@omnitron-dev/omnitron 0.3.1 → 0.3.3

package/dist/files/archive-node.js

@@ -0,0 +1,379 @@
+import fs from 'node:fs/promises';
+import { constants } from 'node:fs';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { ensurePrivateDir } from '../shared/private-files.js';
+import { fileNameError } from '../shared/file-policy.js';
+import { createArchive, probeArchiveFormats } from './archive-codec.js';
+const MAX_BYTES = 100 * 1024 ** 3;
+const stamp = (stat) => [stat.dev, stat.ino, stat.size, stat.mtimeNs, stat.ctimeNs].join(':');
+const sha = (data) => createHash('sha256').update(data).digest('hex');
+/** Durable private source snapshots. Public paths are always read through FileNode's confined API. */
+export class ArchiveNode {
+    call;
+    assertSource;
+    store;
+    directory;
+    active = new Map();
+    cachePin;
+    stopped = false;
+    activeOperationCount() {
+        return this.active.size;
+    }
+    async dispose() {
+        this.stopped = true;
+        const operations = [...this.active.values()];
+        for (const operation of operations)
+            operation.controller.abort();
+        await Promise.all(operations.map((operation) => operation.done));
+    }
+    constructor(call, assertSource, store, directory) {
+        this.call = call;
+        this.assertSource = assertSource;
+        this.store = store;
+        this.directory = directory;
+        for (const id of this.index()) {
+            const record = store.kvGetSync(`files:archive:${id}`);
+            if (record?.view.state === 'preparing') {
+                record.view.state = 'interrupted';
+                record.view.error = 'Archive preparation was interrupted; resume explicitly to rebuild its private snapshot.';
+                this.persist(record);
+            }
+        }
+    }
+    index() {
+        return this.store.kvGetSync('files:archives:index') ?? [];
+    }
+    persist(record) {
+        this.store.kvSetSync(`files:archive:${record.request.id}`, record);
+    }
+    record(actor, id) {
+        if (!/^[a-f0-9-]{36}$/.test(id))
+            throw new Error('Invalid archive operation ID');
+        const value = this.store.kvGetSync(`files:archive:${id}`);
+        if (!value || value.actor !== actor)
+            throw new Error('Archive does not belong to this identity');
+        return value;
+    }
+    async cache(id) {
+        if (!/^[a-f0-9-]{36}$/.test(id))
+            throw new Error('Invalid archive operation ID');
+        ensurePrivateDir(this.directory);
+        const real = await fs.realpath(this.directory), metadata = await fs.lstat(real, { bigint: true });
+        const pin = `${real}:${metadata.dev}:${metadata.ino}`;
+        if (this.cachePin && this.cachePin !== pin)
+            throw new Error('Private archive storage changed');
+        this.cachePin = pin;
+        const candidate = path.join(real, id);
+        const stat = await fs.lstat(candidate).catch((error) => {
+            if (error.code === 'ENOENT')
+                return null;
+            throw error;
+        });
+        if (stat && (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== process.getuid?.() || stat.mode & 0o077))
+            throw new Error('Archive staging is not a private owned directory');
+        return candidate;
+    }
+    async invoke(actor, request) {
+        if (this.stopped)
+            throw new Error('Archive provider is stopping');
+        switch (request.op) {
+            case 'archiveFormats':
+                return probeArchiveFormats();
+            case 'prepareArchive':
+                return this.prepare(actor, request);
+            case 'archiveStatus': {
+                const record = this.record(actor, request.id);
+                if (record.view.state === 'ready') {
+                    const file = path.join(await this.cache(request.id), 'payload');
+                    const stat = await fs.lstat(file, { bigint: true });
+                    if (!stat.isFile() || stat.isSymbolicLink() || stamp(stat) !== record.stamp)
+                        throw new Error('Prepared archive changed; start a new transfer');
+                }
+                return structuredClone(record.view);
+            }
+            case 'readArchive':
+                return this.read(actor, request);
+            case 'abortArchive': {
+                const record = this.record(actor, request.id), active = this.active.get(request.id);
+                active?.controller.abort();
+                await active?.done;
+                record.view.state = 'cancelled';
+                this.persist(record);
+                await fs.rm(await this.cache(request.id), { recursive: true, force: true });
+                return structuredClone(record.view);
+            }
+            case 'releaseArchive': {
+                if (!this.store.kvGetSync(`files:archive:${request.id}`))
+                    return undefined;
+                this.record(actor, request.id);
+                const active = this.active.get(request.id);
+                active?.controller.abort();
+                await active?.done;
+                await fs.rm(await this.cache(request.id), { recursive: true, force: true });
+                this.store.kvDeleteSync(`files:archive:${request.id}`);
+                this.store.kvSetSync('files:archives:index', this.index().filter((id) => id !== request.id));
+                return undefined;
+            }
+            default:
+                throw new Error('Unsupported archive operation');
+        }
+    }
+    async prepare(actor, request) {
+        if (!/^[a-f0-9-]{36}$/.test(request.id) || !/^[a-f0-9]{64}$/.test(request.version))
+            throw new Error('An archive ID and source version are required');
+        await this.assertSource(request.rootId, request.path);
+        if (!(await probeArchiveFormats()).formats.some((item) => item.format === request.format))
+            throw new Error('This archive format is not available on the source node');
+        if (this.stopped)
+            throw new Error('Archive provider is stopping');
+        const previous = this.store.kvGetSync(`files:archive:${request.id}`);
+        if (previous) {
+            if (previous.actor !== actor || JSON.stringify(previous.request) !== JSON.stringify(request))
+                throw new Error('Archive ID is bound to another request');
+            if (previous.view.state === 'ready' || this.active.has(request.id))
+                return structuredClone(previous.view);
+        }
+        if (this.active.size >= 2)
+            throw new Error('At most two source archives can be prepared concurrently');
+        const index = this.index();
+        if (!index.includes(request.id) && index.length >= 100)
+            throw new Error('Archive journal is full; cancel or finish pending transfers');
+        const record = {
+            actor,
+            request,
+            view: { id: request.id, state: 'preparing', phase: 'planning', preparedBytes: 0, sourceBytes: 0 },
+        };
+        this.persist(record);
+        if (!index.includes(request.id))
+            this.store.kvSetSync('files:archives:index', [...index, request.id]);
+        const controller = new AbortController();
+        const active = { controller, done: Promise.resolve() };
+        this.active.set(request.id, active);
+        active.done = this.build(record, AbortSignal.any([controller.signal, AbortSignal.timeout(60 * 60_000)]))
+            .catch(async (error) => {
+            record.view.state = this.stopped ? 'interrupted' : controller.signal.aborted ? 'cancelled' : 'failed';
+            record.view.error = this.stopped
+                ? 'Archive preparation interrupted by node shutdown; resume explicitly'
+                : controller.signal.aborted
+                    ? 'Archive preparation cancelled'
+                    : error instanceof Error
+                        ? error.message.slice(0, 500)
+                        : 'Archive preparation failed';
+            try {
+                await fs.rm(await this.cache(request.id), { recursive: true, force: true });
+            }
+            finally {
+                this.persist(record);
+            }
+        })
+            .finally(() => {
+            this.active.delete(request.id);
+        });
+        // Observe cleanup/journal failure without leaving a rejected background promise.
+        void active.done.catch(() => { });
+        return structuredClone(record.view);
+    }
+    async build(record, signal) {
+        const { request, actor } = record;
+        const checkpoint = () => {
+            signal.throwIfAborted();
+        };
+        const work = await this.cache(request.id);
+        await fs.rm(work, { recursive: true, force: true });
+        await fs.mkdir(work, { mode: 0o700 });
+        const tree = path.join(work, 'tree');
+        await fs.mkdir(tree, { mode: 0o700 });
+        const rootName = request.path.split('/').at(-1);
+        if (fileNameError(rootName))
+            throw new Error('Invalid source folder name');
+        const sourceEntries = [];
+        const walk = async (source, destination, expected, depth) => {
+            checkpoint();
+            if (depth > 32 || sourceEntries.length >= 10_000)
+                throw new Error('Archive exceeds 32 directory levels or 10,000 entries');
+            const item = await this.call(actor, { op: 'stat', rootId: request.rootId, path: source });
+            if (item.version !== expected)
+                throw new Error('Source changed after selection; refresh the panel');
+            if (!['file', 'directory'].includes(item.kind) || (!depth && item.kind !== 'directory'))
+                throw new Error('Archive sources must be directories containing only regular files and directories');
+            sourceEntries.push({ source, item, destination });
+            if (item.kind === 'file') {
+                record.view.sourceBytes += item.size;
+                if (!Number.isSafeInteger(item.size) || item.size < 0 || record.view.sourceBytes > MAX_BYTES)
+                    throw new Error('Archive source exceeds 100 GiB');
+            }
+            else {
+                let after, revision;
+                do {
+                    const listing = await this.call(actor, {
+                        op: 'list',
+                        rootId: request.rootId,
+                        path: source,
+                        ...(after && revision ? { after, revision } : {}),
+                    });
+                    revision = listing.revision;
+                    for (const child of listing.entries)
+                        await walk(child.path, destination + '/' + child.name, child.version, depth + 1);
+                    after = listing.next ?? undefined;
+                } while (after);
+            }
+        };
+        await walk(request.path, rootName, request.version, 0);
+        const available = await fs.statfs(work);
+        if (Number(available.bavail) * Number(available.bsize) < record.view.sourceBytes * 2 + 64 * 1024 ** 2)
+            throw new Error('Source node needs free space for the private snapshot and archive');
+        record.view.phase = 'snapshotting';
+        this.persist(record);
+        const manifest = { protocol: 1, rootName, entries: [] };
+        let lastPersist = Date.now();
+        for (const entry of sourceEntries) {
+            checkpoint();
+            const target = path.join(tree, entry.destination);
+            if (entry.item.kind === 'directory') {
+                await fs.mkdir(target, { mode: entry.item.mode | 0o700 });
+                manifest.entries.push({ path: entry.destination, kind: 'directory', size: 0, mode: entry.item.mode });
+                continue;
+            }
+            const fd = await fs.open(target, 'wx', 0o600), hash = createHash('sha256');
+            try {
+                let offset = 0;
+                while (offset < entry.item.size) {
+                    checkpoint();
+                    const chunk = await this.call(actor, {
+                        op: 'readChunk',
+                        rootId: request.rootId,
+                        path: entry.source,
+                        version: entry.item.version,
+                        offset,
+                    });
+                    const bytes = Buffer.from(chunk.data, 'base64');
+                    if (chunk.offset !== offset ||
+                        !bytes.length ||
+                        bytes.length > 256 * 1024 ||
+                        offset + bytes.length > entry.item.size ||
+                        bytes.toString('base64') !== chunk.data ||
+                        sha(bytes) !== chunk.sha256)
+                        throw new Error('Invalid source snapshot frame');
+                    await fd.writeFile(bytes);
+                    hash.update(bytes);
+                    offset += bytes.length;
+                    record.view.preparedBytes += bytes.length;
+                    if (Date.now() - lastPersist > 250) {
+                        this.persist(record);
+                        lastPersist = Date.now();
+                    }
+                }
+                await fd.chmod(entry.item.mode | 0o400);
+                await fd.sync();
+            }
+            finally {
+                await fd.close();
+            }
+            manifest.entries.push({
+                path: entry.destination,
+                kind: 'file',
+                size: entry.item.size,
+                mode: entry.item.mode,
+                sha256: hash.digest('hex'),
+            });
+        }
+        for (const entry of sourceEntries) {
+            checkpoint();
+            if ((await this.call(actor, { op: 'stat', rootId: request.rootId, path: entry.source })).version !==
+                entry.item.version)
+                throw new Error('Source tree changed while its archive snapshot was prepared');
+        }
+        record.view.phase = 'archiving';
+        this.persist(record);
+        const payload = path.join(work, 'payload');
+        await createArchive({ format: request.format, sourceDirectory: tree, outputFile: payload, manifest, signal });
+        checkpoint();
+        const fd = await fs.open(payload, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        let size, version, fingerprint;
+        try {
+            const before = await fd.stat({ bigint: true });
+            size = Number(before.size);
+            if (!before.isFile() || size > MAX_BYTES)
+                throw new Error('Prepared archive exceeds the 100 GiB transfer limit');
+            const hash = createHash('sha256'), bytes = Buffer.alloc(256 * 1024);
+            let offset = 0;
+            while (offset < size) {
+                checkpoint();
+                const read = await fd.read(bytes, 0, Math.min(bytes.length, size - offset), offset);
+                if (!read.bytesRead)
+                    throw new Error('Archive ended unexpectedly');
+                hash.update(bytes.subarray(0, read.bytesRead));
+                offset += read.bytesRead;
+            }
+            if (stamp(before) !== stamp(await fd.stat({ bigint: true })))
+                throw new Error('Prepared archive changed during verification');
+            fingerprint = stamp(before);
+            version = hash.digest('hex');
+            await fd.sync();
+        }
+        finally {
+            await fd.close();
+        }
+        await fs.rm(tree, { recursive: true, force: true });
+        const parent = await fs.open(work, 'r');
+        try {
+            await parent.sync();
+        }
+        finally {
+            await parent.close();
+        }
+        record.stamp = fingerprint;
+        record.view = {
+            ...record.view,
+            state: 'ready',
+            manifest,
+            file: {
+                name: rootName,
+                path: rootName,
+                kind: 'file',
+                size,
+                mode: 0o600,
+                modifiedAt: new Date().toISOString(),
+                version,
+            },
+        };
+        this.persist(record);
+    }
+    async read(actor, request) {
+        const record = this.record(actor, request.id), file = record.view.file;
+        if (record.view.state !== 'ready' ||
+            !file ||
+            request.version !== file.version ||
+            !Number.isSafeInteger(request.offset) ||
+            request.offset < 0 ||
+            request.offset > file.size)
+            throw new Error('Prepared archive version or offset is unavailable');
+        const fd = await fs.open(path.join(await this.cache(request.id), 'payload'), constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        try {
+            const before = await fd.stat({ bigint: true });
+            if (!before.isFile() || stamp(before) !== record.stamp)
+                throw new Error('Prepared archive changed');
+            const data = Buffer.alloc(Math.min(256 * 1024, file.size - request.offset));
+            let read = 0;
+            while (read < data.length) {
+                const frame = await fd.read(data, read, data.length - read, request.offset + read);
+                if (!frame.bytesRead)
+                    break;
+                read += frame.bytesRead;
+            }
+            if (read !== data.length || stamp(await fd.stat({ bigint: true })) !== record.stamp)
+                throw new Error('Prepared archive changed while reading');
+            return {
+                data: data.toString('base64'),
+                sha256: sha(data),
+                offset: request.offset,
+                eof: request.offset + data.length === file.size,
+            };
+        }
+        finally {
+            await fd.close();
+        }
+    }
+}
+//# sourceMappingURL=archive-node.js.map

package/dist/files/archive-node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"archive-node.js","sourceRoot":"","sources":["../../src/files/archive-node.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,SAAS,EAAoB,MAAM,SAAS,CAAC;AACtD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAUzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAWxE,MAAM,SAAS,GAAG,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC;AAClC,MAAM,KAAK,GAAG,CAAC,IAAiB,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC3G,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAE9E,sGAAsG;AACtG,MAAM,OAAO,WAAW;IAcH,IAAI;IACJ,YAAY;IACZ,KAAK;IACL,SAAS;IAhBpB,MAAM,GAAG,IAAI,GAAG,EAAgE,CAAC;IACjF,QAAQ,CAAqB;IAC7B,OAAO,GAAG,KAAK,CAAC;IACxB,oBAAoB;QAClB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;IAC1B,CAAC;IACD,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7C,KAAK,MAAM,SAAS,IAAI,UAAU;YAAE,SAAS,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACjE,MAAM,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,YACmB,IAAU,EACV,YAAiE,EACjE,KAAY,EACZ,SAAiB;oBAHjB,IAAI;4BACJ,YAAY;qBACZ,KAAK;yBACL,SAAS;QAE1B,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAS,iBAAiB,EAAE,EAAE,CAAC,CAAC;YAC9D,IAAI,MAAM,EAAE,IAAI,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;gBACvC,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,aAAa,CAAC;gBAClC,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,yFAAyF,CAAC;gBAC9G,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IACO,KAAK;QACX,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAW,sBAAsB,CAAC,IAAI,EAAE,CAAC;IACtE,CAAC;IACO,OAAO,CAAC,MAAc;QAC5B,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,iBAAiB,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IACrE,CAAC;IACO,MAAM,CAAC,KAAa,EAAE,EAAU;QACtC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACjF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAS,iBAAiB,EAAE,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QACjG,OAAO,KAAK,CAAC;IACf,CAAC;IACO,KAAK,CAAC,KAAK,CAAC,EAAU;QAC5B,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACjF,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAC5C,QAAQ,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,QAAQ,CAAC,GAAG,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC;QACtD,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC/F,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC;QACpB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACrD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACzC,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QACH,IAAI,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;YAChH,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,OAAwB;QAClD,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClE,QAAQ,OAAO,CAAC,EAAE,EAAE,CAAC;YACnB,KAAK,gBAAgB;gBACnB,OAAO,mBAAmB,EAAE,CAAC;YAC/B,KAAK,gBAAgB;gBACnB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACtC,KAAK,eAAe,EAAE,CAAC;gBACrB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;gBAC9C,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;oBAClC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;oBAChE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;oBACpD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,KAAK;wBACzE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;gBACtE,CAAC;gBACD,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACtC,CAAC;YACD,KAAK,aAAa;gBAChB,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACnC,KAAK,cAAc,EAAE,CAAC;gBACpB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,EAC3C,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBACvC,MAAM,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC;gBAC3B,MAAM,MAAM,EAAE,IAAI,CAAC;gBACnB,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC;gBAChC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBACrB,MAAM,EAAE,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC5E,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACtC,CAAC;YACD,KAAK,gBAAgB,EAAE,CAAC;gBACtB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,iBAAiB,OAAO,CAAC,EAAE,EAAE,CAAC;oBAAE,OAAO,SAAS,CAAC;gBAC3E,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;gBAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBAC3C,MAAM,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC;gBAC3B,MAAM,MAAM,EAAE,IAAI,CAAC;gBACnB,MAAM,EAAE,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC5E,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,iBAAiB,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;gBACvD,IAAI,CAAC,KAAK,CAAC,SAAS,CAClB,sBAAsB,EACtB,IAAI,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC,CAC/C,CAAC;gBACF,OAAO,SAAS,CAAC;YACnB,CAAC;YACD;gBACE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IACO,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,OAAgB;QACnD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;YAChF,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,CAAC,MAAM,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC;YACvF,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAS,iBAAiB,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;gBAC1F,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAC5D,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,KAAK,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAAE,OAAO,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5G,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QACvG,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG;YACpD,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,MAAM,MAAM,GAAW;YACrB,KAAK;YACL,OAAO;YACP,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE;SAClG,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrB,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,sBAAsB,EAAE,CAAC,GAAG,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QACtG,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACpC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;aACrG,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACrB,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;YACtG,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,OAAO;gBAC9B,CAAC,CAAC,qEAAqE;gBACvE,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO;oBACzB,CAAC,CAAC,+BAA+B;oBACjC,CAAC,CAAC,KAAK,YAAY,KAAK;wBACtB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;wBAC7B,CAAC,CAAC,4BAA4B,CAAC;YACrC,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9E,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;QACH,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QACL,iFAAiF;QACjF,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACjC,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACO,KAAK,CAAC,KAAK,CAAC,MAAc,EAAE,MAAmB;QACrD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;QAClC,MAAM,UAAU,GAAG,GAAG,EAAE;YACtB,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,CAAC,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC1C,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC;QACjD,IAAI,aAAa,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAC3E,MAAM,aAAa,GAAoE,EAAE,CAAC;QAC1F,MAAM,IAAI,GAAG,KAAK,EAAE,MAAc,EAAE,WAAmB,EAAE,QAAgB,EAAE,KAAa,EAAiB,EAAE;YACzG,UAAU,EAAE,CAAC;YACb,IAAI,KAAK,GAAG,EAAE,IAAI,aAAa,CAAC,MAAM,IAAI,MAAM;gBAC9C,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;YAC3E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAY,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YACrG,IAAI,IAAI,CAAC,OAAO,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;YACpG,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC;gBACrF,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;YACvG,aAAa,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;YAClD,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI,CAAC;gBACrC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,GAAG,SAAS;oBAC1F,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACtD,CAAC;iBAAM,CAAC;gBACN,IAAI,KAAyB,EAAE,QAA4B,CAAC;gBAC5D,GAAG,CAAC;oBACF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAc,KAAK,EAAE;wBAClD,EAAE,EAAE,MAAM;wBACV,MAAM,EAAE,OAAO,CAAC,MAAM;wBACtB,IAAI,EAAE,MAAM;wBACZ,GAAG,CAAC,KAAK,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAClD,CAAC,CAAC;oBACH,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;oBAC5B,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,OAAO;wBACjC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,GAAG,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;oBACnF,KAAK,GAAG,OAAO,CAAC,IAAI,IAAI,SAAS,CAAC;gBACpC,CAAC,QAAQ,KAAK,EAAE;YAClB,CAAC;QACH,CAAC,CAAC;QACF,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACvD,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC;YACnG,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;QACvF,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,cAAc,CAAC;QACnC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrB,MAAM,QAAQ,GAAwB,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC7E,IAAI,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;YAClC,UAAU,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;YAClD,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBACpC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC;gBAC1D,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;gBACtG,SAAS;YACX,CAAC;YACD,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,EAC3C,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC9B,IAAI,CAAC;gBACH,IAAI,MAAM,GAAG,CAAC,CAAC;gBACf,OAAO,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;oBAChC,UAAU,EAAE,CAAC;oBACb,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAY,KAAK,EAAE;wBAC9C,EAAE,EAAE,WAAW;wBACf,MAAM,EAAE,OAAO,CAAC,MAAM;wBACtB,IAAI,EAAE,KAAK,CAAC,MAAM;wBAClB,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO;wBAC3B,MAAM;qBACP,CAAC,CAAC;oBACH,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;oBAChD,IACE,KAAK,CAAC,MAAM,KAAK,MAAM;wBACvB,CAAC,KAAK,CAAC,MAAM;wBACb,KAAK,CAAC,MAAM,GAAG,GAAG,GAAG,IAAI;wBACzB,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI;wBACvC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,KAAK,CAAC,IAAI;wBACvC,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,MAAM;wBAE3B,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;oBACnD,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;oBAC1B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBACnB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;oBACvB,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,KAAK,CAAC,MAAM,CAAC;oBAC1C,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,GAAG,GAAG,EAAE,CAAC;wBACnC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;wBACrB,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;oBAC3B,CAAC;gBACH,CAAC;gBACD,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC;gBACxC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;YAClB,CAAC;oBAAS,CAAC;gBACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;YACnB,CAAC;YACD,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;gBACpB,IAAI,EAAE,KAAK,CAAC,WAAW;gBACvB,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;gBACrB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;gBACrB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;aAC3B,CAAC,CAAC;QACL,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;YAClC,UAAU,EAAE,CAAC;YACb,IACE,CAAC,MAAM,IAAI,CAAC,IAAI,CAAY,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO;gBACvG,KAAK,CAAC,IAAI,CAAC,OAAO;gBAElB,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC;QAChC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC3C,MAAM,aAAa,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9G,UAAU,EAAE,CAAC;QACb,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QACpG,IAAI,IAAY,EAAE,OAAe,EAAE,WAAmB,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/C,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,GAAG,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACjH,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,EAC/B,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;YACnC,IAAI,MAAM,GAAG,CAAC,CAAC;YACf,OAAO,MAAM,GAAG,IAAI,EAAE,CAAC;gBACrB,UAAU,EAAE,CAAC;gBACb,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,GAAG,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;gBACpF,IAAI,CAAC,IAAI,CAAC,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;gBACnE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;gBAC/C,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC;YAC3B,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC1D,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAClE,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;YAC5B,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC7B,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;QAClB,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;QACD,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;QACD,MAAM,CAAC,KAAK,GAAG,WAAW,CAAC;QAC3B,MAAM,CAAC,IAAI,GAAG;YACZ,GAAG,MAAM,CAAC,IAAI;YACd,KAAK,EAAE,OAAO;YACd,QAAQ;YACR,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,MAAM;gBACZ,IAAI;gBACJ,IAAI,EAAE,KAAK;gBACX,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACpC,OAAO;aACR;SACF,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IACO,KAAK,CAAC,IAAI,CAAC,KAAa,EAAE,OAAwD;QACxF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,EAC3C,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QAC1B,IACE,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,OAAO;YAC7B,CAAC,IAAI;YACL,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO;YAChC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC;YACrC,OAAO,CAAC,MAAM,GAAG,CAAC;YAClB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI;YAE1B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CACtB,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,EAClD,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CACjE,CAAC;QACF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/C,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YACpG,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5E,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,OAAO,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC1B,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;gBACnF,IAAI,CAAC,KAAK,CAAC,SAAS;oBAAE,MAAM;gBAC5B,IAAI,IAAI,KAAK,CAAC,SAAS,CAAC;YAC1B,CAAC;YACD,IAAI,IAAI,KAAK,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK;gBACjF,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAC5D,OAAO;gBACL,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC7B,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC;gBACjB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,GAAG,EAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI;aAChD,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;CACF"}

package/dist/files/archive-publication.d.ts

@@ -0,0 +1,26 @@
+import type { FileArchiveFormat, FileArchiveManifest, FileUpload } from '../shared/dto/files.js';
+type Identity = {
+    device: string;
+    inode: string;
+};
+export interface ArchiveWriteState {
+    format: FileArchiveFormat;
+    manifest: FileArchiveManifest;
+    expectedSha256: string;
+    restored?: boolean;
+    /** Written before mkdir: a lost reservation acknowledgement must never adopt an unrelated directory. */
+    reservationAttempted?: boolean;
+    directories?: Record<string, Identity>;
+}
+/** Portable no-overwrite publication. The reserved directory is visible until the durable receipt completes. */
+export declare function publishArchiveDirectory(options: {
+    upload: FileUpload;
+    archive: ArchiveWriteState;
+    staged: string;
+    tree: string;
+    target: () => Promise<string>;
+    persist: () => void;
+    signal: AbortSignal;
+}): Promise<void>;
+export {};
+//# sourceMappingURL=archive-publication.d.ts.map

package/dist/files/archive-publication.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"archive-publication.d.ts","sourceRoot":"","sources":["../../src/files/archive-publication.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAGjG,KAAK,QAAQ,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAClD,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,wGAAwG;IACxG,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;CACxC;AAsCD,gHAAgH;AAChH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE;IACrD,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,EAAE,iBAAiB,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9B,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB,MAAM,EAAE,WAAW,CAAC;CACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmLhB"}

package/dist/files/archive-publication.js

@@ -0,0 +1,224 @@
+import fs from 'node:fs/promises';
+import { constants } from 'node:fs';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { restoreArchive } from './archive-codec.js';
+const identity = (stat) => ({ device: String(stat.dev), inode: String(stat.ino) });
+const same = (stat, value) => String(stat.dev) === value.device && String(stat.ino) === value.inode;
+const absent = (error) => error.code === 'ENOENT';
+async function sync(directory) {
+    const fd = await fs.open(directory, 'r');
+    try {
+        await fd.sync();
+    }
+    finally {
+        await fd.close();
+    }
+}
+async function checksum(file, size, signal) {
+    const fd = await fs.open(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    try {
+        const initial = await fd.stat({ bigint: true });
+        if (!initial.isFile() || initial.size !== BigInt(size))
+            throw new Error('Archive staging file changed');
+        const hash = createHash('sha256');
+        for await (const chunk of fd.createReadStream({ autoClose: false, highWaterMark: 256 * 1024 })) {
+            signal.throwIfAborted();
+            hash.update(chunk);
+        }
+        const final = await fd.stat({ bigint: true });
+        if (initial.ino !== final.ino ||
+            initial.dev !== final.dev ||
+            initial.size !== final.size ||
+            initial.mtimeNs !== final.mtimeNs ||
+            initial.ctimeNs !== final.ctimeNs)
+            throw new Error('Archive staging file changed while verifying');
+        return hash.digest('hex');
+    }
+    finally {
+        await fd.close();
+    }
+}
+/** Portable no-overwrite publication. The reserved directory is visible until the durable receipt completes. */
+export async function publishArchiveDirectory(options) {
+    const { upload, archive, staged, tree, signal, persist } = options;
+    signal.throwIfAborted();
+    if ((await checksum(staged, upload.size, signal)) !== archive.expectedSha256)
+        throw new Error('Transferred archive SHA-256 does not match its admitted source');
+    upload.sha256 = archive.expectedSha256;
+    upload.phase = 'restoring';
+    persist();
+    if (!archive.restored) {
+        if (archive.reservationAttempted)
+            throw new Error('Archive restore receipt is inconsistent with a publication reservation');
+        await fs.rm(tree, { recursive: true, force: true });
+        await fs.mkdir(tree, { mode: 0o700 });
+        const total = archive.manifest.entries.reduce((sum, entry) => sum + entry.size, 0);
+        const space = await fs.statfs(path.dirname(tree));
+        if (space.bavail * space.bsize < total + 64 * 1024 ** 2)
+            throw new Error('Insufficient free space for verified archive restoration');
+        let last = 0;
+        await restoreArchive({
+            format: archive.format,
+            manifest: archive.manifest,
+            archiveFile: staged,
+            outputDirectory: tree,
+            signal,
+            preserveModes: false,
+            onProgress(bytes) {
+                upload.restoredBytes = bytes;
+                if (Date.now() - last > 500) {
+                    persist();
+                    last = Date.now();
+                }
+            },
+        });
+        await sync(tree);
+        archive.restored = true;
+        persist();
+    }
+    // Never trust paths from the decoder or a private tree left by a previous process.
+    const expectedChildren = new Map();
+    expectedChildren.set('', new Set([archive.manifest.rootName]));
+    for (const item of archive.manifest.entries) {
+        if (item.kind === 'directory')
+            expectedChildren.set(item.path, new Set());
+        expectedChildren
+            .get(path.posix.dirname(item.path) === '.' ? '' : path.posix.dirname(item.path))
+            ?.add(path.posix.basename(item.path));
+        signal.throwIfAborted();
+        const stat = await fs.lstat(path.join(tree, item.path), { bigint: true });
+        if (stat.isSymbolicLink() || (item.kind === 'directory' ? !stat.isDirectory() : !stat.isFile()))
+            throw new Error('Restored archive tree changed');
+        if (item.kind === 'file') {
+            // A crash may follow final chmod on an owned hard-linked file. Restore owner-read only
+            // inside the unfinished private tree so its exact bytes can be checked again.
+            await fs.chmod(path.join(tree, item.path), (Number(stat.mode) & 0o777) | 0o400);
+            if ((await checksum(path.join(tree, item.path), item.size, signal)) !== item.sha256)
+                throw new Error('Restored archive file checksum changed');
+        }
+    }
+    for (const [relative, children] of expectedChildren) {
+        const actual = await fs.readdir(path.join(tree, relative));
+        if (actual.length !== children.size || actual.some((name) => !children.has(name)))
+            throw new Error('Unexpected entries in private archive tree');
+    }
+    upload.phase = 'publishing';
+    persist();
+    signal.throwIfAborted();
+    const root = await options.target();
+    if (!archive.directories?.['']) {
+        if (archive.reservationAttempted &&
+            (await fs.lstat(root).catch((error) => {
+                if (absent(error))
+                    return null;
+                throw error;
+            })))
+            throw new Error('Directory reservation outcome is uncertain; inspect the destination before creating a new transfer');
+        archive.reservationAttempted = true;
+        upload.publication = 'partial';
+        persist();
+        try {
+            await fs.mkdir(root, { mode: 0o700 }); // Exclusive: an existing empty directory is never replaced.
+        }
+        catch (error) {
+            if (error.code === 'EEXIST') {
+                // A rejected exclusive mkdir has a known outcome: this transfer owns no destination.
+                archive.reservationAttempted = false;
+                delete upload.publication;
+                persist();
+            }
+            throw error;
+        }
+        const stat = await fs.lstat(root, { bigint: true });
+        archive.directories = { '': identity(stat) };
+        persist();
+        await sync(path.dirname(root));
+    }
+    const checked = async (relative) => {
+        const target = await options.target();
+        if (target !== root)
+            throw new Error('Publication root changed');
+        const parts = relative ? relative.split('/') : [];
+        let candidate = root;
+        for (let index = 0; index <= parts.length; index++) {
+            const key = parts.slice(0, index).join('/'), bound = archive.directories?.[key];
+            if (!bound)
+                throw new Error('Publication directory has no durable identity');
+            const stat = await fs.lstat(candidate, { bigint: true });
+            if (!stat.isDirectory() || stat.isSymbolicLink() || !same(stat, bound))
+                throw new Error('Publication directory was replaced; nothing will be overwritten');
+            if (index < parts.length)
+                candidate = path.join(candidate, parts[index]);
+        }
+        return candidate;
+    };
+    for (const item of archive.manifest.entries.slice(1)) {
+        signal.throwIfAborted();
+        const relative = item.path.slice(archive.manifest.rootName.length + 1), parent = path.posix.dirname(relative);
+        const parentPath = await checked(parent === '.' ? '' : parent), target = path.join(parentPath, path.posix.basename(relative));
+        if (item.kind === 'directory') {
+            if (!archive.directories[relative]) {
+                await fs.mkdir(target, { mode: 0o700 });
+                archive.directories[relative] = identity(await fs.lstat(target, { bigint: true }));
+                persist();
+                await sync(parentPath);
+            }
+            else
+                await checked(relative);
+        }
+        else {
+            const source = path.join(tree, item.path), sourceStat = await fs.lstat(source, { bigint: true });
+            try {
+                await fs.link(source, target);
+            }
+            catch (error) {
+                if (error.code !== 'EEXIST')
+                    throw error;
+                const stat = await fs.lstat(target, { bigint: true });
+                if (!stat.isFile() || !same(stat, identity(sourceStat)))
+                    throw new Error('Publication destination exists; nothing was overwritten', { cause: error });
+            }
+            await sync(parentPath);
+        }
+    }
+    // A failed/resumed publication cannot silently accept additional or modified user content.
+    for (const item of [...archive.manifest.entries].reverse()) {
+        signal.throwIfAborted();
+        const relative = item.path === archive.manifest.rootName ? '' : item.path.slice(archive.manifest.rootName.length + 1);
+        if (item.kind === 'file') {
+            const parent = path.posix.dirname(relative), target = path.join(await checked(parent === '.' ? '' : parent), path.posix.basename(relative));
+            const actual = await fs.lstat(target, { bigint: true }), source = await fs.lstat(path.join(tree, item.path), { bigint: true });
+            if (!actual.isFile() ||
+                !same(actual, identity(source)) ||
+                (await checksum(target, item.size, signal)) !== item.sha256)
+                throw new Error('Published archive file changed before completion');
+            const fd = await fs.open(path.join(tree, item.path), constants.O_RDONLY | constants.O_NOFOLLOW);
+            try {
+                await fd.chmod(item.mode);
+                await fd.sync();
+            }
+            finally {
+                await fd.close();
+            }
+        }
+        else {
+            const target = await checked(relative), names = await fs.readdir(target), expected = expectedChildren.get(item.path);
+            if (names.length !== expected.size || names.some((name) => !expected.has(name)))
+                throw new Error('Publication directory contains unexpected content');
+            const fd = await fs.open(target, constants.O_RDONLY | constants.O_NOFOLLOW);
+            try {
+                await fd.chmod(item.mode);
+                await fd.sync();
+            }
+            finally {
+                await fd.close();
+            }
+        }
+    }
+    await sync(path.dirname(root));
+    upload.publication = 'complete';
+    upload.state = 'complete';
+    persist();
+}
+//# sourceMappingURL=archive-publication.js.map