run402 1.54.3 → 1.55.0

package/lib/deploy-v2.mjs

@@ -25,9 +25,10 @@
 
 import { readFileSync } from "node:fs";
 import { resolve, dirname, isAbsolute, join } from "node:path";
+import { githubActionsCredentials } from "#sdk/node";
 import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail } from "./sdk-errors.mjs";
-import { allowanceAuthHeaders, resolveProjectId } from "./config.mjs";
+import { API, allowanceAuthHeaders, getActiveProjectId, resolveProjectId } from "./config.mjs";
 
 const APPLY_HELP = `run402 deploy apply — Unified deploy primitive (v1.34+)
 
@@ -166,6 +167,43 @@ async function applyCmd(args) {
     });
   }
 
+  // GH-232: Reject empty specs client-side. Without this guard,
+  // `run402 deploy apply --spec '{}'` (and `--manifest <empty>`) would silently
+  // send an empty ReleaseSpec to /deploy/v2/plans with no signal that nothing
+  // was deployed. This mirrors the GH-185 guard already in place for the
+  // legacy `run402 deploy --manifest` path.
+  //
+  // `deploy apply` is v2-only — only meaningful keys are the v2 ReleaseSpec
+  // shape (database, site, functions, secrets, subdomains, domains).
+  // For object-typed sections the "container is non-empty" check isn't enough
+  // — `site:{replace:{}}` has one key but ships nothing. We recurse one level
+  // so any object whose own values are all empty containers is still empty.
+  const meaningful = ["database", "site", "functions", "secrets", "subdomains", "domains"];
+  function hasContent(v) {
+    if (v == null) return false;
+    if (Array.isArray(v)) return v.length > 0;
+    if (typeof v === "object") {
+      const keys = Object.keys(v);
+      if (keys.length === 0) return false;
+      return keys.some((k) => hasContent(v[k]));
+    }
+    if (typeof v === "string") return v.length > 0;
+    return true;
+  }
+  const hasMeaningfulContent = spec && typeof spec === "object" && !Array.isArray(spec) && meaningful.some((key) => hasContent(spec[key]));
+  if (!hasMeaningfulContent) {
+    fail({
+      code: "MANIFEST_EMPTY",
+      message: `Manifest contains no deployable sections. Expected at least one of: ${meaningful.join(", ")}`,
+      hint: "Did you mean to write a 'site.replace' or 'database.migrations' block? See https://run402.com/schemas/manifest.v1.json",
+      details: {
+        field: opts.manifest ? "manifest" : opts.spec ? "spec" : "stdin",
+        ...(opts.manifest ? { path: resolve(opts.manifest) } : {}),
+        meaningful_keys: meaningful,
+      },
+    });
+  }
+
   if (opts.manifest) resolveFileDataPaths(spec, dirname(resolve(opts.manifest)));
 
   if (opts.project && spec.project_id && spec.project_id !== opts.project) {
@@ -176,7 +214,10 @@ async function applyCmd(args) {
     });
   }
   if (opts.project) spec.project_id = opts.project;
-  if (!spec.project_id) spec.project_id = resolveProjectId(null);
+  const useGithubActionsOidc = hasGithubActionsOidcEnv();
+  if (!spec.project_id) {
+    spec.project_id = useGithubActionsOidc ? resolveCiProjectId() : resolveProjectId(null);
+  }
 
   // Translate { project_id, ... } envelope → ReleaseSpec ({ project, ... })
   // The SDK ReleaseSpec uses `project` rather than `project_id`; both shapes
@@ -185,18 +226,123 @@ async function applyCmd(args) {
   const releaseSpec = mapManifestToReleaseSpec(spec);
   const idempotencyKey = spec.idempotency_key;
 
-  // Preserve the aggressive early exit when no allowance is configured.
-  allowanceAuthHeaders("/deploy/v2/plans");
+  let sdkOpts;
+  if (useGithubActionsOidc) {
+    sdkOpts = {
+      credentials: githubActionsCredentials({ projectId: spec.project_id, apiBase: API }),
+      disablePaidFetch: true,
+    };
+  } else {
+    // Preserve the aggressive early exit when no allowance is configured.
+    allowanceAuthHeaders("/deploy/v2/plans");
+  }
 
   try {
-    const result = await getSdk().deploy.apply(releaseSpec, {
+    const result = await getSdk(sdkOpts).deploy.apply(releaseSpec, {
       onEvent: makeStderrEventWriter(opts.quiet),
       idempotencyKey,
     });
     console.log(JSON.stringify({ status: "ok", ...result }, null, 2));
   } catch (err) {
-    reportSdkError(err);
+    reportDeployApplyError(err, useGithubActionsOidc);
+  }
+}
+
+function hasGithubActionsOidcEnv(env = process.env) {
+  return env.GITHUB_ACTIONS === "true" &&
+    Boolean(env.ACTIONS_ID_TOKEN_REQUEST_URL) &&
+    Boolean(env.ACTIONS_ID_TOKEN_REQUEST_TOKEN);
+}
+
+function resolveCiProjectId(env = process.env) {
+  const projectId = getActiveProjectId() || env.RUN402_PROJECT_ID;
+  if (!projectId) {
+    fail({
+      code: "CI_PROJECT_REQUIRED",
+      message: "GitHub Actions OIDC deploy requires a project id.",
+      hint: "Pass --project <prj_...> in the workflow command, include project_id in the manifest, or set RUN402_PROJECT_ID.",
+      details: { sources: ["--project", "manifest.project_id", "active_project", "RUN402_PROJECT_ID"] },
+    });
   }
+  return projectId;
+}
+
+const CI_DEPLOY_ERROR_GUIDANCE = {
+  invalid_token: {
+    hint: "Ensure the workflow has permissions: id-token: write and is running in the repository/branch linked with run402 ci link github.",
+    next_actions: [
+      "Check the workflow permissions block includes id-token: write.",
+      "Re-run run402 ci link github if the repository, branch, or environment changed.",
+    ],
+  },
+  access_denied: {
+    hint: "The OIDC token was valid, but no active Run402 CI binding allowed this workflow.",
+    next_actions: [
+      "Run run402 ci list --project <prj_...> locally to inspect bindings.",
+      "Run run402 ci link github again for this repository/branch/environment.",
+    ],
+  },
+  event_not_allowed: {
+    hint: "This binding only allows push and workflow_dispatch events in v1.",
+    next_actions: [
+      "Trigger the workflow with push or workflow_dispatch.",
+      "Create a separate follow-up design before enabling PR deploy events.",
+    ],
+  },
+  repository_id_mismatch: {
+    hint: "The GitHub repository id in the OIDC token does not match the linked binding.",
+    next_actions: [
+      "Run run402 ci link github again from the current repository.",
+      "If automatic lookup fails, pass --repository-id with the numeric GitHub repository id.",
+    ],
+  },
+  forbidden_spec_field: {
+    hint: "CI deploys in v1 can deploy site/functions/database content only; link locally for secrets, routes, subdomains, checks, or oversized manifests.",
+    next_actions: [
+      "Remove forbidden fields such as secrets, routes, subdomains, or checks from the CI manifest.",
+      "Keep the normalized manifest small enough to avoid manifest_ref.",
+    ],
+  },
+  forbidden_plan: {
+    hint: "The gateway rejected this deploy plan for CI. Keep CI deploys to the v1 allowed resources and re-link if policy changed.",
+    next_actions: [
+      "Inspect the gateway error details for the rejected resource.",
+      "Run the deploy locally with run402 deploy apply for operations outside the CI allowlist.",
+    ],
+  },
+  payment_required: {
+    hint: "The project tier or payment state does not allow this CI deploy.",
+    next_actions: [
+      "Run run402 tier status --project <prj_...> locally.",
+      "Renew or upgrade the project tier, then re-run the workflow.",
+    ],
+  },
+};
+
+function reportDeployApplyError(err, useGithubActionsOidc) {
+  if (!useGithubActionsOidc) return reportSdkError(err);
+  return reportSdkError(enhanceCiDeployError(err));
+}
+
+function enhanceCiDeployError(err) {
+  const existingBody = err?.body && typeof err.body === "object" && !Array.isArray(err.body)
+    ? err.body
+    : {};
+  const code = existingBody.code || err?.code || (err?.status === 402 ? "payment_required" : null);
+  const guidance = code ? CI_DEPLOY_ERROR_GUIDANCE[code] : null;
+  if (!guidance) return err;
+
+  const enhanced = Object.assign(new Error(err?.message || existingBody.message || String(code)), err);
+  enhanced.body = {
+    ...existingBody,
+    code,
+    message: existingBody.message || err?.message || "GitHub Actions OIDC deploy failed.",
+    hint: existingBody.hint || guidance.hint,
+    next_actions: Array.isArray(existingBody.next_actions) && existingBody.next_actions.length > 0
+      ? existingBody.next_actions
+      : guidance.next_actions,
+  };
+  return enhanced;
 }
 
 async function resumeCmd(args) {

package/lib/functions.mjs

@@ -1,8 +1,8 @@
-import { readFileSync, existsSync, statSync } from "fs";
+import { readFileSync } from "fs";
 import { findProject, API } from "./config.mjs";
 import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail } from "./sdk-errors.mjs";
-import { assertKnownFlags, hasHelp, normalizeArgv, parseIntegerFlag } from "./argparse.mjs";
+import { assertKnownFlags, hasHelp, normalizeArgv, parseIntegerFlag, validateRegularFile } from "./argparse.mjs";
 
 const HELP = `run402 functions — Manage serverless functions
 
@@ -181,24 +181,7 @@ async function deploy(projectId, name, args) {
   if (!opts.file) {
     fail({ code: "BAD_USAGE", message: "Missing --file <file>" });
   }
-  if (!existsSync(opts.file)) {
-    fail({
-      code: "FILE_NOT_FOUND",
-      message: `File not found: ${opts.file}`,
-      field: "--file",
-      path: opts.file,
-      hint: "Check that --file points to an existing source file.",
-    });
-  }
-  const stat = statSync(opts.file);
-  if (!stat.isFile()) {
-    fail({
-      code: "NOT_A_FILE",
-      message: `--file points to a ${stat.isDirectory() ? "directory" : "non-regular file"}: ${opts.file}`,
-      field: "--file",
-      path: opts.file,
-    });
-  }
+  validateRegularFile(opts.file, "--file");
   const code = readFileSync(opts.file, "utf-8");
 
   const deployOpts = { name, code };

package/lib/projects.mjs

@@ -2,7 +2,7 @@ import { readFileSync } from "fs";
 import { findProject, loadKeyStore, API, allowanceAuthHeaders, resolveProjectId, getActiveProjectId } from "./config.mjs";
 import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail, parseFlagJson } from "./sdk-errors.mjs";
-import { assertKnownFlags, failBadProjectId, hasHelp, normalizeArgv, positionalArgs, resolvePositionalProject } from "./argparse.mjs";
+import { assertKnownFlags, failBadProjectId, hasHelp, normalizeArgv, positionalArgs, resolvePositionalProject, validateRegularFile } from "./argparse.mjs";
 
 const HELP = `run402 projects — Manage your deployed Run402 projects
 
@@ -175,13 +175,14 @@ async function provision(args) {
 }
 
 async function applyExpose(projectId, args = []) {
-  const p = findProject(projectId);
   let file = null;
   let inline = null;
   for (let i = 0; i < args.length; i++) {
     if (args[i] === "--file" && args[i + 1]) { file = args[++i]; }
     else if (!inline && !args[i].startsWith("--")) { inline = args[i]; }
   }
+  if (file) validateRegularFile(file, "--file");
+  const p = findProject(projectId);
   const raw = file ? readFileSync(file, "utf-8") : inline;
   if (!raw) {
     fail({
@@ -252,7 +253,6 @@ async function keys(projectId) {
 }
 
 async function sqlCmd(projectId, args = []) {
-  const p = findProject(projectId);
   let file = null;
   let query = null;
   let paramsRaw = null;
@@ -261,6 +261,8 @@ async function sqlCmd(projectId, args = []) {
     else if (args[i] === "--params" && args[i + 1]) { paramsRaw = args[++i]; }
     else if (!query && !args[i].startsWith("--")) { query = args[i]; }
   }
+  if (file) validateRegularFile(file, "--file");
+  const p = findProject(projectId);
   const sql = file ? readFileSync(file, "utf-8") : query;
   if (!sql) {
     fail({

package/lib/sdk.mjs

@@ -9,6 +9,6 @@
 
 import { run402 } from "#sdk/node";
 
-export function getSdk() {
-  return run402();
+export function getSdk(opts = {}) {
+  return run402(opts);
 }

package/lib/secrets.mjs

@@ -1,6 +1,7 @@
 import { readFileSync } from "fs";
 import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail } from "./sdk-errors.mjs";
+import { validateRegularFile } from "./argparse.mjs";
 
 const HELP = `run402 secrets — Manage project secrets
 
@@ -82,6 +83,7 @@ async function set(projectId, key, args = []) {
     if (args[i] === "--file" && args[i + 1]) { file = args[++i]; }
     else if (!value && !args[i].startsWith("--")) { value = args[i]; }
   }
+  if (file) validateRegularFile(file, "--file");
   const val = file ? readFileSync(file, "utf-8") : value;
   if (!val) {
     fail({

package/lib/subdomains.mjs

@@ -10,7 +10,7 @@ Usage:
 Subcommands:
   claim  <name> [--project <id>] [--deployment <id>]   Claim a subdomain
   delete <name> --confirm [--project <id>]              Release a subdomain. Requires --confirm.
-  list   [<id>]                                         List subdomains for a project
+  list   [<id>] | list --project <id>                   List subdomains for a project
 
 Options default to the active project and its last deployment when omitted.
 Legacy syntax 'claim <deployment_id> <name>' is still supported.
@@ -151,8 +151,24 @@ async function deleteSubdomain(allArgs) {
   }
 }
 
-async function list(projectIdArg) {
-  const projectId = resolveProjectId(projectIdArg);
+function parseProjectFlag(args) {
+  let project = null;
+  const rest = [];
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === "--project" && args[i + 1]) { project = args[++i]; }
+    else { rest.push(args[i]); }
+  }
+  return { project, rest };
+}
+
+async function list(args) {
+  const argList = Array.isArray(args) ? args : [];
+  const { project, rest } = parseProjectFlag(argList);
+  // Either --project <id> or a positional id is accepted; --project wins
+  // when both are supplied. Falls back to the active project when neither
+  // is given. Keeps backward-compat with the legacy `subdomains list <id>`
+  // form (GH-231; mirrors the GH-209 fix for `domains list`).
+  const projectId = resolveProjectId(project || rest[0]);
   try {
     const data = await getSdk().subdomains.list(projectId);
     console.log(JSON.stringify(data, null, 2));
@@ -177,7 +193,7 @@ export async function run(sub, args) {
       break;
     }
     case "delete": await deleteSubdomain(args); break;
-    case "list":   await list(args[0]); break;
+    case "list":   await list(args); break;
     default:
       console.error(`Unknown subcommand: ${sub}\n`);
       console.log(HELP);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "run402",
-  "version": "1.54.3",
+  "version": "1.55.0",
   "description": "CLI for Run402 — provision Postgres databases, deploy static sites, generate images, and manage wallets via x402 and MPP micropayments.",
   "type": "module",
   "bin": {

package/sdk/core-dist/allowance-auth.js

@@ -70,16 +70,44 @@ export function formatSIWEMessage(opts, address) {
         opts.statement,
         "",
         `URI: ${opts.uri}`,
-        `Version: ${opts.version}`,
-        `Chain ID: ${opts.chainId}`,
+        `Version: ${opts.version ?? "1"}`,
+        `Chain ID: ${messageChainId(opts.chainId)}`,
         `Nonce: ${opts.nonce}`,
         `Issued At: ${opts.issuedAt}`,
     ];
     if (opts.expirationTime) {
         lines.push(`Expiration Time: ${opts.expirationTime}`);
     }
+    if (opts.resources && opts.resources.length > 0) {
+        lines.push("Resources:");
+        for (const resource of opts.resources)
+            lines.push(`- ${resource}`);
+    }
     return lines.join("\n");
 }
+export function buildSIWxAuthHeaders(opts) {
+    const message = formatSIWEMessage(opts, opts.allowance.address);
+    const signature = personalSign(opts.allowance.privateKey, opts.allowance.address, message);
+    const payload = {
+        domain: opts.domain,
+        address: toChecksumAddress(opts.allowance.address),
+        statement: opts.statement,
+        uri: opts.uri,
+        version: opts.version ?? "1",
+        chainId: payloadChainId(opts.chainId),
+        type: opts.type ?? "eip191",
+        nonce: opts.nonce,
+        issuedAt: opts.issuedAt,
+        expirationTime: opts.expirationTime,
+        signature,
+    };
+    if (opts.resources !== undefined) {
+        payload.resources = opts.resources;
+    }
+    return {
+        "SIGN-IN-WITH-X": Buffer.from(JSON.stringify(payload)).toString("base64"),
+    };
+}
 /**
  * Get SIWX auth headers for the Run402 API.
  * Returns null if no allowance is configured.
@@ -103,32 +131,24 @@ export function getAllowanceAuthHeaders(path, allowancePath) {
     const now = new Date();
     const issuedAt = now.toISOString();
     const expirationTime = new Date(now.getTime() + 5 * 60 * 1000).toISOString();
-    const message = formatSIWEMessage({
+    return buildSIWxAuthHeaders({
+        allowance,
         domain,
         uri,
         statement: "Sign in to Run402",
-        version: "1",
-        chainId: 84532, // Base Sepolia
-        nonce,
-        issuedAt,
-        expirationTime,
-    }, allowance.address);
-    const signature = personalSign(allowance.privateKey, allowance.address, message);
-    const payload = {
-        domain,
-        address: toChecksumAddress(allowance.address),
-        statement: "Sign in to Run402",
-        uri,
-        version: "1",
         chainId: "eip155:84532",
-        type: "eip191",
         nonce,
         issuedAt,
         expirationTime,
-        signature,
-    };
-    return {
-        "SIGN-IN-WITH-X": Buffer.from(JSON.stringify(payload)).toString("base64"),
-    };
+    });
+}
+function messageChainId(chainId) {
+    if (typeof chainId === "number")
+        return String(chainId);
+    const match = /^eip155:(\d+)$/.exec(chainId);
+    return match ? match[1] : chainId;
+}
+function payloadChainId(chainId) {
+    return typeof chainId === "number" ? `eip155:${chainId}` : chainId;
 }
 //# sourceMappingURL=allowance-auth.js.map

package/sdk/dist/ci-credentials.d.ts

@@ -0,0 +1,22 @@
+/** CI-session credential helpers for OIDC-backed deploy flows. */
+import type { CredentialsProvider } from "./credentials.js";
+export declare const CI_SESSION_CREDENTIALS: unique symbol;
+export interface CiMarkedCredentialsProvider extends CredentialsProvider {
+    readonly [CI_SESSION_CREDENTIALS]: true;
+}
+export interface CreateCiSessionCredentialsOptions {
+    projectId: string;
+    accessToken?: string;
+    getAccessToken?: () => Promise<string>;
+}
+export interface GithubActionsCredentialsOptions {
+    projectId: string;
+    apiBase?: string;
+    audience?: string;
+    refreshBeforeSeconds?: number;
+    fetch?: typeof globalThis.fetch;
+}
+export declare function isCiSessionCredentials(credentials: CredentialsProvider): credentials is CiMarkedCredentialsProvider;
+export declare function createCiSessionCredentials(opts: CreateCiSessionCredentialsOptions): CiMarkedCredentialsProvider;
+export declare function githubActionsCredentials(opts: GithubActionsCredentialsOptions): CiMarkedCredentialsProvider;
+//# sourceMappingURL=ci-credentials.d.ts.map

package/sdk/dist/ci-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-credentials.d.ts","sourceRoot":"","sources":["../src/ci-credentials.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAElE,OAAO,KAAK,EAAE,mBAAmB,EAAe,MAAM,kBAAkB,CAAC;AASzE,eAAO,MAAM,sBAAsB,eAAmD,CAAC;AAEvF,MAAM,WAAW,2BAA4B,SAAQ,mBAAmB;IACtE,QAAQ,CAAC,CAAC,sBAAsB,CAAC,EAAE,IAAI,CAAC;CACzC;AAED,MAAM,WAAW,iCAAiC;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,+BAA+B;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CACjC;AAED,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,mBAAmB,GAC/B,WAAW,IAAI,2BAA2B,CAE5C;AAED,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,iCAAiC,GACtC,2BAA2B,CAuC7B;AAED,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,+BAA+B,GACpC,2BAA2B,CA4B7B"}

package/sdk/dist/ci-credentials.js

@@ -0,0 +1,103 @@
+/** CI-session credential helpers for OIDC-backed deploy flows. */
+import { LocalError } from "./errors.js";
+import { buildClient } from "./kernel.js";
+import { Ci } from "./namespaces/ci.js";
+import { CI_AUDIENCE, } from "./namespaces/ci.types.js";
+export const CI_SESSION_CREDENTIALS = Symbol.for("@run402/sdk/ci-session-credentials");
+export function isCiSessionCredentials(credentials) {
+    return Boolean(credentials[CI_SESSION_CREDENTIALS]);
+}
+export function createCiSessionCredentials(opts) {
+    if (!opts?.projectId) {
+        throw new LocalError("createCiSessionCredentials requires projectId", "creating CI session credentials");
+    }
+    if (!opts.accessToken && !opts.getAccessToken) {
+        throw new LocalError("createCiSessionCredentials requires accessToken or getAccessToken", "creating CI session credentials");
+    }
+    const provider = {
+        async getAuth() {
+            const token = opts.getAccessToken ? await opts.getAccessToken() : opts.accessToken;
+            if (!token) {
+                throw new LocalError("CI session credentials did not return an access token", "authenticating with CI session");
+            }
+            return { Authorization: `Bearer ${token}` };
+        },
+        async getProject(id) {
+            if (id !== opts.projectId)
+                return null;
+            return { anon_key: "", service_key: "" };
+        },
+        async getActiveProject() {
+            return opts.projectId;
+        },
+    };
+    Object.defineProperty(provider, CI_SESSION_CREDENTIALS, {
+        value: true,
+        enumerable: false,
+    });
+    return provider;
+}
+export function githubActionsCredentials(opts) {
+    if (!opts?.projectId) {
+        throw new LocalError("githubActionsCredentials requires projectId", "creating GitHub Actions CI credentials");
+    }
+    const apiBase = opts.apiBase ?? CI_AUDIENCE;
+    const audience = opts.audience ?? CI_AUDIENCE;
+    const fetchImpl = opts.fetch ?? globalThis.fetch.bind(globalThis);
+    const refreshBeforeMs = Math.max(0, opts.refreshBeforeSeconds ?? 60) * 1000;
+    let cached = null;
+    return createCiSessionCredentials({
+        projectId: opts.projectId,
+        getAccessToken: async () => {
+            const now = Date.now();
+            if (cached && now < cached.refreshAtMs)
+                return cached.token;
+            const subjectToken = await requestGithubOidcToken(fetchImpl, audience);
+            const exchanged = await exchangeWithRun402Ci(fetchImpl, apiBase, opts.projectId, subjectToken);
+            cached = {
+                token: exchanged.access_token,
+                refreshAtMs: now + Math.max(0, exchanged.expires_in * 1000 - refreshBeforeMs),
+            };
+            return cached.token;
+        },
+    });
+}
+async function requestGithubOidcToken(fetchImpl, audience) {
+    const env = getProcessEnv();
+    const requestUrl = env.ACTIONS_ID_TOKEN_REQUEST_URL;
+    const requestToken = env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
+    if (!requestUrl || !requestToken) {
+        throw new LocalError("GitHub Actions OIDC environment is missing ACTIONS_ID_TOKEN_REQUEST_URL or ACTIONS_ID_TOKEN_REQUEST_TOKEN. Ensure the workflow has permissions: id-token: write.", "requesting GitHub Actions OIDC token");
+    }
+    const url = new URL(requestUrl);
+    url.searchParams.set("audience", audience);
+    const res = await fetchImpl(url.toString(), {
+        headers: { Authorization: `Bearer ${requestToken}` },
+    });
+    const body = await res.json().catch(() => null);
+    if (!res.ok || typeof body?.value !== "string" || body.value.length === 0) {
+        throw new LocalError(`GitHub Actions OIDC token request failed (HTTP ${res.status})`, "requesting GitHub Actions OIDC token");
+    }
+    return body.value;
+}
+async function exchangeWithRun402Ci(fetchImpl, apiBase, projectId, subjectToken) {
+    const noAuth = {
+        async getAuth() {
+            return null;
+        },
+        async getProject() {
+            return null;
+        },
+    };
+    const ci = new Ci(buildClient({
+        apiBase,
+        fetch: fetchImpl,
+        credentials: noAuth,
+    }));
+    return ci.exchangeToken({ project_id: projectId, subject_token: subjectToken });
+}
+function getProcessEnv() {
+    const proc = globalThis;
+    return proc.process?.env ?? {};
+}
+//# sourceMappingURL=ci-credentials.js.map

package/sdk/dist/ci-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-credentials.js","sourceRoot":"","sources":["../src/ci-credentials.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAGlE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AACxC,OAAO,EACL,WAAW,GAEZ,MAAM,0BAA0B,CAAC;AAElC,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;AAoBvF,MAAM,UAAU,sBAAsB,CACpC,WAAgC;IAEhC,OAAO,OAAO,CAAE,WAAoD,CAAC,sBAAsB,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,IAAuC;IAEvC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QACrB,MAAM,IAAI,UAAU,CAClB,+CAA+C,EAC/C,iCAAiC,CAClC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QAC9C,MAAM,IAAI,UAAU,CAClB,mEAAmE,EACnE,iCAAiC,CAClC,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAwB;QACpC,KAAK,CAAC,OAAO;YACX,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;YACnF,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,UAAU,CAClB,uDAAuD,EACvD,gCAAgC,CACjC,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;QAC9C,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,EAAU;YACzB,IAAI,EAAE,KAAK,IAAI,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC;YACvC,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;QAC3C,CAAC;QACD,KAAK,CAAC,gBAAgB;YACpB,OAAO,IAAI,CAAC,SAAS,CAAC;QACxB,CAAC;KACF,CAAC;IAEF,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,sBAAsB,EAAE;QACtD,KAAK,EAAE,IAAI;QACX,UAAU,EAAE,KAAK;KAClB,CAAC,CAAC;IACH,OAAO,QAAuC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,IAAqC;IAErC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QACrB,MAAM,IAAI,UAAU,CAClB,6CAA6C,EAC7C,wCAAwC,CACzC,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,WAAW,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,WAAW,CAAC;IAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAClE,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,oBAAoB,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;IAC5E,IAAI,MAAM,GAAkD,IAAI,CAAC;IAEjE,OAAO,0BAA0B,CAAC;QAChC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,cAAc,EAAE,KAAK,IAAI,EAAE;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,IAAI,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,WAAW;gBAAE,OAAO,MAAM,CAAC,KAAK,CAAC;YAE5D,MAAM,YAAY,GAAG,MAAM,sBAAsB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACvE,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;YAC/F,MAAM,GAAG;gBACP,KAAK,EAAE,SAAS,CAAC,YAAY;gBAC7B,WAAW,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,UAAU,GAAG,IAAI,GAAG,eAAe,CAAC;aAC9E,CAAC;YACF,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,SAAkC,EAClC,QAAgB;IAEhB,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,MAAM,UAAU,GAAG,GAAG,CAAC,4BAA4B,CAAC;IACpD,MAAM,YAAY,GAAG,GAAG,CAAC,8BAA8B,CAAC;IACxD,IAAI,CAAC,UAAU,IAAI,CAAC,YAAY,EAAE,CAAC;QACjC,MAAM,IAAI,UAAU,CAClB,kKAAkK,EAClK,sCAAsC,CACvC,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAChC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;QAC1C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,YAAY,EAAE,EAAE;KACrD,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAA+B,CAAC;IAC9E,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,UAAU,CAClB,kDAAkD,GAAG,CAAC,MAAM,GAAG,EAC/D,sCAAsC,CACvC,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,SAAkC,EAClC,OAAe,EACf,SAAiB,EACjB,YAAoB;IAEpB,MAAM,MAAM,GAAwB;QAClC,KAAK,CAAC,OAAO;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,CAAC,UAAU;YACd,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;IACF,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC,WAAW,CAAC;QAC5B,OAAO;QACP,KAAK,EAAE,SAAS;QAChB,WAAW,EAAE,MAAM;KACpB,CAAC,CAAC,CAAC;IACJ,OAAO,EAAE,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,aAAa;IACpB,MAAM,IAAI,GAAG,UAEZ,CAAC;IACF,OAAO,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;AACjC,CAAC"}

package/sdk/dist/index.d.ts

@@ -25,6 +25,7 @@ import { Email } from "./namespaces/email.js";
 import { Contracts } from "./namespaces/contracts.js";
 import { Admin } from "./namespaces/admin.js";
 import { Deploy } from "./namespaces/deploy.js";
+import { Ci } from "./namespaces/ci.js";
 import type { ContentSource, FileSet } from "./namespaces/deploy.types.js";
 import { ScopedRun402 } from "./scoped.js";
 export interface Run402Options {
@@ -61,6 +62,7 @@ export declare class Run402 {
     readonly contracts: Contracts;
     readonly admin: Admin;
     readonly deploy: Deploy;
+    readonly ci: Ci;
     constructor(opts: Run402Options);
     /**
      * Return a project-scoped sub-client where every project-id-bearing namespace
@@ -122,7 +124,11 @@ export { withRetry } from "./retry.js";
 export type { RetryOptions } from "./retry.js";
 export type { CredentialsProvider, ProjectKeys } from "./credentials.js";
 export type { RequestOptions, Client } from "./kernel.js";
+export { CI_SESSION_CREDENTIALS, createCiSessionCredentials, githubActionsCredentials, isCiSessionCredentials, } from "./ci-credentials.js";
+export type { CiMarkedCredentialsProvider, CreateCiSessionCredentialsOptions, GithubActionsCredentialsOptions, } from "./ci-credentials.js";
 export { Deploy } from "./namespaces/deploy.js";
+export { Ci, CI_AUDIENCE, CI_GITHUB_ACTIONS_ISSUER, CI_GITHUB_ACTIONS_PROVIDER, DEFAULT_CI_DELEGATION_CHAIN_ID, V1_CI_ALLOWED_ACTIONS, V1_CI_ALLOWED_EVENTS_DEFAULT, assertCiDeployableSpec, buildCiDelegationResourceUri, buildCiDelegationStatement, normalizeCiDelegationValues, validateCiNonce, validateCiSubjectMatch, } from "./namespaces/ci.js";
 export { ScopedRun402 } from "./scoped.js";
+export type { CiAllowedAction, CiAllowedEvent, CiBindingErrorCode, CiBindingRow, CiCreateBindingInput, CiDelegationValues, CiDeployErrorCode, CiErrorCode, CiListBindingsInput, CiListBindingsResult, CiProvider, CiTokenExchangeErrorCode, CiTokenExchangeInput, CiTokenExchangeRequestBody, CiTokenExchangeResponse, NormalizedCiDelegationValues, ParsedDelegation, } from "./namespaces/ci.types.js";
 export type { ApplyOptions, CommitResponse, CommitStatus, ContentRef, ContentSource, DatabaseSpec, DeployDiff, DeployEvent, DeployOperation, DeployResult, ExposeManifest, FileSet, FsFileSource, FunctionSpec, FunctionsSpec, MigrationSpec, MissingContent, OperationSnapshot, OperationStatus, PaymentRequiredHint, PlanRequest, PlanResponse, ReleaseSpec, RouteSpec, SecretsSpec, SiteSpec, SmokeCheck, StartOptions, SubdomainsSpec, } from "./namespaces/deploy.types.js";
 //# sourceMappingURL=index.d.ts.map

package/sdk/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,MAAM,WAAW,aAAa;IAC5B,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,WAAW,EAAE,mBAAmB,CAAC;IACjC;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CACjC;AAED,qBAAa,MAAM;;IACjB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;IAChB,QAAQ,CAAC,KAAK,EAAG,EAAE,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAIZ,IAAI,EAAE,aAAa;IA4D/B;;;;;;;;;;;;;;;;OAgBG;IACG,OAAO,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAsBjD;;;;;;;;;;;OAWG;IACG,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;CAIpD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,OAAO,CAEpE;AAED;;;GAGG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAElD;AAED,OAAO,EACL,WAAW,EACX,eAAe,EACf,eAAe,EACf,YAAY,EACZ,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,UAAU,EACV,cAAc,EACd,YAAY,EACZ,aAAa,EACb,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,YAAY,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACzE,YAAY,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,YAAY,EACV,YAAY,EACZ,cAAc,EACd,YAAY,EACZ,UAAU,EACV,aAAa,EACb,YAAY,EACZ,UAAU,EACV,WAAW,EACX,eAAe,EACf,YAAY,EACZ,cAAc,EACd,OAAO,EACP,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,WAAW,EACX,YAAY,EACZ,WAAW,EACX,SAAS,EACT,WAAW,EACX,QAAQ,EACR,UAAU,EACV,YAAY,EACZ,cAAc,GACf,MAAM,8BAA8B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AACxC,OAAO,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,MAAM,WAAW,aAAa;IAC5B,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,WAAW,EAAE,mBAAmB,CAAC;IACjC;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CACjC;AAED,qBAAa,MAAM;;IACjB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;IAChB,QAAQ,CAAC,KAAK,EAAG,EAAE,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;gBAIJ,IAAI,EAAE,aAAa;IA6D/B;;;;;;;;;;;;;;;;OAgBG;IACG,OAAO,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAsBjD;;;;;;;;;;;OAWG;IACG,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;CAIpD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,OAAO,CAEpE;AAED;;;GAGG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAElD;AAED,OAAO,EACL,WAAW,EACX,eAAe,EACf,eAAe,EACf,YAAY,EACZ,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,UAAU,EACV,cAAc,EACd,YAAY,EACZ,aAAa,EACb,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,YAAY,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACzE,YAAY,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,2BAA2B,EAC3B,iCAAiC,EACjC,+BAA+B,GAChC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EACL,EAAE,EACF,WAAW,EACX,wBAAwB,EACxB,0BAA0B,EAC1B,8BAA8B,EAC9B,qBAAqB,EACrB,4BAA4B,EAC5B,sBAAsB,EACtB,4BAA4B,EAC5B,0BAA0B,EAC1B,2BAA2B,EAC3B,eAAe,EACf,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,YAAY,EACV,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EACjB,WAAW,EACX,mBAAmB,EACnB,oBAAoB,EACpB,UAAU,EACV,wBAAwB,EACxB,oBAAoB,EACpB,0BAA0B,EAC1B,uBAAuB,EACvB,4BAA4B,EAC5B,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,YAAY,EACZ,cAAc,EACd,YAAY,EACZ,UAAU,EACV,aAAa,EACb,YAAY,EACZ,UAAU,EACV,WAAW,EACX,eAAe,EACf,YAAY,EACZ,cAAc,EACd,OAAO,EACP,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,WAAW,EACX,YAAY,EACZ,WAAW,EACX,SAAS,EACT,WAAW,EACX,QAAQ,EACR,UAAU,EACV,YAAY,EACZ,cAAc,GACf,MAAM,8BAA8B,CAAC"}