@nocobase/app-plugin-releases 0.0.0-stage → 0.1.0-beta.0

package/dist/server/services/registries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registries.d.ts","sourceRoot":"","sources":["../../../server/services/registries.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,eAAe,EAAO,MAAM,cAAc,CAAC;AAEzD,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,cAAc,EAEpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGxD,OAAO,EAA4B,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AAO9E,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,sEAAsE;IACtE,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;IACnC,+DAA+D;IAC/D,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CAC/B;AAED,kFAAkF;AAClF,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE7C;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAsC3D;AA4DD,UAAU,WAAW;IACnB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAsED,4EAA4E;AAC5E,wBAAsB,aAAa,CACjC,QAAQ,EAAE;IACR,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;CACnC,EACD,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,mBAAmB,CAAC,CAkD9B;AAED,qBAAa,eAAe;IACP,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,sBAAsB;IAEtD,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC;IAYxD,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAKxD,MAAM,CACjB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,cAAc,CAAC;IAoCb,MAAM,CACjB,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,cAAc,CAAC;IAyBb,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAqB9D,+BAA+B;IAClB,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAc5E,+GAA+G;IAClG,UAAU,CACrB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,mBAAmB,CAAC;IAsB/B,mEAAmE;IACtD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAM3C,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAK7D,sFAAsF;IACzE,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QACzC,QAAQ,EAAE,cAAc,CAAC;QACzB,IAAI,EAAE,YAAY,GAAG,SAAS,CAAC;KAChC,GAAG,IAAI,CAAC;YAoBK,QAAQ;IAyBtB,OAAO,CAAC,MAAM;IAsBd,OAAO,CAAC,OAAO;IAaf,OAAO,CAAC,UAAU;YAkBJ,cAAc;YAUd,sBAAsB;YAetB,OAAO;IAQrB,OAAO,CAAC,KAAK;CAGd"}

package/dist/server/services/registries.js

@@ -0,0 +1,409 @@
+import { REGISTRY_SECRET_KEYS, } from '../../shared/releases.js';
+import { ReleasesError, notFound } from '../errors.js';
+import { decodeDate, isRecord, nullableString } from './codec.js';
+import { decryptText, encryptText } from './secrets.js';
+import { assertEnvironmentId, normalizeName } from './validation.js';
+const CHECK_TIMEOUT_MS = 10_000;
+const NAMESPACE_PATTERN = /^[a-z0-9]+(?:[._-][a-z0-9]+)*(?:\/[a-z0-9]+(?:[._-][a-z0-9]+)*)*$/u;
+/** The host images in a registry are named under: `ghcr.io`, `localhost:5000`. */
+export function imageHost(url) {
+    return new URL(url).host;
+}
+/**
+ * A registry address as stored: an origin. A bare host gets `https://`, except a loopback one, which Docker reaches
+ * over plain HTTP (`localhost:5000` is `http://localhost:5000`).
+ */
+export function normalizeRegistryUrl(value) {
+    if (typeof value !== 'string' || !value.trim() || value.length > 1024)
+        throw new ReleasesError('A registry address is required, such as https://ghcr.io or localhost:5000.', 'INVALID_REGISTRY_URL', 'INVALID_ARGUMENT');
+    let text = value.trim().replace(/\/+$/u, '');
+    if (!/^[a-z][a-z0-9+.-]*:\/\//iu.test(text)) {
+        const host = text.split('/')[0] ?? '';
+        const loopback = /^(localhost|127\.\d+\.\d+\.\d+|\[::1\])(:\d+)?$/iu.test(host);
+        text = `${loopback ? 'http' : 'https'}://${text}`;
+    }
+    let url;
+    try {
+        url = new URL(text);
+    }
+    catch {
+        throw new ReleasesError('The registry address is not a valid URL.', 'INVALID_REGISTRY_URL', 'INVALID_ARGUMENT');
+    }
+    if ((url.protocol !== 'https:' && url.protocol !== 'http:') ||
+        (url.pathname !== '/' && url.pathname !== '') ||
+        url.search ||
+        url.username ||
+        url.password)
+        throw new ReleasesError('The registry address is its origin only, such as https://ghcr.io (the path goes in the namespace).', 'INVALID_REGISTRY_URL', 'INVALID_ARGUMENT');
+    return url.origin;
+}
+function normalizeNamespace(value) {
+    if (value === undefined || value === null || value === '')
+        return null;
+    const text = typeof value === 'string' ? value.trim().replace(/^\/+|\/+$/gu, '') : '';
+    if (!text)
+        return null;
+    if (text.length > 255 || !NAMESPACE_PATTERN.test(text))
+        throw new ReleasesError('The namespace is lowercase path components, such as acme or team/apps.', 'INVALID_REGISTRY_NAMESPACE', 'INVALID_ARGUMENT');
+    return text;
+}
+function normalizeUsername(value) {
+    if (value === undefined || value === null || value === '')
+        return null;
+    if (typeof value !== 'string' || value.length > 255)
+        throw new ReleasesError('A username is at most 255 characters.', 'INVALID_REGISTRY_CREDENTIALS', 'INVALID_ARGUMENT');
+    return value.trim() || null;
+}
+/** The passwords after `changes`: a value replaces one, `null` removes it, a key left out keeps it. */
+function mergeSecret(current, changes) {
+    if (changes === undefined)
+        return current;
+    if (!isRecord(changes))
+        throw new ReleasesError('secretChanges must be an object.', 'INVALID_REGISTRY_CREDENTIALS', 'INVALID_ARGUMENT');
+    const next = { ...current };
+    for (const [key, value] of Object.entries(changes)) {
+        if (!REGISTRY_SECRET_KEYS.includes(key))
+            throw new ReleasesError(`Unknown credential ${key}; use ${REGISTRY_SECRET_KEYS.join(' or ')}.`, 'INVALID_REGISTRY_CREDENTIALS', 'INVALID_ARGUMENT');
+        if (value === null)
+            delete next[key];
+        else if (typeof value === 'string' && value && value.length <= 10_000)
+            next[key] = value;
+        else
+            throw new ReleasesError('A password is text of at most 10 000 characters.', 'INVALID_REGISTRY_CREDENTIALS', 'INVALID_ARGUMENT');
+    }
+    return next;
+}
+function basic(credentials) {
+    return `Basic ${Buffer.from(`${credentials.username ?? ''}:${credentials.password ?? ''}`).toString('base64')}`;
+}
+/** The parameters of a `WWW-Authenticate` challenge: `Bearer realm="…",service="…"`. */
+function challenge(header) {
+    if (!header)
+        return null;
+    const match = /^(\w+)\s*(.*)$/su.exec(header.trim());
+    if (!match)
+        return null;
+    const params = {};
+    for (const part of (match[2] ?? '').matchAll(/(\w+)="([^"]*)"/gu))
+        params[part[1].toLowerCase()] = part[2];
+    return { scheme: match[1].toLowerCase(), params };
+}
+/**
+ * Whether `credentials` are accepted by the registry at `base`: `/v2/` with Basic authentication, or a token from the
+ * realm a Bearer challenge names (scoped to pulling from the namespace), then `/v2/` with that token.
+ */
+async function authenticates(base, first, credentials, namespace, fetchImpl) {
+    const found = challenge(first.headers.get('www-authenticate'));
+    const signal = () => AbortSignal.timeout(CHECK_TIMEOUT_MS);
+    if (found?.scheme === 'bearer' && found.params.realm) {
+        const realm = new URL(found.params.realm);
+        if (found.params.service)
+            realm.searchParams.set('service', found.params.service);
+        if (namespace)
+            realm.searchParams.set('scope', `repository:${namespace}/probe:pull`);
+        if (credentials.username)
+            realm.searchParams.set('account', credentials.username);
+        const answer = await fetchImpl(realm, {
+            headers: { authorization: basic(credentials) },
+            signal: signal(),
+        });
+        if (!answer.ok)
+            return false;
+        const body = (await answer.json().catch(() => ({})));
+        const token = typeof body.token === 'string'
+            ? body.token
+            : typeof body.access_token === 'string'
+                ? body.access_token
+                : null;
+        if (!token)
+            return false;
+        const again = await fetchImpl(`${base}/v2/`, {
+            headers: { authorization: `Bearer ${token}` },
+            signal: signal(),
+        });
+        return again.ok;
+    }
+    const again = await fetchImpl(`${base}/v2/`, {
+        headers: { authorization: basic(credentials) },
+        signal: signal(),
+    });
+    return again.ok;
+}
+/** Tries the registry's `/v2/` endpoint and each credential that is set. */
+export async function checkRegistry(registry, fetchImpl = fetch) {
+    let first;
+    try {
+        first = await fetchImpl(`${registry.url}/v2/`, {
+            signal: AbortSignal.timeout(CHECK_TIMEOUT_MS),
+        });
+    }
+    catch (error) {
+        return {
+            ok: false,
+            message: `Could not reach ${registry.url}: ${error instanceof Error ? (error.cause instanceof Error ? error.cause.message : error.message) : String(error)}`,
+        };
+    }
+    if (first.ok)
+        return {
+            ok: true,
+            message: 'The registry answers without credentials.',
+            details: { anonymous: true, pull: registry.pull ? 'ok' : 'notSet' },
+        };
+    if (first.status !== 401)
+        return {
+            ok: false,
+            message: `${registry.url}/v2/ answered ${first.status}; it does not look like an OCI registry.`,
+        };
+    const verdict = async (credentials) => credentials === null
+        ? 'notSet'
+        : (await authenticates(registry.url, first, credentials, registry.namespace, fetchImpl).catch(() => false))
+            ? 'ok'
+            : 'failed';
+    const pull = await verdict(registry.pull);
+    const details = { anonymous: false, pull };
+    if (pull === 'failed')
+        return {
+            ok: false,
+            message: 'The registry refused the pull credentials.',
+            details,
+        };
+    if (pull === 'notSet')
+        return {
+            ok: false,
+            message: 'The registry asks for credentials; set the pull credentials.',
+            details,
+        };
+    return { ok: true, details };
+}
+export class RegistryService {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    async list(caller) {
+        this.options.guard.requireSetting(caller, 'rel.environments', 'read');
+        const rows = await this.query()
+            .selectFrom('relRegistries')
+            .selectAll()
+            .orderBy('name', 'asc')
+            .orderBy('id', 'asc')
+            .execute();
+        const users = await this.environmentsByRegistry();
+        return rows.map((row) => this.decode(row, users.get(String(row.id)) ?? []));
+    }
+    async get(caller, id) {
+        this.options.guard.requireSetting(caller, 'rel.environments', 'read');
+        return await this.record(id);
+    }
+    async create(caller, input) {
+        this.options.guard.requireSetting(caller, 'rel.environments', 'manage');
+        const id = typeof input?.id === 'string' ? input.id.trim() : '';
+        try {
+            assertEnvironmentId(id);
+        }
+        catch {
+            throw new ReleasesError('Registry ID may contain only lowercase letters, numbers, underscores and hyphens, and may not be "check".', 'INVALID_REGISTRY_ID', 'INVALID_ARGUMENT');
+        }
+        if (await this.findRow(id))
+            throw new ReleasesError('A registry with this ID already exists.', 'REGISTRY_EXISTS', 'ALREADY_EXISTS');
+        const secret = mergeSecret({}, input.secretChanges);
+        const now = new Date();
+        await this.query()
+            .insertInto('relRegistries')
+            .values({
+            id,
+            name: normalizeName(input.name, 'INVALID_REGISTRY_NAME'),
+            url: normalizeRegistryUrl(input.url),
+            namespace: normalizeNamespace(input.namespace),
+            pullUsername: normalizeUsername(input.pullUsername),
+            secret: this.encrypt(id, secret),
+            createdAt: now,
+            updatedAt: now,
+        })
+            .execute();
+        return await this.record(id);
+    }
+    async update(caller, id, input) {
+        this.options.guard.requireSetting(caller, 'rel.environments', 'manage');
+        const row = await this.findRow(id);
+        if (!row)
+            throw notFound('Registry', 'REGISTRY_NOT_FOUND', id);
+        const values = { updatedAt: new Date() };
+        if (input.name !== undefined)
+            values.name = normalizeName(input.name, 'INVALID_REGISTRY_NAME');
+        if (input.url !== undefined)
+            values.url = normalizeRegistryUrl(input.url);
+        if (input.namespace !== undefined)
+            values.namespace = normalizeNamespace(input.namespace);
+        if (input.pullUsername !== undefined)
+            values.pullUsername = normalizeUsername(input.pullUsername);
+        if (input.secretChanges !== undefined)
+            values.secret = this.encrypt(id, mergeSecret(this.decryptRow(row), input.secretChanges));
+        await this.query()
+            .updateTable('relRegistries')
+            .set(values)
+            .where('id', '=', id)
+            .execute();
+        return await this.record(id);
+    }
+    async remove(caller, id) {
+        this.options.guard.requireSetting(caller, 'rel.environments', 'manage');
+        await this.record(id);
+        const users = await this.query()
+            .selectFrom('relEnvironments')
+            .select(['name'])
+            .where('registryId', '=', id)
+            .orderBy('name', 'asc')
+            .execute();
+        if (users.length > 0)
+            throw new ReleasesError(`Environments pull from this registry (${users.map((row) => String(row.name)).join(', ')}); choose another registry for them first.`, 'REGISTRY_IN_USE', 'FAILED_PRECONDITION');
+        await this.query()
+            .deleteFrom('relRegistries')
+            .where('id', '=', id)
+            .execute();
+    }
+    /** Tries a stored registry. */
+    async check(caller, id) {
+        this.options.guard.requireSetting(caller, 'rel.environments', 'read');
+        const row = await this.findRow(id);
+        if (!row)
+            throw notFound('Registry', 'REGISTRY_NOT_FOUND', id);
+        return await this.checkRow({
+            url: row.url,
+            namespace: row.namespace,
+            pullUsername: row.pullUsername,
+        }, this.decryptRow(row));
+    }
+    /** Tries settings before they are saved; editing a registry, the passwords not changed are its stored ones. */
+    async checkDraft(caller, input) {
+        this.options.guard.requireSetting(caller, 'rel.environments', 'manage');
+        const existing = typeof input?.id === 'string' && input.id.trim()
+            ? await this.findRow(input.id.trim())
+            : undefined;
+        const secret = mergeSecret(existing ? this.decryptRow(existing) : {}, input.secretChanges);
+        const pick = (key) => input[key] === undefined ? existing?.[key] : input[key];
+        return await this.checkRow({
+            url: normalizeRegistryUrl(pick('url')),
+            namespace: normalizeNamespace(pick('namespace')),
+            pullUsername: normalizeUsername(pick('pullUsername')),
+        }, secret);
+    }
+    /** The registry, without access checks: for the other services. */
+    async record(id) {
+        const row = await this.findRow(id);
+        if (!row)
+            throw notFound('Registry', 'REGISTRY_NOT_FOUND', id);
+        return this.decode(row, await this.environmentsOf(id));
+    }
+    async find(id) {
+        const row = await this.findRow(id);
+        return row ? this.decode(row, await this.environmentsOf(id)) : null;
+    }
+    /** The pull credentials an environment's driver gets, or none for anonymous pulls. */
+    async pullAuth(id) {
+        const row = await this.findRow(id);
+        if (!row)
+            return null;
+        const registry = this.decode(row, []);
+        const password = this.decryptRow(row).pullPassword;
+        return {
+            registry,
+            auth: password === undefined
+                ? undefined
+                : {
+                    serveraddress: registry.host,
+                    ...(registry.pullUsername
+                        ? { username: registry.pullUsername }
+                        : {}),
+                    password,
+                },
+        };
+    }
+    async checkRow(row, secret) {
+        const credentials = (username, password) => password === undefined
+            ? null
+            : {
+                ...(typeof username === 'string' && username ? { username } : {}),
+                password,
+            };
+        return await checkRegistry({
+            url: String(row.url),
+            namespace: nullableString(row.namespace),
+            pull: credentials(row.pullUsername, secret.pullPassword),
+        }, this.options.fetch ?? fetch);
+    }
+    decode(row, environmentIds) {
+        let secretKeys;
+        try {
+            secretKeys = Object.keys(this.decryptRow(row)).sort();
+        }
+        catch {
+            secretKeys = [];
+        }
+        const url = String(row.url);
+        return {
+            id: String(row.id),
+            name: String(row.name),
+            url,
+            host: imageHost(url),
+            namespace: nullableString(row.namespace),
+            pullUsername: nullableString(row.pullUsername),
+            secretKeys,
+            environmentIds,
+            createdAt: decodeDate(row.createdAt).toISOString(),
+            updatedAt: decodeDate(row.updatedAt).toISOString(),
+        };
+    }
+    encrypt(id, secret) {
+        if (Object.keys(secret).length === 0)
+            return null;
+        return encryptText(JSON.stringify(secret), [id], this.options.secrets, 'registry-credentials');
+    }
+    decryptRow(row) {
+        const value = nullableString(row.secret);
+        if (!value)
+            return {};
+        const parsed = JSON.parse(decryptText(value, [String(row.id)], this.options.secrets, 'registry-credentials'));
+        if (!isRecord(parsed))
+            return {};
+        const secret = {};
+        for (const key of REGISTRY_SECRET_KEYS)
+            if (typeof parsed[key] === 'string')
+                secret[key] = parsed[key];
+        return secret;
+    }
+    async environmentsOf(id) {
+        const rows = await this.query()
+            .selectFrom('relEnvironments')
+            .select('id')
+            .where('registryId', '=', id)
+            .orderBy('id', 'asc')
+            .execute();
+        return rows.map((row) => String(row.id));
+    }
+    async environmentsByRegistry() {
+        const rows = await this.query()
+            .selectFrom('relEnvironments')
+            .select(['id', 'registryId'])
+            .where('registryId', 'is not', null)
+            .orderBy('id', 'asc')
+            .execute();
+        const users = new Map();
+        for (const row of rows) {
+            const key = String(row.registryId);
+            users.set(key, [...(users.get(key) ?? []), String(row.id)]);
+        }
+        return users;
+    }
+    async findRow(id) {
+        return await this.query()
+            .selectFrom('relRegistries')
+            .selectAll()
+            .where('id', '=', id)
+            .executeTakeFirst();
+    }
+    query() {
+        return this.options.database.connection().query;
+    }
+}
+//# sourceMappingURL=registries.js.map

package/dist/server/services/registries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registries.js","sourceRoot":"","sources":["../../../server/services/registries.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,oBAAoB,GAKrB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAwB,MAAM,cAAc,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErE,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,MAAM,iBAAiB,GACrB,oEAAoE,CAAC;AAWvE,kFAAkF;AAClF,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI;QACnE,MAAM,IAAI,aAAa,CACrB,4EAA4E,EAC5E,sBAAsB,EACtB,kBAAkB,CACnB,CAAC;IACJ,IAAI,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,mDAAmD,CAAC,IAAI,CACvE,IAAI,CACL,CAAC;QACF,IAAI,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,MAAM,IAAI,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,aAAa,CACrB,0CAA0C,EAC1C,sBAAsB,EACtB,kBAAkB,CACnB,CAAC;IACJ,CAAC;IACD,IACE,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;QACvD,CAAC,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAC;QAC7C,GAAG,CAAC,MAAM;QACV,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,QAAQ;QAEZ,MAAM,IAAI,aAAa,CACrB,oGAAoG,EACpG,sBAAsB,EACtB,kBAAkB,CACnB,CAAC;IACJ,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACvE,MAAM,IAAI,GACR,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;QACpD,MAAM,IAAI,aAAa,CACrB,wEAAwE,EACxE,4BAA4B,EAC5B,kBAAkB,CACnB,CAAC;IACJ,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACvE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;QACjD,MAAM,IAAI,aAAa,CACrB,uCAAuC,EACvC,8BAA8B,EAC9B,kBAAkB,CACnB,CAAC;IACJ,OAAO,KAAK,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;AAC9B,CAAC;AAED,uGAAuG;AACvG,SAAS,WAAW,CAClB,OAAmD,EACnD,OAAgB;IAEhB,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IAC1C,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QACpB,MAAM,IAAI,aAAa,CACrB,kCAAkC,EAClC,8BAA8B,EAC9B,kBAAkB,CACnB,CAAC;IACJ,MAAM,IAAI,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,CAAE,oBAA0C,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC5D,MAAM,IAAI,aAAa,CACrB,sBAAsB,GAAG,SAAS,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EACtE,8BAA8B,EAC9B,kBAAkB,CACnB,CAAC;QACJ,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,GAAwB,CAAC,CAAC;aACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,MAAM;YACnE,IAAI,CAAC,GAAwB,CAAC,GAAG,KAAK,CAAC;;YAEvC,MAAM,IAAI,aAAa,CACrB,kDAAkD,EAClD,8BAA8B,EAC9B,kBAAkB,CACnB,CAAC;IACN,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAOD,SAAS,KAAK,CAAC,WAAwB;IACrC,OAAO,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,QAAQ,IAAI,EAAE,IAAI,WAAW,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;AAClH,CAAC;AAED,wFAAwF;AACxF,SAAS,SAAS,CAAC,MAAqB;IAItC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QAC/D,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;IAC3C,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,aAAa,CAC1B,IAAY,EACZ,KAAe,EACf,WAAwB,EACxB,SAAwB,EACxB,SAAuB;IAEvB,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3D,IAAI,KAAK,EAAE,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;YACtB,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,SAAS;YACX,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,cAAc,SAAS,aAAa,CAAC,CAAC;QACxE,IAAI,WAAW,CAAC,QAAQ;YACtB,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE;YACpC,OAAO,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE;YAC9C,MAAM,EAAE,MAAM,EAAE;SACjB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAGlD,CAAC;QACF,MAAM,KAAK,GACT,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;YAC5B,CAAC,CAAC,IAAI,CAAC,KAAK;YACZ,CAAC,CAAC,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ;gBACrC,CAAC,CAAC,IAAI,CAAC,YAAY;gBACnB,CAAC,CAAC,IAAI,CAAC;QACb,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,MAAM,EAAE;YAC3C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;YAC7C,MAAM,EAAE,MAAM,EAAE;SACjB,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,EAAE,CAAC;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,MAAM,EAAE;QAC3C,OAAO,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE;QAC9C,MAAM,EAAE,MAAM,EAAE;KACjB,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,EAAE,CAAC;AAClB,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,QAIC,EACD,YAA0B,KAAK;IAE/B,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,QAAQ,CAAC,GAAG,MAAM,EAAE;YAC7C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,mBAAmB,QAAQ,CAAC,GAAG,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;SAC7J,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,EAAE;QACV,OAAO;YACL,EAAE,EAAE,IAAI;YACR,OAAO,EAAE,2CAA2C;YACpD,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE;SACpE,CAAC;IACJ,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;QACtB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,GAAG,QAAQ,CAAC,GAAG,iBAAiB,KAAK,CAAC,MAAM,0CAA0C;SAChG,CAAC;IACJ,MAAM,OAAO,GAAG,KAAK,EAAE,WAA+B,EAAE,EAAE,CACxD,WAAW,KAAK,IAAI;QAClB,CAAC,CAAE,QAAkB;QACrB,CAAC,CAAC,CAAC,MAAM,aAAa,CAChB,QAAQ,CAAC,GAAG,EACZ,KAAK,EACL,WAAW,EACX,QAAQ,CAAC,SAAS,EAClB,SAAS,CACV,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;YACvB,CAAC,CAAE,IAAc;YACjB,CAAC,CAAE,QAAkB,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAI,IAAI,KAAK,QAAQ;QACnB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,4CAA4C;YACrD,OAAO;SACR,CAAC;IACJ,IAAI,IAAI,KAAK,QAAQ;QACnB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,8DAA8D;YACvE,OAAO;SACR,CAAC;IACJ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,OAAO,eAAe;IACU;IAApC,YAAoC,OAA+B;QAA/B,YAAO,GAAP,OAAO,CAAwB;IAAG,CAAC;IAEhE,KAAK,CAAC,IAAI,CAAC,MAAc;QAC9B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE;aAC5B,UAAU,CAAC,eAAe,CAAC;aAC3B,SAAS,EAAE;aACX,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC;aACtB,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;aACpB,OAAO,EAAO,CAAC;QAClB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9E,CAAC;IAEM,KAAK,CAAC,GAAG,CAAC,MAAc,EAAE,EAAU;QACzC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC;QACtE,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;IAEM,KAAK,CAAC,MAAM,CACjB,MAAc,EACd,KAAoB;QAEpB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,kBAAkB,EAAE,QAAQ,CAAC,CAAC;QACxE,MAAM,EAAE,GAAG,OAAO,KAAK,EAAE,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC;YACH,mBAAmB,CAAC,EAAE,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,aAAa,CACrB,2GAA2G,EAC3G,qBAAqB,EACrB,kBAAkB,CACnB,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,aAAa,CACrB,yCAAyC,EACzC,iBAAiB,EACjB,gBAAgB,CACjB,CAAC;QACJ,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,CAAC,KAAK,EAAE;aACf,UAAU,CAAC,eAAe,CAAC;aAC3B,MAAM,CAAC;YACN,EAAE;YACF,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,uBAAuB,CAAC;YACxD,GAAG,EAAE,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC;YACpC,SAAS,EAAE,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC;YAC9C,YAAY,EAAE,iBAAiB,CAAC,KAAK,CAAC,YAAY,CAAC;YACnD,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC;YAChC,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;SACf,CAAC;aACD,OAAO,EAAE,CAAC;QACb,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;IAEM,KAAK,CAAC,MAAM,CACjB,MAAc,EACd,EAAU,EACV,KAAoB;QAEpB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,kBAAkB,EAAE,QAAQ,CAAC,CAAC;QACxE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG;YAAE,MAAM,QAAQ,CAAC,UAAU,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAQ,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;QAC9C,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;YAC1B,MAAM,CAAC,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,GAAG,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1E,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;YAC/B,MAAM,CAAC,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;YAClC,MAAM,CAAC,YAAY,GAAG,iBAAiB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC9D,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS;YACnC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAC1B,EAAE,EACF,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC,CACvD,CAAC;QACJ,MAAM,IAAI,CAAC,KAAK,EAAE;aACf,WAAW,CAAC,eAAe,CAAC;aAC5B,GAAG,CAAC,MAAM,CAAC;aACX,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;aACpB,OAAO,EAAE,CAAC;QACb,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,EAAU;QAC5C,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,kBAAkB,EAAE,QAAQ,CAAC,CAAC;QACxE,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE;aAC7B,UAAU,CAAC,iBAAiB,CAAC;aAC7B,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC;aAChB,KAAK,CAAC,YAAY,EAAE,GAAG,EAAE,EAAE,CAAC;aAC5B,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC;aACtB,OAAO,EAAO,CAAC;QAClB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAClB,MAAM,IAAI,aAAa,CACrB,yCAAyC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,4CAA4C,EACpI,iBAAiB,EACjB,qBAAqB,CACtB,CAAC;QACJ,MAAM,IAAI,CAAC,KAAK,EAAE;aACf,UAAU,CAAC,eAAe,CAAC;aAC3B,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;aACpB,OAAO,EAAE,CAAC;IACf,CAAC;IAED,+BAA+B;IACxB,KAAK,CAAC,KAAK,CAAC,MAAc,EAAE,EAAU;QAC3C,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG;YAAE,MAAM,QAAQ,CAAC,UAAU,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAAC;QAC/D,OAAO,MAAM,IAAI,CAAC,QAAQ,CACxB;YACE,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,YAAY,EAAE,GAAG,CAAC,YAAY;SAC/B,EACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CACrB,CAAC;IACJ,CAAC;IAED,+GAA+G;IACxG,KAAK,CAAC,UAAU,CACrB,MAAc,EACd,KAAoB;QAEpB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,kBAAkB,EAAE,QAAQ,CAAC,CAAC;QACxE,MAAM,QAAQ,GACZ,OAAO,KAAK,EAAE,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE;YAC9C,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;YACrC,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,MAAM,GAAG,WAAW,CACxB,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,EACzC,KAAK,CAAC,aAAa,CACpB,CAAC;QACF,MAAM,IAAI,GAAG,CAAgC,GAAM,EAAW,EAAE,CAC9D,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1D,OAAO,MAAM,IAAI,CAAC,QAAQ,CACxB;YACE,GAAG,EAAE,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACtC,SAAS,EAAE,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAChD,YAAY,EAAE,iBAAiB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;SACtD,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IAED,mEAAmE;IAC5D,KAAK,CAAC,MAAM,CAAC,EAAU;QAC5B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG;YAAE,MAAM,QAAQ,CAAC,UAAU,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,EAAU;QAC1B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,CAAC;IAED,sFAAsF;IAC/E,KAAK,CAAC,QAAQ,CAAC,EAAU;QAI9B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;QACnD,OAAO;YACL,QAAQ;YACR,IAAI,EACF,QAAQ,KAAK,SAAS;gBACpB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC;oBACE,aAAa,EAAE,QAAQ,CAAC,IAAI;oBAC5B,GAAG,CAAC,QAAQ,CAAC,YAAY;wBACvB,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,YAAY,EAAE;wBACrC,CAAC,CAAC,EAAE,CAAC;oBACP,QAAQ;iBACT;SACR,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,GAIC,EACD,MAAkD;QAElD,MAAM,WAAW,GAAG,CAAC,QAAiB,EAAE,QAA4B,EAAE,EAAE,CACtE,QAAQ,KAAK,SAAS;YACpB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC;gBACE,GAAG,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjE,QAAQ;aACT,CAAC;QACR,OAAO,MAAM,aAAa,CACxB;YACE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;YACpB,SAAS,EAAE,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC;YACxC,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC;SACzD,EACD,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,KAAK,CAC5B,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,GAAQ,EAAE,cAAiC;QACxD,IAAI,UAA6B,CAAC;QAClC,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,GAAG,EAAE,CAAC;QAClB,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;YACtB,GAAG;YACH,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC;YACpB,SAAS,EAAE,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC;YACxC,YAAY,EAAE,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC;YAC9C,UAAU;YACV,cAAc;YACd,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;YAClD,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;SACnD,CAAC;IACJ,CAAC;IAEO,OAAO,CACb,EAAU,EACV,MAAkD;QAElD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAClD,OAAO,WAAW,CAChB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EACtB,CAAC,EAAE,CAAC,EACJ,IAAI,CAAC,OAAO,CAAC,OAAO,EACpB,sBAAsB,CACvB,CAAC;IACJ,CAAC;IAEO,UAAU,CAAC,GAAQ;QACzB,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CACvB,WAAW,CACT,KAAK,EACL,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAChB,IAAI,CAAC,OAAO,CAAC,OAAO,EACpB,sBAAsB,CACvB,CACS,CAAC;QACb,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QACjC,MAAM,MAAM,GAA+C,EAAE,CAAC;QAC9D,KAAK,MAAM,GAAG,IAAI,oBAAoB;YACpC,IAAI,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,QAAQ;gBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,EAAU;QACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE;aAC5B,UAAU,CAAC,iBAAiB,CAAC;aAC7B,MAAM,CAAC,IAAI,CAAC;aACZ,KAAK,CAAC,YAAY,EAAE,GAAG,EAAE,EAAE,CAAC;aAC5B,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;aACpB,OAAO,EAAO,CAAC;QAClB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3C,CAAC;IAEO,KAAK,CAAC,sBAAsB;QAClC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE;aAC5B,UAAU,CAAC,iBAAiB,CAAC;aAC7B,MAAM,CAAC,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;aAC5B,KAAK,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC;aACnC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;aACpB,OAAO,EAAO,CAAC;QAClB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACnC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,EAAU;QAC9B,OAAO,MAAM,IAAI,CAAC,KAAK,EAAE;aACtB,UAAU,CAAC,eAAe,CAAC;aAC3B,SAAS,EAAE;aACX,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;aACpB,gBAAgB,EAAO,CAAC;IAC7B,CAAC;IAEO,KAAK;QACX,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC;IAClD,CAAC;CACF"}

package/dist/server/services/release-artifacts.d.ts

@@ -0,0 +1,42 @@
+import type { DatabaseConnection, DatabaseManager, Row } from '@nocobase/db';
+import type { ActorKind, RegisterImageReleaseInput, ReleaseArtifactView } from '../../shared/releases.js';
+export type ImageArtifactView = Extract<ReleaseArtifactView, {
+    kind: 'oci-image';
+}>;
+/** `ghcr.io/acme/app:1.2@sha256:…` → `ghcr.io/acme/app`: the repository a reference names. */
+export declare function imageRepository(reference: string): string;
+export interface ImageRegistration {
+    readonly ref: string;
+    readonly digest: string;
+    readonly platform: string;
+    readonly sourceCommit: string | null;
+}
+/** Checks the image CI registers; throws `INVALID_IMAGE`. */
+export declare function normalizeImage(input: Pick<RegisterImageReleaseInput, 'ref' | 'digest' | 'platform' | 'sourceCommit'>): ImageRegistration;
+export declare function decodeImageArtifact(row: Row): ImageArtifactView;
+export declare class ReleaseArtifactStore {
+    private readonly database;
+    constructor(database: DatabaseManager);
+    /** The images of each release, newest first. */
+    imagesOf(releaseIds: readonly string[], conn?: DatabaseConnection): Promise<Map<string, ImageArtifactView[]>>;
+    /**
+     * Records an image of a release and of every release promoted from it. The same digest again is a no-op; another
+     * digest for a platform that already has one is refused (`IMAGE_CONFLICT`): a release's image never changes.
+     */
+    register(conn: DatabaseConnection, release: {
+        readonly id: string;
+        readonly appId: string;
+    }, image: ImageRegistration, actor: {
+        readonly userId: string | null;
+        readonly kind: ActorKind;
+    }): Promise<{
+        view: ImageArtifactView;
+        created: boolean;
+    }>;
+    /** Copies a release's images to its promoted copy. */
+    copy(conn: DatabaseConnection, fromReleaseId: string, to: {
+        readonly id: string;
+        readonly appId: string;
+    }): Promise<void>;
+}
+//# sourceMappingURL=release-artifacts.d.ts.map

package/dist/server/services/release-artifacts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-artifacts.d.ts","sourceRoot":"","sources":["../../../server/services/release-artifacts.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAE7E,OAAO,KAAK,EACV,SAAS,EACT,yBAAyB,EACzB,mBAAmB,EACpB,MAAM,0BAA0B,CAAC;AAWlC,MAAM,MAAM,iBAAiB,GAAG,OAAO,CACrC,mBAAmB,EACnB;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,CACtB,CAAC;AAEF,8FAA8F;AAC9F,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAQzD;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AAED,6DAA6D;AAC7D,wBAAgB,cAAc,CAC5B,KAAK,EAAE,IAAI,CACT,yBAAyB,EACzB,KAAK,GAAG,QAAQ,GAAG,UAAU,GAAG,cAAc,CAC/C,GACA,iBAAiB,CA2BnB;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,GAAG,GAAG,iBAAiB,CAY/D;AAED,qBAAa,oBAAoB;IACZ,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,eAAe;IAE7D,gDAAgD;IACnC,QAAQ,CACnB,UAAU,EAAE,SAAS,MAAM,EAAE,EAC7B,IAAI,CAAC,EAAE,kBAAkB,GACxB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAiB5C;;;OAGG;IACU,QAAQ,CACnB,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EACxD,KAAK,EAAE,iBAAiB,EACxB,KAAK,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;KAAE,GAClE,OAAO,CAAC;QAAE,IAAI,EAAE,iBAAiB,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAwDzD,sDAAsD;IACzC,IAAI,CACf,IAAI,EAAE,kBAAkB,EACxB,aAAa,EAAE,MAAM,EACrB,EAAE,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAClD,OAAO,CAAC,IAAI,CAAC;CAqBjB"}

package/dist/server/services/release-artifacts.js

@@ -0,0 +1,165 @@
+/**
+ * An image release's images (`relReleaseArtifacts`): one per platform, recorded by repository and digest, which CI
+ * built and pushed and registers through the API (`acme release image`). A promoted release carries its source's, so
+ * staging and production deploy the same digest.
+ */
+import { randomUUID } from 'node:crypto';
+import { ReleasesError } from '../errors.js';
+import { decodeDate, nullableString } from './codec.js';
+/** An image repository without tag or digest: an optional registry host, then lowercase path components. */
+const REPOSITORY_PATTERN = /^(?:[a-zA-Z0-9](?:[a-zA-Z0-9.-]*[a-zA-Z0-9])?(?::[0-9]+)?\/)?[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*(?:\/[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*)*$/u;
+const DIGEST_PATTERN = /^sha256:[0-9a-f]{64}$/u;
+const PLATFORM_PATTERN = /^[a-z0-9]+\/[a-z0-9_]+(?:\/[a-z0-9]+)?$/u;
+const COMMIT_PATTERN = /^[0-9a-f]{7,64}$/u;
+/** `ghcr.io/acme/app:1.2@sha256:…` → `ghcr.io/acme/app`: the repository a reference names. */
+export function imageRepository(reference) {
+    let ref = reference.trim();
+    const at = ref.indexOf('@');
+    if (at !== -1)
+        ref = ref.slice(0, at);
+    const slash = ref.lastIndexOf('/');
+    const colon = ref.lastIndexOf(':');
+    if (colon > slash)
+        ref = ref.slice(0, colon);
+    return ref;
+}
+/** Checks the image CI registers; throws `INVALID_IMAGE`. */
+export function normalizeImage(input) {
+    const invalid = (message) => new ReleasesError(message, 'INVALID_IMAGE', 'INVALID_ARGUMENT');
+    if (!input || typeof input !== 'object')
+        throw invalid('Give the image as { ref, digest, platform }.');
+    if (typeof input.ref !== 'string' || input.ref.length > 500)
+        throw invalid('ref is the image repository, such as ghcr.io/acme/app.');
+    const ref = imageRepository(input.ref);
+    if (!REPOSITORY_PATTERN.test(ref))
+        throw invalid(`${input.ref} is not an image repository.`);
+    if (typeof input.digest !== 'string' || !DIGEST_PATTERN.test(input.digest))
+        throw invalid('digest is sha256: and 64 hex digits.');
+    const platform = input.platform ?? 'linux/amd64';
+    if (typeof platform !== 'string' || !PLATFORM_PATTERN.test(platform))
+        throw invalid('platform is like linux/amd64.');
+    const commit = input.sourceCommit;
+    if (commit !== undefined &&
+        (typeof commit !== 'string' || !COMMIT_PATTERN.test(commit)))
+        throw invalid('sourceCommit is a commit hash.');
+    return {
+        ref,
+        digest: input.digest,
+        platform,
+        sourceCommit: commit ?? null,
+    };
+}
+export function decodeImageArtifact(row) {
+    return {
+        kind: 'oci-image',
+        id: String(row.id),
+        ref: String(row.ref),
+        digest: String(row.digest),
+        platform: String(row.platform),
+        sourceCommit: nullableString(row.sourceCommit),
+        createdBy: nullableString(row.createdBy),
+        createdVia: (nullableString(row.createdVia) ?? 'human'),
+        createdAt: decodeDate(row.createdAt).toISOString(),
+    };
+}
+export class ReleaseArtifactStore {
+    database;
+    constructor(database) {
+        this.database = database;
+    }
+    /** The images of each release, newest first. */
+    async imagesOf(releaseIds, conn) {
+        const images = new Map();
+        if (releaseIds.length === 0)
+            return images;
+        const rows = await (conn ?? this.database.connection()).query
+            .selectFrom('relReleaseArtifacts')
+            .selectAll()
+            .where('releaseId', 'in', [...releaseIds])
+            .orderBy('createdAt', 'desc')
+            .orderBy('id', 'asc')
+            .execute();
+        for (const row of rows) {
+            const key = String(row.releaseId);
+            images.set(key, [...(images.get(key) ?? []), decodeImageArtifact(row)]);
+        }
+        return images;
+    }
+    /**
+     * Records an image of a release and of every release promoted from it. The same digest again is a no-op; another
+     * digest for a platform that already has one is refused (`IMAGE_CONFLICT`): a release's image never changes.
+     */
+    async register(conn, release, image, actor) {
+        const targets = [release];
+        for (let index = 0; index < targets.length; index += 1) {
+            const promoted = await conn.query
+                .selectFrom('relReleases')
+                .select(['id', 'appId'])
+                .where('sourceReleaseId', '=', targets[index].id)
+                .execute();
+            for (const row of promoted)
+                if (!targets.some((target) => target.id === String(row.id)))
+                    targets.push({ id: String(row.id), appId: String(row.appId) });
+        }
+        let first;
+        for (const target of targets) {
+            const existing = await conn.query
+                .selectFrom('relReleaseArtifacts')
+                .selectAll()
+                .where('releaseId', '=', target.id)
+                .where('kind', '=', 'oci-image')
+                .where('platform', '=', image.platform)
+                .executeTakeFirst();
+            if (existing) {
+                if (String(existing.digest) !== image.digest ||
+                    String(existing.ref) !== image.ref) {
+                    if (target.id === release.id)
+                        throw new ReleasesError(`The release already has the image ${String(existing.ref)}@${String(existing.digest)} for ${image.platform}; a release's image never changes.`, 'IMAGE_CONFLICT', 'FAILED_PRECONDITION');
+                    continue;
+                }
+                first ??= { view: decodeImageArtifact(existing), created: false };
+                continue;
+            }
+            const row = {
+                id: randomUUID(),
+                releaseId: target.id,
+                appId: target.appId,
+                kind: 'oci-image',
+                ref: image.ref,
+                digest: image.digest,
+                platform: image.platform,
+                sourceCommit: image.sourceCommit,
+                createdBy: actor.userId,
+                createdVia: actor.kind,
+                createdAt: new Date(),
+            };
+            await conn.query.insertInto('relReleaseArtifacts').values(row).execute();
+            first ??= { view: decodeImageArtifact(row), created: true };
+        }
+        return first;
+    }
+    /** Copies a release's images to its promoted copy. */
+    async copy(conn, fromReleaseId, to) {
+        const rows = await conn.query
+            .selectFrom('relReleaseArtifacts')
+            .selectAll()
+            .where('releaseId', '=', fromReleaseId)
+            .execute();
+        for (const row of rows) {
+            const present = await conn.query
+                .selectFrom('relReleaseArtifacts')
+                .select('id')
+                .where('releaseId', '=', to.id)
+                .where('kind', '=', String(row.kind))
+                .where('platform', '=', String(row.platform))
+                .executeTakeFirst();
+            if (present)
+                continue;
+            await conn.query
+                .insertInto('relReleaseArtifacts')
+                .values({ ...row, id: randomUUID(), releaseId: to.id, appId: to.appId })
+                .execute();
+        }
+    }
+}
+//# sourceMappingURL=release-artifacts.js.map