@sanoma-ai/workflows 0.11.3 → 0.11.5

package/dist/host-derive.d.ts

@@ -0,0 +1,145 @@
+import type { Driver } from "./op.ts";
+import type { DeclaredResource, ResourceProblem } from "./description.ts";
+import type { Bindings } from "./lockfile.ts";
+import { type Resource } from "./resource.ts";
+import { type Secrets } from "./secret.ts";
+/** The private half of the key a host clones a private GitHub repository with: minted at its first apply, held in the store. */
+export declare const SOURCE_KEY = "SANOMA_SOURCE_KEY";
+/**
+ * Where the company's GitHub App's keys are stored, by what GitHub's manifest conversion calls
+ * them: the app's Connect page writes them, the staff login reads the client's, and a host carries
+ * the ones that are stored. The one list of them (a connection of its own is later).
+ */
+export declare const GITHUB_APP: {
+    readonly id: "SANOMA_GITHUB_APP_ID";
+    readonly slug: "SANOMA_GITHUB_APP_SLUG";
+    readonly client_id: "SANOMA_GITHUB_CLIENT_ID";
+    readonly client_secret: "SANOMA_GITHUB_CLIENT_SECRET";
+    readonly webhook_secret: "SANOMA_GITHUB_WEBHOOK_SECRET";
+    readonly pem: "SANOMA_GITHUB_APP_PEM";
+};
+/** The signing key a host is given when the config binds none, generated at its create and kept in the store. */
+export declare const HOST_SIGNING_KEY = "SANOMA_HOST_SIGNING_KEY";
+/** The type of the key that lets a host clone its GitHub repository, which apply declares on it. */
+export declare const DEPLOY_KEY_TYPE = "github.repository_deploy_key";
+/** The title a host's deploy key has on GitHub. */
+export declare const DEPLOY_KEY_TITLE = "Sanoma host";
+/** What the runtime knows that a host derives from, read once per apply or drift run (`hostFacts`). */
+export interface HostFacts {
+    /** The `sanoma` version the repository installs: the runtime image's tag. Undefined when it is not installed. */
+    version?: string;
+    /** The clone URL of the repository the app runs from (`origin`), with no credentials. */
+    origin?: string;
+    /** Each public site's domain, by site name (`siteDomains`). */
+    domains: Readonly<Record<string, string>>;
+    /** True when the config keeps its secrets in the built-in store, which `SANOMA_SECRETS_KEY` unlocks. */
+    builtInStore: boolean;
+    /**
+     * The secrets a host carries for each vendor it deploys itself with (its data file's) or signs
+     * people in through (the login's sender), by vendor: the variables the vendor's driver reads
+     * that the store holds (one only in this machine's environment is not given to the host).
+     */
+    carried: ReadonlyMap<string, readonly string[]>;
+    /** The login sender's vendor, whose credentials a host carries so it sends sign-in codes. */
+    sender?: string;
+    /** The company's GitHub App's keys that are stored (`GITHUB_APP`), which a host carries for sign-in and webhooks. */
+    githubApp: readonly string[];
+    /** The public half of the stored `SANOMA_SOURCE_KEY`, when one is: what apply declares on the repository. */
+    sourceKey?: string;
+    /**
+     * By vendor, the variables its driver reads that are set in this machine's environment but
+     * neither bound nor stored: the driver runs here, and a host would not be given them.
+     */
+    unbound?: ReadonlyMap<string, readonly string[]>;
+    /** True when the config binds `SANOMA_SIGNING_KEY`: the host is given that key, else its own (`HOST_SIGNING_KEY`). */
+    signingKeyBound?: boolean;
+    /**
+     * While the config has no deploy-key type, the GitHub repositories a host may clone (`origin`'s,
+     * a declared `source`'s) that GitHub shows to no one: private (or not there). One GitHub does
+     * not answer for is not among them.
+     */
+    privateRepositories?: readonly string[];
+}
+/** The version of `sanoma` the repository at `root` installs (a hoisted install counts); undefined when none does. */
+export declare function installedSanoma(root: string): Promise<string | undefined>;
+/**
+ * A clone URL as a host takes it: GitHub's SSH forms (`git@github.com:o/n.git`,
+ * `ssh://git@github.com/o/n`) as `https://github.com/o/n.git`, and any credentials an https URL
+ * carries left out (an `origin` may hold a token). Undefined for anything that is not a URL.
+ */
+export declare function cloneUrl(url: string): string | undefined;
+/** The URL of `origin` in the git repository at `root`, as a host clones it (`cloneUrl`); undefined when it has none. */
+export declare function originUrl(root: string): Promise<string | undefined>;
+/** The GitHub repository a clone URL names, `owner/name`; undefined for one of another host. */
+export declare function githubRepository(url: unknown): string | undefined;
+/**
+ * The public half of the source key in `secrets`; with `mint`, a new pair made first when none is
+ * stored (its private half stored, never returned), as `sanoma.secret.generate`'s `ssh-rsa` does.
+ * Undefined when none is stored and none is minted, or the stored value is no RSA key.
+ */
+export declare function sourceKeyOf(secrets: Secrets, mint: boolean): Promise<string | undefined>;
+/** Mints the instance token a host's wakeup checks it by, once, when none is stored. */
+export declare const mintWakeupToken: (secrets: Secrets) => Promise<string>;
+/**
+ * The declared repository a host that leaves out its `source` runs from: of the types its
+ * `source` reference names, the one `origin` is, else the one the host's own data file declares.
+ */
+export declare function sourceRepository(host: DeclaredResource, type: Resource, resources: readonly DeclaredResource[], origin: string | undefined): DeclaredResource | undefined;
+/** The declared wakeup that names `host` (its `inputs.host` refers to it), if any. */
+export declare function wokenBy(host: Pick<DeclaredResource, "id">, resources: readonly DeclaredResource[], types: ReadonlyMap<string, Pick<Resource, "wakeup">>): DeclaredResource | undefined;
+/**
+ * Fills, in place, each declared host that derives (`HostSpec.derives`) with what it is not told,
+ * and puts the deploy key it clones with before it in `resources`:
+ *
+ * - `name`, left out (when its type takes `inputs.name`): the name it is bound by, else its
+ *   repository's (`nameOf`), unless another host of its type has that name;
+ * - `image`, left out: the runtime image of the installed `sanoma` (`runtimeImage`);
+ * - `source`, left out: the one repository its own data file declares (a reference to it, of a
+ *   type its `source` names), else the repository the app runs from (`origin`);
+ * - `domains`: each public site's domain (`siteDomains`);
+ * - `secrets` (unless it binds its own bootstrap), markers only: the declared `database`'s URL as
+ *   `SANOMA_DATABASE_URL`, the runtime's keys (the signing key the config binds, else the host's
+ *   own, generated at its create; the encryption key with the built-in store), the source key for
+ *   a GitHub repository it can declare a deploy key on, the wakeup's token (and URL, for
+ *   `sanoma.wakeup`) when a wakeup names it, the credentials of its own vendor, its repository's
+ *   and the login sender's, and the company's GitHub App's keys that are stored;
+ * - for a GitHub repository, a `github.repository_deploy_key` (`sourceKeyId`), read-only, whose
+ *   key is the stored source key's public half, when one is and the config has the type; found by
+ *   its type's identity (the repository and the key), so a key GitHub holds already is bound, not
+ *   made again.
+ *
+ * `ref` is resolved by apply (and drift) with the revision: the repository's default branch.
+ * `out.keep` takes the deploy-key ids not declared this read (no source key stored yet, or its
+ * host left out), which the caller must not orphan; `out.leftOut` the hosts with a problem, which
+ * the caller leaves out, with what names them, so apply changes nothing it cannot give all it needs.
+ * Problems: a host with no `database`, a name (none to tell, or another host's), an image or a
+ * source that cannot be told, a credential its vendor's driver reads from this machine's
+ * environment that nothing binds, a private repository it has no deploy key for, two hosts that
+ * would attach the sites' domains.
+ */
+export declare function deriveHosts(resources: DeclaredResource[], types: ReadonlyMap<string, Resource>, bindings: Bindings, facts: HostFacts, out?: {
+    keep?: Set<string>;
+    leftOut?: Set<string>;
+}): ResourceProblem[];
+/**
+ * What the declared hosts that derive (`deriveHosts`) are filled from, read now: the installed
+ * `sanoma`, `origin`, the public sites' domains, and of `secrets` (none outside a run) which
+ * optional credentials, App keys and source key are stored, and which credentials the drivers
+ * read from this machine's environment alone (`unbound`). With `mint` (apply, never drift or a
+ * sandbox run), the source key (where the config has the deploy-key type) and, when a wakeup is
+ * declared, the wakeup's token are minted first when none is stored, so the host is given them
+ * from its first apply. With no deploy-key type, GitHub is asked which repositories a host may clone are private.
+ * Undefined when no declared host derives.
+ */
+export declare function hostFacts(options: {
+    root: string;
+    resources: readonly DeclaredResource[];
+    types: ReadonlyMap<string, Resource>;
+    drivers: ReadonlyMap<string, Driver>;
+    secrets?: Secrets;
+    builtInStore: boolean;
+    /** True when the config binds `SANOMA_SIGNING_KEY` (`{ env }` or `{ bootstrap }`). */
+    signingKeyBound?: boolean;
+    sender?: string;
+    mint: boolean;
+}): Promise<HostFacts | undefined>;

package/dist/host-derive.js

@@ -0,0 +1,403 @@
+import { execFile } from "node:child_process";
+import { readFile } from "node:fs/promises";
+import { findPackageJSON } from "node:module";
+import { join } from "node:path";
+import { promisify } from "node:util";
+import { databaseUrlSecret } from "./database.js";
+import { statusesOf } from "./env.js";
+import { runtimeImage, sourceKeyId } from "./host.js";
+import { valueAt } from "./resource.js";
+import { secret } from "./secret.js";
+import { sourceKeyPair, sshPublicKey } from "./ssh-key.js";
+import { mintInstanceToken, WAKEUP_TOKEN } from "./wakeup-service.js";
+// What a host that derives (`HostSpec.derives`) is given beyond its decisions: a data file says
+// where it runs, its name, its hostname and the database it runs on, and apply fills the rest
+// before it plans, as it fills a host's revision. Nothing here is ever a secret's value: the
+// secrets a host is given are markers (`secret("NAME")`), resolved by its driver just before the
+// vendor call, so a declaration, a plan, a ledger entry or a page holds names only.
+/** The private half of the key a host clones a private GitHub repository with: minted at its first apply, held in the store. */
+export const SOURCE_KEY = "SANOMA_SOURCE_KEY";
+/**
+ * Where the company's GitHub App's keys are stored, by what GitHub's manifest conversion calls
+ * them: the app's Connect page writes them, the staff login reads the client's, and a host carries
+ * the ones that are stored. The one list of them (a connection of its own is later).
+ */
+export const GITHUB_APP = {
+    id: "SANOMA_GITHUB_APP_ID",
+    slug: "SANOMA_GITHUB_APP_SLUG",
+    client_id: "SANOMA_GITHUB_CLIENT_ID",
+    client_secret: "SANOMA_GITHUB_CLIENT_SECRET",
+    webhook_secret: "SANOMA_GITHUB_WEBHOOK_SECRET",
+    pem: "SANOMA_GITHUB_APP_PEM",
+};
+/** The signing key a host is given when the config binds none, generated at its create and kept in the store. */
+export const HOST_SIGNING_KEY = "SANOMA_HOST_SIGNING_KEY";
+/** The wakeup service's URL, which a host is given beside its token when `sanoma.wakeup` wakes it. */
+const WAKEUP_URL = "SANOMA_WAKEUP_URL";
+/** The type of the key that lets a host clone its GitHub repository, which apply declares on it. */
+export const DEPLOY_KEY_TYPE = "github.repository_deploy_key";
+/** The title a host's deploy key has on GitHub. */
+export const DEPLOY_KEY_TITLE = "Sanoma host";
+const run = promisify(execFile);
+/** The version of `sanoma` the repository at `root` installs (a hoisted install counts); undefined when none does. */
+export async function installedSanoma(root) {
+    try {
+        const at = findPackageJSON("sanoma", join(root, "package.json"));
+        const version = at && JSON.parse(await readFile(at, "utf8")).version;
+        return typeof version === "string" ? version : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * A clone URL as a host takes it: GitHub's SSH forms (`git@github.com:o/n.git`,
+ * `ssh://git@github.com/o/n`) as `https://github.com/o/n.git`, and any credentials an https URL
+ * carries left out (an `origin` may hold a token). Undefined for anything that is not a URL.
+ */
+export function cloneUrl(url) {
+    const ssh = /^(?:ssh:\/\/)?git@github\.com[:/]([\w.-]+)\/([\w.-]+?)(?:\.git)?\/?$/.exec(url.trim());
+    if (ssh)
+        return `https://github.com/${ssh[1]}/${ssh[2]}.git`;
+    if (!URL.canParse(url))
+        return undefined;
+    const parsed = new URL(url);
+    parsed.username = "";
+    parsed.password = "";
+    if (parsed.hostname === "github.com" && !parsed.pathname.endsWith(".git"))
+        parsed.pathname += ".git";
+    return parsed.href;
+}
+/** The URL of `origin` in the git repository at `root`, as a host clones it (`cloneUrl`); undefined when it has none. */
+export async function originUrl(root) {
+    try {
+        const { stdout } = await run("git", ["-C", root, "remote", "get-url", "origin"], { timeout: 10_000 });
+        return cloneUrl(stdout.trim());
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The GitHub repository a clone URL names, `owner/name`; undefined for one of another host. */
+export function githubRepository(url) {
+    if (typeof url !== "string")
+        return undefined;
+    const at = /^https:\/\/github\.com\/([\w.-]+)\/([\w.-]+?)(?:\.git)?\/?$/.exec(cloneUrl(url) ?? "");
+    return at ? `${at[1]}/${at[2]}` : undefined;
+}
+/**
+ * The public half of the source key in `secrets`; with `mint`, a new pair made first when none is
+ * stored (its private half stored, never returned), as `sanoma.secret.generate`'s `ssh-rsa` does.
+ * Undefined when none is stored and none is minted, or the stored value is no RSA key.
+ */
+export async function sourceKeyOf(secrets, mint) {
+    let stored = await secrets.get(SOURCE_KEY);
+    if (stored === undefined && mint) {
+        const pair = await sourceKeyPair();
+        stored = await secrets.ensure(SOURCE_KEY, () => pair.privateKey);
+    }
+    return stored === undefined ? undefined : sshPublicKey(stored);
+}
+/** Mints the instance token a host's wakeup checks it by, once, when none is stored. */
+export const mintWakeupToken = (secrets) => secrets.ensure(WAKEUP_TOKEN, mintInstanceToken);
+/**
+ * The declared repository a host that leaves out its `source` runs from: of the types its
+ * `source` reference names, the one `origin` is, else the one the host's own data file declares.
+ */
+export function sourceRepository(host, type, resources, origin) {
+    const named = [type.fields.references?.[type.host.inputs.source]?.type ?? []].flat();
+    const repositories = resources.filter((o) => named.includes(`${o.vendor}.${o.type}`));
+    const at = githubRepository(origin);
+    const beside = repositories.filter((o) => o.file === host.file);
+    return (repositories.find((o) => at !== undefined && o.identity === at) ?? (beside.length === 1 ? beside[0] : undefined));
+}
+/** The declared wakeup that names `host` (its `inputs.host` refers to it), if any. */
+export function wokenBy(host, resources, types) {
+    return resources.find((o) => {
+        const wakeup = types.get(`${o.vendor}.${o.type}`)?.wakeup;
+        return wakeup !== undefined && o.refs[wakeup.inputs.host] === host.id;
+    });
+}
+/** Sets `value` at the dotted `path` of `into`, making the objects on the way. */
+function setAt(into, path, value) {
+    const keys = path.split(".");
+    let at = into;
+    for (const key of keys.slice(0, -1))
+        at = (at[key] ??= {});
+    at[keys.at(-1)] = value;
+}
+/** A declaration's export: `host` of `resources/sanoma/infra.ts#host`. */
+const exportOf = (id) => id.slice(id.indexOf("#") + 1);
+/** A repository's name as a host's (`HostSpec.inputs.name`): lower-case letters, digits and dashes. */
+const nameOf = (repository) => repository
+    .toLowerCase()
+    .replaceAll(/[^a-z0-9-]+/g, "-")
+    .replaceAll(/^-+|-+$/g, "");
+/**
+ * Fills, in place, each declared host that derives (`HostSpec.derives`) with what it is not told,
+ * and puts the deploy key it clones with before it in `resources`:
+ *
+ * - `name`, left out (when its type takes `inputs.name`): the name it is bound by, else its
+ *   repository's (`nameOf`), unless another host of its type has that name;
+ * - `image`, left out: the runtime image of the installed `sanoma` (`runtimeImage`);
+ * - `source`, left out: the one repository its own data file declares (a reference to it, of a
+ *   type its `source` names), else the repository the app runs from (`origin`);
+ * - `domains`: each public site's domain (`siteDomains`);
+ * - `secrets` (unless it binds its own bootstrap), markers only: the declared `database`'s URL as
+ *   `SANOMA_DATABASE_URL`, the runtime's keys (the signing key the config binds, else the host's
+ *   own, generated at its create; the encryption key with the built-in store), the source key for
+ *   a GitHub repository it can declare a deploy key on, the wakeup's token (and URL, for
+ *   `sanoma.wakeup`) when a wakeup names it, the credentials of its own vendor, its repository's
+ *   and the login sender's, and the company's GitHub App's keys that are stored;
+ * - for a GitHub repository, a `github.repository_deploy_key` (`sourceKeyId`), read-only, whose
+ *   key is the stored source key's public half, when one is and the config has the type; found by
+ *   its type's identity (the repository and the key), so a key GitHub holds already is bound, not
+ *   made again.
+ *
+ * `ref` is resolved by apply (and drift) with the revision: the repository's default branch.
+ * `out.keep` takes the deploy-key ids not declared this read (no source key stored yet, or its
+ * host left out), which the caller must not orphan; `out.leftOut` the hosts with a problem, which
+ * the caller leaves out, with what names them, so apply changes nothing it cannot give all it needs.
+ * Problems: a host with no `database`, a name (none to tell, or another host's), an image or a
+ * source that cannot be told, a credential its vendor's driver reads from this machine's
+ * environment that nothing binds, a private repository it has no deploy key for, two hosts that
+ * would attach the sites' domains.
+ */
+export function deriveHosts(resources, types, bindings, facts, out = {}) {
+    const problems = [];
+    // One host attaches the sites' domains: two would each try to attach them.
+    const attaching = resources.filter((r) => {
+        const host = types.get(`${r.vendor}.${r.type}`)?.host;
+        return host?.derives && host.inputs.domains !== undefined;
+    });
+    if (attaching.length > 1 && Object.keys(facts.domains).length) {
+        for (const r of attaching) {
+            out.leftOut?.add(r.id);
+            problems.push({
+                ...r.at,
+                message: `${r.at.export}: ${attaching.length} hosts would attach the public sites' domains: declare one host that derives, the production one`,
+            });
+        }
+    }
+    const deployKey = types.get(DEPLOY_KEY_TYPE);
+    // A copy: the deploy keys are put in `resources` as it goes.
+    for (const r of resources.slice()) {
+        const type = types.get(`${r.vendor}.${r.type}`);
+        if (!type?.host?.derives)
+            continue;
+        const spec = type.host;
+        const { inputs } = spec;
+        let blocked = out.leftOut?.has(r.id) ?? false;
+        const problem = (message) => {
+            blocked = true;
+            problems.push({ ...r.at, message: `${r.at.export}: ${message}` });
+        };
+        const { desired, refs } = r;
+        if (inputs.image !== undefined && valueAt(desired, inputs.image) == null) {
+            if (facts.version)
+                setAt(desired, inputs.image, runtimeImage(facts.version));
+            else
+                problem("its runtime image is the installed sanoma's, and sanoma is not installed: install it, or declare `image`");
+        }
+        if (valueAt(desired, inputs.source) == null) {
+            const declared = sourceRepository(r, type, resources, facts.origin);
+            if (declared) {
+                setAt(desired, inputs.source, declared.name);
+                refs[inputs.source] = declared.id;
+            }
+            else if (facts.origin)
+                setAt(desired, inputs.source, facts.origin);
+            else
+                problem("its source is the repository the app runs from, and the repository has no origin: push it, or declare `source`");
+        }
+        // The GitHub repository it clones, `owner/name`: a declared one's identity, else its URL's.
+        const repositoryId = refs[inputs.source];
+        const repository = repositoryId
+            ? resources.find((o) => o.id === repositoryId && o.vendor === "github")?.identity
+            : githubRepository(valueAt(desired, inputs.source));
+        if (inputs.name !== undefined && valueAt(desired, inputs.name) == null) {
+            const source = valueAt(desired, inputs.source);
+            const named = repository ?? (typeof source === "string" ? cloneUrl(source) : undefined);
+            // A bound host keeps the name it is bound by: a renamed repository would otherwise replace it.
+            const bound = type.identity === inputs.name ? bindings[r.id]?.id : undefined;
+            const name = bound ??
+                (named &&
+                    nameOf(named
+                        .replace(/\.git$/, "")
+                        .split("/")
+                        .at(-1)));
+            if (name) {
+                setAt(desired, inputs.name, name);
+                const identity = type.find?.(desired);
+                const twin = identity &&
+                    resources.find((o) => o !== r && o.vendor === r.vendor && o.type === r.type && o.identity === identity);
+                if (twin)
+                    problem(`its name, its repository's, is ${twin.at.export}'s too, ${name}: declare \`name\``);
+                else if (identity)
+                    Object.assign(r, { identity, name: identity });
+            }
+            else
+                problem("its name is its repository's, and it has none to name it by: declare `name`");
+        }
+        if (inputs.domains !== undefined && Object.keys(facts.domains).length) {
+            setAt(desired, inputs.domains, { ...facts.domains });
+        }
+        if (spec.bindsBootstrap || inputs.secrets === undefined) {
+            if (blocked)
+                out.leftOut?.add(r.id);
+            continue;
+        }
+        // A deploy key is declared for a GitHub repository only where the config has the type.
+        const keyed = repository !== undefined && deployKey !== undefined;
+        if (repository && !keyed && facts.privateRepositories?.includes(repository)) {
+            problem(`${repository} is private, and the config has no ${DEPLOY_KEY_TYPE} to give the host a key to clone it with: add the GitHub connector (@sanoma-ai/connector-github) to sanoma.config.ts`);
+        }
+        const secrets = {};
+        const database = inputs.database === undefined ? undefined : refs[inputs.database];
+        if (database)
+            secrets.SANOMA_DATABASE_URL = secret(databaseUrlSecret(exportOf(database)));
+        else if (inputs.database !== undefined)
+            problem("declare the database it runs on, `database: store`: the host is given its URL");
+        secrets.SANOMA_SIGNING_KEY = facts.signingKeyBound
+            ? secret("SANOMA_SIGNING_KEY")
+            : secret(HOST_SIGNING_KEY, { generate: true });
+        if (facts.builtInStore)
+            secrets.SANOMA_SECRETS_KEY = secret("SANOMA_SECRETS_KEY");
+        if (keyed)
+            secrets[SOURCE_KEY] = secret(SOURCE_KEY);
+        const wakeup = wokenBy(r, resources, types);
+        if (wakeup) {
+            secrets[WAKEUP_TOKEN] = secret(WAKEUP_TOKEN);
+            if (wakeup.vendor === "sanoma")
+                secrets[WAKEUP_URL] = secret(WAKEUP_URL);
+        }
+        // What it deploys itself with after a push: the vendors of its data file, its repository's, the sender's.
+        const vendors = new Set([
+            ...resources.filter((o) => o.file === r.file).map((o) => o.vendor),
+            ...(repository ? ["github"] : []),
+            ...(facts.sender ? [facts.sender] : []),
+        ]);
+        const carried = [...vendors].flatMap((vendor) => facts.carried.get(vendor) ?? []);
+        for (const name of [...carried, ...facts.githubApp])
+            secrets[name] = secret(name);
+        // One the driver reads here from the environment alone would be left off the host, and a
+        // Worker updated without it would lose it.
+        for (const vendor of vendors) {
+            for (const name of facts.unbound?.get(vendor) ?? []) {
+                problem(`${name} is read from the environment here, and has no binding, so the host would not be given it: bind it in sanoma.config.ts, \`secrets: { bindings: { ${name}: { env: "${name}" } } }\`, or store it on the ${vendor} connector page`);
+            }
+        }
+        setAt(desired, inputs.secrets, secrets);
+        const id = sourceKeyId(r.id);
+        // Kept from orphaning while it cannot be declared: no source key stored yet, or the host left out.
+        if (keyed && (!facts.sourceKey || blocked))
+            out.keep?.add(id);
+        if (blocked)
+            out.leftOut?.add(r.id);
+        // Not twice: a data file of before may declare the same key itself (GitHub takes a key once).
+        const declaredKey = resources.some((o) => `${o.vendor}.${o.type}` === DEPLOY_KEY_TYPE && o.desired.key === facts.sourceKey);
+        if (keyed && facts.sourceKey && !blocked && !declaredKey) {
+            const binding = bindings[id]?.id;
+            const key = { repository, title: DEPLOY_KEY_TITLE, key: facts.sourceKey, read_only: true };
+            const identity = deployKey.find?.(key);
+            resources.splice(resources.indexOf(r), 0, {
+                id,
+                file: r.file,
+                vendor: "github",
+                type: "repository_deploy_key",
+                name: exportOf(id),
+                ...(identity && { identity }),
+                ...(binding !== undefined && { binding }),
+                at: { file: r.at.file, export: exportOf(id) },
+                desired: key,
+                refs: repositoryId ? { repository: repositoryId } : {},
+            });
+        }
+    }
+    return problems;
+}
+/**
+ * Whether GitHub shows `repository` (`owner/name`) to anyone, asked with no token: false for one
+ * that is private (or not there), undefined when GitHub does not say.
+ */
+async function publicOnGithub(repository) {
+    try {
+        const res = await fetch(`https://api.github.com/repos/${repository}`, {
+            method: "HEAD",
+            headers: { accept: "application/vnd.github+json" },
+            signal: AbortSignal.timeout(10_000),
+        });
+        return res.status === 200 ? true : res.status === 404 ? false : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * What the declared hosts that derive (`deriveHosts`) are filled from, read now: the installed
+ * `sanoma`, `origin`, the public sites' domains, and of `secrets` (none outside a run) which
+ * optional credentials, App keys and source key are stored, and which credentials the drivers
+ * read from this machine's environment alone (`unbound`). With `mint` (apply, never drift or a
+ * sandbox run), the source key (where the config has the deploy-key type) and, when a wakeup is
+ * declared, the wakeup's token are minted first when none is stored, so the host is given them
+ * from its first apply. With no deploy-key type, GitHub is asked which repositories a host may clone are private.
+ * Undefined when no declared host derives.
+ */
+export async function hostFacts(options) {
+    const { root, resources, types, drivers, secrets, mint } = options;
+    const typeOf = (r) => types.get(`${r.vendor}.${r.type}`);
+    const deriving = resources.filter((r) => typeOf(r)?.host?.derives);
+    if (!deriving.length)
+        return undefined;
+    const hosts = deriving.filter((r) => !typeOf(r)?.host?.bindsBootstrap);
+    // Which optional credentials and App keys are stored: read at once, and only for a host given secrets.
+    const stored = async (names) => secrets && hosts.length
+        ? new Set((await Promise.all(names.map(async (n) => ((await secrets.get(n)) === undefined ? [] : [n])))).flat())
+        : new Set();
+    const statuses = [...drivers].flatMap(([vendor, { env }]) => env ? statusesOf(env, () => undefined).map((c) => ({ vendor, ...c })) : []);
+    // Only what the store holds: a marker for a name it does not would fail the host's deploy.
+    const held = await stored(statuses.map((c) => c.name));
+    const carried = new Map();
+    const unbound = new Map();
+    for (const c of statuses) {
+        // The driver reads the environment first: set there alone, it runs here and the host is not given it.
+        const into = held.has(c.name) ? carried : secrets && hosts.length && process.env[c.name] ? unbound : undefined;
+        into?.set(c.vendor, [...(into.get(c.vendor) ?? []), c.name]);
+    }
+    const githubApp = [...(await stored(Object.values(GITHUB_APP)))];
+    if (mint && secrets && hosts.some((h) => wokenBy(h, resources, types)))
+        await mintWakeupToken(secrets);
+    const keyed = types.has(DEPLOY_KEY_TYPE);
+    const { siteDomains } = await import("./sites.js");
+    const [version, origin, sourceKey] = await Promise.all([
+        installedSanoma(root),
+        originUrl(root),
+        secrets && hosts.length && keyed ? sourceKeyOf(secrets, mint) : undefined,
+    ]);
+    // What a host may clone: `origin`, else the `source` it declares (with no deploy-key type, no
+    // GitHub repository is declared to be one).
+    const repositories = keyed
+        ? []
+        : [
+            ...new Set([
+                githubRepository(origin),
+                ...hosts.map((h) => githubRepository(valueAt(h.desired, typeOf(h).host.inputs.source))),
+            ].filter((r) => r !== undefined)),
+        ];
+    const open = await Promise.all(repositories.map(publicOnGithub));
+    const privateRepositories = repositories.filter((_, i) => open[i] === false);
+    return {
+        ...(version !== undefined && { version }),
+        ...(origin !== undefined && { origin }),
+        domains: siteDomains(root),
+        builtInStore: options.builtInStore,
+        carried,
+        ...(unbound.size > 0 && { unbound }),
+        ...(options.signingKeyBound && { signingKeyBound: true }),
+        ...(options.sender !== undefined && { sender: options.sender }),
+        githubApp,
+        ...(sourceKey !== undefined && { sourceKey }),
+        ...(privateRepositories.length > 0 && { privateRepositories }),
+    };
+}
+//# sourceMappingURL=host-derive.js.map

package/dist/host-derive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-derive.js","sourceRoot":"","sources":["../src/host-derive.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAGtC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAiB,OAAO,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,MAAM,EAA6B,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEtE,gGAAgG;AAChG,8FAA8F;AAC9F,6FAA6F;AAC7F,iGAAiG;AACjG,oFAAoF;AAEpF,gIAAgI;AAChI,MAAM,CAAC,MAAM,UAAU,GAAG,mBAAmB,CAAC;AAE9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,EAAE,EAAE,sBAAsB;IAC1B,IAAI,EAAE,wBAAwB;IAC9B,SAAS,EAAE,yBAAyB;IACpC,aAAa,EAAE,6BAA6B;IAC5C,cAAc,EAAE,8BAA8B;IAC9C,GAAG,EAAE,uBAAuB;CACpB,CAAC;AAEX,iHAAiH;AACjH,MAAM,CAAC,MAAM,gBAAgB,GAAG,yBAAyB,CAAC;AAE1D,sGAAsG;AACtG,MAAM,UAAU,GAAG,mBAAmB,CAAC;AAEvC,oGAAoG;AACpG,MAAM,CAAC,MAAM,eAAe,GAAG,8BAA8B,CAAC;AAE9D,mDAAmD;AACnD,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAuC9C,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEhC,sHAAsH;AACtH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY;IAChD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,EAAE,IAAK,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,CAA2B,CAAC,OAAO,CAAC;QAChG,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,MAAM,GAAG,GAAG,sEAAsE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACpG,IAAI,GAAG;QAAE,OAAO,sBAAsB,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7D,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC;IACrB,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC;IACrB,IAAI,MAAM,CAAC,QAAQ,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC;IACrG,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,yHAAyH;AACzH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAY;IAC1C,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACtG,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9C,MAAM,EAAE,GAAG,6DAA6D,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACnG,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAgB,EAAE,IAAa;IAC/D,IAAI,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,aAAa,EAAE,CAAC;QACnC,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;AACjE,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAgB,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;AAErG;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAsB,EACtB,IAAc,EACd,SAAsC,EACtC,MAA0B;IAE1B,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,IAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtF,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACtF,MAAM,EAAE,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,OAAO,CACL,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,KAAK,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CACjH,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,OAAO,CACrB,IAAkC,EAClC,SAAsC,EACtC,KAAoD;IAEpD,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC;QAC1D,OAAO,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;IACxE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,kFAAkF;AAClF,SAAS,KAAK,CAAC,IAA6B,EAAE,IAAY,EAAE,KAAc;IACxE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,EAAE,GAAG,IAAI,CAAC;IACd,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAAE,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,CAA4B,CAAC;IACtF,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,GAAG,KAAK,CAAC;AAC3B,CAAC;AAED,0EAA0E;AAC1E,MAAM,QAAQ,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAE/D,uGAAuG;AACvG,MAAM,MAAM,GAAG,CAAC,UAAkB,EAAE,EAAE,CACpC,UAAU;KACP,WAAW,EAAE;KACb,UAAU,CAAC,cAAc,EAAE,GAAG,CAAC;KAC/B,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAEhC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,WAAW,CACzB,SAA6B,EAC7B,KAAoC,EACpC,QAAkB,EAClB,KAAgB,EAChB,GAAG,GAAkD,EAAE;IAEvD,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,2EAA2E;IAC3E,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACvC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC;QACtD,OAAO,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC;IAC5D,CAAC,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;QAC9D,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC;gBACZ,GAAG,CAAC,CAAC,EAAE;gBACP,OAAO,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,kGAAkG;aAC/I,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC7C,6DAA6D;IAC7D,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO;YAAE,SAAS;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QACxB,IAAI,OAAO,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC;QAC9C,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,EAAE;YAClC,OAAO,GAAG,IAAI,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,MAAM,KAAK,OAAO,EAAE,EAAE,CAAC,CAAC;QACpE,CAAC,CAAC;QACF,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAE5B,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;YACzE,IAAI,KAAK,CAAC,OAAO;gBAAE,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;;gBAE3E,OAAO,CACL,0GAA0G,CAC3G,CAAC;QACN,CAAC;QAED,IAAI,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YAC5C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACpE,IAAI,QAAQ,EAAE,CAAC;gBACb,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAC7C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC;YACpC,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM;gBAAE,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;;gBAEnE,OAAO,CACL,gHAAgH,CACjH,CAAC;QACN,CAAC;QACD,4FAA4F;QAC5F,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,YAAY;YAC7B,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,YAAY,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,EAAE,QAAQ;YACjF,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAEtD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;YACvE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,UAAU,IAAI,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACxF,+FAA+F;YAC/F,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7E,MAAM,IAAI,GACR,KAAK;gBACL,CAAC,KAAK;oBACJ,MAAM,CACJ,KAAK;yBACF,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;yBACrB,KAAK,CAAC,GAAG,CAAC;yBACV,EAAE,CAAC,CAAC,CAAC,CAAE,CACX,CAAC,CAAC;YACP,IAAI,IAAI,EAAE,CAAC;gBACT,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC;gBACtC,MAAM,IAAI,GACR,QAAQ;oBACR,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;gBAC1G,IAAI,IAAI;oBAAE,OAAO,CAAC,kCAAkC,IAAI,CAAC,EAAE,CAAC,MAAM,WAAW,IAAI,oBAAoB,CAAC,CAAC;qBAClG,IAAI,QAAQ;oBAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YACpE,CAAC;;gBAAM,OAAO,CAAC,6EAA6E,CAAC,CAAC;QAChG,CAAC;QAED,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;YACtE,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACvD,CAAC;QAED,IAAI,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACxD,IAAI,OAAO;gBAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACpC,SAAS;QACX,CAAC;QACD,uFAAuF;QACvF,MAAM,KAAK,GAAG,UAAU,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,CAAC;QAClE,IAAI,UAAU,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,mBAAmB,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5E,OAAO,CACL,GAAG,UAAU,sCAAsC,eAAe,sHAAsH,CACzL,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnF,IAAI,QAAQ;YAAE,OAAO,CAAC,mBAAmB,GAAG,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;aACrF,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS;YACpC,OAAO,CAAC,+EAA+E,CAAC,CAAC;QAC3F,OAAO,CAAC,kBAAkB,GAAG,KAAK,CAAC,eAAe;YAChD,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC;YAC9B,CAAC,CAAC,MAAM,CAAC,gBAAgB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,IAAI,KAAK,CAAC,YAAY;YAAE,OAAO,CAAC,kBAAkB,GAAG,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAClF,IAAI,KAAK;YAAE,OAAO,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAC5C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,CAAC,YAAY,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;YAC7C,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ;gBAAE,OAAO,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;QAC3E,CAAC;QACD,0GAA0G;QAC1G,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC;YACtB,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;YAClE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAClF,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,OAAO,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAClF,yFAAyF;QACzF,2CAA2C;QAC3C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;gBACpD,OAAO,CACL,GAAG,IAAI,oJAAoJ,IAAI,aAAa,IAAI,iCAAiC,MAAM,iBAAiB,CACzO,CAAC;YACJ,CAAC;QACH,CAAC;QACD,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAExC,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7B,mGAAmG;QACnG,IAAI,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS,IAAI,OAAO,CAAC;YAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9D,IAAI,OAAO;YAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpC,8FAA8F;QAC9F,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAChC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,eAAe,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,KAAK,KAAK,CAAC,SAAS,CACxF,CAAC;QACF,IAAI,KAAK,IAAI,KAAK,CAAC,SAAS,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;YACzD,MAAM,OAAO,GAAG,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,gBAAgB,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAC3F,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;YACvC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;gBACxC,EAAE;gBACF,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,uBAAuB;gBAC7B,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAClB,GAAG,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,CAAC;gBAC7B,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,CAAC;gBACzC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE;gBAC7C,OAAO,EAAE,GAAG;gBACZ,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE;aACvD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,cAAc,CAAC,UAAkB;IAC9C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,gCAAgC,UAAU,EAAE,EAAE;YACpE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,MAAM,EAAE,6BAA6B,EAAE;YAClD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAW/B;IACC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IACnE,MAAM,MAAM,GAAG,CAAC,CAAmB,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACnE,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IACvE,uGAAuG;IACvG,MAAM,MAAM,GAAG,KAAK,EAAE,KAAwB,EAAE,EAAE,CAChD,OAAO,IAAI,KAAK,CAAC,MAAM;QACrB,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAChH,CAAC,CAAC,IAAI,GAAG,EAAU,CAAC;IACxB,MAAM,QAAQ,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CAC1D,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAC3E,CAAC;IACF,2FAA2F;IAC3F,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC5C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,sGAAsG;QACtG,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/G,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAAE,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IACvG,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACzC,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;IACnD,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACrD,eAAe,CAAC,IAAI,CAAC;QACrB,SAAS,CAAC,IAAI,CAAC;QACf,OAAO,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;KAC1E,CAAC,CAAC;IACH,8FAA8F;IAC9F,4CAA4C;IAC5C,MAAM,YAAY,GAAG,KAAK;QACxB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE,GAAG,IAAI,GAAG,CACR;gBACE,gBAAgB,CAAC,MAAM,CAAC;gBACxB,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,IAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;aAC1F,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CACjC;SACF,CAAC;IACN,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;IACjE,MAAM,mBAAmB,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC;IAC7E,OAAO;QACL,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,CAAC;QACzC,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC;QACvC,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC;QAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,OAAO;QACP,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;QACpC,GAAG,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;QACzD,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QAC/D,SAAS;QACT,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7C,GAAG,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,mBAAmB,EAAE,CAAC;KAC/D,CAAC;AACJ,CAAC"}