@cleocode/core 2026.10.13 → 2026.10.14-rc.ci.683

package/dist/store/docs-bytes-backup.js

@@ -0,0 +1,450 @@
+/**
+ * Back up and restore the docs byte surfaces (T13704): the content a project
+ * store backup alone cannot serve `docs fetch` from.
+ *
+ *   - `.cleo/blobs/manifest.db` (blob-store metadata) and
+ *     `.cleo/blobs/blobs/<sha256>` (the bytes);
+ *   - `.cleo/attachments/index.db` and the legacy byte tree under
+ *     `.cleo/attachments/` (`sha256/<2>/<62><ext>`, `keep/...`).
+ *
+ * The two databases are snapshotted per backup with `VACUUM INTO`, checked
+ * with `PRAGMA integrity_check`, and stored as flat `<label>.<backupId>`
+ * payloads beside the store snapshot. The byte files go into ONE shared
+ * content-addressed pool, `.cleo/backups/blobs/<sha256>`, written once and
+ * shared by every backup (T13710: a real store holds ~10k files, so per-backup
+ * copies made rotation delete the backups themselves). Each backup lists what
+ * it references in a `docs-bytes.json.<backupId>` sidecar; rotation removes a
+ * whole backup, sidecar included, and {@link sweepDocsBytePool} then unlinks
+ * only pool files no surviving sidecar references.
+ *
+ * Restore verifies every byte before placing it: each pool file must hash to
+ * its recorded sha256, each database snapshot must match its recorded sha256
+ * and pass `integrity_check` on the staged copy that is then renamed into
+ * place. Anything that fails is listed; a restore with failures is partial,
+ * never clean (T13709).
+ *
+ * Synchronous on purpose: callers hold no async lock across it, and the pool
+ * lock is a {@link withLockSync} lock whose stale age covers a full pass.
+ *
+ * @module store/docs-bytes-backup
+ * @task T13704
+ * @task T13708
+ * @task T13709
+ * @task T13710
+ */
+import { createHash } from 'node:crypto';
+import { copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, unlinkSync, writeFileSync, } from 'node:fs';
+import { dirname, isAbsolute, join } from 'node:path';
+import { z } from 'zod';
+import { getLogger } from '../logger.js';
+import { withLockSync } from './lock.js';
+import { integrityCheck, vacuumSnapshot } from './portable-bundle-scan.js';
+import { storeOpenElsewhere } from './writer-lease.js';
+/** Label of the per-backup sidecar listing the docs bytes it references (`<label>.<backupId>`). */
+export const DOCS_BYTES_SIDECAR_LABEL = 'docs-bytes.json';
+/** The docs databases, snapshotted per backup as `<label>.<backupId>`. Paths relative to `.cleo/`. */
+const DOCS_DBS = [
+    { label: 'blobs.manifest.db', path: 'blobs/manifest.db' },
+    { label: 'attachments.index.db', path: 'attachments/index.db' },
+];
+/** The byte trees pooled by content address. Paths relative to `.cleo/`. */
+const DOCS_BYTE_TREES = ['blobs/blobs', 'attachments'];
+/** SQLite sidecars of a live database: never copied as bytes. */
+const DB_SIDECARS = ['-wal', '-shm', '-journal'];
+/** A full pass over ~10k files blocks for seconds; the pool lock is never taken as stale before this. */
+const POOL_LOCK_STALE_MS = 10 * 60_000;
+const sha256Hex = /^[0-9a-f]{64}$/;
+const sidecarSchema = z.object({
+    version: z.literal(1),
+    dbs: z.array(z.object({ label: z.string(), path: z.string(), sha256: z.string().regex(sha256Hex) })),
+    files: z.array(z.object({ path: z.string(), sha256: z.string().regex(sha256Hex) })),
+});
+/** The shared byte pool of a backup directory (`.cleo/backups/sqlite` -> `.cleo/backups/blobs`). */
+export function docsBytePoolDir(backupDir) {
+    return join(dirname(backupDir), 'blobs');
+}
+function sha256OfFile(path) {
+    return createHash('sha256').update(readFileSync(path)).digest('hex');
+}
+/**
+ * The sha256 a byte file's path claims, or `null` when the path is not
+ * content-addressed: `blobs/blobs/<sha>`, or `attachments/{sha256,keep}/<2>/<62>[.ext]`.
+ */
+function contentAddress(rel) {
+    const parts = rel.split('/');
+    if (parts[0] === 'blobs' && parts.length === 3) {
+        return sha256Hex.test(parts[2] ?? '') ? (parts[2] ?? null) : null;
+    }
+    if (parts[0] !== 'attachments' || parts.length !== 4)
+        return null;
+    if (parts[1] !== 'sha256' && parts[1] !== 'keep')
+        return null;
+    const name = parts[3] ?? '';
+    const stem = name.includes('.') ? name.slice(0, name.lastIndexOf('.')) : name;
+    const sha = `${parts[2]}${stem}`;
+    return sha256Hex.test(sha) ? sha : null;
+}
+/** Every regular file under `dir`, as paths relative to `cleoDir` with `/` separators. */
+function walkFiles(cleoDir, dir, out) {
+    if (!existsSync(dir))
+        return;
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+        const abs = join(dir, entry.name);
+        if (entry.isDirectory())
+            walkFiles(cleoDir, abs, out);
+        else if (entry.isFile())
+            out.push(abs
+                .slice(cleoDir.length + 1)
+                .split('\\')
+                .join('/'));
+    }
+}
+/** Whether `rel` is one of the docs databases or a sidecar of one (snapshotted, never copied raw). */
+function isDocsDbFile(rel) {
+    return DOCS_DBS.some((db) => rel === db.path || DB_SIDECARS.some((suffix) => rel === `${db.path}${suffix}`));
+}
+/** Copy `from` to a private name beside `to`, then rename it into place. */
+function copyAtomic(from, to) {
+    mkdirSync(dirname(to), { recursive: true });
+    const tmp = `${to}.tmp-${process.pid}-${Date.now()}`;
+    try {
+        copyFileSync(from, tmp);
+        renameSync(tmp, to);
+    }
+    finally {
+        rmSync(tmp, { force: true });
+    }
+}
+function withPoolLock(backupDir, fn) {
+    const pool = docsBytePoolDir(backupDir);
+    mkdirSync(pool, { recursive: true });
+    return withLockSync(pool, fn, {
+        waitMs: 60_000,
+        stale: POOL_LOCK_STALE_MS,
+        label: 'the backup blob pool',
+    });
+}
+/**
+ * Snapshot the docs byte surfaces of `cleoDir` into backup `backupId` (T13704):
+ * VACUUM INTO + integrity_check for each docs database, every byte file into
+ * the shared pool (written once), and the `docs-bytes.json.<backupId>`
+ * sidecar listing what the backup references. Best effort per file: what
+ * fails is reported in `skipped`, never silently dropped.
+ *
+ * @param cleoDir - The project's `.cleo/` directory.
+ * @param backupDir - `.cleo/backups/sqlite`.
+ * @param backupId - The backup the snapshot belongs to.
+ * @returns What was captured, or `null` when there are no docs byte surfaces.
+ */
+export function backupDocsBytes(cleoDir, backupDir, backupId) {
+    if (!existsSync(join(cleoDir, 'blobs')) && !existsSync(join(cleoDir, 'attachments')))
+        return null;
+    return withPoolLock(backupDir, () => {
+        const pool = docsBytePoolDir(backupDir);
+        const skipped = [];
+        const sidecar = { version: 1, dbs: [], files: [] };
+        for (const db of DOCS_DBS) {
+            const src = join(cleoDir, db.path);
+            if (!existsSync(src))
+                continue;
+            const dest = join(backupDir, `${db.label}.${backupId}`);
+            const tmp = `${dest}.tmp`;
+            try {
+                rmSync(tmp, { force: true });
+                vacuumSnapshot(src, tmp);
+                const integrity = integrityCheck(tmp);
+                // @sync-invariant none:local-only caught below and listed; a local backup/restore file, no synced row
+                if (integrity !== 'ok')
+                    throw new Error(`integrity_check: ${integrity}`);
+                const sha256 = sha256OfFile(tmp);
+                renameSync(tmp, dest);
+                sidecar.dbs.push({ label: db.label, path: db.path, sha256 });
+            }
+            catch (err) {
+                rmSync(tmp, { force: true });
+                skipped.push(`${db.path}: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        }
+        const files = [];
+        for (const tree of DOCS_BYTE_TREES)
+            walkFiles(cleoDir, join(cleoDir, tree), files);
+        let pooled = 0;
+        for (const rel of files) {
+            if (isDocsDbFile(rel))
+                continue;
+            try {
+                // A content-addressed name already in the pool was verified when it
+                // was written: reference it without reading the live file again.
+                const claimed = contentAddress(rel);
+                if (claimed !== null && existsSync(join(pool, claimed))) {
+                    sidecar.files.push({ path: rel, sha256: claimed });
+                    continue;
+                }
+                const abs = join(cleoDir, rel);
+                const sha256 = sha256OfFile(abs);
+                if (!existsSync(join(pool, sha256))) {
+                    copyAtomic(abs, join(pool, sha256));
+                    pooled++;
+                }
+                sidecar.files.push({ path: rel, sha256 });
+            }
+            catch (err) {
+                skipped.push(`${rel}: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        }
+        if (sidecar.dbs.length === 0 && sidecar.files.length === 0 && skipped.length === 0)
+            return null;
+        const dest = join(backupDir, `${DOCS_BYTES_SIDECAR_LABEL}.${backupId}`);
+        const tmp = `${dest}.tmp`;
+        writeFileSync(tmp, JSON.stringify(sidecar));
+        renameSync(tmp, dest);
+        if (skipped.length > 0) {
+            getLogger('backup').warn({ backupId, skipped }, 'docs byte surfaces partly captured');
+        }
+        return {
+            dbs: sidecar.dbs.map((d) => d.label),
+            files: sidecar.files.length,
+            pooled,
+            skipped,
+        };
+    });
+}
+/**
+ * Unlink every pool file that no `docs-bytes.json.<backupId>` sidecar left in
+ * `backupDir` references (T13710); run after rotation. When any sidecar
+ * cannot be read, what it references is unknown, so nothing is removed.
+ *
+ * @param backupDir - `.cleo/backups/sqlite`.
+ * @returns The pool files removed.
+ */
+export function sweepDocsBytePool(backupDir) {
+    const pool = docsBytePoolDir(backupDir);
+    if (!existsSync(pool))
+        return [];
+    return withPoolLock(backupDir, () => {
+        const referenced = new Set();
+        for (const name of readdirSync(backupDir)) {
+            if (!name.startsWith(`${DOCS_BYTES_SIDECAR_LABEL}.`) || name.endsWith('.tmp'))
+                continue;
+            const sidecar = readSidecarFile(join(backupDir, name));
+            if (sidecar === null) {
+                getLogger('backup').warn({ sidecar: name }, 'unreadable docs-bytes sidecar: pool kept');
+                return [];
+            }
+            for (const f of sidecar.files)
+                referenced.add(f.sha256);
+        }
+        const removed = [];
+        for (const name of readdirSync(pool)) {
+            if (referenced.has(name) || !sha256Hex.test(name))
+                continue;
+            try {
+                unlinkSync(join(pool, name));
+                removed.push(name);
+            }
+            catch {
+                // non-fatal: an unreferenced pool file only costs space
+            }
+        }
+        return removed;
+    });
+}
+function readSidecarFile(path) {
+    try {
+        const parsed = sidecarSchema.safeParse(JSON.parse(readFileSync(path, 'utf-8')));
+        return parsed.success ? parsed.data : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Whether backup `backupId` carries docs byte surfaces (a `docs-bytes.json` sidecar).
+ *
+ * @param backupDir - `.cleo/backups/sqlite`.
+ * @param backupId - The backup.
+ */
+export function hasDocsBytes(backupDir, backupId) {
+    return existsSync(join(backupDir, `${DOCS_BYTES_SIDECAR_LABEL}.${backupId}`));
+}
+/**
+ * The live docs databases another connection holds open (a restore over
+ * them would be lost to that connection's writes).
+ *
+ * @param cleoDir - The project's `.cleo/` directory.
+ * @returns Absolute paths of the busy databases.
+ */
+export function docsDbsOpenElsewhere(cleoDir) {
+    return DOCS_DBS.map((db) => join(cleoDir, db.path)).filter((p) => storeOpenElsewhere(p));
+}
+/**
+ * Restore the docs byte surfaces of backup `backupId` into `cleoDir`, placing
+ * only verified bytes (T13708, T13709). Each database snapshot must match its
+ * recorded sha256 and pass `integrity_check` on the staged copy, and its live
+ * file must not be open elsewhere; each pool file must hash to its recorded
+ * sha256. Failures are listed in `failed`, and `complete` is `false` when
+ * there are any.
+ *
+ * @param cleoDir - The project's `.cleo/` directory.
+ * @param backupDir - `.cleo/backups/sqlite`.
+ * @param backupId - The backup to restore from.
+ * @returns What was placed and what failed, or `null` when the backup holds no docs bytes.
+ */
+export function restoreDocsBytes(cleoDir, backupDir, backupId) {
+    const sidecarPath = join(backupDir, `${DOCS_BYTES_SIDECAR_LABEL}.${backupId}`);
+    if (!existsSync(sidecarPath))
+        return null;
+    const sidecar = readSidecarFile(sidecarPath);
+    if (sidecar === null) {
+        return {
+            complete: false,
+            dbsRestored: [],
+            filesRestored: 0,
+            failed: [`${DOCS_BYTES_SIDECAR_LABEL}.${backupId}: unreadable sidecar`],
+        };
+    }
+    const dbsRestored = [];
+    const failed = [];
+    for (const db of sidecar.dbs) {
+        // The sidecar is data read from disk: a db entry must name a known docs
+        // database exactly, or it could replace cleo.db or escape `.cleo/`.
+        if (!DOCS_DBS.some((known) => known.label === db.label && known.path === db.path)) {
+            failed.push(`${db.path}: not a docs database (${db.label})`);
+            continue;
+        }
+        const dest = join(cleoDir, db.path);
+        const staged = `${dest}.restore-${process.pid}-${Date.now()}`;
+        try {
+            const from = join(backupDir, `${db.label}.${backupId}`);
+            // @sync-invariant none:local-only caught below and listed; a local backup/restore file, no synced row
+            if (!existsSync(from))
+                throw new Error('snapshot missing from the backup');
+            mkdirSync(dirname(dest), { recursive: true });
+            copyFileSync(from, staged);
+            // @sync-invariant none:local-only caught below and listed; a local backup/restore file, no synced row
+            if (sha256OfFile(staged) !== db.sha256)
+                throw new Error('sha256 mismatch');
+            const integrity = integrityCheck(staged);
+            // @sync-invariant none:local-only caught below and listed; a local backup/restore file, no synced row
+            if (integrity !== 'ok')
+                throw new Error(`integrity_check: ${integrity}`);
+            // @sync-invariant none:local-only caught below and listed; a local backup/restore file, no synced row
+            if (storeOpenElsewhere(dest))
+                throw new Error('open in another process');
+            for (const suffix of DB_SIDECARS)
+                rmSync(`${dest}${suffix}`, { force: true });
+            renameSync(staged, dest);
+            dbsRestored.push(db.path);
+        }
+        catch (err) {
+            failed.push(`${db.path}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        finally {
+            for (const p of [staged, ...DB_SIDECARS.map((s) => `${staged}${s}`)]) {
+                rmSync(p, { force: true });
+            }
+        }
+    }
+    const pool = docsBytePoolDir(backupDir);
+    let filesRestored = 0;
+    for (const file of sidecar.files) {
+        // The sidecar is data read from disk: place bytes only inside the two trees.
+        const inTree = (file.path.startsWith('blobs/blobs/') || file.path.startsWith('attachments/')) &&
+            !file.path.includes('\\') &&
+            !isAbsolute(file.path) &&
+            !file.path.split('/').includes('..') &&
+            !isDocsDbFile(file.path);
+        if (!inTree) {
+            failed.push(`${file.path}: not a docs byte path`);
+            continue;
+        }
+        const dest = join(cleoDir, file.path);
+        const staged = `${dest}.restore-${process.pid}-${Date.now()}`;
+        try {
+            const from = join(pool, file.sha256);
+            // @sync-invariant none:local-only caught below and listed; a local backup/restore file, no synced row
+            if (!existsSync(from))
+                throw new Error('missing from the backup pool');
+            mkdirSync(dirname(dest), { recursive: true });
+            copyFileSync(from, staged);
+            // @sync-invariant none:local-only caught below and listed; a local backup/restore file, no synced row
+            if (sha256OfFile(staged) !== file.sha256)
+                throw new Error('sha256 mismatch');
+            renameSync(staged, dest);
+            filesRestored++;
+        }
+        catch (err) {
+            failed.push(`${file.path}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        finally {
+            rmSync(staged, { force: true });
+        }
+    }
+    return { complete: failed.length === 0, dbsRestored, filesRestored, failed };
+}
+/**
+ * Labels of the docs databases that exist live under `cleoDir`: a safety
+ * copy of them must hold each of these before anything replaces them.
+ *
+ * @param cleoDir - The project's `.cleo/` directory.
+ * @returns The live database labels (`blobs.manifest.db`, `attachments.index.db`).
+ */
+export function liveDocsDbLabels(cleoDir) {
+    return DOCS_DBS.filter((db) => existsSync(join(cleoDir, db.path))).map((db) => db.label);
+}
+const metaSchema = z.object({
+    docsBytes: z
+        .object({
+        dbs: z.array(z.string()).optional(),
+        files: z.number().optional(),
+        skipped: z.array(z.string()).optional(),
+        error: z.string().optional(),
+    })
+        .optional(),
+});
+/**
+ * Where backup `backupId` falls short of the docs capture its
+ * `<backupId>.meta.json` records (T13709): a capture that failed or skipped
+ * files, or a `docs-bytes.json` sidecar that is missing or lists fewer
+ * databases or files than recorded. A backup whose meta records no docs
+ * capture (older builds) yields nothing.
+ *
+ * @param backupDir - `.cleo/backups/sqlite`.
+ * @param backupId - The backup.
+ * @returns One warning per shortfall.
+ */
+export function docsBytesMetaWarnings(backupDir, backupId) {
+    let meta;
+    try {
+        const parsed = metaSchema.safeParse(JSON.parse(readFileSync(join(backupDir, `${backupId}.meta.json`), 'utf-8')));
+        meta = parsed.success ? parsed.data.docsBytes : undefined;
+    }
+    catch {
+        return [];
+    }
+    if (meta === undefined)
+        return [];
+    const warnings = [];
+    if (meta.error !== undefined)
+        warnings.push(`docs bytes were not captured: ${meta.error}`);
+    for (const s of meta.skipped ?? [])
+        warnings.push(`docs bytes were not captured: ${s}`);
+    const recorded = (meta.dbs?.length ?? 0) + (meta.files ?? 0);
+    if (recorded === 0)
+        return warnings;
+    const sidecarPath = join(backupDir, `${DOCS_BYTES_SIDECAR_LABEL}.${backupId}`);
+    if (!existsSync(sidecarPath)) {
+        warnings.push(`${DOCS_BYTES_SIDECAR_LABEL}.${backupId} is missing (the backup recorded docs bytes)`);
+        return warnings;
+    }
+    const sidecar = readSidecarFile(sidecarPath);
+    // An unreadable sidecar is reported by restoreDocsBytes.
+    if (sidecar === null)
+        return warnings;
+    const missingDbs = (meta.dbs ?? []).filter((l) => !sidecar.dbs.some((d) => d.label === l));
+    if (missingDbs.length > 0 || sidecar.files.length < (meta.files ?? 0)) {
+        warnings.push(`${DOCS_BYTES_SIDECAR_LABEL}.${backupId} is incomplete: ${sidecar.files.length}/${meta.files ?? 0} files${missingDbs.length > 0 ? `, missing ${missingDbs.join(', ')}` : ''}`);
+    }
+    return warnings;
+}
+//# sourceMappingURL=docs-bytes-backup.js.map

package/dist/store/docs-bytes-backup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docs-bytes-backup.js","sourceRoot":"","sources":["../../src/store/docs-bytes-backup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,YAAY,EACZ,UAAU,EACV,SAAS,EACT,WAAW,EACX,YAAY,EACZ,UAAU,EACV,MAAM,EACN,UAAU,EACV,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD,mGAAmG;AACnG,MAAM,CAAC,MAAM,wBAAwB,GAAG,iBAAiB,CAAC;AAE1D,sGAAsG;AACtG,MAAM,QAAQ,GAAG;IACf,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE;IACzD,EAAE,KAAK,EAAE,sBAAsB,EAAE,IAAI,EAAE,sBAAsB,EAAE;CACvD,CAAC;AAEX,4EAA4E;AAC5E,MAAM,eAAe,GAAG,CAAC,aAAa,EAAE,aAAa,CAAU,CAAC;AAEhE,iEAAiE;AACjE,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAU,CAAC;AAE1D,yGAAyG;AACzG,MAAM,kBAAkB,GAAG,EAAE,GAAG,MAAM,CAAC;AAEvC,MAAM,SAAS,GAAG,gBAAgB,CAAC;AAEnC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,GAAG,EAAE,CAAC,CAAC,KAAK,CACV,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CACvF;IACD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;CACpF,CAAC,CAAC;AAiBH,oGAAoG;AACpG,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACvE,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/C,OAAO,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,CAAC;IACD,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,aAAa,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClE,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAC9D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9E,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC;IACjC,OAAO,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1C,CAAC;AAED,0FAA0F;AAC1F,SAAS,SAAS,CAAC,OAAe,EAAE,GAAW,EAAE,GAAa;IAC5D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO;IAC7B,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,KAAK,CAAC,WAAW,EAAE;YAAE,SAAS,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;aACjD,IAAI,KAAK,CAAC,MAAM,EAAE;YACrB,GAAG,CAAC,IAAI,CACN,GAAG;iBACA,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;iBACzB,KAAK,CAAC,IAAI,CAAC;iBACX,IAAI,CAAC,GAAG,CAAC,CACb,CAAC;IACN,CAAC;AACH,CAAC;AAED,sGAAsG;AACtG,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,QAAQ,CAAC,IAAI,CAClB,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC,IAAI,GAAG,MAAM,EAAE,CAAC,CACvF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,SAAS,UAAU,CAAC,IAAY,EAAE,EAAU;IAC1C,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,GAAG,EAAE,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IACrD,IAAI,CAAC;QACH,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACxB,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACtB,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAI,SAAiB,EAAE,EAAW;IACrD,MAAM,IAAI,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IACxC,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrC,OAAO,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE;QAC5B,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,kBAAkB;QACzB,KAAK,EAAE,sBAAsB;KAC9B,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAe,EACf,SAAiB,EACjB,QAAgB;IAEhB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAClG,OAAO,YAAY,CAAC,SAAS,EAAE,GAAG,EAAE;QAClC,MAAM,IAAI,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAqB,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QAErE,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,IAAI,QAAQ,EAAE,CAAC,CAAC;YACxD,MAAM,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC7B,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACzB,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;gBACtC,sGAAsG;gBACtG,IAAI,SAAS,KAAK,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,SAAS,EAAE,CAAC,CAAC;gBACzE,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;gBACjC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACtB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC/D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC7B,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClF,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,IAAI,IAAI,eAAe;YAAE,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;QACnF,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;YACxB,IAAI,YAAY,CAAC,GAAG,CAAC;gBAAE,SAAS;YAChC,IAAI,CAAC;gBACH,oEAAoE;gBACpE,iEAAiE;gBACjE,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;gBACpC,IAAI,OAAO,KAAK,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;oBACxD,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;oBACnD,SAAS;gBACX,CAAC;gBACD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;gBAC/B,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;gBACjC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;oBACpC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;oBACpC,MAAM,EAAE,CAAC;gBACX,CAAC;gBACD,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAChG,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,wBAAwB,IAAI,QAAQ,EAAE,CAAC,CAAC;QACxE,MAAM,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC;QAC1B,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5C,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACtB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,SAAS,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,oCAAoC,CAAC,CAAC;QACxF,CAAC;QACD,OAAO;YACL,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;YACpC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;YAC3B,MAAM;YACN,OAAO;SACR,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IACjD,MAAM,IAAI,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,OAAO,YAAY,CAAC,SAAS,EAAE,GAAG,EAAE;QAClC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QACrC,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,wBAAwB,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,SAAS;YACxF,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;YACvD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,SAAS,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,0CAA0C,CAAC,CAAC;gBACxF,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,KAAK;gBAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC5D,IAAI,CAAC;gBACH,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;gBAC7B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,wDAAwD;YAC1D,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAChF,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB,EAAE,QAAgB;IAC9D,OAAO,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,wBAAwB,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC;AAChF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAe,EACf,SAAiB,EACjB,QAAgB;IAEhB,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,wBAAwB,IAAI,QAAQ,EAAE,CAAC,CAAC;IAC/E,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,OAAO,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,EAAE;YACf,aAAa,EAAE,CAAC;YAChB,MAAM,EAAE,CAAC,GAAG,wBAAwB,IAAI,QAAQ,sBAAsB,CAAC;SACxE,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,KAAK,MAAM,EAAE,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAC7B,wEAAwE;QACxE,oEAAoE;QACpE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAClF,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,0BAA0B,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC;YAC7D,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,GAAG,IAAI,YAAY,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC9D,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,IAAI,QAAQ,EAAE,CAAC,CAAC;YACxD,sGAAsG;YACtG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YAC3E,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9C,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC3B,sGAAsG;YACtG,IAAI,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;YAC3E,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;YACzC,sGAAsG;YACtG,IAAI,SAAS,KAAK,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,SAAS,EAAE,CAAC,CAAC;YACzE,sGAAsG;YACtG,IAAI,kBAAkB,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YACzE,KAAK,MAAM,MAAM,IAAI,WAAW;gBAAE,MAAM,CAAC,GAAG,IAAI,GAAG,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9E,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACzB,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjF,CAAC;gBAAS,CAAC;YACT,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBACrE,MAAM,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACjC,6EAA6E;QAC7E,MAAM,MAAM,GACV,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;YAC9E,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YACzB,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YACtB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;YACpC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,wBAAwB,CAAC,CAAC;YAClD,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,GAAG,IAAI,YAAY,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC9D,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACrC,sGAAsG;YACtG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YACvE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9C,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC3B,sGAAsG;YACtG,IAAI,YAAY,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;YAC7E,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACzB,aAAa,EAAE,CAAC;QAClB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnF,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;AAC/E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;AAC3F,CAAC;AAcD,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,SAAS,EAAE,CAAC;SACT,MAAM,CAAC;QACN,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC5B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QACvC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC7B,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAiB,EAAE,QAAgB;IACvE,IAAI,IAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CACjC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,QAAQ,YAAY,CAAC,EAAE,OAAO,CAAC,CAAC,CAC5E,CAAC;QACF,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;QAAE,QAAQ,CAAC,IAAI,CAAC,iCAAiC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAC3F,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,iCAAiC,CAAC,EAAE,CAAC,CAAC;IACxF,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;IAC7D,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACpC,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,wBAAwB,IAAI,QAAQ,EAAE,CAAC,CAAC;IAC/E,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CACX,GAAG,wBAAwB,IAAI,QAAQ,8CAA8C,CACtF,CAAC;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC7C,yDAAyD;IACzD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IACtC,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC;QACtE,QAAQ,CAAC,IAAI,CACX,GAAG,wBAAwB,IAAI,QAAQ,mBAAmB,OAAO,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAC9K,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/store/llm-accounts-accessor.d.ts

@@ -0,0 +1,107 @@
+/**
+ * LLM credential pool accessor — the encrypting writer and reader of the
+ * global `accounts` table (T13715 · T13528).
+ *
+ * `cleo llm add` and every other pool writer store credentials here, so the
+ * pool syncs on the home stream: the secret columns hold {@link encryptGlobal}
+ * ciphertext under `account:<provider>:<label>` ({@link llmAccountSecretId}),
+ * the id the sync sealer (`cloud/secret-seal.ts`) decrypts, seals and
+ * re-encrypts under the receiving machine's key. No plaintext secret is ever
+ * written to the store, the same way `service-connections-accessor.ts`
+ * stores service credentials.
+ *
+ * Writes go through {@link openDualScopeDb}`('global')` (migrated, captured).
+ * Reads are synchronous — the LLM resolver (`resolveCredentials`) cannot
+ * await — so they open the global `cleo.db` read-only and decrypt with
+ * {@link decryptGlobalSync}. A missing store or table reads as empty.
+ *
+ * The non-secret fields of a {@link StoredCredential} without a column of
+ * their own (`baseUrl`, `extraHeaders`, `metadata`, `disabled`, `lastStatus`)
+ * live in the row's `metadata` JSON.
+ *
+ * @module store/llm-accounts-accessor
+ * @task T13715
+ * @task T13528
+ */
+import { type StoredCredential } from '../llm/credentials-store.js';
+/**
+ * Where the pool lives. Both fields default to the ambient global store.
+ *
+ * @task T13715
+ */
+export interface LlmAccountsOptions {
+    /** CLEO home whose machine key encrypts the secrets. */
+    readonly cleoHome?: string;
+    /** Global `cleo.db` to use instead of `<cleoHome>/cleo.db` (a restore target or a test store). */
+    readonly dbPath?: string;
+}
+/**
+ * One `accounts` row as stored: secrets still encrypted.
+ *
+ * @task T13715
+ */
+export type LlmAccountRow = {
+    readonly provider: string;
+    readonly label: string;
+    readonly auth_type: string;
+    readonly secret_enc: string | null;
+    readonly refresh_enc: string | null;
+    readonly expires_at: string | null;
+    readonly priority: number;
+    readonly source: string | null;
+    readonly last_error_code: string | null;
+    readonly cooldown_reset_at: string | null;
+    readonly request_count: number;
+    readonly metadata: string;
+};
+/**
+ * The {@link encryptGlobal} id of a pool credential's secret columns. The sync
+ * sealer derives the same id from the row's natural key.
+ *
+ * @param provider - The credential's provider.
+ * @param label - Its label.
+ * @returns `account:<provider>:<label>`.
+ * @task T13715
+ */
+export declare function llmAccountSecretId(provider: string, label: string): string;
+/**
+ * List the pool's rows, still encrypted, ordered by provider and label. A
+ * missing store, or one not yet migrated to carry `accounts`, holds none.
+ *
+ * @param opts - Which store.
+ * @returns The rows.
+ * @task T13715
+ */
+export declare function listLlmAccountRowsSync(opts?: LlmAccountsOptions): LlmAccountRow[];
+/**
+ * Decrypt one row into a {@link StoredCredential}.
+ *
+ * @param row - The row.
+ * @param opts - Whose machine key decrypts it.
+ * @returns The credential, or `null` for a row without a secret (redacted by an
+ *   unencrypted backup) or with an unknown provider or auth type.
+ * @throws When this machine's key cannot decrypt the secret.
+ * @task T13715
+ */
+export declare function llmAccountToCredentialSync(row: LlmAccountRow, opts?: LlmAccountsOptions): StoredCredential | null;
+/**
+ * Upsert a credential into the pool, encrypting its secrets under this
+ * machine's key. The `(provider, label)` pair is the key.
+ *
+ * @param credential - The credential.
+ * @param opts - Which store and machine key.
+ * @task T13715
+ * @sync-invariant none:input-shape reads only its own row, by the (provider, label) natural key, to keep an unchanged ciphertext; no other row is read or written
+ */
+export declare function upsertLlmAccount(credential: StoredCredential, opts?: LlmAccountsOptions): Promise<void>;
+/**
+ * Delete a credential from the pool.
+ *
+ * @param provider - Its provider.
+ * @param label - Its label.
+ * @param opts - Which store.
+ * @returns Whether a row was deleted.
+ * @task T13715
+ */
+export declare function deleteLlmAccount(provider: string, label: string, opts?: LlmAccountsOptions): Promise<boolean>;
+//# sourceMappingURL=llm-accounts-accessor.d.ts.map

package/dist/store/llm-accounts-accessor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"llm-accounts-accessor.d.ts","sourceRoot":"","sources":["../../src/store/llm-accounts-accessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAOH,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,6BAA6B,CAAC;AAMrC;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,kGAAkG;IAClG,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;AAWF;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1E;AAOD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,GAAE,kBAAuB,GAAG,aAAa,EAAE,CAwBrF;AAmBD;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,aAAa,EAClB,IAAI,GAAE,kBAAuB,GAC5B,gBAAgB,GAAG,IAAI,CA2BzB;AA8BD;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,gBAAgB,EAC5B,IAAI,GAAE,kBAAuB,GAC5B,OAAO,CAAC,IAAI,CAAC,CA2Cf;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,kBAAuB,GAC5B,OAAO,CAAC,OAAO,CAAC,CASlB"}