@knowzai/cli 0.3.0 → 0.5.0

package/dist/lib/selfhosted-backup.js

@@ -0,0 +1,446 @@
+import { preserveLegacySelfHostedKeyring } from './selfhosted-keyring.js';
+import { assertLocalEngineContext, readSavedLocalEngine } from './local-engine-context.js';
+import { acquireRuntimeLock } from './runtime-lock.js';
+import { withAnonymousRegistry } from './anonymous-registry.js';
+import { copyFileSync, existsSync, readFileSync, rmSync, statSync, writeFileSync, createReadStream, } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { dirname, join, resolve } from 'node:path';
+import { KnowzError, ExitCode, ensurePrivateDirectory, protectPrivatePath } from '@knowzai/core';
+import { createPrivateStaging, encryptStream, finalizePrivateArchive, executeBackupSteps, } from './platform-backup.js';
+import { SELFHOSTED_BACKUP_ARTIFACTS, withRuntimeBackup } from './runtime-backup-archive.js';
+import { resolvePackagedSelfHostedAssetsDir, resolveSelfHostedReleaseContract, } from './selfhosted-lifecycle.js';
+import { parseEnv, writePrivateFile, validateProjectName, validatePort, redactPlatformSecrets, } from './platform-runtime.js';
+const warning = 'This private backup contains knowledge, file data, user credentials, runtime secrets and the provider encryption keyring. Store it securely; use --encrypt for passphrase protection.';
+function runtime(input) {
+    validateProjectName(input.projectName);
+    if (!input.engine?.daemonReachable ||
+        !input.engine.composeFront ||
+        input.engine.engine === 'none')
+        throw new KnowzError('Start Docker Desktop or Podman with Compose before backup/restore.', ExitCode.Usage);
+    return input.engine;
+}
+function invocation(input, args, compose = true) {
+    const engine = runtime(input);
+    const front = engine.composeFront;
+    return {
+        command: compose ? front.command : engine.engine,
+        args: compose
+            ? [
+                ...front.baseArgs,
+                '--project-name',
+                `knowz-selfhosted-${input.projectName}`,
+                '--file',
+                input.paths.composeFile,
+                '--env-file',
+                input.paths.envFile,
+                ...args,
+            ]
+            : args,
+        options: {
+            cwd: existsSync(input.paths.runtimeDir) ? input.paths.runtimeDir : process.cwd(),
+            shell: false,
+            ...(front.env ? { env: front.env } : {}),
+        },
+    };
+}
+async function run(input, args, description, compose = true, secrets = []) {
+    const call = invocation(input, args, compose);
+    const result = !compose && args[0] === 'run' && args.includes('alpine:3.21')
+        ? await withAnonymousRegistry(call.options.env, async (env) => input.runner(call.command, call.args, { ...call.options, env }))
+        : await input.runner(call.command, call.args, call.options);
+    if (result.status !== 0)
+        throw new KnowzError(`${description} failed: ${redactPlatformSecrets(result.stderr || result.error?.message || 'container command failed', secrets)}`, ExitCode.Generic);
+    return result;
+}
+function release(version) {
+    const catalog = JSON.parse(readFileSync(join(resolvePackagedSelfHostedAssetsDir(), 'releases.json'), 'utf8'));
+    const contract = resolveSelfHostedReleaseContract(JSON.stringify(catalog), version);
+    if (contract.runtime.database !== 'postgres')
+        throw new KnowzError('Legacy MSSQL backup/restore is unsupported by this PostgreSQL adapter. Use the matching legacy tools; never restore SQL backups into PostgreSQL.', ExitCode.Usage);
+    return { contract, digests: catalog.releases.find((x) => x.version === version)?.digests ?? {} };
+}
+async function sha(path) {
+    const hash = createHash('sha256');
+    for await (const chunk of createReadStream(path))
+        hash.update(chunk);
+    return 'sha256:' + hash.digest('hex');
+}
+export async function runSelfHostedBackup(input) {
+    const state = JSON.parse(readFileSync(input.paths.stateFile, 'utf8'));
+    const metadata = release(state.version);
+    if (state.edition !== 'selfhosted' || state.name !== input.projectName)
+        throw new KnowzError('Runtime identity does not match selfhosted backup target.', ExitCode.Usage);
+    const env = parseEnv(readFileSync(input.paths.envFile, 'utf8'));
+    if (env.KNOWZ_SELFHOSTED_VERSION !== state.version)
+        throw new KnowzError('Runtime version and environment disagree; repair setup before backup.', ExitCode.Usage);
+    if (input.encrypt && !input.passphrase)
+        throw new KnowzError('A passphrase is required for --encrypt.', ExitCode.Auth);
+    const secrets = Object.entries(env)
+        .filter(([key]) => /password|secret|key|token/i.test(key))
+        .map(([, value]) => value)
+        .filter(Boolean);
+    const filename = `knowz-selfhosted-backup-${input.projectName}-${new Date().toISOString().replace(/[:.]/g, '-')}.tar.gz${input.encrypt ? '.enc' : ''}`;
+    let destination = resolve(input.out ?? filename);
+    if (existsSync(destination) && statSync(destination).isDirectory())
+        destination = join(destination, filename);
+    if (input.encrypt && !destination.endsWith('.enc'))
+        destination += '.enc';
+    if (existsSync(destination))
+        throw new KnowzError('Refusing to overwrite an existing backup.', ExitCode.Usage);
+    if (!existsSync(dirname(destination)))
+        throw new KnowzError('Backup destination directory does not exist.', ExitCode.Usage);
+    input = {
+        ...input,
+        engine: await assertLocalEngineContext(runtime(input), {
+            runner: input.runner,
+            savedEngine: readSavedLocalEngine(input.paths.stateFile),
+        }),
+    };
+    const unlock = acquireRuntimeLock(input.paths.runtimeDir);
+    try {
+        const staging = createPrivateStaging(input.paths.runtimeDir);
+        const plain = join(staging, 'result.tar.gz');
+        let writers = [];
+        let startedDb = false;
+        let attemptedDump = false;
+        let result;
+        let failure;
+        try {
+            for (const dir of ['pg', 'volumes', 'runtime'])
+                ensurePrivateDirectory(join(staging, dir));
+            const status = await run(input, ['ps', '--services', '--status', 'running'], 'inspect runtime', true, secrets);
+            const running = (status.stdout ?? '').trim().split(/\s+/);
+            const enabledServices = [
+                'db',
+                'api',
+                'web',
+                ...(state.components?.mcp === false ? [] : ['mcp']),
+            ];
+            const observedImages = {};
+            for (const service of enabledServices) {
+                const listed = await run(input, ['ps', '--all', '--quiet', service], `inspect ${service} identity`, true, secrets);
+                const id = (listed.stdout ?? '').trim();
+                if (!id)
+                    continue;
+                if (!/^[a-f0-9]{12,64}$/.test(id))
+                    throw new KnowzError('Ambiguous container identity; backup refused.', ExitCode.Usage);
+                const inspected = await run(input, ['inspect', id, '--format', '{"id":{{json .Image}},"reference":{{json .Config.Image}}}'], `inspect ${service} image`, false, secrets);
+                try {
+                    const image = JSON.parse(inspected.stdout ?? '');
+                    if (typeof image.id !== 'string' ||
+                        !/^sha256:[a-f0-9]{64}$/.test(image.id) ||
+                        typeof image.reference !== 'string' ||
+                        !/^[A-Za-z0-9][A-Za-z0-9./:@_-]+$/.test(image.reference))
+                        throw new Error();
+                    observedImages[service] = { id: image.id, reference: image.reference };
+                }
+                catch {
+                    throw new KnowzError('Cannot validate observed container image metadata; backup refused.', ExitCode.Usage);
+                }
+            }
+            writers = running.filter((x) => ['api', 'mcp'].includes(x));
+            if (writers.length)
+                await run(input, ['stop', ...writers], 'pause writers for consistent snapshot', true, secrets);
+            await preserveLegacySelfHostedKeyring({
+                name: input.projectName,
+                paths: input.paths,
+                engine: input.engine,
+                runner: input.runner,
+            });
+            if (!running.includes('db')) {
+                startedDb = true;
+                await run(input, ['up', '--detach', '--wait', 'db'], 'start database', true, secrets);
+            }
+            attemptedDump = true;
+            await run(input, [
+                'exec',
+                '-T',
+                'db',
+                'pg_dump',
+                '-U',
+                'knowz',
+                '-Fc',
+                '-f',
+                '/tmp/knowz-backup.dump',
+                'knowz_selfhosted',
+            ], 'dump selfhosted PostgreSQL', true, secrets);
+            await run(input, ['cp', 'db:/tmp/knowz-backup.dump', join(staging, 'pg/knowz_selfhosted.dump')], 'copy logical dump', true, secrets);
+            await run(input, ['exec', '-T', 'db', 'rm', '-f', '/tmp/knowz-backup.dump'], 'remove container dump', true, secrets);
+            for (const volume of ['knowz-file-storage', 'knowz-protected-keys'])
+                await run(input, [
+                    'run',
+                    '--rm',
+                    '-v',
+                    `knowz-selfhosted-${input.projectName}_${volume}:/src:ro`,
+                    '-v',
+                    `${staging}:/out`,
+                    'alpine:3.21',
+                    'tar',
+                    '-czf',
+                    `/out/volumes/${volume}.tar.gz`,
+                    '-C',
+                    '/src',
+                    '.',
+                ], `snapshot ${volume}`, false, secrets);
+            writePrivateFile(join(staging, 'runtime/.env'), readFileSync(input.paths.envFile, 'utf8'));
+            writePrivateFile(join(staging, 'runtime/state.json'), readFileSync(input.paths.stateFile, 'utf8'));
+            const checksums = {};
+            const sizes = {};
+            for (const file of SELFHOSTED_BACKUP_ARTIFACTS) {
+                checksums[file] = await sha(join(staging, file));
+                sizes[file] = statSync(join(staging, file)).size;
+            }
+            const manifest = {
+                formatVersion: 2,
+                schemaVersion: 2,
+                edition: 'selfhosted',
+                database: {
+                    engine: 'postgres',
+                    version: '16',
+                    schemaVersion: 'unknown',
+                    schemaVersionSource: 'not-observed',
+                },
+                runtime: {
+                    release: state.version,
+                    imageDigests: metadata.digests,
+                    imageDigestSource: 'release-catalog',
+                    enabledServices,
+                    observedImages,
+                },
+                platformName: input.projectName,
+                createdAt: new Date().toISOString(),
+                cliVersion: input.cliVersion,
+                encrypted: input.encrypt,
+                keyMaterial: 'runtime secrets and protected provider keyring included',
+                checksums,
+                sizes,
+            };
+            writeFileSync(join(staging, 'manifest.json'), JSON.stringify(manifest, null, 2) + '\n', {
+                mode: 0o600,
+            });
+            await executeBackupSteps([
+                {
+                    kind: 'fs',
+                    description: 'create selfhosted archive',
+                    invocation: {
+                        command: 'tar',
+                        args: [
+                            '--format=ustar',
+                            '-czf',
+                            plain,
+                            '-C',
+                            staging,
+                            'manifest.json',
+                            ...SELFHOSTED_BACKUP_ARTIFACTS,
+                        ],
+                        options: { cwd: staging, shell: false, env: { COPYFILE_DISABLE: '1' } },
+                    },
+                },
+            ], input.runner, secrets);
+            protectPrivatePath(plain);
+            if (input.encrypt)
+                await encryptStream(plain, destination, input.passphrase);
+            else
+                finalizePrivateArchive(plain, destination);
+            result = { archive: destination, encrypted: input.encrypt, warning };
+        }
+        catch (error) {
+            failure = error;
+        }
+        finally {
+            if (attemptedDump) {
+                try {
+                    await run(input, ['exec', '-T', 'db', 'rm', '-f', '/tmp/knowz-backup.dump'], 'remove any partial database dump', true, secrets);
+                }
+                catch {
+                    /* Preserve primary failure; original service state still needs recovery. */
+                }
+            }
+            try {
+                if (startedDb)
+                    await run(input, ['stop', 'db'], 'restore original stopped database state', true, secrets);
+                if (writers.length)
+                    await run(input, ['start', ...writers], 'resume original runtime writers', true, secrets);
+            }
+            catch (error) {
+                failure ??= error;
+            }
+            rmSync(staging, { recursive: true, force: true });
+        }
+        if (failure)
+            throw failure;
+        input.emit?.(warning);
+        return result;
+    }
+    finally {
+        unlock();
+    }
+}
+export async function runSelfHostedRestore(input) {
+    if (!input.yes && !input.isTty)
+        throw new KnowzError('Refusing restore without --yes in a non-interactive session.', ExitCode.Usage);
+    return withRuntimeBackup(input, async (backup, extracted) => {
+        const manifest = backup.manifest;
+        const database = manifest.database;
+        const recorded = manifest.runtime;
+        if (backup.edition !== 'selfhosted' ||
+            database?.engine !== 'postgres' ||
+            database?.version !== '16' ||
+            !recorded?.release)
+            throw new KnowzError('Cross-edition or incompatible database restore refused.', ExitCode.Usage);
+        const metadata = release(recorded.release);
+        const state = JSON.parse(readFileSync(join(extracted, 'runtime/state.json'), 'utf8'));
+        if (state.edition !== 'selfhosted' || state.version !== recorded.release)
+            throw new KnowzError('Archive state does not match its release/edition manifest.', ExitCode.Usage);
+        for (const port of Object.values(state.ports ?? {}))
+            validatePort(port);
+        if (!state.ports?.api || !state.ports.web || !state.ports.mcp)
+            throw new KnowzError('Archive runtime ports are invalid.', ExitCode.Usage);
+        const archivedEnv = readFileSync(join(extracted, 'runtime/.env'), 'utf8');
+        const env = parseEnv(archivedEnv);
+        if (env.KNOWZ_SELFHOSTED_VERSION !== state.version)
+            throw new KnowzError('Archive environment version is inconsistent.', ExitCode.Usage);
+        const occupied = existsSync(input.paths.runtimeDir);
+        if (occupied && !input.replaceExisting)
+            throw new KnowzError('Restore target is occupied. Restore into a new --name or stop it and explicitly use --replace-installation.', ExitCode.Usage);
+        if (occupied && existsSync(input.paths.stateFile)) {
+            const previous = JSON.parse(readFileSync(input.paths.stateFile, 'utf8'));
+            if (previous.edition !== 'selfhosted' || previous.version !== state.version)
+                throw new KnowzError('Replacing a different edition or database release is refused. Restore to a fresh isolated --name; do not downgrade an occupied database.', ExitCode.Usage);
+        }
+        input = {
+            ...input,
+            engine: await assertLocalEngineContext(runtime(input), {
+                runner: input.runner,
+                savedEngine: readSavedLocalEngine(input.paths.stateFile),
+            }),
+        };
+        const active = await run(input, [
+            'ps',
+            '--filter',
+            `label=com.docker.compose.project=knowz-selfhosted-${input.projectName}`,
+            '--format',
+            '{{.Names}}',
+        ], 'inspect target containers', false);
+        if (active.stdout?.trim())
+            throw new KnowzError('Target runtime is running; run knowz down first.', ExitCode.Usage);
+        const volumes = await run(input, [
+            'volume',
+            'ls',
+            '--filter',
+            `label=com.docker.compose.project=knowz-selfhosted-${input.projectName}`,
+            '--format',
+            '{{.Name}}',
+        ], 'inspect existing target volumes', false);
+        if (volumes.stdout?.trim() && !input.replaceExisting)
+            throw new KnowzError('Target has occupied runtime volumes; choose a new name or use --replace-installation.', ExitCode.Usage);
+        if (!input.yes && (await input.confirmName?.()) !== input.projectName)
+            throw new KnowzError('Restore confirmation did not match the runtime name.', ExitCode.Usage);
+        const unlock = acquireRuntimeLock(input.paths.runtimeDir);
+        try {
+            if (!occupied && (existsSync(input.paths.stateFile) || existsSync(input.paths.envFile)))
+                throw new KnowzError('Restore target changed during validation; retry with a new name.', ExitCode.Usage);
+            if (existsSync(input.paths.stateFile)) {
+                const current = JSON.parse(readFileSync(input.paths.stateFile, 'utf8'));
+                if (current.edition !== 'selfhosted' || current.version !== state.version)
+                    throw new KnowzError('Target identity changed during restore validation.', ExitCode.Usage);
+            }
+            input = {
+                ...input,
+                engine: await assertLocalEngineContext(runtime(input), {
+                    runner: input.runner,
+                    savedEngine: readSavedLocalEngine(input.paths.stateFile),
+                }),
+            };
+            const activeUnderLease = await run(input, [
+                'ps',
+                '--filter',
+                `label=com.docker.compose.project=knowz-selfhosted-${input.projectName}`,
+                '--format',
+                '{{.Names}}',
+            ], 'recheck stopped target under restore lock', false);
+            if (activeUnderLease.stdout?.trim())
+                throw new KnowzError('Target runtime is now running; stop it and retry restore.', ExitCode.Usage);
+            const volumesUnderLease = await run(input, [
+                'volume',
+                'ls',
+                '--filter',
+                `label=com.docker.compose.project=knowz-selfhosted-${input.projectName}`,
+                '--format',
+                '{{.Name}}',
+            ], 'recheck target volumes under restore lock', false);
+            if (volumesUnderLease.stdout?.trim() && !input.replaceExisting)
+                throw new KnowzError('Target acquired volumes during restore validation; select a fresh target.', ExitCode.Usage);
+            // Only the packaged reviewed compose contract is executed. Archive compose files are never executed.
+            ensurePrivateDirectory(input.paths.runtimeDir);
+            writePrivateFile(input.paths.envFile, archivedEnv);
+            copyFileSync(join(resolvePackagedSelfHostedAssetsDir(), metadata.contract.runtime.composeAsset), input.paths.composeFile);
+            const secrets = Object.entries(env)
+                .filter(([key]) => /password|secret|key|token/i.test(key))
+                .map(([, value]) => value)
+                .filter(Boolean);
+            let started = false;
+            try {
+                if (input.replaceExisting)
+                    await run(input, ['down', '--volumes', '--remove-orphans'], 'remove explicitly selected stopped runtime', true, secrets);
+                await run(input, ['up', '--detach', '--wait', 'db'], 'start restore database', true, secrets);
+                started = true;
+                await run(input, ['cp', join(extracted, 'pg/knowz_selfhosted.dump'), 'db:/tmp/knowz-restore.dump'], 'copy restore dump', true, secrets);
+                await run(input, [
+                    'exec',
+                    '-T',
+                    'db',
+                    'pg_restore',
+                    '--exit-on-error',
+                    '--clean',
+                    '--if-exists',
+                    '--no-owner',
+                    '-U',
+                    'knowz',
+                    '-d',
+                    'knowz_selfhosted',
+                    '/tmp/knowz-restore.dump',
+                ], 'restore PostgreSQL', true, secrets);
+                await run(input, ['exec', '-T', 'db', 'rm', '-f', '/tmp/knowz-restore.dump'], 'remove restore dump', true, secrets);
+                for (const volume of ['knowz-file-storage', 'knowz-protected-keys'])
+                    await run(input, [
+                        'run',
+                        '--rm',
+                        '-v',
+                        `knowz-selfhosted-${input.projectName}_${volume}:/dst`,
+                        '-v',
+                        `${extracted}:/in:ro`,
+                        'alpine:3.21',
+                        'sh',
+                        '-c',
+                        `tar -xzf /in/volumes/${volume}.tar.gz --no-same-owner -C /dst && chown -R 1654:1654 /dst`,
+                    ], `restore ${volume}`, false, secrets);
+                writePrivateFile(input.paths.stateFile, JSON.stringify({
+                    ...state,
+                    name: input.projectName,
+                    engine: input.engine,
+                    healthPassed: false,
+                    restoredAt: new Date().toISOString(),
+                    updatedAt: new Date().toISOString(),
+                }, null, 2) + '\n');
+            }
+            finally {
+                if (started)
+                    await run(input, ['stop', 'db'], 'leave restored runtime stopped', true, secrets);
+            }
+            return {
+                edition: 'selfhosted',
+                version: state.version,
+                platformName: input.projectName,
+                integrityChecked: true,
+                healthPassed: false,
+                next: `knowz up --edition selfhosted --name ${input.projectName}`,
+                warning: 'Runtime restored and left stopped. Start it, verify login and file hashes, then verify provider readiness.',
+            };
+        }
+        finally {
+            unlock();
+        }
+    });
+}
+//# sourceMappingURL=selfhosted-backup.js.map

package/dist/lib/selfhosted-backup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"selfhosted-backup.js","sourceRoot":"","sources":["../../src/lib/selfhosted-backup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAC3F,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EACL,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,MAAM,EACN,QAAQ,EACR,aAAa,EACb,gBAAgB,GACjB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACjG,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,sBAAsB,EACtB,kBAAkB,GAEnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAC7F,OAAO,EACL,kCAAkC,EAClC,gCAAgC,GACjC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,QAAQ,EACR,gBAAgB,EAChB,mBAAmB,EACnB,YAAY,EACZ,qBAAqB,GAItB,MAAM,uBAAuB,CAAC;AAS/B,MAAM,OAAO,GACX,uLAAuL,CAAC;AAC1L,SAAS,OAAO,CAAC,KAAmB;IAClC,mBAAmB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACvC,IACE,CAAC,KAAK,CAAC,MAAM,EAAE,eAAe;QAC9B,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY;QAC1B,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM;QAE9B,MAAM,IAAI,UAAU,CAClB,oEAAoE,EACpE,QAAQ,CAAC,KAAK,CACf,CAAC;IACJ,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AACD,SAAS,UAAU,CAAC,KAAmB,EAAE,IAAc,EAAE,OAAO,GAAG,IAAI;IACrE,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,YAAa,CAAC;IACnC,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM;QAChD,IAAI,EAAE,OAAO;YACX,CAAC,CAAC;gBACE,GAAG,KAAK,CAAC,QAAQ;gBACjB,gBAAgB;gBAChB,oBAAoB,KAAK,CAAC,WAAW,EAAE;gBACvC,QAAQ;gBACR,KAAK,CAAC,KAAK,CAAC,WAAW;gBACvB,YAAY;gBACZ,KAAK,CAAC,KAAK,CAAC,OAAO;gBACnB,GAAG,IAAI;aACR;YACH,CAAC,CAAC,IAAI;QACR,OAAO,EAAE;YACP,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YAChF,KAAK,EAAE,KAAK;YACZ,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzC;KACF,CAAC;AACJ,CAAC;AACD,KAAK,UAAU,GAAG,CAChB,KAAmB,EACnB,IAAc,EACd,WAAmB,EACnB,OAAO,GAAG,IAAI,EACd,UAAoB,EAAE;IAEtB,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC9C,MAAM,MAAM,GACV,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC3D,CAAC,CAAC,MAAM,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAC1D,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAChE;QACH,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAChE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QACrB,MAAM,IAAI,UAAU,CAClB,GAAG,WAAW,YAAY,qBAAqB,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,EAAE,OAAO,IAAI,0BAA0B,EAAE,OAAO,CAAC,EAAE,EAChI,QAAQ,CAAC,OAAO,CACjB,CAAC;IACJ,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,SAAS,OAAO,CAAC,OAAe;IAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,YAAY,CAAC,IAAI,CAAC,kCAAkC,EAAE,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CACJ,CAAC;IAChF,MAAM,QAAQ,GAAG,gCAAgC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;IACpF,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,KAAK,UAAU;QAC1C,MAAM,IAAI,UAAU,CAClB,kJAAkJ,EAClJ,QAAQ,CAAC,KAAK,CACf,CAAC;IACJ,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;AACnG,CAAC;AACD,KAAK,UAAU,GAAG,CAAC,IAAY;IAC7B,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,gBAAgB,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrE,OAAO,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxC,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAiG;IAEjG,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAKnE,CAAC;IACF,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,KAAK,CAAC,OAAO,KAAK,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,WAAW;QACpE,MAAM,IAAI,UAAU,CAClB,2DAA2D,EAC3D,QAAQ,CAAC,KAAK,CACf,CAAC;IACJ,MAAM,GAAG,GAAG,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IAChE,IAAI,GAAG,CAAC,wBAAwB,KAAK,KAAK,CAAC,OAAO;QAChD,MAAM,IAAI,UAAU,CAClB,uEAAuE,EACvE,QAAQ,CAAC,KAAK,CACf,CAAC;IACJ,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU;QACpC,MAAM,IAAI,UAAU,CAAC,yCAAyC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SAChC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,4BAA4B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;SACzD,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC;SACzB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,QAAQ,GAAG,2BAA2B,KAAK,CAAC,WAAW,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,UAAU,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACvJ,IAAI,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,QAAQ,CAAC,CAAC;IACjD,IAAI,UAAU,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE;QAChE,WAAW,GAAG,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC5C,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,WAAW,IAAI,MAAM,CAAC;IAC1E,IAAI,UAAU,CAAC,WAAW,CAAC;QACzB,MAAM,IAAI,UAAU,CAAC,2CAA2C,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpF,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACnC,MAAM,IAAI,UAAU,CAAC,8CAA8C,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IACvF,KAAK,GAAG;QACN,GAAG,KAAK;QACR,MAAM,EAAE,MAAM,wBAAwB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;YACrD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,WAAW,EAAE,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;SACzD,CAAC;KACH,CAAC;IACF,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC7C,IAAI,OAAO,GAAa,EAAE,CAAC;QAC3B,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,MAA4E,CAAC;QACjF,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,KAAK,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC;gBAC5C,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;YAC7C,MAAM,MAAM,GAAG,MAAM,GAAG,CACtB,KAAK,EACL,CAAC,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,CAAC,EAC3C,iBAAiB,EACjB,IAAI,EACJ,OAAO,CACR,CAAC;YACF,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1D,MAAM,eAAe,GAAG;gBACtB,IAAI;gBACJ,KAAK;gBACL,KAAK;gBACL,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;aACpD,CAAC;YACF,MAAM,cAAc,GAAsD,EAAE,CAAC;YAC7E,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;gBACtC,MAAM,MAAM,GAAG,MAAM,GAAG,CACtB,KAAK,EACL,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,EACnC,WAAW,OAAO,WAAW,EAC7B,IAAI,EACJ,OAAO,CACR,CAAC;gBACF,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBACxC,IAAI,CAAC,EAAE;oBAAE,SAAS;gBAClB,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/B,MAAM,IAAI,UAAU,CAAC,+CAA+C,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;gBACxF,MAAM,SAAS,GAAG,MAAM,GAAG,CACzB,KAAK,EACL,CAAC,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,2DAA2D,CAAC,EACxF,WAAW,OAAO,QAAQ,EAC1B,KAAK,EACL,OAAO,CACR,CAAC;gBACF,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,IAAI,EAAE,CAA0C,CAAC;oBAC1F,IACE,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;wBAC5B,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;wBACvC,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;wBACnC,CAAC,iCAAiC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;wBAExD,MAAM,IAAI,KAAK,EAAE,CAAC;oBACpB,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;gBACzE,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,IAAI,UAAU,CAClB,oEAAoE,EACpE,QAAQ,CAAC,KAAK,CACf,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5D,IAAI,OAAO,CAAC,MAAM;gBAChB,MAAM,GAAG,CACP,KAAK,EACL,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,EACpB,uCAAuC,EACvC,IAAI,EACJ,OAAO,CACR,CAAC;YACJ,MAAM,+BAA+B,CAAC;gBACpC,IAAI,EAAE,KAAK,CAAC,WAAW;gBACvB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAO;gBACrB,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,SAAS,GAAG,IAAI,CAAC;gBACjB,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YACxF,CAAC;YACD,aAAa,GAAG,IAAI,CAAC;YACrB,MAAM,GAAG,CACP,KAAK,EACL;gBACE,MAAM;gBACN,IAAI;gBACJ,IAAI;gBACJ,SAAS;gBACT,IAAI;gBACJ,OAAO;gBACP,KAAK;gBACL,IAAI;gBACJ,wBAAwB;gBACxB,kBAAkB;aACnB,EACD,4BAA4B,EAC5B,IAAI,EACJ,OAAO,CACR,CAAC;YACF,MAAM,GAAG,CACP,KAAK,EACL,CAAC,IAAI,EAAE,2BAA2B,EAAE,IAAI,CAAC,OAAO,EAAE,0BAA0B,CAAC,CAAC,EAC9E,mBAAmB,EACnB,IAAI,EACJ,OAAO,CACR,CAAC;YACF,MAAM,GAAG,CACP,KAAK,EACL,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,wBAAwB,CAAC,EAC1D,uBAAuB,EACvB,IAAI,EACJ,OAAO,CACR,CAAC;YACF,KAAK,MAAM,MAAM,IAAI,CAAC,oBAAoB,EAAE,sBAAsB,CAAC;gBACjE,MAAM,GAAG,CACP,KAAK,EACL;oBACE,KAAK;oBACL,MAAM;oBACN,IAAI;oBACJ,oBAAoB,KAAK,CAAC,WAAW,IAAI,MAAM,UAAU;oBACzD,IAAI;oBACJ,GAAG,OAAO,OAAO;oBACjB,aAAa;oBACb,KAAK;oBACL,MAAM;oBACN,gBAAgB,MAAM,SAAS;oBAC/B,IAAI;oBACJ,MAAM;oBACN,GAAG;iBACJ,EACD,YAAY,MAAM,EAAE,EACpB,KAAK,EACL,OAAO,CACR,CAAC;YACJ,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;YAC3F,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,oBAAoB,CAAC,EAAE,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;YACnG,MAAM,SAAS,GAA2B,EAAE,CAAC;YAC7C,MAAM,KAAK,GAA2B,EAAE,CAAC;YACzC,KAAK,MAAM,IAAI,IAAI,2BAA2B,EAAE,CAAC;gBAC/C,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;gBACjD,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YACnD,CAAC;YACD,MAAM,QAAQ,GAAG;gBACf,aAAa,EAAE,CAAC;gBAChB,aAAa,EAAE,CAAC;gBAChB,OAAO,EAAE,YAAY;gBACrB,QAAQ,EAAE;oBACR,MAAM,EAAE,UAAU;oBAClB,OAAO,EAAE,IAAI;oBACb,aAAa,EAAE,SAAS;oBACxB,mBAAmB,EAAE,cAAc;iBACpC;gBACD,OAAO,EAAE;oBACP,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,YAAY,EAAE,QAAQ,CAAC,OAAO;oBAC9B,iBAAiB,EAAE,iBAAiB;oBACpC,eAAe;oBACf,cAAc;iBACf;gBACD,YAAY,EAAE,KAAK,CAAC,WAAW;gBAC/B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,SAAS,EAAE,KAAK,CAAC,OAAO;gBACxB,WAAW,EAAE,yDAAyD;gBACtE,SAAS;gBACT,KAAK;aACN,CAAC;YACF,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE;gBACtF,IAAI,EAAE,KAAK;aACZ,CAAC,CAAC;YACH,MAAM,kBAAkB,CACtB;gBACE;oBACE,IAAI,EAAE,IAAI;oBACV,WAAW,EAAE,2BAA2B;oBACxC,UAAU,EAAE;wBACV,OAAO,EAAE,KAAK;wBACd,IAAI,EAAE;4BACJ,gBAAgB;4BAChB,MAAM;4BACN,KAAK;4BACL,IAAI;4BACJ,OAAO;4BACP,eAAe;4BACf,GAAG,2BAA2B;yBAC/B;wBACD,OAAO,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,gBAAgB,EAAE,GAAG,EAAE,EAAE;qBACxE;iBACF;aACF,EACD,KAAK,CAAC,MAAM,EACZ,OAAO,CACR,CAAC;YACF,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,KAAK,CAAC,OAAO;gBAAE,MAAM,aAAa,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,UAAW,CAAC,CAAC;;gBACzE,sBAAsB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YAChD,MAAM,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;gBAAS,CAAC;YACT,IAAI,aAAa,EAAE,CAAC;gBAClB,IAAI,CAAC;oBACH,MAAM,GAAG,CACP,KAAK,EACL,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,wBAAwB,CAAC,EAC1D,kCAAkC,EAClC,IAAI,EACJ,OAAO,CACR,CAAC;gBACJ,CAAC;gBAAC,MAAM,CAAC;oBACP,4EAA4E;gBAC9E,CAAC;YACH,CAAC;YACD,IAAI,CAAC;gBACH,IAAI,SAAS;oBACX,MAAM,GAAG,CACP,KAAK,EACL,CAAC,MAAM,EAAE,IAAI,CAAC,EACd,yCAAyC,EACzC,IAAI,EACJ,OAAO,CACR,CAAC;gBACJ,IAAI,OAAO,CAAC,MAAM;oBAChB,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,iCAAiC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YAC9F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,KAAK,KAAK,CAAC;YACpB,CAAC;YACD,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,OAAO;YAAE,MAAM,OAAO,CAAC;QAC3B,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC;QACtB,OAAO,MAAO,CAAC;IACjB,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAOC;IAED,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK;QAC5B,MAAM,IAAI,UAAU,CAClB,8DAA8D,EAC9D,QAAQ,CAAC,KAAK,CACf,CAAC;IACJ,OAAO,iBAAiB,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE;QAC1D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACjC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAiD,CAAC;QAC5E,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAA+B,CAAC;QAC1D,IACE,MAAM,CAAC,OAAO,KAAK,YAAY;YAC/B,QAAQ,EAAE,MAAM,KAAK,UAAU;YAC/B,QAAQ,EAAE,OAAO,KAAK,IAAI;YAC1B,CAAC,QAAQ,EAAE,OAAO;YAElB,MAAM,IAAI,UAAU,CAClB,yDAAyD,EACzD,QAAQ,CAAC,KAAK,CACf,CAAC;QACJ,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,EAAE,MAAM,CAAC,CAKnF,CAAC;QACF,IAAI,KAAK,CAAC,OAAO,KAAK,YAAY,IAAI,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO;YACtE,MAAM,IAAI,UAAU,CAClB,4DAA4D,EAC5D,QAAQ,CAAC,KAAK,CACf,CAAC;QACJ,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;YAAE,YAAY,CAAC,IAAI,CAAC,CAAC;QACxE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG;YAC3D,MAAM,IAAI,UAAU,CAAC,oCAAoC,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC7E,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;QAClC,IAAI,GAAG,CAAC,wBAAwB,KAAK,KAAK,CAAC,OAAO;YAChD,MAAM,IAAI,UAAU,CAAC,8CAA8C,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QACvF,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,QAAQ,IAAI,CAAC,KAAK,CAAC,eAAe;YACpC,MAAM,IAAI,UAAU,CAClB,6GAA6G,EAC7G,QAAQ,CAAC,KAAK,CACf,CAAC;QACJ,IAAI,QAAQ,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAGtE,CAAC;YACF,IAAI,QAAQ,CAAC,OAAO,KAAK,YAAY,IAAI,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;gBACzE,MAAM,IAAI,UAAU,CAClB,0IAA0I,EAC1I,QAAQ,CAAC,KAAK,CACf,CAAC;QACN,CAAC;QACD,KAAK,GAAG;YACN,GAAG,KAAK;YACR,MAAM,EAAE,MAAM,wBAAwB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;gBACrD,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,WAAW,EAAE,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;aACzD,CAAC;SACH,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,GAAG,CACtB,KAAK,EACL;YACE,IAAI;YACJ,UAAU;YACV,qDAAqD,KAAK,CAAC,WAAW,EAAE;YACxE,UAAU;YACV,YAAY;SACb,EACD,2BAA2B,EAC3B,KAAK,CACN,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE;YACvB,MAAM,IAAI,UAAU,CAAC,kDAAkD,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC3F,MAAM,OAAO,GAAG,MAAM,GAAG,CACvB,KAAK,EACL;YACE,QAAQ;YACR,IAAI;YACJ,UAAU;YACV,qDAAqD,KAAK,CAAC,WAAW,EAAE;YACxE,UAAU;YACV,WAAW;SACZ,EACD,iCAAiC,EACjC,KAAK,CACN,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe;YAClD,MAAM,IAAI,UAAU,CAClB,uFAAuF,EACvF,QAAQ,CAAC,KAAK,CACf,CAAC;QACJ,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,WAAW;YACnE,MAAM,IAAI,UAAU,CAAC,sDAAsD,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/F,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC1D,IAAI,CAAC;YACH,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACrF,MAAM,IAAI,UAAU,CAClB,kEAAkE,EAClE,QAAQ,CAAC,KAAK,CACf,CAAC;YACJ,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;gBACtC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAGrE,CAAC;gBACF,IAAI,OAAO,CAAC,OAAO,KAAK,YAAY,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;oBACvE,MAAM,IAAI,UAAU,CAClB,oDAAoD,EACpD,QAAQ,CAAC,KAAK,CACf,CAAC;YACN,CAAC;YACD,KAAK,GAAG;gBACN,GAAG,KAAK;gBACR,MAAM,EAAE,MAAM,wBAAwB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;oBACrD,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,WAAW,EAAE,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;iBACzD,CAAC;aACH,CAAC;YACF,MAAM,gBAAgB,GAAG,MAAM,GAAG,CAChC,KAAK,EACL;gBACE,IAAI;gBACJ,UAAU;gBACV,qDAAqD,KAAK,CAAC,WAAW,EAAE;gBACxE,UAAU;gBACV,YAAY;aACb,EACD,2CAA2C,EAC3C,KAAK,CACN,CAAC;YACF,IAAI,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE;gBACjC,MAAM,IAAI,UAAU,CAClB,2DAA2D,EAC3D,QAAQ,CAAC,KAAK,CACf,CAAC;YACJ,MAAM,iBAAiB,GAAG,MAAM,GAAG,CACjC,KAAK,EACL;gBACE,QAAQ;gBACR,IAAI;gBACJ,UAAU;gBACV,qDAAqD,KAAK,CAAC,WAAW,EAAE;gBACxE,UAAU;gBACV,WAAW;aACZ,EACD,2CAA2C,EAC3C,KAAK,CACN,CAAC;YACF,IAAI,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe;gBAC5D,MAAM,IAAI,UAAU,CAClB,2EAA2E,EAC3E,QAAQ,CAAC,KAAK,CACf,CAAC;YACJ,qGAAqG;YACrG,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC/C,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YACnD,YAAY,CACV,IAAI,CAAC,kCAAkC,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,EAClF,KAAK,CAAC,KAAK,CAAC,WAAW,CACxB,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;iBAChC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,4BAA4B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;iBACzD,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC;iBACzB,MAAM,CAAC,OAAO,CAAC,CAAC;YACnB,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,CAAC;gBACH,IAAI,KAAK,CAAC,eAAe;oBACvB,MAAM,GAAG,CACP,KAAK,EACL,CAAC,MAAM,EAAE,WAAW,EAAE,kBAAkB,CAAC,EACzC,4CAA4C,EAC5C,IAAI,EACJ,OAAO,CACR,CAAC;gBACJ,MAAM,GAAG,CACP,KAAK,EACL,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,EAClC,wBAAwB,EACxB,IAAI,EACJ,OAAO,CACR,CAAC;gBACF,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM,GAAG,CACP,KAAK,EACL,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,0BAA0B,CAAC,EAAE,4BAA4B,CAAC,EACjF,mBAAmB,EACnB,IAAI,EACJ,OAAO,CACR,CAAC;gBACF,MAAM,GAAG,CACP,KAAK,EACL;oBACE,MAAM;oBACN,IAAI;oBACJ,IAAI;oBACJ,YAAY;oBACZ,iBAAiB;oBACjB,SAAS;oBACT,aAAa;oBACb,YAAY;oBACZ,IAAI;oBACJ,OAAO;oBACP,IAAI;oBACJ,kBAAkB;oBAClB,yBAAyB;iBAC1B,EACD,oBAAoB,EACpB,IAAI,EACJ,OAAO,CACR,CAAC;gBACF,MAAM,GAAG,CACP,KAAK,EACL,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,yBAAyB,CAAC,EAC3D,qBAAqB,EACrB,IAAI,EACJ,OAAO,CACR,CAAC;gBACF,KAAK,MAAM,MAAM,IAAI,CAAC,oBAAoB,EAAE,sBAAsB,CAAC;oBACjE,MAAM,GAAG,CACP,KAAK,EACL;wBACE,KAAK;wBACL,MAAM;wBACN,IAAI;wBACJ,oBAAoB,KAAK,CAAC,WAAW,IAAI,MAAM,OAAO;wBACtD,IAAI;wBACJ,GAAG,SAAS,SAAS;wBACrB,aAAa;wBACb,IAAI;wBACJ,IAAI;wBACJ,wBAAwB,MAAM,4DAA4D;qBAC3F,EACD,WAAW,MAAM,EAAE,EACnB,KAAK,EACL,OAAO,CACR,CAAC;gBACJ,gBAAgB,CACd,KAAK,CAAC,KAAK,CAAC,SAAS,EACrB,IAAI,CAAC,SAAS,CACZ;oBACE,GAAG,KAAK;oBACR,IAAI,EAAE,KAAK,CAAC,WAAW;oBACvB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,YAAY,EAAE,KAAK;oBACnB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACpC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACpC,EACD,IAAI,EACJ,CAAC,CACF,GAAG,IAAI,CACT,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,IAAI,OAAO;oBACT,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,gCAAgC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YACtF,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,YAAqB;gBAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,YAAY,EAAE,KAAK,CAAC,WAAW;gBAC/B,gBAAgB,EAAE,IAAI;gBACtB,YAAY,EAAE,KAAK;gBACnB,IAAI,EAAE,wCAAwC,KAAK,CAAC,WAAW,EAAE;gBACjE,OAAO,EACL,4GAA4G;aAC/G,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC;QACX,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/lib/selfhosted-keyring.d.ts

@@ -0,0 +1,19 @@
+import type { EngineStatus } from './container-engine.js';
+import { type PlatformPaths, type ProcessRunner, type AsyncProcessRunner } from './platform-runtime.js';
+export interface LegacyKeyringInput {
+    name: string;
+    paths: Pick<PlatformPaths, 'runtimeDir' | 'composeFile' | 'envFile'>;
+    engine: EngineStatus;
+    runner: ProcessRunner | AsyncProcessRunner;
+}
+/** Run after public API image acquisition and before first API startup, including fresh runtimes. */
+export declare function prepareSelfHostedKeyringVolume(input: LegacyKeyringInput & {
+    image: string;
+}): Promise<void>;
+/** Call while writers are stopped and before replacing the old API container. Secret bytes never enter process output. */
+export declare function preserveLegacySelfHostedKeyring(input: LegacyKeyringInput): Promise<{
+    migrated: boolean;
+    keys: number;
+    reason?: string;
+}>;
+//# sourceMappingURL=selfhosted-keyring.d.ts.map

package/dist/lib/selfhosted-keyring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"selfhosted-keyring.d.ts","sourceRoot":"","sources":["../../src/lib/selfhosted-keyring.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAG/B,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,GAAG,aAAa,GAAG,SAAS,CAAC,CAAC;IACrE,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,aAAa,GAAG,kBAAkB,CAAC;CAC5C;AACD,qGAAqG;AACrG,wBAAsB,8BAA8B,CAClD,KAAK,EAAE,kBAAkB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAC5C,OAAO,CAAC,IAAI,CAAC,CAgDf;AACD,0HAA0H;AAC1H,wBAAsB,+BAA+B,CACnD,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA0L/D"}