@package-broker/runtime-node 0.0.0-stage → 2.0.0-rc.1

package/dist/sources/ssh-git.js

@@ -0,0 +1,430 @@
+import { spawn as nodeSpawn } from 'node:child_process';
+import { appendFile, chmod, lstat, mkdir, mkdtemp, readdir, rm, writeFile } from 'node:fs/promises';
+import { isIP } from 'node:net';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+export class SshGitError extends Error {
+    reason;
+    name = 'SshGitError';
+    constructor(reason) {
+        super(`ssh git failed: ${reason}`);
+        this.reason = reason;
+    }
+}
+const QUIET_CONFIG = '[maintenance]\n\tauto = false\n[gc]\n\tauto = 0\n\tautoDetach = false\n';
+const QUIET_ARGS = ['-c', 'maintenance.auto=false', '-c', 'gc.auto=0', '-c', 'gc.autoDetach=false'];
+const DEFAULT_TIMEOUT_MS = 120_000;
+const DEFAULT_MAX_STDOUT = 64 * 1024 * 1024;
+const DEFAULT_MAX_REPO = 256 * 1024 * 1024;
+const SIZE_POLL_MS = 200;
+const GROUP_EXIT_WAIT_MS = 5_000;
+const MAX_STDERR = 16 * 1024;
+const HOSTNAME = /^[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?$/;
+const USER = /^[A-Za-z0-9_][A-Za-z0-9._-]{0,63}$/;
+const REPO_PATH = /^[A-Za-z0-9._/-]+$/;
+const SAFE_TEMP = /^[A-Za-z0-9/._-]+$/;
+const OBJECT_ID = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;
+const ADVERTISED = /^(?:HEAD|refs\/(?:heads|tags)\/.+)$/;
+const REF_NAME = /^refs\/(?:heads|tags)\/[A-Za-z0-9._/+-]+$/;
+const STDERR_REASONS = [
+    [
+        /Host key verification failed|REMOTE HOST IDENTIFICATION HAS CHANGED|host key .* not known/i,
+        'host_key_mismatch',
+    ],
+    [/Permission denied \(|Authentication failed|Too many authentication failures/i, 'auth_failed'],
+    [
+        /Connection refused|Connection timed out|No route to host|Network is unreachable|Connection reset|Connection closed by remote host/i,
+        'connect_failed',
+    ],
+    [
+        /does not exist|not a valid object name|invalid object name|not our ref|repository not found|does not appear to be a git repository|couldn't find remote ref/i,
+        'not_found',
+    ],
+];
+const RECOVERABLE = new Set(['not_found']);
+function hasControl(value) {
+    return [...value].some((char) => {
+        const code = char.charCodeAt(0);
+        return code < 0x20 || code === 0x7f;
+    });
+}
+function parseHost(raw) {
+    const bare = raw.startsWith('[') && raw.endsWith(']') ? raw.slice(1, -1) : raw;
+    if (isIP(bare) === 6 && !bare.includes('%')) {
+        const canonical = new URL(`http://[${bare}]/`).hostname.slice(1, -1);
+        return { host: canonical, urlHost: `[${canonical}]` };
+    }
+    if (bare !== raw || !HOSTNAME.test(raw))
+        throw new SshGitError('invalid_host');
+    const host = raw.toLowerCase();
+    return { host, urlHost: host };
+}
+function assertRemote(remote) {
+    const { host, urlHost } = parseHost(remote.host);
+    if (remote.user !== undefined && !USER.test(remote.user))
+        throw new SshGitError('invalid_user');
+    const port = remote.port ?? 22;
+    if (!Number.isInteger(port) || port < 1 || port > 65535)
+        throw new SshGitError('invalid_port');
+    if (!REPO_PATH.test(remote.path) || remote.path.startsWith('-') || remote.path.startsWith('~')) {
+        throw new SshGitError('invalid_path');
+    }
+    return { host, urlHost, port };
+}
+function assertPath(path) {
+    if (path === '' || path.startsWith('-') || hasControl(path)) {
+        throw new SshGitError('invalid_path');
+    }
+}
+function assertRef(ref) {
+    if (OBJECT_ID.test(ref))
+        return;
+    if (!REF_NAME.test(ref) || ref.includes('..') || ref.endsWith('.lock') || ref.endsWith('/')) {
+        throw new SshGitError('invalid_ref');
+    }
+}
+function refspec(ref) {
+    return OBJECT_ID.test(ref) ? ref : `${ref}:${ref}`;
+}
+function classify(stderr) {
+    return STDERR_REASONS.find(([pattern]) => pattern.test(stderr))?.[1] ?? 'git_failed';
+}
+function orderAddresses(addresses) {
+    return [
+        ...addresses.filter((entry) => entry.family === 4),
+        ...addresses.filter((entry) => entry.family === 6),
+    ].map((entry) => entry.address);
+}
+async function directorySize(dir) {
+    let total = 0;
+    const entries = await readdir(dir, { withFileTypes: true }).catch(() => []);
+    for (const entry of entries) {
+        const full = join(dir, entry.name);
+        if (entry.isDirectory())
+            total += await directorySize(full);
+        else if (entry.isFile())
+            total += await lstat(full).then((info) => info.size, () => 0);
+    }
+    return total;
+}
+function groupAlive(pid) {
+    try {
+        process.kill(-pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function killGroup(child, exited) {
+    const pid = child.pid;
+    if (pid === undefined)
+        return;
+    try {
+        process.kill(-pid, 'SIGKILL');
+    }
+    catch {
+        child.kill('SIGKILL');
+    }
+    await exited;
+    const deadline = Date.now() + GROUP_EXIT_WAIT_MS;
+    while (groupAlive(pid) && Date.now() < deadline) {
+        await new Promise((resolve) => setTimeout(resolve, 20));
+    }
+}
+export async function withSshGitSession(remote, options, work) {
+    const session = await openSshGitSession(remote, options);
+    try {
+        return await work(session);
+    }
+    finally {
+        await session.close();
+    }
+}
+export async function openSshGitSession(remote, options) {
+    const target = assertRemote(remote);
+    const spawn = options.spawn ?? nodeSpawn;
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const maxStdout = options.maxStdoutBytes ?? DEFAULT_MAX_STDOUT;
+    const maxRepo = options.maxRepoBytes ?? DEFAULT_MAX_REPO;
+    const resolution = await options.dnsGuard.forTarget(target.host, target.port, 'ssh').resolve();
+    const addresses = orderAddresses(resolution.addresses);
+    if (addresses.length === 0)
+        throw new SshGitError('no_address');
+    const root = await mkdtemp(join(options.tmpRoot ?? tmpdir(), 'ssh-git-'));
+    const home = join(root, 'home');
+    const keyFile = join(root, 'id_key');
+    const knownHostsFile = join(root, 'known_hosts');
+    const gitConfig = join(home, '.gitconfig');
+    const repo = join(root, 'repo.git');
+    const gitDir = `--git-dir=${repo}`;
+    const live = new Set();
+    let closing;
+    const close = () => {
+        closing ??= (async () => {
+            await Promise.all([...live].map((abort) => abort('closed')));
+            await rm(root, { recursive: true, force: true });
+        })();
+        return closing;
+    };
+    try {
+        if (!SAFE_TEMP.test(root))
+            throw new SshGitError('unsafe_temp_path');
+        await chmod(root, 0o700);
+        await mkdir(home, { mode: 0o700 });
+        const key = options.credential.privateKeyPem;
+        await writeFile(keyFile, key.endsWith('\n') ? key : `${key}\n`, { mode: 0o600, flag: 'wx' });
+        await writeFile(knownHostsFile, options.credential.knownHosts, { mode: 0o600, flag: 'wx' });
+        await writeFile(gitConfig, '', { mode: 0o600, flag: 'wx' });
+    }
+    catch (error) {
+        await close();
+        throw error;
+    }
+    const envFor = (address) => ({
+        PATH: process.env['PATH'] ?? '/usr/bin:/bin',
+        HOME: home,
+        GIT_CONFIG_GLOBAL: gitConfig,
+        GIT_CONFIG_NOSYSTEM: '1',
+        GIT_CEILING_DIRECTORIES: root,
+        GIT_ALLOW_PROTOCOL: 'ssh',
+        GIT_TERMINAL_PROMPT: '0',
+        GIT_SSH_COMMAND: [
+            'ssh -F /dev/null',
+            `-i '${keyFile}'`,
+            '-o IdentitiesOnly=yes',
+            '-o IdentityAgent=none',
+            `-o UserKnownHostsFile='${knownHostsFile}'`,
+            '-o StrictHostKeyChecking=yes',
+            `-o HostKeyAlias=${target.host}`,
+            `-o HostName=${address}`,
+            '-o BatchMode=yes',
+            '-o ProxyCommand=none',
+            '-o PermitLocalCommand=no',
+            '-o ForwardAgent=no',
+            '-o ClearAllForwardings=yes',
+            '-o ControlPath=none',
+            '-o ConnectTimeout=15',
+        ].join(' '),
+    });
+    const userPart = remote.user === undefined ? '' : `${remote.user}@`;
+    const url = `ssh://${userPart}${target.urlHost}:${target.port}/${remote.path.replace(/^\/+/, '')}`;
+    let addressIndex = 0;
+    let partial = false;
+    let repoReady;
+    function run(args, watchSize = false, extraEnv = {}) {
+        if (closing)
+            return Promise.reject(new SshGitError('closed'));
+        const address = addresses[addressIndex] ?? addresses[0] ?? '';
+        return new Promise((resolve, reject) => {
+            const gitArgs = args[0]?.startsWith('--git-dir=')
+                ? [args[0], ...QUIET_ARGS, ...args.slice(1)]
+                : [...QUIET_ARGS, ...args];
+            const child = spawn('git', gitArgs, {
+                shell: false,
+                detached: true,
+                env: { ...envFor(address), ...extraEnv },
+                cwd: root,
+                stdio: ['ignore', 'pipe', 'pipe'],
+            });
+            const exited = new Promise((done) => {
+                child.once('exit', () => done());
+                child.once('error', () => done());
+            });
+            const chunks = [];
+            let stderr = '';
+            let size = 0;
+            let settled = false;
+            const stop = () => {
+                settled = true;
+                clearTimeout(timer);
+                clearInterval(poll);
+                live.delete(abort);
+            };
+            const abort = async (reason) => {
+                if (settled)
+                    return;
+                stop();
+                await killGroup(child, exited);
+                reject(new SshGitError(reason));
+            };
+            live.add(abort);
+            const timer = setTimeout(() => void abort('timeout'), timeoutMs);
+            const poll = setInterval(() => {
+                if (!watchSize || settled)
+                    return;
+                void directorySize(repo).then((bytes) => {
+                    if (bytes > maxRepo)
+                        void abort('repository_too_large');
+                });
+            }, SIZE_POLL_MS);
+            child.stdout?.on('data', (chunk) => {
+                size += chunk.length;
+                if (size > maxStdout)
+                    void abort('output_too_large');
+                else
+                    chunks.push(chunk);
+            });
+            child.stderr?.on('data', (chunk) => {
+                if (stderr.length < MAX_STDERR)
+                    stderr += chunk.toString('utf8');
+            });
+            child.on('error', () => void abort('git_failed'));
+            child.on('close', (code) => {
+                if (settled)
+                    return;
+                stop();
+                if (code === 0)
+                    resolve(Buffer.concat(chunks));
+                else
+                    reject(new SshGitError(classify(stderr)));
+            });
+        });
+    }
+    async function overAddresses(work) {
+        for (;;) {
+            try {
+                return await work();
+            }
+            catch (error) {
+                const retry = error instanceof SshGitError &&
+                    error.reason === 'connect_failed' &&
+                    addressIndex < addresses.length - 1;
+                if (!retry)
+                    throw error;
+                addressIndex += 1;
+            }
+        }
+    }
+    function ensureRepo() {
+        repoReady ??= (async () => {
+            await run(['init', '--bare', '--quiet', repo]);
+            await appendFile(join(repo, 'config'), `\n${QUIET_CONFIG}`);
+            await run([gitDir, 'remote', 'add', 'origin', url]);
+        })();
+        return repoReady;
+    }
+    async function assertRepoSize() {
+        if ((await directorySize(repo)) > maxRepo)
+            throw new SshGitError('repository_too_large');
+    }
+    async function guarded(work) {
+        try {
+            return await work();
+        }
+        catch (error) {
+            if (!(error instanceof SshGitError && RECOVERABLE.has(error.reason)))
+                await close();
+            throw error;
+        }
+    }
+    return {
+        lsRemote() {
+            return guarded(async () => {
+                const out = await overAddresses(() => run([
+                    '-c',
+                    'protocol.version=2',
+                    'ls-remote',
+                    '--symref',
+                    url,
+                    'HEAD',
+                    'refs/heads/*',
+                    'refs/tags/*',
+                ]));
+                const refs = new Map();
+                const symrefs = new Map();
+                for (const line of out.toString('utf8').split('\n')) {
+                    const [sha, name] = line.split('\t');
+                    if (!sha || !name)
+                        continue;
+                    if (sha.startsWith('ref: ')) {
+                        const target = sha.slice(5);
+                        if (name === 'HEAD' && REF_NAME.test(target))
+                            symrefs.set(name, target);
+                        continue;
+                    }
+                    if (!OBJECT_ID.test(sha))
+                        continue;
+                    if (!ADVERTISED.test(name.endsWith('^{}') ? name.slice(0, -3) : name))
+                        continue;
+                    if (name.endsWith('^{}')) {
+                        const base = refs.get(name.slice(0, -3));
+                        if (base)
+                            base.peeled = sha;
+                    }
+                    else {
+                        refs.set(name, { sha });
+                    }
+                }
+                return [...refs].map(([name, ref]) => ({
+                    name,
+                    ...ref,
+                    ...(symrefs.has(name) ? { symref: symrefs.get(name) } : {}),
+                }));
+            });
+        },
+        async fetchRefs(refs, fetchOptions) {
+            refs.forEach(assertRef);
+            return guarded(async () => {
+                if (refs.length === 0)
+                    return;
+                await ensureRepo();
+                if (fetchOptions.filter !== 'none')
+                    partial = true;
+                await overAddresses(() => run([
+                    gitDir,
+                    '-c',
+                    'protocol.version=2',
+                    '-c',
+                    'fetch.fsckObjects=true',
+                    '-c',
+                    'transfer.fsckObjects=true',
+                    'fetch',
+                    '--quiet',
+                    '--no-tags',
+                    '--no-write-fetch-head',
+                    `--depth=${fetchOptions.depth}`,
+                    ...(fetchOptions.filter === 'none' ? [] : [`--filter=${fetchOptions.filter}`]),
+                    'origin',
+                    ...refs.map(refspec),
+                ], true));
+                await assertRepoSize();
+            });
+        },
+        async catFile(ref, path) {
+            assertRef(ref);
+            assertPath(path);
+            return guarded(async () => {
+                await ensureRepo();
+                const out = await run([gitDir, 'cat-file', 'blob', `${ref}:${path}`], partial);
+                if (partial)
+                    await assertRepoSize();
+                return out;
+            });
+        },
+        async commitTime(ref) {
+            assertRef(ref);
+            return guarded(async () => {
+                await ensureRepo();
+                const out = await run([gitDir, 'show', '--no-patch', '--format=%cI', `${ref}^{commit}`, '--'], false, { GIT_NO_LAZY_FETCH: '1' });
+                const time = out.toString('utf8').trim();
+                if (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:Z|[+-]\d{2}:\d{2})$/.test(time)) {
+                    throw new SshGitError('git_failed');
+                }
+                return new Date(time).toISOString();
+            });
+        },
+        async archiveZip(ref) {
+            assertRef(ref);
+            return guarded(async () => {
+                await ensureRepo();
+                const out = await run([gitDir, 'archive', '--format=zip', ref], partial);
+                if (partial)
+                    await assertRepoSize();
+                return out;
+            });
+        },
+        close,
+    };
+}
+//# sourceMappingURL=ssh-git.js.map

package/dist/sources/ssh-git.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh-git.js","sourceRoot":"","sources":["../../src/sources/ssh-git.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,IAAI,SAAS,EAAwC,MAAM,oBAAoB,CAAC;AAC9F,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpG,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAsBjC,MAAM,OAAO,WAAY,SAAQ,KAAK;IAEf;IADH,IAAI,GAAG,aAAa,CAAC;IACvC,YAAqB,MAAoB;QACvC,KAAK,CAAC,mBAAmB,MAAM,EAAE,CAAC,CAAC;QADhB,WAAM,GAAN,MAAM,CAAc;IAEzC,CAAC;CACF;AA8CD,MAAM,YAAY,GAAG,yEAAyE,CAAC;AAC/F,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,qBAAqB,CAAC,CAAC;AAEpG,MAAM,kBAAkB,GAAG,OAAO,CAAC;AACnC,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAC5C,MAAM,gBAAgB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAC3C,MAAM,YAAY,GAAG,GAAG,CAAC;AACzB,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,UAAU,GAAG,EAAE,GAAG,IAAI,CAAC;AAC7B,MAAM,QAAQ,GAAG,mDAAmD,CAAC;AACrE,MAAM,IAAI,GAAG,oCAAoC,CAAC;AAClD,MAAM,SAAS,GAAG,oBAAoB,CAAC;AACvC,MAAM,SAAS,GAAG,oBAAoB,CAAC;AACvC,MAAM,SAAS,GAAG,iCAAiC,CAAC;AACpD,MAAM,UAAU,GAAG,qCAAqC,CAAC;AACzD,MAAM,QAAQ,GAAG,2CAA2C,CAAC;AAE7D,MAAM,cAAc,GAAsC;IACxD;QACE,4FAA4F;QAC5F,mBAAmB;KACpB;IACD,CAAC,8EAA8E,EAAE,aAAa,CAAC;IAC/F;QACE,oIAAoI;QACpI,gBAAgB;KACjB;IACD;QACE,8JAA8J;QAC9J,WAAW;KACZ;CACF,CAAC;AAEF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAe,CAAC,WAAW,CAAC,CAAC,CAAC;AAQzD,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAChC,OAAO,IAAI,GAAG,IAAI,IAAI,IAAI,KAAK,IAAI,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC/E,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACrE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,SAAS,GAAG,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,IAAI,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,cAAc,CAAC,CAAC;IAC/E,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAC/B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,YAAY,CAAC,MAAiB;IACrC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,cAAc,CAAC,CAAC;IAChG,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK;QAAE,MAAM,IAAI,WAAW,CAAC,cAAc,CAAC,CAAC;IAC/F,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/F,MAAM,IAAI,WAAW,CAAC,cAAc,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,WAAW,CAAC,cAAc,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO;IAChC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5F,MAAM,IAAI,WAAW,CAAC,aAAa,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,OAAO,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,QAAQ,CAAC,MAAc;IAC9B,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC;AACvF,CAAC;AAED,SAAS,cAAc,CAAC,SAAqC;IAC3D,OAAO;QACL,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;QAClD,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;KACnD,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAW;IACtC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5E,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,WAAW,EAAE;YAAE,KAAK,IAAI,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;aACvD,IAAI,KAAK,CAAC,MAAM,EAAE;YACrB,KAAK,IAAI,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAC7B,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EACnB,GAAG,EAAE,CAAC,CAAC,CACR,CAAC;IACN,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAmB,EAAE,MAAqB;IACjE,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO;IAC9B,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,MAAM,CAAC;IACb,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB,CAAC;IACjD,OAAO,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAiB,EACjB,OAAsB,EACtB,IAA4C;IAE5C,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAiB,EACjB,OAAsB;IAEtB,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,KAAK,GAAa,OAAO,CAAC,KAAK,IAAI,SAAS,CAAC;IACnD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,MAAM,SAAS,GAAG,OAAO,CAAC,cAAc,IAAI,kBAAkB,CAAC;IAC/D,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,IAAI,gBAAgB,CAAC;IAEzD,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;IAC/F,MAAM,SAAS,GAAG,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACvD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,YAAY,CAAC,CAAC;IAEhE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACrC,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,aAAa,IAAI,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,GAAG,EAA2C,CAAC;IAChE,IAAI,OAAkC,CAAC;IAEvC,MAAM,KAAK,GAAG,GAAkB,EAAE;QAChC,OAAO,KAAK,CAAC,KAAK,IAAI,EAAE;YACtB,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC7D,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,kBAAkB,CAAC,CAAC;QACrE,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACzB,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC;QAC7C,MAAM,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,MAAM,SAAS,CAAC,cAAc,EAAE,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5F,MAAM,SAAS,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,KAAK,EAAE,CAAC;QACd,MAAM,KAAK,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,OAAe,EAA0B,EAAE,CAAC,CAAC;QAC3D,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,eAAe;QAC5C,IAAI,EAAE,IAAI;QACV,iBAAiB,EAAE,SAAS;QAC5B,mBAAmB,EAAE,GAAG;QACxB,uBAAuB,EAAE,IAAI;QAC7B,kBAAkB,EAAE,KAAK;QACzB,mBAAmB,EAAE,GAAG;QACxB,eAAe,EAAE;YACf,kBAAkB;YAClB,OAAO,OAAO,GAAG;YACjB,uBAAuB;YACvB,uBAAuB;YACvB,0BAA0B,cAAc,GAAG;YAC3C,8BAA8B;YAC9B,mBAAmB,MAAM,CAAC,IAAI,EAAE;YAChC,eAAe,OAAO,EAAE;YACxB,kBAAkB;YAClB,sBAAsB;YACtB,0BAA0B;YAC1B,oBAAoB;YACpB,4BAA4B;YAC5B,qBAAqB;YACrB,sBAAsB;SACvB,CAAC,IAAI,CAAC,GAAG,CAAC;KACZ,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,GAAG,CAAC;IACpE,MAAM,GAAG,GAAG,SAAS,QAAQ,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;IACnG,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,SAAoC,CAAC;IAEzC,SAAS,GAAG,CACV,IAAuB,EACvB,SAAS,GAAG,KAAK,EACjB,WAAmC,EAAE;QAErC,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,SAAS,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9D,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,YAAY,CAAC;gBAC/C,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC5C,CAAC,CAAC,CAAC,GAAG,UAAU,EAAE,GAAG,IAAI,CAAC,CAAC;YAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE;gBAClC,KAAK,EAAE,KAAK;gBACZ,QAAQ,EAAE,IAAI;gBACd,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,QAAQ,EAAE;gBACxC,GAAG,EAAE,IAAI;gBACT,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;aAClC,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,OAAO,CAAO,CAAC,IAAI,EAAE,EAAE;gBACxC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;gBACjC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;YACpC,CAAC,CAAC,CAAC;YACH,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,IAAI,GAAG,GAAS,EAAE;gBACtB,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,aAAa,CAAC,IAAI,CAAC,CAAC;gBACpB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC,CAAC;YACF,MAAM,KAAK,GAAG,KAAK,EAAE,MAAoB,EAAiB,EAAE;gBAC1D,IAAI,OAAO;oBAAE,OAAO;gBACpB,IAAI,EAAE,CAAC;gBACP,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gBAC/B,MAAM,CAAC,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;YAClC,CAAC,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,KAAK,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;YACjE,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,SAAS,IAAI,OAAO;oBAAE,OAAO;gBAClC,KAAK,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;oBACtC,IAAI,KAAK,GAAG,OAAO;wBAAE,KAAK,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBAC1D,CAAC,CAAC,CAAC;YACL,CAAC,EAAE,YAAY,CAAC,CAAC;YACjB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBACzC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;gBACrB,IAAI,IAAI,GAAG,SAAS;oBAAE,KAAK,KAAK,CAAC,kBAAkB,CAAC,CAAC;;oBAChD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBACzC,IAAI,MAAM,CAAC,MAAM,GAAG,UAAU;oBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACnE,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;YAClD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,IAAI,OAAO;oBAAE,OAAO;gBACpB,IAAI,EAAE,CAAC;gBACP,IAAI,IAAI,KAAK,CAAC;oBAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;;oBAC1C,MAAM,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACjD,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,aAAa,CAAI,IAAsB;QACpD,SAAS,CAAC;YACR,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,EAAE,CAAC;YACtB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,KAAK,GACT,KAAK,YAAY,WAAW;oBAC5B,KAAK,CAAC,MAAM,KAAK,gBAAgB;oBACjC,YAAY,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;gBACtC,IAAI,CAAC,KAAK;oBAAE,MAAM,KAAK,CAAC;gBACxB,YAAY,IAAI,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS,UAAU;QACjB,SAAS,KAAK,CAAC,KAAK,IAAI,EAAE;YACxB,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;YAC/C,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,KAAK,YAAY,EAAE,CAAC,CAAC;YAC5D,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QACtD,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,UAAU,cAAc;QAC3B,IAAI,CAAC,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,OAAO;YAAE,MAAM,IAAI,WAAW,CAAC,sBAAsB,CAAC,CAAC;IAC3F,CAAC;IAED,KAAK,UAAU,OAAO,CAAI,IAAsB;QAC9C,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,WAAW,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAAE,MAAM,KAAK,EAAE,CAAC;YACpF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO;QACL,QAAQ;YACN,OAAO,OAAO,CAAC,KAAK,IAAI,EAAE;gBACxB,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,CACnC,GAAG,CAAC;oBACF,IAAI;oBACJ,oBAAoB;oBACpB,WAAW;oBACX,UAAU;oBACV,GAAG;oBACH,MAAM;oBACN,cAAc;oBACd,aAAa;iBACd,CAAC,CACH,CAAC;gBACF,MAAM,IAAI,GAAG,IAAI,GAAG,EAA6D,CAAC;gBAClF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;gBAC1C,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpD,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBACrC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI;wBAAE,SAAS;oBAC5B,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;wBAC5B,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;wBAC5B,IAAI,IAAI,KAAK,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;4BAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;wBACxE,SAAS;oBACX,CAAC;oBACD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC;wBAAE,SAAS;oBACnC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;wBAAE,SAAS;oBAChF,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;wBACzB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;wBACzC,IAAI,IAAI;4BAAE,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC;oBAC9B,CAAC;yBAAM,CAAC;wBACN,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;oBAC1B,CAAC;gBACH,CAAC;gBACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;oBACrC,IAAI;oBACJ,GAAG,GAAG;oBACN,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC7D,CAAC,CAAC,CAAC;YACN,CAAC,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,YAAY;YAChC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACxB,OAAO,OAAO,CAAC,KAAK,IAAI,EAAE;gBACxB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO;gBAC9B,MAAM,UAAU,EAAE,CAAC;gBACnB,IAAI,YAAY,CAAC,MAAM,KAAK,MAAM;oBAAE,OAAO,GAAG,IAAI,CAAC;gBACnD,MAAM,aAAa,CAAC,GAAG,EAAE,CACvB,GAAG,CACD;oBACE,MAAM;oBACN,IAAI;oBACJ,oBAAoB;oBACpB,IAAI;oBACJ,wBAAwB;oBACxB,IAAI;oBACJ,2BAA2B;oBAC3B,OAAO;oBACP,SAAS;oBACT,WAAW;oBACX,uBAAuB;oBACvB,WAAW,YAAY,CAAC,KAAK,EAAE;oBAC/B,GAAG,CAAC,YAAY,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;oBAC9E,QAAQ;oBACR,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;iBACrB,EACD,IAAI,CACL,CACF,CAAC;gBACF,MAAM,cAAc,EAAE,CAAC;YACzB,CAAC,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI;YACrB,SAAS,CAAC,GAAG,CAAC,CAAC;YACf,UAAU,CAAC,IAAI,CAAC,CAAC;YACjB,OAAO,OAAO,CAAC,KAAK,IAAI,EAAE;gBACxB,MAAM,UAAU,EAAE,CAAC;gBACnB,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;gBAC/E,IAAI,OAAO;oBAAE,MAAM,cAAc,EAAE,CAAC;gBACpC,OAAO,GAAG,CAAC;YACb,CAAC,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,GAAG;YAClB,SAAS,CAAC,GAAG,CAAC,CAAC;YACf,OAAO,OAAO,CAAC,KAAK,IAAI,EAAE;gBACxB,MAAM,UAAU,EAAE,CAAC;gBACnB,MAAM,GAAG,GAAG,MAAM,GAAG,CACnB,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,GAAG,GAAG,WAAW,EAAE,IAAI,CAAC,EACvE,KAAK,EACL,EAAE,iBAAiB,EAAE,GAAG,EAAE,CAC3B,CAAC;gBACF,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;gBACzC,IAAI,CAAC,4DAA4D,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7E,MAAM,IAAI,WAAW,CAAC,YAAY,CAAC,CAAC;gBACtC,CAAC;gBACD,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YACtC,CAAC,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,GAAG;YAClB,SAAS,CAAC,GAAG,CAAC,CAAC;YACf,OAAO,OAAO,CAAC,KAAK,IAAI,EAAE;gBACxB,MAAM,UAAU,EAAE,CAAC;gBACnB,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;gBACzE,IAAI,OAAO;oBAAE,MAAM,cAAc,EAAE,CAAC;gBACpC,OAAO,GAAG,CAAC;YACb,CAAC,CAAC,CAAC;QACL,CAAC;QAED,KAAK;KACN,CAAC;AACJ,CAAC"}

package/dist/sources/ssh-provider.d.ts

@@ -0,0 +1,55 @@
+import type { OrgContext } from '@package-broker/core/db/port';
+import { type SshKeyMaterial } from '@package-broker/core/sources/credentials';
+import { type ProviderSource, type SourceProvider } from '@package-broker/core/sources/provider';
+import type { DnsGuard } from './dns-guard.js';
+import { type SpawnGit, type SshRemote } from './ssh-git.js';
+export interface SshArchiveRecord {
+    readonly sha1: string;
+    readonly time: string | null;
+}
+export interface SshBuiltArchive extends SshArchiveRecord {
+    readonly version: string;
+    readonly versionNormalized: string;
+    readonly commit: string;
+    readonly zip: Uint8Array;
+}
+/**
+ * Immutable archives built during SSH source ingestion, scoped per call by OrgContext.
+ * Implementations must include `ctx.orgId`, source.id, canonical package name,
+ * normalized version and commit in every storage key. Names are opaque key components,
+ * never filesystem paths; a hash of the tuple is suitable for filesystem naming.
+ *
+ * `store` is the put operation. It resolves only after the complete ZIP and its SHA-1
+ * and commit time are durable and atomically visible together. Readers must see either
+ * no record or the complete archive, including during concurrent writes. Repeating a
+ * put for an existing key preserves the first published archive; it is never rebuilt.
+ *
+ * `find` is the metadata get and existence check: null means absent; a record means
+ * the complete ZIP is available. Storage failures reject, rather than report absence.
+ * Returned records must not expose mutable internal state.
+ *
+ * Implementations enforce their configured ZIP byte cap before publishing. An oversized
+ * archive or failed write rejects without publishing a record, preserves any prior
+ * archive and removes temporary files. Errors must not contain a URL, key path or credential text.
+ */
+export interface SshArchiveStore {
+    find(ctx: OrgContext, source: ProviderSource, name: string, versionNormalized: string, commit: string): Promise<SshArchiveRecord | null>;
+    store(ctx: OrgContext, source: ProviderSource, name: string, archive: SshBuiltArchive): Promise<void>;
+}
+/** Reads only the full archive tuple; null means absent, with no upstream fallback. */
+export interface SshArchiveReader extends SshArchiveStore {
+    readZip(ctx: OrgContext, source: ProviderSource, name: string, versionNormalized: string, commit: string): Promise<Uint8Array | null>;
+}
+export interface SshGitProviderOptions {
+    readonly dnsGuard: DnsGuard;
+    readonly sshKey: (source: ProviderSource) => Promise<SshKeyMaterial>;
+    readonly archives: SshArchiveReader;
+    readonly tmpRoot?: string;
+    readonly timeoutMs?: number;
+    readonly maxStdoutBytes?: number;
+    readonly spawn?: SpawnGit;
+}
+export declare function parseSshRepository(text: string): SshRemote;
+export declare function informationalUrl(remote: SshRemote): string;
+export declare function createSshGitProvider(options: SshGitProviderOptions): SourceProvider;
+//# sourceMappingURL=ssh-provider.d.ts.map

package/dist/sources/ssh-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh-provider.d.ts","sourceRoot":"","sources":["../../src/sources/ssh-provider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAU/D,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAIL,KAAK,cAAc,EAEnB,KAAK,cAAc,EAEpB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAIL,KAAK,QAAQ,EAEb,KAAK,SAAS,EACf,MAAM,cAAc,CAAC;AAQtB,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,eAAgB,SAAQ,gBAAgB;IACvD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,CACF,GAAG,EAAE,UAAU,EACf,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,MAAM,EACZ,iBAAiB,EAAE,MAAM,EACzB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACpC,KAAK,CACH,GAAG,EAAE,UAAU,EACf,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED,uFAAuF;AACvF,MAAM,WAAW,gBAAiB,SAAQ,eAAe;IACvD,OAAO,CACL,GAAG,EAAE,UAAU,EACf,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,MAAM,EACZ,iBAAiB,EAAE,MAAM,EACzB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,cAAc,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IACrE,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;CAC3B;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAmB1D;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,CAE1D;AAwGD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,qBAAqB,GAAG,cAAc,CAyTnF"}