@catladder/cli 0.0.0-fix-changeset-hint-package-manager-20002c27 → 0.0.0-fix-github-gating-release-push-fbb576dc

package/dist/bundles/cli/index.js

@@ -619,6 +619,7 @@ const pipeline_1 = __nccwpck_require__(53695);
 const commandSecretsSyncGithub_1 = __nccwpck_require__(27565);
 const concurrency_1 = __nccwpck_require__(59723);
 const github_1 = __nccwpck_require__(41353);
+const githubMergeGating_1 = __nccwpck_require__(14966);
 /** marker for repo-level (environment-less) targets, see collectSecretTargets */
 const REPO_LEVEL = "";
 /**
@@ -722,10 +723,13 @@ const checkGithub = async (report, config) => {
 exports.checkGithub = checkGithub;
 /**
  * verifies the merge gating `project setup` configures: auto-merge
- * enabled and the generated `catladder ✅` aggregate check required on
- * the default branch. Without it a PR is mergeable while its checks
- * are still running — gitlab ships this behavior built-in, github
- * silently does not.
+ * enabled and the `catladder merge gating` ruleset requiring the
+ * generated `catladder ✅` aggregate check on the default branch (with
+ * the bypass that lets the release job push). Without the check a PR
+ * is mergeable while its checks are still running — gitlab ships this
+ * behavior built-in, github silently does not. The check required via
+ * classic branch protection instead is flagged: that setup rejects the
+ * release job's own push (GH006).
  */
 const checkGithubMergeGating = async (report, repo) => {
     var _a, _b;
@@ -744,17 +748,35 @@ const checkGithubMergeGating = async (report, repo) => {
         report.fail("auto-merge disabled — the merge-when-pipeline-succeeds button cannot appear", "run: catladder project setup");
     }
     const branch = repoInfo.default_branch;
+    let rulesets;
+    try {
+        rulesets = await (0, github_1.ghApiJson)("GET", `repos/${repo}/rulesets?per_page=100`);
+    }
+    catch (e) {
+        report.warn(`could not list rulesets of ${repo} (${e.message})`);
+        return;
+    }
+    const named = rulesets.find((r) => r.name === githubMergeGating_1.MERGE_GATING_RULESET_NAME);
+    const ruleset = named
+        ? await (0, github_1.ghApiJson)("GET", `repos/${repo}/rulesets/${named.id}`).catch(() => null)
+        : null;
+    if (ruleset && (0, githubMergeGating_1.rulesetProvidesMergeGating)(ruleset)) {
+        report.ok(`ruleset '${githubMergeGating_1.MERGE_GATING_RULESET_NAME}': '${pipeline_1.AGGREGATE_CHECK_JOB_NAME}' required on ${branch}, release job can push`);
+    }
+    else if (ruleset) {
+        report.fail(`ruleset '${githubMergeGating_1.MERGE_GATING_RULESET_NAME}' exists but is incomplete (inactive, check not required, or release-job bypass missing)`, "run: catladder project setup");
+    }
+    else {
+        report.fail(`no '${githubMergeGating_1.MERGE_GATING_RULESET_NAME}' ruleset on ${repo} — PRs can merge while the pipeline is red or still running`, "run: catladder project setup");
+    }
     const protection = await (0, github_1.ghApiJson)("GET", `repos/${repo}/branches/${branch}/protection`).catch(() => null);
     const checks = (_b = (_a = protection === null || protection === void 0 ? void 0 : protection.required_status_checks) === null || _a === void 0 ? void 0 : _a.checks) !== null && _b !== void 0 ? _b : [];
     if (checks.some((c) => c.context === pipeline_1.AGGREGATE_CHECK_JOB_NAME)) {
-        report.ok(`'${pipeline_1.AGGREGATE_CHECK_JOB_NAME}' required on ${branch}`);
-    }
-    else {
-        report.fail(`'${pipeline_1.AGGREGATE_CHECK_JOB_NAME}' is not a required check on ${branch} — PRs can merge while the pipeline is red or still running`, "run: catladder project setup");
+        report.fail(`'${pipeline_1.AGGREGATE_CHECK_JOB_NAME}' is still required via classic branch protection on ${branch} — that rejects the release job's push (GH006)`, "run: catladder project setup");
     }
     const stale = checks.filter((c) => c.context !== pipeline_1.AGGREGATE_CHECK_JOB_NAME);
     if (stale.length > 0) {
-        report.warn(`${branch} requires ${stale.length} additional named check(s) (${stale
+        report.warn(`${branch} requires ${stale.length} additional named check(s) via classic branch protection (${stale
             .map((c) => c.context)
             .join(", ")}) — job names change with components; prefer only '${pipeline_1.AGGREGATE_CHECK_JOB_NAME}'`);
     }
@@ -950,6 +972,84 @@ exports.doctorProject = doctorProject;
 
 /***/ }),
 
+/***/ 14966:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.rulesetProvidesMergeGating = exports.desiredMergeGatingRuleset = exports.MERGE_GATING_RULESET_NAME = exports.GITHUB_ACTIONS_APP_ID = void 0;
+const pipeline_1 = __nccwpck_require__(53695);
+/**
+ * github merge gating — shared between `project setup` (writes it) and
+ * `project doctor` (verifies it).
+ *
+ * The gating lives in a repository RULESET, not classic branch
+ * protection: only rulesets can carry bypass actors, and the release
+ * job needs one. It pushes the release commit and tag straight to the
+ * default branch with the workflow token — under classic protection
+ * the required `catladder ✅` check rejects that push (GH006), because
+ * the fresh release commit cannot have a passing check yet. The bypass
+ * covers the GitHub Actions app, i.e. pushes made by workflows, while
+ * PRs and humans stay gated. (Gitlab's counterpart is the
+ * maintainer-role project access token, which may push to protected
+ * branches by default — the same trade-off, made by the platform.)
+ */
+/** the app id of GitHub Actions — the actor workflow tokens act as */
+exports.GITHUB_ACTIONS_APP_ID = 15368;
+exports.MERGE_GATING_RULESET_NAME = "catladder merge gating";
+/** the ruleset `project setup` creates (and restores on drift) */
+const desiredMergeGatingRuleset = () => ({
+    name: exports.MERGE_GATING_RULESET_NAME,
+    target: "branch",
+    enforcement: "active",
+    conditions: { ref_name: { include: ["~DEFAULT_BRANCH"], exclude: [] } },
+    rules: [
+        {
+            type: "required_status_checks",
+            parameters: {
+                strict_required_status_checks_policy: false,
+                do_not_enforce_on_create: false,
+                required_status_checks: [
+                    {
+                        context: pipeline_1.AGGREGATE_CHECK_JOB_NAME,
+                        integration_id: exports.GITHUB_ACTIONS_APP_ID,
+                    },
+                ],
+            },
+        },
+    ],
+    bypass_actors: [
+        {
+            actor_id: exports.GITHUB_ACTIONS_APP_ID,
+            actor_type: "Integration",
+            bypass_mode: "always",
+        },
+    ],
+});
+exports.desiredMergeGatingRuleset = desiredMergeGatingRuleset;
+/**
+ * whether a ruleset provides working merge gating: active, requires
+ * the aggregate check, and lets the release job (GitHub Actions app)
+ * bypass it. Extra rules or bypass actors someone added are fine.
+ */
+const rulesetProvidesMergeGating = (ruleset) => {
+    var _a, _b;
+    return ruleset.enforcement === "active" &&
+        ((_a = ruleset.rules) !== null && _a !== void 0 ? _a : []).some((rule) => {
+            var _a, _b;
+            return rule.type === "required_status_checks" &&
+                ((_b = (_a = rule.parameters) === null || _a === void 0 ? void 0 : _a.required_status_checks) !== null && _b !== void 0 ? _b : []).some((check) => check.context === pipeline_1.AGGREGATE_CHECK_JOB_NAME);
+        }) &&
+        ((_b = ruleset.bypass_actors) !== null && _b !== void 0 ? _b : []).some((actor) => actor.actor_type === "Integration" &&
+            actor.actor_id === exports.GITHUB_ACTIONS_APP_ID &&
+            actor.bypass_mode === "always");
+};
+exports.rulesetProvidesMergeGating = rulesetProvidesMergeGating;
+//# sourceMappingURL=githubMergeGating.js.map
+
+/***/ }),
+
 /***/ 2231:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
@@ -1436,6 +1536,7 @@ exports.setupGithub = void 0;
 const pipeline_1 = __nccwpck_require__(53695);
 const commandSecretsSyncGithub_1 = __nccwpck_require__(27565);
 const github_1 = __nccwpck_require__(41353);
+const githubMergeGating_1 = __nccwpck_require__(14966);
 /**
  * configures github merge gating — the sane default gitlab ships
  * built-in and a fresh github repository lacks entirely: without it a
@@ -1443,18 +1544,19 @@ const github_1 = __nccwpck_require__(41353);
  * auto-merge button never appears.
  *
  * - repo settings: allow auto-merge, delete merged head branches
- * - branch protection on the default branch: require the generated
+ * - a repository ruleset on the default branch requiring the generated
  *   `catladder ✅` aggregate check (the one stable context — individual
- *   job names change with every component add/rename)
+ *   job names change with every component add/rename), with a bypass
+ *   for the GitHub Actions app so the release job can push the release
+ *   commit and tag (see githubMergeGating.ts for the full rationale)
  *
- * Deliberately non-destructive: existing protection settings
- * (enforce-admins, required reviews, restrictions, strictness) are
- * preserved; the aggregate context is merged into the required checks
- * rather than replacing them. Admins can still bypass per PR — this is
- * a default, not a cage.
+ * Earlier versions required the check via classic branch protection,
+ * which has no bypass list — the release job's direct push to the
+ * default branch bounced off catladder's own gating (GH006). Setup
+ * migrates that away: the aggregate context is removed from an
+ * existing classic rule, everything else in it is preserved.
  */
 const setupGithub = async (instance, config) => {
-    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o;
     if (!(0, pipeline_1.getEnabledPipelineTypes)(config).includes("github")) {
         return;
     }
@@ -1479,33 +1581,75 @@ const setupGithub = async (instance, config) => {
         instance.log("✅ auto-merge already enabled");
     }
     const branch = repoInfo.default_branch;
-    const protection = await (0, github_1.ghApiJson)("GET", `repos/${repo}/branches/${branch}/protection`).catch(() => null); // 404: branch not protected yet
-    const existingChecks = (_b = (_a = protection === null || protection === void 0 ? void 0 : protection.required_status_checks) === null || _a === void 0 ? void 0 : _a.checks) !== null && _b !== void 0 ? _b : [];
-    if (existingChecks.some((c) => c.context === pipeline_1.AGGREGATE_CHECK_JOB_NAME)) {
-        instance.log(`✅ '${pipeline_1.AGGREGATE_CHECK_JOB_NAME}' already required on ${branch}`);
+    const rulesets = await (0, github_1.ghApiJson)("GET", `repos/${repo}/rulesets?per_page=100`);
+    const existing = rulesets.find((r) => r.name === githubMergeGating_1.MERGE_GATING_RULESET_NAME);
+    if (!existing) {
+        await (0, github_1.ghApiJson)("POST", `repos/${repo}/rulesets`, (0, githubMergeGating_1.desiredMergeGatingRuleset)());
+        instance.log(`✅ ruleset '${githubMergeGating_1.MERGE_GATING_RULESET_NAME}': '${pipeline_1.AGGREGATE_CHECK_JOB_NAME}' required on ${branch} — merges wait for the pipeline, the release job can push`);
+    }
+    else {
+        const detail = await (0, github_1.ghApiJson)("GET", `repos/${repo}/rulesets/${existing.id}`);
+        if ((0, githubMergeGating_1.rulesetProvidesMergeGating)(detail)) {
+            instance.log(`✅ ruleset '${githubMergeGating_1.MERGE_GATING_RULESET_NAME}' already in place on ${branch}`);
+        }
+        else {
+            await (0, github_1.ghApiJson)("PUT", `repos/${repo}/rulesets/${existing.id}`, (0, githubMergeGating_1.desiredMergeGatingRuleset)());
+            instance.log(`✅ ruleset '${githubMergeGating_1.MERGE_GATING_RULESET_NAME}' restored — '${pipeline_1.AGGREGATE_CHECK_JOB_NAME}' required, release-job bypass in place`);
+        }
+    }
+    await migrateAwayFromClassicProtection(instance, repo, branch);
+};
+exports.setupGithub = setupGithub;
+/**
+ * removes the aggregate check from a classic branch protection rule
+ * set up by earlier catladder versions — with the check now required
+ * via the ruleset, the classic one would still reject the release
+ * job's push. Everything else in the rule is preserved; the whole rule
+ * is deleted when the check was all it carried.
+ */
+const migrateAwayFromClassicProtection = async (instance, repo, branch) => {
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y, _z, _0, _1;
+    const protection = await (0, github_1.ghApiJson)("GET", `repos/${repo}/branches/${branch}/protection`).catch(() => null); // 404: branch not protected
+    const checks = (_b = (_a = protection === null || protection === void 0 ? void 0 : protection.required_status_checks) === null || _a === void 0 ? void 0 : _a.checks) !== null && _b !== void 0 ? _b : [];
+    if (!checks.some((c) => c.context === pipeline_1.AGGREGATE_CHECK_JOB_NAME)) {
+        return;
+    }
+    const remaining = checks.filter((c) => c.context !== pipeline_1.AGGREGATE_CHECK_JOB_NAME);
+    const carriesAnythingElse = remaining.length > 0 ||
+        ((_c = protection === null || protection === void 0 ? void 0 : protection.enforce_admins) === null || _c === void 0 ? void 0 : _c.enabled) ||
+        (protection === null || protection === void 0 ? void 0 : protection.required_pull_request_reviews) ||
+        (protection === null || protection === void 0 ? void 0 : protection.restrictions) ||
+        ((_d = protection === null || protection === void 0 ? void 0 : protection.required_linear_history) === null || _d === void 0 ? void 0 : _d.enabled) ||
+        ((_e = protection === null || protection === void 0 ? void 0 : protection.required_conversation_resolution) === null || _e === void 0 ? void 0 : _e.enabled) ||
+        ((_f = protection === null || protection === void 0 ? void 0 : protection.required_signatures) === null || _f === void 0 ? void 0 : _f.enabled) ||
+        ((_g = protection === null || protection === void 0 ? void 0 : protection.lock_branch) === null || _g === void 0 ? void 0 : _g.enabled) ||
+        ((_h = protection === null || protection === void 0 ? void 0 : protection.allow_force_pushes) === null || _h === void 0 ? void 0 : _h.enabled) ||
+        ((_j = protection === null || protection === void 0 ? void 0 : protection.allow_deletions) === null || _j === void 0 ? void 0 : _j.enabled);
+    if (!carriesAnythingElse) {
+        await (0, github_1.ghApiJson)("DELETE", `repos/${repo}/branches/${branch}/protection`);
+        instance.log(`✅ classic branch protection on ${branch} removed — '${pipeline_1.AGGREGATE_CHECK_JOB_NAME}' was all it carried, and it is now required via the ruleset`);
         return;
     }
-    // merge into whatever protection exists; PUT replaces the whole rule,
-    // so every preserved setting must be carried over explicitly
+    // PUT replaces the whole rule, so every preserved setting must be
+    // carried over explicitly
     await (0, github_1.ghApiJson)("PUT", `repos/${repo}/branches/${branch}/protection`, {
-        required_status_checks: {
-            strict: (_d = (_c = protection === null || protection === void 0 ? void 0 : protection.required_status_checks) === null || _c === void 0 ? void 0 : _c.strict) !== null && _d !== void 0 ? _d : false,
-            checks: [
-                ...existingChecks.map(({ context, app_id }) => ({
+        required_status_checks: remaining.length > 0
+            ? {
+                strict: (_l = (_k = protection === null || protection === void 0 ? void 0 : protection.required_status_checks) === null || _k === void 0 ? void 0 : _k.strict) !== null && _l !== void 0 ? _l : false,
+                checks: remaining.map(({ context, app_id }) => ({
                     context,
                     ...(app_id !== undefined ? { app_id } : {}),
                 })),
-                { context: pipeline_1.AGGREGATE_CHECK_JOB_NAME },
-            ],
-        },
-        enforce_admins: (_f = (_e = protection === null || protection === void 0 ? void 0 : protection.enforce_admins) === null || _e === void 0 ? void 0 : _e.enabled) !== null && _f !== void 0 ? _f : false,
+            }
+            : null,
+        enforce_admins: (_o = (_m = protection === null || protection === void 0 ? void 0 : protection.enforce_admins) === null || _m === void 0 ? void 0 : _m.enabled) !== null && _o !== void 0 ? _o : false,
         required_pull_request_reviews: (protection === null || protection === void 0 ? void 0 : protection.required_pull_request_reviews)
             ? {
-                required_approving_review_count: (_g = protection.required_pull_request_reviews
-                    .required_approving_review_count) !== null && _g !== void 0 ? _g : 0,
-                dismiss_stale_reviews: (_h = protection.required_pull_request_reviews.dismiss_stale_reviews) !== null && _h !== void 0 ? _h : false,
-                require_code_owner_reviews: (_j = protection.required_pull_request_reviews
-                    .require_code_owner_reviews) !== null && _j !== void 0 ? _j : false,
+                required_approving_review_count: (_p = protection.required_pull_request_reviews
+                    .required_approving_review_count) !== null && _p !== void 0 ? _p : 0,
+                dismiss_stale_reviews: (_q = protection.required_pull_request_reviews.dismiss_stale_reviews) !== null && _q !== void 0 ? _q : false,
+                require_code_owner_reviews: (_r = protection.required_pull_request_reviews
+                    .require_code_owner_reviews) !== null && _r !== void 0 ? _r : false,
             }
             : null,
         restrictions: (protection === null || protection === void 0 ? void 0 : protection.restrictions)
@@ -1515,12 +1659,14 @@ const setupGithub = async (instance, config) => {
                 apps: protection.restrictions.apps.map((a) => a.slug),
             }
             : null,
-        allow_force_pushes: (_l = (_k = protection === null || protection === void 0 ? void 0 : protection.allow_force_pushes) === null || _k === void 0 ? void 0 : _k.enabled) !== null && _l !== void 0 ? _l : false,
-        allow_deletions: (_o = (_m = protection === null || protection === void 0 ? void 0 : protection.allow_deletions) === null || _m === void 0 ? void 0 : _m.enabled) !== null && _o !== void 0 ? _o : false,
+        required_linear_history: (_t = (_s = protection === null || protection === void 0 ? void 0 : protection.required_linear_history) === null || _s === void 0 ? void 0 : _s.enabled) !== null && _t !== void 0 ? _t : false,
+        required_conversation_resolution: (_v = (_u = protection === null || protection === void 0 ? void 0 : protection.required_conversation_resolution) === null || _u === void 0 ? void 0 : _u.enabled) !== null && _v !== void 0 ? _v : false,
+        lock_branch: (_x = (_w = protection === null || protection === void 0 ? void 0 : protection.lock_branch) === null || _w === void 0 ? void 0 : _w.enabled) !== null && _x !== void 0 ? _x : false,
+        allow_force_pushes: (_z = (_y = protection === null || protection === void 0 ? void 0 : protection.allow_force_pushes) === null || _y === void 0 ? void 0 : _y.enabled) !== null && _z !== void 0 ? _z : false,
+        allow_deletions: (_1 = (_0 = protection === null || protection === void 0 ? void 0 : protection.allow_deletions) === null || _0 === void 0 ? void 0 : _0.enabled) !== null && _1 !== void 0 ? _1 : false,
     });
-    instance.log(`✅ branch protection on ${branch}: '${pipeline_1.AGGREGATE_CHECK_JOB_NAME}' required (merges now wait for the pipeline)`);
+    instance.log(`✅ '${pipeline_1.AGGREGATE_CHECK_JOB_NAME}' removed from classic branch protection on ${branch} — now required via the ruleset; the rest of the rule is preserved`);
 };
-exports.setupGithub = setupGithub;
 //# sourceMappingURL=setupGithub.js.map
 
 /***/ }),
@@ -15564,9 +15710,14 @@ exports.GCLOUD_RUN_DEPLOY_TYPE = {
         // generation time. For review envs the service name part still
         // contains a runtime expression (the review slug), so the host stays
         // a bash expression there; the suffix is always a literal.
+        //
+        // The service name has to come from getRawServiceNameForEnvContext,
+        // not from fullName: it is shortened when the label would otherwise
+        // exceed what cloud run serves deterministically, and the url must
+        // name the service that is actually deployed.
         const HOSTNAME_INTERNAL = deployConfigRaw && envType !== "local"
             ? (0, bash_1.joinBashExpressions)([
-                fullName,
+                (0, getServiceName_1.getRawServiceNameForEnvContext)(ctx),
                 `${(0, store_1.getGcloudProjectNumber)(fullConfig, deployConfigRaw.projectId)}.${deployConfigRaw.region}.run.app`,
             ], "-").toLowerCase()
             : undefined;
@@ -15828,16 +15979,197 @@ exports.getCloudRunServiceOrJobArgsArg = getCloudRunServiceOrJobArgsArg;
 /***/ }),
 
 /***/ 33102:
-/***/ ((__unused_webpack_module, exports) => {
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.getServiceNameForEnvContext = exports.getServiceName = void 0;
-const getServiceName = (context) => context.environment.fullName.toLowerCase();
+exports.getRawServiceNameForEnvContext = exports.getServiceNameForEnvContext = exports.getServiceName = exports.resolveCloudRunComponentPart = exports.REVIEW_SLUG_LENGTH_BUDGET = exports.CLOUD_RUN_DNS_SEGMENT_LIMIT = void 0;
+const bash_1 = __nccwpck_require__(94143);
+const store_1 = __nccwpck_require__(2789);
+/**
+ * cloud run only serves its deterministic url
+ * `https://<service>-<projectNumber>.<region>.run.app` while that first dns
+ * label stays within the 63 characters a dns label allows — the label holds
+ * the service name, the project number and any traffic tag together.
+ *
+ * Beyond it cloud run silently switches to a legacy url built from a random
+ * identifier that nothing can recompute. The url catladder generates would
+ * then be a hostname that can never resolve, and everything consuming
+ * ROOT_URL/ROOT_URL_INTERNAL (cloud tasks targets, service-to-service
+ * calls) fails with a dns error instead of a helpful one — which is why the
+ * component part is shortened to stay under the limit rather than left to
+ * overflow.
+ *
+ * https://cloud.google.com/run/docs/triggering/https-request
+ */
+exports.CLOUD_RUN_DNS_SEGMENT_LIMIT = 63;
+/**
+ * review environments resolve their slug at runtime (`mr<iid>` on gitlab,
+ * `pr<number>` on github), so its exact length is unknown while generating.
+ * Budget for a six digit number so that service names — and with them the
+ * urls of already deployed services — do not start changing years later
+ * just because a project's merge request numbers grew a digit.
+ */
+exports.REVIEW_SLUG_LENGTH_BUDGET = "mr123456".length;
+/**
+ * a service name shortened past this point is no longer recognizable. When
+ * even this does not fit, the fixed parts (customer name, app name, env,
+ * project number) are what needs to shrink — only the user can do that.
+ */
+const MIN_COMPONENT_PART_LENGTH = 6;
+const quote = (name) => `"${name}"`;
+/**
+ * a trailing dash would end up in the hostname as `...-foo-.run.app`
+ */
+const shortenTo = (name, maxLength) => name.slice(0, maxLength).replace(/-+$/, "");
+/**
+ * the component-name part of a cloud run service name, shortened just
+ * enough to keep the deterministic url resolvable.
+ *
+ * Only the component part is shortened: the env and review slug parts have
+ * to stay intact (they are what makes the name unique per environment), the
+ * project number is fixed, and customerName/appName are shared by every
+ * service of the project.
+ */
+const resolveCloudRunComponentPart = ({ customerName, appName, env, isReviewEnv, componentName, projectNumber, otherComponentNames, }) => {
+    const fixedParts = [
+        customerName,
+        appName,
+        env,
+        ...(isReviewEnv ? ["_".repeat(exports.REVIEW_SLUG_LENGTH_BUDGET)] : []),
+        projectNumber,
+    ];
+    // + 1 for the dash that joins the component part to the rest
+    const fixedLength = fixedParts.join("-").length + 1;
+    const available = exports.CLOUD_RUN_DNS_SEGMENT_LIMIT - fixedLength;
+    if (componentName.length <= available) {
+        return {
+            value: componentName,
+            dropped: 0,
+            dnsSegmentLength: fixedLength + componentName.length,
+        };
+    }
+    if (available < MIN_COMPONENT_PART_LENGTH) {
+        throw new Error(`Cannot build a resolvable cloud run url for component ${quote(componentName)} in env ${quote(env)}.\n` +
+            `Everything but the component name already takes ${fixedLength} of the ${exports.CLOUD_RUN_DNS_SEGMENT_LIMIT} characters ` +
+            `a dns label allows (${fixedParts.join("-")}-<component>), leaving only ${available} for the component name.\n` +
+            `Shorten appName (${quote(appName)}) or customerName (${quote(customerName)}) by at least ` +
+            `${MIN_COMPONENT_PART_LENGTH - available} character(s).` +
+            (isReviewEnv
+                ? `\nReview environments also carry a runtime slug, for which ${exports.REVIEW_SLUG_LENGTH_BUDGET} characters are reserved.`
+                : ""));
+    }
+    const value = shortenTo(componentName, available);
+    const colliding = otherComponentNames.filter((other) => shortenTo(other, available) === value);
+    if (colliding.length > 0) {
+        throw new Error(`Cloud run service names collide in env ${quote(env)}: ${quote(componentName)} and ` +
+            `${colliding.map(quote).join(", ")} all shorten to ${quote(value)}, so they would deploy over each other.\n` +
+            `The deterministic cloud run url allows ${exports.CLOUD_RUN_DNS_SEGMENT_LIMIT} characters, which leaves ${available} ` +
+            `for the component name here — rename the components so their first ${available} characters differ.`);
+    }
+    return {
+        value,
+        dropped: componentName.length - value.length,
+        dnsSegmentLength: fixedLength + value.length,
+    };
+};
+exports.resolveCloudRunComponentPart = resolveCloudRunComponentPart;
+/**
+ * one note per shortened service name instead of one per generated job:
+ * service names are resolved again for every job that references them
+ */
+const reportedTruncations = new Set();
+const reportTruncation = (env, componentName, { value, dnsSegmentLength }) => {
+    const key = `${env}/${componentName}`;
+    if (reportedTruncations.has(key)) {
+        return;
+    }
+    reportedTruncations.add(key);
+    console.warn(`ℹ️ component "${componentName}" deploys to cloud run as "...-${value}" in env "${env}": ` +
+        `the full name would push the url past the ${exports.CLOUD_RUN_DNS_SEGMENT_LIMIT} characters cloud run ` +
+        `serves deterministically, so the component part is shortened ` +
+        `(${dnsSegmentLength} of ${exports.CLOUD_RUN_DNS_SEGMENT_LIMIT} characters used).`);
+};
+/**
+ * the cloud run service name before lowercasing, so that callers keep
+ * lowercasing the whole expression exactly like they did before.
+ *
+ * Returns `fullName` unchanged unless the component part had to be
+ * shortened — every project whose url already fits generates byte-identical
+ * output.
+ *
+ * Note that the composition below has to match the one `fullName` is built
+ * from in getEnvironmentContext; the tests pin that they agree.
+ */
+const getRawServiceName = ({ fullName, environmentSlugPrefix, componentName, env, isReviewEnv, deployConfig, config, }) => {
+    const projectNumber = deployConfig
+        ? (0, store_1.readGcloudProjectNumber)(config, deployConfig.projectId)
+        : null;
+    if (!projectNumber) {
+        // without the project number there is no deterministic url to keep
+        // resolvable — generating the url itself fails with a store error that
+        // says how to fix it, so don't second-guess the name here
+        return fullName;
+    }
+    const componentPart = (0, exports.resolveCloudRunComponentPart)({
+        customerName: config.customerName,
+        appName: config.appName,
+        env,
+        isReviewEnv,
+        componentName,
+        projectNumber,
+        otherComponentNames: Object.keys(config.components).filter((name) => name !== componentName),
+    });
+    if (componentPart.dropped === 0) {
+        return fullName;
+    }
+    reportTruncation(env, componentName, componentPart);
+    return (0, bash_1.joinBashExpressions)([
+        config.customerName,
+        config.appName,
+        environmentSlugPrefix,
+        componentPart.value,
+    ], "-");
+};
+const fromComponentContext = (context) => {
+    var _a;
+    const deployConfig = (_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config;
+    return {
+        fullName: context.environment.fullName,
+        environmentSlugPrefix: context.environment.slugPrefix,
+        componentName: context.name,
+        env: context.env,
+        isReviewEnv: context.environment.envType === "review",
+        deployConfig: deployConfig && deployConfig.type === "google-cloudrun"
+            ? deployConfig
+            : null,
+        config: context.fullConfig,
+    };
+};
+const fromEnvironmentContext = (context) => ({
+    fullName: context.fullName,
+    environmentSlugPrefix: context.environmentSlugPrefix,
+    componentName: context.componentName,
+    env: context.env,
+    isReviewEnv: context.envType === "review",
+    deployConfig: context.deployConfigRaw || null,
+    config: context.fullConfig,
+});
+/**
+ * the cloud run service name as it is passed to `gcloud run` — lowercased,
+ * and shortened when the deterministic url would otherwise not fit.
+ */
+const getServiceName = (context) => getRawServiceName(fromComponentContext(context)).toLowerCase();
 exports.getServiceName = getServiceName;
-const getServiceNameForEnvContext = (context) => context.fullName.toLowerCase();
+const getServiceNameForEnvContext = (context) => getRawServiceName(fromEnvironmentContext(context)).toLowerCase();
 exports.getServiceNameForEnvContext = getServiceNameForEnvContext;
+/**
+ * the service name part of the deterministic url, still to be lowercased
+ * together with the rest of the hostname by the caller.
+ */
+const getRawServiceNameForEnvContext = (context) => getRawServiceName(fromEnvironmentContext(context));
+exports.getRawServiceNameForEnvContext = getRawServiceNameForEnvContext;
 //# sourceMappingURL=getServiceName.js.map
 
 /***/ }),
@@ -18254,7 +18586,7 @@ exports.getRunnerImage = getRunnerImage;
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.getGcloudProjectNumber = exports.readCatladderStore = exports.getCatladderStorePath = exports.catladderStoreSchema = exports.CATLADDER_STORE_FILE = exports.CATLADDER_STORE_FILE_NAME = exports.CATLADDER_STORE_DIR = void 0;
+exports.getGcloudProjectNumber = exports.readGcloudProjectNumber = exports.readCatladderStore = exports.getCatladderStorePath = exports.catladderStoreSchema = exports.CATLADDER_STORE_FILE = exports.CATLADDER_STORE_FILE_NAME = exports.CATLADDER_STORE_DIR = void 0;
 const fs_1 = __nccwpck_require__(79896);
 const path_1 = __nccwpck_require__(16928);
 const yaml_1 = __nccwpck_require__(99292);
@@ -18306,6 +18638,13 @@ const readCatladderStore = (directory = process.cwd()) => {
     }
 };
 exports.readCatladderStore = readCatladderStore;
+/**
+ * gcloud project number from the store, or null when it has not been
+ * fetched yet. Use this where a missing number is not itself the problem —
+ * `getGcloudProjectNumber` is the one that reports it.
+ */
+const readGcloudProjectNumber = (config, projectId) => { var _a, _b, _c, _d; return (_d = (_c = (_b = (_a = config.store) === null || _a === void 0 ? void 0 : _a.gcloudProjects) === null || _b === void 0 ? void 0 : _b[projectId]) === null || _c === void 0 ? void 0 : _c.projectNumber) !== null && _d !== void 0 ? _d : null; };
+exports.readGcloudProjectNumber = readGcloudProjectNumber;
 /**
  * gcloud project number from the store — needed to compute deterministic
  * cloud run urls (`<service>-<projectNumber>.<region>.run.app`) at
@@ -18315,8 +18654,7 @@ exports.readCatladderStore = readCatladderStore;
  * catenv fail until `catladder project setup` has stored it.
  */
 const getGcloudProjectNumber = (config, projectId) => {
-    var _a, _b, _c;
-    const projectNumber = (_c = (_b = (_a = config.store) === null || _a === void 0 ? void 0 : _a.gcloudProjects) === null || _b === void 0 ? void 0 : _b[projectId]) === null || _c === void 0 ? void 0 : _c.projectNumber;
+    const projectNumber = (0, exports.readGcloudProjectNumber)(config, projectId);
     if (!projectNumber) {
         throw new Error(`Missing gcloud project number for project "${projectId}" in ${exports.CATLADDER_STORE_FILE}.\n` +
             `Run "catladder project setup" to fetch and store it.`);

package/dist/bundles/skills/catladder-deploys/references/deploy-types.md

@@ -46,6 +46,7 @@ resources with `yarn catladder project setup`; detect drift with
 - `cloudSql?: DeployConfigCloudRunCloudSql | false` — `{ type: "unmanaged", instanceConnectionName, dbUser?, dbNamePrefix?, dbBaseName?, deleteDatabaseOnStop?, dbConnectionStringFormat? ("prisma" default | "rails" | "jdbc"), dbConnectionStringVariablesMode? ("embedded" default | "legacy"), dbAdditionalQueryParams? }`. Injects `DB_*` vars plus `DATABASE_URL`/`DATABASE_JDBC_URL`; in the default `"embedded"` mode the connection strings contain the component's final values (referenceable from other components, `vars.public` overrides of `DB_*` flow in). To share another component's database: `dbBaseName: "<owner>"` + `DB_PASSWORD: "${<owner>:DB_PASSWORD}"` in `vars.public`.
 - `execute?: Record<string, DeployConfigCloudRunExecute | null>` — run a script / job / HTTP call at a lifecycle point (`when`: `preDeploy` | `postDeploy` | `preStop` | `postStop`) or on a `schedule`.
 - `debug?: boolean`.
+- Service name and url: the service deploys as `<customerName>-<appName>-<env>[-<reviewSlug>]-<componentName>`, and `ROOT_URL`/`ROOT_URL_INTERNAL` are cloud run's deterministic url `https://<service>-<projectNumber>.<region>.run.app`. That url only exists while its first dns label stays within 63 characters, so catladder **shortens the component part** of the service name when it would not fit — otherwise cloud run would serve a legacy url with a random identifier and the generated hostname would never resolve. Review environments carry a runtime slug on top, for which 8 characters are reserved, so a name can fit `dev`/`prod` and still be shortened for `review`. Generation fails instead of shortening when two components would end up with the same name, or when customerName/appName/env/project number already leave no room.
 
 ## `npmPackage`
 

package/dist/bundles/skills/catladder-migrate-ci-backend/SKILL.md

@@ -260,13 +260,17 @@ now-wrong `gitRemote`, regenerate once more, and finish with
   PR is mergeable the moment it opens, checks still running, and the
   auto-merge button does not even appear. `yarn catladder project setup`
   configures it: auto-merge + delete-merged-branches on the repo, and a
-  branch protection rule on the default branch requiring the generated
-  **`catladder ✅`** aggregate check (the one stable context — never
-  require individual job names, they change with every component
-  add/rename and a stale required name blocks its own PR forever).
-  `project doctor` verifies it. Two things stay human choices: "Do not
-  allow bypassing" (leave it off — generated CI means a generation bug
-  can only be fixed via the admin bypass) and required reviews.
+  repository **ruleset** (`catladder merge gating`) on the default
+  branch requiring the generated **`catladder ✅`** aggregate check
+  (the one stable context — never require individual job names, they
+  change with every component add/rename and a stale required name
+  blocks its own PR forever). The ruleset carries a bypass for the
+  GitHub Actions app: the release job pushes the release commit and
+  tag straight to the default branch with the workflow token, which a
+  required check would otherwise reject (GH006 — classic branch
+  protection has no bypass list, which is why setup uses a ruleset and
+  migrates old classic-protection gating away). `project doctor`
+  verifies all of it. Required reviews stay a human choice.
 - Tell the team where the pipeline lives now and how manual actions
   work there (on GitHub, manual jobs are dispatch workflows in the
   Actions sidebar — `🚀 catladder create release`, `▶️ catladder deploy`,

package/dist/packages/pipeline/src/deploy/cloudRun/index.js

@@ -65,9 +65,14 @@ exports.GCLOUD_RUN_DEPLOY_TYPE = {
         // generation time. For review envs the service name part still
         // contains a runtime expression (the review slug), so the host stays
         // a bash expression there; the suffix is always a literal.
+        //
+        // The service name has to come from getRawServiceNameForEnvContext,
+        // not from fullName: it is shortened when the label would otherwise
+        // exceed what cloud run serves deterministically, and the url must
+        // name the service that is actually deployed.
         const HOSTNAME_INTERNAL = deployConfigRaw && envType !== "local"
             ? (0, bash_1.joinBashExpressions)([
-                fullName,
+                (0, getServiceName_1.getRawServiceNameForEnvContext)(ctx),
                 `${(0, store_1.getGcloudProjectNumber)(fullConfig, deployConfigRaw.projectId)}.${deployConfigRaw.region}.run.app`,
             ], "-").toLowerCase()
             : undefined;

package/dist/packages/pipeline/src/deploy/cloudRun/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../../packages/pipeline/src/deploy/cloudRun/index.ts"],"names":[],"mappings":";;;AACA,0CAAsD;AAEtD,2CAAiD;AACjD,uCAAqD;AAErD,+CAG4B;AAC5B,6CAAkD;AAClD,6CAA8D;AAC9D,uEAAwE;AACxE,+CAI0B;AAC1B,2DAAqE;AAExD,QAAA,6BAA6B,GAAG,8BAA8B,CAAC;AAE5E,MAAM,oBAAoB,GAAG,CAAC,EAC5B,eAAe,EACf,qBAAqB,EACrB,GAAG,EACH,aAAa,EACb,UAAU,GAC4C,EAAE,EAAE;;IAC1D,IAAI,eAAe,IAAI,eAAe,CAAC,QAAQ,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,IAAA,qBAAa,EAC3B,eAAe,CAAC,QAAQ,EACxB,UAAU,EACV,qBAAqB,EACrB,aAAa,CACd,CAAC;QAEF,MAAM,2BAA2B,GAAG,MAAM,CAAC,OAAO,CAChD,MAAA,eAAe,CAAC,QAAQ,CAAC,uBAAuB,mCAAI,EAAE,CACvD;aACE,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC;aACzC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEZ,MAAM,MAAM,GAAG;YACb,kCAAkC,EAChC,eAAe,CAAC,QAAQ,CAAC,sBAAsB;YACjD,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,MAAA,eAAe,CAAC,QAAQ,CAAC,MAAM,mCAAI,UAAU;YACtD,WAAW,EAAE,GAAG,GAAG,IAAA,0BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,aAAa,CAAC;SACvE,CAAC;QACF,OAAO;YACL,GAAG,MAAM;YACT,YAAY,EAAE,IAAA,sCAA2B,EACvC,eAAe,CAAC,QAAQ,EACxB,MAAM,EACN,aAAa,CACd,CAAC,MAAM,CAAC,2BAA2B,CAAC;YACrC,iBAAiB,EAAE,IAAA,6BAAkB,EACnC,MAAM,EACN,MAAA,eAAe,CAAC,QAAQ,CAAC,+BAA+B,mCACtD,oCAAyB,EAC3B,aAAa,CACd;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC,CAAC;AACW,QAAA,sBAAsB,GACjC;IACE,IAAI,EAAE,2CAA8B;IACpC,QAAQ,EAAE,CAAC,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,EAAE;QACzC,IAAI,eAAe,IAAI,eAAe,CAAC,QAAQ,EAAE,CAAC;YAChD,OAAO;gBACL,QAAQ,EAAE;oBACR,oBAAoB,EAAE,OAAO,KAAK,QAAQ;iBAC3C;aACF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,oBAAoB,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC;QAC7B,wDAAwD;QACxD,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,OAAO;YACzB,CAAC,CAAC;gBACE;oBACE,GAAG,EAAE,qCAA6B;oBAClC,MAAM,EAAE,IAAI;iBACb;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,eAAe,CAAC,QAAQ;YACrD,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC;YAC1B,CAAC,CAAC,EAAE,CAAC;KACR;IACD,oBAAoB,EAAE,CAAC,GAAG,EAAE,EAAE;QAC5B,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC;QAE/D,sCAAsC;QACtC,+DAA+D;QAC/D,+DAA+D;QAC/D,qEAAqE;QACrE,2DAA2D;QAC3D,MAAM,iBAAiB,GACrB,eAAe,IAAI,OAAO,KAAK,OAAO;YACpC,CAAC,CAAC,IAAA,0BAAmB,EACjB;gBACE,QAAQ;gBACR,GAAG,IAAA,8BAAsB,EACvB,UAAU,EACV,eAAe,CAAC,SAAS,CAC1B,IAAI,eAAe,CAAC,MAAM,UAAU;aACtC,EACD,GAAG,CACJ,CAAC,WAAW,EAAE;YACjB,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,WAAW,GACf,eAAe,IAAI,eAAe,CAAC,IAAI;YACrC,CAAC,CAAC,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC;iBACjC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;iBACrC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;gBACpB,4BAA4B,GAAG,IAAA,gCAAuB,EAAC,IAAI,CAAC;gBAC5D,IAAA,+CAAwB,EAAC,IAAI,EAAE;oBAC7B,WAAW,EAAE,QAAQ;oBACrB,SAAS,EAAE,eAAe,CAAC,SAAS;oBACpC,MAAM,EAAE,eAAe,CAAC,MAAM;iBAC/B,CAAC;aACH,CAAC,CACL;YACH,CAAC,CAAC,EAAE,CAAC;QAET,OAAO;YACL,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,oBAAoB,CAAC,GAAG,CAAC;YAC5B,GAAG,WAAW;YACd,6BAA6B,EAAE,IAAA,4CAA2B,EAAC,GAAG,CAAC;YAC/D,2BAA2B,EAAE,eAAe;gBAC1C,CAAC,CAAC,eAAe,CAAC,SAAS;gBAC3B,CAAC,CAAC,SAAS;YACb,uBAAuB,EAAE,eAAe;gBACtC,CAAC,CAAC,eAAe,CAAC,MAAM;gBACxB,CAAC,CAAC,SAAS;SACd,CAAC;IACJ,CAAC;IACD,oBAAoB,EAAE,CAAC,OAAO,EAAE,EAAE;;QAChC,MAAM,YAAY,GAAG,MAAA,OAAO,CAAC,MAAM,0CAAE,MAExB,CAAC;QACd,MAAM,OAAO,GAAG,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,OAAO,CAAC;QACtC,MAAM,aAAa,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,IAAI,CAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,oBAAoB,MAAK,KAAK,EAAE,CAAC;YAClD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,yEAAyE;QACzE,2EAA2E;QAC3E,OAAO,IAAA,4BAAmB,EACxB,kBAAkB,EAClB,sCAAsC,CACvC,CAAC;YACA,UAAU,qCAA6B,uCAAuC;YAC9E,yEAAyE;SAC1E,CAAC,CAAC;IACL,CAAC;CACF,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../../packages/pipeline/src/deploy/cloudRun/index.ts"],"names":[],"mappings":";;;AACA,0CAAsD;AAEtD,2CAAiD;AACjD,uCAAqD;AAErD,+CAG4B;AAC5B,6CAAkD;AAClD,6CAA8D;AAC9D,uEAAwE;AACxE,+CAI0B;AAC1B,2DAGgC;AAEnB,QAAA,6BAA6B,GAAG,8BAA8B,CAAC;AAE5E,MAAM,oBAAoB,GAAG,CAAC,EAC5B,eAAe,EACf,qBAAqB,EACrB,GAAG,EACH,aAAa,EACb,UAAU,GAC4C,EAAE,EAAE;;IAC1D,IAAI,eAAe,IAAI,eAAe,CAAC,QAAQ,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,IAAA,qBAAa,EAC3B,eAAe,CAAC,QAAQ,EACxB,UAAU,EACV,qBAAqB,EACrB,aAAa,CACd,CAAC;QAEF,MAAM,2BAA2B,GAAG,MAAM,CAAC,OAAO,CAChD,MAAA,eAAe,CAAC,QAAQ,CAAC,uBAAuB,mCAAI,EAAE,CACvD;aACE,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC;aACzC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEZ,MAAM,MAAM,GAAG;YACb,kCAAkC,EAChC,eAAe,CAAC,QAAQ,CAAC,sBAAsB;YACjD,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,MAAA,eAAe,CAAC,QAAQ,CAAC,MAAM,mCAAI,UAAU;YACtD,WAAW,EAAE,GAAG,GAAG,IAAA,0BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,aAAa,CAAC;SACvE,CAAC;QACF,OAAO;YACL,GAAG,MAAM;YACT,YAAY,EAAE,IAAA,sCAA2B,EACvC,eAAe,CAAC,QAAQ,EACxB,MAAM,EACN,aAAa,CACd,CAAC,MAAM,CAAC,2BAA2B,CAAC;YACrC,iBAAiB,EAAE,IAAA,6BAAkB,EACnC,MAAM,EACN,MAAA,eAAe,CAAC,QAAQ,CAAC,+BAA+B,mCACtD,oCAAyB,EAC3B,aAAa,CACd;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC,CAAC;AACW,QAAA,sBAAsB,GACjC;IACE,IAAI,EAAE,2CAA8B;IACpC,QAAQ,EAAE,CAAC,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,EAAE;QACzC,IAAI,eAAe,IAAI,eAAe,CAAC,QAAQ,EAAE,CAAC;YAChD,OAAO;gBACL,QAAQ,EAAE;oBACR,oBAAoB,EAAE,OAAO,KAAK,QAAQ;iBAC3C;aACF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,oBAAoB,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC;QAC7B,wDAAwD;QACxD,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,OAAO;YACzB,CAAC,CAAC;gBACE;oBACE,GAAG,EAAE,qCAA6B;oBAClC,MAAM,EAAE,IAAI;iBACb;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,eAAe,CAAC,QAAQ;YACrD,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC;YAC1B,CAAC,CAAC,EAAE,CAAC;KACR;IACD,oBAAoB,EAAE,CAAC,GAAG,EAAE,EAAE;QAC5B,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC;QAE/D,sCAAsC;QACtC,+DAA+D;QAC/D,+DAA+D;QAC/D,qEAAqE;QACrE,2DAA2D;QAC3D,EAAE;QACF,oEAAoE;QACpE,oEAAoE;QACpE,mEAAmE;QACnE,8CAA8C;QAC9C,MAAM,iBAAiB,GACrB,eAAe,IAAI,OAAO,KAAK,OAAO;YACpC,CAAC,CAAC,IAAA,0BAAmB,EACjB;gBACE,IAAA,+CAA8B,EAAC,GAAG,CAAC;gBACnC,GAAG,IAAA,8BAAsB,EACvB,UAAU,EACV,eAAe,CAAC,SAAS,CAC1B,IAAI,eAAe,CAAC,MAAM,UAAU;aACtC,EACD,GAAG,CACJ,CAAC,WAAW,EAAE;YACjB,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,WAAW,GACf,eAAe,IAAI,eAAe,CAAC,IAAI;YACrC,CAAC,CAAC,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC;iBACjC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;iBACrC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;gBACpB,4BAA4B,GAAG,IAAA,gCAAuB,EAAC,IAAI,CAAC;gBAC5D,IAAA,+CAAwB,EAAC,IAAI,EAAE;oBAC7B,WAAW,EAAE,QAAQ;oBACrB,SAAS,EAAE,eAAe,CAAC,SAAS;oBACpC,MAAM,EAAE,eAAe,CAAC,MAAM;iBAC/B,CAAC;aACH,CAAC,CACL;YACH,CAAC,CAAC,EAAE,CAAC;QAET,OAAO;YACL,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,oBAAoB,CAAC,GAAG,CAAC;YAC5B,GAAG,WAAW;YACd,6BAA6B,EAAE,IAAA,4CAA2B,EAAC,GAAG,CAAC;YAC/D,2BAA2B,EAAE,eAAe;gBAC1C,CAAC,CAAC,eAAe,CAAC,SAAS;gBAC3B,CAAC,CAAC,SAAS;YACb,uBAAuB,EAAE,eAAe;gBACtC,CAAC,CAAC,eAAe,CAAC,MAAM;gBACxB,CAAC,CAAC,SAAS;SACd,CAAC;IACJ,CAAC;IACD,oBAAoB,EAAE,CAAC,OAAO,EAAE,EAAE;;QAChC,MAAM,YAAY,GAAG,MAAA,OAAO,CAAC,MAAM,0CAAE,MAExB,CAAC;QACd,MAAM,OAAO,GAAG,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,OAAO,CAAC;QACtC,MAAM,aAAa,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,IAAI,CAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,oBAAoB,MAAK,KAAK,EAAE,CAAC;YAClD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,yEAAyE;QACzE,2EAA2E;QAC3E,OAAO,IAAA,4BAAmB,EACxB,kBAAkB,EAClB,sCAAsC,CACvC,CAAC;YACA,UAAU,qCAA6B,uCAAuC;YAC9E,yEAAyE;SAC1E,CAAC,CAAC;IACL,CAAC;CACF,CAAC"}