@@ -0,0 +1,87 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * The real side effects of the upgrader job on Google Cloud (epic #696):
+ * gcloud as the job's own service account, the install's ops bucket for
+ * install.json, the fixed release registry, the migration job and the IAP
+ * health probe. upgrader-job.ts takes them as {@link UpgraderJobDeps}; the
+ * database queue and the job log come from `@caelo-cms/platform-updater`,
+ * which owns the Query API connection.
+ *
+ * Nothing here reads the process env or argv: what the job may install and
+ * from where is compiled in (release-manifest.ts's registry + signer), and
+ * where it runs comes from the metadata server.
+ */
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { gcloud } from "./gcloud.js";
+import { realSleep } from "./gcloud-retry.js";
+import { GCP_STACK_ENV } from "./gcp-names.js";
+import { readAdminConfig, runMigrationsViaCloudRunJob } from "./migration-runner.js";
+import { fetchVerifiedReleaseManifest } from "./release-manifest.js";
+import { opsBucketName } from "./state-backend.js";
+import { acquireBucketStateLock, GcsStateStore } from "./state-store.js";
+import { findServiceUrl } from "./upgrade/gcp-lookup.js";
+import { createIapHealthProbe } from "./upgrade/health.js";
+/**
+ * The Cloud SQL private IP the admin connects to — the job connects there
+ * too (as its own IAM database user). Read from the deployed admin service.
+ */
+export async function upgraderDatabaseHost(placement, run = gcloud) {
+    const cfg = await readAdminConfig(placement, run);
+    if (!cfg) {
+        throw new Error(`could not read the admin service's database host in ${placement.projectId}/${placement.region}`);
+    }
+    return cfg.databaseHost;
+}
+/** The IAP-backed deep health probe for `plan`'s install. */
+async function healthProbeFor(run, http, plan) {
+    const { install } = plan;
+    const urls = {};
+    for (const s of plan.services) {
+        const url = await findServiceUrl(run, install.projectId, install.region, s.serviceName);
+        if (!url) {
+            return { ok: false, error: `could not read the ${s.slug} service's URL` };
+        }
+        urls[s.slug] = url;
+    }
+    return {
+        ok: true,
+        probe: createIapHealthProbe({
+            provider: install.provider,
+            projectId: install.projectId,
+            domain: install.domain,
+            adminServiceUrl: urls.admin,
+            gatewayServiceUrl: urls.gateway,
+        }, { run, http, sleep: realSleep }),
+    };
+}
+/** Every dependency of {@link runUpgraderJob} except the database and the log. */
+export function gcpUpgraderDeps(placement, queue, log) {
+    const run = gcloud;
+    const http = fetch;
+    // The bucket store mirrors to a local dir; in the job that is scratch.
+    const store = new GcsStateStore(opsBucketName(placement.projectId), mkdtempSync(join(tmpdir(), "caelo-upgrader-")));
+    return {
+        queue,
+        run,
+        sleep: realSleep,
+        projectId: placement.projectId,
+        region: placement.region,
+        env: GCP_STACK_ENV,
+        execution: placement.execution,
+        // The default deps: the fixed registry and signer, never overridden.
+        fetchManifest: (version) => fetchVerifiedReleaseManifest(version),
+        lockState: () => acquireBucketStateLock(opsBucketName(placement.projectId), "caelo upgrader job"),
+        readInstall: () => {
+            const text = store.read("install.json");
+            return text === null ? null : JSON.parse(text);
+        },
+        writeInstall: (meta) => store.write("install.json", meta),
+        migrate: (imageRef) => runMigrationsViaCloudRunJob({ projectId: placement.projectId, region: placement.region, imageOverride: imageRef }, { run }),
+        healthProbe: (plan) => healthProbeFor(run, http, plan),
+        now: () => new Date(),
+        log,
+    };
+}
+//# sourceMappingURL=upgrader-gcp.js.map

package/dist/upgrader-gcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upgrader-gcp.js","sourceRoot":"","sources":["../src/upgrader-gcp.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAqB,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAE,eAAe,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACrF,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AAErE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEzE,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAW3D;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,SAA0D,EAC1D,MAAoB,MAAM;IAE1B,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,uDAAuD,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,EAAE,CACjG,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,YAAY,CAAC;AAC1B,CAAC;AAED,6DAA6D;AAC7D,KAAK,UAAU,cAAc,CAAC,GAAiB,EAAE,IAAe,EAAE,IAAiB;IACjF,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACzB,MAAM,IAAI,GAAiD,EAAE,CAAC;IAC9D,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;QACxF,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,EAAE,EAAE,EAAE,KAAc,EAAE,KAAK,EAAE,sBAAsB,CAAC,CAAC,IAAI,gBAAgB,EAAE,CAAC;QACrF,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;IACrB,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAa;QACjB,KAAK,EAAE,oBAAoB,CACzB;YACE,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,eAAe,EAAE,IAAI,CAAC,KAAe;YACrC,iBAAiB,EAAE,IAAI,CAAC,OAAiB;SAC1C,EACD,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAChC;KACF,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAC7B,SAA4B,EAC5B,KAAkB,EAClB,GAAW;IAEX,MAAM,GAAG,GAAiB,MAAM,CAAC;IACjC,MAAM,IAAI,GAAG,KAA6B,CAAC;IAC3C,uEAAuE;IACvE,MAAM,KAAK,GAAG,IAAI,aAAa,CAC7B,aAAa,CAAC,SAAS,CAAC,SAAS,CAAC,EAClC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAC/C,CAAC;IACF,OAAO;QACL,KAAK;QACL,GAAG;QACH,KAAK,EAAE,SAAS;QAChB,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,GAAG,EAAE,aAAa;QAClB,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,qEAAqE;QACrE,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,4BAA4B,CAAC,OAAO,CAAC;QACjE,SAAS,EAAE,GAAG,EAAE,CACd,sBAAsB,CAAC,aAAa,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAC;QAClF,WAAW,EAAE,GAAG,EAAE;YAChB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACxC,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqB,CAAC;QACtE,CAAC;QACD,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC;QACzD,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CACpB,2BAA2B,CACzB,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,EACrF,EAAE,GAAG,EAAE,CACR;QACH,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC;QACtD,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QACrB,GAAG;KACJ,CAAC;AACJ,CAAC"}

package/dist/upgrader-job.d.ts

@@ -0,0 +1,133 @@
+/**
+ * The upgrader job (epic #696 Phase 2): installs one signed Caelo release
+ * on a `gcp` / `gcp-firebase` install, from inside the install's own cloud.
+ *
+ * The admin's "Install update" writes a `platform_update_requests` row and
+ * starts this job. The admin holds only `run.jobs.run` on it — not
+ * `runWithOverrides` — so it cannot pass arguments, env or another image
+ * (upgrader-setup.ts). The job runs as its own service account, which may
+ * deploy Cloud Run revisions, run the migration job and back up Cloud SQL,
+ * but cannot change IAM, service accounts or secrets. One run:
+ *
+ *   1. claim the oldest pending request (ending a run that died mid-way);
+ *   2. read what the install runs from install.json in its ops bucket;
+ *   3. fetch the release manifest from the FIXED registry and verify its
+ *      signature (release-manifest.ts) — no registry, identity or digest
+ *      ever comes from the request, the env or argv;
+ *   4. decide (upgrader-assess.ts): refuse a bad signature, a downgrade, a
+ *      release below its minFromVersion, an automatic run the policy does
+ *      not allow; hand an infrastructure change to Cloud Shell;
+ *   5. take a Cloud SQL backup — no backup, no change;
+ *   6. app-roll (upgrade/app-roll.ts) with no converge hooks: migrations
+ *      with the new admin image, admin then gateway, deep health check,
+ *      traffic back onto the previous revisions on any failure;
+ *   7. record the new digests + version in install.json;
+ *   8. move this job onto the release's own ops image, last.
+ *
+ * Every step is narrated into `platform_update_events` (upgrader-reporter.ts).
+ * All side effects come in through {@link UpgraderJobDeps}, so the whole
+ * run is tested against fakes; the real wiring is the
+ * `@caelo-cms/platform-updater` package (`caelo-ops upgrader`).
+ */
+import type { AutoUpdateBasis, PlatformUpdateEventLevel, PlatformUpdatePhase, PlatformUpdateTrigger, StoredUpdatePolicy } from "@caelo-cms/shared";
+import type { GcloudRunner, Sleep } from "./gcloud-retry.js";
+import type { InstallMetadata } from "./install-state.js";
+import type { ReleaseManifestResult } from "./release-manifest.js";
+import { type AppRollPlan } from "./upgrade/app-roll.js";
+import type { HealthProbe } from "./upgrade/health.js";
+import { type JobLog } from "./upgrader-reporter.js";
+/** A request the job claimed, with the policy as it stood at claim time. */
+export interface ClaimedUpdate {
+    readonly id: string;
+    readonly targetVersion: string;
+    readonly trigger: PlatformUpdateTrigger;
+    /** Why the admin's scheduler queued an automatic request; null for the Owner's. */
+    readonly autoBasis?: AutoUpdateBasis | null;
+    readonly policy: StoredUpdatePolicy;
+}
+/** Facts the job learns and stores on the request for the admin to show. */
+export interface UpdateFacts {
+    readonly manifestSecurity?: boolean;
+    readonly contractMigrations?: boolean;
+    readonly infraContractRequired?: number;
+    readonly infraContractInstalled?: number;
+    readonly adminDigest?: string;
+    readonly gatewayDigest?: string;
+    readonly opsDigest?: string;
+    readonly backupId?: string;
+}
+/** How a request ended. */
+export type UpdateEndStatus = "succeeded" | "rolled_back" | "failed" | "refused" | "needs_cloud_shell";
+export interface UpdateEnd {
+    readonly status: UpdateEndStatus;
+    readonly reason: string | null;
+    readonly codes: readonly string[];
+    /** A failed automatic install pauses automatic installs (Phase 5). */
+    readonly pauseAutoUpdates: boolean;
+}
+/** The job's view of the database (the platform_updater role, via the Query API). */
+export interface UpdateQueue {
+    /** End a run that died mid-way, then claim the oldest pending request. */
+    claim(execution: string | null): Promise<ClaimedUpdate | null>;
+    event(requestId: string, phase: PlatformUpdatePhase, level: PlatformUpdateEventLevel, message: string): Promise<void>;
+    record(requestId: string, facts: UpdateFacts): Promise<void>;
+    /**
+     * End a running request. Resolves false when it was no longer running
+     * (another process already ended it), so nothing changed.
+     */
+    finish(requestId: string, end: UpdateEnd): Promise<boolean>;
+}
+export interface UpgraderJobDeps {
+    readonly queue: UpdateQueue;
+    readonly run: GcloudRunner;
+    readonly sleep?: Sleep;
+    /** From the metadata server — never from env or argv. */
+    readonly projectId: string;
+    readonly region: string;
+    /** Pulumi stack name (`production`). */
+    readonly env: string;
+    /** This Cloud Run execution, for the log link; null outside Cloud Run. */
+    readonly execution: string | null;
+    /** fetchVerifiedReleaseManifest against the fixed registry. */
+    readonly fetchManifest: (version: string) => Promise<ReleaseManifestResult>;
+    /**
+     * Take the install's state lock (the one `pulumi up` and `state migrate`
+     * hold) for the whole run; returns its release. Throws when another run
+     * holds it.
+     */
+    readonly lockState: () => () => void;
+    /** install.json from the install's ops bucket (null when absent). */
+    readonly readInstall: () => InstallMetadata | null;
+    readonly writeInstall: (meta: InstallMetadata) => void;
+    /** Runs both migration targets with the NEW admin image. */
+    readonly migrate: (imageRef: string) => Promise<{
+        readonly ok: boolean;
+        readonly error?: string;
+    }>;
+    readonly healthProbe: (plan: AppRollPlan) => Promise<{
+        readonly ok: true;
+        readonly probe: HealthProbe;
+    } | {
+        readonly ok: false;
+        readonly error: string;
+    }>;
+    readonly now: () => Date;
+    readonly log: JobLog;
+}
+/** What one run did: the exit code, and the request it handled (if any). */
+export interface UpgraderRunResult {
+    readonly exitCode: number;
+    readonly requestId: string | null;
+    readonly status: UpdateEndStatus | null;
+}
+/** Run the job once. Never throws; see the file comment for the sequence. */
+export declare function runUpgraderJob(deps: UpgraderJobDeps): Promise<UpgraderRunResult>;
+/**
+ * End request `requestId` as `end`, retrying a failed write: the end state
+ * is what unblocks the next update, so a transient database error must not
+ * leave the request "running" while the run reports success.
+ *
+ * @returns whether the end was written (false after the last attempt failed)
+ */
+export declare function recordUpdateEnd(queue: UpdateQueue, requestId: string, end: UpdateEnd, log: JobLog, sleep?: Sleep): Promise<boolean>;
+//# sourceMappingURL=upgrader-job.d.ts.map

package/dist/upgrader-job.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upgrader-job.d.ts","sourceRoot":"","sources":["../src/upgrader-job.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,wBAAwB,EACxB,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAE7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,KAAK,EAAmB,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,EACL,KAAK,WAAW,EAKjB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGvD,OAAO,EAAiB,KAAK,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAEpE,4EAA4E;AAC5E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;IACxC,mFAAmF;IACnF,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IAC5C,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;CACrC;AAED,4EAA4E;AAC5E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,2BAA2B;AAC3B,MAAM,MAAM,eAAe,GACvB,WAAW,GACX,aAAa,GACb,QAAQ,GACR,SAAS,GACT,mBAAmB,CAAC;AAExB,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACpC;AAED,qFAAqF;AACrF,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAC/D,KAAK,CACH,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,mBAAmB,EAC1B,KAAK,EAAE,wBAAwB,EAC/B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D;;;OAGG;IACH,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7D;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,yDAAyD;IACzD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,+DAA+D;IAC/D,QAAQ,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC5E;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,MAAM,IAAI,CAAC;IACrC,qEAAqE;IACrE,QAAQ,CAAC,WAAW,EAAE,MAAM,eAAe,GAAG,IAAI,CAAC;IACnD,QAAQ,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,IAAI,CAAC;IACvD,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,EAAE,CAChB,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC;QAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChE,QAAQ,CAAC,WAAW,EAAE,CACpB,IAAI,EAAE,WAAW,KACd,OAAO,CACR;QAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAA;KAAE,GAClD;QAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CACjD,CAAC;IACF,QAAQ,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,4EAA4E;AAC5E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAAC;CACzC;AASD,6EAA6E;AAC7E,wBAAsB,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAsQtF;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,WAAW,EAClB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,SAAS,EACd,GAAG,EAAE,MAAM,EACX,KAAK,GAAE,KAAoB,GAC1B,OAAO,CAAC,OAAO,CAAC,CAclB"}