@caelo-cms/provisioning 0.10.61 → 0.10.64

package/dist/agent-db.js

@@ -7169,9 +7169,25 @@ var pageModuleContentSetManySchema = object({
 }).strict();
 // ../shared/src/cap-failures.ts
 var counters = new Map;
+// ../shared/src/css-scope-scan.ts
+var GROUPING_AT_RULES = new Set(["media", "supports", "layer", "container", "document"]);
 // ../shared/src/interactions.ts
-var NAV_FUNCTIONAL_CSS = ".caelo-nav-menu .caelo-nav-toggle{display:none;background:none;border:0;cursor:pointer;padding:0.5rem;color:inherit;font:inherit}" + ".caelo-nav-menu .caelo-nav-toggle .caelo-nav-bar{display:block;width:1.25em;height:2px;background:currentColor;margin:0.25em 0}" + "@media (max-width: 720px){" + ".caelo-nav-menu .caelo-nav-toggle{display:inline-block}" + ".caelo-nav-menu > ul{display:none}" + '.caelo-nav-menu[data-nav-open="true"] > ul{display:block}' + "}";
-var NAV_TOGGLE_JS = "(function(){" + "document.querySelectorAll('.caelo-nav-menu').forEach(function(nav){" + "var btn=nav.querySelector('.caelo-nav-toggle');if(!btn)return;" + "btn.addEventListener('click',function(){" + "var open=nav.getAttribute('data-nav-open')==='true';" + "nav.setAttribute('data-nav-open',String(!open));" + "btn.setAttribute('aria-expanded',String(!open));" + "});" + "nav.addEventListener('keydown',function(e){" + "if(e.key==='Escape'&&nav.getAttribute('data-nav-open')==='true'){" + "nav.setAttribute('data-nav-open','false');" + "btn.setAttribute('aria-expanded','false');btn.focus();" + "}});" + "});" + "})();";
+var MOBILE_NAV_CSS = ".caelo-nav-menu .caelo-nav-toggle{display:none;background:none;border:0;cursor:pointer;padding:0.5rem;color:inherit;font:inherit}" + ".caelo-nav-menu .caelo-nav-toggle .caelo-nav-bar{display:block;width:1.25em;height:2px;background:currentColor;margin:0.25em 0}" + "@media (max-width: 720px){" + ".caelo-nav-menu .caelo-nav-toggle{display:inline-block}" + ".caelo-nav-menu > ul{display:none}" + '.caelo-nav-menu[data-nav-open="true"] > ul{display:block}' + "}";
+var MOBILE_NAV_JS = "(function(){" + `var S='[data-caelo-ui="mobile-nav"]';` + "function set(nav,open){nav.setAttribute('data-nav-open',String(open));" + "var b=nav.querySelector('.caelo-nav-toggle');if(b)b.setAttribute('aria-expanded',String(open));return b;}" + "document.addEventListener('click',function(e){" + "var t=e.target;if(!(t instanceof Element))return;" + "var b=t.closest('.caelo-nav-toggle');if(!b)return;var nav=b.closest(S);if(!nav)return;" + "set(nav,nav.getAttribute('data-nav-open')!=='true');});" + "document.addEventListener('keydown',function(e){" + "if(e.key!=='Escape')return;var t=e.target;if(!(t instanceof Element))return;" + `var nav=t.closest(S+'[data-nav-open="true"]');if(!nav)return;` + "var b=set(nav,false);if(b)b.focus();});" + "})();";
+var ACCORDION_CSS = ':where([data-caelo-ui="accordion"] summary){cursor:pointer}';
+var ACCORDION_JS = "(function(){" + `var S='[data-caelo-ui="accordion"]';` + "document.addEventListener('toggle',function(e){" + "var d=e.target;if(!(d instanceof HTMLDetailsElement)||!d.open)return;" + "var acc=d.closest(S);if(!acc||!acc.hasAttribute('data-single'))return;" + "acc.querySelectorAll('details[open]').forEach(function(o){if(o!==d&&o.closest(S)===acc)o.open=false;});" + "},true);" + "function openHash(){var id;try{id=decodeURIComponent(location.hash.slice(1));}catch(_){return;}if(!id)return;" + "var el=document.getElementById(id);if(!el)return;var d=el.closest(S+' details');" + "if(d&&!d.open){d.open=true;el.scrollIntoView();}}" + "window.addEventListener('hashchange',openHash);" + "if(document.readyState==='loading')document.addEventListener('DOMContentLoaded',openHash);else openHash();" + "})();";
+var TABS_CSS = '[data-caelo-ui="tabs"] [role="tabpanel"][hidden]{display:none}';
+var TABS_JS = "(function(){" + `function tabsOf(list){return Array.prototype.filter.call(list.querySelectorAll('[role="tab"]'),function(t){return t.closest('[role="tablist"]')===list;});}` + `function select(tab,focus){var list=tab.closest('[role="tablist"]');if(!list)return;` + "tabsOf(list).forEach(function(t){var on=t===tab;" + "t.setAttribute('aria-selected',String(on));t.setAttribute('tabindex',on?'0':'-1');" + "var p=document.getElementById(t.getAttribute('aria-controls')||'');if(p){if(on)p.removeAttribute('hidden');else p.setAttribute('hidden','');}});" + "if(focus)tab.focus();}" + "function tabAt(e){var t=e.target;if(!(t instanceof Element))return null;" + `var tab=t.closest('[role="tab"]');return tab&&tab.closest('[data-caelo-ui="tabs"]')?tab:null;}` + "document.addEventListener('click',function(e){var tab=tabAt(e);if(tab)select(tab,false);});" + "document.addEventListener('keydown',function(e){var tab=tabAt(e);if(!tab)return;" + `var list=tab.closest('[role="tablist"]');if(!list)return;var all=tabsOf(list);var i=all.indexOf(tab);var n=-1;` + "if(e.key==='ArrowRight'||e.key==='ArrowDown')n=(i+1)%all.length;" + "else if(e.key==='ArrowLeft'||e.key==='ArrowUp')n=(i-1+all.length)%all.length;" + "else if(e.key==='Home')n=0;else if(e.key==='End')n=all.length-1;" + "if(n<0)return;e.preventDefault();select(all[n],true);});" + "})();";
+var CAROUSEL_CSS = ':where([data-caelo-ui="carousel"] [data-caelo-carousel-track]){display:flex;overflow-x:auto;scroll-snap-type:x mandatory;scroll-behavior:smooth}' + ':where([data-caelo-ui="carousel"] [data-caelo-carousel-track]>*){flex:0 0 100%;scroll-snap-align:start}' + '@media (prefers-reduced-motion: reduce){[data-caelo-ui="carousel"] [data-caelo-carousel-track]{scroll-behavior:auto}}';
+var CAROUSEL_JS = "(function(){" + "document.addEventListener('click',function(e){var t=e.target;if(!(t instanceof Element))return;" + "var b=t.closest('[data-caelo-carousel-prev],[data-caelo-carousel-next]');if(!b)return;" + `var c=b.closest('[data-caelo-ui="carousel"]');if(!c)return;` + "var track=c.querySelector('[data-caelo-carousel-track]');if(!track)return;" + "var dir=b.hasAttribute('data-caelo-carousel-next')?1:-1;" + "var reduce=window.matchMedia('(prefers-reduced-motion: reduce)').matches;" + "track.scrollBy({left:dir*track.clientWidth,behavior:reduce?'auto':'smooth'});});" + "})();";
+var INTERACTIONS = {
+  "mobile-nav": { css: MOBILE_NAV_CSS, js: MOBILE_NAV_JS },
+  accordion: { css: ACCORDION_CSS, js: ACCORDION_JS },
+  tabs: { css: TABS_CSS, js: TABS_JS },
+  carousel: { css: CAROUSEL_CSS, js: CAROUSEL_JS }
+};
+var INTERACTION_IDS = Object.keys(INTERACTIONS);
+var INTERACTION_MARKUP_CONTRACT = '**Vetted interactions - use these instead of writing JS for them.** Add `data-caelo-ui="<id>"` to the markup and Caelo ships accessible, dependency-free behaviour once per page; style it freely in the module CSS. ' + '`accordion` (FAQ, collapsible sections): `<div data-caelo-ui="accordion" data-single>` containing `<details id="..."><summary>Question</summary><div>Answer</div></details>` items - `data-single` keeps one open; a link to `#<details id>` opens it. ' + '`tabs`: `<div data-caelo-ui="tabs"><div role="tablist" aria-label="..."><button type="button" role="tab" id="t1" aria-controls="p1" aria-selected="true">...</button><button type="button" role="tab" id="t2" aria-controls="p2" aria-selected="false" tabindex="-1">...</button></div><div role="tabpanel" id="p1" aria-labelledby="t1">...</div><div role="tabpanel" id="p2" aria-labelledby="t2" hidden>...</div></div>` - ids must be unique on the page. ' + '`carousel` (slider, testimonials): `<section data-caelo-ui="carousel" aria-roledescription="carousel" aria-label="..."><div data-caelo-carousel-track tabindex="0"><div role="group" aria-roledescription="slide" aria-label="1 of 3">...</div>...</div><button type="button" data-caelo-carousel-prev aria-label="Previous slide"><span aria-hidden="true">&lsaquo;</span></button><button type="button" data-caelo-carousel-next aria-label="Next slide"><span aria-hidden="true">&rsaquo;</span></button></section>` (an icon button keeps its visible content aria-hidden; a text button needs no aria-label) - one slide per view by default; set the slides\' `flex-basis` in module CSS to show more. ' + "`mobile-nav` is applied by the built-in nav-menu renderer; never add it by hand. " + "Write module JS only for behaviour the kit does not cover.";
 
 // ../shared/src/media.ts
 var MEDIA_ALLOWED_MIMES = [
@@ -8274,6 +8290,7 @@ var IMAGE_DIGEST = /^sha256:[0-9a-f]{64}$/;
 var SEMVER2 = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/;
 var GHSA_ID = /^GHSA(-[23456789cfghjmpqrvwx]{4}){3}$/;
 var digest = string2().regex(IMAGE_DIGEST, "expected sha256:<64 hex>");
+var OWNER_ACTION_MAX_CHARS = 300;
 var ReleaseManifestSchema = object({
   manifestVersion: literal(1),
   version: string2().regex(SEMVER2, "expected a SemVer version without a leading v"),
@@ -8287,7 +8304,8 @@ var ReleaseManifestSchema = object({
     head: string2().min(1)
   }),
   security: boolean2(),
-  advisories: array(string2().regex(GHSA_ID, "expected a GHSA id"))
+  advisories: array(string2().regex(GHSA_ID, "expected a GHSA id")),
+  ownerAction: string2().min(1).max(OWNER_ACTION_MAX_CHARS).optional()
 });
 var OciManifestSchema = object({
   artifactType: string2().optional(),
@@ -17870,6 +17888,78 @@ function drizzle(...params) {
   drizzle2.mock = mock;
 })(drizzle || (drizzle = {}));
 
+// ../query-api/src/audit.ts
+var SENSITIVE_KEYS = new Set([
+  "password",
+  "newPassword",
+  "currentPassword",
+  "token",
+  "csrfToken",
+  "passwordHash",
+  "secret",
+  "apiKey",
+  "clientSecret"
+]);
+var SENSITIVE_KEY_RE = /pass(word|wd|phrase)?|secret|token|api[-_]?key|credential|private[-_]?key/i;
+function redact2(value) {
+  if (value === null || value === undefined)
+    return value;
+  if (Array.isArray(value))
+    return value.map(redact2);
+  if (typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      if (k === "__proto__" || k === "constructor" || k === "prototype")
+        continue;
+      out[k] = SENSITIVE_KEYS.has(k) || SENSITIVE_KEY_RE.test(k) ? "<redacted>" : redact2(v);
+    }
+    return out;
+  }
+  return value;
+}
+async function canonicalHash(input) {
+  const canonical = JSON.stringify(redact2(input), (_key, val) => {
+    if (val && typeof val === "object" && !Array.isArray(val)) {
+      const sorted = {};
+      for (const k of Object.keys(val).sort())
+        sorted[k] = val[k];
+      return sorted;
+    }
+    return val;
+  });
+  const bytes = new TextEncoder().encode(canonical);
+  const digest = await crypto.subtle.digest("SHA-256", bytes);
+  return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function recordAudit(tx, opts) {
+  const hash = await canonicalHash(opts.input);
+  const entityId = opts.entityId ?? null;
+  const resultSummary = opts.resultSummary ?? null;
+  const requestId = opts.requestId ?? null;
+  const provider = opts.provider ?? null;
+  const model = opts.model ?? null;
+  const operationType = opts.operationType ?? null;
+  await tx.execute(sql`
+    INSERT INTO audit_events (
+      actor_id, operation, input_hash, succeeded, entity_id, result_summary,
+      request_id, provider, model, operation_type
+    )
+    VALUES (
+      ${opts.actorId}::uuid,
+      ${opts.operation},
+      ${hash},
+      ${opts.succeeded},
+      ${entityId === null ? null : sql`${entityId}::uuid`},
+      ${resultSummary},
+      ${requestId},
+      ${provider},
+      ${model},
+      ${operationType}
+    )
+  `);
+}
+var SYSTEM_ACTOR_ID = "00000000-0000-0000-0000-00000000ffff";
+
 // ../query-api/src/branch-access.ts
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function namedBranches(ctx, input) {
@@ -17957,6 +18047,28 @@ function isRlsDenial(error) {
   return false;
 }
 
+// ../query-api/src/post-commit.ts
+var pendingByTx = new WeakMap;
+function collectPostCommitEffects(tx) {
+  const pending = [];
+  pendingByTx.set(tx, pending);
+  return pending;
+}
+async function runPostCommitEffects(effects) {
+  const failures = [];
+  for (const effect of effects) {
+    try {
+      await effect.run();
+    } catch (thrown) {
+      failures.push({
+        effect,
+        message: thrown instanceof Error ? thrown.message : String(thrown)
+      });
+    }
+  }
+  return failures;
+}
+
 // ../query-api/src/adapter.ts
 var SQL3 = globalThis.Bun?.SQL;
 var DEFAULT_ROLES = { admin: "admin_role", public: ["admin_role", "public_role"] };
@@ -17981,6 +18093,10 @@ function validatePoolMax(value, source) {
   }
   return value;
 }
+function postCommitFailureMessage(failures) {
+  const list = failures.map((f) => `${f.effect.label} (${f.message})`).join("; ");
+  return `The change is saved, but its follow-up in the running server failed: ${list}. Do not repeat the change. Restart the admin server so the running state is rebuilt from the saved data; the failure is in the audit log.`;
+}
 
 class DatabaseAdapter {
   #admin;
@@ -18062,14 +18178,12 @@ class DatabaseAdapter {
       await this.verifyRoles();
     const db = op.database === "cms_admin" ? this.#adminDb(`operation ${op.name}`) : this.#public;
     let publishAfterCommit = false;
+    let postCommit = [];
     let result;
     try {
       result = await db.transaction(async (tx) => {
-        await tx.execute(sql`SELECT set_config('caelo.actor_id', ${ctx.actorId}, true)`);
-        await tx.execute(sql`SELECT set_config('caelo.actor_kind', ${ctx.actorKind}, true)`);
-        await tx.execute(sql`SELECT set_config('caelo.plugin_id', ${ctx.pluginId ?? ""}, true)`);
-        await tx.execute(sql`SELECT set_config('caelo.chat_branch_id', ${ctx.chatBranchId ?? ""}, true)`);
-        await tx.execute(sql`SELECT set_config('caelo.chat_task_id', ${ctx.chatTaskId ?? ""}, true)`);
+        postCommit = collectPostCommitEffects(tx);
+        await this.#setIdentity(tx, ctx);
         if (op.database === "cms_admin") {
           const denied = await firstInvisibleBranch(tx, namedBranches(ctx, validatedInput));
           if (denied !== null)
@@ -18099,19 +18213,71 @@ class DatabaseAdapter {
         ...pgDetail ? { pgDetail } : {}
       });
     }
+    const effectFailures = await this.#settlePostCommit(op.name, ctx, postCommit);
+    let publishFailure = null;
     if (publishAfterCommit) {
       try {
         await this.#publishAfterCommit();
       } catch (thrown) {
-        return err({
-          kind: "HandlerError",
-          operation: op.name,
-          message: `The change is saved, but the public site does not serve it yet: publishing it failed (${thrown instanceof Error ? thrown.message : String(thrown)}). Do not repeat the change; it is published automatically within seconds once the public database answers.`
-        });
+        publishFailure = `The change is saved, but the public site does not serve it yet: publishing it failed (${thrown instanceof Error ? thrown.message : String(thrown)}). Do not repeat the change; it is published automatically within seconds once the public database answers.`;
       }
     }
+    if (effectFailures.length > 0) {
+      const effects = postCommitFailureMessage(effectFailures);
+      return err({
+        kind: "HandlerError",
+        operation: op.name,
+        message: publishFailure === null ? effects : `${effects} ${publishFailure}`
+      });
+    }
+    if (publishFailure !== null) {
+      return err({ kind: "HandlerError", operation: op.name, message: publishFailure });
+    }
     return result;
   }
+  async#setIdentity(tx, ctx) {
+    await tx.execute(sql`SELECT set_config('caelo.actor_id', ${ctx.actorId}, true)`);
+    await tx.execute(sql`SELECT set_config('caelo.actor_kind', ${ctx.actorKind}, true)`);
+    await tx.execute(sql`SELECT set_config('caelo.plugin_id', ${ctx.pluginId ?? ""}, true)`);
+    await tx.execute(sql`SELECT set_config('caelo.chat_branch_id', ${ctx.chatBranchId ?? ""}, true)`);
+    await tx.execute(sql`SELECT set_config('caelo.chat_task_id', ${ctx.chatTaskId ?? ""}, true)`);
+  }
+  async#settlePostCommit(operation, ctx, effects) {
+    if (effects.length === 0)
+      return [];
+    const failures = await runPostCommitEffects(effects);
+    for (const failure of failures) {
+      console.error("[query-api] post-commit effect failed", {
+        effect: failure.effect.label,
+        entityId: failure.effect.entityId ?? null,
+        requestId: ctx.requestId,
+        error: failure.message
+      });
+      if (this.#admin === null)
+        continue;
+      try {
+        await this.#admin.transaction(async (tx) => {
+          await this.#setIdentity(tx, ctx);
+          await recordAudit(tx, {
+            actorId: ctx.actorId,
+            requestId: ctx.requestId,
+            operation: `${operation}.post_commit`,
+            input: { effect: failure.effect.label },
+            succeeded: false,
+            entityId: failure.effect.entityId ?? null,
+            resultSummary: `${failure.effect.label}: ${failure.message}`.slice(0, 500)
+          });
+        });
+      } catch (thrown) {
+        console.error("[query-api] could not audit the failed post-commit effect", {
+          effect: failure.effect.label,
+          requestId: ctx.requestId,
+          error: thrown instanceof Error ? thrown.message : String(thrown)
+        });
+      }
+    }
+    return failures;
+  }
   async close() {
     await Promise.all([this.#adminRaw?.end(), this.#publicRaw.end()]);
   }
@@ -18120,12 +18286,10 @@ class DatabaseAdapter {
     if (!this.#skipVerify)
       await this.verifyRoles();
     let publishAfterCommit = false;
+    let postCommit = [];
     const out = await admin.transaction(async (tx) => {
-      await tx.execute(sql`SELECT set_config('caelo.actor_id', ${ctx.actorId}, true)`);
-      await tx.execute(sql`SELECT set_config('caelo.actor_kind', ${ctx.actorKind}, true)`);
-      await tx.execute(sql`SELECT set_config('caelo.plugin_id', ${ctx.pluginId ?? ""}, true)`);
-      await tx.execute(sql`SELECT set_config('caelo.chat_branch_id', ${ctx.chatBranchId ?? ""}, true)`);
-      await tx.execute(sql`SELECT set_config('caelo.chat_task_id', ${ctx.chatTaskId ?? ""}, true)`);
+      postCommit = collectPostCommitEffects(tx);
+      await this.#setIdentity(tx, ctx);
       const denied = await firstInvisibleBranch(tx, namedBranches(ctx, undefined));
       if (denied !== null) {
         throw new OperationAbortError(branchNotFound("withAdminTransaction", denied));
@@ -18134,19 +18298,28 @@ class DatabaseAdapter {
       publishAfterCommit = await this.#projectionDirty(tx);
       return result;
     });
+    const effectFailures = await this.#settlePostCommit("withAdminTransaction", ctx, postCommit);
     if (publishAfterCommit)
       await this.#publishAfterCommit();
+    if (effectFailures.length > 0)
+      throw new Error(postCommitFailureMessage(effectFailures));
     return out;
   }
   async withPublicTransaction(ctx, fn) {
     if (!this.#skipVerify)
       await this.verifyRoles();
-    return await this.#public.transaction(async (tx) => {
+    let postCommit = [];
+    const out = await this.#public.transaction(async (tx) => {
+      postCommit = collectPostCommitEffects(tx);
       await tx.execute(sql`SELECT set_config('caelo.actor_id', ${ctx.actorId}, true)`);
       await tx.execute(sql`SELECT set_config('caelo.actor_kind', ${ctx.actorKind}, true)`);
       await tx.execute(sql`SELECT set_config('caelo.plugin_id', ${ctx.pluginId ?? ""}, true)`);
       return await fn(tx);
     });
+    const effectFailures = await this.#settlePostCommit("withPublicTransaction", ctx, postCommit);
+    if (effectFailures.length > 0)
+      throw new Error(postCommitFailureMessage(effectFailures));
+    return out;
   }
   rawAdmin() {
     if (this.#adminRaw === null)
@@ -18211,77 +18384,6 @@ class DatabaseAdapter {
     return this.#public;
   }
 }
-// ../query-api/src/audit.ts
-var SENSITIVE_KEYS = new Set([
-  "password",
-  "newPassword",
-  "currentPassword",
-  "token",
-  "csrfToken",
-  "passwordHash",
-  "secret",
-  "apiKey",
-  "clientSecret"
-]);
-var SENSITIVE_KEY_RE = /pass(word|wd|phrase)?|secret|token|api[-_]?key|credential|private[-_]?key/i;
-function redact2(value) {
-  if (value === null || value === undefined)
-    return value;
-  if (Array.isArray(value))
-    return value.map(redact2);
-  if (typeof value === "object") {
-    const out = {};
-    for (const [k, v] of Object.entries(value)) {
-      if (k === "__proto__" || k === "constructor" || k === "prototype")
-        continue;
-      out[k] = SENSITIVE_KEYS.has(k) || SENSITIVE_KEY_RE.test(k) ? "<redacted>" : redact2(v);
-    }
-    return out;
-  }
-  return value;
-}
-async function canonicalHash(input) {
-  const canonical = JSON.stringify(redact2(input), (_key, val) => {
-    if (val && typeof val === "object" && !Array.isArray(val)) {
-      const sorted = {};
-      for (const k of Object.keys(val).sort())
-        sorted[k] = val[k];
-      return sorted;
-    }
-    return val;
-  });
-  const bytes = new TextEncoder().encode(canonical);
-  const digest = await crypto.subtle.digest("SHA-256", bytes);
-  return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
-}
-async function recordAudit(tx, opts) {
-  const hash = await canonicalHash(opts.input);
-  const entityId = opts.entityId ?? null;
-  const resultSummary = opts.resultSummary ?? null;
-  const requestId = opts.requestId ?? null;
-  const provider = opts.provider ?? null;
-  const model = opts.model ?? null;
-  const operationType = opts.operationType ?? null;
-  await tx.execute(sql`
-    INSERT INTO audit_events (
-      actor_id, operation, input_hash, succeeded, entity_id, result_summary,
-      request_id, provider, model, operation_type
-    )
-    VALUES (
-      ${opts.actorId}::uuid,
-      ${opts.operation},
-      ${hash},
-      ${opts.succeeded},
-      ${entityId === null ? null : sql`${entityId}::uuid`},
-      ${resultSummary},
-      ${requestId},
-      ${provider},
-      ${model},
-      ${operationType}
-    )
-  `);
-}
-var SYSTEM_ACTOR_ID = "00000000-0000-0000-0000-00000000ffff";
 // ../query-api/src/execute.ts
 var allowAllRateLimiter = {
   async check() {

package/dist/caddy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"caddy.d.ts","sourceRoot":"","sources":["../src/caddy.ts"],"names":[],"mappings":"AA2DA,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAC;IAClC,QAAQ,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,CAAC;CACxC;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,UAAU,CAAC;AAE/C,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,kFAAkF;IAClF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,0FAA0F;IAC1F,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;CAClD;AAED,uFAAuF;AACvF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,eAAe,EAAE,CAM9F;AAYD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,GAAG,MAAM,GAAG,IAAI,CAOzF;AAWD,iFAAiF;AACjF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CA4C7D"}
+{"version":3,"file":"caddy.d.ts","sourceRoot":"","sources":["../src/caddy.ts"],"names":[],"mappings":"AAoEA,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAC;IAClC,QAAQ,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,CAAC;CACxC;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,UAAU,CAAC;AAE/C,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,kFAAkF;IAClF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,0FAA0F;IAC1F,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;CAClD;AAED,uFAAuF;AACvF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,eAAe,EAAE,CAM9F;AAYD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,GAAG,MAAM,GAAG,IAAI,CAOzF;AAWD,iFAAiF;AACjF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CA4C7D"}

package/dist/caddy.js

@@ -48,8 +48,15 @@
  * icon MIME the media library stores and `<link rel="icon" type>`
  * declares. file_server only fills Content-Type when no earlier handler
  * set it, so the `header` line wins over the host's mime.types name.
+ *
+ * #891 — every response of a public vhost is `nosniff`, and every SVG
+ * gets the sandboxing CSP (`SVG_DOCUMENT_CSP`, @caelo-cms/shared): an
+ * uploaded SVG opened directly must not run script on the site's origin,
+ * which also serves `/api/*`. Caddy's `path` matcher is case-insensitive,
+ * so `*.svg` covers `.SVG` too. `cms-provision upgrade` re-writes this file
+ * (self-hosted-upgrade.ts), so existing installs get the headers too.
  */
-import { CONTENT_HASHED_PATH_PATTERN, caddyRedirectsImport, IMMUTABLE_CACHE_CONTROL, } from "@caelo-cms/shared";
+import { CONTENT_HASHED_PATH_PATTERN, caddyRedirectsImport, IMMUTABLE_CACHE_CONTROL, NOSNIFF, SVG_DOCUMENT_CSP, } from "@caelo-cms/shared";
 /** The host the admin of a self-hosted install answers on (same convention as GCP). */
 export function selfHostedAdminHost(domain) {
     return `admin.${domain}`;
@@ -160,6 +167,9 @@ function vhost(d, spec) {
   header @content_hashed Cache-Control "${IMMUTABLE_CACHE_CONTROL}"
   @ico path *.ico
   header @ico Content-Type "image/x-icon"
+  header X-Content-Type-Options "${NOSNIFF}"
+  @svg path *.svg
+  header @svg Content-Security-Policy "${SVG_DOCUMENT_CSP}"
   handle /api/* {
     reverse_proxy ${spec.gatewayUpstream}
   }

package/dist/caddy.js.map

@@ -1 +1 @@
-{"version":3,"file":"caddy.js","sourceRoot":"","sources":["../src/caddy.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,EACL,2BAA2B,EAC3B,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AA4B3B,uFAAuF;AACvF,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO,SAAS,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,aAAqB;IACzE,OAAO;QACL,EAAE,QAAQ,EAAE,mBAAmB,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE;QAC3E,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE;QACvD,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE;KAC5D,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAG,cAAc,CAAC;AAC7C,MAAM,uBAAuB,GAAG,eAAe,CAAC;AAEhD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,IAAyB;IACxE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,qBAAqB,CAAC;IACpF,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,2DAA2D,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC1G,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa,EAAE,KAAa,EAAE,IAAyB;IACnF,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,sBAAsB,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,OAAO,4FAA4F,CAC9J,CAAC;IACJ,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,iBAAiB,CAAC,IAAmB;IACnD,oBAAoB,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC7D,oBAAoB,CAAC,gBAAgB,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACrE,oBAAoB,CAAC,iBAAiB,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IACvE,oBAAoB,CAAC,eAAe,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACnE,oBAAoB,CAAC,iBAAiB,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IAEvE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,oBAAoB,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACxD,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,oEAAoE;YACpE,4DAA4D;YAC5D,MAAM,IAAI,KAAK,CACb,cAAc,CAAC,CAAC,QAAQ,iFAAiF,CAC1G,CAAC;QACJ,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,kBAAkB;IAClB,MAAM,CAAC,IAAI,CAAC;UACJ,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE;;CAE3E,CAAC,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9B,CAAC;IAED,oEAAoE;IACpE,8DAA8D;IAC9D,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC;;;kBAGE,IAAI,CAAC,aAAa;;CAEnC,CAAC,CAAC;IACD,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,KAAK,CAAC,CAAkB,EAAE,IAAmB;IACpD,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO;kBAClB,IAAI,CAAC,aAAa;;CAEnC,CAAC;IACA,CAAC;IACD,sEAAsE;IACtE,oEAAoE;IACpE,uBAAuB;IACvB,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IAC9E,6DAA6D;IAC7D,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO;WACvB,IAAI;IACX,oBAAoB,CAAC,IAAI,CAAC;;iCAEG,2BAA2B;;;0CAGlB,uBAAuB;;;;oBAI7C,IAAI,CAAC,eAAe;;;;;;;;;;;CAWvC,CAAC;AACF,CAAC"}
+{"version":3,"file":"caddy.js","sourceRoot":"","sources":["../src/caddy.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAEH,OAAO,EACL,2BAA2B,EAC3B,oBAAoB,EACpB,uBAAuB,EACvB,OAAO,EACP,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AA4B3B,uFAAuF;AACvF,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO,SAAS,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,aAAqB;IACzE,OAAO;QACL,EAAE,QAAQ,EAAE,mBAAmB,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE;QAC3E,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE;QACvD,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE;KAC5D,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAG,cAAc,CAAC;AAC7C,MAAM,uBAAuB,GAAG,eAAe,CAAC;AAEhD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,IAAyB;IACxE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,qBAAqB,CAAC;IACpF,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,2DAA2D,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC1G,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa,EAAE,KAAa,EAAE,IAAyB;IACnF,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,sBAAsB,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,OAAO,4FAA4F,CAC9J,CAAC;IACJ,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,iBAAiB,CAAC,IAAmB;IACnD,oBAAoB,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC7D,oBAAoB,CAAC,gBAAgB,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACrE,oBAAoB,CAAC,iBAAiB,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IACvE,oBAAoB,CAAC,eAAe,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACnE,oBAAoB,CAAC,iBAAiB,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IAEvE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,oBAAoB,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACxD,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,oEAAoE;YACpE,4DAA4D;YAC5D,MAAM,IAAI,KAAK,CACb,cAAc,CAAC,CAAC,QAAQ,iFAAiF,CAC1G,CAAC;QACJ,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,kBAAkB;IAClB,MAAM,CAAC,IAAI,CAAC;UACJ,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE;;CAE3E,CAAC,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9B,CAAC;IAED,oEAAoE;IACpE,8DAA8D;IAC9D,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC;;;kBAGE,IAAI,CAAC,aAAa;;CAEnC,CAAC,CAAC;IACD,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,KAAK,CAAC,CAAkB,EAAE,IAAmB;IACpD,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO;kBAClB,IAAI,CAAC,aAAa;;CAEnC,CAAC;IACA,CAAC;IACD,sEAAsE;IACtE,oEAAoE;IACpE,uBAAuB;IACvB,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IAC9E,6DAA6D;IAC7D,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO;WACvB,IAAI;IACX,oBAAoB,CAAC,IAAI,CAAC;;iCAEG,2BAA2B;;;0CAGlB,uBAAuB;;;mCAG9B,OAAO;;yCAED,gBAAgB;;oBAErC,IAAI,CAAC,eAAe;;;;;;;;;;;CAWvC,CAAC;AACF,CAAC"}

package/dist/cli-routing.js

@@ -65,7 +65,7 @@ export const CLI_COMMANDS = [
     },
     {
         name: "upgrade",
-        args: "[--version x.y.z] [--channel stable|rc|beta] [--region <r>] [--skip-verify] [--skip-health-check] [--install <id|domain|all>]",
+        args: "[--version x.y.z] [--channel stable|rc|beta] [--region <r>] [--skip-verify] [--skip-health-check] [--install <id|domain|all>] [--project <gcp-project-id>]",
         summary: "Roll the install to a newer release (latest stable by default) after verifying the image signatures.",
     },
     {

package/dist/cli-routing.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli-routing.js","sourceRoot":"","sources":["../src/cli-routing.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAenC;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAuB,EAAE,YAA8B;IACrF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/D,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACzC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,oEAAoE;IACpE,0EAA0E;IAC1E,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,QAAQ,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,KAAK,aAAa,EAAE,CAAC;QAC5D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,OAAO,QAAQ,KAAK,aAAa,CAAC;AACpC,CAAC;AAYD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAA6B;IACpD;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,sIAAsI;QAC5I,OAAO,EACL,4MAA4M;KAC/M;IACD;QACE,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,EAAE;QACR,OAAO,EACL,iHAAiH;KACpH;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,EAAE;QACR,OAAO,EACL,oGAAoG;KACvG;IACD;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,6BAA6B;QACnC,OAAO,EAAE,2DAA2D;KACrE;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,+HAA+H;QACrI,OAAO,EACL,sGAAsG;KACzG;IACD;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,2CAA2C;QACjD,OAAO,EACL,2IAA2I;KAC9I;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,8BAA8B;QACpC,OAAO,EACL,gHAAgH;KACnH;IACD;QACE,IAAI,EAAE,eAAe;QACrB,IAAI,EAAE,2BAA2B;QACjC,OAAO,EAAE,+EAA+E;KACzF;IACD;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,EAAE;QACR,OAAO,EACL,0GAA0G;KAC7G;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,EAAE;QACR,OAAO,EAAE,2EAA2E;KACrF;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,IAAI,EAAE,EAAE;QACR,OAAO,EAAE,sFAAsF;KAChG;IACD;QACE,IAAI,EAAE,cAAc;QACpB,IAAI,EAAE,QAAQ;QACd,OAAO,EACL,8FAA8F;KACjG;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,IAAI,EAAE,wFAAwF;QAC9F,OAAO,EACL,mHAAmH;KACtH;IACD;QACE,IAAI,EAAE,aAAa;QACnB,IAAI,EAAE,mCAAmC;QACzC,OAAO,EACL,wGAAwG;KAC3G;IACD;QACE,IAAI,EAAE,eAAe;QACrB,IAAI,EAAE,iEAAiE;QACvE,OAAO,EAAE,mFAAmF;KAC7F;IACD;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,4BAA4B;QAClC,OAAO,EAAE,qFAAqF;KAC/F;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,IAAI,EAAE,EAAE;QACR,OAAO,EACL,0HAA0H;KAC7H;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,EAAE;QACR,OAAO,EAAE,0BAA0B;KACpC;CACF,CAAC;AAEF,+EAA+E;AAC/E,MAAM,UAAU,QAAQ;IACtB,OAAO,CACL,sJAAsJ,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe;QAC9M,sLAAsL;QACtL,iFAAiF,CAClF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"cli-routing.js","sourceRoot":"","sources":["../src/cli-routing.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAenC;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAuB,EAAE,YAA8B;IACrF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/D,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACzC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,oEAAoE;IACpE,0EAA0E;IAC1E,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,QAAQ,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,KAAK,aAAa,EAAE,CAAC;QAC5D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,OAAO,QAAQ,KAAK,aAAa,CAAC;AACpC,CAAC;AAYD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAA6B;IACpD;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,sIAAsI;QAC5I,OAAO,EACL,4MAA4M;KAC/M;IACD;QACE,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,EAAE;QACR,OAAO,EACL,iHAAiH;KACpH;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,EAAE;QACR,OAAO,EACL,oGAAoG;KACvG;IACD;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,6BAA6B;QACnC,OAAO,EAAE,2DAA2D;KACrE;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,4JAA4J;QAClK,OAAO,EACL,sGAAsG;KACzG;IACD;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,2CAA2C;QACjD,OAAO,EACL,2IAA2I;KAC9I;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,8BAA8B;QACpC,OAAO,EACL,gHAAgH;KACnH;IACD;QACE,IAAI,EAAE,eAAe;QACrB,IAAI,EAAE,2BAA2B;QACjC,OAAO,EAAE,+EAA+E;KACzF;IACD;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,EAAE;QACR,OAAO,EACL,0GAA0G;KAC7G;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,EAAE;QACR,OAAO,EAAE,2EAA2E;KACrF;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,IAAI,EAAE,EAAE;QACR,OAAO,EAAE,sFAAsF;KAChG;IACD;QACE,IAAI,EAAE,cAAc;QACpB,IAAI,EAAE,QAAQ;QACd,OAAO,EACL,8FAA8F;KACjG;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,IAAI,EAAE,wFAAwF;QAC9F,OAAO,EACL,mHAAmH;KACtH;IACD;QACE,IAAI,EAAE,aAAa;QACnB,IAAI,EAAE,mCAAmC;QACzC,OAAO,EACL,wGAAwG;KAC3G;IACD;QACE,IAAI,EAAE,eAAe;QACrB,IAAI,EAAE,iEAAiE;QACvE,OAAO,EAAE,mFAAmF;KAC7F;IACD;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,4BAA4B;QAClC,OAAO,EAAE,qFAAqF;KAC/F;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,IAAI,EAAE,EAAE;QACR,OAAO,EACL,0HAA0H;KAC7H;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,EAAE;QACR,OAAO,EAAE,0BAA0B;KACpC;CACF,CAAC;AAEF,+EAA+E;AAC/E,MAAM,UAAU,QAAQ;IACtB,OAAO,CACL,sJAAsJ,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe;QAC9M,sLAAsL;QACtL,iFAAiF,CAClF,CAAC;AACJ,CAAC"}