@caelo-cms/provisioning 0.10.48 → 0.10.50

package/caddy/Caddyfile.production

@@ -10,6 +10,10 @@
 
 :80 {
 	root * /srv/current
+	# #587 — the redirects table of the build served here (the generator
+	# writes it; `*` so a fresh checkout without a build still starts).
+	# docker-compose.yml reloads Caddy when it changes (caddy-redirects.ts).
+	import /srv/current/_redirects.caddy*
 	# Content-hashed build outputs (fonts, plugin bundles, media) never
 	# change under the same URL — cache them for a year. Keep this pattern in
 	# sync with CONTENT_HASHED_PATH_PATTERN in @caelo-cms/shared
@@ -18,7 +22,7 @@
 	# `file` gates the header on the file existing: a 404 for a hashed
 	# URL (old page after a deploy switch) must not be cached for a year.
 	@content_hashed {
-		path_regexp content_hashed ^/(?:_app/immutable/.+|_assets/fonts/[^/]+/[0-9a-f]{16,64}\.(?:woff2|woff|ttf|otf)|_assets/[a-z0-9][a-z0-9-]*(?:/[a-z][a-z0-9-]*)?\.[0-9a-f]{16}\.[a-z0-9]{2,5}|_caelo/plugin/[^/]+/[^/]+\.[0-9a-f]{12}\.(?:js|css))$
+		path_regexp content_hashed ^/(?:_app/immutable/.+|_assets/fonts/[^/]+/[0-9a-f]{16}\.woff2|_assets/fonts/pinned/[0-9a-f]{64}\.[a-z]+(?:-[a-z]+)?\.[0-9a-f]{12}\.woff2|_assets/[a-z0-9][a-z0-9-]*(?:/[a-z][a-z0-9-]*)?\.[0-9a-f]{16}\.[a-z0-9]{2,5}|_caelo/plugin/[^/]+/[^/]+\.[0-9a-f]{12}\.(?:js|css))$
 		file
 	}
 	header @content_hashed Cache-Control "public, max-age=31536000, immutable"

package/caddy/Caddyfile.staging

@@ -14,6 +14,10 @@
 
 :80 {
 	root * /srv/current
+	# #587 — the redirects table of the build served here (the generator
+	# writes it; `*` so a fresh checkout without a build still starts).
+	# docker-compose.yml reloads Caddy when it changes (caddy-redirects.ts).
+	import /srv/current/_redirects.caddy*
 	# Content-hashed build outputs (fonts, plugin bundles, media) never
 	# change under the same URL — cache them for a year. Keep this pattern in
 	# sync with CONTENT_HASHED_PATH_PATTERN in @caelo-cms/shared
@@ -22,7 +26,7 @@
 	# `file` gates the header on the file existing: a 404 for a hashed
 	# URL (old page after a deploy switch) must not be cached for a year.
 	@content_hashed {
-		path_regexp content_hashed ^/(?:_app/immutable/.+|_assets/fonts/[^/]+/[0-9a-f]{16,64}\.(?:woff2|woff|ttf|otf)|_assets/[a-z0-9][a-z0-9-]*(?:/[a-z][a-z0-9-]*)?\.[0-9a-f]{16}\.[a-z0-9]{2,5}|_caelo/plugin/[^/]+/[^/]+\.[0-9a-f]{12}\.(?:js|css))$
+		path_regexp content_hashed ^/(?:_app/immutable/.+|_assets/fonts/[^/]+/[0-9a-f]{16}\.woff2|_assets/fonts/pinned/[0-9a-f]{64}\.[a-z]+(?:-[a-z]+)?\.[0-9a-f]{12}\.woff2|_assets/[a-z0-9][a-z0-9-]*(?:/[a-z][a-z0-9-]*)?\.[0-9a-f]{16}\.[a-z0-9]{2,5}|_caelo/plugin/[^/]+/[^/]+\.[0-9a-f]{12}\.(?:js|css))$
 		file
 	}
 	header @content_hashed Cache-Control "public, max-age=31536000, immutable"

package/dist/agent-db.js

@@ -6808,7 +6808,7 @@ var setPageSeoToolInput = object({
 }).strict();
 var autofillPageSeoToolInput = object({
   pageId: string2().uuid(),
-  metaDescription: string2().min(1).max(320),
+  metaDescription: string2().trim().min(1).max(320),
   ogImageAssetId: string2().uuid().nullable().optional()
 }).strict();
 var optimizePageSeoToolInput = object({
@@ -6897,6 +6897,61 @@ var loginFormSchema = object({
   email: string2().email("must be a valid email").max(254),
   password: string2().min(1, "required").max(256)
 }).strict();
+// ../shared/src/platform-updates.ts
+var PLATFORM_UPDATE_PHASES = [
+  "queued",
+  "start",
+  "verify",
+  "assess",
+  "backup",
+  "health-baseline",
+  "migrations",
+  "roll",
+  "health",
+  "rollback",
+  "record",
+  "self-update",
+  "finish"
+];
+var PLATFORM_UPDATE_EVENT_LEVELS = ["info", "success", "warn", "error"];
+var PLATFORM_UPDATE_TRIGGERS = ["manual", "auto"];
+var PLATFORM_UPDATE_STALE_MINUTES = 90;
+var PLATFORM_UPDATE_STALE_REASON = "The upgrader stopped before it finished (its run timed out or crashed). The previous release may still serve, or the new one may be partly rolled out: open the site, and if it misbehaves run the upgrade by hand once \u2014 Settings \u2192 Updates shows how for this install.";
+var PLATFORM_UPDATE_EVENT_MAX = 4000;
+var SEMVER = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/;
+var releaseVersionSchema = string2().regex(SEMVER, "expected a release version like 0.11.0 (no leading v)");
+var UPDATE_POLICY_MODES = ["off", "notify", "auto"];
+var UPDATE_POLICY_CHANNELS = ["stable", "rc", "beta", "alpha"];
+var WALL_CLOCK = /^([01]\d|2[0-3]):[0-5]\d$/;
+function isKnownTimeZone(tz) {
+  try {
+    new Intl.DateTimeFormat("en-US", { timeZone: tz });
+    return true;
+  } catch {
+    return false;
+  }
+}
+var updatePolicySchema = object({
+  mode: _enum(UPDATE_POLICY_MODES),
+  autoSecurity: boolean2(),
+  autoPatch: boolean2(),
+  autoMinor: boolean2(),
+  channel: _enum(UPDATE_POLICY_CHANNELS),
+  windowStart: string2().regex(WALL_CLOCK, "expected HH:MM").nullable(),
+  windowEnd: string2().regex(WALL_CLOCK, "expected HH:MM").nullable(),
+  windowTimezone: string2().min(1).max(64).refine(isKnownTimeZone, "unknown time zone"),
+  soakHours: number2().int().min(0).max(720),
+  securitySoakHours: number2().int().min(0).max(720)
+}).strict().refine((p) => p.windowStart === null === (p.windowEnd === null), {
+  message: "set both ends of the maintenance window, or neither"
+}).refine((p) => p.mode !== "auto" || p.channel === "stable", {
+  message: "automatic installs follow the stable channel only"
+}).refine((p) => p.securitySoakHours <= p.soakHours, {
+  message: "security fixes cannot wait longer than other releases"
+});
+
+// ../shared/src/auto-update.ts
+var AUTO_UPDATE_BASES = ["security", "patch", "minor"];
 // ../shared/src/base-css.ts
 var BASE_TECHNICAL_CSS = "*,*::before,*::after{box-sizing:border-box}" + "body{margin:0}" + "img,picture,video,canvas,svg{display:block;max-width:100%}" + "input,button,textarea,select{font:inherit}" + "body{font-family:var(--font-body,system-ui,sans-serif)}";
 // ../shared/src/build-page.ts
@@ -8025,58 +8080,38 @@ var pageLogEntrySchema = object({
   detail: pageLogDetailSchema.nullable(),
   createdAt: string2().datetime()
 }).strict();
-// ../shared/src/platform-updates.ts
-var PLATFORM_UPDATE_PHASES = [
-  "queued",
-  "start",
-  "verify",
-  "assess",
-  "backup",
-  "health-baseline",
-  "migrations",
-  "roll",
-  "health",
-  "rollback",
-  "record",
-  "self-update",
-  "finish"
-];
-var PLATFORM_UPDATE_EVENT_LEVELS = ["info", "success", "warn", "error"];
-var PLATFORM_UPDATE_TRIGGERS = ["manual", "auto"];
-var PLATFORM_UPDATE_STALE_MINUTES = 90;
-var PLATFORM_UPDATE_STALE_REASON = "The upgrader stopped before it finished (its run timed out or crashed). The previous release may still serve, or the new one may be partly rolled out: open the site, and if it misbehaves run the upgrade by hand once \u2014 Settings \u2192 Updates shows how for this install.";
-var PLATFORM_UPDATE_EVENT_MAX = 4000;
-var SEMVER = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/;
-var releaseVersionSchema = string2().regex(SEMVER, "expected a release version like 0.11.0 (no leading v)");
-var UPDATE_POLICY_MODES = ["off", "notify", "auto"];
-var UPDATE_POLICY_CHANNELS = ["stable", "rc", "beta", "alpha"];
-var WALL_CLOCK = /^([01]\d|2[0-3]):[0-5]\d$/;
-function isKnownTimeZone(tz) {
-  try {
-    new Intl.DateTimeFormat("en-US", { timeZone: tz });
-    return true;
-  } catch {
-    return false;
-  }
-}
-var updatePolicySchema = object({
-  mode: _enum(UPDATE_POLICY_MODES),
-  autoSecurity: boolean2(),
-  autoPatch: boolean2(),
-  autoMinor: boolean2(),
-  channel: _enum(UPDATE_POLICY_CHANNELS),
-  windowStart: string2().regex(WALL_CLOCK, "expected HH:MM").nullable(),
-  windowEnd: string2().regex(WALL_CLOCK, "expected HH:MM").nullable(),
-  windowTimezone: string2().min(1).max(64).refine(isKnownTimeZone, "unknown time zone"),
-  soakHours: number2().int().min(0).max(720)
-}).strict().refine((p) => p.windowStart === null === (p.windowEnd === null), {
-  message: "set both ends of the maintenance window, or neither"
-}).refine((p) => p.mode !== "auto" || p.channel === "stable", {
-  message: "automatic installs follow the stable channel only"
-});
 // ../shared/src/proposal-status.ts
 var PROPOSAL_STATUSES = ["pending", "applied", "rejected", "superseded"];
 var proposalStatus = _enum(PROPOSAL_STATUSES);
+// ../shared/src/redirect-emit-cloudfront.ts
+var CLOUDFRONT_KVS_MAX_TOTAL_BYTES = 5 * 1024 * 1024;
+// ../shared/src/redirect-plan.ts
+var REDIRECT_STATUSES = new Set([301, 302, 307, 308]);
+// ../shared/src/release-manifest.ts
+var RELEASE_CHANNELS = ["stable", "rc", "beta", "alpha"];
+var IMAGE_DIGEST = /^sha256:[0-9a-f]{64}$/;
+var SEMVER2 = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/;
+var GHSA_ID = /^GHSA(-[23456789cfghjmpqrvwx]{4}){3}$/;
+var digest = string2().regex(IMAGE_DIGEST, "expected sha256:<64 hex>");
+var ReleaseManifestSchema = object({
+  manifestVersion: literal(1),
+  version: string2().regex(SEMVER2, "expected a SemVer version without a leading v"),
+  channel: _enum(RELEASE_CHANNELS),
+  digests: object({ admin: digest, gateway: digest, ops: digest }),
+  minFromVersion: string2().regex(SEMVER2),
+  infraContractVersion: number2().int().positive(),
+  migrations: object({
+    contract: boolean2(),
+    lastContractVersion: string2().regex(SEMVER2).nullable(),
+    head: string2().min(1)
+  }),
+  security: boolean2(),
+  advisories: array(string2().regex(GHSA_ID, "expected a GHSA id"))
+});
+var OciManifestSchema = object({
+  artifactType: string2().optional(),
+  layers: array(object({ mediaType: string2(), digest: string2().regex(IMAGE_DIGEST) }))
+});
 // ../shared/src/responsive-images.ts
 var LADDER_REPLACEABLE_ORIG_FORMATS = new Set([
   "png",
@@ -8118,7 +8153,7 @@ var seoSetInputSchema = object({
 }).strict();
 var seoAutofillInputSchema = object({
   pageId: string2().uuid(),
-  metaDescription: string2().min(1).max(SEO_DESCRIPTION_HARD_MAX),
+  metaDescription: string2().trim().min(1).max(SEO_DESCRIPTION_HARD_MAX),
   ogImageAssetId: string2().uuid().nullable().optional()
 }).strict();
 var seoOptimizeInputSchema = object({
@@ -8184,7 +8219,7 @@ var revertPageInput = object({
 var STAGING_SESSION_TTL_SECONDS = 12 * 60 * 60;
 var ENCODER = new TextEncoder;
 // ../shared/src/static-cache-policy.ts
-var CONTENT_HASHED_PATH_PATTERN = "^/(?:_app/immutable/.+|_assets/fonts/[^/]+/[0-9a-f]{16,64}\\.(?:woff2|woff|ttf|otf)|_assets/[a-z0-9][a-z0-9-]*(?:/[a-z][a-z0-9-]*)?\\.[0-9a-f]{16}\\.[a-z0-9]{2,5}|_caelo/plugin/[^/]+/[^/]+\\.[0-9a-f]{12}\\.(?:js|css))$";
+var CONTENT_HASHED_PATH_PATTERN = "^/(?:_app/immutable/.+|_assets/fonts/[^/]+/[0-9a-f]{16}\\.woff2|_assets/fonts/pinned/[0-9a-f]{64}\\.[a-z]+(?:-[a-z]+)?\\.[0-9a-f]{12}\\.woff2|_assets/[a-z0-9][a-z0-9-]*(?:/[a-z][a-z0-9-]*)?\\.[0-9a-f]{16}\\.[a-z0-9]{2,5}|_caelo/plugin/[^/]+/[^/]+\\.[0-9a-f]{12}\\.(?:js|css))$";
 var CONTENT_HASHED_PATH_RE = new RegExp(CONTENT_HASHED_PATH_PATTERN);
 // ../shared/src/structured-sets.ts
 var navMenuItem = lazy(() => object({
@@ -18073,9 +18108,12 @@ var policySchema = object({
   windowEnd: string2().nullable(),
   windowTimezone: string2(),
   soakHours: number2(),
+  securitySoakHours: number2(),
   paused: boolean2(),
   pausedReason: string2().nullable(),
   pausedAt: string2().nullable(),
+  pausedUntil: string2().nullable(),
+  pausedByOwner: boolean2(),
   updatedAt: string2()
 });
 var claimOutput = object({
@@ -18084,6 +18122,7 @@ var claimOutput = object({
     id: string2(),
     targetVersion: string2(),
     trigger: _enum(PLATFORM_UPDATE_TRIGGERS),
+    autoBasis: _enum(AUTO_UPDATE_BASES).nullable(),
     policy: policySchema
   }).nullable()
 });
@@ -18127,7 +18166,7 @@ var jobClaimOp = defineOperation({
           LIMIT 1
           FOR UPDATE SKIP LOCKED
        )
-       RETURNING id::text AS id, target_version, trigger
+       RETURNING id::text AS id, target_version, trigger, auto_basis
     `);
     const row = claimed[0];
     if (!row)
@@ -18136,7 +18175,8 @@ var jobClaimOp = defineOperation({
       SELECT mode, auto_security, auto_patch, auto_minor, channel,
              to_char(window_start, 'HH24:MI') AS window_start,
              to_char(window_end, 'HH24:MI') AS window_end,
-             window_timezone, soak_hours, paused, paused_reason, paused_at, updated_at
+             window_timezone, soak_hours, security_soak_hours, paused, paused_reason,
+             paused_at, paused_until, paused_by IS NOT NULL AS paused_by_owner, updated_at
         FROM platform_update_policy WHERE id = 1
     `);
     const p = policies[0];
@@ -18149,6 +18189,7 @@ var jobClaimOp = defineOperation({
         id: row.id,
         targetVersion: row.target_version,
         trigger: row.trigger,
+        autoBasis: row.auto_basis,
         policy: {
           mode: p.mode,
           autoSecurity: p.auto_security,
@@ -18159,9 +18200,12 @@ var jobClaimOp = defineOperation({
           windowEnd: p.window_end,
           windowTimezone: p.window_timezone,
           soakHours: p.soak_hours,
+          securitySoakHours: p.security_soak_hours,
           paused: p.paused,
           pausedReason: p.paused_reason,
           pausedAt: p.paused_at === null ? null : new Date(p.paused_at).toISOString(),
+          pausedUntil: p.paused_until === null ? null : new Date(p.paused_until).toISOString(),
+          pausedByOwner: p.paused_by_owner,
           updatedAt: new Date(p.updated_at).toISOString()
         }
       }
@@ -18187,7 +18231,7 @@ var jobEventOp = defineOperation({
     return ok({});
   }
 });
-var digest = string2().regex(/^sha256:[0-9a-f]{64}$/);
+var digest2 = string2().regex(/^sha256:[0-9a-f]{64}$/);
 var jobRecordOp = defineOperation({
   name: "platform_updates.job_record",
   actorScope: ["system"],
@@ -18199,9 +18243,9 @@ var jobRecordOp = defineOperation({
       contractMigrations: boolean2().optional(),
       infraContractRequired: number2().int().optional(),
       infraContractInstalled: number2().int().optional(),
-      adminDigest: digest.optional(),
-      gatewayDigest: digest.optional(),
-      opsDigest: digest.optional(),
+      adminDigest: digest2.optional(),
+      gatewayDigest: digest2.optional(),
+      opsDigest: digest2.optional(),
       backupId: string2().min(1).max(200).optional()
     }).strict()
   }).strict(),

package/dist/caddy-redirects.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The container's shell script: Caddy in the foreground of the container's
+ * lifetime, reloaded when any file matching `snippetGlob` changes.
+ *
+ * @param snippetGlob Shell glob of the imported snippets, e.g.
+ *   `/srv/caelo/output/*\/current/_redirects.caddy`.
+ */
+export declare function caddyRedirectReloadScript(snippetGlob: string): string;
+/**
+ * A Compose `command:` line running {@link caddyRedirectReloadScript}. `$` is
+ * doubled because Compose interpolates `$VAR` in the file; the JSON string is
+ * a valid YAML double-quoted scalar.
+ */
+export declare function caddyRedirectReloadCommand(snippetGlob: string): string;
+//# sourceMappingURL=caddy-redirects.d.ts.map

package/dist/caddy-redirects.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"caddy-redirects.d.ts","sourceRoot":"","sources":["../src/caddy-redirects.ts"],"names":[],"mappings":"AA2BA;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAuBrE;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAGtE"}

package/dist/caddy-redirects.js

@@ -0,0 +1,65 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * How the self-hosted Caddy picks up a deploy's redirect snippet (#587).
+ *
+ * Each public site block imports `<site root>/_redirects.caddy`, which the
+ * static generator rewrites on every build. Caddy reads imports only when it
+ * loads a config, so something must reload it after a deploy. The container
+ * does that itself: its command runs Caddy plus a small loop that watches a
+ * checksum of the snippets and runs `caddy reload` (against Caddy's own
+ * localhost admin endpoint, inside the container) when they change.
+ *
+ * Why not the alternatives:
+ * - `caddy run --watch` stops watching for good after the first config that
+ *   fails to load — a snippet read while a deploy is still copying it would
+ *   freeze the redirects until Caddy restarts.
+ * - The admin reloading Caddy through the admin API would need a channel
+ *   from the admin into Caddy and would post a file's content over HTTP.
+ *
+ * The loop waits until the checksum is stable across two reads before
+ * reloading (a deploy may be mid-copy), and a reload Caddy rejects only
+ * logs: Caddy keeps the previous config, and the next change retries.
+ */
+/** Seconds between checksum polls. */
+const POLL_SECONDS = 2;
+/**
+ * The container's shell script: Caddy in the foreground of the container's
+ * lifetime, reloaded when any file matching `snippetGlob` changes.
+ *
+ * @param snippetGlob Shell glob of the imported snippets, e.g.
+ *   `/srv/caelo/output/*\/current/_redirects.caddy`.
+ */
+export function caddyRedirectReloadScript(snippetGlob) {
+    if (/[\s'"`$\\;&|<>]/.test(snippetGlob)) {
+        throw new Error(`caddy-redirects: unsafe snippet glob ${JSON.stringify(snippetGlob)}`);
+    }
+    const config = "--config /etc/caddy/Caddyfile --adapter caddyfile";
+    return [
+        `sum() { cat ${snippetGlob} 2>/dev/null | md5sum; }`,
+        "last=$(sum)",
+        `caddy run ${config} &`,
+        "pid=$!",
+        `trap 'kill -TERM "$pid" 2>/dev/null; wait "$pid"; exit $?' TERM INT`,
+        `while kill -0 "$pid" 2>/dev/null; do`,
+        `  sleep ${POLL_SECONDS}`,
+        "  now=$(sum)",
+        `  [ "$now" = "$last" ] && continue`,
+        // A deploy may still be copying the file: reload only a stable one.
+        "  sleep 1",
+        `  [ "$(sum)" = "$now" ] || continue`,
+        "  last=$now",
+        `  caddy reload ${config} || echo "caelo: redirects changed but Caddy rejected the reload; still serving the previous redirects" >&2`,
+        "done",
+        `wait "$pid"`,
+    ].join("\n");
+}
+/**
+ * A Compose `command:` line running {@link caddyRedirectReloadScript}. `$` is
+ * doubled because Compose interpolates `$VAR` in the file; the JSON string is
+ * a valid YAML double-quoted scalar.
+ */
+export function caddyRedirectReloadCommand(snippetGlob) {
+    const script = caddyRedirectReloadScript(snippetGlob).replaceAll("$", () => "$$");
+    return `command: ["/bin/sh", "-c", ${JSON.stringify(script)}]`;
+}
+//# sourceMappingURL=caddy-redirects.js.map

package/dist/caddy-redirects.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"caddy-redirects.js","sourceRoot":"","sources":["../src/caddy-redirects.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,sCAAsC;AACtC,MAAM,YAAY,GAAG,CAAC,CAAC;AAEvB;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,WAAmB;IAC3D,IAAI,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,MAAM,GAAG,mDAAmD,CAAC;IACnE,OAAO;QACL,eAAe,WAAW,0BAA0B;QACpD,aAAa;QACb,aAAa,MAAM,IAAI;QACvB,QAAQ;QACR,qEAAqE;QACrE,sCAAsC;QACtC,WAAW,YAAY,EAAE;QACzB,cAAc;QACd,oCAAoC;QACpC,oEAAoE;QACpE,WAAW;QACX,qCAAqC;QACrC,aAAa;QACb,kBAAkB,MAAM,6GAA6G;QACrI,MAAM;QACN,aAAa;KACd,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,WAAmB;IAC5D,MAAM,MAAM,GAAG,yBAAyB,CAAC,WAAW,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAClF,OAAO,8BAA8B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC;AACjE,CAAC"}

package/dist/caddy.d.ts

@@ -3,13 +3,33 @@ export interface CaddyDomainSpec {
     readonly kind: "admin" | "public";
     readonly env: "production" | "staging";
 }
+/**
+ * How Caddy gets certificates: `acme` — publicly trusted ones from Let's
+ * Encrypt / ZeroSSL (needs public DNS + ports 80/443 reachable); `internal`
+ * — Caddy's own local CA, for a LAN or evaluation install without public
+ * DNS (browsers warn until the CA root is trusted).
+ */
+export type CaddyTlsMode = "acme" | "internal";
 export interface CaddyfileSpec {
     readonly ownerEmail: string;
+    readonly tls: CaddyTlsMode;
     readonly publicSiteRoot: string;
     readonly stagingSiteRoot: string;
-    readonly adminPort: number;
-    readonly gatewayPort: number;
+    /** `host:port` of the admin as Caddy reaches it (Compose: `caelo-admin:5173`). */
+    readonly adminUpstream: string;
+    /** `host:port` of the API gateway as Caddy reaches it (Compose: `caelo-gateway:8090`). */
+    readonly gatewayUpstream: string;
     readonly domains: ReadonlyArray<CaddyDomainSpec>;
 }
+/** The host the admin of a self-hosted install answers on (same convention as GCP). */
+export declare function selfHostedAdminHost(domain: string): string;
+/**
+ * The vhosts every self-hosted install serves before an Owner adds domains
+ * in the admin: the admin on `admin.<domain>`, the live site on `<domain>`,
+ * the staging site on its own host. The admin needs its own host — it
+ * routes from `/` (`/setup`, `/login`, …), so it cannot share one with the
+ * public site, and Caddy refuses two site blocks for the same address.
+ */
+export declare function selfHostedSeedDomains(domain: string, stagingDomain: string): CaddyDomainSpec[];
 export declare function generateCaddyfile(spec: CaddyfileSpec): string;
 //# sourceMappingURL=caddy.d.ts.map

package/dist/caddy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"caddy.d.ts","sourceRoot":"","sources":["../src/caddy.ts"],"names":[],"mappings":"AAoCA,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAC;IAClC,QAAQ,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,CAAC;CACxC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;CAClD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAyB7D"}
+{"version":3,"file":"caddy.d.ts","sourceRoot":"","sources":["../src/caddy.ts"],"names":[],"mappings":"AA2DA,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAC;IAClC,QAAQ,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,CAAC;CACxC;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,UAAU,CAAC;AAE/C,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,kFAAkF;IAClF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,0FAA0F;IAC1F,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;CAClD;AAED,uFAAuF;AACvF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,eAAe,EAAE,CAM9F;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAqC7D"}

package/dist/caddy.js

@@ -4,18 +4,32 @@
  *
  * Reads the `domains` table + the deploy targets and emits a
  * deterministic Caddyfile string. The CLI's `regenerate-caddy`
- * sub-command writes this to `/etc/caddy/Caddyfile` and runs
+ * sub-command writes this to `.caelo/Caddyfile` and runs
  * `caddy reload`.
  *
  * Per-vhost shape:
  *   <hostname> {
- *     # admin   → reverse_proxy localhost:5173
- *     # public  → root + try_files (static), with /api/* → gateway
- *     tls <ownerEmail>
+ *     # admin   → reverse_proxy <adminUpstream>
+ *     # public  → /api/* → <gatewayUpstream>; everything else is the
+ *     #           static site (try_files + file_server, 404 → /404.html)
  *   }
  *
+ * Upstreams are `host:port` as seen FROM CADDY. In the Compose install
+ * Caddy runs in its own container, where `localhost` is Caddy itself, so
+ * the CLI passes the Compose service names (`caelo-admin:5173`,
+ * `caelo-gateway:8090`) — issue #707.
+ *
+ * Every directive here must be one Caddy accepts: the output is checked
+ * with `caddy validate` on the pinned Caddy image (caddy-validate.test.ts,
+ * run in CI) — issue #566 shipped a `try_files` nested inside
+ * `file_server { }`, which Caddy 2.11 refuses, so no vhost came up.
+ *
  * Staging vhosts force `X-Robots-Tag: noindex`.
  *
+ * Public vhosts import the redirect snippet of the build they serve
+ * (`_redirects.caddy`, #587); the Caddy container reloads itself when a
+ * deploy changes it (caddy-redirects.ts).
+ *
  * Public vhosts mark content-hashed build outputs (fonts, plugin
  * bundles — `CONTENT_HASHED_PATH_PATTERN` in @caelo-cms/shared)
  * `immutable` for a year. Everything else keeps Caddy's file_server
@@ -25,17 +39,49 @@
  * hashed URL (an old page requesting an asset the new build dropped)
  * is never cached for a year.
  *
+ * A path that matches no file is a real 404 serving the generator's
+ * `/404.html` — never the home page with a 200 (an SPA-style
+ * `/index.html` fallback would turn every dead URL into a soft 404).
+ * Same behaviour as the GCS / S3 / Blob adapters (CLAUDE.md §11.B).
+ *
  * `.ico` files (theme favicons) are served as `image/x-icon`, the one
  * icon MIME the media library stores and `<link rel="icon" type>`
  * declares. file_server only fills Content-Type when no earlier handler
  * set it, so the `header` line wins over the host's mime.types name.
  */
-import { CONTENT_HASHED_PATH_PATTERN, IMMUTABLE_CACHE_CONTROL } from "@caelo-cms/shared";
+import { CONTENT_HASHED_PATH_PATTERN, caddyRedirectsImport, IMMUTABLE_CACHE_CONTROL, } from "@caelo-cms/shared";
+/** The host the admin of a self-hosted install answers on (same convention as GCP). */
+export function selfHostedAdminHost(domain) {
+    return `admin.${domain}`;
+}
+/**
+ * The vhosts every self-hosted install serves before an Owner adds domains
+ * in the admin: the admin on `admin.<domain>`, the live site on `<domain>`,
+ * the staging site on its own host. The admin needs its own host — it
+ * routes from `/` (`/setup`, `/login`, …), so it cannot share one with the
+ * public site, and Caddy refuses two site blocks for the same address.
+ */
+export function selfHostedSeedDomains(domain, stagingDomain) {
+    return [
+        { hostname: selfHostedAdminHost(domain), kind: "admin", env: "production" },
+        { hostname: domain, kind: "public", env: "production" },
+        { hostname: stagingDomain, kind: "public", env: "staging" },
+    ];
+}
 export function generateCaddyfile(spec) {
+    const hostnames = new Set();
+    for (const d of spec.domains) {
+        if (hostnames.has(d.hostname)) {
+            // Caddy refuses a config with two site blocks for one address, so a
+            // duplicate would take every vhost down, not just this one.
+            throw new Error(`Caddyfile: ${d.hostname} is listed twice — one host serves either the admin or a public site, not both.`);
+        }
+        hostnames.add(d.hostname);
+    }
     const blocks = [];
     // Global options.
     blocks.push(`{
-  email ${spec.ownerEmail}
+  email ${spec.ownerEmail}${spec.tls === "internal" ? "\n  local_certs" : ""}
 }
 `);
     for (const d of spec.domains) {
@@ -47,7 +93,7 @@ export function generateCaddyfile(spec) {
         blocks.push(`# No domains configured yet — cms-provision regenerate-caddy
 # will overwrite this file when you add one at /settings/domains.
 :8081 {
-  reverse_proxy localhost:${spec.adminPort}
+  reverse_proxy ${spec.adminUpstream}
 }
 `);
     }
@@ -57,15 +103,18 @@ function vhost(d, spec) {
     const noindex = d.env === "staging" ? `\n  header X-Robots-Tag "noindex"` : "";
     if (d.kind === "admin") {
         return `${d.hostname} {${noindex}
-  reverse_proxy localhost:${spec.adminPort}
+  reverse_proxy ${spec.adminUpstream}
 }
 `;
     }
-    // public — API routes go to the gateway,
-    // the rest serves static files. Locale variants serve from a
+    // public — API routes go to the gateway, the rest is the static site.
+    // `try_files` is its own directive (a rewrite), never a file_server
+    // subdirective (#566).
     const root = d.env === "staging" ? spec.stagingSiteRoot : spec.publicSiteRoot;
+    // #587 — the redirects table of the build this vhost serves.
     return `${d.hostname} {${noindex}
   root * ${root}
+  ${caddyRedirectsImport(root)}
   @content_hashed {
     path_regexp content_hashed ${CONTENT_HASHED_PATH_PATTERN}
     file
@@ -74,15 +123,15 @@ function vhost(d, spec) {
   @ico path *.ico
   header @ico Content-Type "image/x-icon"
   handle /api/* {
-    reverse_proxy localhost:${spec.gatewayPort}
-  }
-  handle /admin/* {
-    reverse_proxy localhost:${spec.adminPort}
+    reverse_proxy ${spec.gatewayUpstream}
   }
   handle {
-    file_server {
-      try_files {path} {path}/index.html /index.html
-    }
+    try_files {path} {path}/index.html
+    file_server
+  }
+  handle_errors 404 {
+    rewrite * /404.html
+    file_server
   }
 }
 `;

package/dist/caddy.js.map

@@ -1 +1 @@
-{"version":3,"file":"caddy.js","sourceRoot":"","sources":["../src/caddy.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAiBzF,MAAM,UAAU,iBAAiB,CAAC,IAAmB;IACnD,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,kBAAkB;IAClB,MAAM,CAAC,IAAI,CAAC;UACJ,IAAI,CAAC,UAAU;;CAExB,CAAC,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9B,CAAC;IAED,oEAAoE;IACpE,8DAA8D;IAC9D,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC;;;4BAGY,IAAI,CAAC,SAAS;;CAEzC,CAAC,CAAC;IACD,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,KAAK,CAAC,CAAkB,EAAE,IAAmB;IACpD,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO;4BACR,IAAI,CAAC,SAAS;;CAEzC,CAAC;IACA,CAAC;IACD,yCAAyC;IACzC,6DAA6D;IAC7D,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IAC9E,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO;WACvB,IAAI;;iCAEkB,2BAA2B;;;0CAGlB,uBAAuB;;;;8BAInC,IAAI,CAAC,WAAW;;;8BAGhB,IAAI,CAAC,SAAS;;;;;;;;CAQ3C,CAAC;AACF,CAAC"}
+{"version":3,"file":"caddy.js","sourceRoot":"","sources":["../src/caddy.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,EACL,2BAA2B,EAC3B,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AA4B3B,uFAAuF;AACvF,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO,SAAS,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,aAAqB;IACzE,OAAO;QACL,EAAE,QAAQ,EAAE,mBAAmB,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE;QAC3E,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE;QACvD,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE;KAC5D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAmB;IACnD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,oEAAoE;YACpE,4DAA4D;YAC5D,MAAM,IAAI,KAAK,CACb,cAAc,CAAC,CAAC,QAAQ,iFAAiF,CAC1G,CAAC;QACJ,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,kBAAkB;IAClB,MAAM,CAAC,IAAI,CAAC;UACJ,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE;;CAE3E,CAAC,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9B,CAAC;IAED,oEAAoE;IACpE,8DAA8D;IAC9D,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC;;;kBAGE,IAAI,CAAC,aAAa;;CAEnC,CAAC,CAAC;IACD,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,KAAK,CAAC,CAAkB,EAAE,IAAmB;IACpD,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO;kBAClB,IAAI,CAAC,aAAa;;CAEnC,CAAC;IACA,CAAC;IACD,sEAAsE;IACtE,oEAAoE;IACpE,uBAAuB;IACvB,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IAC9E,6DAA6D;IAC7D,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO;WACvB,IAAI;IACX,oBAAoB,CAAC,IAAI,CAAC;;iCAEG,2BAA2B;;;0CAGlB,uBAAuB;;;;oBAI7C,IAAI,CAAC,eAAe;;;;;;;;;;;CAWvC,CAAC;AACF,CAAC"}

package/dist/cli-routing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-routing.d.ts","sourceRoot":"","sources":["../src/cli-routing.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AAEH,+CAA+C;AAC/C,MAAM,MAAM,QAAQ,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAElG;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,QAAQ,CAWjG;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE/D"}
+{"version":3,"file":"cli-routing.d.ts","sourceRoot":"","sources":["../src/cli-routing.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AAEH,+CAA+C;AAC/C,MAAM,MAAM,QAAQ,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAElG;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,QAAQ,CAkBjG;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE/D"}

package/dist/cli-routing.js

@@ -17,6 +17,13 @@ export function resolveCliRoute(argv, handlerNames) {
     if (argv.includes("--no-wizard") || argv.includes("--help") || argv.includes("-h")) {
         return { kind: "usage" };
     }
+    // #707 — `--provider self-hosted --domain … --owner-email …` is the
+    // self-hosted one-command install: `init` writes `.caelo/` and starts the
+    // stack. (The cloud wizard has nothing to provision for it.)
+    const provider = argv.indexOf("--provider");
+    if (provider !== -1 && argv[provider + 1] === "self-hosted") {
+        return { kind: "handler", name: "init" };
+    }
     return { kind: "wizard" };
 }
 /**

package/dist/cli-routing.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli-routing.js","sourceRoot":"","sources":["../src/cli-routing.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAenC;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAuB,EAAE,YAA8B;IACrF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/D,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACzC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,OAAO,QAAQ,KAAK,aAAa,CAAC;AACpC,CAAC"}
+{"version":3,"file":"cli-routing.js","sourceRoot":"","sources":["../src/cli-routing.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAenC;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAuB,EAAE,YAA8B;IACrF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/D,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACzC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,oEAAoE;IACpE,0EAA0E;IAC1E,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,QAAQ,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,KAAK,aAAa,EAAE,CAAC;QAC5D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,OAAO,QAAQ,KAAK,aAAa,CAAC;AACpC,CAAC"}