@caelo-cms/provisioning 0.10.60 → 0.10.62

package/caddy/Caddyfile.production

@@ -30,6 +30,13 @@
 	# page's <link rel="icon" type> declares, not the host mime.types name.
 	@ico path *.ico
 	header @ico Content-Type "image/x-icon"
+	# #891 — nothing is content-sniffed, and an uploaded SVG opened directly
+	# runs no script on this origin. Keep the CSP in sync with
+	# SVG_DOCUMENT_CSP in @caelo-cms/shared (enforced by
+	# packages/provisioning/src/index.test.ts).
+	header X-Content-Type-Options "nosniff"
+	@svg path *.svg
+	header @svg Content-Security-Policy "default-src 'none'; img-src data:; style-src 'unsafe-inline'; font-src data:; sandbox"
 	encode gzip
 	try_files {path} {path}/index.html
 	file_server

package/caddy/Caddyfile.staging

@@ -34,6 +34,13 @@
 	# page's <link rel="icon" type> declares, not the host mime.types name.
 	@ico path *.ico
 	header @ico Content-Type "image/x-icon"
+	# #891 — nothing is content-sniffed, and an uploaded SVG opened directly
+	# runs no script on this origin. Keep the CSP in sync with
+	# SVG_DOCUMENT_CSP in @caelo-cms/shared (enforced by
+	# packages/provisioning/src/index.test.ts).
+	header X-Content-Type-Options "nosniff"
+	@svg path *.svg
+	header @svg Content-Security-Policy "default-src 'none'; img-src data:; style-src 'unsafe-inline'; font-src data:; sandbox"
 	encode gzip
 	header X-Robots-Tag "noindex, nofollow"
 	try_files {path} {path}/index.html

package/dist/admin-internal-answer.d.ts

@@ -0,0 +1,12 @@
+/**
+ * How every admin-internal.ts transport reads the admin's HTTP answer, so a
+ * refusal reads the same whichever provider carried the request.
+ */
+import type { AdminInternalCall, AdminInternalResult } from "./admin-internal.js";
+/**
+ * The admin's answer as a result: a 404 is an admin older than the endpoint
+ * (fixed by `upgradeCommand`), a non-JSON body or `ok !== true` is a refusal
+ * carrying the admin's own message.
+ */
+export declare function readAdminAnswer<T>(status: number, text: string, call: AdminInternalCall, upgradeCommand: string): AdminInternalResult<T>;
+//# sourceMappingURL=admin-internal-answer.d.ts.map

package/dist/admin-internal-answer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-internal-answer.d.ts","sourceRoot":"","sources":["../src/admin-internal-answer.ts"],"names":[],"mappings":"AAEA;;;GAGG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAElF;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAC/B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,iBAAiB,EACvB,cAAc,EAAE,MAAM,GACrB,mBAAmB,CAAC,CAAC,CAAC,CAuBxB"}

package/dist/admin-internal-answer.js

@@ -0,0 +1,32 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * The admin's answer as a result: a 404 is an admin older than the endpoint
+ * (fixed by `upgradeCommand`), a non-JSON body or `ok !== true` is a refusal
+ * carrying the admin's own message.
+ */
+export function readAdminAnswer(status, text, call, upgradeCommand) {
+    if (status === 404) {
+        return {
+            ok: false,
+            error: `the admin has no ${call.endpoint} yet (it runs a release from before ${call.introducedBy}). Run \`${upgradeCommand}\`, then run this command again.`,
+        };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return {
+            ok: false,
+            error: `the admin answered HTTP ${status} with a non-JSON body: ${text.slice(0, 200)}`,
+        };
+    }
+    if (status < 200 || status > 299 || parsed.ok !== true) {
+        return {
+            ok: false,
+            error: `the admin refused (HTTP ${status}): ${parsed.error ?? text.slice(0, 300)}`,
+        };
+    }
+    return { ok: true, value: parsed };
+}
+//# sourceMappingURL=admin-internal-answer.js.map

package/dist/admin-internal-answer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-internal-answer.js","sourceRoot":"","sources":["../src/admin-internal-answer.ts"],"names":[],"mappings":"AAAA,mCAAmC;AASnC;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAc,EACd,IAAY,EACZ,IAAuB,EACvB,cAAsB;IAEtB,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,oBAAoB,IAAI,CAAC,QAAQ,uCAAuC,IAAI,CAAC,YAAY,YAAY,cAAc,kCAAkC;SAC7J,CAAC;IACJ,CAAC;IACD,IAAI,MAAkE,CAAC;IACvE,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkB,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,2BAA2B,MAAM,0BAA0B,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;SACvF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACvD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,2BAA2B,MAAM,MAAM,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;SACnF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAsB,EAAE,CAAC;AACrD,CAAC"}

package/dist/admin-internal-google.d.ts

@@ -0,0 +1,4 @@
+import type { AdminInternalAnswer, AdminInternalCall, AdminInternalDeps, GoogleAdminTarget } from "./admin-internal.js";
+/** The admin call on a gcp / gcp-firebase install (see the file comment). */
+export declare function callGoogleAdmin<T>(target: GoogleAdminTarget, call: AdminInternalCall, deps: AdminInternalDeps): Promise<AdminInternalAnswer<T>>;
+//# sourceMappingURL=admin-internal-google.d.ts.map

package/dist/admin-internal-google.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-internal-google.d.ts","sourceRoot":"","sources":["../src/admin-internal-google.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EACV,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EAEjB,iBAAiB,EAClB,MAAM,qBAAqB,CAAC;AAW7B,6EAA6E;AAC7E,wBAAsB,eAAe,CAAC,CAAC,EACrC,MAAM,EAAE,iBAAiB,EACzB,IAAI,EAAE,iBAAiB,EACvB,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAoEjC"}

package/dist/admin-internal-google.js

@@ -0,0 +1,161 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * admin-internal.ts on Google Cloud, as the operator's own gcloud identity —
+ * the same path the Power-MCP shim takes (packages/mcp-server/src/ingress-auth.ts):
+ *
+ *   1. the admin's URL: on gcp-firebase the admin Cloud Run service's own
+ *      URL (IAP sits on the service); on gcp `https://admin.<domain>` (IAP
+ *      sits on the load balancer's admin backend, and the service's
+ *      run.app URL accepts only load-balancer traffic);
+ *   2. the install's internal secret from Secret Manager (in memory only),
+ *      which signs a 5-minute token for the endpoint's scope;
+ *   3. a JWT signed as `caelo-mcp@<project>` through the IAM Credentials
+ *      API with `aud` = `<admin origin>/*` — the audience IAP's service-
+ *      account JWT path checks on both resource kinds
+ *      (cloud.google.com/iap/docs/authentication-howto). The admin's IAP
+ *      lets that service account in, and every IAP-allowlisted operator may
+ *      sign as it (`cms-provision upgrade` grants both), so the request
+ *      passes IAP first, then Caelo's token.
+ */
+import { findService } from "./admin-domain.js";
+import { readAdminAnswer } from "./admin-internal-answer.js";
+import { gcloud as defaultGcloud } from "./gcloud.js";
+import { GCP_STACK_ENV, gcpSecretId, mcpIapServiceAccountEmail } from "./gcp-names.js";
+import { mintInternalToken } from "./internal-token.js";
+/** Signed JWTs live at most 1 hour; one call needs a few seconds. */
+const IAP_JWT_LIFETIME_S = 600;
+/** The admin call on a gcp / gcp-firebase install (see the file comment). */
+export async function callGoogleAdmin(target, call, deps) {
+    const run = deps.run ?? defaultGcloud;
+    const doFetch = deps.fetch ?? fetch;
+    const admin = await adminUrl(run, target);
+    if (!admin.ok)
+        return admin;
+    const secretId = gcpSecretId(GCP_STACK_ENV, "internal-secret");
+    const secret = await run([
+        "secrets",
+        "versions",
+        "access",
+        "latest",
+        `--secret=${secretId}`,
+        `--project=${target.projectId}`,
+    ]);
+    const internalSecret = secret.stdout.trim();
+    if (!secret.ok || internalSecret.length < 32) {
+        return {
+            ok: false,
+            error: `read the install's internal secret (${secretId}) from Secret Manager: ${secret.stderr.trim() || "missing or too short"}. Your gcloud account needs secretmanager.versions.access on the project.`,
+        };
+    }
+    // Installs from before #678 may not have the IAM Credentials API on;
+    // enabling an enabled API is a no-op (codex review on #681).
+    const api = await run([
+        "services",
+        "enable",
+        "iamcredentials.googleapis.com",
+        `--project=${target.projectId}`,
+    ]);
+    if (!api.ok) {
+        return {
+            ok: false,
+            error: `enable the IAM Credentials API (iamcredentials.googleapis.com), needed to pass the admin's IAP: ${api.stderr.trim()}`,
+        };
+    }
+    const iap = await signIapJwt(run, doFetch, target.projectId, admin.value, deps.now);
+    if (!iap.ok)
+        return iap;
+    const token = await mintInternalToken(internalSecret, call.scope);
+    let res;
+    try {
+        res = await doFetch(`${admin.value}${call.endpoint}`, {
+            method: "POST",
+            headers: {
+                authorization: `Bearer ${iap.value}`,
+                "x-caelo-internal-token": token,
+                "content-type": "application/json",
+            },
+            body: JSON.stringify(call.body),
+        });
+    }
+    catch (e) {
+        return {
+            ok: false,
+            error: `reach the admin at ${admin.value}: ${String(e)}${unreachableHint(target)}`,
+        };
+    }
+    const text = await res.text();
+    if (res.headers.get("x-goog-iap-generated-response") === "true") {
+        return {
+            ok: false,
+            error: `Google IAP refused the request (HTTP ${res.status}: ${text.trim().slice(0, 200)}) — ${mcpIapServiceAccountEmail(target.projectId)} is not allowed on the admin's IAP yet. Run \`cms-provision upgrade\` (it allowlists that service account), then run this command again.`,
+        };
+    }
+    const answer = readAdminAnswer(res.status, text, call, "cms-provision upgrade");
+    return answer.ok ? { ok: true, value: { answer: answer.value, adminUrl: admin.value } } : answer;
+}
+/** Where the admin answers behind IAP (see the file comment, step 1). */
+async function adminUrl(run, target) {
+    if (target.provider === "gcp")
+        return { ok: true, value: `https://admin.${target.domain}` };
+    const scope = [`--region=${target.region}`, `--project=${target.projectId}`];
+    const found = await findService(run, scope, "admin");
+    if (!found.ok)
+        return { ok: false, error: found.error };
+    const url = await run([
+        "run",
+        "services",
+        "describe",
+        found.service,
+        ...scope,
+        "--format=value(status.url)",
+    ]);
+    const value = url.stdout.trim();
+    if (!url.ok || !value) {
+        return { ok: false, error: `read the admin's URL: ${url.stderr.trim() || "empty"}` };
+    }
+    return { ok: true, value };
+}
+/** On gcp the admin's host must resolve to the load balancer and have its certificate. */
+function unreachableHint(target) {
+    return target.provider === "gcp"
+        ? ` — admin.${target.domain} must resolve to the install's load balancer with an ACTIVE certificate (check \`dig +short admin.${target.domain}\`).`
+        : "";
+}
+/** A JWT signed as the install's MCP service account, for the admin's IAP. */
+async function signIapJwt(run, doFetch, projectId, adminUrl, now) {
+    const access = await run(["auth", "print-access-token"]);
+    const accessToken = access.stdout.trim();
+    if (!access.ok || !accessToken) {
+        return {
+            ok: false,
+            error: `get an access token from gcloud: ${access.stderr.trim() || "empty"}. Run \`gcloud auth login\` with the account you provisioned with.`,
+        };
+    }
+    const serviceAccount = mcpIapServiceAccountEmail(projectId);
+    const iat = now ? now() : Math.floor(Date.now() / 1000);
+    const res = await doFetch(`https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${encodeURIComponent(serviceAccount)}:signJwt`, {
+        method: "POST",
+        headers: { authorization: `Bearer ${accessToken}`, "content-type": "application/json" },
+        body: JSON.stringify({
+            payload: JSON.stringify({
+                iss: serviceAccount,
+                sub: serviceAccount,
+                aud: `${new URL(adminUrl).origin}/*`,
+                iat,
+                exp: iat + IAP_JWT_LIFETIME_S,
+            }),
+        }),
+    });
+    if (!res.ok) {
+        const detail = (await res.text().catch(() => "")).slice(0, 300);
+        return {
+            ok: false,
+            error: `sign an IAP token as ${serviceAccount} (HTTP ${res.status}): ${detail} — your account needs roles/iam.serviceAccountTokenCreator on it; \`cms-provision upgrade\` grants it to everyone the admin's IAP lets in.`,
+        };
+    }
+    const { signedJwt } = (await res.json());
+    if (!signedJwt)
+        return { ok: false, error: "IAM signJwt answered without a signedJwt" };
+    return { ok: true, value: signedJwt };
+}
+//# sourceMappingURL=admin-internal-google.js.map

package/dist/admin-internal-google.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-internal-google.js","sourceRoot":"","sources":["../src/admin-internal-google.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAQhD,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,MAAM,IAAI,aAAa,EAAqB,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAIxD,qEAAqE;AACrE,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAE/B,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAyB,EACzB,IAAuB,EACvB,IAAuB;IAEvB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IAEpC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAE5B,MAAM,QAAQ,GAAG,WAAW,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;QACvB,SAAS;QACT,UAAU;QACV,QAAQ;QACR,QAAQ;QACR,YAAY,QAAQ,EAAE;QACtB,aAAa,MAAM,CAAC,SAAS,EAAE;KAChC,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,cAAc,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC7C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,uCAAuC,QAAQ,0BAA0B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,sBAAsB,2EAA2E;SAC1M,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,6DAA6D;IAC7D,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC;QACpB,UAAU;QACV,QAAQ;QACR,+BAA+B;QAC/B,aAAa,MAAM,CAAC,SAAS,EAAE;KAChC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,mGAAmG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;SAC9H,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACpF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC;IAExB,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAClE,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,GAAG,CAAC,KAAK,EAAE;gBACpC,wBAAwB,EAAE,KAAK;gBAC/B,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;SAChC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,sBAAsB,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,EAAE;SACnF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,KAAK,MAAM,EAAE,CAAC;QAChE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,wCAAwC,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,yBAAyB,CAAC,MAAM,CAAC,SAAS,CAAC,0IAA0I;SACpR,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAI,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,uBAAuB,CAAC,CAAC;IACnF,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AACnG,CAAC;AAED,yEAAyE;AACzE,KAAK,UAAU,QAAQ,CAAC,GAAQ,EAAE,MAAyB;IACzD,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,iBAAiB,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;IAC5F,MAAM,KAAK,GAAG,CAAC,YAAY,MAAM,CAAC,MAAM,EAAE,EAAE,aAAa,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IACxD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC;QACpB,KAAK;QACL,UAAU;QACV,UAAU;QACV,KAAK,CAAC,OAAO;QACb,GAAG,KAAK;QACR,4BAA4B;KAC7B,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,OAAO,EAAE,EAAE,CAAC;IACvF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,0FAA0F;AAC1F,SAAS,eAAe,CAAC,MAAyB;IAChD,OAAO,MAAM,CAAC,QAAQ,KAAK,KAAK;QAC9B,CAAC,CAAC,YAAY,MAAM,CAAC,MAAM,qGAAqG,MAAM,CAAC,MAAM,MAAM;QACnJ,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,8EAA8E;AAC9E,KAAK,UAAU,UAAU,CACvB,GAAQ,EACR,OAAqB,EACrB,SAAiB,EACjB,QAAgB,EAChB,GAA+B;IAE/B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,oCAAoC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,OAAO,oEAAoE;SAC/I,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,yBAAyB,CAAC,SAAS,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,uEAAuE,kBAAkB,CAAC,cAAc,CAAC,UAAU,EACnH;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QACvF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;gBACtB,GAAG,EAAE,cAAc;gBACnB,GAAG,EAAE,cAAc;gBACnB,GAAG,EAAE,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,IAAI;gBACpC,GAAG;gBACH,GAAG,EAAE,GAAG,GAAG,kBAAkB;aAC9B,CAAC;SACH,CAAC;KACH,CACF,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAChE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,wBAAwB,cAAc,UAAU,GAAG,CAAC,MAAM,MAAM,MAAM,4IAA4I;SAC1N,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2B,CAAC;IACnE,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC;IACxF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AACxC,CAAC"}

package/dist/admin-internal-self-hosted.d.ts

@@ -0,0 +1,30 @@
+/**
+ * admin-internal.ts on a self-hosted install: from the install's host into
+ * the admin container, never over the internet.
+ *
+ * The root of trust is the host: whoever may run `docker compose` for the
+ * install already controls its database, its files and its secrets, so
+ * reaching the admin's internal endpoints grants nothing new. The CLI signs
+ * a 5-minute token for the endpoint's scope with `.caelo/internal-secret.json`
+ * (the secret the Compose file gives the admin as `CAELO_INTERNAL_SECRET`)
+ * and runs one `fetch` inside the admin container (`docker compose exec`)
+ * against the admin's own port on 127.0.0.1 — the admin image has bun but
+ * no curl.
+ *
+ * Nothing secret travels in process arguments, which other users of the
+ * host can read in `ps`: the token and the request body go in on the exec's
+ * stdin, the answer comes back on its stdout. `docker compose exec` output
+ * is not part of the container's log (`docker compose logs` shows only the
+ * container's main process), so the answer is written nowhere.
+ */
+import type { AdminInternalAnswer, AdminInternalCall, AdminInternalDeps, SelfHostedAdminTarget } from "./admin-internal.js";
+/**
+ * What runs inside the admin container. It reads `{ endpoint, token, body }`
+ * from stdin, POSTs to the admin's own port and prints one JSON line:
+ * `{ status, text }`, or `{ unreachable }` when the admin does not answer.
+ * It holds no secret itself — it is visible in `ps` on the host.
+ */
+export declare const IN_CONTAINER_FETCH = "(async () => {\n  const out = (o) => process.stdout.write(JSON.stringify(o));\n  const req = JSON.parse(await Bun.stdin.text());\n  try {\n    const res = await fetch(\"http://127.0.0.1:\" + process.env.PORT + req.endpoint, {\n      method: \"POST\",\n      headers: { \"x-caelo-internal-token\": req.token, \"content-type\": \"application/json\" },\n      body: JSON.stringify(req.body),\n    });\n    out({ status: res.status, text: await res.text() });\n  } catch (e) {\n    out({ unreachable: String(e) });\n  }\n})();";
+/** The admin call on a self-hosted install (see the file comment). */
+export declare function callSelfHostedAdmin<T>(target: SelfHostedAdminTarget, call: AdminInternalCall, deps: AdminInternalDeps): Promise<AdminInternalAnswer<T>>;
+//# sourceMappingURL=admin-internal-self-hosted.d.ts.map

package/dist/admin-internal-self-hosted.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-internal-self-hosted.d.ts","sourceRoot":"","sources":["../src/admin-internal-self-hosted.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EACV,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,EACtB,MAAM,qBAAqB,CAAC;AAW7B;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,+gBAazB,CAAC;AAEP,sEAAsE;AACtE,wBAAsB,mBAAmB,CAAC,CAAC,EACzC,MAAM,EAAE,qBAAqB,EAC7B,IAAI,EAAE,iBAAiB,EACvB,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CA0DjC"}

package/dist/admin-internal-self-hosted.js

@@ -0,0 +1,92 @@
+// SPDX-License-Identifier: MPL-2.0
+import { readAdminAnswer } from "./admin-internal-answer.js";
+import { mintInternalToken } from "./internal-token.js";
+import { selfCommand } from "./self-command.js";
+import { internalSecretPath, readInternalSecret } from "./self-hosted-internal-secret.js";
+import { bunHostRunner } from "./self-hosted-release.js";
+import { compose } from "./self-hosted-upgrade.js";
+/** The admin's Compose service (compose.ts). */
+const ADMIN_SERVICE = "caelo-admin";
+/**
+ * What runs inside the admin container. It reads `{ endpoint, token, body }`
+ * from stdin, POSTs to the admin's own port and prints one JSON line:
+ * `{ status, text }`, or `{ unreachable }` when the admin does not answer.
+ * It holds no secret itself — it is visible in `ps` on the host.
+ */
+export const IN_CONTAINER_FETCH = `(async () => {
+  const out = (o) => process.stdout.write(JSON.stringify(o));
+  const req = JSON.parse(await Bun.stdin.text());
+  try {
+    const res = await fetch("http://127.0.0.1:" + process.env.PORT + req.endpoint, {
+      method: "POST",
+      headers: { "x-caelo-internal-token": req.token, "content-type": "application/json" },
+      body: JSON.stringify(req.body),
+    });
+    out({ status: res.status, text: await res.text() });
+  } catch (e) {
+    out({ unreachable: String(e) });
+  }
+})();`;
+/** The admin call on a self-hosted install (see the file comment). */
+export async function callSelfHostedAdmin(target, call, deps) {
+    const host = deps.host ?? bunHostRunner;
+    const restart = selfCommand("up");
+    let secret;
+    try {
+        secret = readInternalSecret(target.caeloDir);
+    }
+    catch (e) {
+        return { ok: false, error: e.message };
+    }
+    if (secret === null) {
+        return {
+            ok: false,
+            error: `${internalSecretPath(target.caeloDir)} does not exist. Run \`${restart}\` (it creates the secret and restarts the admin with it), then run this command again.`,
+        };
+    }
+    const token = await mintInternalToken(secret, call.scope);
+    const r = await host.run(compose(target.caeloDir, "exec", "-T", ADMIN_SERVICE, "bun", "-e", IN_CONTAINER_FETCH), { stdinText: JSON.stringify({ endpoint: call.endpoint, token, body: call.body }) });
+    if (r.exitCode !== 0) {
+        return {
+            ok: false,
+            error: `run a request inside the ${ADMIN_SERVICE} container (docker compose exec, exit ${r.exitCode}): ${tail(r.stderr) || "no output"}. The admin must be running — start it with \`${restart}\`, then run this command again.`,
+        };
+    }
+    let reply;
+    try {
+        reply = JSON.parse(r.stdout);
+    }
+    catch {
+        return {
+            ok: false,
+            error: `the request inside the ${ADMIN_SERVICE} container printed no answer: ${tail(r.stdout) || tail(r.stderr) || "empty"}`,
+        };
+    }
+    if (typeof reply.unreachable === "string") {
+        return {
+            ok: false,
+            error: `the admin did not answer on its own port inside the container (${reply.unreachable}). Check \`docker compose -f ${target.caeloDir}/docker-compose.yml logs ${ADMIN_SERVICE}\`, then run this command again.`,
+        };
+    }
+    if (typeof reply.status !== "number" || typeof reply.text !== "string") {
+        return {
+            ok: false,
+            error: `the request inside the ${ADMIN_SERVICE} container answered an unexpected shape`,
+        };
+    }
+    if (reply.status === 401) {
+        return {
+            ok: false,
+            error: `the admin refused the internal token (HTTP 401: ${reply.text.slice(0, 200)}) — the running admin does not hold the secret in ${internalSecretPath(target.caeloDir)} (it was started from an older Compose file). Run \`${restart}\` to restart it with that secret, then run this command again.`,
+        };
+    }
+    const answer = readAdminAnswer(reply.status, reply.text, call, "cms-provision upgrade");
+    return answer.ok
+        ? { ok: true, value: { answer: answer.value, adminUrl: target.adminUrl } }
+        : answer;
+}
+/** The last lines of a command's output, for an error message. */
+function tail(text) {
+    return text.trim().split("\n").slice(-5).join("\n").slice(0, 500);
+}
+//# sourceMappingURL=admin-internal-self-hosted.js.map

package/dist/admin-internal-self-hosted.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-internal-self-hosted.js","sourceRoot":"","sources":["../src/admin-internal-self-hosted.ts"],"names":[],"mappings":"AAAA,mCAAmC;AA4BnC,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAEnD,gDAAgD;AAChD,MAAM,aAAa,GAAG,aAAa,CAAC;AAEpC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;MAa5B,CAAC;AAEP,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAA6B,EAC7B,IAAuB,EACvB,IAAuB;IAEvB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,aAAa,CAAC;IACxC,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,MAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,0BAA0B,OAAO,yFAAyF;SACxK,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1D,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CACtB,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,CAAC,EACtF,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CACnF,CAAC;IACF,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,4BAA4B,aAAa,yCAAyC,CAAC,CAAC,QAAQ,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,WAAW,iDAAiD,OAAO,kCAAkC;SACjO,CAAC;IACJ,CAAC;IACD,IAAI,KAAkE,CAAC;IACvE,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAiB,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,0BAA0B,aAAa,iCAAiC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,OAAO,EAAE;SAC7H,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,kEAAkE,KAAK,CAAC,WAAW,gCAAgC,MAAM,CAAC,QAAQ,4BAA4B,aAAa,kCAAkC;SACrN,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACvE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,0BAA0B,aAAa,yCAAyC;SACxF,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACzB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,mDAAmD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,qDAAqD,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,uDAAuD,OAAO,iEAAiE;SAC1S,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAI,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAC3F,OAAO,MAAM,CAAC,EAAE;QACd,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE;QAC1E,CAAC,CAAC,MAAM,CAAC;AACb,CAAC;AAED,kEAAkE;AAClE,SAAS,IAAI,CAAC,IAAY;IACxB,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACpE,CAAC"}

package/dist/admin-internal.d.ts

@@ -1,14 +1,34 @@
-import { type GcloudResult } from "./gcloud.js";
-type Run = (args: string[]) => Promise<GcloudResult>;
-export interface AdminInternalTarget {
+import type { GcloudResult } from "./gcloud.js";
+import type { HostRunner } from "./self-hosted-release.js";
+/** Which admin to call, and what the provider needs to reach it. */
+export type AdminInternalTarget = GoogleAdminTarget | SelfHostedAdminTarget;
+/** A Google Cloud install (IAP in front of the admin). */
+export type GoogleAdminTarget = {
+    readonly provider: "gcp-firebase";
     readonly projectId: string;
     readonly region: string;
+} | {
+    readonly provider: "gcp";
+    readonly projectId: string;
+    /** The install's domain; the admin answers on `admin.<domain>`. */
+    readonly domain: string;
+};
+/** A self-hosted install on this host. */
+export interface SelfHostedAdminTarget {
+    readonly provider: "self-hosted";
+    /** The install's `.caelo/` directory (Compose file, internal secret). */
+    readonly caeloDir: string;
+    /** The admin's public origin, for the links the operator opens. */
+    readonly adminUrl: string;
 }
 export interface AdminInternalDeps {
-    readonly run?: Run;
+    /** gcloud (Google providers). */
+    readonly run?: (args: string[]) => Promise<GcloudResult>;
     readonly fetch?: typeof fetch;
     /** Seconds since epoch (IAP JWT); tests pin it. */
     readonly now?: () => number;
+    /** `docker compose` on the install's host (self-hosted). */
+    readonly host?: HostRunner;
 }
 /** One endpoint call: where, under which token scope, with what body. */
 export interface AdminInternalCall {
@@ -27,15 +47,16 @@ export type AdminInternalResult<T> = {
     ok: false;
     error: string;
 };
+/** What a transport hands back: the admin's answer and the URL it serves on. */
+export type AdminInternalAnswer<T> = AdminInternalResult<{
+    answer: T;
+    adminUrl: string;
+}>;
 /**
  * POST `call.body` to the endpoint and return the admin's JSON answer and
- * the admin URL it was reached at (to build links the operator opens).
- * Every failure names the fix: an IAP refusal or a pre-endpoint admin points
- * at `cms-provision upgrade`, a refusal carries the admin's own message.
+ * the admin URL the operator opens (to build links). Every failure names
+ * the fix: a gate refusal or a pre-endpoint admin points at the command that
+ * repairs it, a refusal carries the admin's own message.
  */
-export declare function callAdminInternal<T>(target: AdminInternalTarget, call: AdminInternalCall, deps?: AdminInternalDeps): Promise<AdminInternalResult<{
-    answer: T;
-    adminUrl: string;
-}>>;
-export {};
+export declare function callAdminInternal<T>(target: AdminInternalTarget, call: AdminInternalCall, deps?: AdminInternalDeps): Promise<AdminInternalAnswer<T>>;
 //# sourceMappingURL=admin-internal.d.ts.map

package/dist/admin-internal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin-internal.d.ts","sourceRoot":"","sources":["../src/admin-internal.ts"],"names":[],"mappings":"AAuBA,OAAO,EAA2B,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAIzE,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;AAKrD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC;IACnB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,mDAAmD;IACnD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED,yEAAyE;AACzE,MAAM,WAAW,iBAAiB;IAChC,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,gFAAgF;IAChF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,MAAM,mBAAmB,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3F;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,MAAM,EAAE,mBAAmB,EAC3B,IAAI,EAAE,iBAAiB,EACvB,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,mBAAmB,CAAC;IAAE,MAAM,EAAE,CAAC,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAkG/D"}
+{"version":3,"file":"admin-internal.d.ts","sourceRoot":"","sources":["../src/admin-internal.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAE3D,oEAAoE;AACpE,MAAM,MAAM,mBAAmB,GAAG,iBAAiB,GAAG,qBAAqB,CAAC;AAE5E,0DAA0D;AAC1D,MAAM,MAAM,iBAAiB,GACzB;IACE,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,GACD;IACE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEN,0CAA0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,iCAAiC;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IACzD,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,mDAAmD;IACnD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC;CAC5B;AAED,yEAAyE;AACzE,MAAM,WAAW,iBAAiB;IAChC,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,gFAAgF;IAChF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,MAAM,mBAAmB,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3F,gFAAgF;AAChF,MAAM,MAAM,mBAAmB,CAAC,CAAC,IAAI,mBAAmB,CAAC;IAAE,MAAM,EAAE,CAAC,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE1F;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EACjC,MAAM,EAAE,mBAAmB,EAC3B,IAAI,EAAE,iBAAiB,EACvB,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAIjC"}