@nklisch/pi-enhanced 0.1.0

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/http/bounded-fetch.d.ts

@@ -0,0 +1,59 @@
+import type { NetworkEgressPolicy } from "../network/network-egress-policy.js";
+/** A response body exposed as bytes only; callers must consume it exactly once. */
+export type BoundedFetchResponse = Readonly<{
+    status: number;
+    headers: Headers;
+    url: string;
+    body: AsyncIterable<Uint8Array>;
+}>;
+export type BoundedFetchRequest = Readonly<{
+    url: string;
+    maxBytes: number;
+    signal: AbortSignal;
+    /** Internal adapter override; never included in a response or source result. */
+    credentials?: NpmCredentialProvider;
+}>;
+export interface BoundedFetch {
+    request(request: BoundedFetchRequest): Promise<BoundedFetchResponse>;
+}
+/**
+ * Credentials are applied to a private Headers object owned by the HTTP
+ * adapter. The provider deliberately has no return value, so a token cannot
+ * accidentally become part of a resolved source or an application result.
+ */
+export type NpmCredentialProvider = Readonly<{
+    apply(url: URL, headers: Headers, signal: AbortSignal): void | Promise<void>;
+}> | ((url: URL, headers: Headers, signal: AbortSignal) => void | Promise<void>);
+export type BoundedFetchOptions = Readonly<{
+    /** Trusted test/host adapter. Production uses the DNS-pinned Node HTTPS path. */
+    fetch?: typeof globalThis.fetch;
+    credentials: NpmCredentialProvider;
+    egress: NetworkEgressPolicy;
+    maxRedirects?: number;
+}>;
+export type BoundedFetchErrorKind = "network" | "policy" | "credential" | "redirect" | "response" | "limit";
+/** Errors contain only safe classification data; the requested URL is not retained. */
+export declare class BoundedFetchError extends Error {
+    readonly kind: BoundedFetchErrorKind;
+    readonly status?: number;
+    constructor(input: Readonly<{
+        kind: BoundedFetchErrorKind;
+        message: string;
+        status?: number;
+        cause?: unknown;
+    }>);
+}
+export declare function createBoundedFetch(options: BoundedFetchOptions): BoundedFetch;
+/**
+ * Minimal npmrc reader for the standard token/basic auth forms. It is kept in
+ * the HTTP adapter so parsed credentials never cross into source contracts.
+ */
+export declare function createNpmCredentialProvider(options?: Readonly<{
+    configPath?: string;
+    configText?: string;
+    home?: string;
+}>): NpmCredentialProvider;
+export declare const createDefaultNpmCredentialProvider: typeof createNpmCredentialProvider;
+/** A byte collector used by adapters that need bounded JSON rather than a stream. */
+export declare function collectBoundedBytes(body: AsyncIterable<Uint8Array>, maxBytes: number, signal: AbortSignal): Promise<Uint8Array>;
+export declare function decodeUtf8(bytes: Uint8Array): string;

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/http/bounded-fetch.js

@@ -0,0 +1,381 @@
+import { homedir } from "node:os";
+import { readFile } from "node:fs/promises";
+import { request as httpsRequest } from "node:https";
+import { join } from "node:path";
+import { Readable } from "node:stream";
+/** Errors contain only safe classification data; the requested URL is not retained. */
+export class BoundedFetchError extends Error {
+    kind;
+    status;
+    constructor(input) {
+        super(input.message, input.cause === undefined ? undefined : { cause: input.cause });
+        this.name = "BoundedFetchError";
+        this.kind = input.kind;
+        if (input.status !== undefined)
+            this.status = input.status;
+    }
+}
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+function abortError(signal) {
+    return signal.reason ?? new DOMException("The operation was aborted", "AbortError");
+}
+function throwIfAborted(signal) {
+    if (signal.aborted)
+        throw abortError(signal);
+}
+function applyCredentials(provider, url, headers, signal) {
+    if (typeof provider === "function")
+        return Promise.resolve(provider(url, headers, signal));
+    if (typeof provider.apply !== "function")
+        throw new TypeError("npm credential provider must apply credentials");
+    return Promise.resolve(provider.apply(url, headers, signal));
+}
+function bodyFromResponse(response, maxBytes, signal) {
+    if (response.body === null) {
+        return (async function* empty() {
+            throwIfAborted(signal);
+        })();
+    }
+    return (async function* stream() {
+        const reader = response.body.getReader();
+        let total = 0;
+        try {
+            while (true) {
+                throwIfAborted(signal);
+                let next;
+                try {
+                    next = await reader.read();
+                }
+                catch (error) {
+                    if (signal.aborted)
+                        throw abortError(signal);
+                    throw new BoundedFetchError({ kind: "network", message: "HTTP response stream failed", cause: error });
+                }
+                if (next.done)
+                    return;
+                const chunk = next.value;
+                if (!(chunk instanceof Uint8Array)) {
+                    throw new BoundedFetchError({ kind: "response", message: "HTTP response body was not bytes" });
+                }
+                total += chunk.byteLength;
+                if (total > maxBytes) {
+                    throw new BoundedFetchError({ kind: "limit", message: "HTTP response exceeded its byte limit" });
+                }
+                if (chunk.byteLength > 0)
+                    yield new Uint8Array(chunk);
+            }
+        }
+        finally {
+            // Cancellation and parser failures must stop a slow or hostile server
+            // even when the consumer does not finish iterating the body.
+            await reader.cancel().catch(() => undefined);
+        }
+    })();
+}
+function location(response) {
+    const value = response.headers.get("location");
+    return value === null || value.length === 0 ? undefined : value;
+}
+function safeUrl(input) {
+    let value;
+    try {
+        value = new URL(input);
+    }
+    catch (error) {
+        throw new BoundedFetchError({ kind: "redirect", message: "HTTP URL is invalid", cause: error });
+    }
+    if (value.protocol !== "https:") {
+        throw new BoundedFetchError({ kind: "redirect", message: "HTTP URL must use HTTPS" });
+    }
+    if (value.username !== "" || value.password !== "") {
+        throw new BoundedFetchError({ kind: "redirect", message: "HTTP URL contains credentials" });
+    }
+    return value;
+}
+function pinnedLookup(target) {
+    return ((_hostname, options, callback) => {
+        if (options !== null && typeof options === "object" && "all" in options && options.all === true) {
+            callback(null, [{ address: target.address, family: target.family }]);
+        }
+        else {
+            callback(null, target.address, target.family);
+        }
+    });
+}
+function appendResponseHeaders(target, source) {
+    for (const [name, value] of Object.entries(source)) {
+        if (Array.isArray(value))
+            for (const item of value)
+                target.append(name, item);
+        else if (value !== undefined)
+            target.append(name, value);
+    }
+}
+function requestPinnedHttps(target, headers, signal) {
+    return new Promise((resolve, reject) => {
+        const request = httpsRequest(target.url, {
+            method: "GET",
+            headers: Object.fromEntries(headers.entries()),
+            lookup: pinnedLookup(target),
+            servername: target.hostname,
+            signal,
+        }, (incoming) => {
+            const responseHeaders = new Headers();
+            appendResponseHeaders(responseHeaders, incoming.headers);
+            resolve(new Response(Readable.toWeb(incoming), {
+                status: incoming.statusCode ?? 500,
+                ...(incoming.statusMessage === undefined ? {} : { statusText: incoming.statusMessage }),
+                headers: responseHeaders,
+            }));
+        });
+        request.once("error", reject);
+        request.end();
+    });
+}
+async function discard(response, signal) {
+    throwIfAborted(signal);
+    try {
+        await response.body?.cancel();
+    }
+    catch {
+        // The redirect target is authoritative; a body that is already closed does
+        // not change the redirect decision.
+    }
+}
+export function createBoundedFetch(options) {
+    if (options?.fetch !== undefined && typeof options.fetch !== "function")
+        throw new TypeError("bounded fetch adapter is invalid");
+    if (options.credentials === null || options.credentials === undefined) {
+        throw new TypeError("bounded fetch requires a credential provider");
+    }
+    if (options.egress === null || typeof options.egress?.origin !== "function" ||
+        typeof options.egress.authorize !== "function" || typeof options.egress.redirectAllowed !== "function") {
+        throw new TypeError("bounded fetch requires an egress policy");
+    }
+    const maxRedirects = options.maxRedirects ?? 5;
+    if (!Number.isSafeInteger(maxRedirects) || maxRedirects < 0) {
+        throw new TypeError("maxRedirects must be a nonnegative safe integer");
+    }
+    return {
+        async request(input) {
+            if (input === null || typeof input !== "object")
+                throw new TypeError("bounded fetch request is required");
+            if (!Number.isSafeInteger(input.maxBytes) || input.maxBytes <= 0) {
+                throw new TypeError("bounded fetch maxBytes must be positive");
+            }
+            if (typeof input.signal?.aborted !== "boolean")
+                throw new TypeError("bounded fetch requires an AbortSignal");
+            throwIfAborted(input.signal);
+            let current = safeUrl(input.url);
+            let initialOrigin;
+            for (let redirects = 0;; redirects += 1) {
+                throwIfAborted(input.signal);
+                let candidateOrigin;
+                try {
+                    candidateOrigin = options.egress.origin(current.toString());
+                }
+                catch (error) {
+                    throw new BoundedFetchError({ kind: "policy", message: "HTTP destination authority is invalid", cause: error });
+                }
+                initialOrigin ??= candidateOrigin;
+                if (!options.egress.redirectAllowed(initialOrigin, candidateOrigin)) {
+                    throw new BoundedFetchError({ kind: "redirect", message: "HTTP redirect changed authority" });
+                }
+                let target;
+                try {
+                    target = await options.egress.authorize(current.toString(), "https:");
+                }
+                catch (error) {
+                    if (input.signal.aborted)
+                        throw abortError(input.signal);
+                    throw new BoundedFetchError({ kind: "policy", message: "HTTP destination is not permitted", cause: error });
+                }
+                const headers = new Headers({ accept: "application/json, application/octet-stream" });
+                if (target.credentialsApproved) {
+                    try {
+                        await applyCredentials(input.credentials ?? options.credentials, current, headers, input.signal);
+                    }
+                    catch (error) {
+                        if (input.signal.aborted)
+                            throw abortError(input.signal);
+                        throw new BoundedFetchError({ kind: "credential", message: "HTTP credential adapter failed", cause: error });
+                    }
+                }
+                let response;
+                try {
+                    response = options.fetch === undefined
+                        ? await requestPinnedHttps(target, headers, input.signal)
+                        : await options.fetch(current, {
+                            method: "GET",
+                            headers,
+                            redirect: "manual",
+                            signal: input.signal,
+                        });
+                }
+                catch (error) {
+                    if (input.signal.aborted)
+                        throw abortError(input.signal);
+                    throw new BoundedFetchError({ kind: "network", message: "HTTP request failed", cause: error });
+                }
+                if (REDIRECT_STATUSES.has(response.status)) {
+                    const target = location(response);
+                    await discard(response, input.signal);
+                    if (target === undefined) {
+                        throw new BoundedFetchError({ kind: "redirect", message: "HTTP redirect has no location" });
+                    }
+                    if (redirects >= maxRedirects) {
+                        throw new BoundedFetchError({ kind: "redirect", message: "HTTP redirect limit exceeded" });
+                    }
+                    let next;
+                    try {
+                        next = new URL(target, current);
+                    }
+                    catch (error) {
+                        throw new BoundedFetchError({ kind: "redirect", message: "HTTP redirect location is invalid", cause: error });
+                    }
+                    // Rebuilding the request on every hop means Authorization is never
+                    // forwarded implicitly. The provider may elect to authorize the new
+                    // origin, but application code never sees those headers.
+                    current = safeUrl(next.toString());
+                    continue;
+                }
+                return {
+                    status: response.status,
+                    headers: response.headers,
+                    url: current.toString(),
+                    body: bodyFromResponse(response, input.maxBytes, input.signal),
+                };
+            }
+        },
+    };
+}
+function parseNpmrc(text) {
+    const result = [];
+    for (const rawLine of text.split(/\r?\n/u)) {
+        const line = rawLine.trim();
+        if (line.length === 0 || line.startsWith("#") || line.startsWith(";"))
+            continue;
+        const equals = line.indexOf("=");
+        if (equals <= 0)
+            continue;
+        const key = line.slice(0, equals).trim();
+        const value = line.slice(equals + 1).trim();
+        if (value.length === 0)
+            continue;
+        if (key.endsWith(":_authToken")) {
+            // npm's standard token form is `//host[:port]/path/:_authToken`.
+            // Parse the whole authority plus path rather than stopping at the first
+            // slash, so scoped registries and non-default ports remain distinct.
+            const scope = key.slice(0, -":_authToken".length);
+            try {
+                const parsed = new URL(`https:${scope}`);
+                if (!scope.startsWith("//") || !scope.endsWith("/") ||
+                    parsed.hostname.length === 0 || parsed.username !== "" || parsed.password !== "" ||
+                    parsed.search !== "" || parsed.hash !== "")
+                    continue;
+                result.push({ scope, token: value });
+            }
+            catch {
+                // Ignore malformed npmrc keys. They cannot authorize a request, while
+                // unreadable files remain an explicit credential adapter failure.
+            }
+            continue;
+        }
+        if (key === "_auth")
+            result.push({ scope: "//registry.npmjs.org/", basic: value });
+    }
+    return result;
+}
+function credentialScopeLength(scope, url) {
+    try {
+        if (url.protocol !== "https:")
+            return undefined;
+        const scoped = new URL(`https:${scope}`);
+        const scopedPort = scoped.port || "443";
+        const requestPort = url.port || "443";
+        if (scoped.hostname.toLowerCase() !== url.hostname.toLowerCase() || scopedPort !== requestPort)
+            return undefined;
+        // Scope paths are directory prefixes. Requiring the trailing slash from
+        // npmrc prevents `/team/` from authorizing `/teamwork/...`.
+        if (!url.pathname.startsWith(scoped.pathname))
+            return undefined;
+        return scoped.pathname.length;
+    }
+    catch {
+        return undefined;
+    }
+}
+function credentialApplies(scope, url) {
+    return credentialScopeLength(scope, url) !== undefined;
+}
+/**
+ * Minimal npmrc reader for the standard token/basic auth forms. It is kept in
+ * the HTTP adapter so parsed credentials never cross into source contracts.
+ */
+export function createNpmCredentialProvider(options = {}) {
+    let loaded;
+    const readConfig = async () => {
+        if (options.configText !== undefined)
+            return parseNpmrc(options.configText);
+        const path = options.configPath ?? process.env.NPM_CONFIG_USERCONFIG ?? join(options.home ?? homedir(), ".npmrc");
+        try {
+            return parseNpmrc(await readFile(path, "utf8"));
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return [];
+            // An unreadable credential file is not equivalent to an empty one: the
+            // caller must be able to distinguish configuration failure from a
+            // genuinely anonymous request. Keep the path and contents out of the
+            // error; the cause remains adapter-local.
+            throw new BoundedFetchError({ kind: "credential", message: "npm credential configuration could not be read", cause: error });
+        }
+    };
+    return {
+        async apply(url, headers, signal) {
+            throwIfAborted(signal);
+            loaded ??= readConfig();
+            const credentials = await loaded;
+            const match = credentials
+                .filter((entry) => credentialApplies(entry.scope, url))
+                .sort((left, right) => (credentialScopeLength(right.scope, url) ?? -1) - (credentialScopeLength(left.scope, url) ?? -1))[0];
+            if (match?.token !== undefined)
+                headers.set("authorization", `Bearer ${match.token}`);
+            else if (match?.basic !== undefined)
+                headers.set("authorization", `Basic ${match.basic}`);
+        },
+    };
+}
+export const createDefaultNpmCredentialProvider = createNpmCredentialProvider;
+/** A byte collector used by adapters that need bounded JSON rather than a stream. */
+export async function collectBoundedBytes(body, maxBytes, signal) {
+    if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0)
+        throw new TypeError("maxBytes must be positive");
+    const chunks = [];
+    let length = 0;
+    for await (const chunk of body) {
+        throwIfAborted(signal);
+        if (!(chunk instanceof Uint8Array))
+            throw new BoundedFetchError({ kind: "response", message: "HTTP response body was not bytes" });
+        length += chunk.byteLength;
+        if (length > maxBytes)
+            throw new BoundedFetchError({ kind: "limit", message: "HTTP response exceeded its byte limit" });
+        chunks.push(chunk);
+    }
+    const output = new Uint8Array(length);
+    let offset = 0;
+    for (const chunk of chunks) {
+        output.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return output;
+}
+export function decodeUtf8(bytes) {
+    try {
+        return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    }
+    catch (error) {
+        throw new BoundedFetchError({ kind: "response", message: "HTTP response was not valid UTF-8", cause: error });
+    }
+}
+//# sourceMappingURL=bounded-fetch.js.map

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/http/bounded-fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bounded-fetch.js","sourceRoot":"","sources":["../../../src/infrastructure/http/bounded-fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AAErD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AA6CvC,uFAAuF;AACvF,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,IAAI,CAAwB;IAC5B,MAAM,CAAU;IAEzB,YAAY,KAKV;QACA,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QACrF,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACvB,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC7D,CAAC;CACF;AAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAE7D,SAAS,UAAU,CAAC,MAAmB;IACrC,OAAO,MAAM,CAAC,MAAM,IAAI,IAAI,YAAY,CAAC,2BAA2B,EAAE,YAAY,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,cAAc,CAAC,MAAmB;IACzC,IAAI,MAAM,CAAC,OAAO;QAAE,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,gBAAgB,CACvB,QAA+B,EAC/B,GAAQ,EACR,OAAgB,EAChB,MAAmB;IAEnB,IAAI,OAAO,QAAQ,KAAK,UAAU;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3F,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,UAAU;QAAE,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAC;IAChH,OAAO,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAkB,EAAE,QAAgB,EAAE,MAAmB;IACjF,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC3B,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,KAAK;YAC3B,cAAc,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IAED,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,MAAM;QAC5B,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAK,CAAC,SAAS,EAAE,CAAC;QAC1C,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,CAAC;YACH,OAAO,IAAI,EAAE,CAAC;gBACZ,cAAc,CAAC,MAAM,CAAC,CAAC;gBACvB,IAAI,IAA0C,CAAC;gBAC/C,IAAI,CAAC;oBACH,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC7B,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,MAAM,CAAC,OAAO;wBAAE,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;oBAC7C,MAAM,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,6BAA6B,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;gBACzG,CAAC;gBACD,IAAI,IAAI,CAAC,IAAI;oBAAE,OAAO;gBACtB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;gBACzB,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC,EAAE,CAAC;oBACnC,MAAM,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBACjG,CAAC;gBACD,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;gBAC1B,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;oBACrB,MAAM,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAAC;gBACnG,CAAC;gBACD,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC;oBAAE,MAAM,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,sEAAsE;YACtE,6DAA6D;YAC7D,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;AACP,CAAC;AAED,SAAS,QAAQ,CAAC,QAAkB;IAClC,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC/C,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AAClE,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,IAAI,KAAU,CAAC;IACf,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,qBAAqB,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,EAAE,IAAI,KAAK,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QACnD,MAAM,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,MAA6B;IACjD,OAAO,CAAC,CACN,SAAiB,EACjB,OAAgB,EAChB,QAAsC,EACtC,EAAE;QACF,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,IAAI,OAAO,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;YAChG,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACvE,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAA8B,CAAC;AAClC,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAe,EAAE,MAA+C;IAC7F,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;aACzE,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,MAA6B,EAC7B,OAAgB,EAChB,MAAmB;IAEnB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE;YACvC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YAC9C,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC;YAC5B,UAAU,EAAE,MAAM,CAAC,QAAQ;YAC3B,MAAM;SACP,EAAE,CAAC,QAAQ,EAAE,EAAE;YACd,MAAM,eAAe,GAAG,IAAI,OAAO,EAAE,CAAC;YACtC,qBAAqB,CAAC,eAAe,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;YACzD,OAAO,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAA+B,EAAE;gBAC3E,MAAM,EAAE,QAAQ,CAAC,UAAU,IAAI,GAAG;gBAClC,GAAG,CAAC,QAAQ,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC;gBACvF,OAAO,EAAE,eAAe;aACzB,CAAC,CAAC,CAAC;QACN,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,QAAkB,EAAE,MAAmB;IAC5D,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,oCAAoC;IACtC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAA4B;IAC7D,IAAI,OAAO,EAAE,KAAK,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,UAAU;QAAE,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAC;IACjI,IAAI,OAAO,CAAC,WAAW,KAAK,IAAI,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACtE,MAAM,IAAI,SAAS,CAAC,8CAA8C,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,OAAO,CAAC,MAAM,EAAE,MAAM,KAAK,UAAU;QACvE,OAAO,OAAO,CAAC,MAAM,CAAC,SAAS,KAAK,UAAU,IAAI,OAAO,OAAO,CAAC,MAAM,CAAC,eAAe,KAAK,UAAU,EAAE,CAAC;QAC3G,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAC;IACzE,CAAC;IAED,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,KAAK;YACjB,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,MAAM,IAAI,SAAS,CAAC,mCAAmC,CAAC,CAAC;YAC1G,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC;gBACjE,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;YACjE,CAAC;YACD,IAAI,OAAO,KAAK,CAAC,MAAM,EAAE,OAAO,KAAK,SAAS;gBAAE,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;YAC7G,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAE7B,IAAI,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,aAAiC,CAAC;YACtC,KAAK,IAAI,SAAS,GAAG,CAAC,GAAI,SAAS,IAAI,CAAC,EAAE,CAAC;gBACzC,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC7B,IAAI,eAAuB,CAAC;gBAC5B,IAAI,CAAC;oBACH,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC9D,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,uCAAuC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;gBAClH,CAAC;gBACD,aAAa,KAAK,eAAe,CAAC;gBAClC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,aAAa,EAAE,eAAe,CAAC,EAAE,CAAC;oBACpE,MAAM,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC,CAAC;gBAChG,CAAC;gBACD,IAAI,MAA6B,CAAC;gBAClC,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC;gBACxE,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;wBAAE,MAAM,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBACzD,MAAM,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,mCAAmC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC9G,CAAC;gBACD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC,CAAC;gBACtF,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;oBAC/B,IAAI,CAAC;wBACH,MAAM,gBAAgB,CAAC,KAAK,CAAC,WAAW,IAAI,OAAO,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;oBACnG,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;4BAAE,MAAM,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;wBACzD,MAAM,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,gCAAgC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;oBAC/G,CAAC;gBACH,CAAC;gBACD,IAAI,QAAkB,CAAC;gBACvB,IAAI,CAAC;oBACH,QAAQ,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS;wBACpC,CAAC,CAAC,MAAM,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC;wBACzD,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE;4BAC3B,MAAM,EAAE,KAAK;4BACb,OAAO;4BACP,QAAQ,EAAE,QAAQ;4BAClB,MAAM,EAAE,KAAK,CAAC,MAAM;yBACrB,CAAC,CAAC;gBACT,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;wBAAE,MAAM,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBACzD,MAAM,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,qBAAqB,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;gBACjG,CAAC;gBAED,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC3C,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;oBAClC,MAAM,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;oBACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;wBACzB,MAAM,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAC;oBAC9F,CAAC;oBACD,IAAI,SAAS,IAAI,YAAY,EAAE,CAAC;wBAC9B,MAAM,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;oBAC7F,CAAC;oBACD,IAAI,IAAS,CAAC;oBACd,IAAI,CAAC;wBACH,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;oBAClC,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,MAAM,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,mCAAmC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;oBAChH,CAAC;oBACD,mEAAmE;oBACnE,oEAAoE;oBACpE,yDAAyD;oBACzD,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;oBACnC,SAAS;gBACX,CAAC;gBAED,OAAO;oBACL,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;oBACzB,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE;oBACvB,IAAI,EAAE,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC;iBAC/D,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAQD,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,MAAM,GAA0B,EAAE,CAAC;IACzC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAChF,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,IAAI,CAAC;YAAE,SAAS;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACjC,IAAI,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YAChC,iEAAiE;YACjE,wEAAwE;YACxE,qEAAqE;YACrE,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAClD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC;gBACzC,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;oBAC/C,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE;oBAChF,MAAM,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE;oBAC1C,SAAS;gBACX,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,sEAAsE;gBACtE,kEAAkE;YACpE,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,OAAO;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa,EAAE,GAAQ;IACpD,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC;QACxC,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,IAAI,KAAK,CAAC;QACtC,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,UAAU,KAAK,WAAW;YAAE,OAAO,SAAS,CAAC;QACjH,wEAAwE;QACxE,4DAA4D;QAC5D,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC;YAAE,OAAO,SAAS,CAAC;QAChE,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa,EAAE,GAAQ;IAChD,OAAO,qBAAqB,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,SAAS,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,OAAO,GAI9C,EAAE;IACL,IAAI,MAA2D,CAAC;IAChE,MAAM,UAAU,GAAG,KAAK,IAA6C,EAAE;QACrE,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;YAAE,OAAO,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC5E,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;QAClH,IAAI,CAAC;YACH,OAAO,UAAU,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,CAAC;YAClE,uEAAuE;YACvE,kEAAkE;YAClE,qEAAqE;YACrE,0CAA0C;YAC1C,MAAM,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,gDAAgD,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/H,CAAC;IACH,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM;YAC9B,cAAc,CAAC,MAAM,CAAC,CAAC;YACvB,MAAM,KAAK,UAAU,EAAE,CAAC;YACxB,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC;YACjC,MAAM,KAAK,GAAG,WAAW;iBACtB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;iBACtD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9H,IAAI,KAAK,EAAE,KAAK,KAAK,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;iBACjF,IAAI,KAAK,EAAE,KAAK,KAAK,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5F,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,kCAAkC,GAAG,2BAA2B,CAAC;AAE9E,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAA+B,EAC/B,QAAgB,EAChB,MAAmB;IAEnB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,2BAA2B,CAAC,CAAC;IACvG,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QAC/B,cAAc,CAAC,MAAM,CAAC,CAAC;QACvB,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC;YAAE,MAAM,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC,CAAC;QACnI,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;QAC3B,IAAI,MAAM,GAAG,QAAQ;YAAE,MAAM,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAAC;QACxH,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;IAC7B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAiB;IAC1C,IAAI,CAAC;QACH,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,mCAAmC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAChH,CAAC;AACH,CAAC"}

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/logging/redaction.d.ts

@@ -0,0 +1,13 @@
+export type RedactedCommand = Readonly<{
+    executable: string;
+    args: readonly string[];
+}>;
+/**
+ * Rebuilds diagnostic text instead of relying on a best-effort stderr scrub.
+ * Explicit values are accepted for adapters that obtained a token from a
+ * credential provider; the structural substitutions cover common Git/HTTP
+ * credential forms even when an adapter forgot to register the value.
+ */
+export declare function redactText(value: string, secrets?: readonly string[]): string;
+export declare function redactCommand(executable: string, args: readonly string[], secrets?: readonly string[]): RedactedCommand;
+export declare function redactEnvironment(environment: Readonly<Record<string, string | undefined>>, secrets?: readonly string[]): Readonly<Record<string, string | undefined>>;

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/logging/redaction.js

@@ -0,0 +1,63 @@
+import { isSensitiveFieldName, isSensitiveQueryName, } from "../../domain/sensitive-fields.js";
+const URL_CREDENTIAL = /(\b[a-z][a-z0-9+.-]*:\/\/[^\s/@:]+:)[^\s/@]+(@)/gi;
+const URL_USERINFO = /(\b[a-z][a-z0-9+.-]*:\/\/)[^\s/@]+@/gi;
+const BEARER = /(\bBearer\s+)[^\s,;]+/gi;
+const BASIC = /(\bBasic\s+)[^\s,;]+/gi;
+const QUERY_VALUE = /([?&])([^=&#\s]+)=([^&#\s]*)/g;
+function replaceExplicitSecrets(value, secrets) {
+    return [...secrets]
+        .filter((secret) => secret.length > 0)
+        .sort((left, right) => right.length - left.length)
+        .reduce((result, secret) => result.split(secret).join("[REDACTED]"), value);
+}
+/**
+ * Rebuilds diagnostic text instead of relying on a best-effort stderr scrub.
+ * Explicit values are accepted for adapters that obtained a token from a
+ * credential provider; the structural substitutions cover common Git/HTTP
+ * credential forms even when an adapter forgot to register the value.
+ */
+export function redactText(value, secrets = []) {
+    if (typeof value !== "string")
+        return "[REDACTED]";
+    return replaceExplicitSecrets(value, secrets)
+        .replace(URL_CREDENTIAL, "$1[REDACTED]$2")
+        .replace(URL_USERINFO, "$1[REDACTED]@")
+        .replace(BEARER, "$1[REDACTED]")
+        .replace(BASIC, "$1[REDACTED]")
+        .replace(QUERY_VALUE, (match, prefix, rawName) => {
+        let name = rawName;
+        try {
+            name = decodeURIComponent(rawName);
+        }
+        catch {
+            // Malformed names are left intact; explicit secret redaction still ran.
+        }
+        return isSensitiveQueryName(name)
+            ? `${prefix}${rawName}=[REDACTED]`
+            : match;
+    });
+}
+export function redactCommand(executable, args, secrets = []) {
+    if (typeof executable !== "string" || executable.length === 0) {
+        throw new TypeError("command executable must be a non-empty string");
+    }
+    if (!Array.isArray(args) || args.some((arg) => typeof arg !== "string")) {
+        throw new TypeError("command arguments must be strings");
+    }
+    return Object.freeze({
+        executable: redactText(executable, secrets),
+        args: Object.freeze(args.map((arg) => redactText(arg, secrets))),
+    });
+}
+export function redactEnvironment(environment, secrets = []) {
+    const result = {};
+    for (const [key, value] of Object.entries(environment)) {
+        result[key] = value === undefined
+            ? undefined
+            : isSensitiveFieldName(key)
+                ? "[REDACTED]"
+                : redactText(value, secrets);
+    }
+    return Object.freeze(result);
+}
+//# sourceMappingURL=redaction.js.map

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/logging/redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../../../src/infrastructure/logging/redaction.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,kCAAkC,CAAC;AAM1C,MAAM,cAAc,GAAG,mDAAmD,CAAC;AAC3E,MAAM,YAAY,GAAG,uCAAuC,CAAC;AAC7D,MAAM,MAAM,GAAG,yBAAyB,CAAC;AACzC,MAAM,KAAK,GAAG,wBAAwB,CAAC;AACvC,MAAM,WAAW,GAAG,+BAA+B,CAAC;AAEpD,SAAS,sBAAsB,CAAC,KAAa,EAAE,OAA0B;IACvE,OAAO,CAAC,GAAG,OAAO,CAAC;SAChB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;SACrC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;SACjD,MAAM,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;AAChF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,OAAO,GAAsB,EAAE;IACvE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC;IACnD,OAAO,sBAAsB,CAAC,KAAK,EAAE,OAAO,CAAC;SAC1C,OAAO,CAAC,cAAc,EAAE,gBAAgB,CAAC;SACzC,OAAO,CAAC,YAAY,EAAE,eAAe,CAAC;SACtC,OAAO,CAAC,MAAM,EAAE,cAAc,CAAC;SAC/B,OAAO,CAAC,KAAK,EAAE,cAAc,CAAC;SAC9B,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,MAAc,EAAE,OAAe,EAAE,EAAE;QAC/D,IAAI,IAAI,GAAG,OAAO,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;QAC1E,CAAC;QACD,OAAO,oBAAoB,CAAC,IAAI,CAAC;YAC/B,CAAC,CAAC,GAAG,MAAM,GAAG,OAAO,aAAa;YAClC,CAAC,CAAC,KAAK,CAAC;IACZ,CAAC,CAAC,CAAC;AACP,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,UAAkB,EAClB,IAAuB,EACvB,OAAO,GAAsB,EAAE;IAE/B,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,SAAS,CAAC,+CAA+C,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,SAAS,CAAC,mCAAmC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC;QAC3C,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;KACjE,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,WAAyD,EACzD,OAAO,GAAsB,EAAE;IAE/B,MAAM,MAAM,GAAuC,EAAE,CAAC;IACtD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACvD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,KAAK,SAAS;YAC/B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC;gBACzB,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC"}

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/network/network-egress-policy.d.ts

@@ -0,0 +1,35 @@
+export type NetworkAddress = Readonly<{
+    address: string;
+    family: 4 | 6;
+}>;
+export type NetworkLookup = (hostname: string, options: Readonly<{
+    all: true;
+    verbatim: true;
+}>) => Promise<readonly NetworkAddress[]>;
+export type NetworkEgressPolicyOptions = Readonly<{
+    privateOrigins?: readonly string[];
+    credentialOrigins?: readonly string[];
+    redirectOrigins?: readonly string[];
+    lookup?: NetworkLookup;
+}>;
+export type ApprovedNetworkTarget = Readonly<{
+    url: URL;
+    protocol: "https:" | "ssh:";
+    origin: string;
+    hostname: string;
+    port: string;
+    address: string;
+    family: 4 | 6;
+    credentialsApproved: boolean;
+}>;
+export declare class NetworkEgressPolicyError extends Error {
+    readonly kind: "policy" | "resolution";
+    constructor(kind: "policy" | "resolution", message: string, cause?: unknown);
+}
+export declare function networkEgressPolicyOptionsFromEnvironment(environment: Readonly<Record<string, string | undefined>>): NetworkEgressPolicyOptions;
+export interface NetworkEgressPolicy {
+    origin(value: string): string;
+    authorize(value: string, protocol?: "https:" | "ssh:"): Promise<ApprovedNetworkTarget>;
+    redirectAllowed(fromOrigin: string, toOrigin: string): boolean;
+}
+export declare function createNetworkEgressPolicy(options?: NetworkEgressPolicyOptions): NetworkEgressPolicy;