@nklisch/pi-enhanced 0.2.3 → 0.2.4

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/http/bounded-fetch.d.ts

@@ -1,59 +0,0 @@
-import type { NetworkEgressPolicy } from "../network/network-egress-policy.js";
-/** A response body exposed as bytes only; callers must consume it exactly once. */
-export type BoundedFetchResponse = Readonly<{
-    status: number;
-    headers: Headers;
-    url: string;
-    body: AsyncIterable<Uint8Array>;
-}>;
-export type BoundedFetchRequest = Readonly<{
-    url: string;
-    maxBytes: number;
-    signal: AbortSignal;
-    /** Internal adapter override; never included in a response or source result. */
-    credentials?: NpmCredentialProvider;
-}>;
-export interface BoundedFetch {
-    request(request: BoundedFetchRequest): Promise<BoundedFetchResponse>;
-}
-/**
- * Credentials are applied to a private Headers object owned by the HTTP
- * adapter. The provider deliberately has no return value, so a token cannot
- * accidentally become part of a resolved source or an application result.
- */
-export type NpmCredentialProvider = Readonly<{
-    apply(url: URL, headers: Headers, signal: AbortSignal): void | Promise<void>;
-}> | ((url: URL, headers: Headers, signal: AbortSignal) => void | Promise<void>);
-export type BoundedFetchOptions = Readonly<{
-    /** Trusted test/host adapter. Production uses the DNS-pinned Node HTTPS path. */
-    fetch?: typeof globalThis.fetch;
-    credentials: NpmCredentialProvider;
-    egress: NetworkEgressPolicy;
-    maxRedirects?: number;
-}>;
-export type BoundedFetchErrorKind = "network" | "policy" | "credential" | "redirect" | "response" | "limit";
-/** Errors contain only safe classification data; the requested URL is not retained. */
-export declare class BoundedFetchError extends Error {
-    readonly kind: BoundedFetchErrorKind;
-    readonly status?: number;
-    constructor(input: Readonly<{
-        kind: BoundedFetchErrorKind;
-        message: string;
-        status?: number;
-        cause?: unknown;
-    }>);
-}
-export declare function createBoundedFetch(options: BoundedFetchOptions): BoundedFetch;
-/**
- * Minimal npmrc reader for the standard token/basic auth forms. It is kept in
- * the HTTP adapter so parsed credentials never cross into source contracts.
- */
-export declare function createNpmCredentialProvider(options?: Readonly<{
-    configPath?: string;
-    configText?: string;
-    home?: string;
-}>): NpmCredentialProvider;
-export declare const createDefaultNpmCredentialProvider: typeof createNpmCredentialProvider;
-/** A byte collector used by adapters that need bounded JSON rather than a stream. */
-export declare function collectBoundedBytes(body: AsyncIterable<Uint8Array>, maxBytes: number, signal: AbortSignal): Promise<Uint8Array>;
-export declare function decodeUtf8(bytes: Uint8Array): string;

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/http/bounded-fetch.js

@@ -1,381 +0,0 @@
-import { homedir } from "node:os";
-import { readFile } from "node:fs/promises";
-import { request as httpsRequest } from "node:https";
-import { join } from "node:path";
-import { Readable } from "node:stream";
-/** Errors contain only safe classification data; the requested URL is not retained. */
-export class BoundedFetchError extends Error {
-    kind;
-    status;
-    constructor(input) {
-        super(input.message, input.cause === undefined ? undefined : { cause: input.cause });
-        this.name = "BoundedFetchError";
-        this.kind = input.kind;
-        if (input.status !== undefined)
-            this.status = input.status;
-    }
-}
-const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
-function abortError(signal) {
-    return signal.reason ?? new DOMException("The operation was aborted", "AbortError");
-}
-function throwIfAborted(signal) {
-    if (signal.aborted)
-        throw abortError(signal);
-}
-function applyCredentials(provider, url, headers, signal) {
-    if (typeof provider === "function")
-        return Promise.resolve(provider(url, headers, signal));
-    if (typeof provider.apply !== "function")
-        throw new TypeError("npm credential provider must apply credentials");
-    return Promise.resolve(provider.apply(url, headers, signal));
-}
-function bodyFromResponse(response, maxBytes, signal) {
-    if (response.body === null) {
-        return (async function* empty() {
-            throwIfAborted(signal);
-        })();
-    }
-    return (async function* stream() {
-        const reader = response.body.getReader();
-        let total = 0;
-        try {
-            while (true) {
-                throwIfAborted(signal);
-                let next;
-                try {
-                    next = await reader.read();
-                }
-                catch (error) {
-                    if (signal.aborted)
-                        throw abortError(signal);
-                    throw new BoundedFetchError({ kind: "network", message: "HTTP response stream failed", cause: error });
-                }
-                if (next.done)
-                    return;
-                const chunk = next.value;
-                if (!(chunk instanceof Uint8Array)) {
-                    throw new BoundedFetchError({ kind: "response", message: "HTTP response body was not bytes" });
-                }
-                total += chunk.byteLength;
-                if (total > maxBytes) {
-                    throw new BoundedFetchError({ kind: "limit", message: "HTTP response exceeded its byte limit" });
-                }
-                if (chunk.byteLength > 0)
-                    yield new Uint8Array(chunk);
-            }
-        }
-        finally {
-            // Cancellation and parser failures must stop a slow or hostile server
-            // even when the consumer does not finish iterating the body.
-            await reader.cancel().catch(() => undefined);
-        }
-    })();
-}
-function location(response) {
-    const value = response.headers.get("location");
-    return value === null || value.length === 0 ? undefined : value;
-}
-function safeUrl(input) {
-    let value;
-    try {
-        value = new URL(input);
-    }
-    catch (error) {
-        throw new BoundedFetchError({ kind: "redirect", message: "HTTP URL is invalid", cause: error });
-    }
-    if (value.protocol !== "https:") {
-        throw new BoundedFetchError({ kind: "redirect", message: "HTTP URL must use HTTPS" });
-    }
-    if (value.username !== "" || value.password !== "") {
-        throw new BoundedFetchError({ kind: "redirect", message: "HTTP URL contains credentials" });
-    }
-    return value;
-}
-function pinnedLookup(target) {
-    return ((_hostname, options, callback) => {
-        if (options !== null && typeof options === "object" && "all" in options && options.all === true) {
-            callback(null, [{ address: target.address, family: target.family }]);
-        }
-        else {
-            callback(null, target.address, target.family);
-        }
-    });
-}
-function appendResponseHeaders(target, source) {
-    for (const [name, value] of Object.entries(source)) {
-        if (Array.isArray(value))
-            for (const item of value)
-                target.append(name, item);
-        else if (value !== undefined)
-            target.append(name, value);
-    }
-}
-function requestPinnedHttps(target, headers, signal) {
-    return new Promise((resolve, reject) => {
-        const request = httpsRequest(target.url, {
-            method: "GET",
-            headers: Object.fromEntries(headers.entries()),
-            lookup: pinnedLookup(target),
-            servername: target.hostname,
-            signal,
-        }, (incoming) => {
-            const responseHeaders = new Headers();
-            appendResponseHeaders(responseHeaders, incoming.headers);
-            resolve(new Response(Readable.toWeb(incoming), {
-                status: incoming.statusCode ?? 500,
-                ...(incoming.statusMessage === undefined ? {} : { statusText: incoming.statusMessage }),
-                headers: responseHeaders,
-            }));
-        });
-        request.once("error", reject);
-        request.end();
-    });
-}
-async function discard(response, signal) {
-    throwIfAborted(signal);
-    try {
-        await response.body?.cancel();
-    }
-    catch {
-        // The redirect target is authoritative; a body that is already closed does
-        // not change the redirect decision.
-    }
-}
-export function createBoundedFetch(options) {
-    if (options?.fetch !== undefined && typeof options.fetch !== "function")
-        throw new TypeError("bounded fetch adapter is invalid");
-    if (options.credentials === null || options.credentials === undefined) {
-        throw new TypeError("bounded fetch requires a credential provider");
-    }
-    if (options.egress === null || typeof options.egress?.origin !== "function" ||
-        typeof options.egress.authorize !== "function" || typeof options.egress.redirectAllowed !== "function") {
-        throw new TypeError("bounded fetch requires an egress policy");
-    }
-    const maxRedirects = options.maxRedirects ?? 5;
-    if (!Number.isSafeInteger(maxRedirects) || maxRedirects < 0) {
-        throw new TypeError("maxRedirects must be a nonnegative safe integer");
-    }
-    return {
-        async request(input) {
-            if (input === null || typeof input !== "object")
-                throw new TypeError("bounded fetch request is required");
-            if (!Number.isSafeInteger(input.maxBytes) || input.maxBytes <= 0) {
-                throw new TypeError("bounded fetch maxBytes must be positive");
-            }
-            if (typeof input.signal?.aborted !== "boolean")
-                throw new TypeError("bounded fetch requires an AbortSignal");
-            throwIfAborted(input.signal);
-            let current = safeUrl(input.url);
-            let initialOrigin;
-            for (let redirects = 0;; redirects += 1) {
-                throwIfAborted(input.signal);
-                let candidateOrigin;
-                try {
-                    candidateOrigin = options.egress.origin(current.toString());
-                }
-                catch (error) {
-                    throw new BoundedFetchError({ kind: "policy", message: "HTTP destination authority is invalid", cause: error });
-                }
-                initialOrigin ??= candidateOrigin;
-                if (!options.egress.redirectAllowed(initialOrigin, candidateOrigin)) {
-                    throw new BoundedFetchError({ kind: "redirect", message: "HTTP redirect changed authority" });
-                }
-                let target;
-                try {
-                    target = await options.egress.authorize(current.toString(), "https:");
-                }
-                catch (error) {
-                    if (input.signal.aborted)
-                        throw abortError(input.signal);
-                    throw new BoundedFetchError({ kind: "policy", message: "HTTP destination is not permitted", cause: error });
-                }
-                const headers = new Headers({ accept: "application/json, application/octet-stream" });
-                if (target.credentialsApproved) {
-                    try {
-                        await applyCredentials(input.credentials ?? options.credentials, current, headers, input.signal);
-                    }
-                    catch (error) {
-                        if (input.signal.aborted)
-                            throw abortError(input.signal);
-                        throw new BoundedFetchError({ kind: "credential", message: "HTTP credential adapter failed", cause: error });
-                    }
-                }
-                let response;
-                try {
-                    response = options.fetch === undefined
-                        ? await requestPinnedHttps(target, headers, input.signal)
-                        : await options.fetch(current, {
-                            method: "GET",
-                            headers,
-                            redirect: "manual",
-                            signal: input.signal,
-                        });
-                }
-                catch (error) {
-                    if (input.signal.aborted)
-                        throw abortError(input.signal);
-                    throw new BoundedFetchError({ kind: "network", message: "HTTP request failed", cause: error });
-                }
-                if (REDIRECT_STATUSES.has(response.status)) {
-                    const target = location(response);
-                    await discard(response, input.signal);
-                    if (target === undefined) {
-                        throw new BoundedFetchError({ kind: "redirect", message: "HTTP redirect has no location" });
-                    }
-                    if (redirects >= maxRedirects) {
-                        throw new BoundedFetchError({ kind: "redirect", message: "HTTP redirect limit exceeded" });
-                    }
-                    let next;
-                    try {
-                        next = new URL(target, current);
-                    }
-                    catch (error) {
-                        throw new BoundedFetchError({ kind: "redirect", message: "HTTP redirect location is invalid", cause: error });
-                    }
-                    // Rebuilding the request on every hop means Authorization is never
-                    // forwarded implicitly. The provider may elect to authorize the new
-                    // origin, but application code never sees those headers.
-                    current = safeUrl(next.toString());
-                    continue;
-                }
-                return {
-                    status: response.status,
-                    headers: response.headers,
-                    url: current.toString(),
-                    body: bodyFromResponse(response, input.maxBytes, input.signal),
-                };
-            }
-        },
-    };
-}
-function parseNpmrc(text) {
-    const result = [];
-    for (const rawLine of text.split(/\r?\n/u)) {
-        const line = rawLine.trim();
-        if (line.length === 0 || line.startsWith("#") || line.startsWith(";"))
-            continue;
-        const equals = line.indexOf("=");
-        if (equals <= 0)
-            continue;
-        const key = line.slice(0, equals).trim();
-        const value = line.slice(equals + 1).trim();
-        if (value.length === 0)
-            continue;
-        if (key.endsWith(":_authToken")) {
-            // npm's standard token form is `//host[:port]/path/:_authToken`.
-            // Parse the whole authority plus path rather than stopping at the first
-            // slash, so scoped registries and non-default ports remain distinct.
-            const scope = key.slice(0, -":_authToken".length);
-            try {
-                const parsed = new URL(`https:${scope}`);
-                if (!scope.startsWith("//") || !scope.endsWith("/") ||
-                    parsed.hostname.length === 0 || parsed.username !== "" || parsed.password !== "" ||
-                    parsed.search !== "" || parsed.hash !== "")
-                    continue;
-                result.push({ scope, token: value });
-            }
-            catch {
-                // Ignore malformed npmrc keys. They cannot authorize a request, while
-                // unreadable files remain an explicit credential adapter failure.
-            }
-            continue;
-        }
-        if (key === "_auth")
-            result.push({ scope: "//registry.npmjs.org/", basic: value });
-    }
-    return result;
-}
-function credentialScopeLength(scope, url) {
-    try {
-        if (url.protocol !== "https:")
-            return undefined;
-        const scoped = new URL(`https:${scope}`);
-        const scopedPort = scoped.port || "443";
-        const requestPort = url.port || "443";
-        if (scoped.hostname.toLowerCase() !== url.hostname.toLowerCase() || scopedPort !== requestPort)
-            return undefined;
-        // Scope paths are directory prefixes. Requiring the trailing slash from
-        // npmrc prevents `/team/` from authorizing `/teamwork/...`.
-        if (!url.pathname.startsWith(scoped.pathname))
-            return undefined;
-        return scoped.pathname.length;
-    }
-    catch {
-        return undefined;
-    }
-}
-function credentialApplies(scope, url) {
-    return credentialScopeLength(scope, url) !== undefined;
-}
-/**
- * Minimal npmrc reader for the standard token/basic auth forms. It is kept in
- * the HTTP adapter so parsed credentials never cross into source contracts.
- */
-export function createNpmCredentialProvider(options = {}) {
-    let loaded;
-    const readConfig = async () => {
-        if (options.configText !== undefined)
-            return parseNpmrc(options.configText);
-        const path = options.configPath ?? process.env.NPM_CONFIG_USERCONFIG ?? join(options.home ?? homedir(), ".npmrc");
-        try {
-            return parseNpmrc(await readFile(path, "utf8"));
-        }
-        catch (error) {
-            if (error.code === "ENOENT")
-                return [];
-            // An unreadable credential file is not equivalent to an empty one: the
-            // caller must be able to distinguish configuration failure from a
-            // genuinely anonymous request. Keep the path and contents out of the
-            // error; the cause remains adapter-local.
-            throw new BoundedFetchError({ kind: "credential", message: "npm credential configuration could not be read", cause: error });
-        }
-    };
-    return {
-        async apply(url, headers, signal) {
-            throwIfAborted(signal);
-            loaded ??= readConfig();
-            const credentials = await loaded;
-            const match = credentials
-                .filter((entry) => credentialApplies(entry.scope, url))
-                .sort((left, right) => (credentialScopeLength(right.scope, url) ?? -1) - (credentialScopeLength(left.scope, url) ?? -1))[0];
-            if (match?.token !== undefined)
-                headers.set("authorization", `Bearer ${match.token}`);
-            else if (match?.basic !== undefined)
-                headers.set("authorization", `Basic ${match.basic}`);
-        },
-    };
-}
-export const createDefaultNpmCredentialProvider = createNpmCredentialProvider;
-/** A byte collector used by adapters that need bounded JSON rather than a stream. */
-export async function collectBoundedBytes(body, maxBytes, signal) {
-    if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0)
-        throw new TypeError("maxBytes must be positive");
-    const chunks = [];
-    let length = 0;
-    for await (const chunk of body) {
-        throwIfAborted(signal);
-        if (!(chunk instanceof Uint8Array))
-            throw new BoundedFetchError({ kind: "response", message: "HTTP response body was not bytes" });
-        length += chunk.byteLength;
-        if (length > maxBytes)
-            throw new BoundedFetchError({ kind: "limit", message: "HTTP response exceeded its byte limit" });
-        chunks.push(chunk);
-    }
-    const output = new Uint8Array(length);
-    let offset = 0;
-    for (const chunk of chunks) {
-        output.set(chunk, offset);
-        offset += chunk.byteLength;
-    }
-    return output;
-}
-export function decodeUtf8(bytes) {
-    try {
-        return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
-    }
-    catch (error) {
-        throw new BoundedFetchError({ kind: "response", message: "HTTP response was not valid UTF-8", cause: error });
-    }
-}
-//# sourceMappingURL=bounded-fetch.js.map

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/http/bounded-fetch.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"bounded-fetch.js","sourceRoot":"","sources":["../../../src/infrastructure/http/bounded-fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AAErD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AA6CvC,uFAAuF;AACvF,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,IAAI,CAAwB;IAC5B,MAAM,CAAU;IAEzB,YAAY,KAKV;QACA,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QACrF,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACvB,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC7D,CAAC;CACF;AAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAE7D,SAAS,UAAU,CAAC,MAAmB;IACrC,OAAO,MAAM,CAAC,MAAM,IAAI,IAAI,YAAY,CAAC,2BAA2B,EAAE,YAAY,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,cAAc,CAAC,MAAmB;IACzC,IAAI,MAAM,CAAC,OAAO;QAAE,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,gBAAgB,CACvB,QAA+B,EAC/B,GAAQ,EACR,OAAgB,EAChB,MAAmB;IAEnB,IAAI,OAAO,QAAQ,KAAK,UAAU;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3F,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,UAAU;QAAE,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAC;IAChH,OAAO,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAkB,EAAE,QAAgB,EAAE,MAAmB;IACjF,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC3B,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,KAAK;YAC3B,cAAc,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IAED,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,MAAM;QAC5B,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAK,CAAC,SAAS,EAAE,CAAC;QAC1C,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,CAAC;YACH,OAAO,IAAI,EAAE,CAAC;gBACZ,cAAc,CAAC,MAAM,CAAC,CAAC;gBACvB,IAAI,IAA0C,CAAC;gBAC/C,IAAI,CAAC;oBACH,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC7B,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,MAAM,CAAC,OAAO;wBAAE,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;oBAC7C,MAAM,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,6BAA6B,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;gBACzG,CAAC;gBACD,IAAI,IAAI,CAAC,IAAI;oBAAE,OAAO;gBACtB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;gBACzB,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC,EAAE,CAAC;oBACnC,MAAM,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBACjG,CAAC;gBACD,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;gBAC1B,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;oBACrB,MAAM,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAAC;gBACnG,CAAC;gBACD,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC;oBAAE,MAAM,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,sEAAsE;YACtE,6DAA6D;YAC7D,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;AACP,CAAC;AAED,SAAS,QAAQ,CAAC,QAAkB;IAClC,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC/C,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AAClE,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,IAAI,KAAU,CAAC;IACf,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,qBAAqB,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,EAAE,IAAI,KAAK,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QACnD,MAAM,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,MAA6B;IACjD,OAAO,CAAC,CACN,SAAiB,EACjB,OAAgB,EAChB,QAAsC,EACtC,EAAE;QACF,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,IAAI,OAAO,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;YAChG,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACvE,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAA8B,CAAC;AAClC,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAe,EAAE,MAA+C;IAC7F,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;aACzE,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,MAA6B,EAC7B,OAAgB,EAChB,MAAmB;IAEnB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE;YACvC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YAC9C,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC;YAC5B,UAAU,EAAE,MAAM,CAAC,QAAQ;YAC3B,MAAM;SACP,EAAE,CAAC,QAAQ,EAAE,EAAE;YACd,MAAM,eAAe,GAAG,IAAI,OAAO,EAAE,CAAC;YACtC,qBAAqB,CAAC,eAAe,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;YACzD,OAAO,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAA+B,EAAE;gBAC3E,MAAM,EAAE,QAAQ,CAAC,UAAU,IAAI,GAAG;gBAClC,GAAG,CAAC,QAAQ,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC;gBACvF,OAAO,EAAE,eAAe;aACzB,CAAC,CAAC,CAAC;QACN,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,QAAkB,EAAE,MAAmB;IAC5D,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,oCAAoC;IACtC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAA4B;IAC7D,IAAI,OAAO,EAAE,KAAK,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,UAAU;QAAE,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAC;IACjI,IAAI,OAAO,CAAC,WAAW,KAAK,IAAI,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACtE,MAAM,IAAI,SAAS,CAAC,8CAA8C,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,OAAO,CAAC,MAAM,EAAE,MAAM,KAAK,UAAU;QACvE,OAAO,OAAO,CAAC,MAAM,CAAC,SAAS,KAAK,UAAU,IAAI,OAAO,OAAO,CAAC,MAAM,CAAC,eAAe,KAAK,UAAU,EAAE,CAAC;QAC3G,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAC;IACzE,CAAC;IAED,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,KAAK;YACjB,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,MAAM,IAAI,SAAS,CAAC,mCAAmC,CAAC,CAAC;YAC1G,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC;gBACjE,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;YACjE,CAAC;YACD,IAAI,OAAO,KAAK,CAAC,MAAM,EAAE,OAAO,KAAK,SAAS;gBAAE,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;YAC7G,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAE7B,IAAI,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,aAAiC,CAAC;YACtC,KAAK,IAAI,SAAS,GAAG,CAAC,GAAI,SAAS,IAAI,CAAC,EAAE,CAAC;gBACzC,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC7B,IAAI,eAAuB,CAAC;gBAC5B,IAAI,CAAC;oBACH,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC9D,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,uCAAuC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;gBAClH,CAAC;gBACD,aAAa,KAAK,eAAe,CAAC;gBAClC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,aAAa,EAAE,eAAe,CAAC,EAAE,CAAC;oBACpE,MAAM,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC,CAAC;gBAChG,CAAC;gBACD,IAAI,MAA6B,CAAC;gBAClC,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC;gBACxE,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;wBAAE,MAAM,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBACzD,MAAM,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,mCAAmC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC9G,CAAC;gBACD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC,CAAC;gBACtF,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;oBAC/B,IAAI,CAAC;wBACH,MAAM,gBAAgB,CAAC,KAAK,CAAC,WAAW,IAAI,OAAO,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;oBACnG,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;4BAAE,MAAM,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;wBACzD,MAAM,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,gCAAgC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;oBAC/G,CAAC;gBACH,CAAC;gBACD,IAAI,QAAkB,CAAC;gBACvB,IAAI,CAAC;oBACH,QAAQ,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS;wBACpC,CAAC,CAAC,MAAM,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC;wBACzD,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE;4BAC3B,MAAM,EAAE,KAAK;4BACb,OAAO;4BACP,QAAQ,EAAE,QAAQ;4BAClB,MAAM,EAAE,KAAK,CAAC,MAAM;yBACrB,CAAC,CAAC;gBACT,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;wBAAE,MAAM,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBACzD,MAAM,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,qBAAqB,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;gBACjG,CAAC;gBAED,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC3C,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;oBAClC,MAAM,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;oBACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;wBACzB,MAAM,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAC;oBAC9F,CAAC;oBACD,IAAI,SAAS,IAAI,YAAY,EAAE,CAAC;wBAC9B,MAAM,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;oBAC7F,CAAC;oBACD,IAAI,IAAS,CAAC;oBACd,IAAI,CAAC;wBACH,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;oBAClC,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,MAAM,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,mCAAmC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;oBAChH,CAAC;oBACD,mEAAmE;oBACnE,oEAAoE;oBACpE,yDAAyD;oBACzD,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;oBACnC,SAAS;gBACX,CAAC;gBAED,OAAO;oBACL,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;oBACzB,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE;oBACvB,IAAI,EAAE,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC;iBAC/D,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAQD,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,MAAM,GAA0B,EAAE,CAAC;IACzC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAChF,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,IAAI,CAAC;YAAE,SAAS;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACjC,IAAI,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YAChC,iEAAiE;YACjE,wEAAwE;YACxE,qEAAqE;YACrE,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAClD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC;gBACzC,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;oBAC/C,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE;oBAChF,MAAM,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE;oBAC1C,SAAS;gBACX,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,sEAAsE;gBACtE,kEAAkE;YACpE,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,OAAO;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa,EAAE,GAAQ;IACpD,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC;QACxC,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,IAAI,KAAK,CAAC;QACtC,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,UAAU,KAAK,WAAW;YAAE,OAAO,SAAS,CAAC;QACjH,wEAAwE;QACxE,4DAA4D;QAC5D,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC;YAAE,OAAO,SAAS,CAAC;QAChE,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa,EAAE,GAAQ;IAChD,OAAO,qBAAqB,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,SAAS,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,OAAO,GAI9C,EAAE;IACL,IAAI,MAA2D,CAAC;IAChE,MAAM,UAAU,GAAG,KAAK,IAA6C,EAAE;QACrE,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;YAAE,OAAO,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC5E,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;QAClH,IAAI,CAAC;YACH,OAAO,UAAU,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,CAAC;YAClE,uEAAuE;YACvE,kEAAkE;YAClE,qEAAqE;YACrE,0CAA0C;YAC1C,MAAM,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,gDAAgD,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/H,CAAC;IACH,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM;YAC9B,cAAc,CAAC,MAAM,CAAC,CAAC;YACvB,MAAM,KAAK,UAAU,EAAE,CAAC;YACxB,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC;YACjC,MAAM,KAAK,GAAG,WAAW;iBACtB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;iBACtD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9H,IAAI,KAAK,EAAE,KAAK,KAAK,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;iBACjF,IAAI,KAAK,EAAE,KAAK,KAAK,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5F,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,kCAAkC,GAAG,2BAA2B,CAAC;AAE9E,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAA+B,EAC/B,QAAgB,EAChB,MAAmB;IAEnB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,2BAA2B,CAAC,CAAC;IACvG,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QAC/B,cAAc,CAAC,MAAM,CAAC,CAAC;QACvB,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC;YAAE,MAAM,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC,CAAC;QACnI,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;QAC3B,IAAI,MAAM,GAAG,QAAQ;YAAE,MAAM,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAAC;QACxH,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;IAC7B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAiB;IAC1C,IAAI,CAAC;QACH,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,mCAAmC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAChH,CAAC;AACH,CAAC"}

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/logging/redaction.d.ts

@@ -1,13 +0,0 @@
-export type RedactedCommand = Readonly<{
-    executable: string;
-    args: readonly string[];
-}>;
-/**
- * Rebuilds diagnostic text instead of relying on a best-effort stderr scrub.
- * Explicit values are accepted for adapters that obtained a token from a
- * credential provider; the structural substitutions cover common Git/HTTP
- * credential forms even when an adapter forgot to register the value.
- */
-export declare function redactText(value: string, secrets?: readonly string[]): string;
-export declare function redactCommand(executable: string, args: readonly string[], secrets?: readonly string[]): RedactedCommand;
-export declare function redactEnvironment(environment: Readonly<Record<string, string | undefined>>, secrets?: readonly string[]): Readonly<Record<string, string | undefined>>;

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/logging/redaction.js

@@ -1,63 +0,0 @@
-import { isSensitiveFieldName, isSensitiveQueryName, } from "../../domain/sensitive-fields.js";
-const URL_CREDENTIAL = /(\b[a-z][a-z0-9+.-]*:\/\/[^\s/@:]+:)[^\s/@]+(@)/gi;
-const URL_USERINFO = /(\b[a-z][a-z0-9+.-]*:\/\/)[^\s/@]+@/gi;
-const BEARER = /(\bBearer\s+)[^\s,;]+/gi;
-const BASIC = /(\bBasic\s+)[^\s,;]+/gi;
-const QUERY_VALUE = /([?&])([^=&#\s]+)=([^&#\s]*)/g;
-function replaceExplicitSecrets(value, secrets) {
-    return [...secrets]
-        .filter((secret) => secret.length > 0)
-        .sort((left, right) => right.length - left.length)
-        .reduce((result, secret) => result.split(secret).join("[REDACTED]"), value);
-}
-/**
- * Rebuilds diagnostic text instead of relying on a best-effort stderr scrub.
- * Explicit values are accepted for adapters that obtained a token from a
- * credential provider; the structural substitutions cover common Git/HTTP
- * credential forms even when an adapter forgot to register the value.
- */
-export function redactText(value, secrets = []) {
-    if (typeof value !== "string")
-        return "[REDACTED]";
-    return replaceExplicitSecrets(value, secrets)
-        .replace(URL_CREDENTIAL, "$1[REDACTED]$2")
-        .replace(URL_USERINFO, "$1[REDACTED]@")
-        .replace(BEARER, "$1[REDACTED]")
-        .replace(BASIC, "$1[REDACTED]")
-        .replace(QUERY_VALUE, (match, prefix, rawName) => {
-        let name = rawName;
-        try {
-            name = decodeURIComponent(rawName);
-        }
-        catch {
-            // Malformed names are left intact; explicit secret redaction still ran.
-        }
-        return isSensitiveQueryName(name)
-            ? `${prefix}${rawName}=[REDACTED]`
-            : match;
-    });
-}
-export function redactCommand(executable, args, secrets = []) {
-    if (typeof executable !== "string" || executable.length === 0) {
-        throw new TypeError("command executable must be a non-empty string");
-    }
-    if (!Array.isArray(args) || args.some((arg) => typeof arg !== "string")) {
-        throw new TypeError("command arguments must be strings");
-    }
-    return Object.freeze({
-        executable: redactText(executable, secrets),
-        args: Object.freeze(args.map((arg) => redactText(arg, secrets))),
-    });
-}
-export function redactEnvironment(environment, secrets = []) {
-    const result = {};
-    for (const [key, value] of Object.entries(environment)) {
-        result[key] = value === undefined
-            ? undefined
-            : isSensitiveFieldName(key)
-                ? "[REDACTED]"
-                : redactText(value, secrets);
-    }
-    return Object.freeze(result);
-}
-//# sourceMappingURL=redaction.js.map

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/logging/redaction.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../../../src/infrastructure/logging/redaction.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,kCAAkC,CAAC;AAM1C,MAAM,cAAc,GAAG,mDAAmD,CAAC;AAC3E,MAAM,YAAY,GAAG,uCAAuC,CAAC;AAC7D,MAAM,MAAM,GAAG,yBAAyB,CAAC;AACzC,MAAM,KAAK,GAAG,wBAAwB,CAAC;AACvC,MAAM,WAAW,GAAG,+BAA+B,CAAC;AAEpD,SAAS,sBAAsB,CAAC,KAAa,EAAE,OAA0B;IACvE,OAAO,CAAC,GAAG,OAAO,CAAC;SAChB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;SACrC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;SACjD,MAAM,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;AAChF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,OAAO,GAAsB,EAAE;IACvE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC;IACnD,OAAO,sBAAsB,CAAC,KAAK,EAAE,OAAO,CAAC;SAC1C,OAAO,CAAC,cAAc,EAAE,gBAAgB,CAAC;SACzC,OAAO,CAAC,YAAY,EAAE,eAAe,CAAC;SACtC,OAAO,CAAC,MAAM,EAAE,cAAc,CAAC;SAC/B,OAAO,CAAC,KAAK,EAAE,cAAc,CAAC;SAC9B,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,MAAc,EAAE,OAAe,EAAE,EAAE;QAC/D,IAAI,IAAI,GAAG,OAAO,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;QAC1E,CAAC;QACD,OAAO,oBAAoB,CAAC,IAAI,CAAC;YAC/B,CAAC,CAAC,GAAG,MAAM,GAAG,OAAO,aAAa;YAClC,CAAC,CAAC,KAAK,CAAC;IACZ,CAAC,CAAC,CAAC;AACP,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,UAAkB,EAClB,IAAuB,EACvB,OAAO,GAAsB,EAAE;IAE/B,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,SAAS,CAAC,+CAA+C,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,SAAS,CAAC,mCAAmC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC;QAC3C,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;KACjE,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,WAAyD,EACzD,OAAO,GAAsB,EAAE;IAE/B,MAAM,MAAM,GAAuC,EAAE,CAAC;IACtD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACvD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,KAAK,SAAS;YAC/B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC;gBACzB,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC"}

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/network/network-egress-policy.d.ts

@@ -1,35 +0,0 @@
-export type NetworkAddress = Readonly<{
-    address: string;
-    family: 4 | 6;
-}>;
-export type NetworkLookup = (hostname: string, options: Readonly<{
-    all: true;
-    verbatim: true;
-}>) => Promise<readonly NetworkAddress[]>;
-export type NetworkEgressPolicyOptions = Readonly<{
-    privateOrigins?: readonly string[];
-    credentialOrigins?: readonly string[];
-    redirectOrigins?: readonly string[];
-    lookup?: NetworkLookup;
-}>;
-export type ApprovedNetworkTarget = Readonly<{
-    url: URL;
-    protocol: "https:" | "ssh:";
-    origin: string;
-    hostname: string;
-    port: string;
-    address: string;
-    family: 4 | 6;
-    credentialsApproved: boolean;
-}>;
-export declare class NetworkEgressPolicyError extends Error {
-    readonly kind: "policy" | "resolution";
-    constructor(kind: "policy" | "resolution", message: string, cause?: unknown);
-}
-export declare function networkEgressPolicyOptionsFromEnvironment(environment: Readonly<Record<string, string | undefined>>): NetworkEgressPolicyOptions;
-export interface NetworkEgressPolicy {
-    origin(value: string): string;
-    authorize(value: string, protocol?: "https:" | "ssh:"): Promise<ApprovedNetworkTarget>;
-    redirectAllowed(fromOrigin: string, toOrigin: string): boolean;
-}
-export declare function createNetworkEgressPolicy(options?: NetworkEgressPolicyOptions): NetworkEgressPolicy;