@caelo-cms/provisioning 0.10.48 → 0.10.50

package/dist/gcp-url-map.js

@@ -0,0 +1,62 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * The `gcp` stack's URL map, and who may write its redirect rules (#587).
+ *
+ * The admin writes the redirects table into the site host's path matcher
+ * as `urlRedirect` path rules on every Confirm-publish (admin-core
+ * deploy/gcp-url-map-redirects.ts). Those rules change at runtime, not with
+ * `pulumi up`, so the stack must not own them: the URL map ignores changes
+ * to the public path matcher's `pathRules` after creation. Otherwise a
+ * `pulumi refresh` + `up` would wipe every redirect until the next publish.
+ * The admin's writer keeps every non-redirect rule (`/api/*`) as it finds
+ * it.
+ *
+ * The admin's run SA gets a project custom role with only the permissions
+ * that read-modify-write needs (`URL_MAP_REDIRECTS_PERMISSIONS`, gcp-names.ts);
+ * the CLI creates it (url-map-redirects-access.ts), not the stack.
+ *
+ * Imported by the stack from `dist/`; keep it free of CLI dependencies.
+ */
+import { GCP_PUBLIC_BASE_PATHS } from "@caelo-cms/shared";
+import * as gcp from "@pulumi/gcp";
+/** Name of the site host's path matcher. */
+export const PUBLIC_PATH_MATCHER = "public";
+/**
+ * The URL map's `ignoreChanges`: the public path matcher (index 0, see
+ * {@link siteUrlMapArgs}) holds the admin-managed redirect rules.
+ */
+export const SITE_URL_MAP_IGNORE_CHANGES = ["pathMatchers[0].pathRules"];
+/**
+ * The URL map's arguments: the site host to the static bucket with `/api/*`
+ * to the gateway; the admin host to the IAP-gated admin. The public path
+ * matcher comes first — {@link SITE_URL_MAP_IGNORE_CHANGES} addresses it by
+ * index.
+ */
+export function siteUrlMapArgs(i) {
+    return {
+        defaultService: i.staticBackend,
+        hostRules: [
+            { hosts: [i.domain], pathMatcher: PUBLIC_PATH_MATCHER },
+            { hosts: [i.adminDomain], pathMatcher: "admin" },
+        ],
+        pathMatchers: [
+            {
+                name: PUBLIC_PATH_MATCHER,
+                defaultService: i.staticBackend,
+                pathRules: [{ paths: [...GCP_PUBLIC_BASE_PATHS], service: i.gatewayBackend }],
+            },
+            {
+                name: "admin",
+                defaultService: i.adminBackend,
+            },
+        ],
+    };
+}
+/** The stack's URL map (see the module comment for the ignored field). */
+export function createSiteUrlMap(name, inputs, opts) {
+    return new gcp.compute.URLMap(name, siteUrlMapArgs(inputs), {
+        ...opts,
+        ignoreChanges: [...(opts.ignoreChanges ?? []), ...SITE_URL_MAP_IGNORE_CHANGES],
+    });
+}
+//# sourceMappingURL=gcp-url-map.js.map

package/dist/gcp-url-map.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gcp-url-map.js","sourceRoot":"","sources":["../src/gcp-url-map.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AAGnC,4CAA4C;AAC5C,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAQ,CAAC;AAE5C;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsB,CAAC,2BAA2B,CAAC,CAAC;AAW5F;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,CAAmB;IAChD,OAAO;QACL,cAAc,EAAE,CAAC,CAAC,aAAa;QAC/B,SAAS,EAAE;YACT,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,mBAAmB,EAAE;YACvD,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE;SACjD;QACD,YAAY,EAAE;YACZ;gBACE,IAAI,EAAE,mBAAmB;gBACzB,cAAc,EAAE,CAAC,CAAC,aAAa;gBAC/B,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,qBAAqB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC;aAC9E;YACD;gBACE,IAAI,EAAE,OAAO;gBACb,cAAc,EAAE,CAAC,CAAC,YAAY;aAC/B;SACF;KACF,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,MAAwB,EACxB,IAAkC;IAElC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE;QAC1D,GAAG,IAAI;QACP,aAAa,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,EAAE,GAAG,2BAA2B,CAAC;KAC/E,CAAC,CAAC;AACL,CAAC"}

package/dist/index.d.ts

@@ -20,7 +20,6 @@ export { type CaddyDomainSpec, type CaddyfileSpec, generateCaddyfile, } from "./
 export { type CdnCopyAdapter, loadCdnCopyAdapter, selfHostedCdnCopy, } from "./cdn-copy.js";
 export { type ComposeSpec, generateDockerCompose, type RolePasswords } from "./compose.js";
 export { INFRA_CONTRACT_VERSION } from "./infra-contract.js";
-export { type CloudFrontRedirectArtifact, emitRedirectsAzureFrontDoor, emitRedirectsCloudFront, emitRedirectsCloudflare, type FrontDoorRule, type RedirectRow, type RedirectStatusCode, } from "./redirects-emit.js";
 export { INFRA_CONTRACT_PATHS, isInfraContractPath, RELEASE_MIN_FROM_VERSION, } from "./release-contract.js";
 export { assessAutoInstall, channelForVersion, compareImageDigests, compareSemver, type DigestMismatch, fetchVerifiedReleaseManifest, type InstallAssessment, type InstalledRelease, type InstallMode, RELEASE_CHANNELS, RELEASE_IMAGES, RELEASE_MANIFEST_ARTIFACT_TYPE, RELEASE_MANIFEST_MEDIA_TYPE, RELEASE_MANIFEST_REGISTRY, RELEASE_MANIFEST_REPOSITORY, RELEASE_OIDC_ISSUER, type ReleaseChannel, type ReleaseImage, type ReleaseManifest, type ReleaseManifestDeps, type ReleaseManifestError, type ReleaseManifestErrorCode, type ReleaseManifestResult, ReleaseManifestSchema, releaseManifestSignerIdentity, SIGSTORE_BUNDLE_MEDIA_TYPE, } from "./release-manifest.js";
 export { AGENT_DB_ROLE, roleConvergenceScript } from "./self-hosted-roles.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AAEH,YAAY,EACV,kBAAkB,EAClB,mBAAmB,EACnB,SAAS,EACT,WAAW,EACX,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,iBAAiB,EACjB,cAAc,EACd,UAAU,EACV,cAAc,EACd,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,KAAK,cAAc,EACnB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,KAAK,cAAc,EACnB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,KAAK,WAAW,EAAE,qBAAqB,EAAE,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EACL,KAAK,0BAA0B,EAC/B,2BAA2B,EAC3B,uBAAuB,EACvB,uBAAuB,EACvB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,kBAAkB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,KAAK,cAAc,EACnB,4BAA4B,EAC5B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,gBAAgB,EAChB,cAAc,EACd,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAC3B,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,qBAAqB,EACrB,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EACL,oBAAoB,EACpB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,eAAe,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,eAAe,EACf,KAAK,iBAAiB,EACtB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,aAAa,EAClB,cAAc,EACd,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AAEH,YAAY,EACV,kBAAkB,EAClB,mBAAmB,EACnB,SAAS,EACT,WAAW,EACX,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,iBAAiB,EACjB,cAAc,EACd,UAAU,EACV,cAAc,EACd,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,KAAK,cAAc,EACnB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,KAAK,cAAc,EACnB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,KAAK,WAAW,EAAE,qBAAqB,EAAE,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,KAAK,cAAc,EACnB,4BAA4B,EAC5B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,gBAAgB,EAChB,cAAc,EACd,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAC3B,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,qBAAqB,EACrB,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EACL,oBAAoB,EACpB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,eAAe,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,eAAe,EACf,KAAK,iBAAiB,EACtB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,aAAa,EAClB,cAAc,EACd,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/index.js

@@ -4,7 +4,6 @@ export { generateCaddyfile, } from "./caddy.js";
 export { loadCdnCopyAdapter, selfHostedCdnCopy, } from "./cdn-copy.js";
 export { generateDockerCompose } from "./compose.js";
 export { INFRA_CONTRACT_VERSION } from "./infra-contract.js";
-export { emitRedirectsAzureFrontDoor, emitRedirectsCloudFront, emitRedirectsCloudflare, } from "./redirects-emit.js";
 export { INFRA_CONTRACT_PATHS, isInfraContractPath, RELEASE_MIN_FROM_VERSION, } from "./release-contract.js";
 export { assessAutoInstall, channelForVersion, compareImageDigests, compareSemver, fetchVerifiedReleaseManifest, RELEASE_CHANNELS, RELEASE_IMAGES, RELEASE_MANIFEST_ARTIFACT_TYPE, RELEASE_MANIFEST_MEDIA_TYPE, RELEASE_MANIFEST_REGISTRY, RELEASE_MANIFEST_REPOSITORY, RELEASE_OIDC_ISSUER, ReleaseManifestSchema, releaseManifestSignerIdentity, SIGSTORE_BUNDLE_MEDIA_TYPE, } from "./release-manifest.js";
 export { AGENT_DB_ROLE, roleConvergenceScript } from "./self-hosted-roles.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAiCnC,OAAO,EAEL,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAGL,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAEL,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAoB,qBAAqB,EAAsB,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAEL,2BAA2B,EAC3B,uBAAuB,EACvB,uBAAuB,GAIxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EAEb,4BAA4B,EAI5B,gBAAgB,EAChB,cAAc,EACd,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAC3B,mBAAmB,EAQnB,qBAAqB,EACrB,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EACL,oBAAoB,GAIrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,eAAe,EAEf,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAEL,cAAc,GAOf,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAiCnC,OAAO,EAEL,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAGL,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAEL,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAoB,qBAAqB,EAAsB,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EAEb,4BAA4B,EAI5B,gBAAgB,EAChB,cAAc,EACd,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAC3B,mBAAmB,EAQnB,qBAAqB,EACrB,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EACL,oBAAoB,GAIrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,eAAe,EAEf,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAEL,cAAc,GAOf,MAAM,mBAAmB,CAAC"}

package/dist/infra-contract.d.ts

@@ -20,5 +20,24 @@
  * whose app-roll references infrastructure an install does not have yet fails
  * at roll time, after migrations ran.
  */
-export declare const INFRA_CONTRACT_VERSION = 2;
+export declare const INFRA_CONTRACT_VERSION = 4;
+/**
+ * What each contract version adds, in operator terms — the upgrader's
+ * refusal names the steps an install is missing. Keep one entry per version
+ * (the history above says why each bump happened).
+ */
+export declare const INFRA_CONTRACT_STEPS: Readonly<Record<number, string>>;
+/**
+ * The steps an install at contract `installed` lacks for `target`, oldest
+ * first. A release newer than this code can carry versions it does not know
+ * (the upgrader reads the NEW release's manifest); those are named by number.
+ *
+ * @example
+ *   pendingInfraSteps(2, 4)
+ *   // → ["public_role out of the Cloud SQL superuser group (#633)",
+ *   //    "the admin's permission to serve redirects from the load balancer (#587)"]
+ */
+export declare function pendingInfraSteps(installed: number, target: number): string[];
+/** {@link pendingInfraSteps} as one sentence fragment for messages. */
+export declare function infraStepsText(installed: number, target: number): string;
 //# sourceMappingURL=infra-contract.d.ts.map

package/dist/infra-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"infra-contract.d.ts","sourceRoot":"","sources":["../src/infra-contract.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,sBAAsB,IAAI,CAAC"}
+{"version":3,"file":"infra-contract.d.ts","sourceRoot":"","sources":["../src/infra-contract.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAexC;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAKjE,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAM7E;AAED,uEAAuE;AACvE,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAExE"}

package/dist/infra-contract.js

@@ -21,11 +21,49 @@
  * whose app-roll references infrastructure an install does not have yet fails
  * at roll time, after migrations ran.
  */
-export const INFRA_CONTRACT_VERSION = 2;
+export const INFRA_CONTRACT_VERSION = 4;
 // History (why each bump happened — an install below a number needs the
 // converge that introduced it):
 //   1 — epic #696 split: converge vs app-roll.
 //   2 — the upgrader job (#696 Phase 2): its service account + scoped
 //       grants, the Cloud SQL backup role, its IAM database user, the job,
 //       the admin's run-only grant and CAELO_UPGRADER_JOB on the admin.
+//   3 — public_role out of cloudsqlsuperuser (#633): the Admin API revoke
+//       runs as the operator; migration 0278's role audit refuses an install
+//       that has not had it, so the in-cloud upgrader must not get there
+//       first.
+//   4 — #587: on `gcp`, the admin's custom role for writing the redirects
+//       table into the URL map (url-map-redirects-access.ts).
+/**
+ * What each contract version adds, in operator terms — the upgrader's
+ * refusal names the steps an install is missing. Keep one entry per version
+ * (the history above says why each bump happened).
+ */
+export const INFRA_CONTRACT_STEPS = {
+    1: "the converge/app-roll split",
+    2: "the in-cloud upgrader job and its scoped permissions",
+    3: "public_role out of the Cloud SQL superuser group (#633)",
+    4: "the admin's permission to serve redirects from the load balancer (#587)",
+};
+/**
+ * The steps an install at contract `installed` lacks for `target`, oldest
+ * first. A release newer than this code can carry versions it does not know
+ * (the upgrader reads the NEW release's manifest); those are named by number.
+ *
+ * @example
+ *   pendingInfraSteps(2, 4)
+ *   // → ["public_role out of the Cloud SQL superuser group (#633)",
+ *   //    "the admin's permission to serve redirects from the load balancer (#587)"]
+ */
+export function pendingInfraSteps(installed, target) {
+    const steps = [];
+    for (let v = Math.max(installed, 0) + 1; v <= target; v += 1) {
+        steps.push(INFRA_CONTRACT_STEPS[v] ?? `infrastructure step ${v} (see that release's notes)`);
+    }
+    return steps;
+}
+/** {@link pendingInfraSteps} as one sentence fragment for messages. */
+export function infraStepsText(installed, target) {
+    return pendingInfraSteps(installed, target).join("; ");
+}
 //# sourceMappingURL=infra-contract.js.map

package/dist/infra-contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"infra-contract.js","sourceRoot":"","sources":["../src/infra-contract.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAExC,wEAAwE;AACxE,gCAAgC;AAChC,+CAA+C;AAC/C,sEAAsE;AACtE,2EAA2E;AAC3E,wEAAwE"}
+{"version":3,"file":"infra-contract.js","sourceRoot":"","sources":["../src/infra-contract.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAExC,wEAAwE;AACxE,gCAAgC;AAChC,+CAA+C;AAC/C,sEAAsE;AACtE,2EAA2E;AAC3E,wEAAwE;AACxE,0EAA0E;AAC1E,6EAA6E;AAC7E,yEAAyE;AACzE,eAAe;AACf,0EAA0E;AAC1E,8DAA8D;AAE9D;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAqC;IACpE,CAAC,EAAE,6BAA6B;IAChC,CAAC,EAAE,sDAAsD;IACzD,CAAC,EAAE,yDAAyD;IAC5D,CAAC,EAAE,yEAAyE;CAC7E,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,MAAc;IACjE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,uBAAuB,CAAC,6BAA6B,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,MAAc;IAC9D,OAAO,iBAAiB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzD,CAAC"}

package/dist/public-role-isolation.d.ts

@@ -0,0 +1,19 @@
+import { type GcloudRunner, type Sleep } from "./gcloud-retry.js";
+import type { EnsureOutcome } from "./runtime-secrets.js";
+/** The gcloud call that leaves `public_role` with no database roles. */
+export declare function revokePublicRoleMembershipsArgs(target: {
+    readonly projectId: string;
+    readonly sqlInstance: string;
+}): string[];
+/**
+ * Revoke every database role the Admin API gave `public_role`. Reports
+ * instead of throwing; `failed` names the next step.
+ */
+export declare function revokePublicRoleMemberships(install: {
+    readonly projectId: string;
+    readonly env: string;
+}, deps?: {
+    readonly run?: GcloudRunner;
+    readonly sleep?: Sleep;
+}): Promise<EnsureOutcome>;
+//# sourceMappingURL=public-role-isolation.d.ts.map

package/dist/public-role-isolation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-role-isolation.d.ts","sourceRoot":"","sources":["../src/public-role-isolation.ts"],"names":[],"mappings":"AAkCA,OAAO,EAAE,KAAK,YAAY,EAA2B,KAAK,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D,wEAAwE;AACxE,wBAAgB,+BAA+B,CAAC,MAAM,EAAE;IACtD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,GAAG,MAAM,EAAE,CAYX;AAED;;;GAGG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EAC7D,IAAI,GAAE;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAO,GACjE,OAAO,CAAC,aAAa,CAAC,CAoBxB"}

package/dist/public-role-isolation.js

@@ -0,0 +1,69 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * Take `public_role` out of `cloudsqlsuperuser` (issue #633, CLAUDE.md §2).
+ *
+ * The stacks declare `public_role` as a Cloud SQL Admin API user
+ * (`gcp.sql.User`), and Cloud SQL makes every such user a member of
+ * `cloudsqlsuperuser` — the group that owns cms_admin and cms_public. That
+ * gave the API gateway's visitor-facing login the owner group's rights.
+ *
+ * Why the Admin API and not SQL: on PostgreSQL 16+ a role membership can
+ * only be revoked by the role that granted it (or a superuser), and here
+ * that is Cloud SQL's own administrator, not `admin_role` — a `REVOKE` from
+ * the migration job would leave the membership in place with a warning.
+ * `users.update` with `revokeExistingRoles` runs as that administrator. It
+ * is also the one path that works the same for a fresh install and for the
+ * installs out there, with no change to the Pulumi resource (re-creating the
+ * user in SQL would mean deleting a user the stacks' state owns, with
+ * dependent grants in both databases, while the gateway serves on it).
+ *
+ * Revoking every role leaves `public_role` with none, which is exactly its
+ * contract: its rights are object grants in cms_public, nothing else.
+ *
+ * The CLI cannot reach the private-IP database to check the result, so the
+ * check runs where SQL runs: the migration job's role audit
+ * (packages/migrations/src/role-audit.ts), which fails the migration — and
+ * with it the install or upgrade, before any traffic moves — while
+ * `public_role` is still a member of any role. This step therefore runs
+ * BEFORE migrations, on every install pass and every `upgrade`. Idempotent:
+ * revoking from a role that has none changes nothing.
+ */
+import { findSqlInstance } from "./gateway-credentials.js";
+import { gcloud as defaultGcloud } from "./gcloud.js";
+import { realSleep, runWithRetry } from "./gcloud-retry.js";
+/** The gcloud call that leaves `public_role` with no database roles. */
+export function revokePublicRoleMembershipsArgs(target) {
+    return [
+        "sql",
+        "users",
+        "assign-roles",
+        "public_role",
+        `--instance=${target.sqlInstance}`,
+        "--type=BUILT_IN",
+        "--revoke-existing-roles",
+        `--project=${target.projectId}`,
+        "--quiet",
+    ];
+}
+/**
+ * Revoke every database role the Admin API gave `public_role`. Reports
+ * instead of throwing; `failed` names the next step.
+ */
+export async function revokePublicRoleMemberships(install, deps = {}) {
+    const run = deps.run ?? defaultGcloud;
+    const id = "public_role database role memberships";
+    const sqlInstance = await findSqlInstance(install, { run });
+    if (!sqlInstance) {
+        return { id, status: "failed", error: "the Cloud SQL instance was not found" };
+    }
+    const r = await runWithRetry(run, deps.sleep ?? realSleep, revokePublicRoleMembershipsArgs({ projectId: install.projectId, sqlInstance }));
+    if (!r.ok) {
+        return {
+            id,
+            status: "failed",
+            error: `gcloud sql users assign-roles public_role --revoke-existing-roles on ${sqlInstance}: ${r.stderr.trim()}. The account running this needs cloudsql.users.update on the project; re-run once it has.`,
+        };
+    }
+    return { id, status: "applied", detail: `no database roles left on ${sqlInstance}` };
+}
+//# sourceMappingURL=public-role-isolation.js.map

package/dist/public-role-isolation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-role-isolation.js","sourceRoot":"","sources":["../src/public-role-isolation.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAqB,SAAS,EAAE,YAAY,EAAc,MAAM,mBAAmB,CAAC;AAG3F,wEAAwE;AACxE,MAAM,UAAU,+BAA+B,CAAC,MAG/C;IACC,OAAO;QACL,KAAK;QACL,OAAO;QACP,cAAc;QACd,aAAa;QACb,cAAc,MAAM,CAAC,WAAW,EAAE;QAClC,iBAAiB;QACjB,yBAAyB;QACzB,aAAa,MAAM,CAAC,SAAS,EAAE;QAC/B,SAAS;KACV,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAA6D,EAC7D,OAAgE,EAAE;IAElE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,EAAE,GAAG,uCAAuC,CAAC;IACnD,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC;IACjF,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,YAAY,CAC1B,GAAG,EACH,IAAI,CAAC,KAAK,IAAI,SAAS,EACvB,+BAA+B,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,CAC/E,CAAC;IACF,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACV,OAAO;YACL,EAAE;YACF,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,wEAAwE,WAAW,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,4FAA4F;SAC3M,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,6BAA6B,WAAW,EAAE,EAAE,CAAC;AACvF,CAAC"}

package/dist/release-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"release-contract.d.ts","sourceRoot":"","sources":["../src/release-contract.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;GAaG;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,WAAW,CAAC;AAEjD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAajD,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGzD"}
+{"version":3,"file":"release-contract.d.ts","sourceRoot":"","sources":["../src/release-contract.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;GAaG;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,WAAW,CAAC;AAEjD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAgBjD,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGzD"}

package/dist/release-contract.js

@@ -40,6 +40,9 @@ export const INFRA_CONTRACT_PATHS = [
     "packages/provisioning/src/upgrade/converge.ts",
     "packages/provisioning/src/mcp-iap.ts",
     "packages/provisioning/src/default-firewall.ts",
+    // #587 — the admin's URL-map redirects role and the URL map's shape.
+    "packages/provisioning/src/url-map-redirects-access.ts",
+    "packages/provisioning/src/gcp-url-map.ts",
 ];
 /**
  * Whether a changed repo-relative path can alter the infrastructure

package/dist/release-contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"release-contract.js","sourceRoot":"","sources":["../src/release-contract.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;GAaG;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,QAAQ,CAAC;AAEjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,+BAA+B;IAC/B,6CAA6C;IAC7C,6CAA6C;IAC7C,8CAA8C;IAC9C,8CAA8C;IAC9C,wCAAwC;IACxC,yEAAyE;IACzE,oEAAoE;IACpE,mDAAmD;IACnD,+CAA+C;IAC/C,sCAAsC;IACtC,+CAA+C;CAChD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7E,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC"}
+{"version":3,"file":"release-contract.js","sourceRoot":"","sources":["../src/release-contract.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;GAaG;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,QAAQ,CAAC;AAEjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,+BAA+B;IAC/B,6CAA6C;IAC7C,6CAA6C;IAC7C,8CAA8C;IAC9C,8CAA8C;IAC9C,wCAAwC;IACxC,yEAAyE;IACzE,oEAAoE;IACpE,mDAAmD;IACnD,+CAA+C;IAC/C,sCAAsC;IACtC,+CAA+C;IAC/C,qEAAqE;IACrE,uDAAuD;IACvD,0CAA0C;CAC3C,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7E,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC"}

package/dist/release-manifest.d.ts

@@ -1,45 +1,6 @@
-import { z } from "zod";
+import { type ReleaseChannel, type ReleaseImage, type ReleaseManifest } from "@caelo-cms/shared";
 import { RELEASE_OIDC_ISSUER } from "./upgrade/release-images.js";
-/** Release channels. Pre-release versions name theirs (`0.11.0-rc.1` → `rc`). */
-export declare const RELEASE_CHANNELS: readonly ["stable", "rc", "beta", "alpha"];
-export type ReleaseChannel = (typeof RELEASE_CHANNELS)[number];
-/** The services a release ships images for. */
-export declare const RELEASE_IMAGES: readonly ["admin", "gateway", "ops"];
-export type ReleaseImage = (typeof RELEASE_IMAGES)[number];
-/** Zod schema of `release-manifest.json` (manifestVersion 1). */
-export declare const ReleaseManifestSchema: z.ZodObject<{
-    manifestVersion: z.ZodLiteral<1>;
-    version: z.ZodString;
-    channel: z.ZodEnum<{
-        beta: "beta";
-        stable: "stable";
-        rc: "rc";
-        alpha: "alpha";
-    }>;
-    digests: z.ZodObject<{
-        admin: z.ZodString;
-        gateway: z.ZodString;
-        ops: z.ZodString;
-    }, z.core.$strip>;
-    minFromVersion: z.ZodString;
-    infraContractVersion: z.ZodNumber;
-    migrations: z.ZodObject<{
-        contract: z.ZodBoolean;
-        lastContractVersion: z.ZodNullable<z.ZodString>;
-        head: z.ZodString;
-    }, z.core.$strip>;
-    security: z.ZodBoolean;
-    advisories: z.ZodArray<z.ZodString>;
-}, z.core.$strip>;
-export type ReleaseManifest = z.infer<typeof ReleaseManifestSchema>;
-/** Registry the upgrader reads manifests from — the public AR mirror Cloud Run pulls from. */
-export declare const RELEASE_MANIFEST_REGISTRY = "europe-west1-docker.pkg.dev";
-/** Repository path of the manifest artifact inside {@link RELEASE_MANIFEST_REGISTRY}. */
-export declare const RELEASE_MANIFEST_REPOSITORY = "caelo-website/caelo-cms-images/release-manifest";
-/** OCI artifact type + layer media types of the pushed manifest. */
-export declare const RELEASE_MANIFEST_ARTIFACT_TYPE = "application/vnd.caelo.release-manifest.v1";
-export declare const RELEASE_MANIFEST_MEDIA_TYPE = "application/vnd.caelo.release-manifest.v1+json";
-export declare const SIGSTORE_BUNDLE_MEDIA_TYPE = "application/vnd.dev.sigstore.bundle.v0.3+json";
+export { RELEASE_CHANNELS, RELEASE_IMAGES, RELEASE_MANIFEST_ARTIFACT_TYPE, RELEASE_MANIFEST_MEDIA_TYPE, RELEASE_MANIFEST_REGISTRY, RELEASE_MANIFEST_REPOSITORY, type ReleaseChannel, type ReleaseImage, type ReleaseManifest, ReleaseManifestSchema, SIGSTORE_BUNDLE_MEDIA_TYPE, } from "@caelo-cms/shared";
 export { RELEASE_OIDC_ISSUER };
 /**
  * The only identity allowed to sign the manifest of `version`: release.yml

package/dist/release-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"release-manifest.d.ts","sourceRoot":"","sources":["../src/release-manifest.ts"],"names":[],"mappings":"AA2BA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,mBAAmB,EAEpB,MAAM,6BAA6B,CAAC;AAErC,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,4CAA6C,CAAC;AAC3E,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAK/D,+CAA+C;AAC/C,eAAO,MAAM,cAAc,sCAAuC,CAAC;AACnE,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAI3D,iEAAiE;AACjE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;iBAuBhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,8FAA8F;AAC9F,eAAO,MAAM,yBAAyB,gCAAgC,CAAC;AACvE,yFAAyF;AACzF,eAAO,MAAM,2BAA2B,oDAAoD,CAAC;AAE7F,oEAAoE;AACpE,eAAO,MAAM,8BAA8B,8CAA8C,CAAC;AAC1F,eAAO,MAAM,2BAA2B,mDAAmD,CAAC;AAC5F,eAAO,MAAM,0BAA0B,kDAAkD,CAAC;AAG1F,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAE/B;;;;GAIG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAErE;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CA2B1D;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAMxE;AAED,mDAAmD;AACnD,MAAM,MAAM,wBAAwB,GAChC,UAAU,GACV,gBAAgB,GAChB,aAAa,GACb,WAAW,GACX,QAAQ,GACR,kBAAkB,CAAC;AAEvB,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAA;CAAE,GACzD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAEjE,kFAAkF;AAClF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvE,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5F,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAuDD;;;;;;;GAOG;AACH,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,mBAAiC,GACtC,OAAO,CAAC,qBAAqB,CAAC,CAoGhC;AAED,mEAAmE;AACnE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,GACrD,cAAc,EAAE,CAUlB;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;CACvC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;AAExD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,+FAA+F;IAC/F,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,eAAe,EACzB,SAAS,EAAE,gBAAgB,GAC1B,iBAAiB,CA4BnB"}
+{"version":3,"file":"release-manifest.d.ts","sourceRoot":"","sources":["../src/release-manifest.ts"],"names":[],"mappings":"AA0BA,OAAO,EAML,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,eAAe,EACrB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,mBAAmB,EAAyB,MAAM,6BAA6B,CAAC;AAKzF,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAC3B,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAE/B;;;;GAIG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAErE;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CA2B1D;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAMxE;AAED,mDAAmD;AACnD,MAAM,MAAM,wBAAwB,GAChC,UAAU,GACV,gBAAgB,GAChB,aAAa,GACb,WAAW,GACX,QAAQ,GACR,kBAAkB,CAAC;AAEvB,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAA;CAAE,GACzD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAEjE,kFAAkF;AAClF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvE,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5F,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAyBD;;;;;;;GAOG;AACH,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,mBAAiC,GACtC,OAAO,CAAC,qBAAqB,CAAC,CAmChC;AAED,mEAAmE;AACnE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,GACrD,cAAc,EAAE,CAUlB;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;CACvC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;AAExD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,+FAA+F;IAC/F,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,eAAe,EACzB,SAAS,EAAE,gBAAgB,GAC1B,iBAAiB,CA8BnB"}

package/dist/release-manifest.js

@@ -19,52 +19,17 @@
  * Errors are values: every failure carries a code plus a message that
  * says what to check next.
  */
-import { createHash } from "node:crypto";
 import { mkdtemp, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { z } from "zod";
-import { IMAGE_DIGEST, RELEASE_OIDC_ISSUER, RELEASE_WORKFLOWS_URL, } from "./upgrade/release-images.js";
-/** Release channels. Pre-release versions name theirs (`0.11.0-rc.1` → `rc`). */
-export const RELEASE_CHANNELS = ["stable", "rc", "beta", "alpha"];
+import { fetchReleaseArtifact, isSecurityRelease, parseReleaseManifest, RELEASE_CHANNELS, RELEASE_IMAGES, } from "@caelo-cms/shared";
+import { infraStepsText } from "./infra-contract.js";
+import { RELEASE_OIDC_ISSUER, RELEASE_WORKFLOWS_URL } from "./upgrade/release-images.js";
+// The manifest's shape and location live in @caelo-cms/shared (the admin's
+// auto-update scheduler reads them too); re-exported so this module stays
+// the CLI's one import for release manifests.
+export { RELEASE_CHANNELS, RELEASE_IMAGES, RELEASE_MANIFEST_ARTIFACT_TYPE, RELEASE_MANIFEST_MEDIA_TYPE, RELEASE_MANIFEST_REGISTRY, RELEASE_MANIFEST_REPOSITORY, ReleaseManifestSchema, SIGSTORE_BUNDLE_MEDIA_TYPE, } from "@caelo-cms/shared";
 const SEMVER = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/;
-const GHSA_ID = /^GHSA(-[23456789cfghjmpqrvwx]{4}){3}$/;
-/** The services a release ships images for. */
-export const RELEASE_IMAGES = ["admin", "gateway", "ops"];
-const digest = z.string().regex(IMAGE_DIGEST, "expected sha256:<64 hex>");
-/** Zod schema of `release-manifest.json` (manifestVersion 1). */
-export const ReleaseManifestSchema = z.object({
-    manifestVersion: z.literal(1),
-    version: z.string().regex(SEMVER, "expected a SemVer version without a leading v"),
-    channel: z.enum(RELEASE_CHANNELS),
-    digests: z.object({ admin: digest, gateway: digest, ops: digest }),
-    minFromVersion: z.string().regex(SEMVER),
-    infraContractVersion: z.number().int().positive(),
-    migrations: z.object({
-        /** True when the release carries destructive (contract) migrations. */
-        contract: z.boolean(),
-        /**
-         * Newest release up to and including this one that carried contract
-         * migrations (null: none known). An install below it that jumps
-         * straight here would run those destructive steps while its old image
-         * still serves — so it is manual too, even when `contract` is false.
-         */
-        lastContractVersion: z.string().regex(SEMVER).nullable(),
-        /** Newest cms_admin migration in the release, e.g. `0262_tool_approval_branch`. */
-        head: z.string().min(1),
-    }),
-    /** Set only via the release-cut input, backed by published GitHub Security Advisories. */
-    security: z.boolean(),
-    advisories: z.array(z.string().regex(GHSA_ID, "expected a GHSA id")),
-});
-/** Registry the upgrader reads manifests from — the public AR mirror Cloud Run pulls from. */
-export const RELEASE_MANIFEST_REGISTRY = "europe-west1-docker.pkg.dev";
-/** Repository path of the manifest artifact inside {@link RELEASE_MANIFEST_REGISTRY}. */
-export const RELEASE_MANIFEST_REPOSITORY = "caelo-website/caelo-cms-images/release-manifest";
-/** OCI artifact type + layer media types of the pushed manifest. */
-export const RELEASE_MANIFEST_ARTIFACT_TYPE = "application/vnd.caelo.release-manifest.v1";
-export const RELEASE_MANIFEST_MEDIA_TYPE = "application/vnd.caelo.release-manifest.v1+json";
-export const SIGSTORE_BUNDLE_MEDIA_TYPE = "application/vnd.dev.sigstore.bundle.v0.3+json";
 // The signer constants are shared with the image verification (one source).
 export { RELEASE_OIDC_ISSUER };
 /**
@@ -149,28 +114,9 @@ const defaultDeps = {
     fetch: (url, init) => fetch(url, init),
     cosign: runCosign,
 };
-const OciManifestSchema = z.object({
-    artifactType: z.string().optional(),
-    layers: z.array(z.object({ mediaType: z.string(), digest: z.string().regex(IMAGE_DIGEST) })),
-});
 function fail(code, message) {
     return { ok: false, error: { code, message } };
 }
-async function fetchBlob(deps, base, layer) {
-    const res = await deps.fetch(`${base}/blobs/${layer.digest}`);
-    if (!res.ok) {
-        return { code: "registry", message: `blob ${layer.digest}: HTTP ${res.status}` };
-    }
-    const bytes = new Uint8Array(await res.arrayBuffer());
-    const actual = `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
-    if (actual !== layer.digest) {
-        return {
-            code: "blob-digest",
-            message: `blob content does not match its digest (${layer.digest} expected, ${actual} served) — the registry or a proxy altered it`,
-        };
-    }
-    return bytes;
-}
 /**
  * Fetch the manifest of `version` from the fixed registry, verify its
  * Sigstore bundle against the release workflow identity for that exact
@@ -182,55 +128,16 @@ async function fetchBlob(deps, base, layer) {
 export async function fetchVerifiedReleaseManifest(version, deps = defaultDeps) {
     if (!SEMVER.test(version))
         return fail("schema", `"${version}" is not a SemVer version`);
-    const base = `https://${deps.registry ?? RELEASE_MANIFEST_REGISTRY}/v2/${deps.repository ?? RELEASE_MANIFEST_REPOSITORY}`;
-    let artifact;
-    try {
-        const res = await deps.fetch(`${base}/manifests/${version}`, {
-            headers: { Accept: "application/vnd.oci.image.manifest.v1+json" },
-        });
-        if (!res.ok) {
-            return fail("registry", `no release manifest for v${version} at ${base} (HTTP ${res.status}). Releases before the signed manifest (epic #696) have none; otherwise check the version exists.`);
-        }
-        const parsed = OciManifestSchema.safeParse(await res.json());
-        if (!parsed.success)
-            return fail("artifact-shape", `not an OCI manifest: ${parsed.error.message}`);
-        artifact = parsed.data;
-    }
-    catch (e) {
-        return fail("registry", `registry unreachable: ${e instanceof Error ? e.message : String(e)}`);
-    }
-    if (artifact.artifactType !== RELEASE_MANIFEST_ARTIFACT_TYPE) {
-        return fail("artifact-shape", `artifactType is ${artifact.artifactType ?? "(none)"}, expected ${RELEASE_MANIFEST_ARTIFACT_TYPE}`);
-    }
-    const manifestLayers = artifact.layers.filter((l) => l.mediaType === RELEASE_MANIFEST_MEDIA_TYPE);
-    const bundleLayers = artifact.layers.filter((l) => l.mediaType === SIGSTORE_BUNDLE_MEDIA_TYPE);
-    const [manifestLayer] = manifestLayers;
-    const [bundleLayer] = bundleLayers;
-    if (manifestLayers.length !== 1 || bundleLayers.length !== 1 || !manifestLayer || !bundleLayer) {
-        return fail("artifact-shape", "the artifact must hold exactly one release-manifest layer and one Sigstore bundle layer");
-    }
-    let manifestBytes;
-    let bundleBytes;
-    try {
-        const m = await fetchBlob(deps, base, manifestLayer);
-        if (!(m instanceof Uint8Array))
-            return { ok: false, error: m };
-        const b = await fetchBlob(deps, base, bundleLayer);
-        if (!(b instanceof Uint8Array))
-            return { ok: false, error: b };
-        manifestBytes = m;
-        bundleBytes = b;
-    }
-    catch (e) {
-        return fail("registry", `registry unreachable: ${e instanceof Error ? e.message : String(e)}`);
-    }
+    const artifact = await fetchReleaseArtifact(version, deps);
+    if (!artifact.ok)
+        return { ok: false, error: artifact.error };
     // cosign verifies files, so the exact bytes go to a private temp dir.
     const dir = await mkdtemp(join(tmpdir(), "caelo-release-manifest-"));
     try {
         const manifestPath = join(dir, "release-manifest.json");
         const bundlePath = join(dir, "release-manifest.json.sigstore.json");
-        await writeFile(manifestPath, manifestBytes, { mode: 0o600 });
-        await writeFile(bundlePath, bundleBytes, { mode: 0o600 });
+        await writeFile(manifestPath, artifact.manifestBytes, { mode: 0o600 });
+        await writeFile(bundlePath, artifact.bundleBytes, { mode: 0o600 });
         const verify = await deps.cosign([
             "verify-blob",
             "--bundle",
@@ -248,21 +155,10 @@ export async function fetchVerifiedReleaseManifest(version, deps = defaultDeps)
     finally {
         await rm(dir, { recursive: true, force: true });
     }
-    let json;
-    try {
-        json = JSON.parse(new TextDecoder().decode(manifestBytes));
-    }
-    catch {
-        return fail("schema", "the signed manifest is not valid JSON");
-    }
-    const parsed = ReleaseManifestSchema.safeParse(json);
-    if (!parsed.success) {
-        return fail("schema", `the signed manifest does not match manifestVersion 1 — this CLI may be too old to read it: ${parsed.error.message}`);
-    }
-    if (parsed.data.version !== version) {
-        return fail("version-mismatch", `asked for v${version} but the signed manifest describes v${parsed.data.version}`);
-    }
-    return { ok: true, manifest: parsed.data };
+    const parsed = parseReleaseManifest(artifact.manifestBytes, version);
+    if (!parsed.ok)
+        return fail(parsed.code, `signed manifest: ${parsed.message}`);
+    return { ok: true, manifest: parsed.manifest };
 }
 /**
  * Compare the digests a registry resolved for the release's tags with the
@@ -303,7 +199,7 @@ export function assessAutoInstall(manifest, installed) {
         return { mode: "refused", kind: "normal", reasons: refused };
     const manual = [];
     if (manifest.infraContractVersion > installed.infraContractVersion) {
-        manual.push(`the release changes the infrastructure contract (${installed.infraContractVersion} → ${manifest.infraContractVersion}); it must run with the operator's own identity`);
+        manual.push(`the release changes the infrastructure contract (${installed.infraContractVersion} → ${manifest.infraContractVersion}: ${infraStepsText(installed.infraContractVersion, manifest.infraContractVersion)}); it must run with the operator's own identity`);
     }
     const lastContract = manifest.migrations.lastContractVersion;
     if (manifest.migrations.contract) {
@@ -314,6 +210,8 @@ export function assessAutoInstall(manifest, installed) {
     }
     if (manual.length > 0)
         return { mode: "manual", kind: "normal", reasons: manual };
-    return { mode: "auto", kind: manifest.security ? "security" : "normal", reasons: [] };
+    // Security counts only with a published advisory behind it (#696
+    // decision 2); the release workflow already refuses the flag without one.
+    return { mode: "auto", kind: isSecurityRelease(manifest) ? "security" : "normal", reasons: [] };
 }
 //# sourceMappingURL=release-manifest.js.map

package/dist/release-manifest.js.map

@@ -1 +1 @@
-{"version":3,"file":"release-manifest.js","sourceRoot":"","sources":["../src/release-manifest.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,6BAA6B,CAAC;AAErC,iFAAiF;AACjF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAU,CAAC;AAG3E,MAAM,MAAM,GAAG,6CAA6C,CAAC;AAC7D,MAAM,OAAO,GAAG,uCAAuC,CAAC;AAExD,+CAA+C;AAC/C,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAU,CAAC;AAGnE,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,0BAA0B,CAAC,CAAC;AAE1E,iEAAiE;AACjE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,+CAA+C,CAAC;IAClF,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;IACjC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IAClE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;IACxC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACjD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,uEAAuE;QACvE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;QACrB;;;;;WAKG;QACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;QACxD,mFAAmF;QACnF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACxB,CAAC;IACF,0FAA0F;IAC1F,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;CACrE,CAAC,CAAC;AAGH,8FAA8F;AAC9F,MAAM,CAAC,MAAM,yBAAyB,GAAG,6BAA6B,CAAC;AACvE,yFAAyF;AACzF,MAAM,CAAC,MAAM,2BAA2B,GAAG,iDAAiD,CAAC;AAE7F,oEAAoE;AACpE,MAAM,CAAC,MAAM,8BAA8B,GAAG,2CAA2C,CAAC;AAC1F,MAAM,CAAC,MAAM,2BAA2B,GAAG,gDAAgD,CAAC;AAC5F,MAAM,CAAC,MAAM,0BAA0B,GAAG,+CAA+C,CAAC;AAE1F,4EAA4E;AAC5E,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAE/B;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAAe;IAC3D,OAAO,GAAG,qBAAqB,2BAA2B,OAAO,EAAE,CAAC;AACtE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,CAAS,EAAE,CAAS;IAChD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACvE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACjB,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACjB,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACxD,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC;QAC9B,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACtE,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACxC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B,OAAQ,gBAAsC,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAqB,CAAC,CAAC,CAAC,IAAI,CAAC;AACpG,CAAC;AA8BD,sEAAsE;AACtE,KAAK,UAAU,SAAS,CAAC,IAAuB;IAC9C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAClF,MAAM,MAAM,GAAG,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,QAAQ,EAAE,GAAG;YACb,MAAM,EAAE,gCAAgC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,sDAAsD;SACzI,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,WAAW,GAAwB;IACvC,KAAK,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC;IACtC,MAAM,EAAE,SAAS;CAClB,CAAC;AAOF,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;CAC7F,CAAC,CAAC;AAEH,SAAS,IAAI,CAAC,IAA8B,EAAE,OAAe;IAC3D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,IAAyB,EACzB,IAAY,EACZ,KAAoB;IAEpB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,UAAU,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9D,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,KAAK,CAAC,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;IACnF,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5E,IAAI,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QAC5B,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,2CAA2C,KAAK,CAAC,MAAM,cAAc,MAAM,+CAA+C;SACpI,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAe,EACf,OAA4B,WAAW;IAEvC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,IAAI,OAAO,2BAA2B,CAAC,CAAC;IACzF,MAAM,IAAI,GAAG,WAAW,IAAI,CAAC,QAAQ,IAAI,yBAAyB,OAAO,IAAI,CAAC,UAAU,IAAI,2BAA2B,EAAE,CAAC;IAE1H,IAAI,QAA2C,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,cAAc,OAAO,EAAE,EAAE;YAC3D,OAAO,EAAE,EAAE,MAAM,EAAE,4CAA4C,EAAE;SAClE,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,IAAI,CACT,UAAU,EACV,4BAA4B,OAAO,OAAO,IAAI,UAAU,GAAG,CAAC,MAAM,mGAAmG,CACtK,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,OAAO;YACjB,OAAO,IAAI,CAAC,gBAAgB,EAAE,wBAAwB,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAChF,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,IAAI,CAAC,UAAU,EAAE,yBAAyB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,IAAI,QAAQ,CAAC,YAAY,KAAK,8BAA8B,EAAE,CAAC;QAC7D,OAAO,IAAI,CACT,gBAAgB,EAChB,mBAAmB,QAAQ,CAAC,YAAY,IAAI,QAAQ,cAAc,8BAA8B,EAAE,CACnG,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,2BAA2B,CAAC,CAAC;IAClG,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,0BAA0B,CAAC,CAAC;IAC/F,MAAM,CAAC,aAAa,CAAC,GAAG,cAAc,CAAC;IACvC,MAAM,CAAC,WAAW,CAAC,GAAG,YAAY,CAAC;IACnC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/F,OAAO,IAAI,CACT,gBAAgB,EAChB,yFAAyF,CAC1F,CAAC;IACJ,CAAC;IAED,IAAI,aAAyB,CAAC;IAC9B,IAAI,WAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;QACrD,IAAI,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAC/D,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QACnD,IAAI,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAC/D,aAAa,GAAG,CAAC,CAAC;QAClB,WAAW,GAAG,CAAC,CAAC;IAClB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,IAAI,CAAC,UAAU,EAAE,yBAAyB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,sEAAsE;IACtE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,qCAAqC,CAAC,CAAC;QACpE,MAAM,SAAS,CAAC,YAAY,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,MAAM,SAAS,CAAC,UAAU,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC;YAC/B,aAAa;YACb,UAAU;YACV,UAAU;YACV,wBAAwB;YACxB,6BAA6B,CAAC,OAAO,CAAC;YACtC,2BAA2B;YAC3B,mBAAmB;YACnB,YAAY;SACb,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CACT,WAAW,EACX,oBAAoB,OAAO,qBAAqB,6BAA6B,CAAC,OAAO,CAAC,iCAAiC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC5J,CAAC;QACJ,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,QAAQ,EAAE,uCAAuC,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,IAAI,CACT,QAAQ,EACR,8FAA8F,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CACrH,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QACpC,OAAO,IAAI,CACT,kBAAkB,EAClB,cAAc,OAAO,uCAAuC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAClF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC7C,CAAC;AASD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAyB,EACzB,QAAsD;IAEtD,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,IAAI,CAAC,CAAC,KAAK,IAAI,QAAQ,CAAC;YAAE,SAAS;QACnC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;QACvC,IAAI,MAAM,KAAK,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAwBD;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAyB,EACzB,SAA2B;IAE3B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,aAAa,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,OAAO,qCAAqC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,aAAa,CAAC,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,OAAO,CAAC,IAAI,CACV,IAAI,QAAQ,CAAC,OAAO,oBAAoB,QAAQ,CAAC,cAAc,iCAAiC,SAAS,CAAC,OAAO,GAAG,CACrH,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAErF,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,QAAQ,CAAC,oBAAoB,GAAG,SAAS,CAAC,oBAAoB,EAAE,CAAC;QACnE,MAAM,CAAC,IAAI,CACT,oDAAoD,SAAS,CAAC,oBAAoB,MAAM,QAAQ,CAAC,oBAAoB,iDAAiD,CACvK,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,QAAQ,CAAC,UAAU,CAAC,mBAAmB,CAAC;IAC7D,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;IACvE,CAAC;SAAM,IAAI,YAAY,KAAK,IAAI,IAAI,aAAa,CAAC,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;QACvF,MAAM,CAAC,IAAI,CACT,sBAAsB,YAAY,8DAA8D,SAAS,CAAC,OAAO,uBAAuB,CACzI,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AACxF,CAAC"}
+{"version":3,"file":"release-manifest.js","sourceRoot":"","sources":["../src/release-manifest.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,GAIf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAEzF,2EAA2E;AAC3E,0EAA0E;AAC1E,8CAA8C;AAC9C,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAI3B,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,GAAG,6CAA6C,CAAC;AAE7D,4EAA4E;AAC5E,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAE/B;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAAe;IAC3D,OAAO,GAAG,qBAAqB,2BAA2B,OAAO,EAAE,CAAC;AACtE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,CAAS,EAAE,CAAS;IAChD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACvE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACjB,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACjB,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACxD,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC;QAC9B,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACtE,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACxC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B,OAAQ,gBAAsC,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAqB,CAAC,CAAC,CAAC,IAAI,CAAC;AACpG,CAAC;AA8BD,sEAAsE;AACtE,KAAK,UAAU,SAAS,CAAC,IAAuB;IAC9C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAClF,MAAM,MAAM,GAAG,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,QAAQ,EAAE,GAAG;YACb,MAAM,EAAE,gCAAgC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,sDAAsD;SACzI,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,WAAW,GAAwB;IACvC,KAAK,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC;IACtC,MAAM,EAAE,SAAS;CAClB,CAAC;AAEF,SAAS,IAAI,CAAC,IAA8B,EAAE,OAAe;IAC3D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAe,EACf,OAA4B,WAAW;IAEvC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,IAAI,OAAO,2BAA2B,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3D,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;IAE9D,sEAAsE;IACtE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,qCAAqC,CAAC,CAAC;QACpE,MAAM,SAAS,CAAC,YAAY,EAAE,QAAQ,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvE,MAAM,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC;YAC/B,aAAa;YACb,UAAU;YACV,UAAU;YACV,wBAAwB;YACxB,6BAA6B,CAAC,OAAO,CAAC;YACtC,2BAA2B;YAC3B,mBAAmB;YACnB,YAAY;SACb,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CACT,WAAW,EACX,oBAAoB,OAAO,qBAAqB,6BAA6B,CAAC,OAAO,CAAC,iCAAiC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC5J,CAAC;QACJ,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACrE,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,oBAAoB,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;AACjD,CAAC;AASD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAyB,EACzB,QAAsD;IAEtD,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,IAAI,CAAC,CAAC,KAAK,IAAI,QAAQ,CAAC;YAAE,SAAS;QACnC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;QACvC,IAAI,MAAM,KAAK,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAwBD;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAyB,EACzB,SAA2B;IAE3B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,aAAa,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,OAAO,qCAAqC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,aAAa,CAAC,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,OAAO,CAAC,IAAI,CACV,IAAI,QAAQ,CAAC,OAAO,oBAAoB,QAAQ,CAAC,cAAc,iCAAiC,SAAS,CAAC,OAAO,GAAG,CACrH,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAErF,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,QAAQ,CAAC,oBAAoB,GAAG,SAAS,CAAC,oBAAoB,EAAE,CAAC;QACnE,MAAM,CAAC,IAAI,CACT,oDAAoD,SAAS,CAAC,oBAAoB,MAAM,QAAQ,CAAC,oBAAoB,KAAK,cAAc,CAAC,SAAS,CAAC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,CAAC,iDAAiD,CACzP,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,QAAQ,CAAC,UAAU,CAAC,mBAAmB,CAAC;IAC7D,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;IACvE,CAAC;SAAM,IAAI,YAAY,KAAK,IAAI,IAAI,aAAa,CAAC,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;QACvF,MAAM,CAAC,IAAI,CACT,sBAAsB,YAAY,8DAA8D,SAAS,CAAC,OAAO,uBAAuB,CACzI,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClF,iEAAiE;IACjE,0EAA0E;IAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AAClG,CAAC"}