@caelo-cms/provisioning 0.11.8 → 0.11.10

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (261) hide show
  1. package/dist/admin-domain.d.ts +10 -1
  2. package/dist/admin-domain.d.ts.map +1 -1
  3. package/dist/admin-domain.js +13 -3
  4. package/dist/admin-domain.js.map +1 -1
  5. package/dist/adopt-existing.d.ts +6 -1
  6. package/dist/adopt-existing.d.ts.map +1 -1
  7. package/dist/adopt-existing.js +86 -0
  8. package/dist/adopt-existing.js.map +1 -1
  9. package/dist/agent/command.d.ts +20 -0
  10. package/dist/agent/command.d.ts.map +1 -1
  11. package/dist/agent/command.js +32 -9
  12. package/dist/agent/command.js.map +1 -1
  13. package/dist/agent/run.d.ts +2 -0
  14. package/dist/agent/run.d.ts.map +1 -1
  15. package/dist/agent/run.js +5 -1
  16. package/dist/agent/run.js.map +1 -1
  17. package/dist/agent-db.js +65 -3
  18. package/dist/aws-task-roles.d.ts +4 -2
  19. package/dist/aws-task-roles.d.ts.map +1 -1
  20. package/dist/aws-task-roles.js +4 -1
  21. package/dist/aws-task-roles.js.map +1 -1
  22. package/dist/caddy.d.ts +21 -4
  23. package/dist/caddy.d.ts.map +1 -1
  24. package/dist/caddy.js +27 -3
  25. package/dist/caddy.js.map +1 -1
  26. package/dist/cli.js +12 -3
  27. package/dist/cli.js.map +1 -1
  28. package/dist/cloudsql-tls.d.ts +63 -0
  29. package/dist/cloudsql-tls.d.ts.map +1 -0
  30. package/dist/cloudsql-tls.js +289 -0
  31. package/dist/cloudsql-tls.js.map +1 -0
  32. package/dist/compose.d.ts +29 -6
  33. package/dist/compose.d.ts.map +1 -1
  34. package/dist/compose.js +95 -23
  35. package/dist/compose.js.map +1 -1
  36. package/dist/converge-checkpoint.d.ts +1 -0
  37. package/dist/converge-checkpoint.d.ts.map +1 -1
  38. package/dist/converge-checkpoint.js +8 -1
  39. package/dist/converge-checkpoint.js.map +1 -1
  40. package/dist/converge-job-gcp.d.ts.map +1 -1
  41. package/dist/converge-job-gcp.js +2 -11
  42. package/dist/converge-job-gcp.js.map +1 -1
  43. package/dist/deployed-release.d.ts +4 -1
  44. package/dist/deployed-release.d.ts.map +1 -1
  45. package/dist/deployed-release.js +18 -8
  46. package/dist/deployed-release.js.map +1 -1
  47. package/dist/gcp-names.d.ts +21 -0
  48. package/dist/gcp-names.d.ts.map +1 -1
  49. package/dist/gcp-names.js +24 -0
  50. package/dist/gcp-names.js.map +1 -1
  51. package/dist/gcp-url-map.d.ts.map +1 -1
  52. package/dist/gcp-url-map.js +6 -2
  53. package/dist/gcp-url-map.js.map +1 -1
  54. package/dist/index.d.ts +1 -1
  55. package/dist/index.d.ts.map +1 -1
  56. package/dist/index.js +1 -1
  57. package/dist/index.js.map +1 -1
  58. package/dist/infra-contract.d.ts +1 -1
  59. package/dist/infra-contract.d.ts.map +1 -1
  60. package/dist/infra-contract.js +24 -1
  61. package/dist/infra-contract.js.map +1 -1
  62. package/dist/install-state.d.ts +6 -0
  63. package/dist/install-state.d.ts.map +1 -1
  64. package/dist/install-state.js +17 -4
  65. package/dist/install-state.js.map +1 -1
  66. package/dist/lifecycle.d.ts.map +1 -1
  67. package/dist/lifecycle.js +17 -8
  68. package/dist/lifecycle.js.map +1 -1
  69. package/dist/mcp-auth-proxy-setup.d.ts +48 -0
  70. package/dist/mcp-auth-proxy-setup.d.ts.map +1 -0
  71. package/dist/mcp-auth-proxy-setup.js +280 -0
  72. package/dist/mcp-auth-proxy-setup.js.map +1 -0
  73. package/dist/release-manifest.d.ts +25 -1
  74. package/dist/release-manifest.d.ts.map +1 -1
  75. package/dist/release-manifest.js +36 -3
  76. package/dist/release-manifest.js.map +1 -1
  77. package/dist/remote-mcp.d.ts +55 -18
  78. package/dist/remote-mcp.d.ts.map +1 -1
  79. package/dist/remote-mcp.js +307 -77
  80. package/dist/remote-mcp.js.map +1 -1
  81. package/dist/runtime-secrets.d.ts +9 -0
  82. package/dist/runtime-secrets.d.ts.map +1 -1
  83. package/dist/runtime-secrets.js +21 -10
  84. package/dist/runtime-secrets.js.map +1 -1
  85. package/dist/seal-key-rotation.d.ts +7 -7
  86. package/dist/seal-key-rotation.d.ts.map +1 -1
  87. package/dist/seal-key-rotation.js +22 -22
  88. package/dist/seal-key-rotation.js.map +1 -1
  89. package/dist/self-hosted-db-tls.d.ts +37 -0
  90. package/dist/self-hosted-db-tls.d.ts.map +1 -0
  91. package/dist/self-hosted-db-tls.js +220 -0
  92. package/dist/self-hosted-db-tls.js.map +1 -0
  93. package/dist/self-hosted-release.d.ts +3 -1
  94. package/dist/self-hosted-release.d.ts.map +1 -1
  95. package/dist/self-hosted-release.js +33 -9
  96. package/dist/self-hosted-release.js.map +1 -1
  97. package/dist/self-hosted-roles.d.ts +34 -0
  98. package/dist/self-hosted-roles.d.ts.map +1 -1
  99. package/dist/self-hosted-roles.js +52 -0
  100. package/dist/self-hosted-roles.js.map +1 -1
  101. package/dist/self-hosted-start.d.ts +0 -21
  102. package/dist/self-hosted-start.d.ts.map +1 -1
  103. package/dist/self-hosted-start.js +39 -1
  104. package/dist/self-hosted-start.js.map +1 -1
  105. package/dist/self-hosted-upgrade.d.ts +15 -6
  106. package/dist/self-hosted-upgrade.d.ts.map +1 -1
  107. package/dist/self-hosted-upgrade.js +72 -23
  108. package/dist/self-hosted-upgrade.js.map +1 -1
  109. package/dist/stack-contract.d.ts +170 -25
  110. package/dist/stack-contract.d.ts.map +1 -1
  111. package/dist/stack-contract.js +314 -37
  112. package/dist/stack-contract.js.map +1 -1
  113. package/dist/stack-converge.d.ts +31 -0
  114. package/dist/stack-converge.d.ts.map +1 -1
  115. package/dist/stack-converge.js +71 -30
  116. package/dist/stack-converge.js.map +1 -1
  117. package/dist/upgrade/app-roll.d.ts +25 -4
  118. package/dist/upgrade/app-roll.d.ts.map +1 -1
  119. package/dist/upgrade/app-roll.js +63 -17
  120. package/dist/upgrade/app-roll.js.map +1 -1
  121. package/dist/upgrade/converge.d.ts.map +1 -1
  122. package/dist/upgrade/converge.js +99 -12
  123. package/dist/upgrade/converge.js.map +1 -1
  124. package/dist/upgrade/health.d.ts +31 -7
  125. package/dist/upgrade/health.d.ts.map +1 -1
  126. package/dist/upgrade/health.js +41 -17
  127. package/dist/upgrade/health.js.map +1 -1
  128. package/dist/upgrade/image-forms.d.ts +1 -1
  129. package/dist/upgrade/image-forms.d.ts.map +1 -1
  130. package/dist/upgrade/image-forms.js +24 -7
  131. package/dist/upgrade/image-forms.js.map +1 -1
  132. package/dist/upgrade/release-images.d.ts +12 -3
  133. package/dist/upgrade/release-images.d.ts.map +1 -1
  134. package/dist/upgrade/release-images.js +13 -4
  135. package/dist/upgrade/release-images.js.map +1 -1
  136. package/dist/upgrade/upgrade.d.ts +13 -3
  137. package/dist/upgrade/upgrade.d.ts.map +1 -1
  138. package/dist/upgrade/upgrade.js +34 -2
  139. package/dist/upgrade/upgrade.js.map +1 -1
  140. package/dist/upgrader-gcp.d.ts +12 -0
  141. package/dist/upgrader-gcp.d.ts.map +1 -1
  142. package/dist/upgrader-gcp.js +49 -1
  143. package/dist/upgrader-gcp.js.map +1 -1
  144. package/dist/upgrader-iam-preflight.d.ts.map +1 -1
  145. package/dist/upgrader-iam-preflight.js +6 -1
  146. package/dist/upgrader-iam-preflight.js.map +1 -1
  147. package/dist/upgrader-job.d.ts +1 -1
  148. package/dist/upgrader-job.d.ts.map +1 -1
  149. package/dist/upgrader-job.js +20 -14
  150. package/dist/upgrader-job.js.map +1 -1
  151. package/dist/upgrader-records.d.ts +1 -1
  152. package/dist/upgrader-records.d.ts.map +1 -1
  153. package/dist/upgrader-records.js +26 -7
  154. package/dist/upgrader-records.js.map +1 -1
  155. package/dist/upgrader-setup.d.ts.map +1 -1
  156. package/dist/upgrader-setup.js +10 -5
  157. package/dist/upgrader-setup.js.map +1 -1
  158. package/dist/wizards/gcp-cost.d.ts.map +1 -1
  159. package/dist/wizards/gcp-cost.js +22 -7
  160. package/dist/wizards/gcp-cost.js.map +1 -1
  161. package/dist/wizards/gcp.d.ts.map +1 -1
  162. package/dist/wizards/gcp.js +43 -17
  163. package/dist/wizards/gcp.js.map +1 -1
  164. package/package.json +2 -2
  165. package/src/admin-domain.test.ts +9 -8
  166. package/src/admin-domain.ts +13 -3
  167. package/src/admin-memory.test.ts +1 -0
  168. package/src/adopt-existing.test.ts +39 -0
  169. package/src/adopt-existing.ts +83 -1
  170. package/src/agent/command.test.ts +49 -1
  171. package/src/agent/command.ts +36 -9
  172. package/src/agent/run.test.ts +19 -0
  173. package/src/agent/run.ts +11 -2
  174. package/src/aws-task-roles.ts +5 -2
  175. package/src/caddy-redirects.docker.test.ts +2 -0
  176. package/src/caddy-redirects.test.ts +3 -0
  177. package/src/caddy-validate.test.ts +7 -1
  178. package/src/caddy.test.ts +39 -1
  179. package/src/caddy.ts +36 -4
  180. package/src/checkpoint-secrets.test.ts +14 -6
  181. package/src/cli.ts +12 -1
  182. package/src/cloudsql-tls.test.ts +225 -0
  183. package/src/cloudsql-tls.ts +352 -0
  184. package/src/compose.ts +125 -24
  185. package/src/converge-checkpoint.ts +8 -1
  186. package/src/converge-job-gcp.ts +2 -11
  187. package/src/database-tls-builders.test.ts +55 -0
  188. package/src/deployed-release.test.ts +104 -40
  189. package/src/deployed-release.ts +30 -9
  190. package/src/gateway-env-isolation.test.ts +10 -5
  191. package/src/gcp-names.ts +31 -0
  192. package/src/gcp-url-map.test.ts +6 -8
  193. package/src/gcp-url-map.ts +6 -2
  194. package/src/index.test.ts +7 -1
  195. package/src/index.ts +1 -0
  196. package/src/infra-contract.test.ts +5 -3
  197. package/src/infra-contract.ts +24 -1
  198. package/src/install-state.ts +26 -4
  199. package/src/lifecycle.ts +20 -11
  200. package/src/mcp-auth-proxy-setup.test.ts +305 -0
  201. package/src/mcp-auth-proxy-setup.ts +374 -0
  202. package/src/mcp-iap-stacks.test.ts +1 -1
  203. package/src/media-volume.test.ts +1 -1
  204. package/src/operator-access-stacks.test.ts +1 -1
  205. package/src/operator-access.test.ts +5 -4
  206. package/src/pool-budget-stacks.test.ts +1 -1
  207. package/src/release-manifest.test.ts +25 -0
  208. package/src/release-manifest.ts +59 -4
  209. package/src/remote-mcp-stack-config.test.ts +19 -9
  210. package/src/remote-mcp.test.ts +252 -57
  211. package/src/remote-mcp.ts +336 -77
  212. package/src/runtime-secrets.test.ts +20 -7
  213. package/src/runtime-secrets.ts +50 -9
  214. package/src/seal-key-rotation.test.ts +2 -2
  215. package/src/seal-key-rotation.ts +25 -25
  216. package/src/self-hosted-compose.test.ts +108 -5
  217. package/src/self-hosted-db-tls.test.ts +111 -0
  218. package/src/self-hosted-db-tls.ts +287 -0
  219. package/src/self-hosted-release-resolve.test.ts +71 -0
  220. package/src/self-hosted-release.ts +41 -11
  221. package/src/self-hosted-roles.test.ts +54 -0
  222. package/src/self-hosted-roles.ts +58 -0
  223. package/src/self-hosted-start.test.ts +34 -2
  224. package/src/self-hosted-start.ts +20 -2
  225. package/src/self-hosted-upgrade.test.ts +103 -14
  226. package/src/self-hosted-upgrade.ts +115 -29
  227. package/src/stack-contract-parity.test.ts +79 -12
  228. package/src/stack-contract.test.ts +169 -29
  229. package/src/stack-contract.ts +362 -42
  230. package/src/stack-converge-secrets.test.ts +26 -13
  231. package/src/stack-converge.test.ts +199 -26
  232. package/src/stack-converge.ts +92 -30
  233. package/src/state-store.test.ts +2 -1
  234. package/src/upgrade/app-roll.ts +97 -19
  235. package/src/upgrade/converge.ts +120 -11
  236. package/src/upgrade/health.test.ts +63 -25
  237. package/src/upgrade/health.ts +54 -22
  238. package/src/upgrade/image-forms.test.ts +34 -0
  239. package/src/upgrade/image-forms.ts +23 -8
  240. package/src/upgrade/release-images.test.ts +5 -1
  241. package/src/upgrade/release-images.ts +22 -6
  242. package/src/upgrade/upgrade.test.ts +353 -44
  243. package/src/upgrade/upgrade.ts +55 -6
  244. package/src/upgrader-gcp.ts +65 -3
  245. package/src/upgrader-iam-preflight.test.ts +19 -0
  246. package/src/upgrader-iam-preflight.ts +6 -0
  247. package/src/upgrader-job.test.ts +101 -27
  248. package/src/upgrader-job.ts +27 -14
  249. package/src/upgrader-records.test.ts +97 -12
  250. package/src/upgrader-records.ts +28 -11
  251. package/src/upgrader-setup.test.ts +2 -0
  252. package/src/upgrader-setup.ts +10 -4
  253. package/src/wizards/gcp-cost.test.ts +50 -0
  254. package/src/wizards/gcp-cost.ts +24 -7
  255. package/src/wizards/gcp.ts +55 -14
  256. package/stacks/aws/index.ts +32 -14
  257. package/stacks/azure/index.ts +57 -18
  258. package/stacks/gcp/index.ts +83 -23
  259. package/stacks/gcp-firebase/index.ts +162 -33
  260. package/stacks/self-hosted/README.md +2 -1
  261. package/stacks/self-hosted/index.ts +11 -1
@@ -1,6 +1,45 @@
1
1
  import type { SupportedProvider } from "./adapter.js";
2
2
  export type GcpProvider = "gcp" | "gcp-firebase";
3
- export type CloudRunSlug = "admin" | "gateway";
3
+ /**
4
+ * The install's Cloud Run services, by role: the admin, the visitor data
5
+ * gateway and (#1328) the MCP-Auth-Proxy — remote MCP's sign-in broker and
6
+ * its forwarder to the IAP-protected admin, a service of its own so a hole
7
+ * in a visitor handler can never reach the operators' Google tokens.
8
+ * Which deployed service plays which role is {@link cloudRunServicePrefix}.
9
+ */
10
+ export type CloudRunSlug = "admin" | "gateway" | "mcp-auth-proxy";
11
+ /** Every {@link CloudRunSlug}, in roll order: the admin first, the proxy last. */
12
+ export declare const CLOUD_RUN_SLUGS: readonly CloudRunSlug[];
13
+ /**
14
+ * The name prefix of the Cloud Run service that plays `slug` on an install
15
+ * (Pulumi suffixes the names it generates; the services named explicitly,
16
+ * {@link fixedCloudRunServiceName}, match their prefix exactly).
17
+ *
18
+ * One asymmetry, decided as E13 (a) of the gateway hardening plan (#763):
19
+ * on `gcp-firebase` the MCP-Auth-Proxy is the service that was the gateway
20
+ * before #1328. Its `run.app` URL is the remote-MCP address every connector
21
+ * in claude.ai / ChatGPT holds, and the Google sign-in client's registered
22
+ * redirect URI points at it; neither can move without the Owner
23
+ * re-connecting every client and editing the OAuth client by hand. So that
24
+ * service keeps its name and becomes the proxy, and the visitor gateway is
25
+ * the new `caelo-<env>-data-gateway` (the Firebase `/api/**` rewrite the
26
+ * publisher writes follows the admin's `CAELO_GATEWAY_SERVICE`). On `gcp`
27
+ * the MCP address is the site's own host behind the load balancer, so no
28
+ * service name is pinned there and the proxy is the new service.
29
+ *
30
+ * No prefix is a prefix of another (`…-gateway` does not prefix
31
+ * `…-data-gateway`), so a `metadata.name~^<prefix>` lookup finds one role.
32
+ */
33
+ export declare function cloudRunServicePrefix(provider: GcpProvider, env: string, slug: CloudRunSlug): string;
34
+ /**
35
+ * The exact name of a service that is created under a fixed name (#1328):
36
+ * the `gcp-firebase` data gateway and the `gcp` MCP-Auth-Proxy. Fixed, not
37
+ * Pulumi-suffixed, because the converge creates them on existing installs
38
+ * with gcloud, and the stack's next `pulumi up` must then find the same
39
+ * service instead of creating a second one. Null for the services Pulumi
40
+ * has always auto-named.
41
+ */
42
+ export declare function fixedCloudRunServiceName(provider: GcpProvider, env: string, slug: CloudRunSlug): string | null;
4
43
  /**
5
44
  * One container env var, in the shape Pulumi's `gcp.cloudrunv2.Service`
6
45
  * `envs` accepts. `V` is the value type: `pulumi.Input<string>` in the
@@ -51,8 +90,54 @@ export interface DatabaseUrls<V = string> {
51
90
  * Password-less connection URLs for a Cloud SQL instance at `host`. The
52
91
  * password reaches the apps separately, as a Secret Manager reference
53
92
  * ({@link SERVICE_SECRET_ENV}).
93
+ *
94
+ * TLS is `verify-full` against Google's Cloud SQL shared-CA bundle, which
95
+ * every image carries (#1338, shared database-tls.ts). The shared CA's
96
+ * server certificate names the instance's DNS name and no IP, so `host`
97
+ * must be that name (cloudsql-tls.ts resolves it in the VPC); an IP is
98
+ * refused here rather than producing URLs no connection can verify.
99
+ *
100
+ * @throws Error when `host` is an IP literal
54
101
  */
55
102
  export declare function databaseUrls(host: string): DatabaseUrls;
103
+ /**
104
+ * #1338 — the Cloud SQL server CA mode every install runs: Google's shared
105
+ * CA. Its server certificate carries the instance's DNS name, so a client
106
+ * can verify the host (`sslmode=verify-full`). The default per-instance CA
107
+ * names no host a private-IP client can dial ("The SAN field contains the
108
+ * hostname (DNS name of the instance) only for instances enabled with
109
+ * Private Service Connect" — docs.cloud.google.com/sql/docs/postgres/authorize-ssl).
110
+ * An instance moves from per-instance to shared, never back.
111
+ */
112
+ export declare const CLOUD_SQL_SERVER_CA_MODE = "GOOGLE_MANAGED_CAS_CA";
113
+ /** #1338 — Cloud SQL refuses unencrypted connections: every client uses verify-full. */
114
+ export declare const CLOUD_SQL_SSL_MODE = "ENCRYPTED_ONLY";
115
+ /** The `dnsNames[].connectionType` of the name a private-services-access client dials. */
116
+ export declare const CLOUD_SQL_PSA_CONNECTION_TYPE = "PRIVATE_SERVICES_ACCESS";
117
+ /**
118
+ * The private Cloud DNS zone that resolves the instance's DNS name to its
119
+ * private IP inside the install's VPC. Cloud SQL assigns the name but does
120
+ * not resolve it: "create the DNS record in a private DNS zone in the
121
+ * corresponding Virtual Private Cloud (VPC) network"
122
+ * (docs.cloud.google.com/sql/docs/postgres/configure-ssl-instance). The zone
123
+ * is the name itself, holding its one A record.
124
+ */
125
+ export declare function cloudSqlDnsZoneName(env: string): string;
126
+ /**
127
+ * The DNS name a private-IP client dials, from an instance's `dnsNames`,
128
+ * lower-case and without the trailing dot. Null when the instance has none
129
+ * (a per-instance-CA instance before its move to the shared CA).
130
+ */
131
+ export declare function cloudSqlPrivateDnsName(dnsNames: readonly {
132
+ readonly name?: string;
133
+ readonly connectionType?: string;
134
+ }[] | undefined): string | null;
135
+ /** The database URL vars each service carries (the env contract below sets them). */
136
+ export declare const DATABASE_URL_VARS: {
137
+ readonly admin: readonly ["ADMIN_DATABASE_URL", "PUBLIC_ADMIN_DATABASE_URL"];
138
+ readonly gateway: readonly ["PUBLIC_DATABASE_URL"];
139
+ readonly "mcp-auth-proxy": readonly [];
140
+ };
56
141
  /** What a running service's env derives from: install metadata + the database. */
57
142
  export interface RuntimeEnvInputs<V = string> extends ServiceEnvInputs {
58
143
  /** From the Cloud SQL private IP — an Output in the stacks. */
@@ -247,9 +332,9 @@ export declare const OPERATOR_OAUTH_CLIENT_FILE_ENV = "CAELO_OPERATOR_OAUTH_CLIE
247
332
  * time the file is read ("When reading a volume, Cloud Run always fetches
248
333
  * the secret value from the Secret Manager to use the value with the latest
249
334
  * version" — cloud.google.com/run/docs/configuring/services/secrets). So the
250
- * client the Owner saves under Settings → Google sign-in reaches the running gateway
251
- * (which re-reads it within 60 s) without a new revision, and the admin
252
- * needs no right to deploy the gateway.
335
+ * client the Owner saves under Settings → Google sign-in reaches the running
336
+ * MCP-Auth-Proxy (which re-reads it within 60 s) without a new revision, and
337
+ * the admin needs no right to deploy the proxy.
253
338
  */
254
339
  export interface SecretFileContract {
255
340
  readonly secret: RuntimeSecret;
@@ -261,11 +346,11 @@ export interface SecretFileContract {
261
346
  /** Always `latest`: a pinned version would never see the Owner's new client. */
262
347
  readonly version: "latest";
263
348
  }
264
- /** The gateway's Google sign-in client file, read by the remote-MCP broker (#806, #914). */
349
+ /** The Google sign-in client file the remote-MCP broker reads (#806, #914; in the MCP-Auth-Proxy since #1328). */
265
350
  export declare const OPERATOR_OAUTH_CLIENT_FILE: SecretFileContract;
266
351
  /** Full path of a secret file inside the container. */
267
352
  export declare function secretFilePath(file: SecretFileContract): string;
268
- /** Each service's secret files. The admin has none. */
353
+ /** Each service's secret files. Only the MCP-Auth-Proxy has one. */
269
354
  export declare const SERVICE_SECRET_FILES: Readonly<Record<CloudRunSlug, readonly SecretFileContract[]>>;
270
355
  /** A secret file an older contract mounted; upgrade unmounts it in the roll. */
271
356
  export interface RetiredSecretFile {
@@ -337,17 +422,64 @@ export declare const GATEWAY_TRUSTED_PROXY_HOPS: Readonly<Record<SupportedProvid
337
422
  */
338
423
  export declare function gatewayEnvContract<V>(inputs: RuntimeEnvInputs<V>): CloudRunEnvVar<V | string>[];
339
424
  /**
340
- * #806 — the gateway's request timeout, in seconds: Cloud Run's maximum.
341
- * The gateway proxies remote-MCP requests to the admin, and a `caelo_chat`
342
- * turn streams for as long as the admin's own chat stream may (the admin
343
- * runs at 3600 s for the same reason). Visitor endpoints are unaffected: a
344
- * timeout is a ceiling, not a reservation, and Cloud Run bills request time,
345
- * not the allowed maximum. On `gcp` the load balancer in front adds no
346
- * shorter limit — the backend-service timeout does not apply to serverless
347
- * NEGs, which get a fixed 60 minutes
425
+ * #1328 — whether remote MCP can exist on a provider, as the MCP-Auth-Proxy
426
+ * reads it. It needs the admin behind Google IAP, which only the Google
427
+ * Cloud installs have. `unavailable` makes the proxy answer one fixed 404
428
+ * to everything but its health check: the service exists on every provider
429
+ * at zero minimum instances (E14 a of #763), its attack surface one branch.
430
+ * The proxy refuses to start without the var — no default (CLAUDE.md §2).
431
+ */
432
+ export declare const REMOTE_MCP_MODE_ENV = "CAELO_REMOTE_MCP";
433
+ /** {@link REMOTE_MCP_MODE_ENV} per provider. */
434
+ export declare const REMOTE_MCP_MODE: Readonly<Record<SupportedProvider, "available" | "unavailable">>;
435
+ /**
436
+ * {@link TRUSTED_PROXY_HOPS_ENV} of the MCP-Auth-Proxy per provider: its
437
+ * rate limits key on the client address by the same rule as the gateway's
438
+ * (@caelo-cms/shared client-address.ts), under its own topology.
439
+ */
440
+ export declare const MCP_AUTH_PROXY_TRUSTED_PROXY_HOPS: Readonly<Record<SupportedProvider, number>>;
441
+ /**
442
+ * #1328 — points the `gcp-firebase` MCP-Auth-Proxy at the visitor data
443
+ * gateway for the traffic that still reaches the service that used to be
444
+ * the gateway: the Firebase `/api/**` rewrite of the release that is live
445
+ * until the next Publish live, and the staging host's Cloud Run domain
446
+ * mapping (#650), which only the domain's verified owner could move. The
447
+ * proxy streams that traffic to the data gateway unchanged instead of
448
+ * answering it (apps/mcp-auth-proxy interim-forward.ts). gcp-firebase only.
449
+ */
450
+ export declare const INTERIM_FORWARD_ORIGIN_ENV = "CAELO_INTERIM_FORWARD_ORIGIN";
451
+ /**
452
+ * The env of the MCP-Auth-Proxy. No database URL, no pool size, no site
453
+ * settings: the broker reads env plus one secret file and nothing else
454
+ * (apps/mcp-auth-proxy, whose import lint keeps every database client out).
455
+ * The remote-MCP identity env — its public origin, the admin's URL — comes
456
+ * on top from {@link remoteMcpIdentityEnv}, the gcp-firebase forward origin
457
+ * from the stack or the converge ({@link INTERIM_FORWARD_ORIGIN_ENV}).
458
+ */
459
+ export declare function mcpAuthProxyEnvContract(inputs: {
460
+ readonly provider: SupportedProvider;
461
+ readonly env: string;
462
+ }): CloudRunEnvVar[];
463
+ /**
464
+ * #806 — the MCP-Auth-Proxy's request timeout, in seconds: Cloud Run's
465
+ * maximum (the gateway's until #1328 moved the broker out). The proxy
466
+ * streams remote-MCP requests to the admin, and a `caelo_chat` turn streams
467
+ * for as long as the admin's own chat stream may (the admin runs at 3600 s
468
+ * for the same reason). A timeout is a ceiling, not a reservation: Cloud
469
+ * Run bills request time, not the allowed maximum. On `gcp` the load
470
+ * balancer in front adds no shorter limit — the backend-service timeout
471
+ * does not apply to serverless NEGs, which get a fixed 60 minutes
348
472
  * (cloud.google.com/load-balancing/docs/negs/serverless-neg-concepts).
349
473
  */
350
- export declare const GATEWAY_TIMEOUT_SECONDS = 3600;
474
+ export declare const MCP_AUTH_PROXY_TIMEOUT_SECONDS = 3600;
475
+ /**
476
+ * #1328 — the MCP-Auth-Proxy's maximum instances. It holds no database
477
+ * pool, so the connection budget does not bound it; ten instances of
478
+ * streaming proxies carry far more agent sessions than an install has
479
+ * operators, and the ceiling caps what a flood of sign-in requests can cost.
480
+ * Always provisioned at minimum 0 (E14 a of #763).
481
+ */
482
+ export declare const DEFAULT_MCP_AUTH_PROXY_MAX_INSTANCES = 10;
351
483
  /**
352
484
  * Whether each Cloud Run service gets CPU only while it handles a request
353
485
  * (Cloud Run's request-based billing, `cpuIdle: true`) or for its whole
@@ -356,11 +488,18 @@ export declare const GATEWAY_TIMEOUT_SECONDS = 3600;
356
488
  * `resources`, which is how both services ran with always-on CPU without
357
489
  * anyone choosing it — billed for every idle minute an instance stayed up.
358
490
  *
359
- * The gateway only does work inside requests. The admin still runs its
360
- * background work (Tier 5: audit worker, importer, plugin cron, GC) on
361
- * in-process timers that need CPU between requests.
491
+ * The gateway and the MCP-Auth-Proxy only do work inside requests. The
492
+ * admin still runs its background work (Tier 5: audit worker, importer,
493
+ * plugin cron, GC) on in-process timers that need CPU between requests.
362
494
  */
363
495
  export declare const SERVICE_CPU_IDLE: Readonly<Record<CloudRunSlug, boolean>>;
496
+ /**
497
+ * Whether each service egresses into the install's VPC: the admin and the
498
+ * gateway reach Cloud SQL's private IP; the MCP-Auth-Proxy reaches nothing
499
+ * private (#1328) — it calls Google's token endpoint and the admin's public,
500
+ * IAP-gated URL, so it gets no route to the database's network at all.
501
+ */
502
+ export declare const SERVICE_VPC_EGRESS: Readonly<Record<CloudRunSlug, boolean>>;
364
503
  /** Admin env var naming the Secret Manager secret the Owner writes the Google sign-in client to. */
365
504
  export declare const OPERATOR_OAUTH_CLIENT_STORE_ENV = "CAELO_OPERATOR_OAUTH_CLIENT_STORE";
366
505
  /** `projects/<project>/secrets/<id>` of the Google sign-in client secret (#914). */
@@ -399,7 +538,7 @@ export declare function operatorOAuthClientSecretResource(projectId: string, env
399
538
  * usually can.
400
539
  */
401
540
  export interface RemoteMcpIdentity {
402
- /** Where the gateway proxies `/api/mcp/<surface>` to (IAP in front). */
541
+ /** Where the MCP-Auth-Proxy forwards `/api/mcp/<surface>` to (IAP in front). */
403
542
  readonly adminUrl: string;
404
543
  /** The broker's public origin; no trailing slash. */
405
544
  readonly mcpPublicUrl: string;
@@ -433,17 +572,19 @@ export type RemoteMcpIdentityInputs = {
433
572
  readonly adminServiceName: string;
434
573
  /** The services' `status.url` (`https://<name>-<hash>-<r>.a.run.app`). */
435
574
  readonly adminServiceUrl: string;
436
- readonly gatewayServiceUrl: string;
575
+ /** The MCP-Auth-Proxy's: the service that was the gateway before #1328 (E13 a). */
576
+ readonly mcpAuthProxyServiceUrl: string;
437
577
  };
438
578
  /**
439
579
  * The install's remote-MCP identity.
440
580
  *
441
581
  * - `gcp`: the broker answers on the site's own host through the load
442
- * balancer (`/api/*` and the `/.well-known/oauth-*` path rules), the admin
443
- * on `admin.<domain>` behind the LB's IAP; the IAP audience is
444
- * `/projects/<number>/global/backendServices/<id>`.
445
- * - `gcp-firebase`: the broker answers on the gateway's own Cloud Run URL
446
- * (Firebase Hosting rewrites cut requests at 60 s and buffer streams), the
582
+ * balancer (its MCP path rules route to the MCP-Auth-Proxy's backend,
583
+ * #1328), the admin on `admin.<domain>` behind the LB's IAP; the IAP
584
+ * audience is `/projects/<number>/global/backendServices/<id>`.
585
+ * - `gcp-firebase`: the broker answers on the MCP-Auth-Proxy's own Cloud Run
586
+ * URL — the URL the gateway had before #1328 (E13 a) — never through
587
+ * Firebase Hosting (rewrites cut requests at 60 s and buffer streams), the
447
588
  * admin on its Cloud Run URL behind native IAP — whatever custom domain
448
589
  * is mapped to it, IAP and its audience are the service's; the audience
449
590
  * is `/projects/<number>/locations/<region>/services/<name>`.
@@ -524,6 +665,8 @@ export type IamPrincipal =
524
665
  "run-sa"
525
666
  /** The runtime SA the gateway runs as. */
526
667
  | "gateway-sa"
668
+ /** #1328 — the MCP-Auth-Proxy's SA: two secrets, nothing else. */
669
+ | "mcp-auth-proxy-sa"
527
670
  /** The `gcp` stack's static-publisher SA. */
528
671
  | "static-publisher-sa"
529
672
  /** IAP's Google-managed service agent (forwards IAP traffic to Cloud Run). */
@@ -573,6 +716,8 @@ export interface RuntimeSecretBinding {
573
716
  * on exactly the secrets its env reads ({@link SERVICE_SECRET_ENV}).
574
717
  */
575
718
  export declare function runtimeSecretBindings(): RuntimeSecretBinding[];
719
+ /** The runtime SA each Cloud Run service runs as. */
720
+ export declare const SERVICE_PRINCIPAL: Readonly<Record<CloudRunSlug, IamPrincipal>>;
576
721
  /**
577
722
  * A binding an older stack declared that upgrade removes once nothing reads
578
723
  * through it any more (after the rolls). Pulumi drops it on its own: the
@@ -1 +1 @@
1
- {"version":3,"file":"stack-contract.d.ts","sourceRoot":"","sources":["../src/stack-contract.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAgBtD,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,cAAc,CAAC;AACjD,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,SAAS,CAAC;AAE/C;;;;GAIG;AACH,MAAM,MAAM,cAAc,CAAC,CAAC,GAAG,MAAM,IACjC;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAC5C;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE;QACpB,QAAQ,CAAC,YAAY,EAAE;YAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC;KACzE,CAAC;CACH,CAAC;AAEN,yDAAyD;AACzD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,8EAA8E;AAC9E,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,MAAM;IACtC,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;IAClB,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;CACpB;AAKD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAQvD;AAED,kFAAkF;AAClF,MAAM,WAAW,gBAAgB,CAAC,CAAC,GAAG,MAAM,CAAE,SAAQ,gBAAgB;IACpE,+DAA+D;IAC/D,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;CACxC;AAED;;;;;GAKG;AACH,MAAM,MAAM,cAAc,CAAC,CAAC,GAAG,MAAM,IACjC,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG;IAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAA;CAAE,CAAC,GACpD,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG;IACrB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC;CAC5B,CAAC,CAAC;AAEP,qFAAqF;AACrF,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,6DAA6D;AAC7D,eAAO,MAAM,gBAAgB,uBAAuB,CAAC;AAErD;;;GAGG;AACH,eAAO,MAAM,WAAW,kCAAkC,CAAC;AAE3D;;;GAGG;AACH,eAAO,MAAM,2BAA2B,8BAA8B,CAAC;AAEvE;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,uBAAuB,CAAC;AAEzD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,uBAAuB,CAAC;AAEzD;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,oBAAoB,CAAC;AACnD,eAAO,MAAM,4BAA4B,+BAA+B,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,sBAAsB,CAAC;AACvD,eAAO,MAAM,sBAAsB,yBAAyB,CAAC;AAC7D,eAAO,MAAM,oBAAoB,uBAAuB,CAAC;AASzD;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,+BAA+B,CAAC;AAE7D,gDAAgD;AAChD,eAAO,MAAM,iBAAiB,UAAU,CAAC;AAEzC;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,8CAA8C;AAC9C,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,mBAAmB,CAMpF;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,mBAAmB;;;;;;;;;;;;;EAMnE;AAMD;;;GAGG;AACH,MAAM,MAAM,aAAa,GACrB,mBAAmB,GACnB,sBAAsB,GACtB,YAAY,GACZ,iBAAiB,GACjB,sBAAsB,GACtB,qBAAqB;AACvB;;;;;;;;GAQG;GACD,uBAAuB;AACzB;;;GAGG;GACD,oBAAoB,CAAC;AAEzB,2EAA2E;AAC3E,MAAM,MAAM,YAAY,GAAG,YAAY,GAAG,aAAa,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,aAAa,CAAC,CAG9E,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,oJAgBW,CAAC;AAE9C,+FAA+F;AAC/F,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7D;;;GAGG;AACH,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAC5C,MAAM,CAAC,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,EAAE,qBAAqB,CAAC,CAYtE,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EAO7F,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CACvC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CAyB9D,CAAC;AAMF,qFAAqF;AACrF,eAAO,MAAM,8BAA8B,qCAAqC,CAAC;AAEjF;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,gFAAgF;IAChF,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC;CAC5B;AAED,4FAA4F;AAC5F,eAAO,MAAM,0BAA0B,EAAE,kBAMxC,CAAC;AAEF,uDAAuD;AACvD,wBAAgB,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,MAAM,CAE/D;AAED,uDAAuD;AACvD,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,kBAAkB,EAAE,CAAC,CAG9F,CAAC;AAEF,gFAAgF;AAChF,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,iBAAiB,EAAE,CAAC,CAU7F,CAAC;AAEF;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,YAAY,EACrB,GAAG,EAAE,MAAM,GACV;IACD,QAAQ,CAAC,OAAO,EAAE;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE;gBAAE,OAAO,EAAE,MAAM,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAA;aAAE,EAAE,CAAA;SAAE,CAAC;KACxE,EAAE,CAAC;IACJ,QAAQ,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC9D,CAYA;AAED,mFAAmF;AACnF,wBAAgB,cAAc,CAAC,OAAO,EAAE,YAAY,GAAG,aAAa,EAAE,CAOrE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC,CAajF,CAAC;AAyBF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,6BAA6B,CAAC;AAEjE;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAmBlF,CAAC;AAEF;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,CAU/F;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAE5C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,CAKpE,CAAC;AAEF,oGAAoG;AACpG,eAAO,MAAM,+BAA+B,sCAAsC,CAAC;AAEnF,oFAAoF;AACpF,wBAAgB,iCAAiC,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAExF;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,WAAW,iBAAiB;IAChC,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,qDAAqD;IACrD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,yCAAyC;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,kDAAkD;AAClD,eAAO,MAAM,cAAc;;;;;CAKjB,CAAC;AAEX,iGAAiG;AACjG,MAAM,MAAM,uBAAuB,GAC/B;IACE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,+DAA+D;IAC/D,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;CACxC,GACD;IACE,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,0EAA0E;IAC1E,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC,CAAC;AAEN;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,uBAAuB,GAAG,iBAAiB,CAc/E;AAED,4DAA4D;AAC5D,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,iBAAiB,GACpB,MAAM,CAAC,YAAY,EAAE,cAAc,EAAE,CAAC,CAmBxC;AAED;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,sBAAsB,CAAC;AAc9D,oFAAoF;AACpF,wBAAgB,0BAA0B,CAAC,EAAE,EAAE,iBAAiB,GAAG,MAAM,CAExE;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,iBAAiB,GAAG,IAAI,CAiB9F;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,GAAG,SAAS,GACtB,MAAM,CAAC,YAAY,EAAE,cAAc,EAAE,CAAC,CAGxC;AAED,mEAAmE;AACnE,wBAAgB,qBAAqB,CACnC,CAAC,EAAE,iBAAiB,GAAG,IAAI,EAC3B,CAAC,EAAE,iBAAiB,GAAG,IAAI,GAC1B,OAAO,CAQT;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAAgC,CAAC;AAEvF;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,CAqE3F;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB;;;;;CAKpB,CAAC;AAEX,6CAA6C;AAC7C,MAAM,MAAM,YAAY;AACtB,gEAAgE;AAC9D,QAAQ;AACV,0CAA0C;GACxC,YAAY;AACd,6CAA6C;GAC3C,qBAAqB;AACvB,8EAA8E;GAC5E,mBAAmB,GACnB,UAAU,CAAC;AAEf,wDAAwD;AACxD,MAAM,MAAM,SAAS,GACjB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAA;CAAE,GAC5E;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;CAAE,CAAC;AAErE;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,CAAC;IACrC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAKD,4EAA4E;AAC5E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,wEAAwE;IACxE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,oBAAoB,EAAE,CAS9D;AAiKD;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,iBAAiB,EAa5D,CAAC;AAEF,qEAAqE;AACrE,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,WAAW,GAAG,YAAY,EAAE,CAOxE;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAiBvF,CAAC;AAEF,mEAAmE;AACnE,wBAAgB,SAAS,CACvB,SAAS,EAAE,YAAY,EACvB,OAAO,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC5F,MAAM,CAaR;AAMD,6EAA6E;AAC7E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;IAC5C,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,gFAAgF;IAChF,QAAQ,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAE7C;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAAS,yBAAyB,EAiC7E,CAAC;AAEF,yEAAyE;AACzE,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,SAAS;IAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EAAE,EACvF,YAAY,EAAE,SAAS,MAAM,EAAE,GAC9B,MAAM,CAKR;AAED,qFAAqF;AACrF,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,QAAQ,CAAC;AAE1C;;;GAGG;AACH;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG;IAC5D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAQA;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAcjE"}
1
+ {"version":3,"file":"stack-contract.d.ts","sourceRoot":"","sources":["../src/stack-contract.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAiBtD,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,cAAc,CAAC;AACjD;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,SAAS,GAAG,gBAAgB,CAAC;AAElE,kFAAkF;AAClF,eAAO,MAAM,eAAe,EAAE,SAAS,YAAY,EAA2C,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,WAAW,EACrB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,YAAY,GACjB,MAAM,CAOR;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,WAAW,EACrB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,YAAY,GACjB,MAAM,GAAG,IAAI,CAKf;AAED;;;;GAIG;AACH,MAAM,MAAM,cAAc,CAAC,CAAC,GAAG,MAAM,IACjC;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAC5C;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE;QACpB,QAAQ,CAAC,YAAY,EAAE;YAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC;KACzE,CAAC;CACH,CAAC;AAEN,yDAAyD;AACzD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,8EAA8E;AAC9E,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,MAAM;IACtC,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;IAClB,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;CACpB;AAKD;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAavD;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,0BAA0B,CAAC;AAEhE,wFAAwF;AACxF,eAAO,MAAM,kBAAkB,mBAAmB,CAAC;AAEnD,0FAA0F;AAC1F,eAAO,MAAM,6BAA6B,4BAA4B,CAAC;AAEvE;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,SAAS;IAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,GAAG,SAAS,GAC5F,MAAM,GAAG,IAAI,CAIf;AAED,qFAAqF;AACrF,eAAO,MAAM,iBAAiB;;;;CAOpB,CAAC;AAEX,kFAAkF;AAClF,MAAM,WAAW,gBAAgB,CAAC,CAAC,GAAG,MAAM,CAAE,SAAQ,gBAAgB;IACpE,+DAA+D;IAC/D,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;CACxC;AAED;;;;;GAKG;AACH,MAAM,MAAM,cAAc,CAAC,CAAC,GAAG,MAAM,IACjC,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG;IAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAA;CAAE,CAAC,GACpD,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG;IACrB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC;CAC5B,CAAC,CAAC;AAEP,qFAAqF;AACrF,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,6DAA6D;AAC7D,eAAO,MAAM,gBAAgB,uBAAuB,CAAC;AAErD;;;GAGG;AACH,eAAO,MAAM,WAAW,kCAAkC,CAAC;AAE3D;;;GAGG;AACH,eAAO,MAAM,2BAA2B,8BAA8B,CAAC;AAEvE;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,uBAAuB,CAAC;AAEzD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,uBAAuB,CAAC;AAEzD;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,oBAAoB,CAAC;AACnD,eAAO,MAAM,4BAA4B,+BAA+B,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,sBAAsB,CAAC;AACvD,eAAO,MAAM,sBAAsB,yBAAyB,CAAC;AAC7D,eAAO,MAAM,oBAAoB,uBAAuB,CAAC;AASzD;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,+BAA+B,CAAC;AAE7D,gDAAgD;AAChD,eAAO,MAAM,iBAAiB,UAAU,CAAC;AAEzC;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,8CAA8C;AAC9C,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,mBAAmB,CAMpF;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,mBAAmB;;;;;;;;;;;;;EAMnE;AAMD;;;GAGG;AACH,MAAM,MAAM,aAAa,GACrB,mBAAmB,GACnB,sBAAsB,GACtB,YAAY,GACZ,iBAAiB,GACjB,sBAAsB,GACtB,qBAAqB;AACvB;;;;;;;;GAQG;GACD,uBAAuB;AACzB;;;GAGG;GACD,oBAAoB,CAAC;AAEzB,2EAA2E;AAC3E,MAAM,MAAM,YAAY,GAAG,YAAY,GAAG,aAAa,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,aAAa,CAAC,CAG9E,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,oJAgBW,CAAC;AAE9C,+FAA+F;AAC/F,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7D;;;GAGG;AACH,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAC5C,MAAM,CAAC,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,EAAE,qBAAqB,CAAC,CAYtE,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EAO7F,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CACvC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CA6B9D,CAAC;AAMF,qFAAqF;AACrF,eAAO,MAAM,8BAA8B,qCAAqC,CAAC;AAEjF;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,gFAAgF;IAChF,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC;CAC5B;AAED,kHAAkH;AAClH,eAAO,MAAM,0BAA0B,EAAE,kBAMxC,CAAC;AAEF,uDAAuD;AACvD,wBAAgB,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,MAAM,CAE/D;AAED,oEAAoE;AACpE,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,kBAAkB,EAAE,CAAC,CAI9F,CAAC;AAEF,gFAAgF;AAChF,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,iBAAiB,EAAE,CAAC,CA0B7F,CAAC;AAEF;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,YAAY,EACrB,GAAG,EAAE,MAAM,GACV;IACD,QAAQ,CAAC,OAAO,EAAE;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE;gBAAE,OAAO,EAAE,MAAM,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAA;aAAE,EAAE,CAAA;SAAE,CAAC;KACxE,EAAE,CAAC;IACJ,QAAQ,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC9D,CAYA;AAED,mFAAmF;AACnF,wBAAgB,cAAc,CAAC,OAAO,EAAE,YAAY,GAAG,aAAa,EAAE,CAOrE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC,CAqCjF,CAAC;AAyBF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,6BAA6B,CAAC;AAEjE;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAqBlF,CAAC;AAEF;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,CAO/F;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,qBAAqB,CAAC;AAEtD,gDAAgD;AAChD,eAAO,MAAM,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,iBAAiB,EAAE,WAAW,GAAG,aAAa,CAAC,CAM5F,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,EAAE,QAAQ,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAazF,CAAC;AAEF;;;;;;;;GAQG;AAGH,eAAO,MAAM,0BAA0B,iCAAiC,CAAC;AAEzE;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAC9C,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB,GAAG,cAAc,EAAE,CAanB;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,OAAO,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,oCAAoC,KAAK,CAAC;AAEvD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,CAMpE,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,CAItE,CAAC;AAEF,oGAAoG;AACpG,eAAO,MAAM,+BAA+B,sCAAsC,CAAC;AAEnF,oFAAoF;AACpF,wBAAgB,iCAAiC,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAExF;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,WAAW,iBAAiB;IAChC,gFAAgF;IAChF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,qDAAqD;IACrD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,yCAAyC;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,kDAAkD;AAClD,eAAO,MAAM,cAAc;;;;;CAKjB,CAAC;AAEX,iGAAiG;AACjG,MAAM,MAAM,uBAAuB,GAC/B;IACE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,+DAA+D;IAC/D,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;CACxC,GACD;IACE,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,0EAA0E;IAC1E,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,mFAAmF;IACnF,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;CACzC,CAAC;AAEN;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,uBAAuB,GAAG,iBAAiB,CAc/E;AAED,4DAA4D;AAC5D,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,iBAAiB,GACpB,MAAM,CAAC,YAAY,EAAE,cAAc,EAAE,CAAC,CAsBxC;AAED;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,sBAAsB,CAAC;AAc9D,oFAAoF;AACpF,wBAAgB,0BAA0B,CAAC,EAAE,EAAE,iBAAiB,GAAG,MAAM,CAExE;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,iBAAiB,GAAG,IAAI,CAiB9F;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,GAAG,SAAS,GACtB,MAAM,CAAC,YAAY,EAAE,cAAc,EAAE,CAAC,CAGxC;AAED,mEAAmE;AACnE,wBAAgB,qBAAqB,CACnC,CAAC,EAAE,iBAAiB,GAAG,IAAI,EAC3B,CAAC,EAAE,iBAAiB,GAAG,IAAI,GAC1B,OAAO,CAQT;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAAgC,CAAC;AAEvF;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,CAqE3F;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB;;;;;CAKpB,CAAC;AAEX,6CAA6C;AAC7C,MAAM,MAAM,YAAY;AACtB,gEAAgE;AAC9D,QAAQ;AACV,0CAA0C;GACxC,YAAY;AACd,kEAAkE;GAChE,mBAAmB;AACrB,6CAA6C;GAC3C,qBAAqB;AACvB,8EAA8E;GAC5E,mBAAmB,GACnB,UAAU,CAAC;AAEf,wDAAwD;AACxD,MAAM,MAAM,SAAS,GACjB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAA;CAAE,GAC5E;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;CAAE,CAAC;AAErE;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,CAAC;IACrC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAKD,4EAA4E;AAC5E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,wEAAwE;IACxE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,oBAAoB,EAAE,CAS9D;AAED,qDAAqD;AACrD,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,CAI1E,CAAC;AA4KF;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,iBAAiB,EAiC5D,CAAC;AAEF,qEAAqE;AACrE,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,WAAW,GAAG,YAAY,EAAE,CAOxE;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAiBvF,CAAC;AAEF,mEAAmE;AACnE,wBAAgB,SAAS,CACvB,SAAS,EAAE,YAAY,EACvB,OAAO,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC5F,MAAM,CAeR;AAMD,6EAA6E;AAC7E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;IAC5C,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,gFAAgF;IAChF,QAAQ,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAE7C;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAAS,yBAAyB,EAiC7E,CAAC;AAEF,yEAAyE;AACzE,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,SAAS;IAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EAAE,EACvF,YAAY,EAAE,SAAS,MAAM,EAAE,GAC9B,MAAM,CAKR;AAED,qFAAqF;AACrF,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,QAAQ,CAAC;AAE1C;;;GAGG;AACH;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG;IAC5D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAQA;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAcjE"}