@caelo-cms/provisioning 0.11.9 → 0.11.10

package/dist/cloudsql-tls.js

@@ -0,0 +1,289 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * #1338 (gateway hardening L6) — converge a Cloud SQL install to
+ * `sslmode=verify-full` through gcloud, the way `cms-provision upgrade`
+ * converges everything else (stack-converge.ts; it never runs Pulumi).
+ *
+ * Verify-full checks the server certificate's chain AND that it names the
+ * host the client dialled. On Cloud SQL that needs three things the stacks
+ * declare for a new install (stacks/gcp, stacks/gcp-firebase) and this
+ * module brings an existing one to:
+ *
+ *   1. The shared server CA (`GOOGLE_MANAGED_CAS_CA`): "The SAN field
+ *      contains the hostname (DNS name of the instance) for all types of
+ *      instances", while the default per-instance CA names one "only for
+ *      instances enabled with Private Service Connect"
+ *      (docs.cloud.google.com/sql/docs/postgres/authorize-ssl). An instance
+ *      may move from per-instance to shared, not back. After the move the
+ *      instance needs a server certificate from the new CA: "create a new
+ *      server certificate with `gcloud sql ssl server-certs create`", then
+ *      "complete the rotation with `gcloud sql ssl server-certs rotate`"
+ *      (docs.cloud.google.com/sql/docs/postgres/manage-ssl-instance). The
+ *      rotation restarts nothing a client keeps: open connections drop and
+ *      reconnect; every client already uses TLS (`sslmode=require` before).
+ *      `sslMode=ENCRYPTED_ONLY` refuses plaintext from then on.
+ *   2. Resolution of the instance's DNS name (`dnsNames`, the
+ *      PRIVATE_SERVICES_ACCESS entry, `….sql-psa.goog`) inside the VPC:
+ *      "create the DNS record in a private DNS zone in the corresponding
+ *      Virtual Private Cloud (VPC) network"
+ *      (docs.cloud.google.com/sql/docs/postgres/configure-ssl-instance).
+ *   3. The services dialling that name. They read it from their own
+ *      `*_DATABASE_URL`, and so does every job the upgrade derives from the
+ *      admin's (migrations, upgrader, operator access): {@link
+ *      moveServicesToDnsHost} switches the host of the live URLs first,
+ *      keeping their current `sslmode`, so the old image keeps working until
+ *      the roll sets verify-full with the image that carries the CA bundle.
+ *
+ * The CA the clients trust is Google's published shared-CA bundle, shipped
+ * in every image (shared database-tls.ts `CLOUD_SQL_CA_BUNDLE`): it covers
+ * the root and every regional CA, so a server-certificate rotation needs no
+ * change on the client side.
+ *
+ * Every step reads before it writes and is a no-op when already in shape,
+ * so a re-run after a failure picks up where the last one stopped.
+ */
+import { isIpLiteral } from "@caelo-cms/shared";
+import { realSleep, runWithRetry } from "./gcloud-retry.js";
+import { CLOUD_SQL_SERVER_CA_MODE, CLOUD_SQL_SSL_MODE, cloudSqlDnsZoneName, cloudSqlPrivateDnsName, } from "./stack-contract.js";
+const NOT_FOUND = /NOT_FOUND|not found|does not exist|404/i;
+const SQL_ADMIN = "https://sqladmin.googleapis.com/v1";
+async function describeInstance(t, run) {
+    const r = await run([
+        "sql",
+        "instances",
+        "describe",
+        t.sqlInstance,
+        `--project=${t.projectId}`,
+        "--format=json",
+    ]);
+    if (!r.ok)
+        return { ok: false, error: `describe ${t.sqlInstance}: ${r.stderr.trim()}` };
+    try {
+        return { ok: true, d: JSON.parse(r.stdout) };
+    }
+    catch {
+        return { ok: false, error: `describe ${t.sqlInstance}: gcloud printed no JSON` };
+    }
+}
+/** The instance's server certificates and which one is active (Cloud SQL Admin API). */
+async function listServerCertificates(t, run, http) {
+    const token = await run(["auth", "print-access-token"]);
+    const bearer = token.ok ? token.stdout.trim() : "";
+    if (!bearer)
+        return { ok: false, error: `gcloud auth print-access-token: ${token.stderr.trim()}` };
+    const res = await http(`${SQL_ADMIN}/projects/${encodeURIComponent(t.projectId)}/instances/${encodeURIComponent(t.sqlInstance)}/listServerCertificates`, { method: "GET", headers: { Authorization: `Bearer ${bearer}` } });
+    const text = await res.text();
+    if (!res.ok) {
+        return {
+            ok: false,
+            error: `list server certificates: HTTP ${res.status} ${text.slice(0, 300)}`,
+        };
+    }
+    const body = JSON.parse(text);
+    return {
+        ok: true,
+        activeVersion: body.activeVersion ?? null,
+        fingerprints: (body.serverCerts ?? []).map((c) => c.sha1Fingerprint ?? "").filter(Boolean),
+    };
+}
+/**
+ * Bring the instance to verify-full: shared CA with an active server
+ * certificate from it, encrypted connections only, its DNS name resolving
+ * in the VPC. Returns the host every client must dial.
+ */
+export async function ensureCloudSqlVerifyFull(t, deps) {
+    const sleep = deps.sleep ?? realSleep;
+    const run = (args) => runWithRetry(deps.run, sleep, args);
+    const http = deps.http ?? fetch;
+    const done = [];
+    const fail = (error) => ({ ok: false, error, done });
+    const project = `--project=${t.projectId}`;
+    let described = await describeInstance(t, run);
+    if (!described.ok)
+        return fail(described.error);
+    const ip = described.d.settings?.ipConfiguration;
+    const patch = [];
+    if (ip?.serverCaMode !== CLOUD_SQL_SERVER_CA_MODE) {
+        patch.push(`--server-ca-mode=${CLOUD_SQL_SERVER_CA_MODE}`);
+    }
+    if (ip?.sslMode !== CLOUD_SQL_SSL_MODE)
+        patch.push(`--ssl-mode=${CLOUD_SQL_SSL_MODE}`);
+    if (patch.length > 0) {
+        const r = await run(["sql", "instances", "patch", t.sqlInstance, project, ...patch, "--quiet"]);
+        if (!r.ok)
+            return fail(`patch ${t.sqlInstance} (${patch.join(" ")}): ${r.stderr.trim()}`);
+        done.push(`Cloud SQL ${t.sqlInstance}: ${patch.join(" ")}`);
+    }
+    // The active server certificate must come from the shared CA. Before the
+    // move there is none in the list the shared CA keeps; after an
+    // interrupted run there may be an upcoming one that was never rotated in.
+    const certs = await listServerCertificates(t, run, http);
+    if (!certs.ok)
+        return fail(certs.error);
+    const activeShared = certs.activeVersion !== null && certs.fingerprints.includes(certs.activeVersion);
+    if (!activeShared) {
+        const upcoming = certs.fingerprints.filter((f) => f !== certs.activeVersion);
+        if (upcoming.length === 0) {
+            const c = await run([
+                "sql",
+                "ssl",
+                "server-certs",
+                "create",
+                `--instance=${t.sqlInstance}`,
+                project,
+            ]);
+            if (!c.ok)
+                return fail(`create a server certificate: ${c.stderr.trim()}`);
+            done.push(`Cloud SQL ${t.sqlInstance}: server certificate from the shared CA created`);
+        }
+        const rot = await run([
+            "sql",
+            "ssl",
+            "server-certs",
+            "rotate",
+            `--instance=${t.sqlInstance}`,
+            project,
+            "--quiet",
+        ]);
+        if (!rot.ok)
+            return fail(`rotate to the shared-CA server certificate: ${rot.stderr.trim()}`);
+        done.push(`Cloud SQL ${t.sqlInstance}: rotated onto the shared-CA server certificate`);
+        described = await describeInstance(t, run);
+        if (!described.ok)
+            return fail(described.error);
+    }
+    const host = cloudSqlPrivateDnsName(described.d.dnsNames);
+    if (!host) {
+        return fail(`${t.sqlInstance} reports no PRIVATE_SERVICES_ACCESS DNS name (dnsNames) although it uses the shared CA; verify-full needs it. Check the instance's private IP configuration and re-run.`);
+    }
+    const privateIp = described.d.ipAddresses?.find((a) => a.type === "PRIVATE")?.ipAddress;
+    if (!privateIp)
+        return fail(`${t.sqlInstance} has no private IP address`);
+    const network = ip?.privateNetwork?.split("/").pop();
+    if (!network)
+        return fail(`${t.sqlInstance} names no private network`);
+    const zone = cloudSqlDnsZoneName(t.env);
+    const fqdn = `${host}.`;
+    const z = await run(["dns", "managed-zones", "describe", zone, project, "--format=json"]);
+    if (z.ok) {
+        const existing = JSON.parse(z.stdout).dnsName?.toLowerCase();
+        if (existing !== fqdn) {
+            return fail(`the private DNS zone ${zone} serves ${existing ?? "(no name)"}, not the instance's DNS name ${fqdn}. If the instance was replaced, delete the zone (gcloud dns managed-zones delete ${zone} ${project}) after removing its records, then re-run.`);
+        }
+    }
+    else if (NOT_FOUND.test(z.stderr)) {
+        const c = await run([
+            "dns",
+            "managed-zones",
+            "create",
+            zone,
+            project,
+            `--dns-name=${fqdn}`,
+            "--visibility=private",
+            `--networks=${network}`,
+            `--description=Caelo ${t.env}: the Cloud SQL instance's DNS name inside the VPC (#1338)`,
+        ]);
+        if (!c.ok)
+            return fail(`create the private DNS zone ${zone}: ${c.stderr.trim()}`);
+        done.push(`private DNS zone ${zone} (${fqdn}) on network ${network}`);
+    }
+    else {
+        return fail(`describe the private DNS zone ${zone}: ${z.stderr.trim()}`);
+    }
+    const rec = ["dns", "record-sets"];
+    const where = [fqdn, `--zone=${zone}`, "--type=A", project];
+    const a = await run([...rec, "describe", ...where, "--format=json"]);
+    if (a.ok) {
+        const rrdatas = JSON.parse(a.stdout).rrdatas ?? [];
+        if (rrdatas.length !== 1 || rrdatas[0] !== privateIp) {
+            const u = await run([...rec, "update", ...where, "--ttl=300", `--rrdatas=${privateIp}`]);
+            if (!u.ok)
+                return fail(`update the A record of ${fqdn}: ${u.stderr.trim()}`);
+            done.push(`DNS ${fqdn} A ${rrdatas.join(",") || "(none)"} → ${privateIp}`);
+        }
+    }
+    else if (NOT_FOUND.test(a.stderr)) {
+        const c = await run([...rec, "create", ...where, "--ttl=300", `--rrdatas=${privateIp}`]);
+        if (!c.ok)
+            return fail(`create the A record of ${fqdn}: ${c.stderr.trim()}`);
+        done.push(`DNS ${fqdn} A ${privateIp}`);
+    }
+    else {
+        return fail(`describe the A record of ${fqdn}: ${a.stderr.trim()}`);
+    }
+    return { ok: true, host, done };
+}
+/** The plain values of `names` in a service's live env (secret refs and unset vars skipped). */
+export function liveDatabaseUrls(liveEnv, names) {
+    const out = {};
+    for (const name of names) {
+        const v = liveEnv.get(name);
+        if (v?.kind === "value" && v.value)
+            out[name] = v.value;
+    }
+    return out;
+}
+/** Whether a database URL dials an IP literal (an unparsable one does not). */
+export function dialsIpAddress(url) {
+    try {
+        return isIpLiteral(new URL(url).hostname);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * `url` with its host replaced by `host`, everything else kept — or null
+ * when it already dials a host name (nothing to move).
+ */
+export function urlOnDnsHost(url, host) {
+    const parsed = new URL(url);
+    if (!isIpLiteral(parsed.hostname))
+        return null;
+    parsed.hostname = host;
+    return parsed.toString();
+}
+/**
+ * Switch the live database URLs of `services` from the instance's IP to
+ * `host`, keeping their `sslmode` (the running image may not carry the CA
+ * bundle yet; the roll sets verify-full with the image that does). Every
+ * reader of the database host — the rolls, the migration job, the upgrader
+ * and operator-access jobs — takes it from these URLs, so after this they
+ * all dial the name the server's certificate carries.
+ *
+ * @param liveUrls the plain URL values each service carries now
+ */
+export async function moveServicesToDnsHost(target, services, host, deps) {
+    const sleep = deps.sleep ?? realSleep;
+    const done = [];
+    for (const s of services) {
+        const moved = Object.entries(s.liveUrls)
+            .map(([name, url]) => [name, urlOnDnsHost(url, host)])
+            .filter((e) => e[1] !== null);
+        if (moved.length === 0)
+            continue;
+        const r = await runWithRetry(deps.run, sleep, [
+            "run",
+            "services",
+            "update",
+            s.serviceName,
+            "--region",
+            target.region,
+            `--project=${target.projectId}`,
+            // ^|^ — the values carry `&` and `=`; a custom delimiter keeps gcloud
+            // from splitting them.
+            `--update-env-vars=^|^${moved.map(([n, u]) => `${n}=${u}`).join("|")}`,
+            "--quiet",
+        ]);
+        if (!r.ok) {
+            return {
+                ok: false,
+                error: `move ${s.serviceName} onto the database's DNS name: ${r.stderr.trim()}`,
+                done,
+            };
+        }
+        done.push(`${s.serviceName}: ${moved.map(([n]) => n).join(", ")} → ${host}`);
+    }
+    return { ok: true, done };
+}
+//# sourceMappingURL=cloudsql-tls.js.map

package/dist/cloudsql-tls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudsql-tls.js","sourceRoot":"","sources":["../src/cloudsql-tls.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAqB,SAAS,EAAE,YAAY,EAAc,MAAM,mBAAmB,CAAC;AAE3F,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAiC7B,MAAM,SAAS,GAAG,yCAAyC,CAAC;AAC5D,MAAM,SAAS,GAAG,oCAAoC,CAAC;AAEvD,KAAK,UAAU,gBAAgB,CAC7B,CAAoB,EACpB,GAAiB;IAEjB,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC;QAClB,KAAK;QACL,WAAW;QACX,UAAU;QACV,CAAC,CAAC,WAAW;QACb,aAAa,CAAC,CAAC,SAAS,EAAE;QAC1B,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACxF,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAwB,EAAE,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,WAAW,0BAA0B,EAAE,CAAC;IACnF,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,KAAK,UAAU,sBAAsB,CACnC,CAAoB,EACpB,GAAiB,EACjB,IAAe;IAIf,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,IAAI,CAAC,MAAM;QACT,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACxF,MAAM,GAAG,GAAG,MAAM,IAAI,CACpB,GAAG,SAAS,aAAa,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC,cAAc,kBAAkB,CAAC,CAAC,CAAC,WAAW,CAAC,yBAAyB,EAChI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,EAAE,CAClE,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,kCAAkC,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;SAC5E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAG3B,CAAC;IACF,OAAO;QACL,EAAE,EAAE,IAAI;QACR,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,IAAI;QACzC,YAAY,EAAE,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;KAC3F,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,CAAoB,EACpB,IAAqB;IAErB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,GAAG,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAK,KAA8B,CAAC;IAC1D,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,CAAC,KAAa,EAAqB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChF,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,SAAS,EAAE,CAAC;IAE3C,IAAI,SAAS,GAAG,MAAM,gBAAgB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/C,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,eAAe,CAAC;IACjD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,EAAE,EAAE,YAAY,KAAK,wBAAwB,EAAE,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,oBAAoB,wBAAwB,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,EAAE,EAAE,OAAO,KAAK,kBAAkB;QAAE,KAAK,CAAC,IAAI,CAAC,cAAc,kBAAkB,EAAE,CAAC,CAAC;IACvF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;QAChG,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1F,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,yEAAyE;IACzE,+DAA+D;IAC/D,0EAA0E;IAC1E,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,YAAY,GAChB,KAAK,CAAC,aAAa,KAAK,IAAI,IAAI,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACnF,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,aAAa,CAAC,CAAC;QAC7E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC;gBAClB,KAAK;gBACL,KAAK;gBACL,cAAc;gBACd,QAAQ;gBACR,cAAc,CAAC,CAAC,WAAW,EAAE;gBAC7B,OAAO;aACR,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC,gCAAgC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC1E,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,WAAW,iDAAiD,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC;YACpB,KAAK;YACL,KAAK;YACL,cAAc;YACd,QAAQ;YACR,cAAc,CAAC,CAAC,WAAW,EAAE;YAC7B,OAAO;YACP,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,+CAA+C,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC7F,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,WAAW,iDAAiD,CAAC,CAAC;QACvF,SAAS,GAAG,MAAM,gBAAgB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,SAAS,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,IAAI,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC1D,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CACT,GAAG,CAAC,CAAC,WAAW,yKAAyK,CAC1L,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,SAAS,CAAC;IACxF,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,4BAA4B,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,EAAE,EAAE,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACrD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,2BAA2B,CAAC,CAAC;IAEvE,MAAM,IAAI,GAAG,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,GAAG,IAAI,GAAG,CAAC;IACxB,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC;IAC1F,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;QACT,MAAM,QAAQ,GAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAA0B,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC;QACvF,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO,IAAI,CACT,wBAAwB,IAAI,WAAW,QAAQ,IAAI,WAAW,iCAAiC,IAAI,oFAAoF,IAAI,IAAI,OAAO,4CAA4C,CACnP,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC;YAClB,KAAK;YACL,eAAe;YACf,QAAQ;YACR,IAAI;YACJ,OAAO;YACP,cAAc,IAAI,EAAE;YACpB,sBAAsB;YACtB,cAAc,OAAO,EAAE;YACvB,uBAAuB,CAAC,CAAC,GAAG,4DAA4D;SACzF,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,+BAA+B,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,IAAI,CAAC,oBAAoB,IAAI,KAAK,IAAI,gBAAgB,OAAO,EAAE,CAAC,CAAC;IACxE,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,CAAC,iCAAiC,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,GAAG,GAAG,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,CAAC,IAAI,EAAE,UAAU,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IAC5D,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,GAAG,GAAG,EAAE,UAAU,EAAE,GAAG,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;QACT,MAAM,OAAO,GAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAA4B,CAAC,OAAO,IAAI,EAAE,CAAC;QAC/E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YACrD,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,GAAG,GAAG,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,WAAW,EAAE,aAAa,SAAS,EAAE,CAAC,CAAC,CAAC;YACzF,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC,0BAA0B,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC7E,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,MAAM,SAAS,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;SAAM,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,GAAG,GAAG,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,WAAW,EAAE,aAAa,SAAS,EAAE,CAAC,CAAC,CAAC;QACzF,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,0BAA0B,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,MAAM,SAAS,EAAE,CAAC,CAAC;IAC1C,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,CAAC,4BAA4B,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAClC,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,gBAAgB,CAC9B,OAA0C,EAC1C,KAAwB;IAExB,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,EAAE,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,KAAK;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;IAC1D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,IAAY;IACpD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;IACvB,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAA+D,EAC/D,QAGG,EACH,IAAY,EACZ,IAAqB;IAErB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;aACrC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAU,CAAC;aAC9D,MAAM,CAAC,CAAC,CAAC,EAAkC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAChE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACjC,MAAM,CAAC,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE;YAC5C,KAAK;YACL,UAAU;YACV,QAAQ;YACR,CAAC,CAAC,WAAW;YACb,UAAU;YACV,MAAM,CAAC,MAAM;YACb,aAAa,MAAM,CAAC,SAAS,EAAE;YAC/B,sEAAsE;YACtE,uBAAuB;YACvB,wBAAwB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;YACtE,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,QAAQ,CAAC,CAAC,WAAW,kCAAkC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;gBAC/E,IAAI;aACL,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC"}

package/dist/compose.d.ts

@@ -1,9 +1,15 @@
 import { type ReleaseService } from "./upgrade/release-images.js";
-/** The admin + gateway release images, each `ghcr.io/caelo-cms/<svc>@sha256:…`. */
+/** The release images, each `ghcr.io/caelo-cms/<svc>@sha256:…`. */
 export interface ReleaseImages {
     readonly mode: "release";
     readonly admin: string;
     readonly gateway: string;
+    /**
+     * #1328 — the MCP-Auth-Proxy. Absent only for a release recorded before
+     * the proxy shipped (a rollback target in release.json): its Compose file
+     * then has no proxy service, exactly as that release ran.
+     */
+    readonly "mcp-auth-proxy"?: string;
 }
 /**
  * Contributor-only: run the admin + gateway from the Caelo checkout the
@@ -44,11 +50,18 @@ export declare const MEDIA_DIR = "media";
 export declare const MEDIA_ROOT = "/data/media";
 /** The gateway's HTTP port inside the Compose network. */
 export declare const COMPOSE_GATEWAY_PORT = 8090;
+/** #1328 — the MCP-Auth-Proxy's HTTP port inside the Compose network. */
+export declare const COMPOSE_MCP_AUTH_PROXY_PORT = 8095;
+/** #1328 — the Compose service name of the MCP-Auth-Proxy. */
+export declare const COMPOSE_MCP_AUTH_PROXY_SERVICE = "caelo-mcp-auth-proxy";
 /**
- * The Compose services that run Caelo code — what `restore` stops while it
- * rewrites the databases, and what the health checks probe. Workers run
- * inside the admin (CLAUDE.md §11.B Tier 5); there is no orchestrator or
- * runner service.
+ * The Compose services that touch the databases — what `backup` and
+ * `restore` stop while they read or rewrite them. Workers run inside the
+ * admin (CLAUDE.md §11.B Tier 5); there is no orchestrator or runner
+ * service. The MCP-Auth-Proxy (#1328) is deliberately not here: it holds no
+ * database login, so it keeps running, and a release from before it has no
+ * such service for `up` to start. Its health is checked wherever the
+ * install starts (self-hosted-start.ts) or rolls (self-hosted-upgrade.ts).
  */
 export declare const COMPOSE_APP_SERVICES: readonly ["caelo-admin", "caelo-gateway"];
 /**
@@ -58,6 +71,7 @@ export declare const COMPOSE_APP_SERVICES: readonly ["caelo-admin", "caelo-gatew
  */
 export declare const COMPOSE_ADMIN_UPSTREAM = "caelo-admin:5173";
 export declare const COMPOSE_GATEWAY_UPSTREAM = "caelo-gateway:8090";
+export declare const COMPOSE_MCP_AUTH_PROXY_UPSTREAM = "caelo-mcp-auth-proxy:8095";
 /**
  * The Caddy image, pinned to the release the generated Caddyfile is
  * validated against (caddy-validate.test.ts runs `caddy validate` on this
@@ -125,6 +139,15 @@ export interface ComposeSpec {
      * the gateway never gets it.
      */
     readonly internalSecret: string;
+    /**
+     * #1338 — SHA-256 (hex) of the database server certificate the Postgres
+     * service mounts (`.caelo/postgres-tls/server.crt`). It is part of the
+     * service's environment so a renewed certificate changes the service's
+     * definition and `docker compose up -d` recreates Postgres: a bind-mounted
+     * file whose content changes does not, and Postgres would keep serving
+     * the old certificate until verify-full clients refuse it.
+     */
+    readonly dbTlsServerCertSha256: string;
     readonly anthropicApiKey?: string;
     readonly resendApiKey?: string;
     readonly diskSize: string;
@@ -135,7 +158,7 @@ export interface ComposeSpec {
      * busy host never OOM-kills the admin at the limit.
      */
     readonly adminMemory?: string;
-    /** Which admin + gateway images run (see {@link ComposeImages}). */
+    /** Which Caelo images run (see {@link ComposeImages}). */
     readonly images: ComposeImages;
     /**
      * The host ports Caddy listens on (`80` / `443` for a public install —

package/dist/compose.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compose.d.ts","sourceRoot":"","sources":["../src/compose.ts"],"names":[],"mappings":"AAuCA,OAAO,EAAiC,KAAK,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAEjG,mFAAmF;AACnF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;CACtB;AAED,MAAM,MAAM,aAAa,GAAG,aAAa,GAAG,SAAS,CAAC;AAEtD,sFAAsF;AACtF,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAEvC;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,kDAI9B,CAAC;AAMH,mFAAmF;AACnF,eAAO,MAAM,aAAa,cAAc,CAAC;AAEzC;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,eAAe,CAAC;AAE7C;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,iDAAiE,CAAC;AAExG,wFAAwF;AACxF,eAAO,MAAM,SAAS,UAAU,CAAC;AACjC,qFAAqF;AACrF,eAAO,MAAM,UAAU,gBAAgB,CAAC;AAExC,0DAA0D;AAC1D,eAAO,MAAM,oBAAoB,OAAO,CAAC;AAEzC;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,2CAA4C,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,qBAAsC,CAAC;AAC1E,eAAO,MAAM,wBAAwB,uBAA0C,CAAC;AAEhF;;;;;GAKG;AACH,eAAO,MAAM,WAAW,wBAAwB,CAAC;AAEjD,yDAAyD;AACzD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAKzD;AAED,uGAAuG;AACvG,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED,4EAA4E;AAC5E,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAG5E;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKnF;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qEAAqE;IACrE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,wDAAwD;IACxD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC;CAC/B;AAED,iFAAiF;AACjF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,oEAAoE;AACpE,eAAO,MAAM,qBAAqB,cAAc,CAAC;AAEjD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAyE/D;AAID,6EAA6E;AAC7E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEnD"}
+{"version":3,"file":"compose.d.ts","sourceRoot":"","sources":["../src/compose.ts"],"names":[],"mappings":"AA+CA,OAAO,EAAiC,KAAK,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAEjG,mEAAmE;AACnE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;CACtB;AAED,MAAM,MAAM,aAAa,GAAG,aAAa,GAAG,SAAS,CAAC;AAEtD,sFAAsF;AACtF,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAEvC;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,kDAI9B,CAAC;AAMH,mFAAmF;AACnF,eAAO,MAAM,aAAa,cAAc,CAAC;AAEzC;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,eAAe,CAAC;AAE7C;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,iDAAiE,CAAC;AAExG,wFAAwF;AACxF,eAAO,MAAM,SAAS,UAAU,CAAC;AACjC,qFAAqF;AACrF,eAAO,MAAM,UAAU,gBAAgB,CAAC;AAExC,0DAA0D;AAC1D,eAAO,MAAM,oBAAoB,OAAO,CAAC;AAEzC,yEAAyE;AACzE,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAEhD,8DAA8D;AAC9D,eAAO,MAAM,8BAA8B,yBAAyB,CAAC;AAErE;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,2CAA4C,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,qBAAsC,CAAC;AAC1E,eAAO,MAAM,wBAAwB,uBAA0C,CAAC;AAChF,eAAO,MAAM,+BAA+B,8BAAqE,CAAC;AAElH;;;;;GAKG;AACH,eAAO,MAAM,WAAW,wBAAwB,CAAC;AAEjD,yDAAyD;AACzD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAKzD;AAED,uGAAuG;AACvG,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED,4EAA4E;AAC5E,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAG5E;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKnF;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qEAAqE;IACrE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;;;;OAOG;IACH,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,wDAAwD;IACxD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC;CAC/B;AAED,iFAAiF;AACjF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,oEAAoE;AACpE,eAAO,MAAM,qBAAqB,cAAc,CAAC;AAEjD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAwF/D;AAID,6EAA6E;AAC7E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEnD"}

package/dist/compose.js

@@ -2,9 +2,9 @@
 /**
  * P14 — production docker-compose.yml generator.
  *
- * Emits the production stack: Postgres + Caddy + the two Caelo services
- * (admin, gateway). Idempotent: same input →
- * byte-identical output. The CLI's `init` / `up` / `upgrade` sub-commands
+ * Emits the production stack: Postgres + Caddy + the Caelo services
+ * (admin, gateway and — #1328 — the MCP-Auth-Proxy). Idempotent: same
+ * input → byte-identical output. The CLI's `init` / `up` / `upgrade` sub-commands
  * write this to `.caelo/docker-compose.yml`.
  *
  * #696 — the admin and gateway run the PREBUILT, cosign-verified release
@@ -25,10 +25,11 @@
  * and its `minio/minio` image is no longer published, so the service made
  * every fresh `docker compose up` fail.
  */
-import { CADDY_REDIRECTS_FILE } from "@caelo-cms/shared";
+import { CADDY_REDIRECTS_FILE, SELF_HOSTED_CA_FILE, verifyFullQuery } from "@caelo-cms/shared";
 import { caddyRedirectReloadCommand } from "./caddy-redirects.js";
 import { DEFAULT_MAX_CONNECTIONS, stackPoolBudget } from "./pool-budget-stack.js";
-import { ADMIN_MEMORY_DEFAULT, GATEWAY_TRUSTED_PROXY_HOPS, memoryQuantityMiB, publicSiteUrl, TRUSTED_PROXY_HOPS_ENV, } from "./stack-contract.js";
+import { SELF_HOSTED_DB_HOST, SELF_HOSTED_TLS_DIR, SELF_HOSTED_TLS_FILES, } from "./self-hosted-db-tls.js";
+import { ADMIN_MEMORY_DEFAULT, GATEWAY_TRUSTED_PROXY_HOPS, MCP_AUTH_PROXY_TRUSTED_PROXY_HOPS, memoryQuantityMiB, publicSiteUrl, REMOTE_MCP_MODE, REMOTE_MCP_MODE_ENV, TRUSTED_PROXY_HOPS_ENV, } from "./stack-contract.js";
 import { ghcrRepository, isImageDigest } from "./upgrade/release-images.js";
 /** The admin's HTTP port inside the Compose network (the Caddyfile proxies to it). */
 export const COMPOSE_ADMIN_PORT = 5173;
@@ -68,11 +69,18 @@ export const MEDIA_DIR = "media";
 export const MEDIA_ROOT = "/data/media";
 /** The gateway's HTTP port inside the Compose network. */
 export const COMPOSE_GATEWAY_PORT = 8090;
+/** #1328 — the MCP-Auth-Proxy's HTTP port inside the Compose network. */
+export const COMPOSE_MCP_AUTH_PROXY_PORT = 8095;
+/** #1328 — the Compose service name of the MCP-Auth-Proxy. */
+export const COMPOSE_MCP_AUTH_PROXY_SERVICE = "caelo-mcp-auth-proxy";
 /**
- * The Compose services that run Caelo code — what `restore` stops while it
- * rewrites the databases, and what the health checks probe. Workers run
- * inside the admin (CLAUDE.md §11.B Tier 5); there is no orchestrator or
- * runner service.
+ * The Compose services that touch the databases — what `backup` and
+ * `restore` stop while they read or rewrite them. Workers run inside the
+ * admin (CLAUDE.md §11.B Tier 5); there is no orchestrator or runner
+ * service. The MCP-Auth-Proxy (#1328) is deliberately not here: it holds no
+ * database login, so it keeps running, and a release from before it has no
+ * such service for `up` to start. Its health is checked wherever the
+ * install starts (self-hosted-start.ts) or rolls (self-hosted-upgrade.ts).
  */
 export const COMPOSE_APP_SERVICES = ["caelo-admin", "caelo-gateway"];
 /**
@@ -82,6 +90,7 @@ export const COMPOSE_APP_SERVICES = ["caelo-admin", "caelo-gateway"];
  */
 export const COMPOSE_ADMIN_UPSTREAM = `caelo-admin:${COMPOSE_ADMIN_PORT}`;
 export const COMPOSE_GATEWAY_UPSTREAM = `caelo-gateway:${COMPOSE_GATEWAY_PORT}`;
+export const COMPOSE_MCP_AUTH_PROXY_UPSTREAM = `${COMPOSE_MCP_AUTH_PROXY_SERVICE}:${COMPOSE_MCP_AUTH_PROXY_PORT}`;
 /**
  * The Caddy image, pinned to the release the generated Caddyfile is
  * validated against (caddy-validate.test.ts runs `caddy validate` on this
@@ -161,6 +170,9 @@ export function generateDockerCompose(spec) {
     if (spec.internalSecret.length < 32) {
         throw new Error("internalSecret is shorter than 32 characters (.caelo/internal-secret.json)");
     }
+    if (!/^[0-9a-f]{64}$/.test(spec.dbTlsServerCertSha256)) {
+        throw new Error("dbTlsServerCertSha256 is not a SHA-256 hex digest of .caelo/postgres-tls/server.crt");
+    }
     return `# SPDX-License-Identifier: MPL-2.0
 # Generated by cms-provision — do not edit; re-run \`bunx cms-provision up\`.
 # Domain: ${spec.domain}
@@ -168,10 +180,16 @@ export function generateDockerCompose(spec) {
 name: ${spec.project}
 
 services:
-  postgres:
+  ${SELF_HOSTED_DB_HOST}:
     image: postgres:16-alpine
-    # The pool budget (COMPOSE_POOL_BUDGET) is computed from this number.
-    command: ["postgres", "-c", "max_connections=${DEFAULT_MAX_CONNECTIONS["self-hosted"]}"]
+    # #1338 — TLS with the install's own certificate for the host name
+    # \`${SELF_HOSTED_DB_HOST}\` (self-hosted-db-tls.ts); every client connects with
+    # verify-full. Postgres refuses a key file it does not own, and a bind
+    # mount keeps the host's owner, so the entrypoint copies the pair to a
+    # container-local path owned by postgres first.
+    entrypoint: ${POSTGRES_TLS_ENTRYPOINT}
+    # The pool budget (COMPOSE_POOL_BUDGET) is computed from max_connections.
+    command: ["postgres", "-c", "max_connections=${DEFAULT_MAX_CONNECTIONS["self-hosted"]}", "-c", "ssl=on", "-c", "ssl_cert_file=${POSTGRES_TLS_RUNTIME_DIR}/server.crt", "-c", "ssl_key_file=${POSTGRES_TLS_RUNTIME_DIR}/server.key", "-c", "ssl_min_protocol_version=TLSv1.2"]
     restart: unless-stopped
     environment:
       POSTGRES_PASSWORD: "${escapeYaml(spec.postgresPassword)}"
@@ -179,9 +197,13 @@ services:
       POSTGRES_DB: caelo
       ADMIN_ROLE_PASSWORD: "${escapeYaml(spec.rolePasswords.admin)}"
       PUBLIC_ROLE_PASSWORD: "${escapeYaml(spec.rolePasswords.public)}"
+      # Recreates Postgres when its certificate is renewed (see the spec).
+      CAELO_DB_TLS_SERVER_CERT_SHA256: "${spec.dbTlsServerCertSha256}"
 ${postgresAgent(spec.agent)}    volumes:
       - caelo-pg:/var/lib/postgresql/data
       - ./bootstrap.sh:/docker-entrypoint-initdb.d/00_bootstrap.sh:ro
+      - ./${SELF_HOSTED_TLS_DIR}/${SELF_HOSTED_TLS_FILES.serverCert}:${POSTGRES_TLS_MOUNT_DIR}/server.crt:ro
+      - ./${SELF_HOSTED_TLS_DIR}/${SELF_HOSTED_TLS_FILES.serverKey}:${POSTGRES_TLS_MOUNT_DIR}/server.key:ro
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U caelo"]
       interval: 10s
@@ -204,7 +226,7 @@ ${postgresAgent(spec.agent)}    volumes:
 ${adminService(spec, adminMemoryMiB, env)}
 
 ${gatewayService(spec)}
-
+${mcpAuthProxyService(spec.images)}
 volumes:
   caelo-pg:
   caelo-caddy-data:
@@ -246,9 +268,10 @@ function serviceRuntime(images, service, devCommand, mounts = []) {
             ...volumes(["../..:/app", ...mounts]),
         ].join("\n");
     }
-    const digest = ghcrImageDigest(service, images[service]);
+    const ref = images[service] ?? "";
+    const digest = ghcrImageDigest(service, ref);
     if (!digest) {
-        throw new Error(`${service} image ${JSON.stringify(images[service])} is not ${ghcrRepository(service)}@sha256:<digest>`);
+        throw new Error(`${service} image ${JSON.stringify(ref)} is not ${ghcrRepository(service)}@sha256:<digest>`);
     }
     // The image's own CMD starts the service; no source is mounted.
     return [`    image: ${ghcrImageRef(service, digest)}`, ...volumes(mounts)].join("\n");
@@ -269,6 +292,7 @@ ${serviceRuntime(spec.images, "admin", `sh -c "cd apps/admin && bunx svelte-kit
         `./${BOOTSTRAP_DIR}:/app/.caelo`,
         `./output:${SITE_OUTPUT_ROOT}`,
         `./${MEDIA_DIR}:${MEDIA_ROOT}`,
+        DATABASE_CA_MOUNT,
     ])}
     restart: unless-stopped
     depends_on:
@@ -291,7 +315,7 @@ ${env("RESEND_API_KEY", spec.resendApiKey)}`;
 }
 function gatewayService(spec) {
     return `  caelo-gateway:
-${serviceRuntime(spec.images, "gateway", "bun run apps/api-gateway/src/server.ts")}
+${serviceRuntime(spec.images, "gateway", "bun run apps/api-gateway/src/server.ts", [DATABASE_CA_MOUNT])}
     restart: unless-stopped
     depends_on:
       postgres: { condition: service_healthy }
@@ -303,17 +327,65 @@ ${serviceRuntime(spec.images, "gateway", "bun run apps/api-gateway/src/server.ts
       # Caddy is the one proxy in front (client-ip.ts in the gateway).
       ${TRUSTED_PROXY_HOPS_ENV}: "${GATEWAY_TRUSTED_PROXY_HOPS["self-hosted"]}"
 ${poolEnvLines("gateway")}
-      # #806 — no remote MCP here: it rides Google IAP, which this install
-      # does not have. CAELO_ADMIN_URL / CAELO_MCP_PUBLIC_URL /
-      # CAELO_OPERATOR_OAUTH_CLIENT_FILE stay unset, so the gateway's /api/mcp/*
-      # answers 503 remote_mcp_not_configured and Settings → MCP says
-      # "not available on this install".
       NODE_ENV: production`;
 }
-/** A compose-network database URL, password URL-encoded and YAML-escaped. */
+/**
+ * #1328 — the MCP-Auth-Proxy: remote MCP's sign-in broker, its own
+ * container so it never shares a process with visitor handlers. Remote MCP
+ * needs the admin behind Google IAP, which a Compose install does not have,
+ * so it runs with `CAELO_REMOTE_MCP=unavailable` and answers every request
+ * but its health check with one fixed 404 (E14 a of #763: the service
+ * exists on every provider, its attack surface one branch). Caddy serves it
+ * on its own host (`mcp.<domain>`, caddy.ts), never on the site's origin.
+ *
+ * It gets no database URL, no secret and no mount: there is nothing it
+ * could read. The container is locked down on top — read-only root
+ * filesystem, every capability dropped, no privilege escalation — because
+ * it is the Caelo service that holds operators' Google tokens wherever
+ * remote MCP runs. Empty for a release recorded before the proxy shipped
+ * ({@link ReleaseImages}).
+ */
+function mcpAuthProxyService(images) {
+    if (images.mode === "release" && images["mcp-auth-proxy"] === undefined)
+        return "";
+    return `
+  ${COMPOSE_MCP_AUTH_PROXY_SERVICE}:
+${serviceRuntime(images, "mcp-auth-proxy", "bun run apps/mcp-auth-proxy/src/server.ts")}
+    restart: unless-stopped
+    read_only: true
+    tmpfs: ["/tmp"]
+    cap_drop: ["ALL"]
+    security_opt: ["no-new-privileges:true"]
+    environment:
+      CAELO_PROVIDER: "self-hosted"
+      ${REMOTE_MCP_MODE_ENV}: "${REMOTE_MCP_MODE["self-hosted"]}"
+      MCP_AUTH_PROXY_PORT: "${COMPOSE_MCP_AUTH_PROXY_PORT}"
+      # Caddy is the one proxy in front (@caelo-cms/shared client-address.ts).
+      ${TRUSTED_PROXY_HOPS_ENV}: "${MCP_AUTH_PROXY_TRUSTED_PROXY_HOPS["self-hosted"]}"
+      NODE_ENV: production
+`;
+}
+/**
+ * A compose-network database URL, password URL-encoded and YAML-escaped.
+ * #1338 — verify-full against the install's own CA (self-hosted-db-tls.ts),
+ * mounted at shared `SELF_HOSTED_CA_FILE` ({@link DATABASE_CA_MOUNT}).
+ */
 function dbUrl(role, password, database) {
-    return escapeYaml(`postgres://${role}:${encodeURIComponent(password)}@postgres:5432/${database}`);
+    return escapeYaml(`postgres://${role}:${encodeURIComponent(password)}@${SELF_HOSTED_DB_HOST}:5432/${database}?${verifyFullQuery(SELF_HOSTED_CA_FILE)}`);
 }
+/** Where the server certificate + key are bind-mounted into Postgres (host-owned). */
+const POSTGRES_TLS_MOUNT_DIR = "/caelo-tls";
+/** Where the entrypoint copies them, owned by postgres (Postgres refuses others' keys). */
+const POSTGRES_TLS_RUNTIME_DIR = "/var/lib/postgresql/caelo-tls";
+/** The Postgres entrypoint: copy the TLS pair into place, then the image's own entrypoint. */
+const POSTGRES_TLS_ENTRYPOINT = JSON.stringify([
+    "/bin/sh",
+    "-c",
+    `install -d -o postgres -g postgres -m 0700 ${POSTGRES_TLS_RUNTIME_DIR} && install -o postgres -g postgres -m 0644 ${POSTGRES_TLS_MOUNT_DIR}/server.crt ${POSTGRES_TLS_RUNTIME_DIR}/server.crt && install -o postgres -g postgres -m 0600 ${POSTGRES_TLS_MOUNT_DIR}/server.key ${POSTGRES_TLS_RUNTIME_DIR}/server.key && exec docker-entrypoint.sh "$$@"`,
+    "--",
+]);
+/** The install's database CA, read-only, where every verify-full URL names it. */
+const DATABASE_CA_MOUNT = `./${SELF_HOSTED_TLS_DIR}/${SELF_HOSTED_TLS_FILES.caCert}:${SELF_HOSTED_CA_FILE}:ro`;
 function escapeYaml(s) {
     // Conservative escape for double-quoted YAML strings.
     return s.replace(/\\/g, "\\\\").replace(/"/g, '\\"');

package/dist/compose.js.map

@@ -1 +1 @@
-{"version":3,"file":"compose.js","sourceRoot":"","sources":["../src/compose.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAClF,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,iBAAiB,EACjB,aAAa,EACb,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,aAAa,EAAuB,MAAM,6BAA6B,CAAC;AAoBjG,sFAAsF;AACtF,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEvC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAAC,aAAa,EAAE;IAChE,cAAc,EAAE,uBAAuB,CAAC,aAAa,CAAC;IACtD,iBAAiB,EAAE,CAAC;IACpB,mBAAmB,EAAE,CAAC;CACvB,CAAC,CAAC;AAEH,sEAAsE;AACtE,SAAS,YAAY,CAAC,OAA4B;IAChD,OAAO,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjG,CAAC;AACD,mFAAmF;AACnF,MAAM,CAAC,MAAM,aAAa,GAAG,WAAW,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAE7C;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,gBAAgB,qBAAqB,oBAAoB,EAAE,CAAC;AAExG,wFAAwF;AACxF,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC;AACjC,qFAAqF;AACrF,MAAM,CAAC,MAAM,UAAU,GAAG,aAAa,CAAC;AAExC,0DAA0D;AAC1D,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,aAAa,EAAE,eAAe,CAAU,CAAC;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,eAAe,kBAAkB,EAAE,CAAC;AAC1E,MAAM,CAAC,MAAM,wBAAwB,GAAG,iBAAiB,oBAAoB,EAAE,CAAC;AAEhF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,qBAAqB,CAAC;AAQjD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,OAAO,SAAS,MAAM;SACnB,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC;AAC/B,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,SAAiB;IACjE,OAAO,SAAS,KAAK,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;AAC7F,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,OAAuB,EAAE,MAAc;IAClE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9F,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,MAAM,EAAE,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,OAAuB,EAAE,GAAW;IAClE,MAAM,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC;IAC7C,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAmED,oEAAoE;AACpE,MAAM,CAAC,MAAM,qBAAqB,GAAG,WAAW,CAAC;AAEjD,MAAM,UAAU,qBAAqB,CAAC,IAAiB;IACrD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,oBAAoB,CAAC;IAC7D,MAAM,cAAc,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IACtD,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,gBAAgB,WAAW,uCAAuC,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,CAAqB,EAAU,EAAE,CACvD,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,oBAAoB,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,KAAK,CAAC,MAAM,2CAA2C,CAAC,CAAC;IAChG,CAAC;IACD,mFAAmF;IACnF,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,CAAC;IACD,OAAO;;YAEG,IAAI,CAAC,MAAM;;QAEf,IAAI,CAAC,OAAO;;;;;;mDAM+B,uBAAuB,CAAC,aAAa,CAAC;;;4BAG7D,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC;;;8BAG/B,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;+BACnC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;EAClE,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;aAUd,WAAW;;;MAGlB,0BAA0B,CAAC,yBAAyB,CAAC;;eAE5C,IAAI,CAAC,KAAK,CAAC,IAAI,UAAU,IAAI,CAAC,KAAK,CAAC,KAAK;;;;;mBAKrC,gBAAgB;;EAEjC,YAAY,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,CAAC;;EAEvC,cAAc,CAAC,IAAI,CAAC;;;;;;CAMrB,CAAC;AACF,CAAC;AAID,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,KAA+B;IACpD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,OAAO;QACL,+BAA+B,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG;QAC9D,mEAAmE;QACnE,gBAAgB,qBAAqB,IAAI,KAAK,CAAC,MAAM,SAAS;QAC9D,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CACrB,MAAqB,EACrB,OAAuB,EACvB,UAAkB,EAClB,SAA4B,EAAE;IAE9B,MAAM,OAAO,GAAG,CAAC,IAAuB,EAAE,EAAE,CAC1C,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAChF,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC1B,OAAO;YACL,yEAAyE;YACzE,4EAA4E;YAC5E,2BAA2B;YAC3B,uBAAuB;YACvB,gBAAgB,UAAU,EAAE;YAC5B,GAAG,OAAO,CAAC,CAAC,YAAY,EAAE,GAAG,MAAM,CAAC,CAAC;SACtC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,UAAU,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,cAAc,CAAC,OAAO,CAAC,kBAAkB,CACxG,CAAC;IACJ,CAAC;IACD,gEAAgE;IAChE,OAAO,CAAC,cAAc,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxF,CAAC;AAED,SAAS,YAAY,CAAC,IAAiB,EAAE,cAAsB,EAAE,GAAY;IAC3E,OAAO;EACP,cAAc,CACd,IAAI,CAAC,MAAM,EACX,OAAO,EACP,4FAA4F,kBAAkB,GAAG;IACjH,gEAAgE;IAChE,0EAA0E;IAC1E,wEAAwE;IACxE,wEAAwE;IACxE,8DAA8D;IAC9D,uEAAuE;IACvE,sEAAsE;IACtE,sDAAsD;IACtD,oEAAoE;IACpE;QACE,KAAK,aAAa,cAAc;QAChC,YAAY,gBAAgB,EAAE;QAC9B,KAAK,SAAS,IAAI,UAAU,EAAE;KAC/B,CACF;;;;uBAIsB,cAAc;;6BAER,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,WAAW,CAAC;oCACnD,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,YAAY,CAAC;2BACpE,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC;gCAC1B,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC;yBACtC,UAAU,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;eACtE,kBAAkB;4BACL,gBAAgB;yBACnB,UAAU;;EAEjC,YAAY,CAAC,OAAO,CAAC;;EAErB,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,eAAe,CAAC;EAC9C,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,cAAc,CAAC,IAAiB;IACvC,OAAO;EACP,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,wCAAwC,CAAC;;;;;;;8BAOpD,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,YAAY,CAAC;uBACpE,oBAAoB;;QAEnC,sBAAsB,MAAM,0BAA0B,CAAC,aAAa,CAAC;EAC3E,YAAY,CAAC,SAAS,CAAC;;;;;;2BAME,CAAC;AAC5B,CAAC;AAED,6EAA6E;AAC7E,SAAS,KAAK,CAAC,IAAY,EAAE,QAAgB,EAAE,QAAgB;IAC7D,OAAO,UAAU,CAAC,cAAc,IAAI,IAAI,kBAAkB,CAAC,QAAQ,CAAC,kBAAkB,QAAQ,EAAE,CAAC,CAAC;AACpG,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,sDAAsD;IACtD,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACvD,CAAC"}
+{"version":3,"file":"compose.js","sourceRoot":"","sources":["../src/compose.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAC/F,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAClF,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,iCAAiC,EACjC,iBAAiB,EACjB,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,aAAa,EAAuB,MAAM,6BAA6B,CAAC;AA0BjG,sFAAsF;AACtF,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEvC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAAC,aAAa,EAAE;IAChE,cAAc,EAAE,uBAAuB,CAAC,aAAa,CAAC;IACtD,iBAAiB,EAAE,CAAC;IACpB,mBAAmB,EAAE,CAAC;CACvB,CAAC,CAAC;AAEH,sEAAsE;AACtE,SAAS,YAAY,CAAC,OAA4B;IAChD,OAAO,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjG,CAAC;AACD,mFAAmF;AACnF,MAAM,CAAC,MAAM,aAAa,GAAG,WAAW,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAE7C;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,gBAAgB,qBAAqB,oBAAoB,EAAE,CAAC;AAExG,wFAAwF;AACxF,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC;AACjC,qFAAqF;AACrF,MAAM,CAAC,MAAM,UAAU,GAAG,aAAa,CAAC;AAExC,0DAA0D;AAC1D,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAEzC,yEAAyE;AACzE,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC;AAEhD,8DAA8D;AAC9D,MAAM,CAAC,MAAM,8BAA8B,GAAG,sBAAsB,CAAC;AAErE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,aAAa,EAAE,eAAe,CAAU,CAAC;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,eAAe,kBAAkB,EAAE,CAAC;AAC1E,MAAM,CAAC,MAAM,wBAAwB,GAAG,iBAAiB,oBAAoB,EAAE,CAAC;AAChF,MAAM,CAAC,MAAM,+BAA+B,GAAG,GAAG,8BAA8B,IAAI,2BAA2B,EAAE,CAAC;AAElH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,qBAAqB,CAAC;AAQjD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,OAAO,SAAS,MAAM;SACnB,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC;AAC/B,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,SAAiB;IACjE,OAAO,SAAS,KAAK,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;AAC7F,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,OAAuB,EAAE,MAAc;IAClE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9F,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,MAAM,EAAE,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,OAAuB,EAAE,GAAW;IAClE,MAAM,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC;IAC7C,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AA4ED,oEAAoE;AACpE,MAAM,CAAC,MAAM,qBAAqB,GAAG,WAAW,CAAC;AAEjD,MAAM,UAAU,qBAAqB,CAAC,IAAiB;IACrD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,oBAAoB,CAAC;IAC7D,MAAM,cAAc,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IACtD,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,gBAAgB,WAAW,uCAAuC,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,CAAqB,EAAU,EAAE,CACvD,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,oBAAoB,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,KAAK,CAAC,MAAM,2CAA2C,CAAC,CAAC;IAChG,CAAC;IACD,mFAAmF;IACnF,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACD,OAAO;;YAEG,IAAI,CAAC,MAAM;;QAEf,IAAI,CAAC,OAAO;;;IAGhB,mBAAmB;;;UAGb,mBAAmB;;;;kBAIX,uBAAuB;;mDAEU,uBAAuB,CAAC,aAAa,CAAC,2CAA2C,wBAAwB,qCAAqC,wBAAwB;;;4BAG7L,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC;;;8BAG/B,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;+BACnC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;;0CAE1B,IAAI,CAAC,qBAAqB;EAClE,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;;;YAGf,mBAAmB,IAAI,qBAAqB,CAAC,UAAU,IAAI,sBAAsB;YACjF,mBAAmB,IAAI,qBAAqB,CAAC,SAAS,IAAI,sBAAsB;;;;;;;;aAQ/E,WAAW;;;MAGlB,0BAA0B,CAAC,yBAAyB,CAAC;;eAE5C,IAAI,CAAC,KAAK,CAAC,IAAI,UAAU,IAAI,CAAC,KAAK,CAAC,KAAK;;;;;mBAKrC,gBAAgB;;EAEjC,YAAY,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,CAAC;;EAEvC,cAAc,CAAC,IAAI,CAAC;EACpB,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC;;;;;CAKjC,CAAC;AACF,CAAC;AAID,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,KAA+B;IACpD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,OAAO;QACL,+BAA+B,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG;QAC9D,mEAAmE;QACnE,gBAAgB,qBAAqB,IAAI,KAAK,CAAC,MAAM,SAAS;QAC9D,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CACrB,MAAqB,EACrB,OAAuB,EACvB,UAAkB,EAClB,SAA4B,EAAE;IAE9B,MAAM,OAAO,GAAG,CAAC,IAAuB,EAAE,EAAE,CAC1C,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAChF,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC1B,OAAO;YACL,yEAAyE;YACzE,4EAA4E;YAC5E,2BAA2B;YAC3B,uBAAuB;YACvB,gBAAgB,UAAU,EAAE;YAC5B,GAAG,OAAO,CAAC,CAAC,YAAY,EAAE,GAAG,MAAM,CAAC,CAAC;SACtC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,UAAU,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,cAAc,CAAC,OAAO,CAAC,kBAAkB,CAC5F,CAAC;IACJ,CAAC;IACD,gEAAgE;IAChE,OAAO,CAAC,cAAc,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxF,CAAC;AAED,SAAS,YAAY,CAAC,IAAiB,EAAE,cAAsB,EAAE,GAAY;IAC3E,OAAO;EACP,cAAc,CACd,IAAI,CAAC,MAAM,EACX,OAAO,EACP,4FAA4F,kBAAkB,GAAG;IACjH,gEAAgE;IAChE,0EAA0E;IAC1E,wEAAwE;IACxE,wEAAwE;IACxE,8DAA8D;IAC9D,uEAAuE;IACvE,sEAAsE;IACtE,sDAAsD;IACtD,oEAAoE;IACpE;QACE,KAAK,aAAa,cAAc;QAChC,YAAY,gBAAgB,EAAE;QAC9B,KAAK,SAAS,IAAI,UAAU,EAAE;QAC9B,iBAAiB;KAClB,CACF;;;;uBAIsB,cAAc;;6BAER,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,WAAW,CAAC;oCACnD,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,YAAY,CAAC;2BACpE,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC;gCAC1B,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC;yBACtC,UAAU,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;eACtE,kBAAkB;4BACL,gBAAgB;yBACnB,UAAU;;EAEjC,YAAY,CAAC,OAAO,CAAC;;EAErB,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,eAAe,CAAC;EAC9C,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,cAAc,CAAC,IAAiB;IACvC,OAAO;EACP,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,wCAAwC,EAAE,CAAC,iBAAiB,CAAC,CAAC;;;;;;;8BAOzE,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,YAAY,CAAC;uBACpE,oBAAoB;;QAEnC,sBAAsB,MAAM,0BAA0B,CAAC,aAAa,CAAC;EAC3E,YAAY,CAAC,SAAS,CAAC;2BACE,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,mBAAmB,CAAC,MAAqB;IAChD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,gBAAgB,CAAC,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnF,OAAO;IACL,8BAA8B;EAChC,cAAc,CAAC,MAAM,EAAE,gBAAgB,EAAE,2CAA2C,CAAC;;;;;;;;QAQ/E,mBAAmB,MAAM,eAAe,CAAC,aAAa,CAAC;8BACjC,2BAA2B;;QAEjD,sBAAsB,MAAM,iCAAiC,CAAC,aAAa,CAAC;;CAEnF,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,SAAS,KAAK,CAAC,IAAY,EAAE,QAAgB,EAAE,QAAgB;IAC7D,OAAO,UAAU,CACf,cAAc,IAAI,IAAI,kBAAkB,CAAC,QAAQ,CAAC,IAAI,mBAAmB,SAAS,QAAQ,IAAI,eAAe,CAAC,mBAAmB,CAAC,EAAE,CACrI,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,MAAM,sBAAsB,GAAG,YAAY,CAAC;AAC5C,2FAA2F;AAC3F,MAAM,wBAAwB,GAAG,+BAA+B,CAAC;AACjE,8FAA8F;AAC9F,MAAM,uBAAuB,GAAG,IAAI,CAAC,SAAS,CAAC;IAC7C,SAAS;IACT,IAAI;IACJ,8CAA8C,wBAAwB,+CAA+C,sBAAsB,eAAe,wBAAwB,0DAA0D,sBAAsB,eAAe,wBAAwB,gDAAgD;IACzV,IAAI;CACL,CAAC,CAAC;AACH,kFAAkF;AAClF,MAAM,iBAAiB,GAAG,KAAK,mBAAmB,IAAI,qBAAqB,CAAC,MAAM,IAAI,mBAAmB,KAAK,CAAC;AAE/G,SAAS,UAAU,CAAC,CAAS;IAC3B,sDAAsD;IACtD,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACvD,CAAC"}