@n24q02m/hull 0.4.0-beta.9 → 0.5.0-beta.1

package/build/storage/key-pool-store.js

@@ -0,0 +1,470 @@
+/**
+ * SQLite-backed provider key pool and account registry (`~/.hull/hull.db`).
+ *
+ * Mirrors `packages/core-py/src/hull_core/credentials/store.py`, including the
+ * table DDL and the shared `v1:` secret envelope, so either stack can open a
+ * pool the other created. The tables are additive and migration-safe:
+ * `CREATE TABLE/INDEX IF NOT EXISTS` only, no `ALTER`, so a database written by
+ * an older hull (only the `kv` table) keeps working and older hull ignores the
+ * new tables.
+ *
+ * Scope rules:
+ * - A pool is one provider identity; `account_id IS NULL` is that provider's
+ *   default pool and a named account has its own pool. Rotation never hops
+ *   across accounts.
+ * - Entries are ordered by `priority` then insertion order.
+ * - Rotation state lives in the database, not process memory, so two tasks (or
+ *   two processes) never reuse a credential that is cooling down or leased.
+ */
+import { mkdirSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import Database from 'better-sqlite3';
+import { AccountRegistry } from './account-registry.js';
+import { getHomeDir } from './home-dir.js';
+import { AccountError, CredentialExistsError, CredentialNotFoundError, KeyPool, providerFromBaseUrl } from './key-pool.js';
+import { CredentialCryptoError, keyHint, SecretCipher, secretsEqual } from './key-pool-crypto.js';
+export const KEY_POOL_SCHEMA = `
+CREATE TABLE IF NOT EXISTS provider_accounts (
+    account_id TEXT PRIMARY KEY,
+    provider   TEXT NOT NULL,
+    name       TEXT NOT NULL,
+    email      TEXT,
+    workspace  TEXT,
+    labels     TEXT NOT NULL DEFAULT '{}',
+    created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now')),
+    updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS provider_accounts_name
+    ON provider_accounts(provider, name);
+
+CREATE TABLE IF NOT EXISTS provider_credentials (
+    id              INTEGER PRIMARY KEY AUTOINCREMENT,
+    provider        TEXT NOT NULL,
+    account_id      TEXT,
+    label           TEXT,
+    base_url        TEXT NOT NULL,
+    model           TEXT,
+    secret          TEXT NOT NULL,
+    key_hint        TEXT NOT NULL,
+    priority        INTEGER NOT NULL DEFAULT 0,
+    disabled        INTEGER NOT NULL DEFAULT 0,
+    last_status     INTEGER,
+    failure_count   INTEGER NOT NULL DEFAULT 0,
+    cooldown_until  REAL NOT NULL DEFAULT 0,
+    lease_until     REAL NOT NULL DEFAULT 0,
+    created_at      TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now')),
+    updated_at      TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now'))
+);
+
+
+CREATE INDEX IF NOT EXISTS provider_credentials_pool
+    ON provider_credentials(provider, account_id, priority, id);
+`;
+const COLUMNS = 'id, provider, account_id, label, base_url, model, secret, key_hint, ' +
+    'priority, disabled, last_status, failure_count, cooldown_until, lease_until';
+const TOUCH = "updated_at = strftime('%Y-%m-%dT%H:%M:%fZ','now')";
+/** The instance database every hull surface already uses: `~/.hull/hull.db`. */
+export function defaultHullDbPath() {
+    return join(getHomeDir(), '.hull', 'hull.db');
+}
+/** Key file that seals this database's credentials (same directory as the DB). */
+export function credentialKeyPath(dbPath) {
+    return join(dirname(dbPath), '.credential-key');
+}
+function required(value, field) {
+    if (typeof value !== 'string' || !value.trim())
+        throw new Error(`${field} must be a non-empty string`);
+    return value.trim();
+}
+function optional(value) {
+    if (value === null || value === undefined)
+        return null;
+    const text = value.trim();
+    return text || null;
+}
+function makeCredential(row, apiKey) {
+    const owner = row.account_id ?? row.label ?? String(row.id);
+    const masked = `${row.provider}/${owner}:${row.key_hint}`;
+    return {
+        id: row.id,
+        provider: row.provider,
+        accountId: row.account_id,
+        label: row.label,
+        baseUrl: row.base_url,
+        model: row.model,
+        apiKey,
+        priority: row.priority,
+        keyHint: row.key_hint,
+        masked,
+        toString() {
+            return `Credential(${masked}, base_url=${row.base_url})`;
+        },
+        toJSON() {
+            return {
+                id: row.id,
+                provider: row.provider,
+                accountId: row.account_id,
+                label: row.label,
+                baseUrl: row.base_url,
+                model: row.model,
+                priority: row.priority,
+                keyHint: row.key_hint
+            };
+        }
+    };
+}
+/** Ordered provider credential pool plus named accounts, on local SQLite. */
+export class CredentialStore {
+    constructor(dbPath = defaultHullDbPath(), options = {}) {
+        this.path = dbPath;
+        this.clock = options.now ?? (() => Date.now() / 1000);
+        this.cipher = options.cipher ?? new SecretCipher(credentialKeyPath(dbPath));
+        mkdirSync(dirname(dbPath), { recursive: true, mode: 0o700 });
+        this.db = new Database(dbPath);
+        this.db.pragma('journal_mode = WAL');
+        this.db.pragma('busy_timeout = 5000');
+        this.db.exec(KEY_POOL_SCHEMA);
+    }
+    now() {
+        return this.clock();
+    }
+    close() {
+        this.db.close();
+    }
+    // -- row mapping ------------------------------------------------------
+    toCredential(row) {
+        return makeCredential(row, this.cipher.decrypt(row.secret));
+    }
+    toHealth(row, now) {
+        const cooldownUntil = row.cooldown_until;
+        const leaseUntil = row.lease_until;
+        return {
+            id: row.id,
+            provider: row.provider,
+            accountId: row.account_id,
+            label: row.label,
+            baseUrl: row.base_url,
+            model: row.model,
+            keyHint: row.key_hint,
+            priority: row.priority,
+            disabled: Boolean(row.disabled),
+            lastStatus: row.last_status,
+            failureCount: row.failure_count,
+            cooldownUntil,
+            leaseUntil,
+            cooldownRemaining: Math.max(0, cooldownUntil - now),
+            usable: !row.disabled && cooldownUntil <= now && leaseUntil <= now
+        };
+    }
+    row(credentialId) {
+        const row = this.db
+            .prepare(`SELECT ${COLUMNS} FROM provider_credentials WHERE id = ?`)
+            .get(credentialId);
+        if (!row)
+            throw new CredentialNotFoundError(`no provider credential with id ${credentialId}`);
+        return row;
+    }
+    requireAccount(accountId, provider) {
+        const row = this.db
+            .prepare('SELECT * FROM provider_accounts WHERE account_id = ?')
+            .get(accountId);
+        if (!row)
+            throw new AccountError(`unknown account ${JSON.stringify(accountId)}; add it first`);
+        if (row.provider !== provider) {
+            throw new AccountError(`account ${JSON.stringify(accountId)} belongs to provider ${JSON.stringify(row.provider)}, not ${JSON.stringify(provider)}`);
+        }
+        return row;
+    }
+    rejectDuplicate(provider, accountId, apiKey) {
+        const rows = this.db
+            .prepare('SELECT secret FROM provider_credentials WHERE provider = ? AND account_id IS ?')
+            .all(provider, accountId);
+        for (const row of rows) {
+            let existing;
+            try {
+                existing = this.cipher.decrypt(row.secret);
+            }
+            catch (error) {
+                if (error instanceof CredentialCryptoError)
+                    continue;
+                throw error;
+            }
+            if (secretsEqual(existing, apiKey)) {
+                throw new CredentialExistsError(`provider ${JSON.stringify(provider)} already has this credential` +
+                    (accountId ? ` for account ${JSON.stringify(accountId)}` : ''));
+            }
+        }
+    }
+    // -- writes -----------------------------------------------------------
+    addCredential(input) {
+        const provider = required(input.provider, 'provider');
+        const apiKey = required(input.apiKey, 'apiKey');
+        const baseUrl = required(input.baseUrl, 'baseUrl').replace(/\/+$/, '');
+        const accountId = optional(input.accountId);
+        const label = optional(input.label);
+        const model = optional(input.model);
+        const secret = this.cipher.encrypt(apiKey);
+        const hint = keyHint(apiKey);
+        const write = this.db.transaction(() => {
+            if (accountId !== null)
+                this.requireAccount(accountId, provider);
+            this.rejectDuplicate(provider, accountId, apiKey);
+            let priority = input.priority ?? null;
+            if (priority === null || priority === undefined) {
+                const next = this.db
+                    .prepare('SELECT COALESCE(MAX(priority), -1) + 1 AS next FROM provider_credentials WHERE provider = ? AND account_id IS ?')
+                    .get(provider, accountId);
+                priority = next?.next ?? 0;
+            }
+            const result = this.db
+                .prepare('INSERT INTO provider_credentials ' +
+                '(provider, account_id, label, base_url, model, secret, key_hint, priority) ' +
+                'VALUES (?, ?, ?, ?, ?, ?, ?, ?)')
+                .run(provider, accountId, label, baseUrl, model, secret, hint, priority);
+            return this.row(Number(result.lastInsertRowid));
+        });
+        return this.toCredential(write.immediate());
+    }
+    removeCredential(credentialId) {
+        const result = this.db.prepare('DELETE FROM provider_credentials WHERE id = ?').run(credentialId);
+        if (result.changes === 0)
+            throw new CredentialNotFoundError(`no provider credential with id ${credentialId}`);
+    }
+    setPriority(credentialId, priority) {
+        const result = this.db
+            .prepare(`UPDATE provider_credentials SET priority = ?, ${TOUCH} WHERE id = ?`)
+            .run(priority, credentialId);
+        if (result.changes === 0)
+            throw new CredentialNotFoundError(`no provider credential with id ${credentialId}`);
+    }
+    /** Clear disabled/cooldown/failure state after an operator fixes the key. */
+    enable(credentialId) {
+        const result = this.db
+            .prepare(`UPDATE provider_credentials SET disabled = 0, last_status = NULL, failure_count = 0, ` +
+            `cooldown_until = 0, lease_until = 0, ${TOUCH} WHERE id = ?`)
+            .run(credentialId);
+        if (result.changes === 0)
+            throw new CredentialNotFoundError(`no provider credential with id ${credentialId}`);
+    }
+    disable(credentialId) {
+        const result = this.db
+            .prepare(`UPDATE provider_credentials SET disabled = 1, lease_until = 0, ${TOUCH} WHERE id = ?`)
+            .run(credentialId);
+        if (result.changes === 0)
+            throw new CredentialNotFoundError(`no provider credential with id ${credentialId}`);
+    }
+    /** Clear rotation state for one provider (or every provider); returns rows matched. */
+    resetHealth(provider) {
+        const sql = 'UPDATE provider_credentials SET disabled = 0, last_status = NULL, failure_count = 0, ' +
+            `cooldown_until = 0, lease_until = 0, ${TOUCH}`;
+        const result = provider
+            ? this.db.prepare(`${sql} WHERE provider = ?`).run(provider)
+            : this.db.prepare(sql).run();
+        return result.changes;
+    }
+    // -- reads ------------------------------------------------------------
+    /** Every decrypted entry (all accounts), ordered by provider/priority/id. */
+    credentials(provider) {
+        const sql = `SELECT ${COLUMNS} FROM provider_credentials`;
+        const rows = provider
+            ? this.db
+                .prepare(`${sql} WHERE provider = ? ORDER BY provider, priority, id`)
+                .all(provider)
+            : this.db.prepare(`${sql} ORDER BY provider, priority, id`).all();
+        return rows.map((row) => this.toCredential(row));
+    }
+    /** The rotation pool for one provider/account scope, in priority order. */
+    poolCredentials(provider, accountId = null) {
+        const rows = this.db
+            .prepare(`SELECT ${COLUMNS} FROM provider_credentials WHERE provider = ? AND account_id IS ? ORDER BY priority, id`)
+            .all(required(provider, 'provider'), optional(accountId));
+        return rows.map((row) => this.toCredential(row));
+    }
+    /** Masked state of every entry, including disabled and cooling ones. */
+    health(provider) {
+        const now = this.clock();
+        const sql = `SELECT ${COLUMNS} FROM provider_credentials`;
+        const rows = provider
+            ? this.db
+                .prepare(`${sql} WHERE provider = ? ORDER BY provider, priority, id`)
+                .all(provider)
+            : this.db.prepare(`${sql} ORDER BY provider, priority, id`).all();
+        return rows.map((row) => this.toHealth(row, now));
+    }
+    poolHealth(provider, accountId = null) {
+        const now = this.clock();
+        const rows = this.db
+            .prepare(`SELECT ${COLUMNS} FROM provider_credentials WHERE provider = ? AND account_id IS ? ORDER BY priority, id`)
+            .all(required(provider, 'provider'), optional(accountId));
+        return rows.map((row) => this.toHealth(row, now));
+    }
+    getCredential(credentialId) {
+        return this.toCredential(this.row(credentialId));
+    }
+    diagnose(provider, accountId = null) {
+        const now = this.clock();
+        const rows = this.db
+            .prepare('SELECT disabled, cooldown_until, lease_until FROM provider_credentials WHERE provider = ? AND account_id IS ?')
+            .all(required(provider, 'provider'), optional(accountId));
+        const disabled = rows.filter((row) => row.disabled).length;
+        const cooling = rows.filter((row) => !row.disabled && row.cooldown_until > now).map((row) => row.cooldown_until);
+        const leased = rows.filter((row) => !row.disabled && row.cooldown_until <= now && row.lease_until > now).length;
+        return {
+            total: rows.length,
+            disabled,
+            coolingDown: cooling.length,
+            leased,
+            retryAfter: cooling.length ? Math.min(...cooling) - now : null
+        };
+    }
+    // -- rotation state (used by KeyPool) ---------------------------------
+    /** Atomically lease the highest-priority usable entry, or return null. */
+    leaseFirst(provider, accountId, options) {
+        const excluded = [...new Set(options.exclude ?? [])];
+        let sql = `SELECT ${COLUMNS} FROM provider_credentials WHERE provider = ? AND account_id IS ? AND disabled = 0 AND cooldown_until <= ? AND lease_until <= ?`;
+        const params = [required(provider, 'provider'), optional(accountId), options.now, options.now];
+        if (excluded.length > 0) {
+            sql += ` AND id NOT IN (${excluded.map(() => '?').join(',')})`;
+            params.push(...excluded);
+        }
+        sql += ' ORDER BY priority, id LIMIT 1';
+        const lease = this.db.transaction(() => {
+            const row = this.db.prepare(sql).get(...params);
+            if (!row)
+                return null;
+            this.db
+                .prepare(`UPDATE provider_credentials SET lease_until = ?, ${TOUCH} WHERE id = ?`)
+                .run(options.now + options.leaseSeconds, row.id);
+            return this.toCredential(row);
+        });
+        return lease.immediate();
+    }
+    releaseLease(credentialId) {
+        const result = this.db
+            .prepare(`UPDATE provider_credentials SET lease_until = 0, ${TOUCH} WHERE id = ?`)
+            .run(credentialId);
+        if (result.changes === 0)
+            throw new CredentialNotFoundError(`no provider credential with id ${credentialId}`);
+    }
+    recordSuccess(credentialId) {
+        const result = this.db
+            .prepare(`UPDATE provider_credentials SET last_status = 200, failure_count = 0, cooldown_until = 0, lease_until = 0, ${TOUCH} WHERE id = ?`)
+            .run(credentialId);
+        if (result.changes === 0)
+            throw new CredentialNotFoundError(`no provider credential with id ${credentialId}`);
+    }
+    recordFailure(credentialId, status, options = {}) {
+        const result = this.db
+            .prepare('UPDATE provider_credentials SET last_status = ?, failure_count = failure_count + 1, ' +
+            'cooldown_until = COALESCE(?, cooldown_until), ' +
+            `disabled = CASE WHEN ? THEN 1 ELSE disabled END, lease_until = 0, ${TOUCH} WHERE id = ?`)
+            .run(status, options.cooldownUntil ?? null, options.disable ? 1 : 0, credentialId);
+        if (result.changes === 0)
+            throw new CredentialNotFoundError(`no provider credential with id ${credentialId}`);
+    }
+    // -- accounts ---------------------------------------------------------
+    accounts() {
+        return new AccountRegistry(this);
+    }
+    accountRows() {
+        return this.db.prepare('SELECT * FROM provider_accounts ORDER BY provider, name').all();
+    }
+    accountRow(accountId) {
+        return this.db.prepare('SELECT * FROM provider_accounts WHERE account_id = ?').get(accountId);
+    }
+    accountRowsByName(name) {
+        return this.db.prepare('SELECT * FROM provider_accounts WHERE name = ?').all(name);
+    }
+    insertAccount(account) {
+        try {
+            this.db
+                .prepare('INSERT INTO provider_accounts (account_id, provider, name, email, workspace, labels) VALUES (?, ?, ?, ?, ?, ?)')
+                .run(account.accountId, account.provider, account.name, account.email, account.workspace, JSON.stringify(account.labels));
+        }
+        catch (error) {
+            if (error instanceof Error && error.message.includes('UNIQUE')) {
+                throw new AccountError(`account ${JSON.stringify(account.accountId)} or the name ${JSON.stringify(account.name)} ` +
+                    `for provider ${JSON.stringify(account.provider)} already exists`);
+            }
+            throw error;
+        }
+    }
+    updateAccountRow(accountId, values) {
+        const result = this.db
+            .prepare(`UPDATE provider_accounts SET name = ?, email = ?, workspace = ?, labels = ?, ${TOUCH} WHERE account_id = ?`)
+            .run(values.name, values.email, values.workspace, values.labelsJson, accountId);
+        if (result.changes === 0)
+            throw new AccountError(`unknown account ${JSON.stringify(accountId)}`);
+    }
+    deleteAccountRow(accountId, options = {}) {
+        const remove = this.db.transaction(() => {
+            const count = this.db
+                .prepare('SELECT COUNT(*) AS n FROM provider_credentials WHERE account_id = ?')
+                .get(accountId);
+            const total = count?.n ?? 0;
+            if (total > 0 && !options.dropCredentials) {
+                throw new AccountError(`account ${JSON.stringify(accountId)} still has ${total} credential(s); pass dropCredentials: true ` +
+                    'to delete them with the account');
+            }
+            this.db.prepare('DELETE FROM provider_credentials WHERE account_id = ?').run(accountId);
+            const result = this.db.prepare('DELETE FROM provider_accounts WHERE account_id = ?').run(accountId);
+            if (result.changes === 0)
+                throw new AccountError(`unknown account ${JSON.stringify(accountId)}`);
+        });
+        remove.immediate();
+    }
+    // -- pools ------------------------------------------------------------
+    pool(provider, options = {}) {
+        return new KeyPool(this, provider, options);
+    }
+    /** Resolve a `[models.<task>]`-shaped cell's `provider`/`account` pointers. */
+    poolForCell(cell, options = {}) {
+        const provider = optional(cell.provider) ?? providerFromBaseUrl(cell.baseUrl);
+        return this.pool(provider, { ...options, accountId: optional(cell.account) });
+    }
+    /**
+     * Seed the pool from the pre-pool single-key config, idempotently. Every
+     * distinct `(baseUrl, apiKey)` becomes one entry in insertion order; running
+     * it again skips what is already stored.
+     */
+    migrateModelCells(cells, options = {}) {
+        const items = [...cells];
+        if (items.length === 0)
+            return { provider: options.provider ?? 'default', added: 0, skipped: 0 };
+        let provider = options.provider ?? null;
+        if (provider === null) {
+            const keyed = items.filter((cell) => (cell.apiKey ?? '').length > 0);
+            const names = new Set((keyed.length > 0 ? keyed : items).map((cell) => cell.provider || providerFromBaseUrl(cell.baseUrl)));
+            if (names.size !== 1) {
+                throw new Error(`model cells span providers [${[...names].sort().join(', ')}]; pass provider explicitly`);
+            }
+            provider = [...names][0];
+        }
+        let added = 0;
+        let skipped = 0;
+        for (const cell of items) {
+            const apiKey = cell.apiKey ?? '';
+            if (!apiKey)
+                continue;
+            const target = options.accountId ?? optional(cell.account);
+            try {
+                this.addCredential({
+                    provider,
+                    apiKey,
+                    baseUrl: cell.baseUrl,
+                    model: cell.model ?? null,
+                    accountId: target
+                });
+                added += 1;
+            }
+            catch (error) {
+                if (!(error instanceof CredentialExistsError))
+                    throw error;
+                skipped += 1;
+            }
+        }
+        return { provider, added, skipped };
+    }
+}
+//# sourceMappingURL=key-pool-store.js.map

package/build/storage/key-pool-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-pool-store.js","sourceRoot":"","sources":["../../src/storage/key-pool-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,QAAQ,MAAM,gBAAgB,CAAA;AACrC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAEL,YAAY,EAEZ,qBAAqB,EAErB,uBAAuB,EACvB,OAAO,EAGP,mBAAmB,EACpB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAEjG,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqC9B,CAAA;AAED,MAAM,OAAO,GACX,sEAAsE;IACtE,6EAA6E,CAAA;AAC/E,MAAM,KAAK,GAAG,mDAAmD,CAAA;AA4DjE,gFAAgF;AAChF,MAAM,UAAU,iBAAiB;IAC/B,OAAO,IAAI,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;AAC/C,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC,CAAA;AACjD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAgC,EAAE,KAAa;IAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,6BAA6B,CAAC,CAAA;IACtG,OAAO,KAAK,CAAC,IAAI,EAAE,CAAA;AACrB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAgC;IAChD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACtD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IACzB,OAAO,IAAI,IAAI,IAAI,CAAA;AACrB,CAAC;AAED,SAAS,cAAc,CAAC,GAAkB,EAAE,MAAc;IACxD,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,KAAK,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAC3D,MAAM,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,IAAI,KAAK,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAA;IACzD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,MAAM;QACN,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,MAAM;QACN,QAAQ;YACN,OAAO,cAAc,MAAM,cAAc,GAAG,CAAC,QAAQ,GAAG,CAAA;QAC1D,CAAC;QACD,MAAM;YACJ,OAAO;gBACL,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,SAAS,EAAE,GAAG,CAAC,UAAU;gBACzB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,OAAO,EAAE,GAAG,CAAC,QAAQ;gBACrB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,OAAO,EAAE,GAAG,CAAC,QAAQ;aACtB,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,OAAO,eAAe;IAM1B,YAAY,MAAM,GAAW,iBAAiB,EAAE,EAAE,OAAO,GAA2B,EAAE;QACpF,IAAI,CAAC,IAAI,GAAG,MAAM,CAAA;QAClB,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;QACrD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,YAAY,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAA;QAC3E,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC5D,IAAI,CAAC,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAA;QAC9B,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAA;QACpC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAA;QACrC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;IAC/B,CAAC;IAED,GAAG;QACD,OAAO,IAAI,CAAC,KAAK,EAAE,CAAA;IACrB,CAAC;IAED,KAAK;QACH,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAA;IACjB,CAAC;IAED,wEAAwE;IAEhE,YAAY,CAAC,GAAkB;QACrC,OAAO,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;IAC7D,CAAC;IAEO,QAAQ,CAAC,GAAkB,EAAE,GAAW;QAC9C,MAAM,aAAa,GAAG,GAAG,CAAC,cAAc,CAAA;QACxC,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,CAAA;QAClC,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,OAAO,EAAE,GAAG,CAAC,QAAQ;YACrB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,OAAO,EAAE,GAAG,CAAC,QAAQ;YACrB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC/B,UAAU,EAAE,GAAG,CAAC,WAAW;YAC3B,YAAY,EAAE,GAAG,CAAC,aAAa;YAC/B,aAAa;YACb,UAAU;YACV,iBAAiB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,GAAG,GAAG,CAAC;YACnD,MAAM,EAAE,CAAC,GAAG,CAAC,QAAQ,IAAI,aAAa,IAAI,GAAG,IAAI,UAAU,IAAI,GAAG;SACnE,CAAA;IACH,CAAC;IAEO,GAAG,CAAC,YAAoB;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAA0B,UAAU,OAAO,yCAAyC,CAAC;aAC5F,GAAG,CAAC,YAAY,CAAC,CAAA;QACpB,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,uBAAuB,CAAC,kCAAkC,YAAY,EAAE,CAAC,CAAA;QAC7F,OAAO,GAAG,CAAA;IACZ,CAAC;IAEO,cAAc,CAAC,SAAiB,EAAE,QAAgB;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAuB,sDAAsD,CAAC;aACrF,GAAG,CAAC,SAAS,CAAC,CAAA;QACjB,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,YAAY,CAAC,mBAAmB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAA;QAC9F,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,YAAY,CACpB,WAAW,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAC5H,CAAA;QACH,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAEO,eAAe,CAAC,QAAgB,EAAE,SAAwB,EAAE,MAAc;QAChF,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CACN,gFAAgF,CACjF;aACA,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;QAC3B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,QAAgB,CAAA;YACpB,IAAI,CAAC;gBACH,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YAC5C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,qBAAqB;oBAAE,SAAQ;gBACpD,MAAM,KAAK,CAAA;YACb,CAAC;YACD,IAAI,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,qBAAqB,CAC7B,YAAY,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,8BAA8B;oBAChE,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACjE,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,wEAAwE;IAExE,aAAa,CAAC,KAAyB;QACrC,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;QACrD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAC/C,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QACtE,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACnC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAkB,EAAE;YACpD,IAAI,SAAS,KAAK,IAAI;gBAAE,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;YAChE,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;YACjD,IAAI,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAA;YACrC,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAChD,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;qBACjB,OAAO,CACN,iHAAiH,CAClH;qBACA,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;gBAC3B,QAAQ,GAAG,IAAI,EAAE,IAAI,IAAI,CAAC,CAAA;YAC5B,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE;iBACnB,OAAO,CACN,mCAAmC;gBACjC,6EAA6E;gBAC7E,iCAAiC,CACpC;iBACA,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;YAC1E,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAA;QACjD,CAAC,CAAC,CAAA;QACF,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAA;IAC7C,CAAC;IAED,gBAAgB,CAAC,YAAoB;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAW,+CAA+C,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;QAC3G,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;YAAE,MAAM,IAAI,uBAAuB,CAAC,kCAAkC,YAAY,EAAE,CAAC,CAAA;IAC/G,CAAC;IAED,WAAW,CAAC,YAAoB,EAAE,QAAgB;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE;aACnB,OAAO,CAAmB,iDAAiD,KAAK,eAAe,CAAC;aAChG,GAAG,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;QAC9B,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;YAAE,MAAM,IAAI,uBAAuB,CAAC,kCAAkC,YAAY,EAAE,CAAC,CAAA;IAC/G,CAAC;IAED,6EAA6E;IAC7E,MAAM,CAAC,YAAoB;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE;aACnB,OAAO,CACN,uFAAuF;YACrF,wCAAwC,KAAK,eAAe,CAC/D;aACA,GAAG,CAAC,YAAY,CAAC,CAAA;QACpB,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;YAAE,MAAM,IAAI,uBAAuB,CAAC,kCAAkC,YAAY,EAAE,CAAC,CAAA;IAC/G,CAAC;IAED,OAAO,CAAC,YAAoB;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE;aACnB,OAAO,CAAW,kEAAkE,KAAK,eAAe,CAAC;aACzG,GAAG,CAAC,YAAY,CAAC,CAAA;QACpB,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;YAAE,MAAM,IAAI,uBAAuB,CAAC,kCAAkC,YAAY,EAAE,CAAC,CAAA;IAC/G,CAAC;IAED,uFAAuF;IACvF,WAAW,CAAC,QAAiB;QAC3B,MAAM,GAAG,GACP,uFAAuF;YACvF,wCAAwC,KAAK,EAAE,CAAA;QACjD,MAAM,MAAM,GAAG,QAAQ;YACrB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAW,GAAG,GAAG,qBAAqB,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;YACtE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;QAC9B,OAAO,MAAM,CAAC,OAAO,CAAA;IACvB,CAAC;IAED,wEAAwE;IAExE,6EAA6E;IAC7E,WAAW,CAAC,QAAiB;QAC3B,MAAM,GAAG,GAAG,UAAU,OAAO,4BAA4B,CAAA;QACzD,MAAM,IAAI,GAAG,QAAQ;YACnB,CAAC,CAAC,IAAI,CAAC,EAAE;iBACJ,OAAO,CAA0B,GAAG,GAAG,qDAAqD,CAAC;iBAC7F,GAAG,CAAC,QAAQ,CAAC;YAClB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAoB,GAAG,GAAG,kCAAkC,CAAC,CAAC,GAAG,EAAE,CAAA;QACtF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;IAClD,CAAC;IAED,2EAA2E;IAC3E,eAAe,CAAC,QAAgB,EAAE,SAAS,GAAkB,IAAI;QAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CACN,UAAU,OAAO,yFAAyF,CAC3G;aACA,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAA;QAC3D,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;IAClD,CAAC;IAED,wEAAwE;IACxE,MAAM,CAAC,QAAiB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAA;QACxB,MAAM,GAAG,GAAG,UAAU,OAAO,4BAA4B,CAAA;QACzD,MAAM,IAAI,GAAG,QAAQ;YACnB,CAAC,CAAC,IAAI,CAAC,EAAE;iBACJ,OAAO,CAA0B,GAAG,GAAG,qDAAqD,CAAC;iBAC7F,GAAG,CAAC,QAAQ,CAAC;YAClB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAoB,GAAG,GAAG,kCAAkC,CAAC,CAAC,GAAG,EAAE,CAAA;QACtF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;IACnD,CAAC;IAED,UAAU,CAAC,QAAgB,EAAE,SAAS,GAAkB,IAAI;QAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAA;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CACN,UAAU,OAAO,yFAAyF,CAC3G;aACA,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAA;QAC3D,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;IACnD,CAAC;IAED,aAAa,CAAC,YAAoB;QAChC,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAA;IAClD,CAAC;IAED,QAAQ,CAAC,QAAgB,EAAE,SAAS,GAAkB,IAAI;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAA;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CACN,+GAA+G,CAChH;aACA,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAA;QAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAA;QAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,cAAc,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;QAChH,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,cAAc,IAAI,GAAG,IAAI,GAAG,CAAC,WAAW,GAAG,GAAG,CAAC,CAAC,MAAM,CAAA;QAC/G,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,MAAM;YAClB,QAAQ;YACR,WAAW,EAAE,OAAO,CAAC,MAAM;YAC3B,MAAM;YACN,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI;SAC/D,CAAA;IACH,CAAC;IAED,wEAAwE;IAExE,0EAA0E;IAC1E,UAAU,CACR,QAAgB,EAChB,SAAwB,EACxB,OAAkE;QAElE,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAA;QACpD,IAAI,GAAG,GAAG,UAAU,OAAO,iIAAiI,CAAA;QAC5J,MAAM,MAAM,GAAc,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAA;QACzG,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,GAAG,IAAI,mBAAmB,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;YAC9D,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAA;QAC1B,CAAC;QACD,GAAG,IAAI,gCAAgC,CAAA;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAsB,EAAE;YACxD,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAA2B,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAA;YACzE,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAA;YACrB,IAAI,CAAC,EAAE;iBACJ,OAAO,CAAmB,oDAAoD,KAAK,eAAe,CAAC;iBACnG,GAAG,CAAC,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;YAClD,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAA;QAC/B,CAAC,CAAC,CAAA;QACF,OAAO,KAAK,CAAC,SAAS,EAAE,CAAA;IAC1B,CAAC;IAED,YAAY,CAAC,YAAoB;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE;aACnB,OAAO,CAAW,oDAAoD,KAAK,eAAe,CAAC;aAC3F,GAAG,CAAC,YAAY,CAAC,CAAA;QACpB,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;YAAE,MAAM,IAAI,uBAAuB,CAAC,kCAAkC,YAAY,EAAE,CAAC,CAAA;IAC/G,CAAC;IAED,aAAa,CAAC,YAAoB;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE;aACnB,OAAO,CACN,8GAA8G,KAAK,eAAe,CACnI;aACA,GAAG,CAAC,YAAY,CAAC,CAAA;QACpB,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;YAAE,MAAM,IAAI,uBAAuB,CAAC,kCAAkC,YAAY,EAAE,CAAC,CAAA;IAC/G,CAAC;IAED,aAAa,CACX,YAAoB,EACpB,MAAqB,EACrB,OAAO,GAAuE,EAAE;QAEhF,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE;aACnB,OAAO,CACN,sFAAsF;YACpF,gDAAgD;YAChD,qEAAqE,KAAK,eAAe,CAC5F;aACA,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAA;QACpF,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;YAAE,MAAM,IAAI,uBAAuB,CAAC,kCAAkC,YAAY,EAAE,CAAC,CAAA;IAC/G,CAAC;IAED,wEAAwE;IAExE,QAAQ;QACN,OAAO,IAAI,eAAe,CAAC,IAAI,CAAC,CAAA;IAClC,CAAC;IAED,WAAW;QACT,OAAO,IAAI,CAAC,EAAE,CAAC,OAAO,CAAiB,yDAAyD,CAAC,CAAC,GAAG,EAAE,CAAA;IACzG,CAAC;IAED,UAAU,CAAC,SAAiB;QAC1B,OAAO,IAAI,CAAC,EAAE,CAAC,OAAO,CAAuB,sDAAsD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IACrH,CAAC;IAED,iBAAiB,CAAC,IAAY;QAC5B,OAAO,IAAI,CAAC,EAAE,CAAC,OAAO,CAAuB,gDAAgD,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC1G,CAAC;IAED,aAAa,CAAC,OAAgB;QAC5B,IAAI,CAAC;YACH,IAAI,CAAC,EAAE;iBACJ,OAAO,CACN,gHAAgH,CACjH;iBACA,GAAG,CACF,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,IAAI,EACZ,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,SAAS,EACjB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAC/B,CAAA;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/D,MAAM,IAAI,YAAY,CACpB,WAAW,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG;oBACzF,gBAAgB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CACpE,CAAA;YACH,CAAC;YACD,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IAED,gBAAgB,CACd,SAAiB,EACjB,MAA4F;QAE5F,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE;aACnB,OAAO,CACN,gFAAgF,KAAK,uBAAuB,CAC7G;aACA,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;QACjF,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;YAAE,MAAM,IAAI,YAAY,CAAC,mBAAmB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;IAClG,CAAC;IAED,gBAAgB,CAAC,SAAiB,EAAE,OAAO,GAAkC,EAAE;QAC7E,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAS,EAAE;YAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE;iBAClB,OAAO,CAA0B,qEAAqE,CAAC;iBACvG,GAAG,CAAC,SAAS,CAAC,CAAA;YACjB,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC,IAAI,CAAC,CAAA;YAC3B,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;gBAC1C,MAAM,IAAI,YAAY,CACpB,WAAW,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,cAAc,KAAK,6CAA6C;oBAClG,iCAAiC,CACpC,CAAA;YACH,CAAC;YACD,IAAI,CAAC,EAAE,CAAC,OAAO,CAAW,uDAAuD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;YACjG,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAW,oDAAoD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;YAC7G,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;gBAAE,MAAM,IAAI,YAAY,CAAC,mBAAmB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;QAClG,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,SAAS,EAAE,CAAA;IACpB,CAAC;IAED,wEAAwE;IAExE,IAAI,CAAC,QAAgB,EAAE,OAAO,GAAmB,EAAE;QACjD,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC7C,CAAC;IAED,+EAA+E;IAC/E,WAAW,CAAC,IAAmB,EAAE,OAAO,GAAmB,EAAE;QAC3D,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC7E,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC/E,CAAC;IAED;;;;OAIG;IACH,iBAAiB,CACf,KAA8B,EAC9B,OAAO,GAA4D,EAAE;QAErE,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,CAAA;QACxB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAA;QAChG,IAAI,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAA;QACvC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;YACpE,MAAM,KAAK,GAAG,IAAI,GAAG,CACnB,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CACrG,CAAA;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAA;YAC3G,CAAC;YACD,QAAQ,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAC1B,CAAC;QACD,IAAI,KAAK,GAAG,CAAC,CAAA;QACb,IAAI,OAAO,GAAG,CAAC,CAAA;QACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAA;YAChC,IAAI,CAAC,MAAM;gBAAE,SAAQ;YACrB,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAC1D,IAAI,CAAC;gBACH,IAAI,CAAC,aAAa,CAAC;oBACjB,QAAQ;oBACR,MAAM;oBACN,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;oBACzB,SAAS,EAAE,MAAM;iBAClB,CAAC,CAAA;gBACF,KAAK,IAAI,CAAC,CAAA;YACZ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,CAAC,KAAK,YAAY,qBAAqB,CAAC;oBAAE,MAAM,KAAK,CAAA;gBAC1D,OAAO,IAAI,CAAC,CAAA;YACd,CAAC;QACH,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;IACrC,CAAC;CACF"}

package/build/storage/key-pool.d.ts

@@ -0,0 +1,172 @@
+/**
+ * Credential rotation over one provider pool (TypeScript mirror of
+ * `hull_core/credentials/pool.py`).
+ *
+ * Failure policy:
+ *
+ * | status        | action                                                    |
+ * |---------------|-----------------------------------------------------------|
+ * | 401 / 403     | disable the credential and move to the next one            |
+ * | 429           | cool it down (`Retry-After` / `rate_limit_reset`, 1s..1h)  |
+ * | 5xx           | retry the same credential once, then move to the next one  |
+ * | anything else | release the lease and re-raise (request problem, not key)  |
+ *
+ * The pool is bounded at `credentials * (1 + max5xxRetries)` calls, and the
+ * final error carries the redacted last error text — a provider that echoes a
+ * key back cannot leak it through hull.
+ */
+import type { CredentialStore } from './key-pool-store.js';
+export declare const DEFAULT_COOLDOWN_SECONDS = 60;
+export declare const MIN_COOLDOWN_SECONDS = 1;
+export declare const MAX_COOLDOWN_SECONDS = 3600;
+/** Host -> provider identity used when config does not name one explicitly. */
+export declare const KNOWN_PROVIDER_HOSTS: Readonly<Record<string, string>>;
+/**
+ * Derive the provider identity a base URL belongs to. Known hosts map to their
+ * short name; anything else becomes the lowercased host with dots replaced by
+ * hyphens. An unparseable URL falls back to `default`.
+ */
+export declare function providerFromBaseUrl(baseUrl: string): string;
+/** One decrypted pool entry. `apiKey` is never part of `toString`/`toJSON`. */
+export interface Credential {
+    readonly id: number;
+    readonly provider: string;
+    readonly accountId: string | null;
+    readonly label: string | null;
+    readonly baseUrl: string;
+    readonly model: string | null;
+    readonly apiKey: string;
+    readonly priority: number;
+    readonly keyHint: string;
+    readonly masked: string;
+    toString(): string;
+    toJSON(): Record<string, unknown>;
+}
+/** Masked state of one pool entry — no key material at all. */
+export interface CredentialHealth {
+    readonly id: number;
+    readonly provider: string;
+    readonly accountId: string | null;
+    readonly label: string | null;
+    readonly baseUrl: string;
+    readonly model: string | null;
+    readonly keyHint: string;
+    readonly priority: number;
+    readonly disabled: boolean;
+    readonly lastStatus: number | null;
+    readonly failureCount: number;
+    readonly cooldownUntil: number;
+    readonly leaseUntil: number;
+    readonly cooldownRemaining: number;
+    readonly usable: boolean;
+}
+/** A named provider identity (one email/workspace per row). */
+export interface Account {
+    readonly accountId: string;
+    readonly provider: string;
+    readonly name: string;
+    readonly email: string | null;
+    readonly workspace: string | null;
+    readonly labels: Record<string, string>;
+}
+/** Outcome of seeding a pool from the pre-pool single-key config. */
+export interface MigrationResult {
+    readonly provider: string;
+    readonly added: number;
+    readonly skipped: number;
+}
+export type FailureAction = 'disable' | 'cooldown' | 'retry' | 'fatal';
+export declare class CredentialPoolError extends Error {
+    constructor(message: string);
+}
+export declare class PoolExhaustedError extends CredentialPoolError {
+    readonly provider: string;
+    readonly accountId: string | null;
+    readonly total: number;
+    readonly disabled: number;
+    readonly coolingDown: number;
+    readonly leased: number;
+    readonly retryAfter: number | null;
+    readonly lastError: string | null;
+    constructor(message: string, details: {
+        provider: string;
+        accountId?: string | null;
+        total?: number;
+        disabled?: number;
+        coolingDown?: number;
+        leased?: number;
+        retryAfter?: number | null;
+        lastError?: string | null;
+    });
+}
+export declare class CredentialExistsError extends CredentialPoolError {
+    constructor(message: string);
+}
+export declare class CredentialNotFoundError extends CredentialPoolError {
+    constructor(message: string);
+}
+export declare class AccountError extends CredentialPoolError {
+    constructor(message: string);
+}
+/** Map an HTTP status to `disable` / `cooldown` / `retry` / `fatal`. */
+export declare function classifyStatus(status: number | null | undefined): FailureAction;
+/** `Retry-After` as delay seconds (numeric form or HTTP-date). */
+export declare function parseRetryAfter(value: unknown, now?: number): number | null;
+/**
+ * `rate_limit_reset`/`x-ratelimit-reset` as delay seconds. Providers use two
+ * shapes: an epoch second (above 1e9) and a delta already in seconds.
+ */
+export declare function parseRateLimitReset(value: unknown, now?: number): number | null;
+export interface CooldownOptions {
+    retryAfter?: unknown;
+    rateLimitReset?: unknown;
+    now?: number;
+    defaultSeconds?: number;
+    minimum?: number;
+    maximum?: number;
+}
+/** Cooldown for a 429: provider hint first, then the default, always clamped. */
+export declare function cooldownSeconds(options?: CooldownOptions): number;
+export interface KeyPoolOptions {
+    accountId?: string | null;
+    now?: () => number;
+    max5xxRetries?: number;
+    leaseSeconds?: number;
+}
+/**
+ * Ordered, health-aware rotation over one provider's credentials. A pool is
+ * either the provider's default pool (`accountId` null) or one named account's.
+ */
+export declare class KeyPool {
+    readonly store: CredentialStore;
+    readonly provider: string;
+    readonly accountId: string | null;
+    readonly max5xxRetries: number;
+    readonly leaseSeconds: number;
+    private readonly clock;
+    constructor(store: CredentialStore, provider: string, options?: KeyPoolOptions);
+    credentials(): Credential[];
+    health(): CredentialHealth[];
+    toString(): string;
+    acquire(options?: {
+        exclude?: number[];
+    }): Credential;
+    reportSuccess(credential: Credential): void;
+    reportFailure(credential: Credential, status: number | null, options?: {
+        retryAfter?: unknown;
+        rateLimitReset?: unknown;
+    }): FailureAction;
+    enable(credentialId: number): void;
+    /** Replace every stored key of this provider in `text` with `[redacted]`. */
+    redact(text: string | null | undefined): string;
+    /** HTTP status carried by a provider error (`ProviderError.status`). */
+    static statusOf(error: unknown): number | null;
+    exhaustedError(lastError?: string | null): PoolExhaustedError;
+    run<T>(call: (credential: Credential) => T, options?: {
+        statusOf?: (error: unknown) => number | null;
+    }): T;
+    runAsync<T>(call: (credential: Credential) => Promise<T>, options?: {
+        statusOf?: (error: unknown) => number | null;
+    }): Promise<T>;
+}
+//# sourceMappingURL=key-pool.d.ts.map