@caelo-cms/provisioning 0.10.55 → 0.10.58

package/dist/operator-access.js

@@ -5,8 +5,11 @@
  * `cms-provision upgrade`, both as the operator's own gcloud identity.
  *
  * Trust boundary. Who may pass the admin's IAP gate and sign as `caelo-mcp`
- * follows the Caelo user list. The admin does NOT write that: its runtime
- * service account holds no IAM-policy rights. A Cloud Run job with its own
+ * follows the Caelo user list; which OAuth client IAP signs people in with
+ * and accepts programmatically (IAP `oauthSettings`: browser client, its
+ * secret and `programmaticClients`, #914) follows the Google sign-in client
+ * the Owner configured under Settings → Google sign-in. The admin does NOT
+ * write that: its runtime service account holds no IAM-policy rights. A Cloud Run job with its own
  * service account (admin-core security/operator-access/sync-job.ts) is the
  * only principal that may change those two bindings, and it only ever grants
  * individual `user:` emails read from the database. The admin may only start
@@ -18,10 +21,13 @@
  *
  * What this ensures, every step idempotent:
  *   1. the Cloud Scheduler API;
- *   2. the custom role `caeloOperatorAccess` (get/setIamPolicy only);
+ *   2. the custom role `caeloOperatorAccess` (get/setIamPolicy, and
+ *      get/updateSettings for `oauthSettings`);
  *   3. the job's service account, bound to that role on exactly the admin's
- *      IAP resource and the `caelo-mcp` service account, plus
- *      `cloudsql.instanceUser` + `logging.logWriter`;
+ *      IAP resource and the `caelo-mcp` service account, `secretAccessor`
+ *      on exactly the Google sign-in client's secret (#914: IAP needs the
+ *      client secret too), plus `cloudsql.instanceUser` +
+ *      `logging.logWriter`;
  *   4. removal of the admin run SA's operator-access grants an earlier
  *      revision of this feature gave it;
  *   5. Cloud SQL IAM database authentication (flag + the job's IAM database
@@ -38,16 +44,24 @@
 import { ensureCloudSqlIamUser } from "./cloudsql-iam-user.js";
 import { gcloud as defaultGcloud } from "./gcloud.js";
 import { realSleep, runWithRetry } from "./gcloud-retry.js";
-import { gcpNamePrefix, mcpIapServiceAccountEmail, operatorAccessJobName, operatorAccessScheduleName, operatorAccessServiceAccountEmail, operatorAccessServiceAccountId, runServiceAccountEmail, } from "./gcp-names.js";
+import { gcpNamePrefix, gcpSecretId, mcpIapServiceAccountEmail, operatorAccessJobName, operatorAccessScheduleName, operatorAccessServiceAccountEmail, operatorAccessServiceAccountId, runServiceAccountEmail, } from "./gcp-names.js";
 import { iapResourceArgs } from "./mcp-iap.js";
+import { operatorOAuthClientSecretResource } from "./stack-contract.js";
 /** The only IAM-writing rights in this feature, held by the sync job's SA alone. */
 export const OPERATOR_ACCESS_ROLE = {
     roleId: "caeloOperatorAccess",
     title: "Caelo operator access",
-    description: "Lets the Caelo operator-access sync job set who passes the admin's IAP gate and who may sign as caelo-mcp. Bound only on those two resources, only to the job's service account.",
+    description: "Lets the Caelo operator-access sync job set who passes the admin's IAP gate, which OAuth client IAP signs people in with and accepts programmatically (Google sign-in, remote MCP), and who may sign as caelo-mcp. Bound only on those two resources, only to the job's service account.",
     permissions: [
         "iap.webServices.getIamPolicy",
         "iap.webServices.setIamPolicy",
+        // #914 — the admin IAP resource's `oauthSettings` (the install's Google
+        // sign-in client). IAP settings permissions per resource level:
+        // cloud.google.com/iap/docs/customizing ("Web Services": getSettings /
+        // updateSettings); the role is bound on exactly the admin's IAP web
+        // service, so it reaches no other resource's settings.
+        "iap.webServices.getSettings",
+        "iap.webServices.updateSettings",
         "iam.serviceAccounts.getIamPolicy",
         "iam.serviceAccounts.setIamPolicy",
     ],
@@ -124,6 +138,10 @@ function policyHas(policyJson, role, member) {
 }
 /** Env var of the sync job listing {@link OperatorAccessSyncTarget.mcpSigners}. */
 export const MCP_SIGNERS_ENV = "CAELO_OPERATOR_ACCESS_MCP_SIGNERS";
+/** #914 — env var of the sync job naming the Google sign-in client's secret. */
+export const OPERATOR_OAUTH_CLIENT_SECRET_ENV = "CAELO_OPERATOR_OAUTH_CLIENT_SECRET";
+/** The role the job holds on exactly the Google sign-in client's secret (#914). */
+export const OPERATOR_OAUTH_CLIENT_ACCESSOR_ROLE = "roles/secretmanager.secretAccessor";
 /** Ensure the operator-access sync job and everything it needs. Never throws for a gcloud failure. */
 export async function ensureOperatorAccessSync(target, deps = {}) {
     const run = deps.run ?? defaultGcloud;
@@ -206,6 +224,23 @@ export async function ensureOperatorAccessSync(target, deps = {}) {
             return fail(`grant the job ${g.what}`, r);
         done.push(`job: ${g.what}`);
     }
+    // #914 — the job hands the Google sign-in client to IAP (`oauthSettings`
+    // needs the secret too), so it reads that one secret; no other.
+    const clientSecret = gcpSecretId(env, "operator-oauth-client");
+    const accessor = await retry([
+        "secrets",
+        "add-iam-policy-binding",
+        clientSecret,
+        `--member=${jobMember}`,
+        `--role=${OPERATOR_OAUTH_CLIENT_ACCESSOR_ROLE}`,
+        "--condition=None",
+        project,
+        "--quiet",
+        "--format=none",
+    ]);
+    if (!accessor.ok)
+        return fail(`grant the job read access to ${clientSecret}`, accessor);
+    done.push(`job: ${OPERATOR_OAUTH_CLIENT_ACCESSOR_ROLE} on ${clientSecret}`);
     for (const role of ["roles/cloudsql.instanceUser", "roles/logging.logWriter"]) {
         const r = await retry([
             "projects",
@@ -286,6 +321,7 @@ export async function ensureOperatorAccessSync(target, deps = {}) {
         `CAELO_MCP_IAP_SERVICE_ACCOUNT=${mcpSa}`,
         `CAELO_OPERATOR_ACCESS_STATIC_MEMBERS=${installIapAllowlist(target.ownerEmail).join(",")}`,
         `CAELO_OPERATOR_ACCESS_DB_HOST=${target.databaseHost}`,
+        `${OPERATOR_OAUTH_CLIENT_SECRET_ENV}=${operatorOAuthClientSecretResource(projectId, env)}`,
         ...(target.mcpSigners && target.mcpSigners.length > 0
             ? [`${MCP_SIGNERS_ENV}=${target.mcpSigners.join(",")}`]
             : []),

package/dist/operator-access.js.map

@@ -1 +1 @@
-{"version":3,"file":"operator-access.js","sourceRoot":"","sources":["../src/operator-access.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,MAAM,IAAI,aAAa,EAAqB,MAAM,aAAa,CAAC;AACzE,OAAO,EAAqB,SAAS,EAAE,YAAY,EAAc,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EACL,aAAa,EACb,yBAAyB,EACzB,qBAAqB,EACrB,0BAA0B,EAC1B,iCAAiC,EACjC,8BAA8B,EAC9B,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAoB,eAAe,EAAE,MAAM,cAAc,CAAC;AAYjE,oFAAoF;AACpF,MAAM,CAAC,MAAM,oBAAoB,GAAmB;IAClD,MAAM,EAAE,qBAAqB;IAC7B,KAAK,EAAE,uBAAuB;IAC9B,WAAW,EACT,kLAAkL;IACpL,WAAW,EAAE;QACX,8BAA8B;QAC9B,8BAA8B;QAC9B,kCAAkC;QAClC,kCAAkC;KACnC;CACF,CAAC;AAEF,kGAAkG;AAClG,MAAM,qBAAqB,GAAG,qBAAqB,CAAC;AAEpD,6EAA6E;AAC7E,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,MAAc;IAC9D,OAAO,YAAY,SAAS,UAAU,MAAM,EAAE,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAkB;IACpD,OAAO,CAAC,QAAQ,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,wDAAwD;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,wBAAwB,CAAC;AAEhE,yDAAyD;AACzD,MAAM,eAAe,GAAG,mEAAmE,CAAC;AAE5F,2EAA2E;AAC3E,MAAM,UAAU,UAAU,CAAC,QAAqB;IAC9C,OAAO,QAAQ,CAAC,IAAI,KAAK,WAAW;QAClC,CAAC,CAAC,aAAa,QAAQ,CAAC,MAAM,aAAa,QAAQ,CAAC,OAAO,EAAE;QAC7D,CAAC,CAAC,oBAAoB,QAAQ,CAAC,OAAO,EAAE,CAAC;AAC7C,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAQ,EACR,SAAiB,EACjB,IAAoB;IAEpB,MAAM,OAAO,GAAG,aAAa,SAAS,EAAE,CAAC;IACzC,MAAM,WAAW,GAAG,iBAAiB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAClE,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC;IAChG,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;YACvB,KAAK;YACL,OAAO;YACP,QAAQ;YACR,IAAI,CAAC,MAAM;YACX,OAAO;YACP,WAAW,IAAI,CAAC,KAAK,EAAE;YACvB,iBAAiB,IAAI,CAAC,WAAW,EAAE;YACnC,WAAW;YACX,YAAY;YACZ,SAAS;SACV,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;IAClF,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAGzC,CAAC;IACF,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QAC1F,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,iBAAiB,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;IACrF,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvE,IAAI,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;QACvB,KAAK;QACL,OAAO;QACP,QAAQ;QACR,IAAI,CAAC,MAAM;QACX,OAAO;QACP,WAAW;QACX,SAAS;KACV,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;AAClF,CAAC;AAED,mFAAmF;AACnF,SAAS,SAAS,CAAC,UAAkB,EAAE,IAAY,EAAE,MAAc;IACjE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,IAAI,CAElD,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AACpG,CAAC;AAyBD,mFAAmF;AACnF,MAAM,CAAC,MAAM,eAAe,GAAG,mCAAmC,CAAC;AAMnE,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAgC,EAChC,OAA8C,EAAE;IAEhD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACjE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IAC1C,MAAM,OAAO,GAAG,aAAa,SAAS,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,iCAAiC,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,kBAAkB,KAAK,EAAE,CAAC;IAC5C,MAAM,WAAW,GAAG,kBAAkB,sBAAsB,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC;IAC/E,MAAM,KAAK,GAAG,yBAAyB,CAAC,SAAS,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,cAAc,CAAC,SAAS,EAAE,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,CAAe,EAA4B,EAAE,CAAC,CAAC;QACzE,EAAE,EAAE,KAAK;QACT,IAAI;QACJ,KAAK,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;KACrC,CAAC,CAAC;IAEH,wDAAwD;IACxD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC;QACpB,UAAU;QACV,QAAQ;QACR,+BAA+B;QAC/B,OAAO;QACP,SAAS;KACV,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;IACtE,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAEzC,sBAAsB;IACtB,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/E,IAAI,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC5D,IAAI,CAAC,IAAI,CAAC,eAAe,oBAAoB,CAAC,MAAM,EAAE,CAAC,CAAC;IAExD,mDAAmD;IACnD,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC;QAC3B,KAAK;QACL,kBAAkB;QAClB,UAAU;QACV,KAAK;QACL,OAAO;QACP,uBAAuB;KACxB,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;YACvB,KAAK;YACL,kBAAkB;YAClB,QAAQ;YACR,8BAA8B,CAAC,GAAG,CAAC;YACnC,2CAA2C;YAC3C,oHAAoH;YACpH,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YACtD,OAAO,IAAI,CAAC,UAAU,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,mBAAmB,KAAK,EAAE,CAAC,CAAC;IAEtC,MAAM,SAAS,GAAuC;QACpD;YACE,IAAI,EAAE,GAAG,oBAAoB,CAAC,MAAM,8BAA8B;YAClE,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;SACpF;QACD;YACE,IAAI,EAAE,GAAG,oBAAoB,CAAC,MAAM,OAAO,KAAK,EAAE;YAClD,IAAI,EAAE,CAAC,KAAK,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,KAAK,CAAC;SACnE;KACF,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,GAAG,CAAC,CAAC,IAAI;YACT,YAAY,SAAS,EAAE;YACvB,UAAU,UAAU,EAAE;YACtB,kBAAkB;YAClB,OAAO;YACP,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,CAAC,6BAA6B,EAAE,yBAAyB,CAAC,EAAE,CAAC;QAC9E,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,UAAU;YACV,wBAAwB;YACxB,SAAS;YACT,YAAY,SAAS,EAAE;YACvB,UAAU,IAAI,EAAE;YAChB,kBAAkB;YAClB,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,iBAAiB,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,iBAAiB,CAAC,CAAC;IAC3C,CAAC;IAED,qEAAqE;IACrE,uDAAuD;IACvD,MAAM,MAAM,GAAsE;QAChF;YACE,IAAI,EAAE,0BAA0B;YAChC,GAAG,EAAE;gBACH,KAAK;gBACL,KAAK;gBACL,gBAAgB;gBAChB,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC;gBACnC,OAAO;gBACP,eAAe;aAChB;YACD,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACxF,IAAI,EAAE,UAAU;SACjB;QACD;YACE,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,CAAC,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,CAAC;YACnF,MAAM,EAAE,CAAC,KAAK,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,KAAK,CAAC;YACvE,IAAI,EAAE,UAAU;SACjB;QACD;YACE,IAAI,EAAE,aAAa;YACnB,GAAG,EAAE,CAAC,UAAU,EAAE,gBAAgB,EAAE,SAAS,EAAE,eAAe,CAAC;YAC/D,MAAM,EAAE,CAAC,UAAU,EAAE,2BAA2B,EAAE,SAAS,CAAC;YAC5D,IAAI,EAAE,cAAc,CAAC,SAAS,EAAE,qBAAqB,CAAC;SACvD;KACF,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,0BAA0B,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;QACxE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,SAAS;QAC7D,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,GAAG,CAAC,CAAC,MAAM;YACX,YAAY,WAAW,EAAE;YACzB,UAAU,CAAC,CAAC,IAAI,EAAE;YAClB,OAAO;YACP,OAAO;YACP,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,sBAAsB,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,wDAAwD;IACxD,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE;QAC/C,SAAS;QACT,GAAG;QACH,mBAAmB,EAAE,KAAK;QAC1B,YAAY,EAAE,uBAAuB;KACtC,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IAElE,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,OAAO,GAAG;QACd,iCAAiC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE;QAC9D,iCAAiC,KAAK,EAAE;QACxC,wCAAwC,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QAC1F,iCAAiC,MAAM,CAAC,YAAY,EAAE;QACtD,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;YACnD,CAAC,CAAC,CAAC,GAAG,eAAe,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACvD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;QACvB,KAAK;QACL,MAAM;QACN,QAAQ;QACR,OAAO;QACP,WAAW,MAAM,CAAC,QAAQ,EAAE;QAC5B,YAAY,MAAM,EAAE;QACpB,OAAO;QACP,qBAAqB,KAAK,EAAE;QAC5B,aAAa,MAAM,CAAC,OAAO,EAAE;QAC7B,YAAY,MAAM,CAAC,MAAM,EAAE;QAC3B,kCAAkC;QAClC,eAAe;QACf,gBAAgB,eAAe,EAAE;QACjC,6EAA6E;QAC7E,qBAAqB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACxC,iBAAiB;QACjB,mBAAmB;QACnB,SAAS;KACV,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,cAAc,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;IAC7D,IAAI,CAAC,IAAI,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;IAE5B,MAAM,MAAM,GAAoD;QAC9D;YACE,MAAM,EAAE,WAAW;YACnB,IAAI,EAAE,wBAAwB;YAC9B,GAAG,EAAE,yCAAyC;SAC/C;QACD,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,gCAAgC,EAAE;QACxF;YACE,MAAM,EAAE,SAAS;YACjB,IAAI,EAAE,wBAAwB;YAC9B,GAAG,EAAE,kDAAkD;SACxD;KACF,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,KAAK;YACL,MAAM;YACN,wBAAwB;YACxB,OAAO;YACP,YAAY,MAAM,EAAE;YACpB,OAAO;YACP,YAAY,CAAC,CAAC,MAAM,EAAE;YACtB,UAAU,CAAC,CAAC,IAAI,EAAE;YAClB,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,OAAO,OAAO,KAAK,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,IAAI,OAAO,OAAO,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,QAAQ,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,YAAY,GAAG;QACnB,QAAQ;QACR,cAAc,MAAM,EAAE;QACtB,OAAO;QACP,uBAAuB;QACvB,qBAAqB;QACrB,gDAAgD,SAAS,cAAc,MAAM,SAAS,OAAO,MAAM;QACnG,oBAAoB;QACpB,iCAAiC,KAAK,EAAE;QACxC,SAAS;KACV,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;QACzB,WAAW;QACX,MAAM;QACN,UAAU;QACV,QAAQ;QACR,cAAc,MAAM,EAAE;QACtB,OAAO;QACP,sBAAsB;KACvB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC;QACxB,WAAW;QACX,MAAM;QACN,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;QACjC,MAAM;QACN,GAAG,YAAY;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,YAAY,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;IAC1D,IAAI,CAAC,IAAI,CAAC,mBAAmB,QAAQ,EAAE,CAAC,CAAC;IAEzC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,IAOC,EACD,OAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,OAAO,GAAG,aAAa,IAAI,CAAC,SAAS,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC;QACrB,KAAK;QACL,UAAU;QACV,MAAM;QACN,YAAY,IAAI,CAAC,MAAM,EAAE;QACzB,OAAO;QACP,2BAA2B,MAAM,EAAE;QACnC,+BAA+B;KAChC,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IAC5F,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,wBAAwB,MAAM,8BAA8B,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;SAC9G,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAW,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;QACzB,KAAK;QACL,UAAU;QACV,UAAU;QACV,YAAY;QACZ,YAAY,IAAI,CAAC,MAAM,EAAE;QACzB,OAAO;QACP,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,YAAY,KAAK,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACrF,CAAC;IACD,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,YAAY,iEAAiE;SACxF,CAAC;IACJ,CAAC;IAED,IAAI,QAAqB,CAAC;IAC1B,IAAI,IAAI,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;QACrC,QAAQ,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IAC/E,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;YACzB,SAAS;YACT,kBAAkB;YAClB,MAAM;YACN,UAAU;YACV,OAAO;YACP,kBAAkB,MAAM,+BAA+B;YACvD,sBAAsB;SACvB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QAClF,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,oCAAoC,MAAM,oCAAoC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;aAC1H,CAAC;QACJ,CAAC;QACD,QAAQ,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAW,EAAE,CAAC;IACvE,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC;IAC3D,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE;YACN,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ;YACR,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ;YACzC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;YAChC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;YAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,MAAc;IAC3B,OAAO,MAAM;SACV,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC"}
+{"version":3,"file":"operator-access.js","sourceRoot":"","sources":["../src/operator-access.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,MAAM,IAAI,aAAa,EAAqB,MAAM,aAAa,CAAC;AACzE,OAAO,EAAqB,SAAS,EAAE,YAAY,EAAc,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EACL,aAAa,EACb,WAAW,EACX,yBAAyB,EACzB,qBAAqB,EACrB,0BAA0B,EAC1B,iCAAiC,EACjC,8BAA8B,EAC9B,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAoB,eAAe,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,iCAAiC,EAAE,MAAM,qBAAqB,CAAC;AAYxE,oFAAoF;AACpF,MAAM,CAAC,MAAM,oBAAoB,GAAmB;IAClD,MAAM,EAAE,qBAAqB;IAC7B,KAAK,EAAE,uBAAuB;IAC9B,WAAW,EACT,0RAA0R;IAC5R,WAAW,EAAE;QACX,8BAA8B;QAC9B,8BAA8B;QAC9B,wEAAwE;QACxE,gEAAgE;QAChE,uEAAuE;QACvE,oEAAoE;QACpE,uDAAuD;QACvD,6BAA6B;QAC7B,gCAAgC;QAChC,kCAAkC;QAClC,kCAAkC;KACnC;CACF,CAAC;AAEF,kGAAkG;AAClG,MAAM,qBAAqB,GAAG,qBAAqB,CAAC;AAEpD,6EAA6E;AAC7E,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,MAAc;IAC9D,OAAO,YAAY,SAAS,UAAU,MAAM,EAAE,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAkB;IACpD,OAAO,CAAC,QAAQ,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,wDAAwD;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,wBAAwB,CAAC;AAEhE,yDAAyD;AACzD,MAAM,eAAe,GAAG,mEAAmE,CAAC;AAE5F,2EAA2E;AAC3E,MAAM,UAAU,UAAU,CAAC,QAAqB;IAC9C,OAAO,QAAQ,CAAC,IAAI,KAAK,WAAW;QAClC,CAAC,CAAC,aAAa,QAAQ,CAAC,MAAM,aAAa,QAAQ,CAAC,OAAO,EAAE;QAC7D,CAAC,CAAC,oBAAoB,QAAQ,CAAC,OAAO,EAAE,CAAC;AAC7C,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAQ,EACR,SAAiB,EACjB,IAAoB;IAEpB,MAAM,OAAO,GAAG,aAAa,SAAS,EAAE,CAAC;IACzC,MAAM,WAAW,GAAG,iBAAiB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAClE,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC;IAChG,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;YACvB,KAAK;YACL,OAAO;YACP,QAAQ;YACR,IAAI,CAAC,MAAM;YACX,OAAO;YACP,WAAW,IAAI,CAAC,KAAK,EAAE;YACvB,iBAAiB,IAAI,CAAC,WAAW,EAAE;YACnC,WAAW;YACX,YAAY;YACZ,SAAS;SACV,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;IAClF,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAGzC,CAAC;IACF,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QAC1F,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,iBAAiB,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;IACrF,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvE,IAAI,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;QACvB,KAAK;QACL,OAAO;QACP,QAAQ;QACR,IAAI,CAAC,MAAM;QACX,OAAO;QACP,WAAW;QACX,SAAS;KACV,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;AAClF,CAAC;AAED,mFAAmF;AACnF,SAAS,SAAS,CAAC,UAAkB,EAAE,IAAY,EAAE,MAAc;IACjE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,IAAI,CAElD,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AACpG,CAAC;AAyBD,mFAAmF;AACnF,MAAM,CAAC,MAAM,eAAe,GAAG,mCAAmC,CAAC;AAEnE,gFAAgF;AAChF,MAAM,CAAC,MAAM,gCAAgC,GAAG,oCAAoC,CAAC;AAErF,mFAAmF;AACnF,MAAM,CAAC,MAAM,mCAAmC,GAAG,oCAAoC,CAAC;AAMxF,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAgC,EAChC,OAA8C,EAAE;IAEhD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACjE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IAC1C,MAAM,OAAO,GAAG,aAAa,SAAS,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,iCAAiC,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,kBAAkB,KAAK,EAAE,CAAC;IAC5C,MAAM,WAAW,GAAG,kBAAkB,sBAAsB,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC;IAC/E,MAAM,KAAK,GAAG,yBAAyB,CAAC,SAAS,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,cAAc,CAAC,SAAS,EAAE,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,CAAe,EAA4B,EAAE,CAAC,CAAC;QACzE,EAAE,EAAE,KAAK;QACT,IAAI;QACJ,KAAK,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;KACrC,CAAC,CAAC;IAEH,wDAAwD;IACxD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC;QACpB,UAAU;QACV,QAAQ;QACR,+BAA+B;QAC/B,OAAO;QACP,SAAS;KACV,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;IACtE,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAEzC,sBAAsB;IACtB,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/E,IAAI,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC5D,IAAI,CAAC,IAAI,CAAC,eAAe,oBAAoB,CAAC,MAAM,EAAE,CAAC,CAAC;IAExD,mDAAmD;IACnD,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC;QAC3B,KAAK;QACL,kBAAkB;QAClB,UAAU;QACV,KAAK;QACL,OAAO;QACP,uBAAuB;KACxB,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;YACvB,KAAK;YACL,kBAAkB;YAClB,QAAQ;YACR,8BAA8B,CAAC,GAAG,CAAC;YACnC,2CAA2C;YAC3C,oHAAoH;YACpH,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YACtD,OAAO,IAAI,CAAC,UAAU,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,mBAAmB,KAAK,EAAE,CAAC,CAAC;IAEtC,MAAM,SAAS,GAAuC;QACpD;YACE,IAAI,EAAE,GAAG,oBAAoB,CAAC,MAAM,8BAA8B;YAClE,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;SACpF;QACD;YACE,IAAI,EAAE,GAAG,oBAAoB,CAAC,MAAM,OAAO,KAAK,EAAE;YAClD,IAAI,EAAE,CAAC,KAAK,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,KAAK,CAAC;SACnE;KACF,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,GAAG,CAAC,CAAC,IAAI;YACT,YAAY,SAAS,EAAE;YACvB,UAAU,UAAU,EAAE;YACtB,kBAAkB;YAClB,OAAO;YACP,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC;IACD,yEAAyE;IACzE,gEAAgE;IAChE,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC;QAC3B,SAAS;QACT,wBAAwB;QACxB,YAAY;QACZ,YAAY,SAAS,EAAE;QACvB,UAAU,mCAAmC,EAAE;QAC/C,kBAAkB;QAClB,OAAO;QACP,SAAS;QACT,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,gCAAgC,YAAY,EAAE,EAAE,QAAQ,CAAC,CAAC;IACxF,IAAI,CAAC,IAAI,CAAC,QAAQ,mCAAmC,OAAO,YAAY,EAAE,CAAC,CAAC;IAC5E,KAAK,MAAM,IAAI,IAAI,CAAC,6BAA6B,EAAE,yBAAyB,CAAC,EAAE,CAAC;QAC9E,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,UAAU;YACV,wBAAwB;YACxB,SAAS;YACT,YAAY,SAAS,EAAE;YACvB,UAAU,IAAI,EAAE;YAChB,kBAAkB;YAClB,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,iBAAiB,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,iBAAiB,CAAC,CAAC;IAC3C,CAAC;IAED,qEAAqE;IACrE,uDAAuD;IACvD,MAAM,MAAM,GAAsE;QAChF;YACE,IAAI,EAAE,0BAA0B;YAChC,GAAG,EAAE;gBACH,KAAK;gBACL,KAAK;gBACL,gBAAgB;gBAChB,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC;gBACnC,OAAO;gBACP,eAAe;aAChB;YACD,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACxF,IAAI,EAAE,UAAU;SACjB;QACD;YACE,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,CAAC,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,CAAC;YACnF,MAAM,EAAE,CAAC,KAAK,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,KAAK,CAAC;YACvE,IAAI,EAAE,UAAU;SACjB;QACD;YACE,IAAI,EAAE,aAAa;YACnB,GAAG,EAAE,CAAC,UAAU,EAAE,gBAAgB,EAAE,SAAS,EAAE,eAAe,CAAC;YAC/D,MAAM,EAAE,CAAC,UAAU,EAAE,2BAA2B,EAAE,SAAS,CAAC;YAC5D,IAAI,EAAE,cAAc,CAAC,SAAS,EAAE,qBAAqB,CAAC;SACvD;KACF,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,0BAA0B,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;QACxE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,SAAS;QAC7D,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,GAAG,CAAC,CAAC,MAAM;YACX,YAAY,WAAW,EAAE;YACzB,UAAU,CAAC,CAAC,IAAI,EAAE;YAClB,OAAO;YACP,OAAO;YACP,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,sBAAsB,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,wDAAwD;IACxD,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE;QAC/C,SAAS;QACT,GAAG;QACH,mBAAmB,EAAE,KAAK;QAC1B,YAAY,EAAE,uBAAuB;KACtC,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IAElE,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,OAAO,GAAG;QACd,iCAAiC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE;QAC9D,iCAAiC,KAAK,EAAE;QACxC,wCAAwC,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QAC1F,iCAAiC,MAAM,CAAC,YAAY,EAAE;QACtD,GAAG,gCAAgC,IAAI,iCAAiC,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE;QAC1F,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;YACnD,CAAC,CAAC,CAAC,GAAG,eAAe,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACvD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;QACvB,KAAK;QACL,MAAM;QACN,QAAQ;QACR,OAAO;QACP,WAAW,MAAM,CAAC,QAAQ,EAAE;QAC5B,YAAY,MAAM,EAAE;QACpB,OAAO;QACP,qBAAqB,KAAK,EAAE;QAC5B,aAAa,MAAM,CAAC,OAAO,EAAE;QAC7B,YAAY,MAAM,CAAC,MAAM,EAAE;QAC3B,kCAAkC;QAClC,eAAe;QACf,gBAAgB,eAAe,EAAE;QACjC,6EAA6E;QAC7E,qBAAqB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACxC,iBAAiB;QACjB,mBAAmB;QACnB,SAAS;KACV,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,cAAc,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;IAC7D,IAAI,CAAC,IAAI,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;IAE5B,MAAM,MAAM,GAAoD;QAC9D;YACE,MAAM,EAAE,WAAW;YACnB,IAAI,EAAE,wBAAwB;YAC9B,GAAG,EAAE,yCAAyC;SAC/C;QACD,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,gCAAgC,EAAE;QACxF;YACE,MAAM,EAAE,SAAS;YACjB,IAAI,EAAE,wBAAwB;YAC9B,GAAG,EAAE,kDAAkD;SACxD;KACF,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,KAAK;YACL,MAAM;YACN,wBAAwB;YACxB,OAAO;YACP,YAAY,MAAM,EAAE;YACpB,OAAO;YACP,YAAY,CAAC,CAAC,MAAM,EAAE;YACtB,UAAU,CAAC,CAAC,IAAI,EAAE;YAClB,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,OAAO,OAAO,KAAK,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,IAAI,OAAO,OAAO,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,QAAQ,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,YAAY,GAAG;QACnB,QAAQ;QACR,cAAc,MAAM,EAAE;QACtB,OAAO;QACP,uBAAuB;QACvB,qBAAqB;QACrB,gDAAgD,SAAS,cAAc,MAAM,SAAS,OAAO,MAAM;QACnG,oBAAoB;QACpB,iCAAiC,KAAK,EAAE;QACxC,SAAS;KACV,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;QACzB,WAAW;QACX,MAAM;QACN,UAAU;QACV,QAAQ;QACR,cAAc,MAAM,EAAE;QACtB,OAAO;QACP,sBAAsB;KACvB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC;QACxB,WAAW;QACX,MAAM;QACN,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;QACjC,MAAM;QACN,GAAG,YAAY;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,YAAY,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;IAC1D,IAAI,CAAC,IAAI,CAAC,mBAAmB,QAAQ,EAAE,CAAC,CAAC;IAEzC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,IAOC,EACD,OAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,OAAO,GAAG,aAAa,IAAI,CAAC,SAAS,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC;QACrB,KAAK;QACL,UAAU;QACV,MAAM;QACN,YAAY,IAAI,CAAC,MAAM,EAAE;QACzB,OAAO;QACP,2BAA2B,MAAM,EAAE;QACnC,+BAA+B;KAChC,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IAC5F,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,wBAAwB,MAAM,8BAA8B,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;SAC9G,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAW,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;QACzB,KAAK;QACL,UAAU;QACV,UAAU;QACV,YAAY;QACZ,YAAY,IAAI,CAAC,MAAM,EAAE;QACzB,OAAO;QACP,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,YAAY,KAAK,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACrF,CAAC;IACD,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,YAAY,iEAAiE;SACxF,CAAC;IACJ,CAAC;IAED,IAAI,QAAqB,CAAC;IAC1B,IAAI,IAAI,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;QACrC,QAAQ,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IAC/E,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;YACzB,SAAS;YACT,kBAAkB;YAClB,MAAM;YACN,UAAU;YACV,OAAO;YACP,kBAAkB,MAAM,+BAA+B;YACvD,sBAAsB;SACvB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QAClF,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,oCAAoC,MAAM,oCAAoC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;aAC1H,CAAC;QACJ,CAAC;QACD,QAAQ,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAW,EAAE,CAAC;IACvE,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC;IAC3D,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE;YACN,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ;YACR,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ;YACzC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;YAChC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;YAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,MAAc;IAC3B,OAAO,MAAM;SACV,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC"}

package/dist/release-contract.d.ts

@@ -9,8 +9,9 @@
  * The admin's upgrader job (Phase 2) only rolls images: it holds no IAM
  * write, no secret create, no resource create. Anything a release needs
  * beyond "new image digests + expand-only migrations" must therefore be
- * declared here, so the upgrader refuses it and sends the Owner to the
- * "Run in Cloud Shell" path instead of half-applying it.
+ * declared here, so the upgrader refuses it and the admin routes the
+ * release to the converge job (#819; the provisioner's identity) instead
+ * of half-applying it.
  */
 /**
  * Oldest installed version a release can be applied to directly. An

package/dist/release-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"release-contract.d.ts","sourceRoot":"","sources":["../src/release-contract.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;GAaG;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,WAAW,CAAC;AAEjD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAsBjD,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGzD"}
+{"version":3,"file":"release-contract.d.ts","sourceRoot":"","sources":["../src/release-contract.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,WAAW,CAAC;AAEjD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAwBjD,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGzD"}

package/dist/release-contract.js

@@ -10,8 +10,9 @@
  * The admin's upgrader job (Phase 2) only rolls images: it holds no IAM
  * write, no secret create, no resource create. Anything a release needs
  * beyond "new image digests + expand-only migrations" must therefore be
- * declared here, so the upgrader refuses it and sends the Owner to the
- * "Run in Cloud Shell" path instead of half-applying it.
+ * declared here, so the upgrader refuses it and the admin routes the
+ * release to the converge job (#819; the provisioner's identity) instead
+ * of half-applying it.
  */
 /**
  * Oldest installed version a release can be applied to directly. An
@@ -49,6 +50,8 @@ export const INFRA_CONTRACT_PATHS = [
     // #875 — the quality-audit job, its service account, results bucket and
     // grants.
     "packages/provisioning/src/audit-job-setup.ts",
+    // #819 — the converge job, its database login and the admin's grant on it.
+    "packages/provisioning/src/converge-job-setup.ts",
 ];
 /**
  * Whether a changed repo-relative path can alter the infrastructure

package/dist/release-contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"release-contract.js","sourceRoot":"","sources":["../src/release-contract.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;GAaG;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,QAAQ,CAAC;AAEjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,+BAA+B;IAC/B,6CAA6C;IAC7C,6CAA6C;IAC7C,8CAA8C;IAC9C,8CAA8C;IAC9C,wCAAwC;IACxC,yEAAyE;IACzE,oEAAoE;IACpE,mDAAmD;IACnD,+CAA+C;IAC/C,sCAAsC;IACtC,+CAA+C;IAC/C,qEAAqE;IACrE,uDAAuD;IACvD,0CAA0C;IAC1C,uEAAuE;IACvE,uDAAuD;IACvD,6CAA6C;IAC7C,wEAAwE;IACxE,UAAU;IACV,8CAA8C;CAC/C,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7E,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC"}
+{"version":3,"file":"release-contract.js","sourceRoot":"","sources":["../src/release-contract.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,QAAQ,CAAC;AAEjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,+BAA+B;IAC/B,6CAA6C;IAC7C,6CAA6C;IAC7C,8CAA8C;IAC9C,8CAA8C;IAC9C,wCAAwC;IACxC,yEAAyE;IACzE,oEAAoE;IACpE,mDAAmD;IACnD,+CAA+C;IAC/C,sCAAsC;IACtC,+CAA+C;IAC/C,qEAAqE;IACrE,uDAAuD;IACvD,0CAA0C;IAC1C,uEAAuE;IACvE,uDAAuD;IACvD,6CAA6C;IAC7C,wEAAwE;IACxE,UAAU;IACV,8CAA8C;IAC9C,2EAA2E;IAC3E,iDAAiD;CAClD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7E,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC"}

package/dist/release-manifest.d.ts

@@ -27,6 +27,8 @@ export type ReleaseManifestErrorCode = "registry" | "artifact-shape" | "blob-dig
 export interface ReleaseManifestError {
     readonly code: ReleaseManifestErrorCode;
     readonly message: string;
+    /** On `registry` errors a retry may cure; absent for not-found (see @caelo-cms/shared ReleaseArtifactError). */
+    readonly transient?: true;
 }
 export type ReleaseManifestResult = {
     readonly ok: true;

package/dist/release-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"release-manifest.d.ts","sourceRoot":"","sources":["../src/release-manifest.ts"],"names":[],"mappings":"AA0BA,OAAO,EAML,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,eAAe,EACrB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,mBAAmB,EAAyB,MAAM,6BAA6B,CAAC;AAKzF,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAC3B,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAE/B;;;;GAIG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAErE;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CA2B1D;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAMxE;AAED,mDAAmD;AACnD,MAAM,MAAM,wBAAwB,GAChC,UAAU,GACV,gBAAgB,GAChB,aAAa,GACb,WAAW,GACX,QAAQ,GACR,kBAAkB,CAAC;AAEvB,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAA;CAAE,GACzD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAEjE,kFAAkF;AAClF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvE,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5F,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAyBD;;;;;;;GAOG;AACH,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,mBAAiC,GACtC,OAAO,CAAC,qBAAqB,CAAC,CAmChC;AAED,mEAAmE;AACnE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,GACrD,cAAc,EAAE,CAUlB;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;CACvC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;AAExD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,+FAA+F;IAC/F,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,eAAe,EACzB,SAAS,EAAE,gBAAgB,GAC1B,iBAAiB,CA8BnB"}
+{"version":3,"file":"release-manifest.d.ts","sourceRoot":"","sources":["../src/release-manifest.ts"],"names":[],"mappings":"AA0BA,OAAO,EAML,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,eAAe,EACrB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,mBAAmB,EAAyB,MAAM,6BAA6B,CAAC;AAKzF,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAC3B,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAE/B;;;;GAIG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAErE;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CA2B1D;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAMxE;AAED,mDAAmD;AACnD,MAAM,MAAM,wBAAwB,GAChC,UAAU,GACV,gBAAgB,GAChB,aAAa,GACb,WAAW,GACX,QAAQ,GACR,kBAAkB,CAAC;AAEvB,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,gHAAgH;IAChH,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC;CAC3B;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAA;CAAE,GACzD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAEjE,kFAAkF;AAClF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvE,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5F,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAyBD;;;;;;;GAOG;AACH,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,mBAAiC,GACtC,OAAO,CAAC,qBAAqB,CAAC,CAmChC;AAED,mEAAmE;AACnE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,GACrD,cAAc,EAAE,CAUlB;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;CACvC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;AAExD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,+FAA+F;IAC/F,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,eAAe,EACzB,SAAS,EAAE,gBAAgB,GAC1B,iBAAiB,CA8BnB"}

package/dist/release-manifest.js.map

@@ -1 +1 @@
-{"version":3,"file":"release-manifest.js","sourceRoot":"","sources":["../src/release-manifest.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,GAIf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAEzF,2EAA2E;AAC3E,0EAA0E;AAC1E,8CAA8C;AAC9C,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAI3B,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,GAAG,6CAA6C,CAAC;AAE7D,4EAA4E;AAC5E,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAE/B;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAAe;IAC3D,OAAO,GAAG,qBAAqB,2BAA2B,OAAO,EAAE,CAAC;AACtE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,CAAS,EAAE,CAAS;IAChD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACvE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACjB,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACjB,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACxD,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC;QAC9B,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACtE,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACxC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B,OAAQ,gBAAsC,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAqB,CAAC,CAAC,CAAC,IAAI,CAAC;AACpG,CAAC;AA8BD,sEAAsE;AACtE,KAAK,UAAU,SAAS,CAAC,IAAuB;IAC9C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAClF,MAAM,MAAM,GAAG,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,QAAQ,EAAE,GAAG;YACb,MAAM,EAAE,gCAAgC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,sDAAsD;SACzI,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,WAAW,GAAwB;IACvC,KAAK,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC;IACtC,MAAM,EAAE,SAAS;CAClB,CAAC;AAEF,SAAS,IAAI,CAAC,IAA8B,EAAE,OAAe;IAC3D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAe,EACf,OAA4B,WAAW;IAEvC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,IAAI,OAAO,2BAA2B,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3D,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;IAE9D,sEAAsE;IACtE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,qCAAqC,CAAC,CAAC;QACpE,MAAM,SAAS,CAAC,YAAY,EAAE,QAAQ,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvE,MAAM,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC;YAC/B,aAAa;YACb,UAAU;YACV,UAAU;YACV,wBAAwB;YACxB,6BAA6B,CAAC,OAAO,CAAC;YACtC,2BAA2B;YAC3B,mBAAmB;YACnB,YAAY;SACb,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CACT,WAAW,EACX,oBAAoB,OAAO,qBAAqB,6BAA6B,CAAC,OAAO,CAAC,iCAAiC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC5J,CAAC;QACJ,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACrE,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,oBAAoB,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;AACjD,CAAC;AASD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAyB,EACzB,QAAsD;IAEtD,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,IAAI,CAAC,CAAC,KAAK,IAAI,QAAQ,CAAC;YAAE,SAAS;QACnC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;QACvC,IAAI,MAAM,KAAK,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAwBD;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAyB,EACzB,SAA2B;IAE3B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,aAAa,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,OAAO,qCAAqC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,aAAa,CAAC,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,OAAO,CAAC,IAAI,CACV,IAAI,QAAQ,CAAC,OAAO,oBAAoB,QAAQ,CAAC,cAAc,iCAAiC,SAAS,CAAC,OAAO,GAAG,CACrH,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAErF,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,QAAQ,CAAC,oBAAoB,GAAG,SAAS,CAAC,oBAAoB,EAAE,CAAC;QACnE,MAAM,CAAC,IAAI,CACT,oDAAoD,SAAS,CAAC,oBAAoB,MAAM,QAAQ,CAAC,oBAAoB,KAAK,cAAc,CAAC,SAAS,CAAC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,CAAC,iDAAiD,CACzP,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,QAAQ,CAAC,UAAU,CAAC,mBAAmB,CAAC;IAC7D,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;IACvE,CAAC;SAAM,IAAI,YAAY,KAAK,IAAI,IAAI,aAAa,CAAC,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;QACvF,MAAM,CAAC,IAAI,CACT,sBAAsB,YAAY,8DAA8D,SAAS,CAAC,OAAO,uBAAuB,CACzI,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClF,iEAAiE;IACjE,0EAA0E;IAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AAClG,CAAC"}
+{"version":3,"file":"release-manifest.js","sourceRoot":"","sources":["../src/release-manifest.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,GAIf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAEzF,2EAA2E;AAC3E,0EAA0E;AAC1E,8CAA8C;AAC9C,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAI3B,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,GAAG,6CAA6C,CAAC;AAE7D,4EAA4E;AAC5E,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAE/B;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAAe;IAC3D,OAAO,GAAG,qBAAqB,2BAA2B,OAAO,EAAE,CAAC;AACtE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,CAAS,EAAE,CAAS;IAChD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACvE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACjB,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACjB,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACxD,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC;QAC9B,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACtE,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACxC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B,OAAQ,gBAAsC,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAqB,CAAC,CAAC,CAAC,IAAI,CAAC;AACpG,CAAC;AAgCD,sEAAsE;AACtE,KAAK,UAAU,SAAS,CAAC,IAAuB;IAC9C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAClF,MAAM,MAAM,GAAG,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,QAAQ,EAAE,GAAG;YACb,MAAM,EAAE,gCAAgC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,sDAAsD;SACzI,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,WAAW,GAAwB;IACvC,KAAK,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC;IACtC,MAAM,EAAE,SAAS;CAClB,CAAC;AAEF,SAAS,IAAI,CAAC,IAA8B,EAAE,OAAe;IAC3D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAe,EACf,OAA4B,WAAW;IAEvC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,IAAI,OAAO,2BAA2B,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3D,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;IAE9D,sEAAsE;IACtE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,qCAAqC,CAAC,CAAC;QACpE,MAAM,SAAS,CAAC,YAAY,EAAE,QAAQ,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvE,MAAM,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC;YAC/B,aAAa;YACb,UAAU;YACV,UAAU;YACV,wBAAwB;YACxB,6BAA6B,CAAC,OAAO,CAAC;YACtC,2BAA2B;YAC3B,mBAAmB;YACnB,YAAY;SACb,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CACT,WAAW,EACX,oBAAoB,OAAO,qBAAqB,6BAA6B,CAAC,OAAO,CAAC,iCAAiC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC5J,CAAC;QACJ,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACrE,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,oBAAoB,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;AACjD,CAAC;AASD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAyB,EACzB,QAAsD;IAEtD,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,IAAI,CAAC,CAAC,KAAK,IAAI,QAAQ,CAAC;YAAE,SAAS;QACnC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;QACvC,IAAI,MAAM,KAAK,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAwBD;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAyB,EACzB,SAA2B;IAE3B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,aAAa,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,OAAO,qCAAqC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,aAAa,CAAC,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,OAAO,CAAC,IAAI,CACV,IAAI,QAAQ,CAAC,OAAO,oBAAoB,QAAQ,CAAC,cAAc,iCAAiC,SAAS,CAAC,OAAO,GAAG,CACrH,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAErF,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,QAAQ,CAAC,oBAAoB,GAAG,SAAS,CAAC,oBAAoB,EAAE,CAAC;QACnE,MAAM,CAAC,IAAI,CACT,oDAAoD,SAAS,CAAC,oBAAoB,MAAM,QAAQ,CAAC,oBAAoB,KAAK,cAAc,CAAC,SAAS,CAAC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,CAAC,iDAAiD,CACzP,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,QAAQ,CAAC,UAAU,CAAC,mBAAmB,CAAC;IAC7D,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;IACvE,CAAC;SAAM,IAAI,YAAY,KAAK,IAAI,IAAI,aAAa,CAAC,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;QACvF,MAAM,CAAC,IAAI,CACT,sBAAsB,YAAY,8DAA8D,SAAS,CAAC,OAAO,uBAAuB,CACzI,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClF,iEAAiE;IACjE,0EAA0E;IAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AAClG,CAAC"}

package/dist/remote-mcp-edge.d.ts

@@ -0,0 +1,114 @@
+/**
+ * #806 — what the `gcp` stack's load balancer does for remote MCP, declared
+ * once for the stack (new installs, imported from `dist/`) and for
+ * `cms-provision upgrade` (remote-mcp.ts `ensureRemoteMcpEdge`, existing
+ * installs). Pure module: no CLI or Pulumi imports.
+ *
+ * Routing: the broker's discovery documents live at the host root
+ * (`/.well-known/oauth-*`); the URL map sends those prefixes to the gateway
+ * together with `/api/*` (`GCP_PUBLIC_BASE_PATHS` in @caelo-cms/shared).
+ *
+ * Cloud Armor: the stack's policy bans an IP for 10 minutes after 100
+ * requests a minute and denies anything the OWASP sqli/xss rule packs flag.
+ * Both are wrong for `/api/mcp/*`:
+ *
+ *   - MCP bodies carry HTML legitimately (module markup, page content the
+ *     agent writes through Caelo's tools), which the xss/sqli packs flag.
+ *     The broker accepts only bearer-authenticated JSON-RPC that the
+ *     IAP-gated admin validates with Zod; Cloud Armor's signature match
+ *     adds false positives there, not protection.
+ *   - claude.ai and ChatGPT call from their own shared egress IPs, so every
+ *     user of an install arrives from a handful of addresses. One agent
+ *     session issues a JSON-RPC POST per tool call (plus initialize and
+ *     notifications) — a busy Power-MCP agent sustains 1–3 a second. A
+ *     100/min ban would cut every user behind the same connector for 10
+ *     minutes after one busy session.
+ *
+ * So the MCP paths ({@link MCP_ARMOR_PATH_PATTERN}) get their own rule, evaluated before the general ones
+ * (lower priority number = earlier; the first matching rule decides): a
+ * per-IP *throttle* of 600 requests a minute — about five busy agent
+ * sessions per egress IP — answering 429 above it without a ban, so a burst
+ * slows down instead of locking everyone out. Below the threshold the
+ * rule's action is `allow`, which ends evaluation: the OWASP packs and the
+ * general ban do not run for these paths. Abuse stays bounded by the
+ * gateway's max instances (100) and by IAP, which rejects every request
+ * without a valid token of an allowlisted user before it reaches the admin.
+ */
+/**
+ * The paths the MCP rule covers, as an anchored RE2 pattern (Cloud Armor's
+ * `matches`): the two MCP endpoints and the broker's `oauth/<name>` and
+ * `oauth/<name>/<surface>` routes — lowercase letters and hyphens only.
+ *
+ * Deliberately not a prefix match. A `startsWith('/api/mcp/')` rule also
+ * matches `/api/mcp/../forms/submit` or `/api/mcp/%2e%2e/comments`, which
+ * the gateway's URL parser normalises to `/api/forms/submit` — so any
+ * public write could borrow the MCP rule's 600/min throttle and skip the
+ * OWASP packs and the ban. No dot, no percent sign and no extra segment can
+ * match this pattern, so a traversal falls through to the general rules.
+ * The dotted metadata aliases (`/.well-known/…`, `oauth/.well-known/…`) are
+ * one-off GETs per connection and stay under the general rules.
+ */
+export declare const MCP_ARMOR_PATH_PATTERN = "^/api/mcp/(chat|admin|oauth/[a-z-]+(/[a-z-]+)?)$";
+/** The general per-IP ban rule and the OWASP rule packs the MCP rule must precede. */
+export declare const GENERAL_RATE_LIMIT_PRIORITY = 1000;
+export declare const OWASP_RULE_PRIORITIES: readonly number[];
+/** The `/api/mcp/*` rule of the gateway's Cloud Armor policy (see the module comment). */
+export declare const MCP_ARMOR_RULE: {
+    readonly priority: 900;
+    readonly description: "Caelo remote MCP: per-IP throttle sized for agent traffic; skips the OWASP packs";
+    readonly expression: "request.path.matches('^/api/mcp/(chat|admin|oauth/[a-z-]+(/[a-z-]+)?)$')";
+    readonly action: "throttle";
+    /** Requests per {@link MCP_ARMOR_RULE.intervalSec} per source IP. */
+    readonly count: 600;
+    readonly intervalSec: 60;
+    readonly conformAction: "allow";
+    readonly exceedAction: "deny(429)";
+    readonly enforceOnKey: "IP";
+};
+/** {@link MCP_ARMOR_RULE} in the shape `gcp.compute.SecurityPolicy` `rules` take. */
+export declare function mcpArmorRuleArgs(): {
+    action: "throttle";
+    priority: 900;
+    description: "Caelo remote MCP: per-IP throttle sized for agent traffic; skips the OWASP packs";
+    match: {
+        expr: {
+            expression: "request.path.matches('^/api/mcp/(chat|admin|oauth/[a-z-]+(/[a-z-]+)?)$')";
+        };
+    };
+    rateLimitOptions: {
+        rateLimitThreshold: {
+            count: 600;
+            intervalSec: 60;
+        };
+        conformAction: "allow";
+        exceedAction: "deny(429)";
+        enforceOnKey: "IP";
+    };
+};
+/**
+ * The `gcloud compute security-policies rules create|update` flags for
+ * {@link MCP_ARMOR_RULE} (without the verb, priority and policy).
+ */
+export declare function mcpArmorRuleFlags(): string[];
+/** A Cloud Armor rule as `gcloud compute security-policies describe --format=json` lists it. */
+export interface LiveArmorRule {
+    readonly priority?: number;
+    readonly action?: string;
+    readonly match?: {
+        readonly expr?: {
+            readonly expression?: string;
+        };
+    };
+    readonly rateLimitOptions?: {
+        readonly rateLimitThreshold?: {
+            readonly count?: number;
+            readonly intervalSec?: number;
+        };
+        readonly conformAction?: string;
+        readonly exceedAction?: string;
+        readonly enforceOnKey?: string;
+    };
+}
+/** Whether a live rule is exactly {@link MCP_ARMOR_RULE}. */
+export declare function isMcpArmorRule(rule: LiveArmorRule): boolean;
+//# sourceMappingURL=remote-mcp-edge.d.ts.map

package/dist/remote-mcp-edge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-mcp-edge.d.ts","sourceRoot":"","sources":["../src/remote-mcp-edge.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sBAAsB,qDAAqD,CAAC;AAEzF,sFAAsF;AACtF,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAChD,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAAiB,CAAC;AAErE,0FAA0F;AAC1F,eAAO,MAAM,cAAc;;;;;IAKzB,qEAAqE;;;;;;CAM7D,CAAC;AAEX,qFAAqF;AACrF,wBAAgB,gBAAgB;;;;;;;;;;;;;;;;;;EAc/B;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,EAAE,CAa5C;AAED,gGAAgG;AAChG,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE;YAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;IACtE,QAAQ,CAAC,gBAAgB,CAAC,EAAE;QAC1B,QAAQ,CAAC,kBAAkB,CAAC,EAAE;YAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACzF,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;KAChC,CAAC;CACH;AAED,6DAA6D;AAC7D,wBAAgB,cAAc,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAa3D"}

package/dist/remote-mcp-edge.js

@@ -0,0 +1,116 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * #806 — what the `gcp` stack's load balancer does for remote MCP, declared
+ * once for the stack (new installs, imported from `dist/`) and for
+ * `cms-provision upgrade` (remote-mcp.ts `ensureRemoteMcpEdge`, existing
+ * installs). Pure module: no CLI or Pulumi imports.
+ *
+ * Routing: the broker's discovery documents live at the host root
+ * (`/.well-known/oauth-*`); the URL map sends those prefixes to the gateway
+ * together with `/api/*` (`GCP_PUBLIC_BASE_PATHS` in @caelo-cms/shared).
+ *
+ * Cloud Armor: the stack's policy bans an IP for 10 minutes after 100
+ * requests a minute and denies anything the OWASP sqli/xss rule packs flag.
+ * Both are wrong for `/api/mcp/*`:
+ *
+ *   - MCP bodies carry HTML legitimately (module markup, page content the
+ *     agent writes through Caelo's tools), which the xss/sqli packs flag.
+ *     The broker accepts only bearer-authenticated JSON-RPC that the
+ *     IAP-gated admin validates with Zod; Cloud Armor's signature match
+ *     adds false positives there, not protection.
+ *   - claude.ai and ChatGPT call from their own shared egress IPs, so every
+ *     user of an install arrives from a handful of addresses. One agent
+ *     session issues a JSON-RPC POST per tool call (plus initialize and
+ *     notifications) — a busy Power-MCP agent sustains 1–3 a second. A
+ *     100/min ban would cut every user behind the same connector for 10
+ *     minutes after one busy session.
+ *
+ * So the MCP paths ({@link MCP_ARMOR_PATH_PATTERN}) get their own rule, evaluated before the general ones
+ * (lower priority number = earlier; the first matching rule decides): a
+ * per-IP *throttle* of 600 requests a minute — about five busy agent
+ * sessions per egress IP — answering 429 above it without a ban, so a burst
+ * slows down instead of locking everyone out. Below the threshold the
+ * rule's action is `allow`, which ends evaluation: the OWASP packs and the
+ * general ban do not run for these paths. Abuse stays bounded by the
+ * gateway's max instances (100) and by IAP, which rejects every request
+ * without a valid token of an allowlisted user before it reaches the admin.
+ */
+/**
+ * The paths the MCP rule covers, as an anchored RE2 pattern (Cloud Armor's
+ * `matches`): the two MCP endpoints and the broker's `oauth/<name>` and
+ * `oauth/<name>/<surface>` routes — lowercase letters and hyphens only.
+ *
+ * Deliberately not a prefix match. A `startsWith('/api/mcp/')` rule also
+ * matches `/api/mcp/../forms/submit` or `/api/mcp/%2e%2e/comments`, which
+ * the gateway's URL parser normalises to `/api/forms/submit` — so any
+ * public write could borrow the MCP rule's 600/min throttle and skip the
+ * OWASP packs and the ban. No dot, no percent sign and no extra segment can
+ * match this pattern, so a traversal falls through to the general rules.
+ * The dotted metadata aliases (`/.well-known/…`, `oauth/.well-known/…`) are
+ * one-off GETs per connection and stay under the general rules.
+ */
+export const MCP_ARMOR_PATH_PATTERN = "^/api/mcp/(chat|admin|oauth/[a-z-]+(/[a-z-]+)?)$";
+/** The general per-IP ban rule and the OWASP rule packs the MCP rule must precede. */
+export const GENERAL_RATE_LIMIT_PRIORITY = 1000;
+export const OWASP_RULE_PRIORITIES = [2000, 2001];
+/** The `/api/mcp/*` rule of the gateway's Cloud Armor policy (see the module comment). */
+export const MCP_ARMOR_RULE = {
+    priority: 900,
+    description: "Caelo remote MCP: per-IP throttle sized for agent traffic; skips the OWASP packs",
+    expression: `request.path.matches('${MCP_ARMOR_PATH_PATTERN}')`,
+    action: "throttle",
+    /** Requests per {@link MCP_ARMOR_RULE.intervalSec} per source IP. */
+    count: 600,
+    intervalSec: 60,
+    conformAction: "allow",
+    exceedAction: "deny(429)",
+    enforceOnKey: "IP",
+};
+/** {@link MCP_ARMOR_RULE} in the shape `gcp.compute.SecurityPolicy` `rules` take. */
+export function mcpArmorRuleArgs() {
+    const r = MCP_ARMOR_RULE;
+    return {
+        action: r.action,
+        priority: r.priority,
+        description: r.description,
+        match: { expr: { expression: r.expression } },
+        rateLimitOptions: {
+            rateLimitThreshold: { count: r.count, intervalSec: r.intervalSec },
+            conformAction: r.conformAction,
+            exceedAction: r.exceedAction,
+            enforceOnKey: r.enforceOnKey,
+        },
+    };
+}
+/**
+ * The `gcloud compute security-policies rules create|update` flags for
+ * {@link MCP_ARMOR_RULE} (without the verb, priority and policy).
+ */
+export function mcpArmorRuleFlags() {
+    const r = MCP_ARMOR_RULE;
+    return [
+        `--description=${r.description}`,
+        `--expression=${r.expression}`,
+        `--action=${r.action}`,
+        `--rate-limit-threshold-count=${r.count}`,
+        `--rate-limit-threshold-interval-sec=${r.intervalSec}`,
+        `--conform-action=${r.conformAction}`,
+        // gcloud spells deny(429) as deny-429.
+        "--exceed-action=deny-429",
+        `--enforce-on-key=${r.enforceOnKey}`,
+    ];
+}
+/** Whether a live rule is exactly {@link MCP_ARMOR_RULE}. */
+export function isMcpArmorRule(rule) {
+    const r = MCP_ARMOR_RULE;
+    const o = rule.rateLimitOptions;
+    return (rule.priority === r.priority &&
+        rule.action === r.action &&
+        rule.match?.expr?.expression === r.expression &&
+        o?.rateLimitThreshold?.count === r.count &&
+        o?.rateLimitThreshold?.intervalSec === r.intervalSec &&
+        o?.conformAction === r.conformAction &&
+        o?.exceedAction === r.exceedAction &&
+        (o?.enforceOnKey ?? "ALL") === r.enforceOnKey);
+}
+//# sourceMappingURL=remote-mcp-edge.js.map

package/dist/remote-mcp-edge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-mcp-edge.js","sourceRoot":"","sources":["../src/remote-mcp-edge.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,kDAAkD,CAAC;AAEzF,sFAAsF;AACtF,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC;AAChD,MAAM,CAAC,MAAM,qBAAqB,GAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAErE,0FAA0F;AAC1F,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,QAAQ,EAAE,GAAG;IACb,WAAW,EAAE,kFAAkF;IAC/F,UAAU,EAAE,yBAAyB,sBAAsB,IAAI;IAC/D,MAAM,EAAE,UAAU;IAClB,qEAAqE;IACrE,KAAK,EAAE,GAAG;IACV,WAAW,EAAE,EAAE;IACf,aAAa,EAAE,OAAO;IACtB,YAAY,EAAE,WAAW;IACzB,YAAY,EAAE,IAAI;CACV,CAAC;AAEX,qFAAqF;AACrF,MAAM,UAAU,gBAAgB;IAC9B,MAAM,CAAC,GAAG,cAAc,CAAC;IACzB,OAAO;QACL,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,EAAE;QAC7C,gBAAgB,EAAE;YAChB,kBAAkB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE;YAClE,aAAa,EAAE,CAAC,CAAC,aAAa;YAC9B,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,YAAY,EAAE,CAAC,CAAC,YAAY;SAC7B;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,CAAC,GAAG,cAAc,CAAC;IACzB,OAAO;QACL,iBAAiB,CAAC,CAAC,WAAW,EAAE;QAChC,gBAAgB,CAAC,CAAC,UAAU,EAAE;QAC9B,YAAY,CAAC,CAAC,MAAM,EAAE;QACtB,gCAAgC,CAAC,CAAC,KAAK,EAAE;QACzC,uCAAuC,CAAC,CAAC,WAAW,EAAE;QACtD,oBAAoB,CAAC,CAAC,aAAa,EAAE;QACrC,uCAAuC;QACvC,0BAA0B;QAC1B,oBAAoB,CAAC,CAAC,YAAY,EAAE;KACrC,CAAC;AACJ,CAAC;AAeD,6DAA6D;AAC7D,MAAM,UAAU,cAAc,CAAC,IAAmB;IAChD,MAAM,CAAC,GAAG,cAAc,CAAC;IACzB,MAAM,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC;IAChC,OAAO,CACL,IAAI,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ;QAC5B,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QACxB,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,KAAK,CAAC,CAAC,UAAU;QAC7C,CAAC,EAAE,kBAAkB,EAAE,KAAK,KAAK,CAAC,CAAC,KAAK;QACxC,CAAC,EAAE,kBAAkB,EAAE,WAAW,KAAK,CAAC,CAAC,WAAW;QACpD,CAAC,EAAE,aAAa,KAAK,CAAC,CAAC,aAAa;QACpC,CAAC,EAAE,YAAY,KAAK,CAAC,CAAC,YAAY;QAClC,CAAC,CAAC,EAAE,YAAY,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,YAAY,CAC9C,CAAC;AACJ,CAAC"}