@caelo-cms/provisioning 0.10.50 → 0.10.51

package/dist/owner-reset.js

@@ -0,0 +1,80 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * #769 — `cms-provision owner-reset` — get an Owner back into a locked-out admin
+ * when the install cannot email a reset link (no email transport set up).
+ *
+ * The root of trust is the operator's cloud identity: whoever may read the
+ * install's internal secret and pass the admin's IAP already controls its
+ * database and deploys, so issuing them a reset link grants nothing new. The
+ * admin issues the one-hour, single-use token (`auth.issue_owner_reset`,
+ * audited) and hands it back over the admin-internal.ts channel; the CLI
+ * prints the link once. It is never logged, so it does not land in the
+ * project's Cloud Logging the way a "log the link" fallback would.
+ *
+ * The request carries the operator's gcloud account so the admin's audit row
+ * names who asked. That account is self-asserted (the admin sees the shared
+ * `caelo-mcp` identity and the shared internal secret), and labelled so; the
+ * authoritative record is Google's Data Access audit log for the IAM
+ * Credentials and Secret Manager calls this command makes as the operator.
+ */
+import { callAdminInternal, } from "./admin-internal.js";
+import { activeAccount, gcloud as defaultGcloud } from "./gcloud.js";
+/** Token scope the admin endpoint checks (apps/admin …/api/internal/owner-reset). */
+export const OWNER_RESET_SCOPE = "auth.owner_reset";
+const ENDPOINT = "/api/internal/owner-reset";
+/**
+ * Ask the admin for a reset link for the install's Owner (or the Owner named
+ * by `email` when there are several).
+ */
+export async function requestOwnerReset(target, request, deps = {}) {
+    const account = await readGcloudAccount(deps.run ?? defaultGcloud);
+    if (!account.ok)
+        return account;
+    const r = await callAdminInternal(target, {
+        endpoint: ENDPOINT,
+        scope: OWNER_RESET_SCOPE,
+        body: {
+            ...(request.email !== undefined ? { email: request.email } : {}),
+            requestedBy: account.value,
+        },
+        introducedBy: "#769",
+    }, deps);
+    if (!r.ok)
+        return r;
+    const { answer, adminUrl } = r.value;
+    const { email, token, expiresAt } = answer;
+    if (!email || !token || !expiresAt) {
+        return { ok: false, error: "the admin answered without an email, token or expiry" };
+    }
+    const resetUrl = new URL(`/reset?token=${encodeURIComponent(token)}`, adminUrl).toString();
+    return { ok: true, value: { email, resetUrl, expiresAt } };
+}
+/**
+ * The gcloud account this command runs as, for the admin's audit row. Without
+ * one there is nobody to name, and the IAP step after this would fail anyway.
+ */
+async function readGcloudAccount(run) {
+    // `auth list --filter=status:ACTIVE`, not `config get-value account`: the
+    // latter prints the sentinel `(unset)` and exits 0 when no account is set.
+    const account = await activeAccount(run);
+    if (!account || /\s/.test(account)) {
+        return {
+            ok: false,
+            error: "read the active gcloud account: none is signed in. Run `gcloud auth login` with the account you provisioned with.",
+        };
+    }
+    return { ok: true, value: account };
+}
+/** The lines the command prints. Pure — the CLI prints them and stores nothing. */
+export function describeOwnerReset(r) {
+    return [
+        `Reset link for ${r.email} — open it to set a new password:`,
+        "",
+        `  ${r.resetUrl}`,
+        "",
+        `It works once and expires at ${r.expiresAt}. Setting the password signs out every`,
+        "other session of this account. The link is not saved anywhere; run the command",
+        "again for a new one.",
+    ];
+}
+//# sourceMappingURL=owner-reset.js.map

package/dist/owner-reset.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-reset.js","sourceRoot":"","sources":["../src/owner-reset.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAIL,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,aAAa,CAAC;AAErE,qFAAqF;AACrF,MAAM,CAAC,MAAM,iBAAiB,GAAG,kBAAkB,CAAC;AACpD,MAAM,QAAQ,GAAG,2BAA2B,CAAC;AAS7C;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAA2B,EAC3B,OAAoC,EACpC,OAA0B,EAAE;IAE5B,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC,CAAC;IACnE,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC;IAChC,MAAM,CAAC,GAAG,MAAM,iBAAiB,CAC/B,MAAM,EACN;QACE,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,iBAAiB;QACxB,IAAI,EAAE;YACJ,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,WAAW,EAAE,OAAO,CAAC,KAAK;SAC3B;QACD,YAAY,EAAE,MAAM;KACrB,EACD,IAAI,CACL,CAAC;IACF,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,CAAC,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC;IACrC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAC3C,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;QACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sDAAsD,EAAE,CAAC;IACtF,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,gBAAgB,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,iBAAiB,CAC9B,GAA0C;IAE1C,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EACH,mHAAmH;SACtH,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACtC,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,kBAAkB,CAAC,CAAa;IAC9C,OAAO;QACL,kBAAkB,CAAC,CAAC,KAAK,mCAAmC;QAC5D,EAAE;QACF,KAAK,CAAC,CAAC,QAAQ,EAAE;QACjB,EAAE;QACF,gCAAgC,CAAC,CAAC,SAAS,wCAAwC;QACnF,gFAAgF;QAChF,sBAAsB;KACvB,CAAC;AACJ,CAAC"}

package/dist/stack-contract.d.ts

@@ -39,14 +39,12 @@ export interface DatabaseUrls<V = string> {
     readonly admin: V;
     /** admin_role on cms_public — the admin's second pool (DDL, migrations). */
     readonly publicAdmin: V;
-    /** public_role on cms_public — the gateway's visitor-write pool. */
-    readonly public: V;
     /**
-     * gateway_role on cms_admin — the gateway's narrow pool (#613): its
-     * settings, rate limits, captcha, request log, plugin op audit and the
-     * plugin registry, read-mostly (migration 0248).
+     * public_role on cms_public — the gateway's only pool. The gateway has no
+     * cms_admin login (#635, CLAUDE.md §2): what it needs from authoring
+     * state the admin publishes into cms_public.
      */
-    readonly gateway: V;
+    readonly public: V;
 }
 /**
  * Password-less connection URLs for a Cloud SQL instance at `host`. The
@@ -154,8 +152,8 @@ export type RuntimeSecret = "postgres-password" | "public-role-password" | "gate
 export type DatabaseRole = "admin_role" | "public_role" | "gateway_role";
 /**
  * Each database role's password secret — one per role (#613), so the
- * gateway's SA, which reads only the public_role and gateway_role
- * passwords, can never read admin_role's. `postgres-password` keeps its
+ * gateway's SA, which reads only the public_role password, can never read
+ * admin_role's (or, since #635, gateway_role's). `postgres-password` keeps its
  * name: it has always been admin_role's (and, before #613, shared with
  * public_role). `rotate-secret` changes exactly the role(s) listed here.
  */
@@ -180,8 +178,9 @@ export declare function serviceSecrets(service: CloudRunSlug): RuntimeSecret[];
 /**
  * Env vars an older stack set that the contract no longer gives a service;
  * upgrade removes them. The gateway never used the KEK, and its run SA
- * cannot read it. Its admin_role pool went with #613 — the gateway refuses
- * to boot while either var is set (apps/api-gateway `gatewayDatabaseUrls`).
+ * cannot read it. Its admin_role pool went with #613 and its gateway_role
+ * pool with #635 — the gateway refuses to boot while any cms_admin
+ * credential is in its env (apps/api-gateway `adminDatabaseAccessInEnv`).
  */
 export declare const RETIRED_SERVICE_ENV: Readonly<Record<CloudRunSlug, readonly string[]>>;
 /**

package/dist/stack-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stack-contract.d.ts","sourceRoot":"","sources":["../src/stack-contract.ts"],"names":[],"mappings":"AAgDA,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,cAAc,CAAC;AACjD,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,SAAS,CAAC;AAE/C;;;;GAIG;AACH,MAAM,MAAM,cAAc,CAAC,CAAC,GAAG,MAAM,IACjC;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAC5C;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE;QACpB,QAAQ,CAAC,YAAY,EAAE;YAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC;KACzE,CAAC;CACH,CAAC;AAEN,yDAAyD;AACzD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,8EAA8E;AAC9E,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,MAAM;IACtC,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;IAClB,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IACxB,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACnB;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;CACrB;AAKD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CASvD;AAED,kFAAkF;AAClF,MAAM,WAAW,gBAAgB,CAAC,CAAC,GAAG,MAAM,CAAE,SAAQ,gBAAgB;IACpE,+DAA+D;IAC/D,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;CACxC;AAED;;;;;GAKG;AACH,MAAM,MAAM,cAAc,CAAC,CAAC,GAAG,MAAM,IACjC,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG;IAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAA;CAAE,CAAC,GACpD,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG;IACrB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC;CAC5B,CAAC,CAAC;AAEP,qFAAqF;AACrF,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,6DAA6D;AAC7D,eAAO,MAAM,gBAAgB,uBAAuB,CAAC;AAErD;;;GAGG;AACH,eAAO,MAAM,WAAW,kCAAkC,CAAC;AAE3D;;;GAGG;AACH,eAAO,MAAM,2BAA2B,8BAA8B,CAAC;AAEvE;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,uBAAuB,CAAC;AASzD;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,+BAA+B,CAAC;AAE7D,gDAAgD;AAChD,eAAO,MAAM,iBAAiB,UAAU,CAAC;AAEzC;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,8CAA8C;AAC9C,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,mBAAmB,CAMpF;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,mBAAmB;;;;;;;;;;;;;EAMnE;AAMD;;;GAGG;AACH,MAAM,MAAM,aAAa,GACrB,mBAAmB,GACnB,sBAAsB,GACtB,uBAAuB,GACvB,YAAY,GACZ,iBAAiB,GACjB,sBAAsB,GACtB,qBAAqB,CAAC;AAE1B,2EAA2E;AAC3E,MAAM,MAAM,YAAY,GAAG,YAAY,GAAG,aAAa,GAAG,cAAc,CAAC;AAEzE;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,aAAa,CAAC,CAI9E,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,8HAWW,CAAC;AAE9C;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CACvC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CAwB9D,CAAC;AAEF,+DAA+D;AAC/D,wBAAgB,cAAc,CAAC,OAAO,EAAE,YAAY,GAAG,aAAa,EAAE,CAErE;AAED;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC,CAGjF,CAAC;AAyBF;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,CAO/F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,CAiD3F;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB;;;;;CAKpB,CAAC;AAEX,6CAA6C;AAC7C,MAAM,MAAM,YAAY;AACtB,gEAAgE;AAC9D,QAAQ;AACV,0CAA0C;GACxC,YAAY;AACd,6CAA6C;GAC3C,qBAAqB;AACvB,8EAA8E;GAC5E,mBAAmB,GACnB,UAAU,CAAC;AAEf,wDAAwD;AACxD,MAAM,MAAM,SAAS,GACjB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAA;CAAE,GAC5E;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;CAAE,CAAC;AAErE;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,CAAC;IACrC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAID,4EAA4E;AAC5E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,wEAAwE;IACxE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,oBAAoB,EAAE,CAS9D;AA+ID;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,iBAAiB,EAO5D,CAAC;AAEF,qEAAqE;AACrE,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,WAAW,GAAG,YAAY,EAAE,CAMxE;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAiBvF,CAAC;AAEF,mEAAmE;AACnE,wBAAgB,SAAS,CACvB,SAAS,EAAE,YAAY,EACvB,OAAO,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC5F,MAAM,CAaR;AAMD,6EAA6E;AAC7E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;IAC5C,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,gFAAgF;IAChF,QAAQ,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAE7C;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAAS,yBAAyB,EAiC7E,CAAC;AAEF,yEAAyE;AACzE,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,SAAS;IAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EAAE,EACvF,YAAY,EAAE,SAAS,MAAM,EAAE,GAC9B,MAAM,CAKR;AAED,qFAAqF;AACrF,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,QAAQ,CAAC;AAE1C;;;GAGG;AACH;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG;IAC5D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAQA;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAcjE"}
+{"version":3,"file":"stack-contract.d.ts","sourceRoot":"","sources":["../src/stack-contract.ts"],"names":[],"mappings":"AAgDA,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,cAAc,CAAC;AACjD,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,SAAS,CAAC;AAE/C;;;;GAIG;AACH,MAAM,MAAM,cAAc,CAAC,CAAC,GAAG,MAAM,IACjC;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAC5C;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE;QACpB,QAAQ,CAAC,YAAY,EAAE;YAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC;KACzE,CAAC;CACH,CAAC;AAEN,yDAAyD;AACzD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,8EAA8E;AAC9E,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,MAAM;IACtC,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;IAClB,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;CACpB;AAKD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAQvD;AAED,kFAAkF;AAClF,MAAM,WAAW,gBAAgB,CAAC,CAAC,GAAG,MAAM,CAAE,SAAQ,gBAAgB;IACpE,+DAA+D;IAC/D,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;CACxC;AAED;;;;;GAKG;AACH,MAAM,MAAM,cAAc,CAAC,CAAC,GAAG,MAAM,IACjC,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG;IAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAA;CAAE,CAAC,GACpD,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG;IACrB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC;CAC5B,CAAC,CAAC;AAEP,qFAAqF;AACrF,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,6DAA6D;AAC7D,eAAO,MAAM,gBAAgB,uBAAuB,CAAC;AAErD;;;GAGG;AACH,eAAO,MAAM,WAAW,kCAAkC,CAAC;AAE3D;;;GAGG;AACH,eAAO,MAAM,2BAA2B,8BAA8B,CAAC;AAEvE;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,uBAAuB,CAAC;AASzD;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,+BAA+B,CAAC;AAE7D,gDAAgD;AAChD,eAAO,MAAM,iBAAiB,UAAU,CAAC;AAEzC;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,8CAA8C;AAC9C,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,mBAAmB,CAMpF;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,mBAAmB;;;;;;;;;;;;;EAMnE;AAMD;;;GAGG;AACH,MAAM,MAAM,aAAa,GACrB,mBAAmB,GACnB,sBAAsB,GACtB,uBAAuB,GACvB,YAAY,GACZ,iBAAiB,GACjB,sBAAsB,GACtB,qBAAqB,CAAC;AAE1B,2EAA2E;AAC3E,MAAM,MAAM,YAAY,GAAG,YAAY,GAAG,aAAa,GAAG,cAAc,CAAC;AAEzE;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,aAAa,CAAC,CAI9E,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,8HAWW,CAAC;AAE9C;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CACvC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CAuB9D,CAAC;AAEF,+DAA+D;AAC/D,wBAAgB,cAAc,CAAC,OAAO,EAAE,YAAY,GAAG,aAAa,EAAE,CAErE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC,CAUjF,CAAC;AAyBF;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,CAM/F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,CAiD3F;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB;;;;;CAKpB,CAAC;AAEX,6CAA6C;AAC7C,MAAM,MAAM,YAAY;AACtB,gEAAgE;AAC9D,QAAQ;AACV,0CAA0C;GACxC,YAAY;AACd,6CAA6C;GAC3C,qBAAqB;AACvB,8EAA8E;GAC5E,mBAAmB,GACnB,UAAU,CAAC;AAEf,wDAAwD;AACxD,MAAM,MAAM,SAAS,GACjB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAA;CAAE,GAC5E;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;CAAE,CAAC;AAErE;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,CAAC;IACrC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAID,4EAA4E;AAC5E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,wEAAwE;IACxE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,oBAAoB,EAAE,CAS9D;AA+ID;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,iBAAiB,EAa5D,CAAC;AAEF,qEAAqE;AACrE,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,WAAW,GAAG,YAAY,EAAE,CAMxE;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAiBvF,CAAC;AAEF,mEAAmE;AACnE,wBAAgB,SAAS,CACvB,SAAS,EAAE,YAAY,EACvB,OAAO,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC5F,MAAM,CAaR;AAMD,6EAA6E;AAC7E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;IAC5C,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,gFAAgF;IAChF,QAAQ,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAE7C;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAAS,yBAAyB,EAiC7E,CAAC;AAEF,yEAAyE;AACzE,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,SAAS;IAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EAAE,EACvF,YAAY,EAAE,SAAS,MAAM,EAAE,GAC9B,MAAM,CAKR;AAED,qFAAqF;AACrF,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,QAAQ,CAAC;AAE1C;;;GAGG;AACH;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG;IAC5D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAQA;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAcjE"}

package/dist/stack-contract.js

@@ -46,7 +46,6 @@ export function databaseUrls(host) {
         admin: url("admin_role", "cms_admin"),
         publicAdmin: url("admin_role", "cms_public"),
         public: url("public_role", "cms_public"),
-        gateway: url("gateway_role", "cms_admin"),
     };
 }
 /** The public site's base URL, as the admin seeds `site_base_url` from it (#551). */
@@ -115,8 +114,8 @@ export function adminMediaVolumeTemplate(volume) {
 }
 /**
  * Each database role's password secret — one per role (#613), so the
- * gateway's SA, which reads only the public_role and gateway_role
- * passwords, can never read admin_role's. `postgres-password` keeps its
+ * gateway's SA, which reads only the public_role password, can never read
+ * admin_role's (or, since #635, gateway_role's). `postgres-password` keeps its
  * name: it has always been admin_role's (and, before #613, shared with
  * public_role). `rotate-secret` changes exactly the role(s) listed here.
  */
@@ -166,9 +165,8 @@ export const SERVICE_SECRET_ENV = {
         CAELO_STAGING_GATE_SECRET: "staging-gate-secret",
     },
     gateway: {
-        // CLAUDE.md §2: never an admin_role credential (#613). gateway_role on
-        // cms_admin + public_role on cms_public, each with its own password.
-        GATEWAY_DATABASE_PASSWORD: "gateway-role-password",
+        // CLAUDE.md §2: no cms_admin credential of any role (#613, #635).
+        // public_role on cms_public is the gateway's only login.
         PUBLIC_DATABASE_PASSWORD: "public-role-password",
         // #650 — verifies staging-host requests (api-gateway staging-proxy.ts).
         CAELO_STAGING_GATE_SECRET: "staging-gate-secret",
@@ -181,12 +179,20 @@ export function serviceSecrets(service) {
 /**
  * Env vars an older stack set that the contract no longer gives a service;
  * upgrade removes them. The gateway never used the KEK, and its run SA
- * cannot read it. Its admin_role pool went with #613 — the gateway refuses
- * to boot while either var is set (apps/api-gateway `gatewayDatabaseUrls`).
+ * cannot read it. Its admin_role pool went with #613 and its gateway_role
+ * pool with #635 — the gateway refuses to boot while any cms_admin
+ * credential is in its env (apps/api-gateway `adminDatabaseAccessInEnv`).
  */
 export const RETIRED_SERVICE_ENV = {
     admin: [],
-    gateway: ["CAELO_SECRET_KEK", "ADMIN_DATABASE_URL", "ADMIN_DATABASE_PASSWORD"],
+    gateway: [
+        "CAELO_SECRET_KEK",
+        "ADMIN_DATABASE_URL",
+        "ADMIN_DATABASE_PASSWORD",
+        // #635 — its gateway_role login on cms_admin is gone too.
+        "GATEWAY_DATABASE_URL",
+        "GATEWAY_DATABASE_PASSWORD",
+    ],
 };
 function secretEnv(service, env) {
     return Object.entries(SERVICE_SECRET_ENV[service]).map(([name, secret]) => ({
@@ -216,7 +222,6 @@ export function gatewayEnvContract(inputs) {
     return [
         ...commonEnv(inputs),
         { name: "PUBLIC_DATABASE_URL", value: inputs.databaseUrls.public },
-        { name: "GATEWAY_DATABASE_URL", value: inputs.databaseUrls.gateway },
         ...secretEnv("gateway", inputs.env),
     ];
 }
@@ -455,6 +460,12 @@ export const RETIRED_IAM_BINDINGS = [
         target: { kind: "secret", name: "postgres-password" },
         why: "the gateway no longer logs in as admin_role and must not be able to read its password (CLAUDE.md §2)",
     },
+    {
+        role: SECRET_ACCESSOR,
+        member: "gateway-sa",
+        target: { kind: "secret", name: "gateway-role-password" },
+        why: "the gateway has no cms_admin login at all and must not be able to read gateway_role's password (CLAUDE.md §2, #635)",
+    },
 ];
 /** Every IAM binding upgrade ensures on an install of `provider`. */
 export function stackIamInvariants(provider) {

package/dist/stack-contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"stack-contract.js","sourceRoot":"","sources":["../src/stack-contract.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EACL,0BAA0B,EAC1B,aAAa,EACb,aAAa,EACb,WAAW,EACX,yBAAyB,EACzB,yBAAyB,EACzB,sBAAsB,EACtB,+BAA+B,EAC/B,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAoDxB,uDAAuD;AACvD,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAU,EAAE,EAAE,CACvC,gBAAgB,IAAI,IAAI,IAAI,IAAI,aAAa,IAAI,EAAE,kBAAkB,CAAC;IACxE,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,YAAY,EAAE,WAAW,CAAC;QACrC,WAAW,EAAE,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC;QAC5C,MAAM,EAAE,GAAG,CAAC,aAAa,EAAE,YAAY,CAAC;QACxC,OAAO,EAAE,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC;KAC1C,CAAC;AACJ,CAAC;AAsBD,qFAAqF;AACrF,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,OAAO,WAAW,MAAM,EAAE,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,OAAO,WAAW,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;AACrE,CAAC;AAED,6DAA6D;AAC7D,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAErD;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,+BAA+B,CAAC;AAE3D;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,2BAA2B,CAAC;AAEvE;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;AAEzD,4DAA4D;AAC5D,MAAM,aAAa,GAAG,uCAAuC,CAAC;AAE9D,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;AAE7D,gDAAgD;AAChD,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAoBzC,8CAA8C;AAC9C,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,GAAW;IAC7D,OAAO;QACL,UAAU,EAAE,iBAAiB;QAC7B,MAAM,EAAE,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC;QAC9C,SAAS,EAAE,gBAAgB;KAC5B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAA2B;IAClE,OAAO;QACL,oBAAoB,EAAE,4BAA4B;QAClD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC;QACvF,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;KAChE,CAAC;AACb,CAAC;AAsBD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAkD;IACjF,UAAU,EAAE,mBAAmB;IAC/B,WAAW,EAAE,sBAAsB;IACnC,YAAY,EAAE,uBAAuB;CACtC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,iBAAiB;IACjB,sBAAsB;IACtB,wEAAwE;IACxE,kEAAkE;IAClE,sBAAsB;IACtB,uBAAuB;IACvB,uEAAuE;IACvE,sEAAsE;IACtE,uCAAuC;IACvC,qBAAqB;CACsB,CAAC;AAE9C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAE3B;IACF,KAAK,EAAE;QACL,uBAAuB,EAAE,mBAAmB;QAC5C,8BAA8B,EAAE,mBAAmB;QACnD,0EAA0E;QAC1E,gBAAgB,EAAE,YAAY;QAC9B,2EAA2E;QAC3E,qBAAqB,EAAE,iBAAiB;QACxC,oEAAoE;QACpE,4CAA4C;QAC5C,0BAA0B,EAAE,sBAAsB;QAClD,kEAAkE;QAClE,kDAAkD;QAClD,yBAAyB,EAAE,qBAAqB;KACjD;IACD,OAAO,EAAE;QACP,uEAAuE;QACvE,qEAAqE;QACrE,yBAAyB,EAAE,uBAAuB;QAClD,wBAAwB,EAAE,sBAAsB;QAChD,wEAAwE;QACxE,yBAAyB,EAAE,qBAAqB;KACjD;CACF,CAAC;AAEF,+DAA+D;AAC/D,MAAM,UAAU,cAAc,CAAC,OAAqB;IAClD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAsD;IACpF,KAAK,EAAE,EAAE;IACT,OAAO,EAAE,CAAC,kBAAkB,EAAE,oBAAoB,EAAE,yBAAyB,CAAC;CAC/E,CAAC;AAEF,SAAS,SAAS,CAAC,OAAqB,EAAE,GAAW;IACnD,OAAO,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,IAAI;QACJ,WAAW,EAAE,EAAE,YAAY,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;KACvF,CAAC,CAAC,CAAC;AACN,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,oCAAoC;AACpC,SAAS,SAAS,CAAC,MAAwB;IACzC,OAAO;QACL,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE;QAClD,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE;QACxC;YACE,IAAI,EAAE,mBAAmB;YACzB,KAAK,EAAE,QAAQ,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE;SACtE;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAI,MAA2B;IAC/D,OAAO;QACL,GAAG,SAAS,CAAC,MAAM,CAAC;QACpB,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE;QAClE,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE;QACpE,GAAG,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC;KACpC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAI,MAAyB;IAC3D,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAC1C,MAAM,KAAK,GAAiC;QAC1C,GAAG,SAAS,CAAC,MAAM,CAAC;QACpB,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE;QAChE,oEAAoE;QACpE,mCAAmC;QACnC,EAAE,IAAI,EAAE,2BAA2B,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE;QAC7E,yEAAyE;QACzE,kDAAkD;QAClD,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE;QACxD,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,aAAa,EAAE;QACrD,uEAAuE;QACvE,0DAA0D;QAC1D,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,EAAE;QACnD,mEAAmE;QACnE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,yBAAyB,CAAC,SAAS,CAAC,EAAE;QAClE,wEAAwE;QACxE,4DAA4D;QAC5D;YACE,IAAI,EAAE,2BAA2B;YACjC,KAAK,EAAE,yBAAyB,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;SAChE;QACD,wEAAwE;QACxE,sCAAsC;QACtC,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE;KAC1F,CAAC;IACF,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC9B,+DAA+D;QAC/D,oCAAoC;QACpC,KAAK,CAAC,IAAI,CACR,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,EAC/E,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,EAAE,CAClF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,oEAAoE;QACpE,8CAA8C;QAC9C,KAAK,CAAC,IAAI,CACR,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,CAAC,cAAc,EAAE,EAC7D,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,MAAM,CAAC,cAAc,EAAE,EAC/D,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE;QACtD,uEAAuE;QACvE,mEAAmE;QACnE,gDAAgD;QAChD,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,CACtD,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IACvC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,SAAS,EAAE,kBAAkB;IAC7B,UAAU,EAAE,IAAI;IAChB,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,QAAQ;CACX,CAAC;AA0CX,MAAM,eAAe,GAAG,oCAAoC,CAAC;AAU7D;;;GAGG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAQ,CAAC,OAAO,EAAE,SAAS,CAAW,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CACzD,cAAc,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvC,OAAO;QACP,MAAM;QACN,+DAA+D;QAC/D,aAAa,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,UAAU,CAAC,CAAC,CAAC,WAAW,MAAM,UAAU;KACvF,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,qBAAqB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzC,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;QACvD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAC1C,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,OAAO,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,8BAA8B;KACtE,CAAC,CAAC,CAAC;AACN,CAAC;AAED,uEAAuE;AACvE,MAAM,SAAS,GAA4B;IACzC;QACE,aAAa,EAAE,gBAAgB;QAC/B,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3B,SAAS,EAAE,MAAM;QACjB,GAAG,EAAE,oCAAoC;KAC1C;IACD;QACE,aAAa,EAAE,mBAAmB;QAClC,IAAI,EAAE,+BAA+B;QACrC,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3B,SAAS,EAAE,MAAM;QACjB,GAAG,EAAE,iEAAiE;KACvE;IACD;QACE,aAAa,EAAE,oBAAoB;QACnC,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3B,SAAS,EAAE,MAAM;QACjB,GAAG,EAAE,4CAA4C;KAClD;IACD;QACE,aAAa,EAAE,uBAAuB;QACtC,IAAI,EAAE,+BAA+B;QACrC,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3B,SAAS,EAAE,MAAM;QACjB,GAAG,EAAE,yEAAyE;KAC/E;CACF,CAAC;AAEF,MAAM,QAAQ,GAA4B;IACxC;QACE,aAAa,EAAE,oBAAoB;QACnC,IAAI,EAAE,4BAA4B;QAClC,MAAM,EAAE,UAAU;QAClB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE;QAC5C,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,0DAA0D;KAChE;IACD;QACE,aAAa,EAAE,UAAU;QACzB,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE;QAC3C,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,mCAAmC;KACzC;IACD;QACE,aAAa,EAAE,iBAAiB;QAChC,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE;QAC5C,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,gEAAgE;KACtE;IACD;QACE,aAAa,EAAE,kBAAkB;QACjC,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE;QAC7C,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,8DAA8D;KACpE;IACD;QACE,aAAa,EAAE,qBAAqB;QACpC,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,qBAAqB;QAC7B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE;QAC5C,SAAS,EAAE,MAAM;QACjB,GAAG,EAAE,qFAAqF;KAC3F;IACD;QACE,aAAa,EAAE,kBAAkB;QACjC,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,mBAAmB;QAC3B,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE;QACjD,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,8DAA8D;KACpE;CACF,CAAC;AAEF,MAAM,iBAAiB,GAA4B;IACjD;QACE,aAAa,EAAE,UAAU;QACzB,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE;QAC3C,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,mCAAmC;KACzC;IACD;QACE,aAAa,EAAE,sBAAsB;QACrC,IAAI,EAAE,6BAA6B;QACnC,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3B,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,kDAAkD;KACxD;IACD;QACE,aAAa,EAAE,wBAAwB;QACvC,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,UAAU;QAClB,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE;QACnD,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,yDAAyD;KAC/D;IACD;QACE,aAAa,EAAE,6BAA6B;QAC5C,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE;QACnD,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,uHAAuH;KAC7H;IACD;QACE,aAAa,EAAE,sBAAsB;QACrC,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,mBAAmB;QAC3B,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE;QACjD,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,8DAA8D;KACpE;CACF,CAAC;AAcF;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAiC;IAChE;QACE,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,mBAAmB,EAAE;QACrD,GAAG,EAAE,sGAAsG;KAC5G;CACF,CAAC;AAEF,qEAAqE;AACrE,MAAM,UAAU,kBAAkB,CAAC,QAAqB;IACtD,OAAO;QACL,GAAG,eAAe,EAAE;QACpB,GAAG,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC;QACtD,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA0D;IAC1F,GAAG,EAAE;QACH,mBAAmB,EACjB,0HAA0H;QAC5H,qBAAqB,EAAE,6CAA6C;QACpE,eAAe,EAAE,6CAA6C;QAC9D,wBAAwB,EACtB,8FAA8F;KACjG;IACD,cAAc,EAAE;QACd,aAAa,EACX,0HAA0H;QAC5H,iBAAiB,EACf,kFAAkF;QACpF,qBAAqB,EAAE,6CAA6C;QACpE,eAAe,EAAE,6CAA6C;KAC/D;CACF,CAAC;AAEF,mEAAmE;AACnE,MAAM,UAAU,SAAS,CACvB,SAAuB,EACvB,OAA6F;IAE7F,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO,kBAAkB,sBAAsB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACpF,KAAK,YAAY;YACf,OAAO,kBAAkB,0BAA0B,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxF,KAAK,qBAAqB;YACxB,OAAO,kBAAkB,+BAA+B,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,SAAS,0BAA0B,CAAC;QACvH,KAAK,mBAAmB;YACtB,OAAO,0BAA0B,OAAO,CAAC,aAAa,qCAAqC,CAAC;QAC9F,KAAK,UAAU;YACb,OAAO,UAAU,CAAC;IACtB,CAAC;AACH,CAAC;AAkCD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAC;AAE7C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAyC;IACjF;QACE,IAAI,EAAE,mBAAmB;QACzB,YAAY,EAAE,CAAC,WAAW,CAAC;QAC3B,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,qBAAqB,EAAE,KAAK;QAC5B,GAAG,EAAE,iEAAiE;KACvE;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,YAAY,EAAE,CAAC,WAAW,CAAC;QAC3B,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;QACjD,qBAAqB,EAAE,KAAK;QAC5B,GAAG,EAAE,iEAAiE;KACvE;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,YAAY,EAAE,CAAC,WAAW,CAAC;QAC3B,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QACjC,qBAAqB,EAAE,KAAK;QAC5B,GAAG,EAAE,kEAAkE;KACxE;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,YAAY,EAAE,CAAC,cAAc,CAAC;QAC9B,OAAO,EAAE;YACP,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,EAAE;YACzC,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,EAAE;YACzC,EAAE,UAAU,EAAE,MAAM,EAAE;SACvB;QACD,qBAAqB,EAAE,IAAI;QAC3B,GAAG,EAAE,qFAAqF;KAC3F;CACF,CAAC;AAEF,yEAAyE;AACzE,MAAM,UAAU,qBAAqB,CACnC,OAAuF,EACvF,YAA+B;IAE/B,MAAM,KAAK,GAAG,OAAO;SAClB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;SAC9E,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,OAAO,GAAG,KAAK,IAAI,QAAQ,SAAS,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,aAAa,EAAE,CAAC;AAChF,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,yBAAyB,CAAC,GAAW;IACnD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,iBAAiB,CAAC;AAChD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAE1C;;;GAGG;AACH;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAgB;IAIzD,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,GAAG,GAAG,KAAK,CAAC,IAAI,GAAG,GAAG,GAAG,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CACb,4BAA4B,QAAQ,qFAAqF,CAC1H,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,MAAM,CAAC,GAAG,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAClE,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACb,KAAK,IAAI;YACP,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,KAAK,IAAI;YACP,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC9B,KAAK,GAAG;YACN,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC;QACvD;YACE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC;IAChE,CAAC;AACH,CAAC"}
+{"version":3,"file":"stack-contract.js","sourceRoot":"","sources":["../src/stack-contract.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EACL,0BAA0B,EAC1B,aAAa,EACb,aAAa,EACb,WAAW,EACX,yBAAyB,EACzB,yBAAyB,EACzB,sBAAsB,EACtB,+BAA+B,EAC/B,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAkDxB,uDAAuD;AACvD,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAU,EAAE,EAAE,CACvC,gBAAgB,IAAI,IAAI,IAAI,IAAI,aAAa,IAAI,EAAE,kBAAkB,CAAC;IACxE,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,YAAY,EAAE,WAAW,CAAC;QACrC,WAAW,EAAE,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC;QAC5C,MAAM,EAAE,GAAG,CAAC,aAAa,EAAE,YAAY,CAAC;KACzC,CAAC;AACJ,CAAC;AAsBD,qFAAqF;AACrF,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,OAAO,WAAW,MAAM,EAAE,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,OAAO,WAAW,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;AACrE,CAAC;AAED,6DAA6D;AAC7D,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAErD;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,+BAA+B,CAAC;AAE3D;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,2BAA2B,CAAC;AAEvE;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;AAEzD,4DAA4D;AAC5D,MAAM,aAAa,GAAG,uCAAuC,CAAC;AAE9D,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;AAE7D,gDAAgD;AAChD,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAoBzC,8CAA8C;AAC9C,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,GAAW;IAC7D,OAAO;QACL,UAAU,EAAE,iBAAiB;QAC7B,MAAM,EAAE,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC;QAC9C,SAAS,EAAE,gBAAgB;KAC5B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAA2B;IAClE,OAAO;QACL,oBAAoB,EAAE,4BAA4B;QAClD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC;QACvF,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;KAChE,CAAC;AACb,CAAC;AAsBD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAkD;IACjF,UAAU,EAAE,mBAAmB;IAC/B,WAAW,EAAE,sBAAsB;IACnC,YAAY,EAAE,uBAAuB;CACtC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,iBAAiB;IACjB,sBAAsB;IACtB,wEAAwE;IACxE,kEAAkE;IAClE,sBAAsB;IACtB,uBAAuB;IACvB,uEAAuE;IACvE,sEAAsE;IACtE,uCAAuC;IACvC,qBAAqB;CACsB,CAAC;AAE9C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAE3B;IACF,KAAK,EAAE;QACL,uBAAuB,EAAE,mBAAmB;QAC5C,8BAA8B,EAAE,mBAAmB;QACnD,0EAA0E;QAC1E,gBAAgB,EAAE,YAAY;QAC9B,2EAA2E;QAC3E,qBAAqB,EAAE,iBAAiB;QACxC,oEAAoE;QACpE,4CAA4C;QAC5C,0BAA0B,EAAE,sBAAsB;QAClD,kEAAkE;QAClE,kDAAkD;QAClD,yBAAyB,EAAE,qBAAqB;KACjD;IACD,OAAO,EAAE;QACP,kEAAkE;QAClE,yDAAyD;QACzD,wBAAwB,EAAE,sBAAsB;QAChD,wEAAwE;QACxE,yBAAyB,EAAE,qBAAqB;KACjD;CACF,CAAC;AAEF,+DAA+D;AAC/D,MAAM,UAAU,cAAc,CAAC,OAAqB;IAClD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAsD;IACpF,KAAK,EAAE,EAAE;IACT,OAAO,EAAE;QACP,kBAAkB;QAClB,oBAAoB;QACpB,yBAAyB;QACzB,0DAA0D;QAC1D,sBAAsB;QACtB,2BAA2B;KAC5B;CACF,CAAC;AAEF,SAAS,SAAS,CAAC,OAAqB,EAAE,GAAW;IACnD,OAAO,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,IAAI;QACJ,WAAW,EAAE,EAAE,YAAY,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;KACvF,CAAC,CAAC,CAAC;AACN,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,oCAAoC;AACpC,SAAS,SAAS,CAAC,MAAwB;IACzC,OAAO;QACL,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE;QAClD,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE;QACxC;YACE,IAAI,EAAE,mBAAmB;YACzB,KAAK,EAAE,QAAQ,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE;SACtE;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAI,MAA2B;IAC/D,OAAO;QACL,GAAG,SAAS,CAAC,MAAM,CAAC;QACpB,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE;QAClE,GAAG,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC;KACpC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAI,MAAyB;IAC3D,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAC1C,MAAM,KAAK,GAAiC;QAC1C,GAAG,SAAS,CAAC,MAAM,CAAC;QACpB,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE;QAChE,oEAAoE;QACpE,mCAAmC;QACnC,EAAE,IAAI,EAAE,2BAA2B,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE;QAC7E,yEAAyE;QACzE,kDAAkD;QAClD,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE;QACxD,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,aAAa,EAAE;QACrD,uEAAuE;QACvE,0DAA0D;QAC1D,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,EAAE;QACnD,mEAAmE;QACnE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,yBAAyB,CAAC,SAAS,CAAC,EAAE;QAClE,wEAAwE;QACxE,4DAA4D;QAC5D;YACE,IAAI,EAAE,2BAA2B;YACjC,KAAK,EAAE,yBAAyB,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;SAChE;QACD,wEAAwE;QACxE,sCAAsC;QACtC,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE;KAC1F,CAAC;IACF,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC9B,+DAA+D;QAC/D,oCAAoC;QACpC,KAAK,CAAC,IAAI,CACR,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,EAC/E,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,EAAE,CAClF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,oEAAoE;QACpE,8CAA8C;QAC9C,KAAK,CAAC,IAAI,CACR,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,CAAC,cAAc,EAAE,EAC7D,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,MAAM,CAAC,cAAc,EAAE,EAC/D,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE;QACtD,uEAAuE;QACvE,mEAAmE;QACnE,gDAAgD;QAChD,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,CACtD,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IACvC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,SAAS,EAAE,kBAAkB;IAC7B,UAAU,EAAE,IAAI;IAChB,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,QAAQ;CACX,CAAC;AA0CX,MAAM,eAAe,GAAG,oCAAoC,CAAC;AAU7D;;;GAGG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAQ,CAAC,OAAO,EAAE,SAAS,CAAW,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CACzD,cAAc,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvC,OAAO;QACP,MAAM;QACN,+DAA+D;QAC/D,aAAa,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,UAAU,CAAC,CAAC,CAAC,WAAW,MAAM,UAAU;KACvF,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,qBAAqB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzC,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;QACvD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAC1C,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,OAAO,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,8BAA8B;KACtE,CAAC,CAAC,CAAC;AACN,CAAC;AAED,uEAAuE;AACvE,MAAM,SAAS,GAA4B;IACzC;QACE,aAAa,EAAE,gBAAgB;QAC/B,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3B,SAAS,EAAE,MAAM;QACjB,GAAG,EAAE,oCAAoC;KAC1C;IACD;QACE,aAAa,EAAE,mBAAmB;QAClC,IAAI,EAAE,+BAA+B;QACrC,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3B,SAAS,EAAE,MAAM;QACjB,GAAG,EAAE,iEAAiE;KACvE;IACD;QACE,aAAa,EAAE,oBAAoB;QACnC,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3B,SAAS,EAAE,MAAM;QACjB,GAAG,EAAE,4CAA4C;KAClD;IACD;QACE,aAAa,EAAE,uBAAuB;QACtC,IAAI,EAAE,+BAA+B;QACrC,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3B,SAAS,EAAE,MAAM;QACjB,GAAG,EAAE,yEAAyE;KAC/E;CACF,CAAC;AAEF,MAAM,QAAQ,GAA4B;IACxC;QACE,aAAa,EAAE,oBAAoB;QACnC,IAAI,EAAE,4BAA4B;QAClC,MAAM,EAAE,UAAU;QAClB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE;QAC5C,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,0DAA0D;KAChE;IACD;QACE,aAAa,EAAE,UAAU;QACzB,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE;QAC3C,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,mCAAmC;KACzC;IACD;QACE,aAAa,EAAE,iBAAiB;QAChC,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE;QAC5C,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,gEAAgE;KACtE;IACD;QACE,aAAa,EAAE,kBAAkB;QACjC,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE;QAC7C,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,8DAA8D;KACpE;IACD;QACE,aAAa,EAAE,qBAAqB;QACpC,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,qBAAqB;QAC7B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE;QAC5C,SAAS,EAAE,MAAM;QACjB,GAAG,EAAE,qFAAqF;KAC3F;IACD;QACE,aAAa,EAAE,kBAAkB;QACjC,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,mBAAmB;QAC3B,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE;QACjD,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,8DAA8D;KACpE;CACF,CAAC;AAEF,MAAM,iBAAiB,GAA4B;IACjD;QACE,aAAa,EAAE,UAAU;QACzB,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE;QAC3C,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,mCAAmC;KACzC;IACD;QACE,aAAa,EAAE,sBAAsB;QACrC,IAAI,EAAE,6BAA6B;QACnC,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3B,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,kDAAkD;KACxD;IACD;QACE,aAAa,EAAE,wBAAwB;QACvC,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,UAAU;QAClB,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE;QACnD,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,yDAAyD;KAC/D;IACD;QACE,aAAa,EAAE,6BAA6B;QAC5C,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE;QACnD,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,uHAAuH;KAC7H;IACD;QACE,aAAa,EAAE,sBAAsB;QACrC,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,mBAAmB;QAC3B,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE;QACjD,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,8DAA8D;KACpE;CACF,CAAC;AAcF;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAiC;IAChE;QACE,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,mBAAmB,EAAE;QACrD,GAAG,EAAE,sGAAsG;KAC5G;IACD;QACE,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,EAAE;QACzD,GAAG,EAAE,qHAAqH;KAC3H;CACF,CAAC;AAEF,qEAAqE;AACrE,MAAM,UAAU,kBAAkB,CAAC,QAAqB;IACtD,OAAO;QACL,GAAG,eAAe,EAAE;QACpB,GAAG,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC;QACtD,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA0D;IAC1F,GAAG,EAAE;QACH,mBAAmB,EACjB,0HAA0H;QAC5H,qBAAqB,EAAE,6CAA6C;QACpE,eAAe,EAAE,6CAA6C;QAC9D,wBAAwB,EACtB,8FAA8F;KACjG;IACD,cAAc,EAAE;QACd,aAAa,EACX,0HAA0H;QAC5H,iBAAiB,EACf,kFAAkF;QACpF,qBAAqB,EAAE,6CAA6C;QACpE,eAAe,EAAE,6CAA6C;KAC/D;CACF,CAAC;AAEF,mEAAmE;AACnE,MAAM,UAAU,SAAS,CACvB,SAAuB,EACvB,OAA6F;IAE7F,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO,kBAAkB,sBAAsB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACpF,KAAK,YAAY;YACf,OAAO,kBAAkB,0BAA0B,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxF,KAAK,qBAAqB;YACxB,OAAO,kBAAkB,+BAA+B,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,SAAS,0BAA0B,CAAC;QACvH,KAAK,mBAAmB;YACtB,OAAO,0BAA0B,OAAO,CAAC,aAAa,qCAAqC,CAAC;QAC9F,KAAK,UAAU;YACb,OAAO,UAAU,CAAC;IACtB,CAAC;AACH,CAAC;AAkCD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAC;AAE7C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAyC;IACjF;QACE,IAAI,EAAE,mBAAmB;QACzB,YAAY,EAAE,CAAC,WAAW,CAAC;QAC3B,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,qBAAqB,EAAE,KAAK;QAC5B,GAAG,EAAE,iEAAiE;KACvE;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,YAAY,EAAE,CAAC,WAAW,CAAC;QAC3B,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;QACjD,qBAAqB,EAAE,KAAK;QAC5B,GAAG,EAAE,iEAAiE;KACvE;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,YAAY,EAAE,CAAC,WAAW,CAAC;QAC3B,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QACjC,qBAAqB,EAAE,KAAK;QAC5B,GAAG,EAAE,kEAAkE;KACxE;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,YAAY,EAAE,CAAC,cAAc,CAAC;QAC9B,OAAO,EAAE;YACP,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,EAAE;YACzC,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,EAAE;YACzC,EAAE,UAAU,EAAE,MAAM,EAAE;SACvB;QACD,qBAAqB,EAAE,IAAI;QAC3B,GAAG,EAAE,qFAAqF;KAC3F;CACF,CAAC;AAEF,yEAAyE;AACzE,MAAM,UAAU,qBAAqB,CACnC,OAAuF,EACvF,YAA+B;IAE/B,MAAM,KAAK,GAAG,OAAO;SAClB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;SAC9E,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,OAAO,GAAG,KAAK,IAAI,QAAQ,SAAS,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,aAAa,EAAE,CAAC;AAChF,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,yBAAyB,CAAC,GAAW;IACnD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,iBAAiB,CAAC;AAChD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAE1C;;;GAGG;AACH;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAgB;IAIzD,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,GAAG,GAAG,KAAK,CAAC,IAAI,GAAG,GAAG,GAAG,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CACb,4BAA4B,QAAQ,qFAAqF,CAC1H,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,MAAM,CAAC,GAAG,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAClE,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACb,KAAK,IAAI;YACP,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,KAAK,IAAI;YACP,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC9B,KAAK,GAAG;YACN,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC;QACvD;YACE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC;IAChE,CAAC;AACH,CAAC"}

package/dist/staging-admin.d.ts

@@ -1,17 +1,16 @@
-import { type GcloudResult } from "./gcloud.js";
-type Run = (args: string[]) => Promise<GcloudResult>;
+/**
+ * #678 — `staging-domain enable` tells the admin itself what the operator
+ * decided, instead of printing "now set the same host in the admin".
+ * It calls `POST /api/internal/staging/provision` through admin-internal.ts
+ * (IAP as caelo-mcp + the internal token, scope `staging.provision`), because
+ * the answer carries the generated basic-auth password back to the CLI, which
+ * prints it once and never stores it.
+ */
+import { type AdminInternalDeps, type AdminInternalResult, type AdminInternalTarget } from "./admin-internal.js";
 /** Token scope the admin endpoint checks (apps/admin …/api/internal/staging/provision). */
 export declare const STAGING_PROVISION_SCOPE = "staging.provision";
-export interface StagingAdminTarget {
-    readonly projectId: string;
-    readonly region: string;
-}
-export interface StagingAdminDeps {
-    readonly run?: Run;
-    readonly fetch?: typeof fetch;
-    /** Seconds since epoch (IAP JWT); tests pin it. */
-    readonly now?: () => number;
-}
+export type StagingAdminTarget = AdminInternalTarget;
+export type StagingAdminDeps = AdminInternalDeps;
 /** Main's draft pages, as the admin reports them. */
 export interface DraftPages {
     readonly count: number;
@@ -46,13 +45,7 @@ export interface StagingApply {
     readonly stageNote: string | null;
     readonly draftPages: DraftPages;
 }
-export type StagingAdminResult<T> = {
-    ok: true;
-    value: T;
-} | {
-    ok: false;
-    error: string;
-};
+export type StagingAdminResult<T> = AdminInternalResult<T>;
 export interface ApplyRequest {
     readonly host?: string;
     readonly rotateBasicAuth?: boolean;
@@ -75,5 +68,4 @@ export declare function describeStagingApply(r: StagingApply): string[];
  * admin's previous host instead (codex review on #681).
  */
 export declare function domainEnableRetryCommand(command: string, requestedHost: string | null): string;
-export {};
 //# sourceMappingURL=staging-admin.d.ts.map

package/dist/staging-admin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"staging-admin.d.ts","sourceRoot":"","sources":["../src/staging-admin.ts"],"names":[],"mappings":"AA2BA,OAAO,EAA2B,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAIzE,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;AAErD,2FAA2F;AAC3F,eAAO,MAAM,uBAAuB,sBAAsB,CAAC;AAK3D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC;IACnB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,mDAAmD;IACnD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED,qDAAqD;AACrD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,SAAS;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC5D;AAED,qEAAqE;AACrE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,gBAAgB,GAAG,cAAc,GAAG,IAAI,CAAC;IAC/D,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAA;KAAE,CAAC;CACjG;AAED,gEAAgE;AAChE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,mBAAmB,GAAG,oBAAoB,CAAC;QACtF,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;KAClC,CAAC;IACF,QAAQ,CAAC,WAAW,EAAE,gBAAgB,GAAG,cAAc,GAAG,IAAI,CAAC;IAC/D,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;CACjC;AAED,MAAM,MAAM,kBAAkB,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1F,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;CACpC;AAED,qFAAqF;AACrF,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,kBAAkB,EAC1B,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC,CAE7C;AAED,+FAA+F;AAC/F,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,kBAAkB,EAC1B,OAAO,EAAE,YAAY,EACrB,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAE3C;AAwJD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,YAAY,GAAG,MAAM,EAAE,CAmD9D;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAE9F"}
+{"version":3,"file":"staging-admin.d.ts","sourceRoot":"","sources":["../src/staging-admin.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AAEH,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EAEzB,MAAM,qBAAqB,CAAC;AAE7B,2FAA2F;AAC3F,eAAO,MAAM,uBAAuB,sBAAsB,CAAC;AAG3D,MAAM,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AACrD,MAAM,MAAM,gBAAgB,GAAG,iBAAiB,CAAC;AAEjD,qDAAqD;AACrD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,SAAS;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC5D;AAED,qEAAqE;AACrE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,gBAAgB,GAAG,cAAc,GAAG,IAAI,CAAC;IAC/D,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAA;KAAE,CAAC;CACjG;AAED,gEAAgE;AAChE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,mBAAmB,GAAG,oBAAoB,CAAC;QACtF,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;KAClC,CAAC;IACF,QAAQ,CAAC,WAAW,EAAE,gBAAgB,GAAG,cAAc,GAAG,IAAI,CAAC;IAC/D,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;CACjC;AAED,MAAM,MAAM,kBAAkB,CAAC,CAAC,IAAI,mBAAmB,CAAC,CAAC,CAAC,CAAC;AAE3D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;CACpC;AAED,qFAAqF;AACrF,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,kBAAkB,EAC1B,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC,CAE7C;AAED,+FAA+F;AAC/F,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,kBAAkB,EAC1B,OAAO,EAAE,YAAY,EACrB,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAE3C;AAeD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,YAAY,GAAG,MAAM,EAAE,CAmD9D;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAE9F"}

package/dist/staging-admin.js

@@ -2,35 +2,15 @@
 /**
  * #678 — `staging-domain enable` tells the admin itself what the operator
  * decided, instead of printing "now set the same host in the admin".
- *
- * Why an HTTP call to the admin (and not a one-shot Cloud Run job like the
- * migrations): the call must hand a result BACK — above all the generated
- * basic-auth password, which the CLI prints once. A job can only report
- * through Cloud Logging, which would put the password into the project's
- * logs. The admin endpoint (`POST /api/internal/staging/provision`) answers
- * over TLS straight to this process, and the password is never written
- * anywhere (CLAUDE.md §7, #659).
- *
- * Getting there, as the operator's own gcloud identity — the same path the
- * Power-MCP shim takes (packages/mcp-server/src/ingress-auth.ts):
- *
- *   1. the admin Cloud Run service and its URL;
- *   2. the install's internal secret from Secret Manager (in memory only),
- *      which signs a 5-minute token for scope `staging.provision`;
- *   3. a JWT signed as `caelo-mcp@<project>` through the IAM Credentials
- *      API — the admin's IAP lets that service account in, and every
- *      IAP-allowlisted operator may sign as it (`cms-provision upgrade`
- *      grants it) — so the request passes IAP first, then Caelo's token.
+ * It calls `POST /api/internal/staging/provision` through admin-internal.ts
+ * (IAP as caelo-mcp + the internal token, scope `staging.provision`), because
+ * the answer carries the generated basic-auth password back to the CLI, which
+ * prints it once and never stores it.
  */
-import { findService } from "./admin-domain.js";
-import { gcloud as defaultGcloud } from "./gcloud.js";
-import { GCP_STACK_ENV, gcpSecretId, mcpIapServiceAccountEmail } from "./gcp-names.js";
-import { mintInternalToken } from "./internal-token.js";
+import { callAdminInternal, } from "./admin-internal.js";
 /** Token scope the admin endpoint checks (apps/admin …/api/internal/staging/provision). */
 export const STAGING_PROVISION_SCOPE = "staging.provision";
 const ENDPOINT = "/api/internal/staging/provision";
-/** Signed JWTs live at most 1 hour; one call needs a few seconds. */
-const IAP_JWT_LIFETIME_S = 600;
 /** Read the admin's stored staging host (the truth `staging-domain enable` maps). */
 export function inspectStagingAdmin(target, deps = {}) {
     return callStagingAdmin(target, { mode: "inspect" }, deps);
@@ -40,140 +20,8 @@ export function applyStagingAdmin(target, request, deps = {}) {
     return callStagingAdmin(target, { mode: "apply", ...request }, deps);
 }
 async function callStagingAdmin(target, body, deps) {
-    const run = deps.run ?? defaultGcloud;
-    const doFetch = deps.fetch ?? fetch;
-    const scope = [`--region=${target.region}`, `--project=${target.projectId}`];
-    const found = await findService(run, scope, "admin");
-    if (!found.ok)
-        return { ok: false, error: found.error };
-    const url = await run([
-        "run",
-        "services",
-        "describe",
-        found.service,
-        ...scope,
-        "--format=value(status.url)",
-    ]);
-    const adminUrl = url.stdout.trim();
-    if (!url.ok || !adminUrl) {
-        return { ok: false, error: `read the admin's URL: ${url.stderr.trim() || "empty"}` };
-    }
-    const secretId = gcpSecretId(GCP_STACK_ENV, "internal-secret");
-    const secret = await run([
-        "secrets",
-        "versions",
-        "access",
-        "latest",
-        `--secret=${secretId}`,
-        `--project=${target.projectId}`,
-    ]);
-    const internalSecret = secret.stdout.trim();
-    if (!secret.ok || internalSecret.length < 32) {
-        return {
-            ok: false,
-            error: `read the install's internal secret (${secretId}) from Secret Manager: ${secret.stderr.trim() || "missing or too short"}. Your gcloud account needs secretmanager.versions.access on the project.`,
-        };
-    }
-    // Installs from before #678 may not have the IAM Credentials API on;
-    // enabling an enabled API is a no-op (codex review on #681).
-    const api = await run([
-        "services",
-        "enable",
-        "iamcredentials.googleapis.com",
-        `--project=${target.projectId}`,
-    ]);
-    if (!api.ok) {
-        return {
-            ok: false,
-            error: `enable the IAM Credentials API (iamcredentials.googleapis.com), needed to pass the admin's IAP: ${api.stderr.trim()}`,
-        };
-    }
-    const iap = await signIapJwt(run, doFetch, target.projectId, adminUrl, deps.now);
-    if (!iap.ok)
-        return iap;
-    const token = await mintInternalToken(internalSecret, STAGING_PROVISION_SCOPE);
-    let res;
-    try {
-        res = await doFetch(`${adminUrl}${ENDPOINT}`, {
-            method: "POST",
-            headers: {
-                authorization: `Bearer ${iap.value}`,
-                "x-caelo-internal-token": token,
-                "content-type": "application/json",
-            },
-            body: JSON.stringify(body),
-        });
-    }
-    catch (e) {
-        return { ok: false, error: `reach the admin at ${adminUrl}: ${String(e)}` };
-    }
-    const text = await res.text();
-    if (res.headers.get("x-goog-iap-generated-response") === "true") {
-        return {
-            ok: false,
-            error: `Google IAP refused the request (HTTP ${res.status}: ${text.trim().slice(0, 200)}) — ${mcpIapServiceAccountEmail(target.projectId)} is not allowed on the admin's IAP yet. Run \`cms-provision upgrade\` (it allowlists that service account), then run this command again.`,
-        };
-    }
-    if (res.status === 404) {
-        return {
-            ok: false,
-            error: `the admin has no ${ENDPOINT} yet (it runs a release from before #678). Run \`cms-provision upgrade\`, then run this command again.`,
-        };
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(text);
-    }
-    catch {
-        return {
-            ok: false,
-            error: `the admin answered HTTP ${res.status} with a non-JSON body: ${text.slice(0, 200)}`,
-        };
-    }
-    if (!res.ok || parsed.ok !== true) {
-        return {
-            ok: false,
-            error: `the admin refused (HTTP ${res.status}): ${parsed.error ?? text.slice(0, 300)}`,
-        };
-    }
-    return { ok: true, value: parsed };
-}
-/** A JWT signed as the install's MCP service account, for the admin's IAP. */
-async function signIapJwt(run, doFetch, projectId, adminUrl, now) {
-    const access = await run(["auth", "print-access-token"]);
-    const accessToken = access.stdout.trim();
-    if (!access.ok || !accessToken) {
-        return {
-            ok: false,
-            error: `get an access token from gcloud: ${access.stderr.trim() || "empty"}. Run \`gcloud auth login\` with the account you provisioned with.`,
-        };
-    }
-    const serviceAccount = mcpIapServiceAccountEmail(projectId);
-    const iat = now ? now() : Math.floor(Date.now() / 1000);
-    const res = await doFetch(`https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${encodeURIComponent(serviceAccount)}:signJwt`, {
-        method: "POST",
-        headers: { authorization: `Bearer ${accessToken}`, "content-type": "application/json" },
-        body: JSON.stringify({
-            payload: JSON.stringify({
-                iss: serviceAccount,
-                sub: serviceAccount,
-                aud: `${new URL(adminUrl).origin}/*`,
-                iat,
-                exp: iat + IAP_JWT_LIFETIME_S,
-            }),
-        }),
-    });
-    if (!res.ok) {
-        const detail = (await res.text().catch(() => "")).slice(0, 300);
-        return {
-            ok: false,
-            error: `sign an IAP token as ${serviceAccount} (HTTP ${res.status}): ${detail} — your account needs roles/iam.serviceAccountTokenCreator on it; \`cms-provision upgrade\` grants it to everyone the admin's IAP lets in.`,
-        };
-    }
-    const { signedJwt } = (await res.json());
-    if (!signedJwt)
-        return { ok: false, error: "IAM signJwt answered without a signedJwt" };
-    return { ok: true, value: signedJwt };
+    const r = await callAdminInternal(target, { endpoint: ENDPOINT, scope: STAGING_PROVISION_SCOPE, body, introducedBy: "#678" }, deps);
+    return r.ok ? { ok: true, value: r.value.answer } : r;
 }
 /**
  * The lines `staging-domain enable` prints for an apply result: host,

package/dist/staging-admin.js.map

@@ -1 +1 @@
-{"version":3,"file":"staging-admin.js","sourceRoot":"","sources":["../src/staging-admin.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,MAAM,IAAI,aAAa,EAAqB,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAIxD,2FAA2F;AAC3F,MAAM,CAAC,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AAC3D,MAAM,QAAQ,GAAG,iCAAiC,CAAC;AACnD,qEAAqE;AACrE,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAqD/B,qFAAqF;AACrF,MAAM,UAAU,mBAAmB,CACjC,MAA0B,EAC1B,OAAyB,EAAE;IAE3B,OAAO,gBAAgB,CAAiB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,CAAC;AAC7E,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,iBAAiB,CAC/B,MAA0B,EAC1B,OAAqB,EACrB,OAAyB,EAAE;IAE3B,OAAO,gBAAgB,CAAe,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC;AACrF,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,MAA0B,EAC1B,IAA6B,EAC7B,IAAsB;IAEtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACpC,MAAM,KAAK,GAAG,CAAC,YAAY,MAAM,CAAC,MAAM,EAAE,EAAE,aAAa,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAE7E,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IACxD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC;QACpB,KAAK;QACL,UAAU;QACV,UAAU;QACV,KAAK,CAAC,OAAO;QACb,GAAG,KAAK;QACR,4BAA4B;KAC7B,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,OAAO,EAAE,EAAE,CAAC;IACvF,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;QACvB,SAAS;QACT,UAAU;QACV,QAAQ;QACR,QAAQ;QACR,YAAY,QAAQ,EAAE;QACtB,aAAa,MAAM,CAAC,SAAS,EAAE;KAChC,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,cAAc,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC7C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,uCAAuC,QAAQ,0BAA0B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,sBAAsB,2EAA2E;SAC1M,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,6DAA6D;IAC7D,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC;QACpB,UAAU;QACV,QAAQ;QACR,+BAA+B;QAC/B,aAAa,MAAM,CAAC,SAAS,EAAE;KAChC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,mGAAmG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;SAC9H,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACjF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC;IAExB,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAAC;IAC/E,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,QAAQ,GAAG,QAAQ,EAAE,EAAE;YAC5C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,GAAG,CAAC,KAAK,EAAE;gBACpC,wBAAwB,EAAE,KAAK;gBAC/B,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC9E,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,KAAK,MAAM,EAAE,CAAC;QAChE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,wCAAwC,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,yBAAyB,CAAC,MAAM,CAAC,SAAS,CAAC,0IAA0I;SACpR,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,oBAAoB,QAAQ,wGAAwG;SAC5I,CAAC;IACJ,CAAC;IACD,IAAI,MAAkE,CAAC;IACvE,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkB,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,2BAA2B,GAAG,CAAC,MAAM,0BAA0B,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;SAC3F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QAClC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,2BAA2B,GAAG,CAAC,MAAM,MAAM,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;SACvF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAsB,EAAE,CAAC;AACrD,CAAC;AAED,8EAA8E;AAC9E,KAAK,UAAU,UAAU,CACvB,GAAQ,EACR,OAAqB,EACrB,SAAiB,EACjB,QAAgB,EAChB,GAA+B;IAE/B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,oCAAoC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,OAAO,oEAAoE;SAC/I,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,yBAAyB,CAAC,SAAS,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,uEAAuE,kBAAkB,CAAC,cAAc,CAAC,UAAU,EACnH;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QACvF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;gBACtB,GAAG,EAAE,cAAc;gBACnB,GAAG,EAAE,cAAc;gBACnB,GAAG,EAAE,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,IAAI;gBACpC,GAAG;gBACH,GAAG,EAAE,GAAG,GAAG,kBAAkB;aAC9B,CAAC;SACH,CAAC;KACH,CACF,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAChE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,wBAAwB,cAAc,UAAU,GAAG,CAAC,MAAM,MAAM,MAAM,4IAA4I;SAC1N,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2B,CAAC;IACnE,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC;IACxF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,CAAe;IAClD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CACR,CAAC,CAAC,WAAW;QACX,CAAC,CAAC,sBAAsB,CAAC,CAAC,IAAI,6BAA6B,CAAC,CAAC,YAAY,IAAI,OAAO,4BAA4B;QAChH,CAAC,CAAC,+BAA+B,CAAC,CAAC,IAAI,GAAG,CAC7C,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC;IACtB,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;QAChF,KAAK,CAAC,IAAI,CACR,EAAE,EACF,CAAC,CAAC,MAAM,KAAK,WAAW;YACtB,CAAC,CAAC,2FAA2F;YAC7F,CAAC,CAAC,6FAA6F,EACjG,eAAe,CAAC,CAAC,IAAI,EAAE,EACvB,eAAe,CAAC,CAAC,QAAQ,EAAE,EAC3B,6FAA6F,EAC7F,0FAA0F,CAC3F,CAAC;IACJ,CAAC;SAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CACR,EAAE,EACF,iBAAiB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iCAAiC,6CAA6C,EAClH,eAAe,CAAC,CAAC,IAAI,EAAE,EACvB,eAAe,CAAC,CAAC,QAAQ,EAAE,CAC5B,CAAC;IACJ,CAAC;SAAM,IAAI,CAAC,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;QAC5C,KAAK,CAAC,IAAI,CACR,EAAE,EACF,+CAA+C,CAAC,CAAC,IAAI,qGAAqG,CAC3J,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CACR,EAAE,EACF,gJAAgJ,CACjJ,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClF,MAAM,IAAI,GACR,CAAC,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM;YAC5C,CAAC,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,OAAO;YAC/D,CAAC,CAAC,EAAE,CAAC;QACT,KAAK,CAAC,IAAI,CACR,EAAE,EACF,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,kDAAkD,MAAM,GAAG,IAAI,GAAG,EACvF,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAe,EAAE,aAA4B;IACpF,OAAO,iBAAiB,OAAO,UAAU,aAAa,CAAC,CAAC,CAAC,qBAAqB,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACvG,CAAC"}
+{"version":3,"file":"staging-admin.js","sourceRoot":"","sources":["../src/staging-admin.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;GAOG;AAEH,OAAO,EAIL,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAE7B,2FAA2F;AAC3F,MAAM,CAAC,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AAC3D,MAAM,QAAQ,GAAG,iCAAiC,CAAC;AA4CnD,qFAAqF;AACrF,MAAM,UAAU,mBAAmB,CACjC,MAA0B,EAC1B,OAAyB,EAAE;IAE3B,OAAO,gBAAgB,CAAiB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,CAAC;AAC7E,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,iBAAiB,CAC/B,MAA0B,EAC1B,OAAqB,EACrB,OAAyB,EAAE;IAE3B,OAAO,gBAAgB,CAAe,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC;AACrF,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,MAA0B,EAC1B,IAA6B,EAC7B,IAAsB;IAEtB,MAAM,CAAC,GAAG,MAAM,iBAAiB,CAC/B,MAAM,EACN,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,uBAAuB,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,EAClF,IAAI,CACL,CAAC;IACF,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,CAAe;IAClD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CACR,CAAC,CAAC,WAAW;QACX,CAAC,CAAC,sBAAsB,CAAC,CAAC,IAAI,6BAA6B,CAAC,CAAC,YAAY,IAAI,OAAO,4BAA4B;QAChH,CAAC,CAAC,+BAA+B,CAAC,CAAC,IAAI,GAAG,CAC7C,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC;IACtB,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;QAChF,KAAK,CAAC,IAAI,CACR,EAAE,EACF,CAAC,CAAC,MAAM,KAAK,WAAW;YACtB,CAAC,CAAC,2FAA2F;YAC7F,CAAC,CAAC,6FAA6F,EACjG,eAAe,CAAC,CAAC,IAAI,EAAE,EACvB,eAAe,CAAC,CAAC,QAAQ,EAAE,EAC3B,6FAA6F,EAC7F,0FAA0F,CAC3F,CAAC;IACJ,CAAC;SAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CACR,EAAE,EACF,iBAAiB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iCAAiC,6CAA6C,EAClH,eAAe,CAAC,CAAC,IAAI,EAAE,EACvB,eAAe,CAAC,CAAC,QAAQ,EAAE,CAC5B,CAAC;IACJ,CAAC;SAAM,IAAI,CAAC,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;QAC5C,KAAK,CAAC,IAAI,CACR,EAAE,EACF,+CAA+C,CAAC,CAAC,IAAI,qGAAqG,CAC3J,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CACR,EAAE,EACF,gJAAgJ,CACjJ,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClF,MAAM,IAAI,GACR,CAAC,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM;YAC5C,CAAC,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,OAAO;YAC/D,CAAC,CAAC,EAAE,CAAC;QACT,KAAK,CAAC,IAAI,CACR,EAAE,EACF,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,kDAAkD,MAAM,GAAG,IAAI,GAAG,EACvF,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAe,EAAE,aAA4B;IACpF,OAAO,iBAAiB,OAAO,UAAU,aAAa,CAAC,CAAC,CAAC,qBAAqB,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACvG,CAAC"}

package/dist/wizards/gcp-cost.js

@@ -59,7 +59,7 @@ export function estimateGcpCost(inputs) {
         {
             name: "Quality checks (Lighthouse on the admin)",
             monthlyUsd: 1,
-            notes: "~1-2 min of admin CPU per audited Stage (up to 5 pages x 3 runs); ~$1/mo at a few Stages a day",
+            notes: "~2-4 min of admin CPU per audited Stage (up to 5 pages x 5 runs); ~$1/mo at a few Stages a day",
         },
         {
             name: "Cloud Run gateway",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@caelo-cms/provisioning",
-  "version": "0.10.50",
+  "version": "0.10.51",
   "private": false,
   "license": "MPL-2.0",
   "description": "Pulumi-driven provisioning for Caelo CMS — `bunx @caelo-cms/provisioning --provider <self-hosted|gcp|aws|azure>` brings up a TLS-served install with Postgres + storage + secrets manager + the admin + the API gateway.",
@@ -40,7 +40,7 @@
     "prepublishOnly": "tsc -b --force && bun build ../platform-updater/src/agent-db.ts --target=bun --outfile=dist/agent-db.js && tsc --project stacks/gcp/tsconfig.json && tsc --project stacks/gcp-firebase/tsconfig.json"
   },
   "dependencies": {
-    "@caelo-cms/shared": "^0.10.50",
+    "@caelo-cms/shared": "^0.10.51",
     "@clack/prompts": "1.8.1",
     "@pulumi/aws": "^7",
     "@pulumi/awsx": "^3",

package/src/adapter.ts

@@ -55,14 +55,12 @@ export interface DnsRecord {
 export interface CloudAdapterOutputs {
   /** DSN for cms_admin role (encrypted in Pulumi state). */
   readonly adminDatabaseUrl: string;
-  /** DSN for public_role on cms_public (encrypted in Pulumi state). */
-  readonly publicDatabaseUrl: string;
   /**
-   * DSN for gateway_role on cms_admin — the API gateway's own narrow login
-   * (#613). The gateway gets this and `publicDatabaseUrl`, never
-   * `adminDatabaseUrl` (CLAUDE.md §2).
+   * DSN for public_role on cms_public (encrypted in Pulumi state) — the API
+   * gateway's only database login. It never gets a cms_admin DSN of any
+   * role (CLAUDE.md §2, #635).
    */
-  readonly gatewayDatabaseUrl: string;
+  readonly publicDatabaseUrl: string;
   /** Provider-native blob URL (s3://, gs://, https://<account>.blob.core.windows.net/<container>). */
   readonly mediaStorageUrl: string;
   /** Public-facing URL the admin reaches for media reads. */