@caelo-cms/provisioning 0.10.52 → 0.10.55

package/dist/audit-job-setup.js

@@ -0,0 +1,317 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * #875 — set up (and converge) the parallel quality-audit job on a Google
+ * Cloud install (`gcp`, `gcp-firebase`). Run by the wizard after `pulumi up`
+ * and by `cms-provision upgrade`'s converge, both as the operator's own
+ * gcloud identity. App-roll moves the job's image with the admin's
+ * (upgrade/app-roll.ts), because the job runs the admin image.
+ *
+ * Why a separate job at all (CLAUDE.md §11.B Tier 5 exception): Lighthouse
+ * is CPU-bound and simulates the CPU slowdown from observed task durations,
+ * so a run that shares a CPU with another run or with the editor's chat
+ * measures that interference too. One task per run measures the page alone,
+ * and all runs finish in about the time of one.
+ *
+ * Why the CLI owns it and not the stacks: `upgrade` never runs Pulumi, so
+ * existing installs get the job only from here, and a bucket or job both
+ * Pulumi and `upgrade` create would collide on the next wizard re-run (the
+ * same reasoning as operator-access.ts and upgrader-setup.ts).
+ *
+ * Trust boundary. The job's service account, `caelo-<env>-audit`, holds:
+ *
+ *   - `roles/storage.objectCreator` on the audit results bucket — create
+ *     only: it can neither read results back nor overwrite one;
+ *   - on `gcp` only, `roles/storage.objectViewer` on the staging and static
+ *     buckets: it serves the staged build to its own browser, as the admin's
+ *     audit does (admin-core quality/staged-origin.ts). gcp-firebase audits
+ *     the public preview channel and needs no bucket;
+ *   - `roles/logging.logWriter`.
+ *
+ * Nothing else: no Secret Manager, no Cloud SQL, and no VPC egress, so the
+ * database's private IP is not even routable from a task. Plugin data on a
+ * page comes the way any visitor gets it: the task's browser calls the
+ * site's public `/api/*` (the gateway, behind Cloud Armor) over the
+ * internet. The admin's run
+ * SA may run the job WITH overrides (`roles/run.jobsExecutorWithOverrides`:
+ * it passes each audit's batch of orders), read its executions
+ * (`roles/run.viewer`) and read the results bucket. Unlike the
+ * operator-access and upgrader jobs, overrides are acceptable here: a
+ * compromised admin can make the job load other URLs, but the job holds
+ * nothing worth taking. {@link AUDIT_FORBIDDEN_ROLES} names that line; the
+ * tests assert no grant crosses it.
+ */
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { gcloud as defaultGcloud } from "./gcloud.js";
+import { realSleep, runWithRetry } from "./gcloud-retry.js";
+import { auditJobName, auditServiceAccountEmail, auditServiceAccountId, gcpBucketName, runServiceAccountEmail, } from "./gcp-names.js";
+import { readAdminConfig } from "./migration-runner.js";
+import { describeAuditJobImage } from "./upgrade/audit-job-roll.js";
+/** Where the admin image ships the task's entry point. */
+export const AUDIT_TASK_SCRIPT = "/app/packages/admin-core/src/quality/audit-task.ts";
+/** How many audit tasks run at once by default: 5 pages x 3 runs. */
+export const AUDIT_PARALLELISM_DEFAULT = 15;
+/**
+ * Per task: container start, browser start, CPU benchmark and one
+ * Lighthouse run. Matches admin-core `parallelAuditTimeoutMs`, which the
+ * admin also passes per execution.
+ */
+const TASK_TIMEOUT = "5m";
+/**
+ * Roles the audit job's identity must never hold anywhere. Prefix matches
+ * (`roles/secretmanager.` = every Secret Manager role).
+ */
+export const AUDIT_FORBIDDEN_ROLES = [
+    "roles/owner",
+    "roles/editor",
+    "roles/run.",
+    "roles/iam.",
+    "roles/secretmanager.",
+    "roles/cloudsql.",
+    "roles/compute.",
+    "roles/resourcemanager.",
+    "roles/storage.admin",
+    "roles/storage.objectAdmin",
+    "roles/storage.objectUser",
+];
+/** Delete results after a day: the admin reads them within minutes. */
+export const AUDIT_RESULTS_LIFECYCLE = {
+    rule: [{ action: { type: "Delete" }, condition: { age: 1 } }],
+};
+/** Ensure the audit job and everything it needs. Never throws for a gcloud failure. */
+export async function ensureAuditJob(target, deps = {}) {
+    const run = deps.run ?? defaultGcloud;
+    const sleep = deps.sleep ?? realSleep;
+    const retry = (args) => runWithRetry(run, sleep, args);
+    const { projectId, region, env, provider } = target;
+    const project = `--project=${projectId}`;
+    const sa = auditServiceAccountEmail(projectId, env);
+    const member = `serviceAccount:${sa}`;
+    const runSaMember = `serviceAccount:${runServiceAccountEmail(projectId, env)}`;
+    const job = auditJobName(env);
+    const results = gcpBucketName(projectId, env, "audit-results");
+    const resultsUrl = `gs://${results}`;
+    const done = [];
+    const fail = (step, r) => ({
+        ok: false,
+        done,
+        error: `${step}: ${r.stderr.trim()}`,
+    });
+    if (!/@sha256:[0-9a-f]{64}$/.test(target.adminImageRef)) {
+        return {
+            ok: false,
+            done,
+            error: `the audit job's image must be pinned by digest, got ${target.adminImageRef}`,
+        };
+    }
+    if (target.parallelism !== undefined &&
+        (!Number.isInteger(target.parallelism) || target.parallelism < 1 || target.parallelism > 15)) {
+        return {
+            ok: false,
+            done,
+            error: `auditParallelism must be a whole number from 1 to 15, got ${target.parallelism}`,
+        };
+    }
+    // 1. The job's own service account.
+    const describe = await run([
+        "iam",
+        "service-accounts",
+        "describe",
+        sa,
+        project,
+        "--format=value(email)",
+    ]);
+    if (!describe.ok) {
+        const create = await run([
+            "iam",
+            "service-accounts",
+            "create",
+            auditServiceAccountId(env),
+            "--display-name=Caelo quality audit",
+            "--description=Runs the quality audit's Lighthouse runs in parallel; reads the staged build, writes audit results, nothing else.",
+            project,
+        ]);
+        if (!create.ok && !/already exists/i.test(create.stderr))
+            return fail(`create ${sa}`, create);
+    }
+    done.push(`service account ${sa}`);
+    // 2. The results bucket: private, results deleted after a day.
+    const owned = await run(["storage", "buckets", "list", project, "--format=value(name)"]);
+    if (!owned.ok)
+        return fail(`list the buckets of project ${projectId}`, owned);
+    const names = owned.stdout.split("\n").map((l) => l
+        .trim()
+        .replace(/^gs:\/\//, "")
+        .replace(/\/$/, ""));
+    if (!names.includes(results)) {
+        const created = await run([
+            "storage",
+            "buckets",
+            "create",
+            resultsUrl,
+            project,
+            `--location=${region}`,
+            "--default-storage-class=STANDARD",
+            "--uniform-bucket-level-access",
+            "--public-access-prevention",
+            "--soft-delete-duration=0",
+        ]);
+        if (!created.ok) {
+            return {
+                ok: false,
+                done,
+                error: /already exists|409/i.test(created.stderr)
+                    ? `${resultsUrl} exists but does not belong to project ${projectId}; delete or rename that bucket, this install needs the name`
+                    : `create ${resultsUrl}: ${created.stderr.trim()}`,
+            };
+        }
+    }
+    // A private directory (mkdtemp, mode 700): no other local user can swap
+    // the file between write and read.
+    const dir = mkdtempSync(join(tmpdir(), "caelo-audit-"));
+    try {
+        const file = join(dir, "lifecycle.json");
+        writeFileSync(file, JSON.stringify(AUDIT_RESULTS_LIFECYCLE), { mode: 0o600 });
+        const lifecycle = await run([
+            "storage",
+            "buckets",
+            "update",
+            resultsUrl,
+            project,
+            `--lifecycle-file=${file}`,
+        ]);
+        if (!lifecycle.ok)
+            return fail(`set the lifecycle of ${resultsUrl}`, lifecycle);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+    done.push(`bucket ${resultsUrl} (results deleted after 1 day)`);
+    // 3. Bucket grants: the job creates results and (gcp) reads the build;
+    //    the admin reads results.
+    const bucketGrants = [
+        { bucket: results, member, role: "roles/storage.objectCreator", why: "tasks write results" },
+        ...(provider === "gcp"
+            ? ["staging", "static"].map((b) => ({
+                bucket: gcpBucketName(projectId, env, b),
+                member,
+                role: "roles/storage.objectViewer",
+                why: "tasks serve the staged build to their browser",
+            }))
+            : []),
+        {
+            bucket: results,
+            member: runSaMember,
+            role: "roles/storage.objectViewer",
+            why: "the admin reads the results",
+        },
+    ];
+    for (const g of bucketGrants) {
+        const r = await retry([
+            "storage",
+            "buckets",
+            "add-iam-policy-binding",
+            `gs://${g.bucket}`,
+            `--member=${g.member}`,
+            `--role=${g.role}`,
+            project,
+            "--quiet",
+            "--format=none",
+        ]);
+        if (!r.ok)
+            return fail(`grant ${g.role} on gs://${g.bucket} (${g.why})`, r);
+        done.push(`${g.member === member ? "audit job" : "admin"}: ${g.role} on gs://${g.bucket}`);
+    }
+    // 4. Logs.
+    const logs = await retry([
+        "projects",
+        "add-iam-policy-binding",
+        projectId,
+        `--member=${member}`,
+        "--role=roles/logging.logWriter",
+        "--condition=None",
+        "--quiet",
+        "--format=none",
+    ]);
+    if (!logs.ok)
+        return fail("grant the audit job roles/logging.logWriter", logs);
+    done.push("audit job: roles/logging.logWriter on the project");
+    // 5. The job: the admin image, its own SA, no secrets, no VPC. A job
+    //    created without a parallelism would run every task at once with no
+    //    cap; an existing job keeps its own.
+    let parallelism = target.parallelism;
+    if (parallelism === undefined) {
+        const existing = await describeAuditJobImage(run, { projectId, region, env });
+        if (!existing.ok)
+            return { ok: false, done, error: `read job ${job}: ${existing.error}` };
+        if (existing.image === null)
+            parallelism = AUDIT_PARALLELISM_DEFAULT;
+    }
+    const envVars = [
+        `CAELO_PROVIDER=${provider}`,
+        `CAELO_AUDIT_RESULTS_BUCKET=${results}`,
+        ...(provider === "gcp"
+            ? [
+                `CAELO_STAGING_BUCKET=${gcpBucketName(projectId, env, "staging")}`,
+                `CAELO_STATIC_BUCKET=${gcpBucketName(projectId, env, "static")}`,
+            ]
+            : []),
+    ];
+    const deploy = await run([
+        "run",
+        "jobs",
+        "deploy",
+        job,
+        `--image=${target.adminImageRef}`,
+        `--region=${region}`,
+        project,
+        `--service-account=${sa}`,
+        "--command=bun",
+        `--args=--bun,${AUDIT_TASK_SCRIPT}`,
+        `--set-env-vars=${envVars.join(",")}`,
+        "--max-retries=0",
+        `--task-timeout=${TASK_TIMEOUT}`,
+        // Lighthouse wants two cores: the browser and the trace processing.
+        "--cpu=2",
+        "--memory=2Gi",
+        ...(parallelism !== undefined ? [`--parallelism=${parallelism}`] : []),
+        "--quiet",
+    ]);
+    if (!deploy.ok)
+        return fail(`deploy job ${job}`, deploy);
+    done.push(`job ${job} (${target.adminImageRef.split("@")[1]?.slice(0, 19)}...)`);
+    // 6. The admin may run it with its batch and read its executions.
+    for (const role of ["roles/run.jobsExecutorWithOverrides", "roles/run.viewer"]) {
+        const r = await retry([
+            "run",
+            "jobs",
+            "add-iam-policy-binding",
+            job,
+            `--region=${region}`,
+            project,
+            `--member=${runSaMember}`,
+            `--role=${role}`,
+            "--quiet",
+            "--format=none",
+        ]);
+        if (!r.ok)
+            return fail(`grant the admin ${role} on ${job}`, r);
+        done.push(`admin: ${role} on ${job}`);
+    }
+    return { ok: true, done };
+}
+/**
+ * {@link ensureAuditJob}'s image: the deployed admin's, so the job runs the
+ * code the admin runs.
+ */
+export async function resolveAdminImage(opts, deps = {}) {
+    const cfg = await readAdminConfig(opts, deps.run ?? defaultGcloud);
+    if (!cfg)
+        return {
+            ok: false,
+            error: "could not read the admin service's image (is the admin deployed?)",
+        };
+    return { ok: true, imageRef: cfg.imageRef };
+}
+//# sourceMappingURL=audit-job-setup.js.map

package/dist/audit-job-setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-job-setup.js","sourceRoot":"","sources":["../src/audit-job-setup.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,IAAI,aAAa,EAAqB,MAAM,aAAa,CAAC;AACzE,OAAO,EAAqB,SAAS,EAAE,YAAY,EAAc,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EACL,YAAY,EACZ,wBAAwB,EACxB,qBAAqB,EACrB,aAAa,EACb,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAEpE,0DAA0D;AAC1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,oDAAoD,CAAC;AAEtF,qEAAqE;AACrE,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAE5C;;;;GAIG;AACH,MAAM,YAAY,GAAG,IAAI,CAAC;AAE1B;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,aAAa;IACb,cAAc;IACd,YAAY;IACZ,YAAY;IACZ,sBAAsB;IACtB,iBAAiB;IACjB,gBAAgB;IAChB,wBAAwB;IACxB,qBAAqB;IACrB,2BAA2B;IAC3B,0BAA0B;CAClB,CAAC;AAEX,uEAAuE;AACvE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;CAC9D,CAAC;AAuBF,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAsB,EACtB,OAA8C,EAAE;IAEhD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACjE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IACpD,MAAM,OAAO,GAAG,aAAa,SAAS,EAAE,CAAC;IACzC,MAAM,EAAE,GAAG,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,kBAAkB,EAAE,EAAE,CAAC;IACtC,MAAM,WAAW,GAAG,kBAAkB,sBAAsB,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC;IAC/E,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,QAAQ,OAAO,EAAE,CAAC;IACrC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,CAAe,EAAkB,EAAE,CAAC,CAAC;QAC/D,EAAE,EAAE,KAAK;QACT,IAAI;QACJ,KAAK,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;KACrC,CAAC,CAAC;IAEH,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QACxD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI;YACJ,KAAK,EAAE,uDAAuD,MAAM,CAAC,aAAa,EAAE;SACrF,CAAC;IACJ,CAAC;IACD,IACE,MAAM,CAAC,WAAW,KAAK,SAAS;QAChC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,WAAW,GAAG,CAAC,IAAI,MAAM,CAAC,WAAW,GAAG,EAAE,CAAC,EAC5F,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI;YACJ,KAAK,EAAE,6DAA6D,MAAM,CAAC,WAAW,EAAE;SACzF,CAAC;IACJ,CAAC;IAED,oCAAoC;IACpC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;QACzB,KAAK;QACL,kBAAkB;QAClB,UAAU;QACV,EAAE;QACF,OAAO;QACP,uBAAuB;KACxB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;YACvB,KAAK;YACL,kBAAkB;YAClB,QAAQ;YACR,qBAAqB,CAAC,GAAG,CAAC;YAC1B,oCAAoC;YACpC,iIAAiI;YACjI,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;IAEnC,+DAA+D;IAC/D,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACzF,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,+BAA+B,SAAS,EAAE,EAAE,KAAK,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/C,CAAC;SACE,IAAI,EAAE;SACN,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACtB,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC;YACxB,SAAS;YACT,SAAS;YACT,QAAQ;YACR,UAAU;YACV,OAAO;YACP,cAAc,MAAM,EAAE;YACtB,kCAAkC;YAClC,+BAA+B;YAC/B,4BAA4B;YAC5B,0BAA0B;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI;gBACJ,KAAK,EAAE,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;oBAC/C,CAAC,CAAC,GAAG,UAAU,0CAA0C,SAAS,6DAA6D;oBAC/H,CAAC,CAAC,UAAU,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;aACrD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,wEAAwE;IACxE,mCAAmC;IACnC,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACzC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC;YAC1B,SAAS;YACT,SAAS;YACT,QAAQ;YACR,UAAU;YACV,OAAO;YACP,oBAAoB,IAAI,EAAE;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,wBAAwB,UAAU,EAAE,EAAE,SAAS,CAAC,CAAC;IAClF,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,UAAU,UAAU,gCAAgC,CAAC,CAAC;IAEhE,uEAAuE;IACvE,8BAA8B;IAC9B,MAAM,YAAY,GAAoE;QACpF,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,EAAE,GAAG,EAAE,qBAAqB,EAAE;QAC5F,GAAG,CAAC,QAAQ,KAAK,KAAK;YACpB,CAAC,CAAE,CAAC,SAAS,EAAE,QAAQ,CAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC3C,MAAM,EAAE,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;gBACxC,MAAM;gBACN,IAAI,EAAE,4BAA4B;gBAClC,GAAG,EAAE,+CAA+C;aACrD,CAAC,CAAC;YACL,CAAC,CAAC,EAAE,CAAC;QACP;YACE,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,WAAW;YACnB,IAAI,EAAE,4BAA4B;YAClC,GAAG,EAAE,6BAA6B;SACnC;KACF,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,SAAS;YACT,SAAS;YACT,wBAAwB;YACxB,QAAQ,CAAC,CAAC,MAAM,EAAE;YAClB,YAAY,CAAC,CAAC,MAAM,EAAE;YACtB,UAAU,CAAC,CAAC,IAAI,EAAE;YAClB,OAAO;YACP,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;QAC5E,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED,WAAW;IACX,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC;QACvB,UAAU;QACV,wBAAwB;QACxB,SAAS;QACT,YAAY,MAAM,EAAE;QACpB,gCAAgC;QAChC,kBAAkB;QAClB,SAAS;QACT,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,6CAA6C,EAAE,IAAI,CAAC,CAAC;IAC/E,IAAI,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;IAE/D,qEAAqE;IACrE,wEAAwE;IACxE,yCAAyC;IACzC,IAAI,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IACrC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,GAAG,KAAK,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;QAC1F,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI;YAAE,WAAW,GAAG,yBAAyB,CAAC;IACvE,CAAC;IACD,MAAM,OAAO,GAAG;QACd,kBAAkB,QAAQ,EAAE;QAC5B,8BAA8B,OAAO,EAAE;QACvC,GAAG,CAAC,QAAQ,KAAK,KAAK;YACpB,CAAC,CAAC;gBACE,wBAAwB,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,EAAE;gBAClE,uBAAuB,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE;aACjE;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;QACvB,KAAK;QACL,MAAM;QACN,QAAQ;QACR,GAAG;QACH,WAAW,MAAM,CAAC,aAAa,EAAE;QACjC,YAAY,MAAM,EAAE;QACpB,OAAO;QACP,qBAAqB,EAAE,EAAE;QACzB,eAAe;QACf,gBAAgB,iBAAiB,EAAE;QACnC,kBAAkB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACrC,iBAAiB;QACjB,kBAAkB,YAAY,EAAE;QAChC,oEAAoE;QACpE,SAAS;QACT,cAAc;QACd,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,iBAAiB,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,SAAS;KACV,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,cAAc,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IACzD,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,KAAK,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IAEjF,kEAAkE;IAClE,KAAK,MAAM,IAAI,IAAI,CAAC,qCAAqC,EAAE,kBAAkB,CAAC,EAAE,CAAC;QAC/E,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,KAAK;YACL,MAAM;YACN,wBAAwB;YACxB,GAAG;YACH,YAAY,MAAM,EAAE;YACpB,OAAO;YACP,YAAY,WAAW,EAAE;YACzB,UAAU,IAAI,EAAE;YAChB,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,mBAAmB,IAAI,OAAO,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,OAAO,GAAG,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAmF,EACnF,OAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC,CAAC;IACnE,IAAI,CAAC,GAAG;QACN,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,mEAAmE;SAC3E,CAAC;IACJ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;AAC9C,CAAC"}

package/dist/aws-task-roles.d.ts

@@ -8,7 +8,7 @@
  * provisioning tests can assert it.
  */
 /** The Secrets Manager entries the AWS stack creates (`caelo-<env>-<name>`). */
-export type AwsSecret = "postgres-password" | "public-role-password" | "gateway-role-password" | "csrf-secret" | "cookie-secret" | "anthropic-api-key" | "resend-api-key";
+export type AwsSecret = "postgres-password" | "public-role-password" | "csrf-secret" | "cookie-secret" | "anthropic-api-key" | "resend-api-key";
 /** A service with its own ECS task role. */
 export type AwsTaskService = "admin" | "gateway";
 /**

package/dist/aws-task-roles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aws-task-roles.d.ts","sourceRoot":"","sources":["../src/aws-task-roles.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AAEH,gFAAgF;AAChF,MAAM,MAAM,SAAS,GACjB,mBAAmB,GACnB,sBAAsB,GACtB,uBAAuB,GACvB,aAAa,GACb,eAAe,GACf,mBAAmB,GACnB,gBAAgB,CAAC;AAErB,4CAA4C;AAC5C,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,SAAS,CAAC;AAEjD;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,SAAS,SAAS,EAAE,CAAC,CAWtF,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAQvE"}
+{"version":3,"file":"aws-task-roles.d.ts","sourceRoot":"","sources":["../src/aws-task-roles.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AAEH,gFAAgF;AAChF,MAAM,MAAM,SAAS,GACjB,mBAAmB,GACnB,sBAAsB,GACtB,aAAa,GACb,eAAe,GACf,mBAAmB,GACnB,gBAAgB,CAAC;AAErB,4CAA4C;AAC5C,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,SAAS,CAAC;AAEjD;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,SAAS,SAAS,EAAE,CAAC,CAUtF,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAQvE"}

package/dist/aws-task-roles.js

@@ -8,7 +8,6 @@ export const AWS_SERVICE_SECRETS = {
     admin: [
         "postgres-password",
         "public-role-password",
-        "gateway-role-password",
         "csrf-secret",
         "cookie-secret",
         "anthropic-api-key",

package/dist/aws-task-roles.js.map

@@ -1 +1 @@
-{"version":3,"file":"aws-task-roles.js","sourceRoot":"","sources":["../src/aws-task-roles.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAyBnC;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA2D;IACzF,KAAK,EAAE;QACL,mBAAmB;QACnB,sBAAsB;QACtB,uBAAuB;QACvB,aAAa;QACb,eAAe;QACf,mBAAmB;QACnB,gBAAgB;KACjB;IACD,OAAO,EAAE,CAAC,sBAAsB,CAAC;CAClC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAA6B;IAC7D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAClF,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,OAAO,EAAE,YAAY;QACrB,SAAS,EAAE;YACT,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,+BAA+B,EAAE,QAAQ,EAAE,CAAC,GAAG,UAAU,CAAC,EAAE;SACxF;KACF,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"aws-task-roles.js","sourceRoot":"","sources":["../src/aws-task-roles.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAwBnC;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA2D;IACzF,KAAK,EAAE;QACL,mBAAmB;QACnB,sBAAsB;QACtB,aAAa;QACb,eAAe;QACf,mBAAmB;QACnB,gBAAgB;KACjB;IACD,OAAO,EAAE,CAAC,sBAAsB,CAAC;CAClC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAA6B;IAC7D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAClF,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,OAAO,EAAE,YAAY;QACrB,SAAS,EAAE;YACT,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,+BAA+B,EAAE,QAAQ,EAAE,CAAC,GAAG,UAAU,CAAC,EAAE;SACxF;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/caddy.d.ts

@@ -31,5 +31,14 @@ export declare function selfHostedAdminHost(domain: string): string;
  * public site, and Caddy refuses two site blocks for the same address.
  */
 export declare function selfHostedSeedDomains(domain: string, stagingDomain: string): CaddyDomainSpec[];
+/**
+ * Why `value` cannot go into the Caddyfile as one token, or null when it can.
+ * `init` checks the operator's domains and email with this before it writes
+ * anything, so a bad value never leaves a half-made install behind.
+ *
+ * @param kind `address` for a site address (hostname), `token` for any other value
+ */
+export declare function caddyTokenProblem(value: string, kind: "address" | "token"): string | null;
+/** Every caller-supplied value is checked before any of it is emitted (#888). */
 export declare function generateCaddyfile(spec: CaddyfileSpec): string;
 //# sourceMappingURL=caddy.d.ts.map

package/dist/caddy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"caddy.d.ts","sourceRoot":"","sources":["../src/caddy.ts"],"names":[],"mappings":"AA2DA,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAC;IAClC,QAAQ,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,CAAC;CACxC;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,UAAU,CAAC;AAE/C,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,kFAAkF;IAClF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,0FAA0F;IAC1F,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;CAClD;AAED,uFAAuF;AACvF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,eAAe,EAAE,CAM9F;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAqC7D"}
+{"version":3,"file":"caddy.d.ts","sourceRoot":"","sources":["../src/caddy.ts"],"names":[],"mappings":"AA2DA,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAC;IAClC,QAAQ,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,CAAC;CACxC;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,UAAU,CAAC;AAE/C,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,kFAAkF;IAClF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,0FAA0F;IAC1F,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;CAClD;AAED,uFAAuF;AACvF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,eAAe,EAAE,CAM9F;AAYD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,GAAG,MAAM,GAAG,IAAI,CAOzF;AAWD,iFAAiF;AACjF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CA4C7D"}

package/dist/caddy.js

@@ -68,9 +68,47 @@ export function selfHostedSeedDomains(domain, stagingDomain) {
         { hostname: stagingDomain, kind: "public", env: "staging" },
     ];
 }
+/**
+ * Characters that would let a value end its Caddyfile token and start new
+ * directives or blocks: whitespace (incl. newlines), both quote styles Caddy
+ * tokenizes (`"` and backtick), braces (blocks and `{placeholders}`), the
+ * comment marker, escapes and semicolons. A site address additionally may
+ * not hold a comma, which would add further addresses to the same block.
+ */
+const UNSAFE_CADDY_TOKEN_RE = /[\s"`{}#\\;]/;
+const UNSAFE_CADDY_ADDRESS_RE = /[\s"`{}#\\;,]/;
+/**
+ * Why `value` cannot go into the Caddyfile as one token, or null when it can.
+ * `init` checks the operator's domains and email with this before it writes
+ * anything, so a bad value never leaves a half-made install behind.
+ *
+ * @param kind `address` for a site address (hostname), `token` for any other value
+ */
+export function caddyTokenProblem(value, kind) {
+    if (value.length === 0)
+        return "it is empty";
+    const unsafe = kind === "address" ? UNSAFE_CADDY_ADDRESS_RE : UNSAFE_CADDY_TOKEN_RE;
+    if (unsafe.test(value)) {
+        return `it contains whitespace, a quote, a brace, '#', '\\', ';'${kind === "address" ? " or ','" : ""}`;
+    }
+    return null;
+}
+function assertSafeCaddyToken(label, value, kind) {
+    const problem = caddyTokenProblem(value, kind);
+    if (problem) {
+        throw new Error(`Caddyfile: invalid ${label} ${JSON.stringify(value)} — ${problem}. Fix the value in .caelo/config.json (or the domain you added) and run the command again.`);
+    }
+}
+/** Every caller-supplied value is checked before any of it is emitted (#888). */
 export function generateCaddyfile(spec) {
+    assertSafeCaddyToken("ownerEmail", spec.ownerEmail, "token");
+    assertSafeCaddyToken("publicSiteRoot", spec.publicSiteRoot, "token");
+    assertSafeCaddyToken("stagingSiteRoot", spec.stagingSiteRoot, "token");
+    assertSafeCaddyToken("adminUpstream", spec.adminUpstream, "token");
+    assertSafeCaddyToken("gatewayUpstream", spec.gatewayUpstream, "token");
     const hostnames = new Set();
     for (const d of spec.domains) {
+        assertSafeCaddyToken("hostname", d.hostname, "address");
         if (hostnames.has(d.hostname)) {
             // Caddy refuses a config with two site blocks for one address, so a
             // duplicate would take every vhost down, not just this one.

package/dist/caddy.js.map

@@ -1 +1 @@
-{"version":3,"file":"caddy.js","sourceRoot":"","sources":["../src/caddy.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,EACL,2BAA2B,EAC3B,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AA4B3B,uFAAuF;AACvF,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO,SAAS,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,aAAqB;IACzE,OAAO;QACL,EAAE,QAAQ,EAAE,mBAAmB,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE;QAC3E,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE;QACvD,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE;KAC5D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAmB;IACnD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,oEAAoE;YACpE,4DAA4D;YAC5D,MAAM,IAAI,KAAK,CACb,cAAc,CAAC,CAAC,QAAQ,iFAAiF,CAC1G,CAAC;QACJ,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,kBAAkB;IAClB,MAAM,CAAC,IAAI,CAAC;UACJ,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE;;CAE3E,CAAC,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9B,CAAC;IAED,oEAAoE;IACpE,8DAA8D;IAC9D,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC;;;kBAGE,IAAI,CAAC,aAAa;;CAEnC,CAAC,CAAC;IACD,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,KAAK,CAAC,CAAkB,EAAE,IAAmB;IACpD,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO;kBAClB,IAAI,CAAC,aAAa;;CAEnC,CAAC;IACA,CAAC;IACD,sEAAsE;IACtE,oEAAoE;IACpE,uBAAuB;IACvB,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IAC9E,6DAA6D;IAC7D,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO;WACvB,IAAI;IACX,oBAAoB,CAAC,IAAI,CAAC;;iCAEG,2BAA2B;;;0CAGlB,uBAAuB;;;;oBAI7C,IAAI,CAAC,eAAe;;;;;;;;;;;CAWvC,CAAC;AACF,CAAC"}
+{"version":3,"file":"caddy.js","sourceRoot":"","sources":["../src/caddy.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,EACL,2BAA2B,EAC3B,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AA4B3B,uFAAuF;AACvF,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO,SAAS,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,aAAqB;IACzE,OAAO;QACL,EAAE,QAAQ,EAAE,mBAAmB,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE;QAC3E,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE;QACvD,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE;KAC5D,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAG,cAAc,CAAC;AAC7C,MAAM,uBAAuB,GAAG,eAAe,CAAC;AAEhD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,IAAyB;IACxE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,qBAAqB,CAAC;IACpF,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,2DAA2D,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC1G,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa,EAAE,KAAa,EAAE,IAAyB;IACnF,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,sBAAsB,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,OAAO,4FAA4F,CAC9J,CAAC;IACJ,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,iBAAiB,CAAC,IAAmB;IACnD,oBAAoB,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC7D,oBAAoB,CAAC,gBAAgB,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACrE,oBAAoB,CAAC,iBAAiB,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IACvE,oBAAoB,CAAC,eAAe,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACnE,oBAAoB,CAAC,iBAAiB,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IAEvE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,oBAAoB,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACxD,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,oEAAoE;YACpE,4DAA4D;YAC5D,MAAM,IAAI,KAAK,CACb,cAAc,CAAC,CAAC,QAAQ,iFAAiF,CAC1G,CAAC;QACJ,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,kBAAkB;IAClB,MAAM,CAAC,IAAI,CAAC;UACJ,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE;;CAE3E,CAAC,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9B,CAAC;IAED,oEAAoE;IACpE,8DAA8D;IAC9D,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC;;;kBAGE,IAAI,CAAC,aAAa;;CAEnC,CAAC,CAAC;IACD,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,KAAK,CAAC,CAAkB,EAAE,IAAmB;IACpD,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO;kBAClB,IAAI,CAAC,aAAa;;CAEnC,CAAC;IACA,CAAC;IACD,sEAAsE;IACtE,oEAAoE;IACpE,uBAAuB;IACvB,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IAC9E,6DAA6D;IAC7D,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO;WACvB,IAAI;IACX,oBAAoB,CAAC,IAAI,CAAC;;iCAEG,2BAA2B;;;0CAGlB,uBAAuB;;;;oBAI7C,IAAI,CAAC,eAAe;;;;;;;;;;;CAWvC,CAAC;AACF,CAAC"}

package/dist/cli-routing.d.ts

@@ -30,4 +30,24 @@ export declare function resolveCliRoute(argv: readonly string[], handlerNames: I
  * end-to-end by the wizard rather than by printed manual Pulumi steps.
  */
 export declare function initDelegatesToWizard(provider: string): boolean;
+/** One documented `cms-provision` sub-command (the usage text and the public CLI reference). */
+export interface CliCommandDoc {
+    /** The sub-command as typed, e.g. `upgrade` or `state migrate`. */
+    readonly name: string;
+    /** Arguments and flags in usage notation; empty when it takes none. */
+    readonly args: string;
+    /** One sentence for an operator: what it does and when to run it. */
+    readonly summary: string;
+}
+/**
+ * The documented sub-commands, in usage order. The single source for both
+ * the usage text `cms-provision --help` prints ({@link cliUsage}) and the
+ * provisioning CLI page of the developer reference mirrored into the docs
+ * on every release (scripts/docs-reference.ts, #828), so the two never
+ * drift. Internal entry points (`install-job`, `agent`, the
+ * `*-self-hosted` aliases) are deliberately absent.
+ */
+export declare const CLI_COMMANDS: readonly CliCommandDoc[];
+/** The text `cms-provision --help` prints, built from {@link CLI_COMMANDS}. */
+export declare function cliUsage(): string;
 //# sourceMappingURL=cli-routing.d.ts.map

package/dist/cli-routing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-routing.d.ts","sourceRoot":"","sources":["../src/cli-routing.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AAEH,+CAA+C;AAC/C,MAAM,MAAM,QAAQ,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAElG;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,QAAQ,CAkBjG;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE/D"}
+{"version":3,"file":"cli-routing.d.ts","sourceRoot":"","sources":["../src/cli-routing.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AAEH,+CAA+C;AAC/C,MAAM,MAAM,QAAQ,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAElG;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,QAAQ,CAkBjG;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED,gGAAgG;AAChG,MAAM,WAAW,aAAa;IAC5B,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,qEAAqE;IACrE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,EAAE,SAAS,aAAa,EAsGhD,CAAC;AAEF,+EAA+E;AAC/E,wBAAgB,QAAQ,IAAI,MAAM,CAMjC"}

package/dist/cli-routing.js

@@ -34,4 +34,110 @@ export function resolveCliRoute(argv, handlerNames) {
 export function initDelegatesToWizard(provider) {
     return provider !== "self-hosted";
 }
+/**
+ * The documented sub-commands, in usage order. The single source for both
+ * the usage text `cms-provision --help` prints ({@link cliUsage}) and the
+ * provisioning CLI page of the developer reference mirrored into the docs
+ * on every release (scripts/docs-reference.ts, #828), so the two never
+ * drift. Internal entry points (`install-job`, `agent`, the
+ * `*-self-hosted` aliases) are deliberately absent.
+ */
+export const CLI_COMMANDS = [
+    {
+        name: "init",
+        args: "--domain <d> --owner-email <e> [--staging-domain <host>] [--version x.y.z] [--tls acme|internal] [--http-port 80] [--https-port 443]",
+        summary: "Self-hosted only: write the install's config with fresh secrets, verify the signed release images and start the Docker Compose stack; prints the Owner setup link. Cloud providers run the wizard instead.",
+    },
+    {
+        name: "up",
+        args: "",
+        summary: "Self-hosted only: converge the database roles, re-emit the Compose file and Caddyfile, and (re)start the stack.",
+    },
+    {
+        name: "migrate",
+        args: "",
+        summary: "Self-hosted only: apply the database migrations with the admin image the install runs. Idempotent.",
+    },
+    {
+        name: "status",
+        args: "[--install <id|domain|all>]",
+        summary: "Show the install's health and its estimated monthly cost.",
+    },
+    {
+        name: "upgrade",
+        args: "[--version x.y.z] [--channel stable|rc|beta] [--region <r>] [--skip-verify] [--skip-health-check] [--install <id|domain|all>]",
+        summary: "Roll the install to a newer release (latest stable by default) after verifying the image signatures.",
+    },
+    {
+        name: "backup",
+        args: "[--to <file>] [--install <id|domain|all>]",
+        summary: "Take a backup now: an on-demand Cloud SQL backup on cloud installs, an archive of the databases, published site and media on self-hosted.",
+    },
+    {
+        name: "restore",
+        args: "--from <backup.tar.gz> --yes",
+        summary: "Self-hosted only: replace both databases, the published site and the media with a backup archive. Destructive.",
+    },
+    {
+        name: "rotate-secret",
+        args: "<name>",
+        summary: "Rotate one of the install's runtime secrets; run without a name to list them.",
+    },
+    {
+        name: "truncate",
+        args: "",
+        summary: "Delete all content and history while keeping users, roles, providers, domains and settings. Destructive.",
+    },
+    {
+        name: "destroy",
+        args: "",
+        summary: "Permanently delete the install and every resource it created. Asks twice.",
+    },
+    {
+        name: "regenerate-caddy",
+        args: "",
+        summary: "Self-hosted only: re-emit the Caddyfile from the install's domains and reload Caddy.",
+    },
+    {
+        name: "admin-domain",
+        args: "enable",
+        summary: "gcp-firebase: bind admin.<domain> to the admin and wait for its TLS certificate (resumable).",
+    },
+    {
+        name: "staging-domain",
+        args: "enable [--staging-domain <host>] [--rotate-staging-password] [--show-staging-password]",
+        summary: "gcp-firebase: bind the protected staging host and set up its basic auth; prints the credentials on the first run.",
+    },
+    {
+        name: "owner-reset",
+        args: "[--install <id>] [--email <addr>]",
+        summary: "Print a one-time password-reset link for a locked-out Owner on installs whose admin cannot send email.",
+    },
+    {
+        name: "state migrate",
+        args: "[--install <id|domain>] [--to remote|local] [--dry-run] [--yes]",
+        summary: "Move the install's Pulumi state into (or out of) the install's own cloud project.",
+    },
+    {
+        name: "attach",
+        args: "--project <gcp-project-id>",
+        summary: "Set up this machine to manage an existing install whose state lives in its project.",
+    },
+    {
+        name: "pulumi-output-sync",
+        args: "",
+        summary: "Copy the stack outputs into the admin so its DNS and settings pages show current values; run after a manual `pulumi up`.",
+    },
+    {
+        name: "version",
+        args: "",
+        summary: "Print the CLI's version.",
+    },
+];
+/** The text `cms-provision --help` prints, built from {@link CLI_COMMANDS}. */
+export function cliUsage() {
+    return (`Usage: cms-provision [wizard] [--provider <name> --domain <d> [--staging-domain <host>] --owner-email <e> --region <r>] [--local|--install-job] | <${CLI_COMMANDS.map((c) => c.name).join("|")}> [options]\n` +
+        "With several installs on this machine, pick one with --install <install-id or domain> (status, upgrade and backup also take --install all); in a terminal you are asked otherwise.\n" +
+        "Pass --no-wizard with no sub-command to print this usage instead of the wizard.");
+}
 //# sourceMappingURL=cli-routing.js.map

package/dist/cli-routing.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli-routing.js","sourceRoot":"","sources":["../src/cli-routing.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAenC;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAuB,EAAE,YAA8B;IACrF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/D,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACzC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,oEAAoE;IACpE,0EAA0E;IAC1E,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,QAAQ,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,KAAK,aAAa,EAAE,CAAC;QAC5D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,OAAO,QAAQ,KAAK,aAAa,CAAC;AACpC,CAAC"}
+{"version":3,"file":"cli-routing.js","sourceRoot":"","sources":["../src/cli-routing.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAenC;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAuB,EAAE,YAA8B;IACrF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/D,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACzC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,oEAAoE;IACpE,0EAA0E;IAC1E,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,QAAQ,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,KAAK,aAAa,EAAE,CAAC;QAC5D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,OAAO,QAAQ,KAAK,aAAa,CAAC;AACpC,CAAC;AAYD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAA6B;IACpD;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,sIAAsI;QAC5I,OAAO,EACL,4MAA4M;KAC/M;IACD;QACE,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,EAAE;QACR,OAAO,EACL,iHAAiH;KACpH;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,EAAE;QACR,OAAO,EACL,oGAAoG;KACvG;IACD;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,6BAA6B;QACnC,OAAO,EAAE,2DAA2D;KACrE;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,+HAA+H;QACrI,OAAO,EACL,sGAAsG;KACzG;IACD;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,2CAA2C;QACjD,OAAO,EACL,2IAA2I;KAC9I;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,8BAA8B;QACpC,OAAO,EACL,gHAAgH;KACnH;IACD;QACE,IAAI,EAAE,eAAe;QACrB,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,+EAA+E;KACzF;IACD;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,EAAE;QACR,OAAO,EACL,0GAA0G;KAC7G;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,EAAE;QACR,OAAO,EAAE,2EAA2E;KACrF;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,IAAI,EAAE,EAAE;QACR,OAAO,EAAE,sFAAsF;KAChG;IACD;QACE,IAAI,EAAE,cAAc;QACpB,IAAI,EAAE,QAAQ;QACd,OAAO,EACL,8FAA8F;KACjG;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,IAAI,EAAE,wFAAwF;QAC9F,OAAO,EACL,mHAAmH;KACtH;IACD;QACE,IAAI,EAAE,aAAa;QACnB,IAAI,EAAE,mCAAmC;QACzC,OAAO,EACL,wGAAwG;KAC3G;IACD;QACE,IAAI,EAAE,eAAe;QACrB,IAAI,EAAE,iEAAiE;QACvE,OAAO,EAAE,mFAAmF;KAC7F;IACD;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,4BAA4B;QAClC,OAAO,EAAE,qFAAqF;KAC/F;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,IAAI,EAAE,EAAE;QACR,OAAO,EACL,0HAA0H;KAC7H;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,EAAE;QACR,OAAO,EAAE,0BAA0B;KACpC;CACF,CAAC;AAEF,+EAA+E;AAC/E,MAAM,UAAU,QAAQ;IACtB,OAAO,CACL,sJAAsJ,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe;QAC9M,sLAAsL;QACtL,iFAAiF,CAClF,CAAC;AACJ,CAAC"}