@push.rocks/smartlinuxrepo 0.0.0-stage → 0.1.0

package/dist_ts/rpm/sign.js

@@ -0,0 +1,183 @@
+import * as plugins from '../plugins.js';
+import { PackageByteSource } from '../readers/bytesource.js';
+import { READ_CHUNK_BYTES } from '../readers/bytes.js';
+import { LinuxRepoError } from '../shared/errors.js';
+import { resolveLinuxPackageLimits } from '../shared/limits.js';
+import { assertTimestamp } from '../shared/validation.js';
+import { createDetachedBinarySignature } from '../signing/openpgpframing.js';
+import { singleChunk } from '../signing/signers.js';
+import { readRpmHeaders, RPM_SIGNATURE_TAG, RPM_TYPE, writeSignatureHeader } from './header.js';
+const PAYLOAD_DIGEST = 5092;
+const PAYLOAD_DIGEST_ALGORITHM = 5093;
+/** go-rpmutils `getPayloadDigest` algorithms (`signatures.go`, RFC 4880 ids). */
+const PAYLOAD_DIGEST_ALGORITHMS = new Map([
+    [1, 'md5'],
+    [2, 'sha1'],
+    [8, 'sha256'],
+    [9, 'sha384'],
+    [10, 'sha512'],
+    [11, 'sha224'],
+]);
+/**
+ * Signs an RPM package as Gitea 28.2.0 does on upload (`services/packages/rpm/sign.go:17-38`,
+ * go-rpmutils v0.4.0 `SignRpmStream` and `DumpSignatureHeader(false)`):
+ * - the main header digest is checked, and the payload is checked against
+ *   PAYLOADDIGEST (5092/5093), else the signature header MD5 (1004) over
+ *   header and payload; a package with neither is `missing-field`, a mismatch
+ *   `digest-mismatch`;
+ * - tag 1002 gets a signature over the main header and payload, tag 268 one
+ *   over the main header alone; tags 1005, 267 and 1008 are removed; every
+ *   other signature tag from 64 up is kept byte for byte, the tags are written
+ *   in ascending order behind a new region tag 62, and the header is padded to
+ *   8 bytes.
+ *
+ * The signed package is `prefix` (the lead and the new signature header)
+ * followed by the original bytes from `resumeAt`, the start of the main
+ * header. The source is read once; only the headers are held in memory, and
+ * the payload streams through the signer. A signer that returns before reading
+ * the data to its end is `signing-failed`.
+ */
+export async function signRpmPackage(input) {
+    if (input === null || typeof input !== 'object') {
+        throw new LinuxRepoError('invalid-input', 'input must be an object', { field: 'input' });
+    }
+    if (input.signer === null || typeof input.signer !== 'object' || typeof input.signer.signBinary !== 'function') {
+        throw new LinuxRepoError('invalid-input', 'signer must implement IOpenPgpSigner', { field: 'signer' });
+    }
+    assertTimestamp(input.timestamp);
+    const limits = resolveLinuxPackageLimits(input.limits);
+    const bytes = new PackageByteSource(input.source, limits.maxPackageBytes);
+    const headers = await readRpmHeaders(bytes, limits);
+    const payloadCheck = payloadDigestCheck(headers);
+    const signedData = new SignedDataStream(headers.main.bytes, bytes, payloadCheck);
+    let headerAndPayload;
+    try {
+        headerAndPayload = await createDetachedBinarySignature({ data: signedData, signer: input.signer, timestamp: input.timestamp });
+    }
+    catch (error) {
+        // a failure of the codec's own stream (or the caller's source) wins over what the signer made of it
+        throw signedData.failure !== undefined ? signedData.failure.error : error;
+    }
+    if (signedData.failure !== undefined) {
+        throw signedData.failure.error;
+    }
+    if (!signedData.completed) {
+        throw new LinuxRepoError('signing-failed', 'the signer returned before reading the package to its end', { field: 'signer' });
+    }
+    const headerOnly = await createDetachedBinarySignature({
+        data: singleChunk(headers.main.bytes),
+        signer: input.signer,
+        timestamp: input.timestamp,
+    });
+    const removed = new Set([
+        RPM_SIGNATURE_TAG.pgp,
+        RPM_SIGNATURE_TAG.rsa,
+        RPM_SIGNATURE_TAG.gpg,
+        RPM_SIGNATURE_TAG.dsa,
+        RPM_SIGNATURE_TAG.reservedSpace,
+    ]);
+    const signatureHeader = writeSignatureHeader(headers.signature, removed, [
+        { tag: RPM_SIGNATURE_TAG.pgp, type: RPM_TYPE.bin, count: headerAndPayload.length, contents: headerAndPayload },
+        { tag: RPM_SIGNATURE_TAG.rsa, type: RPM_TYPE.bin, count: headerOnly.length, contents: headerOnly },
+    ]);
+    const prefix = new Uint8Array(headers.lead.length + signatureHeader.length);
+    prefix.set(headers.lead, 0);
+    prefix.set(signatureHeader, headers.lead.length);
+    return { prefix, resumeAt: headers.mainStart };
+}
+function payloadDigestCheck(headersArg) {
+    // the same lookups, in the same order, as go-rpmutils `getPayloadDigest`
+    const digests = headersArg.main.strings(PAYLOAD_DIGEST);
+    const algorithms = digests === null || digests.length === 0 ? null : headersArg.main.uint32s(PAYLOAD_DIGEST_ALGORITHM);
+    const algorithm = algorithms === null || algorithms.length === 0 ? undefined : PAYLOAD_DIGEST_ALGORITHMS.get(algorithms[0]);
+    if (algorithm !== undefined && digests !== null) {
+        const expected = digests[0];
+        return {
+            hash: plugins.crypto.createHash(algorithm),
+            coversHeader: false,
+            matches: (digestArg) => {
+                const actual = new TextEncoder().encode(digestArg.toString('hex'));
+                return actual.length === expected.length && actual.every((byte, i) => byte === expected[i]);
+            },
+        };
+    }
+    const md5 = headersArg.signature.binary(RPM_SIGNATURE_TAG.md5);
+    if (md5 !== null && md5.length !== 0) {
+        return {
+            hash: plugins.crypto.createHash('md5'),
+            coversHeader: true,
+            matches: (digestArg) => digestArg.length === md5.length && digestArg.every((byte, i) => byte === md5[i]),
+        };
+    }
+    throw new LinuxRepoError('missing-field', 'the RPM package has no usable payload digest', { field: 'payload digest' });
+}
+/**
+ * The data tag 1002 signs: the main header, then the payload as it is pulled
+ * from the package source, hashed for the payload check on the way. Iterable
+ * once; it pulls only when the signer asks. Any failure (the caller's source,
+ * a limit, truncation, a digest mismatch) is thrown to the signer and kept, so
+ * `signRpmPackage` reports it instead of whatever the signer made of it.
+ */
+class SignedDataStream {
+    mainHeader;
+    source;
+    check;
+    completed = false;
+    failure = undefined;
+    iterated = false;
+    headerSent = false;
+    queue = Promise.resolve();
+    constructor(mainHeader, source, check) {
+        this.mainHeader = mainHeader;
+        this.source = source;
+        this.check = check;
+    }
+    [Symbol.asyncIterator]() {
+        if (this.iterated) {
+            const error = new LinuxRepoError('signing-failed', 'the signer read the package data more than once', { field: 'signer' });
+            this.failure ??= { error };
+            throw error;
+        }
+        this.iterated = true;
+        return {
+            next: () => {
+                // serialize: a signer that does not await one next() before the next one still gets the bytes in order
+                const result = this.queue.then(() => this.pull());
+                this.queue = result.catch(() => undefined);
+                return result;
+            },
+        };
+    }
+    async pull() {
+        if (this.failure !== undefined) {
+            throw this.failure.error;
+        }
+        if (this.completed) {
+            return { done: true, value: undefined };
+        }
+        try {
+            if (!this.headerSent) {
+                this.headerSent = true;
+                if (this.check.coversHeader) {
+                    this.check.hash.update(this.mainHeader);
+                }
+                return { done: false, value: this.mainHeader };
+            }
+            const chunk = await this.source.read(READ_CHUNK_BYTES);
+            if (chunk !== null) {
+                this.check.hash.update(chunk);
+                return { done: false, value: chunk };
+            }
+            if (!this.check.matches(this.check.hash.digest())) {
+                throw new LinuxRepoError('digest-mismatch', 'the RPM payload does not match its digest', { field: 'payload digest' });
+            }
+            this.completed = true;
+            return { done: true, value: undefined };
+        }
+        catch (error) {
+            this.failure = { error };
+            throw error;
+        }
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2lnbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL3JwbS9zaWduLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sZUFBZSxDQUFDO0FBQ3pDLE9BQU8sRUFBRSxpQkFBaUIsRUFBRSxNQUFNLDBCQUEwQixDQUFDO0FBQzdELE9BQU8sRUFBRSxnQkFBZ0IsRUFBRSxNQUFNLHFCQUFxQixDQUFDO0FBQ3ZELE9BQU8sRUFBRSxjQUFjLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUNyRCxPQUFPLEVBQUUseUJBQXlCLEVBQTRCLE1BQU0scUJBQXFCLENBQUM7QUFDMUYsT0FBTyxFQUFFLGVBQWUsRUFBRSxNQUFNLHlCQUF5QixDQUFDO0FBQzFELE9BQU8sRUFBRSw2QkFBNkIsRUFBRSxNQUFNLDhCQUE4QixDQUFDO0FBQzdFLE9BQU8sRUFBRSxXQUFXLEVBQXVCLE1BQU0sdUJBQXVCLENBQUM7QUFDekUsT0FBTyxFQUFFLGNBQWMsRUFBRSxpQkFBaUIsRUFBRSxRQUFRLEVBQUUsb0JBQW9CLEVBQTJCLE1BQU0sYUFBYSxDQUFDO0FBRXpILE1BQU0sY0FBYyxHQUFHLElBQUksQ0FBQztBQUM1QixNQUFNLHdCQUF3QixHQUFHLElBQUksQ0FBQztBQUV0QyxpRkFBaUY7QUFDakYsTUFBTSx5QkFBeUIsR0FBRyxJQUFJLEdBQUcsQ0FBaUI7SUFDeEQsQ0FBQyxDQUFDLEVBQUUsS0FBSyxDQUFDO0lBQ1YsQ0FBQyxDQUFDLEVBQUUsTUFBTSxDQUFDO0lBQ1gsQ0FBQyxDQUFDLEVBQUUsUUFBUSxDQUFDO0lBQ2IsQ0FBQyxDQUFDLEVBQUUsUUFBUSxDQUFDO0lBQ2IsQ0FBQyxFQUFFLEVBQUUsUUFBUSxDQUFDO0lBQ2QsQ0FBQyxFQUFFLEVBQUUsUUFBUSxDQUFDO0NBQ2YsQ0FBQyxDQUFDO0FBRUg7Ozs7Ozs7Ozs7Ozs7Ozs7OztHQWtCRztBQUNILE1BQU0sQ0FBQyxLQUFLLFVBQVUsY0FBYyxDQUFDLEtBS3BDO0lBQ0MsSUFBSSxLQUFLLEtBQUssSUFBSSxJQUFJLE9BQU8sS0FBSyxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQ2hELE1BQU0sSUFBSSxjQUFjLENBQUMsZUFBZSxFQUFFLHlCQUF5QixFQUFFLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUM7SUFDM0YsQ0FBQztJQUNELElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSyxJQUFJLElBQUksT0FBTyxLQUFLLENBQUMsTUFBTSxLQUFLLFFBQVEsSUFBSSxPQUFPLEtBQUssQ0FBQyxNQUFNLENBQUMsVUFBVSxLQUFLLFVBQVUsRUFBRSxDQUFDO1FBQy9HLE1BQU0sSUFBSSxjQUFjLENBQUMsZUFBZSxFQUFFLHNDQUFzQyxFQUFFLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRSxDQUFDLENBQUM7SUFDekcsQ0FBQztJQUNELGVBQWUsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDakMsTUFBTSxNQUFNLEdBQUcseUJBQXlCLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQ3ZELE1BQU0sS0FBSyxHQUFHLElBQUksaUJBQWlCLENBQUMsS0FBSyxDQUFDLE1BQU0sRUFBRSxNQUFNLENBQUMsZUFBZSxDQUFDLENBQUM7SUFDMUUsTUFBTSxPQUFPLEdBQUcsTUFBTSxjQUFjLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQ3BELE1BQU0sWUFBWSxHQUFHLGtCQUFrQixDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBRWpELE1BQU0sVUFBVSxHQUFHLElBQUksZ0JBQWdCLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxLQUFLLEVBQUUsS0FBSyxFQUFFLFlBQVksQ0FBQyxDQUFDO0lBQ2pGLElBQUksZ0JBQTRCLENBQUM7SUFDakMsSUFBSSxDQUFDO1FBQ0gsZ0JBQWdCLEdBQUcsTUFBTSw2QkFBNkIsQ0FBQyxFQUFFLElBQUksRUFBRSxVQUFVLEVBQUUsTUFBTSxFQUFFLEtBQUssQ0FBQyxNQUFNLEVBQUUsU0FBUyxFQUFFLEtBQUssQ0FBQyxTQUFTLEVBQUUsQ0FBQyxDQUFDO0lBQ2pJLENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2Ysb0dBQW9HO1FBQ3BHLE1BQU0sVUFBVSxDQUFDLE9BQU8sS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUM7SUFDNUUsQ0FBQztJQUNELElBQUksVUFBVSxDQUFDLE9BQU8sS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUNyQyxNQUFNLFVBQVUsQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDO0lBQ2pDLENBQUM7SUFDRCxJQUFJLENBQUMsVUFBVSxDQUFDLFNBQVMsRUFBRSxDQUFDO1FBQzFCLE1BQU0sSUFBSSxjQUFjLENBQUMsZ0JBQWdCLEVBQUUsMkRBQTJELEVBQUUsRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztJQUMvSCxDQUFDO0lBQ0QsTUFBTSxVQUFVLEdBQUcsTUFBTSw2QkFBNkIsQ0FBQztRQUNyRCxJQUFJLEVBQUUsV0FBVyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDO1FBQ3JDLE1BQU0sRUFBRSxLQUFLLENBQUMsTUFBTTtRQUNwQixTQUFTLEVBQUUsS0FBSyxDQUFDLFNBQVM7S0FDM0IsQ0FBQyxDQUFDO0lBRUgsTUFBTSxPQUFPLEdBQUcsSUFBSSxHQUFHLENBQVM7UUFDOUIsaUJBQWlCLENBQUMsR0FBRztRQUNyQixpQkFBaUIsQ0FBQyxHQUFHO1FBQ3JCLGlCQUFpQixDQUFDLEdBQUc7UUFDckIsaUJBQWlCLENBQUMsR0FBRztRQUNyQixpQkFBaUIsQ0FBQyxhQUFhO0tBQ2hDLENBQUMsQ0FBQztJQUNILE1BQU0sZUFBZSxHQUFHLG9CQUFvQixDQUFDLE9BQU8sQ0FBQyxTQUFTLEVBQUUsT0FBTyxFQUFFO1FBQ3ZFLEVBQUUsR0FBRyxFQUFFLGlCQUFpQixDQUFDLEdBQUcsRUFBRSxJQUFJLEVBQUUsUUFBUSxDQUFDLEdBQUcsRUFBRSxLQUFLLEVBQUUsZ0JBQWdCLENBQUMsTUFBTSxFQUFFLFFBQVEsRUFBRSxnQkFBZ0IsRUFBRTtRQUM5RyxFQUFFLEdBQUcsRUFBRSxpQkFBaUIsQ0FBQyxHQUFHLEVBQUUsSUFBSSxFQUFFLFFBQVEsQ0FBQyxHQUFHLEVBQUUsS0FBSyxFQUFFLFVBQVUsQ0FBQyxNQUFNLEVBQUUsUUFBUSxFQUFFLFVBQVUsRUFBRTtLQUNuRyxDQUFDLENBQUM7SUFDSCxNQUFNLE1BQU0sR0FBRyxJQUFJLFVBQVUsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLE1BQU0sR0FBRyxlQUFlLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDNUUsTUFBTSxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQyxDQUFDO0lBQzVCLE1BQU0sQ0FBQyxHQUFHLENBQUMsZUFBZSxFQUFFLE9BQU8sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDakQsT0FBTyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsT0FBTyxDQUFDLFNBQVMsRUFBRSxDQUFDO0FBQ2pELENBQUM7QUFVRCxTQUFTLGtCQUFrQixDQUFDLFVBQThCO0lBQ3hELHlFQUF5RTtJQUN6RSxNQUFNLE9BQU8sR0FBRyxVQUFVLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxjQUFjLENBQUMsQ0FBQztJQUN4RCxNQUFNLFVBQVUsR0FBRyxPQUFPLEtBQUssSUFBSSxJQUFJLE9BQU8sQ0FBQyxNQUFNLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLHdCQUF3QixDQUFDLENBQUM7SUFDdkgsTUFBTSxTQUFTLEdBQUcsVUFBVSxLQUFLLElBQUksSUFBSSxVQUFVLENBQUMsTUFBTSxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyx5QkFBeUIsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDNUgsSUFBSSxTQUFTLEtBQUssU0FBUyxJQUFJLE9BQU8sS0FBSyxJQUFJLEVBQUUsQ0FBQztRQUNoRCxNQUFNLFFBQVEsR0FBRyxPQUFPLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDNUIsT0FBTztZQUNMLElBQUksRUFBRSxPQUFPLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxTQUFTLENBQUM7WUFDMUMsWUFBWSxFQUFFLEtBQUs7WUFDbkIsT0FBTyxFQUFFLENBQUMsU0FBUyxFQUFFLEVBQUU7Z0JBQ3JCLE1BQU0sTUFBTSxHQUFHLElBQUksV0FBVyxFQUFFLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztnQkFDbkUsT0FBTyxNQUFNLENBQUMsTUFBTSxLQUFLLFFBQVEsQ0FBQyxNQUFNLElBQUksTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLEVBQUUsRUFBRSxDQUFDLElBQUksS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztZQUM5RixDQUFDO1NBQ0YsQ0FBQztJQUNKLENBQUM7SUFDRCxNQUFNLEdBQUcsR0FBRyxVQUFVLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxpQkFBaUIsQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUMvRCxJQUFJLEdBQUcsS0FBSyxJQUFJLElBQUksR0FBRyxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUNyQyxPQUFPO1lBQ0wsSUFBSSxFQUFFLE9BQU8sQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLEtBQUssQ0FBQztZQUN0QyxZQUFZLEVBQUUsSUFBSTtZQUNsQixPQUFPLEVBQUUsQ0FBQyxTQUFTLEVBQUUsRUFBRSxDQUFDLFNBQVMsQ0FBQyxNQUFNLEtBQUssR0FBRyxDQUFDLE1BQU0sSUFBSSxTQUFTLENBQUMsS0FBSyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsRUFBRSxFQUFFLENBQUMsSUFBSSxLQUFLLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQztTQUN6RyxDQUFDO0lBQ0osQ0FBQztJQUNELE1BQU0sSUFBSSxjQUFjLENBQUMsZUFBZSxFQUFFLDhDQUE4QyxFQUFFLEVBQUUsS0FBSyxFQUFFLGdCQUFnQixFQUFFLENBQUMsQ0FBQztBQUN6SCxDQUFDO0FBRUQ7Ozs7OztHQU1HO0FBQ0gsTUFBTSxnQkFBZ0I7SUFRRCxVQUFVO0lBQ1YsTUFBTTtJQUNOLEtBQUs7SUFUakIsU0FBUyxHQUFHLEtBQUssQ0FBQztJQUNsQixPQUFPLEdBQW1DLFNBQVMsQ0FBQztJQUNuRCxRQUFRLEdBQUcsS0FBSyxDQUFDO0lBQ2pCLFVBQVUsR0FBRyxLQUFLLENBQUM7SUFDbkIsS0FBSyxHQUFxQixPQUFPLENBQUMsT0FBTyxFQUFFLENBQUM7SUFFcEQsWUFDbUIsVUFBc0IsRUFDdEIsTUFBeUIsRUFDekIsS0FBb0I7MEJBRnBCLFVBQVU7c0JBQ1YsTUFBTTtxQkFDTixLQUFLO0lBQ3JCLENBQUM7SUFFRyxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUM7UUFDM0IsSUFBSSxJQUFJLENBQUMsUUFBUSxFQUFFLENBQUM7WUFDbEIsTUFBTSxLQUFLLEdBQUcsSUFBSSxjQUFjLENBQUMsZ0JBQWdCLEVBQUUsaURBQWlELEVBQUUsRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztZQUMzSCxJQUFJLENBQUMsT0FBTyxLQUFLLEVBQUUsS0FBSyxFQUFFLENBQUM7WUFDM0IsTUFBTSxLQUFLLENBQUM7UUFDZCxDQUFDO1FBQ0QsSUFBSSxDQUFDLFFBQVEsR0FBRyxJQUFJLENBQUM7UUFDckIsT0FBTztZQUNMLElBQUksRUFBRSxHQUFHLEVBQUU7Z0JBQ1QsdUdBQXVHO2dCQUN2RyxNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQztnQkFDbEQsSUFBSSxDQUFDLEtBQUssR0FBRyxNQUFNLENBQUMsS0FBSyxDQUFDLEdBQUcsRUFBRSxDQUFDLFNBQVMsQ0FBQyxDQUFDO2dCQUMzQyxPQUFPLE1BQU0sQ0FBQztZQUNoQixDQUFDO1NBQ0YsQ0FBQztJQUNKLENBQUM7SUFFTyxLQUFLLENBQUMsSUFBSTtRQUNoQixJQUFJLElBQUksQ0FBQyxPQUFPLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDL0IsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQztRQUMzQixDQUFDO1FBQ0QsSUFBSSxJQUFJLENBQUMsU0FBUyxFQUFFLENBQUM7WUFDbkIsT0FBTyxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsS0FBSyxFQUFFLFNBQVMsRUFBRSxDQUFDO1FBQzFDLENBQUM7UUFDRCxJQUFJLENBQUM7WUFDSCxJQUFJLENBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxDQUFDO2dCQUNyQixJQUFJLENBQUMsVUFBVSxHQUFHLElBQUksQ0FBQztnQkFDdkIsSUFBSSxJQUFJLENBQUMsS0FBSyxDQUFDLFlBQVksRUFBRSxDQUFDO29CQUM1QixJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxDQUFDO2dCQUMxQyxDQUFDO2dCQUNELE9BQU8sRUFBRSxJQUFJLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRSxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUM7WUFDakQsQ0FBQztZQUNELE1BQU0sS0FBSyxHQUFHLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztZQUN2RCxJQUFJLEtBQUssS0FBSyxJQUFJLEVBQUUsQ0FBQztnQkFDbkIsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO2dCQUM5QixPQUFPLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFLENBQUM7WUFDdkMsQ0FBQztZQUNELElBQUksQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQyxFQUFFLENBQUM7Z0JBQ2xELE1BQU0sSUFBSSxjQUFjLENBQUMsaUJBQWlCLEVBQUUsMkNBQTJDLEVBQUUsRUFBRSxLQUFLLEVBQUUsZ0JBQWdCLEVBQUUsQ0FBQyxDQUFDO1lBQ3hILENBQUM7WUFDRCxJQUFJLENBQUMsU0FBUyxHQUFHLElBQUksQ0FBQztZQUN0QixPQUFPLEVBQUUsSUFBSSxFQUFFLElBQUksRUFBRSxLQUFLLEVBQUUsU0FBUyxFQUFFLENBQUM7UUFDMUMsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixJQUFJLENBQUMsT0FBTyxHQUFHLEVBQUUsS0FBSyxFQUFFLENBQUM7WUFDekIsTUFBTSxLQUFLLENBQUM7UUFDZCxDQUFDO0lBQ0gsQ0FBQztDQUNGIn0=

package/dist_ts/rpm/updates.d.ts

@@ -0,0 +1,38 @@
+import type { IRpmUpdate } from '../shared/types.js';
+/**
+ * Merges posted errata into the stored ones, as Gitea 28.2.0's errata route
+ * does (`routers/api/packages/rpm/rpm.go:367-447`). Pure: the inputs are
+ * never changed, and incoming updates are applied in order.
+ * - A known id: its collections merge by `short` and its packages are
+ *   de-duplicated by name, version, release and arch; the seven scalar fields
+ *   and `references` are replaced; `updated` becomes the timestamp and
+ *   `issued` is kept.
+ * - A new id: the update is appended; `issued` and `updated` get the
+ *   timestamp only when they are `null`.
+ * - De-duplication applies to every append, including the collections of a new
+ *   update (Gitea appends those as posted).
+ * Dates are written as `YYYY-MM-DD HH:MM:SS` in UTC (Gitea uses its server's
+ * local time). Contents are not validated, as in Gitea; only the shape is.
+ */
+export declare function mergeRpmUpdates(input: {
+    existing: IRpmUpdate[];
+    incoming: IRpmUpdate[];
+    timestamp: Date;
+}): IRpmUpdate[];
+/**
+ * The updates of an index: updates with the same id merge as
+ * Gitea's `buildUpdateInfo` does (`services/packages/rpm/repository.go:560-620`),
+ * without setting any date. The scalar fields, dates and references come from
+ * the update with the newest `updated`, then the newest `issued`, then the
+ * greatest canonical JSON of those fields; packages that collide keep the
+ * values of the higher-ranked update. Updates sort by id, collections by
+ * `short`, packages by name, version, release and arch; references keep their
+ * order. The input order never decides.
+ */
+export declare function combineRpmUpdates(updatesArg: IRpmUpdate[]): IRpmUpdate[];
+/** `updateinfo.xml` for combined updates, as Go's `encoding/xml` writes Gitea's `Update` type. */
+export declare function renderUpdateInfo(updatesArg: IRpmUpdate[]): string;
+/** `YYYY-MM-DD HH:MM:SS` in UTC. */
+export declare function formatRpmUpdateDate(timestampArg: Date): string;
+/** Refuses anything that is not an array of plain-JSON `IRpmUpdate` values. */
+export declare function assertRpmUpdates(valueArg: unknown, fieldArg: string): asserts valueArg is IRpmUpdate[];

package/dist_ts/rpm/updates.js

@@ -0,0 +1,265 @@
+import { LinuxRepoError } from '../shared/errors.js';
+import { assertTimestamp } from '../shared/validation.js';
+import { compareCodePoints, element, textElement, XML_HEADER } from './xml.js';
+/**
+ * Merges posted errata into the stored ones, as Gitea 28.2.0's errata route
+ * does (`routers/api/packages/rpm/rpm.go:367-447`). Pure: the inputs are
+ * never changed, and incoming updates are applied in order.
+ * - A known id: its collections merge by `short` and its packages are
+ *   de-duplicated by name, version, release and arch; the seven scalar fields
+ *   and `references` are replaced; `updated` becomes the timestamp and
+ *   `issued` is kept.
+ * - A new id: the update is appended; `issued` and `updated` get the
+ *   timestamp only when they are `null`.
+ * - De-duplication applies to every append, including the collections of a new
+ *   update (Gitea appends those as posted).
+ * Dates are written as `YYYY-MM-DD HH:MM:SS` in UTC (Gitea uses its server's
+ * local time). Contents are not validated, as in Gitea; only the shape is.
+ */
+export function mergeRpmUpdates(input) {
+    if (input === null || typeof input !== 'object') {
+        throw new LinuxRepoError('invalid-input', 'input must be an object', { field: 'input' });
+    }
+    assertRpmUpdates(input.existing, 'existing');
+    assertRpmUpdates(input.incoming, 'incoming');
+    assertTimestamp(input.timestamp);
+    const now = formatRpmUpdateDate(input.timestamp);
+    const merged = input.existing.map(cloneUpdate);
+    for (const incoming of input.incoming) {
+        const update = cloneUpdate(incoming);
+        const known = merged.find((candidate) => candidate.id === update.id);
+        if (known !== undefined) {
+            mergeCollections(known.collections, update.collections);
+            known.from = update.from;
+            known.status = update.status;
+            known.type = update.type;
+            known.version = update.version;
+            known.title = update.title;
+            known.severity = update.severity;
+            known.description = update.description;
+            known.references = update.references;
+            known.updated = now;
+        }
+        else {
+            const appended = { ...update, issued: update.issued ?? now, updated: update.updated ?? now, collections: [] };
+            mergeCollections(appended.collections, update.collections);
+            merged.push(appended);
+        }
+    }
+    return merged;
+}
+/**
+ * The updates of an index: updates with the same id merge as
+ * Gitea's `buildUpdateInfo` does (`services/packages/rpm/repository.go:560-620`),
+ * without setting any date. The scalar fields, dates and references come from
+ * the update with the newest `updated`, then the newest `issued`, then the
+ * greatest canonical JSON of those fields; packages that collide keep the
+ * values of the higher-ranked update. Updates sort by id, collections by
+ * `short`, packages by name, version, release and arch; references keep their
+ * order. The input order never decides.
+ */
+export function combineRpmUpdates(updatesArg) {
+    const byId = new Map();
+    for (const update of updatesArg) {
+        const group = byId.get(update.id);
+        if (group === undefined) {
+            byId.set(update.id, [update]);
+        }
+        else {
+            group.push(update);
+        }
+    }
+    const combined = [];
+    for (const group of byId.values()) {
+        const ranked = [...group].sort(compareRank);
+        const result = { ...cloneUpdate(ranked[0]), collections: [] };
+        for (const update of ranked) {
+            mergeCollections(result.collections, update.collections.map(cloneCollection));
+        }
+        result.collections.sort((a, b) => compareCodePoints(a.short, b.short));
+        for (const collection of result.collections) {
+            collection.packages.sort(comparePackages);
+        }
+        combined.push(result);
+    }
+    return combined.sort((a, b) => compareCodePoints(a.id, b.id));
+}
+/** `updateinfo.xml` for combined updates, as Go's `encoding/xml` writes Gitea's `Update` type. */
+export function renderUpdateInfo(updatesArg) {
+    const updates = updatesArg.map((update) => element('update', [
+        ['from', update.from],
+        ['status', update.status],
+        ['type', update.type],
+        ['version', update.version],
+    ], [
+        textElement('id', update.id),
+        textElement('title', update.title),
+        textElement('severity', update.severity),
+        textElement('description', update.description),
+        update.issued === null ? '' : element('issued', [['date', update.issued]]),
+        update.updated === null ? '' : element('updated', [['date', update.updated]]),
+        element('references', [], update.references
+            .map((reference) => element('reference', [
+            ['href', reference.href],
+            ['id', reference.id],
+            ['title', reference.title],
+            ['type', reference.type],
+        ]))
+            .join('')),
+        element('pkglist', [], update.collections
+            .map((collection) => element('collection', [['short', collection.short]], collection.packages
+            .map((pkg) => element('package', [
+            ['arch', pkg.arch],
+            ['name', pkg.name],
+            ['release', pkg.release],
+            ['src', pkg.src],
+            ['version', pkg.version],
+        ], textElement('filename', pkg.fileName)))
+            .join('')))
+            .join('')),
+    ].join('')));
+    return `${XML_HEADER}${element('updates', [['xmlns', 'http://linux.duke.edu/metadata/updateinfo']], updates.join(''))}`;
+}
+/** `YYYY-MM-DD HH:MM:SS` in UTC. */
+export function formatRpmUpdateDate(timestampArg) {
+    return timestampArg.toISOString().slice(0, 19).replace('T', ' ');
+}
+/** Refuses anything that is not an array of plain-JSON `IRpmUpdate` values. */
+export function assertRpmUpdates(valueArg, fieldArg) {
+    if (!Array.isArray(valueArg)) {
+        throw new LinuxRepoError('invalid-input', `${fieldArg} must be an array of RPM updates`, { field: fieldArg });
+    }
+    valueArg.forEach((update, i) => {
+        const at = `${fieldArg}[${i}]`;
+        const record = assertObject(update, at);
+        for (const key of ['id', 'from', 'status', 'type', 'version', 'title', 'severity', 'description']) {
+            assertStringField(record, key, at);
+        }
+        for (const key of ['issued', 'updated']) {
+            if (record[key] !== null) {
+                assertStringField(record, key, at);
+            }
+        }
+        assertArrayField(record, 'references', at).forEach((reference, r) => {
+            const referenceRecord = assertObject(reference, `${at}.references[${r}]`);
+            for (const key of ['href', 'id', 'title', 'type']) {
+                assertStringField(referenceRecord, key, `${at}.references[${r}]`);
+            }
+        });
+        assertArrayField(record, 'collections', at).forEach((collection, c) => {
+            const collectionAt = `${at}.collections[${c}]`;
+            const collectionRecord = assertObject(collection, collectionAt);
+            assertStringField(collectionRecord, 'short', collectionAt);
+            assertArrayField(collectionRecord, 'packages', collectionAt).forEach((pkg, p) => {
+                const pkgRecord = assertObject(pkg, `${collectionAt}.packages[${p}]`);
+                for (const key of ['name', 'version', 'release', 'arch', 'src', 'fileName']) {
+                    assertStringField(pkgRecord, key, `${collectionAt}.packages[${p}]`);
+                }
+            });
+        });
+    });
+}
+function assertObject(valueArg, fieldArg) {
+    if (valueArg === null || typeof valueArg !== 'object' || Array.isArray(valueArg)) {
+        throw new LinuxRepoError('invalid-input', `${fieldArg} must be an object`, { field: fieldArg });
+    }
+    return valueArg;
+}
+function assertStringField(recordArg, keyArg, atArg) {
+    if (typeof recordArg[keyArg] !== 'string') {
+        throw new LinuxRepoError('invalid-input', `${atArg}.${keyArg} must be a string`, { field: `${atArg}.${keyArg}` });
+    }
+}
+function assertArrayField(recordArg, keyArg, atArg) {
+    const value = recordArg[keyArg];
+    if (!Array.isArray(value)) {
+        throw new LinuxRepoError('invalid-input', `${atArg}.${keyArg} must be an array`, { field: `${atArg}.${keyArg}` });
+    }
+    return value;
+}
+/** Merges `incomingArg` into `targetArg` by `short`, de-duplicating packages (mutates the target only). */
+function mergeCollections(targetArg, incomingArg) {
+    for (const collection of incomingArg) {
+        let target = targetArg.find((candidate) => candidate.short === collection.short);
+        if (target === undefined) {
+            target = { short: collection.short, packages: [] };
+            targetArg.push(target);
+        }
+        for (const pkg of collection.packages) {
+            if (!target.packages.some((candidate) => samePackage(candidate, pkg))) {
+                target.packages.push(clonePackage(pkg));
+            }
+        }
+    }
+}
+function samePackage(aArg, bArg) {
+    return aArg.name === bArg.name && aArg.version === bArg.version && aArg.release === bArg.release && aArg.arch === bArg.arch;
+}
+function comparePackages(aArg, bArg) {
+    return (compareCodePoints(aArg.name, bArg.name) ||
+        compareCodePoints(aArg.version, bArg.version) ||
+        compareCodePoints(aArg.release, bArg.release) ||
+        compareCodePoints(aArg.arch, bArg.arch));
+}
+/** Highest rank first: newest `updated`, newest `issued`, greatest canonical JSON. */
+function compareRank(aArg, bArg) {
+    return (compareNullableDesc(aArg.updated, bArg.updated) ||
+        compareNullableDesc(aArg.issued, bArg.issued) ||
+        compareCodePoints(canonicalScalars(bArg), canonicalScalars(aArg)));
+}
+function compareNullableDesc(aArg, bArg) {
+    if (aArg === bArg) {
+        return 0;
+    }
+    if (aArg === null) {
+        return 1;
+    }
+    if (bArg === null) {
+        return -1;
+    }
+    return compareCodePoints(bArg, aArg);
+}
+function canonicalScalars(updateArg) {
+    return JSON.stringify([
+        updateArg.from,
+        updateArg.status,
+        updateArg.type,
+        updateArg.version,
+        updateArg.title,
+        updateArg.severity,
+        updateArg.description,
+        updateArg.issued,
+        updateArg.updated,
+        updateArg.references.map((reference) => [reference.href, reference.id, reference.title, reference.type]),
+    ]);
+}
+function cloneUpdate(updateArg) {
+    return {
+        id: updateArg.id,
+        from: updateArg.from,
+        status: updateArg.status,
+        type: updateArg.type,
+        version: updateArg.version,
+        title: updateArg.title,
+        severity: updateArg.severity,
+        description: updateArg.description,
+        issued: updateArg.issued,
+        updated: updateArg.updated,
+        references: updateArg.references.map((reference) => ({ href: reference.href, id: reference.id, title: reference.title, type: reference.type })),
+        collections: updateArg.collections.map(cloneCollection),
+    };
+}
+function cloneCollection(collectionArg) {
+    return { short: collectionArg.short, packages: collectionArg.packages.map(clonePackage) };
+}
+function clonePackage(pkgArg) {
+    return {
+        name: pkgArg.name,
+        version: pkgArg.version,
+        release: pkgArg.release,
+        arch: pkgArg.arch,
+        src: pkgArg.src,
+        fileName: pkgArg.fileName,
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidXBkYXRlcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL3JwbS91cGRhdGVzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxjQUFjLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUVyRCxPQUFPLEVBQUUsZUFBZSxFQUFFLE1BQU0seUJBQXlCLENBQUM7QUFDMUQsT0FBTyxFQUFFLGlCQUFpQixFQUFFLE9BQU8sRUFBRSxXQUFXLEVBQUUsVUFBVSxFQUFFLE1BQU0sVUFBVSxDQUFDO0FBRS9FOzs7Ozs7Ozs7Ozs7OztHQWNHO0FBQ0gsTUFBTSxVQUFVLGVBQWUsQ0FBQyxLQUEwRTtJQUN4RyxJQUFJLEtBQUssS0FBSyxJQUFJLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxFQUFFLENBQUM7UUFDaEQsTUFBTSxJQUFJLGNBQWMsQ0FBQyxlQUFlLEVBQUUseUJBQXlCLEVBQUUsRUFBRSxLQUFLLEVBQUUsT0FBTyxFQUFFLENBQUMsQ0FBQztJQUMzRixDQUFDO0lBQ0QsZ0JBQWdCLENBQUMsS0FBSyxDQUFDLFFBQVEsRUFBRSxVQUFVLENBQUMsQ0FBQztJQUM3QyxnQkFBZ0IsQ0FBQyxLQUFLLENBQUMsUUFBUSxFQUFFLFVBQVUsQ0FBQyxDQUFDO0lBQzdDLGVBQWUsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDakMsTUFBTSxHQUFHLEdBQUcsbUJBQW1CLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQ2pELE1BQU0sTUFBTSxHQUFHLEtBQUssQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLFdBQVcsQ0FBQyxDQUFDO0lBQy9DLEtBQUssTUFBTSxRQUFRLElBQUksS0FBSyxDQUFDLFFBQVEsRUFBRSxDQUFDO1FBQ3RDLE1BQU0sTUFBTSxHQUFHLFdBQVcsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUNyQyxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUMsU0FBUyxFQUFFLEVBQUUsQ0FBQyxTQUFTLENBQUMsRUFBRSxLQUFLLE1BQU0sQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUNyRSxJQUFJLEtBQUssS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUN4QixnQkFBZ0IsQ0FBQyxLQUFLLENBQUMsV0FBVyxFQUFFLE1BQU0sQ0FBQyxXQUFXLENBQUMsQ0FBQztZQUN4RCxLQUFLLENBQUMsSUFBSSxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUM7WUFDekIsS0FBSyxDQUFDLE1BQU0sR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO1lBQzdCLEtBQUssQ0FBQyxJQUFJLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQztZQUN6QixLQUFLLENBQUMsT0FBTyxHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUM7WUFDL0IsS0FBSyxDQUFDLEtBQUssR0FBRyxNQUFNLENBQUMsS0FBSyxDQUFDO1lBQzNCLEtBQUssQ0FBQyxRQUFRLEdBQUcsTUFBTSxDQUFDLFFBQVEsQ0FBQztZQUNqQyxLQUFLLENBQUMsV0FBVyxHQUFHLE1BQU0sQ0FBQyxXQUFXLENBQUM7WUFDdkMsS0FBSyxDQUFDLFVBQVUsR0FBRyxNQUFNLENBQUMsVUFBVSxDQUFDO1lBQ3JDLEtBQUssQ0FBQyxPQUFPLEdBQUcsR0FBRyxDQUFDO1FBQ3RCLENBQUM7YUFBTSxDQUFDO1lBQ04sTUFBTSxRQUFRLEdBQWUsRUFBRSxHQUFHLE1BQU0sRUFBRSxNQUFNLEVBQUUsTUFBTSxDQUFDLE1BQU0sSUFBSSxHQUFHLEVBQUUsT0FBTyxFQUFFLE1BQU0sQ0FBQyxPQUFPLElBQUksR0FBRyxFQUFFLFdBQVcsRUFBRSxFQUFFLEVBQUUsQ0FBQztZQUMxSCxnQkFBZ0IsQ0FBQyxRQUFRLENBQUMsV0FBVyxFQUFFLE1BQU0sQ0FBQyxXQUFXLENBQUMsQ0FBQztZQUMzRCxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQ3hCLENBQUM7SUFDSCxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQztBQUVEOzs7Ozs7Ozs7R0FTRztBQUNILE1BQU0sVUFBVSxpQkFBaUIsQ0FBQyxVQUF3QjtJQUN4RCxNQUFNLElBQUksR0FBRyxJQUFJLEdBQUcsRUFBd0IsQ0FBQztJQUM3QyxLQUFLLE1BQU0sTUFBTSxJQUFJLFVBQVUsRUFBRSxDQUFDO1FBQ2hDLE1BQU0sS0FBSyxHQUFHLElBQUksQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQ2xDLElBQUksS0FBSyxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ3hCLElBQUksQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLEVBQUUsRUFBRSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7UUFDaEMsQ0FBQzthQUFNLENBQUM7WUFDTixLQUFLLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQ3JCLENBQUM7SUFDSCxDQUFDO0lBQ0QsTUFBTSxRQUFRLEdBQWlCLEVBQUUsQ0FBQztJQUNsQyxLQUFLLE1BQU0sS0FBSyxJQUFJLElBQUksQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDO1FBQ2xDLE1BQU0sTUFBTSxHQUFHLENBQUMsR0FBRyxLQUFLLENBQUMsQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLENBQUM7UUFDNUMsTUFBTSxNQUFNLEdBQWUsRUFBRSxHQUFHLFdBQVcsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxXQUFXLEVBQUUsRUFBRSxFQUFFLENBQUM7UUFDMUUsS0FBSyxNQUFNLE1BQU0sSUFBSSxNQUFNLEVBQUUsQ0FBQztZQUM1QixnQkFBZ0IsQ0FBQyxNQUFNLENBQUMsV0FBVyxFQUFFLE1BQU0sQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLGVBQWUsQ0FBQyxDQUFDLENBQUM7UUFDaEYsQ0FBQztRQUNELE1BQU0sQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsRUFBRSxFQUFFLENBQUMsaUJBQWlCLENBQUMsQ0FBQyxDQUFDLEtBQUssRUFBRSxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztRQUN2RSxLQUFLLE1BQU0sVUFBVSxJQUFJLE1BQU0sQ0FBQyxXQUFXLEVBQUUsQ0FBQztZQUM1QyxVQUFVLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxlQUFlLENBQUMsQ0FBQztRQUM1QyxDQUFDO1FBQ0QsUUFBUSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUN4QixDQUFDO0lBQ0QsT0FBTyxRQUFRLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsRUFBRSxFQUFFLENBQUMsaUJBQWlCLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQztBQUNoRSxDQUFDO0FBRUQsa0dBQWtHO0FBQ2xHLE1BQU0sVUFBVSxnQkFBZ0IsQ0FBQyxVQUF3QjtJQUN2RCxNQUFNLE9BQU8sR0FBRyxVQUFVLENBQUMsR0FBRyxDQUFDLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FDeEMsT0FBTyxDQUNMLFFBQVEsRUFDUjtRQUNFLENBQUMsTUFBTSxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUM7UUFDckIsQ0FBQyxRQUFRLEVBQUUsTUFBTSxDQUFDLE1BQU0sQ0FBQztRQUN6QixDQUFDLE1BQU0sRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDO1FBQ3JCLENBQUMsU0FBUyxFQUFFLE1BQU0sQ0FBQyxPQUFPLENBQUM7S0FDNUIsRUFDRDtRQUNFLFdBQVcsQ0FBQyxJQUFJLEVBQUUsTUFBTSxDQUFDLEVBQUUsQ0FBQztRQUM1QixXQUFXLENBQUMsT0FBTyxFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUM7UUFDbEMsV0FBVyxDQUFDLFVBQVUsRUFBRSxNQUFNLENBQUMsUUFBUSxDQUFDO1FBQ3hDLFdBQVcsQ0FBQyxhQUFhLEVBQUUsTUFBTSxDQUFDLFdBQVcsQ0FBQztRQUM5QyxNQUFNLENBQUMsTUFBTSxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsUUFBUSxFQUFFLENBQUMsQ0FBQyxNQUFNLEVBQUUsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7UUFDMUUsTUFBTSxDQUFDLE9BQU8sS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLFNBQVMsRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFLE1BQU0sQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDO1FBQzdFLE9BQU8sQ0FDTCxZQUFZLEVBQ1osRUFBRSxFQUNGLE1BQU0sQ0FBQyxVQUFVO2FBQ2QsR0FBRyxDQUFDLENBQUMsU0FBUyxFQUFFLEVBQUUsQ0FDakIsT0FBTyxDQUFDLFdBQVcsRUFBRTtZQUNuQixDQUFDLE1BQU0sRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDO1lBQ3hCLENBQUMsSUFBSSxFQUFFLFNBQVMsQ0FBQyxFQUFFLENBQUM7WUFDcEIsQ0FBQyxPQUFPLEVBQUUsU0FBUyxDQUFDLEtBQUssQ0FBQztZQUMxQixDQUFDLE1BQU0sRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDO1NBQ3pCLENBQUMsQ0FDSDthQUNBLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FDWjtRQUNELE9BQU8sQ0FDTCxTQUFTLEVBQ1QsRUFBRSxFQUNGLE1BQU0sQ0FBQyxXQUFXO2FBQ2YsR0FBRyxDQUFDLENBQUMsVUFBVSxFQUFFLEVBQUUsQ0FDbEIsT0FBTyxDQUNMLFlBQVksRUFDWixDQUFDLENBQUMsT0FBTyxFQUFFLFVBQVUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUM3QixVQUFVLENBQUMsUUFBUTthQUNoQixHQUFHLENBQUMsQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUNYLE9BQU8sQ0FDTCxTQUFTLEVBQ1Q7WUFDRSxDQUFDLE1BQU0sRUFBRSxHQUFHLENBQUMsSUFBSSxDQUFDO1lBQ2xCLENBQUMsTUFBTSxFQUFFLEdBQUcsQ0FBQyxJQUFJLENBQUM7WUFDbEIsQ0FBQyxTQUFTLEVBQUUsR0FBRyxDQUFDLE9BQU8sQ0FBQztZQUN4QixDQUFDLEtBQUssRUFBRSxHQUFHLENBQUMsR0FBRyxDQUFDO1lBQ2hCLENBQUMsU0FBUyxFQUFFLEdBQUcsQ0FBQyxPQUFPLENBQUM7U0FDekIsRUFDRCxXQUFXLENBQUMsVUFBVSxFQUFFLEdBQUcsQ0FBQyxRQUFRLENBQUMsQ0FDdEMsQ0FDRjthQUNBLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FDWixDQUNGO2FBQ0EsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUNaO0tBQ0YsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQ1gsQ0FDRixDQUFDO0lBQ0YsT0FBTyxHQUFHLFVBQVUsR0FBRyxPQUFPLENBQUMsU0FBUyxFQUFFLENBQUMsQ0FBQyxPQUFPLEVBQUUsMkNBQTJDLENBQUMsQ0FBQyxFQUFFLE9BQU8sQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUMsRUFBRSxDQUFDO0FBQzFILENBQUM7QUFFRCxvQ0FBb0M7QUFDcEMsTUFBTSxVQUFVLG1CQUFtQixDQUFDLFlBQWtCO0lBQ3BELE9BQU8sWUFBWSxDQUFDLFdBQVcsRUFBRSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRSxHQUFHLENBQUMsQ0FBQztBQUNuRSxDQUFDO0FBRUQsK0VBQStFO0FBQy9FLE1BQU0sVUFBVSxnQkFBZ0IsQ0FBQyxRQUFpQixFQUFFLFFBQWdCO0lBQ2xFLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDN0IsTUFBTSxJQUFJLGNBQWMsQ0FBQyxlQUFlLEVBQUUsR0FBRyxRQUFRLGtDQUFrQyxFQUFFLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRSxDQUFDLENBQUM7SUFDaEgsQ0FBQztJQUNELFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQyxNQUFlLEVBQUUsQ0FBQyxFQUFFLEVBQUU7UUFDdEMsTUFBTSxFQUFFLEdBQUcsR0FBRyxRQUFRLElBQUksQ0FBQyxHQUFHLENBQUM7UUFDL0IsTUFBTSxNQUFNLEdBQUcsWUFBWSxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsQ0FBQztRQUN4QyxLQUFLLE1BQU0sR0FBRyxJQUFJLENBQUMsSUFBSSxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxPQUFPLEVBQUUsVUFBVSxFQUFFLGFBQWEsQ0FBQyxFQUFFLENBQUM7WUFDbEcsaUJBQWlCLENBQUMsTUFBTSxFQUFFLEdBQUcsRUFBRSxFQUFFLENBQUMsQ0FBQztRQUNyQyxDQUFDO1FBQ0QsS0FBSyxNQUFNLEdBQUcsSUFBSSxDQUFDLFFBQVEsRUFBRSxTQUFTLENBQUMsRUFBRSxDQUFDO1lBQ3hDLElBQUksTUFBTSxDQUFDLEdBQUcsQ0FBQyxLQUFLLElBQUksRUFBRSxDQUFDO2dCQUN6QixpQkFBaUIsQ0FBQyxNQUFNLEVBQUUsR0FBRyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1lBQ3JDLENBQUM7UUFDSCxDQUFDO1FBQ0QsZ0JBQWdCLENBQUMsTUFBTSxFQUFFLFlBQVksRUFBRSxFQUFFLENBQUMsQ0FBQyxPQUFPLENBQUMsQ0FBQyxTQUFrQixFQUFFLENBQUMsRUFBRSxFQUFFO1lBQzNFLE1BQU0sZUFBZSxHQUFHLFlBQVksQ0FBQyxTQUFTLEVBQUUsR0FBRyxFQUFFLGVBQWUsQ0FBQyxHQUFHLENBQUMsQ0FBQztZQUMxRSxLQUFLLE1BQU0sR0FBRyxJQUFJLENBQUMsTUFBTSxFQUFFLElBQUksRUFBRSxPQUFPLEVBQUUsTUFBTSxDQUFDLEVBQUUsQ0FBQztnQkFDbEQsaUJBQWlCLENBQUMsZUFBZSxFQUFFLEdBQUcsRUFBRSxHQUFHLEVBQUUsZUFBZSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1lBQ3BFLENBQUM7UUFDSCxDQUFDLENBQUMsQ0FBQztRQUNILGdCQUFnQixDQUFDLE1BQU0sRUFBRSxhQUFhLEVBQUUsRUFBRSxDQUFDLENBQUMsT0FBTyxDQUFDLENBQUMsVUFBbUIsRUFBRSxDQUFDLEVBQUUsRUFBRTtZQUM3RSxNQUFNLFlBQVksR0FBRyxHQUFHLEVBQUUsZ0JBQWdCLENBQUMsR0FBRyxDQUFDO1lBQy9DLE1BQU0sZ0JBQWdCLEdBQUcsWUFBWSxDQUFDLFVBQVUsRUFBRSxZQUFZLENBQUMsQ0FBQztZQUNoRSxpQkFBaUIsQ0FBQyxnQkFBZ0IsRUFBRSxPQUFPLEVBQUUsWUFBWSxDQUFDLENBQUM7WUFDM0QsZ0JBQWdCLENBQUMsZ0JBQWdCLEVBQUUsVUFBVSxFQUFFLFlBQVksQ0FBQyxDQUFDLE9BQU8sQ0FBQyxDQUFDLEdBQVksRUFBRSxDQUFDLEVBQUUsRUFBRTtnQkFDdkYsTUFBTSxTQUFTLEdBQUcsWUFBWSxDQUFDLEdBQUcsRUFBRSxHQUFHLFlBQVksYUFBYSxDQUFDLEdBQUcsQ0FBQyxDQUFDO2dCQUN0RSxLQUFLLE1BQU0sR0FBRyxJQUFJLENBQUMsTUFBTSxFQUFFLFNBQVMsRUFBRSxTQUFTLEVBQUUsTUFBTSxFQUFFLEtBQUssRUFBRSxVQUFVLENBQUMsRUFBRSxDQUFDO29CQUM1RSxpQkFBaUIsQ0FBQyxTQUFTLEVBQUUsR0FBRyxFQUFFLEdBQUcsWUFBWSxhQUFhLENBQUMsR0FBRyxDQUFDLENBQUM7Z0JBQ3RFLENBQUM7WUFDSCxDQUFDLENBQUMsQ0FBQztRQUNMLENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQyxDQUFDLENBQUM7QUFDTCxDQUFDO0FBRUQsU0FBUyxZQUFZLENBQUMsUUFBaUIsRUFBRSxRQUFnQjtJQUN2RCxJQUFJLFFBQVEsS0FBSyxJQUFJLElBQUksT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztRQUNqRixNQUFNLElBQUksY0FBYyxDQUFDLGVBQWUsRUFBRSxHQUFHLFFBQVEsb0JBQW9CLEVBQUUsRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztJQUNsRyxDQUFDO0lBQ0QsT0FBTyxRQUFtQyxDQUFDO0FBQzdDLENBQUM7QUFFRCxTQUFTLGlCQUFpQixDQUFDLFNBQWtDLEVBQUUsTUFBYyxFQUFFLEtBQWE7SUFDMUYsSUFBSSxPQUFPLFNBQVMsQ0FBQyxNQUFNLENBQUMsS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUMxQyxNQUFNLElBQUksY0FBYyxDQUFDLGVBQWUsRUFBRSxHQUFHLEtBQUssSUFBSSxNQUFNLG1CQUFtQixFQUFFLEVBQUUsS0FBSyxFQUFFLEdBQUcsS0FBSyxJQUFJLE1BQU0sRUFBRSxFQUFFLENBQUMsQ0FBQztJQUNwSCxDQUFDO0FBQ0gsQ0FBQztBQUVELFNBQVMsZ0JBQWdCLENBQUMsU0FBa0MsRUFBRSxNQUFjLEVBQUUsS0FBYTtJQUN6RixNQUFNLEtBQUssR0FBRyxTQUFTLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDaEMsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUMxQixNQUFNLElBQUksY0FBYyxDQUFDLGVBQWUsRUFBRSxHQUFHLEtBQUssSUFBSSxNQUFNLG1CQUFtQixFQUFFLEVBQUUsS0FBSyxFQUFFLEdBQUcsS0FBSyxJQUFJLE1BQU0sRUFBRSxFQUFFLENBQUMsQ0FBQztJQUNwSCxDQUFDO0lBQ0QsT0FBTyxLQUFLLENBQUM7QUFDZixDQUFDO0FBRUQsMkdBQTJHO0FBQzNHLFNBQVMsZ0JBQWdCLENBQUMsU0FBaUMsRUFBRSxXQUFtQztJQUM5RixLQUFLLE1BQU0sVUFBVSxJQUFJLFdBQVcsRUFBRSxDQUFDO1FBQ3JDLElBQUksTUFBTSxHQUFHLFNBQVMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxTQUFTLEVBQUUsRUFBRSxDQUFDLFNBQVMsQ0FBQyxLQUFLLEtBQUssVUFBVSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ2pGLElBQUksTUFBTSxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ3pCLE1BQU0sR0FBRyxFQUFFLEtBQUssRUFBRSxVQUFVLENBQUMsS0FBSyxFQUFFLFFBQVEsRUFBRSxFQUFFLEVBQUUsQ0FBQztZQUNuRCxTQUFTLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQ3pCLENBQUM7UUFDRCxLQUFLLE1BQU0sR0FBRyxJQUFJLFVBQVUsQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUN0QyxJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsQ0FBQyxTQUFTLEVBQUUsRUFBRSxDQUFDLFdBQVcsQ0FBQyxTQUFTLEVBQUUsR0FBRyxDQUFDLENBQUMsRUFBRSxDQUFDO2dCQUN0RSxNQUFNLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztZQUMxQyxDQUFDO1FBQ0gsQ0FBQztJQUNILENBQUM7QUFDSCxDQUFDO0FBRUQsU0FBUyxXQUFXLENBQUMsSUFBdUIsRUFBRSxJQUF1QjtJQUNuRSxPQUFPLElBQUksQ0FBQyxJQUFJLEtBQUssSUFBSSxDQUFDLElBQUksSUFBSSxJQUFJLENBQUMsT0FBTyxLQUFLLElBQUksQ0FBQyxPQUFPLElBQUksSUFBSSxDQUFDLE9BQU8sS0FBSyxJQUFJLENBQUMsT0FBTyxJQUFJLElBQUksQ0FBQyxJQUFJLEtBQUssSUFBSSxDQUFDLElBQUksQ0FBQztBQUM5SCxDQUFDO0FBRUQsU0FBUyxlQUFlLENBQUMsSUFBdUIsRUFBRSxJQUF1QjtJQUN2RSxPQUFPLENBQ0wsaUJBQWlCLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRSxJQUFJLENBQUMsSUFBSSxDQUFDO1FBQ3ZDLGlCQUFpQixDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsSUFBSSxDQUFDLE9BQU8sQ0FBQztRQUM3QyxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLElBQUksQ0FBQyxPQUFPLENBQUM7UUFDN0MsaUJBQWlCLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRSxJQUFJLENBQUMsSUFBSSxDQUFDLENBQ3hDLENBQUM7QUFDSixDQUFDO0FBRUQsc0ZBQXNGO0FBQ3RGLFNBQVMsV0FBVyxDQUFDLElBQWdCLEVBQUUsSUFBZ0I7SUFDckQsT0FBTyxDQUNMLG1CQUFtQixDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsSUFBSSxDQUFDLE9BQU8sQ0FBQztRQUMvQyxtQkFBbUIsQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUM7UUFDN0MsaUJBQWlCLENBQUMsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLEVBQUUsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FDbEUsQ0FBQztBQUNKLENBQUM7QUFFRCxTQUFTLG1CQUFtQixDQUFDLElBQW1CLEVBQUUsSUFBbUI7SUFDbkUsSUFBSSxJQUFJLEtBQUssSUFBSSxFQUFFLENBQUM7UUFDbEIsT0FBTyxDQUFDLENBQUM7SUFDWCxDQUFDO0lBQ0QsSUFBSSxJQUFJLEtBQUssSUFBSSxFQUFFLENBQUM7UUFDbEIsT0FBTyxDQUFDLENBQUM7SUFDWCxDQUFDO0lBQ0QsSUFBSSxJQUFJLEtBQUssSUFBSSxFQUFFLENBQUM7UUFDbEIsT0FBTyxDQUFDLENBQUMsQ0FBQztJQUNaLENBQUM7SUFDRCxPQUFPLGlCQUFpQixDQUFDLElBQUksRUFBRSxJQUFJLENBQUMsQ0FBQztBQUN2QyxDQUFDO0FBRUQsU0FBUyxnQkFBZ0IsQ0FBQyxTQUFxQjtJQUM3QyxPQUFPLElBQUksQ0FBQyxTQUFTLENBQUM7UUFDcEIsU0FBUyxDQUFDLElBQUk7UUFDZCxTQUFTLENBQUMsTUFBTTtRQUNoQixTQUFTLENBQUMsSUFBSTtRQUNkLFNBQVMsQ0FBQyxPQUFPO1FBQ2pCLFNBQVMsQ0FBQyxLQUFLO1FBQ2YsU0FBUyxDQUFDLFFBQVE7UUFDbEIsU0FBUyxDQUFDLFdBQVc7UUFDckIsU0FBUyxDQUFDLE1BQU07UUFDaEIsU0FBUyxDQUFDLE9BQU87UUFDakIsU0FBUyxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsQ0FBQyxTQUFTLEVBQUUsRUFBRSxDQUFDLENBQUMsU0FBUyxDQUFDLElBQUksRUFBRSxTQUFTLENBQUMsRUFBRSxFQUFFLFNBQVMsQ0FBQyxLQUFLLEVBQUUsU0FBUyxDQUFDLElBQUksQ0FBQyxDQUFDO0tBQ3pHLENBQUMsQ0FBQztBQUNMLENBQUM7QUFFRCxTQUFTLFdBQVcsQ0FBQyxTQUFxQjtJQUN4QyxPQUFPO1FBQ0wsRUFBRSxFQUFFLFNBQVMsQ0FBQyxFQUFFO1FBQ2hCLElBQUksRUFBRSxTQUFTLENBQUMsSUFBSTtRQUNwQixNQUFNLEVBQUUsU0FBUyxDQUFDLE1BQU07UUFDeEIsSUFBSSxFQUFFLFNBQVMsQ0FBQyxJQUFJO1FBQ3BCLE9BQU8sRUFBRSxTQUFTLENBQUMsT0FBTztRQUMxQixLQUFLLEVBQUUsU0FBUyxDQUFDLEtBQUs7UUFDdEIsUUFBUSxFQUFFLFNBQVMsQ0FBQyxRQUFRO1FBQzVCLFdBQVcsRUFBRSxTQUFTLENBQUMsV0FBVztRQUNsQyxNQUFNLEVBQUUsU0FBUyxDQUFDLE1BQU07UUFDeEIsT0FBTyxFQUFFLFNBQVMsQ0FBQyxPQUFPO1FBQzFCLFVBQVUsRUFBRSxTQUFTLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FDbEMsQ0FBQyxTQUFTLEVBQXVCLEVBQUUsQ0FBQyxDQUFDLEVBQUUsSUFBSSxFQUFFLFNBQVMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxFQUFFLFNBQVMsQ0FBQyxFQUFFLEVBQUUsS0FBSyxFQUFFLFNBQVMsQ0FBQyxLQUFLLEVBQUUsSUFBSSxFQUFFLFNBQVMsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUMvSDtRQUNELFdBQVcsRUFBRSxTQUFTLENBQUMsV0FBVyxDQUFDLEdBQUcsQ0FBQyxlQUFlLENBQUM7S0FDeEQsQ0FBQztBQUNKLENBQUM7QUFFRCxTQUFTLGVBQWUsQ0FBQyxhQUFtQztJQUMxRCxPQUFPLEVBQUUsS0FBSyxFQUFFLGFBQWEsQ0FBQyxLQUFLLEVBQUUsUUFBUSxFQUFFLGFBQWEsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLFlBQVksQ0FBQyxFQUFFLENBQUM7QUFDNUYsQ0FBQztBQUVELFNBQVMsWUFBWSxDQUFDLE1BQXlCO0lBQzdDLE9BQU87UUFDTCxJQUFJLEVBQUUsTUFBTSxDQUFDLElBQUk7UUFDakIsT0FBTyxFQUFFLE1BQU0sQ0FBQyxPQUFPO1FBQ3ZCLE9BQU8sRUFBRSxNQUFNLENBQUMsT0FBTztRQUN2QixJQUFJLEVBQUUsTUFBTSxDQUFDLElBQUk7UUFDakIsR0FBRyxFQUFFLE1BQU0sQ0FBQyxHQUFHO1FBQ2YsUUFBUSxFQUFFLE1BQU0sQ0FBQyxRQUFRO0tBQzFCLENBQUM7QUFDSixDQUFDIn0=

package/dist_ts/rpm/xml.d.ts

@@ -0,0 +1,18 @@
+/**
+ * The XML output of Go's `encoding/xml` as Gitea 28.2.0 uses it: the header
+ * `xml.Header`, no indentation, no self-closing elements, attributes in struct
+ * field order, and Go's escaping (`EscapeText`/`EscapeString`): `"` and `'`
+ * become numeric references, tab, line feed and carriage return are escaped,
+ * and a code point outside the XML character range becomes U+FFFD.
+ */
+export declare const XML_HEADER = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n";
+/** Go's escaping of character data and attribute values. */
+export declare function escapeXml(valueArg: string): string;
+/** Attributes in order; a value of `undefined` is omitted (Go's `omitempty` for an empty string is the caller's choice). */
+export type TXmlAttributes = Array<[string, string | number | undefined]>;
+/** `<name attr="…">content</name>`, where `contentArg` is already XML. */
+export declare function element(nameArg: string, attributesArg: TXmlAttributes, contentArg?: string): string;
+/** `<name>escaped text</name>`. */
+export declare function textElement(nameArg: string, textArg: string, attributesArg?: TXmlAttributes): string;
+/** Go's `strings.Compare`: UTF-8 byte order, which is code point order. */
+export declare function compareCodePoints(aArg: string, bArg: string): number;

package/dist_ts/rpm/xml.js

@@ -0,0 +1,90 @@
+/**
+ * The XML output of Go's `encoding/xml` as Gitea 28.2.0 uses it: the header
+ * `xml.Header`, no indentation, no self-closing elements, attributes in struct
+ * field order, and Go's escaping (`EscapeText`/`EscapeString`): `"` and `'`
+ * become numeric references, tab, line feed and carriage return are escaped,
+ * and a code point outside the XML character range becomes U+FFFD.
+ */
+export const XML_HEADER = '<?xml version="1.0" encoding="UTF-8"?>\n';
+const NEEDS_ESCAPE = /["'&<>\u0000-\u001f\ud800-\udfff\ufffe\uffff]/;
+/** Go's escaping of character data and attribute values. */
+export function escapeXml(valueArg) {
+    if (!NEEDS_ESCAPE.test(valueArg)) {
+        return valueArg;
+    }
+    let result = '';
+    for (const character of valueArg) {
+        const codePoint = character.codePointAt(0);
+        switch (character) {
+            case '"':
+                result += '&#34;';
+                break;
+            case "'":
+                result += '&#39;';
+                break;
+            case '&':
+                result += '&amp;';
+                break;
+            case '<':
+                result += '&lt;';
+                break;
+            case '>':
+                result += '&gt;';
+                break;
+            case '\t':
+                result += '&#x9;';
+                break;
+            case '\n':
+                result += '&#xA;';
+                break;
+            case '\r':
+                result += '&#xD;';
+                break;
+            default:
+                result += isXmlCharacter(codePoint) ? character : '\ufffd';
+        }
+    }
+    return result;
+}
+/** Go's `isInCharacterRange`. */
+function isXmlCharacter(codePointArg) {
+    return (codePointArg === 0x09 ||
+        codePointArg === 0x0a ||
+        codePointArg === 0x0d ||
+        (codePointArg >= 0x20 && codePointArg <= 0xd7ff) ||
+        (codePointArg >= 0xe000 && codePointArg <= 0xfffd) ||
+        (codePointArg >= 0x10000 && codePointArg <= 0x10ffff));
+}
+/** `<name attr="…">content</name>`, where `contentArg` is already XML. */
+export function element(nameArg, attributesArg, contentArg = '') {
+    let start = `<${nameArg}`;
+    for (const [attribute, value] of attributesArg) {
+        if (value !== undefined) {
+            start += ` ${attribute}="${escapeXml(String(value))}"`;
+        }
+    }
+    return `${start}>${contentArg}</${nameArg}>`;
+}
+/** `<name>escaped text</name>`. */
+export function textElement(nameArg, textArg, attributesArg = []) {
+    return element(nameArg, attributesArg, escapeXml(textArg));
+}
+/** Go's `strings.Compare`: UTF-8 byte order, which is code point order. */
+export function compareCodePoints(aArg, bArg) {
+    const length = Math.min(aArg.length, bArg.length);
+    for (let i = 0; i < length; i++) {
+        const a = aArg.charCodeAt(i);
+        const b = bArg.charCodeAt(i);
+        if (a !== b) {
+            // a surrogate (an astral code point) sorts after every other BMP unit
+            const aSurrogate = a >= 0xd800 && a <= 0xdfff;
+            const bSurrogate = b >= 0xd800 && b <= 0xdfff;
+            if (aSurrogate !== bSurrogate) {
+                return aSurrogate ? 1 : -1;
+            }
+            return a < b ? -1 : 1;
+        }
+    }
+    return aArg.length === bArg.length ? 0 : aArg.length < bArg.length ? -1 : 1;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoieG1sLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvcnBtL3htbC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7Ozs7O0dBTUc7QUFFSCxNQUFNLENBQUMsTUFBTSxVQUFVLEdBQUcsMENBQTBDLENBQUM7QUFFckUsTUFBTSxZQUFZLEdBQUcsK0NBQStDLENBQUM7QUFFckUsNERBQTREO0FBQzVELE1BQU0sVUFBVSxTQUFTLENBQUMsUUFBZ0I7SUFDeEMsSUFBSSxDQUFDLFlBQVksQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztRQUNqQyxPQUFPLFFBQVEsQ0FBQztJQUNsQixDQUFDO0lBQ0QsSUFBSSxNQUFNLEdBQUcsRUFBRSxDQUFDO0lBQ2hCLEtBQUssTUFBTSxTQUFTLElBQUksUUFBUSxFQUFFLENBQUM7UUFDakMsTUFBTSxTQUFTLEdBQUcsU0FBUyxDQUFDLFdBQVcsQ0FBQyxDQUFDLENBQUUsQ0FBQztRQUM1QyxRQUFRLFNBQVMsRUFBRSxDQUFDO1lBQ2xCLEtBQUssR0FBRztnQkFDTixNQUFNLElBQUksT0FBTyxDQUFDO2dCQUNsQixNQUFNO1lBQ1IsS0FBSyxHQUFHO2dCQUNOLE1BQU0sSUFBSSxPQUFPLENBQUM7Z0JBQ2xCLE1BQU07WUFDUixLQUFLLEdBQUc7Z0JBQ04sTUFBTSxJQUFJLE9BQU8sQ0FBQztnQkFDbEIsTUFBTTtZQUNSLEtBQUssR0FBRztnQkFDTixNQUFNLElBQUksTUFBTSxDQUFDO2dCQUNqQixNQUFNO1lBQ1IsS0FBSyxHQUFHO2dCQUNOLE1BQU0sSUFBSSxNQUFNLENBQUM7Z0JBQ2pCLE1BQU07WUFDUixLQUFLLElBQUk7Z0JBQ1AsTUFBTSxJQUFJLE9BQU8sQ0FBQztnQkFDbEIsTUFBTTtZQUNSLEtBQUssSUFBSTtnQkFDUCxNQUFNLElBQUksT0FBTyxDQUFDO2dCQUNsQixNQUFNO1lBQ1IsS0FBSyxJQUFJO2dCQUNQLE1BQU0sSUFBSSxPQUFPLENBQUM7Z0JBQ2xCLE1BQU07WUFDUjtnQkFDRSxNQUFNLElBQUksY0FBYyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQztRQUMvRCxDQUFDO0lBQ0gsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUM7QUFFRCxpQ0FBaUM7QUFDakMsU0FBUyxjQUFjLENBQUMsWUFBb0I7SUFDMUMsT0FBTyxDQUNMLFlBQVksS0FBSyxJQUFJO1FBQ3JCLFlBQVksS0FBSyxJQUFJO1FBQ3JCLFlBQVksS0FBSyxJQUFJO1FBQ3JCLENBQUMsWUFBWSxJQUFJLElBQUksSUFBSSxZQUFZLElBQUksTUFBTSxDQUFDO1FBQ2hELENBQUMsWUFBWSxJQUFJLE1BQU0sSUFBSSxZQUFZLElBQUksTUFBTSxDQUFDO1FBQ2xELENBQUMsWUFBWSxJQUFJLE9BQU8sSUFBSSxZQUFZLElBQUksUUFBUSxDQUFDLENBQ3RELENBQUM7QUFDSixDQUFDO0FBS0QsMEVBQTBFO0FBQzFFLE1BQU0sVUFBVSxPQUFPLENBQUMsT0FBZSxFQUFFLGFBQTZCLEVBQUUsVUFBVSxHQUFHLEVBQUU7SUFDckYsSUFBSSxLQUFLLEdBQUcsSUFBSSxPQUFPLEVBQUUsQ0FBQztJQUMxQixLQUFLLE1BQU0sQ0FBQyxTQUFTLEVBQUUsS0FBSyxDQUFDLElBQUksYUFBYSxFQUFFLENBQUM7UUFDL0MsSUFBSSxLQUFLLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDeEIsS0FBSyxJQUFJLElBQUksU0FBUyxLQUFLLFNBQVMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsR0FBRyxDQUFDO1FBQ3pELENBQUM7SUFDSCxDQUFDO0lBQ0QsT0FBTyxHQUFHLEtBQUssSUFBSSxVQUFVLEtBQUssT0FBTyxHQUFHLENBQUM7QUFDL0MsQ0FBQztBQUVELG1DQUFtQztBQUNuQyxNQUFNLFVBQVUsV0FBVyxDQUFDLE9BQWUsRUFBRSxPQUFlLEVBQUUsYUFBYSxHQUFtQixFQUFFO0lBQzlGLE9BQU8sT0FBTyxDQUFDLE9BQU8sRUFBRSxhQUFhLEVBQUUsU0FBUyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUM7QUFDN0QsQ0FBQztBQUVELDJFQUEyRTtBQUMzRSxNQUFNLFVBQVUsaUJBQWlCLENBQUMsSUFBWSxFQUFFLElBQVk7SUFDMUQsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUNsRCxLQUFLLElBQUksQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLEdBQUcsTUFBTSxFQUFFLENBQUMsRUFBRSxFQUFFLENBQUM7UUFDaEMsTUFBTSxDQUFDLEdBQUcsSUFBSSxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUM3QixNQUFNLENBQUMsR0FBRyxJQUFJLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQzdCLElBQUksQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ1osc0VBQXNFO1lBQ3RFLE1BQU0sVUFBVSxHQUFHLENBQUMsSUFBSSxNQUFNLElBQUksQ0FBQyxJQUFJLE1BQU0sQ0FBQztZQUM5QyxNQUFNLFVBQVUsR0FBRyxDQUFDLElBQUksTUFBTSxJQUFJLENBQUMsSUFBSSxNQUFNLENBQUM7WUFDOUMsSUFBSSxVQUFVLEtBQUssVUFBVSxFQUFFLENBQUM7Z0JBQzlCLE9BQU8sVUFBVSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO1lBQzdCLENBQUM7WUFDRCxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDeEIsQ0FBQztJQUNILENBQUM7SUFDRCxPQUFPLElBQUksQ0FBQyxNQUFNLEtBQUssSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsTUFBTSxHQUFHLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFDOUUsQ0FBQyJ9

package/dist_ts/shared/architecture.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Whether an architecture can name an index path segment. Readers record any
+ * architecture a package states (Gitea accepts them); builders refuse an entry
+ * whose architecture fails this rule with `invalid-input`, and never skip it
+ * silently. Refused: the empty string, `.` and `..`, and any value containing
+ * `/`, whitespace or a control character.
+ */
+export declare function isIndexableArchitecture(architectureArg: string): boolean;