@caelo-cms/provisioning 0.10.53 → 0.10.57

package/dist/seal-key-rotation.d.ts

@@ -0,0 +1,38 @@
+import type { GcloudRunner } from "./gcloud-retry.js";
+/** The gateway env var holding the previous key during a rotation. */
+export declare const SEAL_KEY_PREVIOUS_ENV = "CAELO_MCP_OAUTH_SEAL_KEY_PREVIOUS";
+/** The gateway env var holding the current key (stack-contract SERVICE_SECRET_ENV). */
+export declare const SEAL_KEY_ENV = "CAELO_MCP_OAUTH_SEAL_KEY";
+/** Label on the gateway service: when the rotation started (epoch ms). */
+export declare const SEAL_ROTATION_LABEL = "caelo-seal-rotation-started";
+/**
+ * Days the previous key must stay: the broker's refresh-token lifetime
+ * (api-gateway mcp/token.ts REFRESH_MAX_LIFETIME_SECONDS, 30 days).
+ */
+export declare const SEAL_KEY_ROTATION_WINDOW_DAYS = 30;
+/** The deployed gateway a rotation works on. */
+export interface SealRotationTarget {
+    readonly projectId: string;
+    readonly region: string;
+    readonly env: string;
+    /** Deployed (Pulumi-suffixed) gateway Cloud Run service name. */
+    readonly gatewayService: string;
+}
+export interface SealRotationReport {
+    readonly ok: boolean;
+    readonly steps: string[];
+    readonly error?: string;
+}
+export interface SealRotationDeps {
+    readonly run?: GcloudRunner;
+    readonly nowMs?: () => number;
+    /** The new key (default: 32 random bytes, base64 — the secret's format). */
+    readonly generate?: () => string;
+}
+/** Start a rotation: new key at `latest`, the old one pinned as previous. */
+export declare function startSealKeyRotation(t: SealRotationTarget, deps?: SealRotationDeps): Promise<SealRotationReport>;
+/** Finish a rotation: drop the previous key once the window has passed. */
+export declare function finishSealKeyRotation(t: SealRotationTarget, deps?: SealRotationDeps, opts?: {
+    readonly now?: boolean;
+}): Promise<SealRotationReport>;
+//# sourceMappingURL=seal-key-rotation.d.ts.map

package/dist/seal-key-rotation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seal-key-rotation.d.ts","sourceRoot":"","sources":["../src/seal-key-rotation.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAKtD,sEAAsE;AACtE,eAAO,MAAM,qBAAqB,sCAAsC,CAAC;AACzE,uFAAuF;AACvF,eAAO,MAAM,YAAY,6BAA6B,CAAC;AACvD,0EAA0E;AAC1E,eAAO,MAAM,mBAAmB,gCAAgC,CAAC;AACjE;;;GAGG;AACH,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAIhD,gDAAgD;AAChD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,iEAAiE;IACjE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IAC9B,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,MAAM,CAAC;CAClC;AAuDD,6EAA6E;AAC7E,wBAAsB,oBAAoB,CACxC,CAAC,EAAE,kBAAkB,EACrB,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CAwE7B;AAED,2EAA2E;AAC3E,wBAAsB,qBAAqB,CACzC,CAAC,EAAE,kBAAkB,EACrB,IAAI,GAAE,gBAAqB,EAC3B,IAAI,GAAE;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAO,GACpC,OAAO,CAAC,kBAAkB,CAAC,CA4C7B"}

package/dist/seal-key-rotation.js

@@ -0,0 +1,206 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * Issue #806 — rotating the remote-MCP broker's seal key without signing
+ * every connected MCP client out.
+ *
+ * The broker seals its OAuth state, codes and refresh tokens under
+ * `CAELO_MCP_OAUTH_SEAL_KEY` (api-gateway mcp/seal.ts, envelope v2 with a
+ * key id). While `CAELO_MCP_OAUTH_SEAL_KEY_PREVIOUS` is set it also opens
+ * values sealed under that key, and seals everything new under the current
+ * one. Refresh tokens live at most {@link SEAL_KEY_ROTATION_WINDOW_DAYS}
+ * days (mcp/token.ts), so after that window nothing sealed under the old key
+ * is still valid and the previous key can go.
+ *
+ * Two steps, both `cms-provision rotate-secret mcp-oauth-seal-key`:
+ *
+ *   start   — add a new version to the secret, then roll the gateway with
+ *             the current key at `latest` and the previous key PINNED to
+ *             the version that was latest before (a pinned version never
+ *             follows the new one), labelled with the start time.
+ *   finish  — (`--finish`) once the window has passed: drop the previous key
+ *             and the label and roll again. `--finish --now` skips the
+ *             window — for a leaked key, where signing every client out is
+ *             the point.
+ *
+ * Refused instead of guessed (CLAUDE.md §2): starting while a rotation is in
+ * progress (a second start would pin the CURRENT key as "previous" and drop
+ * the real previous one early), and finishing before the window ends.
+ *
+ * A `cms-provision upgrade` whose `pulumi up` rewrites the gateway template
+ * during the window drops the previous key (the stack does not declare it):
+ * clients sealed under it sign in again. That fails safe — no token lives
+ * longer than intended — and is documented in the rotate output.
+ */
+import { gcloud as defaultGcloud } from "./gcloud.js";
+import { gcpSecretId } from "./gcp-names.js";
+import { initialSecretValue } from "./runtime-secrets.js";
+import { liveContainerEnv } from "./stack-converge.js";
+/** The gateway env var holding the previous key during a rotation. */
+export const SEAL_KEY_PREVIOUS_ENV = "CAELO_MCP_OAUTH_SEAL_KEY_PREVIOUS";
+/** The gateway env var holding the current key (stack-contract SERVICE_SECRET_ENV). */
+export const SEAL_KEY_ENV = "CAELO_MCP_OAUTH_SEAL_KEY";
+/** Label on the gateway service: when the rotation started (epoch ms). */
+export const SEAL_ROTATION_LABEL = "caelo-seal-rotation-started";
+/**
+ * Days the previous key must stay: the broker's refresh-token lifetime
+ * (api-gateway mcp/token.ts REFRESH_MAX_LIFETIME_SECONDS, 30 days).
+ */
+export const SEAL_KEY_ROTATION_WINDOW_DAYS = 30;
+const DAY_MS = 24 * 60 * 60 * 1000;
+async function gatewayState(run, t) {
+    const r = await run([
+        "run",
+        "services",
+        "describe",
+        t.gatewayService,
+        "--region",
+        t.region,
+        `--project=${t.projectId}`,
+        "--format=json",
+    ]);
+    if (!r.ok)
+        return { ok: false, error: `read the gateway service: ${r.stderr.trim()}` };
+    const env = liveContainerEnv(r.stdout);
+    const labels = JSON.parse(r.stdout).metadata?.labels ??
+        {};
+    const raw = labels[SEAL_ROTATION_LABEL];
+    const started = raw !== undefined && /^\d+$/.test(raw) ? Number(raw) : null;
+    const current = env.get(SEAL_KEY_ENV);
+    if (current?.kind !== "secret") {
+        return {
+            ok: false,
+            error: `${SEAL_KEY_ENV} on ${t.gatewayService} is not a Secret Manager reference — run \`cms-provision upgrade\` first (it installs remote MCP's secrets).`,
+        };
+    }
+    return {
+        ok: true,
+        state: { previousPinned: env.has(SEAL_KEY_PREVIOUS_ENV), startedAtMs: started },
+    };
+}
+function rollFlip(t) {
+    return [
+        "run",
+        "services",
+        "update-traffic",
+        t.gatewayService,
+        "--region",
+        t.region,
+        `--project=${t.projectId}`,
+        "--to-latest",
+        "--quiet",
+    ];
+}
+/** Start a rotation: new key at `latest`, the old one pinned as previous. */
+export async function startSealKeyRotation(t, deps = {}) {
+    const run = deps.run ?? defaultGcloud;
+    const now = (deps.nowMs ?? Date.now)();
+    const generate = deps.generate ?? (() => initialSecretValue("mcp-oauth-seal-key"));
+    const secretId = gcpSecretId(t.env, "mcp-oauth-seal-key");
+    const project = `--project=${t.projectId}`;
+    const steps = [];
+    const live = await gatewayState(run, t);
+    if (!live.ok)
+        return { ok: false, steps, error: live.error };
+    if (live.state.previousPinned) {
+        const since = live.state.startedAtMs;
+        return {
+            ok: false,
+            steps,
+            error: `A seal-key rotation is already in progress${since ? ` (started ${new Date(since).toISOString()})` : ""}. Finish it first with \`cms-provision rotate-secret mcp-oauth-seal-key --finish\` once ${SEAL_KEY_ROTATION_WINDOW_DAYS} days have passed; starting again now would drop the previous key early.`,
+        };
+    }
+    const latest = await run([
+        "secrets",
+        "versions",
+        "describe",
+        "latest",
+        `--secret=${secretId}`,
+        project,
+        "--format=value(name)",
+    ]);
+    const version = /\/versions\/(\d+)\s*$/.exec(latest.stdout.trim())?.[1];
+    if (!latest.ok || !version) {
+        return {
+            ok: false,
+            steps,
+            error: `find the current version of ${secretId}: ${latest.ok ? `unexpected answer "${latest.stdout.trim()}"` : latest.stderr.trim()}`,
+        };
+    }
+    const add = await run(["secrets", "versions", "add", secretId, project, "--data-file=-"], {
+        stdin: generate(),
+    });
+    if (!add.ok) {
+        return { ok: false, steps, error: `add a version to ${secretId}: ${add.stderr.trim()}` };
+    }
+    steps.push(`added a new version to ${secretId} (the previous key is version ${version})`);
+    const update = [
+        "run",
+        "services",
+        "update",
+        t.gatewayService,
+        "--region",
+        t.region,
+        project,
+        `--update-secrets=${SEAL_KEY_ENV}=${secretId}:latest,${SEAL_KEY_PREVIOUS_ENV}=${secretId}:${version}`,
+        `--update-labels=${SEAL_ROTATION_LABEL}=${now}`,
+        "--quiet",
+    ];
+    const rolled = await run(update);
+    const flipped = rolled.ok ? await run(rollFlip(t)) : rolled;
+    if (!flipped.ok) {
+        return {
+            ok: false,
+            steps,
+            error: `The new key is stored but the gateway does not use it yet. Do not rotate again — roll the gateway:\n    gcloud ${update.join(" ")}\n    gcloud ${rollFlip(t).join(" ")}\n(${flipped.stderr.trim()})`,
+        };
+    }
+    steps.push(`rolled the gateway onto the new key; tokens sealed under version ${version} keep working`, `finish after ${new Date(now + SEAL_KEY_ROTATION_WINDOW_DAYS * DAY_MS).toISOString()} with: cms-provision rotate-secret mcp-oauth-seal-key --finish`, "a `cms-provision upgrade` before then drops the previous key early: clients sealed under it sign in again");
+    return { ok: true, steps };
+}
+/** Finish a rotation: drop the previous key once the window has passed. */
+export async function finishSealKeyRotation(t, deps = {}, opts = {}) {
+    const run = deps.run ?? defaultGcloud;
+    const now = (deps.nowMs ?? Date.now)();
+    const steps = [];
+    const live = await gatewayState(run, t);
+    if (!live.ok)
+        return { ok: false, steps, error: live.error };
+    if (!live.state.previousPinned) {
+        return {
+            ok: false,
+            steps,
+            error: `No seal-key rotation is in progress on ${t.gatewayService} (${SEAL_KEY_PREVIOUS_ENV} is not set). Start one with \`cms-provision rotate-secret mcp-oauth-seal-key\`.`,
+        };
+    }
+    const started = live.state.startedAtMs;
+    const due = started === null ? null : started + SEAL_KEY_ROTATION_WINDOW_DAYS * DAY_MS;
+    if (!opts.now && (due === null || now < due)) {
+        return {
+            ok: false,
+            steps,
+            error: due === null
+                ? `The gateway has ${SEAL_KEY_PREVIOUS_ENV} but no ${SEAL_ROTATION_LABEL} label, so the rotation's start is unknown. Wait ${SEAL_KEY_ROTATION_WINDOW_DAYS} days from when it started, then run --finish --now.`
+                : `The previous key still opens refresh tokens until ${new Date(due).toISOString()} (${SEAL_KEY_ROTATION_WINDOW_DAYS}-day lifetime). Finishing now would sign those clients out; run --finish after that time, or --finish --now if the old key leaked.`,
+        };
+    }
+    const update = [
+        "run",
+        "services",
+        "update",
+        t.gatewayService,
+        "--region",
+        t.region,
+        `--project=${t.projectId}`,
+        `--remove-secrets=${SEAL_KEY_PREVIOUS_ENV}`,
+        `--remove-labels=${SEAL_ROTATION_LABEL}`,
+        "--quiet",
+    ];
+    const rolled = await run(update);
+    const flipped = rolled.ok ? await run(rollFlip(t)) : rolled;
+    if (!flipped.ok) {
+        return { ok: false, steps, error: `roll the gateway: ${flipped.stderr.trim()}` };
+    }
+    steps.push("removed the previous seal key from the gateway; the rotation is complete");
+    return { ok: true, steps };
+}
+//# sourceMappingURL=seal-key-rotation.js.map

package/dist/seal-key-rotation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seal-key-rotation.js","sourceRoot":"","sources":["../src/seal-key-rotation.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,sEAAsE;AACtE,MAAM,CAAC,MAAM,qBAAqB,GAAG,mCAAmC,CAAC;AACzE,uFAAuF;AACvF,MAAM,CAAC,MAAM,YAAY,GAAG,0BAA0B,CAAC;AACvD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,mBAAmB,GAAG,6BAA6B,CAAC;AACjE;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEhD,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AA6BnC,KAAK,UAAU,YAAY,CACzB,GAAiB,EACjB,CAAqB;IAErB,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC;QAClB,KAAK;QACL,UAAU;QACV,UAAU;QACV,CAAC,CAAC,cAAc;QAChB,UAAU;QACV,CAAC,CAAC,MAAM;QACR,aAAa,CAAC,CAAC,SAAS,EAAE;QAC1B,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACvF,MAAM,GAAG,GAAG,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,MAAM,GACT,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAwD,CAAC,QAAQ,EAAE,MAAM;QAC7F,EAAE,CAAC;IACL,MAAM,GAAG,GAAG,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACtC,IAAI,OAAO,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,YAAY,OAAO,CAAC,CAAC,cAAc,8GAA8G;SAC5J,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,EAAE,cAAc,EAAE,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE;KAChF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,CAAqB;IACrC,OAAO;QACL,KAAK;QACL,UAAU;QACV,gBAAgB;QAChB,CAAC,CAAC,cAAc;QAChB,UAAU;QACV,CAAC,CAAC,MAAM;QACR,aAAa,CAAC,CAAC,SAAS,EAAE;QAC1B,aAAa;QACb,SAAS;KACV,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,CAAqB,EACrB,OAAyB,EAAE;IAE3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACnF,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,SAAS,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IAC7D,IAAI,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;QACrC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK;YACL,KAAK,EAAE,6CAA6C,KAAK,CAAC,CAAC,CAAC,aAAa,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,2FAA2F,6BAA6B,0EAA0E;SACjT,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;QACvB,SAAS;QACT,UAAU;QACV,UAAU;QACV,QAAQ;QACR,YAAY,QAAQ,EAAE;QACtB,OAAO;QACP,sBAAsB;KACvB,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK;YACL,KAAK,EAAE,+BAA+B,QAAQ,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;SACtI,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,CAAC,EAAE;QACxF,KAAK,EAAE,QAAQ,EAAE;KAClB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,QAAQ,KAAK,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IAC3F,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,0BAA0B,QAAQ,iCAAiC,OAAO,GAAG,CAAC,CAAC;IAE1F,MAAM,MAAM,GAAG;QACb,KAAK;QACL,UAAU;QACV,QAAQ;QACR,CAAC,CAAC,cAAc;QAChB,UAAU;QACV,CAAC,CAAC,MAAM;QACR,OAAO;QACP,oBAAoB,YAAY,IAAI,QAAQ,WAAW,qBAAqB,IAAI,QAAQ,IAAI,OAAO,EAAE;QACrG,mBAAmB,mBAAmB,IAAI,GAAG,EAAE;QAC/C,SAAS;KACV,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5D,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK;YACL,KAAK,EAAE,kHAAkH,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG;SAC7M,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CACR,oEAAoE,OAAO,eAAe,EAC1F,gBAAgB,IAAI,IAAI,CAAC,GAAG,GAAG,6BAA6B,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,gEAAgE,EACpJ,2GAA2G,CAC5G,CAAC;IACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,CAAqB,EACrB,OAAyB,EAAE,EAC3B,OAAmC,EAAE;IAErC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACvC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IAC7D,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC/B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK;YACL,KAAK,EAAE,0CAA0C,CAAC,CAAC,cAAc,KAAK,qBAAqB,kFAAkF;SAC9K,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;IACvC,MAAM,GAAG,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,GAAG,6BAA6B,GAAG,MAAM,CAAC;IACvF,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK;YACL,KAAK,EACH,GAAG,KAAK,IAAI;gBACV,CAAC,CAAC,mBAAmB,qBAAqB,WAAW,mBAAmB,oDAAoD,6BAA6B,sDAAsD;gBAC/M,CAAC,CAAC,qDAAqD,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,6BAA6B,oIAAoI;SAC7P,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG;QACb,KAAK;QACL,UAAU;QACV,QAAQ;QACR,CAAC,CAAC,cAAc;QAChB,UAAU;QACV,CAAC,CAAC,MAAM;QACR,aAAa,CAAC,CAAC,SAAS,EAAE;QAC1B,oBAAoB,qBAAqB,EAAE;QAC3C,mBAAmB,mBAAmB,EAAE;QACxC,SAAS;KACV,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5D,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACnF,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAC;IACvF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC"}

package/dist/stack-contract.d.ts

@@ -130,6 +130,20 @@ export declare const OPERATOR_ACCESS_JOB_ENV_VAR = "CAELO_OPERATOR_ACCESS_JOB";
  * could not set the job up.
  */
 export declare const UPGRADER_JOB_ENV_VAR = "CAELO_UPGRADER_JOB";
+/**
+ * The admin env var naming the converge job (#819) — what "Install update"
+ * starts for a release that changes the cloud setup. `upgrade` leaves it
+ * untouched when it could not set the job up.
+ */
+export declare const CONVERGE_JOB_ENV_VAR = "CAELO_CONVERGE_JOB";
+/**
+ * #875 — the admin env vars naming the parallel quality-audit job and the
+ * bucket its tasks write results into (admin-core quality/
+ * gcp-audit-launcher.ts). `upgrade` leaves them untouched when it could not
+ * set the job up.
+ */
+export declare const AUDIT_JOB_ENV_VAR = "CAELO_AUDIT_JOB";
+export declare const AUDIT_RESULTS_BUCKET_ENV_VAR = "CAELO_AUDIT_RESULTS_BUCKET";
 /**
  * Where the admin keeps media: the image's default media root
  * (`/app/apps/admin` + `data/media`), now the mount point of the media
@@ -181,7 +195,19 @@ export declare function adminMediaVolumeTemplate(volume: MediaVolumeContract): {
  * The Secret Manager secrets admin + gateway read at runtime, by logical
  * name ({@link gcpSecretId} gives the secret id).
  */
-export type RuntimeSecret = "postgres-password" | "public-role-password" | "secret-kek" | "internal-secret" | "tool-approval-secret" | "staging-gate-secret";
+export type RuntimeSecret = "postgres-password" | "public-role-password" | "secret-kek" | "internal-secret" | "tool-approval-secret" | "staging-gate-secret"
+/**
+ * #806 — the Google OAuth client the remote-MCP broker signs users in
+ * with: JSON `{"client_id","client_secret"}`, `{}` while remote MCP is not
+ * set up. The Owner writes it from Settings → MCP → Remote (the admin may
+ * add versions, never read them); the gateway reads it from a file.
+ */
+ | "mcp-oauth-client"
+/**
+ * #806 — the broker's AES-256-GCM key (base64, 32 bytes) that seals its
+ * stateless OAuth state, codes and refresh tokens. Gateway only.
+ */
+ | "mcp-oauth-seal-key";
 /** The Postgres roles Caelo's services log in as, with their passwords. */
 export type DatabaseRole = "admin_role" | "public_role";
 /**
@@ -199,7 +225,21 @@ export declare const DATABASE_ROLE_SECRET: Readonly<Record<DatabaseRole, Runtime
  * Pulumi only references them, so a `pulumi up` after an upgrade never
  * collides with a secret upgrade created.
  */
-export declare const CLI_GENERATED_SECRETS: readonly ["internal-secret", "tool-approval-secret", "public-role-password", "staging-gate-secret"];
+export declare const CLI_GENERATED_SECRETS: readonly ["internal-secret", "tool-approval-secret", "public-role-password", "staging-gate-secret", "mcp-oauth-client", "mcp-oauth-seal-key"];
+/** A CLI-generated secret's first value: random hex, random base64, or a fixed placeholder. */
+export type GeneratedSecretFormat = {
+    readonly kind: "hex32";
+} | {
+    readonly kind: "base64-32";
+} | {
+    readonly kind: "placeholder";
+    readonly value: string;
+};
+/**
+ * How each CLI-generated secret's first version is made. Every secret not
+ * listed is 32 random bytes as hex — the shape the stacks always generated.
+ */
+export declare const GENERATED_SECRET_FORMAT: Readonly<Record<(typeof CLI_GENERATED_SECRETS)[number], GeneratedSecretFormat>>;
 /**
  * Each service's Secret Manager-backed env vars and the secret each reads.
  * The services' run SAs get `secretAccessor` on exactly these secrets
@@ -207,7 +247,57 @@ export declare const CLI_GENERATED_SECRETS: readonly ["internal-secret", "tool-a
  * boundary between the two services.
  */
 export declare const SERVICE_SECRET_ENV: Readonly<Record<CloudRunSlug, Readonly<Record<string, RuntimeSecret>>>>;
-/** The secrets `service` reads (deduplicated, table order). */
+/** Env var naming the file that holds the remote-MCP Google OAuth client. */
+export declare const MCP_OAUTH_CLIENT_FILE_ENV = "CAELO_MCP_OAUTH_CLIENT_FILE";
+/**
+ * A Secret Manager secret mounted into a service as one file, at `latest`.
+ *
+ * Why a file and not an env var: Cloud Run resolves a secret env var once,
+ * at instance start, but reads a secret volume from Secret Manager each
+ * time the file is read ("When reading a volume, Cloud Run always fetches
+ * the secret value from the Secret Manager to use the value with the latest
+ * version" — cloud.google.com/run/docs/configuring/services/secrets). So the
+ * client the Owner saves under Settings → MCP reaches the running gateway
+ * (which re-reads it within 60 s) without a new revision, and the admin
+ * needs no right to deploy the gateway.
+ */
+export interface SecretFileContract {
+    readonly secret: RuntimeSecret;
+    /** Volume name the stacks give it (gcloud names the ones upgrade adds itself). */
+    readonly volumeName: string;
+    /** Directory the volume is mounted at; must not exist in the image. */
+    readonly mountDir: string;
+    readonly fileName: string;
+    /** Always `latest`: a pinned version would never see the Owner's new client. */
+    readonly version: "latest";
+}
+/** The gateway's remote-MCP OAuth client file (#806). */
+export declare const MCP_OAUTH_CLIENT_FILE: SecretFileContract;
+/** Full path of a secret file inside the container. */
+export declare function secretFilePath(file: SecretFileContract): string;
+/** Each service's secret files. The admin has none. */
+export declare const SERVICE_SECRET_FILES: Readonly<Record<CloudRunSlug, readonly SecretFileContract[]>>;
+/**
+ * The secret files of `service` in the shape `gcp.cloudrunv2.Service`
+ * takes: `volumes` on the template, `volumeMounts` on the container.
+ */
+export declare function secretFileVolumesTemplate(service: CloudRunSlug, env: string): {
+    readonly volumes: {
+        name: string;
+        secret: {
+            secret: string;
+            items: {
+                version: string;
+                path: string;
+            }[];
+        };
+    }[];
+    readonly volumeMounts: {
+        name: string;
+        mountPath: string;
+    }[];
+};
+/** The secrets `service` reads, as env or as files (deduplicated, table order). */
 export declare function serviceSecrets(service: CloudRunSlug): RuntimeSecret[];
 /**
  * Env vars an older stack set that the contract no longer gives a service;
@@ -237,6 +327,88 @@ export declare const GATEWAY_TRUSTED_PROXY_HOPS: Readonly<Record<SupportedProvid
  * spurious diffs.
  */
 export declare function gatewayEnvContract<V>(inputs: RuntimeEnvInputs<V>): CloudRunEnvVar<V | string>[];
+/**
+ * #806 — the gateway's request timeout, in seconds: Cloud Run's maximum.
+ * The gateway proxies remote-MCP requests to the admin, and a `caelo_chat`
+ * turn streams for as long as the admin's own chat stream may (the admin
+ * runs at 3600 s for the same reason). Visitor endpoints are unaffected: a
+ * timeout is a ceiling, not a reservation, and Cloud Run bills request time,
+ * not the allowed maximum. On `gcp` the load balancer in front adds no
+ * shorter limit — the backend-service timeout does not apply to serverless
+ * NEGs, which get a fixed 60 minutes
+ * (cloud.google.com/load-balancing/docs/negs/serverless-neg-concepts).
+ */
+export declare const GATEWAY_TIMEOUT_SECONDS = 3600;
+/** Admin env var naming the Secret Manager secret the Owner writes the OAuth client to. */
+export declare const MCP_OAUTH_CLIENT_STORE_ENV = "CAELO_MCP_OAUTH_CLIENT_STORE";
+/** `projects/<project>/secrets/<id>` of the remote-MCP OAuth client secret. */
+export declare function mcpOAuthClientSecretResource(projectId: string, env: string): string;
+/**
+ * The remote-MCP env vars that name generated identities of the install:
+ * the admin's URL, the gateway's public origin, and the audience of the IAP
+ * JWTs the admin verifies.
+ *
+ * They are not part of {@link adminEnvContract} / {@link gatewayEnvContract}
+ * because the stacks cannot declare them: on `gcp-firebase` each service's
+ * value names a Cloud Run service Pulumi auto-names (the admin's audience is
+ * its own name; the gateway's public URL is its own URL; the admin's URL is
+ * a service created after the gateway), and on `gcp` the audience is the
+ * numeric id of a backend service created after the admin. A resource
+ * cannot take its own (or a later resource's) output as input. So the CLI
+ * reads the live identities after deploy and applies these vars with gcloud
+ * — the wizard after every `pulumi up`, `upgrade` after every roll
+ * (remote-mcp.ts `ensureRemoteMcpIdentityEnv`). A roll that does not set
+ * them leaves them as they are (planEnvUpdate never removes a var the
+ * contract does not own).
+ */
+export interface RemoteMcpIdentity {
+    /** Where the gateway proxies `/api/mcp/<surface>` to (IAP in front). */
+    readonly adminUrl: string;
+    /** The broker's public origin; no trailing slash. */
+    readonly mcpPublicUrl: string;
+    /** The `aud` of the admin's IAP JWTs. */
+    readonly iapAudience: string;
+}
+/** Env var names of {@link RemoteMcpIdentity}. */
+export declare const REMOTE_MCP_ENV: {
+    readonly adminUrl: "CAELO_ADMIN_URL";
+    readonly mcpPublicUrl: "CAELO_MCP_PUBLIC_URL";
+    readonly iapAudience: "CAELO_IAP_AUDIENCE";
+};
+/** What {@link remoteMcpIdentity} derives the identity from — all read from the live install. */
+export type RemoteMcpIdentityInputs = {
+    readonly provider: "gcp";
+    readonly domain: string;
+    readonly projectNumber: string;
+    /** Numeric `id` of the admin's IAP-enabled backend service. */
+    readonly adminBackendServiceId: string;
+} | {
+    readonly provider: "gcp-firebase";
+    readonly projectNumber: string;
+    readonly region: string;
+    readonly adminServiceName: string;
+    /** The services' `status.url` (`https://<name>-<hash>-<r>.a.run.app`). */
+    readonly adminServiceUrl: string;
+    readonly gatewayServiceUrl: string;
+};
+/**
+ * The install's remote-MCP identity.
+ *
+ * - `gcp`: the broker answers on the site's own host through the load
+ *   balancer (`/api/*` and the `/.well-known/oauth-*` path rules), the admin
+ *   on `admin.<domain>` behind the LB's IAP; the IAP audience is
+ *   `/projects/<number>/global/backendServices/<id>`.
+ * - `gcp-firebase`: the broker answers on the gateway's own Cloud Run URL
+ *   (Firebase Hosting rewrites cut requests at 60 s and buffer streams), the
+ *   admin on its Cloud Run URL behind native IAP — whatever custom domain
+ *   is mapped to it, IAP and its audience are the service's; the audience
+ *   is `/projects/<number>/locations/<region>/services/<name>`.
+ *
+ * Audience formats: cloud.google.com/iap/docs/signed-headers-howto.
+ */
+export declare function remoteMcpIdentity(i: RemoteMcpIdentityInputs): RemoteMcpIdentity;
+/** {@link RemoteMcpIdentity} as each service's env vars. */
+export declare function remoteMcpIdentityEnv(id: RemoteMcpIdentity): Record<CloudRunSlug, CloudRunEnvVar[]>;
 /**
  * The env of the admin service.
  *

package/dist/stack-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stack-contract.d.ts","sourceRoot":"","sources":["../src/stack-contract.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAatD,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,cAAc,CAAC;AACjD,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,SAAS,CAAC;AAE/C;;;;GAIG;AACH,MAAM,MAAM,cAAc,CAAC,CAAC,GAAG,MAAM,IACjC;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAC5C;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE;QACpB,QAAQ,CAAC,YAAY,EAAE;YAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC;KACzE,CAAC;CACH,CAAC;AAEN,yDAAyD;AACzD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,8EAA8E;AAC9E,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,MAAM;IACtC,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;IAClB,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;CACpB;AAKD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAQvD;AAED,kFAAkF;AAClF,MAAM,WAAW,gBAAgB,CAAC,CAAC,GAAG,MAAM,CAAE,SAAQ,gBAAgB;IACpE,+DAA+D;IAC/D,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;CACxC;AAED;;;;;GAKG;AACH,MAAM,MAAM,cAAc,CAAC,CAAC,GAAG,MAAM,IACjC,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG;IAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAA;CAAE,CAAC,GACpD,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG;IACrB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC;CAC5B,CAAC,CAAC;AAEP,qFAAqF;AACrF,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,6DAA6D;AAC7D,eAAO,MAAM,gBAAgB,uBAAuB,CAAC;AAErD;;;GAGG;AACH,eAAO,MAAM,WAAW,kCAAkC,CAAC;AAE3D;;;GAGG;AACH,eAAO,MAAM,2BAA2B,8BAA8B,CAAC;AAEvE;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,uBAAuB,CAAC;AASzD;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,+BAA+B,CAAC;AAE7D,gDAAgD;AAChD,eAAO,MAAM,iBAAiB,UAAU,CAAC;AAEzC;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,8CAA8C;AAC9C,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,mBAAmB,CAMpF;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,mBAAmB;;;;;;;;;;;;;EAMnE;AAMD;;;GAGG;AACH,MAAM,MAAM,aAAa,GACrB,mBAAmB,GACnB,sBAAsB,GACtB,YAAY,GACZ,iBAAiB,GACjB,sBAAsB,GACtB,qBAAqB,CAAC;AAE1B,2EAA2E;AAC3E,MAAM,MAAM,YAAY,GAAG,YAAY,GAAG,aAAa,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,aAAa,CAAC,CAG9E,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,qGAUW,CAAC;AAE9C;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CACvC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CAuB9D,CAAC;AAEF,+DAA+D;AAC/D,wBAAgB,cAAc,CAAC,OAAO,EAAE,YAAY,GAAG,aAAa,EAAE,CAErE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC,CAUjF,CAAC;AAyBF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,6BAA6B,CAAC;AAEjE;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAmBlF,CAAC;AAEF;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,CAO/F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,CAiD3F;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB;;;;;CAKpB,CAAC;AAEX,6CAA6C;AAC7C,MAAM,MAAM,YAAY;AACtB,gEAAgE;AAC9D,QAAQ;AACV,0CAA0C;GACxC,YAAY;AACd,6CAA6C;GAC3C,qBAAqB;AACvB,8EAA8E;GAC5E,mBAAmB,GACnB,UAAU,CAAC;AAEf,wDAAwD;AACxD,MAAM,MAAM,SAAS,GACjB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAA;CAAE,GAC5E;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;CAAE,CAAC;AAErE;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,CAAC;IACrC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAID,4EAA4E;AAC5E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,wEAAwE;IACxE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,oBAAoB,EAAE,CAS9D;AA+ID;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,iBAAiB,EAa5D,CAAC;AAEF,qEAAqE;AACrE,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,WAAW,GAAG,YAAY,EAAE,CAMxE;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAiBvF,CAAC;AAEF,mEAAmE;AACnE,wBAAgB,SAAS,CACvB,SAAS,EAAE,YAAY,EACvB,OAAO,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC5F,MAAM,CAaR;AAMD,6EAA6E;AAC7E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;IAC5C,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,gFAAgF;IAChF,QAAQ,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAE7C;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAAS,yBAAyB,EAiC7E,CAAC;AAEF,yEAAyE;AACzE,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,SAAS;IAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EAAE,EACvF,YAAY,EAAE,SAAS,MAAM,EAAE,GAC9B,MAAM,CAKR;AAED,qFAAqF;AACrF,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,QAAQ,CAAC;AAE1C;;;GAGG;AACH;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG;IAC5D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAQA;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAcjE"}
+{"version":3,"file":"stack-contract.d.ts","sourceRoot":"","sources":["../src/stack-contract.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAetD,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,cAAc,CAAC;AACjD,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,SAAS,CAAC;AAE/C;;;;GAIG;AACH,MAAM,MAAM,cAAc,CAAC,CAAC,GAAG,MAAM,IACjC;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAC5C;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE;QACpB,QAAQ,CAAC,YAAY,EAAE;YAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC;KACzE,CAAC;CACH,CAAC;AAEN,yDAAyD;AACzD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,8EAA8E;AAC9E,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,MAAM;IACtC,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;IAClB,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;CACpB;AAKD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAQvD;AAED,kFAAkF;AAClF,MAAM,WAAW,gBAAgB,CAAC,CAAC,GAAG,MAAM,CAAE,SAAQ,gBAAgB;IACpE,+DAA+D;IAC/D,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;CACxC;AAED;;;;;GAKG;AACH,MAAM,MAAM,cAAc,CAAC,CAAC,GAAG,MAAM,IACjC,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG;IAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAA;CAAE,CAAC,GACpD,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG;IACrB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC;CAC5B,CAAC,CAAC;AAEP,qFAAqF;AACrF,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,6DAA6D;AAC7D,eAAO,MAAM,gBAAgB,uBAAuB,CAAC;AAErD;;;GAGG;AACH,eAAO,MAAM,WAAW,kCAAkC,CAAC;AAE3D;;;GAGG;AACH,eAAO,MAAM,2BAA2B,8BAA8B,CAAC;AAEvE;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,uBAAuB,CAAC;AAEzD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,uBAAuB,CAAC;AAEzD;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,oBAAoB,CAAC;AACnD,eAAO,MAAM,4BAA4B,+BAA+B,CAAC;AASzE;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,+BAA+B,CAAC;AAE7D,gDAAgD;AAChD,eAAO,MAAM,iBAAiB,UAAU,CAAC;AAEzC;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,8CAA8C;AAC9C,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,mBAAmB,CAMpF;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,mBAAmB;;;;;;;;;;;;;EAMnE;AAMD;;;GAGG;AACH,MAAM,MAAM,aAAa,GACrB,mBAAmB,GACnB,sBAAsB,GACtB,YAAY,GACZ,iBAAiB,GACjB,sBAAsB,GACtB,qBAAqB;AACvB;;;;;GAKG;GACD,kBAAkB;AACpB;;;GAGG;GACD,oBAAoB,CAAC;AAEzB,2EAA2E;AAC3E,MAAM,MAAM,YAAY,GAAG,YAAY,GAAG,aAAa,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,aAAa,CAAC,CAG9E,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,+IAeW,CAAC;AAE9C,+FAA+F;AAC/F,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7D;;;GAGG;AACH,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAC5C,MAAM,CAAC,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,EAAE,qBAAqB,CAAC,CAYtE,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CACvC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CAyB9D,CAAC;AAMF,6EAA6E;AAC7E,eAAO,MAAM,yBAAyB,gCAAgC,CAAC;AAEvE;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,gFAAgF;IAChF,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC;CAC5B;AAED,yDAAyD;AACzD,eAAO,MAAM,qBAAqB,EAAE,kBAMnC,CAAC;AAEF,uDAAuD;AACvD,wBAAgB,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,MAAM,CAE/D;AAED,uDAAuD;AACvD,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,kBAAkB,EAAE,CAAC,CAG9F,CAAC;AAEF;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,YAAY,EACrB,GAAG,EAAE,MAAM,GACV;IACD,QAAQ,CAAC,OAAO,EAAE;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE;gBAAE,OAAO,EAAE,MAAM,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAA;aAAE,EAAE,CAAA;SAAE,CAAC;KACxE,EAAE,CAAC;IACJ,QAAQ,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC9D,CAYA;AAED,mFAAmF;AACnF,wBAAgB,cAAc,CAAC,OAAO,EAAE,YAAY,GAAG,aAAa,EAAE,CAOrE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC,CAUjF,CAAC;AAyBF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,6BAA6B,CAAC;AAEjE;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAmBlF,CAAC;AAEF;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,CAU/F;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAE5C,2FAA2F;AAC3F,eAAO,MAAM,0BAA0B,iCAAiC,CAAC;AAEzE,+EAA+E;AAC/E,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnF;AAMD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,iBAAiB;IAChC,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,qDAAqD;IACrD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,yCAAyC;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,kDAAkD;AAClD,eAAO,MAAM,cAAc;;;;CAIjB,CAAC;AAEX,iGAAiG;AACjG,MAAM,MAAM,uBAAuB,GAC/B;IACE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,+DAA+D;IAC/D,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;CACxC,GACD;IACE,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,0EAA0E;IAC1E,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC,CAAC;AAEN;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,uBAAuB,GAAG,iBAAiB,CAc/E;AAED,4DAA4D;AAC5D,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,iBAAiB,GACpB,MAAM,CAAC,YAAY,EAAE,cAAc,EAAE,CAAC,CAYxC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,CA2D3F;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB;;;;;CAKpB,CAAC;AAEX,6CAA6C;AAC7C,MAAM,MAAM,YAAY;AACtB,gEAAgE;AAC9D,QAAQ;AACV,0CAA0C;GACxC,YAAY;AACd,6CAA6C;GAC3C,qBAAqB;AACvB,8EAA8E;GAC5E,mBAAmB,GACnB,UAAU,CAAC;AAEf,wDAAwD;AACxD,MAAM,MAAM,SAAS,GACjB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAA;CAAE,GAC5E;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;CAAE,CAAC;AAErE;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,CAAC;IACrC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAKD,4EAA4E;AAC5E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,wEAAwE;IACxE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,oBAAoB,EAAE,CAS9D;AAgKD;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,iBAAiB,EAa5D,CAAC;AAEF,qEAAqE;AACrE,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,WAAW,GAAG,YAAY,EAAE,CAOxE;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAiBvF,CAAC;AAEF,mEAAmE;AACnE,wBAAgB,SAAS,CACvB,SAAS,EAAE,YAAY,EACvB,OAAO,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC5F,MAAM,CAaR;AAMD,6EAA6E;AAC7E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;IAC5C,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,gFAAgF;IAChF,QAAQ,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAE7C;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAAS,yBAAyB,EAiC7E,CAAC;AAEF,yEAAyE;AACzE,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,SAAS;IAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EAAE,EACvF,YAAY,EAAE,SAAS,MAAM,EAAE,GAC9B,MAAM,CAKR;AAED,qFAAqF;AACrF,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,QAAQ,CAAC;AAE1C;;;GAGG;AACH;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG;IAC5D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAQA;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAcjE"}