@caelo-cms/provisioning 0.10.49 → 0.10.51

package/dist/public-role-isolation.js

@@ -0,0 +1,69 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * Take `public_role` out of `cloudsqlsuperuser` (issue #633, CLAUDE.md §2).
+ *
+ * The stacks declare `public_role` as a Cloud SQL Admin API user
+ * (`gcp.sql.User`), and Cloud SQL makes every such user a member of
+ * `cloudsqlsuperuser` — the group that owns cms_admin and cms_public. That
+ * gave the API gateway's visitor-facing login the owner group's rights.
+ *
+ * Why the Admin API and not SQL: on PostgreSQL 16+ a role membership can
+ * only be revoked by the role that granted it (or a superuser), and here
+ * that is Cloud SQL's own administrator, not `admin_role` — a `REVOKE` from
+ * the migration job would leave the membership in place with a warning.
+ * `users.update` with `revokeExistingRoles` runs as that administrator. It
+ * is also the one path that works the same for a fresh install and for the
+ * installs out there, with no change to the Pulumi resource (re-creating the
+ * user in SQL would mean deleting a user the stacks' state owns, with
+ * dependent grants in both databases, while the gateway serves on it).
+ *
+ * Revoking every role leaves `public_role` with none, which is exactly its
+ * contract: its rights are object grants in cms_public, nothing else.
+ *
+ * The CLI cannot reach the private-IP database to check the result, so the
+ * check runs where SQL runs: the migration job's role audit
+ * (packages/migrations/src/role-audit.ts), which fails the migration — and
+ * with it the install or upgrade, before any traffic moves — while
+ * `public_role` is still a member of any role. This step therefore runs
+ * BEFORE migrations, on every install pass and every `upgrade`. Idempotent:
+ * revoking from a role that has none changes nothing.
+ */
+import { findSqlInstance } from "./gateway-credentials.js";
+import { gcloud as defaultGcloud } from "./gcloud.js";
+import { realSleep, runWithRetry } from "./gcloud-retry.js";
+/** The gcloud call that leaves `public_role` with no database roles. */
+export function revokePublicRoleMembershipsArgs(target) {
+    return [
+        "sql",
+        "users",
+        "assign-roles",
+        "public_role",
+        `--instance=${target.sqlInstance}`,
+        "--type=BUILT_IN",
+        "--revoke-existing-roles",
+        `--project=${target.projectId}`,
+        "--quiet",
+    ];
+}
+/**
+ * Revoke every database role the Admin API gave `public_role`. Reports
+ * instead of throwing; `failed` names the next step.
+ */
+export async function revokePublicRoleMemberships(install, deps = {}) {
+    const run = deps.run ?? defaultGcloud;
+    const id = "public_role database role memberships";
+    const sqlInstance = await findSqlInstance(install, { run });
+    if (!sqlInstance) {
+        return { id, status: "failed", error: "the Cloud SQL instance was not found" };
+    }
+    const r = await runWithRetry(run, deps.sleep ?? realSleep, revokePublicRoleMembershipsArgs({ projectId: install.projectId, sqlInstance }));
+    if (!r.ok) {
+        return {
+            id,
+            status: "failed",
+            error: `gcloud sql users assign-roles public_role --revoke-existing-roles on ${sqlInstance}: ${r.stderr.trim()}. The account running this needs cloudsql.users.update on the project; re-run once it has.`,
+        };
+    }
+    return { id, status: "applied", detail: `no database roles left on ${sqlInstance}` };
+}
+//# sourceMappingURL=public-role-isolation.js.map

package/dist/public-role-isolation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-role-isolation.js","sourceRoot":"","sources":["../src/public-role-isolation.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAqB,SAAS,EAAE,YAAY,EAAc,MAAM,mBAAmB,CAAC;AAG3F,wEAAwE;AACxE,MAAM,UAAU,+BAA+B,CAAC,MAG/C;IACC,OAAO;QACL,KAAK;QACL,OAAO;QACP,cAAc;QACd,aAAa;QACb,cAAc,MAAM,CAAC,WAAW,EAAE;QAClC,iBAAiB;QACjB,yBAAyB;QACzB,aAAa,MAAM,CAAC,SAAS,EAAE;QAC/B,SAAS;KACV,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAA6D,EAC7D,OAAgE,EAAE;IAElE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,EAAE,GAAG,uCAAuC,CAAC;IACnD,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC;IACjF,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,YAAY,CAC1B,GAAG,EACH,IAAI,CAAC,KAAK,IAAI,SAAS,EACvB,+BAA+B,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,CAC/E,CAAC;IACF,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACV,OAAO;YACL,EAAE;YACF,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,wEAAwE,WAAW,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,4FAA4F;SAC3M,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,6BAA6B,WAAW,EAAE,EAAE,CAAC;AACvF,CAAC"}

package/dist/release-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"release-contract.d.ts","sourceRoot":"","sources":["../src/release-contract.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;GAaG;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,WAAW,CAAC;AAEjD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAajD,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGzD"}
+{"version":3,"file":"release-contract.d.ts","sourceRoot":"","sources":["../src/release-contract.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;GAaG;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,WAAW,CAAC;AAEjD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAgBjD,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGzD"}

package/dist/release-contract.js

@@ -40,6 +40,9 @@ export const INFRA_CONTRACT_PATHS = [
     "packages/provisioning/src/upgrade/converge.ts",
     "packages/provisioning/src/mcp-iap.ts",
     "packages/provisioning/src/default-firewall.ts",
+    // #587 — the admin's URL-map redirects role and the URL map's shape.
+    "packages/provisioning/src/url-map-redirects-access.ts",
+    "packages/provisioning/src/gcp-url-map.ts",
 ];
 /**
  * Whether a changed repo-relative path can alter the infrastructure

package/dist/release-contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"release-contract.js","sourceRoot":"","sources":["../src/release-contract.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;GAaG;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,QAAQ,CAAC;AAEjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,+BAA+B;IAC/B,6CAA6C;IAC7C,6CAA6C;IAC7C,8CAA8C;IAC9C,8CAA8C;IAC9C,wCAAwC;IACxC,yEAAyE;IACzE,oEAAoE;IACpE,mDAAmD;IACnD,+CAA+C;IAC/C,sCAAsC;IACtC,+CAA+C;CAChD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7E,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC"}
+{"version":3,"file":"release-contract.js","sourceRoot":"","sources":["../src/release-contract.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;GAaG;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,QAAQ,CAAC;AAEjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,+BAA+B;IAC/B,6CAA6C;IAC7C,6CAA6C;IAC7C,8CAA8C;IAC9C,8CAA8C;IAC9C,wCAAwC;IACxC,yEAAyE;IACzE,oEAAoE;IACpE,mDAAmD;IACnD,+CAA+C;IAC/C,sCAAsC;IACtC,+CAA+C;IAC/C,qEAAqE;IACrE,uDAAuD;IACvD,0CAA0C;CAC3C,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7E,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC"}

package/dist/release-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"release-manifest.d.ts","sourceRoot":"","sources":["../src/release-manifest.ts"],"names":[],"mappings":"AA0BA,OAAO,EAML,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,eAAe,EACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAyB,MAAM,6BAA6B,CAAC;AAKzF,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAC3B,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAE/B;;;;GAIG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAErE;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CA2B1D;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAMxE;AAED,mDAAmD;AACnD,MAAM,MAAM,wBAAwB,GAChC,UAAU,GACV,gBAAgB,GAChB,aAAa,GACb,WAAW,GACX,QAAQ,GACR,kBAAkB,CAAC;AAEvB,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAA;CAAE,GACzD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAEjE,kFAAkF;AAClF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvE,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5F,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAyBD;;;;;;;GAOG;AACH,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,mBAAiC,GACtC,OAAO,CAAC,qBAAqB,CAAC,CAmChC;AAED,mEAAmE;AACnE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,GACrD,cAAc,EAAE,CAUlB;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;CACvC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;AAExD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,+FAA+F;IAC/F,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,eAAe,EACzB,SAAS,EAAE,gBAAgB,GAC1B,iBAAiB,CA8BnB"}
+{"version":3,"file":"release-manifest.d.ts","sourceRoot":"","sources":["../src/release-manifest.ts"],"names":[],"mappings":"AA0BA,OAAO,EAML,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,eAAe,EACrB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,mBAAmB,EAAyB,MAAM,6BAA6B,CAAC;AAKzF,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAC3B,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAE/B;;;;GAIG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAErE;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CA2B1D;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAMxE;AAED,mDAAmD;AACnD,MAAM,MAAM,wBAAwB,GAChC,UAAU,GACV,gBAAgB,GAChB,aAAa,GACb,WAAW,GACX,QAAQ,GACR,kBAAkB,CAAC;AAEvB,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAA;CAAE,GACzD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAEjE,kFAAkF;AAClF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvE,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5F,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAyBD;;;;;;;GAOG;AACH,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,mBAAiC,GACtC,OAAO,CAAC,qBAAqB,CAAC,CAmChC;AAED,mEAAmE;AACnE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,GACrD,cAAc,EAAE,CAUlB;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;CACvC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;AAExD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,+FAA+F;IAC/F,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,eAAe,EACzB,SAAS,EAAE,gBAAgB,GAC1B,iBAAiB,CA8BnB"}

package/dist/release-manifest.js

@@ -23,6 +23,7 @@ import { mkdtemp, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { fetchReleaseArtifact, isSecurityRelease, parseReleaseManifest, RELEASE_CHANNELS, RELEASE_IMAGES, } from "@caelo-cms/shared";
+import { infraStepsText } from "./infra-contract.js";
 import { RELEASE_OIDC_ISSUER, RELEASE_WORKFLOWS_URL } from "./upgrade/release-images.js";
 // The manifest's shape and location live in @caelo-cms/shared (the admin's
 // auto-update scheduler reads them too); re-exported so this module stays
@@ -198,7 +199,7 @@ export function assessAutoInstall(manifest, installed) {
         return { mode: "refused", kind: "normal", reasons: refused };
     const manual = [];
     if (manifest.infraContractVersion > installed.infraContractVersion) {
-        manual.push(`the release changes the infrastructure contract (${installed.infraContractVersion} → ${manifest.infraContractVersion}); it must run with the operator's own identity`);
+        manual.push(`the release changes the infrastructure contract (${installed.infraContractVersion} → ${manifest.infraContractVersion}: ${infraStepsText(installed.infraContractVersion, manifest.infraContractVersion)}); it must run with the operator's own identity`);
     }
     const lastContract = manifest.migrations.lastContractVersion;
     if (manifest.migrations.contract) {

package/dist/release-manifest.js.map

@@ -1 +1 @@
-{"version":3,"file":"release-manifest.js","sourceRoot":"","sources":["../src/release-manifest.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,GAIf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAEzF,2EAA2E;AAC3E,0EAA0E;AAC1E,8CAA8C;AAC9C,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAI3B,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,GAAG,6CAA6C,CAAC;AAE7D,4EAA4E;AAC5E,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAE/B;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAAe;IAC3D,OAAO,GAAG,qBAAqB,2BAA2B,OAAO,EAAE,CAAC;AACtE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,CAAS,EAAE,CAAS;IAChD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACvE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACjB,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACjB,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACxD,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC;QAC9B,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACtE,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACxC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B,OAAQ,gBAAsC,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAqB,CAAC,CAAC,CAAC,IAAI,CAAC;AACpG,CAAC;AA8BD,sEAAsE;AACtE,KAAK,UAAU,SAAS,CAAC,IAAuB;IAC9C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAClF,MAAM,MAAM,GAAG,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,QAAQ,EAAE,GAAG;YACb,MAAM,EAAE,gCAAgC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,sDAAsD;SACzI,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,WAAW,GAAwB;IACvC,KAAK,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC;IACtC,MAAM,EAAE,SAAS;CAClB,CAAC;AAEF,SAAS,IAAI,CAAC,IAA8B,EAAE,OAAe;IAC3D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAe,EACf,OAA4B,WAAW;IAEvC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,IAAI,OAAO,2BAA2B,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3D,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;IAE9D,sEAAsE;IACtE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,qCAAqC,CAAC,CAAC;QACpE,MAAM,SAAS,CAAC,YAAY,EAAE,QAAQ,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvE,MAAM,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC;YAC/B,aAAa;YACb,UAAU;YACV,UAAU;YACV,wBAAwB;YACxB,6BAA6B,CAAC,OAAO,CAAC;YACtC,2BAA2B;YAC3B,mBAAmB;YACnB,YAAY;SACb,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CACT,WAAW,EACX,oBAAoB,OAAO,qBAAqB,6BAA6B,CAAC,OAAO,CAAC,iCAAiC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC5J,CAAC;QACJ,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACrE,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,oBAAoB,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;AACjD,CAAC;AASD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAyB,EACzB,QAAsD;IAEtD,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,IAAI,CAAC,CAAC,KAAK,IAAI,QAAQ,CAAC;YAAE,SAAS;QACnC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;QACvC,IAAI,MAAM,KAAK,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAwBD;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAyB,EACzB,SAA2B;IAE3B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,aAAa,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,OAAO,qCAAqC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,aAAa,CAAC,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,OAAO,CAAC,IAAI,CACV,IAAI,QAAQ,CAAC,OAAO,oBAAoB,QAAQ,CAAC,cAAc,iCAAiC,SAAS,CAAC,OAAO,GAAG,CACrH,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAErF,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,QAAQ,CAAC,oBAAoB,GAAG,SAAS,CAAC,oBAAoB,EAAE,CAAC;QACnE,MAAM,CAAC,IAAI,CACT,oDAAoD,SAAS,CAAC,oBAAoB,MAAM,QAAQ,CAAC,oBAAoB,iDAAiD,CACvK,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,QAAQ,CAAC,UAAU,CAAC,mBAAmB,CAAC;IAC7D,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;IACvE,CAAC;SAAM,IAAI,YAAY,KAAK,IAAI,IAAI,aAAa,CAAC,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;QACvF,MAAM,CAAC,IAAI,CACT,sBAAsB,YAAY,8DAA8D,SAAS,CAAC,OAAO,uBAAuB,CACzI,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClF,iEAAiE;IACjE,0EAA0E;IAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AAClG,CAAC"}
+{"version":3,"file":"release-manifest.js","sourceRoot":"","sources":["../src/release-manifest.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,GAIf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAEzF,2EAA2E;AAC3E,0EAA0E;AAC1E,8CAA8C;AAC9C,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAI3B,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,GAAG,6CAA6C,CAAC;AAE7D,4EAA4E;AAC5E,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAE/B;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAAe;IAC3D,OAAO,GAAG,qBAAqB,2BAA2B,OAAO,EAAE,CAAC;AACtE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,CAAS,EAAE,CAAS;IAChD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACvE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACjB,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACjB,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACxD,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC;QAC9B,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACtE,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACxC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B,OAAQ,gBAAsC,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAqB,CAAC,CAAC,CAAC,IAAI,CAAC;AACpG,CAAC;AA8BD,sEAAsE;AACtE,KAAK,UAAU,SAAS,CAAC,IAAuB;IAC9C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAClF,MAAM,MAAM,GAAG,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,QAAQ,EAAE,GAAG;YACb,MAAM,EAAE,gCAAgC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,sDAAsD;SACzI,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,WAAW,GAAwB;IACvC,KAAK,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC;IACtC,MAAM,EAAE,SAAS;CAClB,CAAC;AAEF,SAAS,IAAI,CAAC,IAA8B,EAAE,OAAe;IAC3D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAe,EACf,OAA4B,WAAW;IAEvC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,IAAI,OAAO,2BAA2B,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3D,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;IAE9D,sEAAsE;IACtE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,qCAAqC,CAAC,CAAC;QACpE,MAAM,SAAS,CAAC,YAAY,EAAE,QAAQ,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvE,MAAM,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC;YAC/B,aAAa;YACb,UAAU;YACV,UAAU;YACV,wBAAwB;YACxB,6BAA6B,CAAC,OAAO,CAAC;YACtC,2BAA2B;YAC3B,mBAAmB;YACnB,YAAY;SACb,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CACT,WAAW,EACX,oBAAoB,OAAO,qBAAqB,6BAA6B,CAAC,OAAO,CAAC,iCAAiC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC5J,CAAC;QACJ,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACrE,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,oBAAoB,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;AACjD,CAAC;AASD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAyB,EACzB,QAAsD;IAEtD,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,IAAI,CAAC,CAAC,KAAK,IAAI,QAAQ,CAAC;YAAE,SAAS;QACnC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;QACvC,IAAI,MAAM,KAAK,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAwBD;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAyB,EACzB,SAA2B;IAE3B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,aAAa,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,OAAO,qCAAqC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,aAAa,CAAC,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,OAAO,CAAC,IAAI,CACV,IAAI,QAAQ,CAAC,OAAO,oBAAoB,QAAQ,CAAC,cAAc,iCAAiC,SAAS,CAAC,OAAO,GAAG,CACrH,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAErF,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,QAAQ,CAAC,oBAAoB,GAAG,SAAS,CAAC,oBAAoB,EAAE,CAAC;QACnE,MAAM,CAAC,IAAI,CACT,oDAAoD,SAAS,CAAC,oBAAoB,MAAM,QAAQ,CAAC,oBAAoB,KAAK,cAAc,CAAC,SAAS,CAAC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,CAAC,iDAAiD,CACzP,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,QAAQ,CAAC,UAAU,CAAC,mBAAmB,CAAC;IAC7D,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;IACvE,CAAC;SAAM,IAAI,YAAY,KAAK,IAAI,IAAI,aAAa,CAAC,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;QACvF,MAAM,CAAC,IAAI,CACT,sBAAsB,YAAY,8DAA8D,SAAS,CAAC,OAAO,uBAAuB,CACzI,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClF,iEAAiE;IACjE,0EAA0E;IAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AAClG,CAAC"}

package/dist/self-hosted-backup.d.ts

@@ -0,0 +1,86 @@
+import type { HostRunner } from "./self-hosted-release.js";
+import type { ConvergeOutcome } from "./self-hosted-roles.js";
+/** The archive layout's version; a restore refuses any other. */
+export declare const BACKUP_FORMAT = 1;
+export interface BackupManifest {
+    readonly format: number;
+    readonly caeloVersion: string;
+    readonly createdAt: string;
+}
+export interface BackupDeps {
+    readonly caeloDir: string;
+    readonly runner: HostRunner;
+    readonly log: (message: string) => void;
+    readonly now?: () => Date;
+    readonly healthAttempts?: number;
+    readonly healthIntervalMs?: number;
+    readonly sleep?: (ms: number) => Promise<void>;
+}
+export type BackupResult = {
+    ok: true;
+    path: string;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * Write a backup archive of the install to `to` (mode 600). Postgres must
+ * be running. The admin and the gateway are stopped while it runs and
+ * started (and health-checked) again afterwards, whatever the outcome.
+ */
+export declare function backupSelfHosted(to: string, caeloVersion: string, deps: BackupDeps): Promise<BackupResult>;
+export interface RestoreDeps extends BackupDeps {
+    /** Brings roles, databases and grants in line with config.json (self-hosted-roles.ts). */
+    readonly convergeRoles: () => Promise<ConvergeOutcome>;
+    /**
+     * Re-renders the Caddyfile from the (restored) domains table and reloads
+     * Caddy, so the served hosts match the restored database.
+     */
+    readonly refreshCaddy: () => Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        error: string;
+    }>;
+}
+export type RestoreResult = {
+    ok: true;
+    manifest: BackupManifest;
+} | {
+    ok: false;
+    error: string;
+    installChanged: boolean;
+};
+/** Replace the install's databases and content files with the backup at `from`. */
+export declare function restoreSelfHosted(from: string, deps: RestoreDeps): Promise<RestoreResult>;
+/** Whether an unpacked archive has every part a restore needs, in a format this CLI reads. */
+export declare function checkArchive(dir: string): {
+    ok: true;
+    manifest: BackupManifest;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * Whether the .tar.gz at `path` holds only the members a backup writes, as
+ * plain files and directories — checked before `tar -x` writes anything.
+ */
+export declare function checkArchiveMembers(path: string): {
+    ok: true;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * Whether files.tar only writes below the site and media directories:
+ * relative paths without `..`, files / directories / relative symlinks
+ * inside the tree, and no member below a symlink (which would write
+ * wherever the link points).
+ */
+export declare function checkFilesTar(path: string): {
+    ok: true;
+} | {
+    ok: false;
+    error: string;
+};
+//# sourceMappingURL=self-hosted-backup.d.ts.map

package/dist/self-hosted-backup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-hosted-backup.d.ts","sourceRoot":"","sources":["../src/self-hosted-backup.ts"],"names":[],"mappings":"AAyDA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAU9D,iEAAiE;AACjE,eAAO,MAAM,aAAa,IAAI,CAAC;AAS/B,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED,MAAM,MAAM,YAAY,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAErF;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,MAAM,EACV,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,YAAY,CAAC,CAiCvB;AA6ED,MAAM,WAAW,WAAY,SAAQ,UAAU;IAC7C,0FAA0F;IAC1F,QAAQ,CAAC,aAAa,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,CAAC;IACvD;;;OAGG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACnF;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,cAAc,CAAA;CAAE,GACtC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,OAAO,CAAA;CAAE,CAAC;AAE1D,mFAAmF;AACnF,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,CAoH/F;AAED,8FAA8F;AAC9F,wBAAgB,YAAY,CAC1B,GAAG,EAAE,MAAM,GACV;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,cAAc,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CA2BvE;AAWD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CA0B7F;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CA6BvF"}

package/dist/self-hosted-backup.js

@@ -0,0 +1,350 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * `cms-provision backup` / `restore` for a self-hosted Compose install
+ * (issue #707).
+ *
+ * A backup is one `.tar.gz` holding everything an install's content lives
+ * in:
+ *   manifest.json        format version, Caelo version, timestamp
+ *   db/cms_admin.dump    pg_dump -Fc (the same dumps `upgrade` takes)
+ *   db/cms_public.dump
+ *   db/globals.sql       the cluster's roles — reference only, see restore
+ *   files.tar            the published site (`/srv/caelo`) and the uploaded
+ *                        media (`/data/media`), read through the admin's
+ *                        own mounts
+ * Secrets (`.caelo/config.json`, incl. the KEK that decrypts stored
+ * provider keys) are NOT in the archive: it may be copied off-host, and a
+ * restore targets the install whose config is already there.
+ *
+ * pg_dump rather than pgBackRest: the old sidecar never had access to the
+ * data volume and no stanza was ever created, so it could not back up
+ * anything. WAL streaming / point-in-time recovery (CMS_REQUIREMENTS §13.2)
+ * needs pgBackRest inside the Postgres image and is tracked separately.
+ *
+ * Files go through a one-off admin container (`docker compose run`), not
+ * the host: the admin writes them as root, which the operator's user may
+ * not be able to replace.
+ *
+ * Backup stops the admin and the gateway for its duration (a short outage):
+ * the two databases and the files are separate steps, and a write between
+ * them would give an archive whose parts do not match each other.
+ *
+ * Restore order: list + check the archive and its files.tar WITHOUT
+ * extracting (only the expected members, relative paths, no member below a
+ * symlink — nothing on the install changes otherwise) → stop the Caelo
+ * services → drop + re-create both databases with the role convergence
+ * (roles, passwords and grants come from config.json, never from the
+ * archive, so a restore cannot reset the superuser's password) →
+ * pg_restore → converge again (re-applies the gateway grants the restored
+ * functions define) → migrate with the install's admin image (a backup of
+ * an older release has its older schema) → replace the files → start
+ * everything and health-check it → re-render + reload the Caddyfile from
+ * the restored domains table.
+ */
+import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { basename, join } from "node:path";
+import { gunzipSync } from "node:zlib";
+import { COMPOSE_APP_SERVICES, MEDIA_ROOT, SITE_OUTPUT_ROOT } from "./compose.js";
+import { compose, DATABASE_DUMPS, dumpDatabases, runMigrations, waitHealthy, } from "./self-hosted-upgrade.js";
+import { escapesRoot, listTarEntries, normalizeMemberName } from "./tar-entries.js";
+/** The archive layout's version; a restore refuses any other. */
+export const BACKUP_FORMAT = 1;
+const MANIFEST = "manifest.json";
+const DB_DIR = "db";
+const FILES_TAR = "files.tar";
+/** The content directories inside the admin container, as `tar -C /` paths. */
+const CONTENT_PATHS = [SITE_OUTPUT_ROOT, MEDIA_ROOT].map((p) => p.replace(/^\//, ""));
+/**
+ * Write a backup archive of the install to `to` (mode 600). Postgres must
+ * be running. The admin and the gateway are stopped while it runs and
+ * started (and health-checked) again afterwards, whatever the outcome.
+ */
+export async function backupSelfHosted(to, caeloVersion, deps) {
+    const { caeloDir, runner, log } = deps;
+    const at = (deps.now ?? (() => new Date()))();
+    const ready = await runner.run(compose(caeloDir, "exec", "-T", "postgres", "pg_isready", "-U", "caelo"));
+    if (ready.exitCode !== 0) {
+        return {
+            ok: false,
+            error: `Postgres is not running, so nothing was backed up. Start it with \`docker compose -f ${caeloDir}/docker-compose.yml up -d postgres\` and re-run.`,
+        };
+    }
+    log("Stopping the admin and the gateway for a consistent snapshot …");
+    const stop = await runner.run(compose(caeloDir, "stop", ...COMPOSE_APP_SERVICES));
+    if (stop.exitCode !== 0) {
+        return { ok: false, error: `Could not stop the Caelo services: ${tail(stop.stderr)}` };
+    }
+    const work = workDir(caeloDir, "backup", at);
+    let result;
+    try {
+        result = await writeArchive(to, caeloVersion, work, deps);
+    }
+    finally {
+        rmSync(work, { recursive: true, force: true });
+    }
+    log("Starting the admin and the gateway again …");
+    const started = await startAppServices(deps);
+    if (!started.ok) {
+        return {
+            ok: false,
+            error: `${result.ok ? `The backup was written to ${result.path}, but` : `${result.error}\nAlso,`} the services did not come back: ${started.error}`,
+        };
+    }
+    return result;
+}
+/** The dumps, files.tar and manifest into `work`, then one .tar.gz at `to`. */
+async function writeArchive(to, caeloVersion, work, deps) {
+    const { caeloDir, runner, log } = deps;
+    log("Dumping the databases (pg_dump) …");
+    const dumped = await dumpDatabases(caeloDir, runner, join(work, DB_DIR));
+    if (!dumped.ok)
+        return { ok: false, error: dumped.error };
+    log("Archiving the published site and the uploaded media …");
+    const files = await runner.run(compose(caeloDir, "run", "--rm", "--no-deps", "-T", "--entrypoint", "tar", "caelo-admin", "-C", "/", "-cf", "-", ...CONTENT_PATHS), { stdoutPath: join(work, FILES_TAR) });
+    if (files.exitCode !== 0) {
+        return { ok: false, error: `Could not archive the site + media files: ${tail(files.stderr)}` };
+    }
+    const manifest = {
+        format: BACKUP_FORMAT,
+        caeloVersion,
+        createdAt: (deps.now ?? (() => new Date()))().toISOString(),
+    };
+    writeFileSync(join(work, MANIFEST), `${JSON.stringify(manifest, null, 2)}\n`, { mode: 0o600 });
+    log(`Writing ${to} …`);
+    // COPYFILE_DISABLE: macOS's bsdtar would add `._*` AppleDouble members
+    // for extended attributes, which a restore refuses as unexpected.
+    const tar = await runner.run(["tar", "-czf", to, "-C", work, "."], {
+        env: { COPYFILE_DISABLE: "1" },
+    });
+    if (tar.exitCode !== 0) {
+        return { ok: false, error: `Could not write ${to}: ${tail(tar.stderr)}` };
+    }
+    chmodSync(to, 0o600);
+    return { ok: true, path: to };
+}
+/** `up -d` the admin + gateway, then health-check both. */
+async function startAppServices(deps) {
+    const { caeloDir, runner } = deps;
+    const up = await runner.run(compose(caeloDir, "up", "-d", ...COMPOSE_APP_SERVICES));
+    if (up.exitCode !== 0)
+        return { ok: false, error: `docker compose up failed: ${tail(up.stderr)}` };
+    for (const service of ["admin", "gateway"]) {
+        const healthy = await waitHealthy(service, caeloDir, {
+            runner,
+            ...(deps.sleep ? { sleep: deps.sleep } : {}),
+            ...(deps.healthAttempts !== undefined ? { healthAttempts: deps.healthAttempts } : {}),
+            ...(deps.healthIntervalMs !== undefined ? { healthIntervalMs: deps.healthIntervalMs } : {}),
+        });
+        if (!healthy.ok)
+            return { ok: false, error: `the ${service} is not healthy: ${healthy.error}` };
+    }
+    return { ok: true };
+}
+/** Replace the install's databases and content files with the backup at `from`. */
+export async function restoreSelfHosted(from, deps) {
+    const { caeloDir, runner, log } = deps;
+    if (!existsSync(from))
+        return unchanged(`${from} does not exist.`);
+    const work = workDir(caeloDir, "restore", (deps.now ?? (() => new Date()))());
+    try {
+        log(`Checking ${basename(from)} …`);
+        const members = checkArchiveMembers(from);
+        if (!members.ok)
+            return unchanged(members.error);
+        const untar = await runner.run(["tar", "-xzf", from, "-C", work]);
+        if (untar.exitCode !== 0) {
+            return unchanged(`${from} is not a readable backup archive: ${tail(untar.stderr)}`);
+        }
+        const checked = checkArchive(work);
+        if (!checked.ok)
+            return unchanged(checked.error);
+        const files = checkFilesTar(join(work, FILES_TAR));
+        if (!files.ok)
+            return unchanged(files.error);
+        log("Stopping the admin and the gateway …");
+        const stop = await runner.run(compose(caeloDir, "stop", ...COMPOSE_APP_SERVICES));
+        if (stop.exitCode !== 0) {
+            return unchanged(`Could not stop the Caelo services: ${tail(stop.stderr)}`);
+        }
+        const pg = await runner.run(compose(caeloDir, "up", "-d", "--wait", "postgres"));
+        if (pg.exitCode !== 0) {
+            return changed(`Postgres did not become healthy: ${tail(pg.stderr)}`);
+        }
+        log("Replacing the databases …");
+        const drop = await runner.run(compose(caeloDir, "exec", "-T", "postgres", "psql", "-U", "caelo", "-d", "postgres", "-v", "ON_ERROR_STOP=1", "-c", "DROP DATABASE IF EXISTS cms_admin WITH (FORCE)", "-c", "DROP DATABASE IF EXISTS cms_public WITH (FORCE)"));
+        if (drop.exitCode !== 0)
+            return changed(`Could not drop the databases: ${tail(drop.stderr)}`);
+        const created = await deps.convergeRoles();
+        if (!created.ok)
+            return changed(`Could not re-create the databases: ${created.error}`);
+        for (const db of ["cms_admin", "cms_public"]) {
+            const r = await runner.run(compose(caeloDir, "exec", "-T", "postgres", "pg_restore", "-U", "caelo", "-d", db, "--exit-on-error", "--single-transaction"), { stdinPath: join(work, DB_DIR, DATABASE_DUMPS[db]) });
+            if (r.exitCode !== 0)
+                return changed(`pg_restore of ${db} failed: ${tail(r.stderr)}`);
+        }
+        const granted = await deps.convergeRoles();
+        if (!granted.ok)
+            return changed(`Could not re-apply the role grants: ${granted.error}`);
+        log("Applying the migrations of the running release …");
+        const migrated = await runMigrations(caeloDir, runner);
+        if (!migrated.ok)
+            return changed(migrated.error);
+        log("Replacing the published site and the uploaded media …");
+        const dirs = CONTENT_PATHS.map((p) => `/${p}`).join(" ");
+        const replaced = await runner.run(compose(caeloDir, "run", "--rm", "--no-deps", "-T", "--entrypoint", "sh", "caelo-admin", "-c", `set -e; find ${dirs} -mindepth 1 -delete; tar -C / -xf -`), { stdinPath: join(work, FILES_TAR) });
+        if (replaced.exitCode !== 0) {
+            return changed(`Could not restore the site + media files: ${tail(replaced.stderr)}`);
+        }
+        log("Starting everything …");
+        const up = await runner.run(compose(caeloDir, "up", "-d", "--remove-orphans"));
+        if (up.exitCode !== 0)
+            return changed(`docker compose up failed: ${tail(up.stderr)}`);
+        for (const service of ["admin", "gateway"]) {
+            const healthy = await waitHealthy(service, caeloDir, {
+                runner,
+                ...(deps.sleep ? { sleep: deps.sleep } : {}),
+                ...(deps.healthAttempts !== undefined ? { healthAttempts: deps.healthAttempts } : {}),
+                ...(deps.healthIntervalMs !== undefined ? { healthIntervalMs: deps.healthIntervalMs } : {}),
+            });
+            if (!healthy.ok)
+                return changed(`The ${service} is not healthy after the restore: ${healthy.error}`);
+        }
+        const caddy = await deps.refreshCaddy();
+        if (!caddy.ok)
+            return changed(`Could not reload Caddy with the restored domains: ${caddy.error}`);
+        return { ok: true, manifest: checked.manifest };
+    }
+    finally {
+        rmSync(work, { recursive: true, force: true });
+    }
+}
+/** Whether an unpacked archive has every part a restore needs, in a format this CLI reads. */
+export function checkArchive(dir) {
+    const manifestPath = join(dir, MANIFEST);
+    if (!existsSync(manifestPath)) {
+        return { ok: false, error: "The archive has no manifest.json — it is not a Caelo backup." };
+    }
+    let manifest;
+    try {
+        manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+    }
+    catch (e) {
+        return { ok: false, error: `manifest.json is not JSON: ${e.message}` };
+    }
+    if (manifest.format !== BACKUP_FORMAT) {
+        return {
+            ok: false,
+            error: `The backup has format ${manifest.format}; this provisioner restores format ${BACKUP_FORMAT}. Use the provisioner of Caelo ${manifest.caeloVersion}.`,
+        };
+    }
+    for (const part of [
+        join(DB_DIR, DATABASE_DUMPS.cms_admin),
+        join(DB_DIR, DATABASE_DUMPS.cms_public),
+        FILES_TAR,
+    ]) {
+        if (!existsSync(join(dir, part)) || statSync(join(dir, part)).size === 0) {
+            return { ok: false, error: `The archive is incomplete: ${part} is missing or empty.` };
+        }
+    }
+    return { ok: true, manifest };
+}
+/** The members a backup archive may hold — anything else is refused before extraction. */
+const ARCHIVE_MEMBERS = new Set([
+    "",
+    MANIFEST,
+    DB_DIR,
+    ...Object.values(DATABASE_DUMPS).map((f) => `${DB_DIR}/${f}`),
+    FILES_TAR,
+]);
+/**
+ * Whether the .tar.gz at `path` holds only the members a backup writes, as
+ * plain files and directories — checked before `tar -x` writes anything.
+ */
+export function checkArchiveMembers(path) {
+    let entries;
+    try {
+        entries = listTarEntries(gunzipSync(readFileSync(path)));
+    }
+    catch (e) {
+        return {
+            ok: false,
+            error: `${path} is not a readable backup archive (${e.message}).`,
+        };
+    }
+    for (const e of entries) {
+        const name = normalizeMemberName(e.name);
+        if (escapesRoot(e.name) || !ARCHIVE_MEMBERS.has(name)) {
+            return {
+                ok: false,
+                error: `The archive holds an unexpected member ${JSON.stringify(e.name)} — it is not a Caelo backup.`,
+            };
+        }
+        if (e.type !== (name === "" || name === DB_DIR ? "directory" : "file")) {
+            return {
+                ok: false,
+                error: `The archive member ${JSON.stringify(e.name)} is a ${e.type}, not what a Caelo backup writes.`,
+            };
+        }
+    }
+    return { ok: true };
+}
+/**
+ * Whether files.tar only writes below the site and media directories:
+ * relative paths without `..`, files / directories / relative symlinks
+ * inside the tree, and no member below a symlink (which would write
+ * wherever the link points).
+ */
+export function checkFilesTar(path) {
+    let entries;
+    try {
+        entries = listTarEntries(readFileSync(path));
+    }
+    catch (e) {
+        return { ok: false, error: `files.tar is not readable (${e.message}).` };
+    }
+    const symlinks = [];
+    const refuse = (e, why) => ({
+        ok: false,
+        error: `files.tar member ${JSON.stringify(e.name)} ${why} — the archive is not a Caelo backup.`,
+    });
+    for (const e of entries) {
+        const name = normalizeMemberName(e.name);
+        if (escapesRoot(e.name))
+            return refuse(e, "points outside the content directories");
+        if (!CONTENT_PATHS.some((root) => name === root || name.startsWith(`${root}/`))) {
+            return refuse(e, "is outside the site and media directories");
+        }
+        if (symlinks.some((link) => name.startsWith(`${link}/`)))
+            return refuse(e, "lies below a symlink");
+        if (e.type === "symlink") {
+            const target = e.linkTarget ?? "";
+            if (target === "" || escapesRoot(target))
+                return refuse(e, "links outside its directory");
+            symlinks.push(name);
+        }
+        else if (e.type === "other") {
+            return refuse(e, "is not a file, directory or symlink");
+        }
+    }
+    return { ok: true };
+}
+/** A scratch dir under `.caelo/backups/` (mode 700) — same filesystem, never world-readable. */
+function workDir(caeloDir, kind, at) {
+    const dir = join(caeloDir, "backups", `.${kind}-${at.toISOString().replace(/[:.]/g, "-")}`);
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    return dir;
+}
+function unchanged(error) {
+    return {
+        ok: false,
+        error: `${error} Nothing on the install was changed.`,
+        installChanged: false,
+    };
+}
+function changed(error) {
+    return { ok: false, error, installChanged: true };
+}
+function tail(s) {
+    return s.trim().split("\n").slice(-5).join("\n").slice(0, 800);
+}
+//# sourceMappingURL=self-hosted-backup.js.map

package/dist/self-hosted-backup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-hosted-backup.js","sourceRoot":"","sources":["../src/self-hosted-backup.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,YAAY,EACZ,MAAM,EACN,QAAQ,EACR,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGlF,OAAO,EACL,OAAO,EACP,cAAc,EACd,aAAa,EACb,aAAa,EACb,WAAW,GACZ,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,mBAAmB,EAAiB,MAAM,kBAAkB,CAAC;AAEnG,iEAAiE;AACjE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC;AAE/B,MAAM,QAAQ,GAAG,eAAe,CAAC;AACjC,MAAM,MAAM,GAAG,IAAI,CAAC;AACpB,MAAM,SAAS,GAAG,WAAW,CAAC;AAE9B,+EAA+E;AAC/E,MAAM,aAAa,GAAG,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;AAoBtF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAU,EACV,YAAoB,EACpB,IAAgB;IAEhB,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACvC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;IAC9C,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,CAC5B,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,CAAC,CACzE,CAAC;IACF,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,wFAAwF,QAAQ,kDAAkD;SAC1J,CAAC;IACJ,CAAC;IACD,GAAG,CAAC,gEAAgE,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,oBAAoB,CAAC,CAAC,CAAC;IAClF,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sCAAsC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;IACzF,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC7C,IAAI,MAAoB,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,YAAY,CAAC,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5D,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,GAAG,CAAC,4CAA4C,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,6BAA6B,MAAM,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,SAAS,oCAAoC,OAAO,CAAC,KAAK,EAAE;SACpJ,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+EAA+E;AAC/E,KAAK,UAAU,YAAY,CACzB,EAAU,EACV,YAAoB,EACpB,IAAY,EACZ,IAAgB;IAEhB,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACvC,GAAG,CAAC,mCAAmC,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACzE,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAE1D,GAAG,CAAC,uDAAuD,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,CAC5B,OAAO,CACL,QAAQ,EACR,KAAK,EACL,MAAM,EACN,WAAW,EACX,IAAI,EACJ,cAAc,EACd,KAAK,EACL,aAAa,EACb,IAAI,EACJ,GAAG,EACH,KAAK,EACL,GAAG,EACH,GAAG,aAAa,CACjB,EACD,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CACtC,CAAC;IACF,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6CAA6C,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;IACjG,CAAC;IAED,MAAM,QAAQ,GAAmB;QAC/B,MAAM,EAAE,aAAa;QACrB,YAAY;QACZ,SAAS,EAAE,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE;KAC5D,CAAC;IACF,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAE/F,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACvB,uEAAuE;IACvE,kEAAkE;IAClE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE;QACjE,GAAG,EAAE,EAAE,gBAAgB,EAAE,GAAG,EAAE;KAC/B,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;IAC5E,CAAC;IACD,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACrB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AAChC,CAAC;AAED,2DAA2D;AAC3D,KAAK,UAAU,gBAAgB,CAC7B,IAAgB;IAEhB,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAClC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,oBAAoB,CAAC,CAAC,CAAC;IACpF,IAAI,EAAE,CAAC,QAAQ,KAAK,CAAC;QACnB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;IAC9E,KAAK,MAAM,OAAO,IAAI,CAAC,OAAO,EAAE,SAAS,CAAU,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,QAAQ,EAAE;YACnD,MAAM;YACN,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5C,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,GAAG,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5F,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,OAAO,oBAAoB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;IAClG,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAgBD,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAY,EAAE,IAAiB;IACrE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC,GAAG,IAAI,kBAAkB,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9E,IAAI,CAAC;QACH,GAAG,CAAC,YAAY,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAClE,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC,GAAG,IAAI,sCAAsC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAE7C,GAAG,CAAC,sCAAsC,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,oBAAoB,CAAC,CAAC,CAAC;QAClF,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC,sCAAsC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;QACjF,IAAI,EAAE,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,OAAO,CAAC,oCAAoC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,GAAG,CAAC,2BAA2B,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAC3B,OAAO,CACL,QAAQ,EACR,MAAM,EACN,IAAI,EACJ,UAAU,EACV,MAAM,EACN,IAAI,EACJ,OAAO,EACP,IAAI,EACJ,UAAU,EACV,IAAI,EACJ,iBAAiB,EACjB,IAAI,EACJ,gDAAgD,EAChD,IAAI,EACJ,iDAAiD,CAClD,CACF,CAAC;QACF,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC,iCAAiC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9F,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3C,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,OAAO,OAAO,CAAC,sCAAsC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACvF,KAAK,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,YAAY,CAAU,EAAE,CAAC;YACtD,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,GAAG,CACxB,OAAO,CACL,QAAQ,EACR,MAAM,EACN,IAAI,EACJ,UAAU,EACV,YAAY,EACZ,IAAI,EACJ,OAAO,EACP,IAAI,EACJ,EAAE,EACF,iBAAiB,EACjB,sBAAsB,CACvB,EACD,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,CAAC,CAAC,EAAE,CACtD,CAAC;YACF,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC;gBAAE,OAAO,OAAO,CAAC,iBAAiB,EAAE,YAAY,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3C,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,OAAO,OAAO,CAAC,uCAAuC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACxF,GAAG,CAAC,kDAAkD,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAEjD,GAAG,CAAC,uDAAuD,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAC/B,OAAO,CACL,QAAQ,EACR,KAAK,EACL,MAAM,EACN,WAAW,EACX,IAAI,EACJ,cAAc,EACd,IAAI,EACJ,aAAa,EACb,IAAI,EACJ,gBAAgB,IAAI,sCAAsC,CAC3D,EACD,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CACrC,CAAC;QACF,IAAI,QAAQ,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,OAAO,CAAC,6CAA6C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACvF,CAAC;QAED,GAAG,CAAC,uBAAuB,CAAC,CAAC;QAC7B,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC,CAAC;QAC/E,IAAI,EAAE,CAAC,QAAQ,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC,6BAA6B,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtF,KAAK,MAAM,OAAO,IAAI,CAAC,OAAO,EAAE,SAAS,CAAU,EAAE,CAAC;YACpD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,QAAQ,EAAE;gBACnD,MAAM;gBACN,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5C,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrF,GAAG,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5F,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,EAAE;gBACb,OAAO,OAAO,CAAC,OAAO,OAAO,sCAAsC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,EAAE;YACX,OAAO,OAAO,CAAC,qDAAqD,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QACrF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;IAClD,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,YAAY,CAC1B,GAAW;IAEX,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8DAA8D,EAAE,CAAC;IAC9F,CAAC;IACD,IAAI,QAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAmB,CAAC;IAC9E,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA+B,CAAW,CAAC,OAAO,EAAE,EAAE,CAAC;IACpF,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;QACtC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,yBAAyB,QAAQ,CAAC,MAAM,sCAAsC,aAAa,kCAAkC,QAAQ,CAAC,YAAY,GAAG;SAC7J,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,IAAI,IAAI;QACjB,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,UAAU,CAAC;QACvC,SAAS;KACV,EAAE,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACzE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,IAAI,uBAAuB,EAAE,CAAC;QACzF,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED,0FAA0F;AAC1F,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,EAAE;IACF,QAAQ;IACR,MAAM;IACN,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC;IAC7D,SAAS;CACV,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,cAAc,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,IAAI,sCAAuC,CAAW,CAAC,OAAO,IAAI;SAC7E,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACtD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,0CAA0C,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,8BAA8B;aACtG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACvE,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,sBAAsB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,mCAAmC;aACtG,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,cAAc,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA+B,CAAW,CAAC,OAAO,IAAI,EAAE,CAAC;IACtF,CAAC;IACD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,CAAC,CAAW,EAAE,GAAW,EAAE,EAAE,CAAC,CAAC;QAC5C,EAAE,EAAE,KAAc;QAClB,KAAK,EAAE,oBAAoB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,uCAAuC;KAChG,CAAC,CAAC;IACH,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,wCAAwC,CAAC,CAAC;QACpF,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC;YAChF,OAAO,MAAM,CAAC,CAAC,EAAE,2CAA2C,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;YACtD,OAAO,MAAM,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;QAC3C,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC;YAClC,IAAI,MAAM,KAAK,EAAE,IAAI,WAAW,CAAC,MAAM,CAAC;gBAAE,OAAO,MAAM,CAAC,CAAC,EAAE,6BAA6B,CAAC,CAAC;YAC1F,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;aAAM,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC9B,OAAO,MAAM,CAAC,CAAC,EAAE,qCAAqC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,gGAAgG;AAChG,SAAS,OAAO,CAAC,QAAgB,EAAE,IAA0B,EAAE,EAAQ;IACrE,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5F,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO;QACL,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,GAAG,KAAK,sCAAsC;QACrD,cAAc,EAAE,KAAK;KACtB,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,IAAI,CAAC,CAAS;IACrB,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACjE,CAAC"}