@nocobase/app-plugin-releases 0.0.0-stage → 0.1.0-beta.0

package/dist/server/services/environments.js

@@ -0,0 +1,508 @@
+/**
+ * Environments: where Apps are deployed. Each names a registered driver with its connection settings, write-only
+ * credentials (encrypted, never returned), a public URL rule, protection and approval settings and a limit of Apps.
+ */
+import { randomUUID } from 'node:crypto';
+import { capabilitiesFor, } from '../drivers/types.js';
+import { ReleasesError, notFound } from '../errors.js';
+import { decodeDate, decodeRecord, decodeStringArray, isRecord, nullableNumber, nullableString, } from './codec.js';
+import { decryptText, encryptText } from './secrets.js';
+import { assertVariableName, assertVariableValue, environmentVariableView, isSecretName, } from './variables.js';
+import { assertEnvironmentId, normalizeName, normalizeRuntimePolicy, positiveInteger, } from './validation.js';
+/** How long trying unsaved settings may take before it is reported as failed. */
+const DRAFT_CHECK_TIMEOUT_MS = 20_000;
+export class EnvironmentService {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    /** Anyone who may see environment settings, create Apps or open the Apps page may list environments. */
+    async list(caller) {
+        this.requireReader(caller);
+        const rows = await this.query()
+            .selectFrom('relEnvironments')
+            .selectAll()
+            .orderBy('name', 'asc')
+            .orderBy('id', 'asc')
+            .execute();
+        return rows.map((row) => this.decode(row));
+    }
+    async get(caller, id) {
+        this.requireReader(caller);
+        return await this.record(id);
+    }
+    drivers(caller) {
+        this.requireReader(caller);
+        return this.options.drivers.list().map(summarizeDriver);
+    }
+    async create(caller, input) {
+        this.options.guard.requireSetting(caller, 'rel.environments', 'manage');
+        if (typeof input?.id !== 'string')
+            throw new ReleasesError('An environment ID is required.', 'INVALID_ENVIRONMENT_ID', 'INVALID_ARGUMENT');
+        const id = input.id.trim();
+        assertEnvironmentId(id);
+        if (await this.find(id))
+            throw new ReleasesError('An environment with this ID already exists.', 'ENVIRONMENT_EXISTS', 'ALREADY_EXISTS');
+        const driver = this.requireDriver(input.driver);
+        const config = normalizeObject(input.config, 'INVALID_ENVIRONMENT_CONFIG');
+        const secret = mergeSecret(null, input);
+        await validateDriver(driver, config, secret);
+        const now = new Date();
+        const settings = normalizeSettings(input, undefined);
+        await this.assertRegistry(settings.registryId);
+        await this.query()
+            .insertInto('relEnvironments')
+            .values({
+            id,
+            name: normalizeName(input.name, 'INVALID_ENVIRONMENT_NAME'),
+            driver: driver.kind,
+            config: JSON.stringify(config),
+            secret: secret ? this.encrypt(id, secret) : null,
+            ...settings,
+            approvers: JSON.stringify(settings.approvers),
+            createdAt: now,
+            updatedAt: now,
+        })
+            .execute();
+        return await this.record(id);
+    }
+    async update(caller, id, input) {
+        this.options.guard.requireSetting(caller, 'rel.environments', 'manage');
+        const row = await this.findRow(id);
+        if (!row)
+            throw notFound('Environment', 'ENVIRONMENT_NOT_FOUND', id);
+        const current = this.decode(row);
+        if (input.driver !== undefined && input.driver !== current.driver)
+            throw new ReleasesError('An environment keeps its driver; create another environment instead.', 'ENVIRONMENT_DRIVER_FIXED', 'FAILED_PRECONDITION');
+        const driver = this.requireDriver(current.driver);
+        const config = input.config === undefined
+            ? current.config
+            : normalizeObject(input.config, 'INVALID_ENVIRONMENT_CONFIG');
+        // Its Apps run where the variant (the Host driver's run mode) put them, so it stays too.
+        const variantKey = driver.variants?.key;
+        if (variantKey && config[variantKey] !== current.config[variantKey])
+            throw new ReleasesError('An environment keeps its run mode; create another environment instead.', 'ENVIRONMENT_VARIANT_FIXED', 'FAILED_PRECONDITION');
+        const secretChanged = input.secret !== undefined || input.secretChanges !== undefined;
+        const secret = secretChanged
+            ? mergeSecret(input.secret === undefined ? this.decryptRow(row) : null, input)
+            : this.decryptRow(row);
+        await validateDriver(driver, config, secret);
+        const settings = normalizeSettings(input, current);
+        await this.assertRegistry(settings.registryId);
+        await this.query()
+            .updateTable('relEnvironments')
+            .set({
+            ...(input.name === undefined
+                ? {}
+                : { name: normalizeName(input.name, 'INVALID_ENVIRONMENT_NAME') }),
+            config: JSON.stringify(config),
+            ...(secretChanged
+                ? { secret: secret ? this.encrypt(id, secret) : null }
+                : {}),
+            ...settings,
+            approvers: JSON.stringify(settings.approvers),
+            updatedAt: new Date(),
+        })
+            .where('id', '=', id)
+            .execute();
+        await this.options.onChanged(id);
+        return await this.record(id);
+    }
+    async remove(caller, id) {
+        this.options.guard.requireSetting(caller, 'rel.environments', 'manage');
+        await this.record(id);
+        if ((await this.options.countApps(id)) > 0)
+            throw new ReleasesError('Remove the environment’s applications first.', 'ENVIRONMENT_IN_USE', 'FAILED_PRECONDITION');
+        await this.query()
+            .deleteFrom('relEnvironments')
+            .where('id', '=', id)
+            .execute();
+        await this.options.variables.removeEnvironment(id);
+        await this.options.onChanged(id);
+    }
+    // --- Variables ----------------------------------------------------------------------------------------------
+    /** The environment's variables; a secret's value never leaves the server. */
+    async listVariables(caller, id) {
+        this.options.guard.requireSetting(caller, 'rel.environments', 'read');
+        await this.record(id);
+        return (await this.options.variables.environmentVariables(id)).map(environmentVariableView);
+    }
+    /** Sets one variable every App of the environment gets, unless the App sets its own. */
+    async setVariable(caller, id, name, input) {
+        this.options.guard.requireSetting(caller, 'rel.environments', 'manage');
+        await this.record(id);
+        assertVariableName(name);
+        assertVariableValue(input?.value);
+        const description = input.description === undefined || input.description === null
+            ? input.description
+            : input.description.trim().slice(0, 1000) || null;
+        await this.options.variables.setEnvironmentVariable(id, name, {
+            value: input.value,
+            secret: input.secret ?? isSecretName(name),
+            ...(description === undefined ? {} : { description }),
+            by: caller.userId,
+        });
+        const stored = (await this.options.variables.environmentVariables(id)).find((variable) => variable.name === name);
+        return environmentVariableView(stored);
+    }
+    async unsetVariable(caller, id, name) {
+        this.options.guard.requireSetting(caller, 'rel.environments', 'manage');
+        await this.record(id);
+        if (!(await this.options.variables.unsetEnvironmentVariable(id, name)))
+            throw notFound('Variable', 'VARIABLE_NOT_FOUND', name);
+    }
+    async check(caller, id) {
+        this.options.guard.requireSetting(caller, 'rel.environments', 'read');
+        await this.record(id);
+        try {
+            return await this.options.check(id);
+        }
+        catch (error) {
+            return {
+                ok: false,
+                message: error instanceof Error ? error.message : String(error),
+            };
+        }
+    }
+    /**
+     * Tries settings before they are saved: the driver validates them, a session is opened on a throwaway environment
+     * ID (so it never replaces a running environment's session), checked and closed. Editing an environment, the
+     * credentials not changed are its stored ones.
+     */
+    async checkDraft(caller, input) {
+        this.options.guard.requireSetting(caller, 'rel.environments', 'manage');
+        const existing = typeof input?.id === 'string' && input.id.trim()
+            ? await this.findRow(input.id.trim())
+            : undefined;
+        const driver = this.requireDriver(existing ? String(existing.driver) : input?.driver);
+        const config = normalizeObject(input.config, 'INVALID_ENVIRONMENT_CONFIG');
+        const secret = mergeSecret(existing ? this.decryptRow(existing) : null, input);
+        await validateDriver(driver, config, secret);
+        const publicUrl = input.publicUrl === undefined
+            ? existing
+                ? nullableString(existing.publicUrl)
+                : null
+            : normalizePublicUrl(input.publicUrl);
+        let session;
+        let timer;
+        try {
+            const check = (async () => {
+                session = await driver.open({
+                    id: `check-${randomUUID().slice(0, 8)}`,
+                    name: typeof input.name === 'string' ? input.name : '',
+                    config,
+                    secret,
+                    publicUrl,
+                }, { desired: () => Promise.resolve([]) });
+                return await session.check();
+            })();
+            const timeout = new Promise((resolve) => {
+                timer = setTimeout(() => resolve({
+                    ok: false,
+                    message: `The check did not finish within ${DRAFT_CHECK_TIMEOUT_MS / 1000} seconds.`,
+                }), DRAFT_CHECK_TIMEOUT_MS);
+            });
+            const result = await Promise.race([check, timeout]);
+            // A check that lost the race still closes its session when it ends.
+            void check
+                .finally(() => session?.close().catch(() => undefined))
+                .catch(() => undefined);
+            return {
+                ok: result.ok,
+                ...(result.message
+                    ? { message: result.message }
+                    : result.ok
+                        ? {}
+                        : { message: 'The target is not ready yet.' }),
+                ...(result.details === undefined ? {} : { details: result.details }),
+            };
+        }
+        catch (error) {
+            await session?.close().catch(() => undefined);
+            return {
+                ok: false,
+                message: error instanceof Error ? error.message : String(error),
+            };
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
+    }
+    /** The environment record, without access checks: for the other services. */
+    async record(id) {
+        const row = await this.findRow(id);
+        if (!row)
+            throw notFound('Environment', 'ENVIRONMENT_NOT_FOUND', id);
+        return this.decode(row);
+    }
+    async find(id) {
+        const row = await this.findRow(id);
+        return row ? this.decode(row) : null;
+    }
+    /** Whether the environment runs release images (the Docker run mode) rather than archives. */
+    runsImages(environment) {
+        const driver = this.options.drivers.get(environment.driver);
+        return driver
+            ? capabilitiesFor(driver, environment.config).images === true
+            : false;
+    }
+    /** What a driver session is opened with: settings and decrypted credentials. */
+    async driverEnvironment(id) {
+        const row = await this.findRow(id);
+        if (!row)
+            throw notFound('Environment', 'ENVIRONMENT_NOT_FOUND', id);
+        const environment = this.decode(row);
+        const driver = this.options.drivers.get(environment.driver);
+        if (!driver)
+            throw new ReleasesError(`The deployment driver "${environment.driver}" is not available in this application.`, 'DRIVER_UNAVAILABLE', 'UNAVAILABLE');
+        return {
+            environment,
+            driver,
+            target: {
+                id: environment.id,
+                name: environment.name,
+                config: environment.config,
+                secret: this.decryptRow(row),
+                publicUrl: environment.publicUrl,
+            },
+        };
+    }
+    async assertRegistry(id) {
+        if (id === null)
+            return;
+        const row = await this.query()
+            .selectFrom('relRegistries')
+            .select('id')
+            .where('id', '=', id)
+            .executeTakeFirst();
+        if (!row)
+            throw new ReleasesError(`There is no registry ${id}.`, 'UNKNOWN_REGISTRY', 'INVALID_ARGUMENT', {
+                fieldViolations: [
+                    { field: 'registryId', description: `There is no registry ${id}.` },
+                ],
+            });
+    }
+    /** Anyone who may see environment settings, create Apps or open the Apps page reads environments and drivers. */
+    requireReader(caller) {
+        const { guard } = this.options;
+        if (guard.hasSetting(caller, 'rel.environments', 'read') ||
+            guard.hasPage(caller, 'rel-apps') ||
+            guard.scope(caller, 'create') === 'all')
+            return;
+        guard.requireSetting(caller, 'rel.environments', 'read');
+    }
+    requireDriver(kind) {
+        const driver = typeof kind === 'string' ? this.options.drivers.get(kind) : undefined;
+        if (!driver)
+            throw new ReleasesError('Choose a deployment driver this application offers.', 'INVALID_DRIVER', 'INVALID_ARGUMENT');
+        return driver;
+    }
+    encrypt(id, secret) {
+        return encryptText(JSON.stringify(secret), [id], this.options.secrets, 'environment-credentials');
+    }
+    /** The record with the names of its stored credentials; credentials that no longer decrypt name none. */
+    decode(row) {
+        let secretKeys;
+        try {
+            secretKeys = Object.keys(this.decryptRow(row) ?? {}).sort();
+        }
+        catch {
+            secretKeys = [];
+        }
+        const environment = decodeEnvironment(row, secretKeys);
+        const driver = this.options.drivers.get(environment.driver);
+        if (!driver)
+            return environment;
+        const found = capabilitiesFor(driver, environment.config);
+        const images = found.images === true;
+        return {
+            ...environment,
+            capabilities: {
+                archives: !images,
+                images,
+                onDemand: found.onDemand === true,
+            },
+        };
+    }
+    decryptRow(row) {
+        const value = nullableString(row.secret);
+        if (!value)
+            return null;
+        const plain = decryptText(value, [String(row.id)], this.options.secrets, 'environment-credentials');
+        const parsed = JSON.parse(plain);
+        return isRecord(parsed) ? parsed : null;
+    }
+    async findRow(id) {
+        return await this.query()
+            .selectFrom('relEnvironments')
+            .selectAll()
+            .where('id', '=', id)
+            .executeTakeFirst();
+    }
+    query() {
+        return this.options.database.connection().query;
+    }
+}
+export function decodeEnvironment(row, secretKeys = []) {
+    return {
+        id: String(row.id),
+        name: String(row.name),
+        driver: String(row.driver),
+        config: decodeRecord(row.config),
+        hasSecret: row.secret != null,
+        secretKeys,
+        publicUrl: nullableString(row.publicUrl),
+        protected: Boolean(row.protected),
+        approvers: decodeStringArray(row.approvers),
+        maxApps: nullableNumber(row.maxApps),
+        defaultIdleStopMinutes: nullableNumber(row.defaultIdleStopMinutes),
+        defaultDormantAfterHours: nullableNumber(row.defaultDormantAfterHours),
+        registryId: nullableString(row.registryId),
+        // Filled in from the driver by the service; nothing without one.
+        capabilities: { archives: false, images: false, onDemand: false },
+        sampleDataOnFirstDeploy: Boolean(row.sampleDataOnFirstDeploy),
+        createdAt: decodeDate(row.createdAt).toISOString(),
+        updatedAt: decodeDate(row.updatedAt).toISOString(),
+    };
+}
+function summarizeDriver(driver) {
+    return {
+        kind: driver.kind,
+        title: driver.title,
+        configSchema: driver.configSchema,
+        secretSchema: driver.secretSchema ?? null,
+        capabilities: capabilitiesView(driver.capabilities),
+        variants: driver.variants
+            ? {
+                key: driver.variants.key,
+                capabilities: Object.fromEntries(Object.entries(driver.variants.capabilities).map(([value, capabilities]) => [
+                    value,
+                    capabilitiesView(capabilities),
+                ])),
+            }
+            : null,
+        facts: driver.facts ?? null,
+    };
+}
+function capabilitiesView(capabilities) {
+    return {
+        ...capabilities,
+        onDemand: capabilities.onDemand === true,
+        images: capabilities.images === true,
+    };
+}
+/**
+ * The credentials after an input: `secret` replaces them (`null` clears), then `secretChanges` replaces the keys it
+ * names and removes the ones set to null. An empty result is no credentials.
+ */
+function mergeSecret(current, input) {
+    let secret = input.secret === undefined
+        ? current
+        : input.secret === null
+            ? null
+            : normalizeObject(input.secret, 'INVALID_ENVIRONMENT_SECRET');
+    if (input.secretChanges !== undefined) {
+        const changes = normalizeObject(input.secretChanges, 'INVALID_ENVIRONMENT_SECRET');
+        const next = { ...secret };
+        for (const [key, value] of Object.entries(changes))
+            if (value === null)
+                delete next[key];
+            else
+                next[key] = value;
+        secret = next;
+    }
+    if (secret && Object.keys(secret).length === 0)
+        return null;
+    return secret;
+}
+async function validateDriver(driver, config, secret) {
+    try {
+        await driver.validate?.(config, secret);
+    }
+    catch (error) {
+        throw new ReleasesError(error instanceof Error ? error.message : String(error), 'INVALID_ENVIRONMENT_CONFIG', 'INVALID_ARGUMENT');
+    }
+}
+function normalizeObject(value, code) {
+    if (value === undefined)
+        return {};
+    if (!isRecord(value))
+        throw new ReleasesError('Expected an object.', code, 'INVALID_ARGUMENT');
+    if (JSON.stringify(value).length > 64 * 1024)
+        throw new ReleasesError('Settings may be at most 64 KiB.', code, 'INVALID_ARGUMENT');
+    return value;
+}
+function normalizeSettings(input, current) {
+    const publicUrl = input.publicUrl === undefined
+        ? (current?.publicUrl ?? null)
+        : normalizePublicUrl(input.publicUrl);
+    const approvers = input.approvers === undefined
+        ? (current?.approvers ?? [])
+        : normalizeApprovers(input.approvers);
+    return {
+        publicUrl,
+        protected: optionalBoolean(input.protected, current?.protected ?? false),
+        approvers,
+        maxApps: optionalLimit(input.maxApps, current?.maxApps ?? null),
+        ...appDefaults(input, current),
+        registryId: optionalRegistryId(input.registryId, current?.registryId ?? null),
+        sampleDataOnFirstDeploy: optionalBoolean(input.sampleDataOnFirstDeploy, current?.sampleDataOnFirstDeploy ?? false),
+    };
+}
+/** The runtime policy Apps created in the environment take, validated as an App's own. */
+function appDefaults(input, current) {
+    const policy = normalizeRuntimePolicy({
+        idleStopMinutes: input.defaultIdleStopMinutes,
+        dormantAfterHours: input.defaultDormantAfterHours,
+    }, {
+        activation: 'eager',
+        idleStopMinutes: current?.defaultIdleStopMinutes ?? null,
+        dormantAfterHours: current?.defaultDormantAfterHours ?? null,
+    });
+    return {
+        defaultIdleStopMinutes: policy.idleStopMinutes,
+        defaultDormantAfterHours: policy.dormantAfterHours,
+    };
+}
+function optionalRegistryId(value, fallback) {
+    if (value === undefined)
+        return fallback;
+    if (value === null || value === '')
+        return null;
+    if (typeof value !== 'string' || value.length > 64)
+        throw new ReleasesError('registryId names a registry.', 'INVALID_ENVIRONMENT_SETTINGS', 'INVALID_ARGUMENT');
+    return value;
+}
+function optionalBoolean(value, fallback) {
+    if (value === undefined)
+        return fallback;
+    if (typeof value !== 'boolean')
+        throw new ReleasesError('Expected true or false.', 'INVALID_ENVIRONMENT_SETTINGS', 'INVALID_ARGUMENT');
+    return value;
+}
+function optionalLimit(value, fallback) {
+    if (value === undefined)
+        return fallback;
+    if (value === null)
+        return null;
+    return positiveInteger(value, 'INVALID_ENVIRONMENT_LIMIT', 100_000);
+}
+function normalizePublicUrl(value) {
+    if (value === null || value === '')
+        return null;
+    if (typeof value !== 'string' ||
+        value.length > 1024 ||
+        !value.includes('{appId}') ||
+        !/^(https?:\/\/[^\s]+|\/[^\s]*)$/.test(value))
+        throw new ReleasesError('The public URL must be an http(s) URL or an absolute path containing {appId}.', 'INVALID_PUBLIC_URL', 'INVALID_ARGUMENT');
+    return value;
+}
+function normalizeApprovers(value) {
+    if (!Array.isArray(value) ||
+        value.length > 100 ||
+        value.some((item) => typeof item !== 'string' || !item.trim() || item.length > 128))
+        throw new ReleasesError('Approvers must be a list of at most 100 references.', 'INVALID_APPROVERS', 'INVALID_ARGUMENT');
+    return [...new Set(value.map((item) => item.trim()))];
+}
+//# sourceMappingURL=environments.js.map

package/dist/server/services/environments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"environments.js","sourceRoot":"","sources":["../../../server/services/environments.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAczC,OAAO,EACL,eAAe,GAIhB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EACL,UAAU,EACV,YAAY,EACZ,iBAAiB,EACjB,QAAQ,EACR,cAAc,EACd,cAAc,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,WAAW,EAAE,WAAW,EAAwB,MAAM,cAAc,CAAC;AAC9E,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,YAAY,GAEb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,sBAAsB,EACtB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AAEzB,iFAAiF;AACjF,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAoBtC,MAAM,OAAO,kBAAkB;IACO;IAApC,YAAoC,OAAkC;QAAlC,YAAO,GAAP,OAAO,CAA2B;IAAG,CAAC;IAE1E,wGAAwG;IACjG,KAAK,CAAC,IAAI,CAAC,MAAc;QAC9B,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE;aAC5B,UAAU,CAAC,iBAAiB,CAAC;aAC7B,SAAS,EAAE;aACX,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC;aACtB,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;aACpB,OAAO,EAAO,CAAC;QAClB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,CAAC;IAEM,KAAK,CAAC,GAAG,CAAC,MAAc,EAAE,EAAU;QACzC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAC3B,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;IAEM,OAAO,CAAC,MAAc;QAC3B,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC1D,CAAC;IAEM,KAAK,CAAC,MAAM,CACjB,MAAc,EACd,KAAuB;QAEvB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,kBAAkB,EAAE,QAAQ,CAAC,CAAC;QACxE,IAAI,OAAO,KAAK,EAAE,EAAE,KAAK,QAAQ;YAC/B,MAAM,IAAI,aAAa,CACrB,gCAAgC,EAChC,wBAAwB,EACxB,kBAAkB,CACnB,CAAC;QACJ,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC3B,mBAAmB,CAAC,EAAE,CAAC,CAAC;QACxB,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,aAAa,CACrB,6CAA6C,EAC7C,oBAAoB,EACpB,gBAAgB,CACjB,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACxC,MAAM,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QACrD,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,IAAI,CAAC,KAAK,EAAE;aACf,UAAU,CAAC,iBAAiB,CAAC;aAC7B,MAAM,CAAC;YACN,EAAE;YACF,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,0BAA0B,CAAC;YAC3D,MAAM,EAAE,MAAM,CAAC,IAAI;YACnB,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YAC9B,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;YAChD,GAAG,QAAQ;YACX,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC7C,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;SACf,CAAC;aACD,OAAO,EAAE,CAAC;QACb,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;IAEM,KAAK,CAAC,MAAM,CACjB,MAAc,EACd,EAAU,EACV,KAAuB;QAEvB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,kBAAkB,EAAE,QAAQ,CAAC,CAAC;QACxE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG;YAAE,MAAM,QAAQ,CAAC,aAAa,EAAE,uBAAuB,EAAE,EAAE,CAAC,CAAC;QACrE,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;YAC/D,MAAM,IAAI,aAAa,CACrB,sEAAsE,EACtE,0BAA0B,EAC1B,qBAAqB,CACtB,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,MAAM,GACV,KAAK,CAAC,MAAM,KAAK,SAAS;YACxB,CAAC,CAAC,OAAO,CAAC,MAAM;YAChB,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC;QAClE,yFAAyF;QACzF,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC;QACxC,IAAI,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;YACjE,MAAM,IAAI,aAAa,CACrB,wEAAwE,EACxE,2BAA2B,EAC3B,qBAAqB,CACtB,CAAC;QACJ,MAAM,aAAa,GACjB,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC;QAClE,MAAM,MAAM,GAAG,aAAa;YAC1B,CAAC,CAAC,WAAW,CACT,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EACxD,KAAK,CACN;YACH,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,IAAI,CAAC,KAAK,EAAE;aACf,WAAW,CAAC,iBAAiB,CAAC;aAC9B,GAAG,CAAC;YACH,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS;gBAC1B,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,0BAA0B,CAAC,EAAE,CAAC;YACpE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YAC9B,GAAG,CAAC,aAAa;gBACf,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;gBACtD,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,QAAQ;YACX,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC7C,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;aACD,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;aACpB,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACjC,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,EAAU;QAC5C,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,kBAAkB,EAAE,QAAQ,CAAC,CAAC;QACxE,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtB,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC;YACxC,MAAM,IAAI,aAAa,CACrB,8CAA8C,EAC9C,oBAAoB,EACpB,qBAAqB,CACtB,CAAC;QACJ,MAAM,IAAI,CAAC,KAAK,EAAE;aACf,UAAU,CAAC,iBAAiB,CAAC;aAC7B,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;aACpB,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,+GAA+G;IAE/G,6EAA6E;IACtE,KAAK,CAAC,aAAa,CACxB,MAAc,EACd,EAAU;QAEV,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC;QACtE,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtB,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAChE,uBAAuB,CACxB,CAAC;IACJ,CAAC;IAED,wFAAwF;IACjF,KAAK,CAAC,WAAW,CACtB,MAAc,EACd,EAAU,EACV,IAAY,EACZ,KAAkC;QAElC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,kBAAkB,EAAE,QAAQ,CAAC,CAAC;QACxE,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtB,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACzB,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAClC,MAAM,WAAW,GACf,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI;YAC3D,CAAC,CAAC,KAAK,CAAC,WAAW;YACnB,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC;QACtD,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,sBAAsB,CAAC,EAAE,EAAE,IAAI,EAAE;YAC5D,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,YAAY,CAAC,IAAI,CAAC;YAC1C,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;YACrD,EAAE,EAAE,MAAM,CAAC,MAAM;SAClB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CACzE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI,CACpC,CAAC;QACH,OAAO,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IAEM,KAAK,CAAC,aAAa,CACxB,MAAc,EACd,EAAU,EACV,IAAY;QAEZ,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,kBAAkB,EAAE,QAAQ,CAAC,CAAC;QACxE,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,wBAAwB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACpE,MAAM,QAAQ,CAAC,UAAU,EAAE,oBAAoB,EAAE,IAAI,CAAC,CAAC;IAC3D,CAAC;IAEM,KAAK,CAAC,KAAK,CAChB,MAAc,EACd,EAAU;QAEV,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC;QACtE,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAChE,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,UAAU,CACrB,MAAc,EACd,KAA4B;QAE5B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,kBAAkB,EAAE,QAAQ,CAAC,CAAC;QACxE,MAAM,QAAQ,GACZ,OAAO,KAAK,EAAE,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE;YAC9C,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;YACrC,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAC/B,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CACnD,CAAC;QACF,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,WAAW,CACxB,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAC3C,KAAK,CACN,CAAC;QACF,MAAM,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,SAAS,GACb,KAAK,CAAC,SAAS,KAAK,SAAS;YAC3B,CAAC,CAAC,QAAQ;gBACR,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC;gBACpC,CAAC,CAAC,IAAI;YACR,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,OAAkE,CAAC;QACvE,IAAI,KAAgD,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE;gBACxB,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CACzB;oBACE,EAAE,EAAE,SAAS,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;oBACvC,IAAI,EAAE,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;oBACtD,MAAM;oBACN,MAAM;oBACN,SAAS;iBACV,EACD,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CACvC,CAAC;gBACF,OAAO,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;YAC/B,CAAC,CAAC,EAAE,CAAC;YACL,MAAM,OAAO,GAAG,IAAI,OAAO,CAAyB,CAAC,OAAO,EAAE,EAAE;gBAC9D,KAAK,GAAG,UAAU,CAChB,GAAG,EAAE,CACH,OAAO,CAAC;oBACN,EAAE,EAAE,KAAK;oBACT,OAAO,EAAE,mCAAmC,sBAAsB,GAAG,IAAI,WAAW;iBACrF,CAAC,EACJ,sBAAsB,CACvB,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;YACpD,oEAAoE;YACpE,KAAK,KAAK;iBACP,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;iBACtD,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC1B,OAAO;gBACL,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,GAAG,CAAC,MAAM,CAAC,OAAO;oBAChB,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;oBAC7B,CAAC,CAAC,MAAM,CAAC,EAAE;wBACT,CAAC,CAAC,EAAE;wBACJ,CAAC,CAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;gBAClD,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;aACrE,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC9C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAChE,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,6EAA6E;IACtE,KAAK,CAAC,MAAM,CAAC,EAAU;QAC5B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG;YAAE,MAAM,QAAQ,CAAC,aAAa,EAAE,uBAAuB,EAAE,EAAE,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,EAAU;QAC1B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC;IAED,8FAA8F;IACvF,UAAU,CAAC,WAA8B;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC5D,OAAO,MAAM;YACX,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,IAAI;YAC7D,CAAC,CAAC,KAAK,CAAC;IACZ,CAAC;IAED,gFAAgF;IACzE,KAAK,CAAC,iBAAiB,CAAC,EAAU;QAKvC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG;YAAE,MAAM,QAAQ,CAAC,aAAa,EAAE,uBAAuB,EAAE,EAAE,CAAC,CAAC;QACrE,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,aAAa,CACrB,0BAA0B,WAAW,CAAC,MAAM,yCAAyC,EACrF,oBAAoB,EACpB,aAAa,CACd,CAAC;QACJ,OAAO;YACL,WAAW;YACX,MAAM;YACN,MAAM,EAAE;gBACN,EAAE,EAAE,WAAW,CAAC,EAAE;gBAClB,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAC5B,SAAS,EAAE,WAAW,CAAC,SAAS;aACjC;SACF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,EAAiB;QAC5C,IAAI,EAAE,KAAK,IAAI;YAAE,OAAO;QACxB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE;aAC3B,UAAU,CAAC,eAAe,CAAC;aAC3B,MAAM,CAAC,IAAI,CAAC;aACZ,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;aACpB,gBAAgB,EAAO,CAAC;QAC3B,IAAI,CAAC,GAAG;YACN,MAAM,IAAI,aAAa,CACrB,wBAAwB,EAAE,GAAG,EAC7B,kBAAkB,EAClB,kBAAkB,EAClB;gBACE,eAAe,EAAE;oBACf,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,wBAAwB,EAAE,GAAG,EAAE;iBACpE;aACF,CACF,CAAC;IACN,CAAC;IAED,iHAAiH;IAC1G,aAAa,CAAC,MAAc;QACjC,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAC/B,IACE,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,kBAAkB,EAAE,MAAM,CAAC;YACpD,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC;YACjC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,KAAK;YAEvC,OAAO;QACT,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC;IAC3D,CAAC;IAEO,aAAa,CAAC,IAAa;QACjC,MAAM,MAAM,GACV,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,aAAa,CACrB,qDAAqD,EACrD,gBAAgB,EAChB,kBAAkB,CACnB,CAAC;QACJ,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,OAAO,CAAC,EAAU,EAAE,MAA+B;QACzD,OAAO,WAAW,CAChB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EACtB,CAAC,EAAE,CAAC,EACJ,IAAI,CAAC,OAAO,CAAC,OAAO,EACpB,yBAAyB,CAC1B,CAAC;IACJ,CAAC;IAED,yGAAyG;IACjG,MAAM,CAAC,GAAQ;QACrB,IAAI,UAA6B,CAAC;QAClC,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,GAAG,EAAE,CAAC;QAClB,CAAC;QACD,MAAM,WAAW,GAAG,iBAAiB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM;YAAE,OAAO,WAAW,CAAC;QAChC,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC;QACrC,OAAO;YACL,GAAG,WAAW;YACd,YAAY,EAAE;gBACZ,QAAQ,EAAE,CAAC,MAAM;gBACjB,MAAM;gBACN,QAAQ,EAAE,KAAK,CAAC,QAAQ,KAAK,IAAI;aAClC;SACF,CAAC;IACJ,CAAC;IAEO,UAAU,CAAC,GAAQ;QACzB,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,KAAK,GAAG,WAAW,CACvB,KAAK,EACL,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAChB,IAAI,CAAC,OAAO,CAAC,OAAO,EACpB,yBAAyB,CAC1B,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAC;QAC5C,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1C,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,EAAU;QAC9B,OAAO,MAAM,IAAI,CAAC,KAAK,EAAE;aACtB,UAAU,CAAC,iBAAiB,CAAC;aAC7B,SAAS,EAAE;aACX,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;aACpB,gBAAgB,EAAO,CAAC;IAC7B,CAAC;IAEO,KAAK;QACX,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC;IAClD,CAAC;CACF;AAED,MAAM,UAAU,iBAAiB,CAC/B,GAAQ,EACR,aAAgC,EAAE;IAElC,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;QACtB,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;QAC1B,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;QAChC,SAAS,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI;QAC7B,UAAU;QACV,SAAS,EAAE,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC;QACxC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QACjC,SAAS,EAAE,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC;QAC3C,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC;QACpC,sBAAsB,EAAE,cAAc,CAAC,GAAG,CAAC,sBAAsB,CAAC;QAClE,wBAAwB,EAAE,cAAc,CAAC,GAAG,CAAC,wBAAwB,CAAC;QACtE,UAAU,EAAE,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC;QAC1C,iEAAiE;QACjE,YAAY,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE;QACjE,uBAAuB,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;QAC7D,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;QAClD,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;KACnD,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,MAAwB;IAC/C,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI;QACzC,YAAY,EAAE,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC;QACnD,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACvB,CAAC,CAAC;gBACE,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG;gBACxB,YAAY,EAAE,MAAM,CAAC,WAAW,CAC9B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,GAAG,CAC9C,CAAC,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC;oBACzB,KAAK;oBACL,gBAAgB,CAAC,YAAY,CAAC;iBAC/B,CACF,CACF;aACF;YACH,CAAC,CAAC,IAAI;QACR,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,YAA8C;IAE9C,OAAO;QACL,GAAG,YAAY;QACf,QAAQ,EAAE,YAAY,CAAC,QAAQ,KAAK,IAAI;QACxC,MAAM,EAAE,YAAY,CAAC,MAAM,KAAK,IAAI;KACrC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAClB,OAAuC,EACvC,KAAyD;IAEzD,IAAI,MAAM,GACR,KAAK,CAAC,MAAM,KAAK,SAAS;QACxB,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI;YACrB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,eAAe,CAC7B,KAAK,CAAC,aAAa,EACnB,4BAA4B,CAC7B,CAAC;QACF,MAAM,IAAI,GAA4B,EAAE,GAAG,MAAM,EAAE,CAAC;QACpD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;YAChD,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;;gBAChC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACzB,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,MAAwB,EACxB,MAA+B,EAC/B,MAAsC;IAEtC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,aAAa,CACrB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACtD,4BAA4B,EAC5B,kBAAkB,CACnB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CACtB,KAAc,EACd,IAAY;IAEZ,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAClB,MAAM,IAAI,aAAa,CAAC,qBAAqB,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAC3E,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI;QAC1C,MAAM,IAAI,aAAa,CACrB,iCAAiC,EACjC,IAAI,EACJ,kBAAkB,CACnB,CAAC;IACJ,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAuB,EACvB,OAAsC;IAWtC,MAAM,SAAS,GACb,KAAK,CAAC,SAAS,KAAK,SAAS;QAC3B,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC;QAC9B,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,SAAS,GACb,KAAK,CAAC,SAAS,KAAK,SAAS;QAC3B,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,IAAI,EAAE,CAAC;QAC5B,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1C,OAAO;QACL,SAAS;QACT,SAAS,EAAE,eAAe,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,KAAK,CAAC;QACxE,SAAS;QACT,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,IAAI,CAAC;QAC/D,GAAG,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC;QAC9B,UAAU,EAAE,kBAAkB,CAC5B,KAAK,CAAC,UAAU,EAChB,OAAO,EAAE,UAAU,IAAI,IAAI,CAC5B;QACD,uBAAuB,EAAE,eAAe,CACtC,KAAK,CAAC,uBAAuB,EAC7B,OAAO,EAAE,uBAAuB,IAAI,KAAK,CAC1C;KACF,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,SAAS,WAAW,CAClB,KAAuB,EACvB,OAAsC;IAKtC,MAAM,MAAM,GAAG,sBAAsB,CACnC;QACE,eAAe,EAAE,KAAK,CAAC,sBAAsB;QAC7C,iBAAiB,EAAE,KAAK,CAAC,wBAAwB;KAClD,EACD;QACE,UAAU,EAAE,OAAO;QACnB,eAAe,EAAE,OAAO,EAAE,sBAAsB,IAAI,IAAI;QACxD,iBAAiB,EAAE,OAAO,EAAE,wBAAwB,IAAI,IAAI;KAC7D,CACF,CAAC;IACF,OAAO;QACL,sBAAsB,EAAE,MAAM,CAAC,eAAe;QAC9C,wBAAwB,EAAE,MAAM,CAAC,iBAAiB;KACnD,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,KAAc,EACd,QAAuB;IAEvB,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACzC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE;QAChD,MAAM,IAAI,aAAa,CACrB,8BAA8B,EAC9B,8BAA8B,EAC9B,kBAAkB,CACnB,CAAC;IACJ,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,QAAiB;IACxD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACzC,IAAI,OAAO,KAAK,KAAK,SAAS;QAC5B,MAAM,IAAI,aAAa,CACrB,yBAAyB,EACzB,8BAA8B,EAC9B,kBAAkB,CACnB,CAAC;IACJ,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,QAAuB;IAC5D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACzC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,eAAe,CAAC,KAAK,EAAE,2BAA2B,EAAE,OAAO,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAChD,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,GAAG,IAAI;QACnB,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC1B,CAAC,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC;QAE7C,MAAM,IAAI,aAAa,CACrB,+EAA+E,EAC/E,oBAAoB,EACpB,kBAAkB,CACnB,CAAC;IACJ,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,KAAK,CAAC,MAAM,GAAG,GAAG;QAClB,KAAK,CAAC,IAAI,CACR,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,CACxE;QAED,MAAM,IAAI,aAAa,CACrB,qDAAqD,EACrD,mBAAmB,EACnB,kBAAkB,CACnB,CAAC;IACJ,OAAO,CAAC,GAAG,IAAI,GAAG,CAAE,KAAkB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACtE,CAAC"}

package/dist/server/services/events.d.ts

@@ -0,0 +1,11 @@
+import { type Logger } from '@nocobase/logging';
+import type { ReleasesEvent, ReleasesEventListener, ReleasesEvents } from '../tokens.js';
+/** Delivers events to the application's listeners in order; a failing listener is logged and skipped. */
+export declare class ReleasesEventBus implements ReleasesEvents {
+    private readonly listeners;
+    private readonly diagnostic;
+    constructor(logger?: Logger);
+    subscribe(listener: ReleasesEventListener): () => void;
+    emit(event: ReleasesEvent): Promise<void>;
+}
+//# sourceMappingURL=events.d.ts.map

package/dist/server/services/events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../../server/services/events.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,KAAK,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAExE,OAAO,KAAK,EACV,aAAa,EACb,qBAAqB,EACrB,cAAc,EACf,MAAM,cAAc,CAAC;AAEtB,yGAAyG;AACzG,qBAAa,gBAAiB,YAAW,cAAc;IACrD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;IAC9D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4C;gBAEpD,MAAM,CAAC,EAAE,MAAM;IAI3B,SAAS,CAAC,QAAQ,EAAE,qBAAqB,GAAG,MAAM,IAAI;IAOhD,IAAI,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;CAYvD"}

package/dist/server/services/events.js

@@ -0,0 +1,26 @@
+import { createDiagnosticLogger } from '@nocobase/logging';
+/** Delivers events to the application's listeners in order; a failing listener is logged and skipped. */
+export class ReleasesEventBus {
+    listeners = new Set();
+    diagnostic;
+    constructor(logger) {
+        this.diagnostic = createDiagnosticLogger(logger);
+    }
+    subscribe(listener) {
+        this.listeners.add(listener);
+        return () => {
+            this.listeners.delete(listener);
+        };
+    }
+    async emit(event) {
+        for (const listener of [...this.listeners]) {
+            try {
+                await listener(event);
+            }
+            catch (error) {
+                this.diagnostic.error(`A releases listener failed on ${event.type}`, error);
+            }
+        }
+    }
+}
+//# sourceMappingURL=events.js.map

package/dist/server/services/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../../../server/services/events.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAe,MAAM,mBAAmB,CAAC;AAQxE,yGAAyG;AACzG,MAAM,OAAO,gBAAgB;IACV,SAAS,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC7C,UAAU,CAA4C;IAEvE,YAAmB,MAAe;QAChC,IAAI,CAAC,UAAU,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IACnD,CAAC;IAEM,SAAS,CAAC,QAA+B;QAC9C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,GAAG,EAAE;YACV,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,KAAoB;QACpC,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;YACxB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,UAAU,CAAC,KAAK,CACnB,iCAAiC,KAAK,CAAC,IAAI,EAAE,EAC7C,KAAK,CACN,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/server/services/registries.d.ts

@@ -0,0 +1,67 @@
+/**
+ * OCI image registries (`relRegistries`): where an App's CI pushes its release images and Docker environments pull
+ * them from, by digest. Only the OCI Distribution API is assumed, so GHCR, a cloud registry, Harbor, Zot or a plain
+ * `registry` all work. A registry holds pull credentials, write-only like an environment's, which a deployment hands
+ * to its driver (`pullAuth`); the username is kept in the clear, the password encrypted under the registry's ID.
+ */
+import type { DatabaseManager } from '@nocobase/db';
+import { type RegistryCheckResult, type RegistryInput, type RegistryRecord } from '../../shared/releases.js';
+import type { AccessGuard, Caller } from '../access/caller.js';
+import type { RegistryAuth } from '../drivers/types.js';
+import { type ReleasesSecrets } from './secrets.js';
+export interface RegistryServiceOptions {
+    readonly database: DatabaseManager;
+    readonly guard: AccessGuard;
+    /** The application's secrets service, which seals the credentials. */
+    readonly secrets?: ReleasesSecrets;
+    /** For the connection check; the global `fetch` by default. */
+    readonly fetch?: typeof fetch;
+}
+/** The host images in a registry are named under: `ghcr.io`, `localhost:5000`. */
+export declare function imageHost(url: string): string;
+/**
+ * A registry address as stored: an origin. A bare host gets `https://`, except a loopback one, which Docker reaches
+ * over plain HTTP (`localhost:5000` is `http://localhost:5000`).
+ */
+export declare function normalizeRegistryUrl(value: unknown): string;
+interface Credentials {
+    readonly username?: string;
+    readonly password?: string;
+}
+/** Tries the registry's `/v2/` endpoint and each credential that is set. */
+export declare function checkRegistry(registry: {
+    readonly url: string;
+    readonly namespace: string | null;
+    readonly pull: Credentials | null;
+}, fetchImpl?: typeof fetch): Promise<RegistryCheckResult>;
+export declare class RegistryService {
+    private readonly options;
+    constructor(options: RegistryServiceOptions);
+    list(caller: Caller): Promise<readonly RegistryRecord[]>;
+    get(caller: Caller, id: string): Promise<RegistryRecord>;
+    create(caller: Caller, input: RegistryInput): Promise<RegistryRecord>;
+    update(caller: Caller, id: string, input: RegistryInput): Promise<RegistryRecord>;
+    remove(caller: Caller, id: string): Promise<void>;
+    /** Tries a stored registry. */
+    check(caller: Caller, id: string): Promise<RegistryCheckResult>;
+    /** Tries settings before they are saved; editing a registry, the passwords not changed are its stored ones. */
+    checkDraft(caller: Caller, input: RegistryInput): Promise<RegistryCheckResult>;
+    /** The registry, without access checks: for the other services. */
+    record(id: string): Promise<RegistryRecord>;
+    find(id: string): Promise<RegistryRecord | null>;
+    /** The pull credentials an environment's driver gets, or none for anonymous pulls. */
+    pullAuth(id: string): Promise<{
+        registry: RegistryRecord;
+        auth: RegistryAuth | undefined;
+    } | null>;
+    private checkRow;
+    private decode;
+    private encrypt;
+    private decryptRow;
+    private environmentsOf;
+    private environmentsByRegistry;
+    private findRow;
+    private query;
+}
+export {};
+//# sourceMappingURL=registries.d.ts.map