@alchemy.run/pkg 0.0.0-placeholder → 2.0.0-beta.79

package/dist/Registry/Handler.js

@@ -0,0 +1,375 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as SQL from "alchemy/SQL/D1";
+import { sha256 } from "alchemy/Util/sha256";
+import * as Clock from "effect/Clock";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Encoding from "effect/Encoding";
+import * as Layer from "effect/Layer";
+import * as Path from "effect/Path";
+import * as Result from "effect/Result";
+import * as Schema from "effect/Schema";
+import * as Etag from "effect/unstable/http/Etag";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import * as HttpPlatform from "effect/unstable/http/HttpPlatform";
+import * as HttpRouter from "effect/unstable/http/HttpRouter";
+import { HttpServerRequest } from "effect/unstable/http/HttpServerRequest";
+import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse";
+import * as HttpApiBuilder from "effect/unstable/httpapi/HttpApiBuilder";
+import { ManifestJson } from "../Manifest.js";
+import { BadRequest, Forbidden, manifestArtifactName, MissingTarballs, PackageTooLarge, PkgApi, RunNotInProgress, RunRef, Upstream, } from "../Protocol.js";
+import { Bucket, Cache, COMMENT_MARKER, Database, RegistryConfig, tarballKey, } from "./Bindings.js";
+import * as GitHub from "./GitHub.js";
+import * as KVCache from "./KVCache.js";
+import { sweep } from "./Sweep.js";
+import * as Tags from "./Tags.js";
+/** What GitHub says about a run. */
+const Run = Schema.Struct({
+    ...RunRef.fields,
+    headSha: Schema.String,
+    headBranch: Schema.NullOr(Schema.String),
+    headRepo: Schema.String,
+    pr: Schema.NullOr(Schema.Number),
+});
+const bindings = Layer.mergeAll(Cloudflare.R2.ReadWriteBucketBinding, Cloudflare.D1.QueryDatabaseBinding, Cloudflare.KV.ReadWriteNamespaceBinding, Cloudflare.Workers.CronEventSourceLive, FetchHttpClient.layer);
+const SHORT = 7;
+/** How long a resolved run is reused for uploads before asking GitHub again. */
+const RUN_CACHE = Duration.minutes(1);
+const CHECK_NAME = "Preview packages";
+/** The public origin a request arrived on. */
+const origin = Effect.map(HttpServerRequest, (request) => `https://${request.headers.host ?? "localhost"}`);
+/**
+ * A run from a fork: its head commit belongs to another repository, so its
+ * workflow file, and therefore everything it packs, is the fork's.
+ */
+const isFork = (run) => run.headRepo !== run.repo;
+/**
+ * Tags every package in a publication receives, all derived from the run.
+ * Runs on the repository's own commits get the head commit, the short
+ * commit, `branch:<name>`, and `pr:N` for pull requests. A fork's run gets
+ * only `pr:N`: commit tags are shared by every publisher, and a fork can
+ * run any commit it likes, including one already published from the
+ * repository, so letting it write them would let it repoint them.
+ */
+export const tagsFor = (run) => {
+    if (isFork(run)) {
+        return run.pr === null ? [] : [`pr:${run.pr}`];
+    }
+    const tags = [run.headSha, run.headSha.slice(0, SHORT)];
+    if (run.pr !== null)
+        tags.push(`pr:${run.pr}`);
+    if (run.headBranch)
+        tags.push(`branch:${run.headBranch}`);
+    return tags;
+};
+/** The tag install commands are written against. */
+export const installTag = (run) => isFork(run) ? `pr:${run.pr}` : run.headSha.slice(0, SHORT);
+const upstream = (e) => new Upstream({ message: GitHub.describe(e) });
+/**
+ * Storage failures are not part of the protocol: they are defects, which
+ * the router answers with a 500 after logging the cause.
+ */
+const storageFailures = ["R2Error", "SqlError", "SchemaError"];
+/**
+ * Resolve the run a request names through GitHub; nothing about it is
+ * trusted from the client. Only allowed repositories are looked up at all,
+ * and the run must be in progress, since requests come from inside it.
+ */
+const lookupRun = Effect.fn("lookupRun")(function* (ref) {
+    const { policy } = yield* RegistryConfig;
+    const github = yield* GitHub.GitHubApp;
+    if (!policy.repos.includes(ref.repo)) {
+        return yield* new Forbidden({ message: `${ref.repo} may not publish` });
+    }
+    const data = yield* github
+        .getRun(ref.repo, ref.runId)
+        .pipe(Effect.mapError(upstream));
+    if (data.status !== "in_progress" ||
+        (data.run_attempt !== undefined && data.run_attempt !== ref.attempt)) {
+        return yield* new RunNotInProgress({ message: "run is not in progress" });
+    }
+    if (data.event !== "push" && data.event !== "pull_request") {
+        return yield* new BadRequest({
+            message: `unsupported event ${data.event}`,
+        });
+    }
+    const headRepo = data.head_repository?.full_name ?? data.repository.full_name;
+    let pr = null;
+    if (data.event === "pull_request") {
+        // The pull request whose head is this run's head, from the repository
+        // the run's head lives in. The same commit can head several pull
+        // requests, including one opened from a fork against a commit the
+        // repository already published; matching the head repository keeps a
+        // run's publication on its own pull request.
+        const pulls = yield* github
+            .pullRequestsForCommit(ref.repo, headRepo, data.head_sha)
+            .pipe(Effect.mapError(upstream));
+        const first = pulls[0];
+        if (first === undefined) {
+            return yield* new BadRequest({
+                message: `no pull request from ${headRepo} has head ${data.head_sha}`,
+            });
+        }
+        pr = first.number;
+    }
+    else if (headRepo !== ref.repo) {
+        return yield* new BadRequest({
+            message: `push run ${ref.runId} is for ${headRepo}, not ${ref.repo}`,
+        });
+    }
+    return {
+        ...ref,
+        headSha: data.head_sha,
+        headBranch: data.head_branch,
+        headRepo,
+        pr,
+    };
+});
+/**
+ * The proof. The job uploaded the manifest as an artifact of its run,
+ * named by the manifest's hash. Only the job can add artifacts to the
+ * run, and GitHub reports the run's artifacts to the App, so a matching
+ * name means this run vouched for exactly this manifest text.
+ */
+const requireVouched = Effect.fn("requireVouched")(function* (run, manifestText) {
+    const github = yield* GitHub.GitHubApp;
+    const expected = manifestArtifactName(yield* sha256(manifestText));
+    const artifacts = yield* github
+        .listRunArtifacts(run.repo, run.runId, expected)
+        .pipe(Effect.mapError(upstream));
+    if (!artifacts.some((a) => a.name === expected && !a.expired)) {
+        return yield* new Forbidden({
+            message: `run ${run.runId} has not vouched for this manifest (no artifact ${expected})`,
+        });
+    }
+});
+const publish = Effect.fn("publish")(function* (run, manifestText) {
+    const { policy } = yield* RegistryConfig;
+    const r2 = yield* Cloudflare.R2.ReadWriteBucket(Bucket);
+    const github = yield* GitHub.GitHubApp;
+    const base = yield* origin;
+    yield* requireVouched(run, manifestText);
+    const manifest = yield* Schema.decodeUnknownEffect(ManifestJson)(manifestText).pipe(Effect.mapError((e) => new BadRequest({ message: `invalid manifest: ${String(e)}` })));
+    // The run vouched for the manifest, but the tags come from the run's
+    // head, so the packed checkout has to be that commit: a `pull_request`
+    // job that packs the synthetic merge commit would otherwise publish bytes
+    // built from a commit that exists nowhere under the commit's name.
+    if (manifest.head !== run.headSha) {
+        return yield* new BadRequest({
+            message: `manifest was packed at ${manifest.head}, but the run's head is ${run.headSha}`,
+        });
+    }
+    const packages = manifest.packages;
+    const maxSize = policy.maxPackageSize;
+    const tooLarge = maxSize === undefined
+        ? undefined
+        : packages.find((pkg) => BigInt(pkg.size) > maxSize);
+    if (tooLarge !== undefined) {
+        return yield* new PackageTooLarge({
+            message: `${tooLarge.name} exceeds ${maxSize} bytes`,
+        });
+    }
+    const missing = yield* Effect.filter(packages, (pkg) => r2
+        .head(tarballKey(pkg.name, pkg.sha256))
+        .pipe(Effect.map((object) => object === null)), { concurrency: 8 }).pipe(Effect.map((packages) => packages.map(({ name, sha256 }) => ({ name, sha256 }))));
+    if (missing.length > 0) {
+        return yield* new MissingTarballs({ missing });
+    }
+    const now = yield* Clock.currentTimeMillis;
+    const expiresAt = now + Duration.toMillis(policy.ttl);
+    const prs = run.pr !== null ? [`${run.repo}#${run.pr}`] : [];
+    const tags = tagsFor(run);
+    const tag = installTag(run);
+    const published = yield* Effect.forEach(packages, Effect.fn(function* (pkg) {
+        yield* Effect.forEach(tags, (tag) => Tags.upsert({
+            package: pkg.name,
+            tag,
+            sha256: pkg.sha256,
+            expiresAt,
+            prs,
+        }), { discard: true });
+        return {
+            name: pkg.name,
+            group: pkg.group,
+            url: `${base}/${pkg.name}/${tag}`,
+            tags,
+        };
+    }), { concurrency: 4 });
+    // A check on the commit itself, so the install lines are visible on
+    // pushes and on fork pull requests alike.
+    yield* github
+        .createCheckRun(run.repo, {
+        headSha: run.headSha,
+        name: CHECK_NAME,
+        title: `${packages.length} package(s) published`,
+        summary: GitHub.renderInstalls(published, manifest.groups),
+        detailsUrl: base,
+    })
+        .pipe(Effect.catch((e) => Effect.logWarning(`check run on ${run.repo}@${run.headSha} failed: ${GitHub.describe(e)}`)));
+    if (run.pr !== null) {
+        const body = GitHub.renderComment(published, manifest.groups, {
+            publishedAt: now,
+            expiresAt,
+        });
+        yield* github
+            .upsertComment(run.repo, run.pr, COMMENT_MARKER, body)
+            .pipe(Effect.catch((e) => Effect.logWarning(`comment on ${run.repo}#${run.pr} failed: ${GitHub.describe(e)}`)));
+    }
+    return { packages: published };
+});
+/**
+ * Content-addressed upload, streamed straight into R2 with the hash
+ * verified by R2 itself. Untagged objects are swept after a day.
+ */
+const uploadTarball = Effect.fn("uploadTarball")(function* (request, name, sha256) {
+    const { policy } = yield* RegistryConfig;
+    const r2 = yield* Cloudflare.R2.ReadWriteBucket(Bucket);
+    const contentLength = Number(request.headers["content-length"] ?? 0);
+    if (!Number.isSafeInteger(contentLength) || contentLength <= 0) {
+        return yield* new BadRequest({ message: "Content-Length is required" });
+    }
+    const maxSize = policy.maxPackageSize;
+    if (maxSize !== undefined && BigInt(contentLength) > maxSize) {
+        return yield* new PackageTooLarge({
+            message: `tarball exceeds ${maxSize} bytes`,
+        });
+    }
+    const key = tarballKey(name, sha256);
+    const existing = yield* r2.head(key);
+    if (existing !== null) {
+        return { name, sha256, size: existing.size, uploaded: false };
+    }
+    yield* r2
+        .put(key, request.stream, {
+        contentLength,
+        // The params schema already constrained this to 64 hex chars.
+        sha256: Result.getOrThrow(Encoding.decodeHex(sha256)),
+    })
+        .pipe(Effect.mapError((e) => new BadRequest({ message: `upload rejected: ${String(e)}` })));
+    return { name, sha256, size: contentLength, uploaded: true };
+});
+/**
+ * Parse `/<name>/<tag>` and `/<name>/-/<sha256>.tgz`. Scoped names take
+ * two segments; the tag is everything after the name and may itself contain
+ * `/` and `:`.
+ */
+export const parseInstallPath = (pathname, scope) => {
+    let path;
+    try {
+        path = decodeURIComponent(pathname.replace(/^\/+/, ""));
+    }
+    catch {
+        // Malformed percent-encoding is a path nothing can be published under.
+        return undefined;
+    }
+    const tarball = path.match(/^(@[^/]+\/[^/@]+|[^/@]+)\/-\/([a-f0-9]{64})\.tgz$/);
+    if (tarball) {
+        return {
+            kind: "tarball",
+            name: qualify(tarball[1], scope),
+            sha256: tarball[2],
+        };
+    }
+    const segments = path.split("/");
+    const nameLength = path.startsWith("@") ? 2 : 1;
+    const name = segments.slice(0, nameLength).join("/");
+    const tag = segments.slice(nameLength).join("/");
+    if (segments.length <= nameLength || name === "" || tag === "") {
+        return undefined;
+    }
+    return { kind: "tag", name: qualify(name, scope), tag };
+};
+const qualify = (name, scope) => scope !== undefined && !name.startsWith("@") ? `${scope}/${name}` : name;
+const notFound = (message) => HttpServerResponse.json({ error: message }, { status: 404 });
+/**
+ * Install URLs: `/<name>/<tag>` redirects to the immutable tarball URL,
+ * `/<name>/-/<sha256>.tgz` streams it from R2. Everything the API routes
+ * do not claim lands here.
+ */
+const install = Effect.gen(function* () {
+    const request = yield* HttpServerRequest;
+    const { aliases } = yield* RegistryConfig;
+    const r2 = yield* Cloudflare.R2.ReadWriteBucket(Bucket);
+    if (request.method !== "GET" && request.method !== "HEAD") {
+        return yield* HttpServerResponse.json({ error: "method not allowed" }, { status: 405 });
+    }
+    const host = request.headers.host ?? "localhost";
+    const target = parseInstallPath(new URL(request.url, `https://${host}`).pathname, aliases[host]);
+    if (target === undefined) {
+        return yield* notFound("not found");
+    }
+    if (target.kind === "tag") {
+        const sha256 = yield* Tags.resolve(target.name, target.tag);
+        if (sha256 === undefined) {
+            return yield* notFound(`${target.name}@${target.tag} not found`);
+        }
+        return HttpServerResponse.redirect(`/${target.name}/-/${sha256}.tgz`, {
+            status: 302,
+            headers: { "cache-control": "no-store" },
+        });
+    }
+    const object = yield* r2.get(tarballKey(target.name, target.sha256));
+    if (object === null) {
+        return yield* notFound("tarball not found");
+    }
+    const headers = {
+        "content-type": "application/gzip",
+        "content-length": String(object.size),
+        "cache-control": "public, max-age=31536000, immutable",
+    };
+    return request.method === "HEAD"
+        ? HttpServerResponse.empty({ status: 200, headers })
+        : HttpServerResponse.stream(object.body, { status: 200, headers });
+});
+const banner = Effect.map(origin, (base) => HttpServerResponse.text(`Preview package registry. Install with: bun add ${base}/<package>/<commit|branch:name|pr:N>\n`));
+/**
+ * The registry never serves files, so the HTTP platform's file surface is
+ * stubbed rather than pulling a file system into the Worker.
+ */
+const HttpPlatformStub = Layer.succeed(HttpPlatform.HttpPlatform, {
+    platform: "web",
+    compression: {
+        algorithms: new Set(),
+        compressResponse: (response) => Effect.succeed(response),
+    },
+    fileResponse: () => Effect.die("fileResponse is not supported"),
+    fileWebResponse: () => Effect.die("fileWebResponse is not supported"),
+});
+/**
+ * The registry Worker's Init phase. Runs at plan time to register bindings
+ * and the cron trigger, and once per isolate at runtime to build the
+ * router. Everything it needs comes from {@link RegistryConfig}.
+ */
+export const handler = Effect.gen(function* () {
+    const config = yield* RegistryConfig;
+    // Binding the capabilities here is what registers the R2, D1, and KV
+    // bindings on the Worker at plan time. Handlers bind them again per event,
+    // which at runtime is just a lookup in the Worker's environment.
+    yield* Cloudflare.R2.ReadWriteBucket(Bucket);
+    yield* Cloudflare.KV.ReadWriteNamespace(Cache);
+    const d1 = yield* Cloudflare.D1.QueryDatabase(Database);
+    // Built once per isolate. The D1 client memoizes its connection on each
+    // event's scope, so its layer is safe to share.
+    const github = yield* GitHub.GitHubApp.pipe(Effect.provide(GitHub.GitHubAppLive));
+    const services = Layer.mergeAll(Cloudflare.R2.ReadWriteBucketBinding, Cloudflare.KV.ReadWriteNamespaceBinding, SQL.D1Layer(d1), Layer.succeed(GitHub.GitHubApp, github), Layer.succeed(RegistryConfig, config));
+    // Recently resolved runs are reused so the uploads that follow a publish
+    // do not repeat the lookup. Failures are not kept.
+    const runs = KVCache.make((ref) => `run:${ref.repo}#${ref.runId}:${ref.attempt}`, Run, (ref) => Effect.map(lookupRun(ref), (value) => ({ value, ttl: RUN_CACHE })));
+    yield* Cloudflare.Workers.cron(config.cron, () => sweep.pipe(Effect.provide(services)));
+    const registry = HttpApiBuilder.group(PkgApi, "Registry", (handlers) => handlers
+        .handle("publish", ({ payload }) => Effect.flatMap(runs(payload.run), (run) => publish(run, payload.manifest)).pipe(Effect.catchTag(storageFailures, (e) => Effect.die(e))))
+        // Raw so the body streams into R2 instead of being buffered.
+        .handleRaw("uploadTarball", ({ query, params, request }) => Effect.andThen(runs(query), uploadTarball(request, params.name, params.sha256)).pipe(Effect.catchTag("R2Error", (e) => Effect.die(e)))));
+    const healthGroup = HttpApiBuilder.group(PkgApi, "Health", (handlers) => handlers.handle("health", () => Effect.succeed({ ok: true })));
+    // Unlike `HttpApiBuilder.group`, the router defers a route's requirements
+    // to request time rather than the layer build, so the services are
+    // provided on the route effect itself.
+    const installRoutes = HttpRouter.use((router) => Effect.all([
+        router.add("GET", "/", banner),
+        router.add("*", "/*", install.pipe(Effect.catchTag(storageFailures, (e) => Effect.die(e)), Effect.provide(services))),
+    ]));
+    return {
+        fetch: Layer.mergeAll(HttpApiBuilder.layer(PkgApi), installRoutes).pipe(Layer.provide([registry, healthGroup]), Layer.provide([Etag.layer, HttpPlatformStub, Path.layer]), Layer.provide(services), HttpRouter.toHttpEffect),
+    };
+}).pipe(Effect.provide(bindings));
+//# sourceMappingURL=Handler.js.map

package/dist/Registry/Handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Handler.js","sourceRoot":"","sources":["../../src/Registry/Handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,UAAU,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,GAAG,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,IAAI,MAAM,2BAA2B,CAAC;AAClD,OAAO,KAAK,eAAe,MAAM,sCAAsC,CAAC;AACxE,OAAO,KAAK,YAAY,MAAM,mCAAmC,CAAC;AAClE,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAC3E,OAAO,KAAK,kBAAkB,MAAM,yCAAyC,CAAC;AAC9E,OAAO,KAAK,cAAc,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,YAAY,EAAwB,MAAM,gBAAgB,CAAC;AACpE,OAAO,EACL,UAAU,EACV,SAAS,EACT,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,MAAM,EACN,gBAAgB,EAChB,MAAM,EACN,QAAQ,GACT,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,MAAM,EACN,KAAK,EACL,cAAc,EACd,QAAQ,EACR,cAAc,EACd,UAAU,GACX,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,OAAO,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,oCAAoC;AACpC,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC;IACxB,GAAG,MAAM,CAAC,MAAM;IAChB,OAAO,EAAE,MAAM,CAAC,MAAM;IACtB,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;IACxC,QAAQ,EAAE,MAAM,CAAC,MAAM;IACvB,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;CACjC,CAAC,CAAC;AAGH,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAC7B,UAAU,CAAC,EAAE,CAAC,sBAAsB,EACpC,UAAU,CAAC,EAAE,CAAC,oBAAoB,EAClC,UAAU,CAAC,EAAE,CAAC,yBAAyB,EACvC,UAAU,CAAC,OAAO,CAAC,mBAAmB,EACtC,eAAe,CAAC,KAAK,CACtB,CAAC;AAEF,MAAM,KAAK,GAAG,CAAC,CAAC;AAEhB,gFAAgF;AAChF,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAEtC,MAAM,UAAU,GAAG,kBAAkB,CAAC;AAEtC,8CAA8C;AAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CACvB,iBAAiB,EACjB,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAC9D,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,GAAG,CAAC,GAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,CAAC;AAEvD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,GAAQ,EAAY,EAAE;IAC5C,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAChB,OAAO,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IACxD,IAAI,GAAG,CAAC,EAAE,KAAK,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/C,IAAI,GAAG,CAAC,UAAU;QAAE,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1D,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,oDAAoD;AACpD,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAQ,EAAE,EAAE,CACrC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AAE7D,MAAM,QAAQ,GAAG,CAAC,CAAuD,EAAE,EAAE,CAC3E,IAAI,QAAQ,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAEhD;;;GAGG;AACH,MAAM,eAAe,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,aAAa,CAAU,CAAC;AAExE;;;;GAIG;AACH,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,EAAE,GAAW;IAC7D,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;IACzC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;IAEvC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,kBAAkB,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM;SACvB,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC;SAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnC,IACE,IAAI,CAAC,MAAM,KAAK,aAAa;QAC7B,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,GAAG,CAAC,OAAO,CAAC,EACpE,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,IAAI,gBAAgB,CAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,KAAK,cAAc,EAAE,CAAC;QAC3D,OAAO,KAAK,CAAC,CAAC,IAAI,UAAU,CAAC;YAC3B,OAAO,EAAE,qBAAqB,IAAI,CAAC,KAAK,EAAE;SAC3C,CAAC,CAAC;IACL,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;IAC9E,IAAI,EAAE,GAAkB,IAAI,CAAC;IAC7B,IAAI,IAAI,CAAC,KAAK,KAAK,cAAc,EAAE,CAAC;QAClC,sEAAsE;QACtE,iEAAiE;QACjE,kEAAkE;QAClE,qEAAqE;QACrE,6CAA6C;QAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM;aACxB,qBAAqB,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC;aACxD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,KAAK,CAAC,CAAC,IAAI,UAAU,CAAC;gBAC3B,OAAO,EAAE,wBAAwB,QAAQ,aAAa,IAAI,CAAC,QAAQ,EAAE;aACtE,CAAC,CAAC;QACL,CAAC;QACD,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC;IACpB,CAAC;SAAM,IAAI,QAAQ,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC,CAAC,IAAI,UAAU,CAAC;YAC3B,OAAO,EAAE,YAAY,GAAG,CAAC,KAAK,WAAW,QAAQ,SAAS,GAAG,CAAC,IAAI,EAAE;SACrE,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,GAAG,GAAG;QACN,OAAO,EAAE,IAAI,CAAC,QAAQ;QACtB,UAAU,EAAE,IAAI,CAAC,WAAW;QAC5B,QAAQ;QACR,EAAE;KACW,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,cAAc,GAAG,MAAM,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,EAC1D,GAAQ,EACR,YAAoB;IAEpB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;IACvC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM;SAC5B,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC;SAC/C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9D,OAAO,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC;YAC1B,OAAO,EAAE,OAAO,GAAG,CAAC,KAAK,mDAAmD,QAAQ,GAAG;SACxF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,EAC5C,GAAQ,EACR,YAAoB;IAEpB,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;IACzC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;IACvC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC;IAE3B,KAAK,CAAC,CAAC,cAAc,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAC9D,YAAY,CACb,CAAC,IAAI,CACJ,MAAM,CAAC,QAAQ,CACb,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,EAAE,OAAO,EAAE,qBAAqB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CACrE,CACF,CAAC;IACF,qEAAqE;IACrE,uEAAuE;IACvE,0EAA0E;IAC1E,mEAAmE;IACnE,IAAI,QAAQ,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC;QAClC,OAAO,KAAK,CAAC,CAAC,IAAI,UAAU,CAAC;YAC3B,OAAO,EAAE,0BAA0B,QAAQ,CAAC,IAAI,2BAA2B,GAAG,CAAC,OAAO,EAAE;SACzF,CAAC,CAAC;IACL,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;IACnC,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,CAAC;IACtC,MAAM,QAAQ,GACZ,OAAO,KAAK,SAAS;QACnB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;IACzD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC,CAAC,IAAI,eAAe,CAAC;YAChC,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,YAAY,OAAO,QAAQ;SACrD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAClC,QAAQ,EACR,CAAC,GAAG,EAAE,EAAE,CACN,EAAE;SACC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;SACtC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,EAClD,EAAE,WAAW,EAAE,CAAC,EAAE,CACnB,CAAC,IAAI,CACJ,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CACtB,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CACvD,CACF,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC,CAAC,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;IAC3C,MAAM,SAAS,GAAG,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACrC,QAAQ,EACR,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,GAAoB;QACvC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACnB,IAAI,EACJ,CAAC,GAAG,EAAE,EAAE,CACN,IAAI,CAAC,MAAM,CAAC;YACV,OAAO,EAAE,GAAG,CAAC,IAAI;YACjB,GAAG;YACH,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,SAAS;YACT,GAAG;SACJ,CAAC,EACJ,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CAAC;QACF,OAAO;YACL,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,GAAG,EAAE,GAAG,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,EAAE;YACjC,IAAI;SACL,CAAC;IACJ,CAAC,CAAC,EACF,EAAE,WAAW,EAAE,CAAC,EAAE,CACnB,CAAC;IAEF,oEAAoE;IACpE,0CAA0C;IAC1C,KAAK,CAAC,CAAC,MAAM;SACV,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE;QACxB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,GAAG,QAAQ,CAAC,MAAM,uBAAuB;QAChD,OAAO,EAAE,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC;QAC1D,UAAU,EAAE,IAAI;KACjB,CAAC;SACD,IAAI,CACH,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CACjB,MAAM,CAAC,UAAU,CACf,gBAAgB,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,YAAY,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CACxE,CACF,CACF,CAAC;IACJ,IAAI,GAAG,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE;YAC5D,WAAW,EAAE,GAAG;YAChB,SAAS;SACV,CAAC,CAAC;QACH,KAAK,CAAC,CAAC,MAAM;aACV,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC;aACrD,IAAI,CACH,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CACjB,MAAM,CAAC,UAAU,CACf,cAAc,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,YAAY,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CACjE,CACF,CACF,CAAC;IACN,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,aAAa,GAAG,MAAM,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,EACxD,OAA0B,EAC1B,IAAY,EACZ,MAAc;IAEd,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;IACzC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IAExD,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;QAC/D,OAAO,KAAK,CAAC,CAAC,IAAI,UAAU,CAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,CAAC;IACtC,IAAI,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,aAAa,CAAC,GAAG,OAAO,EAAE,CAAC;QAC7D,OAAO,KAAK,CAAC,CAAC,IAAI,eAAe,CAAC;YAChC,OAAO,EAAE,mBAAmB,OAAO,QAAQ;SAC5C,CAAC,CAAC;IACL,CAAC;IACD,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAChE,CAAC;IACD,KAAK,CAAC,CAAC,EAAE;SACN,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE;QACxB,aAAa;QACb,8DAA8D;QAC9D,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;KACtD,CAAC;SACD,IAAI,CACH,MAAM,CAAC,QAAQ,CACb,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,EAAE,OAAO,EAAE,oBAAoB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CACpE,CACF,CAAC;IACJ,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC/D,CAAC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,QAAgB,EAChB,KAAyB,EAIb,EAAE;IACd,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,mDAAmD,CACpD,CAAC;IACF,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO;YACL,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAE,EAAE,KAAK,CAAC;YACjC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAE;SACpB,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,QAAQ,CAAC,MAAM,IAAI,UAAU,IAAI,IAAI,KAAK,EAAE,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAC/D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC;AAC1D,CAAC,CAAC;AAEF,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,KAAyB,EAAE,EAAE,CAC1D,KAAK,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAE3E,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAE,EAAE,CACnC,kBAAkB,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AAE/D;;;;GAIG;AACH,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC;IACzC,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;IAC1C,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IAExD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1D,OAAO,KAAK,CAAC,CAAC,kBAAkB,CAAC,IAAI,CACnC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAC/B,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IACjD,MAAM,MAAM,GAAG,gBAAgB,CAC7B,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,QAAQ,EAChD,OAAO,CAAC,IAAI,CAAC,CACd,CAAC;IACF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,kBAAkB,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,IAAI,MAAM,MAAM,MAAM,EAAE;YACpE,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE;SACzC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACrE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,OAAO,GAAG;QACd,cAAc,EAAE,kBAAkB;QAClC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;QACrC,eAAe,EAAE,qCAAqC;KACvD,CAAC;IACF,OAAO,OAAO,CAAC,MAAM,KAAK,MAAM;QAC9B,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;QACpD,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AACvE,CAAC,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CACzC,kBAAkB,CAAC,IAAI,CACrB,mDAAmD,IAAI,wCAAwC,CAChG,CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,YAAY,EAAE;IAChE,QAAQ,EAAE,KAAK;IACf,WAAW,EAAE;QACX,UAAU,EAAE,IAAI,GAAG,EAAqC;QACxD,gBAAgB,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;KACzD;IACD,YAAY,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,+BAA+B,CAAC;IAC/D,eAAe,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC;CACtE,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IACzC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;IACrC,qEAAqE;IACrE,2EAA2E;IAC3E,iEAAiE;IACjE,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IAC7C,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IAExD,wEAAwE;IACxE,gDAAgD;IAChD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CACzC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CACrC,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAC7B,UAAU,CAAC,EAAE,CAAC,sBAAsB,EACpC,UAAU,CAAC,EAAE,CAAC,yBAAyB,EACvC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,EACf,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EACvC,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC,CACtC,CAAC;IAEF,yEAAyE;IACzE,mDAAmD;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CACvB,CAAC,GAAW,EAAE,EAAE,CAAC,OAAO,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,EAAE,EAC9D,GAAG,EACH,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,CAC5E,CAAC;IAEF,KAAK,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,CAC/C,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CACrC,CAAC;IAEF,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,QAAQ,EAAE,EAAE,CACrE,QAAQ;SACL,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CACjC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CACxC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,CAC/B,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAC/D;QACD,6DAA6D;SAC5D,SAAS,CAAC,eAAe,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CACzD,MAAM,CAAC,OAAO,CACZ,IAAI,CAAC,KAAK,CAAC,EACX,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CACnD,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CACzD,CACJ,CAAC;IAEF,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CACtE,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAC9D,CAAC;IAEF,0EAA0E;IAC1E,mEAAmE;IACnE,uCAAuC;IACvC,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAC9C,MAAM,CAAC,GAAG,CAAC;QACT,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC;QAC9B,MAAM,CAAC,GAAG,CACR,GAAG,EACH,IAAI,EACJ,OAAO,CAAC,IAAI,CACV,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EACtD,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CACzB,CACF;KACF,CAAC,CACH,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC,IAAI,CACrE,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,EACtC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,gBAAgB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EACzD,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EACvB,UAAU,CAAC,YAAY,CACxB;KACF,CAAC;AACJ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC"}

package/dist/Registry/KVCache.d.ts

@@ -0,0 +1,24 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+/**
+ * A lookup-through cache on the registry's KV namespace, shared by every
+ * isolate of the Worker.
+ *
+ * Concurrent misses each run the lookup and each write; the last write wins.
+ * That is deliberate: a cache that shares an in-flight lookup, like Effect's
+ * `Cache`, has later callers join the first caller's fiber, and workerd drops
+ * a fiber resumed from another request's context once that request
+ * completes, which surfaces as the joining request hanging.
+ *
+ * Reads set `cacheTtl`, so a value can still be served from the colo's edge
+ * cache for up to a minute after it expired; a lookup's `ttl` must leave
+ * that margin. Values with less than a minute left are not stored. KV
+ * failures are logged and fall through to the lookup.
+ */
+export declare const make: <K, A, I, E, R>(key: (input: K) => string, value: Schema.Codec<A, I>, lookup: (input: K) => Effect.Effect<{
+    value: A;
+    ttl: Duration.Duration;
+}, E, R>) => (input: K) => Effect.Effect<A, E, R | Cloudflare.Providers | Cloudflare.KV.ReadWriteNamespace | import("alchemy").RuntimeContext>;
+//# sourceMappingURL=KVCache.d.ts.map

package/dist/Registry/KVCache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"KVCache.d.ts","sourceRoot":"","sources":["../../src/Registry/KVCache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,UAAU,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AASxC;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,IAAI,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,OAC3B,CAAC,KAAK,EAAE,CAAC,KAAK,MAAM,SAClB,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,UACjB,CACN,KAAK,EAAE,CAAC,KACL,MAAM,CAAC,MAAM,CAAC;IAAE,KAAK,EAAE,CAAC,CAAC;IAAC,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAA;CAAE,EAAE,CAAC,EAAE,CAAC,CAAC,aAK/C,CAAC,wHA8BjB,CAAC"}

package/dist/Registry/KVCache.js

@@ -0,0 +1,42 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+import { Cache } from "./Bindings.js";
+/** KV's floor for both `expirationTtl` and `cacheTtl`. */
+const MIN_TTL = Duration.minutes(1);
+const seconds = (duration) => Math.floor(Duration.toSeconds(duration));
+/**
+ * A lookup-through cache on the registry's KV namespace, shared by every
+ * isolate of the Worker.
+ *
+ * Concurrent misses each run the lookup and each write; the last write wins.
+ * That is deliberate: a cache that shares an in-flight lookup, like Effect's
+ * `Cache`, has later callers join the first caller's fiber, and workerd drops
+ * a fiber resumed from another request's context once that request
+ * completes, which surfaces as the joining request hanging.
+ *
+ * Reads set `cacheTtl`, so a value can still be served from the colo's edge
+ * cache for up to a minute after it expired; a lookup's `ttl` must leave
+ * that margin. Values with less than a minute left are not stored. KV
+ * failures are logged and fall through to the lookup.
+ */
+export const make = (key, value, lookup) => {
+    const json = Schema.fromJsonString(value);
+    const decode = Schema.decodeUnknownEffect(json);
+    const encode = Schema.encodeEffect(json);
+    return (input) => Effect.gen(function* () {
+        const kv = yield* Cloudflare.KV.ReadWriteNamespace(Cache);
+        const id = key(input);
+        const hit = yield* kv.get(id, { cacheTtl: seconds(MIN_TTL) }).pipe(Effect.flatMap((text) => text === null ? Effect.succeed(undefined) : decode(text)), Effect.catch((e) => Effect.logWarning(`cache read of ${id} failed: ${e}`).pipe(Effect.as(undefined))));
+        if (hit !== undefined) {
+            return hit;
+        }
+        const fresh = yield* lookup(input);
+        if (Duration.isGreaterThanOrEqualTo(fresh.ttl, MIN_TTL)) {
+            yield* encode(fresh.value).pipe(Effect.flatMap((text) => kv.put(id, text, { expirationTtl: seconds(fresh.ttl) })), Effect.catch((e) => Effect.logWarning(`cache write of ${id} failed: ${e}`)));
+        }
+        return fresh.value;
+    });
+};
+//# sourceMappingURL=KVCache.js.map

package/dist/Registry/KVCache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"KVCache.js","sourceRoot":"","sources":["../../src/Registry/KVCache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,UAAU,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAEtC,0DAA0D;AAC1D,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAEpC,MAAM,OAAO,GAAG,CAAC,QAA2B,EAAE,EAAE,CAC9C,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;AAE3C;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,CAClB,GAAyB,EACzB,KAAyB,EACzB,MAE8D,EAC9D,EAAE;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACzC,OAAO,CAAC,KAAQ,EAAE,EAAE,CAClB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;QACtB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAChE,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACtB,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CACzD,EACD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CACjB,MAAM,CAAC,UAAU,CAAC,iBAAiB,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC,IAAI,CACxD,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CACrB,CACF,CACF,CAAC;QACF,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,GAAG,CAAC;QACb,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,QAAQ,CAAC,sBAAsB,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;YACxD,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAC7B,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACtB,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CACxD,EACD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CACjB,MAAM,CAAC,UAAU,CAAC,kBAAkB,EAAE,YAAY,CAAC,EAAE,CAAC,CACvD,CACF,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC,CAAC,CAAC;AACP,CAAC,CAAC"}

package/dist/Registry/Sweep.d.ts

@@ -0,0 +1,12 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Effect from "effect/Effect";
+import { RegistryConfig } from "./Bindings.ts";
+import * as GitHub from "./GitHub.ts";
+/**
+ * Expiry sweep. Tags tied to pull requests are extended while any of those
+ * pull requests is open and pinned to the latest close time plus TTL once
+ * they all close. Expired tags go away, and tarballs nothing points at are
+ * deleted from R2.
+ */
+export declare const sweep: Effect.Effect<void, Cloudflare.R2.R2Error | import("effect/Schema").SchemaError | import("effect/unstable/sql/SqlError").SqlError, GitHub.GitHubApp | Cloudflare.Providers | Cloudflare.R2.ReadWriteBucket | Cloudflare.KV.ReadWriteNamespace | RegistryConfig | import("alchemy").RuntimeContext | import("effect/unstable/sql/SqlClient").SqlClient>;
+//# sourceMappingURL=Sweep.d.ts.map

package/dist/Registry/Sweep.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Sweep.d.ts","sourceRoot":"","sources":["../../src/Registry/Sweep.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,UAAU,MAAM,oBAAoB,CAAC;AAGjD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,EAGL,cAAc,EAGf,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAGtC;;;;;GAKG;AACH,eAAO,MAAM,KAAK,wVA8FhB,CAAC"}

package/dist/Registry/Sweep.js

@@ -0,0 +1,69 @@
+import * as Cloudflare from "alchemy/Cloudflare";
+import * as Clock from "effect/Clock";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Stream from "effect/Stream";
+import { Bucket, ORPHAN_GRACE, RegistryConfig, SWEEP_LOOKAHEAD, tarballKey, } from "./Bindings.js";
+import * as GitHub from "./GitHub.js";
+import * as Tags from "./Tags.js";
+/**
+ * Expiry sweep. Tags tied to pull requests are extended while any of those
+ * pull requests is open and pinned to the latest close time plus TTL once
+ * they all close. Expired tags go away, and tarballs nothing points at are
+ * deleted from R2.
+ */
+export const sweep = Effect.gen(function* () {
+    const { policy } = yield* RegistryConfig;
+    const r2 = yield* Cloudflare.R2.ReadWriteBucket(Bucket);
+    const github = yield* GitHub.GitHubApp;
+    const now = yield* Clock.currentTimeMillis;
+    const ttl = Duration.toMillis(policy.ttl);
+    const due = yield* Tags.dueLinked(now + Duration.toMillis(SWEEP_LOOKAHEAD));
+    // One lookup per pull request across every due row. `undefined` means the
+    // pull request is still open; a failed lookup is recorded as such.
+    const lookups = yield* Effect.forEach(new Set(due.flatMap((row) => row.linked_prs)), (ref) => {
+        const [repo, number] = ref.split("#");
+        return github.getPullRequest(repo, Number(number)).pipe(Effect.map((pr) => pr.state === "open"
+            ? undefined
+            : Date.parse(pr.merged_at ?? pr.closed_at ?? "") || now), Effect.map((closedAt) => [ref, { closedAt }]), Effect.catch((e) => Effect.logWarning(`pull request ${ref} lookup failed: ${GitHub.describe(e)}`).pipe(Effect.as([ref, undefined]))));
+    }, { concurrency: 4 });
+    const results = new Map(lookups);
+    const extended = yield* Effect.forEach(due, (row) => {
+        const known = row.linked_prs.flatMap((ref) => {
+            const result = results.get(ref);
+            return result === undefined ? [] : [result.closedAt];
+        });
+        // Open pull requests dominate; otherwise the latest close wins. A row
+        // whose pull requests could not all be checked is kept past the next
+        // sweep rather than left to expire: it is re-checked, never deleted,
+        // on GitHub's bad day.
+        const closes = known.filter((closedAt) => closedAt !== undefined);
+        const expiresAt = closes.length < known.length
+            ? now + ttl
+            : known.length < row.linked_prs.length
+                ? Math.max(row.expires_at, now + Duration.toMillis(SWEEP_LOOKAHEAD))
+                : Math.max(...closes) + ttl;
+        return expiresAt === row.expires_at
+            ? Effect.succeed(false)
+            : Tags.setExpiry(row.package, row.tag, expiresAt).pipe(Effect.as(true));
+    }).pipe(Effect.map((changed) => changed.filter(Boolean).length));
+    const removed = yield* Tags.deleteExpired(now);
+    const referenced = yield* Tags.referencedTarballs();
+    const unreferenced = removed.filter(({ package: pkg, sha256 }) => !referenced.has(`${pkg}/${sha256}`));
+    yield* Effect.forEach(unreferenced, ({ package: pkg, sha256 }) => r2.delete(tarballKey(pkg, sha256)), { discard: true });
+    // Uploads that never got tagged.
+    const orphans = yield* Stream.paginate(undefined, (cursor) => r2
+        .list({ cursor, limit: 500 })
+        .pipe(Effect.map((page) => [
+        page.objects,
+        page.truncated ? Option.some(page.cursor) : Option.none(),
+    ]))).pipe(Stream.filter((object) => {
+        const match = object.key.match(/^(.+)\/([a-f0-9]{64})\.tgz$/);
+        return (match !== null &&
+            !referenced.has(`${decodeURIComponent(match[1])}/${match[2]}`) &&
+            object.uploaded.getTime() < now - Duration.toMillis(ORPHAN_GRACE));
+    }), Stream.mapEffect((object) => r2.delete(object.key)), Stream.runCount);
+    yield* Effect.logInfo(`sweep: ${due.length} due, ${extended} extended, ${removed.length} tags expired, ${unreferenced.length + orphans} tarballs deleted`);
+});
+//# sourceMappingURL=Sweep.js.map

package/dist/Registry/Sweep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Sweep.js","sourceRoot":"","sources":["../../src/Registry/Sweep.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,UAAU,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,MAAM,EACN,YAAY,EACZ,cAAc,EACd,eAAe,EACf,UAAU,GACX,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IACvC,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;IACzC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;IAEvC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;IAC3C,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;IAE5E,0EAA0E;IAC1E,mEAAmE;IACnE,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACnC,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EAC7C,CAAC,GAAG,EAAE,EAAE;QACN,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,MAAM,CAAC,cAAc,CAAC,IAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CACtD,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAChB,EAAE,CAAC,KAAK,KAAK,MAAM;YACjB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,IAAI,GAAG,CAC1D,EACD,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAU,CAAC,EACtD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CACjB,MAAM,CAAC,UAAU,CACf,gBAAgB,GAAG,mBAAmB,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAC3D,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,CAAU,CAAC,CAAC,CAC7C,CACF,CAAC;IACJ,CAAC,EACD,EAAE,WAAW,EAAE,CAAC,EAAE,CACnB,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE;QAClD,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;YAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChC,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QACH,sEAAsE;QACtE,qEAAqE;QACrE,qEAAqE;QACrE,uBAAuB;QACvB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;QAClE,MAAM,SAAS,GACb,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM;YAC1B,CAAC,CAAC,GAAG,GAAG,GAAG;YACX,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM;gBACpC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;gBACpE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,GAAG,CAAC;QAClC,OAAO,SAAS,KAAK,GAAG,CAAC,UAAU;YACjC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YACvB,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAEjE,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;IACpD,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CACjC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,MAAM,EAAE,CAAC,CAClE,CAAC;IACF,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACnB,YAAY,EACZ,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,EAChE,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CAAC;IAEF,iCAAiC;IACjC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CACpC,SAA+B,EAC/B,CAAC,MAAM,EAAE,EAAE,CACT,EAAE;SACC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;SAC5B,IAAI,CACH,MAAM,CAAC,GAAG,CACR,CAAC,IAAI,EAAE,EAAE,CACP;QACE,IAAI,CAAC,OAAO;QACZ,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;KACjD,CACb,CACF,CACN,CAAC,IAAI,CACJ,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;QACvB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC9D,OAAO,CACL,KAAK,KAAK,IAAI;YACd,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAClE,CAAC;IACJ,CAAC,CAAC,EACF,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EACnD,MAAM,CAAC,QAAQ,CAChB,CAAC;IACF,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACnB,UAAU,GAAG,CAAC,MAAM,SAAS,QAAQ,cAAc,OAAO,CAAC,MAAM,kBAAkB,YAAY,CAAC,MAAM,GAAG,OAAO,mBAAmB,CACpI,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/Registry/Tags.d.ts

@@ -0,0 +1,49 @@
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+import * as SqlClient from "effect/unstable/sql/SqlClient";
+export declare const TagRow: Schema.Struct<{
+    readonly package: Schema.String;
+    readonly tag: Schema.String;
+    readonly sha256: Schema.String;
+    readonly expires_at: Schema.Number;
+    /** Pull requests whose runs produced this tag, as `owner/repo#N`. */
+    readonly linked_prs: Schema.fromJsonString<Schema.$Array<Schema.String>>;
+}>;
+export type TagRow = typeof TagRow.Type;
+export declare const get: (pkg: string, tag: string) => Effect.Effect<{
+    readonly package: string;
+    readonly tag: string;
+    readonly sha256: string;
+    readonly expires_at: number;
+    readonly linked_prs: readonly string[];
+}, Schema.SchemaError | import("effect/unstable/sql/SqlError").SqlError, SqlClient.SqlClient>;
+/**
+ * Point `tag` at `sha256`, keeping the row alive for at least `expiresAt`
+ * and remembering every pull request that produced it. One statement, so
+ * concurrent publications of a shared tag merge rather than overwrite.
+ */
+export declare const upsert: (input: {
+    readonly package: string;
+    readonly tag: string;
+    readonly sha256: string;
+    readonly expiresAt: number;
+    readonly prs: ReadonlyArray<string>;
+}) => Effect.Effect<void, Schema.SchemaError | import("effect/unstable/sql/SqlError").SqlError, SqlClient.SqlClient>;
+export declare const resolve: (pkg: string, tag: string) => Effect.Effect<string, Schema.SchemaError | import("effect/unstable/sql/SqlError").SqlError, SqlClient.SqlClient>;
+/** Rows tied to pull requests whose expiry falls before `before`. */
+export declare const dueLinked: (before: number) => Effect.Effect<readonly {
+    readonly package: string;
+    readonly tag: string;
+    readonly sha256: string;
+    readonly expires_at: number;
+    readonly linked_prs: readonly string[];
+}[], Schema.SchemaError | import("effect/unstable/sql/SqlError").SqlError, SqlClient.SqlClient>;
+export declare const setExpiry: (pkg: string, tag: string, expiresAt: number) => Effect.Effect<void, import("effect/unstable/sql/SqlError").SqlError, SqlClient.SqlClient>;
+/** Delete every expired row and return the tarballs those rows pointed at. */
+export declare const deleteExpired: (now: number) => Effect.Effect<readonly {
+    readonly package: string;
+    readonly sha256: string;
+}[], Schema.SchemaError | import("effect/unstable/sql/SqlError").SqlError, SqlClient.SqlClient>;
+/** Every tarball some tag still points at, as `<package>/<sha256>`. */
+export declare const referencedTarballs: () => Effect.Effect<Set<string>, Schema.SchemaError | import("effect/unstable/sql/SqlError").SqlError, SqlClient.SqlClient>;
+//# sourceMappingURL=Tags.d.ts.map

package/dist/Registry/Tags.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Tags.d.ts","sourceRoot":"","sources":["../../src/Registry/Tags.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,SAAS,MAAM,+BAA+B,CAAC;AAW3D,eAAO,MAAM,MAAM;;;;;IAKjB,qEAAqE;;EAErE,CAAC;AACH,MAAM,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,IAAI,CAAC;AAUxC,eAAO,MAAM,GAAG;;;;;;6FAMd,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,MAAM;sBACC,MAAM;kBACV,MAAM;qBACH,MAAM;wBACH,MAAM;kBACZ,aAAa,CAAC,MAAM,CAAC;oHAkBnC,CAAC;AAEH,eAAO,MAAM,OAAO,QAAS,MAAM,OAAO,MAAM,qHACC,CAAC;AAElD,qEAAqE;AACrE,eAAO,MAAM,SAAS;;;;;;+FASpB,CAAC;AAEH,eAAO,MAAM,SAAS,4IASpB,CAAC;AAEH,8EAA8E;AAC9E,eAAO,MAAM,aAAa;;;+FASxB,CAAC;AAEH,uEAAuE;AACvE,eAAO,MAAM,kBAAkB,6HAQ9B,CAAC"}