@cef-ai/cli 2.7.6 → 2.8.1

package/dist/lib/eval-store.d.ts

@@ -0,0 +1,62 @@
+/**
+ * S3-gateway-backed `EvalStore`.
+ *
+ * Datasets live on the S3 gateway, NOT on the DDC content gateway that
+ * `cef push` writes to. ROC's own `agentServiceAccess/wellKnown.ts` states why
+ * these cannot be the same path: "the content gateway cannot resolve S3 keys:
+ * the S3 gateway addresses objects through its own Postgres key->CID index,
+ * which the CDN knows nothing about." They are two systems with two key spaces,
+ * which is also why `cef eval push` is its own command rather than a flag on
+ * `cef push`.
+ */
+import { S3Client } from "@aws-sdk/client-s3";
+import type { EvalStore } from "@cef-ai/eval";
+import type { CredentialSource } from "./eval-auth.js";
+export interface S3StoreOptions {
+    bucket: string;
+    client: S3Client;
+    /** Key prefix within the bucket. Defaults to none. */
+    root?: string;
+    /**
+     * The gateway refused `failed`'s credential (403): a client with a fresh
+     * one, or undefined when there is none. Each request is retried once.
+     */
+    renew?: (failed: S3Client) => Promise<S3Client | undefined>;
+}
+/** A refused credential: expired, revoked, or never valid. */
+export declare function isAuthFailure(err: unknown): boolean;
+export declare function s3Store(opts: S3StoreOptions): EvalStore;
+/**
+ * Build an S3 client for a gateway endpoint. With a `CredentialSource` the
+ * client asks it for a credential, carrying its expiry, so the SDK asks again
+ * inside its refresh window (5 min before expiry) and the source mints anew.
+ */
+export declare function gatewayClient(cfg: {
+    endpoint: string;
+    region?: string;
+} & ({
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken?: string;
+    credentials?: never;
+} | {
+    credentials: CredentialSource;
+})): S3Client;
+/**
+ * The store `cef eval` uses: a gateway client over a credential source, and
+ * on a 403 one fresh client per refused credential — concurrent requests that
+ * fail together share it instead of minting one each.
+ */
+export declare function gatewayStore(opts: {
+    endpoint: string;
+    bucket: string;
+    region?: string;
+    credentials: CredentialSource;
+    root?: string;
+    makeClient?: (cfg: {
+        endpoint: string;
+        region?: string;
+        credentials: CredentialSource;
+    }) => S3Client;
+}): EvalStore;
+//# sourceMappingURL=eval-store.d.ts.map

package/dist/lib/eval-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eval-store.d.ts","sourceRoot":"","sources":["../../src/lib/eval-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAML,QAAQ,EAET,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,QAAQ,CAAC;IACjB,sDAAsD;IACtD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,KAAK,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;CAC7D;AAED,8DAA8D;AAC9D,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAInD;AAuBD,wBAAgB,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,SAAS,CA8NvD;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,CACA;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,KAAK,CAAA;CAAE,GAC5F;IAAE,WAAW,EAAE,gBAAgB,CAAA;CAAE,CACpC,GAAG,QAAQ,CA+CX;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,gBAAgB,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,gBAAgB,CAAA;KAAE,KAAK,QAAQ,CAAC;CACtG,GAAG,SAAS,CAwBZ"}

package/dist/lib/eval-store.js

@@ -0,0 +1,334 @@
+/**
+ * S3-gateway-backed `EvalStore`.
+ *
+ * Datasets live on the S3 gateway, NOT on the DDC content gateway that
+ * `cef push` writes to. ROC's own `agentServiceAccess/wellKnown.ts` states why
+ * these cannot be the same path: "the content gateway cannot resolve S3 keys:
+ * the S3 gateway addresses objects through its own Postgres key->CID index,
+ * which the CDN knows nothing about." They are two systems with two key spaces,
+ * which is also why `cef eval push` is its own command rather than a flag on
+ * `cef push`.
+ */
+import { GetObjectCommand, ListObjectsV2Command, PutObjectCommand, S3Client, } from "@aws-sdk/client-s3";
+/** A refused credential: expired, revoked, or never valid. */
+export function isAuthFailure(err) {
+    const e = err;
+    return e?.$metadata?.httpStatusCode === 403
+        || e?.name === "InvalidAccessKeyId" || e?.name === "ExpiredToken" || e?.name === "AccessDenied";
+}
+/**
+ * `listObjects` on the gateway caps a page at 1000 keys and does NOT signal
+ * truncation to a naive caller — a known ceiling recorded in the design. So
+ * this paginates explicitly with the continuation token rather than trusting a
+ * single response, and every caller gets the whole prefix or an error.
+ *
+ * Silent truncation is the dangerous shape: a dataset that quietly
+ * stops at 1000 cases cuts a version missing the rest, and the experiment
+ * built from it looks complete.
+ */
+/** The endpoint host, for a warning that has to say WHICH gateway misbehaved. */
+async function endpointLabel(client) {
+    try {
+        const endpoint = client.config
+            .endpoint;
+        return (await endpoint?.())?.hostname ?? "the S3 endpoint";
+    }
+    catch {
+        return "the S3 endpoint";
+    }
+}
+export function s3Store(opts) {
+    const { bucket } = opts;
+    let client = opts.client;
+    /*
+     * ONE RETRY ON A REFUSED CREDENTIAL. The client re-asks its credential
+     * provider before expiry on its own; this covers the rest (revoked, a clock
+     * that disagrees with the gateway's) without turning a real permission
+     * error into a loop.
+     */
+    const send = async (command) => {
+        const used = client;
+        try {
+            return (await used.send(command));
+        }
+        catch (err) {
+            if (!opts.renew || !isAuthFailure(err))
+                throw err;
+            const fresh = await opts.renew(used);
+            if (!fresh)
+                throw err;
+            client = fresh;
+            return (await fresh.send(command));
+        }
+    };
+    const root = opts.root ? opts.root.replace(/\/*$/, "/") : "";
+    const full = (key) => `${root}${key}`;
+    const get = async (key) => {
+        try {
+            const res = await send(new GetObjectCommand({ Bucket: bucket, Key: full(key) }));
+            return (await res.Body?.transformToString()) ?? null;
+        }
+        catch (err) {
+            const name = err.name;
+            // A genuinely absent object is `null`; anything else (auth, network,
+            // a bad bucket) must propagate — swallowing it would make `putCase`'s
+            // written-once check silently pass and overwrite a real case.
+            if (name === "NoSuchKey" || name === "NotFound")
+                return null;
+            throw err;
+        }
+    };
+    return {
+        async list(prefix) {
+            const keys = [];
+            let token;
+            do {
+                const page = await send(new ListObjectsV2Command({
+                    Bucket: bucket,
+                    Prefix: full(prefix),
+                    ContinuationToken: token,
+                }));
+                for (const obj of page.Contents ?? []) {
+                    if (obj.Key)
+                        keys.push(root ? obj.Key.slice(root.length) : obj.Key);
+                }
+                // Truncated with nowhere to continue from is the exact silent
+                // truncation this function exists to prevent: returning the short list
+                // reads as a complete one, and the version cut from it is missing cases
+                // nobody will notice are gone.
+                if (page.IsTruncated && !page.NextContinuationToken) {
+                    throw new Error(`[eval] listing "${full(prefix)}" in bucket "${bucket}" came back ` +
+                        `TRUNCATED after ${keys.length} key(s) with no ` +
+                        `NextContinuationToken, so the rest of the prefix cannot be ` +
+                        `fetched. Refusing to return a short list — a set that quietly ` +
+                        `stops cuts a version missing cases, and the experiment built ` +
+                        `from it looks complete.`);
+                }
+                token = page.IsTruncated ? page.NextContinuationToken : undefined;
+            } while (token);
+            return keys.sort();
+        },
+        /**
+         * Child prefixes through `Delimiter: "/"`, paged the same way and with the
+         * same refusal of a truncated page that has nowhere to continue — what
+         * lets `listDatasets`/`findExperiment` skip every run record in the bucket.
+         */
+        async listPrefixes(prefix) {
+            const out = new Set();
+            let token;
+            do {
+                const page = await send(new ListObjectsV2Command({
+                    Bucket: bucket,
+                    Prefix: full(prefix),
+                    Delimiter: "/",
+                    ContinuationToken: token,
+                }));
+                for (const p of page.CommonPrefixes ?? []) {
+                    if (p.Prefix)
+                        out.add(root ? p.Prefix.slice(root.length) : p.Prefix);
+                }
+                if (page.IsTruncated && !page.NextContinuationToken) {
+                    throw new Error(`[eval] listing the prefixes of "${full(prefix)}" in bucket "${bucket}" came back TRUNCATED ` +
+                        `with no NextContinuationToken — refusing to return a short list.`);
+                }
+                token = page.IsTruncated ? page.NextContinuationToken : undefined;
+            } while (token);
+            return [...out].sort();
+        },
+        get,
+        async put(key, body) {
+            await send(new PutObjectCommand({
+                Bucket: bucket,
+                Key: full(key),
+                Body: body,
+                ContentType: "application/json",
+            }));
+        },
+        /**
+         * Write-if-absent. A real compare-and-set on every store this runs against,
+         * including Cere's DDC S3 gateway — verified, not assumed.
+         *
+         * Two layers, in order:
+         *
+         * 1. READ FIRST, and return `false` without attempting any write. Catches
+         *    every collision older than one round trip, and — because it never
+         *    writes on that path — it is also what keeps a store that ignored the
+         *    header from corrupting rather than merely losing a cut.
+         *
+         * 2. `If-None-Match: "*"` on the PUT, with `412` read as "taken". This is
+         *    the part that actually closes the race, step 1 or no step 1.
+         *
+         * Step 2 was believed inert on the DDC gateway: it is a hand-written Go
+         * service whose documented PutObject path is "stream to DDC, then UPSERT
+         * the index row" with no precondition step, its published error model lists
+         * no `412`, and nothing in this repo or ROC had ever sent the header. Two
+         * company ADR paragraphs contradicted each other on it.
+         *
+         * Probed against dev rather than left as a caveat: the first conditional
+         * PUT succeeded, the SECOND returned `PreconditionFailed` / 412, and the
+         * stored bytes were still the first writer's. The gateway honours it, and
+         * the ADR paragraph claiming conditional writes exist is the correct one.
+         *
+         * The unconditional fallback below stays for a store that rejects the
+         * header outright with 501 — one unknown header must not be able to take
+         * `eval push --cut` down entirely — and step 1 still guards that path. NOT
+         * 400: that covers a malformed key, a bad body, a signing problem and much
+         * else, and downgrading on it would let two concurrent cutters both
+         * believe they won while step 2 was never really tried.
+         */
+        async putIfAbsent(key, body) {
+            if ((await get(key)) !== null)
+                return false;
+            const command = (conditional) => new PutObjectCommand({
+                Bucket: bucket,
+                Key: full(key),
+                Body: body,
+                ContentType: "application/json",
+                ...(conditional ? { IfNoneMatch: "*" } : {}),
+            });
+            try {
+                await send(command(true));
+                return true;
+            }
+            catch (err) {
+                const code = err.$metadata
+                    ?.httpStatusCode;
+                // 412: the key was taken. 409 (`ConditionalRequestConflict`) means a
+                // concurrent write collided and AWS says to retry — reporting it as
+                // "taken" sends the caller back to re-list and try the next number,
+                // which is the same recovery and is self-correcting if the key turns
+                // out to be free after all.
+                if (err.name === "PreconditionFailed")
+                    return false;
+                if (code === 412 || code === 409)
+                    return false;
+                // A server that does not IMPLEMENT the header must not take the whole
+                // feature down with it: `cef eval push --cut` has to keep working
+                // against a gateway that answers 501. 501 ONLY — a 400 is "your request
+                // was wrong", which covers a malformed key, a bad body, a signing
+                // problem and much else, and downgrading on it means two cutters both
+                // believe they won while step 2 was never really tried. And the
+                // downgrade is announced: a gateway that regresses out of conditional
+                // writes must be visible, not a comment nobody reads.
+                if (code === 501) {
+                    console.warn(`[eval] ${await endpointLabel(client)} answered 501 to a conditional ` +
+                        `PUT (If-None-Match: *) on "${full(key)}" — falling back to an ` +
+                        `UNCONDITIONAL write. The read check above still stands, but two ` +
+                        `concurrent writers can now both believe they won a version or a ` +
+                        `revision. This gateway no longer supports write-once.`);
+                    await send(command(false));
+                    return true;
+                }
+                throw err;
+            }
+        },
+        /**
+         * The claim `storeConformance` refuses to run without, and the one the
+         * doc comment above spends forty lines earning: the SERVER adjudicates,
+         * through `If-None-Match: "*"` with 412/409 read as "taken".
+         *
+         * Pinned, not asserted-by-comment: `eval-store.test.ts` drives this
+         * `putIfAbsent` and reads the header off the `PutObjectCommand` the store
+         * actually sent. Change the mechanism and that test goes red next to this
+         * word.
+         *
+         * One honest caveat, and it is wider than "one write": the 501 branch
+         * above is in a per-call `catch`, so against a gateway that answers 501 it
+         * fires on EVERY `putIfAbsent` for as long as that lasts. The whole
+         * process is writing unconditionally, with only step 1's read between two
+         * cutters and a silently replaced manifest. The per-call `console.warn` is
+         * the right mitigation precisely because of that — it names the endpoint
+         * every time rather than once — but nobody should read this as a single
+         * degraded write.
+         *
+         * The declaration stays `conditional-write` regardless, because it
+         * describes what this store SENDS. A store whose declared mechanism
+         * flipped mid-run would be a claim nobody could check against the code,
+         * which is the one thing the word has to be.
+         */
+        atomicity: "conditional-write",
+    };
+}
+/**
+ * Build an S3 client for a gateway endpoint. With a `CredentialSource` the
+ * client asks it for a credential, carrying its expiry, so the SDK asks again
+ * inside its refresh window (5 min before expiry) and the source mints anew.
+ */
+export function gatewayClient(cfg) {
+    const credentials = "credentials" in cfg && cfg.credentials
+        ? async () => {
+            const c = await cfg.credentials.get();
+            return {
+                accessKeyId: c.accessKeyId,
+                secretAccessKey: c.secretAccessKey,
+                ...(c.expiresAt !== undefined ? { expiration: new Date(c.expiresAt) } : {}),
+            };
+        }
+        : {
+            accessKeyId: cfg.accessKeyId,
+            secretAccessKey: cfg.secretAccessKey,
+            ...(cfg.sessionToken ? { sessionToken: cfg.sessionToken } : {}),
+        };
+    const config = {
+        endpoint: cfg.endpoint,
+        region: cfg.region ?? "us-east-1",
+        // The gateway addresses buckets by path, not by virtual host.
+        forcePathStyle: true,
+        credentials,
+    };
+    const client = new S3Client(config);
+    // The gateway routes on `/<bucket>/<key>` and reads the empty last segment of
+    // a bucket-level path (`/<bucket>/`, which is what the AWS SDK sends under
+    // `forcePathStyle`) as a key, answering `400 InvalidArgument: key is
+    // required`. Keyed commands are left alone: an object key may legitimately
+    // end in `/`. Keying off the command input rather than the path shape also
+    // survives a `--endpoint` that carries a path prefix, where `/s3/<bucket>/`
+    // is indistinguishable from a bucket-and-key path by pattern alone.
+    //
+    // ROC needs this too and has `removeTrailingBucketSlashForDdcGateway` in
+    // `browserBucketStorage.ts`; that one matches on the path shape, so it is the
+    // same behaviour for the bare-host endpoints both use.
+    client.middlewareStack.add((next) => (args) => {
+        const request = args.request;
+        const keyed = typeof args.input === "object" && args.input !== null && "Key" in args.input;
+        if (request?.path && request.path.length > 1 && request.path.endsWith("/") && !keyed) {
+            request.path = request.path.replace(/\/+$/, "");
+        }
+        return next(args);
+    }, { name: "removeTrailingBucketSlashForDdcGateway", step: "build" });
+    return client;
+}
+/**
+ * The store `cef eval` uses: a gateway client over a credential source, and
+ * on a 403 one fresh client per refused credential — concurrent requests that
+ * fail together share it instead of minting one each.
+ */
+export function gatewayStore(opts) {
+    const make = () => (opts.makeClient ?? gatewayClient)({
+        endpoint: opts.endpoint, ...(opts.region ? { region: opts.region } : {}), credentials: opts.credentials,
+    });
+    let current = make();
+    let renewing;
+    return s3Store({
+        bucket: opts.bucket,
+        client: current,
+        ...(opts.root ? { root: opts.root } : {}),
+        renew: async (failed) => {
+            if (failed !== current)
+                return current;
+            renewing ??= (async () => {
+                try {
+                    if (!(await opts.credentials.invalidate()))
+                        return undefined;
+                    current = make();
+                    return current;
+                }
+                finally {
+                    renewing = undefined;
+                }
+            })();
+            return renewing;
+        },
+    });
+}
+//# sourceMappingURL=eval-store.js.map

package/dist/lib/eval-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eval-store.js","sourceRoot":"","sources":["../../src/lib/eval-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EACL,gBAAgB,EAEhB,oBAAoB,EAEpB,gBAAgB,EAChB,QAAQ,GAET,MAAM,oBAAoB,CAAC;AAiB5B,8DAA8D;AAC9D,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,MAAM,CAAC,GAAG,GAAiE,CAAC;IAC5E,OAAO,CAAC,EAAE,SAAS,EAAE,cAAc,KAAK,GAAG;WACtC,CAAC,EAAE,IAAI,KAAK,oBAAoB,IAAI,CAAC,EAAE,IAAI,KAAK,cAAc,IAAI,CAAC,EAAE,IAAI,KAAK,cAAc,CAAC;AACpG,CAAC;AAED;;;;;;;;;GASG;AACH,iFAAiF;AACjF,KAAK,UAAU,aAAa,CAAC,MAAgB;IAC3C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAI,MAAM,CAAC,MAA8D;aACpF,QAAQ,CAAC;QACZ,OAAO,CAAC,MAAM,QAAQ,EAAE,EAAE,CAAC,EAAE,QAAQ,IAAI,iBAAiB,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,iBAAiB,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAoB;IAC1C,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IACzB;;;;;OAKG;IACH,MAAM,IAAI,GAAG,KAAK,EAAK,OAAmE,EAAc,EAAE;QACxG,MAAM,IAAI,GAAG,MAAM,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAgB,CAAC,CAAM,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;YAClD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,CAAC,KAAK;gBAAE,MAAM,GAAG,CAAC;YACtB,MAAM,GAAG,KAAK,CAAC;YACf,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAgB,CAAC,CAAM,CAAC;QACnD,CAAC;IACH,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC;IAE9C,MAAM,GAAG,GAAG,KAAK,EAAE,GAAW,EAA0B,EAAE;QACxD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CACpB,IAAI,gBAAgB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CACzD,CAAC;YACF,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,iBAAiB,EAAE,CAAC,IAAI,IAAI,CAAC;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAAyB,CAAC,IAAI,CAAC;YAC7C,qEAAqE;YACrE,sEAAsE;YACtE,8DAA8D;YAC9D,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,UAAU;gBAAE,OAAO,IAAI,CAAC;YAC7D,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,MAAM;YACf,MAAM,IAAI,GAAa,EAAE,CAAC;YAC1B,IAAI,KAAyB,CAAC;YAC9B,GAAG,CAAC;gBACF,MAAM,IAAI,GAAG,MAAM,IAAI,CACrB,IAAI,oBAAoB,CAAC;oBACvB,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;oBACpB,iBAAiB,EAAE,KAAK;iBACzB,CAAC,CACH,CAAC;gBACF,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;oBACtC,IAAI,GAAG,CAAC,GAAG;wBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACtE,CAAC;gBACD,8DAA8D;gBAC9D,uEAAuE;gBACvE,wEAAwE;gBACxE,+BAA+B;gBAC/B,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;oBACpD,MAAM,IAAI,KAAK,CACb,mBAAmB,IAAI,CAAC,MAAM,CAAC,gBAAgB,MAAM,cAAc;wBACjE,mBAAmB,IAAI,CAAC,MAAM,kBAAkB;wBAChD,6DAA6D;wBAC7D,gEAAgE;wBAChE,+DAA+D;wBAC/D,yBAAyB,CAC5B,CAAC;gBACJ,CAAC;gBACD,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC;YACpE,CAAC,QAAQ,KAAK,EAAE;YAChB,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;QACrB,CAAC;QAED;;;;WAIG;QACH,KAAK,CAAC,YAAY,CAAC,MAAM;YACvB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;YAC9B,IAAI,KAAyB,CAAC;YAC9B,GAAG,CAAC;gBACF,MAAM,IAAI,GAAG,MAAM,IAAI,CACrB,IAAI,oBAAoB,CAAC;oBACvB,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;oBACpB,SAAS,EAAE,GAAG;oBACd,iBAAiB,EAAE,KAAK;iBACzB,CAAC,CACH,CAAC;gBACF,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,cAAc,IAAI,EAAE,EAAE,CAAC;oBAC1C,IAAI,CAAC,CAAC,MAAM;wBAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBACvE,CAAC;gBACD,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;oBACpD,MAAM,IAAI,KAAK,CACb,mCAAmC,IAAI,CAAC,MAAM,CAAC,gBAAgB,MAAM,wBAAwB;wBAC3F,kEAAkE,CACrE,CAAC;gBACJ,CAAC;gBACD,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC;YACpE,CAAC,QAAQ,KAAK,EAAE;YAChB,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACzB,CAAC;QAED,GAAG;QAEH,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI;YACjB,MAAM,IAAI,CACR,IAAI,gBAAgB,CAAC;gBACnB,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;gBACd,IAAI,EAAE,IAAI;gBACV,WAAW,EAAE,kBAAkB;aAChC,CAAC,CACH,CAAC;QACJ,CAAC;QAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA+BG;QACH,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI;YACzB,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;YAC5C,MAAM,OAAO,GAAG,CAAC,WAAoB,EAAE,EAAE,CACvC,IAAI,gBAAgB,CAAC;gBACnB,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;gBACd,IAAI,EAAE,IAAI;gBACV,WAAW,EAAE,kBAAkB;gBAC/B,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7C,CAAC,CAAC;YACL,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC1B,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,GAAI,GAAmD,CAAC,SAAS;oBACzE,EAAE,cAAc,CAAC;gBACnB,qEAAqE;gBACrE,oEAAoE;gBACpE,oEAAoE;gBACpE,qEAAqE;gBACrE,4BAA4B;gBAC5B,IAAK,GAAyB,CAAC,IAAI,KAAK,oBAAoB;oBAAE,OAAO,KAAK,CAAC;gBAC3E,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG;oBAAE,OAAO,KAAK,CAAC;gBAC/C,sEAAsE;gBACtE,kEAAkE;gBAClE,wEAAwE;gBACxE,kEAAkE;gBAClE,sEAAsE;gBACtE,gEAAgE;gBAChE,sEAAsE;gBACtE,sDAAsD;gBACtD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;oBACjB,OAAO,CAAC,IAAI,CACV,UAAU,MAAM,aAAa,CAAC,MAAM,CAAC,iCAAiC;wBACpE,8BAA8B,IAAI,CAAC,GAAG,CAAC,yBAAyB;wBAChE,kEAAkE;wBAClE,kEAAkE;wBAClE,uDAAuD,CAC1D,CAAC;oBACF,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC3B,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED;;;;;;;;;;;;;;;;;;;;;;;WAuBG;QACH,SAAS,EAAE,mBAAmB;KAC/B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAM7B;IACC,MAAM,WAAW,GAAkC,aAAa,IAAI,GAAG,IAAI,GAAG,CAAC,WAAW;QACxF,CAAC,CAAC,KAAK,IAAI,EAAE;YACX,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC;YACtC,OAAO;gBACL,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,eAAe,EAAE,CAAC,CAAC,eAAe;gBAClC,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5E,CAAC;QACJ,CAAC;QACD,CAAC,CAAC;YACA,WAAW,EAAG,GAA+B,CAAC,WAAW;YACzD,eAAe,EAAG,GAAmC,CAAC,eAAe;YACrE,GAAG,CAAE,GAAiC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAG,GAAgC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7H,CAAC;IACJ,MAAM,MAAM,GAAmB;QAC7B,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,WAAW;QACjC,8DAA8D;QAC9D,cAAc,EAAE,IAAI;QACpB,WAAW;KACZ,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,8EAA8E;IAC9E,2EAA2E;IAC3E,qEAAqE;IACrE,2EAA2E;IAC3E,2EAA2E;IAC3E,4EAA4E;IAC5E,oEAAoE;IACpE,EAAE;IACF,yEAAyE;IACzE,8EAA8E;IAC9E,uDAAuD;IACvD,MAAM,CAAC,eAAe,CAAC,GAAG,CACxB,CAAoD,IAAoB,EAAE,EAAE,CAC1E,CAAC,IAAO,EAAK,EAAE;QACb,MAAM,OAAO,GAAG,IAAI,CAAC,OAAwC,CAAC;QAC9D,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC;QAC3F,IAAI,OAAO,EAAE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACrF,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC,EACH,EAAE,IAAI,EAAE,wCAAwC,EAAE,IAAI,EAAE,OAAO,EAAE,CAClE,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAO5B;IACC,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,aAAa,CAAC,CAAC;QACpD,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW;KACxG,CAAC,CAAC;IACH,IAAI,OAAO,GAAG,IAAI,EAAE,CAAC;IACrB,IAAI,QAAmD,CAAC;IACxD,OAAO,OAAO,CAAC;QACb,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,MAAM,EAAE,OAAO;QACf,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACtB,IAAI,MAAM,KAAK,OAAO;gBAAE,OAAO,OAAO,CAAC;YACvC,QAAQ,KAAK,CAAC,KAAK,IAAI,EAAE;gBACvB,IAAI,CAAC;oBACH,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;wBAAE,OAAO,SAAS,CAAC;oBAC7D,OAAO,GAAG,IAAI,EAAE,CAAC;oBACjB,OAAO,OAAO,CAAC;gBACjB,CAAC;wBAAS,CAAC;oBACT,QAAQ,GAAG,SAAS,CAAC;gBACvB,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;YACL,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/lib/eval-store.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=eval-store.test.d.ts.map

package/dist/lib/eval-store.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eval-store.test.d.ts","sourceRoot":"","sources":["../../src/lib/eval-store.test.ts"],"names":[],"mappings":""}

package/dist/lib/eval-store.test.js

@@ -0,0 +1,155 @@
+/**
+ * `s3Store` against an in-process S3 that behaves like the gateway where it
+ * matters: a list page holds at most PAGE keys, and `If-None-Match: *` on an
+ * existing key answers 412. A plain memory map would pass a store that reads
+ * one page or ignores the condition.
+ */
+import { describe, expect, it } from "vitest";
+import { GetObjectCommand, ListObjectsV2Command, PutObjectCommand, } from "@aws-sdk/client-s3";
+import { addCase, createDataset, cutVersion, loadVersion, storeConformance } from "@cef-ai/eval";
+import { mintedCredentials, staticCredentials } from "./eval-auth.js";
+import { gatewayStore, s3Store } from "./eval-store.js";
+const PAGE = 3;
+function fakeS3(opts = {}) {
+    const objects = new Map();
+    const sent = [];
+    const send = async (cmd) => {
+        const input = cmd.input;
+        sent.push({ name: cmd.constructor.name, input });
+        if (cmd instanceof GetObjectCommand) {
+            const body = objects.get(String(input.Key));
+            if (body === undefined)
+                throw Object.assign(new Error("NoSuchKey"), { name: "NoSuchKey" });
+            return { Body: { transformToString: async () => body } };
+        }
+        if (cmd instanceof PutObjectCommand) {
+            const key = String(input.Key);
+            if (input.IfNoneMatch === "*") {
+                if (opts.conditional === "501")
+                    throw Object.assign(new Error("NotImplemented"), { $metadata: { httpStatusCode: 501 } });
+                if (objects.has(key))
+                    throw Object.assign(new Error("PreconditionFailed"), { name: "PreconditionFailed", $metadata: { httpStatusCode: 412 } });
+            }
+            objects.set(key, String(input.Body));
+            return {};
+        }
+        if (cmd instanceof ListObjectsV2Command) {
+            const prefix = String(input.Prefix ?? "");
+            const keys = [...objects.keys()].filter((k) => k.startsWith(prefix)).sort();
+            // With a delimiter, S3 rolls every key below a "/" into one CommonPrefix and pages over the mix.
+            const entries = input.Delimiter === "/"
+                ? [...new Set(keys.map((k) => {
+                        const slash = k.indexOf("/", prefix.length);
+                        return slash < 0 ? k : `${k.slice(0, slash + 1)}`;
+                    }))].sort()
+                : keys;
+            const start = input.ContinuationToken ? Number(input.ContinuationToken) : 0;
+            const page = entries.slice(start, start + PAGE);
+            const more = start + PAGE < entries.length;
+            return {
+                Contents: page.filter((k) => !k.endsWith("/") || input.Delimiter !== "/").map((Key) => ({ Key })),
+                CommonPrefixes: input.Delimiter === "/" ? page.filter((k) => k.endsWith("/")).map((Prefix) => ({ Prefix })) : [],
+                IsTruncated: more,
+                ...(more ? { NextContinuationToken: String(start + PAGE) } : {}),
+            };
+        }
+        throw new Error(`unexpected command ${cmd.constructor.name}`);
+    };
+    return { client: { send }, objects, sent };
+}
+describe("s3Store", () => {
+    for (const check of storeConformance(async () => s3Store({ bucket: "b", client: fakeS3().client }))) {
+        // The 1050-key paging check is slow against nothing in particular; paging is covered below.
+        if (check.name.includes("pages past"))
+            continue;
+        it(check.name, check.run);
+    }
+    it("lists every page, under the root, with the root stripped", async () => {
+        const s3 = fakeS3();
+        const store = s3Store({ bucket: "b", client: s3.client, root: "team" });
+        for (let i = 0; i < 7; i++)
+            await store.put(`evals/k${i}`, "x");
+        await store.put("other/z", "x");
+        expect(await store.list("evals/")).toEqual(["evals/k0", "evals/k1", "evals/k2", "evals/k3", "evals/k4", "evals/k5", "evals/k6"]);
+        expect([...s3.objects.keys()].every((k) => k.startsWith("team/"))).toBe(true);
+    });
+    it("reads an absent key as null and refuses a taken one with a conditional put", async () => {
+        const s3 = fakeS3();
+        const store = s3Store({ bucket: "b", client: s3.client });
+        expect(await store.get("nope")).toBeNull();
+        expect(await store.putIfAbsent("k", "1")).toBe(true);
+        expect(await store.putIfAbsent("k", "2")).toBe(false);
+        expect(await store.get("k")).toBe("1");
+        expect(s3.sent.filter((c) => c.name === "PutObjectCommand").every((c) => c.input.IfNoneMatch === "*")).toBe(true);
+    });
+    it("lists child prefixes across pages, under the root, with the root stripped", async () => {
+        const s3 = fakeS3();
+        const store = s3Store({ bucket: "b", client: s3.client, root: "team" });
+        for (const d of ["a", "b", "c", "d", "e"]) {
+            await store.put(`evals/datasets/${d}/header.json`, "{}");
+            await store.put(`evals/datasets/${d}/cases/x/r1.json`, "{}");
+        }
+        await store.put("evals/datasets/loose.json", "{}");
+        expect(await store.listPrefixes("evals/datasets/")).toEqual(["a", "b", "c", "d", "e"].map((d) => `evals/datasets/${d}/`));
+        expect(s3.sent.filter((c) => c.name === "ListObjectsV2Command").every((c) => c.input.Delimiter === "/")).toBe(true);
+    });
+    it("falls back to an unconditional write only on 501", async () => {
+        const store = s3Store({ bucket: "b", client: fakeS3({ conditional: "501" }).client });
+        expect(await store.putIfAbsent("k", "1")).toBe(true);
+    });
+    it("holds a dataset end to end", async () => {
+        const store = s3Store({ bucket: "b", client: fakeS3().client });
+        await createDataset(store, { dataset: "triage", workflowId: "wf" });
+        for (const id of ["a", "b", "c", "d"])
+            await addCase(store, "wf", "triage", { id, input: { id } });
+        await cutVersion(store, "wf", "triage");
+        expect((await loadVersion(store, "wf", "triage", 1)).cases.map((c) => c.case.id)).toEqual(["a", "b", "c", "d"]);
+    });
+    it("replaces a refused credential once, shared by every request it failed, and retries each", async () => {
+        const backing = fakeS3();
+        let n = 0;
+        const credentials = mintedCredentials({
+            mint: async () => ({ accessKeyId: `k${++n}`, secretAccessKey: "s", expiresAt: Date.now() + 3600_000 }),
+        });
+        await credentials.get();
+        const clients = [];
+        const store = gatewayStore({
+            endpoint: "https://gw", bucket: "b", credentials,
+            makeClient: (cfg) => {
+                const send = async (cmd) => {
+                    const key = (await cfg.credentials.get()).accessKeyId;
+                    // The first credential was revoked behind our back.
+                    if (key === "k1") {
+                        // One request was already in flight on the old credential, and is refused after the renewal.
+                        if (cmd.input.Key === "slow")
+                            await new Promise((r) => setTimeout(r, 20));
+                        throw Object.assign(new Error("InvalidAccessKeyId"), { name: "InvalidAccessKeyId", $metadata: { httpStatusCode: 403 } });
+                    }
+                    return backing.client.send(cmd);
+                };
+                clients.push(`client${clients.length + 1}`);
+                return { send };
+            },
+        });
+        await Promise.all([store.get("slow"), store.put("a", "1"), store.put("b", "2"), store.get("a")]);
+        expect(await store.get("a")).toBe("1");
+        expect(await store.get("b")).toBe("2");
+        expect(clients).toEqual(["client1", "client2"]);
+        expect(n).toBe(2);
+    });
+    it("does not retry a refusal it cannot fix", async () => {
+        let calls = 0;
+        const store = gatewayStore({
+            endpoint: "https://gw", bucket: "b", credentials: staticCredentials({ accessKeyId: "AK", secretAccessKey: "SK" }),
+            makeClient: () => ({
+                send: async () => {
+                    calls++;
+                    throw Object.assign(new Error("AccessDenied"), { name: "AccessDenied", $metadata: { httpStatusCode: 403 } });
+                },
+            }),
+        });
+        await expect(store.put("a", "1")).rejects.toThrow(/AccessDenied/);
+        expect(calls).toBe(1);
+    });
+});
+//# sourceMappingURL=eval-store.test.js.map

package/dist/lib/eval-store.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eval-store.test.js","sourceRoot":"","sources":["../../src/lib/eval-store.test.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,GAEjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEjG,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAExD,MAAM,IAAI,GAAG,CAAC,CAAC;AAEf,SAAS,MAAM,CAAC,OAA2C,EAAE;IAC3D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,MAAM,IAAI,GAA4D,EAAE,CAAC;IACzE,MAAM,IAAI,GAAG,KAAK,EAAE,GAAuC,EAAoB,EAAE;QAC/E,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5C,IAAI,IAAI,KAAK,SAAS;gBAAE,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;YAC3F,OAAO,EAAE,IAAI,EAAE,EAAE,iBAAiB,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;QAC3D,CAAC;QACD,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;YACpC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,KAAK,CAAC,WAAW,KAAK,GAAG,EAAE,CAAC;gBAC9B,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK;oBAAE,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;gBACzH,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,SAAS,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACjJ,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YACrC,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;YAC1C,MAAM,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5E,iGAAiG;YACjG,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,KAAK,GAAG;gBACrC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;wBAC3B,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;wBAC5C,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;oBACpD,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;gBACX,CAAC,CAAC,IAAI,CAAC;YACT,MAAM,KAAK,GAAG,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5E,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC,CAAC;YAChD,MAAM,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;YAC3C,OAAO;gBACL,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,SAAS,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;gBACjG,cAAc,EAAE,KAAK,CAAC,SAAS,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;gBAChH,WAAW,EAAE,IAAI;gBACjB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjE,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAyB,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACpE,CAAC;AAED,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE;IACvB,KAAK,MAAM,KAAK,IAAI,gBAAgB,CAAC,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC;QACpG,4FAA4F;QAC5F,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;YAAE,SAAS;QAChD,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACxE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;YAAE,MAAM,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAChE,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAChC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;QACjI,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3C,MAAM,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACxE,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YAC1C,MAAM,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;YACzD,MAAM,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,KAAK,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,KAAK,CAAC,YAAa,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAC1D,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAC7D,CAAC;QACF,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,sBAAsB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,KAAK,GAAG,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACtF,MAAM,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;QAChE,MAAM,aAAa,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;YAAE,MAAM,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACnG,MAAM,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QACxC,MAAM,CAAC,CAAC,MAAM,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAClH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yFAAyF,EAAE,KAAK,IAAI,EAAE;QACvG,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,MAAM,WAAW,GAAG,iBAAiB,CAAC;YACpC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;SACvG,CAAC,CAAC;QACH,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC;QACxB,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,YAAY,CAAC;YACzB,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW;YAChD,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE;gBAClB,MAAM,IAAI,GAAG,KAAK,EAAE,GAAY,EAAE,EAAE;oBAClC,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC;oBACtD,oDAAoD;oBACpD,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;wBACjB,6FAA6F;wBAC7F,IAAK,GAAmC,CAAC,KAAK,CAAC,GAAG,KAAK,MAAM;4BAAE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;wBAC3G,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,SAAS,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;oBAC3H,CAAC;oBACD,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAY,CAAC,CAAC;gBAC3C,CAAC,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,SAAS,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC5C,OAAO,EAAE,IAAI,EAAyB,CAAC;YACzC,CAAC;SACF,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACjG,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,MAAM,KAAK,GAAG,YAAY,CAAC;YACzB,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,iBAAiB,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;YACjH,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;gBACjB,IAAI,EAAE,KAAK,IAAI,EAAE;oBACf,KAAK,EAAE,CAAC;oBACR,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC/G,CAAC;aACF,CAAwB;SAC1B,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAClE,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}