@hsuite/smart-engines-cli 1.2.1 → 1.4.0

package/dist/_lib/frontend-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontend-guard.d.ts","sourceRoot":"","sources":["../../src/_lib/frontend-guard.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBxE"}

package/dist/_lib/frontend-guard.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertNoDeploySentinels = assertNoDeploySentinels;
+const fs_1 = require("fs");
+const path_1 = require("path");
+/**
+ * Fail-closed guard shared by `deploy` and `redeploy`: refuse to ship a
+ * frontend build that still carries unfilled `REPLACE_BEFORE_DEPLOY:<key>`
+ * placeholders (per-deployment config that was never set).
+ *
+ * Such a build refuses to bootstrap in the browser (the SPA's `main.ts` asserts
+ * on the sentinel prefix), and the CLI would otherwise tar+upload it silently —
+ * which is exactly how a non-bootstrapping bundle reached production. Matches
+ * the sentinel VALUE form (`:` followed by a letter) so it does NOT
+ * false-positive on the guard's own comparison literal (`REPLACE_BEFORE_DEPLOY:"`).
+ */
+async function assertNoDeploySentinels(dir) {
+    const SENTINEL = /REPLACE_BEFORE_DEPLOY:[A-Za-z]/;
+    const TEXT_EXT = /\.(js|mjs|cjs|html|css|json|txt|map|webmanifest)$/i;
+    const hits = [];
+    const walk = async (d) => {
+        for (const ent of await fs_1.promises.readdir(d, { withFileTypes: true })) {
+            const p = (0, path_1.join)(d, ent.name);
+            if (ent.isDirectory())
+                await walk(p);
+            else if (TEXT_EXT.test(ent.name)) {
+                const m = (await fs_1.promises.readFile(p, 'utf8')).match(SENTINEL);
+                if (m)
+                    hits.push(`${(0, path_1.relative)(dir, p)} (${m[0]}…)`);
+            }
+        }
+    };
+    await walk(dir);
+    if (hits.length) {
+        throw new Error(`frontend still contains REPLACE_BEFORE_DEPLOY placeholders — fill your ` +
+            `per-deployment config (e.g. environment.prod.ts) and rebuild before deploying. ` +
+            `Offending: ${hits.slice(0, 5).join(', ')}` +
+            (hits.length > 5 ? `, +${hits.length - 5} more` : ''));
+    }
+}
+//# sourceMappingURL=frontend-guard.js.map

package/dist/_lib/frontend-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontend-guard.js","sourceRoot":"","sources":["../../src/_lib/frontend-guard.ts"],"names":[],"mappings":";;AAcA,0DAuBC;AArCD,2BAAoC;AACpC,+BAAsC;AAEtC;;;;;;;;;;GAUG;AACI,KAAK,UAAU,uBAAuB,CAAC,GAAW;IACvD,MAAM,QAAQ,GAAG,gCAAgC,CAAC;IAClD,MAAM,QAAQ,GAAG,oDAAoD,CAAC;IACtE,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,KAAK,EAAE,CAAS,EAAiB,EAAE;QAC9C,KAAK,MAAM,GAAG,IAAI,MAAM,aAAE,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/D,MAAM,CAAC,GAAG,IAAA,WAAI,EAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,GAAG,CAAC,WAAW,EAAE;gBAAE,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC;iBAChC,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjC,MAAM,CAAC,GAAG,CAAC,MAAM,aAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACzD,IAAI,CAAC;oBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,IAAA,eAAQ,EAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;IAChB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,yEAAyE;YACvE,iFAAiF;YACjF,cAAc,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAC3C,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CACxD,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/_lib/registry-fanout.d.ts

@@ -0,0 +1,114 @@
+import { Buffer } from 'buffer';
+/** A request against one cluster's Harbor Registry-v2 API. `path` is always `/v2/...` (or `/token...`). */
+export type RegistryRequest = {
+    ip: string;
+    method: 'GET' | 'HEAD' | 'POST' | 'PUT' | 'PATCH';
+    path: string;
+    headers?: Record<string, string>;
+    body?: Buffer;
+};
+/** A Registry-v2 response. Header keys are lower-cased by the default transport. */
+export type RegistryResponse = {
+    status: number;
+    headers: Record<string, string>;
+    body: Buffer;
+};
+/**
+ * The injectable network seam. The default implementation
+ * ({@link defaultTransport}) dials `req.ip:443` with TLS `servername` =
+ * the federated host and an added `Host` header = the federated host, with
+ * verification ON. Tests inject a fake — no real network.
+ */
+export type RegistryTransport = (req: RegistryRequest) => Promise<RegistryResponse>;
+/** A fan-out target — just the cluster-ingress IP. (Kept as a type for call-site clarity.) */
+export type FanOutTarget = {
+    ip: string;
+};
+/** Per-endpoint outcome of {@link ensureImageOnClusters}. */
+export type FanOutReport = {
+    targets: Array<{
+        ip: string;
+        outcome: 'present' | 'copied' | 'failed';
+        error?: string;
+    }>;
+};
+export type EnsureImageOpts = {
+    host: string;
+    repository: string;
+    tag: string;
+    /** The `sha256:<64hex>` manifest digest the push produced — the SSoT for present/verify. */
+    digest: string;
+    username: string;
+    password: string;
+    /** Cluster-ingress IPs (e.g. from {@link resolveClusterEndpoints}). */
+    endpoints: string[];
+    /** Test seam — defaults to {@link defaultTransport} bound to `host`. */
+    transport?: RegistryTransport;
+};
+/** A parsed `WWW-Authenticate: Bearer ...` token challenge. `realm` is mandatory. */
+export type AuthChallenge = {
+    realm: string;
+    service?: string;
+    scope?: string;
+};
+/**
+ * Parse a `Bearer realm="...",service="...",scope="..."` challenge. Pure.
+ *
+ * Returns `null` for a non-Bearer scheme or a Bearer challenge missing the
+ * mandatory `realm` (without a realm there is nowhere to fetch a token from).
+ */
+export declare function parseAuthChallenge(wwwAuthenticate: string): AuthChallenge | null;
+/**
+ * DNS-resolve the federated host's A-records into the de-duplicated, sorted list
+ * of cluster-ingress IPs to fan out across. Injectable `resolve4` for tests;
+ * defaults to `dns.promises.resolve4`.
+ */
+export declare function resolveClusterEndpoints(host: string, resolve4?: (h: string) => Promise<string[]>): Promise<string[]>;
+/**
+ * Real {@link RegistryTransport}: HTTPS to `req.ip:443` with TLS SNI + HTTP
+ * `Host` pinned to `host`, verification ON. All registry paths are `/v2/...`;
+ * absolute token-realm URLs are handled by {@link fetchAbsolute}.
+ */
+export declare function defaultTransport(host: string): RegistryTransport;
+/**
+ * Fan out an already-pushed image to every cluster Harbor and prove it landed
+ * on all of them. See the module header for the full algorithm. Throws if no
+ * endpoint serves the digest to copy from, or if re-verification finds any
+ * endpoint not serving the pushed digest (the error names the failed IPs).
+ */
+export declare function ensureImageOnClusters(opts: EnsureImageOpts): Promise<FanOutReport>;
+/** Registry coordinates a push produced (shape of `BaasInitResponse.registry`). */
+export type FanOutRegistry = {
+    server: string;
+    username: string;
+    password: string;
+    repository: string;
+};
+export type FanOutPushedImageOpts = {
+    registry: FanOutRegistry;
+    tag: string;
+    /** The `sha256:<64hex>` digest the push produced. */
+    digest: string;
+    /** Test seam — DNS A-record resolver (defaults to `dns.promises.resolve4`). */
+    resolve4?: (h: string) => Promise<string[]>;
+    /** Test seam — the registry transport. */
+    transport?: RegistryTransport;
+    /** Optional progress log sink (defaults to no-op). */
+    log?: (msg: string) => void;
+};
+/**
+ * The deploy-time entrypoint: take an image just pushed to the federated host
+ * (landed on ONE cluster) and guarantee it is present on EVERY cluster Harbor.
+ *
+ * Resolves the registry host's A-records into the cluster-ingress set, then:
+ *   - 0/1 endpoint (a non-federated or local/dev registry, or DNS that doesn't
+ *     fan out) → nothing to distribute; returns `null`.
+ *   - ≥2 endpoints → {@link ensureImageOnClusters}, which copies + re-verifies
+ *     and THROWS if any cluster ends up not serving the pushed digest.
+ *
+ * A DNS resolution failure is treated as "single-target" (logged, returns
+ * `null`) rather than fatal: a real federated push has already proven the host
+ * resolves, so a failure here means a dev/local registry where fan-out is moot.
+ */
+export declare function fanOutPushedImage(opts: FanOutPushedImageOpts): Promise<FanOutReport | null>;
+//# sourceMappingURL=registry-fanout.d.ts.map

package/dist/_lib/registry-fanout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-fanout.d.ts","sourceRoot":"","sources":["../../src/_lib/registry-fanout.ts"],"names":[],"mappings":"AA8CA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAkBhC,2GAA2G;AAC3G,MAAM,MAAM,eAAe,GAAG;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,CAAC;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,oFAAoF;AACpF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAEpF,8FAA8F;AAC9F,MAAM,MAAM,YAAY,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1C,6DAA6D;AAC7D,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC1F,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,4FAA4F;IAC5F,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,wEAAwE;IACxE,SAAS,CAAC,EAAE,iBAAiB,CAAC;CAC/B,CAAC;AAEF,qFAAqF;AACrF,MAAM,MAAM,aAAa,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhF;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,eAAe,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAgBhF;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,MAAM,EACZ,QAAQ,GAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAA0B,GAClE,OAAO,CAAC,MAAM,EAAE,CAAC,CAGnB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,CA6BhE;AAwHD;;;;;GAKG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC,CA8FxF;AA8ED,mFAAmF;AACnF,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,cAAc,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5C,0CAA0C;IAC1C,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,sDAAsD;IACtD,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CA+B9B"}

package/dist/_lib/registry-fanout.js

@@ -0,0 +1,435 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseAuthChallenge = parseAuthChallenge;
+exports.resolveClusterEndpoints = resolveClusterEndpoints;
+exports.defaultTransport = defaultTransport;
+exports.ensureImageOnClusters = ensureImageOnClusters;
+exports.fanOutPushedImage = fanOutPushedImage;
+/**
+ * Synchronous Registry-v2 fan-out: copy one already-pushed image to EVERY
+ * federated Harbor cluster, then prove it landed on all of them.
+ *
+ * ## Why this exists
+ *
+ * `harbor.testnet.hsuite.network` is public-DNS round-robin over the 3
+ * cluster-ingress IPs, and each IP fronts its OWN independent Harbor instance.
+ * A single `docker push` (via {@link import('./baas').buildAndPush}) therefore
+ * lands the image on exactly ONE cluster — whichever IP the OS resolver picked
+ * that second. The Harbor cross-cluster replication mesh is unreliable, so we do
+ * the fan-out ourselves, at the Registry-v2 API level, and BLOCK the deploy
+ * until every cluster serves the exact pushed digest.
+ *
+ * ## How the fan-out works
+ *
+ * We talk to each cluster by its IP while pinning TLS SNI + the HTTP `Host`
+ * header to the federated hostname ({@link defaultTransport}) — the cert and the
+ * Harbor vhost are keyed on that name, the IP is just the dial target. The
+ * push-robot credential is BLS-deterministic and identical on all 3 Harbors, so
+ * one credential authenticates against every IP.
+ *
+ * 1. HEAD the tag on each IP; an IP whose `Docker-Content-Digest` equals the
+ *    pushed digest is already `present`.
+ * 2. At least one IP MUST be present (the federated push landed somewhere); pick
+ *    it as the copy SOURCE.
+ * 3. To each non-present IP, copy: pull the source manifest (exact bytes +
+ *    content-type), and for the config blob + every layer blob, HEAD it on the
+ *    dest and — only if absent — monolithically PUT it (start an upload session,
+ *    fetch the blob from source, PUT to the session `Location` with `?digest=`).
+ *    Then PUT the manifest with the source's exact bytes + content-type.
+ * 4. RE-VERIFY by HEADing the tag on EVERY IP. If any IP's served digest still
+ *    mismatches, throw an aggregated error naming the failed IPs — a deploy must
+ *    never proceed with a partially-distributed image.
+ *
+ * Single-arch only: the CLI builds `linux/amd64 --provenance=false --sbom=false`,
+ * so the artifact is always a single image manifest, never a manifest list /
+ * image index. A manifest-list mediaType is treated as a hard error rather than
+ * silently fanning out a list whose per-arch children we never copied.
+ *
+ * The transport is the ONLY injectable seam ({@link RegistryTransport}); specs
+ * pass an in-memory Harbor simulation so no real network is touched. The robot
+ * password rides only inside the Basic-auth header of the token request and is
+ * never logged.
+ */
+const https = __importStar(require("https"));
+const buffer_1 = require("buffer");
+const dns_1 = require("dns");
+/** Media types that identify a multi-arch manifest list / image index (unsupported). */
+const MANIFEST_LIST_TYPES = [
+    'application/vnd.docker.distribution.manifest.list.v2+json',
+    'application/vnd.oci.image.index.v1+json',
+];
+/** Accept header offered on manifest HEAD/GET — single-arch image manifests, either flavour. */
+const MANIFEST_ACCEPT = [
+    'application/vnd.docker.distribution.manifest.v2+json',
+    'application/vnd.oci.image.manifest.v1+json',
+    // Also accept the list types so the registry hands us the list (we then reject
+    // it with a clear error) rather than 406-ing into an opaque failure.
+    ...MANIFEST_LIST_TYPES,
+].join(', ');
+/**
+ * Parse a `Bearer realm="...",service="...",scope="..."` challenge. Pure.
+ *
+ * Returns `null` for a non-Bearer scheme or a Bearer challenge missing the
+ * mandatory `realm` (without a realm there is nowhere to fetch a token from).
+ */
+function parseAuthChallenge(wwwAuthenticate) {
+    const trimmed = wwwAuthenticate.trim();
+    if (!/^Bearer\s/i.test(trimmed))
+        return null;
+    const params = trimmed.replace(/^Bearer\s+/i, '');
+    const out = {};
+    // Match `key="value"` pairs; values are quoted in every real registry challenge.
+    const re = /([a-zA-Z0-9_]+)="([^"]*)"/g;
+    let m;
+    while ((m = re.exec(params)) !== null) {
+        out[m[1]] = m[2];
+    }
+    if (!out.realm)
+        return null;
+    const result = { realm: out.realm };
+    if (out.service !== undefined)
+        result.service = out.service;
+    if (out.scope !== undefined)
+        result.scope = out.scope;
+    return result;
+}
+/**
+ * DNS-resolve the federated host's A-records into the de-duplicated, sorted list
+ * of cluster-ingress IPs to fan out across. Injectable `resolve4` for tests;
+ * defaults to `dns.promises.resolve4`.
+ */
+async function resolveClusterEndpoints(host, resolve4 = (h) => dns_1.promises.resolve4(h)) {
+    const ips = await resolve4(host);
+    return Array.from(new Set(ips)).sort();
+}
+/**
+ * Real {@link RegistryTransport}: HTTPS to `req.ip:443` with TLS SNI + HTTP
+ * `Host` pinned to `host`, verification ON. All registry paths are `/v2/...`;
+ * absolute token-realm URLs are handled by {@link fetchAbsolute}.
+ */
+function defaultTransport(host) {
+    return (req) => new Promise((resolvePromise, reject) => {
+        const r = https.request({
+            host: req.ip,
+            servername: host, // TLS SNI → the federated cert
+            port: 443,
+            method: req.method,
+            path: req.path,
+            rejectUnauthorized: true,
+            headers: { ...(req.headers ?? {}), Host: host },
+        }, (res) => {
+            const chunks = [];
+            res.on('data', (d) => chunks.push(d));
+            res.on('end', () => resolvePromise({
+                status: res.statusCode ?? 0,
+                headers: lowerCaseHeaders(res.headers),
+                body: buffer_1.Buffer.concat(chunks),
+            }));
+        });
+        r.on('error', reject);
+        if (req.body)
+            r.write(req.body);
+        r.end();
+    });
+}
+/** Lower-case header keys; collapse array values to the first entry. */
+function lowerCaseHeaders(h) {
+    const out = {};
+    for (const [k, v] of Object.entries(h)) {
+        if (v === undefined)
+            continue;
+        out[k.toLowerCase()] = Array.isArray(v) ? v[0] : v;
+    }
+    return out;
+}
+/** Case-insensitive header read. */
+function header(res, name) {
+    const lower = name.toLowerCase();
+    for (const [k, v] of Object.entries(res.headers)) {
+        if (k.toLowerCase() === lower)
+            return v;
+    }
+    return undefined;
+}
+/** Resolve a possibly-relative `Location` against the `/v2/...` request space. */
+function locationPath(location) {
+    if (location.startsWith('http://') || location.startsWith('https://')) {
+        const u = new URL(location);
+        return u.pathname + u.search;
+    }
+    return location;
+}
+/**
+ * An authenticating Registry client over the injected transport. Transparently
+ * handles the 401 + Bearer-challenge dance: on a 401 it parses the challenge,
+ * fetches a token from the realm with HTTP Basic over the robot creds (caching
+ * it per `(ip, scope)`), then retries the original request with the Bearer.
+ */
+function makeClient(transport, username, password) {
+    const tokens = new Map();
+    const basic = 'Basic ' + buffer_1.Buffer.from(`${username}:${password}`).toString('base64');
+    async function fetchToken(ip, realm, service, scope) {
+        const key = `${ip}|${scope ?? ''}`;
+        const cached = tokens.get(key);
+        if (cached)
+            return cached;
+        const u = new URL(realm);
+        if (service)
+            u.searchParams.set('service', service);
+        if (scope)
+            u.searchParams.set('scope', scope);
+        const res = await transport({
+            ip,
+            method: 'GET',
+            path: u.pathname + u.search,
+            headers: { Authorization: basic },
+        });
+        if (res.status !== 200) {
+            throw new Error(`token request to ${ip} (${realm}) failed: HTTP ${res.status}`);
+        }
+        const parsed = JSON.parse(res.body.toString('utf8'));
+        const token = parsed.token ?? parsed.access_token;
+        if (!token)
+            throw new Error(`token request to ${ip} returned no token`);
+        tokens.set(key, token);
+        return token;
+    }
+    /**
+     * Send `req`, transparently authenticating on a 401. `scopeHint` is the scope
+     * we proactively request (`repository:<repo>:pull,push`) when the challenge
+     * itself omits one.
+     */
+    async function send(req, scopeHint) {
+        const res = await transport(req);
+        if (res.status !== 401)
+            return res;
+        const wwwAuth = header(res, 'www-authenticate');
+        const challenge = wwwAuth ? parseAuthChallenge(wwwAuth) : null;
+        if (!challenge)
+            return res; // not a bearer challenge we can satisfy
+        const token = await fetchToken(req.ip, challenge.realm, challenge.service, challenge.scope ?? scopeHint);
+        return transport({
+            ...req,
+            headers: { ...(req.headers ?? {}), Authorization: `Bearer ${token}` },
+        });
+    }
+    return { send };
+}
+/**
+ * Parse a single-arch image manifest into its config + layer descriptors.
+ * Throws on a manifest-list / image-index mediaType (single-arch deploy only).
+ */
+function parseManifest(bytes, contentType) {
+    const doc = JSON.parse(bytes.toString('utf8'));
+    const mediaType = contentType ?? doc.mediaType;
+    if (mediaType && MANIFEST_LIST_TYPES.includes(mediaType.split(';')[0].trim())) {
+        throw new Error(`manifest list not supported (single-arch deploy only): got mediaType "${mediaType}". ` +
+            'The CLI builds linux/amd64 --provenance=false --sbom=false, which must yield a single image manifest.');
+    }
+    if (!doc.config?.digest || !Array.isArray(doc.layers)) {
+        throw new Error('source manifest is not a single-arch image manifest (no config/layers)');
+    }
+    return { config: doc.config, layers: doc.layers };
+}
+/**
+ * Fan out an already-pushed image to every cluster Harbor and prove it landed
+ * on all of them. See the module header for the full algorithm. Throws if no
+ * endpoint serves the digest to copy from, or if re-verification finds any
+ * endpoint not serving the pushed digest (the error names the failed IPs).
+ */
+async function ensureImageOnClusters(opts) {
+    const transport = opts.transport ?? defaultTransport(opts.host);
+    const client = makeClient(transport, opts.username, opts.password);
+    const pullPushScope = `repository:${opts.repository}:pull,push`;
+    const manifestPath = `/v2/${opts.repository}/manifests/${opts.tag}`;
+    // 1. Which endpoints already serve the pushed digest?
+    const presence = await Promise.all(opts.endpoints.map(async (ip) => {
+        const res = await client.send({ ip, method: 'HEAD', path: manifestPath, headers: { Accept: MANIFEST_ACCEPT } }, pullPushScope);
+        const served = res.status === 200 ? header(res, 'docker-content-digest') : undefined;
+        return { ip, present: served === opts.digest };
+    }));
+    const source = presence.find((p) => p.present);
+    if (!source) {
+        throw new Error(`no cluster endpoint serves ${opts.repository}:${opts.tag}@${opts.digest} — ` +
+            'nothing to copy from (the federated push must land on at least one cluster first).');
+    }
+    // Fast path: every endpoint already serves the digest (e.g. a single-cluster
+    // deployment, or a re-run). Nothing to copy — skip the source manifest GET.
+    if (presence.every((p) => p.present)) {
+        return { targets: presence.map((p) => ({ ip: p.ip, outcome: 'present' })) };
+    }
+    // 2. Pull the source manifest once (exact bytes + content-type).
+    const srcManifestRes = await client.send({ ip: source.ip, method: 'GET', path: manifestPath, headers: { Accept: MANIFEST_ACCEPT } }, pullPushScope);
+    if (srcManifestRes.status !== 200) {
+        throw new Error(`failed to read source manifest from ${source.ip}: HTTP ${srcManifestRes.status}`);
+    }
+    const manifestContentType = header(srcManifestRes, 'content-type');
+    const parsed = parseManifest(srcManifestRes.body, manifestContentType); // throws on manifest list
+    const blobDigests = [parsed.config.digest, ...parsed.layers.map((l) => l.digest)];
+    // 3. Copy to every non-present endpoint.
+    const report = { targets: [] };
+    for (const p of presence) {
+        if (p.present) {
+            report.targets.push({ ip: p.ip, outcome: 'present' });
+            continue;
+        }
+        await copyToDest({
+            client,
+            source: source.ip,
+            dest: p.ip,
+            repository: opts.repository,
+            tag: opts.tag,
+            pullPushScope,
+            blobDigests,
+            manifestBytes: srcManifestRes.body,
+            manifestContentType,
+            manifestPath,
+        });
+        report.targets.push({ ip: p.ip, outcome: 'copied' });
+    }
+    // 4. Re-verify the tag on EVERY endpoint; any mismatch is fatal.
+    const failures = [];
+    await Promise.all(opts.endpoints.map(async (ip) => {
+        const res = await client.send({ ip, method: 'HEAD', path: manifestPath, headers: { Accept: MANIFEST_ACCEPT } }, pullPushScope);
+        const served = res.status === 200 ? header(res, 'docker-content-digest') : undefined;
+        if (served !== opts.digest) {
+            failures.push(ip);
+            const t = report.targets.find((x) => x.ip === ip);
+            if (t) {
+                t.outcome = 'failed';
+                t.error = `re-verify: served digest ${served ?? '<none>'} !== ${opts.digest}`;
+            }
+        }
+    }));
+    if (failures.length > 0) {
+        throw new Error(`image fan-out incomplete: ${failures.sort().join(', ')} do not serve ` +
+            `${opts.repository}:${opts.tag}@${opts.digest} after copy — deploy aborted.`);
+    }
+    return report;
+}
+/** Copy the config + layer blobs (skipping ones the dest already has) and PUT the manifest. */
+async function copyToDest(args) {
+    const { client, source, dest, repository, pullPushScope } = args;
+    for (const digest of args.blobDigests) {
+        // HEAD on dest — skip the upload entirely if the blob already exists.
+        const head = await client.send({ ip: dest, method: 'HEAD', path: `/v2/${repository}/blobs/${digest}` }, pullPushScope);
+        if (head.status === 200)
+            continue;
+        // Fetch the blob bytes from the source.
+        const blob = await client.send({ ip: source, method: 'GET', path: `/v2/${repository}/blobs/${digest}` }, pullPushScope);
+        if (blob.status !== 200) {
+            throw new Error(`failed to fetch blob ${digest} from source ${source}: HTTP ${blob.status}`);
+        }
+        // Start an upload session, then monolithic-PUT to its Location with ?digest=.
+        const start = await client.send({ ip: dest, method: 'POST', path: `/v2/${repository}/blobs/uploads/` }, pullPushScope);
+        if (start.status !== 202) {
+            throw new Error(`failed to start blob upload on ${dest}: HTTP ${start.status}`);
+        }
+        const location = header(start, 'location');
+        if (!location)
+            throw new Error(`blob upload on ${dest} returned no Location`);
+        const putPath = appendDigestQuery(locationPath(location), digest);
+        const put = await client.send({
+            ip: dest,
+            method: 'PUT',
+            path: putPath,
+            headers: { 'Content-Type': 'application/octet-stream' },
+            body: blob.body,
+        }, pullPushScope);
+        if (put.status !== 201) {
+            throw new Error(`failed to upload blob ${digest} to ${dest}: HTTP ${put.status}`);
+        }
+    }
+    // All blobs present on dest → PUT the manifest with the EXACT source bytes + content-type.
+    const headers = {};
+    if (args.manifestContentType)
+        headers['Content-Type'] = args.manifestContentType;
+    const put = await client.send({ ip: dest, method: 'PUT', path: args.manifestPath, headers, body: args.manifestBytes }, pullPushScope);
+    if (put.status !== 201 && put.status !== 200) {
+        throw new Error(`failed to PUT manifest to ${dest}: HTTP ${put.status}`);
+    }
+}
+/** Append `digest=<d>` to a `Location`, respecting any query string already present. */
+function appendDigestQuery(path, digest) {
+    const sep = path.includes('?') ? '&' : '?';
+    return `${path}${sep}digest=${encodeURIComponent(digest)}`;
+}
+/**
+ * The deploy-time entrypoint: take an image just pushed to the federated host
+ * (landed on ONE cluster) and guarantee it is present on EVERY cluster Harbor.
+ *
+ * Resolves the registry host's A-records into the cluster-ingress set, then:
+ *   - 0/1 endpoint (a non-federated or local/dev registry, or DNS that doesn't
+ *     fan out) → nothing to distribute; returns `null`.
+ *   - ≥2 endpoints → {@link ensureImageOnClusters}, which copies + re-verifies
+ *     and THROWS if any cluster ends up not serving the pushed digest.
+ *
+ * A DNS resolution failure is treated as "single-target" (logged, returns
+ * `null`) rather than fatal: a real federated push has already proven the host
+ * resolves, so a failure here means a dev/local registry where fan-out is moot.
+ */
+async function fanOutPushedImage(opts) {
+    const log = opts.log ?? (() => undefined);
+    const host = opts.registry.server.replace(/^https?:\/\//, '').replace(/:\d+$/, '');
+    let endpoints;
+    try {
+        endpoints = await resolveClusterEndpoints(host, opts.resolve4);
+    }
+    catch (err) {
+        log(`  distribute: ${host} did not resolve (${err.message}); single-target, skipping fan-out`);
+        return null;
+    }
+    if (endpoints.length <= 1) {
+        log(`  distribute: ${host} resolves to ${endpoints.length} endpoint(s); single-target, skipping fan-out`);
+        return null;
+    }
+    log(`  distribute: fanning ${opts.registry.repository}:${opts.tag} to ${endpoints.length} clusters (${endpoints.join(', ')})`);
+    const report = await ensureImageOnClusters({
+        host,
+        repository: opts.registry.repository,
+        tag: opts.tag,
+        digest: opts.digest,
+        username: opts.registry.username,
+        password: opts.registry.password,
+        endpoints,
+        transport: opts.transport,
+    });
+    for (const t of report.targets) {
+        log(`  distribute: ${t.ip} → ${t.outcome}${t.error ? ` (${t.error})` : ''}`);
+    }
+    return report;
+}
+//# sourceMappingURL=registry-fanout.js.map

package/dist/_lib/registry-fanout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-fanout.js","sourceRoot":"","sources":["../../src/_lib/registry-fanout.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuHA,gDAgBC;AAOD,0DAMC;AAOD,4CA6BC;AA8HD,sDA8FC;AAiHD,8CAiCC;AAtiBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,6CAA+B;AAC/B,mCAAgC;AAChC,6BAAsC;AAEtC,wFAAwF;AACxF,MAAM,mBAAmB,GAAG;IAC1B,2DAA2D;IAC3D,yCAAyC;CAC1C,CAAC;AAEF,gGAAgG;AAChG,MAAM,eAAe,GAAG;IACtB,sDAAsD;IACtD,4CAA4C;IAC5C,+EAA+E;IAC/E,qEAAqE;IACrE,GAAG,mBAAmB;CACvB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAmDb;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,eAAuB;IACxD,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,iFAAiF;IACjF,MAAM,EAAE,GAAG,4BAA4B,CAAC;IACxC,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACtC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,MAAM,GAAkB,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;IACnD,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;QAAE,MAAM,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC5D,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IACtD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,uBAAuB,CAC3C,IAAY,EACZ,WAA6C,CAAC,CAAC,EAAE,EAAE,CAAC,cAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEnE,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,SAAgB,gBAAgB,CAAC,IAAY;IAC3C,OAAO,CAAC,GAAG,EAAE,EAAE,CACb,IAAI,OAAO,CAAmB,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;QACvD,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CACrB;YACE,IAAI,EAAE,GAAG,CAAC,EAAE;YACZ,UAAU,EAAE,IAAI,EAAE,+BAA+B;YACjD,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,kBAAkB,EAAE,IAAI;YACxB,OAAO,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;SAChD,EACD,CAAC,GAAG,EAAE,EAAE;YACN,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CACjB,cAAc,CAAC;gBACb,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC;gBAC3B,OAAO,EAAE,gBAAgB,CAAC,GAAG,CAAC,OAAwD,CAAC;gBACvF,IAAI,EAAE,eAAM,CAAC,MAAM,CAAC,MAAM,CAAC;aAC5B,CAAC,CACH,CAAC;QACJ,CAAC,CACF,CAAC;QACF,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACtB,IAAI,GAAG,CAAC,IAAI;YAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC,CAAC,GAAG,EAAE,CAAC;IACV,CAAC,CAAC,CAAC;AACP,CAAC;AAED,wEAAwE;AACxE,SAAS,gBAAgB,CAAC,CAAgD;IACxE,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oCAAoC;AACpC,SAAS,MAAM,CAAC,GAAwC,EAAE,IAAY;IACpE,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK;YAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,kFAAkF;AAClF,SAAS,YAAY,CAAC,QAAgB;IACpC,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACtE,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5B,OAAO,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAKD;;;;;GAKG;AACH,SAAS,UAAU,CACjB,SAA4B,EAC5B,QAAgB,EAChB,QAAgB;IAEhB,MAAM,MAAM,GAAe,IAAI,GAAG,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,QAAQ,GAAG,eAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAEnF,KAAK,UAAU,UAAU,CAAC,EAAU,EAAE,KAAa,EAAE,OAAgB,EAAE,KAAc;QACnF,MAAM,GAAG,GAAG,GAAG,EAAE,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,OAAO;YAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,KAAK;YAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC;YAC1B,EAAE;YACF,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,MAAM;YAC3B,OAAO,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE;SAClC,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,oBAAoB,EAAE,KAAK,KAAK,kBAAkB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA8C,CAAC;QAClG,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,YAAY,CAAC;QAClD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,CAAC;QACxE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACvB,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,KAAK,UAAU,IAAI,CAAC,GAAoB,EAAE,SAAkB;QAC1D,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,GAAG,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/D,IAAI,CAAC,SAAS;YAAE,OAAO,GAAG,CAAC,CAAC,wCAAwC;QACpE,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,CAAC;QACzG,OAAO,SAAS,CAAC;YACf,GAAG,GAAG;YACN,OAAO,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SACtE,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,CAAC;AAClB,CAAC;AAQD;;;GAGG;AACH,SAAS,aAAa,CAAC,KAAa,EAAE,WAAoB;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAI5C,CAAC;IACF,MAAM,SAAS,GAAG,WAAW,IAAI,GAAG,CAAC,SAAS,CAAC;IAC/C,IAAI,SAAS,IAAI,mBAAmB,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CACb,yEAAyE,SAAS,KAAK;YACrF,uGAAuG,CAC1G,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,qBAAqB,CAAC,IAAqB;IAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnE,MAAM,aAAa,GAAG,cAAc,IAAI,CAAC,UAAU,YAAY,CAAC;IAChE,MAAM,YAAY,GAAG,OAAO,IAAI,CAAC,UAAU,cAAc,IAAI,CAAC,GAAG,EAAE,CAAC;IAEpE,sDAAsD;IACtD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QAC9B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAC3B,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,EAChF,aAAa,CACd,CAAC;QACF,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrF,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;IACjD,CAAC,CAAC,CACH,CAAC;IAEF,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,8BAA8B,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,KAAK;YAC3E,oFAAoF,CACvF,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,4EAA4E;IAC5E,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,SAAkB,EAAE,CAAC,CAAC,EAAE,CAAC;IACvF,CAAC;IAED,iEAAiE;IACjE,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,IAAI,CACtC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,EAC1F,aAAa,CACd,CAAC;IACF,IAAI,cAAc,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,uCAAuC,MAAM,CAAC,EAAE,UAAU,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;IACrG,CAAC;IACD,MAAM,mBAAmB,GAAG,MAAM,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,aAAa,CAAC,cAAc,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC,CAAC,0BAA0B;IAClG,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAElF,yCAAyC;IACzC,MAAM,MAAM,GAAiB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YACd,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YACtD,SAAS;QACX,CAAC;QACD,MAAM,UAAU,CAAC;YACf,MAAM;YACN,MAAM,EAAE,MAAM,CAAC,EAAE;YACjB,IAAI,EAAE,CAAC,CAAC,EAAE;YACV,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,aAAa;YACb,WAAW;YACX,aAAa,EAAE,cAAc,CAAC,IAAI;YAClC,mBAAmB;YACnB,YAAY;SACb,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,iEAAiE;IACjE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,CAAC,GAAG,CACf,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QAC9B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAC3B,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,EAChF,aAAa,CACd,CAAC;QACF,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrF,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClB,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAClD,IAAI,CAAC,EAAE,CAAC;gBACN,CAAC,CAAC,OAAO,GAAG,QAAQ,CAAC;gBACrB,CAAC,CAAC,KAAK,GAAG,4BAA4B,MAAM,IAAI,QAAQ,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YAChF,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IAEF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,6BAA6B,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB;YACrE,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,+BAA+B,CAC/E,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+FAA+F;AAC/F,KAAK,UAAU,UAAU,CAAC,IAWzB;IACC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IAEjE,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACtC,sEAAsE;QACtE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAC5B,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,UAAU,UAAU,MAAM,EAAE,EAAE,EACvE,aAAa,CACd,CAAC;QACF,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;YAAE,SAAS;QAElC,wCAAwC;QACxC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAC5B,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,UAAU,UAAU,MAAM,EAAE,EAAE,EACxE,aAAa,CACd,CAAC;QACF,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,wBAAwB,MAAM,gBAAgB,MAAM,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/F,CAAC;QAED,8EAA8E;QAC9E,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAC7B,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,UAAU,iBAAiB,EAAE,EACtE,aAAa,CACd,CAAC;QACF,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,UAAU,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,uBAAuB,CAAC,CAAC;QAC9E,MAAM,OAAO,GAAG,iBAAiB,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAC3B;YACE,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;YACvD,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,EACD,aAAa,CACd,CAAC;QACF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,OAAO,IAAI,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAED,2FAA2F;IAC3F,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,IAAI,IAAI,CAAC,mBAAmB;QAAE,OAAO,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,mBAAmB,CAAC;IACjF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAC3B,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,EACvF,aAAa,CACd,CAAC;IACF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,SAAS,iBAAiB,CAAC,IAAY,EAAE,MAAc;IACrD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAC3C,OAAO,GAAG,IAAI,GAAG,GAAG,UAAU,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;AAC7D,CAAC;AAuBD;;;;;;;;;;;;;GAaG;AACI,KAAK,UAAU,iBAAiB,CACrC,IAA2B;IAE3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAEnF,IAAI,SAAmB,CAAC;IACxB,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,uBAAuB,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,iBAAiB,IAAI,qBAAsB,GAAa,CAAC,OAAO,oCAAoC,CAAC,CAAC;QAC1G,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QAC1B,GAAG,CAAC,iBAAiB,IAAI,gBAAgB,SAAS,CAAC,MAAM,+CAA+C,CAAC,CAAC;QAC1G,OAAO,IAAI,CAAC;IACd,CAAC;IAED,GAAG,CAAC,yBAAyB,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,OAAO,SAAS,CAAC,MAAM,cAAc,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/H,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC;QACzC,IAAI;QACJ,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU;QACpC,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;QAChC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;QAChC,SAAS;QACT,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CAAC;IACH,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/B,GAAG,CAAC,iBAAiB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}