@caelo-cms/provisioning 0.11.8 → 0.11.10

package/dist/cloudsql-tls.d.ts

@@ -0,0 +1,63 @@
+import { type GcloudRunner, type Sleep } from "./gcloud-retry.js";
+import type { HttpFetch } from "./runtime-secrets.js";
+import type { LiveEnvValue } from "./stack-converge.js";
+/** The install's Cloud SQL instance. */
+export interface CloudSqlTlsTarget {
+    readonly projectId: string;
+    readonly env: string;
+    readonly sqlInstance: string;
+}
+export interface CloudSqlTlsDeps {
+    readonly run: GcloudRunner;
+    readonly http?: HttpFetch;
+    readonly sleep?: Sleep;
+}
+export type CloudSqlTlsResult = {
+    readonly ok: true;
+    readonly host: string;
+    readonly done: string[];
+} | {
+    readonly ok: false;
+    readonly error: string;
+    readonly done: string[];
+};
+/**
+ * Bring the instance to verify-full: shared CA with an active server
+ * certificate from it, encrypted connections only, its DNS name resolving
+ * in the VPC. Returns the host every client must dial.
+ */
+export declare function ensureCloudSqlVerifyFull(t: CloudSqlTlsTarget, deps: CloudSqlTlsDeps): Promise<CloudSqlTlsResult>;
+/** The plain values of `names` in a service's live env (secret refs and unset vars skipped). */
+export declare function liveDatabaseUrls(liveEnv: ReadonlyMap<string, LiveEnvValue>, names: readonly string[]): Record<string, string>;
+/** Whether a database URL dials an IP literal (an unparsable one does not). */
+export declare function dialsIpAddress(url: string): boolean;
+/**
+ * `url` with its host replaced by `host`, everything else kept — or null
+ * when it already dials a host name (nothing to move).
+ */
+export declare function urlOnDnsHost(url: string, host: string): string | null;
+/**
+ * Switch the live database URLs of `services` from the instance's IP to
+ * `host`, keeping their `sslmode` (the running image may not carry the CA
+ * bundle yet; the roll sets verify-full with the image that does). Every
+ * reader of the database host — the rolls, the migration job, the upgrader
+ * and operator-access jobs — takes it from these URLs, so after this they
+ * all dial the name the server's certificate carries.
+ *
+ * @param liveUrls the plain URL values each service carries now
+ */
+export declare function moveServicesToDnsHost(target: {
+    readonly projectId: string;
+    readonly region: string;
+}, services: readonly {
+    readonly serviceName: string;
+    readonly liveUrls: Readonly<Record<string, string>>;
+}[], host: string, deps: CloudSqlTlsDeps): Promise<{
+    ok: true;
+    done: string[];
+} | {
+    ok: false;
+    error: string;
+    done: string[];
+}>;
+//# sourceMappingURL=cloudsql-tls.d.ts.map

package/dist/cloudsql-tls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudsql-tls.d.ts","sourceRoot":"","sources":["../src/cloudsql-tls.ts"],"names":[],"mappings":"AA+CA,OAAO,EAAE,KAAK,YAAY,EAA2B,KAAK,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAOtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,wCAAwC;AACxC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACxB;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GACrE;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAwE5E;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,CAAC,EAAE,iBAAiB,EACpB,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,iBAAiB,CAAC,CAmH5B;AAED,gGAAgG;AAChG,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,EAC1C,KAAK,EAAE,SAAS,MAAM,EAAE,GACvB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOxB;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAMnD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKrE;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAC/D,QAAQ,EAAE,SAAS;IACjB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACrD,EAAE,EACH,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA+BtF"}

package/dist/cloudsql-tls.js

@@ -0,0 +1,289 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * #1338 (gateway hardening L6) — converge a Cloud SQL install to
+ * `sslmode=verify-full` through gcloud, the way `cms-provision upgrade`
+ * converges everything else (stack-converge.ts; it never runs Pulumi).
+ *
+ * Verify-full checks the server certificate's chain AND that it names the
+ * host the client dialled. On Cloud SQL that needs three things the stacks
+ * declare for a new install (stacks/gcp, stacks/gcp-firebase) and this
+ * module brings an existing one to:
+ *
+ *   1. The shared server CA (`GOOGLE_MANAGED_CAS_CA`): "The SAN field
+ *      contains the hostname (DNS name of the instance) for all types of
+ *      instances", while the default per-instance CA names one "only for
+ *      instances enabled with Private Service Connect"
+ *      (docs.cloud.google.com/sql/docs/postgres/authorize-ssl). An instance
+ *      may move from per-instance to shared, not back. After the move the
+ *      instance needs a server certificate from the new CA: "create a new
+ *      server certificate with `gcloud sql ssl server-certs create`", then
+ *      "complete the rotation with `gcloud sql ssl server-certs rotate`"
+ *      (docs.cloud.google.com/sql/docs/postgres/manage-ssl-instance). The
+ *      rotation restarts nothing a client keeps: open connections drop and
+ *      reconnect; every client already uses TLS (`sslmode=require` before).
+ *      `sslMode=ENCRYPTED_ONLY` refuses plaintext from then on.
+ *   2. Resolution of the instance's DNS name (`dnsNames`, the
+ *      PRIVATE_SERVICES_ACCESS entry, `….sql-psa.goog`) inside the VPC:
+ *      "create the DNS record in a private DNS zone in the corresponding
+ *      Virtual Private Cloud (VPC) network"
+ *      (docs.cloud.google.com/sql/docs/postgres/configure-ssl-instance).
+ *   3. The services dialling that name. They read it from their own
+ *      `*_DATABASE_URL`, and so does every job the upgrade derives from the
+ *      admin's (migrations, upgrader, operator access): {@link
+ *      moveServicesToDnsHost} switches the host of the live URLs first,
+ *      keeping their current `sslmode`, so the old image keeps working until
+ *      the roll sets verify-full with the image that carries the CA bundle.
+ *
+ * The CA the clients trust is Google's published shared-CA bundle, shipped
+ * in every image (shared database-tls.ts `CLOUD_SQL_CA_BUNDLE`): it covers
+ * the root and every regional CA, so a server-certificate rotation needs no
+ * change on the client side.
+ *
+ * Every step reads before it writes and is a no-op when already in shape,
+ * so a re-run after a failure picks up where the last one stopped.
+ */
+import { isIpLiteral } from "@caelo-cms/shared";
+import { realSleep, runWithRetry } from "./gcloud-retry.js";
+import { CLOUD_SQL_SERVER_CA_MODE, CLOUD_SQL_SSL_MODE, cloudSqlDnsZoneName, cloudSqlPrivateDnsName, } from "./stack-contract.js";
+const NOT_FOUND = /NOT_FOUND|not found|does not exist|404/i;
+const SQL_ADMIN = "https://sqladmin.googleapis.com/v1";
+async function describeInstance(t, run) {
+    const r = await run([
+        "sql",
+        "instances",
+        "describe",
+        t.sqlInstance,
+        `--project=${t.projectId}`,
+        "--format=json",
+    ]);
+    if (!r.ok)
+        return { ok: false, error: `describe ${t.sqlInstance}: ${r.stderr.trim()}` };
+    try {
+        return { ok: true, d: JSON.parse(r.stdout) };
+    }
+    catch {
+        return { ok: false, error: `describe ${t.sqlInstance}: gcloud printed no JSON` };
+    }
+}
+/** The instance's server certificates and which one is active (Cloud SQL Admin API). */
+async function listServerCertificates(t, run, http) {
+    const token = await run(["auth", "print-access-token"]);
+    const bearer = token.ok ? token.stdout.trim() : "";
+    if (!bearer)
+        return { ok: false, error: `gcloud auth print-access-token: ${token.stderr.trim()}` };
+    const res = await http(`${SQL_ADMIN}/projects/${encodeURIComponent(t.projectId)}/instances/${encodeURIComponent(t.sqlInstance)}/listServerCertificates`, { method: "GET", headers: { Authorization: `Bearer ${bearer}` } });
+    const text = await res.text();
+    if (!res.ok) {
+        return {
+            ok: false,
+            error: `list server certificates: HTTP ${res.status} ${text.slice(0, 300)}`,
+        };
+    }
+    const body = JSON.parse(text);
+    return {
+        ok: true,
+        activeVersion: body.activeVersion ?? null,
+        fingerprints: (body.serverCerts ?? []).map((c) => c.sha1Fingerprint ?? "").filter(Boolean),
+    };
+}
+/**
+ * Bring the instance to verify-full: shared CA with an active server
+ * certificate from it, encrypted connections only, its DNS name resolving
+ * in the VPC. Returns the host every client must dial.
+ */
+export async function ensureCloudSqlVerifyFull(t, deps) {
+    const sleep = deps.sleep ?? realSleep;
+    const run = (args) => runWithRetry(deps.run, sleep, args);
+    const http = deps.http ?? fetch;
+    const done = [];
+    const fail = (error) => ({ ok: false, error, done });
+    const project = `--project=${t.projectId}`;
+    let described = await describeInstance(t, run);
+    if (!described.ok)
+        return fail(described.error);
+    const ip = described.d.settings?.ipConfiguration;
+    const patch = [];
+    if (ip?.serverCaMode !== CLOUD_SQL_SERVER_CA_MODE) {
+        patch.push(`--server-ca-mode=${CLOUD_SQL_SERVER_CA_MODE}`);
+    }
+    if (ip?.sslMode !== CLOUD_SQL_SSL_MODE)
+        patch.push(`--ssl-mode=${CLOUD_SQL_SSL_MODE}`);
+    if (patch.length > 0) {
+        const r = await run(["sql", "instances", "patch", t.sqlInstance, project, ...patch, "--quiet"]);
+        if (!r.ok)
+            return fail(`patch ${t.sqlInstance} (${patch.join(" ")}): ${r.stderr.trim()}`);
+        done.push(`Cloud SQL ${t.sqlInstance}: ${patch.join(" ")}`);
+    }
+    // The active server certificate must come from the shared CA. Before the
+    // move there is none in the list the shared CA keeps; after an
+    // interrupted run there may be an upcoming one that was never rotated in.
+    const certs = await listServerCertificates(t, run, http);
+    if (!certs.ok)
+        return fail(certs.error);
+    const activeShared = certs.activeVersion !== null && certs.fingerprints.includes(certs.activeVersion);
+    if (!activeShared) {
+        const upcoming = certs.fingerprints.filter((f) => f !== certs.activeVersion);
+        if (upcoming.length === 0) {
+            const c = await run([
+                "sql",
+                "ssl",
+                "server-certs",
+                "create",
+                `--instance=${t.sqlInstance}`,
+                project,
+            ]);
+            if (!c.ok)
+                return fail(`create a server certificate: ${c.stderr.trim()}`);
+            done.push(`Cloud SQL ${t.sqlInstance}: server certificate from the shared CA created`);
+        }
+        const rot = await run([
+            "sql",
+            "ssl",
+            "server-certs",
+            "rotate",
+            `--instance=${t.sqlInstance}`,
+            project,
+            "--quiet",
+        ]);
+        if (!rot.ok)
+            return fail(`rotate to the shared-CA server certificate: ${rot.stderr.trim()}`);
+        done.push(`Cloud SQL ${t.sqlInstance}: rotated onto the shared-CA server certificate`);
+        described = await describeInstance(t, run);
+        if (!described.ok)
+            return fail(described.error);
+    }
+    const host = cloudSqlPrivateDnsName(described.d.dnsNames);
+    if (!host) {
+        return fail(`${t.sqlInstance} reports no PRIVATE_SERVICES_ACCESS DNS name (dnsNames) although it uses the shared CA; verify-full needs it. Check the instance's private IP configuration and re-run.`);
+    }
+    const privateIp = described.d.ipAddresses?.find((a) => a.type === "PRIVATE")?.ipAddress;
+    if (!privateIp)
+        return fail(`${t.sqlInstance} has no private IP address`);
+    const network = ip?.privateNetwork?.split("/").pop();
+    if (!network)
+        return fail(`${t.sqlInstance} names no private network`);
+    const zone = cloudSqlDnsZoneName(t.env);
+    const fqdn = `${host}.`;
+    const z = await run(["dns", "managed-zones", "describe", zone, project, "--format=json"]);
+    if (z.ok) {
+        const existing = JSON.parse(z.stdout).dnsName?.toLowerCase();
+        if (existing !== fqdn) {
+            return fail(`the private DNS zone ${zone} serves ${existing ?? "(no name)"}, not the instance's DNS name ${fqdn}. If the instance was replaced, delete the zone (gcloud dns managed-zones delete ${zone} ${project}) after removing its records, then re-run.`);
+        }
+    }
+    else if (NOT_FOUND.test(z.stderr)) {
+        const c = await run([
+            "dns",
+            "managed-zones",
+            "create",
+            zone,
+            project,
+            `--dns-name=${fqdn}`,
+            "--visibility=private",
+            `--networks=${network}`,
+            `--description=Caelo ${t.env}: the Cloud SQL instance's DNS name inside the VPC (#1338)`,
+        ]);
+        if (!c.ok)
+            return fail(`create the private DNS zone ${zone}: ${c.stderr.trim()}`);
+        done.push(`private DNS zone ${zone} (${fqdn}) on network ${network}`);
+    }
+    else {
+        return fail(`describe the private DNS zone ${zone}: ${z.stderr.trim()}`);
+    }
+    const rec = ["dns", "record-sets"];
+    const where = [fqdn, `--zone=${zone}`, "--type=A", project];
+    const a = await run([...rec, "describe", ...where, "--format=json"]);
+    if (a.ok) {
+        const rrdatas = JSON.parse(a.stdout).rrdatas ?? [];
+        if (rrdatas.length !== 1 || rrdatas[0] !== privateIp) {
+            const u = await run([...rec, "update", ...where, "--ttl=300", `--rrdatas=${privateIp}`]);
+            if (!u.ok)
+                return fail(`update the A record of ${fqdn}: ${u.stderr.trim()}`);
+            done.push(`DNS ${fqdn} A ${rrdatas.join(",") || "(none)"} → ${privateIp}`);
+        }
+    }
+    else if (NOT_FOUND.test(a.stderr)) {
+        const c = await run([...rec, "create", ...where, "--ttl=300", `--rrdatas=${privateIp}`]);
+        if (!c.ok)
+            return fail(`create the A record of ${fqdn}: ${c.stderr.trim()}`);
+        done.push(`DNS ${fqdn} A ${privateIp}`);
+    }
+    else {
+        return fail(`describe the A record of ${fqdn}: ${a.stderr.trim()}`);
+    }
+    return { ok: true, host, done };
+}
+/** The plain values of `names` in a service's live env (secret refs and unset vars skipped). */
+export function liveDatabaseUrls(liveEnv, names) {
+    const out = {};
+    for (const name of names) {
+        const v = liveEnv.get(name);
+        if (v?.kind === "value" && v.value)
+            out[name] = v.value;
+    }
+    return out;
+}
+/** Whether a database URL dials an IP literal (an unparsable one does not). */
+export function dialsIpAddress(url) {
+    try {
+        return isIpLiteral(new URL(url).hostname);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * `url` with its host replaced by `host`, everything else kept — or null
+ * when it already dials a host name (nothing to move).
+ */
+export function urlOnDnsHost(url, host) {
+    const parsed = new URL(url);
+    if (!isIpLiteral(parsed.hostname))
+        return null;
+    parsed.hostname = host;
+    return parsed.toString();
+}
+/**
+ * Switch the live database URLs of `services` from the instance's IP to
+ * `host`, keeping their `sslmode` (the running image may not carry the CA
+ * bundle yet; the roll sets verify-full with the image that does). Every
+ * reader of the database host — the rolls, the migration job, the upgrader
+ * and operator-access jobs — takes it from these URLs, so after this they
+ * all dial the name the server's certificate carries.
+ *
+ * @param liveUrls the plain URL values each service carries now
+ */
+export async function moveServicesToDnsHost(target, services, host, deps) {
+    const sleep = deps.sleep ?? realSleep;
+    const done = [];
+    for (const s of services) {
+        const moved = Object.entries(s.liveUrls)
+            .map(([name, url]) => [name, urlOnDnsHost(url, host)])
+            .filter((e) => e[1] !== null);
+        if (moved.length === 0)
+            continue;
+        const r = await runWithRetry(deps.run, sleep, [
+            "run",
+            "services",
+            "update",
+            s.serviceName,
+            "--region",
+            target.region,
+            `--project=${target.projectId}`,
+            // ^|^ — the values carry `&` and `=`; a custom delimiter keeps gcloud
+            // from splitting them.
+            `--update-env-vars=^|^${moved.map(([n, u]) => `${n}=${u}`).join("|")}`,
+            "--quiet",
+        ]);
+        if (!r.ok) {
+            return {
+                ok: false,
+                error: `move ${s.serviceName} onto the database's DNS name: ${r.stderr.trim()}`,
+                done,
+            };
+        }
+        done.push(`${s.serviceName}: ${moved.map(([n]) => n).join(", ")} → ${host}`);
+    }
+    return { ok: true, done };
+}
+//# sourceMappingURL=cloudsql-tls.js.map

package/dist/cloudsql-tls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudsql-tls.js","sourceRoot":"","sources":["../src/cloudsql-tls.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAqB,SAAS,EAAE,YAAY,EAAc,MAAM,mBAAmB,CAAC;AAE3F,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAiC7B,MAAM,SAAS,GAAG,yCAAyC,CAAC;AAC5D,MAAM,SAAS,GAAG,oCAAoC,CAAC;AAEvD,KAAK,UAAU,gBAAgB,CAC7B,CAAoB,EACpB,GAAiB;IAEjB,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC;QAClB,KAAK;QACL,WAAW;QACX,UAAU;QACV,CAAC,CAAC,WAAW;QACb,aAAa,CAAC,CAAC,SAAS,EAAE;QAC1B,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACxF,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAwB,EAAE,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,WAAW,0BAA0B,EAAE,CAAC;IACnF,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,KAAK,UAAU,sBAAsB,CACnC,CAAoB,EACpB,GAAiB,EACjB,IAAe;IAIf,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,IAAI,CAAC,MAAM;QACT,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACxF,MAAM,GAAG,GAAG,MAAM,IAAI,CACpB,GAAG,SAAS,aAAa,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC,cAAc,kBAAkB,CAAC,CAAC,CAAC,WAAW,CAAC,yBAAyB,EAChI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,EAAE,CAClE,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,kCAAkC,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;SAC5E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAG3B,CAAC;IACF,OAAO;QACL,EAAE,EAAE,IAAI;QACR,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,IAAI;QACzC,YAAY,EAAE,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;KAC3F,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,CAAoB,EACpB,IAAqB;IAErB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,GAAG,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAK,KAA8B,CAAC;IAC1D,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,CAAC,KAAa,EAAqB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChF,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,SAAS,EAAE,CAAC;IAE3C,IAAI,SAAS,GAAG,MAAM,gBAAgB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/C,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,eAAe,CAAC;IACjD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,EAAE,EAAE,YAAY,KAAK,wBAAwB,EAAE,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,oBAAoB,wBAAwB,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,EAAE,EAAE,OAAO,KAAK,kBAAkB;QAAE,KAAK,CAAC,IAAI,CAAC,cAAc,kBAAkB,EAAE,CAAC,CAAC;IACvF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;QAChG,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1F,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,yEAAyE;IACzE,+DAA+D;IAC/D,0EAA0E;IAC1E,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,YAAY,GAChB,KAAK,CAAC,aAAa,KAAK,IAAI,IAAI,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACnF,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,aAAa,CAAC,CAAC;QAC7E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC;gBAClB,KAAK;gBACL,KAAK;gBACL,cAAc;gBACd,QAAQ;gBACR,cAAc,CAAC,CAAC,WAAW,EAAE;gBAC7B,OAAO;aACR,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC,gCAAgC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC1E,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,WAAW,iDAAiD,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC;YACpB,KAAK;YACL,KAAK;YACL,cAAc;YACd,QAAQ;YACR,cAAc,CAAC,CAAC,WAAW,EAAE;YAC7B,OAAO;YACP,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,+CAA+C,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC7F,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,WAAW,iDAAiD,CAAC,CAAC;QACvF,SAAS,GAAG,MAAM,gBAAgB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,SAAS,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,IAAI,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC1D,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CACT,GAAG,CAAC,CAAC,WAAW,yKAAyK,CAC1L,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,SAAS,CAAC;IACxF,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,4BAA4B,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,EAAE,EAAE,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACrD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,2BAA2B,CAAC,CAAC;IAEvE,MAAM,IAAI,GAAG,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,GAAG,IAAI,GAAG,CAAC;IACxB,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC;IAC1F,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;QACT,MAAM,QAAQ,GAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAA0B,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC;QACvF,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO,IAAI,CACT,wBAAwB,IAAI,WAAW,QAAQ,IAAI,WAAW,iCAAiC,IAAI,oFAAoF,IAAI,IAAI,OAAO,4CAA4C,CACnP,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC;YAClB,KAAK;YACL,eAAe;YACf,QAAQ;YACR,IAAI;YACJ,OAAO;YACP,cAAc,IAAI,EAAE;YACpB,sBAAsB;YACtB,cAAc,OAAO,EAAE;YACvB,uBAAuB,CAAC,CAAC,GAAG,4DAA4D;SACzF,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,+BAA+B,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,IAAI,CAAC,oBAAoB,IAAI,KAAK,IAAI,gBAAgB,OAAO,EAAE,CAAC,CAAC;IACxE,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,CAAC,iCAAiC,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,GAAG,GAAG,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,CAAC,IAAI,EAAE,UAAU,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IAC5D,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,GAAG,GAAG,EAAE,UAAU,EAAE,GAAG,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;QACT,MAAM,OAAO,GAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAA4B,CAAC,OAAO,IAAI,EAAE,CAAC;QAC/E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YACrD,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,GAAG,GAAG,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,WAAW,EAAE,aAAa,SAAS,EAAE,CAAC,CAAC,CAAC;YACzF,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC,0BAA0B,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC7E,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,MAAM,SAAS,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;SAAM,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,GAAG,GAAG,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,WAAW,EAAE,aAAa,SAAS,EAAE,CAAC,CAAC,CAAC;QACzF,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,0BAA0B,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,MAAM,SAAS,EAAE,CAAC,CAAC;IAC1C,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,CAAC,4BAA4B,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAClC,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,gBAAgB,CAC9B,OAA0C,EAC1C,KAAwB;IAExB,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,EAAE,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,KAAK;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;IAC1D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,IAAY;IACpD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;IACvB,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAA+D,EAC/D,QAGG,EACH,IAAY,EACZ,IAAqB;IAErB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;aACrC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAU,CAAC;aAC9D,MAAM,CAAC,CAAC,CAAC,EAAkC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAChE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACjC,MAAM,CAAC,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE;YAC5C,KAAK;YACL,UAAU;YACV,QAAQ;YACR,CAAC,CAAC,WAAW;YACb,UAAU;YACV,MAAM,CAAC,MAAM;YACb,aAAa,MAAM,CAAC,SAAS,EAAE;YAC/B,sEAAsE;YACtE,uBAAuB;YACvB,wBAAwB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;YACtE,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,QAAQ,CAAC,CAAC,WAAW,kCAAkC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;gBAC/E,IAAI;aACL,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC"}

package/dist/compose.d.ts

@@ -1,9 +1,15 @@
 import { type ReleaseService } from "./upgrade/release-images.js";
-/** The admin + gateway release images, each `ghcr.io/caelo-cms/<svc>@sha256:…`. */
+/** The release images, each `ghcr.io/caelo-cms/<svc>@sha256:…`. */
 export interface ReleaseImages {
     readonly mode: "release";
     readonly admin: string;
     readonly gateway: string;
+    /**
+     * #1328 — the MCP-Auth-Proxy. Absent only for a release recorded before
+     * the proxy shipped (a rollback target in release.json): its Compose file
+     * then has no proxy service, exactly as that release ran.
+     */
+    readonly "mcp-auth-proxy"?: string;
 }
 /**
  * Contributor-only: run the admin + gateway from the Caelo checkout the
@@ -44,11 +50,18 @@ export declare const MEDIA_DIR = "media";
 export declare const MEDIA_ROOT = "/data/media";
 /** The gateway's HTTP port inside the Compose network. */
 export declare const COMPOSE_GATEWAY_PORT = 8090;
+/** #1328 — the MCP-Auth-Proxy's HTTP port inside the Compose network. */
+export declare const COMPOSE_MCP_AUTH_PROXY_PORT = 8095;
+/** #1328 — the Compose service name of the MCP-Auth-Proxy. */
+export declare const COMPOSE_MCP_AUTH_PROXY_SERVICE = "caelo-mcp-auth-proxy";
 /**
- * The Compose services that run Caelo code — what `restore` stops while it
- * rewrites the databases, and what the health checks probe. Workers run
- * inside the admin (CLAUDE.md §11.B Tier 5); there is no orchestrator or
- * runner service.
+ * The Compose services that touch the databases — what `backup` and
+ * `restore` stop while they read or rewrite them. Workers run inside the
+ * admin (CLAUDE.md §11.B Tier 5); there is no orchestrator or runner
+ * service. The MCP-Auth-Proxy (#1328) is deliberately not here: it holds no
+ * database login, so it keeps running, and a release from before it has no
+ * such service for `up` to start. Its health is checked wherever the
+ * install starts (self-hosted-start.ts) or rolls (self-hosted-upgrade.ts).
  */
 export declare const COMPOSE_APP_SERVICES: readonly ["caelo-admin", "caelo-gateway"];
 /**
@@ -58,6 +71,7 @@ export declare const COMPOSE_APP_SERVICES: readonly ["caelo-admin", "caelo-gatew
  */
 export declare const COMPOSE_ADMIN_UPSTREAM = "caelo-admin:5173";
 export declare const COMPOSE_GATEWAY_UPSTREAM = "caelo-gateway:8090";
+export declare const COMPOSE_MCP_AUTH_PROXY_UPSTREAM = "caelo-mcp-auth-proxy:8095";
 /**
  * The Caddy image, pinned to the release the generated Caddyfile is
  * validated against (caddy-validate.test.ts runs `caddy validate` on this
@@ -125,6 +139,15 @@ export interface ComposeSpec {
      * the gateway never gets it.
      */
     readonly internalSecret: string;
+    /**
+     * #1338 — SHA-256 (hex) of the database server certificate the Postgres
+     * service mounts (`.caelo/postgres-tls/server.crt`). It is part of the
+     * service's environment so a renewed certificate changes the service's
+     * definition and `docker compose up -d` recreates Postgres: a bind-mounted
+     * file whose content changes does not, and Postgres would keep serving
+     * the old certificate until verify-full clients refuse it.
+     */
+    readonly dbTlsServerCertSha256: string;
     readonly anthropicApiKey?: string;
     readonly resendApiKey?: string;
     readonly diskSize: string;
@@ -135,7 +158,7 @@ export interface ComposeSpec {
      * busy host never OOM-kills the admin at the limit.
      */
     readonly adminMemory?: string;
-    /** Which admin + gateway images run (see {@link ComposeImages}). */
+    /** Which Caelo images run (see {@link ComposeImages}). */
     readonly images: ComposeImages;
     /**
      * The host ports Caddy listens on (`80` / `443` for a public install —

package/dist/compose.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compose.d.ts","sourceRoot":"","sources":["../src/compose.ts"],"names":[],"mappings":"AAuCA,OAAO,EAAiC,KAAK,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAEjG,mFAAmF;AACnF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;CACtB;AAED,MAAM,MAAM,aAAa,GAAG,aAAa,GAAG,SAAS,CAAC;AAEtD,sFAAsF;AACtF,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAEvC;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,kDAI9B,CAAC;AAMH,mFAAmF;AACnF,eAAO,MAAM,aAAa,cAAc,CAAC;AAEzC;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,eAAe,CAAC;AAE7C;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,iDAAiE,CAAC;AAExG,wFAAwF;AACxF,eAAO,MAAM,SAAS,UAAU,CAAC;AACjC,qFAAqF;AACrF,eAAO,MAAM,UAAU,gBAAgB,CAAC;AAExC,0DAA0D;AAC1D,eAAO,MAAM,oBAAoB,OAAO,CAAC;AAEzC;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,2CAA4C,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,qBAAsC,CAAC;AAC1E,eAAO,MAAM,wBAAwB,uBAA0C,CAAC;AAEhF;;;;;GAKG;AACH,eAAO,MAAM,WAAW,wBAAwB,CAAC;AAEjD,yDAAyD;AACzD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAKzD;AAED,uGAAuG;AACvG,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED,4EAA4E;AAC5E,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAG5E;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKnF;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qEAAqE;IACrE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,wDAAwD;IACxD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC;CAC/B;AAED,iFAAiF;AACjF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,oEAAoE;AACpE,eAAO,MAAM,qBAAqB,cAAc,CAAC;AAEjD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAyE/D;AAID,6EAA6E;AAC7E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEnD"}
+{"version":3,"file":"compose.d.ts","sourceRoot":"","sources":["../src/compose.ts"],"names":[],"mappings":"AA+CA,OAAO,EAAiC,KAAK,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAEjG,mEAAmE;AACnE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;CACtB;AAED,MAAM,MAAM,aAAa,GAAG,aAAa,GAAG,SAAS,CAAC;AAEtD,sFAAsF;AACtF,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAEvC;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,kDAI9B,CAAC;AAMH,mFAAmF;AACnF,eAAO,MAAM,aAAa,cAAc,CAAC;AAEzC;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,eAAe,CAAC;AAE7C;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,iDAAiE,CAAC;AAExG,wFAAwF;AACxF,eAAO,MAAM,SAAS,UAAU,CAAC;AACjC,qFAAqF;AACrF,eAAO,MAAM,UAAU,gBAAgB,CAAC;AAExC,0DAA0D;AAC1D,eAAO,MAAM,oBAAoB,OAAO,CAAC;AAEzC,yEAAyE;AACzE,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAEhD,8DAA8D;AAC9D,eAAO,MAAM,8BAA8B,yBAAyB,CAAC;AAErE;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,2CAA4C,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,qBAAsC,CAAC;AAC1E,eAAO,MAAM,wBAAwB,uBAA0C,CAAC;AAChF,eAAO,MAAM,+BAA+B,8BAAqE,CAAC;AAElH;;;;;GAKG;AACH,eAAO,MAAM,WAAW,wBAAwB,CAAC;AAEjD,yDAAyD;AACzD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAKzD;AAED,uGAAuG;AACvG,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED,4EAA4E;AAC5E,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAG5E;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKnF;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qEAAqE;IACrE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;;;;OAOG;IACH,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,wDAAwD;IACxD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC;CAC/B;AAED,iFAAiF;AACjF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,oEAAoE;AACpE,eAAO,MAAM,qBAAqB,cAAc,CAAC;AAEjD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAwF/D;AAID,6EAA6E;AAC7E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEnD"}