@caelo-cms/provisioning 0.10.55 → 0.10.58

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (221) hide show
  1. package/dist/agent-db.js +97 -24
  2. package/dist/cli-routing.js +1 -1
  3. package/dist/cli-routing.js.map +1 -1
  4. package/dist/cli.js +4 -1
  5. package/dist/cli.js.map +1 -1
  6. package/dist/compose.js +5 -0
  7. package/dist/compose.js.map +1 -1
  8. package/dist/converge-checkpoint.d.ts +66 -0
  9. package/dist/converge-checkpoint.d.ts.map +1 -0
  10. package/dist/converge-checkpoint.js +61 -0
  11. package/dist/converge-checkpoint.js.map +1 -0
  12. package/dist/converge-job-gcp.d.ts +46 -0
  13. package/dist/converge-job-gcp.d.ts.map +1 -0
  14. package/dist/converge-job-gcp.js +368 -0
  15. package/dist/converge-job-gcp.js.map +1 -0
  16. package/dist/converge-job-setup.d.ts +62 -0
  17. package/dist/converge-job-setup.d.ts.map +1 -0
  18. package/dist/converge-job-setup.js +228 -0
  19. package/dist/converge-job-setup.js.map +1 -0
  20. package/dist/converge-job.d.ts +141 -0
  21. package/dist/converge-job.d.ts.map +1 -0
  22. package/dist/converge-job.js +325 -0
  23. package/dist/converge-job.js.map +1 -0
  24. package/dist/gcp-names.d.ts +9 -0
  25. package/dist/gcp-names.d.ts.map +1 -1
  26. package/dist/gcp-names.js +13 -0
  27. package/dist/gcp-names.js.map +1 -1
  28. package/dist/index.d.ts +2 -0
  29. package/dist/index.d.ts.map +1 -1
  30. package/dist/index.js +2 -0
  31. package/dist/index.js.map +1 -1
  32. package/dist/infra-contract.d.ts +1 -1
  33. package/dist/infra-contract.d.ts.map +1 -1
  34. package/dist/infra-contract.js +33 -1
  35. package/dist/infra-contract.js.map +1 -1
  36. package/dist/install-job.d.ts +11 -3
  37. package/dist/install-job.d.ts.map +1 -1
  38. package/dist/install-job.js +22 -12
  39. package/dist/install-job.js.map +1 -1
  40. package/dist/lifecycle.d.ts +13 -1
  41. package/dist/lifecycle.d.ts.map +1 -1
  42. package/dist/lifecycle.js +115 -58
  43. package/dist/lifecycle.js.map +1 -1
  44. package/dist/operator-access.d.ts +4 -0
  45. package/dist/operator-access.d.ts.map +1 -1
  46. package/dist/operator-access.js +43 -7
  47. package/dist/operator-access.js.map +1 -1
  48. package/dist/release-contract.d.ts +3 -2
  49. package/dist/release-contract.d.ts.map +1 -1
  50. package/dist/release-contract.js +5 -2
  51. package/dist/release-contract.js.map +1 -1
  52. package/dist/release-manifest.d.ts +2 -0
  53. package/dist/release-manifest.d.ts.map +1 -1
  54. package/dist/release-manifest.js.map +1 -1
  55. package/dist/remote-mcp-edge.d.ts +114 -0
  56. package/dist/remote-mcp-edge.d.ts.map +1 -0
  57. package/dist/remote-mcp-edge.js +116 -0
  58. package/dist/remote-mcp-edge.js.map +1 -0
  59. package/dist/remote-mcp.d.ts +139 -0
  60. package/dist/remote-mcp.d.ts.map +1 -0
  61. package/dist/remote-mcp.js +434 -0
  62. package/dist/remote-mcp.js.map +1 -0
  63. package/dist/runtime-secrets.d.ts +12 -0
  64. package/dist/runtime-secrets.d.ts.map +1 -1
  65. package/dist/runtime-secrets.js +32 -4
  66. package/dist/runtime-secrets.js.map +1 -1
  67. package/dist/seal-key-rotation.d.ts +38 -0
  68. package/dist/seal-key-rotation.d.ts.map +1 -0
  69. package/dist/seal-key-rotation.js +206 -0
  70. package/dist/seal-key-rotation.js.map +1 -0
  71. package/dist/stack-contract.d.ts +206 -3
  72. package/dist/stack-contract.d.ts.map +1 -1
  73. package/dist/stack-contract.js +219 -4
  74. package/dist/stack-contract.js.map +1 -1
  75. package/dist/stack-converge.d.ts +53 -1
  76. package/dist/stack-converge.d.ts.map +1 -1
  77. package/dist/stack-converge.js +124 -4
  78. package/dist/stack-converge.js.map +1 -1
  79. package/dist/state-lock-lease.d.ts +142 -0
  80. package/dist/state-lock-lease.d.ts.map +1 -0
  81. package/dist/state-lock-lease.js +347 -0
  82. package/dist/state-lock-lease.js.map +1 -0
  83. package/dist/state-store.d.ts +66 -9
  84. package/dist/state-store.d.ts.map +1 -1
  85. package/dist/state-store.js +249 -30
  86. package/dist/state-store.js.map +1 -1
  87. package/dist/upgrade/app-roll.d.ts +36 -7
  88. package/dist/upgrade/app-roll.d.ts.map +1 -1
  89. package/dist/upgrade/app-roll.js +53 -19
  90. package/dist/upgrade/app-roll.js.map +1 -1
  91. package/dist/upgrade/audit-job-roll.d.ts.map +1 -1
  92. package/dist/upgrade/audit-job-roll.js +3 -1
  93. package/dist/upgrade/audit-job-roll.js.map +1 -1
  94. package/dist/upgrade/converge.d.ts.map +1 -1
  95. package/dist/upgrade/converge.js +125 -12
  96. package/dist/upgrade/converge.js.map +1 -1
  97. package/dist/upgrade/gcp-lookup.d.ts +27 -10
  98. package/dist/upgrade/gcp-lookup.d.ts.map +1 -1
  99. package/dist/upgrade/gcp-lookup.js +46 -7
  100. package/dist/upgrade/gcp-lookup.js.map +1 -1
  101. package/dist/upgrade/record-rolled.d.ts +40 -0
  102. package/dist/upgrade/record-rolled.d.ts.map +1 -0
  103. package/dist/upgrade/record-rolled.js +46 -0
  104. package/dist/upgrade/record-rolled.js.map +1 -0
  105. package/dist/upgrade/upgrade.d.ts +45 -1
  106. package/dist/upgrade/upgrade.d.ts.map +1 -1
  107. package/dist/upgrade/upgrade.js +60 -17
  108. package/dist/upgrade/upgrade.js.map +1 -1
  109. package/dist/upgrader-assess.d.ts +15 -1
  110. package/dist/upgrader-assess.d.ts.map +1 -1
  111. package/dist/upgrader-assess.js +36 -6
  112. package/dist/upgrader-assess.js.map +1 -1
  113. package/dist/upgrader-gcp.d.ts +15 -0
  114. package/dist/upgrader-gcp.d.ts.map +1 -1
  115. package/dist/upgrader-gcp.js +42 -7
  116. package/dist/upgrader-gcp.js.map +1 -1
  117. package/dist/upgrader-iam-preflight.d.ts +123 -0
  118. package/dist/upgrader-iam-preflight.d.ts.map +1 -0
  119. package/dist/upgrader-iam-preflight.js +414 -0
  120. package/dist/upgrader-iam-preflight.js.map +1 -0
  121. package/dist/upgrader-job.d.ts +33 -9
  122. package/dist/upgrader-job.d.ts.map +1 -1
  123. package/dist/upgrader-job.js +169 -27
  124. package/dist/upgrader-job.js.map +1 -1
  125. package/dist/upgrader-records.d.ts +58 -0
  126. package/dist/upgrader-records.d.ts.map +1 -0
  127. package/dist/upgrader-records.js +87 -0
  128. package/dist/upgrader-records.js.map +1 -0
  129. package/dist/upgrader-reporter.d.ts +3 -2
  130. package/dist/upgrader-reporter.d.ts.map +1 -1
  131. package/dist/upgrader-reporter.js +10 -2
  132. package/dist/upgrader-reporter.js.map +1 -1
  133. package/dist/upgrader-setup.d.ts +25 -3
  134. package/dist/upgrader-setup.d.ts.map +1 -1
  135. package/dist/upgrader-setup.js +123 -11
  136. package/dist/upgrader-setup.js.map +1 -1
  137. package/dist/wizards/gcp-cost.d.ts.map +1 -1
  138. package/dist/wizards/gcp-cost.js +11 -3
  139. package/dist/wizards/gcp-cost.js.map +1 -1
  140. package/dist/wizards/gcp-pulumi.d.ts +6 -0
  141. package/dist/wizards/gcp-pulumi.d.ts.map +1 -1
  142. package/dist/wizards/gcp-pulumi.js +14 -2
  143. package/dist/wizards/gcp-pulumi.js.map +1 -1
  144. package/dist/wizards/gcp.d.ts.map +1 -1
  145. package/dist/wizards/gcp.js +106 -4
  146. package/dist/wizards/gcp.js.map +1 -1
  147. package/package.json +2 -2
  148. package/src/agent/run.test.ts +14 -1
  149. package/src/audit-job-setup.test.ts +7 -1
  150. package/src/cli-routing.ts +1 -1
  151. package/src/cli.ts +4 -1
  152. package/src/compose.ts +5 -0
  153. package/src/converge-checkpoint.ts +75 -0
  154. package/src/converge-entrypoint.test.ts +213 -0
  155. package/src/converge-job-gcp.test.ts +222 -0
  156. package/src/converge-job-gcp.ts +443 -0
  157. package/src/converge-job-setup.test.ts +152 -0
  158. package/src/converge-job-setup.ts +268 -0
  159. package/src/converge-job.test.ts +486 -0
  160. package/src/converge-job.ts +542 -0
  161. package/src/gateway-env-isolation.test.ts +8 -1
  162. package/src/gcp-names.ts +15 -0
  163. package/src/gcp-url-map.test.ts +9 -1
  164. package/src/index.ts +8 -0
  165. package/src/infra-contract.test.ts +8 -4
  166. package/src/infra-contract.ts +33 -1
  167. package/src/install-job.test.ts +3 -1
  168. package/src/install-job.ts +31 -14
  169. package/src/lifecycle.ts +137 -71
  170. package/src/operator-access.test.ts +24 -1
  171. package/src/operator-access.ts +44 -6
  172. package/src/release-contract.ts +5 -2
  173. package/src/release-manifest.test.ts +42 -0
  174. package/src/release-manifest.ts +2 -0
  175. package/src/remote-mcp-edge.ts +137 -0
  176. package/src/remote-mcp.test.ts +690 -0
  177. package/src/remote-mcp.ts +524 -0
  178. package/src/runtime-secrets.test.ts +31 -6
  179. package/src/runtime-secrets.ts +41 -3
  180. package/src/seal-key-rotation.test.ts +131 -0
  181. package/src/seal-key-rotation.ts +258 -0
  182. package/src/stack-contract-parity.test.ts +20 -3
  183. package/src/stack-contract.test.ts +32 -2
  184. package/src/stack-contract.ts +363 -4
  185. package/src/stack-converge-secrets.test.ts +4 -0
  186. package/src/stack-converge.test.ts +21 -5
  187. package/src/stack-converge.ts +162 -7
  188. package/src/state-attach.test.ts +7 -1
  189. package/src/state-lock-lease.test.ts +302 -0
  190. package/src/state-lock-lease.ts +423 -0
  191. package/src/state-lock.test.ts +568 -0
  192. package/src/state-store.ts +347 -27
  193. package/src/upgrade/app-roll.ts +102 -21
  194. package/src/upgrade/audit-job-roll.ts +3 -1
  195. package/src/upgrade/converge.ts +148 -10
  196. package/src/upgrade/gcp-lookup.test.ts +80 -0
  197. package/src/upgrade/gcp-lookup.ts +65 -8
  198. package/src/upgrade/record-rolled.test.ts +105 -0
  199. package/src/upgrade/record-rolled.ts +91 -0
  200. package/src/upgrade/upgrade.test.ts +203 -3
  201. package/src/upgrade/upgrade.ts +120 -24
  202. package/src/upgrader-assess.test.ts +92 -3
  203. package/src/upgrader-assess.ts +58 -9
  204. package/src/upgrader-gcp.ts +47 -8
  205. package/src/upgrader-iam-preflight.test.ts +393 -0
  206. package/src/upgrader-iam-preflight.ts +510 -0
  207. package/src/upgrader-job.test.ts +586 -15
  208. package/src/upgrader-job.ts +237 -53
  209. package/src/upgrader-records.ts +151 -0
  210. package/src/upgrader-reporter.test.ts +6 -0
  211. package/src/upgrader-reporter.ts +7 -2
  212. package/src/upgrader-setup.test.ts +3 -3
  213. package/src/upgrader-setup.ts +128 -11
  214. package/src/wizards/gcp-cost.ts +12 -3
  215. package/src/wizards/gcp-pulumi.test.ts +15 -0
  216. package/src/wizards/gcp-pulumi.ts +18 -2
  217. package/src/wizards/gcp.ts +134 -4
  218. package/stacks/aws/index.ts +10 -0
  219. package/stacks/azure/index.ts +9 -0
  220. package/stacks/gcp/index.ts +47 -7
  221. package/stacks/gcp-firebase/index.ts +38 -6
@@ -130,6 +130,12 @@ export declare const OPERATOR_ACCESS_JOB_ENV_VAR = "CAELO_OPERATOR_ACCESS_JOB";
130
130
  * could not set the job up.
131
131
  */
132
132
  export declare const UPGRADER_JOB_ENV_VAR = "CAELO_UPGRADER_JOB";
133
+ /**
134
+ * The admin env var naming the converge job (#819) — what "Install update"
135
+ * starts for a release that changes the cloud setup. `upgrade` leaves it
136
+ * untouched when it could not set the job up.
137
+ */
138
+ export declare const CONVERGE_JOB_ENV_VAR = "CAELO_CONVERGE_JOB";
133
139
  /**
134
140
  * #875 — the admin env vars naming the parallel quality-audit job and the
135
141
  * bucket its tasks write results into (admin-core quality/
@@ -189,7 +195,22 @@ export declare function adminMediaVolumeTemplate(volume: MediaVolumeContract): {
189
195
  * The Secret Manager secrets admin + gateway read at runtime, by logical
190
196
  * name ({@link gcpSecretId} gives the secret id).
191
197
  */
192
- export type RuntimeSecret = "postgres-password" | "public-role-password" | "secret-kek" | "internal-secret" | "tool-approval-secret" | "staging-gate-secret";
198
+ export type RuntimeSecret = "postgres-password" | "public-role-password" | "secret-kek" | "internal-secret" | "tool-approval-secret" | "staging-gate-secret"
199
+ /**
200
+ * #914 — the install's Google sign-in client: JSON
201
+ * `{"client_id","client_secret"}`, `{}` while it is not set up. One client
202
+ * for IAP browser login, IAP programmatic access and the remote-MCP broker
203
+ * (#806 introduced it as `mcp-oauth-client`). The Owner writes it from
204
+ * Settings → Google sign-in (the admin may add versions, never read them);
205
+ * the gateway reads it from a file, the operator-access sync job reads it
206
+ * to hand it to IAP.
207
+ */
208
+ | "operator-oauth-client"
209
+ /**
210
+ * #806 — the broker's AES-256-GCM key (base64, 32 bytes) that seals its
211
+ * stateless OAuth state, codes and refresh tokens. Gateway only.
212
+ */
213
+ | "mcp-oauth-seal-key";
193
214
  /** The Postgres roles Caelo's services log in as, with their passwords. */
194
215
  export type DatabaseRole = "admin_role" | "public_role";
195
216
  /**
@@ -207,7 +228,32 @@ export declare const DATABASE_ROLE_SECRET: Readonly<Record<DatabaseRole, Runtime
207
228
  * Pulumi only references them, so a `pulumi up` after an upgrade never
208
229
  * collides with a secret upgrade created.
209
230
  */
210
- export declare const CLI_GENERATED_SECRETS: readonly ["internal-secret", "tool-approval-secret", "public-role-password", "staging-gate-secret"];
231
+ export declare const CLI_GENERATED_SECRETS: readonly ["internal-secret", "tool-approval-secret", "public-role-password", "staging-gate-secret", "operator-oauth-client", "mcp-oauth-seal-key"];
232
+ /** A CLI-generated secret's first value: random hex, random base64, or a fixed placeholder. */
233
+ export type GeneratedSecretFormat = {
234
+ readonly kind: "hex32";
235
+ } | {
236
+ readonly kind: "base64-32";
237
+ } | {
238
+ readonly kind: "placeholder";
239
+ readonly value: string;
240
+ };
241
+ /**
242
+ * How each CLI-generated secret's first version is made. Every secret not
243
+ * listed is 32 random bytes as hex — the shape the stacks always generated.
244
+ */
245
+ export declare const GENERATED_SECRET_FORMAT: Readonly<Record<(typeof CLI_GENERATED_SECRETS)[number], GeneratedSecretFormat>>;
246
+ /**
247
+ * Secrets an older contract created that nothing reads any more. Upgrade
248
+ * deletes each once both services rolled onto revisions that no longer
249
+ * reference it (stack-converge.ts `deleteRetiredSecrets`); deleting a
250
+ * secret drops its IAM bindings with it. Pre-1.0 delete-don't-migrate: a
251
+ * renamed secret is created fresh, never copied.
252
+ */
253
+ export declare const RETIRED_RUNTIME_SECRETS: readonly {
254
+ readonly name: string;
255
+ readonly why: string;
256
+ }[];
211
257
  /**
212
258
  * Each service's Secret Manager-backed env vars and the secret each reads.
213
259
  * The services' run SAs get `secretAccessor` on exactly these secrets
@@ -215,7 +261,69 @@ export declare const CLI_GENERATED_SECRETS: readonly ["internal-secret", "tool-a
215
261
  * boundary between the two services.
216
262
  */
217
263
  export declare const SERVICE_SECRET_ENV: Readonly<Record<CloudRunSlug, Readonly<Record<string, RuntimeSecret>>>>;
218
- /** The secrets `service` reads (deduplicated, table order). */
264
+ /** Env var naming the file that holds the install's Google sign-in client (#914). */
265
+ export declare const OPERATOR_OAUTH_CLIENT_FILE_ENV = "CAELO_OPERATOR_OAUTH_CLIENT_FILE";
266
+ /**
267
+ * A Secret Manager secret mounted into a service as one file, at `latest`.
268
+ *
269
+ * Why a file and not an env var: Cloud Run resolves a secret env var once,
270
+ * at instance start, but reads a secret volume from Secret Manager each
271
+ * time the file is read ("When reading a volume, Cloud Run always fetches
272
+ * the secret value from the Secret Manager to use the value with the latest
273
+ * version" — cloud.google.com/run/docs/configuring/services/secrets). So the
274
+ * client the Owner saves under Settings → Google sign-in reaches the running gateway
275
+ * (which re-reads it within 60 s) without a new revision, and the admin
276
+ * needs no right to deploy the gateway.
277
+ */
278
+ export interface SecretFileContract {
279
+ readonly secret: RuntimeSecret;
280
+ /** Volume name the stacks give it (gcloud names the ones upgrade adds itself). */
281
+ readonly volumeName: string;
282
+ /** Directory the volume is mounted at; must not exist in the image. */
283
+ readonly mountDir: string;
284
+ readonly fileName: string;
285
+ /** Always `latest`: a pinned version would never see the Owner's new client. */
286
+ readonly version: "latest";
287
+ }
288
+ /** The gateway's Google sign-in client file, read by the remote-MCP broker (#806, #914). */
289
+ export declare const OPERATOR_OAUTH_CLIENT_FILE: SecretFileContract;
290
+ /** Full path of a secret file inside the container. */
291
+ export declare function secretFilePath(file: SecretFileContract): string;
292
+ /** Each service's secret files. The admin has none. */
293
+ export declare const SERVICE_SECRET_FILES: Readonly<Record<CloudRunSlug, readonly SecretFileContract[]>>;
294
+ /** A secret file an older contract mounted; upgrade unmounts it in the roll. */
295
+ export interface RetiredSecretFile {
296
+ readonly mountDir: string;
297
+ readonly fileName: string;
298
+ readonly why: string;
299
+ }
300
+ /**
301
+ * Secret files older contracts mounted that nothing reads any more, per
302
+ * service. The roll removes each mount (`--remove-secrets=<path>`) in the
303
+ * same revision that mounts its replacement.
304
+ */
305
+ export declare const RETIRED_SECRET_FILES: Readonly<Record<CloudRunSlug, readonly RetiredSecretFile[]>>;
306
+ /**
307
+ * The secret files of `service` in the shape `gcp.cloudrunv2.Service`
308
+ * takes: `volumes` on the template, `volumeMounts` on the container.
309
+ */
310
+ export declare function secretFileVolumesTemplate(service: CloudRunSlug, env: string): {
311
+ readonly volumes: {
312
+ name: string;
313
+ secret: {
314
+ secret: string;
315
+ items: {
316
+ version: string;
317
+ path: string;
318
+ }[];
319
+ };
320
+ }[];
321
+ readonly volumeMounts: {
322
+ name: string;
323
+ mountPath: string;
324
+ }[];
325
+ };
326
+ /** The secrets `service` reads, as env or as files (deduplicated, table order). */
219
327
  export declare function serviceSecrets(service: CloudRunSlug): RuntimeSecret[];
220
328
  /**
221
329
  * Env vars an older stack set that the contract no longer gives a service;
@@ -245,6 +353,101 @@ export declare const GATEWAY_TRUSTED_PROXY_HOPS: Readonly<Record<SupportedProvid
245
353
  * spurious diffs.
246
354
  */
247
355
  export declare function gatewayEnvContract<V>(inputs: RuntimeEnvInputs<V>): CloudRunEnvVar<V | string>[];
356
+ /**
357
+ * #806 — the gateway's request timeout, in seconds: Cloud Run's maximum.
358
+ * The gateway proxies remote-MCP requests to the admin, and a `caelo_chat`
359
+ * turn streams for as long as the admin's own chat stream may (the admin
360
+ * runs at 3600 s for the same reason). Visitor endpoints are unaffected: a
361
+ * timeout is a ceiling, not a reservation, and Cloud Run bills request time,
362
+ * not the allowed maximum. On `gcp` the load balancer in front adds no
363
+ * shorter limit — the backend-service timeout does not apply to serverless
364
+ * NEGs, which get a fixed 60 minutes
365
+ * (cloud.google.com/load-balancing/docs/negs/serverless-neg-concepts).
366
+ */
367
+ export declare const GATEWAY_TIMEOUT_SECONDS = 3600;
368
+ /** Admin env var naming the Secret Manager secret the Owner writes the Google sign-in client to. */
369
+ export declare const OPERATOR_OAUTH_CLIENT_STORE_ENV = "CAELO_OPERATOR_OAUTH_CLIENT_STORE";
370
+ /** `projects/<project>/secrets/<id>` of the Google sign-in client secret (#914). */
371
+ export declare function operatorOAuthClientSecretResource(projectId: string, env: string): string;
372
+ /**
373
+ * The remote-MCP env vars that name generated identities of the install:
374
+ * the admin's URL, the gateway's public origin, and the audience of the IAP
375
+ * JWTs the admin verifies.
376
+ *
377
+ * They are not part of {@link adminEnvContract} / {@link gatewayEnvContract}
378
+ * because the stacks cannot declare them: on `gcp-firebase` each service's
379
+ * value names a Cloud Run service Pulumi auto-names (the admin's audience is
380
+ * its own name; the gateway's public URL is its own URL; the admin's URL is
381
+ * a service created after the gateway), and on `gcp` the audience is the
382
+ * numeric id of a backend service created after the admin. A resource
383
+ * cannot take its own (or a later resource's) output as input. So the CLI
384
+ * reads the live identities after deploy and applies these vars with gcloud
385
+ * — the wizard after every `pulumi up`, `upgrade` after every roll
386
+ * (remote-mcp.ts `ensureRemoteMcpIdentityEnv`). A roll that does not set
387
+ * them leaves them as they are (planEnvUpdate never removes a var the
388
+ * contract does not own).
389
+ *
390
+ * #914 adds two the admin's Google sign-in needs: its own URL (the
391
+ * self-check opens it signed out) and the project's Google organisation
392
+ * domain, which the admin's service account cannot read (organisation
393
+ * metadata needs a grant on the organisation) but the operator's identity
394
+ * usually can.
395
+ */
396
+ export interface RemoteMcpIdentity {
397
+ /** Where the gateway proxies `/api/mcp/<surface>` to (IAP in front). */
398
+ readonly adminUrl: string;
399
+ /** The broker's public origin; no trailing slash. */
400
+ readonly mcpPublicUrl: string;
401
+ /** The `aud` of the admin's IAP JWTs. */
402
+ readonly iapAudience: string;
403
+ /**
404
+ * #914 — the project's Google organisation domain, `none` when the project
405
+ * is in no organisation, undefined when it could not be read (the var is
406
+ * then left as it is and the admin reports the organisation as unknown).
407
+ */
408
+ readonly googleOrgDomain?: string;
409
+ }
410
+ /** Env var names of {@link RemoteMcpIdentity}. */
411
+ export declare const REMOTE_MCP_ENV: {
412
+ readonly adminUrl: "CAELO_ADMIN_URL";
413
+ readonly mcpPublicUrl: "CAELO_MCP_PUBLIC_URL";
414
+ readonly iapAudience: "CAELO_IAP_AUDIENCE";
415
+ readonly googleOrgDomain: "CAELO_GOOGLE_ORG_DOMAIN";
416
+ };
417
+ /** What {@link remoteMcpIdentity} derives the identity from — all read from the live install. */
418
+ export type RemoteMcpIdentityInputs = {
419
+ readonly provider: "gcp";
420
+ readonly domain: string;
421
+ readonly projectNumber: string;
422
+ /** Numeric `id` of the admin's IAP-enabled backend service. */
423
+ readonly adminBackendServiceId: string;
424
+ } | {
425
+ readonly provider: "gcp-firebase";
426
+ readonly projectNumber: string;
427
+ readonly region: string;
428
+ readonly adminServiceName: string;
429
+ /** The services' `status.url` (`https://<name>-<hash>-<r>.a.run.app`). */
430
+ readonly adminServiceUrl: string;
431
+ readonly gatewayServiceUrl: string;
432
+ };
433
+ /**
434
+ * The install's remote-MCP identity.
435
+ *
436
+ * - `gcp`: the broker answers on the site's own host through the load
437
+ * balancer (`/api/*` and the `/.well-known/oauth-*` path rules), the admin
438
+ * on `admin.<domain>` behind the LB's IAP; the IAP audience is
439
+ * `/projects/<number>/global/backendServices/<id>`.
440
+ * - `gcp-firebase`: the broker answers on the gateway's own Cloud Run URL
441
+ * (Firebase Hosting rewrites cut requests at 60 s and buffer streams), the
442
+ * admin on its Cloud Run URL behind native IAP — whatever custom domain
443
+ * is mapped to it, IAP and its audience are the service's; the audience
444
+ * is `/projects/<number>/locations/<region>/services/<name>`.
445
+ *
446
+ * Audience formats: cloud.google.com/iap/docs/signed-headers-howto.
447
+ */
448
+ export declare function remoteMcpIdentity(i: RemoteMcpIdentityInputs): RemoteMcpIdentity;
449
+ /** {@link RemoteMcpIdentity} as each service's env vars. */
450
+ export declare function remoteMcpIdentityEnv(id: RemoteMcpIdentity): Record<CloudRunSlug, CloudRunEnvVar[]>;
248
451
  /**
249
452
  * The env of the admin service.
250
453
  *
@@ -1 +1 @@
1
- {"version":3,"file":"stack-contract.d.ts","sourceRoot":"","sources":["../src/stack-contract.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AActD,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,cAAc,CAAC;AACjD,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,SAAS,CAAC;AAE/C;;;;GAIG;AACH,MAAM,MAAM,cAAc,CAAC,CAAC,GAAG,MAAM,IACjC;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAC5C;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE;QACpB,QAAQ,CAAC,YAAY,EAAE;YAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC;KACzE,CAAC;CACH,CAAC;AAEN,yDAAyD;AACzD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,8EAA8E;AAC9E,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,MAAM;IACtC,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;IAClB,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;CACpB;AAKD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAQvD;AAED,kFAAkF;AAClF,MAAM,WAAW,gBAAgB,CAAC,CAAC,GAAG,MAAM,CAAE,SAAQ,gBAAgB;IACpE,+DAA+D;IAC/D,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;CACxC;AAED;;;;;GAKG;AACH,MAAM,MAAM,cAAc,CAAC,CAAC,GAAG,MAAM,IACjC,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG;IAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAA;CAAE,CAAC,GACpD,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG;IACrB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC;CAC5B,CAAC,CAAC;AAEP,qFAAqF;AACrF,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,6DAA6D;AAC7D,eAAO,MAAM,gBAAgB,uBAAuB,CAAC;AAErD;;;GAGG;AACH,eAAO,MAAM,WAAW,kCAAkC,CAAC;AAE3D;;;GAGG;AACH,eAAO,MAAM,2BAA2B,8BAA8B,CAAC;AAEvE;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,uBAAuB,CAAC;AAEzD;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,oBAAoB,CAAC;AACnD,eAAO,MAAM,4BAA4B,+BAA+B,CAAC;AASzE;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,+BAA+B,CAAC;AAE7D,gDAAgD;AAChD,eAAO,MAAM,iBAAiB,UAAU,CAAC;AAEzC;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,8CAA8C;AAC9C,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,mBAAmB,CAMpF;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,mBAAmB;;;;;;;;;;;;;EAMnE;AAMD;;;GAGG;AACH,MAAM,MAAM,aAAa,GACrB,mBAAmB,GACnB,sBAAsB,GACtB,YAAY,GACZ,iBAAiB,GACjB,sBAAsB,GACtB,qBAAqB,CAAC;AAE1B,2EAA2E;AAC3E,MAAM,MAAM,YAAY,GAAG,YAAY,GAAG,aAAa,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,aAAa,CAAC,CAG9E,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,qGAUW,CAAC;AAE9C;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CACvC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CAuB9D,CAAC;AAEF,+DAA+D;AAC/D,wBAAgB,cAAc,CAAC,OAAO,EAAE,YAAY,GAAG,aAAa,EAAE,CAErE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC,CAUjF,CAAC;AAyBF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,6BAA6B,CAAC;AAEjE;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAmBlF,CAAC;AAEF;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,CAO/F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,CAqD3F;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB;;;;;CAKpB,CAAC;AAEX,6CAA6C;AAC7C,MAAM,MAAM,YAAY;AACtB,gEAAgE;AAC9D,QAAQ;AACV,0CAA0C;GACxC,YAAY;AACd,6CAA6C;GAC3C,qBAAqB;AACvB,8EAA8E;GAC5E,mBAAmB,GACnB,UAAU,CAAC;AAEf,wDAAwD;AACxD,MAAM,MAAM,SAAS,GACjB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAA;CAAE,GAC5E;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;CAAE,CAAC;AAErE;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,CAAC;IACrC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAID,4EAA4E;AAC5E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,wEAAwE;IACxE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,oBAAoB,EAAE,CAS9D;AA+ID;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,iBAAiB,EAa5D,CAAC;AAEF,qEAAqE;AACrE,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,WAAW,GAAG,YAAY,EAAE,CAMxE;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAiBvF,CAAC;AAEF,mEAAmE;AACnE,wBAAgB,SAAS,CACvB,SAAS,EAAE,YAAY,EACvB,OAAO,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC5F,MAAM,CAaR;AAMD,6EAA6E;AAC7E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;IAC5C,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,gFAAgF;IAChF,QAAQ,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAE7C;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAAS,yBAAyB,EAiC7E,CAAC;AAEF,yEAAyE;AACzE,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,SAAS;IAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EAAE,EACvF,YAAY,EAAE,SAAS,MAAM,EAAE,GAC9B,MAAM,CAKR;AAED,qFAAqF;AACrF,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,QAAQ,CAAC;AAE1C;;;GAGG;AACH;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG;IAC5D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAQA;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAcjE"}
1
+ {"version":3,"file":"stack-contract.d.ts","sourceRoot":"","sources":["../src/stack-contract.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAetD,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,cAAc,CAAC;AACjD,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,SAAS,CAAC;AAE/C;;;;GAIG;AACH,MAAM,MAAM,cAAc,CAAC,CAAC,GAAG,MAAM,IACjC;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAC5C;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE;QACpB,QAAQ,CAAC,YAAY,EAAE;YAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC;KACzE,CAAC;CACH,CAAC;AAEN,yDAAyD;AACzD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,8EAA8E;AAC9E,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,MAAM;IACtC,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;IAClB,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;CACpB;AAKD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAQvD;AAED,kFAAkF;AAClF,MAAM,WAAW,gBAAgB,CAAC,CAAC,GAAG,MAAM,CAAE,SAAQ,gBAAgB;IACpE,+DAA+D;IAC/D,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;CACxC;AAED;;;;;GAKG;AACH,MAAM,MAAM,cAAc,CAAC,CAAC,GAAG,MAAM,IACjC,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG;IAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAA;CAAE,CAAC,GACpD,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG;IACrB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC;CAC5B,CAAC,CAAC;AAEP,qFAAqF;AACrF,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,6DAA6D;AAC7D,eAAO,MAAM,gBAAgB,uBAAuB,CAAC;AAErD;;;GAGG;AACH,eAAO,MAAM,WAAW,kCAAkC,CAAC;AAE3D;;;GAGG;AACH,eAAO,MAAM,2BAA2B,8BAA8B,CAAC;AAEvE;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,uBAAuB,CAAC;AAEzD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,uBAAuB,CAAC;AAEzD;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,oBAAoB,CAAC;AACnD,eAAO,MAAM,4BAA4B,+BAA+B,CAAC;AASzE;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,+BAA+B,CAAC;AAE7D,gDAAgD;AAChD,eAAO,MAAM,iBAAiB,UAAU,CAAC;AAEzC;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,8CAA8C;AAC9C,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,mBAAmB,CAMpF;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,mBAAmB;;;;;;;;;;;;;EAMnE;AAMD;;;GAGG;AACH,MAAM,MAAM,aAAa,GACrB,mBAAmB,GACnB,sBAAsB,GACtB,YAAY,GACZ,iBAAiB,GACjB,sBAAsB,GACtB,qBAAqB;AACvB;;;;;;;;GAQG;GACD,uBAAuB;AACzB;;;GAGG;GACD,oBAAoB,CAAC;AAEzB,2EAA2E;AAC3E,MAAM,MAAM,YAAY,GAAG,YAAY,GAAG,aAAa,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,aAAa,CAAC,CAG9E,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,oJAgBW,CAAC;AAE9C,+FAA+F;AAC/F,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7D;;;GAGG;AACH,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAC5C,MAAM,CAAC,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,EAAE,qBAAqB,CAAC,CAYtE,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EAO7F,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CACvC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CAyB9D,CAAC;AAMF,qFAAqF;AACrF,eAAO,MAAM,8BAA8B,qCAAqC,CAAC;AAEjF;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,gFAAgF;IAChF,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC;CAC5B;AAED,4FAA4F;AAC5F,eAAO,MAAM,0BAA0B,EAAE,kBAMxC,CAAC;AAEF,uDAAuD;AACvD,wBAAgB,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,MAAM,CAE/D;AAED,uDAAuD;AACvD,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,kBAAkB,EAAE,CAAC,CAG9F,CAAC;AAEF,gFAAgF;AAChF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,iBAAiB,EAAE,CAAC,CAS7F,CAAC;AAEF;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,YAAY,EACrB,GAAG,EAAE,MAAM,GACV;IACD,QAAQ,CAAC,OAAO,EAAE;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE;gBAAE,OAAO,EAAE,MAAM,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAA;aAAE,EAAE,CAAA;SAAE,CAAC;KACxE,EAAE,CAAC;IACJ,QAAQ,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC9D,CAYA;AAED,mFAAmF;AACnF,wBAAgB,cAAc,CAAC,OAAO,EAAE,YAAY,GAAG,aAAa,EAAE,CAOrE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC,CAajF,CAAC;AAyBF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,6BAA6B,CAAC;AAEjE;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAmBlF,CAAC;AAEF;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,CAU/F;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAE5C,oGAAoG;AACpG,eAAO,MAAM,+BAA+B,sCAAsC,CAAC;AAEnF,oFAAoF;AACpF,wBAAgB,iCAAiC,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAExF;AAMD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,iBAAiB;IAChC,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,qDAAqD;IACrD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,yCAAyC;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,kDAAkD;AAClD,eAAO,MAAM,cAAc;;;;;CAKjB,CAAC;AAEX,iGAAiG;AACjG,MAAM,MAAM,uBAAuB,GAC/B;IACE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,+DAA+D;IAC/D,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;CACxC,GACD;IACE,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,0EAA0E;IAC1E,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC,CAAC;AAEN;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,uBAAuB,GAAG,iBAAiB,CAc/E;AAED,4DAA4D;AAC5D,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,iBAAiB,GACpB,MAAM,CAAC,YAAY,EAAE,cAAc,EAAE,CAAC,CAmBxC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,CA+D3F;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB;;;;;CAKpB,CAAC;AAEX,6CAA6C;AAC7C,MAAM,MAAM,YAAY;AACtB,gEAAgE;AAC9D,QAAQ;AACV,0CAA0C;GACxC,YAAY;AACd,6CAA6C;GAC3C,qBAAqB;AACvB,8EAA8E;GAC5E,mBAAmB,GACnB,UAAU,CAAC;AAEf,wDAAwD;AACxD,MAAM,MAAM,SAAS,GACjB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAA;CAAE,GAC5E;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;CAAE,CAAC;AAErE;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,CAAC;IACrC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAKD,4EAA4E;AAC5E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,wEAAwE;IACxE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,oBAAoB,EAAE,CAS9D;AAiKD;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,iBAAiB,EAa5D,CAAC;AAEF,qEAAqE;AACrE,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,WAAW,GAAG,YAAY,EAAE,CAOxE;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAiBvF,CAAC;AAEF,mEAAmE;AACnE,wBAAgB,SAAS,CACvB,SAAS,EAAE,YAAY,EACvB,OAAO,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC5F,MAAM,CAaR;AAMD,6EAA6E;AAC7E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;IAC5C,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,gFAAgF;IAChF,QAAQ,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAE7C;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAAS,yBAAyB,EAiC7E,CAAC;AAEF,yEAAyE;AACzE,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,SAAS;IAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EAAE,EACvF,YAAY,EAAE,SAAS,MAAM,EAAE,GAC9B,MAAM,CAKR;AAED,qFAAqF;AACrF,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,QAAQ,CAAC;AAE1C;;;GAGG;AACH;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG;IAC5D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAQA;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAcjE"}
@@ -1,5 +1,5 @@
1
1
  // SPDX-License-Identifier: MPL-2.0
2
- import { auditJobResource, gatewayServiceAccountEmail, gcpBucketName, gcpNamePrefix, gcpSecretId, mcpIapServiceAccountEmail, operatorAccessJobResource, runServiceAccountEmail, staticPublisherServiceAccountId, upgraderJobResource, } from "./gcp-names.js";
2
+ import { auditJobResource, convergeJobResource, gatewayServiceAccountEmail, gcpBucketName, gcpNamePrefix, gcpSecretId, mcpIapServiceAccountEmail, operatorAccessJobResource, runServiceAccountEmail, staticPublisherServiceAccountId, upgraderJobResource, } from "./gcp-names.js";
3
3
  /** Port Cloud SQL Postgres listens on (private IP). */
4
4
  const DATABASE_PORT = 5432;
5
5
  /**
@@ -45,6 +45,12 @@ export const OPERATOR_ACCESS_JOB_ENV_VAR = "CAELO_OPERATOR_ACCESS_JOB";
45
45
  * could not set the job up.
46
46
  */
47
47
  export const UPGRADER_JOB_ENV_VAR = "CAELO_UPGRADER_JOB";
48
+ /**
49
+ * The admin env var naming the converge job (#819) — what "Install update"
50
+ * starts for a release that changes the cloud setup. `upgrade` leaves it
51
+ * untouched when it could not set the job up.
52
+ */
53
+ export const CONVERGE_JOB_ENV_VAR = "CAELO_CONVERGE_JOB";
48
54
  /**
49
55
  * #875 — the admin env vars naming the parallel quality-audit job and the
50
56
  * bucket its tasks write results into (admin-core quality/
@@ -115,6 +121,43 @@ export const CLI_GENERATED_SECRETS = [
115
121
  // session cookies, derives the crawler credentials. Read by the admin
116
122
  // (issues) and the gateway (verifies).
117
123
  "staging-gate-secret",
124
+ // #914 / #806 — the Google sign-in client starts as the `{}` placeholder
125
+ // (not configured; the Owner fills it under Settings → Google sign-in),
126
+ // the broker's seal key as 32 random bytes in base64
127
+ // ({@link GENERATED_SECRET_FORMAT}).
128
+ "operator-oauth-client",
129
+ "mcp-oauth-seal-key",
130
+ ];
131
+ /**
132
+ * How each CLI-generated secret's first version is made. Every secret not
133
+ * listed is 32 random bytes as hex — the shape the stacks always generated.
134
+ */
135
+ export const GENERATED_SECRET_FORMAT = {
136
+ "internal-secret": { kind: "hex32" },
137
+ "tool-approval-secret": { kind: "hex32" },
138
+ "public-role-password": { kind: "hex32" },
139
+ "staging-gate-secret": { kind: "hex32" },
140
+ // The gateway's seal key contract (#806): base64 of exactly 32 bytes.
141
+ "mcp-oauth-seal-key": { kind: "base64-32" },
142
+ // "Not configured" until the Owner pastes a client (#914). A version must
143
+ // exist from the start: Cloud Run refuses a revision whose secret volume
144
+ // points at a secret without an enabled version.
145
+ "operator-oauth-client": { kind: "placeholder", value: "{}" },
146
+ };
147
+ /**
148
+ * Secrets an older contract created that nothing reads any more. Upgrade
149
+ * deletes each once both services rolled onto revisions that no longer
150
+ * reference it (stack-converge.ts `deleteRetiredSecrets`); deleting a
151
+ * secret drops its IAM bindings with it. Pre-1.0 delete-don't-migrate: a
152
+ * renamed secret is created fresh, never copied.
153
+ */
154
+ export const RETIRED_RUNTIME_SECRETS = [
155
+ {
156
+ // #914 — renamed to `operator-oauth-client`; nobody had configured
157
+ // remote MCP when the rename shipped, so there is nothing to carry over.
158
+ name: "mcp-oauth-client",
159
+ why: "the Google sign-in client moved to operator-oauth-client (#914)",
160
+ },
118
161
  ];
119
162
  /**
120
163
  * Each service's Secret Manager-backed env vars and the secret each reads.
@@ -143,11 +186,72 @@ export const SERVICE_SECRET_ENV = {
143
186
  PUBLIC_DATABASE_PASSWORD: "public-role-password",
144
187
  // #650 — verifies staging-host requests (api-gateway staging-proxy.ts).
145
188
  CAELO_STAGING_GATE_SECRET: "staging-gate-secret",
189
+ // #806 — seals the remote-MCP broker's state, codes and refresh tokens.
190
+ CAELO_MCP_OAUTH_SEAL_KEY: "mcp-oauth-seal-key",
146
191
  },
147
192
  };
148
- /** The secrets `service` reads (deduplicated, table order). */
193
+ // ===========================================================================
194
+ // Secret files (#806)
195
+ // ===========================================================================
196
+ /** Env var naming the file that holds the install's Google sign-in client (#914). */
197
+ export const OPERATOR_OAUTH_CLIENT_FILE_ENV = "CAELO_OPERATOR_OAUTH_CLIENT_FILE";
198
+ /** The gateway's Google sign-in client file, read by the remote-MCP broker (#806, #914). */
199
+ export const OPERATOR_OAUTH_CLIENT_FILE = {
200
+ secret: "operator-oauth-client",
201
+ volumeName: "operator-oauth-client",
202
+ mountDir: "/secrets/operator-oauth-client",
203
+ fileName: "client.json",
204
+ version: "latest",
205
+ };
206
+ /** Full path of a secret file inside the container. */
207
+ export function secretFilePath(file) {
208
+ return `${file.mountDir}/${file.fileName}`;
209
+ }
210
+ /** Each service's secret files. The admin has none. */
211
+ export const SERVICE_SECRET_FILES = {
212
+ admin: [],
213
+ gateway: [OPERATOR_OAUTH_CLIENT_FILE],
214
+ };
215
+ /**
216
+ * Secret files older contracts mounted that nothing reads any more, per
217
+ * service. The roll removes each mount (`--remove-secrets=<path>`) in the
218
+ * same revision that mounts its replacement.
219
+ */
220
+ export const RETIRED_SECRET_FILES = {
221
+ admin: [],
222
+ gateway: [
223
+ {
224
+ mountDir: "/secrets/mcp-oauth-client",
225
+ fileName: "client.json",
226
+ why: "the Google sign-in client is mounted from operator-oauth-client now (#914)",
227
+ },
228
+ ],
229
+ };
230
+ /**
231
+ * The secret files of `service` in the shape `gcp.cloudrunv2.Service`
232
+ * takes: `volumes` on the template, `volumeMounts` on the container.
233
+ */
234
+ export function secretFileVolumesTemplate(service, env) {
235
+ const files = SERVICE_SECRET_FILES[service];
236
+ return {
237
+ volumes: files.map((f) => ({
238
+ name: f.volumeName,
239
+ secret: {
240
+ secret: gcpSecretId(env, f.secret),
241
+ items: [{ version: f.version, path: f.fileName }],
242
+ },
243
+ })),
244
+ volumeMounts: files.map((f) => ({ name: f.volumeName, mountPath: f.mountDir })),
245
+ };
246
+ }
247
+ /** The secrets `service` reads, as env or as files (deduplicated, table order). */
149
248
  export function serviceSecrets(service) {
150
- return [...new Set(Object.values(SERVICE_SECRET_ENV[service]))];
249
+ return [
250
+ ...new Set([
251
+ ...Object.values(SERVICE_SECRET_ENV[service]),
252
+ ...SERVICE_SECRET_FILES[service].map((f) => f.secret),
253
+ ]),
254
+ ];
151
255
  }
152
256
  /**
153
257
  * Env vars an older stack set that the contract no longer gives a service;
@@ -157,8 +261,11 @@ export function serviceSecrets(service) {
157
261
  * credential is in its env (apps/api-gateway `adminDatabaseAccessInEnv`).
158
262
  */
159
263
  export const RETIRED_SERVICE_ENV = {
160
- admin: [],
264
+ // #914 — the sign-in client's store was renamed with its secret.
265
+ admin: ["CAELO_MCP_OAUTH_CLIENT_STORE"],
161
266
  gateway: [
267
+ // #914 — renamed to CAELO_OPERATOR_OAUTH_CLIENT_FILE with its secret.
268
+ "CAELO_MCP_OAUTH_CLIENT_FILE",
162
269
  "CAELO_SECRET_KEK",
163
270
  "ADMIN_DATABASE_URL",
164
271
  "ADMIN_DATABASE_PASSWORD",
@@ -230,9 +337,88 @@ export function gatewayEnvContract(inputs) {
230
337
  ...commonEnv(inputs),
231
338
  { name: TRUSTED_PROXY_HOPS_ENV, value: String(GATEWAY_TRUSTED_PROXY_HOPS[inputs.provider]) },
232
339
  { name: "PUBLIC_DATABASE_URL", value: inputs.databaseUrls.public },
340
+ // #806 — where the remote-MCP broker reads its Google OAuth client
341
+ // (the secret volume of SERVICE_SECRET_FILES).
342
+ { name: OPERATOR_OAUTH_CLIENT_FILE_ENV, value: secretFilePath(OPERATOR_OAUTH_CLIENT_FILE) },
233
343
  ...secretEnv("gateway", inputs.env),
234
344
  ];
235
345
  }
346
+ /**
347
+ * #806 — the gateway's request timeout, in seconds: Cloud Run's maximum.
348
+ * The gateway proxies remote-MCP requests to the admin, and a `caelo_chat`
349
+ * turn streams for as long as the admin's own chat stream may (the admin
350
+ * runs at 3600 s for the same reason). Visitor endpoints are unaffected: a
351
+ * timeout is a ceiling, not a reservation, and Cloud Run bills request time,
352
+ * not the allowed maximum. On `gcp` the load balancer in front adds no
353
+ * shorter limit — the backend-service timeout does not apply to serverless
354
+ * NEGs, which get a fixed 60 minutes
355
+ * (cloud.google.com/load-balancing/docs/negs/serverless-neg-concepts).
356
+ */
357
+ export const GATEWAY_TIMEOUT_SECONDS = 3600;
358
+ /** Admin env var naming the Secret Manager secret the Owner writes the Google sign-in client to. */
359
+ export const OPERATOR_OAUTH_CLIENT_STORE_ENV = "CAELO_OPERATOR_OAUTH_CLIENT_STORE";
360
+ /** `projects/<project>/secrets/<id>` of the Google sign-in client secret (#914). */
361
+ export function operatorOAuthClientSecretResource(projectId, env) {
362
+ return `projects/${projectId}/secrets/${gcpSecretId(env, "operator-oauth-client")}`;
363
+ }
364
+ /** Env var names of {@link RemoteMcpIdentity}. */
365
+ export const REMOTE_MCP_ENV = {
366
+ adminUrl: "CAELO_ADMIN_URL",
367
+ mcpPublicUrl: "CAELO_MCP_PUBLIC_URL",
368
+ iapAudience: "CAELO_IAP_AUDIENCE",
369
+ googleOrgDomain: "CAELO_GOOGLE_ORG_DOMAIN",
370
+ };
371
+ /**
372
+ * The install's remote-MCP identity.
373
+ *
374
+ * - `gcp`: the broker answers on the site's own host through the load
375
+ * balancer (`/api/*` and the `/.well-known/oauth-*` path rules), the admin
376
+ * on `admin.<domain>` behind the LB's IAP; the IAP audience is
377
+ * `/projects/<number>/global/backendServices/<id>`.
378
+ * - `gcp-firebase`: the broker answers on the gateway's own Cloud Run URL
379
+ * (Firebase Hosting rewrites cut requests at 60 s and buffer streams), the
380
+ * admin on its Cloud Run URL behind native IAP — whatever custom domain
381
+ * is mapped to it, IAP and its audience are the service's; the audience
382
+ * is `/projects/<number>/locations/<region>/services/<name>`.
383
+ *
384
+ * Audience formats: cloud.google.com/iap/docs/signed-headers-howto.
385
+ */
386
+ export function remoteMcpIdentity(i) {
387
+ const origin = (url) => url.replace(/\/+$/, "");
388
+ if (i.provider === "gcp") {
389
+ return {
390
+ adminUrl: `https://admin.${i.domain}`,
391
+ mcpPublicUrl: publicSiteUrl(i.domain),
392
+ iapAudience: `/projects/${i.projectNumber}/global/backendServices/${i.adminBackendServiceId}`,
393
+ };
394
+ }
395
+ return {
396
+ adminUrl: origin(i.adminServiceUrl),
397
+ mcpPublicUrl: origin(i.gatewayServiceUrl),
398
+ iapAudience: `/projects/${i.projectNumber}/locations/${i.region}/services/${i.adminServiceName}`,
399
+ };
400
+ }
401
+ /** {@link RemoteMcpIdentity} as each service's env vars. */
402
+ export function remoteMcpIdentityEnv(id) {
403
+ return {
404
+ admin: [
405
+ { name: REMOTE_MCP_ENV.iapAudience, value: id.iapAudience },
406
+ // The setup pages show the redirect URI and the MCP URLs from it.
407
+ { name: REMOTE_MCP_ENV.mcpPublicUrl, value: id.mcpPublicUrl },
408
+ // #914 — Google sign-in's self-check opens the admin signed out.
409
+ { name: REMOTE_MCP_ENV.adminUrl, value: id.adminUrl },
410
+ // #914 — who IAP admits without the Google sign-in client
411
+ // (admin-core security/identity-gate.ts).
412
+ ...(id.googleOrgDomain
413
+ ? [{ name: REMOTE_MCP_ENV.googleOrgDomain, value: id.googleOrgDomain }]
414
+ : []),
415
+ ],
416
+ gateway: [
417
+ { name: REMOTE_MCP_ENV.adminUrl, value: id.adminUrl },
418
+ { name: REMOTE_MCP_ENV.mcpPublicUrl, value: id.mcpPublicUrl },
419
+ ],
420
+ };
421
+ }
236
422
  /**
237
423
  * The env of the admin service.
238
424
  *
@@ -270,10 +456,20 @@ export function adminEnvContract(inputs) {
270
456
  // #696 — the job "Install update" starts (upgrader-setup.ts); the admin
271
457
  // may only run it, never override it.
272
458
  { name: UPGRADER_JOB_ENV_VAR, value: upgraderJobResource(projectId, inputs.region, env) },
459
+ // #819 — the job "Install update" starts for a release that changes the
460
+ // cloud setup (converge-job-setup.ts); start-only as well.
461
+ { name: CONVERGE_JOB_ENV_VAR, value: convergeJobResource(projectId, inputs.region, env) },
273
462
  // #875 — the job the quality audit fans its Lighthouse runs out to, and
274
463
  // where the tasks write their results (audit-job-setup.ts).
275
464
  { name: AUDIT_JOB_ENV_VAR, value: auditJobResource(projectId, inputs.region, env) },
276
465
  { name: AUDIT_RESULTS_BUCKET_ENV_VAR, value: gcpBucketName(projectId, env, "audit-results") },
466
+ // #914 — where Settings → Google sign-in writes the install's Google
467
+ // sign-in client (add-version only, see the run SA's secretVersionAdder
468
+ // invariant).
469
+ {
470
+ name: OPERATOR_OAUTH_CLIENT_STORE_ENV,
471
+ value: operatorOAuthClientSecretResource(projectId, env),
472
+ },
277
473
  ];
278
474
  if (inputs.provider === "gcp") {
279
475
  // v0.2.78 — the GCS StaticPublisher: Stage uploads to staging,
@@ -311,6 +507,7 @@ export const STATIC_CDN_POLICY = {
311
507
  clientTtl: 31536000,
312
508
  };
313
509
  const SECRET_ACCESSOR = "roles/secretmanager.secretAccessor";
510
+ const SECRET_VERSION_ADDER = "roles/secretmanager.secretVersionAdder";
314
511
  /**
315
512
  * The `secretAccessor` bindings both stacks declare: each service's run SA
316
513
  * on exactly the secrets its env reads ({@link SERVICE_SECRET_ENV}).
@@ -333,6 +530,23 @@ function secretAccessors() {
333
530
  why: `the ${b.service} reads ${b.secret} from Secret Manager at boot`,
334
531
  }));
335
532
  }
533
+ /** Bindings both GCP stacks declare beyond the secret accessors and telemetry. */
534
+ const GCP_COMMON = [
535
+ {
536
+ stackResource: "admin-operator-oauth-client-version-adder",
537
+ // Why the admin may write a secret at all: the Owner pastes the
538
+ // install's Google sign-in client under Settings → Google sign-in, and
539
+ // the admin stores it where the gateway and the operator-access sync job
540
+ // read it. secretVersionAdder is add-version only (no access, no
541
+ // destroy, no IAM), bound on this one secret only — the admin can
542
+ // replace the client, never read it or any other secret.
543
+ role: SECRET_VERSION_ADDER,
544
+ member: "run-sa",
545
+ target: { kind: "secret", name: "operator-oauth-client" },
546
+ onFailure: "warn",
547
+ why: "the Owner's Google sign-in setup (Settings → Google sign-in) stores the OAuth client; without it only that setup fails",
548
+ },
549
+ ];
336
550
  /** v0.6.6 — a custom runtime SA gets no telemetry roles implicitly. */
337
551
  const TELEMETRY = [
338
552
  {
@@ -483,6 +697,7 @@ export const RETIRED_IAM_BINDINGS = [
483
697
  export function stackIamInvariants(provider) {
484
698
  return [
485
699
  ...secretAccessors(),
700
+ ...GCP_COMMON,
486
701
  ...(provider === "gcp" ? GCP_ONLY : GCP_FIREBASE_ONLY),
487
702
  ...TELEMETRY,
488
703
  ];
@@ -1 +1 @@
1
- {"version":3,"file":"stack-contract.js","sourceRoot":"","sources":["../src/stack-contract.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAqCnC,OAAO,EACL,gBAAgB,EAChB,0BAA0B,EAC1B,aAAa,EACb,aAAa,EACb,WAAW,EACX,yBAAyB,EACzB,yBAAyB,EACzB,sBAAsB,EACtB,+BAA+B,EAC/B,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAkDxB,uDAAuD;AACvD,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAU,EAAE,EAAE,CACvC,gBAAgB,IAAI,IAAI,IAAI,IAAI,aAAa,IAAI,EAAE,kBAAkB,CAAC;IACxE,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,YAAY,EAAE,WAAW,CAAC;QACrC,WAAW,EAAE,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC;QAC5C,MAAM,EAAE,GAAG,CAAC,aAAa,EAAE,YAAY,CAAC;KACzC,CAAC;AACJ,CAAC;AAsBD,qFAAqF;AACrF,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,OAAO,WAAW,MAAM,EAAE,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,OAAO,WAAW,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;AACrE,CAAC;AAED,6DAA6D;AAC7D,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAErD;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,+BAA+B,CAAC;AAE3D;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,2BAA2B,CAAC;AAEvE;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;AACnD,MAAM,CAAC,MAAM,4BAA4B,GAAG,4BAA4B,CAAC;AAEzE,4DAA4D;AAC5D,MAAM,aAAa,GAAG,uCAAuC,CAAC;AAE9D,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;AAE7D,gDAAgD;AAChD,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAoBzC,8CAA8C;AAC9C,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,GAAW;IAC7D,OAAO;QACL,UAAU,EAAE,iBAAiB;QAC7B,MAAM,EAAE,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC;QAC9C,SAAS,EAAE,gBAAgB;KAC5B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAA2B;IAClE,OAAO;QACL,oBAAoB,EAAE,4BAA4B;QAClD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC;QACvF,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;KAChE,CAAC;AACb,CAAC;AAqBD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAkD;IACjF,UAAU,EAAE,mBAAmB;IAC/B,WAAW,EAAE,sBAAsB;CACpC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,iBAAiB;IACjB,sBAAsB;IACtB,uEAAuE;IACvE,kEAAkE;IAClE,sBAAsB;IACtB,uEAAuE;IACvE,sEAAsE;IACtE,uCAAuC;IACvC,qBAAqB;CACsB,CAAC;AAE9C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAE3B;IACF,KAAK,EAAE;QACL,uBAAuB,EAAE,mBAAmB;QAC5C,8BAA8B,EAAE,mBAAmB;QACnD,0EAA0E;QAC1E,gBAAgB,EAAE,YAAY;QAC9B,2EAA2E;QAC3E,qBAAqB,EAAE,iBAAiB;QACxC,oEAAoE;QACpE,4CAA4C;QAC5C,0BAA0B,EAAE,sBAAsB;QAClD,kEAAkE;QAClE,kDAAkD;QAClD,yBAAyB,EAAE,qBAAqB;KACjD;IACD,OAAO,EAAE;QACP,kEAAkE;QAClE,yDAAyD;QACzD,wBAAwB,EAAE,sBAAsB;QAChD,wEAAwE;QACxE,yBAAyB,EAAE,qBAAqB;KACjD;CACF,CAAC;AAEF,+DAA+D;AAC/D,MAAM,UAAU,cAAc,CAAC,OAAqB;IAClD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAsD;IACpF,KAAK,EAAE,EAAE;IACT,OAAO,EAAE;QACP,kBAAkB;QAClB,oBAAoB;QACpB,yBAAyB;QACzB,0DAA0D;QAC1D,sBAAsB;QACtB,2BAA2B;KAC5B;CACF,CAAC;AAEF,SAAS,SAAS,CAAC,OAAqB,EAAE,GAAW;IACnD,OAAO,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,IAAI;QACJ,WAAW,EAAE,EAAE,YAAY,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;KACvF,CAAC,CAAC,CAAC;AACN,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,oCAAoC;AACpC,SAAS,SAAS,CAAC,MAAwB;IACzC,OAAO;QACL,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE;QAClD,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE;QACxC;YACE,IAAI,EAAE,mBAAmB;YACzB,KAAK,EAAE,QAAQ,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE;SACtE;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,0BAA0B,CAAC;AAEjE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAgD;IACrF,oEAAoE;IACpE,wEAAwE;IACxE,GAAG,EAAE,CAAC;IACN,sEAAsE;IACtE,wEAAwE;IACxE,mEAAmE;IACnE,yEAAyE;IACzE,mEAAmE;IACnE,cAAc,EAAE,CAAC;IACjB,yEAAyE;IACzE,oDAAoD;IACpD,aAAa,EAAE,CAAC;IAChB,0EAA0E;IAC1E,gDAAgD;IAChD,GAAG,EAAE,CAAC;IACN,oEAAoE;IACpE,+DAA+D;IAC/D,KAAK,EAAE,CAAC;CACT,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAI,MAA2B;IAC/D,OAAO;QACL,GAAG,SAAS,CAAC,MAAM,CAAC;QACpB,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,CAAC,0BAA0B,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE;QAC5F,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE;QAClE,GAAG,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC;KACpC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAI,MAAyB;IAC3D,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAC1C,MAAM,KAAK,GAAiC;QAC1C,GAAG,SAAS,CAAC,MAAM,CAAC;QACpB,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE;QAChE,oEAAoE;QACpE,mCAAmC;QACnC,EAAE,IAAI,EAAE,2BAA2B,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE;QAC7E,yEAAyE;QACzE,kDAAkD;QAClD,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE;QACxD,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,aAAa,EAAE;QACrD,uEAAuE;QACvE,0DAA0D;QAC1D,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,EAAE;QACnD,mEAAmE;QACnE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,yBAAyB,CAAC,SAAS,CAAC,EAAE;QAClE,wEAAwE;QACxE,4DAA4D;QAC5D;YACE,IAAI,EAAE,2BAA2B;YACjC,KAAK,EAAE,yBAAyB,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;SAChE;QACD,wEAAwE;QACxE,sCAAsC;QACtC,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE;QACzF,wEAAwE;QACxE,4DAA4D;QAC5D,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE;QACnF,EAAE,IAAI,EAAE,4BAA4B,EAAE,KAAK,EAAE,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,eAAe,CAAC,EAAE;KAC9F,CAAC;IACF,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC9B,+DAA+D;QAC/D,oCAAoC;QACpC,KAAK,CAAC,IAAI,CACR,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,EAC/E,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,EAAE,CAClF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,oEAAoE;QACpE,8CAA8C;QAC9C,KAAK,CAAC,IAAI,CACR,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,CAAC,cAAc,EAAE,EAC7D,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,MAAM,CAAC,cAAc,EAAE,EAC/D,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE;QACtD,uEAAuE;QACvE,mEAAmE;QACnE,gDAAgD;QAChD,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,CACtD,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IACvC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,SAAS,EAAE,kBAAkB;IAC7B,UAAU,EAAE,IAAI;IAChB,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,QAAQ;CACX,CAAC;AA0CX,MAAM,eAAe,GAAG,oCAAoC,CAAC;AAU7D;;;GAGG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAQ,CAAC,OAAO,EAAE,SAAS,CAAW,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CACzD,cAAc,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvC,OAAO;QACP,MAAM;QACN,+DAA+D;QAC/D,aAAa,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,UAAU,CAAC,CAAC,CAAC,WAAW,MAAM,UAAU;KACvF,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,qBAAqB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzC,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;QACvD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAC1C,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,OAAO,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,8BAA8B;KACtE,CAAC,CAAC,CAAC;AACN,CAAC;AAED,uEAAuE;AACvE,MAAM,SAAS,GAA4B;IACzC;QACE,aAAa,EAAE,gBAAgB;QAC/B,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3B,SAAS,EAAE,MAAM;QACjB,GAAG,EAAE,oCAAoC;KAC1C;IACD;QACE,aAAa,EAAE,mBAAmB;QAClC,IAAI,EAAE,+BAA+B;QACrC,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3B,SAAS,EAAE,MAAM;QACjB,GAAG,EAAE,iEAAiE;KACvE;IACD;QACE,aAAa,EAAE,oBAAoB;QACnC,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3B,SAAS,EAAE,MAAM;QACjB,GAAG,EAAE,4CAA4C;KAClD;IACD;QACE,aAAa,EAAE,uBAAuB;QACtC,IAAI,EAAE,+BAA+B;QACrC,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3B,SAAS,EAAE,MAAM;QACjB,GAAG,EAAE,yEAAyE;KAC/E;CACF,CAAC;AAEF,MAAM,QAAQ,GAA4B;IACxC;QACE,aAAa,EAAE,oBAAoB;QACnC,IAAI,EAAE,4BAA4B;QAClC,MAAM,EAAE,UAAU;QAClB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE;QAC5C,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,0DAA0D;KAChE;IACD;QACE,aAAa,EAAE,UAAU;QACzB,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE;QAC3C,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,mCAAmC;KACzC;IACD;QACE,aAAa,EAAE,iBAAiB;QAChC,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE;QAC5C,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,gEAAgE;KACtE;IACD;QACE,aAAa,EAAE,kBAAkB;QACjC,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE;QAC7C,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,8DAA8D;KACpE;IACD;QACE,aAAa,EAAE,qBAAqB;QACpC,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,qBAAqB;QAC7B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE;QAC5C,SAAS,EAAE,MAAM;QACjB,GAAG,EAAE,qFAAqF;KAC3F;IACD;QACE,aAAa,EAAE,kBAAkB;QACjC,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,mBAAmB;QAC3B,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE;QACjD,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,8DAA8D;KACpE;CACF,CAAC;AAEF,MAAM,iBAAiB,GAA4B;IACjD;QACE,aAAa,EAAE,UAAU;QACzB,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE;QAC3C,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,mCAAmC;KACzC;IACD;QACE,aAAa,EAAE,sBAAsB;QACrC,IAAI,EAAE,6BAA6B;QACnC,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3B,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,kDAAkD;KACxD;IACD;QACE,aAAa,EAAE,wBAAwB;QACvC,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,UAAU;QAClB,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE;QACnD,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,yDAAyD;KAC/D;IACD;QACE,aAAa,EAAE,6BAA6B;QAC5C,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE;QACnD,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,uHAAuH;KAC7H;IACD;QACE,aAAa,EAAE,sBAAsB;QACrC,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,mBAAmB;QAC3B,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE;QACjD,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,8DAA8D;KACpE;CACF,CAAC;AAcF;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAiC;IAChE;QACE,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,mBAAmB,EAAE;QACrD,GAAG,EAAE,sGAAsG;KAC5G;IACD;QACE,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,EAAE;QACzD,GAAG,EAAE,qHAAqH;KAC3H;CACF,CAAC;AAEF,qEAAqE;AACrE,MAAM,UAAU,kBAAkB,CAAC,QAAqB;IACtD,OAAO;QACL,GAAG,eAAe,EAAE;QACpB,GAAG,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC;QACtD,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA0D;IAC1F,GAAG,EAAE;QACH,mBAAmB,EACjB,0HAA0H;QAC5H,qBAAqB,EAAE,6CAA6C;QACpE,eAAe,EAAE,6CAA6C;QAC9D,wBAAwB,EACtB,8FAA8F;KACjG;IACD,cAAc,EAAE;QACd,aAAa,EACX,0HAA0H;QAC5H,iBAAiB,EACf,kFAAkF;QACpF,qBAAqB,EAAE,6CAA6C;QACpE,eAAe,EAAE,6CAA6C;KAC/D;CACF,CAAC;AAEF,mEAAmE;AACnE,MAAM,UAAU,SAAS,CACvB,SAAuB,EACvB,OAA6F;IAE7F,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO,kBAAkB,sBAAsB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACpF,KAAK,YAAY;YACf,OAAO,kBAAkB,0BAA0B,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxF,KAAK,qBAAqB;YACxB,OAAO,kBAAkB,+BAA+B,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,SAAS,0BAA0B,CAAC;QACvH,KAAK,mBAAmB;YACtB,OAAO,0BAA0B,OAAO,CAAC,aAAa,qCAAqC,CAAC;QAC9F,KAAK,UAAU;YACb,OAAO,UAAU,CAAC;IACtB,CAAC;AACH,CAAC;AAkCD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAC;AAE7C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAyC;IACjF;QACE,IAAI,EAAE,mBAAmB;QACzB,YAAY,EAAE,CAAC,WAAW,CAAC;QAC3B,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,qBAAqB,EAAE,KAAK;QAC5B,GAAG,EAAE,iEAAiE;KACvE;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,YAAY,EAAE,CAAC,WAAW,CAAC;QAC3B,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;QACjD,qBAAqB,EAAE,KAAK;QAC5B,GAAG,EAAE,iEAAiE;KACvE;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,YAAY,EAAE,CAAC,WAAW,CAAC;QAC3B,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QACjC,qBAAqB,EAAE,KAAK;QAC5B,GAAG,EAAE,kEAAkE;KACxE;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,YAAY,EAAE,CAAC,cAAc,CAAC;QAC9B,OAAO,EAAE;YACP,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,EAAE;YACzC,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,EAAE;YACzC,EAAE,UAAU,EAAE,MAAM,EAAE;SACvB;QACD,qBAAqB,EAAE,IAAI;QAC3B,GAAG,EAAE,qFAAqF;KAC3F;CACF,CAAC;AAEF,yEAAyE;AACzE,MAAM,UAAU,qBAAqB,CACnC,OAAuF,EACvF,YAA+B;IAE/B,MAAM,KAAK,GAAG,OAAO;SAClB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;SAC9E,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,OAAO,GAAG,KAAK,IAAI,QAAQ,SAAS,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,aAAa,EAAE,CAAC;AAChF,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,yBAAyB,CAAC,GAAW;IACnD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,iBAAiB,CAAC;AAChD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAE1C;;;GAGG;AACH;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAgB;IAIzD,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,GAAG,GAAG,KAAK,CAAC,IAAI,GAAG,GAAG,GAAG,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CACb,4BAA4B,QAAQ,qFAAqF,CAC1H,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,MAAM,CAAC,GAAG,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAClE,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACb,KAAK,IAAI;YACP,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,KAAK,IAAI;YACP,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC9B,KAAK,GAAG;YACN,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC;QACvD;YACE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC;IAChE,CAAC;AACH,CAAC"}
1
+ {"version":3,"file":"stack-contract.js","sourceRoot":"","sources":["../src/stack-contract.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAqCnC,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,0BAA0B,EAC1B,aAAa,EACb,aAAa,EACb,WAAW,EACX,yBAAyB,EACzB,yBAAyB,EACzB,sBAAsB,EACtB,+BAA+B,EAC/B,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AAkDxB,uDAAuD;AACvD,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAU,EAAE,EAAE,CACvC,gBAAgB,IAAI,IAAI,IAAI,IAAI,aAAa,IAAI,EAAE,kBAAkB,CAAC;IACxE,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,YAAY,EAAE,WAAW,CAAC;QACrC,WAAW,EAAE,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC;QAC5C,MAAM,EAAE,GAAG,CAAC,aAAa,EAAE,YAAY,CAAC;KACzC,CAAC;AACJ,CAAC;AAsBD,qFAAqF;AACrF,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,OAAO,WAAW,MAAM,EAAE,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,OAAO,WAAW,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;AACrE,CAAC;AAED,6DAA6D;AAC7D,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAErD;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,+BAA+B,CAAC;AAE3D;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,2BAA2B,CAAC;AAEvE;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;AAEzD;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;AACnD,MAAM,CAAC,MAAM,4BAA4B,GAAG,4BAA4B,CAAC;AAEzE,4DAA4D;AAC5D,MAAM,aAAa,GAAG,uCAAuC,CAAC;AAE9D,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;AAE7D,gDAAgD;AAChD,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAoBzC,8CAA8C;AAC9C,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,GAAW;IAC7D,OAAO;QACL,UAAU,EAAE,iBAAiB;QAC7B,MAAM,EAAE,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC;QAC9C,SAAS,EAAE,gBAAgB;KAC5B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAA2B;IAClE,OAAO;QACL,oBAAoB,EAAE,4BAA4B;QAClD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC;QACvF,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;KAChE,CAAC;AACb,CAAC;AAoCD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAkD;IACjF,UAAU,EAAE,mBAAmB;IAC/B,WAAW,EAAE,sBAAsB;CACpC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,iBAAiB;IACjB,sBAAsB;IACtB,uEAAuE;IACvE,kEAAkE;IAClE,sBAAsB;IACtB,uEAAuE;IACvE,sEAAsE;IACtE,uCAAuC;IACvC,qBAAqB;IACrB,yEAAyE;IACzE,wEAAwE;IACxE,qDAAqD;IACrD,qCAAqC;IACrC,uBAAuB;IACvB,oBAAoB;CACuB,CAAC;AAQ9C;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAEhC;IACF,iBAAiB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;IACpC,sBAAsB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;IACzC,sBAAsB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;IACzC,qBAAqB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;IACxC,sEAAsE;IACtE,oBAAoB,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IAC3C,0EAA0E;IAC1E,yEAAyE;IACzE,iDAAiD;IACjD,uBAAuB,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE;CAC9D,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAA+D;IACjG;QACE,mEAAmE;QACnE,yEAAyE;QACzE,IAAI,EAAE,kBAAkB;QACxB,GAAG,EAAE,iEAAiE;KACvE;CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAE3B;IACF,KAAK,EAAE;QACL,uBAAuB,EAAE,mBAAmB;QAC5C,8BAA8B,EAAE,mBAAmB;QACnD,0EAA0E;QAC1E,gBAAgB,EAAE,YAAY;QAC9B,2EAA2E;QAC3E,qBAAqB,EAAE,iBAAiB;QACxC,oEAAoE;QACpE,4CAA4C;QAC5C,0BAA0B,EAAE,sBAAsB;QAClD,kEAAkE;QAClE,kDAAkD;QAClD,yBAAyB,EAAE,qBAAqB;KACjD;IACD,OAAO,EAAE;QACP,kEAAkE;QAClE,yDAAyD;QACzD,wBAAwB,EAAE,sBAAsB;QAChD,wEAAwE;QACxE,yBAAyB,EAAE,qBAAqB;QAChD,wEAAwE;QACxE,wBAAwB,EAAE,oBAAoB;KAC/C;CACF,CAAC;AAEF,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E,qFAAqF;AACrF,MAAM,CAAC,MAAM,8BAA8B,GAAG,kCAAkC,CAAC;AAyBjF,4FAA4F;AAC5F,MAAM,CAAC,MAAM,0BAA0B,GAAuB;IAC5D,MAAM,EAAE,uBAAuB;IAC/B,UAAU,EAAE,uBAAuB;IACnC,QAAQ,EAAE,gCAAgC;IAC1C,QAAQ,EAAE,aAAa;IACvB,OAAO,EAAE,QAAQ;CAClB,CAAC;AAEF,uDAAuD;AACvD,MAAM,UAAU,cAAc,CAAC,IAAwB;IACrD,OAAO,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;AAC7C,CAAC;AAED,uDAAuD;AACvD,MAAM,CAAC,MAAM,oBAAoB,GAAkE;IACjG,KAAK,EAAE,EAAE;IACT,OAAO,EAAE,CAAC,0BAA0B,CAAC;CACtC,CAAC;AASF;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAiE;IAChG,KAAK,EAAE,EAAE;IACT,OAAO,EAAE;QACP;YACE,QAAQ,EAAE,2BAA2B;YACrC,QAAQ,EAAE,aAAa;YACvB,GAAG,EAAE,4EAA4E;SAClF;KACF;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAAqB,EACrB,GAAW;IAQX,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACzB,IAAI,EAAE,CAAC,CAAC,UAAU;YAClB,MAAM,EAAE;gBACN,MAAM,EAAE,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC;gBAClC,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;aAClD;SACF,CAAC,CAAC;QACH,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;KAChF,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,cAAc,CAAC,OAAqB;IAClD,OAAO;QACL,GAAG,IAAI,GAAG,CAAC;YACT,GAAG,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAC7C,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;SACtD,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAsD;IACpF,iEAAiE;IACjE,KAAK,EAAE,CAAC,8BAA8B,CAAC;IACvC,OAAO,EAAE;QACP,sEAAsE;QACtE,6BAA6B;QAC7B,kBAAkB;QAClB,oBAAoB;QACpB,yBAAyB;QACzB,0DAA0D;QAC1D,sBAAsB;QACtB,2BAA2B;KAC5B;CACF,CAAC;AAEF,SAAS,SAAS,CAAC,OAAqB,EAAE,GAAW;IACnD,OAAO,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,IAAI;QACJ,WAAW,EAAE,EAAE,YAAY,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;KACvF,CAAC,CAAC,CAAC;AACN,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,oCAAoC;AACpC,SAAS,SAAS,CAAC,MAAwB;IACzC,OAAO;QACL,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE;QAClD,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE;QACxC;YACE,IAAI,EAAE,mBAAmB;YACzB,KAAK,EAAE,QAAQ,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE;SACtE;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,0BAA0B,CAAC;AAEjE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAgD;IACrF,oEAAoE;IACpE,wEAAwE;IACxE,GAAG,EAAE,CAAC;IACN,sEAAsE;IACtE,wEAAwE;IACxE,mEAAmE;IACnE,yEAAyE;IACzE,mEAAmE;IACnE,cAAc,EAAE,CAAC;IACjB,yEAAyE;IACzE,oDAAoD;IACpD,aAAa,EAAE,CAAC;IAChB,0EAA0E;IAC1E,gDAAgD;IAChD,GAAG,EAAE,CAAC;IACN,oEAAoE;IACpE,+DAA+D;IAC/D,KAAK,EAAE,CAAC;CACT,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAI,MAA2B;IAC/D,OAAO;QACL,GAAG,SAAS,CAAC,MAAM,CAAC;QACpB,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,CAAC,0BAA0B,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE;QAC5F,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE;QAClE,mEAAmE;QACnE,+CAA+C;QAC/C,EAAE,IAAI,EAAE,8BAA8B,EAAE,KAAK,EAAE,cAAc,CAAC,0BAA0B,CAAC,EAAE;QAC3F,GAAG,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC;KACpC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAE5C,oGAAoG;AACpG,MAAM,CAAC,MAAM,+BAA+B,GAAG,mCAAmC,CAAC;AAEnF,oFAAoF;AACpF,MAAM,UAAU,iCAAiC,CAAC,SAAiB,EAAE,GAAW;IAC9E,OAAO,YAAY,SAAS,YAAY,WAAW,CAAC,GAAG,EAAE,uBAAuB,CAAC,EAAE,CAAC;AACtF,CAAC;AA6CD,kDAAkD;AAClD,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,QAAQ,EAAE,iBAAiB;IAC3B,YAAY,EAAE,sBAAsB;IACpC,WAAW,EAAE,oBAAoB;IACjC,eAAe,EAAE,yBAAyB;CAClC,CAAC;AAqBX;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAA0B;IAC1D,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxD,IAAI,CAAC,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QACzB,OAAO;YACL,QAAQ,EAAE,iBAAiB,CAAC,CAAC,MAAM,EAAE;YACrC,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC;YACrC,WAAW,EAAE,aAAa,CAAC,CAAC,aAAa,2BAA2B,CAAC,CAAC,qBAAqB,EAAE;SAC9F,CAAC;IACJ,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC;QACnC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC;QACzC,WAAW,EAAE,aAAa,CAAC,CAAC,aAAa,cAAc,CAAC,CAAC,MAAM,aAAa,CAAC,CAAC,gBAAgB,EAAE;KACjG,CAAC;AACJ,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,oBAAoB,CAClC,EAAqB;IAErB,OAAO;QACL,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,cAAc,CAAC,WAAW,EAAE,KAAK,EAAE,EAAE,CAAC,WAAW,EAAE;YAC3D,kEAAkE;YAClE,EAAE,IAAI,EAAE,cAAc,CAAC,YAAY,EAAE,KAAK,EAAE,EAAE,CAAC,YAAY,EAAE;YAC7D,iEAAiE;YACjE,EAAE,IAAI,EAAE,cAAc,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,QAAQ,EAAE;YACrD,0DAA0D;YAC1D,0CAA0C;YAC1C,GAAG,CAAC,EAAE,CAAC,eAAe;gBACpB,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,eAAe,EAAE,KAAK,EAAE,EAAE,CAAC,eAAe,EAAE,CAAC;gBACvE,CAAC,CAAC,EAAE,CAAC;SACR;QACD,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,cAAc,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,QAAQ,EAAE;YACrD,EAAE,IAAI,EAAE,cAAc,CAAC,YAAY,EAAE,KAAK,EAAE,EAAE,CAAC,YAAY,EAAE;SAC9D;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAI,MAAyB;IAC3D,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAC1C,MAAM,KAAK,GAAiC;QAC1C,GAAG,SAAS,CAAC,MAAM,CAAC;QACpB,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE;QAChE,oEAAoE;QACpE,mCAAmC;QACnC,EAAE,IAAI,EAAE,2BAA2B,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE;QAC7E,yEAAyE;QACzE,kDAAkD;QAClD,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE;QACxD,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,aAAa,EAAE;QACrD,uEAAuE;QACvE,0DAA0D;QAC1D,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,EAAE;QACnD,mEAAmE;QACnE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,yBAAyB,CAAC,SAAS,CAAC,EAAE;QAClE,wEAAwE;QACxE,4DAA4D;QAC5D;YACE,IAAI,EAAE,2BAA2B;YACjC,KAAK,EAAE,yBAAyB,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;SAChE;QACD,wEAAwE;QACxE,sCAAsC;QACtC,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE;QACzF,wEAAwE;QACxE,2DAA2D;QAC3D,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE;QACzF,wEAAwE;QACxE,4DAA4D;QAC5D,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE;QACnF,EAAE,IAAI,EAAE,4BAA4B,EAAE,KAAK,EAAE,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,eAAe,CAAC,EAAE;QAC7F,qEAAqE;QACrE,wEAAwE;QACxE,cAAc;QACd;YACE,IAAI,EAAE,+BAA+B;YACrC,KAAK,EAAE,iCAAiC,CAAC,SAAS,EAAE,GAAG,CAAC;SACzD;KACF,CAAC;IACF,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC9B,+DAA+D;QAC/D,oCAAoC;QACpC,KAAK,CAAC,IAAI,CACR,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,EAC/E,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,EAAE,CAClF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,oEAAoE;QACpE,8CAA8C;QAC9C,KAAK,CAAC,IAAI,CACR,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,CAAC,cAAc,EAAE,EAC7D,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,MAAM,CAAC,cAAc,EAAE,EAC/D,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE;QACtD,uEAAuE;QACvE,mEAAmE;QACnE,gDAAgD;QAChD,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,CACtD,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IACvC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,SAAS,EAAE,kBAAkB;IAC7B,UAAU,EAAE,IAAI;IAChB,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,QAAQ;CACX,CAAC;AA0CX,MAAM,eAAe,GAAG,oCAAoC,CAAC;AAC7D,MAAM,oBAAoB,GAAG,wCAAwC,CAAC;AAUtE;;;GAGG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAQ,CAAC,OAAO,EAAE,SAAS,CAAW,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CACzD,cAAc,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvC,OAAO;QACP,MAAM;QACN,+DAA+D;QAC/D,aAAa,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,UAAU,CAAC,CAAC,CAAC,WAAW,MAAM,UAAU;KACvF,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,qBAAqB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzC,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;QACvD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAC1C,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,OAAO,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,8BAA8B;KACtE,CAAC,CAAC,CAAC;AACN,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,GAA4B;IAC1C;QACE,aAAa,EAAE,2CAA2C;QAC1D,gEAAgE;QAChE,uEAAuE;QACvE,yEAAyE;QACzE,iEAAiE;QACjE,kEAAkE;QAClE,yDAAyD;QACzD,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,EAAE;QACzD,SAAS,EAAE,MAAM;QACjB,GAAG,EAAE,wHAAwH;KAC9H;CACF,CAAC;AAEF,uEAAuE;AACvE,MAAM,SAAS,GAA4B;IACzC;QACE,aAAa,EAAE,gBAAgB;QAC/B,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3B,SAAS,EAAE,MAAM;QACjB,GAAG,EAAE,oCAAoC;KAC1C;IACD;QACE,aAAa,EAAE,mBAAmB;QAClC,IAAI,EAAE,+BAA+B;QACrC,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3B,SAAS,EAAE,MAAM;QACjB,GAAG,EAAE,iEAAiE;KACvE;IACD;QACE,aAAa,EAAE,oBAAoB;QACnC,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3B,SAAS,EAAE,MAAM;QACjB,GAAG,EAAE,4CAA4C;KAClD;IACD;QACE,aAAa,EAAE,uBAAuB;QACtC,IAAI,EAAE,+BAA+B;QACrC,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3B,SAAS,EAAE,MAAM;QACjB,GAAG,EAAE,yEAAyE;KAC/E;CACF,CAAC;AAEF,MAAM,QAAQ,GAA4B;IACxC;QACE,aAAa,EAAE,oBAAoB;QACnC,IAAI,EAAE,4BAA4B;QAClC,MAAM,EAAE,UAAU;QAClB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE;QAC5C,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,0DAA0D;KAChE;IACD;QACE,aAAa,EAAE,UAAU;QACzB,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE;QAC3C,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,mCAAmC;KACzC;IACD;QACE,aAAa,EAAE,iBAAiB;QAChC,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE;QAC5C,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,gEAAgE;KACtE;IACD;QACE,aAAa,EAAE,kBAAkB;QACjC,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE;QAC7C,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,8DAA8D;KACpE;IACD;QACE,aAAa,EAAE,qBAAqB;QACpC,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,qBAAqB;QAC7B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE;QAC5C,SAAS,EAAE,MAAM;QACjB,GAAG,EAAE,qFAAqF;KAC3F;IACD;QACE,aAAa,EAAE,kBAAkB;QACjC,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,mBAAmB;QAC3B,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE;QACjD,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,8DAA8D;KACpE;CACF,CAAC;AAEF,MAAM,iBAAiB,GAA4B;IACjD;QACE,aAAa,EAAE,UAAU;QACzB,IAAI,EAAE,2BAA2B;QACjC,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE;QAC3C,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,mCAAmC;KACzC;IACD;QACE,aAAa,EAAE,sBAAsB;QACrC,IAAI,EAAE,6BAA6B;QACnC,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3B,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,kDAAkD;KACxD;IACD;QACE,aAAa,EAAE,wBAAwB;QACvC,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,UAAU;QAClB,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE;QACnD,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,yDAAyD;KAC/D;IACD;QACE,aAAa,EAAE,6BAA6B;QAC5C,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE;QACnD,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,uHAAuH;KAC7H;IACD;QACE,aAAa,EAAE,sBAAsB;QACrC,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,mBAAmB;QAC3B,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE;QACjD,SAAS,EAAE,OAAO;QAClB,GAAG,EAAE,8DAA8D;KACpE;CACF,CAAC;AAcF;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAiC;IAChE;QACE,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,mBAAmB,EAAE;QACrD,GAAG,EAAE,sGAAsG;KAC5G;IACD;QACE,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,EAAE;QACzD,GAAG,EAAE,qHAAqH;KAC3H;CACF,CAAC;AAEF,qEAAqE;AACrE,MAAM,UAAU,kBAAkB,CAAC,QAAqB;IACtD,OAAO;QACL,GAAG,eAAe,EAAE;QACpB,GAAG,UAAU;QACb,GAAG,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC;QACtD,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA0D;IAC1F,GAAG,EAAE;QACH,mBAAmB,EACjB,0HAA0H;QAC5H,qBAAqB,EAAE,6CAA6C;QACpE,eAAe,EAAE,6CAA6C;QAC9D,wBAAwB,EACtB,8FAA8F;KACjG;IACD,cAAc,EAAE;QACd,aAAa,EACX,0HAA0H;QAC5H,iBAAiB,EACf,kFAAkF;QACpF,qBAAqB,EAAE,6CAA6C;QACpE,eAAe,EAAE,6CAA6C;KAC/D;CACF,CAAC;AAEF,mEAAmE;AACnE,MAAM,UAAU,SAAS,CACvB,SAAuB,EACvB,OAA6F;IAE7F,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO,kBAAkB,sBAAsB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACpF,KAAK,YAAY;YACf,OAAO,kBAAkB,0BAA0B,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxF,KAAK,qBAAqB;YACxB,OAAO,kBAAkB,+BAA+B,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,SAAS,0BAA0B,CAAC;QACvH,KAAK,mBAAmB;YACtB,OAAO,0BAA0B,OAAO,CAAC,aAAa,qCAAqC,CAAC;QAC9F,KAAK,UAAU;YACb,OAAO,UAAU,CAAC;IACtB,CAAC;AACH,CAAC;AAkCD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAC;AAE7C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAyC;IACjF;QACE,IAAI,EAAE,mBAAmB;QACzB,YAAY,EAAE,CAAC,WAAW,CAAC;QAC3B,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,qBAAqB,EAAE,KAAK;QAC5B,GAAG,EAAE,iEAAiE;KACvE;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,YAAY,EAAE,CAAC,WAAW,CAAC;QAC3B,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;QACjD,qBAAqB,EAAE,KAAK;QAC5B,GAAG,EAAE,iEAAiE;KACvE;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,YAAY,EAAE,CAAC,WAAW,CAAC;QAC3B,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QACjC,qBAAqB,EAAE,KAAK;QAC5B,GAAG,EAAE,kEAAkE;KACxE;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,YAAY,EAAE,CAAC,cAAc,CAAC;QAC9B,OAAO,EAAE;YACP,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,EAAE;YACzC,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,EAAE;YACzC,EAAE,UAAU,EAAE,MAAM,EAAE;SACvB;QACD,qBAAqB,EAAE,IAAI;QAC3B,GAAG,EAAE,qFAAqF;KAC3F;CACF,CAAC;AAEF,yEAAyE;AACzE,MAAM,UAAU,qBAAqB,CACnC,OAAuF,EACvF,YAA+B;IAE/B,MAAM,KAAK,GAAG,OAAO;SAClB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;SAC9E,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,OAAO,GAAG,KAAK,IAAI,QAAQ,SAAS,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,aAAa,EAAE,CAAC;AAChF,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,yBAAyB,CAAC,GAAW;IACnD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,iBAAiB,CAAC;AAChD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAE1C;;;GAGG;AACH;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAgB;IAIzD,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,GAAG,GAAG,KAAK,CAAC,IAAI,GAAG,GAAG,GAAG,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CACb,4BAA4B,QAAQ,qFAAqF,CAC1H,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,MAAM,CAAC,GAAG,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAClE,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACb,KAAK,IAAI;YACP,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,KAAK,IAAI;YACP,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC9B,KAAK,GAAG;YACN,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC;QACvD;YACE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC;IAChE,CAAC;AACH,CAAC"}