@schema-weaver/pg-connector 0.0.0-stage → 2.0.0

package/dist/esm/config/schema.js

@@ -0,0 +1,180 @@
+/**
+ * Config errors and hand-rolled validators for machine and database config files.
+ */
+import { atomicWriteFile } from './atomic-write';
+export class ConfigError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'ConfigError';
+    }
+}
+export class ConfigInvalidError extends ConfigError {
+    constructor(message) {
+        super('invalid', message);
+        this.name = 'ConfigInvalidError';
+    }
+}
+export class ConfigNotFoundError extends ConfigError {
+    constructor(path) {
+        super('not_found', `Config file not found: ${path}`);
+        this.name = 'ConfigNotFoundError';
+    }
+}
+/**
+ * Checks if a string is a valid hostname.
+ */
+export function isValidHostname(s) {
+    if (typeof s !== 'string')
+        return false;
+    if (s.length === 0 || s.length > 253)
+        return false;
+    const labelRegex = /^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?$/;
+    if (!s.includes('.')) {
+        return labelRegex.test(s);
+    }
+    const labels = s.split('.');
+    return labels.every((label) => labelRegex.test(label));
+}
+/**
+ * Checks if a string is a valid IPv4 address.
+ */
+export function isValidIpv4(s) {
+    if (typeof s !== 'string')
+        return false;
+    const parts = s.split('.');
+    if (parts.length !== 4)
+        return false;
+    return parts.every((part) => {
+        if (!/^\d+$/.test(part))
+            return false;
+        const num = parseInt(part, 10);
+        return num >= 0 && num <= 255 && String(num) === part;
+    });
+}
+/**
+ * Checks if a string is a valid IPv6 address.
+ */
+export function isValidIpv6(s) {
+    if (typeof s !== 'string')
+        return false;
+    const ipv6Regex = /^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,3}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,2}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$/;
+    return ipv6Regex.test(s);
+}
+/**
+ * Checks if a string is a valid environment variable name.
+ */
+export function isValidEnvVarName(s) {
+    if (typeof s !== 'string')
+        return false;
+    return /^[A-Z][A-Z0-9_]*$/.test(s);
+}
+/**
+ * Checks if a string is a valid ISO 8601 timestamp.
+ */
+export function isValidIso8601(s) {
+    if (typeof s !== 'string')
+        return false;
+    const iso8601Regex = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})$/;
+    if (!iso8601Regex.test(s))
+        return false;
+    const d = new Date(s);
+    return !isNaN(d.getTime());
+}
+/**
+ * Checks if a string contains only letters, numbers, hyphens, and underscores, up to maxLen.
+ */
+export function isValidIdentifier(s, maxLen) {
+    if (typeof s !== 'string')
+        return false;
+    if (s.length === 0 || s.length > maxLen)
+        return false;
+    return /^[a-zA-Z0-9_-]+$/.test(s);
+}
+/** Longest cloud/telemetry URL accepted. */
+const MAX_URL_LENGTH = 2048;
+function hasControlOrSpace(raw) {
+    for (let i = 0; i < raw.length; i++) {
+        const code = raw.charCodeAt(i);
+        if (code <= 0x20 || code === 0x7f)
+            return true;
+    }
+    return false;
+}
+/**
+ * Strictly parses a URL that is required to use `scheme` with an explicit
+ * "//" authority separator.
+ *
+ * The scheme is matched against the raw string with a case-sensitive prefix
+ * check *and* against the parsed URL, because the WHATWG parser normalises
+ * several downgrade shapes that must be rejected: "WSS://host" lower-cases to
+ * the "wss:" scheme, and "wss:/host" (single slash) is happily parsed as the
+ * host. Either one alone would be a bypassable transport check.
+ */
+export function parseSecureUrl(raw, scheme) {
+    if (typeof raw !== 'string')
+        return null;
+    const prefix = `${scheme}//`;
+    if (raw.length < prefix.length + 1 || raw.length > MAX_URL_LENGTH)
+        return null;
+    if (hasControlOrSpace(raw))
+        return null;
+    if (!raw.startsWith(prefix))
+        return null;
+    // "wss:///host" parses as host "host": the authority must start immediately.
+    if (raw[prefix.length] === '/')
+        return null;
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return null;
+    }
+    if (url.protocol !== scheme)
+        return null;
+    if (url.hostname.length === 0)
+        return null;
+    if (url.username.length > 0 || url.password.length > 0)
+        return null;
+    if (url.hostname.includes('..'))
+        return null;
+    return url;
+}
+/**
+ * True only for a wss: URL with an explicit lowercase "//" authority.
+ * ws:, http:, WSS: and "wss:/x" are all rejected.
+ */
+export function isSecureCloudUrl(raw) {
+    return parseSecureUrl(raw, 'wss:') !== null;
+}
+/**
+ * True only for an https: URL with an explicit lowercase "//" authority.
+ * http: is rejected.
+ */
+export function isSecureIngestUrl(raw) {
+    return parseSecureUrl(raw, 'https:') !== null;
+}
+/**
+ * Writes a config file atomically with the given owner-only mode: a
+ * create-only mode option is not a control, so the mode is applied explicitly
+ * to both the temporary file and, through the rename, the final file.
+ */
+export function writeConfigFileAtomic(filePath, contents, mode) {
+    atomicWriteFile(filePath, contents, mode);
+}
+/**
+ * Redacts secret material from text that is about to be printed or logged.
+ * Replaces each known secret and any URL userinfo password with "***".
+ */
+export function redactSecrets(text, ...secrets) {
+    let out = text.replace(/([a-zA-Z][a-zA-Z0-9+.-]*:\/\/[^:@/\s]*:)[^@/\s]*@/g, '$1***@');
+    for (const secret of secrets) {
+        if (typeof secret === 'string' && secret.length > 0) {
+            out = out.split(secret).join('***');
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=schema.js.map

package/dist/esm/config/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/config/schema.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD,MAAM,OAAO,WAAY,SAAQ,KAAK;IAE3B;IADT,YACS,IAA8C,EACrD,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHR,SAAI,GAAJ,IAAI,CAA0C;QAIrD,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED,MAAM,OAAO,kBAAmB,SAAQ,WAAW;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,WAAW;IAClD,YAAY,IAAY;QACtB,KAAK,CAAC,WAAW,EAAE,0BAA0B,IAAI,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,CAAS;IACvC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,UAAU,GAAG,+CAA+C,CAAC;IACnE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,CAAS;IACnC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE;QAC1B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACtC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/B,OAAO,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,CAAS;IACnC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,SAAS,GACb,upBAAupB,CAAC;IAC1pB,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAS;IACzC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,CAAS;IACtC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,YAAY,GAAG,kEAAkE,CAAC;IACxF,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAS,EAAE,MAAc;IACzD,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,MAAM;QAAE,OAAO,KAAK,CAAC;IACtD,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAKD,4CAA4C;AAC5C,MAAM,cAAc,GAAG,IAAI,CAAC;AAE5B,SAAS,iBAAiB,CAAC,GAAW;IACpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,GAAY,EAAE,MAAoB;IAC/D,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC;IAC7B,IAAI,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,cAAc;QAAE,OAAO,IAAI,CAAC;IAC/E,IAAI,iBAAiB,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,6EAA6E;IAC7E,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAE5C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,OAAO,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,IAAI,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,OAAO,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,IAAI,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB,EAAE,QAAgB,EAAE,IAAY;IACpF,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,GAAG,OAA+B;IAC5E,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,oDAAoD,EAAE,QAAQ,CAAC,CAAC;IACvF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/esm/config/token.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Generates a cryptographically random agent token starting with swagt_ followed by 32 base62 characters.
+ */
+export declare function generateAgentToken(): string;
+/**
+ * Validates the format of an agent token.
+ * Returns true if it starts with "swagt_" and the body contains exactly 32 base62 characters.
+ */
+export declare function validateAgentTokenFormat(token: string): boolean;
+/**
+ * Generates an agent ID from the machine label and a random 8 hex char suffix.
+ */
+export declare function generateAgentId(machineLabel: string): string;
+/**
+ * The only token accepted in place of a generated one, for local development
+ * against a dev relay. It is not a credential: every caller must refuse to ship
+ * it to the cloud (see {@link isDevToken}), because it authenticates nothing.
+ */
+export declare const DEV_TOKEN = "swagt_DEV_LOCAL_ONLY";
+/**
+ * True when `token` is the local development token.
+ *
+ * Contract: accepts `unknown` so call sites reading a token out of a config
+ * file, an env var or a cloud payload cannot pass a value the type system
+ * claims is a string when it is not; anything that is not exactly
+ * {@link DEV_TOKEN} — including an empty or absent token — is not a dev token.
+ * This deliberately fails closed: a truthy answer must never mean "treat this
+ * as authenticated".
+ */
+export declare function isDevToken(token: unknown): token is typeof DEV_TOKEN;
+/**
+ * Domain-separation label for the relay-facing credential.
+ *
+ * Bumping this invalidates every derived credential, so it must stay stable
+ * across releases and must never be reused for another purpose.
+ */
+export declare const RELAY_CREDENTIAL_LABEL = "sw-agent/relay-auth/v1";
+/**
+ * Derive the credential actually transmitted to the relay.
+ *
+ * The agent keeps its `swagt_…` token locally and never puts it on the wire.
+ * What travels is this derived value, so the long-lived master token does not
+ * appear in proxy logs, TLS-terminating middleboxes, or `ps` output. The relay
+ * derives the same value from the token it holds at pairing time and compares
+ * digests, so it never needs to store a second secret.
+ *
+ * This is a transmission-hygiene measure, NOT an additional authentication
+ * factor. The derived value is itself a bearer credential with the same
+ * authority as the token it came from: anyone who captures it can
+ * authenticate. Its value is that a leaked relay-side credential is scoped to
+ * the relay and does not also yield the agent's master token for reuse against
+ * other endpoints.
+ *
+ * @param token the locally-held agent token
+ * @returns a lowercase hex digest, 64 characters
+ */
+export declare function deriveRelayCredential(token: string): string;
+/**
+ * Constant-time comparison of two derived relay credentials.
+ * Returns false rather than throwing on malformed input.
+ */
+export declare function relayCredentialsMatch(a: unknown, b: unknown): boolean;
+//# sourceMappingURL=token.d.ts.map

package/dist/esm/config/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../src/config/token.ts"],"names":[],"mappings":"AAKA;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAU3C;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAM/D;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAI5D;AAED;;;;GAIG;AACH,eAAO,MAAM,SAAS,yBAAyB,CAAC;AAEhD;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,OAAO,SAAS,CAEpE;AAED;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,2BAA2B,CAAC;AAE/D;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,OAAO,CAUrE"}

package/dist/esm/config/token.js

@@ -0,0 +1,104 @@
+import * as crypto from 'crypto';
+const { createHmac, timingSafeEqual } = crypto;
+const BASE62_CHARS = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
+/**
+ * Generates a cryptographically random agent token starting with swagt_ followed by 32 base62 characters.
+ */
+export function generateAgentToken() {
+    let result = '';
+    while (result.length < 32) {
+        const bytes = crypto.randomBytes(1);
+        const val = bytes[0];
+        if (val < 248) {
+            result += BASE62_CHARS[val % 62];
+        }
+    }
+    return `swagt_${result}`;
+}
+/**
+ * Validates the format of an agent token.
+ * Returns true if it starts with "swagt_" and the body contains exactly 32 base62 characters.
+ */
+export function validateAgentTokenFormat(token) {
+    if (typeof token !== 'string')
+        return false;
+    if (!token.startsWith('swagt_'))
+        return false;
+    const body = token.slice(6);
+    if (body.length !== 32)
+        return false;
+    return /^[a-zA-Z0-9]+$/.test(body);
+}
+/**
+ * Generates an agent ID from the machine label and a random 8 hex char suffix.
+ */
+export function generateAgentId(machineLabel) {
+    const cleaned = machineLabel.replace(/[^a-zA-Z0-9_-]/g, '');
+    const hex = crypto.randomBytes(4).toString('hex');
+    return `agt_${cleaned}_${hex}`;
+}
+/**
+ * The only token accepted in place of a generated one, for local development
+ * against a dev relay. It is not a credential: every caller must refuse to ship
+ * it to the cloud (see {@link isDevToken}), because it authenticates nothing.
+ */
+export const DEV_TOKEN = 'swagt_DEV_LOCAL_ONLY';
+/**
+ * True when `token` is the local development token.
+ *
+ * Contract: accepts `unknown` so call sites reading a token out of a config
+ * file, an env var or a cloud payload cannot pass a value the type system
+ * claims is a string when it is not; anything that is not exactly
+ * {@link DEV_TOKEN} — including an empty or absent token — is not a dev token.
+ * This deliberately fails closed: a truthy answer must never mean "treat this
+ * as authenticated".
+ */
+export function isDevToken(token) {
+    return typeof token === 'string' && token === DEV_TOKEN;
+}
+/**
+ * Domain-separation label for the relay-facing credential.
+ *
+ * Bumping this invalidates every derived credential, so it must stay stable
+ * across releases and must never be reused for another purpose.
+ */
+export const RELAY_CREDENTIAL_LABEL = 'sw-agent/relay-auth/v1';
+/**
+ * Derive the credential actually transmitted to the relay.
+ *
+ * The agent keeps its `swagt_…` token locally and never puts it on the wire.
+ * What travels is this derived value, so the long-lived master token does not
+ * appear in proxy logs, TLS-terminating middleboxes, or `ps` output. The relay
+ * derives the same value from the token it holds at pairing time and compares
+ * digests, so it never needs to store a second secret.
+ *
+ * This is a transmission-hygiene measure, NOT an additional authentication
+ * factor. The derived value is itself a bearer credential with the same
+ * authority as the token it came from: anyone who captures it can
+ * authenticate. Its value is that a leaked relay-side credential is scoped to
+ * the relay and does not also yield the agent's master token for reuse against
+ * other endpoints.
+ *
+ * @param token the locally-held agent token
+ * @returns a lowercase hex digest, 64 characters
+ */
+export function deriveRelayCredential(token) {
+    return createHmac('sha256', token).update(RELAY_CREDENTIAL_LABEL, 'utf8').digest('hex');
+}
+/**
+ * Constant-time comparison of two derived relay credentials.
+ * Returns false rather than throwing on malformed input.
+ */
+export function relayCredentialsMatch(a, b) {
+    if (typeof a !== 'string' || typeof b !== 'string')
+        return false;
+    const bufA = Buffer.from(a, 'utf8');
+    const bufB = Buffer.from(b, 'utf8');
+    if (bufA.length !== bufB.length || bufA.length === 0) {
+        // Still do the work so timing does not depend on which branch was taken.
+        timingSafeEqual(bufA, bufA);
+        return false;
+    }
+    return timingSafeEqual(bufA, bufB);
+}
+//# sourceMappingURL=token.js.map

package/dist/esm/config/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../../src/config/token.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;AAE/C,MAAM,YAAY,GAAG,gEAAgE,CAAC;AAEtF;;GAEG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,OAAO,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,GAAG,GAAG,GAAG,EAAE,CAAC;YACd,MAAM,IAAI,YAAY,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IACD,OAAO,SAAS,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACrC,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,YAAoB;IAClD,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClD,OAAO,OAAO,OAAO,IAAI,GAAG,EAAE,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,sBAAsB,CAAC;AAEhD;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,SAAS,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,wBAAwB,CAAC;AAE/D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,OAAO,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,CAAU,EAAE,CAAU;IAC1D,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACjE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,yEAAyE;QACzE,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC"}

package/dist/esm/execution/canceller.d.ts

@@ -0,0 +1,41 @@
+import { DbEntry } from '../config/db-config';
+import { InFlightRequest } from './types';
+import { PoolManager } from './pool';
+export interface CancellerOptions {
+    /**
+     * Reuse the pool for the cancellation connection.
+     *
+     * This is not an optimisation: without it every cancel opened a brand-new
+     * TCP + TLS + password-authenticated PostgreSQL connection, so a stream of
+     * cancel requests could exhaust `max_connections` on the customer's database.
+     */
+    poolManager?: PoolManager;
+}
+export interface CancelResult {
+    /** Whether a cancellation signal was delivered to the request. */
+    cancelled: boolean;
+    /** Whether the PostgreSQL backend was actually signalled. */
+    terminated: boolean;
+    /**
+     * Whether the in-process cooperative abort fired. The local runner stops at
+     * its next checkpoint without any database round trip, so this can be true
+     * while `terminated` is false — a blocked server-side statement is still
+     * running until `pg_cancel_backend` reaches it.
+     */
+    local_abort: boolean;
+    reason?: string;
+}
+export declare class Canceller {
+    private readonly inFlight;
+    private readonly opts;
+    constructor(opts?: CancellerOptions);
+    register(req: InFlightRequest): void;
+    unregister(requestId: string): void;
+    getInFlight(): Map<string, InFlightRequest>;
+    /**
+     * Cancel a request by request_id using pg_cancel_backend on a separate
+     * connection (PostgreSQL cannot cancel a query from the busy session).
+     */
+    cancel(requestId: string, dbEntry: DbEntry): Promise<CancelResult>;
+}
+//# sourceMappingURL=canceller.d.ts.map

package/dist/esm/execution/canceller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canceller.d.ts","sourceRoot":"","sources":["../../../src/execution/canceller.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAmD,MAAM,QAAQ,CAAC;AAEtF,MAAM,WAAW,gBAAgB;IAC/B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,MAAM,WAAW,YAAY;IAC3B,kEAAkE;IAClE,SAAS,EAAE,OAAO,CAAC;IACnB,6DAA6D;IAC7D,UAAU,EAAE,OAAO,CAAC;IACpB;;;;;OAKG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA2C;IACpE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAmB;gBAE5B,IAAI,GAAE,gBAAqB;IAIvC,QAAQ,CAAC,GAAG,EAAE,eAAe,GAAG,IAAI;IAIpC,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAInC,WAAW,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC;IAI3C;;;OAGG;IACG,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC;CAuMzE"}

package/dist/esm/execution/canceller.js

@@ -0,0 +1,205 @@
+import { Client } from 'pg';
+import { buildSslConfig, markSessionDirty } from './pool';
+export class Canceller {
+    inFlight = new Map();
+    opts;
+    constructor(opts = {}) {
+        this.opts = opts;
+    }
+    register(req) {
+        this.inFlight.set(req.request_id, req);
+    }
+    unregister(requestId) {
+        this.inFlight.delete(requestId);
+    }
+    getInFlight() {
+        return this.inFlight;
+    }
+    /**
+     * Cancel a request by request_id using pg_cancel_backend on a separate
+     * connection (PostgreSQL cannot cancel a query from the busy session).
+     */
+    async cancel(requestId, dbEntry) {
+        const req = this.inFlight.get(requestId);
+        if (!req) {
+            return {
+                cancelled: false,
+                terminated: false,
+                local_abort: false,
+                reason: 'No in-flight request found with the specified ID.',
+            };
+        }
+        // Cooperative local cancellation. Every runner that registers an in-flight
+        // request listens on this controller, so firing it stops the local work at
+        // the next checkpoint (between FETCH batches, before the next statement)
+        // with no database round trip at all. This happens first and never depends
+        // on the connection below succeeding.
+        const localAbortFired = !req.abort.signal.aborted;
+        req.abort.abort();
+        let client = null;
+        let cleanup = () => { };
+        if (this.opts.poolManager) {
+            try {
+                const acquired = await this.opts.poolManager.acquire(dbEntry);
+                client = acquired.client;
+                // This connection is about to issue `pg_cancel_backend`. From here on its
+                // session is no longer a session this pool can vouch for: it has acted on
+                // a backend the pool knows nothing about, and nothing that happens next
+                // can prove the session clean again.
+                //
+                // Marking it dirty is what makes `PoolManager.release` destroy it instead
+                // of recycling it. Releasing it normally would put a connection that has
+                // already cancelled someone else's session back into the idle queue, where
+                // the next unrelated request inherits it — the same reason
+                // `MigrationRunner` marks its client dirty before it opens a transaction.
+                // The cost is one reconnect per cancel, which is the point: reusing the
+                // pool instead of dialling a new connection is what keeps a stream of
+                // cancels from exhausting `max_connections`, and it does not require
+                // recycling the connection that did it.
+                markSessionDirty(acquired.client);
+                cleanup = acquired.release;
+            }
+            catch {
+                client = null;
+            }
+        }
+        if (!client) {
+            // Fall back to a one-off connection. Mirror the pool's TLS negotiation
+            // exactly. The previous code fell back to `sslConfig = false`, which
+            // silently downgraded a credential-bearing connection to plaintext when
+            // the CA file could not be read.
+            let sslConfig;
+            try {
+                sslConfig = buildSslConfig(dbEntry.ssl_mode, dbEntry.ssl_root_cert);
+            }
+            catch (err) {
+                // Audit M-02: fail CLOSED, and report it as the failure it is.
+                //
+                // `cancelled` is the wire fact documented on CancelResultPayload —
+                // "whether the cancel signal was sent". No signal reached PostgreSQL,
+                // so it is `false`; the cooperative abort that did fire is reported
+                // separately and exactly, through `local_abort`. Claiming `cancelled:
+                // true` here told the browser the backend had been signalled while a
+                // blocked statement kept running.
+                //
+                // The detail is logged rather than folded into `reason`, which stays the
+                // stable `ssl_error` code this contract specifies and that
+                // validateCancelResultPayload accepts as a plain string.
+                console.error(`Canceller: refusing to open a cancellation connection for ${dbEntry.db_alias} without TLS ` +
+                    `(ssl_mode ${dbEntry.ssl_mode}): ${err instanceof Error ? err.message : String(err)}`);
+                return {
+                    cancelled: false,
+                    terminated: false,
+                    local_abort: localAbortFired,
+                    reason: 'ssl_error',
+                };
+            }
+            const password = dbEntry.password_stored ||
+                (dbEntry.password_env ? process.env[dbEntry.password_env] : undefined);
+            if (!password) {
+                // Same contract as the TLS refusal above: no signal reached PostgreSQL,
+                // so `cancelled` is false and the cooperative abort is reported through
+                // `local_abort` alone. Claiming `cancelled: true` here told the browser
+                // the backend had been signalled when nothing was ever sent.
+                return {
+                    cancelled: false,
+                    terminated: false,
+                    local_abort: localAbortFired,
+                    reason: 'No password available for the cancellation connection.',
+                };
+            }
+            const clientConfig = {
+                host: dbEntry.host,
+                port: dbEntry.port,
+                database: dbEntry.database,
+                user: dbEntry.user,
+                password,
+                ssl: sslConfig,
+                connectionTimeoutMillis: 5_000,
+                application_name: 'schema-weaver-pg-connector-cancel',
+            };
+            const c = new Client(clientConfig);
+            try {
+                await c.connect();
+            }
+            catch (err) {
+                // The connection never opened, so no cancel signal was sent. Fail closed
+                // for the same reason as the TLS path, and keep the underlying cause on
+                // the console rather than folding it into the stable `reason` string.
+                console.error(`Canceller: could not open a cancellation connection for ${dbEntry.db_alias}: ${err instanceof Error ? err.message : String(err)}`);
+                return {
+                    cancelled: false,
+                    terminated: false,
+                    local_abort: localAbortFired,
+                    reason: `Could not open a cancellation connection: ${err instanceof Error ? err.message : String(err)}`,
+                };
+            }
+            client = c;
+            cleanup = () => {
+                c.end().catch(() => { });
+            };
+        }
+        try {
+            const cancelRes = await client.query('SELECT pg_cancel_backend($1) AS cancelled', [req.pid]);
+            const wasCancelled = cancelRes.rows[0]?.cancelled === true;
+            if (wasCancelled) {
+                return { cancelled: true, terminated: true, local_abort: localAbortFired };
+            }
+            // PostgreSQL answered `false`: no cancel signal was delivered. That is
+            // the server's own verdict and it governs `cancelled`.
+            //
+            // This previously reported `cancelled: localAbortFired`, which is `true`
+            // whenever the local AbortController fired. A caller that trusted the
+            // field was told a blocked statement had been stopped while it kept
+            // running on the server — the exact failure the `catch` branch below was
+            // already corrected for. A local abort stops OUR loop; only
+            // pg_cancel_backend stops PostgreSQL's.
+            return {
+                cancelled: false,
+                terminated: true,
+                local_abort: localAbortFired,
+                reason: 'PostgreSQL reported the cancel signal was not delivered (pg_cancel_backend ' +
+                    'returned false). The backend was likely already idle, gone, or the PID was ' +
+                    'recycled. The local fetch loop was aborted' +
+                    (localAbortFired ? '.' : ', but it had already finished.'),
+            };
+        }
+        catch (err) {
+            // `pg_cancel_backend` did not return a verdict, so no signal is known to
+            // have reached PostgreSQL. The previous `cancelled: localAbortFired` made
+            // a fired local abort indistinguishable from a delivered cancel, so the
+            // browser was told a blocked statement had been stopped while it kept
+            // running. Fail closed and keep the cause on the console.
+            console.error(`Canceller: pg_cancel_backend failed for ${dbEntry.db_alias} (pid ${req.pid}): ${err instanceof Error ? err.message : String(err)}`);
+            return {
+                cancelled: false,
+                terminated: false,
+                local_abort: localAbortFired,
+                reason: `pg_cancel_backend failed: ${err instanceof Error ? err.message : String(err)}`,
+            };
+        }
+        finally {
+            // A connection that has issued a cancel is never handed back for reuse.
+            //
+            // Pooled: `markSessionDirty` above makes this release *destroy* the
+            //   connection instead of returning it to the idle queue, so the next
+            //   request cannot inherit a session that just cancelled a backend.
+            // One-off: `cleanup` ends the dedicated connection, and its rejection is
+            //   already swallowed there.
+            //
+            // Both are the same call, so there is one branch — not a conditional whose
+            // arms happen to be identical. Neither may throw: this runs in a `finally`,
+            // and an exception raised while unwinding would replace the cancel result
+            // the caller is about to report to the browser with a release failure that
+            // says nothing about whether the query was actually stopped.
+            try {
+                cleanup();
+            }
+            catch {
+                // The cancel outcome above stands; a connection that will not release is
+                // the pool's problem to log, not a reason to misreport the cancel.
+            }
+        }
+    }
+}
+//# sourceMappingURL=canceller.js.map

package/dist/esm/execution/canceller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canceller.js","sourceRoot":"","sources":["../../../src/execution/canceller.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAc,MAAM,IAAI,CAAC;AAIxC,OAAO,EAAe,cAAc,EAAE,gBAAgB,EAAiB,MAAM,QAAQ,CAAC;AA4BtF,MAAM,OAAO,SAAS;IACH,QAAQ,GAAiC,IAAI,GAAG,EAAE,CAAC;IACnD,IAAI,CAAmB;IAExC,YAAY,OAAyB,EAAE;QACrC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,QAAQ,CAAC,GAAoB;QAC3B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC;IAED,UAAU,CAAC,SAAiB;QAC1B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;IAED,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,OAAgB;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO;gBACL,SAAS,EAAE,KAAK;gBAChB,UAAU,EAAE,KAAK;gBACjB,WAAW,EAAE,KAAK;gBAClB,MAAM,EAAE,mDAAmD;aAC5D,CAAC;QACJ,CAAC;QAED,2EAA2E;QAC3E,2EAA2E;QAC3E,yEAAyE;QACzE,2EAA2E;QAC3E,sCAAsC;QACtC,MAAM,eAAe,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC;QAClD,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAElB,IAAI,MAAM,GAA+B,IAAI,CAAC;QAC9C,IAAI,OAAO,GAAe,GAAG,EAAE,GAAE,CAAC,CAAC;QAEnC,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBAC9D,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;gBACzB,0EAA0E;gBAC1E,0EAA0E;gBAC1E,wEAAwE;gBACxE,qCAAqC;gBACrC,EAAE;gBACF,0EAA0E;gBAC1E,yEAAyE;gBACzE,2EAA2E;gBAC3E,2DAA2D;gBAC3D,0EAA0E;gBAC1E,wEAAwE;gBACxE,sEAAsE;gBACtE,qEAAqE;gBACrE,wCAAwC;gBACxC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAClC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,IAAI,CAAC;YAChB,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,uEAAuE;YACvE,qEAAqE;YACrE,wEAAwE;YACxE,iCAAiC;YACjC,IAAI,SAAwB,CAAC;YAC7B,IAAI,CAAC;gBACH,SAAS,GAAG,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;YACtE,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,+DAA+D;gBAC/D,EAAE;gBACF,mEAAmE;gBACnE,sEAAsE;gBACtE,oEAAoE;gBACpE,sEAAsE;gBACtE,qEAAqE;gBACrE,kCAAkC;gBAClC,EAAE;gBACF,yEAAyE;gBACzE,2DAA2D;gBAC3D,yDAAyD;gBACzD,OAAO,CAAC,KAAK,CACX,6DAA6D,OAAO,CAAC,QAAQ,eAAe;oBAC1F,aAAa,OAAO,CAAC,QAAQ,MAC3B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CACL,CAAC;gBACF,OAAO;oBACL,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,KAAK;oBACjB,WAAW,EAAE,eAAe;oBAC5B,MAAM,EAAE,WAAW;iBACpB,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GACZ,OAAO,CAAC,eAAe;gBACvB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACzE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,wEAAwE;gBACxE,wEAAwE;gBACxE,wEAAwE;gBACxE,6DAA6D;gBAC7D,OAAO;oBACL,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,KAAK;oBACjB,WAAW,EAAE,eAAe;oBAC5B,MAAM,EAAE,wDAAwD;iBACjE,CAAC;YACJ,CAAC;YAED,MAAM,YAAY,GAAiB;gBACjC,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,QAAQ;gBACR,GAAG,EAAE,SAAgC;gBACrC,uBAAuB,EAAE,KAAK;gBAC9B,gBAAgB,EAAE,mCAAmC;aACtD,CAAC;YACF,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC;YACnC,IAAI,CAAC;gBACH,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;YACpB,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,yEAAyE;gBACzE,wEAAwE;gBACxE,sEAAsE;gBACtE,OAAO,CAAC,KAAK,CACX,2DAA2D,OAAO,CAAC,QAAQ,KACzE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CACH,CAAC;gBACF,OAAO;oBACL,SAAS,EAAE,KAAK;oBAChB,UAAU,EAAE,KAAK;oBACjB,WAAW,EAAE,eAAe;oBAC5B,MAAM,EAAE,6CACN,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE;iBACH,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC,CAAC;YACX,OAAO,GAAG,GAAG,EAAE;gBACb,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC1B,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7F,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,KAAK,IAAI,CAAC;YAC3D,IAAI,YAAY,EAAE,CAAC;gBACjB,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;YAC7E,CAAC;YACD,uEAAuE;YACvE,uDAAuD;YACvD,EAAE;YACF,yEAAyE;YACzE,sEAAsE;YACtE,oEAAoE;YACpE,yEAAyE;YACzE,4DAA4D;YAC5D,wCAAwC;YACxC,OAAO;gBACL,SAAS,EAAE,KAAK;gBAChB,UAAU,EAAE,IAAI;gBAChB,WAAW,EAAE,eAAe;gBAC5B,MAAM,EACJ,6EAA6E;oBAC7E,6EAA6E;oBAC7E,4CAA4C;oBAC5C,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,gCAAgC,CAAC;aAC7D,CAAC;QACJ,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,yEAAyE;YACzE,0EAA0E;YAC1E,wEAAwE;YACxE,sEAAsE;YACtE,0DAA0D;YAC1D,OAAO,CAAC,KAAK,CACX,2CAA2C,OAAO,CAAC,QAAQ,SAAS,GAAG,CAAC,GAAG,MACzE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CACH,CAAC;YACF,OAAO;gBACL,SAAS,EAAE,KAAK;gBAChB,UAAU,EAAE,KAAK;gBACjB,WAAW,EAAE,eAAe;gBAC5B,MAAM,EAAE,6BAA6B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;aACxF,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,wEAAwE;YACxE,EAAE;YACF,oEAAoE;YACpE,sEAAsE;YACtE,oEAAoE;YACpE,yEAAyE;YACzE,6BAA6B;YAC7B,EAAE;YACF,2EAA2E;YAC3E,4EAA4E;YAC5E,0EAA0E;YAC1E,2EAA2E;YAC3E,6DAA6D;YAC7D,IAAI,CAAC;gBACH,OAAO,EAAE,CAAC;YACZ,CAAC;YAAC,MAAM,CAAC;gBACP,yEAAyE;gBACzE,mEAAmE;YACrE,CAAC;QACH,CAAC;IACH,CAAC;CACF"}