@caelo-cms/provisioning 0.10.55 → 0.10.58

package/dist/remote-mcp.d.ts

@@ -0,0 +1,139 @@
+import type { GcloudRunner } from "./gcloud-retry.js";
+import type { HttpFetch } from "./runtime-secrets.js";
+import { type CloudRunSlug, type GcpProvider, type RemoteMcpIdentity } from "./stack-contract.js";
+import { type EnvChange } from "./stack-converge.js";
+/** The install remote MCP is set up on. */
+export interface RemoteMcpTarget {
+    readonly provider: GcpProvider;
+    readonly projectId: string;
+    readonly region: string;
+    /** Pulumi stack name (`production`). */
+    readonly env: string;
+    readonly domain: string;
+    /** Deployed (Pulumi-suffixed) Cloud Run service names. */
+    readonly services: Readonly<Record<CloudRunSlug, string>>;
+}
+export type RemoteMcpResult<T> = ({
+    readonly ok: true;
+} & T) | {
+    readonly ok: false;
+    readonly error: string;
+};
+/**
+ * #914 — the project's Google organisation domain (the organisation's
+ * `displayName`, which Cloud Resource Manager sets to its primary domain),
+ * or `none` when the project sits in no organisation. Read as the
+ * operator's identity: `organizations describe` needs
+ * `resourcemanager.organizations.get` on the organisation, which project
+ * Owners often have and the admin's service account never does.
+ */
+export declare function resolveGoogleOrgDomain(projectId: string, deps?: {
+    run?: GcloudRunner;
+}): Promise<RemoteMcpResult<{
+    readonly domain: string;
+}>>;
+/** `CAELO_GOOGLE_ORG_DOMAIN` value for a project outside any organisation (admin-core identity-gate.ts). */
+export declare const NO_GOOGLE_ORGANISATION = "none";
+/**
+ * Read the live identities {@link remoteMcpIdentity} derives from: the
+ * project number, and the admin's backend service id (`gcp`) or both
+ * services' URLs (`gcp-firebase`). Fails naming what it could not read.
+ *
+ * The organisation domain (#914) is best-effort: when it cannot be read,
+ * `orgDomainError` says why and the identity carries none, so the admin's
+ * var keeps its value — the admin then reports the organisation as unknown
+ * and refuses user creation loudly until the Owner sets up Google sign-in.
+ */
+export declare function resolveRemoteMcpIdentity(target: RemoteMcpTarget, deps?: {
+    run?: GcloudRunner;
+}): Promise<RemoteMcpResult<{
+    readonly identity: RemoteMcpIdentity;
+    readonly orgDomainError?: string;
+}>>;
+/**
+ * Bring both services' {@link RemoteMcpIdentity} env vars to `identity`
+ * with one `gcloud run services update` per service that differs (a new
+ * revision only then). Vars already right are left alone.
+ */
+export declare function applyRemoteMcpIdentityEnv(target: RemoteMcpTarget, identity: RemoteMcpIdentity, deps?: {
+    run?: GcloudRunner;
+}): Promise<RemoteMcpResult<{
+    readonly changes: Record<CloudRunSlug, EnvChange[]>;
+}>>;
+/** {@link resolveRemoteMcpIdentity} then {@link applyRemoteMcpIdentityEnv}. */
+export declare function ensureRemoteMcpIdentityEnv(target: RemoteMcpTarget, deps?: {
+    run?: GcloudRunner;
+}): Promise<RemoteMcpResult<{
+    readonly identity: RemoteMcpIdentity;
+    readonly changes: Record<CloudRunSlug, EnvChange[]>;
+    readonly orgDomainError?: string;
+}>>;
+/** A path rule / matcher / URL map as the Compute API returns them (the parts used here). */
+interface UrlMapPathRule {
+    readonly paths: string[];
+    readonly service?: string;
+    readonly urlRedirect?: unknown;
+}
+interface UrlMapPathMatcher {
+    readonly name: string;
+    readonly pathRules?: UrlMapPathRule[];
+}
+export interface LiveUrlMap {
+    readonly name: string;
+    readonly hostRules?: {
+        readonly hosts: string[];
+        readonly pathMatcher: string;
+    }[];
+    readonly pathMatchers?: UrlMapPathMatcher[];
+    readonly [field: string]: unknown;
+}
+export type UrlMapPathsPlan = {
+    readonly ok: true;
+    readonly map: LiveUrlMap;
+    readonly added: string[];
+} | {
+    readonly ok: false;
+    readonly error: string;
+};
+/**
+ * The URL map with every {@link GCP_PUBLIC_BASE_PATHS} entry routed like
+ * `/api/*` (to the gateway). Only the rule that carries `/api/*` changes;
+ * redirect rules the admin wrote stay as they are. `added` is empty when the
+ * map is already complete.
+ */
+export declare function planUrlMapPaths(maps: readonly LiveUrlMap[], siteHost: string): UrlMapPathsPlan;
+/**
+ * Route the remote-MCP discovery paths to the gateway on an existing `gcp`
+ * install: read the URL map, add the missing paths to its `/api/*` rule and
+ * write it back through the Compute API (`urlMaps.update` carries the map's
+ * fingerprint, so a concurrent write — the admin publishing redirects —
+ * fails instead of being lost; a re-run then succeeds).
+ */
+export declare function ensureUrlMapRemoteMcpPaths(target: Pick<RemoteMcpTarget, "projectId" | "domain">, deps?: {
+    run?: GcloudRunner;
+    http?: HttpFetch;
+    sleep?: (ms: number) => Promise<void>;
+}): Promise<RemoteMcpResult<{
+    readonly added: string[];
+}>>;
+/**
+ * Give the gateway's Cloud Armor policy the `/api/mcp/*` rule
+ * ({@link MCP_ARMOR_RULE}): create it, or bring a rule at its priority back
+ * to spec.
+ */
+export declare function ensureMcpArmorRule(target: Pick<RemoteMcpTarget, "projectId" | "env">, deps?: {
+    run?: GcloudRunner;
+}): Promise<RemoteMcpResult<{
+    readonly policy: string;
+    readonly action: "present" | "created" | "updated";
+}>>;
+/** Both load-balancer parts on `gcp`; a no-op success on `gcp-firebase`. */
+export declare function ensureRemoteMcpEdge(target: Pick<RemoteMcpTarget, "provider" | "projectId" | "env" | "domain">, deps?: {
+    run?: GcloudRunner;
+    http?: HttpFetch;
+    sleep?: (ms: number) => Promise<void>;
+}): Promise<RemoteMcpResult<{
+    readonly done: string[];
+}>>;
+export {};
+//# sourceMappingURL=remote-mcp.d.ts.map

package/dist/remote-mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-mcp.d.ts","sourceRoot":"","sources":["../src/remote-mcp.ts"],"names":[],"mappings":"AAiCA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAQtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,iBAAiB,EAGvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,KAAK,SAAS,EAAmC,MAAM,qBAAqB,CAAC;AAEtF,2CAA2C;AAC3C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,0DAA0D;IAC1D,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;CAC3D;AAED,MAAM,MAAM,eAAe,CAAC,CAAC,IACzB,CAAC;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG,CAAC,CAAC,GAC3B;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAsBnD;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAA;CAAO,GAChC,OAAO,CAAC,eAAe,CAAC;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAmBvD;AAED,4GAA4G;AAC5G,eAAO,MAAM,sBAAsB,SAAS,CAAC;AAE7C;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,eAAe,EACvB,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAA;CAAO,GAChC,OAAO,CACR,eAAe,CAAC;IAAE,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAC5F,CAOA;AAoFD;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAA;CAAO,GAChC,OAAO,CAAC,eAAe,CAAC;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,CAAC,CAAA;CAAE,CAAC,CAAC,CAoCnF;AAED,+EAA+E;AAC/E,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,eAAe,EACvB,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAA;CAAO,GAChC,OAAO,CACR,eAAe,CAAC;IACd,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,CAAC,CAAC;IACpD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC,CAAC,CACH,CAWA;AAMD,6FAA6F;AAC7F,UAAU,cAAc;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;CAChC;AACD,UAAU,iBAAiB;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,CAAC;CACvC;AACD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAClF,QAAQ,CAAC,YAAY,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC5C,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CACnC;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GACzE;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,UAAU,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,eAAe,CAuC9F;AAKD;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,GAAG,QAAQ,CAAC,EACrD,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAC;IAAC,IAAI,CAAC,EAAE,SAAS,CAAC;IAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAAO,GACzF,OAAO,CAAC,eAAe,CAAC;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC,CAuDxD;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,GAAG,KAAK,CAAC,EAClD,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAA;CAAO,GAChC,OAAO,CACR,eAAe,CAAC;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAAA;CAAE,CAAC,CACjG,CAqDA;AAED,4EAA4E;AAC5E,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,UAAU,GAAG,WAAW,GAAG,KAAK,GAAG,QAAQ,CAAC,EAC1E,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAC;IAAC,IAAI,CAAC,EAAE,SAAS,CAAC;IAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAAO,GACzF,OAAO,CAAC,eAAe,CAAC;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC,CAcvD"}

package/dist/remote-mcp.js

@@ -0,0 +1,434 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * #806 — the CLI's part of remote MCP on a Google IAP install (`gcp`,
+ * `gcp-firebase`), run as the operator's (or the provisioner's) gcloud
+ * identity by the wizard after `pulumi up` and by `cms-provision upgrade`
+ * after the roll. Every step is idempotent.
+ *
+ *   - {@link ensureRemoteMcpIdentityEnv}: the env vars that name generated
+ *     identities ({@link RemoteMcpIdentity} — why the stacks cannot declare
+ *     them is in stack-contract.ts), applied with `gcloud run services
+ *     update` only where they differ.
+ *   - {@link ensureRemoteMcpEdge} (`gcp` only): the load balancer's part for
+ *     installs whose URL map / Cloud Armor policy predate it — the
+ *     `/.well-known/oauth-*` path rules (the stack ignores `pathRules` after
+ *     creation, gcp-url-map.ts) and the `/api/mcp/*` Cloud Armor rule
+ *     (remote-mcp-edge.ts).
+ *
+ * The secrets, the IAM bindings, the gateway's secret volume and timeout
+ * come through the shared contract like everything else
+ * (runtime-secrets.ts, stack-contract.ts, upgrade/app-roll.ts).
+ *
+ * The same identity env carries what the admin's Google sign-in needs
+ * (#914): its own URL and the project's Google organisation domain
+ * ({@link resolveGoogleOrgDomain}).
+ *
+ * Nothing here enables remote MCP: that happens when the Owner sets up the
+ * install's Google sign-in client (Settings → Google sign-in). Until then
+ * the gateway answers 503 `remote_mcp_not_configured`.
+ */
+import { GCP_PUBLIC_BASE_PATHS } from "@caelo-cms/shared";
+import { gcloud as defaultGcloud } from "./gcloud.js";
+import { gcpNamePrefix } from "./gcp-names.js";
+import { isMcpArmorRule, MCP_ARMOR_RULE, mcpArmorRuleFlags, } from "./remote-mcp-edge.js";
+import { remoteMcpIdentity, remoteMcpIdentityEnv, } from "./stack-contract.js";
+import { liveContainerEnv, planEnvUpdate } from "./stack-converge.js";
+/** Parse gcloud JSON output; null (never a throw) when it is not JSON. */
+function parseJson(stdout) {
+    try {
+        return JSON.parse(stdout);
+    }
+    catch {
+        return null;
+    }
+}
+function lines(stdout) {
+    return stdout
+        .split("\n")
+        .map((s) => s.trim())
+        .filter(Boolean);
+}
+// ===========================================================================
+// Identity env
+// ===========================================================================
+/**
+ * #914 — the project's Google organisation domain (the organisation's
+ * `displayName`, which Cloud Resource Manager sets to its primary domain),
+ * or `none` when the project sits in no organisation. Read as the
+ * operator's identity: `organizations describe` needs
+ * `resourcemanager.organizations.get` on the organisation, which project
+ * Owners often have and the admin's service account never does.
+ */
+export async function resolveGoogleOrgDomain(projectId, deps = {}) {
+    const run = deps.run ?? defaultGcloud;
+    const ancestors = await run(["projects", "get-ancestors", projectId, "--format=json"]);
+    if (!ancestors.ok) {
+        return { ok: false, error: `read the ancestors of ${projectId}: ${ancestors.stderr.trim()}` };
+    }
+    const list = parseJson(ancestors.stdout || "[]");
+    if (!Array.isArray(list))
+        return { ok: false, error: "get-ancestors: output is not a JSON list" };
+    const org = list.find((a) => a.type === "organization");
+    if (!org?.id)
+        return { ok: true, domain: NO_GOOGLE_ORGANISATION };
+    const describe = await run(["organizations", "describe", org.id, "--format=value(displayName)"]);
+    const domain = describe.ok ? describe.stdout.trim().toLowerCase() : "";
+    if (!/^[a-z0-9.-]+\.[a-z]{2,}$/.test(domain)) {
+        return {
+            ok: false,
+            error: `read organization ${org.id}: ${describe.stderr.trim() || `unexpected name "${domain}"`} (needs the Organization Viewer role)`,
+        };
+    }
+    return { ok: true, domain };
+}
+/** `CAELO_GOOGLE_ORG_DOMAIN` value for a project outside any organisation (admin-core identity-gate.ts). */
+export const NO_GOOGLE_ORGANISATION = "none";
+/**
+ * Read the live identities {@link remoteMcpIdentity} derives from: the
+ * project number, and the admin's backend service id (`gcp`) or both
+ * services' URLs (`gcp-firebase`). Fails naming what it could not read.
+ *
+ * The organisation domain (#914) is best-effort: when it cannot be read,
+ * `orgDomainError` says why and the identity carries none, so the admin's
+ * var keeps its value — the admin then reports the organisation as unknown
+ * and refuses user creation loudly until the Owner sets up Google sign-in.
+ */
+export async function resolveRemoteMcpIdentity(target, deps = {}) {
+    const resolved = await resolveServiceIdentity(target, deps);
+    if (!resolved.ok)
+        return resolved;
+    const org = await resolveGoogleOrgDomain(target.projectId, deps);
+    return org.ok
+        ? { ok: true, identity: { ...resolved.identity, googleOrgDomain: org.domain } }
+        : { ok: true, identity: resolved.identity, orgDomainError: org.error };
+}
+async function resolveServiceIdentity(target, deps = {}) {
+    const run = deps.run ?? defaultGcloud;
+    const project = `--project=${target.projectId}`;
+    const num = await run([
+        "projects",
+        "describe",
+        target.projectId,
+        "--format=value(projectNumber)",
+    ]);
+    const projectNumber = num.ok ? num.stdout.trim() : "";
+    if (!/^\d+$/.test(projectNumber)) {
+        return {
+            ok: false,
+            error: `read the project number of ${target.projectId}: ${num.stderr.trim() || "empty"}`,
+        };
+    }
+    if (target.provider === "gcp") {
+        const prefix = `${gcpNamePrefix(target.env)}-admin-backend`;
+        const list = await run([
+            "compute",
+            "backend-services",
+            "list",
+            "--global",
+            project,
+            `--filter=name~^${prefix} AND iap.enabled=true`,
+            "--format=value(id)",
+        ]);
+        if (!list.ok)
+            return { ok: false, error: `list backend services: ${list.stderr.trim()}` };
+        const ids = lines(list.stdout);
+        if (ids.length !== 1 || !/^\d+$/.test(ids[0] ?? "")) {
+            return {
+                ok: false,
+                error: `expected exactly one IAP-enabled ${prefix}* backend service, found ${ids.length}`,
+            };
+        }
+        return {
+            ok: true,
+            identity: remoteMcpIdentity({
+                provider: "gcp",
+                domain: target.domain,
+                projectNumber,
+                adminBackendServiceId: ids[0],
+            }),
+        };
+    }
+    const url = async (service) => {
+        const r = await run([
+            "run",
+            "services",
+            "describe",
+            service,
+            `--region=${target.region}`,
+            project,
+            "--format=value(status.url)",
+        ]);
+        const value = r.ok ? r.stdout.trim() : "";
+        return value.startsWith("https://") ? value : null;
+    };
+    const adminUrl = await url(target.services.admin);
+    const gatewayUrl = await url(target.services.gateway);
+    if (!adminUrl || !gatewayUrl) {
+        return {
+            ok: false,
+            error: `read the Cloud Run URL of the ${adminUrl ? "gateway" : "admin"} service (${adminUrl ? target.services.gateway : target.services.admin})`,
+        };
+    }
+    return {
+        ok: true,
+        identity: remoteMcpIdentity({
+            provider: "gcp-firebase",
+            projectNumber,
+            region: target.region,
+            adminServiceName: target.services.admin,
+            adminServiceUrl: adminUrl,
+            gatewayServiceUrl: gatewayUrl,
+        }),
+    };
+}
+/**
+ * Bring both services' {@link RemoteMcpIdentity} env vars to `identity`
+ * with one `gcloud run services update` per service that differs (a new
+ * revision only then). Vars already right are left alone.
+ */
+export async function applyRemoteMcpIdentityEnv(target, identity, deps = {}) {
+    const run = deps.run ?? defaultGcloud;
+    const desired = remoteMcpIdentityEnv(identity);
+    const changes = { admin: [], gateway: [] };
+    for (const slug of ["admin", "gateway"]) {
+        const service = target.services[slug];
+        const describe = await run([
+            "run",
+            "services",
+            "describe",
+            service,
+            `--region=${target.region}`,
+            `--project=${target.projectId}`,
+            "--format=json",
+        ]);
+        if (!describe.ok)
+            return { ok: false, error: `describe ${service}: ${describe.stderr.trim()}` };
+        if (parseJson(describe.stdout) === null) {
+            return { ok: false, error: `describe ${service}: output is not JSON` };
+        }
+        const plan = planEnvUpdate(liveContainerEnv(describe.stdout), desired[slug]);
+        if (!plan.ok)
+            return { ok: false, error: `${slug}: ${plan.error}` };
+        if (plan.flags.length === 0)
+            continue;
+        const update = await run([
+            "run",
+            "services",
+            "update",
+            service,
+            `--region=${target.region}`,
+            `--project=${target.projectId}`,
+            ...plan.flags,
+            "--quiet",
+        ]);
+        if (!update.ok)
+            return { ok: false, error: `update ${service}: ${update.stderr.trim()}` };
+        changes[slug] = plan.changes;
+    }
+    return { ok: true, changes };
+}
+/** {@link resolveRemoteMcpIdentity} then {@link applyRemoteMcpIdentityEnv}. */
+export async function ensureRemoteMcpIdentityEnv(target, deps = {}) {
+    const resolved = await resolveRemoteMcpIdentity(target, deps);
+    if (!resolved.ok)
+        return resolved;
+    const applied = await applyRemoteMcpIdentityEnv(target, resolved.identity, deps);
+    if (!applied.ok)
+        return applied;
+    return {
+        ok: true,
+        identity: resolved.identity,
+        changes: applied.changes,
+        ...(resolved.orgDomainError ? { orgDomainError: resolved.orgDomainError } : {}),
+    };
+}
+/**
+ * The URL map with every {@link GCP_PUBLIC_BASE_PATHS} entry routed like
+ * `/api/*` (to the gateway). Only the rule that carries `/api/*` changes;
+ * redirect rules the admin wrote stay as they are. `added` is empty when the
+ * map is already complete.
+ */
+export function planUrlMapPaths(maps, siteHost) {
+    const routing = maps.flatMap((m) => (m.hostRules ?? [])
+        .filter((h) => h.hosts.includes(siteHost))
+        .map((h) => ({ map: m, pathMatcher: h.pathMatcher })));
+    if (routing.length !== 1) {
+        return {
+            ok: false,
+            error: `expected exactly one URL map routing ${siteHost}, found ${routing.length}`,
+        };
+    }
+    const { map, pathMatcher } = routing[0];
+    const matcher = (map.pathMatchers ?? []).find((m) => m.name === pathMatcher);
+    const gatewayRule = matcher?.pathRules?.find((r) => r.service !== undefined && r.urlRedirect === undefined && r.paths.includes("/api/*"));
+    if (!matcher || !gatewayRule) {
+        return {
+            ok: false,
+            error: `URL map ${map.name} has no /api/* rule to the gateway in path matcher ${pathMatcher}; re-run the installer to restore the load balancer`,
+        };
+    }
+    const added = GCP_PUBLIC_BASE_PATHS.filter((p) => !gatewayRule.paths.includes(p));
+    if (added.length === 0)
+        return { ok: true, map, added };
+    const next = {
+        ...map,
+        pathMatchers: (map.pathMatchers ?? []).map((m) => m !== matcher
+            ? m
+            : {
+                ...m,
+                pathRules: (m.pathRules ?? []).map((r) => r === gatewayRule ? { ...r, paths: [...r.paths, ...added] } : r),
+            }),
+    };
+    return { ok: true, map: next, added };
+}
+const COMPUTE_API = "https://compute.googleapis.com/compute/v1";
+const OPERATION_POLLS = 60;
+/**
+ * Route the remote-MCP discovery paths to the gateway on an existing `gcp`
+ * install: read the URL map, add the missing paths to its `/api/*` rule and
+ * write it back through the Compute API (`urlMaps.update` carries the map's
+ * fingerprint, so a concurrent write — the admin publishing redirects —
+ * fails instead of being lost; a re-run then succeeds).
+ */
+export async function ensureUrlMapRemoteMcpPaths(target, deps = {}) {
+    const run = deps.run ?? defaultGcloud;
+    const http = deps.http ?? fetch;
+    const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const list = await run([
+        "compute",
+        "url-maps",
+        "list",
+        "--global",
+        `--project=${target.projectId}`,
+        "--format=json",
+    ]);
+    if (!list.ok)
+        return { ok: false, error: `list URL maps: ${list.stderr.trim()}` };
+    const maps = parseJson(list.stdout || "[]");
+    if (!Array.isArray(maps))
+        return { ok: false, error: "list URL maps: output is not a JSON list" };
+    const plan = planUrlMapPaths(maps, target.domain);
+    if (!plan.ok)
+        return plan;
+    if (plan.added.length === 0)
+        return { ok: true, added: [] };
+    const token = await run(["auth", "print-access-token"]);
+    const bearer = token.ok ? token.stdout.trim() : "";
+    if (!bearer)
+        return { ok: false, error: `gcloud auth print-access-token: ${token.stderr.trim()}` };
+    const headers = { Authorization: `Bearer ${bearer}`, "Content-Type": "application/json" };
+    const base = `${COMPUTE_API}/projects/${encodeURIComponent(target.projectId)}/global`;
+    const put = await http(`${base}/urlMaps/${encodeURIComponent(plan.map.name)}`, {
+        method: "PUT",
+        headers,
+        body: JSON.stringify(plan.map),
+    });
+    if (!put.ok) {
+        return {
+            ok: false,
+            error: `update URL map ${plan.map.name}: HTTP ${put.status} ${(await put.text()).slice(0, 500)}`,
+        };
+    }
+    let op = (parseJson(await put.text()) ?? {});
+    for (let i = 0; op.status !== "DONE" && i < OPERATION_POLLS; i++) {
+        await sleep(2_000);
+        const poll = await http(`${base}/operations/${encodeURIComponent(op.name ?? "")}`, {
+            method: "GET",
+            headers,
+        });
+        if (!poll.ok)
+            return { ok: false, error: `poll ${op.name}: HTTP ${poll.status}` };
+        op = (parseJson(await poll.text()) ?? {});
+    }
+    if (op.status !== "DONE")
+        return { ok: false, error: `URL-map update ${op.name} did not finish` };
+    const errors = op.error?.errors ?? [];
+    if (errors.length > 0) {
+        return {
+            ok: false,
+            error: `URL-map update failed: ${errors.map((e) => e.message).join("; ")}`,
+        };
+    }
+    return { ok: true, added: plan.added };
+}
+/**
+ * Give the gateway's Cloud Armor policy the `/api/mcp/*` rule
+ * ({@link MCP_ARMOR_RULE}): create it, or bring a rule at its priority back
+ * to spec.
+ */
+export async function ensureMcpArmorRule(target, deps = {}) {
+    const run = deps.run ?? defaultGcloud;
+    const project = `--project=${target.projectId}`;
+    const prefix = `${gcpNamePrefix(target.env)}-waf`;
+    const list = await run([
+        "compute",
+        "security-policies",
+        "list",
+        project,
+        `--filter=name~^${prefix}`,
+        "--format=value(name)",
+    ]);
+    if (!list.ok)
+        return { ok: false, error: `list security policies: ${list.stderr.trim()}` };
+    const names = lines(list.stdout);
+    if (names.length !== 1) {
+        return {
+            ok: false,
+            error: `expected exactly one ${prefix}* Cloud Armor policy, found ${names.length}`,
+        };
+    }
+    const policy = names[0];
+    const describe = await run([
+        "compute",
+        "security-policies",
+        "describe",
+        policy,
+        project,
+        "--format=json",
+    ]);
+    if (!describe.ok)
+        return { ok: false, error: `describe ${policy}: ${describe.stderr.trim()}` };
+    const described = parseJson(describe.stdout);
+    if (!described)
+        return { ok: false, error: `describe ${policy}: output is not JSON` };
+    const rules = described.rules ?? [];
+    const existing = rules.find((r) => r.priority === MCP_ARMOR_RULE.priority);
+    if (existing && isMcpArmorRule(existing))
+        return { ok: true, policy, action: "present" };
+    const verb = existing ? "update" : "create";
+    const r = await run([
+        "compute",
+        "security-policies",
+        "rules",
+        verb,
+        String(MCP_ARMOR_RULE.priority),
+        `--security-policy=${policy}`,
+        project,
+        ...mcpArmorRuleFlags(),
+        "--quiet",
+    ]);
+    if (!r.ok)
+        return {
+            ok: false,
+            error: `${verb} rule ${MCP_ARMOR_RULE.priority} on ${policy}: ${r.stderr.trim()}`,
+        };
+    return { ok: true, policy, action: existing ? "updated" : "created" };
+}
+/** Both load-balancer parts on `gcp`; a no-op success on `gcp-firebase`. */
+export async function ensureRemoteMcpEdge(target, deps = {}) {
+    if (target.provider !== "gcp")
+        return { ok: true, done: [] };
+    const done = [];
+    const armor = await ensureMcpArmorRule(target, deps);
+    if (!armor.ok)
+        return { ok: false, error: `Cloud Armor: ${armor.error}` };
+    done.push(`Cloud Armor rule ${MCP_ARMOR_RULE.priority} on ${armor.policy}: ${armor.action}`);
+    const paths = await ensureUrlMapRemoteMcpPaths(target, deps);
+    if (!paths.ok)
+        return { ok: false, error: `URL map: ${paths.error}` };
+    done.push(paths.added.length > 0
+        ? `URL map: routed ${paths.added.join(", ")} to the gateway`
+        : "URL map: discovery paths already routed to the gateway");
+    return { ok: true, done };
+}
+//# sourceMappingURL=remote-mcp.js.map

package/dist/remote-mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-mcp.js","sourceRoot":"","sources":["../src/remote-mcp.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EACL,cAAc,EAEd,cAAc,EACd,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAIL,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAkB,gBAAgB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAkBtF,0EAA0E;AAC1E,SAAS,SAAS,CAAC,MAAc;IAC/B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,MAAc;IAC3B,OAAO,MAAM;SACV,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,SAAiB,EACjB,OAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,CAAC,UAAU,EAAE,eAAe,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC;IACvF,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,SAAS,KAAK,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IAChG,CAAC;IACD,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC;IAClG,MAAM,GAAG,GAAI,IAAyC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC;IAC9F,IAAI,CAAC,GAAG,EAAE,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAClE,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,CAAC,eAAe,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,EAAE,6BAA6B,CAAC,CAAC,CAAC;IACjG,MAAM,MAAM,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,qBAAqB,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,oBAAoB,MAAM,GAAG,uCAAuC;SACtI,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED,4GAA4G;AAC5G,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAE7C;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAuB,EACvB,OAA+B,EAAE;IAIjC,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC5D,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACjE,OAAO,GAAG,CAAC,EAAE;QACX,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE;QAC/E,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;AAC3E,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,MAAuB,EACvB,OAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,OAAO,GAAG,aAAa,MAAM,CAAC,SAAS,EAAE,CAAC;IAChD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC;QACpB,UAAU;QACV,UAAU;QACV,MAAM,CAAC,SAAS;QAChB,+BAA+B;KAChC,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QACjC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,8BAA8B,MAAM,CAAC,SAAS,KAAK,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,OAAO,EAAE;SACzF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC;YACrB,SAAS;YACT,kBAAkB;YAClB,MAAM;YACN,UAAU;YACV,OAAO;YACP,kBAAkB,MAAM,uBAAuB;YAC/C,oBAAoB;SACrB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QAC1F,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACpD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,oCAAoC,MAAM,4BAA4B,GAAG,CAAC,MAAM,EAAE;aAC1F,CAAC;QACJ,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE,iBAAiB,CAAC;gBAC1B,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,aAAa;gBACb,qBAAqB,EAAE,GAAG,CAAC,CAAC,CAAW;aACxC,CAAC;SACH,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,EAAE,OAAe,EAAE,EAAE;QACpC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC;YAClB,KAAK;YACL,UAAU;YACV,UAAU;YACV,OAAO;YACP,YAAY,MAAM,CAAC,MAAM,EAAE;YAC3B,OAAO;YACP,4BAA4B;SAC7B,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACrD,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;QAC7B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,iCAAiC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,aAAa,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,GAAG;SACjJ,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,QAAQ,EAAE,iBAAiB,CAAC;YAC1B,QAAQ,EAAE,cAAc;YACxB,aAAa;YACb,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,gBAAgB,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK;YACvC,eAAe,EAAE,QAAQ;YACzB,iBAAiB,EAAE,UAAU;SAC9B,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAuB,EACvB,QAA2B,EAC3B,OAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAsC,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC9E,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,SAAS,CAAU,EAAE,CAAC;QACjD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;YACzB,KAAK;YACL,UAAU;YACV,UAAU;YACV,OAAO;YACP,YAAY,MAAM,CAAC,MAAM,EAAE;YAC3B,aAAa,MAAM,CAAC,SAAS,EAAE;YAC/B,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,OAAO,KAAK,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QAChG,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;YACxC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,OAAO,sBAAsB,EAAE,CAAC;QACzE,CAAC;QACD,MAAM,IAAI,GAAG,aAAa,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7E,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,KAAK,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;QACpE,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACtC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;YACvB,KAAK;YACL,UAAU;YACV,QAAQ;YACR,OAAO;YACP,YAAY,MAAM,CAAC,MAAM,EAAE;YAC3B,aAAa,MAAM,CAAC,SAAS,EAAE;YAC/B,GAAG,IAAI,CAAC,KAAK;YACb,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,OAAO,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QAC1F,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;IAC/B,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAAuB,EACvB,OAA+B,EAAE;IAQjC,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC9D,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IAClC,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACjF,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC;IAChC,OAAO;QACL,EAAE,EAAE,IAAI;QACR,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChF,CAAC;AACJ,CAAC;AA2BD;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,IAA2B,EAAE,QAAgB;IAC3E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CACjC,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC;SAChB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;SACzC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CACxD,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,wCAAwC,QAAQ,WAAW,OAAO,CAAC,MAAM,EAAE;SACnF,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,CAAC,CAA6B,CAAC;IACpE,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;IAC7E,MAAM,WAAW,GAAG,OAAO,EAAE,SAAS,EAAE,IAAI,CAC1C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAC5F,CAAC;IACF,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,WAAW,GAAG,CAAC,IAAI,sDAAsD,WAAW,qDAAqD;SACjJ,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IACxD,MAAM,IAAI,GAAe;QACvB,GAAG,GAAG;QACN,YAAY,EAAE,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/C,CAAC,KAAK,OAAO;YACX,CAAC,CAAC,CAAC;YACH,CAAC,CAAC;gBACE,GAAG,CAAC;gBACJ,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACvC,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAChE;aACF,CACN;KACF,CAAC;IACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,WAAW,GAAG,2CAA2C,CAAC;AAChE,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAAqD,EACrD,OAAwF,EAAE;IAE1F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAK,KAA8B,CAAC;IAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1F,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC;QACrB,SAAS;QACT,UAAU;QACV,MAAM;QACN,UAAU;QACV,aAAa,MAAM,CAAC,SAAS,EAAE;QAC/B,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IAClF,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC;IAClG,MAAM,IAAI,GAAG,eAAe,CAAC,IAAoB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAClE,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC5D,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,IAAI,CAAC,MAAM;QACT,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACxF,MAAM,OAAO,GAAG,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;IAC1F,MAAM,IAAI,GAAG,GAAG,WAAW,aAAa,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC;IACtF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,IAAI,YAAY,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE;QAC7E,MAAM,EAAE,KAAK;QACb,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC;KAC/B,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,kBAAkB,IAAI,CAAC,GAAG,CAAC,IAAI,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;SACjG,CAAC;IACJ,CAAC;IAED,IAAI,EAAE,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAc,CAAC;IAC1D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,GAAG,eAAe,EAAE,CAAC,EAAE,EAAE,CAAC;QACjE,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;QACnB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,IAAI,eAAe,kBAAkB,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,EAAE;YACjF,MAAM,EAAE,KAAK;YACb,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,IAAI,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAClF,EAAE,GAAG,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAc,CAAC;IACzD,CAAC;IACD,IAAI,EAAE,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,IAAI,iBAAiB,EAAE,CAAC;IAClG,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC;IACtC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,0BAA0B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAC3E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAkD,EAClD,OAA+B,EAAE;IAIjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,OAAO,GAAG,aAAa,MAAM,CAAC,SAAS,EAAE,CAAC;IAChD,MAAM,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC;QACrB,SAAS;QACT,mBAAmB;QACnB,MAAM;QACN,OAAO;QACP,kBAAkB,MAAM,EAAE;QAC1B,sBAAsB;KACvB,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IAC3F,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,wBAAwB,MAAM,+BAA+B,KAAK,CAAC,MAAM,EAAE;SACnF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;IAClC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;QACzB,SAAS;QACT,mBAAmB;QACnB,UAAU;QACV,MAAM;QACN,OAAO;QACP,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IAC/F,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAuC,CAAC;IACnF,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,MAAM,sBAAsB,EAAE,CAAC;IACtF,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC3E,IAAI,QAAQ,IAAI,cAAc,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACzF,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC5C,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC;QAClB,SAAS;QACT,mBAAmB;QACnB,OAAO;QACP,IAAI;QACJ,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC;QAC/B,qBAAqB,MAAM,EAAE;QAC7B,OAAO;QACP,GAAG,iBAAiB,EAAE;QACtB,SAAS;KACV,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,IAAI,SAAS,cAAc,CAAC,QAAQ,OAAO,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;SAClF,CAAC;IACJ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;AACxE,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAA0E,EAC1E,OAAwF,EAAE;IAE1F,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC7D,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAC1E,IAAI,CAAC,IAAI,CAAC,oBAAoB,cAAc,CAAC,QAAQ,OAAO,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7F,MAAM,KAAK,GAAG,MAAM,0BAA0B,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC7D,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IACtE,IAAI,CAAC,IAAI,CACP,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QACpB,CAAC,CAAC,mBAAmB,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB;QAC5D,CAAC,CAAC,wDAAwD,CAC7D,CAAC;IACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC"}

package/dist/runtime-secrets.d.ts

@@ -8,6 +8,12 @@ export interface RuntimeDeps {
 }
 /** 32 random bytes as hex — the shape of every secret the stacks generate. */
 export declare function generateSecretValue(): string;
+/**
+ * The first value of a CLI-generated secret, in its format
+ * ({@link GENERATED_SECRET_FORMAT}). `generate` makes the hex ones (tests
+ * inject it); a placeholder is the fixed value its format names.
+ */
+export declare function initialSecretValue(name: (typeof CLI_GENERATED_SECRETS)[number], generate?: () => string): string;
 export interface EnsureOutcome {
     readonly id: string;
     readonly status: "present" | "applied" | "failed";
@@ -100,6 +106,12 @@ export declare function ensureGeneratedSecrets(install: {
 /** The secrets `rotate-secret` can rotate. */
 export declare const ROTATABLE_SECRETS: readonly ["postgres-password", "public-role-password", "internal-secret", "tool-approval-secret", "staging-gate-secret"];
 export type RotatableSecret = (typeof ROTATABLE_SECRETS)[number];
+/**
+ * #806 — the remote-MCP seal key rotates in two steps with an overlap
+ * window (`rotate-secret mcp-oauth-seal-key`, then `--finish`), not through
+ * {@link rotateRuntimeSecret}: see seal-key-rotation.ts.
+ */
+export declare const SEAL_KEY_SECRET = "mcp-oauth-seal-key";
 /**
  * Why `name` cannot be rotated, or `null` when it can.
  *

package/dist/runtime-secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-secrets.d.ts","sourceRoot":"","sources":["../src/runtime-secrets.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,KAAK,YAAY,EAA2B,KAAK,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAE3F,OAAO,EACL,qBAAqB,EACrB,KAAK,YAAY,EAEjB,KAAK,YAAY,EACjB,KAAK,aAAa,EAGnB,MAAM,qBAAqB,CAAC;AAG7B,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,MAAM,CAAC;CAClC;AAED,8EAA8E;AAC9E,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;IAClD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,yEAAyE;IACzE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AASD,oDAAoD;AACpD,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EAC7D,IAAI,GAAE,WAAgB,GACrB,OAAO,CAAC,aAAa,CAAC,CA4BxB;AAMD;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAC/E,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAQjE;AAED,qDAAqD;AACrD,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAE7E,mFAAmF;AACnF,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,MAAM,GAAG,UAAU,EACzB,MAAM,EAAE,MAAM,GACb,iBAAiB,CAEnB;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EAC7D,IAAI,GAAE,WAAgB,GACrB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,iBAAiB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CA2BtF;AAeD;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE;IACP,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,EACD,IAAI,GAAE,WAAgB,GACrB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAqCtD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE;IACP,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;CAC3F,EACD,IAAI,GAAE,WAAgB,GACrB,OAAO,CAAC,aAAa,EAAE,CAAC,CAmF1B;AAkBD,8CAA8C;AAC9C,eAAO,MAAM,iBAAiB,0HAQe,CAAC;AAC9C,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjE;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM3D;AAED,2DAA2D;AAC3D,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,0DAA0D;IAC1D,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1D,gEAAgE;IAChE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,iDAAiD;IACjD,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,sFAAsF;AACtF,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,YAAY,EAAE,CAInE;AA2DD,iFAAiF;AACjF,MAAM,MAAM,SAAS,GAAG,CACtB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,KACrE,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CAAE,CAAC,CAAC;AAoFvE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,eAAe,EACvB,IAAI,GAAE,WAAW,GAAG;IAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAA;CAAO,GACrD,OAAO,CAAC,cAAc,CAAC,CAiGzB;AAMD,kEAAkE;AAClE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,+BAA+B;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,YAAY,EACjB,OAAO,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EAC7D,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAarE;AAED;;;;;;;GAOG;AACH,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,kBAAkB,EAC1B,IAAI,EAAE,YAAY,EAClB,IAAI,GAAE,WAAW,GAAG;IAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GACjF,OAAO,CAAC,aAAa,CAAC,CAkBxB"}
+{"version":3,"file":"runtime-secrets.d.ts","sourceRoot":"","sources":["../src/runtime-secrets.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,KAAK,YAAY,EAA2B,KAAK,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAE3F,OAAO,EACL,qBAAqB,EACrB,KAAK,YAAY,EAEjB,KAAK,YAAY,EAEjB,KAAK,aAAa,EAGnB,MAAM,qBAAqB,CAAC;AAG7B,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,MAAM,CAAC;CAClC;AAED,8EAA8E;AAC9E,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,EAC5C,QAAQ,GAAE,MAAM,MAA4B,GAC3C,MAAM,CAUR;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;IAClD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,yEAAyE;IACzE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AASD,oDAAoD;AACpD,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EAC7D,IAAI,GAAE,WAAgB,GACrB,OAAO,CAAC,aAAa,CAAC,CA4BxB;AAMD;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAC/E,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAQjE;AAED,qDAAqD;AACrD,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAE7E,mFAAmF;AACnF,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,MAAM,GAAG,UAAU,EACzB,MAAM,EAAE,MAAM,GACb,iBAAiB,CAEnB;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EAC7D,IAAI,GAAE,WAAgB,GACrB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,iBAAiB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CA2BtF;AAeD;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE;IACP,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,EACD,IAAI,GAAE,WAAgB,GACrB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAqCtD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE;IACP,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;CAC3F,EACD,IAAI,GAAE,WAAgB,GACrB,OAAO,CAAC,aAAa,EAAE,CAAC,CAwF1B;AAkBD,8CAA8C;AAC9C,eAAO,MAAM,iBAAiB,0HAQe,CAAC;AAC9C,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjE;;;;GAIG;AACH,eAAO,MAAM,eAAe,uBAA+C,CAAC;AAE5E;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAW3D;AAED,2DAA2D;AAC3D,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,0DAA0D;IAC1D,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1D,gEAAgE;IAChE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,iDAAiD;IACjD,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,sFAAsF;AACtF,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,YAAY,EAAE,CAInE;AA2DD,iFAAiF;AACjF,MAAM,MAAM,SAAS,GAAG,CACtB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,KACrE,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CAAE,CAAC,CAAC;AAoFvE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,eAAe,EACvB,IAAI,GAAE,WAAW,GAAG;IAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAA;CAAO,GACrD,OAAO,CAAC,cAAc,CAAC,CAiGzB;AAMD,kEAAkE;AAClE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,+BAA+B;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,YAAY,EACjB,OAAO,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EAC7D,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAarE;AAED;;;;;;;GAOG;AACH,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,kBAAkB,EAC1B,IAAI,EAAE,YAAY,EAClB,IAAI,GAAE,WAAW,GAAG;IAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GACjF,OAAO,CAAC,aAAa,CAAC,CAkBxB"}