@secondlayer/shared 7.4.0 → 7.5.1

package/dist/src/crypto/secrets.d.ts

@@ -1,5 +1,14 @@
+/**
+* Non-throwing check for whether a secrets key is currently resolvable —
+* same resolution order as {@link loadKey} (env var, then the OSS
+* `.env.local` fallback), but never bootstraps a new key (that would
+* generate+persist a key as a side effect of a mere existence check), never
+* throws, and never returns or logs the key itself. Used by callers that
+* need to fail loud on a missing key BEFORE attempting a decrypt (f072).
+*/
+declare function secretsKeyAvailable(): boolean;
 declare function encryptSecret(plaintext: string): Buffer;
 declare function decryptSecret(envelope: Buffer): string;
 /** Generate a fresh 32-byte hex key suitable for `SECONDLAYER_SECRETS_KEY`. */
 declare function generateSecretsKey(): string;
-export { generateSecretsKey, encryptSecret, decryptSecret };
+export { secretsKeyAvailable, generateSecretsKey, encryptSecret, decryptSecret };

package/dist/src/crypto/secrets.js

@@ -121,6 +121,15 @@ function getKey() {
     _cachedKey = loadKey();
   return _cachedKey;
 }
+function secretsKeyAvailable() {
+  if (process.env[KEY_ENV])
+    return true;
+  if (getInstanceMode() === "oss") {
+    const envPath = resolve(process.cwd(), ".env.local");
+    return readExistingKey(envPath) !== null;
+  }
+  return false;
+}
 function encryptSecret(plaintext) {
   const key = getKey();
   const iv = randomBytes(IV_LEN);
@@ -145,10 +154,11 @@ function generateSecretsKey() {
   return randomBytes(32).toString("hex");
 }
 export {
+  secretsKeyAvailable,
   generateSecretsKey,
   encryptSecret,
   decryptSecret
 };
 
-//# debugId=40A784140E79E07464756E2164756E21
+//# debugId=D05BC92983E1614B64756E2164756E21
 //# sourceMappingURL=secrets.js.map

package/dist/src/crypto/secrets.js.map

@@ -3,9 +3,9 @@
   "sources": ["../src/mode.ts", "../src/crypto/secrets.ts"],
   "sourcesContent": [
     "/**\n * Instance modes for the Secondlayer platform.\n *\n * - `oss`: self-hosted, single-tenant. No auth middleware, no platform routes\n *   (projects, admin). Everything runs against a single `DATABASE_URL`.\n *   Intended for `docker compose up`.\n *\n * - `platform`: control-plane mode. Magic-link auth, API keys, projects,\n *   admin. Serves the dashboard + CLI against a single shared DB. Post\n *   2026-05-14 shared-rip this also serves subgraphs + subscriptions.\n */\n\nexport type InstanceMode = \"oss\" | \"platform\";\n\nconst VALID_MODES: readonly InstanceMode[] = [\"oss\", \"platform\"];\n\n/**\n * Resolve the active instance mode from `process.env.INSTANCE_MODE`.\n * Defaults to `\"oss\"` — the safest default for self-hosters who deploy\n * without setting the variable.\n */\nexport function getInstanceMode(): InstanceMode {\n\tconst raw = process.env.INSTANCE_MODE?.trim().toLowerCase();\n\tif (raw && (VALID_MODES as readonly string[]).includes(raw)) {\n\t\treturn raw as InstanceMode;\n\t}\n\treturn \"oss\";\n}\n\n/** True when the active mode is `\"platform\"` (shared multi-tenant). */\nexport function isPlatformMode(): boolean {\n\treturn getInstanceMode() === \"platform\";\n}\n\n/** True when the active mode is `\"oss\"` (self-hosted). */\nexport function isOssMode(): boolean {\n\treturn getInstanceMode() === \"oss\";\n}\n",
-    "import { createCipheriv, createDecipheriv, randomBytes } from \"node:crypto\";\nimport {\n\tappendFileSync,\n\tcloseSync,\n\texistsSync,\n\topenSync,\n\treadFileSync,\n\tunlinkSync,\n} from \"node:fs\";\nimport { resolve } from \"node:path\";\nimport { getInstanceMode } from \"../mode.ts\";\n\n/**\n * AES-256-GCM symmetric envelope for encrypted secrets at rest (tenant keys,\n * subscription signing secrets, etc.).\n *\n * Ciphertext layout: `iv (12 bytes) || authTag (16 bytes) || ciphertext`\n *\n * The key comes from `SECONDLAYER_SECRETS_KEY` — 32 bytes hex. In OSS mode,\n * if the env var is unset on first use we autogenerate a key and persist it\n * to `.env.local` in the current working directory so subsequent restarts\n * pick it up without user intervention. Dedicated/platform modes throw —\n * those runtimes must provision the key explicitly.\n *\n * Rotation strategy: re-encrypt all rows with the new key and swap the env\n * var. Not zero-downtime, but acceptable at v2 scale. For real KMS (AWS\n * KMS, Vault, GCP KMS), wrap the same byte layout behind an\n * `EncryptSecret`/`DecryptSecret` interface and swap at startup.\n */\n\nconst KEY_ENV = \"SECONDLAYER_SECRETS_KEY\";\nconst IV_LEN = 12;\nconst TAG_LEN = 16;\n\nfunction readExistingKey(envPath: string): string | null {\n\tif (!existsSync(envPath)) return null;\n\tconst contents = readFileSync(envPath, \"utf8\");\n\tconst match = contents.match(/^SECONDLAYER_SECRETS_KEY=([a-fA-F0-9]{64})/m);\n\t// biome-ignore lint/style/noNonNullAssertion: value is non-null after preceding check or by construction; TS narrowing limitation\n\treturn match ? match[1]! : null;\n}\n\n/**\n * Atomic file lock via `openSync(..., \"wx\")` — O_CREAT | O_EXCL. If two\n * processes race on cold-compose start, exactly one creates the lock\n * file; the loser polls until the winner finishes writing `.env.local`,\n * then reads the winner's key. Stale locks (process crashed mid-write)\n * are cleaned after `STALE_LOCK_MS`.\n */\nconst STALE_LOCK_MS = 10_000;\nconst POLL_MS = 25;\n\nfunction bootstrapOssKey(): string {\n\tconst envPath = resolve(process.cwd(), \".env.local\");\n\n\t// Fast path — key already on disk from a prior run.\n\tconst existing = readExistingKey(envPath);\n\tif (existing) {\n\t\tprocess.env[KEY_ENV] = existing;\n\t\treturn existing;\n\t}\n\n\tconst lockPath = `${envPath}.secret-bootstrap.lock`;\n\tlet lockFd: number | null = null;\n\ttry {\n\t\tlockFd = openSync(lockPath, \"wx\", 0o600);\n\t} catch (err) {\n\t\tconst e = err as NodeJS.ErrnoException;\n\t\tif (e.code !== \"EEXIST\") throw err;\n\t}\n\n\tif (lockFd === null) {\n\t\t// Another process is bootstrapping. Poll for its result.\n\t\tconst deadline = Date.now() + STALE_LOCK_MS;\n\t\twhile (Date.now() < deadline) {\n\t\t\tconst key = readExistingKey(envPath);\n\t\t\tif (key) {\n\t\t\t\tprocess.env[KEY_ENV] = key;\n\t\t\t\treturn key;\n\t\t\t}\n\t\t\tBun.sleepSync(POLL_MS);\n\t\t}\n\t\t// Lock holder died mid-write — force-clean and retry once.\n\t\ttry {\n\t\t\tunlinkSync(lockPath);\n\t\t} catch {}\n\t\treturn bootstrapOssKey();\n\t}\n\n\ttry {\n\t\tconst hex = randomBytes(32).toString(\"hex\");\n\t\tconst line = `${existsSync(envPath) ? \"\\n\" : \"\"}${KEY_ENV}=${hex}\\n`;\n\t\tappendFileSync(envPath, line, { mode: 0o600 });\n\t\tprocess.env[KEY_ENV] = hex;\n\t\tconsole.log(\n\t\t\t`[secondlayer] generated ${KEY_ENV}; saved to ${envPath} (mode 0600)`,\n\t\t);\n\t\treturn hex;\n\t} finally {\n\t\tcloseSync(lockFd);\n\t\ttry {\n\t\t\tunlinkSync(lockPath);\n\t\t} catch {}\n\t}\n}\n\nfunction loadKey(): Buffer {\n\tlet hex = process.env[KEY_ENV];\n\tif (!hex) {\n\t\tif (getInstanceMode() === \"oss\") {\n\t\t\thex = bootstrapOssKey();\n\t\t} else {\n\t\t\tthrow new Error(\n\t\t\t\t`${KEY_ENV} not set. Generate one with: openssl rand -hex 32`,\n\t\t\t);\n\t\t}\n\t}\n\tconst key = Buffer.from(hex, \"hex\");\n\tif (key.length !== 32) {\n\t\tthrow new Error(`${KEY_ENV} must be 32 bytes hex (got ${key.length})`);\n\t}\n\treturn key;\n}\n\nlet _cachedKey: Buffer | null = null;\nfunction getKey(): Buffer {\n\tif (!_cachedKey) _cachedKey = loadKey();\n\treturn _cachedKey;\n}\n\nexport function encryptSecret(plaintext: string): Buffer {\n\tconst key = getKey();\n\tconst iv = randomBytes(IV_LEN);\n\tconst cipher = createCipheriv(\"aes-256-gcm\", key, iv);\n\tconst ciphertext = Buffer.concat([\n\t\tcipher.update(plaintext, \"utf8\"),\n\t\tcipher.final(),\n\t]);\n\tconst tag = cipher.getAuthTag();\n\treturn Buffer.concat([iv, tag, ciphertext]);\n}\n\nexport function decryptSecret(envelope: Buffer): string {\n\tconst key = getKey();\n\tconst iv = envelope.subarray(0, IV_LEN);\n\tconst tag = envelope.subarray(IV_LEN, IV_LEN + TAG_LEN);\n\tconst ciphertext = envelope.subarray(IV_LEN + TAG_LEN);\n\tconst decipher = createDecipheriv(\"aes-256-gcm\", key, iv);\n\tdecipher.setAuthTag(tag);\n\treturn decipher.update(ciphertext).toString(\"utf8\") + decipher.final(\"utf8\");\n}\n\n/** Generate a fresh 32-byte hex key suitable for `SECONDLAYER_SECRETS_KEY`. */\nexport function generateSecretsKey(): string {\n\treturn randomBytes(32).toString(\"hex\");\n}\n"
+    "import { createCipheriv, createDecipheriv, randomBytes } from \"node:crypto\";\nimport {\n\tappendFileSync,\n\tcloseSync,\n\texistsSync,\n\topenSync,\n\treadFileSync,\n\tunlinkSync,\n} from \"node:fs\";\nimport { resolve } from \"node:path\";\nimport { getInstanceMode } from \"../mode.ts\";\n\n/**\n * AES-256-GCM symmetric envelope for encrypted secrets at rest (tenant keys,\n * subscription signing secrets, etc.).\n *\n * Ciphertext layout: `iv (12 bytes) || authTag (16 bytes) || ciphertext`\n *\n * The key comes from `SECONDLAYER_SECRETS_KEY` — 32 bytes hex. In OSS mode,\n * if the env var is unset on first use we autogenerate a key and persist it\n * to `.env.local` in the current working directory so subsequent restarts\n * pick it up without user intervention. Dedicated/platform modes throw —\n * those runtimes must provision the key explicitly.\n *\n * Rotation strategy: re-encrypt all rows with the new key and swap the env\n * var. Not zero-downtime, but acceptable at v2 scale. For real KMS (AWS\n * KMS, Vault, GCP KMS), wrap the same byte layout behind an\n * `EncryptSecret`/`DecryptSecret` interface and swap at startup.\n */\n\nconst KEY_ENV = \"SECONDLAYER_SECRETS_KEY\";\nconst IV_LEN = 12;\nconst TAG_LEN = 16;\n\nfunction readExistingKey(envPath: string): string | null {\n\tif (!existsSync(envPath)) return null;\n\tconst contents = readFileSync(envPath, \"utf8\");\n\tconst match = contents.match(/^SECONDLAYER_SECRETS_KEY=([a-fA-F0-9]{64})/m);\n\t// biome-ignore lint/style/noNonNullAssertion: value is non-null after preceding check or by construction; TS narrowing limitation\n\treturn match ? match[1]! : null;\n}\n\n/**\n * Atomic file lock via `openSync(..., \"wx\")` — O_CREAT | O_EXCL. If two\n * processes race on cold-compose start, exactly one creates the lock\n * file; the loser polls until the winner finishes writing `.env.local`,\n * then reads the winner's key. Stale locks (process crashed mid-write)\n * are cleaned after `STALE_LOCK_MS`.\n */\nconst STALE_LOCK_MS = 10_000;\nconst POLL_MS = 25;\n\nfunction bootstrapOssKey(): string {\n\tconst envPath = resolve(process.cwd(), \".env.local\");\n\n\t// Fast path — key already on disk from a prior run.\n\tconst existing = readExistingKey(envPath);\n\tif (existing) {\n\t\tprocess.env[KEY_ENV] = existing;\n\t\treturn existing;\n\t}\n\n\tconst lockPath = `${envPath}.secret-bootstrap.lock`;\n\tlet lockFd: number | null = null;\n\ttry {\n\t\tlockFd = openSync(lockPath, \"wx\", 0o600);\n\t} catch (err) {\n\t\tconst e = err as NodeJS.ErrnoException;\n\t\tif (e.code !== \"EEXIST\") throw err;\n\t}\n\n\tif (lockFd === null) {\n\t\t// Another process is bootstrapping. Poll for its result.\n\t\tconst deadline = Date.now() + STALE_LOCK_MS;\n\t\twhile (Date.now() < deadline) {\n\t\t\tconst key = readExistingKey(envPath);\n\t\t\tif (key) {\n\t\t\t\tprocess.env[KEY_ENV] = key;\n\t\t\t\treturn key;\n\t\t\t}\n\t\t\tBun.sleepSync(POLL_MS);\n\t\t}\n\t\t// Lock holder died mid-write — force-clean and retry once.\n\t\ttry {\n\t\t\tunlinkSync(lockPath);\n\t\t} catch {}\n\t\treturn bootstrapOssKey();\n\t}\n\n\ttry {\n\t\tconst hex = randomBytes(32).toString(\"hex\");\n\t\tconst line = `${existsSync(envPath) ? \"\\n\" : \"\"}${KEY_ENV}=${hex}\\n`;\n\t\tappendFileSync(envPath, line, { mode: 0o600 });\n\t\tprocess.env[KEY_ENV] = hex;\n\t\tconsole.log(\n\t\t\t`[secondlayer] generated ${KEY_ENV}; saved to ${envPath} (mode 0600)`,\n\t\t);\n\t\treturn hex;\n\t} finally {\n\t\tcloseSync(lockFd);\n\t\ttry {\n\t\t\tunlinkSync(lockPath);\n\t\t} catch {}\n\t}\n}\n\nfunction loadKey(): Buffer {\n\tlet hex = process.env[KEY_ENV];\n\tif (!hex) {\n\t\tif (getInstanceMode() === \"oss\") {\n\t\t\thex = bootstrapOssKey();\n\t\t} else {\n\t\t\tthrow new Error(\n\t\t\t\t`${KEY_ENV} not set. Generate one with: openssl rand -hex 32`,\n\t\t\t);\n\t\t}\n\t}\n\tconst key = Buffer.from(hex, \"hex\");\n\tif (key.length !== 32) {\n\t\tthrow new Error(`${KEY_ENV} must be 32 bytes hex (got ${key.length})`);\n\t}\n\treturn key;\n}\n\nlet _cachedKey: Buffer | null = null;\nfunction getKey(): Buffer {\n\tif (!_cachedKey) _cachedKey = loadKey();\n\treturn _cachedKey;\n}\n\n/**\n * Non-throwing check for whether a secrets key is currently resolvable —\n * same resolution order as {@link loadKey} (env var, then the OSS\n * `.env.local` fallback), but never bootstraps a new key (that would\n * generate+persist a key as a side effect of a mere existence check), never\n * throws, and never returns or logs the key itself. Used by callers that\n * need to fail loud on a missing key BEFORE attempting a decrypt (f072).\n */\nexport function secretsKeyAvailable(): boolean {\n\tif (process.env[KEY_ENV]) return true;\n\tif (getInstanceMode() === \"oss\") {\n\t\tconst envPath = resolve(process.cwd(), \".env.local\");\n\t\treturn readExistingKey(envPath) !== null;\n\t}\n\treturn false;\n}\n\nexport function encryptSecret(plaintext: string): Buffer {\n\tconst key = getKey();\n\tconst iv = randomBytes(IV_LEN);\n\tconst cipher = createCipheriv(\"aes-256-gcm\", key, iv);\n\tconst ciphertext = Buffer.concat([\n\t\tcipher.update(plaintext, \"utf8\"),\n\t\tcipher.final(),\n\t]);\n\tconst tag = cipher.getAuthTag();\n\treturn Buffer.concat([iv, tag, ciphertext]);\n}\n\nexport function decryptSecret(envelope: Buffer): string {\n\tconst key = getKey();\n\tconst iv = envelope.subarray(0, IV_LEN);\n\tconst tag = envelope.subarray(IV_LEN, IV_LEN + TAG_LEN);\n\tconst ciphertext = envelope.subarray(IV_LEN + TAG_LEN);\n\tconst decipher = createDecipheriv(\"aes-256-gcm\", key, iv);\n\tdecipher.setAuthTag(tag);\n\treturn decipher.update(ciphertext).toString(\"utf8\") + decipher.final(\"utf8\");\n}\n\n/** Generate a fresh 32-byte hex key suitable for `SECONDLAYER_SECRETS_KEY`. */\nexport function generateSecretsKey(): string {\n\treturn randomBytes(32).toString(\"hex\");\n}\n"
   ],
-  "mappings": ";;;;;;;;;;;;;;;;;AAcA,IAAM,cAAuC,CAAC,OAAO,UAAU;AAOxD,SAAS,eAAe,GAAiB;AAAA,EAC/C,MAAM,MAAM,QAAQ,IAAI,eAAe,KAAK,EAAE,YAAY;AAAA,EAC1D,IAAI,OAAQ,YAAkC,SAAS,GAAG,GAAG;AAAA,IAC5D,OAAO;AAAA,EACR;AAAA,EACA,OAAO;AAAA;AAID,SAAS,cAAc,GAAY;AAAA,EACzC,OAAO,gBAAgB,MAAM;AAAA;AAIvB,SAAS,SAAS,GAAY;AAAA,EACpC,OAAO,gBAAgB,MAAM;AAAA;;;ACpC9B;AACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQA;AAqBA,IAAM,UAAU;AAChB,IAAM,SAAS;AACf,IAAM,UAAU;AAEhB,SAAS,eAAe,CAAC,SAAgC;AAAA,EACxD,IAAI,CAAC,WAAW,OAAO;AAAA,IAAG,OAAO;AAAA,EACjC,MAAM,WAAW,aAAa,SAAS,MAAM;AAAA,EAC7C,MAAM,QAAQ,SAAS,MAAM,6CAA6C;AAAA,EAE1E,OAAO,QAAQ,MAAM,KAAM;AAAA;AAU5B,IAAM,gBAAgB;AACtB,IAAM,UAAU;AAEhB,SAAS,eAAe,GAAW;AAAA,EAClC,MAAM,UAAU,QAAQ,QAAQ,IAAI,GAAG,YAAY;AAAA,EAGnD,MAAM,WAAW,gBAAgB,OAAO;AAAA,EACxC,IAAI,UAAU;AAAA,IACb,QAAQ,IAAI,WAAW;AAAA,IACvB,OAAO;AAAA,EACR;AAAA,EAEA,MAAM,WAAW,GAAG;AAAA,EACpB,IAAI,SAAwB;AAAA,EAC5B,IAAI;AAAA,IACH,SAAS,SAAS,UAAU,MAAM,GAAK;AAAA,IACtC,OAAO,KAAK;AAAA,IACb,MAAM,IAAI;AAAA,IACV,IAAI,EAAE,SAAS;AAAA,MAAU,MAAM;AAAA;AAAA,EAGhC,IAAI,WAAW,MAAM;AAAA,IAEpB,MAAM,WAAW,KAAK,IAAI,IAAI;AAAA,IAC9B,OAAO,KAAK,IAAI,IAAI,UAAU;AAAA,MAC7B,MAAM,MAAM,gBAAgB,OAAO;AAAA,MACnC,IAAI,KAAK;AAAA,QACR,QAAQ,IAAI,WAAW;AAAA,QACvB,OAAO;AAAA,MACR;AAAA,MACA,IAAI,UAAU,OAAO;AAAA,IACtB;AAAA,IAEA,IAAI;AAAA,MACH,WAAW,QAAQ;AAAA,MAClB,MAAM;AAAA,IACR,OAAO,gBAAgB;AAAA,EACxB;AAAA,EAEA,IAAI;AAAA,IACH,MAAM,MAAM,YAAY,EAAE,EAAE,SAAS,KAAK;AAAA,IAC1C,MAAM,OAAO,GAAG,WAAW,OAAO,IAAI;AAAA,IAAO,KAAK,WAAW;AAAA;AAAA,IAC7D,eAAe,SAAS,MAAM,EAAE,MAAM,IAAM,CAAC;AAAA,IAC7C,QAAQ,IAAI,WAAW;AAAA,IACvB,QAAQ,IACP,2BAA2B,qBAAqB,qBACjD;AAAA,IACA,OAAO;AAAA,YACN;AAAA,IACD,UAAU,MAAM;AAAA,IAChB,IAAI;AAAA,MACH,WAAW,QAAQ;AAAA,MAClB,MAAM;AAAA;AAAA;AAIV,SAAS,OAAO,GAAW;AAAA,EAC1B,IAAI,MAAM,QAAQ,IAAI;AAAA,EACtB,IAAI,CAAC,KAAK;AAAA,IACT,IAAI,gBAAgB,MAAM,OAAO;AAAA,MAChC,MAAM,gBAAgB;AAAA,IACvB,EAAO;AAAA,MACN,MAAM,IAAI,MACT,GAAG,0DACJ;AAAA;AAAA,EAEF;AAAA,EACA,MAAM,MAAM,OAAO,KAAK,KAAK,KAAK;AAAA,EAClC,IAAI,IAAI,WAAW,IAAI;AAAA,IACtB,MAAM,IAAI,MAAM,GAAG,qCAAqC,IAAI,SAAS;AAAA,EACtE;AAAA,EACA,OAAO;AAAA;AAGR,IAAI,aAA4B;AAChC,SAAS,MAAM,GAAW;AAAA,EACzB,IAAI,CAAC;AAAA,IAAY,aAAa,QAAQ;AAAA,EACtC,OAAO;AAAA;AAGD,SAAS,aAAa,CAAC,WAA2B;AAAA,EACxD,MAAM,MAAM,OAAO;AAAA,EACnB,MAAM,KAAK,YAAY,MAAM;AAAA,EAC7B,MAAM,SAAS,eAAe,eAAe,KAAK,EAAE;AAAA,EACpD,MAAM,aAAa,OAAO,OAAO;AAAA,IAChC,OAAO,OAAO,WAAW,MAAM;AAAA,IAC/B,OAAO,MAAM;AAAA,EACd,CAAC;AAAA,EACD,MAAM,MAAM,OAAO,WAAW;AAAA,EAC9B,OAAO,OAAO,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC;AAAA;AAGpC,SAAS,aAAa,CAAC,UAA0B;AAAA,EACvD,MAAM,MAAM,OAAO;AAAA,EACnB,MAAM,KAAK,SAAS,SAAS,GAAG,MAAM;AAAA,EACtC,MAAM,MAAM,SAAS,SAAS,QAAQ,SAAS,OAAO;AAAA,EACtD,MAAM,aAAa,SAAS,SAAS,SAAS,OAAO;AAAA,EACrD,MAAM,WAAW,iBAAiB,eAAe,KAAK,EAAE;AAAA,EACxD,SAAS,WAAW,GAAG;AAAA,EACvB,OAAO,SAAS,OAAO,UAAU,EAAE,SAAS,MAAM,IAAI,SAAS,MAAM,MAAM;AAAA;AAIrE,SAAS,kBAAkB,GAAW;AAAA,EAC5C,OAAO,YAAY,EAAE,EAAE,SAAS,KAAK;AAAA;",
-  "debugId": "40A784140E79E07464756E2164756E21",
+  "mappings": ";;;;;;;;;;;;;;;;;AAcA,IAAM,cAAuC,CAAC,OAAO,UAAU;AAOxD,SAAS,eAAe,GAAiB;AAAA,EAC/C,MAAM,MAAM,QAAQ,IAAI,eAAe,KAAK,EAAE,YAAY;AAAA,EAC1D,IAAI,OAAQ,YAAkC,SAAS,GAAG,GAAG;AAAA,IAC5D,OAAO;AAAA,EACR;AAAA,EACA,OAAO;AAAA;AAID,SAAS,cAAc,GAAY;AAAA,EACzC,OAAO,gBAAgB,MAAM;AAAA;AAIvB,SAAS,SAAS,GAAY;AAAA,EACpC,OAAO,gBAAgB,MAAM;AAAA;;;ACpC9B;AACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQA;AAqBA,IAAM,UAAU;AAChB,IAAM,SAAS;AACf,IAAM,UAAU;AAEhB,SAAS,eAAe,CAAC,SAAgC;AAAA,EACxD,IAAI,CAAC,WAAW,OAAO;AAAA,IAAG,OAAO;AAAA,EACjC,MAAM,WAAW,aAAa,SAAS,MAAM;AAAA,EAC7C,MAAM,QAAQ,SAAS,MAAM,6CAA6C;AAAA,EAE1E,OAAO,QAAQ,MAAM,KAAM;AAAA;AAU5B,IAAM,gBAAgB;AACtB,IAAM,UAAU;AAEhB,SAAS,eAAe,GAAW;AAAA,EAClC,MAAM,UAAU,QAAQ,QAAQ,IAAI,GAAG,YAAY;AAAA,EAGnD,MAAM,WAAW,gBAAgB,OAAO;AAAA,EACxC,IAAI,UAAU;AAAA,IACb,QAAQ,IAAI,WAAW;AAAA,IACvB,OAAO;AAAA,EACR;AAAA,EAEA,MAAM,WAAW,GAAG;AAAA,EACpB,IAAI,SAAwB;AAAA,EAC5B,IAAI;AAAA,IACH,SAAS,SAAS,UAAU,MAAM,GAAK;AAAA,IACtC,OAAO,KAAK;AAAA,IACb,MAAM,IAAI;AAAA,IACV,IAAI,EAAE,SAAS;AAAA,MAAU,MAAM;AAAA;AAAA,EAGhC,IAAI,WAAW,MAAM;AAAA,IAEpB,MAAM,WAAW,KAAK,IAAI,IAAI;AAAA,IAC9B,OAAO,KAAK,IAAI,IAAI,UAAU;AAAA,MAC7B,MAAM,MAAM,gBAAgB,OAAO;AAAA,MACnC,IAAI,KAAK;AAAA,QACR,QAAQ,IAAI,WAAW;AAAA,QACvB,OAAO;AAAA,MACR;AAAA,MACA,IAAI,UAAU,OAAO;AAAA,IACtB;AAAA,IAEA,IAAI;AAAA,MACH,WAAW,QAAQ;AAAA,MAClB,MAAM;AAAA,IACR,OAAO,gBAAgB;AAAA,EACxB;AAAA,EAEA,IAAI;AAAA,IACH,MAAM,MAAM,YAAY,EAAE,EAAE,SAAS,KAAK;AAAA,IAC1C,MAAM,OAAO,GAAG,WAAW,OAAO,IAAI;AAAA,IAAO,KAAK,WAAW;AAAA;AAAA,IAC7D,eAAe,SAAS,MAAM,EAAE,MAAM,IAAM,CAAC;AAAA,IAC7C,QAAQ,IAAI,WAAW;AAAA,IACvB,QAAQ,IACP,2BAA2B,qBAAqB,qBACjD;AAAA,IACA,OAAO;AAAA,YACN;AAAA,IACD,UAAU,MAAM;AAAA,IAChB,IAAI;AAAA,MACH,WAAW,QAAQ;AAAA,MAClB,MAAM;AAAA;AAAA;AAIV,SAAS,OAAO,GAAW;AAAA,EAC1B,IAAI,MAAM,QAAQ,IAAI;AAAA,EACtB,IAAI,CAAC,KAAK;AAAA,IACT,IAAI,gBAAgB,MAAM,OAAO;AAAA,MAChC,MAAM,gBAAgB;AAAA,IACvB,EAAO;AAAA,MACN,MAAM,IAAI,MACT,GAAG,0DACJ;AAAA;AAAA,EAEF;AAAA,EACA,MAAM,MAAM,OAAO,KAAK,KAAK,KAAK;AAAA,EAClC,IAAI,IAAI,WAAW,IAAI;AAAA,IACtB,MAAM,IAAI,MAAM,GAAG,qCAAqC,IAAI,SAAS;AAAA,EACtE;AAAA,EACA,OAAO;AAAA;AAGR,IAAI,aAA4B;AAChC,SAAS,MAAM,GAAW;AAAA,EACzB,IAAI,CAAC;AAAA,IAAY,aAAa,QAAQ;AAAA,EACtC,OAAO;AAAA;AAWD,SAAS,mBAAmB,GAAY;AAAA,EAC9C,IAAI,QAAQ,IAAI;AAAA,IAAU,OAAO;AAAA,EACjC,IAAI,gBAAgB,MAAM,OAAO;AAAA,IAChC,MAAM,UAAU,QAAQ,QAAQ,IAAI,GAAG,YAAY;AAAA,IACnD,OAAO,gBAAgB,OAAO,MAAM;AAAA,EACrC;AAAA,EACA,OAAO;AAAA;AAGD,SAAS,aAAa,CAAC,WAA2B;AAAA,EACxD,MAAM,MAAM,OAAO;AAAA,EACnB,MAAM,KAAK,YAAY,MAAM;AAAA,EAC7B,MAAM,SAAS,eAAe,eAAe,KAAK,EAAE;AAAA,EACpD,MAAM,aAAa,OAAO,OAAO;AAAA,IAChC,OAAO,OAAO,WAAW,MAAM;AAAA,IAC/B,OAAO,MAAM;AAAA,EACd,CAAC;AAAA,EACD,MAAM,MAAM,OAAO,WAAW;AAAA,EAC9B,OAAO,OAAO,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC;AAAA;AAGpC,SAAS,aAAa,CAAC,UAA0B;AAAA,EACvD,MAAM,MAAM,OAAO;AAAA,EACnB,MAAM,KAAK,SAAS,SAAS,GAAG,MAAM;AAAA,EACtC,MAAM,MAAM,SAAS,SAAS,QAAQ,SAAS,OAAO;AAAA,EACtD,MAAM,aAAa,SAAS,SAAS,SAAS,OAAO;AAAA,EACrD,MAAM,WAAW,iBAAiB,eAAe,KAAK,EAAE;AAAA,EACxD,SAAS,WAAW,GAAG;AAAA,EACvB,OAAO,SAAS,OAAO,UAAU,EAAE,SAAS,MAAM,IAAI,SAAS,MAAM,MAAM;AAAA;AAIrE,SAAS,kBAAkB,GAAW;AAAA,EAC5C,OAAO,YAAY,EAAE,EAAE,SAAS,KAAK;AAAA;",
+  "debugId": "D05BC92983E1614B64756E2164756E21",
   "names": []
 }

package/dist/src/db/queries/subgraphs.d.ts

@@ -1031,6 +1031,22 @@ declare function listSubgraphs(db: Kysely<Database>, accountId?: string): Promis
 declare function findPublicSubgraphByName(db: Kysely<Database>, name: string): Promise<Subgraph | null>;
 declare function updateSubgraphVisibility(db: Kysely<Database>, name: string, accountId: string, visibility: "public" | "private"): Promise<void>;
 declare function updateSubgraphStatus(db: Kysely<Database>, name: string, status: string, lastProcessedBlock?: number): Promise<void>;
+/** Live-walk ERROR write (f069): a block whose handlers ALL failed
+*  (`processed === 0 && errors > 0`, `block-processor.ts`'s `applyProgress`)
+*  is stamped 'error' and its height is recorded as processed, same as
+*  `updateSubgraphStatus(db, name, "error", blockHeight)` — except the
+*  cursor half of that write now goes through the same conditional `<`
+*  guard as {@link recordLiveProgress}. Marking a subgraph 'error' is not
+*  itself replay-sensitive, but it shares the `last_processed_block` column
+*  with the replay guard: an unconditional write here could regress the
+*  cursor a racing (successful) writer already advanced past, which is
+*  exactly the regress-then-re-walk loop this guard exists to close. In
+*  practice `ctx.rollbackTo` (`runner.ts`) means an all-failed block never
+*  flushes writes, so a lost race here is always a silent no-op, never a
+*  case that needs `CursorRaceLostError`-style tx abort. Returns whether
+*  the write applied. Live path only — reindex/backfill's error stamping
+*  goes through {@link updateSubgraphStatus} unconditionally, as before. */
+declare function recordLiveError(db: Kysely<Database>, name: string, blockHeight: number): Promise<boolean>;
 declare function recordSubgraphProcessed(db: Kysely<Database>, name: string, processed: number, errors: number, lastError?: string): Promise<void>;
 declare function updateSubgraphHandlerPath(db: Kysely<Database>, name: string, handlerPath: string, opts?: {
 	handlerCode?: string
@@ -1045,16 +1061,49 @@ declare function updateSubgraphExpiry(db: Kysely<Database>, name: string, accoun
 *  status stamping let catch-up flap a parked subgraph back into its own path
 *  per block, fighting the queued reindex op.
 *
-*  `last_processed_block` itself is written UNCONDITIONALLY — no monotonic
-*  guard — on purpose: a reorg rewind must be able to move it *backward* to
-*  the fork height, and a naive GREATEST(old, new) would block that. This
-*  only stays correct because the two writers that can advance/rewind a
-*  given subgraph's cursor concurrently (the catch-up walk and the reorg
-*  handler, both in `@secondlayer/subgraphs/runtime`) serialize on an
-*  in-process per-subgraph lock + reorg epoch guard
-*  (`packages/subgraphs/src/runtime/catchup.ts`, `subgraphBlockLockHeld` /
-*  `reorgEpoch` — see the comment there for the full invariant; f057). Don't
-*  add a monotonic guard here without re-deriving that it can't also block
-*  the rewind. */
-declare function recordLiveProgress(db: Kysely<Database>, name: string, lastProcessedBlock: number): Promise<void>;
-export { updateSubgraphVisibility, updateSubgraphStatus, updateSubgraphHandlerPath, updateSubgraphExpiry, subgraphDatabaseUrl, resolveSubgraphRawClient, resolveSubgraphDb, registerSubgraph, recordSubgraphProcessed, recordLiveProgress, pgSchemaNameFor, pgSchemaName, listSubgraphs, isByoSubgraph, getSubgraph, findPublicSubgraphByName, encryptDatabaseUrl, deleteSubgraph };
+*  `last_processed_block` is now written CONDITIONALLY — `WHERE
+*  last_processed_block < lastProcessedBlock`, mirroring
+*  `advanceOperationCursor`'s (`subgraph-operations.ts`) comparison shape —
+*  and returns whether THIS call actually advanced it. This used to be
+*  unconditional by design, on the premise that the only two writers able to
+*  advance/rewind a given subgraph's cursor concurrently (the catch-up walk
+*  and the reorg handler) serialize on an in-process per-subgraph lock +
+*  reorg epoch guard (`packages/subgraphs/src/runtime/catchup.ts`,
+*  `subgraphBlockLockHeld` / `reorgEpoch`; f057). That guard is in-process
+*  only. The f068 investigation
+*  (`docs/internal/audits/asset-holdings-unreproducible-balances-f068.md`)
+*  found a cross-process sequence it does not cover: a catch-up leader that
+*  loses its advisory-lock connection mid-walk keeps writing (leadership is
+*  checked only at walk entry, not per-iteration) while a new leader takes
+*  over and walks the same range — both commit increments for overlapping
+*  heights, and every regressed cursor write from the laggard re-triggers a
+*  full re-walk, growing per-height application without bound. The
+*  conditional advance here (paired with the fast-path replay guard armed on
+*  the live path in `block-processor.ts`) is now the cross-process
+*  guarantee: a block at/below the current cursor can never re-advance it,
+*  so a laggard's commits can no longer regress-then-retrigger.
+*
+*  This conditionality is why the reorg rewind can no longer go through this
+*  function — a rewind's whole point is to move the cursor *backward*, which
+*  the `<` guard would silently refuse. Reorg mode calls
+*  {@link rewindLiveProgress} instead, which keeps the old unconditional
+*  semantics and is safe specifically because the reorg path takes a
+*  transaction-scoped advisory lock (`reorg.ts`) other writers can't cross. */
+declare function recordLiveProgress(db: Kysely<Database>, name: string, lastProcessedBlock: number): Promise<boolean>;
+/** Reorg-rewind progress write: the OLD unconditional `recordLiveProgress`
+*  semantics, verbatim — moves `last_processed_block` to the fork height
+*  regardless of its current value, because that is by definition a
+*  backward move the conditional `<` guard in `recordLiveProgress` would
+*  refuse. Same status-promotion CASE (never unparks an explicit
+*  'reindexing').
+*
+*  Callers: exclusively the subgraph-reorg path
+*  (`packages/subgraphs/src/runtime/reorg.ts`, via `block-processor.ts`'s
+*  `reorgRewind` mode), which is safe from the cross-process race this
+*  function reintroduces because it holds a transaction-scoped Postgres
+*  advisory lock (`pg_advisory_xact_lock`) for the whole
+*  delete+reprocess+rewind sequence — no other writer can interleave a
+*  forward write between the rewind and the fork block's reprocess. Do not
+*  call this from the live catch-up path. */
+declare function rewindLiveProgress(db: Kysely<Database>, name: string, lastProcessedBlock: number): Promise<void>;
+export { updateSubgraphVisibility, updateSubgraphStatus, updateSubgraphHandlerPath, updateSubgraphExpiry, subgraphDatabaseUrl, rewindLiveProgress, resolveSubgraphRawClient, resolveSubgraphDb, registerSubgraph, recordSubgraphProcessed, recordLiveProgress, recordLiveError, pgSchemaNameFor, pgSchemaName, listSubgraphs, isByoSubgraph, getSubgraph, findPublicSubgraphByName, encryptDatabaseUrl, deleteSubgraph };

package/dist/src/db/queries/subgraphs.js

@@ -986,6 +986,15 @@ function getKey() {
     _cachedKey = loadKey();
   return _cachedKey;
 }
+function secretsKeyAvailable() {
+  if (process.env[KEY_ENV])
+    return true;
+  if (getInstanceMode() === "oss") {
+    const envPath = resolve(process.cwd(), ".env.local");
+    return readExistingKey(envPath) !== null;
+  }
+  return false;
+}
 function encryptSecret(plaintext) {
   const key = getKey();
   const iv = randomBytes(IV_LEN);
@@ -1093,6 +1102,14 @@ async function updateSubgraphStatus(db, name, status, lastProcessedBlock) {
     updated_at: new Date
   }).where("name", "=", name).execute();
 }
+async function recordLiveError(db, name, blockHeight) {
+  const result = await db.updateTable("subgraphs").set({
+    status: "error",
+    last_processed_block: blockHeight,
+    updated_at: new Date
+  }).where("name", "=", name).where("last_processed_block", "<", blockHeight).executeTakeFirst();
+  return Number(result.numUpdatedRows ?? 0n) > 0;
+}
 async function recordSubgraphProcessed(db, name, processed, errors, lastError) {
   await db.updateTable("subgraphs").set({
     total_processed: sql3`total_processed + ${processed}`,
@@ -1130,6 +1147,14 @@ async function updateSubgraphExpiry(db, name, accountId, expiresAt) {
   await db.updateTable("subgraphs").set({ expires_at: expiresAt }).where("name", "=", name).where("account_id", "=", accountId).execute();
 }
 async function recordLiveProgress(db, name, lastProcessedBlock) {
+  const result = await db.updateTable("subgraphs").set({
+    last_processed_block: lastProcessedBlock,
+    status: sql3`CASE WHEN status = 'reindexing' THEN status ELSE 'active' END`,
+    updated_at: new Date
+  }).where("name", "=", name).where("last_processed_block", "<", lastProcessedBlock).executeTakeFirst();
+  return Number(result.numUpdatedRows ?? 0n) > 0;
+}
+async function rewindLiveProgress(db, name, lastProcessedBlock) {
   await db.updateTable("subgraphs").set({
     last_processed_block: lastProcessedBlock,
     status: sql3`CASE WHEN status = 'reindexing' THEN status ELSE 'active' END`,
@@ -1142,11 +1167,13 @@ export {
   updateSubgraphHandlerPath,
   updateSubgraphExpiry,
   subgraphDatabaseUrl,
+  rewindLiveProgress,
   resolveSubgraphRawClient,
   resolveSubgraphDb,
   registerSubgraph,
   recordSubgraphProcessed,
   recordLiveProgress,
+  recordLiveError,
   pgSchemaNameFor,
   pgSchemaName,
   listSubgraphs,
@@ -1157,5 +1184,5 @@ export {
   deleteSubgraph
 };
 
-//# debugId=EB2E9A3BA7B8FF6964756E2164756E21
+//# debugId=1A6BD206140BEBFE64756E2164756E21
 //# sourceMappingURL=subgraphs.js.map

package/dist/src/db/queries/subgraphs.js.map

@@ -10,10 +10,10 @@
     "/**\n * Per-migration DB-plane gating for the source/target split.\n *\n * Under the split, SOURCE (chain DB) holds only chain+decoded tables — the\n * control-plane tables were dropped to reclaim space — while TARGET (platform\n * DB) holds the control plane. `migrate.ts` still runs EVERY migration on EVERY\n * database (kysely integrity: the provider set must never be filtered per-DB, or\n * kysely throws \"previously executed migration is missing\" because each DB's\n * `kysely_migration` already records all of them). Instead, `migrate.ts` sets a\n * role before each pass and a migration gates its DDL with the helpers below: a\n * control migration's `up()` is a no-op on SOURCE but is still recorded applied,\n * so there is no missing-migration error and no re-run.\n *\n * `'both'` is single-DB / collapsed-split mode (dev / OSS / CI): every helper\n * runs, identical to pre-split behavior.\n *\n * Authoring a new migration under the split:\n *   export async function up(db: Kysely<unknown>): Promise<void> {\n *     await onControlPlane(() => sql`ALTER TABLE accounts ADD COLUMN …`.execute(db));\n *     await onChainPlane(() => sql`ALTER TABLE blocks ADD COLUMN …`.execute(db));\n *     // schema-wide / mixed statements: leave unwrapped (run on both).\n *   }\n */\n\nexport type MigrationRole = \"source\" | \"target\" | \"both\";\n\n// Module-level singleton: migrate runs sequentially in one process, one target\n// at a time, so there is no concurrency to guard.\nlet currentRole: MigrationRole = \"both\";\n\nexport function setMigrationRole(role: MigrationRole): void {\n\tcurrentRole = role;\n}\n\nexport function getMigrationRole(): MigrationRole {\n\treturn currentRole;\n}\n\n/** Run control-plane (TARGET) DDL only when this pass targets the control plane. */\nexport async function onControlPlane(fn: () => Promise<void>): Promise<void> {\n\tif (currentRole === \"target\" || currentRole === \"both\") await fn();\n}\n\n/** Run chain/decoded (SOURCE) DDL only when this pass targets the chain plane. */\nexport async function onChainPlane(fn: () => Promise<void>): Promise<void> {\n\tif (currentRole === \"source\" || currentRole === \"both\") await fn();\n}\n",
     "import type { Database } from \"./types.ts\";\n\nexport type DbPlane = \"source\" | \"target\" | \"both\";\n\n/**\n * Canonical table → DB-plane mapping for the source/target split.\n *\n * SOURCE = chain + decoded (the `postgres` instance); TARGET = control plane\n * (the `postgres-platform` instance). `both` = present/used on both planes\n * (`service_heartbeats`: the indexer writes its row on SOURCE, the\n * subgraph-processor writes its row on TARGET).\n *\n * `satisfies Record<keyof Database, DbPlane>` makes adding a table to `Database`\n * without classifying it here a COMPILE error. This is the single source of\n * truth for the split — `docker/SCHEMA_SPLIT.md` and the cutover script's\n * `CONTROL_TABLES` mirror the `target` set (guarded by `table-plane.test.ts`).\n * Use it to decide which migration helper a table's DDL belongs in\n * (`onControlPlane` for `target`, `onChainPlane` for `source`).\n *\n * Note: `kysely_migration` / `kysely_migration_lock` are kysely-managed (not in\n * `Database`) and exist on both — they are intentionally not listed here.\n */\nexport const TABLE_TO_DB = {\n\t// ── SOURCE: raw chain ──\n\tblocks: \"source\",\n\ttransactions: \"source\",\n\tevents: \"source\",\n\ttransactions_archive: \"source\",\n\tevents_archive: \"source\",\n\tdead_letter_events: \"source\",\n\tmempool_transactions: \"source\",\n\tindex_progress: \"source\",\n\tcontracts: \"source\",\n\tchain_reorgs: \"source\",\n\t// Chain-derived read memo — keyed on index_block_hash, lives with the\n\t// blocks it pins to.\n\tchain_read_cache: \"source\",\n\t// Staged fork contenders — raw chain data, resolved during ingest.\n\tpending_fork_blocks: \"source\",\n\t// ── SOURCE: decoded (L2) ──\n\tdecoded_events: \"source\",\n\tdecoder_checkpoints: \"source\",\n\tpox4_calls: \"source\",\n\tpox4_cycles_daily: \"source\",\n\tpox4_signers_daily: \"source\",\n\tpox5_events: \"source\",\n\tburn_block_rewards: \"source\",\n\tburn_block_reward_slots: \"source\",\n\tsbtc_events: \"source\",\n\tsbtc_token_events: \"source\",\n\tsbtc_settlements: \"source\",\n\tsbtc_supply_snapshots: \"source\",\n\tbns_name_events: \"source\",\n\tbns_namespace_events: \"source\",\n\tbns_marketplace_events: \"source\",\n\tbns_names: \"source\",\n\tbns_namespaces: \"source\",\n\t// ── TARGET: accounts / auth / billing ──\n\taccounts: \"target\",\n\tapi_keys: \"target\",\n\tsessions: \"target\",\n\tmagic_links: \"target\",\n\tclaim_tokens: \"target\",\n\tusage_daily: \"target\",\n\tusage_snapshots: \"target\",\n\taccount_insights: \"target\",\n\taccount_agent_runs: \"target\",\n\taccount_spend_caps: \"target\",\n\tprocessed_stripe_events: \"target\",\n\ttenants: \"target\",\n\ttenant_usage_monthly: \"target\",\n\ttenant_compute_addons: \"target\",\n\tprovisioning_audit_log: \"target\",\n\tprojects: \"target\",\n\tteam_members: \"target\",\n\tteam_invitations: \"target\",\n\t// ── TARGET: subscriptions ──\n\tsubscriptions: \"target\",\n\tsubscription_outbox: \"target\",\n\tsubscription_deliveries: \"target\",\n\ttrigger_evaluator_state: \"target\",\n\t// ── TARGET: subgraphs + metadata ──\n\tsubgraphs: \"target\",\n\tsubgraph_operations: \"target\",\n\tsubgraph_health_snapshots: \"target\",\n\tsubgraph_gaps: \"target\",\n\tsubgraph_usage_daily: \"target\",\n\tsubgraph_processing_stats: \"target\",\n\tsubgraph_table_snapshots: \"target\",\n\t// ── TARGET: x402 payment rail ──\n\tx402_payments: \"target\",\n\tx402_balances: \"target\",\n\taccount_credits: \"target\",\n\t// ── BOTH ──\n\tservice_heartbeats: \"both\",\n} satisfies Record<keyof Database, DbPlane>;\n",
     "/**\n * Instance modes for the Secondlayer platform.\n *\n * - `oss`: self-hosted, single-tenant. No auth middleware, no platform routes\n *   (projects, admin). Everything runs against a single `DATABASE_URL`.\n *   Intended for `docker compose up`.\n *\n * - `platform`: control-plane mode. Magic-link auth, API keys, projects,\n *   admin. Serves the dashboard + CLI against a single shared DB. Post\n *   2026-05-14 shared-rip this also serves subgraphs + subscriptions.\n */\n\nexport type InstanceMode = \"oss\" | \"platform\";\n\nconst VALID_MODES: readonly InstanceMode[] = [\"oss\", \"platform\"];\n\n/**\n * Resolve the active instance mode from `process.env.INSTANCE_MODE`.\n * Defaults to `\"oss\"` — the safest default for self-hosters who deploy\n * without setting the variable.\n */\nexport function getInstanceMode(): InstanceMode {\n\tconst raw = process.env.INSTANCE_MODE?.trim().toLowerCase();\n\tif (raw && (VALID_MODES as readonly string[]).includes(raw)) {\n\t\treturn raw as InstanceMode;\n\t}\n\treturn \"oss\";\n}\n\n/** True when the active mode is `\"platform\"` (shared multi-tenant). */\nexport function isPlatformMode(): boolean {\n\treturn getInstanceMode() === \"platform\";\n}\n\n/** True when the active mode is `\"oss\"` (self-hosted). */\nexport function isOssMode(): boolean {\n\treturn getInstanceMode() === \"oss\";\n}\n",
-    "import { createCipheriv, createDecipheriv, randomBytes } from \"node:crypto\";\nimport {\n\tappendFileSync,\n\tcloseSync,\n\texistsSync,\n\topenSync,\n\treadFileSync,\n\tunlinkSync,\n} from \"node:fs\";\nimport { resolve } from \"node:path\";\nimport { getInstanceMode } from \"../mode.ts\";\n\n/**\n * AES-256-GCM symmetric envelope for encrypted secrets at rest (tenant keys,\n * subscription signing secrets, etc.).\n *\n * Ciphertext layout: `iv (12 bytes) || authTag (16 bytes) || ciphertext`\n *\n * The key comes from `SECONDLAYER_SECRETS_KEY` — 32 bytes hex. In OSS mode,\n * if the env var is unset on first use we autogenerate a key and persist it\n * to `.env.local` in the current working directory so subsequent restarts\n * pick it up without user intervention. Dedicated/platform modes throw —\n * those runtimes must provision the key explicitly.\n *\n * Rotation strategy: re-encrypt all rows with the new key and swap the env\n * var. Not zero-downtime, but acceptable at v2 scale. For real KMS (AWS\n * KMS, Vault, GCP KMS), wrap the same byte layout behind an\n * `EncryptSecret`/`DecryptSecret` interface and swap at startup.\n */\n\nconst KEY_ENV = \"SECONDLAYER_SECRETS_KEY\";\nconst IV_LEN = 12;\nconst TAG_LEN = 16;\n\nfunction readExistingKey(envPath: string): string | null {\n\tif (!existsSync(envPath)) return null;\n\tconst contents = readFileSync(envPath, \"utf8\");\n\tconst match = contents.match(/^SECONDLAYER_SECRETS_KEY=([a-fA-F0-9]{64})/m);\n\t// biome-ignore lint/style/noNonNullAssertion: value is non-null after preceding check or by construction; TS narrowing limitation\n\treturn match ? match[1]! : null;\n}\n\n/**\n * Atomic file lock via `openSync(..., \"wx\")` — O_CREAT | O_EXCL. If two\n * processes race on cold-compose start, exactly one creates the lock\n * file; the loser polls until the winner finishes writing `.env.local`,\n * then reads the winner's key. Stale locks (process crashed mid-write)\n * are cleaned after `STALE_LOCK_MS`.\n */\nconst STALE_LOCK_MS = 10_000;\nconst POLL_MS = 25;\n\nfunction bootstrapOssKey(): string {\n\tconst envPath = resolve(process.cwd(), \".env.local\");\n\n\t// Fast path — key already on disk from a prior run.\n\tconst existing = readExistingKey(envPath);\n\tif (existing) {\n\t\tprocess.env[KEY_ENV] = existing;\n\t\treturn existing;\n\t}\n\n\tconst lockPath = `${envPath}.secret-bootstrap.lock`;\n\tlet lockFd: number | null = null;\n\ttry {\n\t\tlockFd = openSync(lockPath, \"wx\", 0o600);\n\t} catch (err) {\n\t\tconst e = err as NodeJS.ErrnoException;\n\t\tif (e.code !== \"EEXIST\") throw err;\n\t}\n\n\tif (lockFd === null) {\n\t\t// Another process is bootstrapping. Poll for its result.\n\t\tconst deadline = Date.now() + STALE_LOCK_MS;\n\t\twhile (Date.now() < deadline) {\n\t\t\tconst key = readExistingKey(envPath);\n\t\t\tif (key) {\n\t\t\t\tprocess.env[KEY_ENV] = key;\n\t\t\t\treturn key;\n\t\t\t}\n\t\t\tBun.sleepSync(POLL_MS);\n\t\t}\n\t\t// Lock holder died mid-write — force-clean and retry once.\n\t\ttry {\n\t\t\tunlinkSync(lockPath);\n\t\t} catch {}\n\t\treturn bootstrapOssKey();\n\t}\n\n\ttry {\n\t\tconst hex = randomBytes(32).toString(\"hex\");\n\t\tconst line = `${existsSync(envPath) ? \"\\n\" : \"\"}${KEY_ENV}=${hex}\\n`;\n\t\tappendFileSync(envPath, line, { mode: 0o600 });\n\t\tprocess.env[KEY_ENV] = hex;\n\t\tconsole.log(\n\t\t\t`[secondlayer] generated ${KEY_ENV}; saved to ${envPath} (mode 0600)`,\n\t\t);\n\t\treturn hex;\n\t} finally {\n\t\tcloseSync(lockFd);\n\t\ttry {\n\t\t\tunlinkSync(lockPath);\n\t\t} catch {}\n\t}\n}\n\nfunction loadKey(): Buffer {\n\tlet hex = process.env[KEY_ENV];\n\tif (!hex) {\n\t\tif (getInstanceMode() === \"oss\") {\n\t\t\thex = bootstrapOssKey();\n\t\t} else {\n\t\t\tthrow new Error(\n\t\t\t\t`${KEY_ENV} not set. Generate one with: openssl rand -hex 32`,\n\t\t\t);\n\t\t}\n\t}\n\tconst key = Buffer.from(hex, \"hex\");\n\tif (key.length !== 32) {\n\t\tthrow new Error(`${KEY_ENV} must be 32 bytes hex (got ${key.length})`);\n\t}\n\treturn key;\n}\n\nlet _cachedKey: Buffer | null = null;\nfunction getKey(): Buffer {\n\tif (!_cachedKey) _cachedKey = loadKey();\n\treturn _cachedKey;\n}\n\nexport function encryptSecret(plaintext: string): Buffer {\n\tconst key = getKey();\n\tconst iv = randomBytes(IV_LEN);\n\tconst cipher = createCipheriv(\"aes-256-gcm\", key, iv);\n\tconst ciphertext = Buffer.concat([\n\t\tcipher.update(plaintext, \"utf8\"),\n\t\tcipher.final(),\n\t]);\n\tconst tag = cipher.getAuthTag();\n\treturn Buffer.concat([iv, tag, ciphertext]);\n}\n\nexport function decryptSecret(envelope: Buffer): string {\n\tconst key = getKey();\n\tconst iv = envelope.subarray(0, IV_LEN);\n\tconst tag = envelope.subarray(IV_LEN, IV_LEN + TAG_LEN);\n\tconst ciphertext = envelope.subarray(IV_LEN + TAG_LEN);\n\tconst decipher = createDecipheriv(\"aes-256-gcm\", key, iv);\n\tdecipher.setAuthTag(tag);\n\treturn decipher.update(ciphertext).toString(\"utf8\") + decipher.final(\"utf8\");\n}\n\n/** Generate a fresh 32-byte hex key suitable for `SECONDLAYER_SECRETS_KEY`. */\nexport function generateSecretsKey(): string {\n\treturn randomBytes(32).toString(\"hex\");\n}\n",
-    "import { type Kysely, sql } from \"kysely\";\nimport type postgres from \"postgres\";\nimport { decryptSecret, encryptSecret } from \"../../crypto/secrets.ts\";\nimport { getDb, getRawClient, getRawClientFor, getTargetDb } from \"../index.ts\";\nimport { jsonb } from \"../jsonb.ts\";\nimport type { Database, Subgraph } from \"../types.ts\";\n\n/**\n * BYO data plane helpers. A subgraph's user-owned Postgres connection string is\n * stored encrypted at rest in `database_url_enc` (AES-GCM envelope). Plaintext\n * only exists transiently — at deploy (to encrypt) and at pool construction (to\n * connect). Never serialize it into API responses.\n */\nexport function encryptDatabaseUrl(url: string): Buffer {\n\treturn encryptSecret(url);\n}\n\n/** Decrypt a subgraph's BYO connection string, or null when managed. */\nexport function subgraphDatabaseUrl(subgraph: Subgraph): string | null {\n\treturn subgraph.database_url_enc\n\t\t? decryptSecret(subgraph.database_url_enc)\n\t\t: null;\n}\n\n/** True when the subgraph writes/serves from a user-owned DB. */\nexport function isByoSubgraph(subgraph: Subgraph): boolean {\n\treturn subgraph.database_url_enc != null;\n}\n\n/**\n * Resolve the Kysely instance a subgraph's data plane lives on: the user's DB\n * when BYO, else the managed target DB. Pools are cached by URL in db/index.ts.\n */\nexport function resolveSubgraphDb(subgraph: Subgraph): Kysely<Database> {\n\tconst url = subgraphDatabaseUrl(subgraph);\n\treturn url ? getDb(url) : getTargetDb();\n}\n\n/** Raw postgres.js client for a subgraph's data plane (DDL / serving queries). */\nexport function resolveSubgraphRawClient(\n\tsubgraph: Subgraph,\n): ReturnType<typeof postgres> {\n\tconst url = subgraphDatabaseUrl(subgraph);\n\treturn url ? getRawClientFor(url) : getRawClient(\"target\");\n}\n\n/**\n * Convert a subgraph name to its PostgreSQL schema name (legacy form).\n * Pre shared-rip every tenant DB had its own schema namespace so disambiguation\n * was implicit. Kept for oss mode (single-tenant) and legacy-row fallback.\n * Platform-mode deploys use `pgSchemaNameFor(accountId, name)`.\n */\nexport function pgSchemaName(subgraphName: string): string {\n\tconst safeName = subgraphName.replace(/-/g, \"_\");\n\treturn `subgraph_${safeName}`;\n}\n\n/**\n * Account-scoped schema name. Matches migration 0028's rename pattern:\n *   subgraph_{first8charsOfAccountId, dashes-as-underscores}_{name}\n * Empty accountId falls back to legacy form (oss mode).\n */\nexport function pgSchemaNameFor(\n\taccountId: string,\n\tsubgraphName: string,\n): string {\n\tif (!accountId) return pgSchemaName(subgraphName);\n\tconst accountPrefix = accountId.slice(0, 8).replace(/-/g, \"_\");\n\tconst safeName = subgraphName.replace(/-/g, \"_\");\n\treturn `subgraph_${accountPrefix}_${safeName}`;\n}\n\nexport async function registerSubgraph(\n\tdb: Kysely<Database>,\n\tdata: {\n\t\tname: string;\n\t\tversion: string;\n\t\tdefinition: Record<string, unknown>;\n\t\tschemaHash: string;\n\t\thandlerPath: string;\n\t\tapiKeyId?: string;\n\t\taccountId?: string;\n\t\tschemaName?: string;\n\t\tstartBlock?: number;\n\t\thandlerCode?: string;\n\t\tsourceCode?: string;\n\t\t/** BYO data plane: encrypted user-DB connection string, or null = managed. */\n\t\tdatabaseUrlEnc?: Buffer | null;\n\t},\n): Promise<Subgraph> {\n\treturn await db\n\t\t.insertInto(\"subgraphs\")\n\t\t.values({\n\t\t\tname: data.name,\n\t\t\tversion: data.version,\n\t\t\tdefinition: jsonb<Record<string, unknown>>(data.definition),\n\t\t\tschema_hash: data.schemaHash,\n\t\t\thandler_path: data.handlerPath,\n\t\t\taccount_id: data.accountId ?? \"\",\n\t\t\thandler_code: data.handlerCode ?? null,\n\t\t\tsource_code: data.sourceCode ?? null,\n\t\t\tschema_name: data.schemaName ?? null,\n\t\t\tstart_block: data.startBlock ?? 0,\n\t\t\tdatabase_url_enc: data.databaseUrlEnc ?? null,\n\t\t})\n\t\t.onConflict((oc) =>\n\t\t\toc.columns([\"name\", \"account_id\"]).doUpdateSet({\n\t\t\t\tversion: data.version,\n\t\t\t\tdefinition: jsonb<Record<string, unknown>>(data.definition),\n\t\t\t\tschema_hash: data.schemaHash,\n\t\t\t\thandler_path: data.handlerPath,\n\t\t\t\thandler_code: data.handlerCode ?? null,\n\t\t\t\tsource_code: data.sourceCode ?? null,\n\t\t\t\tschema_name: data.schemaName ?? null,\n\t\t\t\tstart_block: data.startBlock ?? 0,\n\t\t\t\tdatabase_url_enc: data.databaseUrlEnc ?? null,\n\t\t\t\tupdated_at: new Date(),\n\t\t\t}),\n\t\t)\n\t\t.returningAll()\n\t\t.executeTakeFirstOrThrow();\n}\n\nexport async function getSubgraph(\n\tdb: Kysely<Database>,\n\tname: string,\n\taccountId?: string,\n): Promise<Subgraph | null> {\n\tlet query = db.selectFrom(\"subgraphs\").selectAll().where(\"name\", \"=\", name);\n\n\tif (accountId !== undefined) {\n\t\tquery = query.where(\"account_id\", \"=\", accountId);\n\t}\n\n\treturn (await query.executeTakeFirst()) ?? null;\n}\n\nexport async function listSubgraphs(\n\tdb: Kysely<Database>,\n\taccountId?: string,\n): Promise<Subgraph[]> {\n\tlet query = db.selectFrom(\"subgraphs\").selectAll();\n\tif (accountId !== undefined) {\n\t\tquery = query.where(\"account_id\", \"=\", accountId);\n\t}\n\treturn query.execute();\n}\n\n/**\n * Resolve a public subgraph by name. Public names are a single global\n * namespace (partial unique index `subgraphs_public_name_uidx`), so at most\n * one row matches regardless of account.\n */\nexport async function findPublicSubgraphByName(\n\tdb: Kysely<Database>,\n\tname: string,\n): Promise<Subgraph | null> {\n\treturn (\n\t\t(await db\n\t\t\t.selectFrom(\"subgraphs\")\n\t\t\t.selectAll()\n\t\t\t.where(\"name\", \"=\", name)\n\t\t\t.where(\"visibility\", \"=\", \"public\")\n\t\t\t.executeTakeFirst()) ?? null\n\t);\n}\n\nexport async function updateSubgraphVisibility(\n\tdb: Kysely<Database>,\n\tname: string,\n\taccountId: string,\n\tvisibility: \"public\" | \"private\",\n): Promise<void> {\n\tawait db\n\t\t.updateTable(\"subgraphs\")\n\t\t.set({ visibility, updated_at: new Date() })\n\t\t.where(\"name\", \"=\", name)\n\t\t.where(\"account_id\", \"=\", accountId)\n\t\t.execute();\n}\n\nexport async function updateSubgraphStatus(\n\tdb: Kysely<Database>,\n\tname: string,\n\tstatus: string,\n\tlastProcessedBlock?: number,\n): Promise<void> {\n\tawait db\n\t\t.updateTable(\"subgraphs\")\n\t\t.set({\n\t\t\tstatus,\n\t\t\t...(lastProcessedBlock !== undefined\n\t\t\t\t? { last_processed_block: lastProcessedBlock }\n\t\t\t\t: {}),\n\t\t\tupdated_at: new Date(),\n\t\t})\n\t\t.where(\"name\", \"=\", name)\n\t\t.execute();\n}\n\nexport async function recordSubgraphProcessed(\n\tdb: Kysely<Database>,\n\tname: string,\n\tprocessed: number,\n\terrors: number,\n\tlastError?: string,\n): Promise<void> {\n\tawait db\n\t\t.updateTable(\"subgraphs\")\n\t\t.set({\n\t\t\ttotal_processed: sql`total_processed + ${processed}`,\n\t\t\ttotal_errors: sql`total_errors + ${errors}`,\n\t\t\t...(lastError\n\t\t\t\t? { last_error: lastError, last_error_at: new Date() }\n\t\t\t\t: {}),\n\t\t\tupdated_at: new Date(),\n\t\t})\n\t\t.where(\"name\", \"=\", name)\n\t\t.execute();\n}\n\nexport async function updateSubgraphHandlerPath(\n\tdb: Kysely<Database>,\n\tname: string,\n\thandlerPath: string,\n\topts?: { handlerCode?: string; sourceCode?: string },\n): Promise<void> {\n\tawait db\n\t\t.updateTable(\"subgraphs\")\n\t\t.set({\n\t\t\thandler_path: handlerPath,\n\t\t\t...(opts?.handlerCode != null ? { handler_code: opts.handlerCode } : {}),\n\t\t\t...(opts?.sourceCode != null ? { source_code: opts.sourceCode } : {}),\n\t\t\tupdated_at: new Date(),\n\t\t})\n\t\t.where(\"name\", \"=\", name)\n\t\t.execute();\n}\n\nexport async function deleteSubgraph(\n\tdb: Kysely<Database>,\n\tname: string,\n\taccountId?: string,\n): Promise<Subgraph | null> {\n\tconst subgraph = await getSubgraph(db, name, accountId);\n\tif (!subgraph) return null;\n\n\t// Use stored schema_name if available, otherwise compute\n\tconst schemaName = subgraph.schema_name ?? pgSchemaName(name);\n\n\t// Cascade to subscriptions: a subscription pointing at a deleted\n\t// subgraph + table will throw `relation does not exist` on every\n\t// subsequent emission. Pause active subs and purge any pending outbox\n\t// rows so receivers don't get phantom replays. We don't delete the\n\t// subscriptions themselves — operators may want to repoint them at a\n\t// resurrected subgraph; we just stop them firing.\n\tawait db\n\t\t.updateTable(\"subscriptions\")\n\t\t.set({\n\t\t\tstatus: \"paused\",\n\t\t\tlast_error: `Subgraph \"${name}\" deleted; subscription auto-paused.`,\n\t\t\tupdated_at: new Date(),\n\t\t})\n\t\t.where(\"subgraph_name\", \"=\", name)\n\t\t.execute();\n\tawait db\n\t\t.deleteFrom(\"subscription_outbox\")\n\t\t.where(\"status\", \"=\", \"pending\")\n\t\t.where(\"subscription_id\", \"in\", (qb) =>\n\t\t\tqb\n\t\t\t\t.selectFrom(\"subscriptions\")\n\t\t\t\t.select(\"id\")\n\t\t\t\t.where(\"subgraph_name\", \"=\", name),\n\t\t)\n\t\t.execute();\n\n\t// Drop the subgraph's schema (CASCADE drops all tables within). For BYO the\n\t// schema lives in the user's DB — we deliberately do NOT connect there to\n\t// drop their data on delete; deleting the subgraph just removes our registry\n\t// row (and, with it, the encrypted connection) + pauses subscriptions. The\n\t// user drops the schema themselves if they want it gone.\n\tif (!isByoSubgraph(subgraph)) {\n\t\tawait sql`DROP SCHEMA IF EXISTS ${sql.raw(`\"${schemaName}\"`)} CASCADE`.execute(\n\t\t\tdb,\n\t\t);\n\t}\n\n\t// Remove from registry (the inline database_url_enc envelope goes with it)\n\tawait db.deleteFrom(\"subgraphs\").where(\"id\", \"=\", subgraph.id).execute();\n\n\treturn subgraph;\n}\n\n/** Set or clear a paid subgraph's expiry (NULL = no expiry, e.g. on claim). */\nexport async function updateSubgraphExpiry(\n\tdb: Kysely<Database>,\n\tname: string,\n\taccountId: string,\n\texpiresAt: Date | null,\n): Promise<void> {\n\tawait db\n\t\t.updateTable(\"subgraphs\")\n\t\t.set({ expires_at: expiresAt })\n\t\t.where(\"name\", \"=\", name)\n\t\t.where(\"account_id\", \"=\", accountId)\n\t\t.execute();\n}\n\n/** Live-walk progress write: advances the cursor and PROMOTES toward\n *  'active' (deploying/error → active keeps reorg eligibility, reorg.ts gates\n *  on it) but never overwrites an explicit 'reindexing' park — unconditional\n *  status stamping let catch-up flap a parked subgraph back into its own path\n *  per block, fighting the queued reindex op.\n *\n *  `last_processed_block` itself is written UNCONDITIONALLY — no monotonic\n *  guard — on purpose: a reorg rewind must be able to move it *backward* to\n *  the fork height, and a naive GREATEST(old, new) would block that. This\n *  only stays correct because the two writers that can advance/rewind a\n *  given subgraph's cursor concurrently (the catch-up walk and the reorg\n *  handler, both in `@secondlayer/subgraphs/runtime`) serialize on an\n *  in-process per-subgraph lock + reorg epoch guard\n *  (`packages/subgraphs/src/runtime/catchup.ts`, `subgraphBlockLockHeld` /\n *  `reorgEpoch` — see the comment there for the full invariant; f057). Don't\n *  add a monotonic guard here without re-deriving that it can't also block\n *  the rewind. */\nexport async function recordLiveProgress(\n\tdb: Kysely<Database>,\n\tname: string,\n\tlastProcessedBlock: number,\n): Promise<void> {\n\tawait db\n\t\t.updateTable(\"subgraphs\")\n\t\t.set({\n\t\t\tlast_processed_block: lastProcessedBlock,\n\t\t\tstatus: sql`CASE WHEN status = 'reindexing' THEN status ELSE 'active' END`,\n\t\t\tupdated_at: new Date(),\n\t\t})\n\t\t.where(\"name\", \"=\", name)\n\t\t.execute();\n}\n"
+    "import { createCipheriv, createDecipheriv, randomBytes } from \"node:crypto\";\nimport {\n\tappendFileSync,\n\tcloseSync,\n\texistsSync,\n\topenSync,\n\treadFileSync,\n\tunlinkSync,\n} from \"node:fs\";\nimport { resolve } from \"node:path\";\nimport { getInstanceMode } from \"../mode.ts\";\n\n/**\n * AES-256-GCM symmetric envelope for encrypted secrets at rest (tenant keys,\n * subscription signing secrets, etc.).\n *\n * Ciphertext layout: `iv (12 bytes) || authTag (16 bytes) || ciphertext`\n *\n * The key comes from `SECONDLAYER_SECRETS_KEY` — 32 bytes hex. In OSS mode,\n * if the env var is unset on first use we autogenerate a key and persist it\n * to `.env.local` in the current working directory so subsequent restarts\n * pick it up without user intervention. Dedicated/platform modes throw —\n * those runtimes must provision the key explicitly.\n *\n * Rotation strategy: re-encrypt all rows with the new key and swap the env\n * var. Not zero-downtime, but acceptable at v2 scale. For real KMS (AWS\n * KMS, Vault, GCP KMS), wrap the same byte layout behind an\n * `EncryptSecret`/`DecryptSecret` interface and swap at startup.\n */\n\nconst KEY_ENV = \"SECONDLAYER_SECRETS_KEY\";\nconst IV_LEN = 12;\nconst TAG_LEN = 16;\n\nfunction readExistingKey(envPath: string): string | null {\n\tif (!existsSync(envPath)) return null;\n\tconst contents = readFileSync(envPath, \"utf8\");\n\tconst match = contents.match(/^SECONDLAYER_SECRETS_KEY=([a-fA-F0-9]{64})/m);\n\t// biome-ignore lint/style/noNonNullAssertion: value is non-null after preceding check or by construction; TS narrowing limitation\n\treturn match ? match[1]! : null;\n}\n\n/**\n * Atomic file lock via `openSync(..., \"wx\")` — O_CREAT | O_EXCL. If two\n * processes race on cold-compose start, exactly one creates the lock\n * file; the loser polls until the winner finishes writing `.env.local`,\n * then reads the winner's key. Stale locks (process crashed mid-write)\n * are cleaned after `STALE_LOCK_MS`.\n */\nconst STALE_LOCK_MS = 10_000;\nconst POLL_MS = 25;\n\nfunction bootstrapOssKey(): string {\n\tconst envPath = resolve(process.cwd(), \".env.local\");\n\n\t// Fast path — key already on disk from a prior run.\n\tconst existing = readExistingKey(envPath);\n\tif (existing) {\n\t\tprocess.env[KEY_ENV] = existing;\n\t\treturn existing;\n\t}\n\n\tconst lockPath = `${envPath}.secret-bootstrap.lock`;\n\tlet lockFd: number | null = null;\n\ttry {\n\t\tlockFd = openSync(lockPath, \"wx\", 0o600);\n\t} catch (err) {\n\t\tconst e = err as NodeJS.ErrnoException;\n\t\tif (e.code !== \"EEXIST\") throw err;\n\t}\n\n\tif (lockFd === null) {\n\t\t// Another process is bootstrapping. Poll for its result.\n\t\tconst deadline = Date.now() + STALE_LOCK_MS;\n\t\twhile (Date.now() < deadline) {\n\t\t\tconst key = readExistingKey(envPath);\n\t\t\tif (key) {\n\t\t\t\tprocess.env[KEY_ENV] = key;\n\t\t\t\treturn key;\n\t\t\t}\n\t\t\tBun.sleepSync(POLL_MS);\n\t\t}\n\t\t// Lock holder died mid-write — force-clean and retry once.\n\t\ttry {\n\t\t\tunlinkSync(lockPath);\n\t\t} catch {}\n\t\treturn bootstrapOssKey();\n\t}\n\n\ttry {\n\t\tconst hex = randomBytes(32).toString(\"hex\");\n\t\tconst line = `${existsSync(envPath) ? \"\\n\" : \"\"}${KEY_ENV}=${hex}\\n`;\n\t\tappendFileSync(envPath, line, { mode: 0o600 });\n\t\tprocess.env[KEY_ENV] = hex;\n\t\tconsole.log(\n\t\t\t`[secondlayer] generated ${KEY_ENV}; saved to ${envPath} (mode 0600)`,\n\t\t);\n\t\treturn hex;\n\t} finally {\n\t\tcloseSync(lockFd);\n\t\ttry {\n\t\t\tunlinkSync(lockPath);\n\t\t} catch {}\n\t}\n}\n\nfunction loadKey(): Buffer {\n\tlet hex = process.env[KEY_ENV];\n\tif (!hex) {\n\t\tif (getInstanceMode() === \"oss\") {\n\t\t\thex = bootstrapOssKey();\n\t\t} else {\n\t\t\tthrow new Error(\n\t\t\t\t`${KEY_ENV} not set. Generate one with: openssl rand -hex 32`,\n\t\t\t);\n\t\t}\n\t}\n\tconst key = Buffer.from(hex, \"hex\");\n\tif (key.length !== 32) {\n\t\tthrow new Error(`${KEY_ENV} must be 32 bytes hex (got ${key.length})`);\n\t}\n\treturn key;\n}\n\nlet _cachedKey: Buffer | null = null;\nfunction getKey(): Buffer {\n\tif (!_cachedKey) _cachedKey = loadKey();\n\treturn _cachedKey;\n}\n\n/**\n * Non-throwing check for whether a secrets key is currently resolvable —\n * same resolution order as {@link loadKey} (env var, then the OSS\n * `.env.local` fallback), but never bootstraps a new key (that would\n * generate+persist a key as a side effect of a mere existence check), never\n * throws, and never returns or logs the key itself. Used by callers that\n * need to fail loud on a missing key BEFORE attempting a decrypt (f072).\n */\nexport function secretsKeyAvailable(): boolean {\n\tif (process.env[KEY_ENV]) return true;\n\tif (getInstanceMode() === \"oss\") {\n\t\tconst envPath = resolve(process.cwd(), \".env.local\");\n\t\treturn readExistingKey(envPath) !== null;\n\t}\n\treturn false;\n}\n\nexport function encryptSecret(plaintext: string): Buffer {\n\tconst key = getKey();\n\tconst iv = randomBytes(IV_LEN);\n\tconst cipher = createCipheriv(\"aes-256-gcm\", key, iv);\n\tconst ciphertext = Buffer.concat([\n\t\tcipher.update(plaintext, \"utf8\"),\n\t\tcipher.final(),\n\t]);\n\tconst tag = cipher.getAuthTag();\n\treturn Buffer.concat([iv, tag, ciphertext]);\n}\n\nexport function decryptSecret(envelope: Buffer): string {\n\tconst key = getKey();\n\tconst iv = envelope.subarray(0, IV_LEN);\n\tconst tag = envelope.subarray(IV_LEN, IV_LEN + TAG_LEN);\n\tconst ciphertext = envelope.subarray(IV_LEN + TAG_LEN);\n\tconst decipher = createDecipheriv(\"aes-256-gcm\", key, iv);\n\tdecipher.setAuthTag(tag);\n\treturn decipher.update(ciphertext).toString(\"utf8\") + decipher.final(\"utf8\");\n}\n\n/** Generate a fresh 32-byte hex key suitable for `SECONDLAYER_SECRETS_KEY`. */\nexport function generateSecretsKey(): string {\n\treturn randomBytes(32).toString(\"hex\");\n}\n",
+    "import { type Kysely, sql } from \"kysely\";\nimport type postgres from \"postgres\";\nimport { decryptSecret, encryptSecret } from \"../../crypto/secrets.ts\";\nimport { getDb, getRawClient, getRawClientFor, getTargetDb } from \"../index.ts\";\nimport { jsonb } from \"../jsonb.ts\";\nimport type { Database, Subgraph } from \"../types.ts\";\n\n/**\n * BYO data plane helpers. A subgraph's user-owned Postgres connection string is\n * stored encrypted at rest in `database_url_enc` (AES-GCM envelope). Plaintext\n * only exists transiently — at deploy (to encrypt) and at pool construction (to\n * connect). Never serialize it into API responses.\n */\nexport function encryptDatabaseUrl(url: string): Buffer {\n\treturn encryptSecret(url);\n}\n\n/** Decrypt a subgraph's BYO connection string, or null when managed. */\nexport function subgraphDatabaseUrl(subgraph: Subgraph): string | null {\n\treturn subgraph.database_url_enc\n\t\t? decryptSecret(subgraph.database_url_enc)\n\t\t: null;\n}\n\n/** True when the subgraph writes/serves from a user-owned DB. */\nexport function isByoSubgraph(subgraph: Subgraph): boolean {\n\treturn subgraph.database_url_enc != null;\n}\n\n/**\n * Resolve the Kysely instance a subgraph's data plane lives on: the user's DB\n * when BYO, else the managed target DB. Pools are cached by URL in db/index.ts.\n */\nexport function resolveSubgraphDb(subgraph: Subgraph): Kysely<Database> {\n\tconst url = subgraphDatabaseUrl(subgraph);\n\treturn url ? getDb(url) : getTargetDb();\n}\n\n/** Raw postgres.js client for a subgraph's data plane (DDL / serving queries). */\nexport function resolveSubgraphRawClient(\n\tsubgraph: Subgraph,\n): ReturnType<typeof postgres> {\n\tconst url = subgraphDatabaseUrl(subgraph);\n\treturn url ? getRawClientFor(url) : getRawClient(\"target\");\n}\n\n/**\n * Convert a subgraph name to its PostgreSQL schema name (legacy form).\n * Pre shared-rip every tenant DB had its own schema namespace so disambiguation\n * was implicit. Kept for oss mode (single-tenant) and legacy-row fallback.\n * Platform-mode deploys use `pgSchemaNameFor(accountId, name)`.\n */\nexport function pgSchemaName(subgraphName: string): string {\n\tconst safeName = subgraphName.replace(/-/g, \"_\");\n\treturn `subgraph_${safeName}`;\n}\n\n/**\n * Account-scoped schema name. Matches migration 0028's rename pattern:\n *   subgraph_{first8charsOfAccountId, dashes-as-underscores}_{name}\n * Empty accountId falls back to legacy form (oss mode).\n */\nexport function pgSchemaNameFor(\n\taccountId: string,\n\tsubgraphName: string,\n): string {\n\tif (!accountId) return pgSchemaName(subgraphName);\n\tconst accountPrefix = accountId.slice(0, 8).replace(/-/g, \"_\");\n\tconst safeName = subgraphName.replace(/-/g, \"_\");\n\treturn `subgraph_${accountPrefix}_${safeName}`;\n}\n\nexport async function registerSubgraph(\n\tdb: Kysely<Database>,\n\tdata: {\n\t\tname: string;\n\t\tversion: string;\n\t\tdefinition: Record<string, unknown>;\n\t\tschemaHash: string;\n\t\thandlerPath: string;\n\t\tapiKeyId?: string;\n\t\taccountId?: string;\n\t\tschemaName?: string;\n\t\tstartBlock?: number;\n\t\thandlerCode?: string;\n\t\tsourceCode?: string;\n\t\t/** BYO data plane: encrypted user-DB connection string, or null = managed. */\n\t\tdatabaseUrlEnc?: Buffer | null;\n\t},\n): Promise<Subgraph> {\n\treturn await db\n\t\t.insertInto(\"subgraphs\")\n\t\t.values({\n\t\t\tname: data.name,\n\t\t\tversion: data.version,\n\t\t\tdefinition: jsonb<Record<string, unknown>>(data.definition),\n\t\t\tschema_hash: data.schemaHash,\n\t\t\thandler_path: data.handlerPath,\n\t\t\taccount_id: data.accountId ?? \"\",\n\t\t\thandler_code: data.handlerCode ?? null,\n\t\t\tsource_code: data.sourceCode ?? null,\n\t\t\tschema_name: data.schemaName ?? null,\n\t\t\tstart_block: data.startBlock ?? 0,\n\t\t\tdatabase_url_enc: data.databaseUrlEnc ?? null,\n\t\t})\n\t\t.onConflict((oc) =>\n\t\t\toc.columns([\"name\", \"account_id\"]).doUpdateSet({\n\t\t\t\tversion: data.version,\n\t\t\t\tdefinition: jsonb<Record<string, unknown>>(data.definition),\n\t\t\t\tschema_hash: data.schemaHash,\n\t\t\t\thandler_path: data.handlerPath,\n\t\t\t\thandler_code: data.handlerCode ?? null,\n\t\t\t\tsource_code: data.sourceCode ?? null,\n\t\t\t\tschema_name: data.schemaName ?? null,\n\t\t\t\tstart_block: data.startBlock ?? 0,\n\t\t\t\tdatabase_url_enc: data.databaseUrlEnc ?? null,\n\t\t\t\tupdated_at: new Date(),\n\t\t\t}),\n\t\t)\n\t\t.returningAll()\n\t\t.executeTakeFirstOrThrow();\n}\n\nexport async function getSubgraph(\n\tdb: Kysely<Database>,\n\tname: string,\n\taccountId?: string,\n): Promise<Subgraph | null> {\n\tlet query = db.selectFrom(\"subgraphs\").selectAll().where(\"name\", \"=\", name);\n\n\tif (accountId !== undefined) {\n\t\tquery = query.where(\"account_id\", \"=\", accountId);\n\t}\n\n\treturn (await query.executeTakeFirst()) ?? null;\n}\n\nexport async function listSubgraphs(\n\tdb: Kysely<Database>,\n\taccountId?: string,\n): Promise<Subgraph[]> {\n\tlet query = db.selectFrom(\"subgraphs\").selectAll();\n\tif (accountId !== undefined) {\n\t\tquery = query.where(\"account_id\", \"=\", accountId);\n\t}\n\treturn query.execute();\n}\n\n/**\n * Resolve a public subgraph by name. Public names are a single global\n * namespace (partial unique index `subgraphs_public_name_uidx`), so at most\n * one row matches regardless of account.\n */\nexport async function findPublicSubgraphByName(\n\tdb: Kysely<Database>,\n\tname: string,\n): Promise<Subgraph | null> {\n\treturn (\n\t\t(await db\n\t\t\t.selectFrom(\"subgraphs\")\n\t\t\t.selectAll()\n\t\t\t.where(\"name\", \"=\", name)\n\t\t\t.where(\"visibility\", \"=\", \"public\")\n\t\t\t.executeTakeFirst()) ?? null\n\t);\n}\n\nexport async function updateSubgraphVisibility(\n\tdb: Kysely<Database>,\n\tname: string,\n\taccountId: string,\n\tvisibility: \"public\" | \"private\",\n): Promise<void> {\n\tawait db\n\t\t.updateTable(\"subgraphs\")\n\t\t.set({ visibility, updated_at: new Date() })\n\t\t.where(\"name\", \"=\", name)\n\t\t.where(\"account_id\", \"=\", accountId)\n\t\t.execute();\n}\n\nexport async function updateSubgraphStatus(\n\tdb: Kysely<Database>,\n\tname: string,\n\tstatus: string,\n\tlastProcessedBlock?: number,\n): Promise<void> {\n\tawait db\n\t\t.updateTable(\"subgraphs\")\n\t\t.set({\n\t\t\tstatus,\n\t\t\t...(lastProcessedBlock !== undefined\n\t\t\t\t? { last_processed_block: lastProcessedBlock }\n\t\t\t\t: {}),\n\t\t\tupdated_at: new Date(),\n\t\t})\n\t\t.where(\"name\", \"=\", name)\n\t\t.execute();\n}\n\n/** Live-walk ERROR write (f069): a block whose handlers ALL failed\n *  (`processed === 0 && errors > 0`, `block-processor.ts`'s `applyProgress`)\n *  is stamped 'error' and its height is recorded as processed, same as\n *  `updateSubgraphStatus(db, name, \"error\", blockHeight)` — except the\n *  cursor half of that write now goes through the same conditional `<`\n *  guard as {@link recordLiveProgress}. Marking a subgraph 'error' is not\n *  itself replay-sensitive, but it shares the `last_processed_block` column\n *  with the replay guard: an unconditional write here could regress the\n *  cursor a racing (successful) writer already advanced past, which is\n *  exactly the regress-then-re-walk loop this guard exists to close. In\n *  practice `ctx.rollbackTo` (`runner.ts`) means an all-failed block never\n *  flushes writes, so a lost race here is always a silent no-op, never a\n *  case that needs `CursorRaceLostError`-style tx abort. Returns whether\n *  the write applied. Live path only — reindex/backfill's error stamping\n *  goes through {@link updateSubgraphStatus} unconditionally, as before. */\nexport async function recordLiveError(\n\tdb: Kysely<Database>,\n\tname: string,\n\tblockHeight: number,\n): Promise<boolean> {\n\tconst result = await db\n\t\t.updateTable(\"subgraphs\")\n\t\t.set({\n\t\t\tstatus: \"error\",\n\t\t\tlast_processed_block: blockHeight,\n\t\t\tupdated_at: new Date(),\n\t\t})\n\t\t.where(\"name\", \"=\", name)\n\t\t.where(\"last_processed_block\", \"<\", blockHeight)\n\t\t.executeTakeFirst();\n\treturn Number(result.numUpdatedRows ?? 0n) > 0;\n}\n\nexport async function recordSubgraphProcessed(\n\tdb: Kysely<Database>,\n\tname: string,\n\tprocessed: number,\n\terrors: number,\n\tlastError?: string,\n): Promise<void> {\n\tawait db\n\t\t.updateTable(\"subgraphs\")\n\t\t.set({\n\t\t\ttotal_processed: sql`total_processed + ${processed}`,\n\t\t\ttotal_errors: sql`total_errors + ${errors}`,\n\t\t\t...(lastError\n\t\t\t\t? { last_error: lastError, last_error_at: new Date() }\n\t\t\t\t: {}),\n\t\t\tupdated_at: new Date(),\n\t\t})\n\t\t.where(\"name\", \"=\", name)\n\t\t.execute();\n}\n\nexport async function updateSubgraphHandlerPath(\n\tdb: Kysely<Database>,\n\tname: string,\n\thandlerPath: string,\n\topts?: { handlerCode?: string; sourceCode?: string },\n): Promise<void> {\n\tawait db\n\t\t.updateTable(\"subgraphs\")\n\t\t.set({\n\t\t\thandler_path: handlerPath,\n\t\t\t...(opts?.handlerCode != null ? { handler_code: opts.handlerCode } : {}),\n\t\t\t...(opts?.sourceCode != null ? { source_code: opts.sourceCode } : {}),\n\t\t\tupdated_at: new Date(),\n\t\t})\n\t\t.where(\"name\", \"=\", name)\n\t\t.execute();\n}\n\nexport async function deleteSubgraph(\n\tdb: Kysely<Database>,\n\tname: string,\n\taccountId?: string,\n): Promise<Subgraph | null> {\n\tconst subgraph = await getSubgraph(db, name, accountId);\n\tif (!subgraph) return null;\n\n\t// Use stored schema_name if available, otherwise compute\n\tconst schemaName = subgraph.schema_name ?? pgSchemaName(name);\n\n\t// Cascade to subscriptions: a subscription pointing at a deleted\n\t// subgraph + table will throw `relation does not exist` on every\n\t// subsequent emission. Pause active subs and purge any pending outbox\n\t// rows so receivers don't get phantom replays. We don't delete the\n\t// subscriptions themselves — operators may want to repoint them at a\n\t// resurrected subgraph; we just stop them firing.\n\tawait db\n\t\t.updateTable(\"subscriptions\")\n\t\t.set({\n\t\t\tstatus: \"paused\",\n\t\t\tlast_error: `Subgraph \"${name}\" deleted; subscription auto-paused.`,\n\t\t\tupdated_at: new Date(),\n\t\t})\n\t\t.where(\"subgraph_name\", \"=\", name)\n\t\t.execute();\n\tawait db\n\t\t.deleteFrom(\"subscription_outbox\")\n\t\t.where(\"status\", \"=\", \"pending\")\n\t\t.where(\"subscription_id\", \"in\", (qb) =>\n\t\t\tqb\n\t\t\t\t.selectFrom(\"subscriptions\")\n\t\t\t\t.select(\"id\")\n\t\t\t\t.where(\"subgraph_name\", \"=\", name),\n\t\t)\n\t\t.execute();\n\n\t// Drop the subgraph's schema (CASCADE drops all tables within). For BYO the\n\t// schema lives in the user's DB — we deliberately do NOT connect there to\n\t// drop their data on delete; deleting the subgraph just removes our registry\n\t// row (and, with it, the encrypted connection) + pauses subscriptions. The\n\t// user drops the schema themselves if they want it gone.\n\tif (!isByoSubgraph(subgraph)) {\n\t\tawait sql`DROP SCHEMA IF EXISTS ${sql.raw(`\"${schemaName}\"`)} CASCADE`.execute(\n\t\t\tdb,\n\t\t);\n\t}\n\n\t// Remove from registry (the inline database_url_enc envelope goes with it)\n\tawait db.deleteFrom(\"subgraphs\").where(\"id\", \"=\", subgraph.id).execute();\n\n\treturn subgraph;\n}\n\n/** Set or clear a paid subgraph's expiry (NULL = no expiry, e.g. on claim). */\nexport async function updateSubgraphExpiry(\n\tdb: Kysely<Database>,\n\tname: string,\n\taccountId: string,\n\texpiresAt: Date | null,\n): Promise<void> {\n\tawait db\n\t\t.updateTable(\"subgraphs\")\n\t\t.set({ expires_at: expiresAt })\n\t\t.where(\"name\", \"=\", name)\n\t\t.where(\"account_id\", \"=\", accountId)\n\t\t.execute();\n}\n\n/** Live-walk progress write: advances the cursor and PROMOTES toward\n *  'active' (deploying/error → active keeps reorg eligibility, reorg.ts gates\n *  on it) but never overwrites an explicit 'reindexing' park — unconditional\n *  status stamping let catch-up flap a parked subgraph back into its own path\n *  per block, fighting the queued reindex op.\n *\n *  `last_processed_block` is now written CONDITIONALLY — `WHERE\n *  last_processed_block < lastProcessedBlock`, mirroring\n *  `advanceOperationCursor`'s (`subgraph-operations.ts`) comparison shape —\n *  and returns whether THIS call actually advanced it. This used to be\n *  unconditional by design, on the premise that the only two writers able to\n *  advance/rewind a given subgraph's cursor concurrently (the catch-up walk\n *  and the reorg handler) serialize on an in-process per-subgraph lock +\n *  reorg epoch guard (`packages/subgraphs/src/runtime/catchup.ts`,\n *  `subgraphBlockLockHeld` / `reorgEpoch`; f057). That guard is in-process\n *  only. The f068 investigation\n *  (`docs/internal/audits/asset-holdings-unreproducible-balances-f068.md`)\n *  found a cross-process sequence it does not cover: a catch-up leader that\n *  loses its advisory-lock connection mid-walk keeps writing (leadership is\n *  checked only at walk entry, not per-iteration) while a new leader takes\n *  over and walks the same range — both commit increments for overlapping\n *  heights, and every regressed cursor write from the laggard re-triggers a\n *  full re-walk, growing per-height application without bound. The\n *  conditional advance here (paired with the fast-path replay guard armed on\n *  the live path in `block-processor.ts`) is now the cross-process\n *  guarantee: a block at/below the current cursor can never re-advance it,\n *  so a laggard's commits can no longer regress-then-retrigger.\n *\n *  This conditionality is why the reorg rewind can no longer go through this\n *  function — a rewind's whole point is to move the cursor *backward*, which\n *  the `<` guard would silently refuse. Reorg mode calls\n *  {@link rewindLiveProgress} instead, which keeps the old unconditional\n *  semantics and is safe specifically because the reorg path takes a\n *  transaction-scoped advisory lock (`reorg.ts`) other writers can't cross. */\nexport async function recordLiveProgress(\n\tdb: Kysely<Database>,\n\tname: string,\n\tlastProcessedBlock: number,\n): Promise<boolean> {\n\tconst result = await db\n\t\t.updateTable(\"subgraphs\")\n\t\t.set({\n\t\t\tlast_processed_block: lastProcessedBlock,\n\t\t\tstatus: sql`CASE WHEN status = 'reindexing' THEN status ELSE 'active' END`,\n\t\t\tupdated_at: new Date(),\n\t\t})\n\t\t.where(\"name\", \"=\", name)\n\t\t.where(\"last_processed_block\", \"<\", lastProcessedBlock)\n\t\t.executeTakeFirst();\n\treturn Number(result.numUpdatedRows ?? 0n) > 0;\n}\n\n/** Reorg-rewind progress write: the OLD unconditional `recordLiveProgress`\n *  semantics, verbatim — moves `last_processed_block` to the fork height\n *  regardless of its current value, because that is by definition a\n *  backward move the conditional `<` guard in `recordLiveProgress` would\n *  refuse. Same status-promotion CASE (never unparks an explicit\n *  'reindexing').\n *\n *  Callers: exclusively the subgraph-reorg path\n *  (`packages/subgraphs/src/runtime/reorg.ts`, via `block-processor.ts`'s\n *  `reorgRewind` mode), which is safe from the cross-process race this\n *  function reintroduces because it holds a transaction-scoped Postgres\n *  advisory lock (`pg_advisory_xact_lock`) for the whole\n *  delete+reprocess+rewind sequence — no other writer can interleave a\n *  forward write between the rewind and the fork block's reprocess. Do not\n *  call this from the live catch-up path. */\nexport async function rewindLiveProgress(\n\tdb: Kysely<Database>,\n\tname: string,\n\tlastProcessedBlock: number,\n): Promise<void> {\n\tawait db\n\t\t.updateTable(\"subgraphs\")\n\t\t.set({\n\t\t\tlast_processed_block: lastProcessedBlock,\n\t\t\tstatus: sql`CASE WHEN status = 'reindexing' THEN status ELSE 'active' END`,\n\t\t\tupdated_at: new Date(),\n\t\t})\n\t\t.where(\"name\", \"=\", name)\n\t\t.execute();\n}\n"
   ],
-  "mappings": ";;;;;;;;;;;;;;;;;AAAA;AAGA,IAAM,iBAAiB,EAAE,OAAO,EAAE,UAAU,CAAC,QAAQ;AAAA,EACpD,MAAM,WAAW,IACf,MAAM,GAAG,EACT,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,OAAO;AAAA,EAChB,MAAM,QAAQ,CAAC,WAAW,SAAS;AAAA,EACnC,WAAW,KAAK,UAAU;AAAA,IACzB,IAAI,CAAC,MAAM,SAAS,CAAC,GAAG;AAAA,MACvB,MAAM,IAAI,MACT,oBAAoB,sBAAsB,MAAM,KAAK,IAAI,GAC1D;AAAA,IACD;AAAA,EACD;AAAA,EACA,OAAO;AAAA,CACP;AAsBD,IAAM,YAAwC,EAAE,OAAO;AAAA,EACtD,cAAc,EAAE,WACf,CAAC,QAAS,OAAO,QAAQ,YAAY,IAAI,WAAW,IAAI,YAAY,KACpE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAC3B;AAAA,EACA,qBAAqB,EAAE,WACtB,CAAC,QAAS,OAAO,QAAQ,YAAY,IAAI,WAAW,IAAI,YAAY,KACpE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAC3B;AAAA,EACA,qBAAqB,EAAE,WACtB,CAAC,QAAS,OAAO,QAAQ,YAAY,IAAI,WAAW,IAAI,YAAY,KACpE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAC3B;AAAA,EACA,SAAS,EAAE,KAAK,CAAC,WAAW,SAAS,CAAC,EAAE,SAAS;AAAA,EACjD,UAAU,eAAe,SAAS;AAAA,EAClC,WAAW,EAAE,KAAK,CAAC,SAAS,QAAQ,QAAQ,OAAO,CAAC,EAAE,QAAQ,MAAM;AAAA,EACpE,UAAU,EACR,KAAK,CAAC,eAAe,cAAc,MAAM,CAAC,EAC1C,QAAQ,aAAa;AACxB,CAAC;AAMD,IAAI,YAAwB;AAErB,SAAS,MAAM,GAAQ;AAAA,EAC7B,IAAI,WAAW;AAAA,IACd,OAAO;AAAA,EACR;AAAA,EAEA,MAAM,SAAS,UAAU,UAAU,QAAQ,GAAG;AAAA,EAE9C,IAAI,CAAC,OAAO,SAAS;AAAA,IACpB,QAAQ,MAAM,sCAAqC;AAAA,IACnD,QAAQ,MAAM,EAAE,aAAa,OAAO,KAAK,CAAC;AAAA,IAC1C,MAAM,IAAI,MAAM,mCAAmC;AAAA,EACpD;AAAA,EAGA,IAAI;AAAA,EACJ,IAAI,OAAO,KAAK,YAAY,OAAO,KAAK,SAAS,SAAS,GAAG;AAAA,IAC5D,kBAAkB,OAAO,KAAK;AAAA,EAC/B,EAAO,SAAI,OAAO,KAAK,SAAS;AAAA,IAC/B,kBAAkB,CAAC,OAAO,KAAK,OAAO;AAAA,EACvC,EAAO;AAAA,IACN,kBAAkB,CAAC,SAAS;AAAA;AAAA,EAG7B,YAAY,KAAK,OAAO,MAAM,gBAAgB;AAAA,EAC9C,OAAO;AAAA;AAeD,SAAS,eAAe,GAAY;AAAA,EAE1C,OAAO,QAAQ,IAAI,gBAAgB;AAAA;AAQ7B,SAAS,oBAAoB,GAAY;AAAA,EAC/C,OAAO,QAAQ,IAAI,yBAAyB;AAAA;AAStC,SAAS,oBAAoB,GAAY;AAAA,EAC/C,OAAO,QAAQ,IAAI,yBAAyB;AAAA;;AC1H7C,IAAM,aAAuC;AAAA,EAC5C,OAAO;AAAA,EACP,MAAM;AAAA,EACN,MAAM;AAAA,EACN,OAAO;AACR;AAAA;AAEA,MAAM,OAAO;AAAA,EACJ;AAAA,EACA;AAAA,EACA,eAAe;AAAA,EAEf,IAAI,GAAG;AAAA,IACd,IAAI,KAAK;AAAA,MAAc;AAAA,IACvB,KAAK,eAAe;AAAA,IACpB,IAAI;AAAA,MACH,MAAM,MAAM,OAAO;AAAA,MACnB,KAAK,SAAS,IAAI;AAAA,MAClB,KAAK,gBAAgB,IAAI,aAAa;AAAA,MACrC,MAAM;AAAA,MAEP,KAAK,SAAS;AAAA,MACd,KAAK,gBAAgB;AAAA;AAAA;AAAA,MAIX,KAAK,GAAa;AAAA,IAC7B,KAAK,KAAK;AAAA,IAEV,OAAO,KAAK;AAAA;AAAA,MAGD,YAAY,GAAY;AAAA,IACnC,KAAK,KAAK;AAAA,IAEV,OAAO,KAAK;AAAA;AAAA,EAGL,SAAS,CAAC,OAA0B;AAAA,IAC3C,OAAO,WAAW,UAAU,WAAW,KAAK;AAAA;AAAA,EAGrC,aAAa,CACpB,OACA,SAEA,MACC;AAAA,IACD,MAAM,YAAY,IAAI,KAAK,EAAE,YAAY;AAAA,IAEzC,IAAI,KAAK,cAAc;AAAA,MAEtB,OAAO,KAAK,UAAU;AAAA,QACrB;AAAA,QACA;AAAA,QACA;AAAA,WACG;AAAA,MACJ,CAAC;AAAA,IACF;AAAA,IAGA,MAAM,UAAU,OAAO,IAAI,KAAK,UAAU,IAAI,MAAM;AAAA,IACpD,OAAO,IAAI,cAAc,MAAM,YAAY,MAAM,UAAU;AAAA;AAAA,EAI5D,KAAK,CAAC,SAAiB,MAAkC;AAAA,IACxD,IAAI,KAAK,UAAU,OAAO,GAAG;AAAA,MAC5B,QAAQ,MAAM,KAAK,cAAc,SAAS,SAAS,IAAI,CAAC;AAAA,IACzD;AAAA;AAAA,EAID,IAAI,CAAC,SAAiB,MAAkC;AAAA,IACvD,IAAI,KAAK,UAAU,MAAM,GAAG;AAAA,MAC3B,QAAQ,KAAK,KAAK,cAAc,QAAQ,SAAS,IAAI,CAAC;AAAA,IACvD;AAAA;AAAA,EAID,IAAI,CAAC,SAAiB,MAAkC;AAAA,IACvD,IAAI,KAAK,UAAU,MAAM,GAAG;AAAA,MAC3B,QAAQ,KAAK,KAAK,cAAc,QAAQ,SAAS,IAAI,CAAC;AAAA,IACvD;AAAA;AAAA,EAID,KAAK,CAAC,SAAiB,MAAkC;AAAA,IACxD,IAAI,KAAK,UAAU,OAAO,GAAG;AAAA,MAC5B,QAAQ,MAAM,KAAK,cAAc,SAAS,SAAS,IAAI,CAAC;AAAA,IACzD;AAAA;AAEF;AAGO,IAAM,SAAiB,IAAI;;;ACnGlC;AAWO,SAAS,KAAkB,CAAC,OAAyB;AAAA,EAC3D,MAAM,UAAU,KAAK,UAAU,OAAO,CAAC,IAAI,MAC1C,OAAO,MAAM,WAAW,EAAE,SAAS,IAAI,CACxC,EAAE,QAAQ,MAAM,IAAI;AAAA,EACpB,OAAO,MAAM,IAAI,IAAI,IAAI,iBAAiB;AAAA;AAQpC,SAAS,UAAuB,CAAC,OAAmB;AAAA,EAC1D,IAAI,OAAO,UAAU,UAAU;AAAA,IAC9B,IAAI;AAAA,MACH,OAAO,KAAK,MAAM,KAAK;AAAA,MACtB,MAAM;AAAA,MACP,OAAO;AAAA;AAAA,EAET;AAAA,EACA,OAAQ,SAAS,CAAC;AAAA;;;AC/BnB;AACA;AACA;AAuVA,gBAAS;;;AC3UF,IAAM,sBAAsB;AAAA,EAClC,QAAQ;AAAA,IACP;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACD;AAAA,EACA,gBAAgB;AAAA,IACf;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACD;AAAA,EACA,cAAc;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACD;AAAA,EACA,sBAAsB;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACD;AAAA,EACA,YAAY;AAAA,IACX;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACD;AAAA,EACA,aAAa;AAAA,IACZ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACD;AAAA,EACA,mBAAmB;AAAA,IAClB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACD;AAAA,EACA,iBAAiB;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACD;AAAA,EACA,sBAAsB;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACD;AAAA,EACA,wBAAwB;AAAA,IACvB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACD;AAAA,EACA,WAAW;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACD;AAAA,EACA,gBAAgB;AAAA,IACf;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACD;AAAA,EACA,oBAAoB;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACD;AAAA,EACA,yBAAyB;AAAA,IACxB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACD;AAAA,EACA,QAAQ,CAAC,gBAAgB,QAAQ,eAAe,SAAS,MAAM;AAAA,EAC/D,cAAc,CAAC,aAAa;AAC7B;AA4BO,IAAM,oBAAoB;AAAA,EAChC,QAAQ;AAAA,IACP,iBAAiB,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAChD,mBAAmB,EAAE,MAAM,MAAM;AAAA,IACjC,WAAW,EAAE,MAAM,UAAU;AAAA,IAC7B,MAAM,EAAE,MAAM,OAAO;AAAA,IACrB,QAAQ,EAAE,MAAM,MAAM;AAAA,IACtB,aAAa,EAAE,MAAM,OAAO;AAAA,IAC5B,WAAW,EAAE,MAAM,MAAM;AAAA,EAC1B;AAAA,EACA,gBAAgB;AAAA,IACf,QAAQ,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACvC,kBAAkB,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACjD,cAAc,EAAE,MAAM,MAAM;AAAA,IAC5B,WAAW,EAAE,MAAM,UAAU;AAAA,IAC7B,aAAa,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC5C,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,aAAa,EAAE,MAAM,MAAM;AAAA,IAC3B,YAAY,EAAE,MAAM,OAAO;AAAA,IAC3B,MAAM,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACrC,SAAS,EAAE,MAAM,SAAS,UAAU,KAAK;AAAA,IACzC,WAAW,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC1C,QAAQ,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACvC,OAAO,EAAE,MAAM,OAAO;AAAA,IACtB,UAAU,EAAE,MAAM,MAAM;AAAA,IACxB,OAAO,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,EACvC;AAAA,EACA,cAAc;AAAA,IACb,cAAc,EAAE,MAAM,MAAM;AAAA,IAC5B,aAAa,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC5C,eAAe,EAAE,MAAM,SAAS,UAAU,KAAK;AAAA,IAC/C,eAAe,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC9C,YAAY,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC3C,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,OAAO,EAAE,MAAM,OAAO;AAAA,IACtB,UAAU,EAAE,MAAM,MAAM;AAAA,IACxB,MAAM,EAAE,MAAM,OAAO;AAAA,EACtB;AAAA,EACA,sBAAsB;AAAA,IACrB,aAAa,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC5C,eAAe,EAAE,MAAM,SAAS,UAAU,KAAK;AAAA,IAC/C,eAAe,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC9C,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,aAAa,EAAE,MAAM,YAAY;AAAA,IACjC,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,KAAK,EAAE,MAAM,OAAO;AAAA,IACpB,OAAO,EAAE,MAAM,OAAO;AAAA,IACtB,MAAM,EAAE,MAAM,OAAO;AAAA,EACtB;AAAA,EACA,YAAY;AAAA,IACX,wBAAwB,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACvD,yBAAyB,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IACvD,aAAa,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC5C,cAAc,EAAE,MAAM,WAAW,UAAU,KAAK;AAAA,IAChD,SAAS,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACxC,aAAa,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IAC3C,YAAY,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC3C,cAAc,EAAE,MAAM,MAAM;AAAA,IAC5B,YAAY,EAAE,MAAM,YAAY;AAAA,IAChC,mBAAmB,EAAE,MAAM,MAAM;AAAA,IACjC,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,WAAW,EAAE,MAAM,UAAU;AAAA,IAC7B,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,aAAa,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC5C,WAAW,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IACzC,eAAe,EAAE,MAAM,OAAO;AAAA,IAC9B,aAAa,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IAC3C,YAAY,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC3C,cAAc,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC7C,oBAAoB,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACnD,kBAAkB,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IAChD,WAAW,EAAE,MAAM,UAAU;AAAA,IAC7B,cAAc,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IAC5C,YAAY,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC3C,kBAAkB,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACjD,eAAe,EAAE,MAAM,OAAO;AAAA,IAC9B,SAAS,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACxC,aAAa,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IAC3C,OAAO,EAAE,MAAM,OAAO;AAAA,IACtB,UAAU,EAAE,MAAM,MAAM;AAAA,EACzB;AAAA,EACA,aAAa;AAAA,IACZ,QAAQ,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACvC,cAAc,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC7C,cAAc,EAAE,MAAM,MAAM;AAAA,IAC5B,YAAY,EAAE,MAAM,YAAY;AAAA,IAChC,WAAW,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC1C,aAAa,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IAC3C,WAAW,EAAE,MAAM,UAAU;AAAA,IAC7B,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,aAAa,EAAE,MAAM,MAAM;AAAA,IAC3B,KAAK,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACpC,0BAA0B,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IACxD,yBAAyB,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACxD,SAAS,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACxC,cAAc,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IAC5C,yBAAyB,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACxD,uBAAuB,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IACrD,YAAY,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IAC1C,QAAQ,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACvC,gBAAgB,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC/C,yBAAyB,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACxD,eAAe,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC9C,mBAAmB,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IACjD,kBAAkB,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IAChD,YAAY,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC3C,OAAO,EAAE,MAAM,OAAO;AAAA,IACtB,OAAO,EAAE,MAAM,OAAO;AAAA,IACtB,UAAU,EAAE,MAAM,MAAM;AAAA,EACzB;AAAA,EACA,mBAAmB;AAAA,IAClB,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,cAAc,EAAE,MAAM,MAAM;AAAA,IAC5B,YAAY,EAAE,MAAM,YAAY;AAAA,IAChC,WAAW,EAAE,MAAM,UAAU;AAAA,IAC7B,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,aAAa,EAAE,MAAM,MAAM;AAAA,IAC3B,YAAY,EAAE,MAAM,OAAO;AAAA,IAC3B,MAAM,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACrC,WAAW,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC1C,QAAQ,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACvC,OAAO,EAAE,MAAM,OAAO;AAAA,IACtB,UAAU,EAAE,MAAM,MAAM;AAAA,EACzB;AAAA,EACA,iBAAiB;AAAA,IAChB,cAAc,EAAE,MAAM,MAAM;AAAA,IAC5B,YAAY,EAAE,MAAM,YAAY;AAAA,IAChC,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,WAAW,EAAE,MAAM,UAAU;AAAA,IAC7B,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,aAAa,EAAE,MAAM,MAAM;AAAA,IAC3B,KAAK,EAAE,MAAM,OAAO;AAAA,IACpB,4BAA4B,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC3D,aAAa,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IAC3C,MAAM,EAAE,MAAM,OAAO;AAAA,IACrB,WAAW,EAAE,MAAM,OAAO;AAAA,IAC1B,OAAO,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACtC,eAAe,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC9C,eAAe,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IAC7C,gBAAgB,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IAC9C,UAAU,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACzC,OAAO,EAAE,MAAM,OAAO;AAAA,IACtB,OAAO,EAAE,MAAM,OAAO;AAAA,IACtB,UAAU,EAAE,MAAM,MAAM;AAAA,EACzB;AAAA,EACA,sBAAsB;AAAA,IACrB,cAAc,EAAE,MAAM,MAAM;AAAA,IAC5B,YAAY,EAAE,MAAM,YAAY;AAAA,IAChC,WAAW,EAAE,MAAM,UAAU;AAAA,IAC7B,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,aAAa,EAAE,MAAM,MAAM;AAAA,IAC3B,aAAa,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IAC3C,UAAU,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IACxC,SAAS,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACxC,gBAAgB,EAAE,MAAM,WAAW,UAAU,KAAK;AAAA,IAClD,4BAA4B,EAAE,MAAM,WAAW,UAAU,KAAK;AAAA,IAC9D,WAAW,EAAE,MAAM,OAAO;AAAA,IAC1B,cAAc,EAAE,MAAM,WAAW,UAAU,KAAK;AAAA,IAChD,gBAAgB,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC/C,aAAa,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IAC3C,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,OAAO,EAAE,MAAM,OAAO;AAAA,IACtB,UAAU,EAAE,MAAM,MAAM;AAAA,EACzB;AAAA,EACA,wBAAwB;AAAA,IACvB,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,cAAc,EAAE,MAAM,MAAM;AAAA,IAC5B,YAAY,EAAE,MAAM,YAAY;AAAA,IAChC,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,WAAW,EAAE,MAAM,UAAU;AAAA,IAC7B,YAAY,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC3C,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,aAAa,EAAE,MAAM,MAAM;AAAA,IAC3B,YAAY,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC3C,OAAO,EAAE,MAAM,OAAO;AAAA,IACtB,UAAU,EAAE,MAAM,MAAM;AAAA,EACzB;AAAA,EACA,WAAW;AAAA,IACV,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,KAAK,EAAE,MAAM,OAAO;AAAA,IACpB,eAAe,EAAE,MAAM,YAAY;AAAA,IACnC,mBAAmB,EAAE,MAAM,OAAO;AAAA,IAClC,MAAM,EAAE,MAAM,OAAO;AAAA,IACrB,WAAW,EAAE,MAAM,OAAO;AAAA,IAC1B,OAAO,EAAE,MAAM,OAAO;AAAA,IACtB,eAAe,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IAC7C,gBAAgB,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,EAC/C;AAAA,EACA,gBAAgB;AAAA,IACf,eAAe,EAAE,MAAM,YAAY;AAAA,IACnC,mBAAmB,EAAE,MAAM,OAAO;AAAA,IAClC,aAAa,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IAC3C,UAAU,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IACxC,SAAS,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACxC,gBAAgB,EAAE,MAAM,UAAU;AAAA,IAClC,YAAY,EAAE,MAAM,MAAM;AAAA,IAC1B,WAAW,EAAE,MAAM,OAAO;AAAA,IAC1B,cAAc,EAAE,MAAM,UAAU;AAAA,EACjC;AAAA,EACA,oBAAoB;AAAA,IACnB,aAAa,EAAE,MAAM,OAAO;AAAA,IAC5B,aAAa,EAAE,MAAM,OAAO;AAAA,IAC5B,iBAAiB,EAAE,MAAM,OAAO;AAAA,IAChC,mBAAmB,EAAE,MAAM,MAAM;AAAA,IACjC,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,eAAe,EAAE,MAAM,OAAO;AAAA,IAC9B,cAAc,EAAE,MAAM,MAAM;AAAA,EAC7B;AAAA,EACA,yBAAyB;AAAA,IACxB,iBAAiB,EAAE,MAAM,OAAO;AAAA,IAChC,mBAAmB,EAAE,MAAM,MAAM;AAAA,IACjC,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,YAAY,EAAE,MAAM,OAAO;AAAA,IAC3B,YAAY,EAAE,MAAM,MAAM;AAAA,EAC3B;AAAA,EACA,QAAQ;AAAA,IACP,cAAc,EAAE,MAAM,MAAM;AAAA,IAC5B,MAAM,EAAE,MAAM,QAAQ;AAAA,IACtB,aAAa,EAAE,MAAM,MAAM;AAAA,IAC3B,OAAO,EAAE,MAAM,OAAO;AAAA,IACtB,MAAM,EAAE,MAAM,OAAO;AAAA,EACtB;AAAA,EACA,cAAc;AAAA,IACb,aAAa,EAAE,MAAM,YAAY;AAAA,EAClC;AACD;AAaO,IAAM,kBAAkB;AAAA,EAC9B,QAAQ,CAAC,QAAQ;AAAA,EACjB,gBAAgB,CAAC,QAAQ;AAAA,EACzB,cAAc,CAAC,OAAO;AAAA,EACtB,sBAAsB,CAAC,KAAK;AAAA,EAC5B,YAAY,CAAC,QAAQ;AAAA,EACrB,aAAa,CAAC,QAAQ;AAAA,EACtB,mBAAmB,CAAC,QAAQ;AAAA,EAC5B,iBAAiB,CAAC,QAAQ;AAAA,EAC1B,sBAAsB,CAAC,QAAQ;AAAA,EAC/B,wBAAwB,CAAC,QAAQ;AAAA,EACjC,WAAW,CAAC,KAAK;AAAA,EACjB,gBAAgB,CAAC,WAAW;AAAA,EAC5B,oBAAoB,CAAC,QAAQ;AAAA,EAC7B,yBAAyB,CAAC,QAAQ;AAAA,EAClC,QAAQ,CAAC,SAAS,aAAa;AAAA,EAC/B,cAAc;AACf;;AC1eA,IAAI,cAA6B;AAE1B,SAAS,gBAAgB,CAAC,MAA2B;AAAA,EAC3D,cAAc;AAAA;AAGR,SAAS,gBAAgB,GAAkB;AAAA,EACjD,OAAO;AAAA;AAIR,eAAsB,cAAc,CAAC,IAAwC;AAAA,EAC5E,IAAI,gBAAgB,YAAY,gBAAgB;AAAA,IAAQ,MAAM,GAAG;AAAA;AAIlE,eAAsB,YAAY,CAAC,IAAwC;AAAA,EAC1E,IAAI,gBAAgB,YAAY,gBAAgB;AAAA,IAAQ,MAAM,GAAG;AAAA;;ACvB3D,IAAM,cAAc;AAAA,EAE1B,QAAQ;AAAA,EACR,cAAc;AAAA,EACd,QAAQ;AAAA,EACR,sBAAsB;AAAA,EACtB,gBAAgB;AAAA,EAChB,oBAAoB;AAAA,EACpB,sBAAsB;AAAA,EACtB,gBAAgB;AAAA,EAChB,WAAW;AAAA,EACX,cAAc;AAAA,EAGd,kBAAkB;AAAA,EAElB,qBAAqB;AAAA,EAErB,gBAAgB;AAAA,EAChB,qBAAqB;AAAA,EACrB,YAAY;AAAA,EACZ,mBAAmB;AAAA,EACnB,oBAAoB;AAAA,EACpB,aAAa;AAAA,EACb,oBAAoB;AAAA,EACpB,yBAAyB;AAAA,EACzB,aAAa;AAAA,EACb,mBAAmB;AAAA,EACnB,kBAAkB;AAAA,EAClB,uBAAuB;AAAA,EACvB,iBAAiB;AAAA,EACjB,sBAAsB;AAAA,EACtB,wBAAwB;AAAA,EACxB,WAAW;AAAA,EACX,gBAAgB;AAAA,EAEhB,UAAU;AAAA,EACV,UAAU;AAAA,EACV,UAAU;AAAA,EACV,aAAa;AAAA,EACb,cAAc;AAAA,EACd,aAAa;AAAA,EACb,iBAAiB;AAAA,EACjB,kBAAkB;AAAA,EAClB,oBAAoB;AAAA,EACpB,oBAAoB;AAAA,EACpB,yBAAyB;AAAA,EACzB,SAAS;AAAA,EACT,sBAAsB;AAAA,EACtB,uBAAuB;AAAA,EACvB,wBAAwB;AAAA,EACxB,UAAU;AAAA,EACV,cAAc;AAAA,EACd,kBAAkB;AAAA,EAElB,eAAe;AAAA,EACf,qBAAqB;AAAA,EACrB,yBAAyB;AAAA,EACzB,yBAAyB;AAAA,EAEzB,WAAW;AAAA,EACX,qBAAqB;AAAA,EACrB,2BAA2B;AAAA,EAC3B,eAAe;AAAA,EACf,sBAAsB;AAAA,EACtB,2BAA2B;AAAA,EAC3B,0BAA0B;AAAA,EAE1B,eAAe;AAAA,EACf,eAAe;AAAA,EACf,iBAAiB;AAAA,EAEjB,oBAAoB;AACrB;;;AHtFA,IAAM,cACL;AAqBD,IAAM,QAAQ,IAAI;AAClB,IAAI,UAAU;AAEd,SAAS,QAAQ,GAAW;AAAA,EAC3B,OAAO,OAAO,SAAS,QAAQ,IAAI,sBAAsB,MAAM,EAAE;AAAA;AAIlE,SAAS,aAAa,GAAS;AAAA,EAC9B,IAAI,MAAM,QAAQ,SAAS;AAAA,IAAG;AAAA,EAC9B,MAAM,gBAAgB,IAAI,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC,CAAC;AAAA,EACtE,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,YAAY,KAAK,UAAU,OAAO;AAAA,IACjC,IAAI,cAAc,IAAI,GAAG;AAAA,MAAG;AAAA,IAC5B,IACC,CAAC,YACD,MAAM,WAAW,SAAS,YACzB,MAAM,aAAa,SAAS,YAAY,MAAM,MAAM,SAAS,KAC7D;AAAA,MACD,SAAS;AAAA,MACT,WAAW;AAAA,IACZ;AAAA,EACD;AAAA,EACA,IAAI,CAAC,UAAU,CAAC;AAAA,IAAU;AAAA,EAC1B,MAAM,OAAO,MAAM;AAAA,EACnB,MAAM,UAAU;AAAA,EAEX,QAAQ,GACX,QAAQ,EACR,MAAM,MAAM,EAAE,EACd,KAAK,MAAM,QAAQ,UAAU,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,EAChD,MAAM,MAAM,EAAE;AAAA;AAGjB,SAAS,gBAAgB,GAAW;AAAA,EACnC,OACC,QAAQ,IAAI,uBAAuB,QAAQ,IAAI,gBAAgB;AAAA;AAIjE,SAAS,gBAAgB,GAAW;AAAA,EACnC,OACC,QAAQ,IAAI,uBAAuB,QAAQ,IAAI,gBAAgB;AAAA;AAKjE,SAAS,aAAa,CAAC,KAAqB;AAAA,EAC3C,IAAI;AAAA,IACH,MAAM,IAAI,IAAI,IAAI,GAAG;AAAA,IACrB,OAAO,GAAG,EAAE,WAAW,EAAE,OAAO,IAAI,EAAE,SAAS,KAAK,EAAE;AAAA,IACrD,MAAM;AAAA,IACP,OAAO;AAAA;AAAA;AAKT,IAAI,8BAA8B;AAqBlC,SAAS,kCAAkC,GAAS;AAAA,EACnD,IAAI;AAAA,IAA6B;AAAA,EAIjC,IAAI,QAAQ,IAAI,gBAAgB;AAAA,IAAQ;AAAA,EACxC,IACC,QAAQ,IAAI,gBACZ,QAAQ,IAAI,uBACZ,QAAQ,IAAI,qBACX;AAAA,IACD;AAAA,EACD;AAAA,EACA,8BAA8B;AAAA,EAC9B,QAAQ,KACP,yEAAwE,cACvE,WACD,gIACD;AAAA;AAGD,mCAAmC;AAuB5B,SAAS,gBAAgB,GAAkB;AAAA,EACjD,MAAM,SAAS,iBAAiB;AAAA,EAChC,MAAM,SAAS,iBAAiB;AAAA,EAChC,MAAM,SAAS,WAAW;AAAA,EAC1B,OAAO;AAAA,IACN,MAAM,SAAS,UAAU;AAAA,IACzB;AAAA,IACA,UAAU,cAAc,MAAM;AAAA,IAC9B,UAAU,cAAc,MAAM;AAAA,EAC/B;AAAA;AAiBM,SAAS,aAAa,GAAS;AAAA,EAGrC,MAAM,SAAS,gBAAgB;AAAA,EAC/B,MAAM,aAAa,CAAC,EACnB,QAAQ,IAAI,uBAAuB,QAAQ,IAAI;AAAA,EAEhD,MAAM,iBAAiB,CAAC,CAAC,QAAQ,IAAI;AAAA,EACrC,MAAM,SAAS,iBAAiB;AAAA,EAChC,MAAM,SAAS,iBAAiB;AAAA,EAEhC,IACC,cACA,CAAC,mBACA,WAAW,eAAe,WAAW,cACrC;AAAA,IACD,MAAM,QACL,WAAW,cAAc,wBAAwB;AAAA,IAClD,MAAM,MAAM,GAAG;AAAA,IACf,IAAI;AAAA,MAAQ,QAAQ,MAAM,KAAI,KAAK;AAAA,IAC9B;AAAA,cAAQ,KAAK,OAAM,KAAK;AAAA,IAC7B;AAAA,EACD;AAAA,EAEA,IAAI,CAAC,YAAY;AAAA,IAChB,IAAI,QAAQ;AAAA,MACX,QAAQ,KACP,2GACD;AAAA,IACD;AAAA,IACA;AAAA,EACD;AAAA,EAEA,IAAI,WAAW,QAAQ;AAAA,IACtB,MAAM,MACL;AAAA,IACD,IAAI;AAAA,MAAQ,QAAQ,MAAM,KAAI,KAAK;AAAA,IAC9B;AAAA,cAAQ,KAAK,OAAM,KAAK;AAAA,EAC9B;AAAA;AAGD,SAAS,eAAe,CAAC,KAAwB;AAAA,EAChD,MAAM,WAAW,MAAM,IAAI,GAAG;AAAA,EAC9B,IAAI,UAAU;AAAA,IACb,SAAS,WAAW,KAAK,IAAI;AAAA,IAC7B,SAAS,MAAM;AAAA,IACf,OAAO;AAAA,EACR;AAAA,EAIA,MAAM,QAAQ,MAAM;AAAA,IACnB,IAAI;AAAA,MACH,OAAO,IAAI,IAAI,GAAG,EAAE;AAAA,MACnB,MAAM;AAAA,MACP,OAAO;AAAA;AAAA,KAEN;AAAA,EACH,MAAM,UACL,SAAS,eAAe,SAAS,eAAe,CAAC,KAAK,SAAS,GAAG;AAAA,EACnE,MAAM,UAAU,OAAO,SAAS,QAAQ,IAAI,qBAAqB,MAAM,EAAE;AAAA,EAGzE,MAAM,cAAc,OAAO,SAC1B,QAAQ,IAAI,yBAAyB,OACrC,EACD;AAAA,EACA,MAAM,YAAY,SAAS,KAAK;AAAA,IAC/B,KAAK;AAAA,IACL,cAAc;AAAA,IACd,KAAK,UACF,YACA;AAAA,MACA,oBAAoB,QAAQ,IAAI,iCAAiC;AAAA,IAClE;AAAA,EACH,CAAC;AAAA,EACD,MAAM,KAAK,IAAI,OAAiB;AAAA,IAC/B,SAAS,IAAI,kBAAkB,EAAE,UAAU,UAAU,CAAC;AAAA,IAKtD,KAAK,CAAC,UAAU;AAAA,MACf,IAAI,MAAM,UAAU;AAAA,QAAS;AAAA,MAC7B,MAAM,MAAM,MAAM;AAAA,MAIlB,IAAI,KAAK,SAAS;AAAA,QAAS;AAAA,MAC3B,OAAO,KAAK,qCAAqC;AAAA,QAChD,MAAM,IAAI;AAAA,QACV,SAAS,IAAI;AAAA,QACb,KAAK,MAAM,MAAM;AAAA,QACjB,QAAQ,MAAM,MAAM;AAAA,MACrB,CAAC;AAAA;AAAA,EAEH,CAAC;AAAA,EACD,MAAM,QAAmB;AAAA,IACxB;AAAA,IACA;AAAA,IACA,UAAU,KAAK,IAAI;AAAA,IACnB,KAAK;AAAA,EACN;AAAA,EACA,MAAM,IAAI,KAAK,KAAK;AAAA,EACpB,cAAc;AAAA,EACd,OAAO;AAAA;AAOD,SAAS,WAAW,GAAqB;AAAA,EAC/C,OAAO,gBAAgB,iBAAiB,CAAC,EAAE;AAAA;AAQrC,SAAS,WAAW,GAAqB;AAAA,EAC/C,OAAO,gBAAgB,iBAAiB,CAAC,EAAE;AAAA;AAQrC,SAAS,KAAK,CAAC,kBAA6C;AAAA,EAClE,IAAI;AAAA,IAAkB,OAAO,gBAAgB,gBAAgB,EAAE;AAAA,EAC/D,OAAO,YAAY;AAAA;AAOb,SAAS,YAAY,CAC3B,OAA4B,UACE;AAAA,EAC9B,MAAM,MAAM,SAAS,WAAW,iBAAiB,IAAI,iBAAiB;AAAA,EACtE,OAAO,gBAAgB,GAAG,EAAE;AAAA;AAStB,SAAS,eAAe,CAAC,KAA0C;AAAA,EACzE,OAAO,gBAAgB,GAAG,EAAE;AAAA;AAI7B,eAAsB,OAAO,GAAkB;AAAA,EAC9C,WAAW,SAAS,MAAM,OAAO,GAAG;AAAA,IACnC,MAAM,MAAM,GAAG,QAAQ;AAAA,IACvB,MAAM,MAAM,UAAU,IAAI;AAAA,EAC3B;AAAA,EACA,MAAM,MAAM;AAAA;;AIxUb,IAAM,cAAuC,CAAC,OAAO,UAAU;AAOxD,SAAS,eAAe,GAAiB;AAAA,EAC/C,MAAM,MAAM,QAAQ,IAAI,eAAe,KAAK,EAAE,YAAY;AAAA,EAC1D,IAAI,OAAQ,YAAkC,SAAS,GAAG,GAAG;AAAA,IAC5D,OAAO;AAAA,EACR;AAAA,EACA,OAAO;AAAA;AAID,SAAS,cAAc,GAAY;AAAA,EACzC,OAAO,gBAAgB,MAAM;AAAA;AAIvB,SAAS,SAAS,GAAY;AAAA,EACpC,OAAO,gBAAgB,MAAM;AAAA;;;ACpC9B;AACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQA;AAqBA,IAAM,UAAU;AAChB,IAAM,SAAS;AACf,IAAM,UAAU;AAEhB,SAAS,eAAe,CAAC,SAAgC;AAAA,EACxD,IAAI,CAAC,WAAW,OAAO;AAAA,IAAG,OAAO;AAAA,EACjC,MAAM,WAAW,aAAa,SAAS,MAAM;AAAA,EAC7C,MAAM,QAAQ,SAAS,MAAM,6CAA6C;AAAA,EAE1E,OAAO,QAAQ,MAAM,KAAM;AAAA;AAU5B,IAAM,gBAAgB;AACtB,IAAM,UAAU;AAEhB,SAAS,eAAe,GAAW;AAAA,EAClC,MAAM,UAAU,QAAQ,QAAQ,IAAI,GAAG,YAAY;AAAA,EAGnD,MAAM,WAAW,gBAAgB,OAAO;AAAA,EACxC,IAAI,UAAU;AAAA,IACb,QAAQ,IAAI,WAAW;AAAA,IACvB,OAAO;AAAA,EACR;AAAA,EAEA,MAAM,WAAW,GAAG;AAAA,EACpB,IAAI,SAAwB;AAAA,EAC5B,IAAI;AAAA,IACH,SAAS,SAAS,UAAU,MAAM,GAAK;AAAA,IACtC,OAAO,KAAK;AAAA,IACb,MAAM,IAAI;AAAA,IACV,IAAI,EAAE,SAAS;AAAA,MAAU,MAAM;AAAA;AAAA,EAGhC,IAAI,WAAW,MAAM;AAAA,IAEpB,MAAM,WAAW,KAAK,IAAI,IAAI;AAAA,IAC9B,OAAO,KAAK,IAAI,IAAI,UAAU;AAAA,MAC7B,MAAM,MAAM,gBAAgB,OAAO;AAAA,MACnC,IAAI,KAAK;AAAA,QACR,QAAQ,IAAI,WAAW;AAAA,QACvB,OAAO;AAAA,MACR;AAAA,MACA,IAAI,UAAU,OAAO;AAAA,IACtB;AAAA,IAEA,IAAI;AAAA,MACH,WAAW,QAAQ;AAAA,MAClB,MAAM;AAAA,IACR,OAAO,gBAAgB;AAAA,EACxB;AAAA,EAEA,IAAI;AAAA,IACH,MAAM,MAAM,YAAY,EAAE,EAAE,SAAS,KAAK;AAAA,IAC1C,MAAM,OAAO,GAAG,WAAW,OAAO,IAAI;AAAA,IAAO,KAAK,WAAW;AAAA;AAAA,IAC7D,eAAe,SAAS,MAAM,EAAE,MAAM,IAAM,CAAC;AAAA,IAC7C,QAAQ,IAAI,WAAW;AAAA,IACvB,QAAQ,IACP,2BAA2B,qBAAqB,qBACjD;AAAA,IACA,OAAO;AAAA,YACN;AAAA,IACD,UAAU,MAAM;AAAA,IAChB,IAAI;AAAA,MACH,WAAW,QAAQ;AAAA,MAClB,MAAM;AAAA;AAAA;AAIV,SAAS,OAAO,GAAW;AAAA,EAC1B,IAAI,MAAM,QAAQ,IAAI;AAAA,EACtB,IAAI,CAAC,KAAK;AAAA,IACT,IAAI,gBAAgB,MAAM,OAAO;AAAA,MAChC,MAAM,gBAAgB;AAAA,IACvB,EAAO;AAAA,MACN,MAAM,IAAI,MACT,GAAG,0DACJ;AAAA;AAAA,EAEF;AAAA,EACA,MAAM,MAAM,OAAO,KAAK,KAAK,KAAK;AAAA,EAClC,IAAI,IAAI,WAAW,IAAI;AAAA,IACtB,MAAM,IAAI,MAAM,GAAG,qCAAqC,IAAI,SAAS;AAAA,EACtE;AAAA,EACA,OAAO;AAAA;AAGR,IAAI,aAA4B;AAChC,SAAS,MAAM,GAAW;AAAA,EACzB,IAAI,CAAC;AAAA,IAAY,aAAa,QAAQ;AAAA,EACtC,OAAO;AAAA;AAGD,SAAS,aAAa,CAAC,WAA2B;AAAA,EACxD,MAAM,MAAM,OAAO;AAAA,EACnB,MAAM,KAAK,YAAY,MAAM;AAAA,EAC7B,MAAM,SAAS,eAAe,eAAe,KAAK,EAAE;AAAA,EACpD,MAAM,aAAa,OAAO,OAAO;AAAA,IAChC,OAAO,OAAO,WAAW,MAAM;AAAA,IAC/B,OAAO,MAAM;AAAA,EACd,CAAC;AAAA,EACD,MAAM,MAAM,OAAO,WAAW;AAAA,EAC9B,OAAO,OAAO,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC;AAAA;AAGpC,SAAS,aAAa,CAAC,UAA0B;AAAA,EACvD,MAAM,MAAM,OAAO;AAAA,EACnB,MAAM,KAAK,SAAS,SAAS,GAAG,MAAM;AAAA,EACtC,MAAM,MAAM,SAAS,SAAS,QAAQ,SAAS,OAAO;AAAA,EACtD,MAAM,aAAa,SAAS,SAAS,SAAS,OAAO;AAAA,EACrD,MAAM,WAAW,iBAAiB,eAAe,KAAK,EAAE;AAAA,EACxD,SAAS,WAAW,GAAG;AAAA,EACvB,OAAO,SAAS,OAAO,UAAU,EAAE,SAAS,MAAM,IAAI,SAAS,MAAM,MAAM;AAAA;AAIrE,SAAS,kBAAkB,GAAW;AAAA,EAC5C,OAAO,YAAY,EAAE,EAAE,SAAS,KAAK;AAAA;;;AC1JtC,gBAAsB;AAaf,SAAS,kBAAkB,CAAC,KAAqB;AAAA,EACvD,OAAO,cAAc,GAAG;AAAA;AAIlB,SAAS,mBAAmB,CAAC,UAAmC;AAAA,EACtE,OAAO,SAAS,mBACb,cAAc,SAAS,gBAAgB,IACvC;AAAA;AAIG,SAAS,aAAa,CAAC,UAA6B;AAAA,EAC1D,OAAO,SAAS,oBAAoB;AAAA;AAO9B,SAAS,iBAAiB,CAAC,UAAsC;AAAA,EACvE,MAAM,MAAM,oBAAoB,QAAQ;AAAA,EACxC,OAAO,MAAM,MAAM,GAAG,IAAI,YAAY;AAAA;AAIhC,SAAS,wBAAwB,CACvC,UAC8B;AAAA,EAC9B,MAAM,MAAM,oBAAoB,QAAQ;AAAA,EACxC,OAAO,MAAM,gBAAgB,GAAG,IAAI,aAAa,QAAQ;AAAA;AASnD,SAAS,YAAY,CAAC,cAA8B;AAAA,EAC1D,MAAM,WAAW,aAAa,QAAQ,MAAM,GAAG;AAAA,EAC/C,OAAO,YAAY;AAAA;AAQb,SAAS,eAAe,CAC9B,WACA,cACS;AAAA,EACT,IAAI,CAAC;AAAA,IAAW,OAAO,aAAa,YAAY;AAAA,EAChD,MAAM,gBAAgB,UAAU,MAAM,GAAG,CAAC,EAAE,QAAQ,MAAM,GAAG;AAAA,EAC7D,MAAM,WAAW,aAAa,QAAQ,MAAM,GAAG;AAAA,EAC/C,OAAO,YAAY,iBAAiB;AAAA;AAGrC,eAAsB,gBAAgB,CACrC,IACA,MAeoB;AAAA,EACpB,OAAO,MAAM,GACX,WAAW,WAAW,EACtB,OAAO;AAAA,IACP,MAAM,KAAK;AAAA,IACX,SAAS,KAAK;AAAA,IACd,YAAY,MAA+B,KAAK,UAAU;AAAA,IAC1D,aAAa,KAAK;AAAA,IAClB,cAAc,KAAK;AAAA,IACnB,YAAY,KAAK,aAAa;AAAA,IAC9B,cAAc,KAAK,eAAe;AAAA,IAClC,aAAa,KAAK,cAAc;AAAA,IAChC,aAAa,KAAK,cAAc;AAAA,IAChC,aAAa,KAAK,cAAc;AAAA,IAChC,kBAAkB,KAAK,kBAAkB;AAAA,EAC1C,CAAC,EACA,WAAW,CAAC,OACZ,GAAG,QAAQ,CAAC,QAAQ,YAAY,CAAC,EAAE,YAAY;AAAA,IAC9C,SAAS,KAAK;AAAA,IACd,YAAY,MAA+B,KAAK,UAAU;AAAA,IAC1D,aAAa,KAAK;AAAA,IAClB,cAAc,KAAK;AAAA,IACnB,cAAc,KAAK,eAAe;AAAA,IAClC,aAAa,KAAK,cAAc;AAAA,IAChC,aAAa,KAAK,cAAc;AAAA,IAChC,aAAa,KAAK,cAAc;AAAA,IAChC,kBAAkB,KAAK,kBAAkB;AAAA,IACzC,YAAY,IAAI;AAAA,EACjB,CAAC,CACF,EACC,aAAa,EACb,wBAAwB;AAAA;AAG3B,eAAsB,WAAW,CAChC,IACA,MACA,WAC2B;AAAA,EAC3B,IAAI,QAAQ,GAAG,WAAW,WAAW,EAAE,UAAU,EAAE,MAAM,QAAQ,KAAK,IAAI;AAAA,EAE1E,IAAI,cAAc,WAAW;AAAA,IAC5B,QAAQ,MAAM,MAAM,cAAc,KAAK,SAAS;AAAA,EACjD;AAAA,EAEA,OAAQ,MAAM,MAAM,iBAAiB,KAAM;AAAA;AAG5C,eAAsB,aAAa,CAClC,IACA,WACsB;AAAA,EACtB,IAAI,QAAQ,GAAG,WAAW,WAAW,EAAE,UAAU;AAAA,EACjD,IAAI,cAAc,WAAW;AAAA,IAC5B,QAAQ,MAAM,MAAM,cAAc,KAAK,SAAS;AAAA,EACjD;AAAA,EACA,OAAO,MAAM,QAAQ;AAAA;AAQtB,eAAsB,wBAAwB,CAC7C,IACA,MAC2B;AAAA,EAC3B,OACE,MAAM,GACL,WAAW,WAAW,EACtB,UAAU,EACV,MAAM,QAAQ,KAAK,IAAI,EACvB,MAAM,cAAc,KAAK,QAAQ,EACjC,iBAAiB,KAAM;AAAA;AAI3B,eAAsB,wBAAwB,CAC7C,IACA,MACA,WACA,YACgB;AAAA,EAChB,MAAM,GACJ,YAAY,WAAW,EACvB,IAAI,EAAE,YAAY,YAAY,IAAI,KAAO,CAAC,EAC1C,MAAM,QAAQ,KAAK,IAAI,EACvB,MAAM,cAAc,KAAK,SAAS,EAClC,QAAQ;AAAA;AAGX,eAAsB,oBAAoB,CACzC,IACA,MACA,QACA,oBACgB;AAAA,EAChB,MAAM,GACJ,YAAY,WAAW,EACvB,IAAI;AAAA,IACJ;AAAA,OACI,uBAAuB,YACxB,EAAE,sBAAsB,mBAAmB,IAC3C,CAAC;AAAA,IACJ,YAAY,IAAI;AAAA,EACjB,CAAC,EACA,MAAM,QAAQ,KAAK,IAAI,EACvB,QAAQ;AAAA;AAGX,eAAsB,uBAAuB,CAC5C,IACA,MACA,WACA,QACA,WACgB;AAAA,EAChB,MAAM,GACJ,YAAY,WAAW,EACvB,IAAI;AAAA,IACJ,iBAAiB,yBAAwB;AAAA,IACzC,cAAc,sBAAqB;AAAA,OAC/B,YACD,EAAE,YAAY,WAAW,eAAe,IAAI,KAAO,IACnD,CAAC;AAAA,IACJ,YAAY,IAAI;AAAA,EACjB,CAAC,EACA,MAAM,QAAQ,KAAK,IAAI,EACvB,QAAQ;AAAA;AAGX,eAAsB,yBAAyB,CAC9C,IACA,MACA,aACA,MACgB;AAAA,EAChB,MAAM,GACJ,YAAY,WAAW,EACvB,IAAI;AAAA,IACJ,cAAc;AAAA,OACV,MAAM,eAAe,OAAO,EAAE,cAAc,KAAK,YAAY,IAAI,CAAC;AAAA,OAClE,MAAM,cAAc,OAAO,EAAE,aAAa,KAAK,WAAW,IAAI,CAAC;AAAA,IACnE,YAAY,IAAI;AAAA,EACjB,CAAC,EACA,MAAM,QAAQ,KAAK,IAAI,EACvB,QAAQ;AAAA;AAGX,eAAsB,cAAc,CACnC,IACA,MACA,WAC2B;AAAA,EAC3B,MAAM,WAAW,MAAM,YAAY,IAAI,MAAM,SAAS;AAAA,EACtD,IAAI,CAAC;AAAA,IAAU,OAAO;AAAA,EAGtB,MAAM,aAAa,SAAS,eAAe,aAAa,IAAI;AAAA,EAQ5D,MAAM,GACJ,YAAY,eAAe,EAC3B,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR,YAAY,aAAa;AAAA,IACzB,YAAY,IAAI;AAAA,EACjB,CAAC,EACA,MAAM,iBAAiB,KAAK,IAAI,EAChC,QAAQ;AAAA,EACV,MAAM,GACJ,WAAW,qBAAqB,EAChC,MAAM,UAAU,KAAK,SAAS,EAC9B,MAAM,mBAAmB,MAAM,CAAC,OAChC,GACE,WAAW,eAAe,EAC1B,OAAO,IAAI,EACX,MAAM,iBAAiB,KAAK,IAAI,CACnC,EACC,QAAQ;AAAA,EAOV,IAAI,CAAC,cAAc,QAAQ,GAAG;AAAA,IAC7B,MAAM,6BAA4B,KAAI,IAAI,IAAI,aAAa,YAAY,QACtE,EACD;AAAA,EACD;AAAA,EAGA,MAAM,GAAG,WAAW,WAAW,EAAE,MAAM,MAAM,KAAK,SAAS,EAAE,EAAE,QAAQ;AAAA,EAEvE,OAAO;AAAA;AAIR,eAAsB,oBAAoB,CACzC,IACA,MACA,WACA,WACgB;AAAA,EAChB,MAAM,GACJ,YAAY,WAAW,EACvB,IAAI,EAAE,YAAY,UAAU,CAAC,EAC7B,MAAM,QAAQ,KAAK,IAAI,EACvB,MAAM,cAAc,KAAK,SAAS,EAClC,QAAQ;AAAA;AAoBX,eAAsB,kBAAkB,CACvC,IACA,MACA,oBACgB;AAAA,EAChB,MAAM,GACJ,YAAY,WAAW,EACvB,IAAI;AAAA,IACJ,sBAAsB;AAAA,IACtB,QAAQ;AAAA,IACR,YAAY,IAAI;AAAA,EACjB,CAAC,EACA,MAAM,QAAQ,KAAK,IAAI,EACvB,QAAQ;AAAA;",
-  "debugId": "EB2E9A3BA7B8FF6964756E2164756E21",
+  "mappings": ";;;;;;;;;;;;;;;;;AAAA;AAGA,IAAM,iBAAiB,EAAE,OAAO,EAAE,UAAU,CAAC,QAAQ;AAAA,EACpD,MAAM,WAAW,IACf,MAAM,GAAG,EACT,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,OAAO;AAAA,EAChB,MAAM,QAAQ,CAAC,WAAW,SAAS;AAAA,EACnC,WAAW,KAAK,UAAU;AAAA,IACzB,IAAI,CAAC,MAAM,SAAS,CAAC,GAAG;AAAA,MACvB,MAAM,IAAI,MACT,oBAAoB,sBAAsB,MAAM,KAAK,IAAI,GAC1D;AAAA,IACD;AAAA,EACD;AAAA,EACA,OAAO;AAAA,CACP;AAsBD,IAAM,YAAwC,EAAE,OAAO;AAAA,EACtD,cAAc,EAAE,WACf,CAAC,QAAS,OAAO,QAAQ,YAAY,IAAI,WAAW,IAAI,YAAY,KACpE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAC3B;AAAA,EACA,qBAAqB,EAAE,WACtB,CAAC,QAAS,OAAO,QAAQ,YAAY,IAAI,WAAW,IAAI,YAAY,KACpE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAC3B;AAAA,EACA,qBAAqB,EAAE,WACtB,CAAC,QAAS,OAAO,QAAQ,YAAY,IAAI,WAAW,IAAI,YAAY,KACpE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAC3B;AAAA,EACA,SAAS,EAAE,KAAK,CAAC,WAAW,SAAS,CAAC,EAAE,SAAS;AAAA,EACjD,UAAU,eAAe,SAAS;AAAA,EAClC,WAAW,EAAE,KAAK,CAAC,SAAS,QAAQ,QAAQ,OAAO,CAAC,EAAE,QAAQ,MAAM;AAAA,EACpE,UAAU,EACR,KAAK,CAAC,eAAe,cAAc,MAAM,CAAC,EAC1C,QAAQ,aAAa;AACxB,CAAC;AAMD,IAAI,YAAwB;AAErB,SAAS,MAAM,GAAQ;AAAA,EAC7B,IAAI,WAAW;AAAA,IACd,OAAO;AAAA,EACR;AAAA,EAEA,MAAM,SAAS,UAAU,UAAU,QAAQ,GAAG;AAAA,EAE9C,IAAI,CAAC,OAAO,SAAS;AAAA,IACpB,QAAQ,MAAM,sCAAqC;AAAA,IACnD,QAAQ,MAAM,EAAE,aAAa,OAAO,KAAK,CAAC;AAAA,IAC1C,MAAM,IAAI,MAAM,mCAAmC;AAAA,EACpD;AAAA,EAGA,IAAI;AAAA,EACJ,IAAI,OAAO,KAAK,YAAY,OAAO,KAAK,SAAS,SAAS,GAAG;AAAA,IAC5D,kBAAkB,OAAO,KAAK;AAAA,EAC/B,EAAO,SAAI,OAAO,KAAK,SAAS;AAAA,IAC/B,kBAAkB,CAAC,OAAO,KAAK,OAAO;AAAA,EACvC,EAAO;AAAA,IACN,kBAAkB,CAAC,SAAS;AAAA;AAAA,EAG7B,YAAY,KAAK,OAAO,MAAM,gBAAgB;AAAA,EAC9C,OAAO;AAAA;AAeD,SAAS,eAAe,GAAY;AAAA,EAE1C,OAAO,QAAQ,IAAI,gBAAgB;AAAA;AAQ7B,SAAS,oBAAoB,GAAY;AAAA,EAC/C,OAAO,QAAQ,IAAI,yBAAyB;AAAA;AAStC,SAAS,oBAAoB,GAAY;AAAA,EAC/C,OAAO,QAAQ,IAAI,yBAAyB;AAAA;;AC1H7C,IAAM,aAAuC;AAAA,EAC5C,OAAO;AAAA,EACP,MAAM;AAAA,EACN,MAAM;AAAA,EACN,OAAO;AACR;AAAA;AAEA,MAAM,OAAO;AAAA,EACJ;AAAA,EACA;AAAA,EACA,eAAe;AAAA,EAEf,IAAI,GAAG;AAAA,IACd,IAAI,KAAK;AAAA,MAAc;AAAA,IACvB,KAAK,eAAe;AAAA,IACpB,IAAI;AAAA,MACH,MAAM,MAAM,OAAO;AAAA,MACnB,KAAK,SAAS,IAAI;AAAA,MAClB,KAAK,gBAAgB,IAAI,aAAa;AAAA,MACrC,MAAM;AAAA,MAEP,KAAK,SAAS;AAAA,MACd,KAAK,gBAAgB;AAAA;AAAA;AAAA,MAIX,KAAK,GAAa;AAAA,IAC7B,KAAK,KAAK;AAAA,IAEV,OAAO,KAAK;AAAA;AAAA,MAGD,YAAY,GAAY;AAAA,IACnC,KAAK,KAAK;AAAA,IAEV,OAAO,KAAK;AAAA;AAAA,EAGL,SAAS,CAAC,OAA0B;AAAA,IAC3C,OAAO,WAAW,UAAU,WAAW,KAAK;AAAA;AAAA,EAGrC,aAAa,CACpB,OACA,SAEA,MACC;AAAA,IACD,MAAM,YAAY,IAAI,KAAK,EAAE,YAAY;AAAA,IAEzC,IAAI,KAAK,cAAc;AAAA,MAEtB,OAAO,KAAK,UAAU;AAAA,QACrB;AAAA,QACA;AAAA,QACA;AAAA,WACG;AAAA,MACJ,CAAC;AAAA,IACF;AAAA,IAGA,MAAM,UAAU,OAAO,IAAI,KAAK,UAAU,IAAI,MAAM;AAAA,IACpD,OAAO,IAAI,cAAc,MAAM,YAAY,MAAM,UAAU;AAAA;AAAA,EAI5D,KAAK,CAAC,SAAiB,MAAkC;AAAA,IACxD,IAAI,KAAK,UAAU,OAAO,GAAG;AAAA,MAC5B,QAAQ,MAAM,KAAK,cAAc,SAAS,SAAS,IAAI,CAAC;AAAA,IACzD;AAAA;AAAA,EAID,IAAI,CAAC,SAAiB,MAAkC;AAAA,IACvD,IAAI,KAAK,UAAU,MAAM,GAAG;AAAA,MAC3B,QAAQ,KAAK,KAAK,cAAc,QAAQ,SAAS,IAAI,CAAC;AAAA,IACvD;AAAA;AAAA,EAID,IAAI,CAAC,SAAiB,MAAkC;AAAA,IACvD,IAAI,KAAK,UAAU,MAAM,GAAG;AAAA,MAC3B,QAAQ,KAAK,KAAK,cAAc,QAAQ,SAAS,IAAI,CAAC;AAAA,IACvD;AAAA;AAAA,EAID,KAAK,CAAC,SAAiB,MAAkC;AAAA,IACxD,IAAI,KAAK,UAAU,OAAO,GAAG;AAAA,MAC5B,QAAQ,MAAM,KAAK,cAAc,SAAS,SAAS,IAAI,CAAC;AAAA,IACzD;AAAA;AAEF;AAGO,IAAM,SAAiB,IAAI;;;ACnGlC;AAWO,SAAS,KAAkB,CAAC,OAAyB;AAAA,EAC3D,MAAM,UAAU,KAAK,UAAU,OAAO,CAAC,IAAI,MAC1C,OAAO,MAAM,WAAW,EAAE,SAAS,IAAI,CACxC,EAAE,QAAQ,MAAM,IAAI;AAAA,EACpB,OAAO,MAAM,IAAI,IAAI,IAAI,iBAAiB;AAAA;AAQpC,SAAS,UAAuB,CAAC,OAAmB;AAAA,EAC1D,IAAI,OAAO,UAAU,UAAU;AAAA,IAC9B,IAAI;AAAA,MACH,OAAO,KAAK,MAAM,KAAK;AAAA,MACtB,MAAM;AAAA,MACP,OAAO;AAAA;AAAA,EAET;AAAA,EACA,OAAQ,SAAS,CAAC;AAAA;;;AC/BnB;AACA;AACA;AAuVA,gBAAS;;;AC3UF,IAAM,sBAAsB;AAAA,EAClC,QAAQ;AAAA,IACP;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACD;AAAA,EACA,gBAAgB;AAAA,IACf;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACD;AAAA,EACA,cAAc;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACD;AAAA,EACA,sBAAsB;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACD;AAAA,EACA,YAAY;AAAA,IACX;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACD;AAAA,EACA,aAAa;AAAA,IACZ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACD;AAAA,EACA,mBAAmB;AAAA,IAClB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACD;AAAA,EACA,iBAAiB;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACD;AAAA,EACA,sBAAsB;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACD;AAAA,EACA,wBAAwB;AAAA,IACvB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACD;AAAA,EACA,WAAW;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACD;AAAA,EACA,gBAAgB;AAAA,IACf;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACD;AAAA,EACA,oBAAoB;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACD;AAAA,EACA,yBAAyB;AAAA,IACxB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACD;AAAA,EACA,QAAQ,CAAC,gBAAgB,QAAQ,eAAe,SAAS,MAAM;AAAA,EAC/D,cAAc,CAAC,aAAa;AAC7B;AA4BO,IAAM,oBAAoB;AAAA,EAChC,QAAQ;AAAA,IACP,iBAAiB,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAChD,mBAAmB,EAAE,MAAM,MAAM;AAAA,IACjC,WAAW,EAAE,MAAM,UAAU;AAAA,IAC7B,MAAM,EAAE,MAAM,OAAO;AAAA,IACrB,QAAQ,EAAE,MAAM,MAAM;AAAA,IACtB,aAAa,EAAE,MAAM,OAAO;AAAA,IAC5B,WAAW,EAAE,MAAM,MAAM;AAAA,EAC1B;AAAA,EACA,gBAAgB;AAAA,IACf,QAAQ,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACvC,kBAAkB,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACjD,cAAc,EAAE,MAAM,MAAM;AAAA,IAC5B,WAAW,EAAE,MAAM,UAAU;AAAA,IAC7B,aAAa,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC5C,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,aAAa,EAAE,MAAM,MAAM;AAAA,IAC3B,YAAY,EAAE,MAAM,OAAO;AAAA,IAC3B,MAAM,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACrC,SAAS,EAAE,MAAM,SAAS,UAAU,KAAK;AAAA,IACzC,WAAW,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC1C,QAAQ,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACvC,OAAO,EAAE,MAAM,OAAO;AAAA,IACtB,UAAU,EAAE,MAAM,MAAM;AAAA,IACxB,OAAO,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,EACvC;AAAA,EACA,cAAc;AAAA,IACb,cAAc,EAAE,MAAM,MAAM;AAAA,IAC5B,aAAa,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC5C,eAAe,EAAE,MAAM,SAAS,UAAU,KAAK;AAAA,IAC/C,eAAe,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC9C,YAAY,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC3C,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,OAAO,EAAE,MAAM,OAAO;AAAA,IACtB,UAAU,EAAE,MAAM,MAAM;AAAA,IACxB,MAAM,EAAE,MAAM,OAAO;AAAA,EACtB;AAAA,EACA,sBAAsB;AAAA,IACrB,aAAa,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC5C,eAAe,EAAE,MAAM,SAAS,UAAU,KAAK;AAAA,IAC/C,eAAe,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC9C,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,aAAa,EAAE,MAAM,YAAY;AAAA,IACjC,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,KAAK,EAAE,MAAM,OAAO;AAAA,IACpB,OAAO,EAAE,MAAM,OAAO;AAAA,IACtB,MAAM,EAAE,MAAM,OAAO;AAAA,EACtB;AAAA,EACA,YAAY;AAAA,IACX,wBAAwB,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACvD,yBAAyB,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IACvD,aAAa,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC5C,cAAc,EAAE,MAAM,WAAW,UAAU,KAAK;AAAA,IAChD,SAAS,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACxC,aAAa,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IAC3C,YAAY,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC3C,cAAc,EAAE,MAAM,MAAM;AAAA,IAC5B,YAAY,EAAE,MAAM,YAAY;AAAA,IAChC,mBAAmB,EAAE,MAAM,MAAM;AAAA,IACjC,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,WAAW,EAAE,MAAM,UAAU;AAAA,IAC7B,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,aAAa,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC5C,WAAW,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IACzC,eAAe,EAAE,MAAM,OAAO;AAAA,IAC9B,aAAa,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IAC3C,YAAY,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC3C,cAAc,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC7C,oBAAoB,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACnD,kBAAkB,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IAChD,WAAW,EAAE,MAAM,UAAU;AAAA,IAC7B,cAAc,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IAC5C,YAAY,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC3C,kBAAkB,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACjD,eAAe,EAAE,MAAM,OAAO;AAAA,IAC9B,SAAS,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACxC,aAAa,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IAC3C,OAAO,EAAE,MAAM,OAAO;AAAA,IACtB,UAAU,EAAE,MAAM,MAAM;AAAA,EACzB;AAAA,EACA,aAAa;AAAA,IACZ,QAAQ,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACvC,cAAc,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC7C,cAAc,EAAE,MAAM,MAAM;AAAA,IAC5B,YAAY,EAAE,MAAM,YAAY;AAAA,IAChC,WAAW,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC1C,aAAa,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IAC3C,WAAW,EAAE,MAAM,UAAU;AAAA,IAC7B,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,aAAa,EAAE,MAAM,MAAM;AAAA,IAC3B,KAAK,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACpC,0BAA0B,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IACxD,yBAAyB,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACxD,SAAS,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACxC,cAAc,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IAC5C,yBAAyB,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACxD,uBAAuB,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IACrD,YAAY,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IAC1C,QAAQ,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACvC,gBAAgB,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC/C,yBAAyB,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACxD,eAAe,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC9C,mBAAmB,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IACjD,kBAAkB,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IAChD,YAAY,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC3C,OAAO,EAAE,MAAM,OAAO;AAAA,IACtB,OAAO,EAAE,MAAM,OAAO;AAAA,IACtB,UAAU,EAAE,MAAM,MAAM;AAAA,EACzB;AAAA,EACA,mBAAmB;AAAA,IAClB,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,cAAc,EAAE,MAAM,MAAM;AAAA,IAC5B,YAAY,EAAE,MAAM,YAAY;AAAA,IAChC,WAAW,EAAE,MAAM,UAAU;AAAA,IAC7B,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,aAAa,EAAE,MAAM,MAAM;AAAA,IAC3B,YAAY,EAAE,MAAM,OAAO;AAAA,IAC3B,MAAM,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACrC,WAAW,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC1C,QAAQ,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACvC,OAAO,EAAE,MAAM,OAAO;AAAA,IACtB,UAAU,EAAE,MAAM,MAAM;AAAA,EACzB;AAAA,EACA,iBAAiB;AAAA,IAChB,cAAc,EAAE,MAAM,MAAM;AAAA,IAC5B,YAAY,EAAE,MAAM,YAAY;AAAA,IAChC,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,WAAW,EAAE,MAAM,UAAU;AAAA,IAC7B,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,aAAa,EAAE,MAAM,MAAM;AAAA,IAC3B,KAAK,EAAE,MAAM,OAAO;AAAA,IACpB,4BAA4B,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC3D,aAAa,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IAC3C,MAAM,EAAE,MAAM,OAAO;AAAA,IACrB,WAAW,EAAE,MAAM,OAAO;AAAA,IAC1B,OAAO,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACtC,eAAe,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC9C,eAAe,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IAC7C,gBAAgB,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IAC9C,UAAU,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACzC,OAAO,EAAE,MAAM,OAAO;AAAA,IACtB,OAAO,EAAE,MAAM,OAAO;AAAA,IACtB,UAAU,EAAE,MAAM,MAAM;AAAA,EACzB;AAAA,EACA,sBAAsB;AAAA,IACrB,cAAc,EAAE,MAAM,MAAM;AAAA,IAC5B,YAAY,EAAE,MAAM,YAAY;AAAA,IAChC,WAAW,EAAE,MAAM,UAAU;AAAA,IAC7B,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,aAAa,EAAE,MAAM,MAAM;AAAA,IAC3B,aAAa,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IAC3C,UAAU,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IACxC,SAAS,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACxC,gBAAgB,EAAE,MAAM,WAAW,UAAU,KAAK;AAAA,IAClD,4BAA4B,EAAE,MAAM,WAAW,UAAU,KAAK;AAAA,IAC9D,WAAW,EAAE,MAAM,OAAO;AAAA,IAC1B,cAAc,EAAE,MAAM,WAAW,UAAU,KAAK;AAAA,IAChD,gBAAgB,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC/C,aAAa,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IAC3C,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,OAAO,EAAE,MAAM,OAAO;AAAA,IACtB,UAAU,EAAE,MAAM,MAAM;AAAA,EACzB;AAAA,EACA,wBAAwB;AAAA,IACvB,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,cAAc,EAAE,MAAM,MAAM;AAAA,IAC5B,YAAY,EAAE,MAAM,YAAY;AAAA,IAChC,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,WAAW,EAAE,MAAM,UAAU;AAAA,IAC7B,YAAY,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC3C,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,aAAa,EAAE,MAAM,MAAM;AAAA,IAC3B,YAAY,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC3C,OAAO,EAAE,MAAM,OAAO;AAAA,IACtB,UAAU,EAAE,MAAM,MAAM;AAAA,EACzB;AAAA,EACA,WAAW;AAAA,IACV,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,KAAK,EAAE,MAAM,OAAO;AAAA,IACpB,eAAe,EAAE,MAAM,YAAY;AAAA,IACnC,mBAAmB,EAAE,MAAM,OAAO;AAAA,IAClC,MAAM,EAAE,MAAM,OAAO;AAAA,IACrB,WAAW,EAAE,MAAM,OAAO;AAAA,IAC1B,OAAO,EAAE,MAAM,OAAO;AAAA,IACtB,eAAe,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IAC7C,gBAAgB,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,EAC/C;AAAA,EACA,gBAAgB;AAAA,IACf,eAAe,EAAE,MAAM,YAAY;AAAA,IACnC,mBAAmB,EAAE,MAAM,OAAO;AAAA,IAClC,aAAa,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IAC3C,UAAU,EAAE,MAAM,OAAO,UAAU,KAAK;AAAA,IACxC,SAAS,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IACxC,gBAAgB,EAAE,MAAM,UAAU;AAAA,IAClC,YAAY,EAAE,MAAM,MAAM;AAAA,IAC1B,WAAW,EAAE,MAAM,OAAO;AAAA,IAC1B,cAAc,EAAE,MAAM,UAAU;AAAA,EACjC;AAAA,EACA,oBAAoB;AAAA,IACnB,aAAa,EAAE,MAAM,OAAO;AAAA,IAC5B,aAAa,EAAE,MAAM,OAAO;AAAA,IAC5B,iBAAiB,EAAE,MAAM,OAAO;AAAA,IAChC,mBAAmB,EAAE,MAAM,MAAM;AAAA,IACjC,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,eAAe,EAAE,MAAM,OAAO;AAAA,IAC9B,cAAc,EAAE,MAAM,MAAM;AAAA,EAC7B;AAAA,EACA,yBAAyB;AAAA,IACxB,iBAAiB,EAAE,MAAM,OAAO;AAAA,IAChC,mBAAmB,EAAE,MAAM,MAAM;AAAA,IACjC,QAAQ,EAAE,MAAM,OAAO;AAAA,IACvB,YAAY,EAAE,MAAM,OAAO;AAAA,IAC3B,YAAY,EAAE,MAAM,MAAM;AAAA,EAC3B;AAAA,EACA,QAAQ;AAAA,IACP,cAAc,EAAE,MAAM,MAAM;AAAA,IAC5B,MAAM,EAAE,MAAM,QAAQ;AAAA,IACtB,aAAa,EAAE,MAAM,MAAM;AAAA,IAC3B,OAAO,EAAE,MAAM,OAAO;AAAA,IACtB,MAAM,EAAE,MAAM,OAAO;AAAA,EACtB;AAAA,EACA,cAAc;AAAA,IACb,aAAa,EAAE,MAAM,YAAY;AAAA,EAClC;AACD;AAaO,IAAM,kBAAkB;AAAA,EAC9B,QAAQ,CAAC,QAAQ;AAAA,EACjB,gBAAgB,CAAC,QAAQ;AAAA,EACzB,cAAc,CAAC,OAAO;AAAA,EACtB,sBAAsB,CAAC,KAAK;AAAA,EAC5B,YAAY,CAAC,QAAQ;AAAA,EACrB,aAAa,CAAC,QAAQ;AAAA,EACtB,mBAAmB,CAAC,QAAQ;AAAA,EAC5B,iBAAiB,CAAC,QAAQ;AAAA,EAC1B,sBAAsB,CAAC,QAAQ;AAAA,EAC/B,wBAAwB,CAAC,QAAQ;AAAA,EACjC,WAAW,CAAC,KAAK;AAAA,EACjB,gBAAgB,CAAC,WAAW;AAAA,EAC5B,oBAAoB,CAAC,QAAQ;AAAA,EAC7B,yBAAyB,CAAC,QAAQ;AAAA,EAClC,QAAQ,CAAC,SAAS,aAAa;AAAA,EAC/B,cAAc;AACf;;AC1eA,IAAI,cAA6B;AAE1B,SAAS,gBAAgB,CAAC,MAA2B;AAAA,EAC3D,cAAc;AAAA;AAGR,SAAS,gBAAgB,GAAkB;AAAA,EACjD,OAAO;AAAA;AAIR,eAAsB,cAAc,CAAC,IAAwC;AAAA,EAC5E,IAAI,gBAAgB,YAAY,gBAAgB;AAAA,IAAQ,MAAM,GAAG;AAAA;AAIlE,eAAsB,YAAY,CAAC,IAAwC;AAAA,EAC1E,IAAI,gBAAgB,YAAY,gBAAgB;AAAA,IAAQ,MAAM,GAAG;AAAA;;ACvB3D,IAAM,cAAc;AAAA,EAE1B,QAAQ;AAAA,EACR,cAAc;AAAA,EACd,QAAQ;AAAA,EACR,sBAAsB;AAAA,EACtB,gBAAgB;AAAA,EAChB,oBAAoB;AAAA,EACpB,sBAAsB;AAAA,EACtB,gBAAgB;AAAA,EAChB,WAAW;AAAA,EACX,cAAc;AAAA,EAGd,kBAAkB;AAAA,EAElB,qBAAqB;AAAA,EAErB,gBAAgB;AAAA,EAChB,qBAAqB;AAAA,EACrB,YAAY;AAAA,EACZ,mBAAmB;AAAA,EACnB,oBAAoB;AAAA,EACpB,aAAa;AAAA,EACb,oBAAoB;AAAA,EACpB,yBAAyB;AAAA,EACzB,aAAa;AAAA,EACb,mBAAmB;AAAA,EACnB,kBAAkB;AAAA,EAClB,uBAAuB;AAAA,EACvB,iBAAiB;AAAA,EACjB,sBAAsB;AAAA,EACtB,wBAAwB;AAAA,EACxB,WAAW;AAAA,EACX,gBAAgB;AAAA,EAEhB,UAAU;AAAA,EACV,UAAU;AAAA,EACV,UAAU;AAAA,EACV,aAAa;AAAA,EACb,cAAc;AAAA,EACd,aAAa;AAAA,EACb,iBAAiB;AAAA,EACjB,kBAAkB;AAAA,EAClB,oBAAoB;AAAA,EACpB,oBAAoB;AAAA,EACpB,yBAAyB;AAAA,EACzB,SAAS;AAAA,EACT,sBAAsB;AAAA,EACtB,uBAAuB;AAAA,EACvB,wBAAwB;AAAA,EACxB,UAAU;AAAA,EACV,cAAc;AAAA,EACd,kBAAkB;AAAA,EAElB,eAAe;AAAA,EACf,qBAAqB;AAAA,EACrB,yBAAyB;AAAA,EACzB,yBAAyB;AAAA,EAEzB,WAAW;AAAA,EACX,qBAAqB;AAAA,EACrB,2BAA2B;AAAA,EAC3B,eAAe;AAAA,EACf,sBAAsB;AAAA,EACtB,2BAA2B;AAAA,EAC3B,0BAA0B;AAAA,EAE1B,eAAe;AAAA,EACf,eAAe;AAAA,EACf,iBAAiB;AAAA,EAEjB,oBAAoB;AACrB;;;AHtFA,IAAM,cACL;AAqBD,IAAM,QAAQ,IAAI;AAClB,IAAI,UAAU;AAEd,SAAS,QAAQ,GAAW;AAAA,EAC3B,OAAO,OAAO,SAAS,QAAQ,IAAI,sBAAsB,MAAM,EAAE;AAAA;AAIlE,SAAS,aAAa,GAAS;AAAA,EAC9B,IAAI,MAAM,QAAQ,SAAS;AAAA,IAAG;AAAA,EAC9B,MAAM,gBAAgB,IAAI,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC,CAAC;AAAA,EACtE,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,YAAY,KAAK,UAAU,OAAO;AAAA,IACjC,IAAI,cAAc,IAAI,GAAG;AAAA,MAAG;AAAA,IAC5B,IACC,CAAC,YACD,MAAM,WAAW,SAAS,YACzB,MAAM,aAAa,SAAS,YAAY,MAAM,MAAM,SAAS,KAC7D;AAAA,MACD,SAAS;AAAA,MACT,WAAW;AAAA,IACZ;AAAA,EACD;AAAA,EACA,IAAI,CAAC,UAAU,CAAC;AAAA,IAAU;AAAA,EAC1B,MAAM,OAAO,MAAM;AAAA,EACnB,MAAM,UAAU;AAAA,EAEX,QAAQ,GACX,QAAQ,EACR,MAAM,MAAM,EAAE,EACd,KAAK,MAAM,QAAQ,UAAU,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,EAChD,MAAM,MAAM,EAAE;AAAA;AAGjB,SAAS,gBAAgB,GAAW;AAAA,EACnC,OACC,QAAQ,IAAI,uBAAuB,QAAQ,IAAI,gBAAgB;AAAA;AAIjE,SAAS,gBAAgB,GAAW;AAAA,EACnC,OACC,QAAQ,IAAI,uBAAuB,QAAQ,IAAI,gBAAgB;AAAA;AAKjE,SAAS,aAAa,CAAC,KAAqB;AAAA,EAC3C,IAAI;AAAA,IACH,MAAM,IAAI,IAAI,IAAI,GAAG;AAAA,IACrB,OAAO,GAAG,EAAE,WAAW,EAAE,OAAO,IAAI,EAAE,SAAS,KAAK,EAAE;AAAA,IACrD,MAAM;AAAA,IACP,OAAO;AAAA;AAAA;AAKT,IAAI,8BAA8B;AAqBlC,SAAS,kCAAkC,GAAS;AAAA,EACnD,IAAI;AAAA,IAA6B;AAAA,EAIjC,IAAI,QAAQ,IAAI,gBAAgB;AAAA,IAAQ;AAAA,EACxC,IACC,QAAQ,IAAI,gBACZ,QAAQ,IAAI,uBACZ,QAAQ,IAAI,qBACX;AAAA,IACD;AAAA,EACD;AAAA,EACA,8BAA8B;AAAA,EAC9B,QAAQ,KACP,yEAAwE,cACvE,WACD,gIACD;AAAA;AAGD,mCAAmC;AAuB5B,SAAS,gBAAgB,GAAkB;AAAA,EACjD,MAAM,SAAS,iBAAiB;AAAA,EAChC,MAAM,SAAS,iBAAiB;AAAA,EAChC,MAAM,SAAS,WAAW;AAAA,EAC1B,OAAO;AAAA,IACN,MAAM,SAAS,UAAU;AAAA,IACzB;AAAA,IACA,UAAU,cAAc,MAAM;AAAA,IAC9B,UAAU,cAAc,MAAM;AAAA,EAC/B;AAAA;AAiBM,SAAS,aAAa,GAAS;AAAA,EAGrC,MAAM,SAAS,gBAAgB;AAAA,EAC/B,MAAM,aAAa,CAAC,EACnB,QAAQ,IAAI,uBAAuB,QAAQ,IAAI;AAAA,EAEhD,MAAM,iBAAiB,CAAC,CAAC,QAAQ,IAAI;AAAA,EACrC,MAAM,SAAS,iBAAiB;AAAA,EAChC,MAAM,SAAS,iBAAiB;AAAA,EAEhC,IACC,cACA,CAAC,mBACA,WAAW,eAAe,WAAW,cACrC;AAAA,IACD,MAAM,QACL,WAAW,cAAc,wBAAwB;AAAA,IAClD,MAAM,MAAM,GAAG;AAAA,IACf,IAAI;AAAA,MAAQ,QAAQ,MAAM,KAAI,KAAK;AAAA,IAC9B;AAAA,cAAQ,KAAK,OAAM,KAAK;AAAA,IAC7B;AAAA,EACD;AAAA,EAEA,IAAI,CAAC,YAAY;AAAA,IAChB,IAAI,QAAQ;AAAA,MACX,QAAQ,KACP,2GACD;AAAA,IACD;AAAA,IACA;AAAA,EACD;AAAA,EAEA,IAAI,WAAW,QAAQ;AAAA,IACtB,MAAM,MACL;AAAA,IACD,IAAI;AAAA,MAAQ,QAAQ,MAAM,KAAI,KAAK;AAAA,IAC9B;AAAA,cAAQ,KAAK,OAAM,KAAK;AAAA,EAC9B;AAAA;AAGD,SAAS,eAAe,CAAC,KAAwB;AAAA,EAChD,MAAM,WAAW,MAAM,IAAI,GAAG;AAAA,EAC9B,IAAI,UAAU;AAAA,IACb,SAAS,WAAW,KAAK,IAAI;AAAA,IAC7B,SAAS,MAAM;AAAA,IACf,OAAO;AAAA,EACR;AAAA,EAIA,MAAM,QAAQ,MAAM;AAAA,IACnB,IAAI;AAAA,MACH,OAAO,IAAI,IAAI,GAAG,EAAE;AAAA,MACnB,MAAM;AAAA,MACP,OAAO;AAAA;AAAA,KAEN;AAAA,EACH,MAAM,UACL,SAAS,eAAe,SAAS,eAAe,CAAC,KAAK,SAAS,GAAG;AAAA,EACnE,MAAM,UAAU,OAAO,SAAS,QAAQ,IAAI,qBAAqB,MAAM,EAAE;AAAA,EAGzE,MAAM,cAAc,OAAO,SAC1B,QAAQ,IAAI,yBAAyB,OACrC,EACD;AAAA,EACA,MAAM,YAAY,SAAS,KAAK;AAAA,IAC/B,KAAK;AAAA,IACL,cAAc;AAAA,IACd,KAAK,UACF,YACA;AAAA,MACA,oBAAoB,QAAQ,IAAI,iCAAiC;AAAA,IAClE;AAAA,EACH,CAAC;AAAA,EACD,MAAM,KAAK,IAAI,OAAiB;AAAA,IAC/B,SAAS,IAAI,kBAAkB,EAAE,UAAU,UAAU,CAAC;AAAA,IAKtD,KAAK,CAAC,UAAU;AAAA,MACf,IAAI,MAAM,UAAU;AAAA,QAAS;AAAA,MAC7B,MAAM,MAAM,MAAM;AAAA,MAIlB,IAAI,KAAK,SAAS;AAAA,QAAS;AAAA,MAC3B,OAAO,KAAK,qCAAqC;AAAA,QAChD,MAAM,IAAI;AAAA,QACV,SAAS,IAAI;AAAA,QACb,KAAK,MAAM,MAAM;AAAA,QACjB,QAAQ,MAAM,MAAM;AAAA,MACrB,CAAC;AAAA;AAAA,EAEH,CAAC;AAAA,EACD,MAAM,QAAmB;AAAA,IACxB;AAAA,IACA;AAAA,IACA,UAAU,KAAK,IAAI;AAAA,IACnB,KAAK;AAAA,EACN;AAAA,EACA,MAAM,IAAI,KAAK,KAAK;AAAA,EACpB,cAAc;AAAA,EACd,OAAO;AAAA;AAOD,SAAS,WAAW,GAAqB;AAAA,EAC/C,OAAO,gBAAgB,iBAAiB,CAAC,EAAE;AAAA;AAQrC,SAAS,WAAW,GAAqB;AAAA,EAC/C,OAAO,gBAAgB,iBAAiB,CAAC,EAAE;AAAA;AAQrC,SAAS,KAAK,CAAC,kBAA6C;AAAA,EAClE,IAAI;AAAA,IAAkB,OAAO,gBAAgB,gBAAgB,EAAE;AAAA,EAC/D,OAAO,YAAY;AAAA;AAOb,SAAS,YAAY,CAC3B,OAA4B,UACE;AAAA,EAC9B,MAAM,MAAM,SAAS,WAAW,iBAAiB,IAAI,iBAAiB;AAAA,EACtE,OAAO,gBAAgB,GAAG,EAAE;AAAA;AAStB,SAAS,eAAe,CAAC,KAA0C;AAAA,EACzE,OAAO,gBAAgB,GAAG,EAAE;AAAA;AAI7B,eAAsB,OAAO,GAAkB;AAAA,EAC9C,WAAW,SAAS,MAAM,OAAO,GAAG;AAAA,IACnC,MAAM,MAAM,GAAG,QAAQ;AAAA,IACvB,MAAM,MAAM,UAAU,IAAI;AAAA,EAC3B;AAAA,EACA,MAAM,MAAM;AAAA;;AIxUb,IAAM,cAAuC,CAAC,OAAO,UAAU;AAOxD,SAAS,eAAe,GAAiB;AAAA,EAC/C,MAAM,MAAM,QAAQ,IAAI,eAAe,KAAK,EAAE,YAAY;AAAA,EAC1D,IAAI,OAAQ,YAAkC,SAAS,GAAG,GAAG;AAAA,IAC5D,OAAO;AAAA,EACR;AAAA,EACA,OAAO;AAAA;AAID,SAAS,cAAc,GAAY;AAAA,EACzC,OAAO,gBAAgB,MAAM;AAAA;AAIvB,SAAS,SAAS,GAAY;AAAA,EACpC,OAAO,gBAAgB,MAAM;AAAA;;;ACpC9B;AACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQA;AAqBA,IAAM,UAAU;AAChB,IAAM,SAAS;AACf,IAAM,UAAU;AAEhB,SAAS,eAAe,CAAC,SAAgC;AAAA,EACxD,IAAI,CAAC,WAAW,OAAO;AAAA,IAAG,OAAO;AAAA,EACjC,MAAM,WAAW,aAAa,SAAS,MAAM;AAAA,EAC7C,MAAM,QAAQ,SAAS,MAAM,6CAA6C;AAAA,EAE1E,OAAO,QAAQ,MAAM,KAAM;AAAA;AAU5B,IAAM,gBAAgB;AACtB,IAAM,UAAU;AAEhB,SAAS,eAAe,GAAW;AAAA,EAClC,MAAM,UAAU,QAAQ,QAAQ,IAAI,GAAG,YAAY;AAAA,EAGnD,MAAM,WAAW,gBAAgB,OAAO;AAAA,EACxC,IAAI,UAAU;AAAA,IACb,QAAQ,IAAI,WAAW;AAAA,IACvB,OAAO;AAAA,EACR;AAAA,EAEA,MAAM,WAAW,GAAG;AAAA,EACpB,IAAI,SAAwB;AAAA,EAC5B,IAAI;AAAA,IACH,SAAS,SAAS,UAAU,MAAM,GAAK;AAAA,IACtC,OAAO,KAAK;AAAA,IACb,MAAM,IAAI;AAAA,IACV,IAAI,EAAE,SAAS;AAAA,MAAU,MAAM;AAAA;AAAA,EAGhC,IAAI,WAAW,MAAM;AAAA,IAEpB,MAAM,WAAW,KAAK,IAAI,IAAI;AAAA,IAC9B,OAAO,KAAK,IAAI,IAAI,UAAU;AAAA,MAC7B,MAAM,MAAM,gBAAgB,OAAO;AAAA,MACnC,IAAI,KAAK;AAAA,QACR,QAAQ,IAAI,WAAW;AAAA,QACvB,OAAO;AAAA,MACR;AAAA,MACA,IAAI,UAAU,OAAO;AAAA,IACtB;AAAA,IAEA,IAAI;AAAA,MACH,WAAW,QAAQ;AAAA,MAClB,MAAM;AAAA,IACR,OAAO,gBAAgB;AAAA,EACxB;AAAA,EAEA,IAAI;AAAA,IACH,MAAM,MAAM,YAAY,EAAE,EAAE,SAAS,KAAK;AAAA,IAC1C,MAAM,OAAO,GAAG,WAAW,OAAO,IAAI;AAAA,IAAO,KAAK,WAAW;AAAA;AAAA,IAC7D,eAAe,SAAS,MAAM,EAAE,MAAM,IAAM,CAAC;AAAA,IAC7C,QAAQ,IAAI,WAAW;AAAA,IACvB,QAAQ,IACP,2BAA2B,qBAAqB,qBACjD;AAAA,IACA,OAAO;AAAA,YACN;AAAA,IACD,UAAU,MAAM;AAAA,IAChB,IAAI;AAAA,MACH,WAAW,QAAQ;AAAA,MAClB,MAAM;AAAA;AAAA;AAIV,SAAS,OAAO,GAAW;AAAA,EAC1B,IAAI,MAAM,QAAQ,IAAI;AAAA,EACtB,IAAI,CAAC,KAAK;AAAA,IACT,IAAI,gBAAgB,MAAM,OAAO;AAAA,MAChC,MAAM,gBAAgB;AAAA,IACvB,EAAO;AAAA,MACN,MAAM,IAAI,MACT,GAAG,0DACJ;AAAA;AAAA,EAEF;AAAA,EACA,MAAM,MAAM,OAAO,KAAK,KAAK,KAAK;AAAA,EAClC,IAAI,IAAI,WAAW,IAAI;AAAA,IACtB,MAAM,IAAI,MAAM,GAAG,qCAAqC,IAAI,SAAS;AAAA,EACtE;AAAA,EACA,OAAO;AAAA;AAGR,IAAI,aAA4B;AAChC,SAAS,MAAM,GAAW;AAAA,EACzB,IAAI,CAAC;AAAA,IAAY,aAAa,QAAQ;AAAA,EACtC,OAAO;AAAA;AAWD,SAAS,mBAAmB,GAAY;AAAA,EAC9C,IAAI,QAAQ,IAAI;AAAA,IAAU,OAAO;AAAA,EACjC,IAAI,gBAAgB,MAAM,OAAO;AAAA,IAChC,MAAM,UAAU,QAAQ,QAAQ,IAAI,GAAG,YAAY;AAAA,IACnD,OAAO,gBAAgB,OAAO,MAAM;AAAA,EACrC;AAAA,EACA,OAAO;AAAA;AAGD,SAAS,aAAa,CAAC,WAA2B;AAAA,EACxD,MAAM,MAAM,OAAO;AAAA,EACnB,MAAM,KAAK,YAAY,MAAM;AAAA,EAC7B,MAAM,SAAS,eAAe,eAAe,KAAK,EAAE;AAAA,EACpD,MAAM,aAAa,OAAO,OAAO;AAAA,IAChC,OAAO,OAAO,WAAW,MAAM;AAAA,IAC/B,OAAO,MAAM;AAAA,EACd,CAAC;AAAA,EACD,MAAM,MAAM,OAAO,WAAW;AAAA,EAC9B,OAAO,OAAO,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC;AAAA;AAGpC,SAAS,aAAa,CAAC,UAA0B;AAAA,EACvD,MAAM,MAAM,OAAO;AAAA,EACnB,MAAM,KAAK,SAAS,SAAS,GAAG,MAAM;AAAA,EACtC,MAAM,MAAM,SAAS,SAAS,QAAQ,SAAS,OAAO;AAAA,EACtD,MAAM,aAAa,SAAS,SAAS,SAAS,OAAO;AAAA,EACrD,MAAM,WAAW,iBAAiB,eAAe,KAAK,EAAE;AAAA,EACxD,SAAS,WAAW,GAAG;AAAA,EACvB,OAAO,SAAS,OAAO,UAAU,EAAE,SAAS,MAAM,IAAI,SAAS,MAAM,MAAM;AAAA;AAIrE,SAAS,kBAAkB,GAAW;AAAA,EAC5C,OAAO,YAAY,EAAE,EAAE,SAAS,KAAK;AAAA;;;AC3KtC,gBAAsB;AAaf,SAAS,kBAAkB,CAAC,KAAqB;AAAA,EACvD,OAAO,cAAc,GAAG;AAAA;AAIlB,SAAS,mBAAmB,CAAC,UAAmC;AAAA,EACtE,OAAO,SAAS,mBACb,cAAc,SAAS,gBAAgB,IACvC;AAAA;AAIG,SAAS,aAAa,CAAC,UAA6B;AAAA,EAC1D,OAAO,SAAS,oBAAoB;AAAA;AAO9B,SAAS,iBAAiB,CAAC,UAAsC;AAAA,EACvE,MAAM,MAAM,oBAAoB,QAAQ;AAAA,EACxC,OAAO,MAAM,MAAM,GAAG,IAAI,YAAY;AAAA;AAIhC,SAAS,wBAAwB,CACvC,UAC8B;AAAA,EAC9B,MAAM,MAAM,oBAAoB,QAAQ;AAAA,EACxC,OAAO,MAAM,gBAAgB,GAAG,IAAI,aAAa,QAAQ;AAAA;AASnD,SAAS,YAAY,CAAC,cAA8B;AAAA,EAC1D,MAAM,WAAW,aAAa,QAAQ,MAAM,GAAG;AAAA,EAC/C,OAAO,YAAY;AAAA;AAQb,SAAS,eAAe,CAC9B,WACA,cACS;AAAA,EACT,IAAI,CAAC;AAAA,IAAW,OAAO,aAAa,YAAY;AAAA,EAChD,MAAM,gBAAgB,UAAU,MAAM,GAAG,CAAC,EAAE,QAAQ,MAAM,GAAG;AAAA,EAC7D,MAAM,WAAW,aAAa,QAAQ,MAAM,GAAG;AAAA,EAC/C,OAAO,YAAY,iBAAiB;AAAA;AAGrC,eAAsB,gBAAgB,CACrC,IACA,MAeoB;AAAA,EACpB,OAAO,MAAM,GACX,WAAW,WAAW,EACtB,OAAO;AAAA,IACP,MAAM,KAAK;AAAA,IACX,SAAS,KAAK;AAAA,IACd,YAAY,MAA+B,KAAK,UAAU;AAAA,IAC1D,aAAa,KAAK;AAAA,IAClB,cAAc,KAAK;AAAA,IACnB,YAAY,KAAK,aAAa;AAAA,IAC9B,cAAc,KAAK,eAAe;AAAA,IAClC,aAAa,KAAK,cAAc;AAAA,IAChC,aAAa,KAAK,cAAc;AAAA,IAChC,aAAa,KAAK,cAAc;AAAA,IAChC,kBAAkB,KAAK,kBAAkB;AAAA,EAC1C,CAAC,EACA,WAAW,CAAC,OACZ,GAAG,QAAQ,CAAC,QAAQ,YAAY,CAAC,EAAE,YAAY;AAAA,IAC9C,SAAS,KAAK;AAAA,IACd,YAAY,MAA+B,KAAK,UAAU;AAAA,IAC1D,aAAa,KAAK;AAAA,IAClB,cAAc,KAAK;AAAA,IACnB,cAAc,KAAK,eAAe;AAAA,IAClC,aAAa,KAAK,cAAc;AAAA,IAChC,aAAa,KAAK,cAAc;AAAA,IAChC,aAAa,KAAK,cAAc;AAAA,IAChC,kBAAkB,KAAK,kBAAkB;AAAA,IACzC,YAAY,IAAI;AAAA,EACjB,CAAC,CACF,EACC,aAAa,EACb,wBAAwB;AAAA;AAG3B,eAAsB,WAAW,CAChC,IACA,MACA,WAC2B;AAAA,EAC3B,IAAI,QAAQ,GAAG,WAAW,WAAW,EAAE,UAAU,EAAE,MAAM,QAAQ,KAAK,IAAI;AAAA,EAE1E,IAAI,cAAc,WAAW;AAAA,IAC5B,QAAQ,MAAM,MAAM,cAAc,KAAK,SAAS;AAAA,EACjD;AAAA,EAEA,OAAQ,MAAM,MAAM,iBAAiB,KAAM;AAAA;AAG5C,eAAsB,aAAa,CAClC,IACA,WACsB;AAAA,EACtB,IAAI,QAAQ,GAAG,WAAW,WAAW,EAAE,UAAU;AAAA,EACjD,IAAI,cAAc,WAAW;AAAA,IAC5B,QAAQ,MAAM,MAAM,cAAc,KAAK,SAAS;AAAA,EACjD;AAAA,EACA,OAAO,MAAM,QAAQ;AAAA;AAQtB,eAAsB,wBAAwB,CAC7C,IACA,MAC2B;AAAA,EAC3B,OACE,MAAM,GACL,WAAW,WAAW,EACtB,UAAU,EACV,MAAM,QAAQ,KAAK,IAAI,EACvB,MAAM,cAAc,KAAK,QAAQ,EACjC,iBAAiB,KAAM;AAAA;AAI3B,eAAsB,wBAAwB,CAC7C,IACA,MACA,WACA,YACgB;AAAA,EAChB,MAAM,GACJ,YAAY,WAAW,EACvB,IAAI,EAAE,YAAY,YAAY,IAAI,KAAO,CAAC,EAC1C,MAAM,QAAQ,KAAK,IAAI,EACvB,MAAM,cAAc,KAAK,SAAS,EAClC,QAAQ;AAAA;AAGX,eAAsB,oBAAoB,CACzC,IACA,MACA,QACA,oBACgB;AAAA,EAChB,MAAM,GACJ,YAAY,WAAW,EACvB,IAAI;AAAA,IACJ;AAAA,OACI,uBAAuB,YACxB,EAAE,sBAAsB,mBAAmB,IAC3C,CAAC;AAAA,IACJ,YAAY,IAAI;AAAA,EACjB,CAAC,EACA,MAAM,QAAQ,KAAK,IAAI,EACvB,QAAQ;AAAA;AAkBX,eAAsB,eAAe,CACpC,IACA,MACA,aACmB;AAAA,EACnB,MAAM,SAAS,MAAM,GACnB,YAAY,WAAW,EACvB,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR,sBAAsB;AAAA,IACtB,YAAY,IAAI;AAAA,EACjB,CAAC,EACA,MAAM,QAAQ,KAAK,IAAI,EACvB,MAAM,wBAAwB,KAAK,WAAW,EAC9C,iBAAiB;AAAA,EACnB,OAAO,OAAO,OAAO,kBAAkB,EAAE,IAAI;AAAA;AAG9C,eAAsB,uBAAuB,CAC5C,IACA,MACA,WACA,QACA,WACgB;AAAA,EAChB,MAAM,GACJ,YAAY,WAAW,EACvB,IAAI;AAAA,IACJ,iBAAiB,yBAAwB;AAAA,IACzC,cAAc,sBAAqB;AAAA,OAC/B,YACD,EAAE,YAAY,WAAW,eAAe,IAAI,KAAO,IACnD,CAAC;AAAA,IACJ,YAAY,IAAI;AAAA,EACjB,CAAC,EACA,MAAM,QAAQ,KAAK,IAAI,EACvB,QAAQ;AAAA;AAGX,eAAsB,yBAAyB,CAC9C,IACA,MACA,aACA,MACgB;AAAA,EAChB,MAAM,GACJ,YAAY,WAAW,EACvB,IAAI;AAAA,IACJ,cAAc;AAAA,OACV,MAAM,eAAe,OAAO,EAAE,cAAc,KAAK,YAAY,IAAI,CAAC;AAAA,OAClE,MAAM,cAAc,OAAO,EAAE,aAAa,KAAK,WAAW,IAAI,CAAC;AAAA,IACnE,YAAY,IAAI;AAAA,EACjB,CAAC,EACA,MAAM,QAAQ,KAAK,IAAI,EACvB,QAAQ;AAAA;AAGX,eAAsB,cAAc,CACnC,IACA,MACA,WAC2B;AAAA,EAC3B,MAAM,WAAW,MAAM,YAAY,IAAI,MAAM,SAAS;AAAA,EACtD,IAAI,CAAC;AAAA,IAAU,OAAO;AAAA,EAGtB,MAAM,aAAa,SAAS,eAAe,aAAa,IAAI;AAAA,EAQ5D,MAAM,GACJ,YAAY,eAAe,EAC3B,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR,YAAY,aAAa;AAAA,IACzB,YAAY,IAAI;AAAA,EACjB,CAAC,EACA,MAAM,iBAAiB,KAAK,IAAI,EAChC,QAAQ;AAAA,EACV,MAAM,GACJ,WAAW,qBAAqB,EAChC,MAAM,UAAU,KAAK,SAAS,EAC9B,MAAM,mBAAmB,MAAM,CAAC,OAChC,GACE,WAAW,eAAe,EAC1B,OAAO,IAAI,EACX,MAAM,iBAAiB,KAAK,IAAI,CACnC,EACC,QAAQ;AAAA,EAOV,IAAI,CAAC,cAAc,QAAQ,GAAG;AAAA,IAC7B,MAAM,6BAA4B,KAAI,IAAI,IAAI,aAAa,YAAY,QACtE,EACD;AAAA,EACD;AAAA,EAGA,MAAM,GAAG,WAAW,WAAW,EAAE,MAAM,MAAM,KAAK,SAAS,EAAE,EAAE,QAAQ;AAAA,EAEvE,OAAO;AAAA;AAIR,eAAsB,oBAAoB,CACzC,IACA,MACA,WACA,WACgB;AAAA,EAChB,MAAM,GACJ,YAAY,WAAW,EACvB,IAAI,EAAE,YAAY,UAAU,CAAC,EAC7B,MAAM,QAAQ,KAAK,IAAI,EACvB,MAAM,cAAc,KAAK,SAAS,EAClC,QAAQ;AAAA;AAqCX,eAAsB,kBAAkB,CACvC,IACA,MACA,oBACmB;AAAA,EACnB,MAAM,SAAS,MAAM,GACnB,YAAY,WAAW,EACvB,IAAI;AAAA,IACJ,sBAAsB;AAAA,IACtB,QAAQ;AAAA,IACR,YAAY,IAAI;AAAA,EACjB,CAAC,EACA,MAAM,QAAQ,KAAK,IAAI,EACvB,MAAM,wBAAwB,KAAK,kBAAkB,EACrD,iBAAiB;AAAA,EACnB,OAAO,OAAO,OAAO,kBAAkB,EAAE,IAAI;AAAA;AAkB9C,eAAsB,kBAAkB,CACvC,IACA,MACA,oBACgB;AAAA,EAChB,MAAM,GACJ,YAAY,WAAW,EACvB,IAAI;AAAA,IACJ,sBAAsB;AAAA,IACtB,QAAQ;AAAA,IACR,YAAY,IAAI;AAAA,EACjB,CAAC,EACA,MAAM,QAAQ,KAAK,IAAI,EACvB,QAAQ;AAAA;",
+  "debugId": "1A6BD206140BEBFE64756E2164756E21",
   "names": []
 }

package/dist/src/db/queries/subscriptions.js

@@ -175,6 +175,15 @@ function getKey() {
     _cachedKey = loadKey();
   return _cachedKey;
 }
+function secretsKeyAvailable() {
+  if (process.env[KEY_ENV])
+    return true;
+  if (getInstanceMode() === "oss") {
+    const envPath = resolve(process.cwd(), ".env.local");
+    return readExistingKey(envPath) !== null;
+  }
+  return false;
+}
 function encryptSecret(plaintext) {
   const key = getKey();
   const iv = randomBytes2(IV_LEN);
@@ -313,5 +322,5 @@ export {
   createSubscription
 };
 
-//# debugId=D7D84F5D4DCA785B64756E2164756E21
+//# debugId=82CE895808FBD66564756E2164756E21
 //# sourceMappingURL=subscriptions.js.map

package/dist/src/db/queries/subscriptions.js.map

@@ -4,10 +4,10 @@
   "sourcesContent": [
     "import { createHmac, randomBytes } from \"node:crypto\";\n\n/**\n * Generate a random secret for delivery signing\n * Returns 32 bytes as a 64-character hex string\n */\nexport function generateSecret(): string {\n\treturn randomBytes(32).toString(\"hex\");\n}\n\n/**\n * Sign a payload with HMAC-SHA256\n * Returns the signature as a hex string\n */\nexport function signPayload(payload: string, secret: string): string {\n\tconst hmac = createHmac(\"sha256\", secret);\n\thmac.update(payload);\n\treturn hmac.digest(\"hex\");\n}\n\n/**\n * Verify an HMAC signature\n * Uses constant-time comparison to prevent timing attacks\n */\nexport function verifySignature(\n\tpayload: string,\n\tsignature: string,\n\tsecret: string,\n): boolean {\n\tconst expectedSignature = signPayload(payload, secret);\n\n\t// Constant-time comparison\n\tif (signature.length !== expectedSignature.length) {\n\t\treturn false;\n\t}\n\n\tlet result = 0;\n\tfor (let i = 0; i < signature.length; i++) {\n\t\tresult |= signature.charCodeAt(i) ^ expectedSignature.charCodeAt(i);\n\t}\n\n\treturn result === 0;\n}\n\n/**\n * Create a Stripe-style signature header\n * Format: t=timestamp,v1=signature\n */\nexport function createSignatureHeader(\n\tpayload: string,\n\tsecret: string,\n\ttimestamp?: number,\n): string {\n\tconst ts = timestamp ?? Math.floor(Date.now() / 1000);\n\tconst signedPayload = `${ts}.${payload}`;\n\tconst signature = signPayload(signedPayload, secret);\n\n\treturn `t=${ts},v1=${signature}`;\n}\n\n/**\n * Parse and verify a Stripe-style signature header\n * Returns true if valid, false otherwise\n */\nexport function verifySignatureHeader(\n\tpayload: string,\n\theader: string,\n\tsecret: string,\n\ttoleranceSeconds = 300, // 5 minutes\n): boolean {\n\t// Parse header\n\tconst parts = header.split(\",\");\n\tconst timestamp = parts.find((p) => p.startsWith(\"t=\"))?.slice(2);\n\tconst signature = parts.find((p) => p.startsWith(\"v1=\"))?.slice(3);\n\n\tif (!timestamp || !signature) {\n\t\treturn false;\n\t}\n\n\tconst ts = Number.parseInt(timestamp, 10);\n\tif (Number.isNaN(ts)) {\n\t\treturn false;\n\t}\n\n\t// Check timestamp is within tolerance\n\tconst now = Math.floor(Date.now() / 1000);\n\tif (Math.abs(now - ts) > toleranceSeconds) {\n\t\treturn false;\n\t}\n\n\t// Verify signature\n\tconst signedPayload = `${ts}.${payload}`;\n\treturn verifySignature(signedPayload, signature, secret);\n}\n",
     "/**\n * Instance modes for the Secondlayer platform.\n *\n * - `oss`: self-hosted, single-tenant. No auth middleware, no platform routes\n *   (projects, admin). Everything runs against a single `DATABASE_URL`.\n *   Intended for `docker compose up`.\n *\n * - `platform`: control-plane mode. Magic-link auth, API keys, projects,\n *   admin. Serves the dashboard + CLI against a single shared DB. Post\n *   2026-05-14 shared-rip this also serves subgraphs + subscriptions.\n */\n\nexport type InstanceMode = \"oss\" | \"platform\";\n\nconst VALID_MODES: readonly InstanceMode[] = [\"oss\", \"platform\"];\n\n/**\n * Resolve the active instance mode from `process.env.INSTANCE_MODE`.\n * Defaults to `\"oss\"` — the safest default for self-hosters who deploy\n * without setting the variable.\n */\nexport function getInstanceMode(): InstanceMode {\n\tconst raw = process.env.INSTANCE_MODE?.trim().toLowerCase();\n\tif (raw && (VALID_MODES as readonly string[]).includes(raw)) {\n\t\treturn raw as InstanceMode;\n\t}\n\treturn \"oss\";\n}\n\n/** True when the active mode is `\"platform\"` (shared multi-tenant). */\nexport function isPlatformMode(): boolean {\n\treturn getInstanceMode() === \"platform\";\n}\n\n/** True when the active mode is `\"oss\"` (self-hosted). */\nexport function isOssMode(): boolean {\n\treturn getInstanceMode() === \"oss\";\n}\n",
-    "import { createCipheriv, createDecipheriv, randomBytes } from \"node:crypto\";\nimport {\n\tappendFileSync,\n\tcloseSync,\n\texistsSync,\n\topenSync,\n\treadFileSync,\n\tunlinkSync,\n} from \"node:fs\";\nimport { resolve } from \"node:path\";\nimport { getInstanceMode } from \"../mode.ts\";\n\n/**\n * AES-256-GCM symmetric envelope for encrypted secrets at rest (tenant keys,\n * subscription signing secrets, etc.).\n *\n * Ciphertext layout: `iv (12 bytes) || authTag (16 bytes) || ciphertext`\n *\n * The key comes from `SECONDLAYER_SECRETS_KEY` — 32 bytes hex. In OSS mode,\n * if the env var is unset on first use we autogenerate a key and persist it\n * to `.env.local` in the current working directory so subsequent restarts\n * pick it up without user intervention. Dedicated/platform modes throw —\n * those runtimes must provision the key explicitly.\n *\n * Rotation strategy: re-encrypt all rows with the new key and swap the env\n * var. Not zero-downtime, but acceptable at v2 scale. For real KMS (AWS\n * KMS, Vault, GCP KMS), wrap the same byte layout behind an\n * `EncryptSecret`/`DecryptSecret` interface and swap at startup.\n */\n\nconst KEY_ENV = \"SECONDLAYER_SECRETS_KEY\";\nconst IV_LEN = 12;\nconst TAG_LEN = 16;\n\nfunction readExistingKey(envPath: string): string | null {\n\tif (!existsSync(envPath)) return null;\n\tconst contents = readFileSync(envPath, \"utf8\");\n\tconst match = contents.match(/^SECONDLAYER_SECRETS_KEY=([a-fA-F0-9]{64})/m);\n\t// biome-ignore lint/style/noNonNullAssertion: value is non-null after preceding check or by construction; TS narrowing limitation\n\treturn match ? match[1]! : null;\n}\n\n/**\n * Atomic file lock via `openSync(..., \"wx\")` — O_CREAT | O_EXCL. If two\n * processes race on cold-compose start, exactly one creates the lock\n * file; the loser polls until the winner finishes writing `.env.local`,\n * then reads the winner's key. Stale locks (process crashed mid-write)\n * are cleaned after `STALE_LOCK_MS`.\n */\nconst STALE_LOCK_MS = 10_000;\nconst POLL_MS = 25;\n\nfunction bootstrapOssKey(): string {\n\tconst envPath = resolve(process.cwd(), \".env.local\");\n\n\t// Fast path — key already on disk from a prior run.\n\tconst existing = readExistingKey(envPath);\n\tif (existing) {\n\t\tprocess.env[KEY_ENV] = existing;\n\t\treturn existing;\n\t}\n\n\tconst lockPath = `${envPath}.secret-bootstrap.lock`;\n\tlet lockFd: number | null = null;\n\ttry {\n\t\tlockFd = openSync(lockPath, \"wx\", 0o600);\n\t} catch (err) {\n\t\tconst e = err as NodeJS.ErrnoException;\n\t\tif (e.code !== \"EEXIST\") throw err;\n\t}\n\n\tif (lockFd === null) {\n\t\t// Another process is bootstrapping. Poll for its result.\n\t\tconst deadline = Date.now() + STALE_LOCK_MS;\n\t\twhile (Date.now() < deadline) {\n\t\t\tconst key = readExistingKey(envPath);\n\t\t\tif (key) {\n\t\t\t\tprocess.env[KEY_ENV] = key;\n\t\t\t\treturn key;\n\t\t\t}\n\t\t\tBun.sleepSync(POLL_MS);\n\t\t}\n\t\t// Lock holder died mid-write — force-clean and retry once.\n\t\ttry {\n\t\t\tunlinkSync(lockPath);\n\t\t} catch {}\n\t\treturn bootstrapOssKey();\n\t}\n\n\ttry {\n\t\tconst hex = randomBytes(32).toString(\"hex\");\n\t\tconst line = `${existsSync(envPath) ? \"\\n\" : \"\"}${KEY_ENV}=${hex}\\n`;\n\t\tappendFileSync(envPath, line, { mode: 0o600 });\n\t\tprocess.env[KEY_ENV] = hex;\n\t\tconsole.log(\n\t\t\t`[secondlayer] generated ${KEY_ENV}; saved to ${envPath} (mode 0600)`,\n\t\t);\n\t\treturn hex;\n\t} finally {\n\t\tcloseSync(lockFd);\n\t\ttry {\n\t\t\tunlinkSync(lockPath);\n\t\t} catch {}\n\t}\n}\n\nfunction loadKey(): Buffer {\n\tlet hex = process.env[KEY_ENV];\n\tif (!hex) {\n\t\tif (getInstanceMode() === \"oss\") {\n\t\t\thex = bootstrapOssKey();\n\t\t} else {\n\t\t\tthrow new Error(\n\t\t\t\t`${KEY_ENV} not set. Generate one with: openssl rand -hex 32`,\n\t\t\t);\n\t\t}\n\t}\n\tconst key = Buffer.from(hex, \"hex\");\n\tif (key.length !== 32) {\n\t\tthrow new Error(`${KEY_ENV} must be 32 bytes hex (got ${key.length})`);\n\t}\n\treturn key;\n}\n\nlet _cachedKey: Buffer | null = null;\nfunction getKey(): Buffer {\n\tif (!_cachedKey) _cachedKey = loadKey();\n\treturn _cachedKey;\n}\n\nexport function encryptSecret(plaintext: string): Buffer {\n\tconst key = getKey();\n\tconst iv = randomBytes(IV_LEN);\n\tconst cipher = createCipheriv(\"aes-256-gcm\", key, iv);\n\tconst ciphertext = Buffer.concat([\n\t\tcipher.update(plaintext, \"utf8\"),\n\t\tcipher.final(),\n\t]);\n\tconst tag = cipher.getAuthTag();\n\treturn Buffer.concat([iv, tag, ciphertext]);\n}\n\nexport function decryptSecret(envelope: Buffer): string {\n\tconst key = getKey();\n\tconst iv = envelope.subarray(0, IV_LEN);\n\tconst tag = envelope.subarray(IV_LEN, IV_LEN + TAG_LEN);\n\tconst ciphertext = envelope.subarray(IV_LEN + TAG_LEN);\n\tconst decipher = createDecipheriv(\"aes-256-gcm\", key, iv);\n\tdecipher.setAuthTag(tag);\n\treturn decipher.update(ciphertext).toString(\"utf8\") + decipher.final(\"utf8\");\n}\n\n/** Generate a fresh 32-byte hex key suitable for `SECONDLAYER_SECRETS_KEY`. */\nexport function generateSecretsKey(): string {\n\treturn randomBytes(32).toString(\"hex\");\n}\n",
+    "import { createCipheriv, createDecipheriv, randomBytes } from \"node:crypto\";\nimport {\n\tappendFileSync,\n\tcloseSync,\n\texistsSync,\n\topenSync,\n\treadFileSync,\n\tunlinkSync,\n} from \"node:fs\";\nimport { resolve } from \"node:path\";\nimport { getInstanceMode } from \"../mode.ts\";\n\n/**\n * AES-256-GCM symmetric envelope for encrypted secrets at rest (tenant keys,\n * subscription signing secrets, etc.).\n *\n * Ciphertext layout: `iv (12 bytes) || authTag (16 bytes) || ciphertext`\n *\n * The key comes from `SECONDLAYER_SECRETS_KEY` — 32 bytes hex. In OSS mode,\n * if the env var is unset on first use we autogenerate a key and persist it\n * to `.env.local` in the current working directory so subsequent restarts\n * pick it up without user intervention. Dedicated/platform modes throw —\n * those runtimes must provision the key explicitly.\n *\n * Rotation strategy: re-encrypt all rows with the new key and swap the env\n * var. Not zero-downtime, but acceptable at v2 scale. For real KMS (AWS\n * KMS, Vault, GCP KMS), wrap the same byte layout behind an\n * `EncryptSecret`/`DecryptSecret` interface and swap at startup.\n */\n\nconst KEY_ENV = \"SECONDLAYER_SECRETS_KEY\";\nconst IV_LEN = 12;\nconst TAG_LEN = 16;\n\nfunction readExistingKey(envPath: string): string | null {\n\tif (!existsSync(envPath)) return null;\n\tconst contents = readFileSync(envPath, \"utf8\");\n\tconst match = contents.match(/^SECONDLAYER_SECRETS_KEY=([a-fA-F0-9]{64})/m);\n\t// biome-ignore lint/style/noNonNullAssertion: value is non-null after preceding check or by construction; TS narrowing limitation\n\treturn match ? match[1]! : null;\n}\n\n/**\n * Atomic file lock via `openSync(..., \"wx\")` — O_CREAT | O_EXCL. If two\n * processes race on cold-compose start, exactly one creates the lock\n * file; the loser polls until the winner finishes writing `.env.local`,\n * then reads the winner's key. Stale locks (process crashed mid-write)\n * are cleaned after `STALE_LOCK_MS`.\n */\nconst STALE_LOCK_MS = 10_000;\nconst POLL_MS = 25;\n\nfunction bootstrapOssKey(): string {\n\tconst envPath = resolve(process.cwd(), \".env.local\");\n\n\t// Fast path — key already on disk from a prior run.\n\tconst existing = readExistingKey(envPath);\n\tif (existing) {\n\t\tprocess.env[KEY_ENV] = existing;\n\t\treturn existing;\n\t}\n\n\tconst lockPath = `${envPath}.secret-bootstrap.lock`;\n\tlet lockFd: number | null = null;\n\ttry {\n\t\tlockFd = openSync(lockPath, \"wx\", 0o600);\n\t} catch (err) {\n\t\tconst e = err as NodeJS.ErrnoException;\n\t\tif (e.code !== \"EEXIST\") throw err;\n\t}\n\n\tif (lockFd === null) {\n\t\t// Another process is bootstrapping. Poll for its result.\n\t\tconst deadline = Date.now() + STALE_LOCK_MS;\n\t\twhile (Date.now() < deadline) {\n\t\t\tconst key = readExistingKey(envPath);\n\t\t\tif (key) {\n\t\t\t\tprocess.env[KEY_ENV] = key;\n\t\t\t\treturn key;\n\t\t\t}\n\t\t\tBun.sleepSync(POLL_MS);\n\t\t}\n\t\t// Lock holder died mid-write — force-clean and retry once.\n\t\ttry {\n\t\t\tunlinkSync(lockPath);\n\t\t} catch {}\n\t\treturn bootstrapOssKey();\n\t}\n\n\ttry {\n\t\tconst hex = randomBytes(32).toString(\"hex\");\n\t\tconst line = `${existsSync(envPath) ? \"\\n\" : \"\"}${KEY_ENV}=${hex}\\n`;\n\t\tappendFileSync(envPath, line, { mode: 0o600 });\n\t\tprocess.env[KEY_ENV] = hex;\n\t\tconsole.log(\n\t\t\t`[secondlayer] generated ${KEY_ENV}; saved to ${envPath} (mode 0600)`,\n\t\t);\n\t\treturn hex;\n\t} finally {\n\t\tcloseSync(lockFd);\n\t\ttry {\n\t\t\tunlinkSync(lockPath);\n\t\t} catch {}\n\t}\n}\n\nfunction loadKey(): Buffer {\n\tlet hex = process.env[KEY_ENV];\n\tif (!hex) {\n\t\tif (getInstanceMode() === \"oss\") {\n\t\t\thex = bootstrapOssKey();\n\t\t} else {\n\t\t\tthrow new Error(\n\t\t\t\t`${KEY_ENV} not set. Generate one with: openssl rand -hex 32`,\n\t\t\t);\n\t\t}\n\t}\n\tconst key = Buffer.from(hex, \"hex\");\n\tif (key.length !== 32) {\n\t\tthrow new Error(`${KEY_ENV} must be 32 bytes hex (got ${key.length})`);\n\t}\n\treturn key;\n}\n\nlet _cachedKey: Buffer | null = null;\nfunction getKey(): Buffer {\n\tif (!_cachedKey) _cachedKey = loadKey();\n\treturn _cachedKey;\n}\n\n/**\n * Non-throwing check for whether a secrets key is currently resolvable —\n * same resolution order as {@link loadKey} (env var, then the OSS\n * `.env.local` fallback), but never bootstraps a new key (that would\n * generate+persist a key as a side effect of a mere existence check), never\n * throws, and never returns or logs the key itself. Used by callers that\n * need to fail loud on a missing key BEFORE attempting a decrypt (f072).\n */\nexport function secretsKeyAvailable(): boolean {\n\tif (process.env[KEY_ENV]) return true;\n\tif (getInstanceMode() === \"oss\") {\n\t\tconst envPath = resolve(process.cwd(), \".env.local\");\n\t\treturn readExistingKey(envPath) !== null;\n\t}\n\treturn false;\n}\n\nexport function encryptSecret(plaintext: string): Buffer {\n\tconst key = getKey();\n\tconst iv = randomBytes(IV_LEN);\n\tconst cipher = createCipheriv(\"aes-256-gcm\", key, iv);\n\tconst ciphertext = Buffer.concat([\n\t\tcipher.update(plaintext, \"utf8\"),\n\t\tcipher.final(),\n\t]);\n\tconst tag = cipher.getAuthTag();\n\treturn Buffer.concat([iv, tag, ciphertext]);\n}\n\nexport function decryptSecret(envelope: Buffer): string {\n\tconst key = getKey();\n\tconst iv = envelope.subarray(0, IV_LEN);\n\tconst tag = envelope.subarray(IV_LEN, IV_LEN + TAG_LEN);\n\tconst ciphertext = envelope.subarray(IV_LEN + TAG_LEN);\n\tconst decipher = createDecipheriv(\"aes-256-gcm\", key, iv);\n\tdecipher.setAuthTag(tag);\n\treturn decipher.update(ciphertext).toString(\"utf8\") + decipher.final(\"utf8\");\n}\n\n/** Generate a fresh 32-byte hex key suitable for `SECONDLAYER_SECRETS_KEY`. */\nexport function generateSecretsKey(): string {\n\treturn randomBytes(32).toString(\"hex\");\n}\n",
     "import { type Kysely, sql } from \"kysely\";\nimport { generateSecret } from \"../../crypto/hmac.ts\";\nimport { decryptSecret, encryptSecret } from \"../../crypto/secrets.ts\";\nimport type {\n\tDatabase,\n\tInsertSubscription,\n\tSubscription,\n\tSubscriptionFormat,\n\tSubscriptionKind,\n\tSubscriptionRuntime,\n\tSubscriptionStatus,\n\tUpdateSubscription,\n} from \"../types.ts\";\n\n/**\n * Subscription CRUD. `signing_secret_enc` is transparently encrypted via\n * `encryptSecret`/`decryptSecret`. Plaintext secrets only leave via the\n * return value of `create` (one-time display) and `rotateSecret`.\n */\n\nexport interface CreateSubscriptionInput {\n\taccountId: string;\n\tprojectId?: string | null;\n\tname: string;\n\t/** Defaults to \"subgraph\". Chain subscriptions set kind=\"chain\" + triggers. */\n\tkind?: SubscriptionKind;\n\t/** Required for subgraph subscriptions; omitted for chain. */\n\tsubgraphName?: string | null;\n\t/** Required for subgraph subscriptions; omitted for chain. */\n\ttableName?: string | null;\n\t/** Chain-trigger filter array. Required for chain subscriptions. */\n\ttriggers?: unknown;\n\tfilter?: unknown;\n\tformat?: SubscriptionFormat;\n\truntime?: SubscriptionRuntime | null;\n\turl: string;\n\tauthConfig?: unknown;\n\tmaxRetries?: number;\n\ttimeoutMs?: number;\n\tconcurrency?: number;\n}\n\nexport interface CreateSubscriptionResult {\n\tsubscription: Subscription;\n\t/** Plaintext signing secret — surfaced once, never stored decrypted. */\n\tsigningSecret: string;\n}\n\nexport async function createSubscription(\n\tdb: Kysely<Database>,\n\tinput: CreateSubscriptionInput,\n): Promise<CreateSubscriptionResult> {\n\tconst signingSecret = generateSecret();\n\tconst kind: SubscriptionKind = input.kind ?? \"subgraph\";\n\tconst row: InsertSubscription = {\n\t\taccount_id: input.accountId,\n\t\tproject_id: input.projectId ?? null,\n\t\tname: input.name,\n\t\tstatus: \"active\",\n\t\tkind,\n\t\tsubgraph_name: input.subgraphName ?? null,\n\t\ttable_name: input.tableName ?? null,\n\t\ttriggers: kind === \"chain\" ? ((input.triggers ?? []) as unknown) : null,\n\t\tfilter: input.filter ?? {},\n\t\tformat: input.format ?? \"standard-webhooks\",\n\t\truntime: input.runtime ?? null,\n\t\turl: input.url,\n\t\tsigning_secret_enc: encryptSecret(signingSecret),\n\t\tauth_config: input.authConfig ?? {},\n\t\t...(input.maxRetries !== undefined\n\t\t\t? { max_retries: input.maxRetries }\n\t\t\t: {}),\n\t\t...(input.timeoutMs !== undefined ? { timeout_ms: input.timeoutMs } : {}),\n\t\t...(input.concurrency !== undefined\n\t\t\t? { concurrency: input.concurrency }\n\t\t\t: {}),\n\t};\n\tconst subscription = await db\n\t\t.insertInto(\"subscriptions\")\n\t\t.values(row)\n\t\t.returningAll()\n\t\t.executeTakeFirstOrThrow();\n\treturn { subscription, signingSecret };\n}\n\nexport async function listSubscriptions(\n\tdb: Kysely<Database>,\n\taccountId: string,\n\topts?: { limit?: number; offset?: number },\n): Promise<Subscription[]> {\n\tlet q = db\n\t\t.selectFrom(\"subscriptions\")\n\t\t.selectAll()\n\t\t.where(\"account_id\", \"=\", accountId)\n\t\t.orderBy(\"created_at\", \"desc\");\n\tif (opts?.limit !== undefined) q = q.limit(opts.limit);\n\tif (opts?.offset !== undefined) q = q.offset(opts.offset);\n\treturn q.execute();\n}\n\n/**\n * All active chain subscriptions across every account — the input to the global\n * trigger evaluator (one loop serves them all). Subgraph subscriptions are\n * excluded; they emit via the subgraph flush path.\n */\nexport async function listActiveChainSubscriptions(\n\tdb: Kysely<Database>,\n): Promise<Subscription[]> {\n\treturn db\n\t\t.selectFrom(\"subscriptions\")\n\t\t.selectAll()\n\t\t.where(\"kind\", \"=\", \"chain\")\n\t\t.where(\"status\", \"=\", \"active\")\n\t\t.execute();\n}\n\nexport async function getSubscription(\n\tdb: Kysely<Database>,\n\taccountId: string,\n\tid: string,\n): Promise<Subscription | null> {\n\tconst row = await db\n\t\t.selectFrom(\"subscriptions\")\n\t\t.selectAll()\n\t\t.where(\"account_id\", \"=\", accountId)\n\t\t.where(\"id\", \"=\", id)\n\t\t.executeTakeFirst();\n\treturn row ?? null;\n}\n\nexport async function getSubscriptionByName(\n\tdb: Kysely<Database>,\n\taccountId: string,\n\tname: string,\n): Promise<Subscription | null> {\n\tconst row = await db\n\t\t.selectFrom(\"subscriptions\")\n\t\t.selectAll()\n\t\t.where(\"account_id\", \"=\", accountId)\n\t\t.where(\"name\", \"=\", name)\n\t\t.executeTakeFirst();\n\treturn row ?? null;\n}\n\nexport interface UpdateSubscriptionInput {\n\tname?: string;\n\tfilter?: unknown;\n\tformat?: SubscriptionFormat;\n\truntime?: SubscriptionRuntime | null;\n\turl?: string;\n\tauthConfig?: unknown;\n\tmaxRetries?: number;\n\ttimeoutMs?: number;\n\tconcurrency?: number;\n}\n\nexport async function updateSubscription(\n\tdb: Kysely<Database>,\n\taccountId: string,\n\tid: string,\n\tpatch: UpdateSubscriptionInput,\n): Promise<Subscription | null> {\n\tconst update: UpdateSubscription = { updated_at: new Date() };\n\tif (patch.name !== undefined) update.name = patch.name;\n\tif (patch.filter !== undefined) update.filter = patch.filter;\n\tif (patch.format !== undefined) update.format = patch.format;\n\tif (patch.runtime !== undefined) update.runtime = patch.runtime;\n\tif (patch.url !== undefined) update.url = patch.url;\n\tif (patch.authConfig !== undefined) update.auth_config = patch.authConfig;\n\tif (patch.maxRetries !== undefined) update.max_retries = patch.maxRetries;\n\tif (patch.timeoutMs !== undefined) update.timeout_ms = patch.timeoutMs;\n\tif (patch.concurrency !== undefined) update.concurrency = patch.concurrency;\n\n\tconst row = await db\n\t\t.updateTable(\"subscriptions\")\n\t\t.set(update)\n\t\t.where(\"account_id\", \"=\", accountId)\n\t\t.where(\"id\", \"=\", id)\n\t\t.returningAll()\n\t\t.executeTakeFirst();\n\treturn row ?? null;\n}\n\nexport async function toggleSubscriptionStatus(\n\tdb: Kysely<Database>,\n\taccountId: string,\n\tid: string,\n\tstatus: SubscriptionStatus,\n): Promise<Subscription | null> {\n\tconst row = await db\n\t\t.updateTable(\"subscriptions\")\n\t\t.set({\n\t\t\tstatus,\n\t\t\tupdated_at: new Date(),\n\t\t\t...(status === \"active\"\n\t\t\t\t? {\n\t\t\t\t\t\tcircuit_failures: 0,\n\t\t\t\t\t\tcircuit_opened_at: null,\n\t\t\t\t\t}\n\t\t\t\t: {}),\n\t\t})\n\t\t.where(\"account_id\", \"=\", accountId)\n\t\t.where(\"id\", \"=\", id)\n\t\t.returningAll()\n\t\t.executeTakeFirst();\n\treturn row ?? null;\n}\n\nexport async function deleteSubscription(\n\tdb: Kysely<Database>,\n\taccountId: string,\n\tid: string,\n): Promise<boolean> {\n\tconst res = await db\n\t\t.deleteFrom(\"subscriptions\")\n\t\t.where(\"account_id\", \"=\", accountId)\n\t\t.where(\"id\", \"=\", id)\n\t\t.executeTakeFirst();\n\treturn Number(res.numDeletedRows ?? 0) > 0;\n}\n\nexport interface RotateSecretResult {\n\tsubscription: Subscription;\n\tsigningSecret: string;\n}\n\nexport async function rotateSubscriptionSecret(\n\tdb: Kysely<Database>,\n\taccountId: string,\n\tid: string,\n): Promise<RotateSecretResult | null> {\n\tconst signingSecret = generateSecret();\n\tconst row = await db\n\t\t.updateTable(\"subscriptions\")\n\t\t.set({\n\t\t\tsigning_secret_enc: encryptSecret(signingSecret),\n\t\t\tupdated_at: new Date(),\n\t\t})\n\t\t.where(\"account_id\", \"=\", accountId)\n\t\t.where(\"id\", \"=\", id)\n\t\t.returningAll()\n\t\t.executeTakeFirst();\n\tif (!row) return null;\n\treturn { subscription: row, signingSecret };\n}\n\n/** Decrypt a subscription's signing secret for HMAC signing at emit time. */\nexport function getSubscriptionSigningSecret(sub: Subscription): string {\n\treturn decryptSecret(sub.signing_secret_enc);\n}\n\n/** Fire `subscriptions:changed` notify so the emitter hot-reloads its cache. */\nexport async function notifySubscriptionsChanged(\n\tdb: Kysely<Database>,\n\taccountId: string,\n): Promise<void> {\n\tawait sql`SELECT pg_notify('subscriptions:changed', ${accountId})`.execute(\n\t\tdb,\n\t);\n}\n"
   ],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAMO,SAAS,cAAc,GAAW;AAAA,EACxC,OAAO,YAAY,EAAE,EAAE,SAAS,KAAK;AAAA;AAO/B,SAAS,WAAW,CAAC,SAAiB,QAAwB;AAAA,EACpE,MAAM,OAAO,WAAW,UAAU,MAAM;AAAA,EACxC,KAAK,OAAO,OAAO;AAAA,EACnB,OAAO,KAAK,OAAO,KAAK;AAAA;AAOlB,SAAS,eAAe,CAC9B,SACA,WACA,QACU;AAAA,EACV,MAAM,oBAAoB,YAAY,SAAS,MAAM;AAAA,EAGrD,IAAI,UAAU,WAAW,kBAAkB,QAAQ;AAAA,IAClD,OAAO;AAAA,EACR;AAAA,EAEA,IAAI,SAAS;AAAA,EACb,SAAS,IAAI,EAAG,IAAI,UAAU,QAAQ,KAAK;AAAA,IAC1C,UAAU,UAAU,WAAW,CAAC,IAAI,kBAAkB,WAAW,CAAC;AAAA,EACnE;AAAA,EAEA,OAAO,WAAW;AAAA;AAOZ,SAAS,qBAAqB,CACpC,SACA,QACA,WACS;AAAA,EACT,MAAM,KAAK,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,IAAI;AAAA,EACpD,MAAM,gBAAgB,GAAG,MAAM;AAAA,EAC/B,MAAM,YAAY,YAAY,eAAe,MAAM;AAAA,EAEnD,OAAO,KAAK,SAAS;AAAA;AAOf,SAAS,qBAAqB,CACpC,SACA,QACA,QACA,mBAAmB,KACT;AAAA,EAEV,MAAM,QAAQ,OAAO,MAAM,GAAG;AAAA,EAC9B,MAAM,YAAY,MAAM,KAAK,CAAC,MAAM,EAAE,WAAW,IAAI,CAAC,GAAG,MAAM,CAAC;AAAA,EAChE,MAAM,YAAY,MAAM,KAAK,CAAC,MAAM,EAAE,WAAW,KAAK,CAAC,GAAG,MAAM,CAAC;AAAA,EAEjE,IAAI,CAAC,aAAa,CAAC,WAAW;AAAA,IAC7B,OAAO;AAAA,EACR;AAAA,EAEA,MAAM,KAAK,OAAO,SAAS,WAAW,EAAE;AAAA,EACxC,IAAI,OAAO,MAAM,EAAE,GAAG;AAAA,IACrB,OAAO;AAAA,EACR;AAAA,EAGA,MAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,IAAI;AAAA,EACxC,IAAI,KAAK,IAAI,MAAM,EAAE,IAAI,kBAAkB;AAAA,IAC1C,OAAO;AAAA,EACR;AAAA,EAGA,MAAM,gBAAgB,GAAG,MAAM;AAAA,EAC/B,OAAO,gBAAgB,eAAe,WAAW,MAAM;AAAA;;;AC9ExD,IAAM,cAAuC,CAAC,OAAO,UAAU;AAOxD,SAAS,eAAe,GAAiB;AAAA,EAC/C,MAAM,MAAM,QAAQ,IAAI,eAAe,KAAK,EAAE,YAAY;AAAA,EAC1D,IAAI,OAAQ,YAAkC,SAAS,GAAG,GAAG;AAAA,IAC5D,OAAO;AAAA,EACR;AAAA,EACA,OAAO;AAAA;AAID,SAAS,cAAc,GAAY;AAAA,EACzC,OAAO,gBAAgB,MAAM;AAAA;AAIvB,SAAS,SAAS,GAAY;AAAA,EACpC,OAAO,gBAAgB,MAAM;AAAA;;;ACpC9B,0DAA2C;AAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQA;AAqBA,IAAM,UAAU;AAChB,IAAM,SAAS;AACf,IAAM,UAAU;AAEhB,SAAS,eAAe,CAAC,SAAgC;AAAA,EACxD,IAAI,CAAC,WAAW,OAAO;AAAA,IAAG,OAAO;AAAA,EACjC,MAAM,WAAW,aAAa,SAAS,MAAM;AAAA,EAC7C,MAAM,QAAQ,SAAS,MAAM,6CAA6C;AAAA,EAE1E,OAAO,QAAQ,MAAM,KAAM;AAAA;AAU5B,IAAM,gBAAgB;AACtB,IAAM,UAAU;AAEhB,SAAS,eAAe,GAAW;AAAA,EAClC,MAAM,UAAU,QAAQ,QAAQ,IAAI,GAAG,YAAY;AAAA,EAGnD,MAAM,WAAW,gBAAgB,OAAO;AAAA,EACxC,IAAI,UAAU;AAAA,IACb,QAAQ,IAAI,WAAW;AAAA,IACvB,OAAO;AAAA,EACR;AAAA,EAEA,MAAM,WAAW,GAAG;AAAA,EACpB,IAAI,SAAwB;AAAA,EAC5B,IAAI;AAAA,IACH,SAAS,SAAS,UAAU,MAAM,GAAK;AAAA,IACtC,OAAO,KAAK;AAAA,IACb,MAAM,IAAI;AAAA,IACV,IAAI,EAAE,SAAS;AAAA,MAAU,MAAM;AAAA;AAAA,EAGhC,IAAI,WAAW,MAAM;AAAA,IAEpB,MAAM,WAAW,KAAK,IAAI,IAAI;AAAA,IAC9B,OAAO,KAAK,IAAI,IAAI,UAAU;AAAA,MAC7B,MAAM,MAAM,gBAAgB,OAAO;AAAA,MACnC,IAAI,KAAK;AAAA,QACR,QAAQ,IAAI,WAAW;AAAA,QACvB,OAAO;AAAA,MACR;AAAA,MACA,IAAI,UAAU,OAAO;AAAA,IACtB;AAAA,IAEA,IAAI;AAAA,MACH,WAAW,QAAQ;AAAA,MAClB,MAAM;AAAA,IACR,OAAO,gBAAgB;AAAA,EACxB;AAAA,EAEA,IAAI;AAAA,IACH,MAAM,MAAM,aAAY,EAAE,EAAE,SAAS,KAAK;AAAA,IAC1C,MAAM,OAAO,GAAG,WAAW,OAAO,IAAI;AAAA,IAAO,KAAK,WAAW;AAAA;AAAA,IAC7D,eAAe,SAAS,MAAM,EAAE,MAAM,IAAM,CAAC;AAAA,IAC7C,QAAQ,IAAI,WAAW;AAAA,IACvB,QAAQ,IACP,2BAA2B,qBAAqB,qBACjD;AAAA,IACA,OAAO;AAAA,YACN;AAAA,IACD,UAAU,MAAM;AAAA,IAChB,IAAI;AAAA,MACH,WAAW,QAAQ;AAAA,MAClB,MAAM;AAAA;AAAA;AAIV,SAAS,OAAO,GAAW;AAAA,EAC1B,IAAI,MAAM,QAAQ,IAAI;AAAA,EACtB,IAAI,CAAC,KAAK;AAAA,IACT,IAAI,gBAAgB,MAAM,OAAO;AAAA,MAChC,MAAM,gBAAgB;AAAA,IACvB,EAAO;AAAA,MACN,MAAM,IAAI,MACT,GAAG,0DACJ;AAAA;AAAA,EAEF;AAAA,EACA,MAAM,MAAM,OAAO,KAAK,KAAK,KAAK;AAAA,EAClC,IAAI,IAAI,WAAW,IAAI;AAAA,IACtB,MAAM,IAAI,MAAM,GAAG,qCAAqC,IAAI,SAAS;AAAA,EACtE;AAAA,EACA,OAAO;AAAA;AAGR,IAAI,aAA4B;AAChC,SAAS,MAAM,GAAW;AAAA,EACzB,IAAI,CAAC;AAAA,IAAY,aAAa,QAAQ;AAAA,EACtC,OAAO;AAAA;AAGD,SAAS,aAAa,CAAC,WAA2B;AAAA,EACxD,MAAM,MAAM,OAAO;AAAA,EACnB,MAAM,KAAK,aAAY,MAAM;AAAA,EAC7B,MAAM,SAAS,eAAe,eAAe,KAAK,EAAE;AAAA,EACpD,MAAM,aAAa,OAAO,OAAO;AAAA,IAChC,OAAO,OAAO,WAAW,MAAM;AAAA,IAC/B,OAAO,MAAM;AAAA,EACd,CAAC;AAAA,EACD,MAAM,MAAM,OAAO,WAAW;AAAA,EAC9B,OAAO,OAAO,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC;AAAA;AAGpC,SAAS,aAAa,CAAC,UAA0B;AAAA,EACvD,MAAM,MAAM,OAAO;AAAA,EACnB,MAAM,KAAK,SAAS,SAAS,GAAG,MAAM;AAAA,EACtC,MAAM,MAAM,SAAS,SAAS,QAAQ,SAAS,OAAO;AAAA,EACtD,MAAM,aAAa,SAAS,SAAS,SAAS,OAAO;AAAA,EACrD,MAAM,WAAW,iBAAiB,eAAe,KAAK,EAAE;AAAA,EACxD,SAAS,WAAW,GAAG;AAAA,EACvB,OAAO,SAAS,OAAO,UAAU,EAAE,SAAS,MAAM,IAAI,SAAS,MAAM,MAAM;AAAA;AAIrE,SAAS,kBAAkB,GAAW;AAAA,EAC5C,OAAO,aAAY,EAAE,EAAE,SAAS,KAAK;AAAA;;;AC1JtC;AAgDA,eAAsB,kBAAkB,CACvC,IACA,OACoC;AAAA,EACpC,MAAM,gBAAgB,eAAe;AAAA,EACrC,MAAM,OAAyB,MAAM,QAAQ;AAAA,EAC7C,MAAM,MAA0B;AAAA,IAC/B,YAAY,MAAM;AAAA,IAClB,YAAY,MAAM,aAAa;AAAA,IAC/B,MAAM,MAAM;AAAA,IACZ,QAAQ;AAAA,IACR;AAAA,IACA,eAAe,MAAM,gBAAgB;AAAA,IACrC,YAAY,MAAM,aAAa;AAAA,IAC/B,UAAU,SAAS,UAAY,MAAM,YAAY,CAAC,IAAiB;AAAA,IACnE,QAAQ,MAAM,UAAU,CAAC;AAAA,IACzB,QAAQ,MAAM,UAAU;AAAA,IACxB,SAAS,MAAM,WAAW;AAAA,IAC1B,KAAK,MAAM;AAAA,IACX,oBAAoB,cAAc,aAAa;AAAA,IAC/C,aAAa,MAAM,cAAc,CAAC;AAAA,OAC9B,MAAM,eAAe,YACtB,EAAE,aAAa,MAAM,WAAW,IAChC,CAAC;AAAA,OACA,MAAM,cAAc,YAAY,EAAE,YAAY,MAAM,UAAU,IAAI,CAAC;AAAA,OACnE,MAAM,gBAAgB,YACvB,EAAE,aAAa,MAAM,YAAY,IACjC,CAAC;AAAA,EACL;AAAA,EACA,MAAM,eAAe,MAAM,GACzB,WAAW,eAAe,EAC1B,OAAO,GAAG,EACV,aAAa,EACb,wBAAwB;AAAA,EAC1B,OAAO,EAAE,cAAc,cAAc;AAAA;AAGtC,eAAsB,iBAAiB,CACtC,IACA,WACA,MAC0B;AAAA,EAC1B,IAAI,IAAI,GACN,WAAW,eAAe,EAC1B,UAAU,EACV,MAAM,cAAc,KAAK,SAAS,EAClC,QAAQ,cAAc,MAAM;AAAA,EAC9B,IAAI,MAAM,UAAU;AAAA,IAAW,IAAI,EAAE,MAAM,KAAK,KAAK;AAAA,EACrD,IAAI,MAAM,WAAW;AAAA,IAAW,IAAI,EAAE,OAAO,KAAK,MAAM;AAAA,EACxD,OAAO,EAAE,QAAQ;AAAA;AAQlB,eAAsB,4BAA4B,CACjD,IAC0B;AAAA,EAC1B,OAAO,GACL,WAAW,eAAe,EAC1B,UAAU,EACV,MAAM,QAAQ,KAAK,OAAO,EAC1B,MAAM,UAAU,KAAK,QAAQ,EAC7B,QAAQ;AAAA;AAGX,eAAsB,eAAe,CACpC,IACA,WACA,IAC+B;AAAA,EAC/B,MAAM,MAAM,MAAM,GAChB,WAAW,eAAe,EAC1B,UAAU,EACV,MAAM,cAAc,KAAK,SAAS,EAClC,MAAM,MAAM,KAAK,EAAE,EACnB,iBAAiB;AAAA,EACnB,OAAO,OAAO;AAAA;AAGf,eAAsB,qBAAqB,CAC1C,IACA,WACA,MAC+B;AAAA,EAC/B,MAAM,MAAM,MAAM,GAChB,WAAW,eAAe,EAC1B,UAAU,EACV,MAAM,cAAc,KAAK,SAAS,EAClC,MAAM,QAAQ,KAAK,IAAI,EACvB,iBAAiB;AAAA,EACnB,OAAO,OAAO;AAAA;AAef,eAAsB,kBAAkB,CACvC,IACA,WACA,IACA,OAC+B;AAAA,EAC/B,MAAM,SAA6B,EAAE,YAAY,IAAI,KAAO;AAAA,EAC5D,IAAI,MAAM,SAAS;AAAA,IAAW,OAAO,OAAO,MAAM;AAAA,EAClD,IAAI,MAAM,WAAW;AAAA,IAAW,OAAO,SAAS,MAAM;AAAA,EACtD,IAAI,MAAM,WAAW;AAAA,IAAW,OAAO,SAAS,MAAM;AAAA,EACtD,IAAI,MAAM,YAAY;AAAA,IAAW,OAAO,UAAU,MAAM;AAAA,EACxD,IAAI,MAAM,QAAQ;AAAA,IAAW,OAAO,MAAM,MAAM;AAAA,EAChD,IAAI,MAAM,eAAe;AAAA,IAAW,OAAO,cAAc,MAAM;AAAA,EAC/D,IAAI,MAAM,eAAe;AAAA,IAAW,OAAO,cAAc,MAAM;AAAA,EAC/D,IAAI,MAAM,cAAc;AAAA,IAAW,OAAO,aAAa,MAAM;AAAA,EAC7D,IAAI,MAAM,gBAAgB;AAAA,IAAW,OAAO,cAAc,MAAM;AAAA,EAEhE,MAAM,MAAM,MAAM,GAChB,YAAY,eAAe,EAC3B,IAAI,MAAM,EACV,MAAM,cAAc,KAAK,SAAS,EAClC,MAAM,MAAM,KAAK,EAAE,EACnB,aAAa,EACb,iBAAiB;AAAA,EACnB,OAAO,OAAO;AAAA;AAGf,eAAsB,wBAAwB,CAC7C,IACA,WACA,IACA,QAC+B;AAAA,EAC/B,MAAM,MAAM,MAAM,GAChB,YAAY,eAAe,EAC3B,IAAI;AAAA,IACJ;AAAA,IACA,YAAY,IAAI;AAAA,OACZ,WAAW,WACZ;AAAA,MACA,kBAAkB;AAAA,MAClB,mBAAmB;AAAA,IACpB,IACC,CAAC;AAAA,EACL,CAAC,EACA,MAAM,cAAc,KAAK,SAAS,EAClC,MAAM,MAAM,KAAK,EAAE,EACnB,aAAa,EACb,iBAAiB;AAAA,EACnB,OAAO,OAAO;AAAA;AAGf,eAAsB,kBAAkB,CACvC,IACA,WACA,IACmB;AAAA,EACnB,MAAM,MAAM,MAAM,GAChB,WAAW,eAAe,EAC1B,MAAM,cAAc,KAAK,SAAS,EAClC,MAAM,MAAM,KAAK,EAAE,EACnB,iBAAiB;AAAA,EACnB,OAAO,OAAO,IAAI,kBAAkB,CAAC,IAAI;AAAA;AAQ1C,eAAsB,wBAAwB,CAC7C,IACA,WACA,IACqC;AAAA,EACrC,MAAM,gBAAgB,eAAe;AAAA,EACrC,MAAM,MAAM,MAAM,GAChB,YAAY,eAAe,EAC3B,IAAI;AAAA,IACJ,oBAAoB,cAAc,aAAa;AAAA,IAC/C,YAAY,IAAI;AAAA,EACjB,CAAC,EACA,MAAM,cAAc,KAAK,SAAS,EAClC,MAAM,MAAM,KAAK,EAAE,EACnB,aAAa,EACb,iBAAiB;AAAA,EACnB,IAAI,CAAC;AAAA,IAAK,OAAO;AAAA,EACjB,OAAO,EAAE,cAAc,KAAK,cAAc;AAAA;AAIpC,SAAS,4BAA4B,CAAC,KAA2B;AAAA,EACvE,OAAO,cAAc,IAAI,kBAAkB;AAAA;AAI5C,eAAsB,0BAA0B,CAC/C,IACA,WACgB;AAAA,EAChB,MAAM,gDAAgD,aAAa,QAClE,EACD;AAAA;",
-  "debugId": "D7D84F5D4DCA785B64756E2164756E21",
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAMO,SAAS,cAAc,GAAW;AAAA,EACxC,OAAO,YAAY,EAAE,EAAE,SAAS,KAAK;AAAA;AAO/B,SAAS,WAAW,CAAC,SAAiB,QAAwB;AAAA,EACpE,MAAM,OAAO,WAAW,UAAU,MAAM;AAAA,EACxC,KAAK,OAAO,OAAO;AAAA,EACnB,OAAO,KAAK,OAAO,KAAK;AAAA;AAOlB,SAAS,eAAe,CAC9B,SACA,WACA,QACU;AAAA,EACV,MAAM,oBAAoB,YAAY,SAAS,MAAM;AAAA,EAGrD,IAAI,UAAU,WAAW,kBAAkB,QAAQ;AAAA,IAClD,OAAO;AAAA,EACR;AAAA,EAEA,IAAI,SAAS;AAAA,EACb,SAAS,IAAI,EAAG,IAAI,UAAU,QAAQ,KAAK;AAAA,IAC1C,UAAU,UAAU,WAAW,CAAC,IAAI,kBAAkB,WAAW,CAAC;AAAA,EACnE;AAAA,EAEA,OAAO,WAAW;AAAA;AAOZ,SAAS,qBAAqB,CACpC,SACA,QACA,WACS;AAAA,EACT,MAAM,KAAK,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,IAAI;AAAA,EACpD,MAAM,gBAAgB,GAAG,MAAM;AAAA,EAC/B,MAAM,YAAY,YAAY,eAAe,MAAM;AAAA,EAEnD,OAAO,KAAK,SAAS;AAAA;AAOf,SAAS,qBAAqB,CACpC,SACA,QACA,QACA,mBAAmB,KACT;AAAA,EAEV,MAAM,QAAQ,OAAO,MAAM,GAAG;AAAA,EAC9B,MAAM,YAAY,MAAM,KAAK,CAAC,MAAM,EAAE,WAAW,IAAI,CAAC,GAAG,MAAM,CAAC;AAAA,EAChE,MAAM,YAAY,MAAM,KAAK,CAAC,MAAM,EAAE,WAAW,KAAK,CAAC,GAAG,MAAM,CAAC;AAAA,EAEjE,IAAI,CAAC,aAAa,CAAC,WAAW;AAAA,IAC7B,OAAO;AAAA,EACR;AAAA,EAEA,MAAM,KAAK,OAAO,SAAS,WAAW,EAAE;AAAA,EACxC,IAAI,OAAO,MAAM,EAAE,GAAG;AAAA,IACrB,OAAO;AAAA,EACR;AAAA,EAGA,MAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,IAAI;AAAA,EACxC,IAAI,KAAK,IAAI,MAAM,EAAE,IAAI,kBAAkB;AAAA,IAC1C,OAAO;AAAA,EACR;AAAA,EAGA,MAAM,gBAAgB,GAAG,MAAM;AAAA,EAC/B,OAAO,gBAAgB,eAAe,WAAW,MAAM;AAAA;;;AC9ExD,IAAM,cAAuC,CAAC,OAAO,UAAU;AAOxD,SAAS,eAAe,GAAiB;AAAA,EAC/C,MAAM,MAAM,QAAQ,IAAI,eAAe,KAAK,EAAE,YAAY;AAAA,EAC1D,IAAI,OAAQ,YAAkC,SAAS,GAAG,GAAG;AAAA,IAC5D,OAAO;AAAA,EACR;AAAA,EACA,OAAO;AAAA;AAID,SAAS,cAAc,GAAY;AAAA,EACzC,OAAO,gBAAgB,MAAM;AAAA;AAIvB,SAAS,SAAS,GAAY;AAAA,EACpC,OAAO,gBAAgB,MAAM;AAAA;;;ACpC9B,0DAA2C;AAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQA;AAqBA,IAAM,UAAU;AAChB,IAAM,SAAS;AACf,IAAM,UAAU;AAEhB,SAAS,eAAe,CAAC,SAAgC;AAAA,EACxD,IAAI,CAAC,WAAW,OAAO;AAAA,IAAG,OAAO;AAAA,EACjC,MAAM,WAAW,aAAa,SAAS,MAAM;AAAA,EAC7C,MAAM,QAAQ,SAAS,MAAM,6CAA6C;AAAA,EAE1E,OAAO,QAAQ,MAAM,KAAM;AAAA;AAU5B,IAAM,gBAAgB;AACtB,IAAM,UAAU;AAEhB,SAAS,eAAe,GAAW;AAAA,EAClC,MAAM,UAAU,QAAQ,QAAQ,IAAI,GAAG,YAAY;AAAA,EAGnD,MAAM,WAAW,gBAAgB,OAAO;AAAA,EACxC,IAAI,UAAU;AAAA,IACb,QAAQ,IAAI,WAAW;AAAA,IACvB,OAAO;AAAA,EACR;AAAA,EAEA,MAAM,WAAW,GAAG;AAAA,EACpB,IAAI,SAAwB;AAAA,EAC5B,IAAI;AAAA,IACH,SAAS,SAAS,UAAU,MAAM,GAAK;AAAA,IACtC,OAAO,KAAK;AAAA,IACb,MAAM,IAAI;AAAA,IACV,IAAI,EAAE,SAAS;AAAA,MAAU,MAAM;AAAA;AAAA,EAGhC,IAAI,WAAW,MAAM;AAAA,IAEpB,MAAM,WAAW,KAAK,IAAI,IAAI;AAAA,IAC9B,OAAO,KAAK,IAAI,IAAI,UAAU;AAAA,MAC7B,MAAM,MAAM,gBAAgB,OAAO;AAAA,MACnC,IAAI,KAAK;AAAA,QACR,QAAQ,IAAI,WAAW;AAAA,QACvB,OAAO;AAAA,MACR;AAAA,MACA,IAAI,UAAU,OAAO;AAAA,IACtB;AAAA,IAEA,IAAI;AAAA,MACH,WAAW,QAAQ;AAAA,MAClB,MAAM;AAAA,IACR,OAAO,gBAAgB;AAAA,EACxB;AAAA,EAEA,IAAI;AAAA,IACH,MAAM,MAAM,aAAY,EAAE,EAAE,SAAS,KAAK;AAAA,IAC1C,MAAM,OAAO,GAAG,WAAW,OAAO,IAAI;AAAA,IAAO,KAAK,WAAW;AAAA;AAAA,IAC7D,eAAe,SAAS,MAAM,EAAE,MAAM,IAAM,CAAC;AAAA,IAC7C,QAAQ,IAAI,WAAW;AAAA,IACvB,QAAQ,IACP,2BAA2B,qBAAqB,qBACjD;AAAA,IACA,OAAO;AAAA,YACN;AAAA,IACD,UAAU,MAAM;AAAA,IAChB,IAAI;AAAA,MACH,WAAW,QAAQ;AAAA,MAClB,MAAM;AAAA;AAAA;AAIV,SAAS,OAAO,GAAW;AAAA,EAC1B,IAAI,MAAM,QAAQ,IAAI;AAAA,EACtB,IAAI,CAAC,KAAK;AAAA,IACT,IAAI,gBAAgB,MAAM,OAAO;AAAA,MAChC,MAAM,gBAAgB;AAAA,IACvB,EAAO;AAAA,MACN,MAAM,IAAI,MACT,GAAG,0DACJ;AAAA;AAAA,EAEF;AAAA,EACA,MAAM,MAAM,OAAO,KAAK,KAAK,KAAK;AAAA,EAClC,IAAI,IAAI,WAAW,IAAI;AAAA,IACtB,MAAM,IAAI,MAAM,GAAG,qCAAqC,IAAI,SAAS;AAAA,EACtE;AAAA,EACA,OAAO;AAAA;AAGR,IAAI,aAA4B;AAChC,SAAS,MAAM,GAAW;AAAA,EACzB,IAAI,CAAC;AAAA,IAAY,aAAa,QAAQ;AAAA,EACtC,OAAO;AAAA;AAWD,SAAS,mBAAmB,GAAY;AAAA,EAC9C,IAAI,QAAQ,IAAI;AAAA,IAAU,OAAO;AAAA,EACjC,IAAI,gBAAgB,MAAM,OAAO;AAAA,IAChC,MAAM,UAAU,QAAQ,QAAQ,IAAI,GAAG,YAAY;AAAA,IACnD,OAAO,gBAAgB,OAAO,MAAM;AAAA,EACrC;AAAA,EACA,OAAO;AAAA;AAGD,SAAS,aAAa,CAAC,WAA2B;AAAA,EACxD,MAAM,MAAM,OAAO;AAAA,EACnB,MAAM,KAAK,aAAY,MAAM;AAAA,EAC7B,MAAM,SAAS,eAAe,eAAe,KAAK,EAAE;AAAA,EACpD,MAAM,aAAa,OAAO,OAAO;AAAA,IAChC,OAAO,OAAO,WAAW,MAAM;AAAA,IAC/B,OAAO,MAAM;AAAA,EACd,CAAC;AAAA,EACD,MAAM,MAAM,OAAO,WAAW;AAAA,EAC9B,OAAO,OAAO,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC;AAAA;AAGpC,SAAS,aAAa,CAAC,UAA0B;AAAA,EACvD,MAAM,MAAM,OAAO;AAAA,EACnB,MAAM,KAAK,SAAS,SAAS,GAAG,MAAM;AAAA,EACtC,MAAM,MAAM,SAAS,SAAS,QAAQ,SAAS,OAAO;AAAA,EACtD,MAAM,aAAa,SAAS,SAAS,SAAS,OAAO;AAAA,EACrD,MAAM,WAAW,iBAAiB,eAAe,KAAK,EAAE;AAAA,EACxD,SAAS,WAAW,GAAG;AAAA,EACvB,OAAO,SAAS,OAAO,UAAU,EAAE,SAAS,MAAM,IAAI,SAAS,MAAM,MAAM;AAAA;AAIrE,SAAS,kBAAkB,GAAW;AAAA,EAC5C,OAAO,aAAY,EAAE,EAAE,SAAS,KAAK;AAAA;;;AC3KtC;AAgDA,eAAsB,kBAAkB,CACvC,IACA,OACoC;AAAA,EACpC,MAAM,gBAAgB,eAAe;AAAA,EACrC,MAAM,OAAyB,MAAM,QAAQ;AAAA,EAC7C,MAAM,MAA0B;AAAA,IAC/B,YAAY,MAAM;AAAA,IAClB,YAAY,MAAM,aAAa;AAAA,IAC/B,MAAM,MAAM;AAAA,IACZ,QAAQ;AAAA,IACR;AAAA,IACA,eAAe,MAAM,gBAAgB;AAAA,IACrC,YAAY,MAAM,aAAa;AAAA,IAC/B,UAAU,SAAS,UAAY,MAAM,YAAY,CAAC,IAAiB;AAAA,IACnE,QAAQ,MAAM,UAAU,CAAC;AAAA,IACzB,QAAQ,MAAM,UAAU;AAAA,IACxB,SAAS,MAAM,WAAW;AAAA,IAC1B,KAAK,MAAM;AAAA,IACX,oBAAoB,cAAc,aAAa;AAAA,IAC/C,aAAa,MAAM,cAAc,CAAC;AAAA,OAC9B,MAAM,eAAe,YACtB,EAAE,aAAa,MAAM,WAAW,IAChC,CAAC;AAAA,OACA,MAAM,cAAc,YAAY,EAAE,YAAY,MAAM,UAAU,IAAI,CAAC;AAAA,OACnE,MAAM,gBAAgB,YACvB,EAAE,aAAa,MAAM,YAAY,IACjC,CAAC;AAAA,EACL;AAAA,EACA,MAAM,eAAe,MAAM,GACzB,WAAW,eAAe,EAC1B,OAAO,GAAG,EACV,aAAa,EACb,wBAAwB;AAAA,EAC1B,OAAO,EAAE,cAAc,cAAc;AAAA;AAGtC,eAAsB,iBAAiB,CACtC,IACA,WACA,MAC0B;AAAA,EAC1B,IAAI,IAAI,GACN,WAAW,eAAe,EAC1B,UAAU,EACV,MAAM,cAAc,KAAK,SAAS,EAClC,QAAQ,cAAc,MAAM;AAAA,EAC9B,IAAI,MAAM,UAAU;AAAA,IAAW,IAAI,EAAE,MAAM,KAAK,KAAK;AAAA,EACrD,IAAI,MAAM,WAAW;AAAA,IAAW,IAAI,EAAE,OAAO,KAAK,MAAM;AAAA,EACxD,OAAO,EAAE,QAAQ;AAAA;AAQlB,eAAsB,4BAA4B,CACjD,IAC0B;AAAA,EAC1B,OAAO,GACL,WAAW,eAAe,EAC1B,UAAU,EACV,MAAM,QAAQ,KAAK,OAAO,EAC1B,MAAM,UAAU,KAAK,QAAQ,EAC7B,QAAQ;AAAA;AAGX,eAAsB,eAAe,CACpC,IACA,WACA,IAC+B;AAAA,EAC/B,MAAM,MAAM,MAAM,GAChB,WAAW,eAAe,EAC1B,UAAU,EACV,MAAM,cAAc,KAAK,SAAS,EAClC,MAAM,MAAM,KAAK,EAAE,EACnB,iBAAiB;AAAA,EACnB,OAAO,OAAO;AAAA;AAGf,eAAsB,qBAAqB,CAC1C,IACA,WACA,MAC+B;AAAA,EAC/B,MAAM,MAAM,MAAM,GAChB,WAAW,eAAe,EAC1B,UAAU,EACV,MAAM,cAAc,KAAK,SAAS,EAClC,MAAM,QAAQ,KAAK,IAAI,EACvB,iBAAiB;AAAA,EACnB,OAAO,OAAO;AAAA;AAef,eAAsB,kBAAkB,CACvC,IACA,WACA,IACA,OAC+B;AAAA,EAC/B,MAAM,SAA6B,EAAE,YAAY,IAAI,KAAO;AAAA,EAC5D,IAAI,MAAM,SAAS;AAAA,IAAW,OAAO,OAAO,MAAM;AAAA,EAClD,IAAI,MAAM,WAAW;AAAA,IAAW,OAAO,SAAS,MAAM;AAAA,EACtD,IAAI,MAAM,WAAW;AAAA,IAAW,OAAO,SAAS,MAAM;AAAA,EACtD,IAAI,MAAM,YAAY;AAAA,IAAW,OAAO,UAAU,MAAM;AAAA,EACxD,IAAI,MAAM,QAAQ;AAAA,IAAW,OAAO,MAAM,MAAM;AAAA,EAChD,IAAI,MAAM,eAAe;AAAA,IAAW,OAAO,cAAc,MAAM;AAAA,EAC/D,IAAI,MAAM,eAAe;AAAA,IAAW,OAAO,cAAc,MAAM;AAAA,EAC/D,IAAI,MAAM,cAAc;AAAA,IAAW,OAAO,aAAa,MAAM;AAAA,EAC7D,IAAI,MAAM,gBAAgB;AAAA,IAAW,OAAO,cAAc,MAAM;AAAA,EAEhE,MAAM,MAAM,MAAM,GAChB,YAAY,eAAe,EAC3B,IAAI,MAAM,EACV,MAAM,cAAc,KAAK,SAAS,EAClC,MAAM,MAAM,KAAK,EAAE,EACnB,aAAa,EACb,iBAAiB;AAAA,EACnB,OAAO,OAAO;AAAA;AAGf,eAAsB,wBAAwB,CAC7C,IACA,WACA,IACA,QAC+B;AAAA,EAC/B,MAAM,MAAM,MAAM,GAChB,YAAY,eAAe,EAC3B,IAAI;AAAA,IACJ;AAAA,IACA,YAAY,IAAI;AAAA,OACZ,WAAW,WACZ;AAAA,MACA,kBAAkB;AAAA,MAClB,mBAAmB;AAAA,IACpB,IACC,CAAC;AAAA,EACL,CAAC,EACA,MAAM,cAAc,KAAK,SAAS,EAClC,MAAM,MAAM,KAAK,EAAE,EACnB,aAAa,EACb,iBAAiB;AAAA,EACnB,OAAO,OAAO;AAAA;AAGf,eAAsB,kBAAkB,CACvC,IACA,WACA,IACmB;AAAA,EACnB,MAAM,MAAM,MAAM,GAChB,WAAW,eAAe,EAC1B,MAAM,cAAc,KAAK,SAAS,EAClC,MAAM,MAAM,KAAK,EAAE,EACnB,iBAAiB;AAAA,EACnB,OAAO,OAAO,IAAI,kBAAkB,CAAC,IAAI;AAAA;AAQ1C,eAAsB,wBAAwB,CAC7C,IACA,WACA,IACqC;AAAA,EACrC,MAAM,gBAAgB,eAAe;AAAA,EACrC,MAAM,MAAM,MAAM,GAChB,YAAY,eAAe,EAC3B,IAAI;AAAA,IACJ,oBAAoB,cAAc,aAAa;AAAA,IAC/C,YAAY,IAAI;AAAA,EACjB,CAAC,EACA,MAAM,cAAc,KAAK,SAAS,EAClC,MAAM,MAAM,KAAK,EAAE,EACnB,aAAa,EACb,iBAAiB;AAAA,EACnB,IAAI,CAAC;AAAA,IAAK,OAAO;AAAA,EACjB,OAAO,EAAE,cAAc,KAAK,cAAc;AAAA;AAIpC,SAAS,4BAA4B,CAAC,KAA2B;AAAA,EACvE,OAAO,cAAc,IAAI,kBAAkB;AAAA;AAI5C,eAAsB,0BAA0B,CAC/C,IACA,WACgB;AAAA,EAChB,MAAM,gDAAgD,aAAa,QAClE,EACD;AAAA;",
+  "debugId": "82CE895808FBD66564756E2164756E21",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@secondlayer/shared",
-	"version": "7.4.0",
+	"version": "7.5.1",
 	"license": "MIT",
 	"repository": {
 		"type": "git",
@@ -153,10 +153,7 @@
 			"import": "./dist/src/node/archive-client.js"
 		}
 	},
-	"files": [
-		"dist",
-		"migrations"
-	],
+	"files": ["dist", "migrations"],
 	"scripts": {
 		"build": "bunup",
 		"dev": "bunup --watch",