@cat-factory/integrations 0.6.0

package/dist/modules/environments/EnvironmentProvisioningService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EnvironmentProvisioningService.d.ts","sourceRoot":"","sources":["../../../src/modules/environments/EnvironmentProvisioningService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAC7D,OAAO,KAAK,EAAqB,6BAA6B,EAAE,MAAM,qBAAqB,CAAA;AAC3F,OAAO,KAAK,EACV,mBAAmB,EACnB,gBAAgB,EAEhB,eAAe,EAChB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,KAAK,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAErF,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAA;AAQrF,MAAM,WAAW,0CAA0C;IACzD,iBAAiB,EAAE,4BAA4B,CAAA;IAC/C,mBAAmB,EAAE,mBAAmB,CAAA;IACxC,6BAA6B,EAAE,6BAA6B,CAAA;IAC5D,YAAY,EAAE,YAAY,CAAA;IAC1B,WAAW,EAAE,WAAW,CAAA;IACxB,KAAK,EAAE,KAAK,CAAA;IACZ,wFAAwF;IACxF,SAAS,CAAC,EAAE,eAAe,CAAA;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,qFAAqF;IACrF,OAAO,CAAC,EAAE,gBAAgB,CAAA;CAC3B;AAYD,2EAA2E;AAC3E,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,MAAM,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IACnC,MAAM,EAAE,uBAAuB,GAAG,IAAI,CAAA;IACtC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB;AAED,qBAAa,8BAA8B;IAC7B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,0CAA0C,EAAI;IAEjF,OAAO,KAAK,SAAS,GAEpB;IAED,mFAAmF;IAC7E,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA2D/D;IAED,+EAA+E;IACzE,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA6B/E;IAED,kDAAkD;IAC5C,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAGnE;IAED,uDAAuD;IACjD,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAGlF;IAED,wEAAwE;IAClE,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAI5F;IAED;;;OAGG;IACG,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAS/F;IAED,OAAO,CAAC,aAAa;YAUP,aAAa;YAKb,aAAa;YAKb,aAAa;CAK5B"}

package/dist/modules/environments/EnvironmentProvisioningService.js

@@ -0,0 +1,153 @@
+import { assertFound, STRICT_URL_SAFETY_POLICY } from '@cat-factory/kernel';
+import { assertSafeEnvironmentUrl, recordToHandle } from './environments.logic.js';
+/** Flatten a typed provision context into `{{input.*}}` string vars (skips empties). */
+function contextInputs(context) {
+    if (!context)
+        return {};
+    const out = {};
+    for (const [key, value] of Object.entries(context)) {
+        if (value !== undefined && value !== null && value !== '')
+            out[key] = String(value);
+    }
+    return out;
+}
+export class EnvironmentProvisioningService {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    get urlPolicy() {
+        return this.deps.urlPolicy ?? STRICT_URL_SAFETY_POLICY;
+    }
+    /** Provision an environment, persisting an encrypted record keyed by block/run. */
+    async provision(args) {
+        const { workspaceId } = args;
+        const { manifest } = await this.deps.connectionService.requireConnection(workspaceId);
+        const resolveSecret = await this.deps.connectionService.resolveSecrets(workspaceId);
+        // Expose the block id as `{{input.blockId}}` even on a manual provision, so a
+        // manifest can template against it without the caller having to repeat it. The
+        // typed git/PR/repo context is flattened into the same namespace for the manifest
+        // path. Explicit inputs win over the derived block id + context.
+        const inputs = {};
+        if (args.blockId)
+            inputs.blockId = args.blockId;
+        Object.assign(inputs, contextInputs(args.context));
+        Object.assign(inputs, args.inputs);
+        const provisioned = await this.deps.environmentProvider.provision({
+            manifest,
+            inputs,
+            ...(args.context ? { provisionContext: args.context } : {}),
+            resolveSecret,
+        });
+        if (provisioned.url) {
+            assertSafeEnvironmentUrl(provisioned.url, 'environment URL', this.urlPolicy);
+        }
+        // A block holds at most one live environment: supersede any prior one.
+        if (args.blockId) {
+            const prior = await this.deps.environmentRegistryRepository.getByBlock(workspaceId, args.blockId);
+            if (prior) {
+                await this.deps.environmentRegistryRepository.softDelete(workspaceId, prior.id, this.deps.clock.now());
+            }
+        }
+        const now = this.deps.clock.now();
+        const record = {
+            id: this.deps.idGenerator.next('env'),
+            workspaceId,
+            blockId: args.blockId ?? null,
+            executionId: args.executionId ?? null,
+            providerId: manifest.providerId,
+            externalId: provisioned.externalId,
+            url: provisioned.url,
+            status: provisioned.status,
+            accessCipher: await this.encryptAccess(provisioned.access),
+            provisionFieldsCipher: await this.deps.secretCipher.encrypt(JSON.stringify(provisioned.fields)),
+            createdAt: now,
+            expiresAt: this.resolveExpiry(provisioned, manifest.defaultTtlMs, now),
+            lastError: provisioned.status === 'failed' ? 'Provisioning failed' : null,
+            deletedAt: null,
+        };
+        await this.deps.environmentRegistryRepository.insert(record);
+        return recordToHandle(record);
+    }
+    /** Re-poll the provider for an environment's status and persist any change. */
+    async refreshStatus(workspaceId, id) {
+        const record = assertFound(await this.deps.environmentRegistryRepository.get(workspaceId, id), 'Environment', id);
+        const { manifest } = await this.deps.connectionService.requireConnection(workspaceId);
+        const resolveSecret = await this.deps.connectionService.resolveSecrets(workspaceId);
+        const provisionFields = await this.decryptFields(record.provisionFieldsCipher);
+        const provisioned = await this.deps.environmentProvider.status({
+            manifest,
+            externalId: record.externalId,
+            provisionFields,
+            resolveSecret,
+        });
+        if (provisioned.url) {
+            assertSafeEnvironmentUrl(provisioned.url, 'environment URL', this.urlPolicy);
+        }
+        const patch = {
+            status: provisioned.status,
+            url: provisioned.url,
+            externalId: provisioned.externalId ?? record.externalId,
+            expiresAt: this.resolveExpiry(provisioned, manifest.defaultTtlMs, record.createdAt),
+            accessCipher: await this.encryptAccess(provisioned.access),
+        };
+        await this.deps.environmentRegistryRepository.update(workspaceId, id, patch);
+        return recordToHandle({ ...record, ...patch });
+    }
+    /** List a workspace's environments (no creds). */
+    async listHandles(workspaceId) {
+        const records = await this.deps.environmentRegistryRepository.listByWorkspace(workspaceId);
+        return records.map((r) => recordToHandle(r));
+    }
+    /** A single environment handle (no creds), or null. */
+    async getHandle(workspaceId, id) {
+        const record = await this.deps.environmentRegistryRepository.get(workspaceId, id);
+        return record ? recordToHandle(record) : null;
+    }
+    /** A single environment handle WITH decrypted access creds, or null. */
+    async getHandleWithAccess(workspaceId, id) {
+        const record = await this.deps.environmentRegistryRepository.get(workspaceId, id);
+        if (!record)
+            return null;
+        return recordToHandle(record, await this.decryptAccess(record.accessCipher));
+    }
+    /**
+     * The live environment provisioned for a block, with decrypted access — the
+     * discovery entry point the execution engine calls to enrich tester context.
+     */
+    async resolveForBlock(workspaceId, blockId) {
+        const record = await this.deps.environmentRegistryRepository.getByBlock(workspaceId, blockId);
+        if (!record)
+            return null;
+        return {
+            url: record.url,
+            status: record.status,
+            access: await this.decryptAccess(record.accessCipher),
+            expiresAt: record.expiresAt,
+        };
+    }
+    resolveExpiry(provisioned, defaultTtlMs, base) {
+        if (provisioned.expiresAt !== null)
+            return provisioned.expiresAt;
+        if (defaultTtlMs)
+            return base + defaultTtlMs;
+        return null;
+    }
+    async encryptAccess(access) {
+        if (!access)
+            return null;
+        return this.deps.secretCipher.encrypt(JSON.stringify(access));
+    }
+    async decryptAccess(cipher) {
+        if (!cipher)
+            return null;
+        return JSON.parse(await this.deps.secretCipher.decrypt(cipher));
+    }
+    async decryptFields(cipher) {
+        if (!cipher)
+            return {};
+        const parsed = JSON.parse(await this.deps.secretCipher.decrypt(cipher));
+        return parsed && typeof parsed === 'object' ? parsed : {};
+    }
+}
+//# sourceMappingURL=EnvironmentProvisioningService.js.map

package/dist/modules/environments/EnvironmentProvisioningService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EnvironmentProvisioningService.js","sourceRoot":"","sources":["../../../src/modules/environments/EnvironmentProvisioningService.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAA;AAE3E,OAAO,EAAE,wBAAwB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AA2BlF,wFAAwF;AACxF,SAAS,aAAa,CAAC,OAAqC;IAC1D,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAA;IACvB,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IACrF,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAUD,MAAM,OAAO,8BAA8B;IACZ,IAAI;IAAjC,YAA6B,IAAgD;oBAAhD,IAAI;IAA+C,CAAC;IAEjF,IAAY,SAAS;QACnB,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,wBAAwB,CAAA;IACxD,CAAC;IAED,mFAAmF;IACnF,KAAK,CAAC,SAAS,CAAC,IAAmB;QACjC,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,CAAA;QAC5B,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAA;QACrF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;QAEnF,8EAA8E;QAC9E,+EAA+E;QAC/E,kFAAkF;QAClF,iEAAiE;QACjE,MAAM,MAAM,GAA2B,EAAE,CAAA;QACzC,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;QAC/C,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;QAClD,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QAClC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC;YAChE,QAAQ;YACR,MAAM;YACN,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,aAAa;SACd,CAAC,CAAA;QACF,IAAI,WAAW,CAAC,GAAG,EAAE,CAAC;YACpB,wBAAwB,CAAC,WAAW,CAAC,GAAG,EAAE,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QAC9E,CAAC;QAED,uEAAuE;QACvE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,UAAU,CACpE,WAAW,EACX,IAAI,CAAC,OAAO,CACb,CAAA;YACD,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,UAAU,CACtD,WAAW,EACX,KAAK,CAAC,EAAE,EACR,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CACtB,CAAA;YACH,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QACjC,MAAM,MAAM,GAAsB;YAChC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;YACrC,WAAW;YACX,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI;YAC7B,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;YACrC,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,UAAU,EAAE,WAAW,CAAC,UAAU;YAClC,GAAG,EAAE,WAAW,CAAC,GAAG;YACpB,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,YAAY,EAAE,MAAM,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,MAAM,CAAC;YAC1D,qBAAqB,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CACzD,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,CACnC;YACD,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC;YACtE,SAAS,EAAE,WAAW,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI;YACzE,SAAS,EAAE,IAAI;SAChB,CAAA;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC5D,OAAO,cAAc,CAAC,MAAM,CAAC,CAAA;IAC/B,CAAC;IAED,+EAA+E;IAC/E,KAAK,CAAC,aAAa,CAAC,WAAmB,EAAE,EAAU;QACjD,MAAM,MAAM,GAAG,WAAW,CACxB,MAAM,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,EAClE,aAAa,EACb,EAAE,CACH,CAAA;QACD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAA;QACrF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;QACnF,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAA;QAE9E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC;YAC7D,QAAQ;YACR,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,eAAe;YACf,aAAa;SACd,CAAC,CAAA;QACF,IAAI,WAAW,CAAC,GAAG,EAAE,CAAC;YACpB,wBAAwB,CAAC,WAAW,CAAC,GAAG,EAAE,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QAC9E,CAAC;QAED,MAAM,KAAK,GAAG;YACZ,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,GAAG,EAAE,WAAW,CAAC,GAAG;YACpB,UAAU,EAAE,WAAW,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU;YACvD,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC;YACnF,YAAY,EAAE,MAAM,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,MAAM,CAAC;SAC3D,CAAA;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,KAAK,CAAC,CAAA;QAC5E,OAAO,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC,CAAA;IAChD,CAAC;IAED,kDAAkD;IAClD,KAAK,CAAC,WAAW,CAAC,WAAmB;QACnC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,eAAe,CAAC,WAAW,CAAC,CAAA;QAC1F,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAA;IAC9C,CAAC;IAED,uDAAuD;IACvD,KAAK,CAAC,SAAS,CAAC,WAAmB,EAAE,EAAU;QAC7C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;QACjF,OAAO,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC/C,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,mBAAmB,CAAC,WAAmB,EAAE,EAAU;QACvD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;QACjF,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACxB,OAAO,cAAc,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAA;IAC9E,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe,CAAC,WAAmB,EAAE,OAAe;QACxD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,UAAU,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QAC7F,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACxB,OAAO;YACL,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC;YACrD,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAA;IACH,CAAC;IAEO,aAAa,CACnB,WAAmC,EACnC,YAAgC,EAChC,IAAY;QAEZ,IAAI,WAAW,CAAC,SAAS,KAAK,IAAI;YAAE,OAAO,WAAW,CAAC,SAAS,CAAA;QAChE,IAAI,YAAY;YAAE,OAAO,IAAI,GAAG,YAAY,CAAA;QAC5C,OAAO,IAAI,CAAA;IACb,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,MAAsC;QAChE,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACxB,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;IAC/D,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,MAAqB;QAC/C,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACxB,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAA4B,CAAA;IAC5F,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,MAAqB;QAC/C,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,CAAA;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;QACvE,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAiC,CAAC,CAAC,CAAC,EAAE,CAAA;IACvF,CAAC;CACF"}

package/dist/modules/environments/EnvironmentTeardownService.d.ts

@@ -0,0 +1,24 @@
+import type { Clock } from '@cat-factory/kernel';
+import type { EnvironmentRegistryRepository } from '@cat-factory/kernel';
+import type { EnvironmentProvider } from '@cat-factory/kernel';
+import type { SecretCipher } from '@cat-factory/kernel';
+import type { EnvironmentHandle } from '@cat-factory/kernel';
+import type { EnvironmentConnectionService } from './EnvironmentConnectionService.js';
+export interface EnvironmentTeardownServiceDependencies {
+    connectionService: EnvironmentConnectionService;
+    environmentProvider: EnvironmentProvider;
+    environmentRegistryRepository: EnvironmentRegistryRepository;
+    secretCipher: SecretCipher;
+    clock: Clock;
+}
+export declare class EnvironmentTeardownService {
+    private readonly deps;
+    constructor(deps: EnvironmentTeardownServiceDependencies);
+    /** Tear down a single environment and tombstone its record. */
+    teardown(workspaceId: string, id: string): Promise<EnvironmentHandle>;
+    /** Tear down every environment whose TTL has elapsed. Returns the count swept. */
+    sweepExpired(now: number): Promise<number>;
+    private teardownRecord;
+    private decryptFields;
+}
+//# sourceMappingURL=EnvironmentTeardownService.d.ts.map

package/dist/modules/environments/EnvironmentTeardownService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EnvironmentTeardownService.d.ts","sourceRoot":"","sources":["../../../src/modules/environments/EnvironmentTeardownService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,KAAK,EAAqB,6BAA6B,EAAE,MAAM,qBAAqB,CAAA;AAC3F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAE5D,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAA;AAQrF,MAAM,WAAW,sCAAsC;IACrD,iBAAiB,EAAE,4BAA4B,CAAA;IAC/C,mBAAmB,EAAE,mBAAmB,CAAA;IACxC,6BAA6B,EAAE,6BAA6B,CAAA;IAC5D,YAAY,EAAE,YAAY,CAAA;IAC1B,KAAK,EAAE,KAAK,CAAA;CACb;AAED,qBAAa,0BAA0B;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,sCAAsC,EAAI;IAE7E,+DAA+D;IACzD,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAQ1E;IAED,kFAAkF;IAC5E,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAa/C;YAEa,cAAc;YAsBd,aAAa;CAK5B"}

package/dist/modules/environments/EnvironmentTeardownService.js

@@ -0,0 +1,54 @@
+import { assertFound } from '@cat-factory/kernel';
+import { recordToHandle } from './environments.logic.js';
+export class EnvironmentTeardownService {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /** Tear down a single environment and tombstone its record. */
+    async teardown(workspaceId, id) {
+        const record = assertFound(await this.deps.environmentRegistryRepository.get(workspaceId, id), 'Environment', id);
+        await this.teardownRecord(record);
+        return recordToHandle({ ...record, status: 'torn_down' });
+    }
+    /** Tear down every environment whose TTL has elapsed. Returns the count swept. */
+    async sweepExpired(now) {
+        const expired = await this.deps.environmentRegistryRepository.listExpired(now);
+        let swept = 0;
+        for (const record of expired) {
+            try {
+                await this.teardownRecord(record);
+                swept++;
+            }
+            catch {
+                // Best-effort: a failing provider must not block the rest of the sweep.
+                // The record stays live and is retried on the next pass.
+            }
+        }
+        return swept;
+    }
+    async teardownRecord(record) {
+        const connection = await this.deps.connectionService
+            .requireConnection(record.workspaceId)
+            .catch(() => null);
+        // If the provider was unregistered we can't call its API; just tombstone.
+        if (connection) {
+            const resolveSecret = await this.deps.connectionService.resolveSecrets(record.workspaceId);
+            const provisionFields = await this.decryptFields(record.provisionFieldsCipher);
+            await this.deps.environmentProvider.teardown({
+                manifest: connection.manifest,
+                externalId: record.externalId,
+                provisionFields,
+                resolveSecret,
+            });
+        }
+        await this.deps.environmentRegistryRepository.softDelete(record.workspaceId, record.id, this.deps.clock.now());
+    }
+    async decryptFields(cipher) {
+        if (!cipher)
+            return {};
+        const parsed = JSON.parse(await this.deps.secretCipher.decrypt(cipher));
+        return parsed && typeof parsed === 'object' ? parsed : {};
+    }
+}
+//# sourceMappingURL=EnvironmentTeardownService.js.map

package/dist/modules/environments/EnvironmentTeardownService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EnvironmentTeardownService.js","sourceRoot":"","sources":["../../../src/modules/environments/EnvironmentTeardownService.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAEjD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAexD,MAAM,OAAO,0BAA0B;IACR,IAAI;IAAjC,YAA6B,IAA4C;oBAA5C,IAAI;IAA2C,CAAC;IAE7E,+DAA+D;IAC/D,KAAK,CAAC,QAAQ,CAAC,WAAmB,EAAE,EAAU;QAC5C,MAAM,MAAM,GAAG,WAAW,CACxB,MAAM,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,EAClE,aAAa,EACb,EAAE,CACH,CAAA;QACD,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;QACjC,OAAO,cAAc,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAA;IAC3D,CAAC;IAED,kFAAkF;IAClF,KAAK,CAAC,YAAY,CAAC,GAAW;QAC5B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAC9E,IAAI,KAAK,GAAG,CAAC,CAAA;QACb,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;gBACjC,KAAK,EAAE,CAAA;YACT,CAAC;YAAC,MAAM,CAAC;gBACP,wEAAwE;gBACxE,yDAAyD;YAC3D,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,MAAyB;QACpD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB;aACjD,iBAAiB,CAAC,MAAM,CAAC,WAAW,CAAC;aACrC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;QACpB,0EAA0E;QAC1E,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;YAC1F,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAA;YAC9E,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC;gBAC3C,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,eAAe;gBACf,aAAa;aACd,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,UAAU,CACtD,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,EAAE,EACT,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CACtB,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,MAAqB;QAC/C,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,CAAA;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;QACvE,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAiC,CAAC,CAAC,CAAC,EAAE,CAAA;IACvF,CAAC;CACF"}

package/dist/modules/environments/HttpEnvironmentProvider.d.ts

@@ -0,0 +1,30 @@
+import { type EnvironmentProvider, type EnvironmentStatusRequest, type EnvironmentTeardownRequest, type EnvironmentStatus, type ProvisionEnvironmentRequest, type ProvisionedEnvironment, type UrlSafetyPolicy } from '@cat-factory/kernel';
+/** Carries the HTTP status so the API can surface a meaningful (redacted) error. */
+export declare class EnvironmentApiError extends Error {
+    readonly status: number;
+    constructor(status: number, message: string);
+}
+export interface HttpEnvironmentProviderOptions {
+    defaultTimeoutMs?: number;
+    /** URL/host safety policy; defaults to strict (https-only, no private hosts). */
+    urlPolicy?: UrlSafetyPolicy;
+}
+export declare class HttpEnvironmentProvider implements EnvironmentProvider {
+    private readonly defaultTimeoutMs;
+    private readonly urlPolicy;
+    /** Per-isolate OAuth token cache, keyed by token URL + client id. */
+    private readonly oauthCache;
+    constructor(options?: HttpEnvironmentProviderOptions);
+    provision(req: ProvisionEnvironmentRequest): Promise<ProvisionedEnvironment>;
+    status(req: EnvironmentStatusRequest): Promise<ProvisionedEnvironment>;
+    teardown(req: EnvironmentTeardownRequest): Promise<{
+        status: EnvironmentStatus;
+    }>;
+    private execute;
+    private buildUrl;
+    private authHeaders;
+    private oauthToken;
+    private mapResponse;
+    private mapAccess;
+}
+//# sourceMappingURL=HttpEnvironmentProvider.d.ts.map

package/dist/modules/environments/HttpEnvironmentProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"HttpEnvironmentProvider.d.ts","sourceRoot":"","sources":["../../../src/modules/environments/HttpEnvironmentProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,mBAAmB,EAExB,KAAK,wBAAwB,EAC7B,KAAK,0BAA0B,EAC/B,KAAK,iBAAiB,EACtB,KAAK,2BAA2B,EAEhC,KAAK,sBAAsB,EAE3B,KAAK,eAAe,EAErB,MAAM,qBAAqB,CAAA;AAqB5B,oFAAoF;AACpF,qBAAa,mBAAoB,SAAQ,KAAK;IAE1C,QAAQ,CAAC,MAAM,EAAE,MAAM;IADzB,YACW,MAAM,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM,EAIhB;CACF;AAqFD,MAAM,WAAW,8BAA8B;IAC7C,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,iFAAiF;IACjF,SAAS,CAAC,EAAE,eAAe,CAAA;CAC5B;AAED,qBAAa,uBAAwB,YAAW,mBAAmB;IACjE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAQ;IACzC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiB;IAC3C,qEAAqE;IACrE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA0D;IAErF,YAAY,OAAO,GAAE,8BAAmC,EAGvD;IAEK,SAAS,CAAC,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAajF;IAEK,MAAM,CAAC,GAAG,EAAE,wBAAwB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAwB3E;IAEK,QAAQ,CAAC,GAAG,EAAE,0BAA0B,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,iBAAiB,CAAA;KAAE,CAAC,CAatF;YAIa,OAAO;IAmDrB,OAAO,CAAC,QAAQ;YAoBF,WAAW;YAgCX,UAAU;IAsDxB,OAAO,CAAC,WAAW;IA4BnB,OAAO,CAAC,SAAS;CAiBlB"}

package/dist/modules/environments/HttpEnvironmentProvider.js

@@ -0,0 +1,316 @@
+import { STRICT_URL_SAFETY_POLICY, } from '@cat-factory/kernel';
+import * as environmentsLogic from './environments.logic.js';
+// The single generic adapter that interprets ANY environment manifest. There are
+// no per-provider presets: an org's self-rolled management API is described as
+// HTTP request templates with `{{var}}` interpolation, an auth scheme, and a
+// dot-path mapping from its (arbitrary) response onto the canonical handle.
+//
+// Security: every URL is SSRF-guarded before it is fetched; the per-tenant
+// secrets are resolved in-memory via the injected resolver and only ever placed
+// in request headers — never logged or echoed in errors (error bodies are
+// length-capped and carry no request headers).
+const DEFAULT_TIMEOUT_MS = 15_000;
+const MAX_RESPONSE_CHARS = 200_000;
+/** Hard cap on the bytes read off any response body (mirrors MAX_RESPONSE_CHARS). */
+const MAX_RESPONSE_BYTES = MAX_RESPONSE_CHARS;
+/** Bound the redirect chain so a permitted first hop can't walk us anywhere. */
+const MAX_REDIRECTS = 5;
+const USER_AGENT = 'cat-factory';
+/** Carries the HTTP status so the API can surface a meaningful (redacted) error. */
+export class EnvironmentApiError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+        this.name = 'EnvironmentApiError';
+    }
+}
+/**
+ * `fetch` with redirects followed by hand so the SSRF guard runs against EVERY
+ * hop, not just the first URL. With the default `redirect: 'follow'` a permitted
+ * host can 302 to an internal target (e.g. 169.254.169.254) — or downgrade
+ * https→http — and the runtime would follow it unchecked. We force
+ * `redirect: 'manual'`, re-resolve the `Location` against the current URL, and
+ * re-run the same `assertSafe` guard (which also enforces https-only) before
+ * following. A redirect target that fails the guard throws exactly as an invalid
+ * initial URL would.
+ */
+async function safeFetch(url, init, assertSafe) {
+    let current = url;
+    for (let hop = 0;; hop++) {
+        assertSafe(current);
+        const res = await fetch(current, { ...init, redirect: 'manual' });
+        if (res.status >= 300 && res.status < 400) {
+            const location = res.headers.get('location');
+            if (!location)
+                return res;
+            if (hop >= MAX_REDIRECTS) {
+                throw new EnvironmentApiError(502, 'Environment provider returned too many redirects');
+            }
+            // Resolve relative redirects against the current URL, then re-validate.
+            current = new URL(location, current).toString();
+            continue;
+        }
+        return res;
+    }
+}
+/**
+ * Read a response body with a running byte cap so a hostile/huge response can't
+ * OOM the isolate. Checks the declared Content-Length first, then enforces the
+ * cap while streaming. When `throwOnOverflow` is false (error snippets) the body
+ * is truncated instead of throwing.
+ */
+async function readCappedText(res, maxBytes, throwOnOverflow = true) {
+    const declared = res.headers.get('content-length');
+    if (declared && Number(declared) > maxBytes) {
+        if (throwOnOverflow) {
+            throw new EnvironmentApiError(502, 'Environment provider response too large');
+        }
+    }
+    const body = res.body;
+    if (!body)
+        return '';
+    const reader = body.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            if (!value)
+                continue;
+            total += value.byteLength;
+            if (total > maxBytes) {
+                await reader.cancel();
+                if (throwOnOverflow) {
+                    throw new EnvironmentApiError(502, 'Environment provider response too large');
+                }
+                chunks.push(value);
+                break;
+            }
+            chunks.push(value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const merged = new Uint8Array(chunks.reduce((n, c) => n + c.byteLength, 0));
+    let offset = 0;
+    for (const c of chunks) {
+        merged.set(c, offset);
+        offset += c.byteLength;
+    }
+    return new TextDecoder().decode(merged).slice(0, maxBytes);
+}
+export class HttpEnvironmentProvider {
+    defaultTimeoutMs;
+    urlPolicy;
+    /** Per-isolate OAuth token cache, keyed by token URL + client id. */
+    oauthCache = new Map();
+    constructor(options = {}) {
+        this.defaultTimeoutMs = options.defaultTimeoutMs ?? DEFAULT_TIMEOUT_MS;
+        this.urlPolicy = options.urlPolicy ?? STRICT_URL_SAFETY_POLICY;
+    }
+    async provision(req) {
+        const json = await this.execute(req.manifest, req.manifest.provision, {
+            input: req.inputs,
+            provision: {},
+        }, req.resolveSecret);
+        // A successful provision call defaults to 'ready' unless the manifest maps a
+        // status string (e.g. an async provisioner returning 'pending').
+        return this.mapResponse(req.manifest, json, 'ready');
+    }
+    async status(req) {
+        if (!req.manifest.status) {
+            // No status endpoint declared: treat the environment as ready and echo what
+            // we captured at provision time.
+            return {
+                externalId: req.externalId,
+                url: req.provisionFields.url ?? null,
+                status: 'ready',
+                expiresAt: null,
+                access: null,
+                fields: req.provisionFields,
+            };
+        }
+        const json = await this.execute(req.manifest, req.manifest.status, {
+            input: {},
+            provision: req.provisionFields,
+        }, req.resolveSecret);
+        const mapped = this.mapResponse(req.manifest, json, 'ready');
+        return { ...mapped, externalId: mapped.externalId ?? req.externalId };
+    }
+    async teardown(req) {
+        if (req.manifest.teardown) {
+            await this.execute(req.manifest, req.manifest.teardown, {
+                input: {},
+                provision: req.provisionFields,
+            }, req.resolveSecret);
+        }
+        return { status: 'torn_down' };
+    }
+    // --- internals ----------------------------------------------------------
+    async execute(manifest, template, scope, resolveSecret) {
+        const url = this.buildUrl(manifest.baseUrl, template, scope);
+        const headers = {
+            accept: 'application/json',
+            'user-agent': USER_AGENT,
+            ...(await this.authHeaders(manifest.auth, resolveSecret)),
+        };
+        for (const h of template.headers ?? []) {
+            headers[h.name] = environmentsLogic.interpolateTemplate(h.value, scope);
+        }
+        let body;
+        if (template.bodyTemplate !== undefined && template.method !== 'GET') {
+            body = environmentsLogic.interpolateTemplate(template.bodyTemplate, scope);
+            if (!headers['content-type'])
+                headers['content-type'] = 'application/json';
+        }
+        const res = await safeFetch(url, {
+            method: template.method,
+            headers,
+            body,
+            signal: AbortSignal.timeout(template.timeoutMs ?? this.defaultTimeoutMs),
+        }, (u) => environmentsLogic.assertSafeEnvironmentUrl(u, 'request URL', this.urlPolicy));
+        if (!res.ok) {
+            const errText = await readCappedText(res, MAX_RESPONSE_BYTES, false).catch(() => '');
+            throw new EnvironmentApiError(res.status, `Environment provider ${template.method} → ${res.status}: ${errText.slice(0, 300)}`);
+        }
+        const text = await readCappedText(res, MAX_RESPONSE_BYTES);
+        if (!text)
+            return {};
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            // Non-JSON responses leave the mapping to resolve to nulls.
+            return {};
+        }
+    }
+    buildUrl(baseUrl, template, scope) {
+        const base = baseUrl.replace(/\/+$/, '');
+        const path = environmentsLogic.interpolateTemplate(template.pathTemplate, scope);
+        let url = path ? `${base}${path.startsWith('/') ? '' : '/'}${path}` : base;
+        const query = (template.query ?? [])
+            .map((q) => `${encodeURIComponent(q.key)}=${encodeURIComponent(environmentsLogic.interpolateTemplate(q.value, scope))}`)
+            .join('&');
+        if (query)
+            url += `${url.includes('?') ? '&' : '?'}${query}`;
+        return url;
+    }
+    async authHeaders(auth, resolveSecret) {
+        const secret = (key) => {
+            const value = resolveSecret(key);
+            if (value === undefined)
+                throw new EnvironmentApiError(500, `Missing secret '${key}'`);
+            return value;
+        };
+        switch (auth.type) {
+            case 'none':
+                return {};
+            case 'api_key':
+                return { [auth.headerName]: `${auth.valuePrefix ?? ''}${secret(auth.secretRef.key)}` };
+            case 'bearer':
+                return { authorization: `Bearer ${secret(auth.secretRef.key)}` };
+            case 'basic':
+                return {
+                    authorization: `Basic ${btoa(`${secret(auth.usernameSecretRef.key)}:${secret(auth.passwordSecretRef.key)}`)}`,
+                };
+            case 'oauth2_client_credentials':
+                return { authorization: `Bearer ${await this.oauthToken(auth, secret)}` };
+            case 'custom_headers': {
+                const headers = {};
+                for (const h of auth.headers)
+                    headers[h.name] = secret(h.secretRef.key);
+                return headers;
+            }
+        }
+    }
+    async oauthToken(auth, secret) {
+        const clientId = secret(auth.clientIdSecretRef.key);
+        const cacheKey = `${auth.tokenUrl}::${clientId}`;
+        const cached = this.oauthCache.get(cacheKey);
+        if (cached && cached.expiresAt > Date.now() + 5_000)
+            return cached.token;
+        const form = new URLSearchParams({
+            grant_type: 'client_credentials',
+            client_id: clientId,
+            client_secret: secret(auth.clientSecretSecretRef.key),
+        });
+        if (auth.scope)
+            form.set('scope', auth.scope);
+        if (auth.audience)
+            form.set('audience', auth.audience);
+        const res = await safeFetch(auth.tokenUrl, {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/x-www-form-urlencoded',
+                accept: 'application/json',
+                'user-agent': USER_AGENT,
+            },
+            body: form.toString(),
+            signal: AbortSignal.timeout(this.defaultTimeoutMs),
+        }, (u) => environmentsLogic.assertSafeEnvironmentUrl(u, 'OAuth token URL', this.urlPolicy));
+        if (!res.ok) {
+            const text = await readCappedText(res, MAX_RESPONSE_BYTES, false).catch(() => '');
+            throw new EnvironmentApiError(res.status, `OAuth token request → ${res.status}: ${text.slice(0, 200)}`);
+        }
+        const tokenText = await readCappedText(res, MAX_RESPONSE_BYTES);
+        const json = (() => {
+            try {
+                return JSON.parse(tokenText);
+            }
+            catch {
+                return null;
+            }
+        })();
+        if (!json?.access_token) {
+            throw new EnvironmentApiError(502, 'OAuth token response missing access_token');
+        }
+        const ttlMs = (typeof json.expires_in === 'number' ? json.expires_in : 300) * 1000;
+        this.oauthCache.set(cacheKey, { token: json.access_token, expiresAt: Date.now() + ttlMs });
+        return json.access_token;
+    }
+    mapResponse(manifest, json, fallbackStatus) {
+        const r = manifest.response;
+        const externalId = environmentsLogic.extractString(json, r.externalIdPath) ?? null;
+        const url = environmentsLogic.extractString(json, r.urlPath) ?? null;
+        const rawStatus = environmentsLogic.extractString(json, r.statusPath);
+        const status = environmentsLogic.mapStatus(rawStatus, r.statusMap, fallbackStatus);
+        const expiresAt = r.expiresAtPath
+            ? environmentsLogic.coerceExpiresAt(environmentsLogic.extractByPath(json, r.expiresAtPath))
+            : null;
+        const fields = {};
+        if (externalId)
+            fields.externalId = externalId;
+        if (url)
+            fields.url = url;
+        return {
+            externalId,
+            url,
+            status,
+            expiresAt,
+            access: this.mapAccess(r.access, json),
+            fields,
+        };
+    }
+    mapAccess(mapping, json) {
+        if (!mapping)
+            return null;
+        const access = { scheme: mapping.scheme };
+        if (mapping.scheme === 'bearer') {
+            access.token = environmentsLogic.extractString(json, mapping.tokenPath);
+        }
+        else if (mapping.scheme === 'basic') {
+            access.username = environmentsLogic.extractString(json, mapping.usernamePath);
+            access.password = environmentsLogic.extractString(json, mapping.passwordPath);
+        }
+        else if (mapping.scheme === 'custom_header') {
+            access.headerName = mapping.headerName;
+            access.headerValue = environmentsLogic.extractString(json, mapping.headerValuePath);
+        }
+        return access;
+    }
+}
+//# sourceMappingURL=HttpEnvironmentProvider.js.map

package/dist/modules/environments/HttpEnvironmentProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"HttpEnvironmentProvider.js","sourceRoot":"","sources":["../../../src/modules/environments/HttpEnvironmentProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAeL,wBAAwB,GACzB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,iBAAiB,MAAM,yBAAyB,CAAA;AAE5D,iFAAiF;AACjF,+EAA+E;AAC/E,6EAA6E;AAC7E,4EAA4E;AAC5E,EAAE;AACF,2EAA2E;AAC3E,gFAAgF;AAChF,0EAA0E;AAC1E,+CAA+C;AAE/C,MAAM,kBAAkB,GAAG,MAAM,CAAA;AACjC,MAAM,kBAAkB,GAAG,OAAO,CAAA;AAClC,qFAAqF;AACrF,MAAM,kBAAkB,GAAG,kBAAkB,CAAA;AAC7C,gFAAgF;AAChF,MAAM,aAAa,GAAG,CAAC,CAAA;AACvB,MAAM,UAAU,GAAG,aAAa,CAAA;AAEhC,oFAAoF;AACpF,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAEjC,MAAM;IADjB,YACW,MAAc,EACvB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAA;sBAHL,MAAM;QAIf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;IACnC,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,SAAS,CACtB,GAAW,EACX,IAAiB,EACjB,UAA+B;IAE/B,IAAI,OAAO,GAAG,GAAG,CAAA;IACjB,KAAK,IAAI,GAAG,GAAG,CAAC,GAAI,GAAG,EAAE,EAAE,CAAC;QAC1B,UAAU,CAAC,OAAO,CAAC,CAAA;QACnB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAA;QACjE,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;YAC5C,IAAI,CAAC,QAAQ;gBAAE,OAAO,GAAG,CAAA;YACzB,IAAI,GAAG,IAAI,aAAa,EAAE,CAAC;gBACzB,MAAM,IAAI,mBAAmB,CAAC,GAAG,EAAE,kDAAkD,CAAC,CAAA;YACxF,CAAC;YACD,wEAAwE;YACxE,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAA;YAC/C,SAAQ;QACV,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,cAAc,CAC3B,GAAa,EACb,QAAgB,EAChB,eAAe,GAAG,IAAI;IAEtB,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;IAClD,IAAI,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,QAAQ,EAAE,CAAC;QAC5C,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,IAAI,mBAAmB,CAAC,GAAG,EAAE,yCAAyC,CAAC,CAAA;QAC/E,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAA;IACrB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAA;IACpB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAA;IAC/B,MAAM,MAAM,GAAiB,EAAE,CAAA;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;YAC3C,IAAI,IAAI;gBAAE,MAAK;YACf,IAAI,CAAC,KAAK;gBAAE,SAAQ;YACpB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAA;YACzB,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACrB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAA;gBACrB,IAAI,eAAe,EAAE,CAAC;oBACpB,MAAM,IAAI,mBAAmB,CAAC,GAAG,EAAE,yCAAyC,CAAC,CAAA;gBAC/E,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAClB,MAAK;YACP,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACpB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAA;IACtB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAA;IAC3E,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACrB,MAAM,IAAI,CAAC,CAAC,UAAU,CAAA;IACxB,CAAC;IACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;AAC5D,CAAC;AAQD,MAAM,OAAO,uBAAuB;IACjB,gBAAgB,CAAQ;IACxB,SAAS,CAAiB;IAC3C,qEAAqE;IACpD,UAAU,GAAG,IAAI,GAAG,EAAgD,CAAA;IAErF,YAAY,OAAO,GAAmC,EAAE;QACtD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,kBAAkB,CAAA;QACtE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,wBAAwB,CAAA;IAChE,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAgC;QAC9C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,GAAG,CAAC,QAAQ,EACZ,GAAG,CAAC,QAAQ,CAAC,SAAS,EACtB;YACE,KAAK,EAAE,GAAG,CAAC,MAAM;YACjB,SAAS,EAAE,EAAE;SACd,EACD,GAAG,CAAC,aAAa,CAClB,CAAA;QACD,6EAA6E;QAC7E,iEAAiE;QACjE,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IACtD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAA6B;QACxC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YACzB,4EAA4E;YAC5E,iCAAiC;YACjC,OAAO;gBACL,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,GAAG,EAAE,GAAG,CAAC,eAAe,CAAC,GAAG,IAAI,IAAI;gBACpC,MAAM,EAAE,OAAO;gBACf,SAAS,EAAE,IAAI;gBACf,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,GAAG,CAAC,eAAe;aAC5B,CAAA;QACH,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,GAAG,CAAC,QAAQ,EACZ,GAAG,CAAC,QAAQ,CAAC,MAAM,EACnB;YACE,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,GAAG,CAAC,eAAe;SAC/B,EACD,GAAG,CAAC,aAAa,CAClB,CAAA;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;QAC5D,OAAO,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,EAAE,CAAA;IACvE,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAA+B;QAC5C,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,OAAO,CAChB,GAAG,CAAC,QAAQ,EACZ,GAAG,CAAC,QAAQ,CAAC,QAAQ,EACrB;gBACE,KAAK,EAAE,EAAE;gBACT,SAAS,EAAE,GAAG,CAAC,eAAe;aAC/B,EACD,GAAG,CAAC,aAAa,CAClB,CAAA;QACH,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;IAChC,CAAC;IAED,2EAA2E;IAEnE,KAAK,CAAC,OAAO,CACnB,QAA6B,EAC7B,QAAoC,EACpC,KAA2C,EAC3C,aAA6B;QAE7B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAA;QAE5D,MAAM,OAAO,GAA2B;YACtC,MAAM,EAAE,kBAAkB;YAC1B,YAAY,EAAE,UAAU;YACxB,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;SAC1D,CAAA;QACD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YACvC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,mBAAmB,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QACzE,CAAC;QAED,IAAI,IAAwB,CAAA;QAC5B,IAAI,QAAQ,CAAC,YAAY,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACrE,IAAI,GAAG,iBAAiB,CAAC,mBAAmB,CAAC,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;YAC1E,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;gBAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAA;QAC5E,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,SAAS,CACzB,GAAG,EACH;YACE,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,OAAO;YACP,IAAI;YACJ,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,gBAAgB,CAAC;SACzE,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,CACpF,CAAA;QAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YACpF,MAAM,IAAI,mBAAmB,CAC3B,GAAG,CAAC,MAAM,EACV,wBAAwB,QAAQ,CAAC,MAAM,MAAM,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CACpF,CAAA;QACH,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;QAC1D,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,CAAA;QACpB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;YAC5D,OAAO,EAAE,CAAA;QACX,CAAC;IACH,CAAC;IAEO,QAAQ,CACd,OAAe,EACf,QAAoC,EACpC,KAA2C;QAE3C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QACxC,MAAM,IAAI,GAAG,iBAAiB,CAAC,mBAAmB,CAAC,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;QAChF,IAAI,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;QAC1E,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;aACjC,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAChD,iBAAiB,CAAC,mBAAmB,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CACtD,EAAE,CACN;aACA,IAAI,CAAC,GAAG,CAAC,CAAA;QACZ,IAAI,KAAK;YAAE,GAAG,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,EAAE,CAAA;QAC5D,OAAO,GAAG,CAAA;IACZ,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,IAA2B,EAC3B,aAA6B;QAE7B,MAAM,MAAM,GAAG,CAAC,GAAW,EAAU,EAAE;YACrC,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;YAChC,IAAI,KAAK,KAAK,SAAS;gBAAE,MAAM,IAAI,mBAAmB,CAAC,GAAG,EAAE,mBAAmB,GAAG,GAAG,CAAC,CAAA;YACtF,OAAO,KAAK,CAAA;QACd,CAAC,CAAA;QACD,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,MAAM;gBACT,OAAO,EAAE,CAAA;YACX,KAAK,SAAS;gBACZ,OAAO,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,CAAA;YACxF,KAAK,QAAQ;gBACX,OAAO,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,CAAA;YAClE,KAAK,OAAO;gBACV,OAAO;oBACL,aAAa,EAAE,SAAS,IAAI,CAC1B,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAC9E,EAAE;iBACJ,CAAA;YACH,KAAK,2BAA2B;gBAC9B,OAAO,EAAE,aAAa,EAAE,UAAU,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAA;YAC3E,KAAK,gBAAgB,EAAE,CAAC;gBACtB,MAAM,OAAO,GAA2B,EAAE,CAAA;gBAC1C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO;oBAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;gBACvE,OAAO,OAAO,CAAA;YAChB,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,IAA2E,EAC3E,MAA+B;QAE/B,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAA;QACnD,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAA;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC5C,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAAE,OAAO,MAAM,CAAC,KAAK,CAAA;QAExE,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,QAAQ;YACnB,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC;SACtD,CAAC,CAAA;QACF,IAAI,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;QAC7C,IAAI,IAAI,CAAC,QAAQ;YAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;QAEtD,MAAM,GAAG,GAAG,MAAM,SAAS,CACzB,IAAI,CAAC,QAAQ,EACb;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,MAAM,EAAE,kBAAkB;gBAC1B,YAAY,EAAE,UAAU;aACzB;YACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;YACrB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC;SACnD,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,CACxF,CAAA;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YACjF,MAAM,IAAI,mBAAmB,CAC3B,GAAG,CAAC,MAAM,EACV,yBAAyB,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC7D,CAAA;QACH,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;QAC/D,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE;YACjB,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAmD,CAAA;YAChF,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC,CAAC,EAAE,CAAA;QACJ,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC;YACxB,MAAM,IAAI,mBAAmB,CAAC,GAAG,EAAE,2CAA2C,CAAC,CAAA;QACjF,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAA;QAClF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAA;QAC1F,OAAO,IAAI,CAAC,YAAY,CAAA;IAC1B,CAAC;IAEO,WAAW,CACjB,QAA6B,EAC7B,IAAa,EACb,cAAiC;QAEjC,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAA;QAC3B,MAAM,UAAU,GAAG,iBAAiB,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,cAAc,CAAC,IAAI,IAAI,CAAA;QAClF,MAAM,GAAG,GAAG,iBAAiB,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,CAAA;QACpE,MAAM,SAAS,GAAG,iBAAiB,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,CAAA;QACrE,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;QAClF,MAAM,SAAS,GAAG,CAAC,CAAC,aAAa;YAC/B,CAAC,CAAC,iBAAiB,CAAC,eAAe,CAAC,iBAAiB,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC;YAC3F,CAAC,CAAC,IAAI,CAAA;QAER,MAAM,MAAM,GAAoB,EAAE,CAAA;QAClC,IAAI,UAAU;YAAE,MAAM,CAAC,UAAU,GAAG,UAAU,CAAA;QAC9C,IAAI,GAAG;YAAE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAA;QAEzB,OAAO;YACL,UAAU;YACV,GAAG;YACH,MAAM;YACN,SAAS;YACT,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC;YACtC,MAAM;SACP,CAAA;IACH,CAAC;IAEO,SAAS,CACf,OAA6C,EAC7C,IAAa;QAEb,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAA;QACzB,MAAM,MAAM,GAA4B,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAA;QAClE,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,CAAC,KAAK,GAAG,iBAAiB,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;QACzE,CAAC;aAAM,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YACtC,MAAM,CAAC,QAAQ,GAAG,iBAAiB,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;YAC7E,MAAM,CAAC,QAAQ,GAAG,iBAAiB,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;QAC/E,CAAC;aAAM,IAAI,OAAO,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YAC9C,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;YACtC,MAAM,CAAC,WAAW,GAAG,iBAAiB,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,eAAe,CAAC,CAAA;QACrF,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;CACF"}