@caelo-cms/provisioning 0.11.10 → 0.11.12

package/dist/scheduler-setup.d.ts

@@ -0,0 +1,75 @@
+import { type GcloudRunner, type Sleep } from "./gcloud-retry.js";
+import { type IapResource } from "./mcp-iap.js";
+/** The admin path the workflow calls (apps/admin `api/internal/scheduler/tick`). */
+export declare const SCHEDULER_TICK_PATH = "/api/internal/scheduler/tick";
+/**
+ * How long the workflow waits for the admin's answer, in seconds: Workflows'
+ * maximum (cloud.google.com/workflows/docs/reference/stdlib/http/post). The
+ * admin holds the request until the tick's work is done: it claims tasks for
+ * at most its budget (4 minutes, admin-core scheduler/tick.ts) and then waits
+ * at most one task's lease (10 minutes) for the last one, so 14 minutes in
+ * the worst case, inside the admin's own 3600 s request timeout.
+ */
+export declare const SCHEDULER_TICK_TIMEOUT_SECONDS = 1800;
+/** APIs the tick needs on the project. */
+export declare const SCHEDULER_APIS: readonly ["cloudscheduler.googleapis.com", "workflows.googleapis.com", "iamcredentials.googleapis.com"];
+/**
+ * Roles the scheduler's identity must never hold anywhere. Prefix matches
+ * (`roles/secretmanager.` = every Secret Manager role).
+ */
+export declare const SCHEDULER_FORBIDDEN_ROLES: readonly ["roles/owner", "roles/editor", "roles/viewer", "roles/run.", "roles/iam.serviceAccountUser", "roles/iam.serviceAccountAdmin", "roles/iam.securityAdmin", "roles/iap.admin", "roles/iap.settingsAdmin", "roles/secretmanager.", "roles/cloudsql.", "roles/compute.", "roles/storage.", "roles/resourcemanager.", "roles/workflows.admin", "roles/workflows.editor", "roles/cloudscheduler."];
+export interface SchedulerTickTarget {
+    readonly projectId: string;
+    readonly region: string;
+    /** Pulumi stack name (`production`). */
+    readonly env: string;
+    /**
+     * Where the admin answers behind IAP, an origin: `https://admin.<domain>`
+     * on gcp, the admin service's URL on gcp-firebase (remote-mcp.ts
+     * RemoteMcpIdentity.adminUrl, the same value as the admin's
+     * CAELO_ADMIN_URL).
+     */
+    readonly adminUrl: string;
+    /** The admin's IAP resource (the service on gcp-firebase, the LB backend on gcp). */
+    readonly resource: IapResource;
+    /** The `schedulerIntervalMinutes` knob (1–15). */
+    readonly intervalMinutes: number;
+}
+export type SchedulerTickResult = {
+    readonly ok: true;
+    readonly done: string[];
+    readonly serviceAccount: string;
+} | {
+    readonly ok: false;
+    readonly done: string[];
+    readonly error: string;
+};
+/**
+ * The tick's admin origin, or an error naming why it is not one: an https
+ * origin without path, query or credentials (it is written into the
+ * workflow's source, so nothing but an origin may get there).
+ */
+export declare function tickOrigin(adminUrl: string): {
+    ok: true;
+    origin: string;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * The workflow one tick runs (Cloud Workflows YAML): sign a service-account
+ * JWT for the admin's IAP as the scheduler account itself (the IAM
+ * Credentials API, authenticated with the workflow's own OAuth token), then
+ * POST the tick with it. A refused or failed tick (HTTP ≥ 400) fails the
+ * execution, so it shows in the workflow's execution history and logs.
+ */
+export declare function schedulerWorkflowSource(opts: {
+    readonly serviceAccount: string;
+    readonly origin: string;
+}): string;
+/** Ensure the scheduler tick and everything it needs. Never throws for a gcloud failure. */
+export declare function ensureSchedulerTick(target: SchedulerTickTarget, deps?: {
+    run?: GcloudRunner;
+    sleep?: Sleep;
+}): Promise<SchedulerTickResult>;
+//# sourceMappingURL=scheduler-setup.d.ts.map

package/dist/scheduler-setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scheduler-setup.d.ts","sourceRoot":"","sources":["../src/scheduler-setup.ts"],"names":[],"mappings":"AAmDA,OAAO,EAAE,KAAK,YAAY,EAA2B,KAAK,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAO3F,OAAO,EAAE,KAAK,WAAW,EAAmB,MAAM,cAAc,CAAC;AAGjE,oFAAoF;AACpF,eAAO,MAAM,mBAAmB,iCAAiC,CAAC;AAElE;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B,OAAO,CAAC;AAKnD,0CAA0C;AAC1C,eAAO,MAAM,cAAc,yGAIjB,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,yBAAyB,uYAkB5B,CAAC;AAEX,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,qFAAqF;IACrF,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,kDAAkD;IAClD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAAE,GAC/E;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,QAAQ,EAAE,MAAM,GACf;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAsB7D;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC5C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,GAAG,MAAM,CAkCT;AAED,4FAA4F;AAC5F,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,mBAAmB,EAC3B,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAO,GAC/C,OAAO,CAAC,mBAAmB,CAAC,CAmK9B"}

package/dist/scheduler-setup.js

@@ -0,0 +1,331 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * #1140 — set up (and converge) the scheduler tick on a Google Cloud install
+ * (`gcp`, `gcp-firebase`): the ONE Cloud Scheduler job that calls the
+ * admin's `/api/internal/scheduler/tick` every `schedulerIntervalMinutes`
+ * (1–15, default 5). Each task's own cadence lives in the admin's
+ * due-table; the tick only says "run what is due now". Run by the wizard
+ * after migrations and by `cms-provision upgrade`'s converge (and the
+ * converge job), as the operator's or the provisioner's identity.
+ *
+ * Why not Cloud Scheduler → admin directly. The admin sits behind IAP, and
+ * IAP accepts a service account's OIDC ID token only when its `aud` is an
+ * OAuth client allowlisted for programmatic access; an install on the
+ * Google-managed IAP client has none (cloud.google.com/iap/docs/
+ * authentication-howto). Cloud Scheduler's other credential, an OAuth
+ * access token, it sends only to `*.googleapis.com` (cloud.google.com/
+ * scheduler/docs/http-target-auth). What passes IAP for a service account
+ * on every install is a self-signed service-account JWT with `aud` =
+ * `<admin origin>/*` — the path caelo-mcp and admin-internal-google.ts
+ * take. Cloud Scheduler cannot sign one, so the job starts a Cloud
+ * Workflows execution (a googleapis.com target, OAuth), and the workflow
+ * signs the JWT as the scheduler account through the IAM Credentials API
+ * and POSTs the tick. No container per tick and no image to keep in step
+ * with the app-roll; cents a month (wizards/gcp-cost.ts).
+ *
+ * Why the CLI owns it and not the stacks: the same as audit-job-setup.ts —
+ * `upgrade` never runs Pulumi, and existing installs get the tick from here.
+ *
+ * Trust boundary. The scheduler's identity, `caelo-<env>-scheduler`, holds:
+ *
+ *   - `roles/iam.serviceAccountTokenCreator` on ITSELF only (signJwt);
+ *   - `roles/iap.httpsResourceAccessor` on the admin's IAP resource (the
+ *     operator-access sync job keeps it there, operator-access.ts);
+ *   - `roles/workflows.invoker` on the project (Cloud Scheduler starts the
+ *     workflow as it; Workflows has no per-workflow IAM policy to bind to);
+ *   - `roles/logging.logWriter` (the workflow's error call logs).
+ *
+ * Nothing else: no Secret Manager, no Cloud SQL, no Cloud Run rights. What
+ * it can do with the admin is the admin's to decide: the tick endpoint
+ * accepts exactly this account's IAP identity (`CAELO_SCHEDULER_SERVICE_
+ * ACCOUNT` on the admin) and only ever runs the due-table, never a build
+ * or a publish (scripts/no-automatic-production-deploy.test.ts).
+ * {@link SCHEDULER_FORBIDDEN_ROLES} names that line; the tests assert no
+ * grant crosses it.
+ */
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { gcloud as defaultGcloud } from "./gcloud.js";
+import { realSleep, runWithRetry } from "./gcloud-retry.js";
+import { schedulerJobName, schedulerServiceAccountEmail, schedulerServiceAccountId, schedulerWorkflowName, } from "./gcp-names.js";
+import { iapResourceArgs } from "./mcp-iap.js";
+import { schedulerCron } from "./stack-contract.js";
+/** The admin path the workflow calls (apps/admin `api/internal/scheduler/tick`). */
+export const SCHEDULER_TICK_PATH = "/api/internal/scheduler/tick";
+/**
+ * How long the workflow waits for the admin's answer, in seconds: Workflows'
+ * maximum (cloud.google.com/workflows/docs/reference/stdlib/http/post). The
+ * admin holds the request until the tick's work is done: it claims tasks for
+ * at most its budget (4 minutes, admin-core scheduler/tick.ts) and then waits
+ * at most one task's lease (10 minutes) for the last one, so 14 minutes in
+ * the worst case, inside the admin's own 3600 s request timeout.
+ */
+export const SCHEDULER_TICK_TIMEOUT_SECONDS = 1800;
+/** Lifetime of the IAP credential the workflow signs per tick. */
+const JWT_LIFETIME_SECONDS = 600;
+/** APIs the tick needs on the project. */
+export const SCHEDULER_APIS = [
+    "cloudscheduler.googleapis.com",
+    "workflows.googleapis.com",
+    "iamcredentials.googleapis.com",
+];
+/**
+ * Roles the scheduler's identity must never hold anywhere. Prefix matches
+ * (`roles/secretmanager.` = every Secret Manager role).
+ */
+export const SCHEDULER_FORBIDDEN_ROLES = [
+    "roles/owner",
+    "roles/editor",
+    "roles/viewer",
+    "roles/run.",
+    "roles/iam.serviceAccountUser",
+    "roles/iam.serviceAccountAdmin",
+    "roles/iam.securityAdmin",
+    "roles/iap.admin",
+    "roles/iap.settingsAdmin",
+    "roles/secretmanager.",
+    "roles/cloudsql.",
+    "roles/compute.",
+    "roles/storage.",
+    "roles/resourcemanager.",
+    "roles/workflows.admin",
+    "roles/workflows.editor",
+    "roles/cloudscheduler.",
+];
+/**
+ * The tick's admin origin, or an error naming why it is not one: an https
+ * origin without path, query or credentials (it is written into the
+ * workflow's source, so nothing but an origin may get there).
+ */
+export function tickOrigin(adminUrl) {
+    let u;
+    try {
+        u = new URL(adminUrl);
+    }
+    catch {
+        return { ok: false, error: `the admin URL ${JSON.stringify(adminUrl)} is not a URL` };
+    }
+    if (u.protocol !== "https:" ||
+        u.username ||
+        u.password ||
+        (u.pathname !== "/" && u.pathname !== "") ||
+        u.search ||
+        u.hash ||
+        !/^[a-z0-9.-]+$/.test(u.hostname)) {
+        return {
+            ok: false,
+            error: `the admin URL ${JSON.stringify(adminUrl)} is not a plain https origin`,
+        };
+    }
+    return { ok: true, origin: u.origin };
+}
+/**
+ * The workflow one tick runs (Cloud Workflows YAML): sign a service-account
+ * JWT for the admin's IAP as the scheduler account itself (the IAM
+ * Credentials API, authenticated with the workflow's own OAuth token), then
+ * POST the tick with it. A refused or failed tick (HTTP ≥ 400) fails the
+ * execution, so it shows in the workflow's execution history and logs.
+ */
+export function schedulerWorkflowSource(opts) {
+    const { serviceAccount: sa, origin } = opts;
+    return `# Caelo scheduler tick (#1140) — generated by cms-provision, do not edit.
+main:
+  steps:
+    - claims:
+        assign:
+          - now: \${int(sys.now())}
+          - jwtClaims:
+              iss: "${sa}"
+              sub: "${sa}"
+              aud: "${origin}/*"
+              iat: \${now}
+              exp: \${now + ${JWT_LIFETIME_SECONDS}}
+    - sign:
+        call: http.post
+        args:
+          url: "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${sa}:signJwt"
+          auth:
+            type: OAuth2
+          body:
+            payload: \${json.encode_to_string(jwtClaims)}
+        result: signed
+    - tick:
+        call: http.post
+        args:
+          url: "${origin}${SCHEDULER_TICK_PATH}"
+          headers:
+            Authorization: \${"Bearer " + signed.body.signedJwt}
+          timeout: ${SCHEDULER_TICK_TIMEOUT_SECONDS}
+        result: answer
+    - done:
+        return: \${answer.code}
+`;
+}
+/** Ensure the scheduler tick and everything it needs. Never throws for a gcloud failure. */
+export async function ensureSchedulerTick(target, deps = {}) {
+    const run = deps.run ?? defaultGcloud;
+    const sleep = deps.sleep ?? realSleep;
+    const retry = (args) => runWithRetry(run, sleep, args);
+    const { projectId, region, env } = target;
+    const project = `--project=${projectId}`;
+    const sa = schedulerServiceAccountEmail(projectId, env);
+    const member = `serviceAccount:${sa}`;
+    const workflow = schedulerWorkflowName(env);
+    const job = schedulerJobName(env);
+    const done = [];
+    const fail = (step, r) => ({
+        ok: false,
+        done,
+        error: `${step}: ${r.stderr.trim()}`,
+    });
+    const origin = tickOrigin(target.adminUrl);
+    if (!origin.ok)
+        return { ok: false, done, error: origin.error };
+    let cron;
+    try {
+        cron = schedulerCron(target.intervalMinutes);
+    }
+    catch (e) {
+        return { ok: false, done, error: e.message };
+    }
+    // 1. APIs.
+    const api = await run(["services", "enable", ...SCHEDULER_APIS, project, "--quiet"]);
+    if (!api.ok)
+        return fail(`enable ${SCHEDULER_APIS.join(", ")}`, api);
+    done.push(`APIs enabled (${SCHEDULER_APIS.join(", ")})`);
+    // 2. The scheduler's own service account.
+    const describe = await run([
+        "iam",
+        "service-accounts",
+        "describe",
+        sa,
+        project,
+        "--format=value(email)",
+    ]);
+    if (!describe.ok) {
+        const create = await run([
+            "iam",
+            "service-accounts",
+            "create",
+            schedulerServiceAccountId(env),
+            "--display-name=Caelo scheduler tick",
+            "--description=Calls the admin's scheduler tick through IAP every few minutes; signs its own IAP credential, nothing else.",
+            project,
+        ]);
+        if (!create.ok && !/already exists/i.test(create.stderr))
+            return fail(`create ${sa}`, create);
+    }
+    done.push(`service account ${sa}`);
+    // 3. Its grants (see the file comment).
+    const self = await retry([
+        "iam",
+        "service-accounts",
+        "add-iam-policy-binding",
+        sa,
+        `--member=${member}`,
+        "--role=roles/iam.serviceAccountTokenCreator",
+        "--condition=None",
+        project,
+        "--quiet",
+        "--format=none",
+    ]);
+    if (!self.ok)
+        return fail("let the scheduler sign its IAP credential as itself", self);
+    done.push(`scheduler: roles/iam.serviceAccountTokenCreator on ${sa} (itself, signJwt)`);
+    for (const g of [
+        { role: "roles/workflows.invoker", why: "Cloud Scheduler starts the tick workflow as it" },
+        { role: "roles/logging.logWriter", why: "the workflow logs failed calls" },
+    ]) {
+        const r = await retry([
+            "projects",
+            "add-iam-policy-binding",
+            projectId,
+            `--member=${member}`,
+            `--role=${g.role}`,
+            "--condition=None",
+            "--quiet",
+            "--format=none",
+        ]);
+        if (!r.ok)
+            return fail(`grant the scheduler ${g.role} (${g.why})`, r);
+        done.push(`scheduler: ${g.role} on the project`);
+    }
+    const iap = await retry([
+        "iap",
+        "web",
+        "add-iam-policy-binding",
+        ...iapResourceArgs(target.resource),
+        `--member=${member}`,
+        "--role=roles/iap.httpsResourceAccessor",
+        "--condition=None",
+        project,
+        "--quiet",
+    ]);
+    if (!iap.ok)
+        return fail("let the scheduler pass the admin's IAP", iap);
+    done.push(`scheduler: roles/iap.httpsResourceAccessor on the admin (${target.resource.service})`);
+    // 4. The workflow. A private directory (mkdtemp, mode 700): no other local
+    //    user can swap the file between write and read.
+    const dir = mkdtempSync(join(tmpdir(), "caelo-scheduler-"));
+    try {
+        const file = join(dir, "tick.yaml");
+        writeFileSync(file, schedulerWorkflowSource({ serviceAccount: sa, origin: origin.origin }), {
+            mode: 0o600,
+        });
+        const deploy = await retry([
+            "workflows",
+            "deploy",
+            workflow,
+            `--source=${file}`,
+            `--location=${region}`,
+            `--service-account=${sa}`,
+            "--call-log-level=log-errors-only",
+            `--description=Caelo scheduler tick (#1140): calls ${origin.origin}${SCHEDULER_TICK_PATH}`,
+            project,
+            "--quiet",
+        ]);
+        if (!deploy.ok)
+            return fail(`deploy workflow ${workflow}`, deploy);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+    done.push(`workflow ${workflow} (calls ${origin.origin}${SCHEDULER_TICK_PATH})`);
+    // 5. The one Cloud Scheduler job.
+    const scheduleArgs = [
+        job,
+        `--location=${region}`,
+        project,
+        `--schedule=${cron}`,
+        "--time-zone=Etc/UTC",
+        `--uri=https://workflowexecutions.googleapis.com/v1/projects/${projectId}/locations/${region}/workflows/${workflow}/executions`,
+        "--http-method=POST",
+        `--oauth-service-account-email=${sa}`,
+        // A tick that has not answered when the next one is due is the admin's
+        // lease to sort out (its due-table), not a reason to retry this one.
+        "--max-retry-attempts=0",
+        "--quiet",
+    ];
+    const existing = await run([
+        "scheduler",
+        "jobs",
+        "describe",
+        job,
+        `--location=${region}`,
+        project,
+        "--format=value(name)",
+    ]);
+    const sched = await retry([
+        "scheduler",
+        "jobs",
+        existing.ok ? "update" : "create",
+        "http",
+        ...scheduleArgs,
+    ]);
+    if (!sched.ok)
+        return fail(`schedule ${job}`, sched);
+    done.push(`Cloud Scheduler job ${job} (${cron}, UTC)`);
+    return { ok: true, done, serviceAccount: sa };
+}
+//# sourceMappingURL=scheduler-setup.js.map

package/dist/scheduler-setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scheduler-setup.js","sourceRoot":"","sources":["../src/scheduler-setup.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,IAAI,aAAa,EAAqB,MAAM,aAAa,CAAC;AACzE,OAAO,EAAqB,SAAS,EAAE,YAAY,EAAc,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EACL,gBAAgB,EAChB,4BAA4B,EAC5B,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAoB,eAAe,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,oFAAoF;AACpF,MAAM,CAAC,MAAM,mBAAmB,GAAG,8BAA8B,CAAC;AAElE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,CAAC;AAEnD,kEAAkE;AAClE,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAEjC,0CAA0C;AAC1C,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,+BAA+B;IAC/B,0BAA0B;IAC1B,+BAA+B;CACvB,CAAC;AAEX;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,aAAa;IACb,cAAc;IACd,cAAc;IACd,YAAY;IACZ,8BAA8B;IAC9B,+BAA+B;IAC/B,yBAAyB;IACzB,iBAAiB;IACjB,yBAAyB;IACzB,sBAAsB;IACtB,iBAAiB;IACjB,gBAAgB;IAChB,gBAAgB;IAChB,wBAAwB;IACxB,uBAAuB;IACvB,wBAAwB;IACxB,uBAAuB;CACf,CAAC;AAwBX;;;;GAIG;AACH,MAAM,UAAU,UAAU,CACxB,QAAgB;IAEhB,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC;IACxF,CAAC;IACD,IACE,CAAC,CAAC,QAAQ,KAAK,QAAQ;QACvB,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,CAAC,QAAQ,KAAK,GAAG,IAAI,CAAC,CAAC,QAAQ,KAAK,EAAE,CAAC;QACzC,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,IAAI;QACN,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,EACjC,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,iBAAiB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,8BAA8B;SAC/E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACxC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAGvC;IACC,MAAM,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC5C,OAAO;;;;;;;sBAOa,EAAE;sBACF,EAAE;sBACF,MAAM;;8BAEE,oBAAoB;;;;sFAIoC,EAAE;;;;;;;;;kBAStE,MAAM,GAAG,mBAAmB;;;qBAGzB,8BAA8B;;;;CAIlD,CAAC;AACF,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAA2B,EAC3B,OAA8C,EAAE;IAEhD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACjE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IAC1C,MAAM,OAAO,GAAG,aAAa,SAAS,EAAE,CAAC;IACzC,MAAM,EAAE,GAAG,4BAA4B,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,kBAAkB,EAAE,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,CAAe,EAAuB,EAAE,CAAC,CAAC;QACpE,EAAE,EAAE,KAAK;QACT,IAAI;QACJ,KAAK,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;KACrC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAChE,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC;IAC1D,CAAC;IAED,WAAW;IACX,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,GAAG,cAAc,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IACrF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,UAAU,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACrE,IAAI,CAAC,IAAI,CAAC,iBAAiB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEzD,0CAA0C;IAC1C,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;QACzB,KAAK;QACL,kBAAkB;QAClB,UAAU;QACV,EAAE;QACF,OAAO;QACP,uBAAuB;KACxB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;YACvB,KAAK;YACL,kBAAkB;YAClB,QAAQ;YACR,yBAAyB,CAAC,GAAG,CAAC;YAC9B,qCAAqC;YACrC,2HAA2H;YAC3H,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;IAEnC,wCAAwC;IACxC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC;QACvB,KAAK;QACL,kBAAkB;QAClB,wBAAwB;QACxB,EAAE;QACF,YAAY,MAAM,EAAE;QACpB,6CAA6C;QAC7C,kBAAkB;QAClB,OAAO;QACP,SAAS;QACT,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,qDAAqD,EAAE,IAAI,CAAC,CAAC;IACvF,IAAI,CAAC,IAAI,CAAC,sDAAsD,EAAE,oBAAoB,CAAC,CAAC;IAExF,KAAK,MAAM,CAAC,IAAI;QACd,EAAE,IAAI,EAAE,yBAAyB,EAAE,GAAG,EAAE,gDAAgD,EAAE;QAC1F,EAAE,IAAI,EAAE,yBAAyB,EAAE,GAAG,EAAE,gCAAgC,EAAE;KAC3E,EAAE,CAAC;QACF,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,UAAU;YACV,wBAAwB;YACxB,SAAS;YACT,YAAY,MAAM,EAAE;YACpB,UAAU,CAAC,CAAC,IAAI,EAAE;YAClB,kBAAkB;YAClB,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,uBAAuB,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,iBAAiB,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC;QACtB,KAAK;QACL,KAAK;QACL,wBAAwB;QACxB,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC;QACnC,YAAY,MAAM,EAAE;QACpB,wCAAwC;QACxC,kBAAkB;QAClB,OAAO;QACP,SAAS;KACV,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,wCAAwC,EAAE,GAAG,CAAC,CAAC;IACxE,IAAI,CAAC,IAAI,CAAC,4DAA4D,MAAM,CAAC,QAAQ,CAAC,OAAO,GAAG,CAAC,CAAC;IAElG,2EAA2E;IAC3E,oDAAoD;IACpD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACpC,aAAa,CAAC,IAAI,EAAE,uBAAuB,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;YAC1F,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC;YACzB,WAAW;YACX,QAAQ;YACR,QAAQ;YACR,YAAY,IAAI,EAAE;YAClB,cAAc,MAAM,EAAE;YACtB,qBAAqB,EAAE,EAAE;YACzB,kCAAkC;YAClC,qDAAqD,MAAM,CAAC,MAAM,GAAG,mBAAmB,EAAE;YAC1F,OAAO;YACP,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,mBAAmB,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;IACrE,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,YAAY,QAAQ,WAAW,MAAM,CAAC,MAAM,GAAG,mBAAmB,GAAG,CAAC,CAAC;IAEjF,kCAAkC;IAClC,MAAM,YAAY,GAAG;QACnB,GAAG;QACH,cAAc,MAAM,EAAE;QACtB,OAAO;QACP,cAAc,IAAI,EAAE;QACpB,qBAAqB;QACrB,+DAA+D,SAAS,cAAc,MAAM,cAAc,QAAQ,aAAa;QAC/H,oBAAoB;QACpB,iCAAiC,EAAE,EAAE;QACrC,uEAAuE;QACvE,qEAAqE;QACrE,wBAAwB;QACxB,SAAS;KACV,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;QACzB,WAAW;QACX,MAAM;QACN,UAAU;QACV,GAAG;QACH,cAAc,MAAM,EAAE;QACtB,OAAO;QACP,sBAAsB;KACvB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC;QACxB,WAAW;QACX,MAAM;QACN,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;QACjC,MAAM;QACN,GAAG,YAAY;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,YAAY,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC,IAAI,CAAC,uBAAuB,GAAG,KAAK,IAAI,QAAQ,CAAC,CAAC;IAEvD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;AAChD,CAAC"}

package/dist/self-hosted-roles.d.ts

@@ -11,8 +11,10 @@
  * as the Postgres superuser BEFORE it writes the new Compose file: it
  * creates missing roles and databases and sets each role's password to the
  * configured one. It also drops the former `gateway_role` (#635: the
- * gateway has no cms_admin login), with whatever it still holds. Every
- * statement is idempotent.
+ * gateway has no cms_admin login), with whatever it still holds, and
+ * (#1329) creates the staging database `cms_public_staging` with the
+ * staging gateway's login `public_staging_role` on an install from before
+ * it. Every statement is idempotent.
  *
  * Passwords travel on psql's stdin, never on argv.
  */
@@ -33,7 +35,8 @@ export declare const AGENT_DB_ROLE = "caelo_agent";
  * (packages/migrations role-audit.ts) refuses an install without them.
  * Self-hosted admin_role has no CREATEROLE, so the superuser applies them
  * here — on the volume's first start (bootstrap.sh), on every `up`, and
- * before the migrations of every upgrade ({@link publicRoleLimitsScript}).
+ * before the migrations of every upgrade ({@link preMigrationRolesScript}).
+ * Since #1329 the staging gateway's public_staging_role carries the same.
  */
 export declare const PUBLIC_ROLE_LIMITS: {
     readonly connectionLimit: 30;
@@ -42,13 +45,15 @@ export declare const PUBLIC_ROLE_LIMITS: {
     readonly workMem: "1MB";
 };
 /**
- * The psql script (superuser) that applies only {@link PUBLIC_ROLE_LIMITS}.
- * The self-hosted upgrade runs it BEFORE the migrations: their role audit
- * refuses public_role without the limits, and the full convergence must
+ * The psql script (superuser) the self-hosted upgrade runs BEFORE the
+ * migrations: the gateway logins' {@link PUBLIC_ROLE_LIMITS} (#1338) and
+ * (#1329) the staging database with its login. The migrations' role audit
+ * refuses either gateway login without its limits, and the
+ * cms_public_staging run needs the database; the full convergence must
  * wait until after them (it drops roles a migration retired). Fails when
  * public_role does not exist — the install's roles were never created.
  */
-export declare function publicRoleLimitsScript(): string;
+export declare function preMigrationRolesScript(stagingPassword: string): string;
 /**
  * The psql script (run as the superuser, connected to any database) that
  * brings roles and databases to the configured state.
@@ -73,13 +78,15 @@ export type SuperuserPsql = (script: string) => Promise<{
     stderr: string;
 }>;
 /**
- * Apply {@link publicRoleLimitsScript} through the running Postgres
+ * Apply {@link preMigrationRolesScript} through the running Postgres
  * container. Unlike {@link convergeSelfHostedRoles} a stopped database is a
  * failure: the upgrade runs it right before migrations that need it.
  */
-export declare function applyPublicRoleLimits(deps: {
+export declare function applyPreMigrationRoles(deps: {
     readonly probe: () => Promise<boolean>;
     readonly psql: SuperuserPsql;
+    /** #1329 — public_staging_role's password from `.caelo/config.json`. */
+    readonly stagingPassword: string;
 }): Promise<ConvergeOutcome>;
 export type ConvergeOutcome = {
     readonly ok: true;

package/dist/self-hosted-roles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"self-hosted-roles.d.ts","sourceRoot":"","sources":["../src/self-hosted-roles.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAOlD;;;;;GAKG;AACH,eAAO,MAAM,aAAa,gBAAgB,CAAC;AAM3C;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB;;;;;CAKrB,CAAC;AAaX;;;;;;GAMG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAkDD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,aAAa,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,CAS9F;AASD;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAqBnF;AAED,kFAAkF;AAClF,MAAM,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE9F;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;CAC9B,GAAG,OAAO,CAAC,eAAe,CAAC,CAO3B;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE;AACvB,+EAA+E;GAC7E;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhF;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,aAAa,EACxB,IAAI,EAAE;IACJ,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,kEAAkE;IAClE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC,GACA,OAAO,CAAC,eAAe,CAAC,CAO1B;AAED,+DAA+D;AAC/D,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GACxF;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvD;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,GAAG,UAAU,CAoBtF"}
+{"version":3,"file":"self-hosted-roles.d.ts","sourceRoot":"","sources":["../src/self-hosted-roles.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAOlD;;;;;GAKG;AACH,eAAO,MAAM,aAAa,gBAAgB,CAAC;AAS3C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB;;;;;CAKrB,CAAC;AAmCX;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAOvE;AAmDD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,aAAa,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,CAU9F;AAUD;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAqBnF;AAED,kFAAkF;AAClF,MAAM,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE9F;;;;GAIG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,wEAAwE;IACxE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC,GAAG,OAAO,CAAC,eAAe,CAAC,CAO3B;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE;AACvB,+EAA+E;GAC7E;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhF;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,aAAa,EACxB,IAAI,EAAE;IACJ,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,kEAAkE;IAClE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC,GACA,OAAO,CAAC,eAAe,CAAC,CAO1B;AAED,+DAA+D;AAC/D,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GACxF;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvD;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,GAAG,UAAU,CAoBtF"}

package/dist/self-hosted-roles.js

@@ -11,7 +11,9 @@ function literal(s) {
  */
 export const AGENT_DB_ROLE = "caelo_agent";
 /** The application roles bootstrap.sh and the convergence create. */
-const APP_ROLES = ["admin_role", "public_role"];
+const APP_ROLES = ["admin_role", "public_role", "public_staging_role"];
+/** #1329 — the gateway logins that carry {@link PUBLIC_ROLE_LIMITS}: the live and the staging one. */
+const GATEWAY_LOGINS = ["public_role", "public_staging_role"];
 /**
  * #1338 (gateway hardening H3) — what bounds public_role, the gateway's
  * login, on the database: at most this many connections, no statement or
@@ -21,7 +23,8 @@ const APP_ROLES = ["admin_role", "public_role"];
  * (packages/migrations role-audit.ts) refuses an install without them.
  * Self-hosted admin_role has no CREATEROLE, so the superuser applies them
  * here — on the volume's first start (bootstrap.sh), on every `up`, and
- * before the migrations of every upgrade ({@link publicRoleLimitsScript}).
+ * before the migrations of every upgrade ({@link preMigrationRolesScript}).
+ * Since #1329 the staging gateway's public_staging_role carries the same.
  */
 export const PUBLIC_ROLE_LIMITS = {
     connectionLimit: 30,
@@ -29,25 +32,50 @@ export const PUBLIC_ROLE_LIMITS = {
     idleInTransactionSessionTimeout: "15s",
     workMem: "1MB",
 };
-/** The statements that apply {@link PUBLIC_ROLE_LIMITS} (idempotent). */
+/** The statements that apply {@link PUBLIC_ROLE_LIMITS} to both gateway logins (idempotent). */
 function publicRoleLimitsSql() {
     const l = PUBLIC_ROLE_LIMITS;
+    return GATEWAY_LOGINS.flatMap((role) => [
+        `ALTER ROLE ${role} CONNECTION LIMIT ${l.connectionLimit};`,
+        `ALTER ROLE ${role} SET statement_timeout = '${l.statementTimeout}';`,
+        `ALTER ROLE ${role} SET idle_in_transaction_session_timeout = '${l.idleInTransactionSessionTimeout}';`,
+        `ALTER ROLE ${role} SET work_mem = '${l.workMem}';`,
+    ]);
+}
+/**
+ * #1329 — the staging database and its gateway login, with each gateway
+ * login on its own database only (the same as bootstrap.sh and cms_admin
+ * migration 0530). Idempotent: an install from before #1329 gets both, an
+ * install that has them gets the password re-applied.
+ */
+function stagingDatabaseSql(password) {
     return [
-        `ALTER ROLE public_role CONNECTION LIMIT ${l.connectionLimit};`,
-        `ALTER ROLE public_role SET statement_timeout = '${l.statementTimeout}';`,
-        `ALTER ROLE public_role SET idle_in_transaction_session_timeout = '${l.idleInTransactionSessionTimeout}';`,
-        `ALTER ROLE public_role SET work_mem = '${l.workMem}';`,
+        "SELECT 'CREATE ROLE public_staging_role NOINHERIT LOGIN' WHERE NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'public_staging_role') \\gexec",
+        `ALTER ROLE public_staging_role WITH LOGIN PASSWORD ${password("public_staging_role")};`,
+        "SELECT 'CREATE DATABASE cms_public_staging OWNER admin_role' WHERE NOT EXISTS (SELECT 1 FROM pg_database WHERE datname = 'cms_public_staging') \\gexec",
+        "REVOKE ALL ON DATABASE cms_public_staging FROM PUBLIC;",
+        "GRANT CONNECT ON DATABASE cms_public_staging TO public_staging_role, admin_role;",
+        "REVOKE ALL ON DATABASE cms_public_staging FROM public_role;",
+        "REVOKE ALL ON DATABASE cms_public FROM public_staging_role;",
+        "REVOKE ALL ON DATABASE cms_admin FROM public_staging_role;",
     ];
 }
 /**
- * The psql script (superuser) that applies only {@link PUBLIC_ROLE_LIMITS}.
- * The self-hosted upgrade runs it BEFORE the migrations: their role audit
- * refuses public_role without the limits, and the full convergence must
+ * The psql script (superuser) the self-hosted upgrade runs BEFORE the
+ * migrations: the gateway logins' {@link PUBLIC_ROLE_LIMITS} (#1338) and
+ * (#1329) the staging database with its login. The migrations' role audit
+ * refuses either gateway login without its limits, and the
+ * cms_public_staging run needs the database; the full convergence must
  * wait until after them (it drops roles a migration retired). Fails when
  * public_role does not exist — the install's roles were never created.
  */
-export function publicRoleLimitsScript() {
-    return ["\\set ON_ERROR_STOP on", ...publicRoleLimitsSql(), ""].join("\n");
+export function preMigrationRolesScript(stagingPassword) {
+    return [
+        "\\set ON_ERROR_STOP on",
+        ...stagingDatabaseSql(() => literal(stagingPassword)),
+        ...publicRoleLimitsSql(),
+        "",
+    ].join("\n");
 }
 /**
  * The convergence SQL (psql, as the superuser, connected to any database).
@@ -79,11 +107,15 @@ function convergenceSql(password, agent) {
         "REVOKE ALL ON DATABASE cms_public FROM PUBLIC;",
         "GRANT CONNECT ON DATABASE cms_admin TO admin_role;",
         "GRANT CONNECT ON DATABASE cms_public TO public_role, admin_role;",
+        // #1329 — after the other two databases exist: its revokes name them.
+        ...stagingDatabaseSql(password),
         // #635 — the gateway's former cms_admin login goes, with whatever it
         // still holds in either database (the superuser may drop what
         // migration 0285 could only revoke).
         "\\connect cms_public",
         "DO $$ BEGIN IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'gateway_role') THEN DROP OWNED BY gateway_role; END IF; END $$;",
+        "\\connect cms_public_staging",
+        "DO $$ BEGIN IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'gateway_role') THEN DROP OWNED BY gateway_role; END IF; END $$;",
         "\\connect cms_admin",
         "DO $$ BEGIN IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'gateway_role') THEN DROP OWNED BY gateway_role; END IF; END $$;",
         "DO $$ BEGIN IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'gateway_role') THEN DROP ROLE gateway_role; END IF; END $$;",
@@ -103,6 +135,7 @@ export function roleConvergenceScript(passwords, agentPassword) {
     const byRole = {
         admin_role: passwords.admin,
         public_role: passwords.public,
+        public_staging_role: passwords.publicStaging,
     };
     return convergenceSql((role) => literal(role === AGENT_DB_ROLE ? (agentPassword ?? "") : byRole[role]), agentPassword !== undefined);
 }
@@ -110,6 +143,7 @@ export function roleConvergenceScript(passwords, agentPassword) {
 const PASSWORD_ENV = {
     admin_role: "ADMIN_ROLE_PASSWORD",
     public_role: "PUBLIC_ROLE_PASSWORD",
+    public_staging_role: "PUBLIC_STAGING_ROLE_PASSWORD",
     [AGENT_DB_ROLE]: "AGENT_ROLE_PASSWORD",
 };
 /**
@@ -143,15 +177,15 @@ ${convergenceSql((role) => `:'${role}_pw'`, opts.agent)}CAELO_SQL
 `;
 }
 /**
- * Apply {@link publicRoleLimitsScript} through the running Postgres
+ * Apply {@link preMigrationRolesScript} through the running Postgres
  * container. Unlike {@link convergeSelfHostedRoles} a stopped database is a
  * failure: the upgrade runs it right before migrations that need it.
  */
-export async function applyPublicRoleLimits(deps) {
+export async function applyPreMigrationRoles(deps) {
     if (!(await deps.probe())) {
         return { ok: false, reachable: false, error: "the Postgres container is not running" };
     }
-    const r = await deps.psql(publicRoleLimitsScript());
+    const r = await deps.psql(preMigrationRolesScript(deps.stagingPassword));
     if (r.exitCode === 0)
         return { ok: true };
     return { ok: false, reachable: true, error: r.stderr.trim() || `psql exited ${r.exitCode}` };

package/dist/self-hosted-roles.js.map

@@ -1 +1 @@
-{"version":3,"file":"self-hosted-roles.js","sourceRoot":"","sources":["../src/self-hosted-roles.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAuBnC,4BAA4B;AAC5B,SAAS,OAAO,CAAC,CAAS;IACxB,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;AACtC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAC;AAE3C,qEAAqE;AACrE,MAAM,SAAS,GAAG,CAAC,YAAY,EAAE,aAAa,CAAU,CAAC;AAGzD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,eAAe,EAAE,EAAE;IACnB,gBAAgB,EAAE,IAAI;IACtB,+BAA+B,EAAE,KAAK;IACtC,OAAO,EAAE,KAAK;CACN,CAAC;AAEX,yEAAyE;AACzE,SAAS,mBAAmB;IAC1B,MAAM,CAAC,GAAG,kBAAkB,CAAC;IAC7B,OAAO;QACL,2CAA2C,CAAC,CAAC,eAAe,GAAG;QAC/D,mDAAmD,CAAC,CAAC,gBAAgB,IAAI;QACzE,qEAAqE,CAAC,CAAC,+BAA+B,IAAI;QAC1G,0CAA0C,CAAC,CAAC,OAAO,IAAI;KACxD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,CAAC,wBAAwB,EAAE,GAAG,mBAAmB,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC7E,CAAC;AAKD;;;GAGG;AACH,SAAS,cAAc,CAAC,QAAqB,EAAE,KAAc;IAC3D,OAAO;QACL,wBAAwB;QACxB,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC7B,uBAAuB,IAAI,+EAA+E,IAAI,YAAY;YAC1H,cAAc,IAAI,wBAAwB,QAAQ,CAAC,IAAI,CAAC,GAAG;SAC5D,CAAC;QACF,GAAG,mBAAmB,EAAE;QACxB,uEAAuE;QACvE,2CAA2C;QAC3C,oIAAoI;QACpI,GAAG,CAAC,KAAK;YACP,CAAC,CAAC;gBACE,6DAA6D;gBAC7D,gEAAgE;gBAChE,uBAAuB,aAAa,6EAA6E,aAAa,YAAY;gBAC1I,cAAc,aAAa,8FAA8F,QAAQ,CAAC,aAAa,CAAC,GAAG;gBACnJ,qCAAqC,aAAa,4BAA4B,aAAa,0CAA0C;aACtI;YACH,CAAC,CAAC,EAAE,CAAC;QACP,sIAAsI;QACtI,wIAAwI;QACxI,+CAA+C;QAC/C,gDAAgD;QAChD,oDAAoD;QACpD,kEAAkE;QAClE,qEAAqE;QACrE,8DAA8D;QAC9D,qCAAqC;QACrC,sBAAsB;QACtB,gIAAgI;QAChI,qBAAqB;QACrB,gIAAgI;QAChI,4HAA4H;QAC5H,qEAAqE;QACrE,4BAA4B;QAC5B,2JAA2J;QAC3J,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAwB,EAAE,aAAsB;IACpF,MAAM,MAAM,GAA4B;QACtC,UAAU,EAAE,SAAS,CAAC,KAAK;QAC3B,WAAW,EAAE,SAAS,CAAC,MAAM;KAC9B,CAAC;IACF,OAAO,cAAc,CACnB,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAChF,aAAa,KAAK,SAAS,CAC5B,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,MAAM,YAAY,GAAmD;IACnE,UAAU,EAAE,qBAAqB;IACjC,WAAW,EAAE,sBAAsB;IACnC,CAAC,aAAa,CAAC,EAAE,qBAAqB;CACvC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAiC;IACzE,MAAM,KAAK,GAAgD;QACzD,GAAG,SAAS;QACZ,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,aAAqC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC;IACF,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,IAAI,SAAS,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChG,MAAM,MAAM,GAAG,KAAK;SACjB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,YAAY,CAAC,IAAI,CAAC,gCAAgC,CAAC;SAC1E,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO;;;;;;EAMP,MAAM;;EAEN,SAAS;;EAET,cAAc,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC;CACtD,CAAC;AACF,CAAC;AAKD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAG3C;IACC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC;IACzF,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,eAAe,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC/F,CAAC;AAOD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,SAAwB,EACxB,IAKC;IAED,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC;IACzF,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IAChF,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,eAAe,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC/F,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,cAAuB,EAAE,OAAwB;IACxE,IAAI,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,cAAc,EAAE,CAAC;IAC3E,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,uEAAuE,OAAO,CAAC,KAAK,uEAAuE;SACnK,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO;YACL,IAAI,EAAE,OAAO;YACb,KAAK,EACH,8PAA8P;SACjQ,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,SAAS;QACf,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,+EAA+E;KACzF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"self-hosted-roles.js","sourceRoot":"","sources":["../src/self-hosted-roles.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAyBnC,4BAA4B;AAC5B,SAAS,OAAO,CAAC,CAAS;IACxB,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;AACtC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAC;AAE3C,qEAAqE;AACrE,MAAM,SAAS,GAAG,CAAC,YAAY,EAAE,aAAa,EAAE,qBAAqB,CAAU,CAAC;AAEhF,sGAAsG;AACtG,MAAM,cAAc,GAAG,CAAC,aAAa,EAAE,qBAAqB,CAAU,CAAC;AAGvE;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,eAAe,EAAE,EAAE;IACnB,gBAAgB,EAAE,IAAI;IACtB,+BAA+B,EAAE,KAAK;IACtC,OAAO,EAAE,KAAK;CACN,CAAC;AAEX,gGAAgG;AAChG,SAAS,mBAAmB;IAC1B,MAAM,CAAC,GAAG,kBAAkB,CAAC;IAC7B,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACtC,cAAc,IAAI,qBAAqB,CAAC,CAAC,eAAe,GAAG;QAC3D,cAAc,IAAI,6BAA6B,CAAC,CAAC,gBAAgB,IAAI;QACrE,cAAc,IAAI,+CAA+C,CAAC,CAAC,+BAA+B,IAAI;QACtG,cAAc,IAAI,oBAAoB,CAAC,CAAC,OAAO,IAAI;KACpD,CAAC,CAAC;AACL,CAAC;AAKD;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,QAAqB;IAC/C,OAAO;QACL,kJAAkJ;QAClJ,sDAAsD,QAAQ,CAAC,qBAAqB,CAAC,GAAG;QACxF,wJAAwJ;QACxJ,wDAAwD;QACxD,kFAAkF;QAClF,6DAA6D;QAC7D,6DAA6D;QAC7D,4DAA4D;KAC7D,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,eAAuB;IAC7D,OAAO;QACL,wBAAwB;QACxB,GAAG,kBAAkB,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACrD,GAAG,mBAAmB,EAAE;QACxB,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,QAAqB,EAAE,KAAc;IAC3D,OAAO;QACL,wBAAwB;QACxB,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC7B,uBAAuB,IAAI,+EAA+E,IAAI,YAAY;YAC1H,cAAc,IAAI,wBAAwB,QAAQ,CAAC,IAAI,CAAC,GAAG;SAC5D,CAAC;QACF,GAAG,mBAAmB,EAAE;QACxB,uEAAuE;QACvE,2CAA2C;QAC3C,oIAAoI;QACpI,GAAG,CAAC,KAAK;YACP,CAAC,CAAC;gBACE,6DAA6D;gBAC7D,gEAAgE;gBAChE,uBAAuB,aAAa,6EAA6E,aAAa,YAAY;gBAC1I,cAAc,aAAa,8FAA8F,QAAQ,CAAC,aAAa,CAAC,GAAG;gBACnJ,qCAAqC,aAAa,4BAA4B,aAAa,0CAA0C;aACtI;YACH,CAAC,CAAC,EAAE,CAAC;QACP,sIAAsI;QACtI,wIAAwI;QACxI,+CAA+C;QAC/C,gDAAgD;QAChD,oDAAoD;QACpD,kEAAkE;QAClE,sEAAsE;QACtE,GAAG,kBAAkB,CAAC,QAAQ,CAAC;QAC/B,qEAAqE;QACrE,8DAA8D;QAC9D,qCAAqC;QACrC,sBAAsB;QACtB,gIAAgI;QAChI,8BAA8B;QAC9B,gIAAgI;QAChI,qBAAqB;QACrB,gIAAgI;QAChI,4HAA4H;QAC5H,qEAAqE;QACrE,4BAA4B;QAC5B,2JAA2J;QAC3J,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAwB,EAAE,aAAsB;IACpF,MAAM,MAAM,GAA4B;QACtC,UAAU,EAAE,SAAS,CAAC,KAAK;QAC3B,WAAW,EAAE,SAAS,CAAC,MAAM;QAC7B,mBAAmB,EAAE,SAAS,CAAC,aAAa;KAC7C,CAAC;IACF,OAAO,cAAc,CACnB,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAChF,aAAa,KAAK,SAAS,CAC5B,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,MAAM,YAAY,GAAmD;IACnE,UAAU,EAAE,qBAAqB;IACjC,WAAW,EAAE,sBAAsB;IACnC,mBAAmB,EAAE,8BAA8B;IACnD,CAAC,aAAa,CAAC,EAAE,qBAAqB;CACvC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAiC;IACzE,MAAM,KAAK,GAAgD;QACzD,GAAG,SAAS;QACZ,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,aAAqC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC;IACF,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,IAAI,SAAS,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChG,MAAM,MAAM,GAAG,KAAK;SACjB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,YAAY,CAAC,IAAI,CAAC,gCAAgC,CAAC;SAC1E,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO;;;;;;EAMP,MAAM;;EAEN,SAAS;;EAET,cAAc,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC;CACtD,CAAC;AACF,CAAC;AAKD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAK5C;IACC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC;IACzF,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;IACzE,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,eAAe,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC/F,CAAC;AAOD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,SAAwB,EACxB,IAKC;IAED,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC;IACzF,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IAChF,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,eAAe,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC/F,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,cAAuB,EAAE,OAAwB;IACxE,IAAI,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,cAAc,EAAE,CAAC;IAC3E,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,uEAAuE,OAAO,CAAC,KAAK,uEAAuE;SACnK,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO;YACL,IAAI,EAAE,OAAO;YACb,KAAK,EACH,8PAA8P;SACjQ,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,SAAS;QACf,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,+EAA+E;KACzF,CAAC;AACJ,CAAC"}