@hsuite/smart-engines-cli 1.2.1 → 1.4.2

package/dist/_lib/registry-fanout.js

@@ -0,0 +1,545 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseAuthChallenge = parseAuthChallenge;
+exports.resolveClusterEndpoints = resolveClusterEndpoints;
+exports.defaultTransport = defaultTransport;
+exports.ensureImageOnClusters = ensureImageOnClusters;
+exports.resolveRegistryDigest = resolveRegistryDigest;
+exports.resolveAttestationDigest = resolveAttestationDigest;
+exports.fanOutPushedImage = fanOutPushedImage;
+/**
+ * Synchronous Registry-v2 fan-out: copy one already-pushed image to EVERY
+ * federated Harbor cluster, then prove it landed on all of them.
+ *
+ * ## Why this exists
+ *
+ * `harbor.testnet.hsuite.network` is public-DNS round-robin over the 3
+ * cluster-ingress IPs, and each IP fronts its OWN independent Harbor instance.
+ * A single `docker push` (via {@link import('./baas').buildAndPush}) therefore
+ * lands the image on exactly ONE cluster — whichever IP the OS resolver picked
+ * that second. The Harbor cross-cluster replication mesh is unreliable, so we do
+ * the fan-out ourselves, at the Registry-v2 API level, and BLOCK the deploy
+ * until every cluster serves the exact pushed digest.
+ *
+ * ## How the fan-out works
+ *
+ * We talk to each cluster by its IP while pinning TLS SNI + the HTTP `Host`
+ * header to the federated hostname ({@link defaultTransport}) — the cert and the
+ * Harbor vhost are keyed on that name, the IP is just the dial target. The
+ * push-robot credential is BLS-deterministic and identical on all 3 Harbors, so
+ * one credential authenticates against every IP.
+ *
+ * 1. HEAD the tag on each IP; an IP whose `Docker-Content-Digest` equals the
+ *    pushed digest is already `present`.
+ * 2. At least one IP MUST be present (the federated push landed somewhere); pick
+ *    it as the copy SOURCE.
+ * 3. To each non-present IP, copy: pull the source manifest (exact bytes +
+ *    content-type), and for the config blob + every layer blob, HEAD it on the
+ *    dest and — only if absent — monolithically PUT it (start an upload session,
+ *    fetch the blob from source, PUT to the session `Location` with `?digest=`).
+ *    Then PUT the manifest with the source's exact bytes + content-type.
+ * 4. RE-VERIFY by HEADing the tag on EVERY IP. If any IP's served digest still
+ *    mismatches, throw an aggregated error naming the failed IPs — a deploy must
+ *    never proceed with a partially-distributed image.
+ *
+ * Single-arch only: the CLI builds `linux/amd64 --provenance=false --sbom=false`,
+ * so the artifact is always a single image manifest, never a manifest list /
+ * image index. A manifest-list mediaType is treated as a hard error rather than
+ * silently fanning out a list whose per-arch children we never copied.
+ *
+ * The transport is the ONLY injectable seam ({@link RegistryTransport}); specs
+ * pass an in-memory Harbor simulation so no real network is touched. The robot
+ * password rides only inside the Basic-auth header of the token request and is
+ * never logged.
+ */
+const https = __importStar(require("https"));
+const buffer_1 = require("buffer");
+const dns_1 = require("dns");
+/** Media types that identify a multi-arch manifest list / image index (unsupported). */
+const MANIFEST_LIST_TYPES = [
+    'application/vnd.docker.distribution.manifest.list.v2+json',
+    'application/vnd.oci.image.index.v1+json',
+];
+/** Accept header offered on manifest HEAD/GET — single-arch image manifests, either flavour. */
+const MANIFEST_ACCEPT = [
+    'application/vnd.docker.distribution.manifest.v2+json',
+    'application/vnd.oci.image.manifest.v1+json',
+    // Also accept the list types so the registry hands us the list (we then reject
+    // it with a clear error) rather than 406-ing into an opaque failure.
+    ...MANIFEST_LIST_TYPES,
+].join(', ');
+/**
+ * Accept header offered when resolving the digest to ATTEST (#1589) — BYTE-FOR-BYTE
+ * and IN THE SAME ORDER as the deployer's `CustomerImageDigestResolverService`
+ * (`oci.index → oci.manifest → docker.v2 → docker.list.v2`). Harbor picks the
+ * served manifest (and thus the `Docker-Content-Digest`) by the Accept order, so
+ * the CLI MUST offer the identical preference list — otherwise content negotiation
+ * hands the CLI a different canonical digest than the deployer pins (e.g. the
+ * schema2 manifest digest vs the OCI-index digest) and the #1445 gate rejects a
+ * legitimate deploy. Do not reorder without changing the deployer in lockstep.
+ */
+const DEPLOYER_PARITY_MANIFEST_ACCEPT = [
+    'application/vnd.oci.image.index.v1+json',
+    'application/vnd.oci.image.manifest.v1+json',
+    'application/vnd.docker.distribution.manifest.v2+json',
+    'application/vnd.docker.distribution.manifest.list.v2+json',
+].join(', ');
+/**
+ * Parse a `Bearer realm="...",service="...",scope="..."` challenge. Pure.
+ *
+ * Returns `null` for a non-Bearer scheme or a Bearer challenge missing the
+ * mandatory `realm` (without a realm there is nowhere to fetch a token from).
+ */
+function parseAuthChallenge(wwwAuthenticate) {
+    const trimmed = wwwAuthenticate.trim();
+    if (!/^Bearer\s/i.test(trimmed))
+        return null;
+    const params = trimmed.replace(/^Bearer\s+/i, '');
+    const out = {};
+    // Match `key="value"` pairs; values are quoted in every real registry challenge.
+    const re = /([a-zA-Z0-9_]+)="([^"]*)"/g;
+    let m;
+    while ((m = re.exec(params)) !== null) {
+        out[m[1]] = m[2];
+    }
+    if (!out.realm)
+        return null;
+    const result = { realm: out.realm };
+    if (out.service !== undefined)
+        result.service = out.service;
+    if (out.scope !== undefined)
+        result.scope = out.scope;
+    return result;
+}
+/**
+ * DNS-resolve the federated host's A-records into the de-duplicated, sorted list
+ * of cluster-ingress IPs to fan out across. Injectable `resolve4` for tests;
+ * defaults to `dns.promises.resolve4`.
+ */
+async function resolveClusterEndpoints(host, resolve4 = (h) => dns_1.promises.resolve4(h)) {
+    const ips = await resolve4(host);
+    return Array.from(new Set(ips)).sort();
+}
+/**
+ * Real {@link RegistryTransport}: HTTPS to `req.ip:443` with TLS SNI + HTTP
+ * `Host` pinned to `host`, verification ON. All registry paths are `/v2/...`;
+ * absolute token-realm URLs are handled by {@link fetchAbsolute}.
+ */
+function defaultTransport(host) {
+    return (req) => new Promise((resolvePromise, reject) => {
+        const r = https.request({
+            host: req.ip,
+            servername: host, // TLS SNI → the federated cert
+            port: 443,
+            method: req.method,
+            path: req.path,
+            rejectUnauthorized: true,
+            headers: { ...(req.headers ?? {}), Host: host },
+        }, (res) => {
+            const chunks = [];
+            res.on('data', (d) => chunks.push(d));
+            res.on('end', () => resolvePromise({
+                status: res.statusCode ?? 0,
+                headers: lowerCaseHeaders(res.headers),
+                body: buffer_1.Buffer.concat(chunks),
+            }));
+        });
+        r.on('error', reject);
+        if (req.body)
+            r.write(req.body);
+        r.end();
+    });
+}
+/** Lower-case header keys; collapse array values to the first entry. */
+function lowerCaseHeaders(h) {
+    const out = {};
+    for (const [k, v] of Object.entries(h)) {
+        if (v === undefined)
+            continue;
+        out[k.toLowerCase()] = Array.isArray(v) ? v[0] : v;
+    }
+    return out;
+}
+/** Case-insensitive header read. */
+function header(res, name) {
+    const lower = name.toLowerCase();
+    for (const [k, v] of Object.entries(res.headers)) {
+        if (k.toLowerCase() === lower)
+            return v;
+    }
+    return undefined;
+}
+/** Resolve a possibly-relative `Location` against the `/v2/...` request space. */
+function locationPath(location) {
+    if (location.startsWith('http://') || location.startsWith('https://')) {
+        const u = new URL(location);
+        return u.pathname + u.search;
+    }
+    return location;
+}
+/**
+ * An authenticating Registry client over the injected transport. Transparently
+ * handles the 401 + Bearer-challenge dance: on a 401 it parses the challenge,
+ * fetches a token from the realm with HTTP Basic over the robot creds (caching
+ * it per `(ip, scope)`), then retries the original request with the Bearer.
+ */
+function makeClient(transport, username, password) {
+    const tokens = new Map();
+    const basic = 'Basic ' + buffer_1.Buffer.from(`${username}:${password}`).toString('base64');
+    async function fetchToken(ip, realm, service, scope) {
+        const key = `${ip}|${scope ?? ''}`;
+        const cached = tokens.get(key);
+        if (cached)
+            return cached;
+        const u = new URL(realm);
+        if (service)
+            u.searchParams.set('service', service);
+        if (scope)
+            u.searchParams.set('scope', scope);
+        const res = await transport({
+            ip,
+            method: 'GET',
+            path: u.pathname + u.search,
+            headers: { Authorization: basic },
+        });
+        if (res.status !== 200) {
+            throw new Error(`token request to ${ip} (${realm}) failed: HTTP ${res.status}`);
+        }
+        const parsed = JSON.parse(res.body.toString('utf8'));
+        const token = parsed.token ?? parsed.access_token;
+        if (!token)
+            throw new Error(`token request to ${ip} returned no token`);
+        tokens.set(key, token);
+        return token;
+    }
+    /**
+     * Send `req`, transparently authenticating on a 401. `scopeHint` is the scope
+     * we proactively request (`repository:<repo>:pull,push`) when the challenge
+     * itself omits one.
+     */
+    async function send(req, scopeHint) {
+        const res = await transport(req);
+        if (res.status !== 401)
+            return res;
+        const wwwAuth = header(res, 'www-authenticate');
+        const challenge = wwwAuth ? parseAuthChallenge(wwwAuth) : null;
+        if (!challenge)
+            return res; // not a bearer challenge we can satisfy
+        const token = await fetchToken(req.ip, challenge.realm, challenge.service, challenge.scope ?? scopeHint);
+        return transport({
+            ...req,
+            headers: { ...(req.headers ?? {}), Authorization: `Bearer ${token}` },
+        });
+    }
+    return { send };
+}
+/**
+ * Parse a single-arch image manifest into its config + layer descriptors.
+ * Throws on a manifest-list / image-index mediaType (single-arch deploy only).
+ */
+function parseManifest(bytes, contentType) {
+    const doc = JSON.parse(bytes.toString('utf8'));
+    const mediaType = contentType ?? doc.mediaType;
+    if (mediaType && MANIFEST_LIST_TYPES.includes(mediaType.split(';')[0].trim())) {
+        throw new Error(`manifest list not supported (single-arch deploy only): got mediaType "${mediaType}". ` +
+            'The CLI builds linux/amd64 --provenance=false --sbom=false, which must yield a single image manifest.');
+    }
+    if (!doc.config?.digest || !Array.isArray(doc.layers)) {
+        throw new Error('source manifest is not a single-arch image manifest (no config/layers)');
+    }
+    return { config: doc.config, layers: doc.layers };
+}
+/**
+ * Fan out an already-pushed image to every cluster Harbor and prove it landed
+ * on all of them. See the module header for the full algorithm. Throws if no
+ * endpoint serves the digest to copy from, or if re-verification finds any
+ * endpoint not serving the pushed digest (the error names the failed IPs).
+ */
+async function ensureImageOnClusters(opts) {
+    const transport = opts.transport ?? defaultTransport(opts.host);
+    const client = makeClient(transport, opts.username, opts.password);
+    const pullPushScope = `repository:${opts.repository}:pull,push`;
+    const manifestPath = `/v2/${opts.repository}/manifests/${opts.tag}`;
+    // 1. Which endpoints already serve the pushed digest?
+    const presence = await Promise.all(opts.endpoints.map(async (ip) => {
+        const res = await client.send({ ip, method: 'HEAD', path: manifestPath, headers: { Accept: MANIFEST_ACCEPT } }, pullPushScope);
+        const served = res.status === 200 ? header(res, 'docker-content-digest') : undefined;
+        return { ip, present: served === opts.digest };
+    }));
+    const source = presence.find((p) => p.present);
+    if (!source) {
+        throw new Error(`no cluster endpoint serves ${opts.repository}:${opts.tag}@${opts.digest} — ` +
+            'nothing to copy from (the federated push must land on at least one cluster first).');
+    }
+    // Fast path: every endpoint already serves the digest (e.g. a single-cluster
+    // deployment, or a re-run). Nothing to copy — skip the source manifest GET.
+    if (presence.every((p) => p.present)) {
+        return { targets: presence.map((p) => ({ ip: p.ip, outcome: 'present' })) };
+    }
+    // 2. Pull the source manifest once (exact bytes + content-type).
+    const srcManifestRes = await client.send({ ip: source.ip, method: 'GET', path: manifestPath, headers: { Accept: MANIFEST_ACCEPT } }, pullPushScope);
+    if (srcManifestRes.status !== 200) {
+        throw new Error(`failed to read source manifest from ${source.ip}: HTTP ${srcManifestRes.status}`);
+    }
+    const manifestContentType = header(srcManifestRes, 'content-type');
+    const parsed = parseManifest(srcManifestRes.body, manifestContentType); // throws on manifest list
+    const blobDigests = [parsed.config.digest, ...parsed.layers.map((l) => l.digest)];
+    // 3. Copy to every non-present endpoint.
+    const report = { targets: [] };
+    for (const p of presence) {
+        if (p.present) {
+            report.targets.push({ ip: p.ip, outcome: 'present' });
+            continue;
+        }
+        await copyToDest({
+            client,
+            source: source.ip,
+            dest: p.ip,
+            repository: opts.repository,
+            tag: opts.tag,
+            pullPushScope,
+            blobDigests,
+            manifestBytes: srcManifestRes.body,
+            manifestContentType,
+            manifestPath,
+        });
+        report.targets.push({ ip: p.ip, outcome: 'copied' });
+    }
+    // 4. Re-verify the tag on EVERY endpoint; any mismatch is fatal.
+    const failures = [];
+    await Promise.all(opts.endpoints.map(async (ip) => {
+        const res = await client.send({ ip, method: 'HEAD', path: manifestPath, headers: { Accept: MANIFEST_ACCEPT } }, pullPushScope);
+        const served = res.status === 200 ? header(res, 'docker-content-digest') : undefined;
+        if (served !== opts.digest) {
+            failures.push(ip);
+            const t = report.targets.find((x) => x.ip === ip);
+            if (t) {
+                t.outcome = 'failed';
+                t.error = `re-verify: served digest ${served ?? '<none>'} !== ${opts.digest}`;
+            }
+        }
+    }));
+    if (failures.length > 0) {
+        throw new Error(`image fan-out incomplete: ${failures.sort().join(', ')} do not serve ` +
+            `${opts.repository}:${opts.tag}@${opts.digest} after copy — deploy aborted.`);
+    }
+    return report;
+}
+/** Copy the config + layer blobs (skipping ones the dest already has) and PUT the manifest. */
+async function copyToDest(args) {
+    const { client, source, dest, repository, pullPushScope } = args;
+    for (const digest of args.blobDigests) {
+        // HEAD on dest — skip the upload entirely if the blob already exists.
+        const head = await client.send({ ip: dest, method: 'HEAD', path: `/v2/${repository}/blobs/${digest}` }, pullPushScope);
+        if (head.status === 200)
+            continue;
+        // Fetch the blob bytes from the source.
+        const blob = await client.send({ ip: source, method: 'GET', path: `/v2/${repository}/blobs/${digest}` }, pullPushScope);
+        if (blob.status !== 200) {
+            throw new Error(`failed to fetch blob ${digest} from source ${source}: HTTP ${blob.status}`);
+        }
+        // Start an upload session, then monolithic-PUT to its Location with ?digest=.
+        const start = await client.send({ ip: dest, method: 'POST', path: `/v2/${repository}/blobs/uploads/` }, pullPushScope);
+        if (start.status !== 202) {
+            throw new Error(`failed to start blob upload on ${dest}: HTTP ${start.status}`);
+        }
+        const location = header(start, 'location');
+        if (!location)
+            throw new Error(`blob upload on ${dest} returned no Location`);
+        const putPath = appendDigestQuery(locationPath(location), digest);
+        const put = await client.send({
+            ip: dest,
+            method: 'PUT',
+            path: putPath,
+            headers: { 'Content-Type': 'application/octet-stream' },
+            body: blob.body,
+        }, pullPushScope);
+        if (put.status !== 201) {
+            throw new Error(`failed to upload blob ${digest} to ${dest}: HTTP ${put.status}`);
+        }
+    }
+    // All blobs present on dest → PUT the manifest with the EXACT source bytes + content-type.
+    const headers = {};
+    if (args.manifestContentType)
+        headers['Content-Type'] = args.manifestContentType;
+    const put = await client.send({ ip: dest, method: 'PUT', path: args.manifestPath, headers, body: args.manifestBytes }, pullPushScope);
+    if (put.status !== 201 && put.status !== 200) {
+        throw new Error(`failed to PUT manifest to ${dest}: HTTP ${put.status}`);
+    }
+}
+/** Append `digest=<d>` to a `Location`, respecting any query string already present. */
+function appendDigestQuery(path, digest) {
+    const sep = path.includes('?') ? '&' : '?';
+    return `${path}${sep}digest=${encodeURIComponent(digest)}`;
+}
+/**
+ * Resolve the CANONICAL manifest digest the registry serves for `<repo>:<tag>`
+ * — the value returned in the `Docker-Content-Digest` response header on a
+ * `HEAD /v2/<repo>/manifests/<tag>`.
+ *
+ * ## Why this is the digest to ATTEST (issue #1589)
+ *
+ * The `docker push` summary reports the digest of the manifest the *local*
+ * client holds. With a containerd image store (Colima / buildkit snapshotter),
+ * that is an OCI image manifest, but Harbor stores + re-serves the tag under a
+ * DIFFERENT canonical digest (a re-serialized Docker schema2 manifest) — the
+ * push-summary digest and the tag's served digest disagree. The deployer pins +
+ * the fan-out re-verify BOTH key off the tag's served `Docker-Content-Digest`
+ * ({@link CustomerImageDigestResolverService} does the identical HEAD). So the
+ * CLI must attest THIS registry-truth digest, not the push-summary one, and feed
+ * the SAME value to the fan-out — then attested == fanned-out == deployer-resolved
+ * by construction.
+ *
+ * This is the exact resolution the deployer performs, so it is authoritative for
+ * the strict-equality attestation gate. Returns the `sha256:<64hex>` served
+ * digest, or `null` when the registry can't be probed (caller decides whether to
+ * fall back to the push-summary digest — a fail-soft, not a fail-open: the
+ * deployer still re-verifies).
+ */
+async function resolveRegistryDigest(opts) {
+    const transport = opts.transport ?? defaultTransport(opts.host);
+    const endpoints = await resolveClusterEndpoints(opts.host, opts.resolve4).catch(() => [opts.host]);
+    // Any single endpoint is authoritative for the tag→digest mapping (the
+    // fan-out proves every cluster ends up serving that same digest). Try each
+    // until one answers, so a single-cluster transient miss doesn't fail-soft.
+    const client = makeClient(transport, opts.username, opts.password);
+    const pullScope = `repository:${opts.repository}:pull`;
+    const manifestPath = `/v2/${opts.repository}/manifests/${opts.tag}`;
+    for (const ip of endpoints.length > 0 ? endpoints : [opts.host]) {
+        for (const method of ['HEAD', 'GET']) {
+            let res;
+            try {
+                res = await client.send({ ip, method, path: manifestPath, headers: { Accept: DEPLOYER_PARITY_MANIFEST_ACCEPT } }, pullScope);
+            }
+            catch {
+                continue;
+            }
+            if (res.status !== 200)
+                continue;
+            const served = header(res, 'docker-content-digest');
+            if (served && /^sha256:[0-9a-f]{64}$/.test(served))
+                return served;
+        }
+    }
+    return null;
+}
+/**
+ * Decide the digest to ATTEST (and to feed the fan-out): the digest Harbor
+ * SERVES for `<repo>:<tag>`, resolved the same way the deployer does. Falls back
+ * to the local `docker push` summary digest ONLY if the registry can't be probed
+ * (offline / dev registry / transient) — a fail-SOFT, never a fail-open, because
+ * the deployer independently re-verifies the served digest against the attested
+ * one before it pins the pod.
+ *
+ * See {@link resolveRegistryDigest} for why the served digest — not the push
+ * summary — is authoritative for the #1445 strict-equality gate (issue #1589).
+ */
+async function resolveAttestationDigest(opts) {
+    const log = opts.log ?? (() => undefined);
+    const host = opts.registry.server.replace(/^https?:\/\//, '').replace(/:\d+$/, '');
+    let served = null;
+    try {
+        served = await resolveRegistryDigest({
+            host,
+            repository: opts.registry.repository,
+            tag: opts.tag,
+            username: opts.registry.username,
+            password: opts.registry.password,
+            transport: opts.transport,
+            resolve4: opts.resolve4,
+        });
+    }
+    catch (err) {
+        log(`  attest: registry digest probe threw (${err.message}); ` +
+            'attesting the local push digest');
+    }
+    if (!served) {
+        log(`  attest: could not resolve the registry-served digest for ${opts.registry.repository}:${opts.tag}; ` +
+            'attesting the local push digest (the deployer re-verifies)');
+        return opts.pushDigest;
+    }
+    if (served !== opts.pushDigest) {
+        log(`  attest: registry serves ${served} for ${opts.registry.repository}:${opts.tag} ` +
+            `(local push reported ${opts.pushDigest}); attesting the registry-served digest`);
+    }
+    return served;
+}
+/**
+ * The deploy-time entrypoint: take an image just pushed to the federated host
+ * (landed on ONE cluster) and guarantee it is present on EVERY cluster Harbor.
+ *
+ * Resolves the registry host's A-records into the cluster-ingress set, then:
+ *   - 0/1 endpoint (a non-federated or local/dev registry, or DNS that doesn't
+ *     fan out) → nothing to distribute; returns `null`.
+ *   - ≥2 endpoints → {@link ensureImageOnClusters}, which copies + re-verifies
+ *     and THROWS if any cluster ends up not serving the pushed digest.
+ *
+ * A DNS resolution failure is treated as "single-target" (logged, returns
+ * `null`) rather than fatal: a real federated push has already proven the host
+ * resolves, so a failure here means a dev/local registry where fan-out is moot.
+ */
+async function fanOutPushedImage(opts) {
+    const log = opts.log ?? (() => undefined);
+    const host = opts.registry.server.replace(/^https?:\/\//, '').replace(/:\d+$/, '');
+    let endpoints;
+    try {
+        endpoints = await resolveClusterEndpoints(host, opts.resolve4);
+    }
+    catch (err) {
+        log(`  distribute: ${host} did not resolve (${err.message}); single-target, skipping fan-out`);
+        return null;
+    }
+    if (endpoints.length <= 1) {
+        log(`  distribute: ${host} resolves to ${endpoints.length} endpoint(s); single-target, skipping fan-out`);
+        return null;
+    }
+    log(`  distribute: fanning ${opts.registry.repository}:${opts.tag} to ${endpoints.length} clusters (${endpoints.join(', ')})`);
+    const report = await ensureImageOnClusters({
+        host,
+        repository: opts.registry.repository,
+        tag: opts.tag,
+        digest: opts.digest,
+        username: opts.registry.username,
+        password: opts.registry.password,
+        endpoints,
+        transport: opts.transport,
+    });
+    for (const t of report.targets) {
+        log(`  distribute: ${t.ip} → ${t.outcome}${t.error ? ` (${t.error})` : ''}`);
+    }
+    return report;
+}
+//# sourceMappingURL=registry-fanout.js.map

package/dist/_lib/registry-fanout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-fanout.js","sourceRoot":"","sources":["../../src/_lib/registry-fanout.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwIA,gDAgBC;AAOD,0DAMC;AAOD,4CA6BC;AA8HD,sDA8FC;AAsHD,sDA8BC;AAkCD,4DAoCC;AA6BD,8CAiCC;AA7rBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,6CAA+B;AAC/B,mCAAgC;AAChC,6BAAsC;AAEtC,wFAAwF;AACxF,MAAM,mBAAmB,GAAG;IAC1B,2DAA2D;IAC3D,yCAAyC;CAC1C,CAAC;AAEF,gGAAgG;AAChG,MAAM,eAAe,GAAG;IACtB,sDAAsD;IACtD,4CAA4C;IAC5C,+EAA+E;IAC/E,qEAAqE;IACrE,GAAG,mBAAmB;CACvB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb;;;;;;;;;GASG;AACH,MAAM,+BAA+B,GAAG;IACtC,yCAAyC;IACzC,4CAA4C;IAC5C,sDAAsD;IACtD,2DAA2D;CAC5D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAmDb;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,eAAuB;IACxD,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,iFAAiF;IACjF,MAAM,EAAE,GAAG,4BAA4B,CAAC;IACxC,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACtC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,MAAM,GAAkB,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;IACnD,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;QAAE,MAAM,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC5D,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IACtD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,uBAAuB,CAC3C,IAAY,EACZ,WAA6C,CAAC,CAAC,EAAE,EAAE,CAAC,cAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEnE,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,SAAgB,gBAAgB,CAAC,IAAY;IAC3C,OAAO,CAAC,GAAG,EAAE,EAAE,CACb,IAAI,OAAO,CAAmB,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;QACvD,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CACrB;YACE,IAAI,EAAE,GAAG,CAAC,EAAE;YACZ,UAAU,EAAE,IAAI,EAAE,+BAA+B;YACjD,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,kBAAkB,EAAE,IAAI;YACxB,OAAO,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;SAChD,EACD,CAAC,GAAG,EAAE,EAAE;YACN,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CACjB,cAAc,CAAC;gBACb,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC;gBAC3B,OAAO,EAAE,gBAAgB,CAAC,GAAG,CAAC,OAAwD,CAAC;gBACvF,IAAI,EAAE,eAAM,CAAC,MAAM,CAAC,MAAM,CAAC;aAC5B,CAAC,CACH,CAAC;QACJ,CAAC,CACF,CAAC;QACF,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACtB,IAAI,GAAG,CAAC,IAAI;YAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC,CAAC,GAAG,EAAE,CAAC;IACV,CAAC,CAAC,CAAC;AACP,CAAC;AAED,wEAAwE;AACxE,SAAS,gBAAgB,CAAC,CAAgD;IACxE,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oCAAoC;AACpC,SAAS,MAAM,CAAC,GAAwC,EAAE,IAAY;IACpE,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK;YAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,kFAAkF;AAClF,SAAS,YAAY,CAAC,QAAgB;IACpC,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACtE,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5B,OAAO,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAKD;;;;;GAKG;AACH,SAAS,UAAU,CACjB,SAA4B,EAC5B,QAAgB,EAChB,QAAgB;IAEhB,MAAM,MAAM,GAAe,IAAI,GAAG,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,QAAQ,GAAG,eAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAEnF,KAAK,UAAU,UAAU,CAAC,EAAU,EAAE,KAAa,EAAE,OAAgB,EAAE,KAAc;QACnF,MAAM,GAAG,GAAG,GAAG,EAAE,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,OAAO;YAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,KAAK;YAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC;YAC1B,EAAE;YACF,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,MAAM;YAC3B,OAAO,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE;SAClC,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,oBAAoB,EAAE,KAAK,KAAK,kBAAkB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA8C,CAAC;QAClG,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,YAAY,CAAC;QAClD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,CAAC;QACxE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACvB,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,KAAK,UAAU,IAAI,CAAC,GAAoB,EAAE,SAAkB;QAC1D,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,GAAG,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/D,IAAI,CAAC,SAAS;YAAE,OAAO,GAAG,CAAC,CAAC,wCAAwC;QACpE,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,CAAC;QACzG,OAAO,SAAS,CAAC;YACf,GAAG,GAAG;YACN,OAAO,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SACtE,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,CAAC;AAClB,CAAC;AAQD;;;GAGG;AACH,SAAS,aAAa,CAAC,KAAa,EAAE,WAAoB;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAI5C,CAAC;IACF,MAAM,SAAS,GAAG,WAAW,IAAI,GAAG,CAAC,SAAS,CAAC;IAC/C,IAAI,SAAS,IAAI,mBAAmB,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CACb,yEAAyE,SAAS,KAAK;YACrF,uGAAuG,CAC1G,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,qBAAqB,CAAC,IAAqB;IAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnE,MAAM,aAAa,GAAG,cAAc,IAAI,CAAC,UAAU,YAAY,CAAC;IAChE,MAAM,YAAY,GAAG,OAAO,IAAI,CAAC,UAAU,cAAc,IAAI,CAAC,GAAG,EAAE,CAAC;IAEpE,sDAAsD;IACtD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QAC9B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAC3B,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,EAChF,aAAa,CACd,CAAC;QACF,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrF,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;IACjD,CAAC,CAAC,CACH,CAAC;IAEF,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,8BAA8B,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,KAAK;YAC3E,oFAAoF,CACvF,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,4EAA4E;IAC5E,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,SAAkB,EAAE,CAAC,CAAC,EAAE,CAAC;IACvF,CAAC;IAED,iEAAiE;IACjE,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,IAAI,CACtC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,EAC1F,aAAa,CACd,CAAC;IACF,IAAI,cAAc,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,uCAAuC,MAAM,CAAC,EAAE,UAAU,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;IACrG,CAAC;IACD,MAAM,mBAAmB,GAAG,MAAM,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,aAAa,CAAC,cAAc,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC,CAAC,0BAA0B;IAClG,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAElF,yCAAyC;IACzC,MAAM,MAAM,GAAiB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YACd,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YACtD,SAAS;QACX,CAAC;QACD,MAAM,UAAU,CAAC;YACf,MAAM;YACN,MAAM,EAAE,MAAM,CAAC,EAAE;YACjB,IAAI,EAAE,CAAC,CAAC,EAAE;YACV,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,aAAa;YACb,WAAW;YACX,aAAa,EAAE,cAAc,CAAC,IAAI;YAClC,mBAAmB;YACnB,YAAY;SACb,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,iEAAiE;IACjE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,CAAC,GAAG,CACf,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QAC9B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAC3B,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,EAChF,aAAa,CACd,CAAC;QACF,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrF,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClB,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAClD,IAAI,CAAC,EAAE,CAAC;gBACN,CAAC,CAAC,OAAO,GAAG,QAAQ,CAAC;gBACrB,CAAC,CAAC,KAAK,GAAG,4BAA4B,MAAM,IAAI,QAAQ,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YAChF,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IAEF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,6BAA6B,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB;YACrE,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,+BAA+B,CAC/E,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+FAA+F;AAC/F,KAAK,UAAU,UAAU,CAAC,IAWzB;IACC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IAEjE,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACtC,sEAAsE;QACtE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAC5B,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,UAAU,UAAU,MAAM,EAAE,EAAE,EACvE,aAAa,CACd,CAAC;QACF,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;YAAE,SAAS;QAElC,wCAAwC;QACxC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAC5B,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,UAAU,UAAU,MAAM,EAAE,EAAE,EACxE,aAAa,CACd,CAAC;QACF,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,wBAAwB,MAAM,gBAAgB,MAAM,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/F,CAAC;QAED,8EAA8E;QAC9E,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAC7B,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,UAAU,iBAAiB,EAAE,EACtE,aAAa,CACd,CAAC;QACF,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,UAAU,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,uBAAuB,CAAC,CAAC;QAC9E,MAAM,OAAO,GAAG,iBAAiB,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAC3B;YACE,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;YACvD,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,EACD,aAAa,CACd,CAAC;QACF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,OAAO,IAAI,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAED,2FAA2F;IAC3F,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,IAAI,IAAI,CAAC,mBAAmB;QAAE,OAAO,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,mBAAmB,CAAC;IACjF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAC3B,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,EACvF,aAAa,CACd,CAAC;IACF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,SAAS,iBAAiB,CAAC,IAAY,EAAE,MAAc;IACrD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAC3C,OAAO,GAAG,IAAI,GAAG,GAAG,UAAU,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;AAC7D,CAAC;AAkBD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACI,KAAK,UAAU,qBAAqB,CACzC,IAA+B;IAE/B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAC7E,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAClB,CAAC;IACF,uEAAuE;IACvE,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,cAAc,IAAI,CAAC,UAAU,OAAO,CAAC;IACvD,MAAM,YAAY,GAAG,OAAO,IAAI,CAAC,UAAU,cAAc,IAAI,CAAC,GAAG,EAAE,CAAC;IACpE,KAAK,MAAM,EAAE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChE,KAAK,MAAM,MAAM,IAAI,CAAC,MAAM,EAAE,KAAK,CAAU,EAAE,CAAC;YAC9C,IAAI,GAAqB,CAAC;YAC1B,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CACrB,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,+BAA+B,EAAE,EAAE,EACxF,SAAS,CACV,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,SAAS;YACjC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;YACpD,IAAI,MAAM,IAAI,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,OAAO,MAAM,CAAC;QACpE,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAuBD;;;;;;;;;;GAUG;AACI,KAAK,UAAU,wBAAwB,CAC5C,IAAkC;IAElC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACnF,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,qBAAqB,CAAC;YACnC,IAAI;YACJ,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU;YACpC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;YAChC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;YAChC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CACD,0CAA2C,GAAa,CAAC,OAAO,KAAK;YACnE,iCAAiC,CACpC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,GAAG,CACD,8DAA8D,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI;YACpG,4DAA4D,CAC/D,CAAC;QACF,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/B,GAAG,CACD,6BAA6B,MAAM,QAAQ,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,GAAG;YAChF,wBAAwB,IAAI,CAAC,UAAU,yCAAyC,CACnF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAeD;;;;;;;;;;;;;GAaG;AACI,KAAK,UAAU,iBAAiB,CACrC,IAA2B;IAE3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAEnF,IAAI,SAAmB,CAAC;IACxB,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,uBAAuB,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,iBAAiB,IAAI,qBAAsB,GAAa,CAAC,OAAO,oCAAoC,CAAC,CAAC;QAC1G,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QAC1B,GAAG,CAAC,iBAAiB,IAAI,gBAAgB,SAAS,CAAC,MAAM,+CAA+C,CAAC,CAAC;QAC1G,OAAO,IAAI,CAAC;IACd,CAAC;IAED,GAAG,CAAC,yBAAyB,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,OAAO,SAAS,CAAC,MAAM,cAAc,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/H,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC;QACzC,IAAI;QACJ,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU;QACpC,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;QAChC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;QAChC,SAAS;QACT,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CAAC;IACH,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/B,GAAG,CAAC,iBAAiB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}