@caelo-cms/provisioning 0.11.9 → 0.11.11

package/dist/runtime-secrets.js

@@ -4,7 +4,8 @@
  * Pulumi) creates and maintains, through gcloud:
  *
  *   - {@link ensureGatewayServiceAccount}: the gateway's own run SA, so it
- *     can be granted only the secrets the gateway reads.
+ *     can be granted only the secrets the gateway reads; the same for the
+ *     MCP-Auth-Proxy ({@link ensureMcpAuthProxyServiceAccount}, #1328).
  *   - {@link ensureGeneratedSecrets}: the secrets in
  *     `CLI_GENERATED_SECRETS` (stack-contract.ts). The wizard runs it before
  *     `pulumi up`, upgrade on every roll, so installs that predate a secret
@@ -21,8 +22,8 @@
 import { randomBytes } from "node:crypto";
 import { gcloud as defaultGcloud } from "./gcloud.js";
 import { realSleep, runWithRetry } from "./gcloud-retry.js";
-import { gatewayServiceAccountEmail, gatewayServiceAccountId, gcpSecretId } from "./gcp-names.js";
-import { CLI_GENERATED_SECRETS, DATABASE_ROLE_SECRET, GENERATED_SECRET_FORMAT, SERVICE_SECRET_ENV, serviceSecrets, } from "./stack-contract.js";
+import { gatewayServiceAccountEmail, gatewayServiceAccountId, gcpSecretId, mcpAuthProxyServiceAccountEmail, mcpAuthProxyServiceAccountId, } from "./gcp-names.js";
+import { CLI_GENERATED_SECRETS, CLOUD_RUN_SLUGS, DATABASE_ROLE_SECRET, GENERATED_SECRET_FORMAT, SERVICE_SECRET_ENV, serviceSecrets, } from "./stack-contract.js";
 import { liveContainerEnv } from "./stack-converge.js";
 /** 32 random bytes as hex — the shape of every secret the stacks generate. */
 export function generateSecretValue() {
@@ -50,11 +51,21 @@ const ALREADY_EXISTS = /ALREADY_EXISTS|already exists/i;
 // Gateway service account
 // ===========================================================================
 /** Create the gateway's run SA unless it exists. */
-export async function ensureGatewayServiceAccount(install, deps = {}) {
+export function ensureGatewayServiceAccount(install, deps = {}) {
+    return ensureServiceAccount(install.projectId, gatewayServiceAccountId(install.env), gatewayServiceAccountEmail(install.projectId, install.env), `Caelo ${install.env} gateway`, deps);
+}
+/**
+ * #1328 — create the MCP-Auth-Proxy's run SA unless it exists. It gets no
+ * role here or anywhere: only `secretAccessor` on its two secrets
+ * (stack-contract.ts runtimeSecretBindings).
+ */
+export function ensureMcpAuthProxyServiceAccount(install, deps = {}) {
+    return ensureServiceAccount(install.projectId, mcpAuthProxyServiceAccountId(install.env), mcpAuthProxyServiceAccountEmail(install.projectId, install.env), `Caelo ${install.env} MCP-Auth-Proxy`, deps);
+}
+async function ensureServiceAccount(projectId, accountId, email, displayName, deps) {
     const run = deps.run ?? defaultGcloud;
-    const email = gatewayServiceAccountEmail(install.projectId, install.env);
     const id = `service account ${email}`;
-    const project = `--project=${install.projectId}`;
+    const project = `--project=${projectId}`;
     const describe = await run([
         "iam",
         "service-accounts",
@@ -72,9 +83,9 @@ export async function ensureGatewayServiceAccount(install, deps = {}) {
         "iam",
         "service-accounts",
         "create",
-        gatewayServiceAccountId(install.env),
+        accountId,
         project,
-        `--display-name=Caelo ${install.env} gateway`,
+        `--display-name=${displayName}`,
         "--quiet",
     ]);
     if (create.ok || ALREADY_EXISTS.test(create.stderr))
@@ -343,7 +354,7 @@ async function checkRotationReaders(run, target, secret) {
     const secretId = gcpSecretId(target.env, secret);
     const isSecret = (live) => live?.kind === "secret" &&
         (live.secret === secretId || (live.secret?.endsWith(`/secrets/${secretId}`) ?? false));
-    for (const service of ["admin", "gateway"]) {
+    for (const service of CLOUD_RUN_SLUGS) {
         const vars = Object.entries(SERVICE_SECRET_ENV[service])
             .filter(([, s]) => s === secret)
             .map(([name]) => name);
@@ -390,7 +401,13 @@ const SQL_OPERATION_POLLS = 60;
  * prompt, so it is not used. The bearer token comes from the operator's
  * gcloud session, like every other call here.
  */
-async function setSqlUserPassword(run, http, sleep, user) {
+async function setSqlUserPassword(run, http, sleep, user, 
+/**
+ * `update` sets an existing user's password (`users.update`); `create`
+ * adds the user with it (`users.insert`, #1329: the staging gateway's
+ * login on an install from before it).
+ */
+mode) {
     const token = await run(["auth", "print-access-token"]);
     const bearer = token.ok ? token.stdout.trim() : "";
     if (!bearer) {
@@ -405,9 +422,17 @@ async function setSqlUserPassword(run, http, sleep, user) {
         ok: false,
         error: `${what}: HTTP ${res.status} ${(await res.text()).slice(0, 500)}`,
     });
-    const put = await http(`${project}/instances/${encodeURIComponent(user.instance)}/users?name=${encodeURIComponent(user.role)}`, { method: "PUT", headers, body: JSON.stringify({ name: user.role, password: user.password }) });
+    const users = `${project}/instances/${encodeURIComponent(user.instance)}/users`;
+    const body = JSON.stringify({ name: user.role, password: user.password });
+    const put = mode === "update"
+        ? await http(`${users}?name=${encodeURIComponent(user.role)}`, {
+            method: "PUT",
+            headers,
+            body,
+        })
+        : await http(users, { method: "POST", headers, body });
     if (!put.ok)
-        return failed("update the user", put);
+        return failed(mode === "update" ? "update the user" : "create the user", put);
     let op = JSON.parse(await put.text());
     for (let i = 0; op.status !== "DONE" && i < SQL_OPERATION_POLLS; i++) {
         if (!op.name)
@@ -498,12 +523,7 @@ export async function rotateRuntimeSecret(target, secret, deps = {}) {
             return { ok: false, steps, error: `read the current password: ${current.stderr.trim()}` };
         }
         const previous = current.stdout;
-        const setPassword = (role, password) => setSqlUserPassword(run, http, sleep, {
-            projectId: target.projectId,
-            instance,
-            role,
-            password,
-        });
+        const setPassword = (role, password) => setSqlUserPassword(run, http, sleep, { projectId: target.projectId, instance, role, password }, "update");
         const changed = [];
         const restore = async () => {
             const failed = [];
@@ -544,7 +564,7 @@ export async function rotateRuntimeSecret(target, secret, deps = {}) {
     }
     steps.push(`added a new version to ${secretId}`);
     const failures = [];
-    for (const service of ["admin", "gateway"]) {
+    for (const service of CLOUD_RUN_SLUGS) {
         if (!serviceSecrets(service).includes(secret))
             continue;
         const name = target.services[service];
@@ -606,12 +626,7 @@ export async function ensureDatabaseRolePassword(target, role, deps = {}) {
             return { id, status: "failed", error: value.error };
         password = value.value;
     }
-    const set = await setSqlUserPassword(run, http, sleep, {
-        projectId: target.projectId,
-        instance: target.sqlInstance,
-        role,
-        password,
-    });
+    const set = await setSqlUserPassword(run, http, sleep, { projectId: target.projectId, instance: target.sqlInstance, role, password }, deps.create === true ? "create" : "update");
     return set.ok ? { id, status: "applied" } : { id, status: "failed", error: set.error };
 }
 //# sourceMappingURL=runtime-secrets.js.map

package/dist/runtime-secrets.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-secrets.js","sourceRoot":"","sources":["../src/runtime-secrets.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAqB,SAAS,EAAE,YAAY,EAAc,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EAAE,0BAA0B,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClG,OAAO,EACL,qBAAqB,EAErB,oBAAoB,EAEpB,uBAAuB,EAEvB,kBAAkB,EAClB,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AASvD,8EAA8E;AAC9E,MAAM,UAAU,mBAAmB;IACjC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAA4C,EAC5C,WAAyB,mBAAmB;IAE5C,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC7C,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,OAAO;YACV,OAAO,QAAQ,EAAE,CAAC;QACpB,KAAK,WAAW;YACd,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC5C,KAAK,aAAa;YAChB,OAAO,MAAM,CAAC,KAAK,CAAC;IACxB,CAAC;AACH,CAAC;AAUD,MAAM,SAAS,GAAG,qCAAqC,CAAC;AACxD,MAAM,cAAc,GAAG,gCAAgC,CAAC;AAExD,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E,oDAAoD;AACpD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAA6D,EAC7D,OAAoB,EAAE;IAEtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,0BAA0B,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACzE,MAAM,EAAE,GAAG,mBAAmB,KAAK,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,aAAa,OAAO,CAAC,SAAS,EAAE,CAAC;IACjD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;QACzB,KAAK;QACL,kBAAkB;QAClB,UAAU;QACV,KAAK;QACL,OAAO;QACP,uBAAuB;KACxB,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAClD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;IACjE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;QACvB,KAAK;QACL,kBAAkB;QAClB,QAAQ;QACR,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC;QACpC,OAAO;QACP,wBAAwB,OAAO,CAAC,GAAG,UAAU;QAC7C,SAAS;KACV,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,EAAE,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACtF,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;AAC/D,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAgF;IAEhF,MAAM,IAAI,GAAoE,EAAE,CAAC;IACjF,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QACtE,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,SAAS,IAAI,IAAI,EAAE,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;IACtF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAOD,mFAAmF;AACnF,MAAM,UAAU,sBAAsB,CACpC,IAAyB,EACzB,MAAc;IAEd,OAAO,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;AACjG,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAA6D,EAC7D,OAAoB,EAAE;IAEtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAC/D,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC;QAClB,SAAS;QACT,UAAU;QACV,QAAQ;QACR,aAAa,OAAO,CAAC,SAAS,EAAE;QAChC,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,QAAQ,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACnF,MAAM,WAAW,GACf,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAMpB,CAAC,WAAW,CAAC;IACd,IAAI,WAAW,EAAE,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC;IACpF,MAAM,SAAS,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,IAAI,EAAE,CAAC;SACzD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;SACtB,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,EAAE,CAAC;IACxE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,QAAQ,2CAA2C,EAAE,CAAC;AACtF,CAAC;AAED;;;;GAIG;AACH,MAAM,4BAA4B,GAAG,wBAAwB,CAAC;AAE9D,SAAS,eAAe,CAAC,WAA8B;IACrD,OAAO,WAAW,CAAC,IAAI,KAAK,WAAW;QACrC,CAAC,CAAC,CAAC,gCAAgC,CAAC;QACpC,CAAC,CAAC,CAAC,mCAAmC,EAAE,eAAe,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAKC,EACD,OAAoB,EAAE;IAEtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,2EAA2E;IAC3E,sEAAsE;IACtE,0EAA0E;IAC1E,yBAAyB;IACzB,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC;QACnB,SAAS;QACT,UAAU;QACV,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,mBAAmB,CAAC;QAC7C,aAAa,OAAO,CAAC,SAAS,EAAE;QAChC,sBAAsB;KACvB,CAAC,CAAC;IACH,MAAM,IAAI,GACR,CAAC,EAAE,CAAC,EAAE,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC;QACjC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE;QAClF,CAAC,CAAC,MAAM,qBAAqB,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,UAAU,GAAG,CAAC,WAA8B,EAAE,EAAE,CACpD,GAAG,CAAC;QACF,SAAS;QACT,QAAQ;QACR,OAAO,CAAC,QAAQ;QAChB,aAAa,OAAO,CAAC,SAAS,EAAE;QAChC,GAAG,eAAe,CAAC,WAAW,CAAC;QAC/B,SAAS;KACV,CAAC,CAAC;IACL,IAAI,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAChD,IACE,CAAC,MAAM,CAAC,EAAE;QACV,IAAI,CAAC,WAAW,CAAC,IAAI,KAAK,WAAW;QACrC,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAChD,CAAC;QACD,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,MAAM,CAAC,EAAE,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACzE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;AACrF,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAMC,EACD,OAAoB,EAAE;IAEtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,mBAAmB,CAAC;IACtD,MAAM,OAAO,GAAG,aAAa,OAAO,CAAC,SAAS,EAAE,CAAC;IACjD,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAsB,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;IAC1F,kEAAkE;IAClE,qDAAqD;IACrD,IAAI,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC;IAE5C,KAAK,MAAM,IAAI,IAAI,qBAAqB,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAChD,MAAM,EAAE,GAAG,UAAU,QAAQ,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAAC;QAC/F,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACvE,SAAS;QACX,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACzE,MAAM,UAAU,GAAG,CAAC,WAA8B,EAAE,EAAE,CACpD,GAAG,CACD;gBACE,SAAS;gBACT,QAAQ;gBACR,QAAQ;gBACR,OAAO;gBACP,GAAG,eAAe,CAAC,WAAW,CAAC;gBAC/B,eAAe;gBACf,SAAS;aACV,EACD,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;YACJ,IAAI,MAAM,GAAG,MAAM,UAAU,CAAC,iBAAiB,CAAC,CAAC;YACjD,IACE,CAAC,MAAM,CAAC,EAAE;gBACV,iBAAiB,CAAC,IAAI,KAAK,WAAW;gBACtC,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAChD,CAAC;gBACD,iBAAiB,GAAG,QAAQ,CAAC;gBAC7B,MAAM,GAAG,MAAM,UAAU,CAAC,iBAAiB,CAAC,CAAC;YAC/C,CAAC;YACD,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,QAAQ,CAAC,IAAI,CACX,iBAAiB,KAAK,OAAO,CAAC,WAAW;oBACvC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;oBAC3B,CAAC,CAAC;wBACE,EAAE;wBACF,MAAM,EAAE,SAAS;wBACjB,MAAM,EAAE,iBAAiB,OAAO,CAAC,MAAM,sFAAsF;qBAC9H,CACN,CAAC;gBACF,SAAS;YACX,CAAC;YACD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACrE,SAAS;YACX,CAAC;YACD,4DAA4D;QAC9D,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE;YAC9C,SAAS;YACT,UAAU;YACV,MAAM;YACN,QAAQ;YACR,OAAO;YACP,wBAAwB;YACxB,WAAW;YACX,sBAAsB;SACvB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACvE,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YACzC,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,UAAU,CAC1B,GAAG,EACH,QAAQ,EACR,OAAO,EACP,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAC3D,CAAC;QACF,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,GAAiB,EACjB,QAAgB,EAChB,OAAe,EACf,KAAa;IAEb,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,CAAC,EAAE;QACtF,KAAK,EAAE,KAAK;KACb,CAAC,CAAC;IACH,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;AACrE,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,8CAA8C;AAC9C,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,mBAAmB;IACnB,sBAAsB;IACtB,iBAAiB;IACjB,sBAAsB;IACtB,sEAAsE;IACtE,0DAA0D;IAC1D,qBAAqB;CACsB,CAAC;AAG9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,oBAA4C,CAAC;AAE5E;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAK,iBAAuC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,0EAA0E;IAC1E,IAAI,IAAI,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,IAAI,KAAK,uBAAuB,EAAE,CAAC;QACrC,OAAO,4MAA4M,CAAC;IACtN,CAAC;IACD,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,OAAO,wLAAwL,CAAC;IAClM,CAAC;IACD,OAAO,GAAG,IAAI,wDAAwD,CAAC,GAAG,iBAAiB,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AAC9H,CAAC;AAoBD,sFAAsF;AACtF,MAAM,UAAU,aAAa,CAAC,MAAqB;IACjD,OAAQ,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAqC;SAC7E,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC;SAC/B,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,oBAAoB,CACjC,GAAiB,EACjB,MAAsB,EACtB,MAAuB;IAEvB,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,CAAC,IAAmD,EAAE,EAAE,CACvE,IAAI,EAAE,IAAI,KAAK,QAAQ;QACvB,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,YAAY,QAAQ,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;IACzF,KAAK,MAAM,OAAO,IAAI,CAAC,OAAO,EAAE,SAAS,CAAU,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;aACrD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC;aAC/B,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;YACzB,KAAK;YACL,UAAU;YACV,UAAU;YACV,IAAI;YACJ,UAAU;YACV,MAAM,CAAC,MAAM;YACb,aAAa,MAAM,CAAC,SAAS,EAAE;YAC/B,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,YAAY,OAAO,KAAK,IAAI,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACpF,MAAM,GAAG,GAAG,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9C,qEAAqE;QACrE,uEAAuE;QACvE,mEAAmE;QACnE,qBAAqB;QACrB,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAClF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,OAAO,OAAO,KAAK,IAAI,iBAAiB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,QAAQ,qHAAqH,CAAC;QACxN,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACxB,OAAO,CACL,IAAI,EAAE,IAAI,KAAK,QAAQ;gBACvB,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,QAAQ,EAAE,CAAC,CAAC;gBAC3E,IAAI,CAAC,OAAO,KAAK,QAAQ,CAC1B,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,OAAO,OAAO,KAAK,IAAI,mBAAmB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,QAAQ,kLAAkL,CAAC;QACvQ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAQD,MAAM,SAAS,GAAG,oCAAoC,CAAC;AACvD,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B;;;;;;GAMG;AACH,KAAK,UAAU,kBAAkB,CAC/B,GAAiB,EACjB,IAAe,EACf,KAAY,EACZ,IAA6E;IAE7E,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,mCAAmC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,OAAO,EAAE;SAC3E,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;IAC1F,MAAM,OAAO,GAAG,GAAG,SAAS,aAAa,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;IAC9E,MAAM,MAAM,GAAG,KAAK,EAAE,IAAY,EAAE,GAAgD,EAAE,EAAE,CAAC,CAAC;QACxF,EAAE,EAAE,KAAc;QAClB,KAAK,EAAE,GAAG,IAAI,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;KACzE,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,MAAM,IAAI,CACpB,GAAG,OAAO,cAAc,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACvG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,CAC/F,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IAMnD,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAc,CAAC;IACnD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,GAAG,mBAAmB,EAAE,CAAC,EAAE,EAAE,CAAC;QACrE,IAAI,CAAC,EAAE,CAAC,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC;QAC1F,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;QACnB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,OAAO,eAAe,kBAAkB,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE;YAC9E,MAAM,EAAE,KAAK;YACb,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC,kBAAkB,EAAE,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;QAC/D,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAc,CAAC;IAClD,CAAC;IACD,IAAI,EAAE,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,IAAI,IAAI,GAAG,yBAAyB,EAAE,CAAC;IACpF,CAAC;IACD,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,kBAAkB;SAC7F,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,sFAAsF;AACtF,SAAS,QAAQ,CAAC,IAAY,EAAE,MAAc,EAAE,SAAiB;IAC/D,MAAM,QAAQ,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,SAAS,EAAE,CAAC,CAAC;IAChE,OAAO;QACL,sEAAsE;QACtE,2CAA2C;QAC3C;YACE,KAAK;YACL,UAAU;YACV,QAAQ;YACR,IAAI;YACJ,GAAG,QAAQ;YACX,wCAAwC,IAAI,CAAC,GAAG,EAAE,EAAE;YACpD,SAAS;SACV;QACD,CAAC,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,SAAS,CAAC;KACnF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAsB,EACtB,MAAuB,EACvB,OAAoD,EAAE;IAEtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAK,KAA8B,CAAC;IAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,mBAAmB,CAAC;IACtD,MAAM,OAAO,GAAG,aAAa,MAAM,CAAC,SAAS,EAAE,CAAC;IAChD,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACjE,IAAI,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAC3D,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IAEzB,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC;QAC7E,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC;QACpC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC;YACxB,SAAS;YACT,UAAU;YACV,QAAQ;YACR,QAAQ;YACR,YAAY,QAAQ,EAAE;YACtB,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QAC5F,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC;QAChC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,QAAgB,EAAE,EAAE,CACrD,kBAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE;YACnC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,QAAQ;YACR,IAAI;YACJ,QAAQ;SACT,CAAC,CAAC;QACL,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,KAAK,IAAqB,EAAE;YAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;gBAC3B,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE;oBAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjE,CAAC;YACD,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC;gBACxB,CAAC,CAAC,2DAA2D;gBAC7D,CAAC,CAAC,iBAAiB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,oEAAoE,QAAQ,UAAU,CAAC;QAC/H,CAAC,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACzC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBACV,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK;oBACL,KAAK,EAAE,WAAW,IAAI,cAAc,CAAC,CAAC,KAAK,GAAG,QAAQ,EAAE;iBACzD,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,KAAK,CAAC,IAAI,CAAC,uCAAuC,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5D,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK;gBACL,KAAK,EAAE,6BAA6B,QAAQ,KAAK,GAAG,CAAC,KAAK,KAAK,MAAM,OAAO,EAAE,EAAE;aACjF,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5D,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,QAAQ,KAAK,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;IAChG,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,0BAA0B,QAAQ,EAAE,CAAC,CAAC;IAEjD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,OAAO,IAAI,CAAC,OAAO,EAAE,SAAS,CAAU,EAAE,CAAC;QACpD,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,SAAS;QACxD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAyB,CAAC;QAC/F,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACrD,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,cAAc,OAAO,qBAAqB,CAAC,CAAC;YACvD,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,IAAI,CACX,YAAY,OAAO,KAAK,IAAI,yBAAyB,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,gCAAgC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAC3J,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK;YACL,KAAK,EAAE,0BAA0B,aAAa,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,EAAE,uGAAuG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACjO,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAcD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAiB,EACjB,OAA6D,EAC7D,MAAqB;IAErB,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC;QAClB,SAAS;QACT,UAAU;QACV,QAAQ;QACR,QAAQ;QACR,YAAY,QAAQ,EAAE;QACtB,aAAa,OAAO,CAAC,SAAS,EAAE;KACjC,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,QAAQ,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IAC/E,IAAI,CAAC,CAAC,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,QAAQ,8BAA8B,EAAE,CAAC;IACtF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACvC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAA0B,EAC1B,IAAkB,EAClB,OAAgF,EAAE;IAElF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAK,KAA8B,CAAC;IAC1D,MAAM,EAAE,GAAG,iBAAiB,IAAI,EAAE,CAAC;IACnC,IAAI,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC7B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7E,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACnE,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC;IACzB,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE;QACrD,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,QAAQ,EAAE,MAAM,CAAC,WAAW;QAC5B,IAAI;QACJ,QAAQ;KACT,CAAC,CAAC;IACH,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;AACzF,CAAC"}
+{"version":3,"file":"runtime-secrets.js","sourceRoot":"","sources":["../src/runtime-secrets.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAqB,SAAS,EAAE,YAAY,EAAc,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EACvB,WAAW,EACX,+BAA+B,EAC/B,4BAA4B,GAC7B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,qBAAqB,EACrB,eAAe,EAEf,oBAAoB,EAEpB,uBAAuB,EAEvB,kBAAkB,EAClB,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AASvD,8EAA8E;AAC9E,MAAM,UAAU,mBAAmB;IACjC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAA4C,EAC5C,WAAyB,mBAAmB;IAE5C,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC7C,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,OAAO;YACV,OAAO,QAAQ,EAAE,CAAC;QACpB,KAAK,WAAW;YACd,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC5C,KAAK,aAAa;YAChB,OAAO,MAAM,CAAC,KAAK,CAAC;IACxB,CAAC;AACH,CAAC;AAUD,MAAM,SAAS,GAAG,qCAAqC,CAAC;AACxD,MAAM,cAAc,GAAG,gCAAgC,CAAC;AAExD,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E,oDAAoD;AACpD,MAAM,UAAU,2BAA2B,CACzC,OAA6D,EAC7D,OAAoB,EAAE;IAEtB,OAAO,oBAAoB,CACzB,OAAO,CAAC,SAAS,EACjB,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC,EACpC,0BAA0B,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,EAC1D,SAAS,OAAO,CAAC,GAAG,UAAU,EAC9B,IAAI,CACL,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gCAAgC,CAC9C,OAA6D,EAC7D,OAAoB,EAAE;IAEtB,OAAO,oBAAoB,CACzB,OAAO,CAAC,SAAS,EACjB,4BAA4B,CAAC,OAAO,CAAC,GAAG,CAAC,EACzC,+BAA+B,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,EAC/D,SAAS,OAAO,CAAC,GAAG,iBAAiB,EACrC,IAAI,CACL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,SAAiB,EACjB,SAAiB,EACjB,KAAa,EACb,WAAmB,EACnB,IAAiB;IAEjB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,EAAE,GAAG,mBAAmB,KAAK,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,aAAa,SAAS,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;QACzB,KAAK;QACL,kBAAkB;QAClB,UAAU;QACV,KAAK;QACL,OAAO;QACP,uBAAuB;KACxB,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAClD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;IACjE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;QACvB,KAAK;QACL,kBAAkB;QAClB,QAAQ;QACR,SAAS;QACT,OAAO;QACP,kBAAkB,WAAW,EAAE;QAC/B,SAAS;KACV,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,EAAE,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACtF,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;AAC/D,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAgF;IAEhF,MAAM,IAAI,GAAoE,EAAE,CAAC;IACjF,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QACtE,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,SAAS,IAAI,IAAI,EAAE,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;IACtF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAOD,mFAAmF;AACnF,MAAM,UAAU,sBAAsB,CACpC,IAAyB,EACzB,MAAc;IAEd,OAAO,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;AACjG,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAA6D,EAC7D,OAAoB,EAAE;IAEtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAC/D,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC;QAClB,SAAS;QACT,UAAU;QACV,QAAQ;QACR,aAAa,OAAO,CAAC,SAAS,EAAE;QAChC,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,QAAQ,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACnF,MAAM,WAAW,GACf,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAMpB,CAAC,WAAW,CAAC;IACd,IAAI,WAAW,EAAE,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC;IACpF,MAAM,SAAS,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,IAAI,EAAE,CAAC;SACzD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;SACtB,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,EAAE,CAAC;IACxE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,QAAQ,2CAA2C,EAAE,CAAC;AACtF,CAAC;AAED;;;;GAIG;AACH,MAAM,4BAA4B,GAAG,wBAAwB,CAAC;AAE9D,SAAS,eAAe,CAAC,WAA8B;IACrD,OAAO,WAAW,CAAC,IAAI,KAAK,WAAW;QACrC,CAAC,CAAC,CAAC,gCAAgC,CAAC;QACpC,CAAC,CAAC,CAAC,mCAAmC,EAAE,eAAe,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAKC,EACD,OAAoB,EAAE;IAEtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,2EAA2E;IAC3E,sEAAsE;IACtE,0EAA0E;IAC1E,yBAAyB;IACzB,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC;QACnB,SAAS;QACT,UAAU;QACV,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,mBAAmB,CAAC;QAC7C,aAAa,OAAO,CAAC,SAAS,EAAE;QAChC,sBAAsB;KACvB,CAAC,CAAC;IACH,MAAM,IAAI,GACR,CAAC,EAAE,CAAC,EAAE,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC;QACjC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE;QAClF,CAAC,CAAC,MAAM,qBAAqB,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,UAAU,GAAG,CAAC,WAA8B,EAAE,EAAE,CACpD,GAAG,CAAC;QACF,SAAS;QACT,QAAQ;QACR,OAAO,CAAC,QAAQ;QAChB,aAAa,OAAO,CAAC,SAAS,EAAE;QAChC,GAAG,eAAe,CAAC,WAAW,CAAC;QAC/B,SAAS;KACV,CAAC,CAAC;IACL,IAAI,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAChD,IACE,CAAC,MAAM,CAAC,EAAE;QACV,IAAI,CAAC,WAAW,CAAC,IAAI,KAAK,WAAW;QACrC,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAChD,CAAC;QACD,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,MAAM,CAAC,EAAE,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACzE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;AACrF,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAMC,EACD,OAAoB,EAAE;IAEtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,mBAAmB,CAAC;IACtD,MAAM,OAAO,GAAG,aAAa,OAAO,CAAC,SAAS,EAAE,CAAC;IACjD,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAsB,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;IAC1F,kEAAkE;IAClE,qDAAqD;IACrD,IAAI,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC;IAE5C,KAAK,MAAM,IAAI,IAAI,qBAAqB,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAChD,MAAM,EAAE,GAAG,UAAU,QAAQ,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAAC;QAC/F,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACvE,SAAS;QACX,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACzE,MAAM,UAAU,GAAG,CAAC,WAA8B,EAAE,EAAE,CACpD,GAAG,CACD;gBACE,SAAS;gBACT,QAAQ;gBACR,QAAQ;gBACR,OAAO;gBACP,GAAG,eAAe,CAAC,WAAW,CAAC;gBAC/B,eAAe;gBACf,SAAS;aACV,EACD,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;YACJ,IAAI,MAAM,GAAG,MAAM,UAAU,CAAC,iBAAiB,CAAC,CAAC;YACjD,IACE,CAAC,MAAM,CAAC,EAAE;gBACV,iBAAiB,CAAC,IAAI,KAAK,WAAW;gBACtC,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAChD,CAAC;gBACD,iBAAiB,GAAG,QAAQ,CAAC;gBAC7B,MAAM,GAAG,MAAM,UAAU,CAAC,iBAAiB,CAAC,CAAC;YAC/C,CAAC;YACD,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,QAAQ,CAAC,IAAI,CACX,iBAAiB,KAAK,OAAO,CAAC,WAAW;oBACvC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;oBAC3B,CAAC,CAAC;wBACE,EAAE;wBACF,MAAM,EAAE,SAAS;wBACjB,MAAM,EAAE,iBAAiB,OAAO,CAAC,MAAM,sFAAsF;qBAC9H,CACN,CAAC;gBACF,SAAS;YACX,CAAC;YACD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACrE,SAAS;YACX,CAAC;YACD,4DAA4D;QAC9D,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE;YAC9C,SAAS;YACT,UAAU;YACV,MAAM;YACN,QAAQ;YACR,OAAO;YACP,wBAAwB;YACxB,WAAW;YACX,sBAAsB;SACvB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACvE,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YACzC,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,UAAU,CAC1B,GAAG,EACH,QAAQ,EACR,OAAO,EACP,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAC3D,CAAC;QACF,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,GAAiB,EACjB,QAAgB,EAChB,OAAe,EACf,KAAa;IAEb,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,CAAC,EAAE;QACtF,KAAK,EAAE,KAAK;KACb,CAAC,CAAC;IACH,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;AACrE,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,8CAA8C;AAC9C,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,mBAAmB;IACnB,sBAAsB;IACtB,iBAAiB;IACjB,sBAAsB;IACtB,sEAAsE;IACtE,0DAA0D;IAC1D,qBAAqB;CACsB,CAAC;AAG9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,oBAA4C,CAAC;AAE5E;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAK,iBAAuC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,0EAA0E;IAC1E,IAAI,IAAI,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,IAAI,KAAK,uBAAuB,EAAE,CAAC;QACrC,OAAO,4MAA4M,CAAC;IACtN,CAAC;IACD,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,OAAO,wLAAwL,CAAC;IAClM,CAAC;IACD,OAAO,GAAG,IAAI,wDAAwD,CAAC,GAAG,iBAAiB,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AAC9H,CAAC;AAoBD,sFAAsF;AACtF,MAAM,UAAU,aAAa,CAAC,MAAqB;IACjD,OAAQ,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAqC;SAC7E,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC;SAC/B,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,oBAAoB,CACjC,GAAiB,EACjB,MAAsB,EACtB,MAAuB;IAEvB,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,CAAC,IAAmD,EAAE,EAAE,CACvE,IAAI,EAAE,IAAI,KAAK,QAAQ;QACvB,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,YAAY,QAAQ,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;IACzF,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;aACrD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC;aAC/B,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;YACzB,KAAK;YACL,UAAU;YACV,UAAU;YACV,IAAI;YACJ,UAAU;YACV,MAAM,CAAC,MAAM;YACb,aAAa,MAAM,CAAC,SAAS,EAAE;YAC/B,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,YAAY,OAAO,KAAK,IAAI,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACpF,MAAM,GAAG,GAAG,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9C,qEAAqE;QACrE,uEAAuE;QACvE,mEAAmE;QACnE,qBAAqB;QACrB,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAClF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,OAAO,OAAO,KAAK,IAAI,iBAAiB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,QAAQ,qHAAqH,CAAC;QACxN,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACxB,OAAO,CACL,IAAI,EAAE,IAAI,KAAK,QAAQ;gBACvB,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,QAAQ,EAAE,CAAC,CAAC;gBAC3E,IAAI,CAAC,OAAO,KAAK,QAAQ,CAC1B,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,OAAO,OAAO,KAAK,IAAI,mBAAmB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,QAAQ,kLAAkL,CAAC;QACvQ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAQD,MAAM,SAAS,GAAG,oCAAoC,CAAC;AACvD,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B;;;;;;GAMG;AACH,KAAK,UAAU,kBAAkB,CAC/B,GAAiB,EACjB,IAAe,EACf,KAAY,EACZ,IAA6E;AAC7E;;;;GAIG;AACH,IAAyB;IAEzB,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,mCAAmC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,OAAO,EAAE;SAC3E,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;IAC1F,MAAM,OAAO,GAAG,GAAG,SAAS,aAAa,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;IAC9E,MAAM,MAAM,GAAG,KAAK,EAAE,IAAY,EAAE,GAAgD,EAAE,EAAE,CAAC,CAAC;QACxF,EAAE,EAAE,KAAc;QAClB,KAAK,EAAE,GAAG,IAAI,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;KACzE,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,GAAG,OAAO,cAAc,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAChF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1E,MAAM,GAAG,GACP,IAAI,KAAK,QAAQ;QACf,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,KAAK,SAAS,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;YAC3D,MAAM,EAAE,KAAK;YACb,OAAO;YACP,IAAI;SACL,CAAC;QACJ,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IAM3F,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAc,CAAC;IACnD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,GAAG,mBAAmB,EAAE,CAAC,EAAE,EAAE,CAAC;QACrE,IAAI,CAAC,EAAE,CAAC,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC;QAC1F,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;QACnB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,OAAO,eAAe,kBAAkB,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE;YAC9E,MAAM,EAAE,KAAK;YACb,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC,kBAAkB,EAAE,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;QAC/D,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAc,CAAC;IAClD,CAAC;IACD,IAAI,EAAE,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,IAAI,IAAI,GAAG,yBAAyB,EAAE,CAAC;IACpF,CAAC;IACD,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,kBAAkB;SAC7F,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,sFAAsF;AACtF,SAAS,QAAQ,CAAC,IAAY,EAAE,MAAc,EAAE,SAAiB;IAC/D,MAAM,QAAQ,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,SAAS,EAAE,CAAC,CAAC;IAChE,OAAO;QACL,sEAAsE;QACtE,2CAA2C;QAC3C;YACE,KAAK;YACL,UAAU;YACV,QAAQ;YACR,IAAI;YACJ,GAAG,QAAQ;YACX,wCAAwC,IAAI,CAAC,GAAG,EAAE,EAAE;YACpD,SAAS;SACV;QACD,CAAC,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,SAAS,CAAC;KACnF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAsB,EACtB,MAAuB,EACvB,OAAoD,EAAE;IAEtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAK,KAA8B,CAAC;IAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,mBAAmB,CAAC;IACtD,MAAM,OAAO,GAAG,aAAa,MAAM,CAAC,SAAS,EAAE,CAAC;IAChD,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACjE,IAAI,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAC3D,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IAEzB,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC;QAC7E,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC;QACpC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC;YACxB,SAAS;YACT,UAAU;YACV,QAAQ;YACR,QAAQ;YACR,YAAY,QAAQ,EAAE;YACtB,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QAC5F,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC;QAChC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,QAAgB,EAAE,EAAE,CACrD,kBAAkB,CAChB,GAAG,EACH,IAAI,EACJ,KAAK,EACL,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,EACzD,QAAQ,CACT,CAAC;QACJ,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,KAAK,IAAqB,EAAE;YAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;gBAC3B,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE;oBAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjE,CAAC;YACD,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC;gBACxB,CAAC,CAAC,2DAA2D;gBAC7D,CAAC,CAAC,iBAAiB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,oEAAoE,QAAQ,UAAU,CAAC;QAC/H,CAAC,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACzC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBACV,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK;oBACL,KAAK,EAAE,WAAW,IAAI,cAAc,CAAC,CAAC,KAAK,GAAG,QAAQ,EAAE;iBACzD,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,KAAK,CAAC,IAAI,CAAC,uCAAuC,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5D,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK;gBACL,KAAK,EAAE,6BAA6B,QAAQ,KAAK,GAAG,CAAC,KAAK,KAAK,MAAM,OAAO,EAAE,EAAE;aACjF,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5D,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,QAAQ,KAAK,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;IAChG,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,0BAA0B,QAAQ,EAAE,CAAC,CAAC;IAEjD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,SAAS;QACxD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAyB,CAAC;QAC/F,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACrD,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,cAAc,OAAO,qBAAqB,CAAC,CAAC;YACvD,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,IAAI,CACX,YAAY,OAAO,KAAK,IAAI,yBAAyB,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,gCAAgC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAC3J,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK;YACL,KAAK,EAAE,0BAA0B,aAAa,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,EAAE,uGAAuG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACjO,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAcD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAiB,EACjB,OAA6D,EAC7D,MAAqB;IAErB,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC;QAClB,SAAS;QACT,UAAU;QACV,QAAQ;QACR,QAAQ;QACR,YAAY,QAAQ,EAAE;QACtB,aAAa,OAAO,CAAC,SAAS,EAAE;KACjC,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,QAAQ,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IAC/E,IAAI,CAAC,CAAC,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,QAAQ,8BAA8B,EAAE,CAAC;IACtF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACvC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAA0B,EAC1B,IAAkB,EAClB,OAKI,EAAE;IAEN,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAK,KAA8B,CAAC;IAC1D,MAAM,EAAE,GAAG,iBAAiB,IAAI,EAAE,CAAC;IACnC,IAAI,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC7B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7E,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACnE,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC;IACzB,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAClC,GAAG,EACH,IAAI,EACJ,KAAK,EACL,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,EAC7E,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAC3C,CAAC;IACF,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;AACzF,CAAC"}

package/dist/scheduler-setup.d.ts

@@ -0,0 +1,75 @@
+import { type GcloudRunner, type Sleep } from "./gcloud-retry.js";
+import { type IapResource } from "./mcp-iap.js";
+/** The admin path the workflow calls (apps/admin `api/internal/scheduler/tick`). */
+export declare const SCHEDULER_TICK_PATH = "/api/internal/scheduler/tick";
+/**
+ * How long the workflow waits for the admin's answer, in seconds: Workflows'
+ * maximum (cloud.google.com/workflows/docs/reference/stdlib/http/post). The
+ * admin holds the request until the tick's work is done: it claims tasks for
+ * at most its budget (4 minutes, admin-core scheduler/tick.ts) and then waits
+ * at most one task's lease (10 minutes) for the last one, so 14 minutes in
+ * the worst case, inside the admin's own 3600 s request timeout.
+ */
+export declare const SCHEDULER_TICK_TIMEOUT_SECONDS = 1800;
+/** APIs the tick needs on the project. */
+export declare const SCHEDULER_APIS: readonly ["cloudscheduler.googleapis.com", "workflows.googleapis.com", "iamcredentials.googleapis.com"];
+/**
+ * Roles the scheduler's identity must never hold anywhere. Prefix matches
+ * (`roles/secretmanager.` = every Secret Manager role).
+ */
+export declare const SCHEDULER_FORBIDDEN_ROLES: readonly ["roles/owner", "roles/editor", "roles/viewer", "roles/run.", "roles/iam.serviceAccountUser", "roles/iam.serviceAccountAdmin", "roles/iam.securityAdmin", "roles/iap.admin", "roles/iap.settingsAdmin", "roles/secretmanager.", "roles/cloudsql.", "roles/compute.", "roles/storage.", "roles/resourcemanager.", "roles/workflows.admin", "roles/workflows.editor", "roles/cloudscheduler."];
+export interface SchedulerTickTarget {
+    readonly projectId: string;
+    readonly region: string;
+    /** Pulumi stack name (`production`). */
+    readonly env: string;
+    /**
+     * Where the admin answers behind IAP, an origin: `https://admin.<domain>`
+     * on gcp, the admin service's URL on gcp-firebase (remote-mcp.ts
+     * RemoteMcpIdentity.adminUrl, the same value as the admin's
+     * CAELO_ADMIN_URL).
+     */
+    readonly adminUrl: string;
+    /** The admin's IAP resource (the service on gcp-firebase, the LB backend on gcp). */
+    readonly resource: IapResource;
+    /** The `schedulerIntervalMinutes` knob (1–15). */
+    readonly intervalMinutes: number;
+}
+export type SchedulerTickResult = {
+    readonly ok: true;
+    readonly done: string[];
+    readonly serviceAccount: string;
+} | {
+    readonly ok: false;
+    readonly done: string[];
+    readonly error: string;
+};
+/**
+ * The tick's admin origin, or an error naming why it is not one: an https
+ * origin without path, query or credentials (it is written into the
+ * workflow's source, so nothing but an origin may get there).
+ */
+export declare function tickOrigin(adminUrl: string): {
+    ok: true;
+    origin: string;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * The workflow one tick runs (Cloud Workflows YAML): sign a service-account
+ * JWT for the admin's IAP as the scheduler account itself (the IAM
+ * Credentials API, authenticated with the workflow's own OAuth token), then
+ * POST the tick with it. A refused or failed tick (HTTP ≥ 400) fails the
+ * execution, so it shows in the workflow's execution history and logs.
+ */
+export declare function schedulerWorkflowSource(opts: {
+    readonly serviceAccount: string;
+    readonly origin: string;
+}): string;
+/** Ensure the scheduler tick and everything it needs. Never throws for a gcloud failure. */
+export declare function ensureSchedulerTick(target: SchedulerTickTarget, deps?: {
+    run?: GcloudRunner;
+    sleep?: Sleep;
+}): Promise<SchedulerTickResult>;
+//# sourceMappingURL=scheduler-setup.d.ts.map

package/dist/scheduler-setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scheduler-setup.d.ts","sourceRoot":"","sources":["../src/scheduler-setup.ts"],"names":[],"mappings":"AAmDA,OAAO,EAAE,KAAK,YAAY,EAA2B,KAAK,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAO3F,OAAO,EAAE,KAAK,WAAW,EAAmB,MAAM,cAAc,CAAC;AAGjE,oFAAoF;AACpF,eAAO,MAAM,mBAAmB,iCAAiC,CAAC;AAElE;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B,OAAO,CAAC;AAKnD,0CAA0C;AAC1C,eAAO,MAAM,cAAc,yGAIjB,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,yBAAyB,uYAkB5B,CAAC;AAEX,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,qFAAqF;IACrF,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,kDAAkD;IAClD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAAE,GAC/E;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,QAAQ,EAAE,MAAM,GACf;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAsB7D;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC5C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,GAAG,MAAM,CAkCT;AAED,4FAA4F;AAC5F,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,mBAAmB,EAC3B,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAO,GAC/C,OAAO,CAAC,mBAAmB,CAAC,CAmK9B"}

package/dist/scheduler-setup.js

@@ -0,0 +1,331 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * #1140 — set up (and converge) the scheduler tick on a Google Cloud install
+ * (`gcp`, `gcp-firebase`): the ONE Cloud Scheduler job that calls the
+ * admin's `/api/internal/scheduler/tick` every `schedulerIntervalMinutes`
+ * (1–15, default 5). Each task's own cadence lives in the admin's
+ * due-table; the tick only says "run what is due now". Run by the wizard
+ * after migrations and by `cms-provision upgrade`'s converge (and the
+ * converge job), as the operator's or the provisioner's identity.
+ *
+ * Why not Cloud Scheduler → admin directly. The admin sits behind IAP, and
+ * IAP accepts a service account's OIDC ID token only when its `aud` is an
+ * OAuth client allowlisted for programmatic access; an install on the
+ * Google-managed IAP client has none (cloud.google.com/iap/docs/
+ * authentication-howto). Cloud Scheduler's other credential, an OAuth
+ * access token, it sends only to `*.googleapis.com` (cloud.google.com/
+ * scheduler/docs/http-target-auth). What passes IAP for a service account
+ * on every install is a self-signed service-account JWT with `aud` =
+ * `<admin origin>/*` — the path caelo-mcp and admin-internal-google.ts
+ * take. Cloud Scheduler cannot sign one, so the job starts a Cloud
+ * Workflows execution (a googleapis.com target, OAuth), and the workflow
+ * signs the JWT as the scheduler account through the IAM Credentials API
+ * and POSTs the tick. No container per tick and no image to keep in step
+ * with the app-roll; cents a month (wizards/gcp-cost.ts).
+ *
+ * Why the CLI owns it and not the stacks: the same as audit-job-setup.ts —
+ * `upgrade` never runs Pulumi, and existing installs get the tick from here.
+ *
+ * Trust boundary. The scheduler's identity, `caelo-<env>-scheduler`, holds:
+ *
+ *   - `roles/iam.serviceAccountTokenCreator` on ITSELF only (signJwt);
+ *   - `roles/iap.httpsResourceAccessor` on the admin's IAP resource (the
+ *     operator-access sync job keeps it there, operator-access.ts);
+ *   - `roles/workflows.invoker` on the project (Cloud Scheduler starts the
+ *     workflow as it; Workflows has no per-workflow IAM policy to bind to);
+ *   - `roles/logging.logWriter` (the workflow's error call logs).
+ *
+ * Nothing else: no Secret Manager, no Cloud SQL, no Cloud Run rights. What
+ * it can do with the admin is the admin's to decide: the tick endpoint
+ * accepts exactly this account's IAP identity (`CAELO_SCHEDULER_SERVICE_
+ * ACCOUNT` on the admin) and only ever runs the due-table, never a build
+ * or a publish (scripts/no-automatic-production-deploy.test.ts).
+ * {@link SCHEDULER_FORBIDDEN_ROLES} names that line; the tests assert no
+ * grant crosses it.
+ */
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { gcloud as defaultGcloud } from "./gcloud.js";
+import { realSleep, runWithRetry } from "./gcloud-retry.js";
+import { schedulerJobName, schedulerServiceAccountEmail, schedulerServiceAccountId, schedulerWorkflowName, } from "./gcp-names.js";
+import { iapResourceArgs } from "./mcp-iap.js";
+import { schedulerCron } from "./stack-contract.js";
+/** The admin path the workflow calls (apps/admin `api/internal/scheduler/tick`). */
+export const SCHEDULER_TICK_PATH = "/api/internal/scheduler/tick";
+/**
+ * How long the workflow waits for the admin's answer, in seconds: Workflows'
+ * maximum (cloud.google.com/workflows/docs/reference/stdlib/http/post). The
+ * admin holds the request until the tick's work is done: it claims tasks for
+ * at most its budget (4 minutes, admin-core scheduler/tick.ts) and then waits
+ * at most one task's lease (10 minutes) for the last one, so 14 minutes in
+ * the worst case, inside the admin's own 3600 s request timeout.
+ */
+export const SCHEDULER_TICK_TIMEOUT_SECONDS = 1800;
+/** Lifetime of the IAP credential the workflow signs per tick. */
+const JWT_LIFETIME_SECONDS = 600;
+/** APIs the tick needs on the project. */
+export const SCHEDULER_APIS = [
+    "cloudscheduler.googleapis.com",
+    "workflows.googleapis.com",
+    "iamcredentials.googleapis.com",
+];
+/**
+ * Roles the scheduler's identity must never hold anywhere. Prefix matches
+ * (`roles/secretmanager.` = every Secret Manager role).
+ */
+export const SCHEDULER_FORBIDDEN_ROLES = [
+    "roles/owner",
+    "roles/editor",
+    "roles/viewer",
+    "roles/run.",
+    "roles/iam.serviceAccountUser",
+    "roles/iam.serviceAccountAdmin",
+    "roles/iam.securityAdmin",
+    "roles/iap.admin",
+    "roles/iap.settingsAdmin",
+    "roles/secretmanager.",
+    "roles/cloudsql.",
+    "roles/compute.",
+    "roles/storage.",
+    "roles/resourcemanager.",
+    "roles/workflows.admin",
+    "roles/workflows.editor",
+    "roles/cloudscheduler.",
+];
+/**
+ * The tick's admin origin, or an error naming why it is not one: an https
+ * origin without path, query or credentials (it is written into the
+ * workflow's source, so nothing but an origin may get there).
+ */
+export function tickOrigin(adminUrl) {
+    let u;
+    try {
+        u = new URL(adminUrl);
+    }
+    catch {
+        return { ok: false, error: `the admin URL ${JSON.stringify(adminUrl)} is not a URL` };
+    }
+    if (u.protocol !== "https:" ||
+        u.username ||
+        u.password ||
+        (u.pathname !== "/" && u.pathname !== "") ||
+        u.search ||
+        u.hash ||
+        !/^[a-z0-9.-]+$/.test(u.hostname)) {
+        return {
+            ok: false,
+            error: `the admin URL ${JSON.stringify(adminUrl)} is not a plain https origin`,
+        };
+    }
+    return { ok: true, origin: u.origin };
+}
+/**
+ * The workflow one tick runs (Cloud Workflows YAML): sign a service-account
+ * JWT for the admin's IAP as the scheduler account itself (the IAM
+ * Credentials API, authenticated with the workflow's own OAuth token), then
+ * POST the tick with it. A refused or failed tick (HTTP ≥ 400) fails the
+ * execution, so it shows in the workflow's execution history and logs.
+ */
+export function schedulerWorkflowSource(opts) {
+    const { serviceAccount: sa, origin } = opts;
+    return `# Caelo scheduler tick (#1140) — generated by cms-provision, do not edit.
+main:
+  steps:
+    - claims:
+        assign:
+          - now: \${int(sys.now())}
+          - jwtClaims:
+              iss: "${sa}"
+              sub: "${sa}"
+              aud: "${origin}/*"
+              iat: \${now}
+              exp: \${now + ${JWT_LIFETIME_SECONDS}}
+    - sign:
+        call: http.post
+        args:
+          url: "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${sa}:signJwt"
+          auth:
+            type: OAuth2
+          body:
+            payload: \${json.encode_to_string(jwtClaims)}
+        result: signed
+    - tick:
+        call: http.post
+        args:
+          url: "${origin}${SCHEDULER_TICK_PATH}"
+          headers:
+            Authorization: \${"Bearer " + signed.body.signedJwt}
+          timeout: ${SCHEDULER_TICK_TIMEOUT_SECONDS}
+        result: answer
+    - done:
+        return: \${answer.code}
+`;
+}
+/** Ensure the scheduler tick and everything it needs. Never throws for a gcloud failure. */
+export async function ensureSchedulerTick(target, deps = {}) {
+    const run = deps.run ?? defaultGcloud;
+    const sleep = deps.sleep ?? realSleep;
+    const retry = (args) => runWithRetry(run, sleep, args);
+    const { projectId, region, env } = target;
+    const project = `--project=${projectId}`;
+    const sa = schedulerServiceAccountEmail(projectId, env);
+    const member = `serviceAccount:${sa}`;
+    const workflow = schedulerWorkflowName(env);
+    const job = schedulerJobName(env);
+    const done = [];
+    const fail = (step, r) => ({
+        ok: false,
+        done,
+        error: `${step}: ${r.stderr.trim()}`,
+    });
+    const origin = tickOrigin(target.adminUrl);
+    if (!origin.ok)
+        return { ok: false, done, error: origin.error };
+    let cron;
+    try {
+        cron = schedulerCron(target.intervalMinutes);
+    }
+    catch (e) {
+        return { ok: false, done, error: e.message };
+    }
+    // 1. APIs.
+    const api = await run(["services", "enable", ...SCHEDULER_APIS, project, "--quiet"]);
+    if (!api.ok)
+        return fail(`enable ${SCHEDULER_APIS.join(", ")}`, api);
+    done.push(`APIs enabled (${SCHEDULER_APIS.join(", ")})`);
+    // 2. The scheduler's own service account.
+    const describe = await run([
+        "iam",
+        "service-accounts",
+        "describe",
+        sa,
+        project,
+        "--format=value(email)",
+    ]);
+    if (!describe.ok) {
+        const create = await run([
+            "iam",
+            "service-accounts",
+            "create",
+            schedulerServiceAccountId(env),
+            "--display-name=Caelo scheduler tick",
+            "--description=Calls the admin's scheduler tick through IAP every few minutes; signs its own IAP credential, nothing else.",
+            project,
+        ]);
+        if (!create.ok && !/already exists/i.test(create.stderr))
+            return fail(`create ${sa}`, create);
+    }
+    done.push(`service account ${sa}`);
+    // 3. Its grants (see the file comment).
+    const self = await retry([
+        "iam",
+        "service-accounts",
+        "add-iam-policy-binding",
+        sa,
+        `--member=${member}`,
+        "--role=roles/iam.serviceAccountTokenCreator",
+        "--condition=None",
+        project,
+        "--quiet",
+        "--format=none",
+    ]);
+    if (!self.ok)
+        return fail("let the scheduler sign its IAP credential as itself", self);
+    done.push(`scheduler: roles/iam.serviceAccountTokenCreator on ${sa} (itself, signJwt)`);
+    for (const g of [
+        { role: "roles/workflows.invoker", why: "Cloud Scheduler starts the tick workflow as it" },
+        { role: "roles/logging.logWriter", why: "the workflow logs failed calls" },
+    ]) {
+        const r = await retry([
+            "projects",
+            "add-iam-policy-binding",
+            projectId,
+            `--member=${member}`,
+            `--role=${g.role}`,
+            "--condition=None",
+            "--quiet",
+            "--format=none",
+        ]);
+        if (!r.ok)
+            return fail(`grant the scheduler ${g.role} (${g.why})`, r);
+        done.push(`scheduler: ${g.role} on the project`);
+    }
+    const iap = await retry([
+        "iap",
+        "web",
+        "add-iam-policy-binding",
+        ...iapResourceArgs(target.resource),
+        `--member=${member}`,
+        "--role=roles/iap.httpsResourceAccessor",
+        "--condition=None",
+        project,
+        "--quiet",
+    ]);
+    if (!iap.ok)
+        return fail("let the scheduler pass the admin's IAP", iap);
+    done.push(`scheduler: roles/iap.httpsResourceAccessor on the admin (${target.resource.service})`);
+    // 4. The workflow. A private directory (mkdtemp, mode 700): no other local
+    //    user can swap the file between write and read.
+    const dir = mkdtempSync(join(tmpdir(), "caelo-scheduler-"));
+    try {
+        const file = join(dir, "tick.yaml");
+        writeFileSync(file, schedulerWorkflowSource({ serviceAccount: sa, origin: origin.origin }), {
+            mode: 0o600,
+        });
+        const deploy = await retry([
+            "workflows",
+            "deploy",
+            workflow,
+            `--source=${file}`,
+            `--location=${region}`,
+            `--service-account=${sa}`,
+            "--call-log-level=log-errors-only",
+            `--description=Caelo scheduler tick (#1140): calls ${origin.origin}${SCHEDULER_TICK_PATH}`,
+            project,
+            "--quiet",
+        ]);
+        if (!deploy.ok)
+            return fail(`deploy workflow ${workflow}`, deploy);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+    done.push(`workflow ${workflow} (calls ${origin.origin}${SCHEDULER_TICK_PATH})`);
+    // 5. The one Cloud Scheduler job.
+    const scheduleArgs = [
+        job,
+        `--location=${region}`,
+        project,
+        `--schedule=${cron}`,
+        "--time-zone=Etc/UTC",
+        `--uri=https://workflowexecutions.googleapis.com/v1/projects/${projectId}/locations/${region}/workflows/${workflow}/executions`,
+        "--http-method=POST",
+        `--oauth-service-account-email=${sa}`,
+        // A tick that has not answered when the next one is due is the admin's
+        // lease to sort out (its due-table), not a reason to retry this one.
+        "--max-retry-attempts=0",
+        "--quiet",
+    ];
+    const existing = await run([
+        "scheduler",
+        "jobs",
+        "describe",
+        job,
+        `--location=${region}`,
+        project,
+        "--format=value(name)",
+    ]);
+    const sched = await retry([
+        "scheduler",
+        "jobs",
+        existing.ok ? "update" : "create",
+        "http",
+        ...scheduleArgs,
+    ]);
+    if (!sched.ok)
+        return fail(`schedule ${job}`, sched);
+    done.push(`Cloud Scheduler job ${job} (${cron}, UTC)`);
+    return { ok: true, done, serviceAccount: sa };
+}
+//# sourceMappingURL=scheduler-setup.js.map