@shipstatic/ship 2.0.0-beta.9 → 2.0.0

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../node_modules/.pnpm/@shipstatic+types@2.5.0-beta.16/node_modules/@shipstatic/types/dist/index.js","../src/shared/lib/md5.ts","../src/shared/lib/env.ts","../src/shared/lib/path.ts","../src/shared/lib/deploy-paths.ts","../src/shared/lib/file-validation.ts","../src/shared/lib/junk.ts","../src/shared/lib/security.ts","../src/node/core/node-files.ts","../src/index.ts","../src/node/index.ts","../src/shared/base-ship.ts","../src/shared/api/http.ts","../src/shared/events.ts","../src/shared/lib/validation.ts","../src/shared/resources.ts","../src/shared/lib/spa.ts","../src/node/core/config.ts","../src/shared/core/credential-schema.ts","../src/node/core/deploy-body.ts","../src/shared/index.ts","../src/shared/core/constants.ts","../src/shared/lib/text.ts"],"sourcesContent":["/**\n * @file Shared TypeScript types, constants, and utilities for the ShipStatic platform.\n * This package is the single source of truth for all shared data structures.\n */\n// =============================================================================\n// I. CORE ENTITIES\n// =============================================================================\n/**\n * Deployment status constants\n */\nexport const DeploymentStatus = {\n    PENDING: 'pending',\n    SUCCESS: 'success',\n    FAILED: 'failed',\n    DELETING: 'deleting',\n};\n/**\n * Every path the public API answers on, declared once.\n *\n * The URL surface was written out in four places — the API's mounts, the\n * SDK's client, the dashboard's client, and the post-deploy smoke — so a\n * rename meant finding all four. The first three now read this table.\n *\n * The smoke (`cloudflare/api/smoke.mjs`) deliberately still spells its own:\n * five of its nine paths are `/admin/*`, which this table excludes by\n * design, and splitting one list between a registry and literals reads worse\n * than keeping it uniform.\n *\n * **What this guarantees, exactly.** Collection paths are mounted from here,\n * so producer and consumer cannot diverge. Item paths are declared here and\n * consumed by clients, but the API spells them relative to their mount\n * (`/:deployment/config`), so the table does not *generate* them — it is\n * held to them by `api/tests/architecture/api-paths.test.ts`, which fails if\n * any entry names a path no route answers. Some entries have no client yet\n * (`DEPLOYMENT_CONFIG`, `DOMAIN_PROPAGATION` — endpoints the SDK\n * deliberately does not reach); the fence is what keeps those honest rather\n * than merely asserted.\n *\n * **The operator surface is deliberately absent.** `/admin/*` paths belong\n * to `web/my`, for the same reason its row types do: this package is\n * published, and the operator surface is not public (see `CLAUDE.md`, \"Admin\n * types\"). A path here is a promise to every npm consumer; `/admin` is a\n * promise to one dashboard.\n *\n * Item paths are functions rather than templates so the key is interpolated\n * in one place, encoded the same way by every caller.\n */\nexport const API_PATHS = {\n    DEPLOYMENTS: '/deployments',\n    DEPLOYMENT: (deployment) => `/deployments/${deployment}`,\n    DEPLOYMENT_CONFIG: (deployment) => `/deployments/${deployment}/config`,\n    DOMAINS: '/domains',\n    DOMAIN: (domain) => `/domains/${domain}`,\n    DOMAIN_VERIFY: (domain) => `/domains/${domain}/verify`,\n    DOMAIN_DNS: (domain) => `/domains/${domain}/dns`,\n    DOMAIN_RECORDS: (domain) => `/domains/${domain}/records`,\n    DOMAIN_SHARE: (domain) => `/domains/${domain}/share`,\n    DOMAIN_PROPAGATION: (domain) => `/domains/${domain}/propagation`,\n    DOMAINS_VALIDATE: '/domains/validate',\n    TOKENS: '/tokens',\n    TOKEN: (token) => `/tokens/${token}`,\n    ACCOUNT: '/account',\n    ACCOUNT_KEY: '/account/key',\n    ACCOUNT_CLAIM: '/account/claim',\n    ACTIVITIES: '/activities',\n    LABELS: '/labels',\n    LIMITS: '/limits',\n    PING: '/ping',\n    SETUP: '/setup',\n    SPA_CHECK: '/spa-check',\n    UPLOAD: '/upload',\n};\n// =============================================================================\n// DOMAIN TYPES\n// =============================================================================\n/**\n * Domain status constants\n *\n * - PENDING: DNS not configured\n * - PARTIAL: DNS partially configured\n * - SUCCESS: DNS fully verified\n * - PAUSED: Domain paused due to plan enforcement (billing)\n */\nexport const DomainStatus = {\n    PENDING: 'pending',\n    PARTIAL: 'partial',\n    SUCCESS: 'success',\n    PAUSED: 'paused',\n};\n/**\n * The envelope an `Idempotency-Key` must fit, and how long a replay lasts.\n *\n * Format lives here rather than on the server alone by the format-vs-policy\n * rule: a client can decide offline whether a key is well-formed, and the\n * API would reject the same value the same way.\n */\nexport const IDEMPOTENCY_KEY_CONSTRAINTS = {\n    MAX_LENGTH: 256,\n    /** How long a stored 201 stays replayable. */\n    WINDOW_SECONDS: 24 * 60 * 60,\n};\n/**\n * Validate an idempotency key, returning the trimmed value or `undefined`\n * when none was supplied. Throws {@link ShipError.validation} when the value\n * cannot be sent — the same verdict the API would reach, reached earlier.\n */\nexport function validateIdempotencyKey(value) {\n    if (value === undefined || value === null)\n        return undefined;\n    if (typeof value !== 'string') {\n        throw ShipError.validation('Idempotency key must be a string.');\n    }\n    const key = value.trim();\n    if (!key) {\n        throw ShipError.validation('Idempotency key must not be empty.');\n    }\n    if (key.length > IDEMPOTENCY_KEY_CONSTRAINTS.MAX_LENGTH) {\n        throw ShipError.validation(`Idempotency key must be at most ${IDEMPOTENCY_KEY_CONSTRAINTS.MAX_LENGTH} characters.`);\n    }\n    return key;\n}\n// =============================================================================\n// ACCOUNT TYPES\n// =============================================================================\n/**\n * Account plan constants\n */\nexport const AccountPlan = {\n    FREE: 'free',\n    STANDARD: 'standard',\n    SPONSORED: 'sponsored',\n    ENTERPRISE: 'enterprise',\n    SUSPENDED: 'suspended',\n    TERMINATING: 'terminating',\n    TERMINATED: 'terminated',\n};\n// =============================================================================\n// ERROR SYSTEM\n// =============================================================================\n/**\n * All possible error types in the ShipStatic platform.\n *\n * Developer-friendly key names map to stable wire-format string values.\n * Both the value and the type are exported under the same name so callers\n * can use `ErrorType.Validation` (value comparison) and `: ErrorType` (type\n * annotation) without ceremony — matching the pattern other status objects\n * (`DeploymentStatus`, `DomainStatus`, `AccountPlan`, `AuthMethod`) follow.\n */\nexport const ErrorType = {\n    /**\n     * Validation failed. Input shape is wrong.\n     *\n     * Carries 400 when an API judged it — including a client-side pre-check of a\n     * rule the server enforces too, which keeps the error identical wherever it\n     * was caught. **Statusless** when a client rejects something no API judges,\n     * such as a CLI's own command grammar: `status` is documented \"(API\n     * contexts)\" on `ErrorResponse`, so there is none to report.\n     */\n    Validation: 'validation_failed',\n    /** Resource not found (404). */\n    NotFound: 'not_found',\n    /** Authenticated but not allowed (403). User lacks permission for this action. */\n    Forbidden: 'forbidden',\n    /** Rate limit exceeded (429). */\n    RateLimit: 'rate_limit_exceeded',\n    /** Authentication required or failed (401). Missing/invalid credentials. */\n    Authentication: 'authentication_failed',\n    /** Business rule violation. Catch-all for 4xx state-rule errors that aren't more specific. */\n    Business: 'business_logic_error',\n    /** API server error (500). Generic server-side fault. */\n    Api: 'internal_server_error',\n    /** Network/connection error. Client-side only — set by HTTP clients on fetch failure; never produced server-side. */\n    Network: 'network_error',\n    /** Operation was cancelled. Client-side only — set on `AbortSignal` abort; never produced server-side. */\n    Cancelled: 'operation_cancelled',\n    /** File operation error. Client-side only — set by SDK during local file processing; never produced server-side. */\n    File: 'file_error',\n    /** Configuration error. Client-side only — set by SDK during config parsing/validation; never produced server-side. */\n    Config: 'config_error',\n};\n/**\n * Error types that originate exclusively on the client (HTTP clients, SDK\n * file processing, local config parsing). These never appear on the wire\n * from the server, so `fromHttpResponse` will not trust them even if a\n * misbehaving server claims one in `body.error`.\n */\nconst CLIENT_ONLY_ERROR_TYPES = new Set([\n    ErrorType.Network,\n    ErrorType.Cancelled,\n    ErrorType.File,\n    ErrorType.Config,\n]);\n/**\n * Categorizes error types for the `isClientError` / `isNetworkError` /\n * `isAuthError` helpers. Each `Set` is typed against the wider `ErrorType`\n * union so `.has(error.type)` accepts any value from the union.\n */\nconst ERROR_CATEGORIES = {\n    /**\n     * Client-attributable types. Exhaustive over the 4xx-carrying types, and\n     * over the statusless ones too — those are raised locally and have no\n     * status for `isClientError`'s second arm to read, so omitting one makes it\n     * read as a server fault. The rule is the membership test: every type in\n     * `CLIENT_ONLY_ERROR_TYPES` except `Network` (which `isNetworkError` owns)\n     * belongs here.\n     *\n     * `Cancelled` was missing until 2026-07-29, which is exactly that failure:\n     * a caller who aborted their own deploy was told \"server error: please try\n     * again\" — the CLI's fallback for everything this set does not claim.\n     */\n    client: new Set([\n        ErrorType.Business,\n        ErrorType.Cancelled,\n        ErrorType.Config,\n        ErrorType.File,\n        ErrorType.Forbidden,\n        ErrorType.NotFound,\n        ErrorType.RateLimit,\n        ErrorType.Validation,\n    ]),\n    network: new Set([ErrorType.Network]),\n    auth: new Set([ErrorType.Authentication]),\n};\n/**\n * Error types the server can legitimately produce on the wire. Used by\n * `ShipError.fromHttpResponse` to validate the body's `error` field before\n * trusting it as `ShipError.type`. Derived by exclusion from\n * `CLIENT_ONLY_ERROR_TYPES` so adding a new server-producible type to\n * `ErrorType` is automatically picked up.\n */\nconst SERVER_PRODUCIBLE_ERROR_TYPES = new Set(Object.values(ErrorType).filter((t) => !CLIENT_ONLY_ERROR_TYPES.has(t)));\n/**\n * Ceiling on a message adopted from a **non-JSON** error body — a foreign\n * responder's, never this platform's. Generous for the plain-text one-liners\n * intermediaries actually send (`error code: 1015`), far below a document.\n * Our own messages are never measured against it: a JSON body is the API's\n * contract, and truncating a long validation message would be the bug.\n */\nconst MAX_FOREIGN_MESSAGE_LENGTH = 200;\n/**\n * Simple unified error class for both API and SDK\n */\nexport class ShipError extends Error {\n    type;\n    status;\n    details;\n    constructor(type, message, status, details) {\n        super(message);\n        this.type = type;\n        this.status = status;\n        this.details = details;\n        this.name = 'ShipError';\n    }\n    /** Convert to wire format */\n    toResponse() {\n        // Strip authentication details when they carry an `internal` telemetry\n        // tag (see `ShipError.authentication` JSDoc) — these are server-side\n        // diagnostics like 'session_invalid' that must not leak to clients.\n        const authDetails = this.details;\n        const details = this.type === ErrorType.Authentication && authDetails?.internal ? undefined : this.details;\n        return {\n            error: this.type,\n            message: this.message,\n            status: this.status,\n            details,\n        };\n    }\n    /**\n     * Construct a `ShipError` from an HTTP error response.\n     *\n     * Best-effort body parse for `{ message, error?, details? }`. Message\n     * resolution: `body.message` → `body.error` → `\"<operationName> failed with\n     * status <N>\"`.\n     *\n     * Type resolution: trusts `body.error` when it's a known server-producible\n     * `ErrorType` (preserves the wire's intent — server's\n     * `ShipError.validation(...)` round-trips back to `ErrorType.Validation`\n     * on the client). Falls back to status-derived (401 → Authentication,\n     * 403 → Forbidden, 429 → RateLimit, else → Api) for non-API responses\n     * (CDN errors, intermediaries) or malformed bodies. Client-only types\n     * (`Network`, `Cancelled`, `File`, `Config`) are filtered out of the\n     * trusted set — a misbehaving server claiming one of those is ignored.\n     *\n     * `operationName` (e.g. `\"Get account\"`) is used to compose the fallback\n     * message. Defaults to `\"Request\"`. Same convention as `fromFetchError`.\n     *\n     * Async because it reads the response body. Returns rather than throws so\n     * callers can compose; most will `throw await ShipError.fromHttpResponse(...)`.\n     */\n    static async fromHttpResponse(response, operationName) {\n        let message;\n        let details;\n        let bodyType;\n        try {\n            const contentType = response.headers.get('content-type');\n            if (contentType?.includes('application/json')) {\n                const json = await response.json();\n                if (json && typeof json === 'object') {\n                    const obj = json;\n                    if (typeof obj.message === 'string')\n                        message = obj.message;\n                    else if (typeof obj.error === 'string')\n                        message = obj.error;\n                    details = obj.details;\n                    if (typeof obj.error === 'string' && SERVER_PRODUCIBLE_ERROR_TYPES.has(obj.error)) {\n                        bodyType = obj.error;\n                    }\n                }\n            }\n            else {\n                // A non-JSON body did not come from this platform — every API error\n                // is `ErrorResponse` JSON — so it is an intermediary's output, and\n                // the two kinds it produces need opposite treatment. A CDN's plain\n                // `error code: 1015` is the most useful thing there is to say. A\n                // proxy's HTML error page is a *document*, not a message: adopting it\n                // verbatim made a misconfigured `apiUrl` print 2,059 characters of\n                // markup as the error. Trust it only when it reads as a message.\n                const text = (await response.text()).trim();\n                if (text && !text.startsWith('<') && text.length <= MAX_FOREIGN_MESSAGE_LENGTH) {\n                    message = text;\n                }\n            }\n        }\n        catch {\n            // Body unreadable; fall through to operationName-derived message.\n        }\n        // Rate-limit (and 503) timing rides the `Retry-After` HEADER, which a\n        // body-only reader would drop. Lift it into `details` as seconds so\n        // consumers can back off from the typed error alone, without keeping the\n        // raw Response around. Body-carried fields are preserved and win.\n        const retryAfterHeader = response.headers.get('retry-after');\n        if (retryAfterHeader !== null) {\n            const value = retryAfterHeader.trim();\n            const seconds = /^\\d+$/.test(value)\n                ? Number(value)\n                : Math.ceil((Date.parse(value) - Date.now()) / 1000);\n            if (Number.isFinite(seconds) && seconds >= 0) {\n                const existing = details && typeof details === 'object' ? details : {};\n                if (existing.retryAfter === undefined) {\n                    details = { ...existing, retryAfter: seconds };\n                }\n            }\n        }\n        message = message || `${operationName || 'Request'} failed with status ${response.status}`;\n        const type = bodyType ??\n            (response.status === 401\n                ? ErrorType.Authentication\n                : response.status === 403\n                    ? ErrorType.Forbidden\n                    : response.status === 429\n                        ? ErrorType.RateLimit\n                        : ErrorType.Api);\n        return new ShipError(type, message, response.status, details);\n    }\n    /**\n     * Construct a `ShipError` from an error caught around a `fetch()` call.\n     *\n     * The mirror of `fromHttpResponse` for the *other* side of the HTTP error\n     * story — the network layer failing (offline, CORS, abort) rather than the\n     * server returning a non-OK response.\n     *\n     * Routing:\n     * - Already a `ShipError` → returned as-is (caller's intent preserved)\n     * - `AbortError` → `ShipError.cancelled(...)`\n     * - `TypeError` whose message mentions \"fetch\" → `ShipError.network(...)`\n     * - Any other `Error` → `ShipError(Api, ...)` (no HTTP status — fetch never reached the server)\n     * - Anything else (string, undefined, etc.) → `ShipError(Api, ...)`\n     *\n     * The optional `operationName` is composed into the message for context:\n     * `\"Get account was cancelled\"`, `\"Get account failed: ...\"`. Defaults to\n     * `\"Request\"` when omitted.\n     */\n    static fromFetchError(cause, operationName) {\n        if (isShipError(cause))\n            return cause;\n        const op = operationName || 'Request';\n        if (cause instanceof Error) {\n            if (cause.name === 'AbortError') {\n                return ShipError.cancelled(`${op} was cancelled`);\n            }\n            if (cause instanceof TypeError && cause.message.includes('fetch')) {\n                return ShipError.network(`${op} failed: ${cause.message}`, { cause });\n            }\n            return new ShipError(ErrorType.Api, `${op} failed: ${cause.message}`);\n        }\n        return new ShipError(ErrorType.Api, `${op} failed: Unknown error`);\n    }\n    // Factory methods. Uniform shape `(message, details?)` with two principled\n    // exceptions: `notFound` composes its message from (resource, id?), and\n    // `business` / `api` accept an optional status because they're the\n    // multi-status fallbacks.\n    static validation(message, details) {\n        return new ShipError(ErrorType.Validation, message, 400, details);\n    }\n    static notFound(resource, id) {\n        const message = id ? `${resource} ${id} not found` : `${resource} not found`;\n        return new ShipError(ErrorType.NotFound, message, 404);\n    }\n    static forbidden(message, details) {\n        return new ShipError(ErrorType.Forbidden, message, 403, details);\n    }\n    static rateLimit(message = 'Too many requests', details) {\n        return new ShipError(ErrorType.RateLimit, message, 429, details);\n    }\n    /**\n     * Construct an Authentication (401) error.\n     *\n     * **Telemetry pattern — `details: { internal: '<tag>' }`.** When the\n     * server creates an auth error with an `internal` key in `details`\n     * (e.g. `{ internal: 'session_invalid' }`), `toResponse()` strips the\n     * entire `details` object before serialization. This keeps the wire\n     * response a clean \"Authentication failed\" while preserving granular\n     * server-side telemetry (which strategy/check failed) for logs and tests.\n     *\n     * Use this pattern in API auth code; do not put client-visible info under\n     * `internal`. Other `details` keys round-trip normally.\n     */\n    static authentication(message = 'Authentication required', details) {\n        return new ShipError(ErrorType.Authentication, message, 401, details);\n    }\n    static business(message, status = 400, details) {\n        return new ShipError(ErrorType.Business, message, status, details);\n    }\n    static network(message, details) {\n        return new ShipError(ErrorType.Network, message, undefined, details);\n    }\n    static cancelled(message, details) {\n        return new ShipError(ErrorType.Cancelled, message, undefined, details);\n    }\n    static file(message, details) {\n        return new ShipError(ErrorType.File, message, undefined, details);\n    }\n    static config(message, details) {\n        return new ShipError(ErrorType.Config, message, undefined, details);\n    }\n    static api(message, status = 500, details) {\n        return new ShipError(ErrorType.Api, message, status, details);\n    }\n    // Semantic-category guards. For specific-type checks, use\n    // `error.type === ErrorType.X` directly or the generic `isType(t)`.\n    /**\n     * The caller is at fault — by HTTP's own definition of a 4xx, or by a type\n     * that is client-attributable without ever having a status (`Config`,\n     * `File`, raised locally by the SDK).\n     *\n     * Both arms are load-bearing, because type and status are independent\n     * axes. `fromHttpResponse` trusts `body.error` only when it names a\n     * server-producible type; a non-OK response without one is status-derived,\n     * so a CDN 404 or any intermediary error arrives as `Api` — a server-fault\n     * *type* carrying a client *status*. Judging by type alone would report it\n     * as a platform failure and bury the server's own message.\n     */\n    isClientError() {\n        if (ERROR_CATEGORIES.client.has(this.type))\n            return true;\n        return this.status !== undefined && this.status >= 400 && this.status < 500;\n    }\n    isNetworkError() {\n        return ERROR_CATEGORIES.network.has(this.type);\n    }\n    isAuthError() {\n        return ERROR_CATEGORIES.auth.has(this.type);\n    }\n    isType(errorType) {\n        return this.type === errorType;\n    }\n}\n/**\n * Type guard to check if an unknown value is a ShipError.\n *\n * Uses structural checking instead of instanceof to handle module duplication\n * in bundled applications where multiple copies of the ShipError class may exist.\n *\n * @example\n * if (isShipError(error)) {\n *   console.log(error.status, error.message);\n * }\n */\nexport function isShipError(error) {\n    return (error !== null &&\n        typeof error === 'object' &&\n        'name' in error &&\n        error.name === 'ShipError' &&\n        'status' in error);\n}\n// =============================================================================\n// EXTENSION BLOCKLIST\n// =============================================================================\n/**\n * Blocked file extensions — files that cannot be uploaded.\n *\n * We accept any file type by default and derive Content-Type from the\n * extension at serve time (via mime-db in the API worker). Unknown extensions\n * are served as `application/octet-stream` with `X-Content-Type-Options: nosniff`.\n *\n * The blocklist targets file types that pose direct security risks when hosted:\n * executables, disk images, malware vectors, dangerous scripts, and shortcuts.\n */\nexport const BLOCKED_EXTENSIONS = new Set([\n    // Executables\n    'exe',\n    'msi',\n    'dll',\n    'scr',\n    'bat',\n    'cmd',\n    'com',\n    'pif',\n    'app',\n    'deb',\n    'rpm',\n    // Installers\n    'pkg',\n    'mpkg',\n    // Disk images\n    'dmg',\n    'iso',\n    'img',\n    // Malware vectors\n    'cab',\n    'cpl',\n    'chm',\n    // Dangerous scripts\n    'ps1',\n    'vbs',\n    'vbe',\n    'ws',\n    'wsf',\n    'wsc',\n    'wsh',\n    'reg',\n    // Java\n    'jar',\n    'jnlp',\n    // Mobile/browser packages\n    'apk',\n    'crx',\n    // Shortcut/link\n    'lnk',\n    'inf',\n    'hta',\n]);\n/**\n * Check if a filename has a blocked extension.\n * Extracts the extension from the filename and checks against the blocklist.\n * Case-insensitive. Returns false for files without extensions.\n *\n * @example\n * isBlockedExtension('virus.exe')     // true\n * isBlockedExtension('app.dmg')       // true\n * isBlockedExtension('style.css')     // false\n * isBlockedExtension('data.custom')   // false\n * isBlockedExtension('README')        // false\n */\nexport function isBlockedExtension(filename) {\n    const dotIndex = filename.lastIndexOf('.');\n    if (dotIndex === -1 || dotIndex === filename.length - 1)\n        return false;\n    const ext = filename.slice(dotIndex + 1).toLowerCase();\n    return BLOCKED_EXTENSIONS.has(ext);\n}\n// =============================================================================\n// FILENAME CHARACTER VALIDATION\n// =============================================================================\n/**\n * Characters that are unsafe in filenames for static hosting.\n *\n * Blocks only characters that genuinely break the upload→serve round-trip:\n * - # ? %        URL round-trip breakers (fragment, query, encoding ambiguity)\n * - \\            Path separator confusion (upload splits on backslash)\n * - < > \"        XSS vectors with zero legitimate use in filenames\n * - \\x00-\\x1f \\x7f  Control characters (header injection, display corruption)\n *\n * Everything else is allowed — browser percent-encodes, Worker decodes, R2 matches.\n */\n// biome-ignore lint/suspicious/noControlCharactersInRegex: blocking control characters is this regex's purpose\nexport const UNSAFE_FILENAME_CHARS = /[\\x00-\\x1f\\x7f#?%\\\\<>\"]/;\n/**\n * Check if a filename contains unsafe characters.\n *\n * @example\n * hasUnsafeChars('saved_resource(1).html')  // false — parentheses are safe\n * hasUnsafeChars('page[slug].js')           // false — brackets are safe\n * hasUnsafeChars('file#anchor.html')        // true  — # breaks URL resolution\n * hasUnsafeChars('file<tag>.html')          // true  — < is an XSS vector\n */\nexport function hasUnsafeChars(filename) {\n    return UNSAFE_FILENAME_CHARS.test(filename);\n}\n// =============================================================================\n// UNBUILT PROJECT MARKERS\n// =============================================================================\n/**\n * Path segment names that indicate an unbuilt project was uploaded instead of build output.\n * Used for early detection in CLI, browser, and server validation.\n */\nexport const UNBUILT_PROJECT_MARKERS = new Set([\n    'node_modules',\n    'package.json',\n]);\n/**\n * Check if a file path contains an unbuilt project marker.\n *\n * @example\n * hasUnbuiltMarker('node_modules/react/index.js')  // true\n * hasUnbuiltMarker('package.json')                  // true\n * hasUnbuiltMarker('dist/index.html')               // false\n */\nexport function hasUnbuiltMarker(filePath) {\n    const segments = filePath.replace(/\\\\/g, '/').split('/').filter(Boolean);\n    return segments.some((s) => UNBUILT_PROJECT_MARKERS.has(s));\n}\n// =============================================================================\n// CREDENTIAL SHAPES\n// =============================================================================\n// The one address for credential vocabulary: where human identity lives\n// (AUTH_BASE_PATH), how a request is authorized (AuthMethod), the shapes\n// that distinguish populations on the wire (API_KEY, DEPLOY_TOKEN, CALLER),\n// the single dispatch over them (TokenKind, classifyToken), and the\n// delegated-access scopes (OAuthScope).\n/**\n * Where human identity is mounted on the API host. The API mounts Better\n * Auth at this path (sign-in, sign-out, session reads, admin impersonation)\n * and the web console's auth client posts to it — shared here so the two\n * halves of the auth pair agree by construction, the same way both sides\n * already share the credential prefixes below.\n */\nexport const AUTH_BASE_PATH = '/auth';\n/**\n * How a request (or recorded activity) was authorized.\n *\n * Client populations: `SESSION` (first-party cookie), `API_KEY` (`ship-`\n * key), `TOKEN` (`deploy-` deploy token), `AGENT` (anonymous public deploy —\n * no credential; the platform grants the public-account identity per\n * request), `OAUTH` (delegated access token). Server populations: `WEBHOOK`\n * (signed webhook processing), `SYSTEM` (scheduled/background jobs).\n */\nexport const AuthMethod = {\n    SESSION: 'session',\n    API_KEY: 'apiKey',\n    TOKEN: 'token',\n    AGENT: 'agent',\n    OAUTH: 'oauth',\n    WEBHOOK: 'webhook',\n    SYSTEM: 'system',\n};\n/**\n * Shape constants for API keys (`ship-{64 hex chars}`).\n * Single source of truth used by validation utilities and auth middleware.\n */\nexport const API_KEY = {\n    /** Prefix that identifies an API key. */\n    PREFIX: 'ship-',\n    /** Number of hex characters following the prefix. */\n    HEX_LENGTH: 64,\n    /** Total length of an API key including prefix (`PREFIX.length + HEX_LENGTH = 69`). */\n    TOTAL_LENGTH: 69,\n    /** Number of trailing characters used to display a redacted hint (e.g. last 4). */\n    HINT_LENGTH: 4,\n};\n/**\n * Shape constants for deploy tokens (`deploy-{64 hex chars}`).\n * Single source of truth used by validation utilities and auth middleware.\n */\nexport const DEPLOY_TOKEN = {\n    /** Prefix that identifies a deploy token. */\n    PREFIX: 'deploy-',\n    /** Number of hex characters following the prefix. */\n    HEX_LENGTH: 64,\n    /** Total length of a deploy token including prefix (`PREFIX.length + HEX_LENGTH = 71`). */\n    TOTAL_LENGTH: 71,\n};\n/**\n * Shape constants for caller identifiers (the `X-Caller` instance-identity\n * header — rate-limit bucketing for multi-tenant orchestrators). The API\n * normalizes case and silently ignores malformed values (the header is\n * unauthenticated); clients validate at the boundary via `validateCaller`,\n * so a value the server would drop fails fast instead.\n */\nexport const CALLER = {\n    /** HTTP header name. */\n    HEADER: 'X-Caller',\n    /** Maximum identifier length. */\n    MAX_LENGTH: 128,\n    /** Allowed characters: alphanumeric, dot, underscore, hyphen. */\n    PATTERN: /^[a-zA-Z0-9._-]+$/,\n};\n/**\n * Token populations distinguishable by shape. The platform carries every\n * client token in one wire slot (`Authorization: Bearer <value>`) and\n * classifies by value, never by a side channel — this is the classifier.\n *\n * `API_KEY` and `DEPLOY_TOKEN` *are* `AuthMethod.API_KEY` and\n * `AuthMethod.TOKEN` — the equality is structural, so a classification flows\n * straight into an auth method and the pair can never drift. `OPAQUE` is any\n * other value — shape says nothing about it, so only a lookup can. Today the\n * server refuses every opaque bearer; the OAuth access-token population\n * resolves there when the authorization server ships.\n */\nexport const TokenKind = {\n    API_KEY: AuthMethod.API_KEY,\n    DEPLOY_TOKEN: AuthMethod.TOKEN,\n    OPAQUE: 'opaque',\n};\n/**\n * Classify a client token by shape. The single dispatch used by both sides\n * of the wire: API auth middleware (which population is this credential?)\n * and SDK validation (which format rules apply before sending?). Sharing it\n * is what guarantees client and server can never disagree on dispatch.\n */\nexport function classifyToken(token) {\n    if (token.startsWith(API_KEY.PREFIX))\n        return TokenKind.API_KEY;\n    if (token.startsWith(DEPLOY_TOKEN.PREFIX))\n        return TokenKind.DEPLOY_TOKEN;\n    return TokenKind.OPAQUE;\n}\n/**\n * OAuth scope vocabulary for delegated third-party access tokens.\n * Single source of truth used by the authorization server (advertised in\n * `scopes_supported`), the API's scope-enforcement middleware, and consent UI\n * copy. The standard `offline_access` scope (refresh tokens) is not platform\n * vocabulary and is deliberately absent — the middleware never checks it.\n *\n * Deliberately absent by design: any `tokens:*` scope, `account:write`, or\n * admin scope — a delegated app must never mint credentials, delete the\n * account, or act as admin.\n */\nexport const OAuthScope = {\n    ACCOUNT_READ: 'account:read',\n    DEPLOYMENTS_READ: 'deployments:read',\n    DEPLOYMENTS_WRITE: 'deployments:write',\n    DOMAINS_READ: 'domains:read',\n    DOMAINS_WRITE: 'domains:write',\n};\n// =============================================================================\n// DEPLOYMENT CONFIGURATION CONSTANTS\n// =============================================================================\nexport const DEPLOYMENT_CONFIG_FILENAME = 'ship.json';\n/** Default ship.json config for SPA routing. Single source of truth — used by both API and SDK. */\nexport const SPA_DEFAULT_CONFIG = {\n    rewrites: [{ source: '/(.*)', destination: '/index.html' }],\n};\n/**\n * Assert that a ship.json file is *syntactically* loadable. Syntax only —\n * never schema.\n *\n * ship.json is validated and compiled on the server, deliberately: the schema\n * and the compiler evolve, and a client that judged them would reject configs\n * a newer platform accepts. That reasoning bounds what a client may check to\n * the properties which are true of *every* past and future schema:\n *\n *   1. it parses as JSON — JSON syntax is frozen (RFC 8259), so text that\n *      does not parse can never be a valid config;\n *   2. its top level is an object — ship.json is `{ ... }` in every version.\n *\n * Both are monotonic: neither can ever reject something the server would\n * accept. Everything beyond them (field names, types, rule semantics, which\n * keys are permitted) stays server-side, where it can change.\n *\n * The payoff is the common case. Hand-edited JSON fails on a trailing comma,\n * a `//` comment, single quotes, unquoted keys, or smart quotes pasted from\n * documentation — mistakes that otherwise cost a full upload round-trip to\n * discover. A UTF-8 BOM (Windows editors, PowerShell redirects) is stripped\n * before parsing rather than rejected, because the server accepts it too;\n * diverging there would reintroduce exactly the false rejection this\n * function exists to avoid.\n *\n * @throws {ShipError} `ErrorType.Config` — the same type the server's own\n * config rejection carries, so the error contract is identical wherever the\n * failure is detected.\n */\nexport function assertShipJsonSyntax(text) {\n    const withoutBom = text.charCodeAt(0) === 0xfeff ? text.slice(1) : text;\n    let parsed;\n    try {\n        parsed = JSON.parse(withoutBom);\n    }\n    catch (error) {\n        throw ShipError.config(`invalid JSON format in config: ${error.message}`, {\n            filePath: DEPLOYMENT_CONFIG_FILENAME,\n        });\n    }\n    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {\n        throw ShipError.config(`${DEPLOYMENT_CONFIG_FILENAME} must contain a JSON object`, {\n            filePath: DEPLOYMENT_CONFIG_FILENAME,\n        });\n    }\n}\n// =============================================================================\n// VALIDATION UTILITIES\n// =============================================================================\n/**\n * Shared rule for prefixed credentials: `{PREFIX}{HEX_LENGTH hex chars}`.\n * The regex derives from the shape constants, so the validators can never\n * drift from the shapes `classifyToken` dispatches on.\n */\nfunction validatePrefixedCredential(value, shape, label) {\n    if (!value.startsWith(shape.PREFIX)) {\n        throw ShipError.validation(`${label} must start with \"${shape.PREFIX}\"`);\n    }\n    if (value.length !== shape.TOTAL_LENGTH) {\n        throw ShipError.validation(`${label} must be ${shape.TOTAL_LENGTH} characters total (${shape.PREFIX} + ${shape.HEX_LENGTH} hex chars)`);\n    }\n    const hexPart = value.slice(shape.PREFIX.length);\n    if (!new RegExp(`^[a-f0-9]{${shape.HEX_LENGTH}}$`, 'i').test(hexPart)) {\n        throw ShipError.validation(`${label} must contain ${shape.HEX_LENGTH} hexadecimal characters after \"${shape.PREFIX}\" prefix`);\n    }\n}\n/**\n * Validate API key format\n */\nexport function validateApiKey(apiKey) {\n    validatePrefixedCredential(apiKey, API_KEY, 'API key');\n}\n/**\n * Validate deploy token format\n */\nexport function validateDeployToken(deployToken) {\n    validatePrefixedCredential(deployToken, DEPLOY_TOKEN, 'Deploy token');\n}\n/**\n * Validate a client token of any population. Classifies by shape and applies\n * the matching format rules: `ship-` keys and `deploy-` deploy tokens are\n * validated strictly; opaque tokens (OAuth access tokens, future populations)\n * only need to be non-empty — their validity is the server's to decide.\n */\nexport function validateToken(token) {\n    switch (classifyToken(token)) {\n        case TokenKind.API_KEY:\n            validateApiKey(token);\n            return;\n        case TokenKind.DEPLOY_TOKEN:\n            validateDeployToken(token);\n            return;\n        case TokenKind.OPAQUE:\n            if (!token)\n                throw ShipError.validation('Token must be a non-empty string');\n    }\n}\n/**\n * Validate a caller identifier against the `CALLER` shape. The server\n * silently ignores malformed values (the header is unauthenticated); clients\n * call this at configuration time so the drop never silently happens.\n */\nexport function validateCaller(caller) {\n    if (!caller || caller.length > CALLER.MAX_LENGTH || !CALLER.PATTERN.test(caller)) {\n        throw ShipError.validation(`Caller must be 1-${CALLER.MAX_LENGTH} characters: letters, digits, dots, underscores, or hyphens`);\n    }\n}\n/**\n * Validate API URL format\n */\nexport function validateApiUrl(apiUrl) {\n    try {\n        const url = new URL(apiUrl);\n        if (!['http:', 'https:'].includes(url.protocol)) {\n            throw ShipError.validation('API URL must use http:// or https:// protocol');\n        }\n        if (url.pathname !== '/' && url.pathname !== '') {\n            throw ShipError.validation('API URL must not contain a path');\n        }\n        if (url.search || url.hash) {\n            throw ShipError.validation('API URL must not contain query parameters or fragments');\n        }\n    }\n    catch (error) {\n        if (isShipError(error)) {\n            throw error;\n        }\n        throw ShipError.validation('API URL must be a valid URL');\n    }\n}\n/**\n * Check if a string matches the deployment identifier pattern (word-word-alphanumeric7).\n * Example: \"happy-cat-abc1234.shipstatic.com\"\n */\nexport function isDeployment(input) {\n    return /^[a-z]+-[a-z]+-[a-z0-9]{7}(\\.[a-z0-9.-]+)?$/i.test(input);\n}\n// =============================================================================\n// PLATFORM CONSTANTS\n// =============================================================================\n/** Default API URL if not otherwise configured. */\nexport const DEFAULT_API = 'https://api.shipstatic.com';\n// =============================================================================\n// FILE UPLOAD TYPES\n// =============================================================================\n/**\n * File status constants for validation state tracking\n */\nexport const FileValidationStatus = {\n    /** File is pending validation */\n    PENDING: 'pending',\n    /** File failed during processing (before validation) */\n    PROCESSING_ERROR: 'processing_error',\n    /** File was excluded by validation warning (not an error) */\n    EXCLUDED: 'excluded',\n    /** File failed validation (blocks deployment) */\n    VALIDATION_FAILED: 'validation_failed',\n    /** File passed validation and is ready for deployment */\n    READY: 'ready',\n};\n// =============================================================================\n// DOMAIN UTILITIES\n// =============================================================================\n/**\n * Check if a domain is a platform domain (subdomain of our platform).\n * Platform domains are free and don't require DNS verification.\n *\n * @example isPlatformDomain(\"www.shipstatic.com\", \"shipstatic.com\") → true\n * @example isPlatformDomain(\"example.com\", \"shipstatic.com\") → false\n */\nexport function isPlatformDomain(domain, platformDomain) {\n    return domain.endsWith(`.${platformDomain}`);\n}\n/**\n * Check if a domain is a custom domain (not a platform subdomain).\n * Custom domains are billable and require DNS verification.\n *\n * @example isCustomDomain(\"example.com\", \"shipstatic.com\") → true\n * @example isCustomDomain(\"www.shipstatic.com\", \"shipstatic.com\") → false\n */\nexport function isCustomDomain(domain, platformDomain) {\n    return !isPlatformDomain(domain, platformDomain);\n}\n/**\n * Extract subdomain from a platform domain.\n * Returns null if not a platform domain.\n *\n * @example extractSubdomain(\"www.shipstatic.com\", \"shipstatic.com\") → \"www\"\n * @example extractSubdomain(\"example.com\", \"shipstatic.com\") → null\n */\nexport function extractSubdomain(domain, platformDomain) {\n    if (!isPlatformDomain(domain, platformDomain)) {\n        return null;\n    }\n    return domain.slice(0, -(platformDomain.length + 1)); // +1 for the dot\n}\n/**\n * Generate HTTPS URL for a deployment hostname.\n */\nexport function generateDeploymentUrl(deployment) {\n    return `https://${deployment}`;\n}\n/**\n * Generate HTTPS URL for a domain.\n */\nexport function generateDomainUrl(domain) {\n    return `https://${domain}`;\n}\n// =============================================================================\n// LABEL UTILITIES\n// =============================================================================\n/**\n * Label validation constraints shared across UI and API.\n * These rules define the single source of truth for label validation.\n */\nexport const LABEL_CONSTRAINTS = {\n    /** Minimum label length in characters */\n    MIN_LENGTH: 3,\n    /** Maximum label length in characters (concise labels, matches Stack Overflow's original limit) */\n    MAX_LENGTH: 25,\n    /** Maximum number of labels allowed per resource */\n    MAX_COUNT: 10,\n    /** Allowed separator characters between label segments */\n    SEPARATORS: '._-',\n};\n/**\n * Label validation pattern.\n * Must start and end with alphanumeric (a-z, 0-9).\n * Can contain separators (. _ -) between segments, but not consecutive.\n *\n * Valid examples: 'production', 'v1.2.3', 'api_v2', 'us-east-1'\n * Invalid examples: 'ab' (too short), '-prod' (starts with separator), 'foo--bar' (consecutive separators)\n */\nexport const LABEL_PATTERN = /^[a-z0-9]+(?:[._-][a-z0-9]+)*$/;\n/**\n * Serialize labels array to JSON string for database storage.\n * Returns null for empty or undefined arrays.\n *\n * @example serializeLabels(['web', 'production']) → '[\"web\",\"production\"]'\n * @example serializeLabels([]) → null\n * @example serializeLabels(undefined) → null\n */\nexport function serializeLabels(labels) {\n    if (!labels || labels.length === 0)\n        return null;\n    return JSON.stringify(labels);\n}\n/**\n * Deserialize labels from JSON string to array.\n * Always returns an array — empty array for null/empty/invalid input.\n *\n * @example deserializeLabels('[\"web\",\"production\"]') → ['web', 'production']\n * @example deserializeLabels(null) → []\n * @example deserializeLabels('') → []\n */\nexport function deserializeLabels(labelsJson) {\n    if (!labelsJson)\n        return [];\n    try {\n        const parsed = JSON.parse(labelsJson);\n        return Array.isArray(parsed) ? parsed : [];\n    }\n    catch {\n        return [];\n    }\n}\n// =============================================================================\n// PASSWORD UTILITIES\n// =============================================================================\n/**\n * Length constraints for the optional deployment password\n * (`DeploymentUploadOptions.password`). Single source of truth shared across\n * platform consumers.\n */\nexport const PASSWORD_CONSTRAINTS = {\n    /** Minimum password length in characters */\n    MIN_LENGTH: 6,\n    /** Maximum password length in characters */\n    MAX_LENGTH: 128,\n};\n/**\n * Validate an optional deployment password and return it normalized.\n *\n * Absent (`undefined` / `null`) → returns `undefined`. Present → trim\n * leading/trailing whitespace, then validate against `PASSWORD_CONSTRAINTS`\n * length bounds (internal whitespace is significant and counts toward\n * length). Throws `ShipError.validation` on breach; returns the trimmed\n * value.\n *\n * The trim is canonical: at upload, the API hashes the trimmed value; at\n * unlock, the router trims submissions before hashing. Submission and storage\n * agree byte-for-byte. Length validation runs on the trimmed value because\n * that's the user's actual intent — and it disarms a class of invisible\n * foot-guns (trailing newlines from copy/paste, mobile auto-spacing,\n * password-manager artifacts).\n *\n * Single source of truth shared by SDK (client-side validation, return\n * ignored) and API (server-side enforcement, return threaded into config).\n * Length is part of the wire-format contract; strength rules, if added later,\n * stay server-side. See `CLAUDE.md` \"Validation: format vs policy\".\n */\nexport function validatePassword(value) {\n    if (value === undefined || value === null)\n        return undefined;\n    if (typeof value !== 'string') {\n        throw ShipError.validation('Password must be a string');\n    }\n    const trimmed = value.trim();\n    if (trimmed.length < PASSWORD_CONSTRAINTS.MIN_LENGTH ||\n        trimmed.length > PASSWORD_CONSTRAINTS.MAX_LENGTH) {\n        throw ShipError.validation(`Password must be between ${PASSWORD_CONSTRAINTS.MIN_LENGTH} and ${PASSWORD_CONSTRAINTS.MAX_LENGTH} characters`);\n    }\n    return trimmed;\n}\n","/**\n * @file MD5 utility for Blob, Buffer, or file path inputs.\n */\nimport { ShipError } from '@shipstatic/types';\n\nexport interface MD5Result {\n  md5: string;\n}\n\nasync function md5Blob(blob: Blob): Promise<MD5Result> {\n  const SparkMD5 = (await import('spark-md5')).default;\n  const spark = new SparkMD5.ArrayBuffer();\n  const chunkSize = 2097152; // 2 MB\n  for (let start = 0; start < blob.size; start += chunkSize) {\n    const end = Math.min(start + chunkSize, blob.size);\n    spark.append(await blob.slice(start, end).arrayBuffer());\n  }\n  return { md5: spark.end() };\n}\n\nasync function md5Buffer(buffer: Buffer): Promise<MD5Result> {\n  // biome-ignore lint/style/useNodejsImportProtocol: the browser build shims bare specifiers only — `node:` bypasses esbuild alias resolution (see tsup.config.ts)\n  const { createHash } = await import('crypto');\n  const hash = createHash('md5');\n  hash.update(buffer);\n  return { md5: hash.digest('hex') };\n}\n\nasync function md5Path(path: string): Promise<MD5Result> {\n  // biome-ignore lint/style/useNodejsImportProtocol: see md5Buffer — bare specifier is load-bearing for the browser shim\n  const { createHash } = await import('crypto');\n  // biome-ignore lint/style/useNodejsImportProtocol: see md5Buffer — bare specifier is load-bearing for the browser shim\n  const { createReadStream } = await import('fs');\n  return new Promise((resolve, reject) => {\n    const hash = createHash('md5');\n    const stream = createReadStream(path);\n    // A local read that failed — no request was made and no server rule was\n    // being mirrored, so there is no status to report and this is the `File`\n    // type by definition (see CLAUDE.md, \"What a status means\"). The path\n    // rides `details`, per the factory's own convention, rather than being\n    // spelled into prose twice.\n    stream.on('error', (err) =>\n      reject(ShipError.file(`Failed to read file for MD5: ${err.message}`, { filePath: path })),\n    );\n    stream.on('data', (chunk) => hash.update(chunk));\n    stream.on('end', () => resolve({ md5: hash.digest('hex') }));\n  });\n}\n\nexport async function calculateMD5(input: Blob | Buffer | string): Promise<MD5Result> {\n  if (input instanceof Blob) return md5Blob(input);\n  if (typeof Buffer !== 'undefined' && Buffer.isBuffer(input)) return md5Buffer(input);\n  if (typeof input === 'string') return md5Path(input);\n  throw ShipError.business('Invalid input for MD5 calculation');\n}\n","/**\n * @file Environment detection utilities for the Ship SDK.\n * Helps in determining whether the SDK is running in a Node.js, browser, or unknown environment.\n */\n\n/**\n * Represents the detected or simulated JavaScript execution environment.\n */\nexport type ExecutionEnvironment = 'browser' | 'node' | 'unknown';\n\n/** @internal Environment override for testing. */\nlet _testEnvironment: ExecutionEnvironment | null = null;\n\n/**\n * **FOR TESTING PURPOSES ONLY.**\n *\n * Allows tests to override the detected environment, forcing the SDK to behave\n * as if it's running in the specified environment.\n *\n * @param env - The environment to simulate ('node', 'browser', 'unknown'),\n *              or `null` to clear the override and revert to actual environment detection.\n * @internal\n */\nexport function __setTestEnvironment(env: ExecutionEnvironment | null): void {\n  _testEnvironment = env;\n}\n\n/**\n * Detects the actual JavaScript execution environment (Node.js, browser, or unknown)\n * by checking for characteristic global objects.\n * @returns The detected environment as {@link ExecutionEnvironment}.\n * @internal\n */\nfunction detectEnvironment(): ExecutionEnvironment {\n  // Check for Node.js environment\n  if (typeof process !== 'undefined' && process.versions && process.versions.node) {\n    return 'node';\n  }\n\n  // Check for Browser environment (including Web Workers)\n  if (typeof window !== 'undefined' || typeof self !== 'undefined') {\n    return 'browser';\n  }\n\n  return 'unknown';\n}\n\n/**\n * Gets the current effective execution environment.\n *\n * This function first checks if a test environment override is active via {@link __setTestEnvironment}.\n * If not, it detects the actual environment (Node.js, browser, or unknown).\n *\n * @returns The current execution environment: 'browser', 'node', or 'unknown'.\n * @public\n */\nexport function getENV(): ExecutionEnvironment {\n  // Return test override if set\n  if (_testEnvironment) {\n    return _testEnvironment;\n  }\n\n  // Detect actual environment\n  return detectEnvironment();\n}\n","/**\n * @file Path helper utilities that work in both browser and Node.js environments.\n * Provides environment-agnostic path manipulation functions.\n */\n\n/**\n * Finds the common parent directory from an array of directory paths.\n * The basis of `pathDetect`: the common parent is the prefix stripped from\n * every deploy path so a deployment's root is the site's root.\n *\n * @param dirPaths - Array of directory paths (not file paths - directories containing the files)\n * @returns The common parent directory path, or empty string if none found\n */\nexport function findCommonParent(dirPaths: string[]): string {\n  if (!dirPaths || dirPaths.length === 0) return '';\n\n  const normalizedPaths = dirPaths\n    .filter((p) => p && typeof p === 'string')\n    .map((p) => p.replace(/\\\\/g, '/'));\n\n  if (normalizedPaths.length === 0) return '';\n  if (normalizedPaths.length === 1) return normalizedPaths[0];\n\n  const pathSegments = normalizedPaths.map((p) => p.split('/').filter(Boolean));\n  const commonSegments = [];\n  const minLength = Math.min(...pathSegments.map((p) => p.length));\n\n  for (let i = 0; i < minLength; i++) {\n    const segment = pathSegments[0][i];\n    if (pathSegments.every((segments) => segments[i] === segment)) {\n      commonSegments.push(segment);\n    } else {\n      break;\n    }\n  }\n\n  return commonSegments.join('/');\n}\n\n/**\n * Converts backslashes to forward slashes for cross-platform compatibility.\n * Does not remove leading slashes (preserves absolute paths).\n * @param path - The path to normalize\n * @returns Path with forward slashes\n */\nexport function normalizeSlashes(path: string): string {\n  return path.replace(/\\\\/g, '/');\n}\n\n/**\n * Normalizes a path for web usage by converting backslashes to forward slashes\n * and removing leading slashes.\n * @param path - The path to normalize\n * @returns Normalized path suitable for web deployment\n */\nexport function normalizeWebPath(path: string): string {\n  return path.replace(/\\\\/g, '/').replace(/\\/+/g, '/').replace(/^\\/+/, '');\n}\n","/**\n * @file Deploy path optimization - the core logic that makes Ship deployments clean and intuitive.\n * Automatically strips common parent directories to create clean deployment URLs.\n */\n\nimport { normalizeWebPath } from './path.js';\n\n/**\n * Represents a file ready for deployment with its optimized path\n */\nexport interface DeployFile {\n  /** The clean deployment path (e.g., \"assets/style.css\") */\n  path: string;\n  /** Original filename */\n  name: string;\n}\n\n/**\n * Core path optimization logic.\n * Transforms messy local paths into clean deployment paths.\n *\n * @example\n * Input:  [\"dist/index.html\", \"dist/assets/app.js\"]\n * Output: [\"index.html\", \"assets/app.js\"]\n *\n * @param filePaths - Raw file paths from the local filesystem\n * @param options - Path processing options\n */\nexport function optimizeDeployPaths(\n  filePaths: string[],\n  options: { flatten?: boolean } = {},\n): DeployFile[] {\n  // When flattening is disabled, keep original structure\n  if (options.flatten === false) {\n    return filePaths.map((path) => ({\n      path: normalizeWebPath(path),\n      name: extractFileName(path),\n    }));\n  }\n\n  // Find the common directory prefix to strip\n  const commonPrefix = findCommonDirectory(filePaths);\n\n  return filePaths.map((filePath) => {\n    let deployPath = normalizeWebPath(filePath);\n\n    // Strip the common prefix to create clean deployment paths\n    if (commonPrefix) {\n      const prefixToRemove = commonPrefix.endsWith('/') ? commonPrefix : `${commonPrefix}/`;\n      if (deployPath.startsWith(prefixToRemove)) {\n        deployPath = deployPath.substring(prefixToRemove.length);\n      }\n    }\n\n    // Fallback to filename if path becomes empty\n    if (!deployPath) {\n      deployPath = extractFileName(filePath);\n    }\n\n    return {\n      path: deployPath,\n      name: extractFileName(filePath),\n    };\n  });\n}\n\n/**\n * Finds the common directory shared by all file paths.\n * This is what gets stripped to create clean deployment URLs.\n *\n * @example\n * [\"dist/index.html\", \"dist/assets/app.js\"] → \"dist\"\n * [\"src/components/A.tsx\", \"src/utils/B.ts\"] → \"src\"\n * [\"file1.txt\", \"file2.txt\", \"subdir/file3.txt\"] → \"\" (no common directory)\n */\nfunction findCommonDirectory(filePaths: string[]): string {\n  if (!filePaths.length) return '';\n\n  // Normalize all paths first\n  const normalizedPaths = filePaths.map((path) => normalizeWebPath(path));\n\n  // Find the common prefix among all file paths (not just directories)\n  const pathSegments = normalizedPaths.map((path) => path.split('/'));\n  const commonSegments: string[] = [];\n  const minLength = Math.min(...pathSegments.map((segments) => segments.length));\n\n  // Check each segment level to find the longest common prefix\n  for (let i = 0; i < minLength - 1; i++) {\n    // -1 because we don't want to include the filename\n    const segment = pathSegments[0][i];\n    if (pathSegments.every((segments) => segments[i] === segment)) {\n      commonSegments.push(segment);\n    } else {\n      break;\n    }\n  }\n\n  return commonSegments.join('/');\n}\n\n/**\n * Extracts just the filename from a file path\n */\nfunction extractFileName(path: string): string {\n  return path.split(/[/\\\\]/).pop() || path;\n}\n","/**\n * @file File validation utilities for Ship SDK\n * Provides client-side validation for file uploads before deployment\n */\n\nimport type {\n  FileValidationResult,\n  FileValidationStatusType,\n  PlatformLimits,\n  ValidatableFile,\n  ValidationIssue,\n} from '@shipstatic/types';\nimport {\n  FileValidationStatus as FILE_VALIDATION_STATUS,\n  hasUnbuiltMarker,\n  hasUnsafeChars,\n  isBlockedExtension,\n} from '@shipstatic/types';\n\n// Re-exported because it constrains three exported generics (validateFiles,\n// getValidFiles, allValidFilesReady) — a consumer cannot name the bound\n// otherwise, which is why the tests were inventing their own copy.\nexport type { ValidatableFile };\nexport { FILE_VALIDATION_STATUS };\n\n/**\n * Format file size to human-readable string\n */\nexport function formatFileSize(bytes: number, decimals: number = 1): string {\n  if (bytes === 0) return '0 Bytes';\n  const k = 1024;\n  const sizes = ['Bytes', 'KB', 'MB', 'GB'];\n  const i = Math.floor(Math.log(bytes) / Math.log(k));\n  return `${parseFloat((bytes / k ** i).toFixed(decimals))} ${sizes[i]}`;\n}\n\n/**\n * Validate filename for deployment safety\n *\n * Blocks only characters that genuinely break the upload→serve round-trip:\n * - # ? %     URL round-trip breakers (fragment, query, encoding ambiguity)\n * - \\         Path separator confusion (buildFileKey splits on backslash)\n * - < > \"     XSS vectors with zero legitimate use in filenames\n * - \\x00-\\x1f \\x7f  Control characters (header injection, display corruption)\n *\n * Everything else is allowed — browser percent-encodes, Worker decodes, R2 matches.\n *\n * Additional checks: path traversal, reserved names, leading/trailing dots or spaces.\n */\nexport function validateFileName(filename: string): { valid: boolean; reason?: string } {\n  if (hasUnsafeChars(filename)) {\n    return { valid: false, reason: 'File name contains unsafe characters' };\n  }\n\n  if (filename.startsWith(' ') || filename.endsWith(' ')) {\n    return { valid: false, reason: 'File name cannot start/end with spaces' };\n  }\n\n  if (filename.endsWith('.')) {\n    return { valid: false, reason: 'File name cannot end with dots' };\n  }\n\n  const reservedNames = /^(CON|PRN|AUX|NUL|COM[1-9]|LPT[1-9])(\\.|$)/i;\n  const nameWithoutPath = filename.split('/').pop() || filename;\n  if (reservedNames.test(nameWithoutPath)) {\n    return { valid: false, reason: 'File name uses a reserved system name' };\n  }\n\n  if (filename.includes('..')) {\n    return { valid: false, reason: 'File name contains path traversal pattern' };\n  }\n\n  return { valid: true };\n}\n\n/**\n * Validate files against configuration limits with severity-based reporting\n *\n * Validation categorizes issues by severity:\n * - **Errors**: Block deployment (file too large, blocked extension, etc.)\n * - **Warnings**: Exclude files but allow deployment (empty files, etc.)\n *\n * @param files - Array of files to validate\n * @param config - Validation configuration from ship.getLimits()\n * @returns Validation result with errors and warnings\n *\n * @example\n * ```typescript\n * const config = await ship.getLimits();\n * const result = validateFiles(files, config);\n *\n * if (!result.canDeploy) {\n *   // Has errors - deployment blocked\n *   console.error('Deployment blocked:', result.errors);\n * } else if (result.warnings.length > 0) {\n *   // Has warnings - deployment proceeds, some files excluded\n *   console.warn('Files excluded:', result.warnings);\n *   await ship.deploy(result.validFiles);\n * } else {\n *   // All files valid\n *   await ship.deploy(result.validFiles);\n * }\n * ```\n */\nexport function validateFiles<T extends ValidatableFile>(\n  files: T[],\n  config: PlatformLimits,\n): FileValidationResult<T> {\n  const errors: ValidationIssue[] = [];\n  const warnings: ValidationIssue[] = [];\n  let fileStatuses: T[] = []; // Use 'let' for atomic enforcement later\n\n  // Check at least 1 file required\n  if (files.length === 0) {\n    const issue: ValidationIssue = {\n      file: '(no files)',\n      message: 'At least one file must be provided',\n    };\n    errors.push(issue);\n\n    return {\n      files: [],\n      validFiles: [],\n      errors,\n      warnings: [],\n      canDeploy: false,\n    };\n  }\n\n  // Check for unbuilt project markers (node_modules/, etc.)\n  for (const file of files) {\n    if (hasUnbuiltMarker(file.name)) {\n      errors.push({\n        file: file.name,\n        message: `Unbuilt project detected — deploy your build output (dist/, build/, out/), not the project folder`,\n      });\n      return {\n        files: files.map((f) => ({\n          ...f,\n          status: FILE_VALIDATION_STATUS.VALIDATION_FAILED,\n          statusMessage: 'Unbuilt project detected',\n        })),\n        validFiles: [],\n        errors,\n        warnings: [],\n        canDeploy: false,\n      };\n    }\n  }\n\n  // Check file count limit\n  if (files.length > config.maxFilesCount) {\n    const issue: ValidationIssue = {\n      file: `(${files.length} files)`,\n      message: `File count (${files.length}) exceeds limit of ${config.maxFilesCount}`,\n    };\n    errors.push(issue);\n\n    return {\n      files: files.map((f) => ({\n        ...f,\n        status: FILE_VALIDATION_STATUS.VALIDATION_FAILED,\n        statusMessage: issue.message,\n      })),\n      validFiles: [],\n      errors,\n      warnings: [],\n      canDeploy: false,\n    };\n  }\n\n  // Validate each file\n  let totalSize = 0;\n\n  for (const file of files) {\n    let fileStatus: FileValidationStatusType = FILE_VALIDATION_STATUS.READY;\n    let statusMessage = 'Ready for upload';\n\n    // Pre-compute filename validation\n    const nameValidation = file.name\n      ? validateFileName(file.name)\n      : { valid: false, reason: 'File name cannot be empty' };\n\n    // Check for processing errors\n    if (file.status === FILE_VALIDATION_STATUS.PROCESSING_ERROR) {\n      fileStatus = FILE_VALIDATION_STATUS.VALIDATION_FAILED;\n      statusMessage = file.statusMessage || 'File failed during processing';\n      errors.push({\n        file: file.name,\n        message: statusMessage,\n      });\n    }\n\n    // EMPTY FILE - Warning (not error)\n    else if (file.size === 0) {\n      fileStatus = FILE_VALIDATION_STATUS.EXCLUDED;\n      statusMessage = 'File is empty (0 bytes) and cannot be deployed due to storage limitations';\n      warnings.push({\n        file: file.name,\n        message: statusMessage,\n      });\n      // Skip other validations for excluded files\n      fileStatuses.push({\n        ...file,\n        status: fileStatus,\n        statusMessage,\n      });\n      continue;\n    }\n\n    // Negative file size - Error\n    else if (file.size < 0) {\n      fileStatus = FILE_VALIDATION_STATUS.VALIDATION_FAILED;\n      statusMessage = 'File size must be positive';\n      errors.push({\n        file: file.name,\n        message: statusMessage,\n      });\n    }\n\n    // File name validation\n    else if (!file.name || file.name.trim().length === 0) {\n      fileStatus = FILE_VALIDATION_STATUS.VALIDATION_FAILED;\n      statusMessage = 'File name cannot be empty';\n      errors.push({\n        file: file.name || '(empty)',\n        message: statusMessage,\n      });\n    } else if (file.name.includes('\\0')) {\n      fileStatus = FILE_VALIDATION_STATUS.VALIDATION_FAILED;\n      statusMessage = 'File name contains invalid characters (null byte)';\n      errors.push({\n        file: file.name,\n        message: statusMessage,\n      });\n    } else if (!nameValidation.valid) {\n      fileStatus = FILE_VALIDATION_STATUS.VALIDATION_FAILED;\n      statusMessage = nameValidation.reason || 'Invalid file name';\n      errors.push({\n        file: file.name,\n        message: statusMessage,\n      });\n    }\n\n    // Blocked extension check\n    else if (isBlockedExtension(file.name)) {\n      fileStatus = FILE_VALIDATION_STATUS.VALIDATION_FAILED;\n      statusMessage = `File extension not allowed: \"${file.name}\"`;\n      errors.push({\n        file: file.name,\n        message: statusMessage,\n      });\n    }\n\n    // File size validation\n    else if (file.size > config.maxFileSize) {\n      fileStatus = FILE_VALIDATION_STATUS.VALIDATION_FAILED;\n      statusMessage = `File size (${formatFileSize(file.size)}) exceeds limit of ${formatFileSize(config.maxFileSize)}`;\n      errors.push({\n        file: file.name,\n        message: statusMessage,\n      });\n    }\n\n    // Total size validation\n    else {\n      totalSize += file.size;\n      if (totalSize > config.maxTotalSize) {\n        fileStatus = FILE_VALIDATION_STATUS.VALIDATION_FAILED;\n        statusMessage = `Total size would exceed limit of ${formatFileSize(config.maxTotalSize)}`;\n        errors.push({\n          file: file.name,\n          message: statusMessage,\n        });\n      }\n    }\n\n    fileStatuses.push({\n      ...file,\n      status: fileStatus,\n      statusMessage,\n    });\n  }\n\n  // ATOMIC ENFORCEMENT: Two-phase validation for optimal UX + atomic semantics\n  // Phase 1 (above): Validate files individually to collect ALL errors\n  // Phase 2 (below): Mark all files as failed if any errors exist\n  //\n  // Why two phases? We validate individually for better UX (users see all problems\n  // at once and can fix everything in one pass), then enforce atomicity to maintain\n  // deployment transaction semantics (all-or-nothing).\n  if (errors.length > 0) {\n    fileStatuses = fileStatuses.map((file) => {\n      // Keep EXCLUDED files as-is (they're warnings, not errors)\n      if (file.status === FILE_VALIDATION_STATUS.EXCLUDED) {\n        return file;\n      }\n\n      // Mark ALL other files as VALIDATION_FAILED (atomic deployment)\n      return {\n        ...file,\n        status: FILE_VALIDATION_STATUS.VALIDATION_FAILED,\n        statusMessage:\n          file.status === FILE_VALIDATION_STATUS.VALIDATION_FAILED\n            ? file.statusMessage // Keep original error message for the file that actually failed\n            : 'Deployment failed due to validation errors in bundle',\n      };\n    });\n  }\n\n  // Build atomic result\n  // validFiles is empty if ANY errors exist (all-or-nothing)\n  const validFiles =\n    errors.length === 0\n      ? fileStatuses.filter((f) => f.status === FILE_VALIDATION_STATUS.READY)\n      : [];\n  const canDeploy = errors.length === 0;\n\n  return {\n    files: fileStatuses,\n    validFiles,\n    errors,\n    warnings,\n    canDeploy,\n  };\n}\n\n/**\n * Get only the valid files from validation results\n */\nexport function getValidFiles<T extends ValidatableFile>(files: T[]): T[] {\n  return files.filter((f) => f.status === FILE_VALIDATION_STATUS.READY);\n}\n\n/**\n * Check if all valid files have required properties for upload\n * (Can be extended to check for MD5, etc.)\n */\nexport function allValidFilesReady<T extends ValidatableFile>(files: T[]): boolean {\n  const validFiles = getValidFiles(files);\n  return validFiles.length > 0;\n}\n","/**\n * @file Utility for filtering out junk files and directories from file paths\n *\n * This module provides functionality to filter out common system junk files and directories\n * from a list of file paths. It uses the 'junk' package to identify junk filenames and\n * a custom list to filter out common junk directories.\n */\n\nimport { hasUnbuiltMarker, ShipError } from '@shipstatic/types';\nimport { isJunk } from 'junk';\n\n/**\n * List of directory names considered as junk\n *\n * Files within these directories (at any level in the path hierarchy) will be excluded.\n * The comparison is case-insensitive for cross-platform compatibility.\n *\n * @internal\n */\nexport const JUNK_DIRECTORIES = ['__MACOSX', '.Trashes', '.fseventsd', '.Spotlight-V100'] as const;\n\n/**\n * Filters an array of file paths, removing those considered junk\n *\n * Throws if any path contains an unbuilt project marker (e.g. `node_modules`, `package.json`).\n * This check runs first because the dot-file filter below would strip paths like\n * `node_modules/.pnpm/...`, destroying the evidence.\n *\n * A path is filtered out if any of these conditions are met:\n * 1. The basename is identified as junk by the 'junk' package (e.g., .DS_Store, Thumbs.db)\n * 2. Any path segment starts with a dot (e.g., .env, .git, .htaccess)\n *    Exception: `.well-known` is allowed (RFC 8615 — ACME, security.txt, app links)\n * 3. Any path segment exceeds 255 characters (filesystem limit)\n * 4. Any directory segment in the path matches an entry in JUNK_DIRECTORIES (case-insensitive)\n *\n * All path separators are normalized to forward slashes for consistent cross-platform behavior.\n *\n * Dot files are filtered for security — they typically contain sensitive configuration\n * (.env, .git) or are not meant to be served publicly. This matches server-side filtering.\n *\n * @param filePaths - An array of file path strings to filter\n * @param options - Optional settings\n * @param options.allowUnbuilt - When true, skip the unbuilt project marker check (for server-processed uploads)\n * @returns A new array containing only non-junk file paths\n * @throws {ShipError} If any path contains an unbuilt project marker (unless allowUnbuilt is true)\n *\n * @example\n * ```typescript\n * import { filterJunk } from '@shipstatic/ship';\n *\n * // Filter an array of file paths\n * const paths = ['index.html', '.DS_Store', '.gitattributes', '__MACOSX/file.txt', 'app.js'];\n * const clean = filterJunk(paths);\n * // Result: ['index.html', 'app.js']\n * ```\n *\n * @example\n * ```typescript\n * // Use with browser File objects\n * import { filterJunk } from '@shipstatic/ship';\n *\n * const files: File[] = [...]; // From input or drag-drop\n *\n * // Extract paths from File objects\n * const filePaths = files.map(f => f.webkitRelativePath || f.name);\n *\n * // Filter out junk paths\n * const validPaths = new Set(filterJunk(filePaths));\n *\n * // Filter the original File array\n * const validFiles = files.filter(f =>\n *   validPaths.has(f.webkitRelativePath || f.name)\n * );\n * ```\n */\nexport function filterJunk(filePaths: string[], options?: { allowUnbuilt?: boolean }): string[] {\n  if (!filePaths || filePaths.length === 0) {\n    return [];\n  }\n\n  // Reject unbuilt projects before the dot-file filter removes evidence.\n  // pnpm stores files under node_modules/.pnpm/ — the dot-file filter below\n  // strips .pnpm/ paths, destroying the only signal that this is an unbuilt project.\n  if (!options?.allowUnbuilt) {\n    const marker = filePaths.find((p) => p && hasUnbuiltMarker(p));\n    if (marker) {\n      throw ShipError.business(\n        'Unbuilt project detected — deploy your build output (dist/, build/, out/), not the project folder',\n      );\n    }\n  }\n\n  return filePaths.filter((filePath) => {\n    if (!filePath) {\n      return false; // Exclude null or undefined paths\n    }\n\n    // Normalize path separators to forward slashes and split into segments\n    const parts = filePath.replace(/\\\\/g, '/').split('/').filter(Boolean);\n    if (parts.length === 0) return true;\n\n    // Check if the basename is a junk file (using junk package)\n    const basename = parts[parts.length - 1];\n    if (isJunk(basename)) {\n      return false;\n    }\n\n    // Filter out dot files and directories (security: prevents .env, .git, etc.)\n    // .well-known is not junk — it's a standard directory (RFC 8615)\n    // Path position constraints enforced at upload (buildFileKey) and serving (isBlockedDotFile)\n    for (const part of parts) {\n      if (part === '.well-known') continue;\n      if (part.startsWith('.') || part.length > 255) {\n        return false;\n      }\n    }\n\n    // Check if any directory segment is in our junk directories list\n    const directorySegments = parts.slice(0, -1);\n    for (const segment of directorySegments) {\n      if (JUNK_DIRECTORIES.some((junkDir) => segment.toLowerCase() === junkDir.toLowerCase())) {\n        return false;\n      }\n    }\n\n    return true;\n  });\n}\n","/**\n * @file Shared security validation for the deploy pipeline.\n * Used by both Node.js and browser file processing pipelines.\n */\nimport { isBlockedExtension, ShipError } from '@shipstatic/types';\nimport { validateFileName } from './file-validation.js';\n\n/**\n * Validate a deploy path for security concerns.\n * Rejects paths containing path traversal patterns or null bytes.\n *\n * Checks for:\n * - Null bytes (\\0) — path injection\n * - /../ — directory traversal within path\n * - ../ at start — upward traversal\n * - /.. at end — trailing traversal\n *\n * Does NOT reject double dots in filenames (e.g., \"foo..bar.txt\" is safe).\n *\n * @param deployPath - The deployment path to validate\n * @param sourceIdentifier - Human-readable identifier for error messages\n * @throws {ShipError} If the path contains unsafe patterns\n */\nexport function validateDeployPath(deployPath: string, sourceIdentifier: string): void {\n  if (\n    deployPath.includes('\\0') ||\n    deployPath.includes('/../') ||\n    deployPath.startsWith('../') ||\n    deployPath.endsWith('/..')\n  ) {\n    throw ShipError.business(\n      `Security error: Unsafe file path \"${deployPath}\" for file: ${sourceIdentifier}`,\n    );\n  }\n}\n\n/**\n * Validate a deploy file's name and extension.\n * Rejects unsafe filenames (shell/URL-dangerous chars, reserved names)\n * and blocked file extensions (.exe, .msi, .dll, etc.).\n *\n * @param deployPath - The deployment path to validate\n * @param sourceIdentifier - Human-readable identifier for error messages\n * @throws {ShipError} If the filename is unsafe or extension is blocked\n */\nexport function validateDeployFile(deployPath: string, sourceIdentifier: string): void {\n  const nameCheck = validateFileName(deployPath);\n  if (!nameCheck.valid) {\n    throw ShipError.business(nameCheck.reason || 'Invalid file name');\n  }\n\n  if (isBlockedExtension(deployPath)) {\n    throw ShipError.business(`File extension not allowed: \"${sourceIdentifier}\"`);\n  }\n}\n","/**\n * @file Node.js-specific file utilities for the Ship SDK.\n * Provides helpers for recursively discovering, filtering, and preparing files for deploy in Node.js.\n */\n\nimport * as fs from 'node:fs';\nimport * as path from 'node:path';\nimport type { PlatformLimits } from '@shipstatic/types';\nimport { isShipError, ShipError, UNBUILT_PROJECT_MARKERS } from '@shipstatic/types';\nimport { optimizeDeployPaths } from '../../shared/lib/deploy-paths.js';\nimport { getENV } from '../../shared/lib/env.js';\nimport { filterJunk } from '../../shared/lib/junk.js';\nimport { calculateMD5 } from '../../shared/lib/md5.js';\nimport { findCommonParent } from '../../shared/lib/path.js';\nimport { validateDeployFile, validateDeployPath } from '../../shared/lib/security.js';\nimport type { DeploymentOptions, StaticFile } from '../../shared/types.js';\n\n/**\n * Recursive function to walk directory and return all file paths.\n * Includes symlink loop protection to prevent infinite recursion.\n * @param dirPath - Directory path to traverse\n * @param visited - Set of already visited real paths (for cycle detection)\n * @returns Array of absolute file paths in the directory\n */\nfunction findAllFilePaths(dirPath: string, visited: Set<string> = new Set()): string[] {\n  const results: string[] = [];\n\n  // Resolve the real path to detect symlink cycles\n  const realPath = fs.realpathSync(dirPath);\n  if (visited.has(realPath)) {\n    // Already visited this directory (symlink cycle) - skip to prevent infinite loop\n    return results;\n  }\n  visited.add(realPath);\n\n  const entries = fs.readdirSync(dirPath);\n\n  for (const entry of entries) {\n    const fullPath = path.join(dirPath, entry);\n    const stats = fs.statSync(fullPath);\n\n    if (stats.isDirectory()) {\n      const subFiles = findAllFilePaths(fullPath, visited);\n      results.push(...subFiles);\n    } else if (stats.isFile()) {\n      results.push(fullPath);\n    }\n  }\n\n  return results;\n}\n\n/**\n * Processes Node.js file and directory paths into an array of StaticFile objects ready for deploy.\n * Computes content paths relative to the upload root before filtering, so only the deployed\n * directory structure is evaluated — not the user's filesystem above it.\n *\n * @param paths - File or directory paths to scan and process.\n * @param options - Processing options (pathDetect, etc.).\n * @param platformLimits - Per-instance platform limits (file-size / count /\n *   total-size caps) from the originating Ship's `GET /limits` fetch. Passed\n *   in rather than read from a module global so concurrent Ships against\n *   different API URLs cannot clobber each other's caps.\n * @returns Promise resolving to an array of StaticFile objects.\n * @throws {ShipClientError} If called outside Node.js or if fs/path modules fail.\n */\nexport async function processFilesForNode(\n  paths: string[],\n  options: DeploymentOptions = {},\n  platformLimits?: PlatformLimits,\n): Promise<StaticFile[]> {\n  if (getENV() !== 'node') {\n    throw ShipError.business('processFilesForNode can only be called in Node.js environment.');\n  }\n\n  // Check input directories for unbuilt project markers before recursive walk\n  for (const p of paths) {\n    const absPath = path.resolve(p);\n    try {\n      if (fs.statSync(absPath).isDirectory()) {\n        const marker = fs.readdirSync(absPath).find((e) => UNBUILT_PROJECT_MARKERS.has(e));\n        if (marker) {\n          throw ShipError.business(\n            `\"${marker}\" detected — deploy your build output (dist/, build/, out/), not the project folder`,\n          );\n        }\n      }\n    } catch (e) {\n      if (isShipError(e)) throw e;\n      // Path errors handled in the existing flatMap below\n    }\n  }\n\n  // 1. Discover all unique, absolute file paths from the input list\n  const absolutePaths = paths.flatMap((p) => {\n    const absPath = path.resolve(p);\n    try {\n      const stats = fs.statSync(absPath);\n      return stats.isDirectory() ? findAllFilePaths(absPath) : [absPath];\n    } catch (_error) {\n      throw ShipError.file(`Path does not exist: ${p}`, { filePath: p });\n    }\n  });\n  const uniquePaths = [...new Set(absolutePaths)];\n\n  // 2. Determine base path for content paths (from INPUT paths, not discovered files)\n  const inputAbsolutePaths = paths.map((p) => path.resolve(p));\n  const inputBasePath = findCommonParent(\n    inputAbsolutePaths.map((p) => {\n      try {\n        const stats = fs.statSync(p);\n        return stats.isDirectory() ? p : path.dirname(p);\n      } catch {\n        return path.dirname(p);\n      }\n    }),\n  );\n\n  // 3. Compute content paths (relative to upload root)\n  const contentPaths = uniquePaths.map((absPath) => {\n    if (inputBasePath && inputBasePath.length > 0) {\n      const rel = path.relative(inputBasePath, absPath);\n      if (rel && typeof rel === 'string' && !rel.startsWith('..')) {\n        return rel.replace(/\\\\/g, '/');\n      }\n    }\n    return path.basename(absPath);\n  });\n\n  // 4. Optimize paths for deployment (strip common root, flatten)\n  const deployFiles = optimizeDeployPaths(contentPaths, {\n    flatten: options.pathDetect !== false,\n  });\n  const deployPaths = deployFiles.map((f) => f.path);\n\n  // 5. Filter junk from deploy paths\n  const filteredSet = new Set(filterJunk(deployPaths));\n  if (filteredSet.size === 0) {\n    return [];\n  }\n\n  // 6. Collect valid file pairs (absolute path for reading, deploy path for output)\n  const validAbsPaths: string[] = [];\n  const validDeployPaths: string[] = [];\n  for (let i = 0; i < uniquePaths.length; i++) {\n    if (filteredSet.has(deployPaths[i])) {\n      validAbsPaths.push(uniquePaths[i]);\n      validDeployPaths.push(deployPaths[i]);\n    }\n  }\n\n  // 7. Process files into StaticFile objects\n  const results: StaticFile[] = [];\n  let totalSize = 0;\n  if (!platformLimits) {\n    throw ShipError.config(\n      'Platform limits not provided. processFilesForNode requires the limits ' +\n        'argument — pass `ship.getLimits()` result.',\n    );\n  }\n\n  for (let i = 0; i < validAbsPaths.length; i++) {\n    const filePath = validAbsPaths[i];\n    const deployPath = validDeployPaths[i];\n\n    try {\n      // Security validation (shared with browser) — fail fast before any I/O\n      validateDeployPath(deployPath, filePath);\n\n      const stats = fs.statSync(filePath);\n\n      // Skip empty files — R2 cannot store zero-byte objects\n      if (stats.size === 0) {\n        continue;\n      }\n\n      // Filename and extension validation (shared with browser)\n      validateDeployFile(deployPath, filePath);\n\n      // Validate file sizes\n      if (stats.size > platformLimits.maxFileSize) {\n        throw ShipError.business(\n          `File ${filePath} is too large. Maximum allowed size is ${platformLimits.maxFileSize / (1024 * 1024)}MB.`,\n        );\n      }\n      totalSize += stats.size;\n      if (totalSize > platformLimits.maxTotalSize) {\n        throw ShipError.business(\n          `Total deploy size is too large. Maximum allowed is ${platformLimits.maxTotalSize / (1024 * 1024)}MB.`,\n        );\n      }\n\n      const content = fs.readFileSync(filePath);\n      const { md5 } = await calculateMD5(content);\n\n      results.push({\n        path: deployPath,\n        content,\n        size: content.length,\n        md5,\n      });\n    } catch (error) {\n      // Re-throw ShipError instances directly\n      if (isShipError(error)) {\n        throw error;\n      }\n      // Convert file system errors to ShipError with clear message\n      const errorMessage = error instanceof Error ? error.message : String(error);\n      throw ShipError.file(`Failed to read file \"${filePath}\": ${errorMessage}`, { filePath });\n    }\n  }\n\n  // Final validation\n  if (results.length > platformLimits.maxFilesCount) {\n    throw ShipError.business(\n      `Too many files to deploy. Maximum allowed is ${platformLimits.maxFilesCount} files.`,\n    );\n  }\n\n  return results;\n}\n","/**\n * @file Main entry point for the Ship SDK.\n *\n * This is the Node.js entry: file-system deploy input plus the `SHIP_*`\n * env-var fallback. Browser consumers resolve this same package to the\n * browser build through the `browser` condition in the exports map —\n * bundlers select it automatically; there is no separate import path.\n */\n\n// Re-export everything from the Node.js index, including both named and default exports\nexport * from './node/index.js';\nexport { default } from './node/index.js';\n","/**\n * @file Ship SDK for Node.js environments.\n *\n * The Node-side `Ship` adds two things on top of the base class:\n *   1. Environment detection — refuses to construct outside Node.\n *   2. `SHIP_TOKEN` / `SHIP_API_URL` env-var resolution as the universal\n *      \"process boundary\" credential source — the industry's one-token\n *      convention. Constructor arguments win over env vars.\n *\n * The SDK does NOT read `~/.shiprc` or `package.json` `\"ship\"` keys — that's\n * the CLI's job (see `cli/shiprc.ts`). Keeping file resolution out of the SDK\n * is what lets embedded consumers (MCP, n8n, GitHub Action) safely write\n * `new Ship({})` for anonymous public deployments without inheriting the host\n * developer's personal credentials.\n */\n\nimport { ShipError } from '@shipstatic/types';\nimport { Ship as BaseShip } from '../shared/base-ship.js';\nimport { getENV } from '../shared/lib/env.js';\nimport type {\n  DeployBodyCreator,\n  DeployInput,\n  DeploymentCreateResponse,\n  DeploymentOptions,\n  ShipClientOptions,\n  StaticFile,\n} from '../shared/types.js';\nimport { readEnvConfig } from './core/config.js';\nimport { createDeployBody } from './core/deploy-body.js';\n\n// Export all shared functionality\nexport * from '../shared/index.js';\n\n/**\n * Ship SDK Client for Node.js environments.\n *\n * @example\n * ```typescript\n * // Authenticated — explicit token (API key, deploy token, or OAuth bearer)\n * const ship = new Ship({ token: 'ship-xxxx' });\n *\n * // Authenticated — picks up SHIP_TOKEN from env\n * const ship = new Ship({});\n *\n * // Anonymous public deploy — works when neither constructor nor env provides a token\n * const ship = new Ship({});\n * await ship.deploy('./dist');\n * ```\n */\nexport class Ship extends BaseShip {\n  constructor(options: ShipClientOptions = {}) {\n    if (getENV() !== 'node') {\n      throw ShipError.business('Node.js Ship class can only be used in Node.js environment.');\n    }\n\n    // Layer env vars under constructor options. The merged result is what the\n    // base class sees, so the credential and the HTTP client are fully formed\n    // by the time the constructor returns — no async config phase needed.\n    //\n    // Truthiness (not `??`) is deliberate: an empty-string token is absence\n    // (shell expansion of unset CI variables), so `token: ''` falls through\n    // to `SHIP_TOKEN` instead of locking in a phantom credential. A client\n    // constructed with `session: true` has chosen its identity — the ambient\n    // token does not ride along.\n    const env = readEnvConfig();\n    super({\n      ...options,\n      apiUrl: options.apiUrl || env.apiUrl,\n      token: options.token || (options.session ? undefined : env.token),\n    });\n  }\n\n  /**\n   * Deploy file or directory paths to ShipStatic. Convenience shortcut for\n   * `ship.deployments.upload()`.\n   *\n   * Wrong-platform inputs (e.g. `File[]`) fail at compile time. For\n   * platform-neutral code, use `ship.deployments.upload()`, which accepts\n   * the wider `DeployInput` and validates at runtime — that asymmetry is\n   * intentional: the convenience shortcut narrows; the resource-layer\n   * contract stays platform-neutral.\n   */\n  async deploy(\n    input: string | string[],\n    options?: DeploymentOptions,\n  ): Promise<DeploymentCreateResponse> {\n    return super.deploy(input, options);\n  }\n\n  protected async processInput(\n    input: DeployInput,\n    options: DeploymentOptions,\n  ): Promise<StaticFile[]> {\n    // Normalize string to string[] and validate.\n    const paths = typeof input === 'string' ? [input] : input;\n\n    if (!Array.isArray(paths) || !paths.every((p) => typeof p === 'string')) {\n      throw ShipError.business(\n        'Invalid input type for Node.js environment. Expected string or string[].',\n      );\n    }\n\n    if (paths.length === 0) {\n      throw ShipError.business('No files to deploy.');\n    }\n\n    const { processFilesForNode } = await import('./core/node-files.js');\n    return processFilesForNode(paths, options, this.platformLimits ?? undefined);\n  }\n\n  protected getDeployBodyCreator(): DeployBodyCreator {\n    return createDeployBody;\n  }\n}\n\n// Default export (for `import Ship from '@shipstatic/ship'`)\nexport default Ship;\n\n// Node-only utilities (path-walking + MD5 over the local filesystem)\nexport { processFilesForNode } from './core/node-files.js';\n","/**\n * @file Base Ship SDK class — shared functionality across environments.\n *\n * The constructor is fully synchronous: an `ApiHttp` instance is built immediately\n * with whatever credentials the caller supplied (and, in Node, env vars merged in\n * by the subclass before `super()`). The only deferred work is the one-shot\n * `GET /limits` fetch that hydrates platform limits — that's lazy and runs on\n * first API call via `ensureInitialized()`.\n *\n * Subclasses only override what genuinely differs per environment:\n *   - `processInput()` — Node reads paths from disk; Browser handles `File[]`\n *   - `getDeployBodyCreator()` — Node streams Buffers; Browser builds Blobs\n *\n * Everything else (the credential slot, resources, events, lazy platform-limits)\n * lives here.\n */\n\nimport type {\n  AccountResource,\n  DeploymentCreateResponse,\n  DeploymentResource,\n  DomainResource,\n  PingResponse,\n  PlatformLimits,\n  StaticFile,\n  TokenResource,\n} from '@shipstatic/types';\nimport { ShipError, validateCaller, validateToken } from '@shipstatic/types';\n\nimport { ApiHttp } from './api/http.js';\nimport {\n  createAccountResource,\n  createDeploymentResource,\n  createDomainResource,\n  createTokenResource,\n  type DeployInput,\n} from './resources.js';\nimport type {\n  DeployBodyCreator,\n  DeploymentOptions,\n  ShipClientOptions,\n  ShipEvents,\n  TokenProvider,\n} from './types.js';\n\n/**\n * Abstract base class for Ship SDK implementations.\n */\nexport abstract class Ship {\n  // Resource handles, created once at construction. Each is a thin facade\n  // bound to `this.http` plus the lazy-init callback.\n  // Parameterized with the SDK's extended options (timeout, callbacks,\n  // signal…) — the interface's documented extension point, so typed\n  // consumers can pass them without casts.\n  public readonly deployments: DeploymentResource<DeploymentOptions>;\n  public readonly domains: DomainResource;\n  public readonly account: AccountResource;\n  public readonly tokens: TokenResource;\n\n  // The HTTP client and merged options are private — subclasses interact\n  // with the base class through the abstract methods below, never by\n  // reaching into these fields. Tests bypass via `(ship as any).http = ...`.\n  private readonly http: ApiHttp;\n  private readonly clientOptions: ShipClientOptions;\n\n  // Lazy-init plumbing for the one-shot `GET /limits` fetch.\n  // `platformLimits` is INSTANCE state (not a module-level singleton): two\n  // Ships against different `apiUrl`s — staging + prod, multi-tenant\n  // orchestrators, n8n with multiple credentials — must not clobber each\n  // other's limits. Each instance owns its hydrated copy.\n  // `protected` so subclasses' `processInput` can pass it down to the\n  // platform-specific file-validation utilities.\n  private initPromise: Promise<void> | null = null;\n  protected platformLimits: PlatformLimits | null = null;\n\n  // The credential slot — one platform token (any population) or a provider\n  // that supplies one per request. Read dynamically on every request through\n  // `getAuthHeaders`, so `setToken` takes effect without rebuilding the client.\n  private credential: string | TokenProvider | null = null;\n\n  constructor(options: ShipClientOptions = {}) {\n    // SDK-boundary normalization: an empty-string token is absence of\n    // credential intent, never a credential. Empty strings reach here from\n    // shell-expansion of unset CI variables, empty form fields in browser\n    // apps, and any other path that produces `''` instead of `undefined`.\n    // Normalizing once at the SDK boundary covers every entry point: CLI,\n    // Browser SDK, Node SDK, embedded consumers, and direct base-class use.\n    options = {\n      ...options,\n      apiUrl: options.apiUrl || undefined,\n      token: options.token || undefined,\n      caller: options.caller || undefined,\n    };\n    this.clientOptions = options;\n\n    // Caller identity is validated at the boundary like the token: a value\n    // the API would silently drop (the header is unauthenticated) is a\n    // configuration error here, never a quiet fallback to IP bucketing.\n    if (options.caller !== undefined) {\n      validateCaller(options.caller);\n    }\n\n    // One client, one identity. A token and a cookie session are different\n    // principals — holding both is a configuration error, not a precedence\n    // question.\n    if (options.token && options.session) {\n      throw ShipError.config('Provide either `token` or `session`, not both.');\n    }\n\n    // Static tokens are validated at the boundary (prefix-classified, same\n    // rules the server applies); providers are invoked per request instead.\n    if (typeof options.token === 'string') {\n      validateToken(options.token);\n      this.credential = options.token;\n    } else if (options.token) {\n      this.credential = options.token;\n    }\n\n    // Build the HTTP client once. The `getAuthHeaders` callback reads\n    // `this.credential` dynamically on every request.\n    this.http = new ApiHttp({\n      ...options,\n      getAuthHeaders: () => this.getAuthHeaders(),\n      createDeployBody: this.getDeployBodyCreator(),\n    });\n\n    const ctx = {\n      getApi: () => this.http,\n      ensureInit: () => this.ensureInitialized(),\n    };\n\n    this.deployments = createDeploymentResource({\n      ...ctx,\n      processInput: (input, opts) => this.processInput(input, opts),\n    });\n    this.domains = createDomainResource(ctx);\n    this.account = createAccountResource(ctx);\n    this.tokens = createTokenResource(ctx);\n  }\n\n  // Environment-specific behavior.\n  protected abstract processInput(\n    input: DeployInput,\n    options: DeploymentOptions,\n  ): Promise<StaticFile[]>;\n  protected abstract getDeployBodyCreator(): DeployBodyCreator;\n\n  /**\n   * Lazy initialization — fetches platform limits (file size / count caps) once,\n   * on the first API call. Subsequent calls reuse the resolved promise.\n   */\n  protected async ensureInitialized(): Promise<void> {\n    if (!this.initPromise) {\n      this.initPromise = this.fetchPlatformLimits();\n    }\n    return this.initPromise;\n  }\n\n  private async fetchPlatformLimits(): Promise<void> {\n    try {\n      this.platformLimits = await this.http.getLimits();\n    } catch (error) {\n      // Reset so the next API call can retry initialization.\n      this.initPromise = null;\n      throw error;\n    }\n  }\n\n  /**\n   * Ping the API server, resolving its answer: `{ success, timestamp }`, where\n   * `timestamp` is the server clock in unix SECONDS.\n   *\n   * It resolves the response rather than a bare `true` because every other\n   * method here does — narrowing to a boolean discarded the one thing ping\n   * carries beyond liveness, and made `success` mean a boolean on the wire and\n   * something else by the time it reached a caller. A non-OK response throws in\n   * transport, so a resolved value always means the API answered.\n   */\n  async ping(): Promise<PingResponse> {\n    await this.ensureInitialized();\n    return this.http.ping();\n  }\n\n  /**\n   * Deploy project (convenience shortcut to `ship.deployments.upload()`).\n   */\n  async deploy(input: DeployInput, options?: DeploymentOptions): Promise<DeploymentCreateResponse> {\n    return this.deployments.upload(input, options);\n  }\n\n  /**\n   * Get current account information (convenience shortcut to `ship.account.get()`).\n   */\n  async whoami() {\n    return this.account.get();\n  }\n\n  /**\n   * Get platform limits (max file size, file count, total size).\n   * Reuses the response fetched during initialization. Per-instance state —\n   * does not leak between concurrent Ships against different API URLs.\n   */\n  async getLimits(): Promise<PlatformLimits> {\n    if (this.platformLimits) return this.platformLimits;\n    await this.ensureInitialized();\n    // biome-ignore lint/style/noNonNullAssertion: ensureInitialized() hydrates platformLimits or throws\n    return this.platformLimits!;\n  }\n\n  on<K extends keyof ShipEvents>(event: K, handler: (...args: ShipEvents[K]) => void): void {\n    this.http.on(event, handler);\n  }\n\n  off<K extends keyof ShipEvents>(event: K, handler: (...args: ShipEvents[K]) => void): void {\n    this.http.off(event, handler);\n  }\n\n  /**\n   * Set global headers included in every request.\n   * Useful for injecting custom headers (e.g. for admin impersonation).\n   */\n  setHeaders(headers: Record<string, string>): void {\n    this.http.setGlobalHeaders(headers);\n  }\n\n  /**\n   * Clear all custom global headers.\n   */\n  clearHeaders(): void {\n    this.http.setGlobalHeaders({});\n  }\n\n  /**\n   * Sets the client token — any platform token (API key, deploy token, OAuth\n   * access token) or a {@link TokenProvider} invoked per request. Replaces\n   * whatever credential the client held before.\n   * @param token A platform token, sent verbatim, or a provider function\n   */\n  public setToken(token: string | TokenProvider): void {\n    // One client, one identity — the constructor's token/session exclusion\n    // holds for the client's whole life, not just its first moment.\n    if (this.clientOptions.session) {\n      throw ShipError.config('Provide either `token` or `session`, not both.');\n    }\n    if (typeof token === 'string') {\n      if (!token) {\n        throw ShipError.business('Invalid token provided. Token must be a non-empty string.');\n      }\n      validateToken(token);\n      this.credential = token;\n      return;\n    }\n    if (typeof token !== 'function') {\n      throw ShipError.business(\n        'Invalid token provided. Token must be a non-empty string or a provider function.',\n      );\n    }\n    this.credential = token;\n  }\n\n  /**\n   * Resolve the credential slot into request headers. Async because a\n   * provider may mint or refresh its token per request.\n   *\n   * Anonymity requires proven absence of credentials: a configured provider\n   * that yields nothing is an error — the request fails typed rather than\n   * silently proceeding as an anonymous public deploy. Empty-string\n   * normalization at the constructor is the same invariant's boundary\n   * condition: `''` is absence of intent, so it never reaches this point.\n   */\n  private async getAuthHeaders(): Promise<Record<string, string>> {\n    if (this.credential === null) return {};\n    const value = typeof this.credential === 'function' ? await this.credential() : this.credential;\n    if (!value) {\n      throw ShipError.authentication('Token provider returned no token.');\n    }\n    if (typeof value !== 'string') {\n      throw ShipError.authentication('Token provider returned a non-string value.');\n    }\n    return { Authorization: `Bearer ${value}` };\n  }\n}\n","/**\n * @file HTTP client for Ship API.\n */\nimport type {\n  AccountGetResponse,\n  Deployment,\n  DeploymentCreateResponse,\n  DeploymentDeleteResponse,\n  DeploymentListResponse,\n  Domain,\n  DomainDeleteResponse,\n  DomainDnsResponse,\n  DomainListResponse,\n  DomainRecordsResponse,\n  DomainShareResponse,\n  DomainValidateResponse,\n  DomainVerifyResponse,\n  ListOptions,\n  PingResponse,\n  PlatformLimits,\n  SPACheckRequest,\n  SPACheckResponse,\n  StaticFile,\n  Token,\n  TokenCreateResponse,\n  TokenDeleteResponse,\n  TokenListResponse,\n} from '@shipstatic/types';\nimport { API_PATHS, DEFAULT_API, ShipError, validateIdempotencyKey } from '@shipstatic/types';\nimport { SimpleEvents } from '../events.js';\nimport { validateDeployConfig, validateLabels, validatePassword } from '../lib/validation.js';\nimport type {\n  ApiDeployOptions,\n  DeployBodyCreator,\n  DomainSetResult,\n  Fetch,\n  ShipClientOptions,\n} from '../types.js';\n\n// =============================================================================\n// CONSTANTS\n// =============================================================================\n\nconst DEFAULT_REQUEST_TIMEOUT = 30_000;\n\n/**\n * Deploys get their own ceilings, because one budget cannot fit every\n * operation this client performs.\n *\n * 30s is right for a metadata read — `/ping`, `/account`, a page of a list —\n * where anything slower is a fault rather than a big payload. A deploy is\n * bounded by the PLATFORM's limits instead: `DEPLOYMENT.MAX_TOTAL_SIZE` is\n * 50MB, and 50MB in 30s needs ~13 Mbit/s of sustained UPLOAD, above what most\n * residential links give. A deployment the API explicitly permits was being\n * aborted here by default — which is the exact failure `Idempotency-Key`\n * exists to repair, so the cause had to go and not merely the remedy.\n *\n * 5 minutes covers 50MB at ~1.4 Mbit/s.\n */\nconst DEFAULT_DEPLOY_TIMEOUT = 300_000;\n\n/**\n * The server's own budget for a build, mirrored here because the client has\n * to outlast it: the API gives the build service\n * `PERFORMANCE.BUILD_SERVICE_TIMEOUT` (`cloudflare/api/src/lib/config.ts`),\n * and that work begins only after the upload lands.\n *\n * **Raising it there must raise it here.** The two sit in different repos, so\n * nothing can fence the pair; the constraint is stated at both ends instead.\n */\nconst BUILD_SERVICE_BUDGET = 300_000;\n\n/**\n * A deploy that also builds: the upload, then the build, then the commit.\n *\n * Written as a sum rather than a number, so the name and the value compose\n * the same way — `DEPLOY` plus `BUILD` on one side, the deploy budget plus\n * the build budget on the other. A magic `600_000` would state the result\n * and hide the reasoning, and the reasoning is the part that has to survive\n * someone tuning either half.\n */\nconst DEFAULT_DEPLOY_BUILD_TIMEOUT = DEFAULT_DEPLOY_TIMEOUT + BUILD_SERVICE_BUDGET;\n\n/**\n * This client's identity in a deployment's `via` field.\n *\n * Every surface that deploys names itself: the CLI sends `cli`, the GitHub\n * Action `git`, the MCP server `mcp`, the VS Code extension `vsc`, the web\n * apps `web`. A direct SDK call is `sdk`. Each surface owns its own string —\n * there is deliberately no central registry, since integrations outside this\n * repo mint their own.\n *\n * Applied at this one wire boundary, so `via` is populated on every deploy\n * from every platform: an absent value means an unattributed caller (raw\n * HTTP), never \"probably the SDK\".\n */\nconst DEPLOY_VIA = 'sdk';\n\n/**\n * Serialize pagination options into a query string, or '' when there are\n * none — the paginated list endpoints accept `limit` and `cursor`.\n */\nfunction listQuery(options?: ListOptions): string {\n  const params = new URLSearchParams();\n  if (options?.limit !== undefined) params.set('limit', String(options.limit));\n  if (options?.cursor !== undefined) params.set('cursor', options.cursor);\n  const query = params.toString();\n  return query ? `?${query}` : '';\n}\n\n// =============================================================================\n// TYPES\n// =============================================================================\n\nexport interface ApiHttpOptions extends ShipClientOptions {\n  /** Resolves the credential slot per request — async so token providers can mint/refresh. */\n  getAuthHeaders: () => Record<string, string> | Promise<Record<string, string>>;\n  createDeployBody: DeployBodyCreator;\n}\n\ninterface RequestResult<T> {\n  data: T;\n  status: number;\n}\n\n// =============================================================================\n// HTTP CLIENT\n// =============================================================================\n\nexport class ApiHttp extends SimpleEvents {\n  private readonly apiUrl: string;\n  private readonly getAuthHeadersCallback: () =>\n    | Record<string, string>\n    | Promise<Record<string, string>>;\n  private readonly session: boolean;\n  private readonly caller: string | undefined;\n  private readonly timeout: number;\n  private readonly deployTimeout: number;\n  private readonly deployBuildTimeout: number;\n  private readonly fetch: Fetch;\n  private readonly createDeployBody: DeployBodyCreator;\n  private readonly deployEndpoint: string;\n  private globalHeaders: Record<string, string> = {};\n\n  constructor(options: ApiHttpOptions) {\n    super();\n    this.apiUrl = options.apiUrl || DEFAULT_API;\n    this.getAuthHeadersCallback = options.getAuthHeaders;\n    this.session = options.session ?? false;\n    this.caller = options.caller;\n    this.timeout = options.timeout ?? DEFAULT_REQUEST_TIMEOUT;\n    // An explicit timeout is the caller's whole answer and applies to deploys\n    // too — they asked for a ceiling, not for one with an exception. Only the\n    // DEFAULT splits by operation.\n    this.deployTimeout = options.timeout ?? DEFAULT_DEPLOY_TIMEOUT;\n    this.deployBuildTimeout = options.timeout ?? DEFAULT_DEPLOY_BUILD_TIMEOUT;\n    // Bind to globalThis when falling back to the platform `fetch` — browsers\n    // require `this === window` on `window.fetch` and throw \"Illegal invocation\"\n    // when it's invoked as a property of any other object.\n    this.fetch = options.fetch ?? globalThis.fetch.bind(globalThis);\n    this.createDeployBody = options.createDeployBody;\n    this.deployEndpoint = options.deployEndpoint || API_PATHS.DEPLOYMENTS;\n  }\n\n  /**\n   * Set global headers included in every request.\n   * Priority: globalHeaders (lowest) < instance auth < per-request headers (highest)\n   */\n  setGlobalHeaders(headers: Record<string, string>): void {\n    this.globalHeaders = headers;\n  }\n\n  // ===========================================================================\n  // CORE REQUEST INFRASTRUCTURE\n  // ===========================================================================\n\n  /**\n   * Execute HTTP request with timeout, events, and error handling\n   */\n  private async executeRequest<T>(\n    url: string,\n    options: RequestInit,\n    operationName: string,\n    timeoutMs: number = this.timeout,\n  ): Promise<RequestResult<T>> {\n    let cleanup = () => {};\n\n    try {\n      // Credential resolution runs inside the error boundary: a token\n      // provider that throws or yields nothing fails the request through\n      // the same typed path (and `error` event) as any transport failure.\n      const headers = await this.mergeHeaders(options.headers as Record<string, string>);\n      const timeout = this.createTimeoutSignal(options.signal, timeoutMs);\n      cleanup = timeout.cleanup;\n\n      const fetchOptions: RequestInit = {\n        ...options,\n        headers,\n        credentials: this.session && !headers.Authorization ? 'include' : undefined,\n        signal: timeout.signal,\n      };\n\n      this.emit('request', url, fetchOptions);\n\n      const response = await this.fetch(url, fetchOptions);\n      cleanup();\n\n      if (!response.ok) {\n        throw await ShipError.fromHttpResponse(response, operationName);\n      }\n\n      this.emit('response', this.safeClone(response), url);\n      const data = await this.parseResponse<T>(this.safeClone(response));\n      return { data, status: response.status };\n    } catch (error) {\n      cleanup();\n      // Normalize anything thrown above (credential resolution, fetch\n      // failure, abort, response error) into a ShipError.\n      // fromFetchError passes existing ShipErrors through unchanged.\n      const shipError = ShipError.fromFetchError(error, operationName);\n      this.emit('error', shipError, url);\n      throw shipError;\n    }\n  }\n\n  /**\n   * Simple request - returns data only\n   */\n  private async request<T>(\n    url: string,\n    options: RequestInit,\n    operationName: string,\n    timeoutMs?: number,\n  ): Promise<T> {\n    const { data } = await this.executeRequest<T>(url, options, operationName, timeoutMs);\n    return data;\n  }\n\n  /**\n   * Request with status - returns data and HTTP status code\n   */\n  private async requestWithStatus<T>(\n    url: string,\n    options: RequestInit,\n    operationName: string,\n  ): Promise<RequestResult<T>> {\n    return this.executeRequest<T>(url, options, operationName);\n  }\n\n  // ===========================================================================\n  // REQUEST HELPERS\n  // ===========================================================================\n\n  private async mergeHeaders(\n    customHeaders: Record<string, string> = {},\n  ): Promise<Record<string, string>> {\n    // `caller` is instance identity metadata, like the credential: the\n    // rate limiter buckets by X-Caller on every write, so it rides every\n    // request rather than any single operation.\n    return {\n      ...this.globalHeaders,\n      ...(this.caller ? { 'X-Caller': this.caller } : {}),\n      ...(await this.getAuthHeadersCallback()),\n      ...customHeaders,\n    };\n  }\n\n  private createTimeoutSignal(\n    existingSignal?: AbortSignal | null,\n    timeoutMs: number = this.timeout,\n  ): {\n    signal: AbortSignal;\n    cleanup: () => void;\n  } {\n    const controller = new AbortController();\n    const timeoutId = setTimeout(() => controller.abort(), timeoutMs);\n\n    if (existingSignal) {\n      const abort = () => controller.abort();\n      existingSignal.addEventListener('abort', abort);\n      if (existingSignal.aborted) controller.abort();\n    }\n\n    return {\n      signal: controller.signal,\n      cleanup: () => clearTimeout(timeoutId),\n    };\n  }\n\n  private safeClone(response: Response): Response {\n    try {\n      return response.clone();\n    } catch {\n      return response;\n    }\n  }\n\n  private async parseResponse<T>(response: Response): Promise<T> {\n    if (response.headers.get('Content-Length') === '0' || response.status === 204) {\n      return undefined as T;\n    }\n    return response.json() as Promise<T>;\n  }\n\n  // ===========================================================================\n  // PUBLIC API - DEPLOYMENTS\n  // ===========================================================================\n\n  async deploy(\n    files: StaticFile[],\n    options: ApiDeployOptions = {},\n  ): Promise<DeploymentCreateResponse> {\n    if (!files.length) {\n      throw ShipError.business('No files to deploy');\n    }\n    for (const file of files) {\n      if (!file.md5) {\n        throw ShipError.file(`MD5 checksum missing for file: ${file.path}`, {\n          filePath: file.path,\n        });\n      }\n    }\n\n    // Fast-fail on definitely-invalid input before constructing a multipart body.\n    validatePassword(options.password);\n    const idempotencyKey = validateIdempotencyKey(options.idempotencyKey);\n    const labels = validateLabels(options.labels);\n    await validateDeployConfig(files);\n\n    const flags =\n      options.build || options.prerender || options.spa\n        ? { build: options.build, prerender: options.prerender, spa: options.spa }\n        : undefined;\n    const { body, headers: bodyHeaders } = await this.createDeployBody(files, {\n      labels,\n      via: options.via ?? DEPLOY_VIA,\n      password: options.password,\n      flags,\n      captcha: options.captcha,\n    });\n\n    // The key rides a header, not the body, because it must be readable\n    // before the request is parsed — the API replays a stored 201 ahead of\n    // the write budget, so a retry costs nothing.\n    return this.request<DeploymentCreateResponse>(\n      `${this.apiUrl}${this.deployEndpoint}`,\n      {\n        method: 'POST',\n        body,\n        headers: idempotencyKey\n          ? { ...bodyHeaders, 'Idempotency-Key': idempotencyKey }\n          : bodyHeaders,\n        signal: options.signal || null,\n      },\n      'Deploy',\n      // Only `build`/`prerender` reach the build service\n      // (`api/src/lib/upload-processing.ts:35`); `spa` is local detection\n      // bounded by the AI tier's own 10s, so it does not earn the longer\n      // ceiling.\n      options.build || options.prerender ? this.deployBuildTimeout : this.deployTimeout,\n    );\n  }\n\n  async listDeployments(options?: ListOptions): Promise<DeploymentListResponse> {\n    return this.request(\n      `${this.apiUrl}${API_PATHS.DEPLOYMENTS}${listQuery(options)}`,\n      { method: 'GET' },\n      'List deployments',\n    );\n  }\n\n  async getDeployment(id: string): Promise<Deployment> {\n    return this.request(\n      `${this.apiUrl}${API_PATHS.DEPLOYMENT(encodeURIComponent(id))}`,\n      { method: 'GET' },\n      'Get deployment',\n    );\n  }\n\n  async updateDeploymentLabels(id: string, labels: string[]): Promise<Deployment> {\n    const normalized = validateLabels(labels);\n    return this.request(\n      `${this.apiUrl}${API_PATHS.DEPLOYMENT(encodeURIComponent(id))}`,\n      {\n        method: 'PATCH',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify({ labels: normalized }),\n      },\n      'Update deployment labels',\n    );\n  }\n\n  async deleteDeployment(id: string): Promise<DeploymentDeleteResponse> {\n    return this.request<DeploymentDeleteResponse>(\n      `${this.apiUrl}${API_PATHS.DEPLOYMENT(encodeURIComponent(id))}`,\n      { method: 'DELETE' },\n      'Delete deployment',\n    );\n  }\n\n  // ===========================================================================\n  // PUBLIC API - DOMAINS\n  // ===========================================================================\n  // All domain methods accept FQDN (Fully Qualified Domain Name) as the `name` parameter.\n  // The SDK does not validate or normalize - the API handles all domain semantics.\n\n  async setDomain(name: string, deployment?: string, labels?: string[]): Promise<DomainSetResult> {\n    const normalized = validateLabels(labels);\n    const body: { deployment?: string; labels?: string[] } = {};\n    if (deployment) body.deployment = deployment;\n    if (normalized !== undefined) body.labels = normalized;\n\n    const { data, status } = await this.requestWithStatus<Domain>(\n      `${this.apiUrl}${API_PATHS.DOMAIN(encodeURIComponent(name))}`,\n      {\n        method: 'PUT',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify(body),\n      },\n      'Set domain',\n    );\n\n    return { ...data, isCreate: status === 201 };\n  }\n\n  async listDomains(options?: ListOptions): Promise<DomainListResponse> {\n    return this.request(\n      `${this.apiUrl}${API_PATHS.DOMAINS}${listQuery(options)}`,\n      { method: 'GET' },\n      'List domains',\n    );\n  }\n\n  async getDomain(name: string): Promise<Domain> {\n    return this.request(\n      `${this.apiUrl}${API_PATHS.DOMAIN(encodeURIComponent(name))}`,\n      { method: 'GET' },\n      'Get domain',\n    );\n  }\n\n  async deleteDomain(name: string): Promise<DomainDeleteResponse> {\n    return this.request<DomainDeleteResponse>(\n      `${this.apiUrl}${API_PATHS.DOMAIN(encodeURIComponent(name))}`,\n      { method: 'DELETE' },\n      'Delete domain',\n    );\n  }\n\n  async verifyDomain(name: string): Promise<DomainVerifyResponse> {\n    return this.request(\n      `${this.apiUrl}${API_PATHS.DOMAIN_VERIFY(encodeURIComponent(name))}`,\n      { method: 'POST' },\n      'Verify domain',\n    );\n  }\n\n  async getDomainDns(name: string): Promise<DomainDnsResponse> {\n    return this.request(\n      `${this.apiUrl}${API_PATHS.DOMAIN_DNS(encodeURIComponent(name))}`,\n      { method: 'GET' },\n      'Get domain DNS',\n    );\n  }\n\n  async getDomainRecords(name: string): Promise<DomainRecordsResponse> {\n    return this.request(\n      `${this.apiUrl}${API_PATHS.DOMAIN_RECORDS(encodeURIComponent(name))}`,\n      { method: 'GET' },\n      'Get domain records',\n    );\n  }\n\n  async getDomainShare(name: string): Promise<DomainShareResponse> {\n    return this.request(\n      `${this.apiUrl}${API_PATHS.DOMAIN_SHARE(encodeURIComponent(name))}`,\n      { method: 'GET' },\n      'Get domain share',\n    );\n  }\n\n  async validateDomain(name: string): Promise<DomainValidateResponse> {\n    return this.request(\n      `${this.apiUrl}${API_PATHS.DOMAINS_VALIDATE}`,\n      {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify({ domain: name }),\n      },\n      'Validate domain',\n    );\n  }\n\n  // ===========================================================================\n  // PUBLIC API - TOKENS\n  // ===========================================================================\n\n  async createToken(ttl?: number, labels?: string[]): Promise<TokenCreateResponse> {\n    const normalized = validateLabels(labels);\n    const body: { ttl?: number; labels?: string[] } = {};\n    if (ttl !== undefined) body.ttl = ttl;\n    if (normalized !== undefined) body.labels = normalized;\n\n    return this.request(\n      `${this.apiUrl}${API_PATHS.TOKENS}`,\n      {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify(body),\n      },\n      'Create token',\n    );\n  }\n\n  async listTokens(options?: ListOptions): Promise<TokenListResponse> {\n    return this.request(\n      `${this.apiUrl}${API_PATHS.TOKENS}${listQuery(options)}`,\n      { method: 'GET' },\n      'List tokens',\n    );\n  }\n\n  async deleteToken(token: string): Promise<TokenDeleteResponse> {\n    return this.request<TokenDeleteResponse>(\n      `${this.apiUrl}${API_PATHS.TOKEN(encodeURIComponent(token))}`,\n      { method: 'DELETE' },\n      'Delete token',\n    );\n  }\n\n  async getToken(token: string): Promise<Token> {\n    return this.request<Token>(\n      `${this.apiUrl}${API_PATHS.TOKEN(encodeURIComponent(token))}`,\n      { method: 'GET' },\n      'Get token',\n    );\n  }\n\n  // ===========================================================================\n  // PUBLIC API - ACCOUNT & CONFIG\n  // ===========================================================================\n\n  async getAccount(): Promise<AccountGetResponse> {\n    return this.request(`${this.apiUrl}${API_PATHS.ACCOUNT}`, { method: 'GET' }, 'Get account');\n  }\n\n  async getLimits(): Promise<PlatformLimits> {\n    return this.request(`${this.apiUrl}${API_PATHS.LIMITS}`, { method: 'GET' }, 'Get limits');\n  }\n\n  async ping(): Promise<PingResponse> {\n    return this.request<PingResponse>(`${this.apiUrl}${API_PATHS.PING}`, { method: 'GET' }, 'Ping');\n  }\n\n  // ===========================================================================\n  // PUBLIC API - SPA CHECK\n  // ===========================================================================\n\n  async checkSPA(files: StaticFile[], _options: ApiDeployOptions = {}): Promise<boolean> {\n    const indexFile = files.find((f) => f.path === 'index.html' || f.path === '/index.html');\n    if (!indexFile || indexFile.size > 100 * 1024) {\n      return false;\n    }\n\n    let indexContent: string;\n    if (typeof Buffer !== 'undefined' && Buffer.isBuffer(indexFile.content)) {\n      indexContent = indexFile.content.toString('utf-8');\n    } else if (typeof Blob !== 'undefined' && indexFile.content instanceof Blob) {\n      indexContent = await indexFile.content.text();\n    } else if (typeof File !== 'undefined' && indexFile.content instanceof File) {\n      indexContent = await indexFile.content.text();\n    } else {\n      return false;\n    }\n\n    const body: SPACheckRequest = { files: files.map((f) => f.path), index: indexContent };\n    const response = await this.request<SPACheckResponse>(\n      `${this.apiUrl}${API_PATHS.SPA_CHECK}`,\n      {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify(body),\n      },\n      'SPA check',\n    );\n\n    return response.isSPA;\n  }\n}\n","/**\n * Event system for Ship SDK\n * Lightweight, reliable event handling with proper error boundaries\n */\n\nimport type { ShipEvents } from './types.js';\n\n/**\n * Lightweight typed event emitter.\n *\n * Public API: `on()` / `off()`. `emit()` is internal — only the SDK\n * publishes events. Throwing handlers are evicted automatically and\n * surfaced as `error` events on the next tick.\n */\nexport class SimpleEvents {\n  // biome-ignore lint/complexity/noBannedTypes: the registry is heterogeneous by design — per-event signatures are enforced at the on()/emit() boundary\n  private handlers = new Map<string, Set<Function>>();\n\n  /**\n   * Add event handler\n   */\n  on<K extends keyof ShipEvents>(event: K, handler: (...args: ShipEvents[K]) => void): void {\n    if (!this.handlers.has(event as string)) {\n      this.handlers.set(event as string, new Set());\n    }\n    this.handlers.get(event as string)?.add(handler);\n  }\n\n  /**\n   * Remove event handler\n   */\n  off<K extends keyof ShipEvents>(event: K, handler: (...args: ShipEvents[K]) => void): void {\n    const eventHandlers = this.handlers.get(event as string);\n    if (eventHandlers) {\n      eventHandlers.delete(handler);\n      if (eventHandlers.size === 0) {\n        this.handlers.delete(event as string);\n      }\n    }\n  }\n\n  /**\n   * Emit event (internal use only)\n   * @internal\n   */\n  emit<K extends keyof ShipEvents>(event: K, ...args: ShipEvents[K]): void {\n    const eventHandlers = this.handlers.get(event as string);\n    if (!eventHandlers) return;\n\n    // Snapshot handlers so a handler that mutates the set during iteration\n    // (e.g. by removing itself) doesn't skip or duplicate calls.\n    const handlerArray = Array.from(eventHandlers);\n\n    for (const handler of handlerArray) {\n      try {\n        handler(...args);\n      } catch (error) {\n        // A throwing handler is treated as broken — drop it so we don't\n        // repeatedly invoke it and re-emit the failure as an `error` event\n        // for observability. Defer the re-emit so the next tick has a clean\n        // call stack and we can't recurse if the error handler also throws.\n        eventHandlers.delete(handler);\n\n        if (event !== 'error') {\n          setTimeout(() => {\n            const err = error instanceof Error ? error : new Error(String(error));\n            this.emit('error', err, String(event));\n          }, 0);\n        }\n      }\n    }\n  }\n}\n","/**\n * @file Client-side input validation for SDK request boundaries.\n *\n * These validators run before request construction, and this module is the\n * one import surface for them (`http.ts` takes all three from here). The\n * rules themselves live in `@shipstatic/types` — constants\n * (`LABEL_CONSTRAINTS`, `LABEL_PATTERN`) and whole checks\n * (`validatePassword`, `assertShipJsonSyntax`) alike — so the SDK and the\n * API can never disagree about what a value must look like.\n *\n * Every check here is format, never policy: length envelopes, patterns, JSON\n * syntax. Anything that can evolve server-side — password strength, plan\n * caps, the ship.json schema — is deliberately absent, because a client that\n * judged it would reject input a newer platform accepts. See\n * `@shipstatic/types/CLAUDE.md` \"Validation: format vs policy\".\n */\n\nimport type { StaticFile } from '@shipstatic/types';\nimport {\n  assertShipJsonSyntax,\n  DEPLOYMENT_CONFIG_FILENAME,\n  LABEL_CONSTRAINTS,\n  LABEL_PATTERN,\n  ShipError,\n} from '@shipstatic/types';\n\n// Re-export the canonical password validator from `@shipstatic/types` so\n// existing SDK callers (`http.ts`) keep their `from '../lib/validation.js'`\n// import path unchanged. The types-tier definition is the single source of\n// truth — see `@shipstatic/types/CLAUDE.md` \"Validation: format vs policy\".\nexport { validatePassword } from '@shipstatic/types';\n\n/**\n * Validate and normalize an array of labels.\n *\n * Lowercases and trims each entry, enforces per-label length and pattern\n * (`LABEL_CONSTRAINTS` / `LABEL_PATTERN`), count cap, and uniqueness after\n * normalization. Returns the normalized array. An empty array is valid and\n * signals \"clear all labels\" on label-update operations.\n */\nexport function validateLabels(labels: string[]): string[];\nexport function validateLabels(labels: string[] | undefined | null): string[] | undefined;\nexport function validateLabels(labels: string[] | undefined | null): string[] | undefined {\n  if (labels === undefined || labels === null) return undefined;\n  if (labels.length === 0) return labels;\n\n  if (labels.length > LABEL_CONSTRAINTS.MAX_COUNT) {\n    throw ShipError.validation(`Maximum ${LABEL_CONSTRAINTS.MAX_COUNT} labels allowed`);\n  }\n\n  const normalized = labels.map((label, i) => {\n    if (typeof label !== 'string') {\n      throw ShipError.validation(`Label at index ${i} must be a string`);\n    }\n    const cleaned = label.trim().toLowerCase();\n    if (cleaned.length < LABEL_CONSTRAINTS.MIN_LENGTH) {\n      throw ShipError.validation(\n        `Labels must be at least ${LABEL_CONSTRAINTS.MIN_LENGTH} characters long`,\n      );\n    }\n    if (cleaned.length > LABEL_CONSTRAINTS.MAX_LENGTH) {\n      throw ShipError.validation(\n        `Labels must be no more than ${LABEL_CONSTRAINTS.MAX_LENGTH} characters long`,\n      );\n    }\n    if (!LABEL_PATTERN.test(cleaned)) {\n      throw ShipError.validation(\n        `Labels must start and end with alphanumeric characters, with optional separators (${LABEL_CONSTRAINTS.SEPARATORS}) between segments`,\n      );\n    }\n    return cleaned;\n  });\n\n  const unique = [...new Set(normalized)];\n  if (unique.length !== normalized.length) {\n    throw ShipError.validation('Duplicate labels are not allowed');\n  }\n\n  return unique;\n}\n\n/**\n * Validate a deploy's root `ship.json` — syntax only, never schema.\n *\n * The same format-not-policy split the password and label validators follow,\n * drawn one layer further out: ship.json's schema and its compiler live on\n * the server and evolve there, so a client that judged them would reject\n * configs a newer platform accepts. `assertShipJsonSyntax` (the types-tier\n * definition, and the single source of truth) checks only what holds for\n * every past and future schema — the text parses as JSON, and its top level\n * is an object.\n *\n * Scope matches the API's `findDeploymentConfigFile`: the exact name at the\n * deploy root, optional leading slash and nothing else, so a\n * `config/ship.json` stays an ordinary asset the platform never reads.\n */\nexport async function validateDeployConfig(files: StaticFile[]): Promise<void> {\n  const config = files.find(\n    (f) => f.path === DEPLOYMENT_CONFIG_FILENAME || f.path === `/${DEPLOYMENT_CONFIG_FILENAME}`,\n  );\n  if (!config) return;\n\n  // Node hands the pipeline a `Buffer`; the browser a `File`/`Blob`, which is\n  // the only one of the two carrying `.text()`.\n  const content = config.content as Blob;\n  const text =\n    typeof content.text === 'function'\n      ? await content.text()\n      : (config.content as Buffer).toString('utf8');\n\n  assertShipJsonSyntax(text);\n}\n","/**\n * Ship SDK resource factory functions.\n */\nimport {\n  type AccountResource,\n  type DeployInput,\n  type DeploymentResource,\n  type DomainResource,\n  type ListOptions,\n  ShipError,\n  type StaticFile,\n  type TokenResource,\n} from '@shipstatic/types';\n\nexport type {\n  AccountResource,\n  DeployInput,\n  DeploymentResource,\n  DomainResource,\n  StaticFile,\n  TokenResource,\n};\n\nimport type { ApiHttp } from './api/http.js';\nimport { detectAndConfigureSPA } from './lib/spa.js';\nimport type { DeploymentOptions } from './types.js';\n\n/**\n * Shared context for all resource factories.\n */\nexport interface ResourceContext {\n  getApi: () => ApiHttp;\n  ensureInit: () => Promise<void>;\n}\n\n/**\n * Extended context for deployment resource.\n */\nexport interface DeploymentResourceContext extends ResourceContext {\n  processInput: (input: DeployInput, options: DeploymentOptions) => Promise<StaticFile[]>;\n}\n\n/**\n * Upload deployment resource with all CRUD operations.\n *\n * There is no client-side auth branching: an upload from a credential-less\n * client simply carries no `Authorization` header, and the API grants the\n * public-account agent identity per request (claim URL + expiry on the\n * response). The SDK stays a transparent pipe either way.\n */\nexport function createDeploymentResource(\n  ctx: DeploymentResourceContext,\n): DeploymentResource<DeploymentOptions> {\n  const { getApi, ensureInit, processInput } = ctx;\n\n  return {\n    upload: async (input: DeployInput, options: DeploymentOptions = {}) => {\n      await ensureInit();\n\n      if (!processInput) {\n        throw ShipError.config('processInput function is not provided.');\n      }\n\n      const apiClient = getApi();\n      let staticFiles = await processInput(input, options);\n      staticFiles = await detectAndConfigureSPA(staticFiles, apiClient, options);\n\n      return apiClient.deploy(staticFiles, options);\n    },\n\n    list: async (options?: ListOptions) => {\n      await ensureInit();\n      return getApi().listDeployments(options);\n    },\n\n    get: async (id: string) => {\n      await ensureInit();\n      return getApi().getDeployment(id);\n    },\n\n    set: async (id: string, options: { labels: string[] }) => {\n      await ensureInit();\n      return getApi().updateDeploymentLabels(id, options.labels);\n    },\n\n    delete: async (id: string) => {\n      await ensureInit();\n      return getApi().deleteDeployment(id);\n    },\n  };\n}\n\n/**\n * Create domain resource with all CRUD operations.\n *\n * @remarks\n * The `name` parameter in all methods is an FQDN (Fully Qualified Domain Name).\n * The SDK does not validate or normalize domain names - the API handles all domain semantics.\n */\nexport function createDomainResource(ctx: ResourceContext): DomainResource {\n  const { getApi, ensureInit } = ctx;\n\n  return {\n    // INTENTIONAL DESIGN: The API does NOT support unlinking domains (setting deployment to null).\n    // Once a domain is linked to a deployment, it must always have a deployment.\n    // Supported: reserve (omit deployment), link, switch deployments atomically, delete entirely.\n    // Not supported: unlink after linking (creates ambiguous state with no clear use case).\n    // See npm/ship/CLAUDE.md \"Domain Write Semantics\" for full rationale.\n    set: async (name: string, options: { deployment?: string; labels?: string[] } = {}) => {\n      await ensureInit();\n      return getApi().setDomain(name, options.deployment, options.labels);\n    },\n\n    list: async (options?: ListOptions) => {\n      await ensureInit();\n      return getApi().listDomains(options);\n    },\n\n    get: async (name: string) => {\n      await ensureInit();\n      return getApi().getDomain(name);\n    },\n\n    delete: async (name: string) => {\n      await ensureInit();\n      return getApi().deleteDomain(name);\n    },\n\n    verify: async (name: string) => {\n      await ensureInit();\n      return getApi().verifyDomain(name);\n    },\n\n    validate: async (name: string) => {\n      await ensureInit();\n      return getApi().validateDomain(name);\n    },\n\n    dns: async (name: string) => {\n      await ensureInit();\n      return getApi().getDomainDns(name);\n    },\n\n    records: async (name: string) => {\n      await ensureInit();\n      return getApi().getDomainRecords(name);\n    },\n\n    share: async (name: string) => {\n      await ensureInit();\n      return getApi().getDomainShare(name);\n    },\n  };\n}\n\n/**\n * Create account resource (whoami functionality).\n */\nexport function createAccountResource(ctx: ResourceContext): AccountResource {\n  const { getApi, ensureInit } = ctx;\n\n  return {\n    get: async () => {\n      await ensureInit();\n      return getApi().getAccount();\n    },\n  };\n}\n\n/**\n * Create token resource for managing deploy tokens.\n */\nexport function createTokenResource(ctx: ResourceContext): TokenResource {\n  const { getApi, ensureInit } = ctx;\n\n  return {\n    create: async (options: { ttl?: number; labels?: string[] } = {}) => {\n      await ensureInit();\n      return getApi().createToken(options.ttl, options.labels);\n    },\n\n    list: async (options?: ListOptions) => {\n      await ensureInit();\n      return getApi().listTokens(options);\n    },\n\n    get: async (token: string) => {\n      await ensureInit();\n      return getApi().getToken(token);\n    },\n\n    delete: async (token: string) => {\n      await ensureInit();\n      return getApi().deleteToken(token);\n    },\n  };\n}\n","/**\n * @file SPA detection and auto-configuration utilities.\n *\n * Provides SPA detection and ship.json generation functionality\n * that can be used by both Node.js and browser environments.\n */\n\nimport { DEPLOYMENT_CONFIG_FILENAME, SPA_DEFAULT_CONFIG } from '@shipstatic/types';\nimport type { ApiHttp } from '../api/http.js';\nimport type { DeploymentOptions, StaticFile } from '../types.js';\nimport { calculateMD5 } from './md5.js';\n\n/**\n * Creates ship.json configuration for SPA projects.\n * @returns Promise resolving to StaticFile with SPA configuration\n */\nexport async function createSPAConfig(): Promise<StaticFile> {\n  const configString = JSON.stringify(SPA_DEFAULT_CONFIG, null, 2);\n\n  // Create content that works in both browser and Node.js environments\n  let content: Buffer | Blob;\n  if (typeof Buffer !== 'undefined') {\n    // Node.js environment\n    content = Buffer.from(configString, 'utf-8');\n  } else {\n    // Browser environment\n    content = new Blob([configString], { type: 'application/json' });\n  }\n\n  const { md5 } = await calculateMD5(content);\n\n  return {\n    path: DEPLOYMENT_CONFIG_FILENAME,\n    content,\n    size: configString.length,\n    md5,\n  };\n}\n\n/**\n * Detects SPA projects and auto-generates configuration.\n * This function can be used by both Node.js and browser environments.\n *\n * @param files - Array of StaticFiles to analyze\n * @param apiClient - HTTP client for API communication\n * @param options - Deployment options containing SPA detection settings\n * @returns Promise resolving to files array with optional SPA config added\n */\nexport async function detectAndConfigureSPA(\n  files: StaticFile[],\n  apiClient: ApiHttp,\n  options: DeploymentOptions,\n): Promise<StaticFile[]> {\n  // Skip if disabled, config already exists, or server will handle detection\n  if (\n    options.spaDetect === false ||\n    options.spa ||\n    options.build ||\n    options.prerender ||\n    files.some((f) => f.path === DEPLOYMENT_CONFIG_FILENAME)\n  ) {\n    return files;\n  }\n\n  try {\n    const isSPA = await apiClient.checkSPA(files, options);\n\n    if (isSPA) {\n      const spaConfig = await createSPAConfig();\n      return [...files, spaConfig];\n    }\n  } catch (_error) {\n    // SPA detection failed, continue silently without auto-config\n  }\n\n  return files;\n}\n","/**\n * @file Environment variable resolution for the Node.js Ship SDK.\n *\n * The SDK has exactly one ambient credential source: process environment\n * variables. `SHIP_TOKEN` (any platform token — the value's prefix says what\n * it is) and `SHIP_API_URL` are honored as the universal \"process boundary\" —\n * the one-token idiom used across the industry (`GITHUB_TOKEN`, `NPM_TOKEN`,\n * `VERCEL_TOKEN`). Constructor arguments win over env vars.\n *\n * File-based config (`~/.shiprc`, `package.json` `\"ship\"` key) is the CLI's\n * responsibility — see `src/node/cli/shiprc.ts`. The SDK does not read files,\n * which is what lets embedded consumers (MCP, n8n, GitHub Action) construct\n * `new Ship({})` for anonymous deployments without leaking the host developer's\n * personal credentials.\n */\n\nimport { ShipError } from '@shipstatic/types';\nimport { z } from 'zod';\nimport { CREDENTIAL_FIELDS } from '../../shared/core/credential-schema.js';\nimport { getENV } from '../../shared/lib/env.js';\nimport type { ShipClientOptions } from '../../shared/types.js';\n\n// `.strict()` matches the file-config schema. The `raw` object below is\n// constructed from a fixed set of keys, so .strict() doesn't catch user\n// typos here (env vars we don't read are simply never put into `raw` in\n// the first place). What it does catch is a *contributor* error — adding\n// a new env-var read without updating `CREDENTIAL_FIELDS` produces a clear\n// validation failure rather than a silently-stripped value. Nearly free\n// (one method call), and keeps both schemas reading the same.\nconst EnvConfigSchema = z.object(CREDENTIAL_FIELDS).strict();\n\n/**\n * Map a `ShipClientOptions` field name (camelCase) back to the env var that\n * supplied it (SCREAMING_SNAKE_CASE), so validation errors point users at\n * the actual variable they need to fix. Kept as an explicit table rather\n * than a regex because the set is small, fixed, and unambiguous.\n */\nconst ENV_VAR_BY_FIELD: Record<string, string> = {\n  apiUrl: 'SHIP_API_URL',\n  token: 'SHIP_TOKEN',\n};\n\n/**\n * Read `SHIP_*` environment variables and validate the result.\n *\n * Empty strings (CI/Docker often sets env vars to `\"\"` instead of unsetting them)\n * are normalized to `undefined` before validation, so they don't trigger zod's\n * \"min length 1\" check or accidentally override a valid constructor argument.\n *\n * Returns an empty object outside Node.js — browser/edge runtimes have no\n * `process.env` we should reach into.\n */\nexport function readEnvConfig(): Partial<ShipClientOptions> {\n  if (getENV() !== 'node') return {};\n\n  const raw = {\n    apiUrl: process.env.SHIP_API_URL || undefined,\n    token: process.env.SHIP_TOKEN || undefined,\n  };\n\n  try {\n    return EnvConfigSchema.parse(raw);\n  } catch (error) {\n    if (error instanceof z.ZodError) {\n      const issue = error.issues[0];\n      const field = issue.path[0] as string | undefined;\n      const envVar = (field && ENV_VAR_BY_FIELD[field]) ?? 'SHIP environment configuration';\n      throw ShipError.config(`Invalid ${envVar}: ${issue.message}`);\n    }\n    throw ShipError.config('Invalid environment configuration');\n  }\n}\n","/**\n * @file Single source of truth for ambient-config field validation.\n *\n * Both the SDK env reader (`node/core/config.ts`) and the CLI file loader\n * (`node/cli/shiprc.ts`) import these — if we tighten or relax a rule,\n * both layers update together. The `token` field accepts any platform token;\n * strict prefix-classified format validation happens once, at the `Ship`\n * constructor boundary, for every source uniformly.\n *\n * Lives in its own file because it's a pure data constant: tests that mock\n * runtime config behavior shouldn't have to forward this through their mocks.\n */\n\nimport { z } from 'zod';\n\nexport const CREDENTIAL_FIELDS = {\n  apiUrl: z.string().url().optional(),\n  token: z.string().min(1).optional(),\n};\n","/**\n * Node.js-specific deploy body creation.\n */\nimport { ShipError } from '@shipstatic/types';\nimport type { DeployBody, DeployBodyContext, StaticFile } from '../../shared/types.js';\n\nexport async function createDeployBody(\n  files: StaticFile[],\n  context: DeployBodyContext = {},\n): Promise<DeployBody> {\n  const { FormData, File } = await import('formdata-node');\n  const { FormDataEncoder } = await import('form-data-encoder');\n\n  const { labels, via, password, flags, captcha } = context;\n  const formData = new FormData();\n  const checksums: string[] = [];\n\n  for (const file of files) {\n    // 1. Validate content type\n    if (\n      !Buffer.isBuffer(file.content) &&\n      !(typeof Blob !== 'undefined' && file.content instanceof Blob)\n    ) {\n      throw ShipError.file(`Unsupported file.content type for Node.js: ${file.path}`, {\n        filePath: file.path,\n      });\n    }\n\n    // 2. Validate md5\n    if (!file.md5) {\n      throw ShipError.file(`File missing md5 checksum: ${file.path}`, { filePath: file.path });\n    }\n\n    // 3. Create File and append — API derives Content-Type from extension\n    const fileInstance = new File([file.content], file.path, { type: 'application/octet-stream' });\n    formData.append('files[]', fileInstance);\n    checksums.push(file.md5);\n  }\n\n  formData.append('checksums', JSON.stringify(checksums));\n\n  if (labels && labels.length > 0) formData.append('labels', JSON.stringify(labels));\n  if (via) formData.append('via', via);\n  if (password) formData.append('password', password);\n  if (flags?.build) formData.append('build', 'true');\n  if (flags?.prerender) formData.append('prerender', 'true');\n  if (flags?.spa) formData.append('spa', 'true');\n  if (captcha) formData.append('captcha', captcha);\n\n  const encoder = new FormDataEncoder(formData);\n  const chunks = [];\n  for await (const chunk of encoder.encode()) {\n    chunks.push(Buffer.from(chunk));\n  }\n  const body = Buffer.concat(chunks);\n\n  return {\n    body: body.buffer.slice(body.byteOffset, body.byteOffset + body.byteLength) as ArrayBuffer,\n    headers: {\n      'Content-Type': encoder.contentType,\n      'Content-Length': Buffer.byteLength(body).toString(),\n    },\n  };\n}\n","/**\n * @file Shared SDK exports - environment agnostic.\n */\n\nexport type { Account, Deployment, Domain, PingResponse } from '@shipstatic/types';\n// Re-export types from @shipstatic/types\nexport { ErrorType, ShipError } from '@shipstatic/types';\nexport * from './api/http.js';\nexport { Ship } from './base-ship.js';\nexport * from './core/constants.js';\nexport * from './lib/deploy-paths.js';\nexport * from './lib/env.js';\nexport * from './lib/file-validation.js';\nexport * from './lib/junk.js';\n// Shared utilities\nexport * from './lib/md5.js';\nexport * from './lib/security.js';\nexport * from './lib/text.js';\n// Core functionality\nexport * from './resources.js';\nexport * from './types.js';\n","/**\n * @file SDK-specific constants.\n * Platform constants are now in @shipstatic/types.\n */\n\n// Re-export platform constants for convenience\nexport { DEFAULT_API } from '@shipstatic/types';\n","/**\n * Utility functions for string manipulation.\n */\n\n/**\n * Simple utility to pluralize a word based on a count.\n * @param count The number to determine pluralization.\n * @param singular The singular form of the word.\n * @param plural The plural form of the word.\n * @param includeCount Whether to include the count in the returned string. Defaults to true.\n * @returns A string with the count and the correctly pluralized word.\n */\nexport function pluralize(\n  count: number,\n  singular: string,\n  plural: string,\n  includeCount: boolean = true,\n): string {\n  const word = count === 1 ? singular : plural;\n  return includeCount ? `${count} ${word}` : word;\n}\n"],"mappings":"4mBA0GO,SAASA,GAAuBC,EAAO,CAC1C,GAA2BA,GAAU,KACjC,OACJ,GAAI,OAAOA,GAAU,SACjB,MAAMC,EAAU,WAAW,mCAAmC,EAElE,IAAMC,EAAMF,EAAM,KAAK,EACvB,GAAI,CAACE,EACD,MAAMD,EAAU,WAAW,oCAAoC,EAEnE,GAAIC,EAAI,OAASC,GAA4B,WACzC,MAAMF,EAAU,WAAW,mCAAmCE,GAA4B,UAAU,cAAc,EAEtH,OAAOD,CACX,CAsWO,SAASE,EAAYC,EAAO,CAC/B,OAAQA,IAAU,MACd,OAAOA,GAAU,UACjB,SAAUA,GACVA,EAAM,OAAS,aACf,WAAYA,CACpB,CAsEO,SAASC,EAAmBC,EAAU,CACzC,IAAMC,EAAWD,EAAS,YAAY,GAAG,EACzC,GAAIC,IAAa,IAAMA,IAAaD,EAAS,OAAS,EAClD,MAAO,GACX,IAAME,EAAMF,EAAS,MAAMC,EAAW,CAAC,EAAE,YAAY,EACrD,OAAOE,GAAmB,IAAID,CAAG,CACrC,CA0BO,SAASE,GAAeJ,EAAU,CACrC,OAAOK,GAAsB,KAAKL,CAAQ,CAC9C,CAoBO,SAASM,EAAiBC,EAAU,CAEvC,OADiBA,EAAS,QAAQ,MAAO,GAAG,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO,EACvD,KAAMC,GAAMC,EAAwB,IAAID,CAAC,CAAC,CAC9D,CAmGO,SAASE,GAAcC,EAAO,CACjC,OAAIA,EAAM,WAAWC,GAAQ,MAAM,EACxBC,EAAU,QACjBF,EAAM,WAAWG,GAAa,MAAM,EAC7BD,EAAU,aACdA,EAAU,MACrB,CAwDO,SAASE,GAAqBC,EAAM,CACvC,IAAMC,EAAaD,EAAK,WAAW,CAAC,IAAM,MAASA,EAAK,MAAM,CAAC,EAAIA,EAC/DE,EACJ,GAAI,CACAA,EAAS,KAAK,MAAMD,CAAU,CAClC,OACOnB,EAAO,CACV,MAAMJ,EAAU,OAAO,kCAAkCI,EAAM,OAAO,GAAI,CACtE,SAAUqB,CACd,CAAC,CACL,CACA,GAAID,IAAW,MAAQ,OAAOA,GAAW,UAAY,MAAM,QAAQA,CAAM,EACrE,MAAMxB,EAAU,OAAO,GAAGyB,CAA0B,8BAA+B,CAC/E,SAAUA,CACd,CAAC,CAET,CASA,SAASC,GAA2B3B,EAAO4B,EAAOC,EAAO,CACrD,GAAI,CAAC7B,EAAM,WAAW4B,EAAM,MAAM,EAC9B,MAAM3B,EAAU,WAAW,GAAG4B,CAAK,qBAAqBD,EAAM,MAAM,GAAG,EAE3E,GAAI5B,EAAM,SAAW4B,EAAM,aACvB,MAAM3B,EAAU,WAAW,GAAG4B,CAAK,YAAYD,EAAM,YAAY,sBAAsBA,EAAM,MAAM,MAAMA,EAAM,UAAU,aAAa,EAE1I,IAAME,EAAU9B,EAAM,MAAM4B,EAAM,OAAO,MAAM,EAC/C,GAAI,CAAC,IAAI,OAAO,aAAaA,EAAM,UAAU,KAAM,GAAG,EAAE,KAAKE,CAAO,EAChE,MAAM7B,EAAU,WAAW,GAAG4B,CAAK,iBAAiBD,EAAM,UAAU,kCAAkCA,EAAM,MAAM,UAAU,CAEpI,CAIO,SAASG,GAAeC,EAAQ,CACnCL,GAA2BK,EAAQb,GAAS,SAAS,CACzD,CAIO,SAASc,GAAoBC,EAAa,CAC7CP,GAA2BO,EAAab,GAAc,cAAc,CACxE,CAOO,SAASc,EAAcjB,EAAO,CACjC,OAAQD,GAAcC,CAAK,EAAG,CAC1B,KAAKE,EAAU,QACXW,GAAeb,CAAK,EACpB,OACJ,KAAKE,EAAU,aACXa,GAAoBf,CAAK,EACzB,OACJ,KAAKE,EAAU,OACX,GAAI,CAACF,EACD,MAAMjB,EAAU,WAAW,kCAAkC,CACzE,CACJ,CAMO,SAASmC,GAAeC,EAAQ,CACnC,GAAI,CAACA,GAAUA,EAAO,OAASC,EAAO,YAAc,CAACA,EAAO,QAAQ,KAAKD,CAAM,EAC3E,MAAMpC,EAAU,WAAW,oBAAoBqC,EAAO,UAAU,6DAA6D,CAErI,CAIO,SAASC,GAAeC,EAAQ,CACnC,GAAI,CACA,IAAMC,EAAM,IAAI,IAAID,CAAM,EAC1B,GAAI,CAAC,CAAC,QAAS,QAAQ,EAAE,SAASC,EAAI,QAAQ,EAC1C,MAAMxC,EAAU,WAAW,+CAA+C,EAE9E,GAAIwC,EAAI,WAAa,KAAOA,EAAI,WAAa,GACzC,MAAMxC,EAAU,WAAW,iCAAiC,EAEhE,GAAIwC,EAAI,QAAUA,EAAI,KAClB,MAAMxC,EAAU,WAAW,wDAAwD,CAE3F,OACOI,EAAO,CACV,MAAID,EAAYC,CAAK,EACXA,EAEJJ,EAAU,WAAW,6BAA6B,CAC5D,CACJ,CAKO,SAASyC,GAAaC,EAAO,CAChC,MAAO,+CAA+C,KAAKA,CAAK,CACpE,CAkCO,SAASC,GAAiBC,EAAQC,EAAgB,CACrD,OAAOD,EAAO,SAAS,IAAIC,CAAc,EAAE,CAC/C,CAQO,SAASC,GAAeF,EAAQC,EAAgB,CACnD,MAAO,CAACF,GAAiBC,EAAQC,CAAc,CACnD,CAQO,SAASE,GAAiBH,EAAQC,EAAgB,CACrD,OAAKF,GAAiBC,EAAQC,CAAc,EAGrCD,EAAO,MAAM,EAAG,EAAEC,EAAe,OAAS,EAAE,EAFxC,IAGf,CAIO,SAASG,GAAsBC,EAAY,CAC9C,MAAO,WAAWA,CAAU,EAChC,CAIO,SAASC,GAAkBN,EAAQ,CACtC,MAAO,WAAWA,CAAM,EAC5B,CAmCO,SAASO,GAAgBC,EAAQ,CACpC,MAAI,CAACA,GAAUA,EAAO,SAAW,EACtB,KACJ,KAAK,UAAUA,CAAM,CAChC,CASO,SAASC,GAAkBC,EAAY,CAC1C,GAAI,CAACA,EACD,MAAO,CAAC,EACZ,GAAI,CACA,IAAM9B,EAAS,KAAK,MAAM8B,CAAU,EACpC,OAAO,MAAM,QAAQ9B,CAAM,EAAIA,EAAS,CAAC,CAC7C,MACM,CACF,MAAO,CAAC,CACZ,CACJ,CAoCO,SAAS+B,EAAiBxD,EAAO,CACpC,GAA2BA,GAAU,KACjC,OACJ,GAAI,OAAOA,GAAU,SACjB,MAAMC,EAAU,WAAW,2BAA2B,EAE1D,IAAMwD,EAAUzD,EAAM,KAAK,EAC3B,GAAIyD,EAAQ,OAASC,EAAqB,YACtCD,EAAQ,OAASC,EAAqB,WACtC,MAAMzD,EAAU,WAAW,4BAA4ByD,EAAqB,UAAU,QAAQA,EAAqB,UAAU,aAAa,EAE9I,OAAOD,CACX,CAhiCA,IAUaE,GAqCAC,EAoCAC,GAaA1D,GA+BA2D,GAqBAC,EAsCPC,GAWAC,GAiCAC,GAQAC,GAIOlE,EAgQAS,GA8EAE,GAoBAI,EA+BAoD,GAUAC,GAaAlD,GAcAE,GAeAiB,EAoBAlB,EA6BAkD,GAUA5C,EAEA6C,GAgJAC,EAOAC,EAmEAC,EAkBAC,GAyCAjB,EAz/BbkB,EAAAC,EAAA,kBAUalB,GAAmB,CAC5B,QAAS,UACT,QAAS,UACT,OAAQ,SACR,SAAU,UACd,EAgCaC,EAAY,CACrB,YAAa,eACb,WAAaV,GAAe,gBAAgBA,CAAU,GACtD,kBAAoBA,GAAe,gBAAgBA,CAAU,UAC7D,QAAS,WACT,OAASL,GAAW,YAAYA,CAAM,GACtC,cAAgBA,GAAW,YAAYA,CAAM,UAC7C,WAAaA,GAAW,YAAYA,CAAM,OAC1C,eAAiBA,GAAW,YAAYA,CAAM,WAC9C,aAAeA,GAAW,YAAYA,CAAM,SAC5C,mBAAqBA,GAAW,YAAYA,CAAM,eAClD,iBAAkB,oBAClB,OAAQ,UACR,MAAQ3B,GAAU,WAAWA,CAAK,GAClC,QAAS,WACT,YAAa,eACb,cAAe,iBACf,WAAY,cACZ,OAAQ,UACR,OAAQ,UACR,KAAM,QACN,MAAO,SACP,UAAW,aACX,OAAQ,SACZ,EAYa2C,GAAe,CACxB,QAAS,UACT,QAAS,UACT,QAAS,UACT,OAAQ,QACZ,EAQa1D,GAA8B,CACvC,WAAY,IAEZ,eAAgB,KAAU,EAC9B,EA2Ba2D,GAAc,CACvB,KAAM,OACN,SAAU,WACV,UAAW,YACX,WAAY,aACZ,UAAW,YACX,YAAa,cACb,WAAY,YAChB,EAaaC,EAAY,CAUrB,WAAY,oBAEZ,SAAU,YAEV,UAAW,YAEX,UAAW,sBAEX,eAAgB,wBAEhB,SAAU,uBAEV,IAAK,wBAEL,QAAS,gBAET,UAAW,sBAEX,KAAM,aAEN,OAAQ,cACZ,EAOMC,GAA0B,IAAI,IAAI,CACpCD,EAAU,QACVA,EAAU,UACVA,EAAU,KACVA,EAAU,MACd,CAAC,EAMKE,GAAmB,CAarB,OAAQ,IAAI,IAAI,CACZF,EAAU,SACVA,EAAU,UACVA,EAAU,OACVA,EAAU,KACVA,EAAU,UACVA,EAAU,SACVA,EAAU,UACVA,EAAU,UACd,CAAC,EACD,QAAS,IAAI,IAAI,CAACA,EAAU,OAAO,CAAC,EACpC,KAAM,IAAI,IAAI,CAACA,EAAU,cAAc,CAAC,CAC5C,EAQMG,GAAgC,IAAI,IAAI,OAAO,OAAOH,CAAS,EAAE,OAAQe,GAAM,CAACd,GAAwB,IAAIc,CAAC,CAAC,CAAC,EAQ/GX,GAA6B,IAItBlE,EAAN,MAAM8E,UAAkB,KAAM,CACjC,KACA,OACA,QACA,YAAYC,EAAMC,EAASC,EAAQC,EAAS,CACxC,MAAMF,CAAO,EACb,KAAK,KAAOD,EACZ,KAAK,OAASE,EACd,KAAK,QAAUC,EACf,KAAK,KAAO,WAChB,CAEA,YAAa,CAIT,IAAMC,EAAc,KAAK,QACnBD,EAAU,KAAK,OAASpB,EAAU,gBAAkBqB,GAAa,SAAW,OAAY,KAAK,QACnG,MAAO,CACH,MAAO,KAAK,KACZ,QAAS,KAAK,QACd,OAAQ,KAAK,OACb,QAAAD,CACJ,CACJ,CAuBA,aAAa,iBAAiBE,EAAUC,EAAe,CACnD,IAAIL,EACAE,EACAI,EACJ,GAAI,CAEA,GADoBF,EAAS,QAAQ,IAAI,cAAc,GACtC,SAAS,kBAAkB,EAAG,CAC3C,IAAMG,EAAO,MAAMH,EAAS,KAAK,EACjC,GAAIG,GAAQ,OAAOA,GAAS,SAAU,CAClC,IAAMC,EAAMD,EACR,OAAOC,EAAI,SAAY,SACvBR,EAAUQ,EAAI,QACT,OAAOA,EAAI,OAAU,WAC1BR,EAAUQ,EAAI,OAClBN,EAAUM,EAAI,QACV,OAAOA,EAAI,OAAU,UAAYvB,GAA8B,IAAIuB,EAAI,KAAK,IAC5EF,EAAWE,EAAI,MAEvB,CACJ,KACK,CAQD,IAAMlE,GAAQ,MAAM8D,EAAS,KAAK,GAAG,KAAK,EACtC9D,GAAQ,CAACA,EAAK,WAAW,GAAG,GAAKA,EAAK,QAAU4C,KAChDc,EAAU1D,EAElB,CACJ,MACM,CAEN,CAKA,IAAMmE,EAAmBL,EAAS,QAAQ,IAAI,aAAa,EAC3D,GAAIK,IAAqB,KAAM,CAC3B,IAAM1F,EAAQ0F,EAAiB,KAAK,EAC9BC,EAAU,QAAQ,KAAK3F,CAAK,EAC5B,OAAOA,CAAK,EACZ,KAAK,MAAM,KAAK,MAAMA,CAAK,EAAI,KAAK,IAAI,GAAK,GAAI,EACvD,GAAI,OAAO,SAAS2F,CAAO,GAAKA,GAAW,EAAG,CAC1C,IAAMC,EAAWT,GAAW,OAAOA,GAAY,SAAWA,EAAU,CAAC,EACjES,EAAS,aAAe,SACxBT,EAAU,CAAE,GAAGS,EAAU,WAAYD,CAAQ,EAErD,CACJ,CACAV,EAAUA,GAAW,GAAGK,GAAiB,SAAS,uBAAuBD,EAAS,MAAM,GACxF,IAAML,EAAOO,IACRF,EAAS,SAAW,IACftB,EAAU,eACVsB,EAAS,SAAW,IAChBtB,EAAU,UACVsB,EAAS,SAAW,IAChBtB,EAAU,UACVA,EAAU,KAC5B,OAAO,IAAIgB,EAAUC,EAAMC,EAASI,EAAS,OAAQF,CAAO,CAChE,CAmBA,OAAO,eAAeU,EAAOP,EAAe,CACxC,GAAIlF,EAAYyF,CAAK,EACjB,OAAOA,EACX,IAAMC,EAAKR,GAAiB,UAC5B,OAAIO,aAAiB,MACbA,EAAM,OAAS,aACRd,EAAU,UAAU,GAAGe,CAAE,gBAAgB,EAEhDD,aAAiB,WAAaA,EAAM,QAAQ,SAAS,OAAO,EACrDd,EAAU,QAAQ,GAAGe,CAAE,YAAYD,EAAM,OAAO,GAAI,CAAE,MAAAA,CAAM,CAAC,EAEjE,IAAId,EAAUhB,EAAU,IAAK,GAAG+B,CAAE,YAAYD,EAAM,OAAO,EAAE,EAEjE,IAAId,EAAUhB,EAAU,IAAK,GAAG+B,CAAE,wBAAwB,CACrE,CAKA,OAAO,WAAWb,EAASE,EAAS,CAChC,OAAO,IAAIJ,EAAUhB,EAAU,WAAYkB,EAAS,IAAKE,CAAO,CACpE,CACA,OAAO,SAASY,EAAUC,EAAI,CAC1B,IAAMf,EAAUe,EAAK,GAAGD,CAAQ,IAAIC,CAAE,aAAe,GAAGD,CAAQ,aAChE,OAAO,IAAIhB,EAAUhB,EAAU,SAAUkB,EAAS,GAAG,CACzD,CACA,OAAO,UAAUA,EAASE,EAAS,CAC/B,OAAO,IAAIJ,EAAUhB,EAAU,UAAWkB,EAAS,IAAKE,CAAO,CACnE,CACA,OAAO,UAAUF,EAAU,oBAAqBE,EAAS,CACrD,OAAO,IAAIJ,EAAUhB,EAAU,UAAWkB,EAAS,IAAKE,CAAO,CACnE,CAcA,OAAO,eAAeF,EAAU,0BAA2BE,EAAS,CAChE,OAAO,IAAIJ,EAAUhB,EAAU,eAAgBkB,EAAS,IAAKE,CAAO,CACxE,CACA,OAAO,SAASF,EAASC,EAAS,IAAKC,EAAS,CAC5C,OAAO,IAAIJ,EAAUhB,EAAU,SAAUkB,EAASC,EAAQC,CAAO,CACrE,CACA,OAAO,QAAQF,EAASE,EAAS,CAC7B,OAAO,IAAIJ,EAAUhB,EAAU,QAASkB,EAAS,OAAWE,CAAO,CACvE,CACA,OAAO,UAAUF,EAASE,EAAS,CAC/B,OAAO,IAAIJ,EAAUhB,EAAU,UAAWkB,EAAS,OAAWE,CAAO,CACzE,CACA,OAAO,KAAKF,EAASE,EAAS,CAC1B,OAAO,IAAIJ,EAAUhB,EAAU,KAAMkB,EAAS,OAAWE,CAAO,CACpE,CACA,OAAO,OAAOF,EAASE,EAAS,CAC5B,OAAO,IAAIJ,EAAUhB,EAAU,OAAQkB,EAAS,OAAWE,CAAO,CACtE,CACA,OAAO,IAAIF,EAASC,EAAS,IAAKC,EAAS,CACvC,OAAO,IAAIJ,EAAUhB,EAAU,IAAKkB,EAASC,EAAQC,CAAO,CAChE,CAeA,eAAgB,CACZ,OAAIlB,GAAiB,OAAO,IAAI,KAAK,IAAI,EAC9B,GACJ,KAAK,SAAW,QAAa,KAAK,QAAU,KAAO,KAAK,OAAS,GAC5E,CACA,gBAAiB,CACb,OAAOA,GAAiB,QAAQ,IAAI,KAAK,IAAI,CACjD,CACA,aAAc,CACV,OAAOA,GAAiB,KAAK,IAAI,KAAK,IAAI,CAC9C,CACA,OAAOgC,EAAW,CACd,OAAO,KAAK,OAASA,CACzB,CACJ,EAgCavF,GAAqB,IAAI,IAAI,CAEtC,MACA,MACA,MACA,MACA,MACA,MACA,MACA,MACA,MACA,MACA,MAEA,MACA,OAEA,MACA,MACA,MAEA,MACA,MACA,MAEA,MACA,MACA,MACA,KACA,MACA,MACA,MACA,MAEA,MACA,OAEA,MACA,MAEA,MACA,MACA,KACJ,CAAC,EAmCYE,GAAwB,0BAoBxBI,EAA0B,IAAI,IAAI,CAC3C,eACA,cACJ,CAAC,EA4BYoD,GAAiB,QAUjBC,GAAa,CACtB,QAAS,UACT,QAAS,SACT,MAAO,QACP,MAAO,QACP,MAAO,QACP,QAAS,UACT,OAAQ,QACZ,EAKalD,GAAU,CAEnB,OAAQ,QAER,WAAY,GAEZ,aAAc,GAEd,YAAa,CACjB,EAKaE,GAAe,CAExB,OAAQ,UAER,WAAY,GAEZ,aAAc,EAClB,EAQaiB,EAAS,CAElB,OAAQ,WAER,WAAY,IAEZ,QAAS,mBACb,EAaalB,EAAY,CACrB,QAASiD,GAAW,QACpB,aAAcA,GAAW,MACzB,OAAQ,QACZ,EAyBaC,GAAa,CACtB,aAAc,eACd,iBAAkB,mBAClB,kBAAmB,oBACnB,aAAc,eACd,cAAe,eACnB,EAIa5C,EAA6B,YAE7B6C,GAAqB,CAC9B,SAAU,CAAC,CAAE,OAAQ,QAAS,YAAa,aAAc,CAAC,CAC9D,EA8IaC,EAAc,6BAOdC,EAAuB,CAEhC,QAAS,UAET,iBAAkB,mBAElB,SAAU,WAEV,kBAAmB,oBAEnB,MAAO,OACX,EAwDaC,EAAoB,CAE7B,WAAY,EAEZ,WAAY,GAEZ,UAAW,GAEX,WAAY,KAChB,EASaC,GAAgB,iCAyChBjB,EAAuB,CAEhC,WAAY,EAEZ,WAAY,GAChB,ICr/BA,eAAewC,GAAQC,EAAgC,CACrD,IAAMC,GAAY,KAAM,QAAO,WAAW,GAAG,QACvCC,EAAQ,IAAID,EAAS,YACrBE,EAAY,QAClB,QAASC,EAAQ,EAAGA,EAAQJ,EAAK,KAAMI,GAASD,EAAW,CACzD,IAAME,EAAM,KAAK,IAAID,EAAQD,EAAWH,EAAK,IAAI,EACjDE,EAAM,OAAO,MAAMF,EAAK,MAAMI,EAAOC,CAAG,EAAE,YAAY,CAAC,CACzD,CACA,MAAO,CAAE,IAAKH,EAAM,IAAI,CAAE,CAC5B,CAEA,eAAeI,GAAUC,EAAoC,CAE3D,GAAM,CAAE,WAAAC,CAAW,EAAI,KAAM,QAAO,QAAQ,EACtCC,EAAOD,EAAW,KAAK,EAC7B,OAAAC,EAAK,OAAOF,CAAM,EACX,CAAE,IAAKE,EAAK,OAAO,KAAK,CAAE,CACnC,CAEA,eAAeC,GAAQC,EAAkC,CAEvD,GAAM,CAAE,WAAAH,CAAW,EAAI,KAAM,QAAO,QAAQ,EAEtC,CAAE,iBAAAI,CAAiB,EAAI,KAAM,QAAO,IAAI,EAC9C,OAAO,IAAI,QAAQ,CAACC,EAASC,IAAW,CACtC,IAAML,EAAOD,EAAW,KAAK,EACvBO,EAASH,EAAiBD,CAAI,EAMpCI,EAAO,GAAG,QAAUC,GAClBF,EAAOG,EAAU,KAAK,gCAAgCD,EAAI,OAAO,GAAI,CAAE,SAAUL,CAAK,CAAC,CAAC,CAC1F,EACAI,EAAO,GAAG,OAASG,GAAUT,EAAK,OAAOS,CAAK,CAAC,EAC/CH,EAAO,GAAG,MAAO,IAAMF,EAAQ,CAAE,IAAKJ,EAAK,OAAO,KAAK,CAAE,CAAC,CAAC,CAC7D,CAAC,CACH,CAEA,eAAsBU,EAAaC,EAAmD,CACpF,GAAIA,aAAiB,KAAM,OAAOrB,GAAQqB,CAAK,EAC/C,GAAI,OAAO,OAAW,KAAe,OAAO,SAASA,CAAK,EAAG,OAAOd,GAAUc,CAAK,EACnF,GAAI,OAAOA,GAAU,SAAU,OAAOV,GAAQU,CAAK,EACnD,MAAMH,EAAU,SAAS,mCAAmC,CAC9D,CAtDA,IAAAI,EAAAC,EAAA,kBAGAC,MCoBO,SAASC,GAAqBC,EAAwC,CAC3EC,GAAmBD,CACrB,CAQA,SAASE,IAA0C,CAEjD,OAAI,OAAO,QAAY,KAAe,QAAQ,UAAY,QAAQ,SAAS,KAClE,OAIL,OAAO,OAAW,KAAe,OAAO,KAAS,IAC5C,UAGF,SACT,CAWO,SAASC,GAA+B,CAE7C,OAAIF,IAKGC,GAAkB,CAC3B,CAhEA,IAWID,GAXJG,EAAAC,EAAA,kBAWIJ,GAAgD,OCE7C,SAASK,GAAiBC,EAA4B,CAC3D,GAAI,CAACA,GAAYA,EAAS,SAAW,EAAG,MAAO,GAE/C,IAAMC,EAAkBD,EACrB,OAAQE,GAAMA,GAAK,OAAOA,GAAM,QAAQ,EACxC,IAAKA,GAAMA,EAAE,QAAQ,MAAO,GAAG,CAAC,EAEnC,GAAID,EAAgB,SAAW,EAAG,MAAO,GACzC,GAAIA,EAAgB,SAAW,EAAG,OAAOA,EAAgB,CAAC,EAE1D,IAAME,EAAeF,EAAgB,IAAKC,GAAMA,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO,CAAC,EACtEE,EAAiB,CAAC,EAClBC,EAAY,KAAK,IAAI,GAAGF,EAAa,IAAKD,GAAMA,EAAE,MAAM,CAAC,EAE/D,QAASI,EAAI,EAAGA,EAAID,EAAWC,IAAK,CAClC,IAAMC,EAAUJ,EAAa,CAAC,EAAEG,CAAC,EACjC,GAAIH,EAAa,MAAOK,GAAaA,EAASF,CAAC,IAAMC,CAAO,EAC1DH,EAAe,KAAKG,CAAO,MAE3B,MAEJ,CAEA,OAAOH,EAAe,KAAK,GAAG,CAChC,CAkBO,SAASK,EAAiBC,EAAsB,CACrD,OAAOA,EAAK,QAAQ,MAAO,GAAG,EAAE,QAAQ,OAAQ,GAAG,EAAE,QAAQ,OAAQ,EAAE,CACzE,CAzDA,IAAAC,GAAAC,EAAA,oBC4BO,SAASC,GACdC,EACAC,EAAiC,CAAC,EACpB,CAEd,GAAIA,EAAQ,UAAY,GACtB,OAAOD,EAAU,IAAKE,IAAU,CAC9B,KAAMC,EAAiBD,CAAI,EAC3B,KAAME,GAAgBF,CAAI,CAC5B,EAAE,EAIJ,IAAMG,EAAeC,GAAoBN,CAAS,EAElD,OAAOA,EAAU,IAAKO,GAAa,CACjC,IAAIC,EAAaL,EAAiBI,CAAQ,EAG1C,GAAIF,EAAc,CAChB,IAAMI,EAAiBJ,EAAa,SAAS,GAAG,EAAIA,EAAe,GAAGA,CAAY,IAC9EG,EAAW,WAAWC,CAAc,IACtCD,EAAaA,EAAW,UAAUC,EAAe,MAAM,EAE3D,CAGA,OAAKD,IACHA,EAAaJ,GAAgBG,CAAQ,GAGhC,CACL,KAAMC,EACN,KAAMJ,GAAgBG,CAAQ,CAChC,CACF,CAAC,CACH,CAWA,SAASD,GAAoBN,EAA6B,CACxD,GAAI,CAACA,EAAU,OAAQ,MAAO,GAM9B,IAAMU,EAHkBV,EAAU,IAAKE,GAASC,EAAiBD,CAAI,CAAC,EAGjC,IAAKA,GAASA,EAAK,MAAM,GAAG,CAAC,EAC5DS,EAA2B,CAAC,EAC5BC,EAAY,KAAK,IAAI,GAAGF,EAAa,IAAKG,GAAaA,EAAS,MAAM,CAAC,EAG7E,QAASC,EAAI,EAAGA,EAAIF,EAAY,EAAGE,IAAK,CAEtC,IAAMC,EAAUL,EAAa,CAAC,EAAEI,CAAC,EACjC,GAAIJ,EAAa,MAAOG,GAAaA,EAASC,CAAC,IAAMC,CAAO,EAC1DJ,EAAe,KAAKI,CAAO,MAE3B,MAEJ,CAEA,OAAOJ,EAAe,KAAK,GAAG,CAChC,CAKA,SAASP,GAAgBF,EAAsB,CAC7C,OAAOA,EAAK,MAAM,OAAO,EAAE,IAAI,GAAKA,CACtC,CAzGA,IAAAc,GAAAC,EAAA,kBAKAC,OCuBO,SAASC,EAAeC,EAAeC,EAAmB,EAAW,CAC1E,GAAID,IAAU,EAAG,MAAO,UACxB,IAAME,EAAI,KACJC,EAAQ,CAAC,QAAS,KAAM,KAAM,IAAI,EAClCC,EAAI,KAAK,MAAM,KAAK,IAAIJ,CAAK,EAAI,KAAK,IAAIE,CAAC,CAAC,EAClD,MAAO,GAAG,YAAYF,EAAQE,GAAKE,GAAG,QAAQH,CAAQ,CAAC,CAAC,IAAIE,EAAMC,CAAC,CAAC,EACtE,CAeO,SAASC,EAAiBC,EAAuD,CACtF,GAAIC,GAAeD,CAAQ,EACzB,MAAO,CAAE,MAAO,GAAO,OAAQ,sCAAuC,EAGxE,GAAIA,EAAS,WAAW,GAAG,GAAKA,EAAS,SAAS,GAAG,EACnD,MAAO,CAAE,MAAO,GAAO,OAAQ,wCAAyC,EAG1E,GAAIA,EAAS,SAAS,GAAG,EACvB,MAAO,CAAE,MAAO,GAAO,OAAQ,gCAAiC,EAGlE,IAAME,EAAgB,8CAChBC,EAAkBH,EAAS,MAAM,GAAG,EAAE,IAAI,GAAKA,EACrD,OAAIE,EAAc,KAAKC,CAAe,EAC7B,CAAE,MAAO,GAAO,OAAQ,uCAAwC,EAGrEH,EAAS,SAAS,IAAI,EACjB,CAAE,MAAO,GAAO,OAAQ,2CAA4C,EAGtE,CAAE,MAAO,EAAK,CACvB,CA+BO,SAASI,GACdC,EACAC,EACyB,CACzB,IAAMC,EAA4B,CAAC,EAC7BC,EAA8B,CAAC,EACjCC,EAAoB,CAAC,EAGzB,GAAIJ,EAAM,SAAW,EAAG,CACtB,IAAMK,EAAyB,CAC7B,KAAM,aACN,QAAS,oCACX,EACA,OAAAH,EAAO,KAAKG,CAAK,EAEV,CACL,MAAO,CAAC,EACR,WAAY,CAAC,EACb,OAAAH,EACA,SAAU,CAAC,EACX,UAAW,EACb,CACF,CAGA,QAAWI,KAAQN,EACjB,GAAIO,EAAiBD,EAAK,IAAI,EAC5B,OAAAJ,EAAO,KAAK,CACV,KAAMI,EAAK,KACX,QAAS,wGACX,CAAC,EACM,CACL,MAAON,EAAM,IAAKQ,IAAO,CACvB,GAAGA,EACH,OAAQC,EAAuB,kBAC/B,cAAe,0BACjB,EAAE,EACF,WAAY,CAAC,EACb,OAAAP,EACA,SAAU,CAAC,EACX,UAAW,EACb,EAKJ,GAAIF,EAAM,OAASC,EAAO,cAAe,CACvC,IAAMI,EAAyB,CAC7B,KAAM,IAAIL,EAAM,MAAM,UACtB,QAAS,eAAeA,EAAM,MAAM,sBAAsBC,EAAO,aAAa,EAChF,EACA,OAAAC,EAAO,KAAKG,CAAK,EAEV,CACL,MAAOL,EAAM,IAAKQ,IAAO,CACvB,GAAGA,EACH,OAAQC,EAAuB,kBAC/B,cAAeJ,EAAM,OACvB,EAAE,EACF,WAAY,CAAC,EACb,OAAAH,EACA,SAAU,CAAC,EACX,UAAW,EACb,CACF,CAGA,IAAIQ,EAAY,EAEhB,QAAWJ,KAAQN,EAAO,CACxB,IAAIW,EAAuCF,EAAuB,MAC9DG,EAAgB,mBAGdC,EAAiBP,EAAK,KACxBZ,EAAiBY,EAAK,IAAI,EAC1B,CAAE,MAAO,GAAO,OAAQ,2BAA4B,EAGxD,GAAIA,EAAK,SAAWG,EAAuB,iBACzCE,EAAaF,EAAuB,kBACpCG,EAAgBN,EAAK,eAAiB,gCACtCJ,EAAO,KAAK,CACV,KAAMI,EAAK,KACX,QAASM,CACX,CAAC,UAIMN,EAAK,OAAS,EAAG,CACxBK,EAAaF,EAAuB,SACpCG,EAAgB,4EAChBT,EAAS,KAAK,CACZ,KAAMG,EAAK,KACX,QAASM,CACX,CAAC,EAEDR,EAAa,KAAK,CAChB,GAAGE,EACH,OAAQK,EACR,cAAAC,CACF,CAAC,EACD,QACF,MAGSN,EAAK,KAAO,GACnBK,EAAaF,EAAuB,kBACpCG,EAAgB,6BAChBV,EAAO,KAAK,CACV,KAAMI,EAAK,KACX,QAASM,CACX,CAAC,GAIM,CAACN,EAAK,MAAQA,EAAK,KAAK,KAAK,EAAE,SAAW,GACjDK,EAAaF,EAAuB,kBACpCG,EAAgB,4BAChBV,EAAO,KAAK,CACV,KAAMI,EAAK,MAAQ,UACnB,QAASM,CACX,CAAC,GACQN,EAAK,KAAK,SAAS,IAAI,GAChCK,EAAaF,EAAuB,kBACpCG,EAAgB,oDAChBV,EAAO,KAAK,CACV,KAAMI,EAAK,KACX,QAASM,CACX,CAAC,GACSC,EAAe,MAUlBC,EAAmBR,EAAK,IAAI,GACnCK,EAAaF,EAAuB,kBACpCG,EAAgB,gCAAgCN,EAAK,IAAI,IACzDJ,EAAO,KAAK,CACV,KAAMI,EAAK,KACX,QAASM,CACX,CAAC,GAIMN,EAAK,KAAOL,EAAO,aAC1BU,EAAaF,EAAuB,kBACpCG,EAAgB,cAAcxB,EAAekB,EAAK,IAAI,CAAC,sBAAsBlB,EAAea,EAAO,WAAW,CAAC,GAC/GC,EAAO,KAAK,CACV,KAAMI,EAAK,KACX,QAASM,CACX,CAAC,IAKDF,GAAaJ,EAAK,KACdI,EAAYT,EAAO,eACrBU,EAAaF,EAAuB,kBACpCG,EAAgB,oCAAoCxB,EAAea,EAAO,YAAY,CAAC,GACvFC,EAAO,KAAK,CACV,KAAMI,EAAK,KACX,QAASM,CACX,CAAC,KArCHD,EAAaF,EAAuB,kBACpCG,EAAgBC,EAAe,QAAU,oBACzCX,EAAO,KAAK,CACV,KAAMI,EAAK,KACX,QAASM,CACX,CAAC,GAoCHR,EAAa,KAAK,CAChB,GAAGE,EACH,OAAQK,EACR,cAAAC,CACF,CAAC,CACH,CASIV,EAAO,OAAS,IAClBE,EAAeA,EAAa,IAAKE,GAE3BA,EAAK,SAAWG,EAAuB,SAClCH,EAIF,CACL,GAAGA,EACH,OAAQG,EAAuB,kBAC/B,cACEH,EAAK,SAAWG,EAAuB,kBACnCH,EAAK,cACL,sDACR,CACD,GAKH,IAAMS,EACJb,EAAO,SAAW,EACdE,EAAa,OAAQI,GAAMA,EAAE,SAAWC,EAAuB,KAAK,EACpE,CAAC,EACDO,EAAYd,EAAO,SAAW,EAEpC,MAAO,CACL,MAAOE,EACP,WAAAW,EACA,OAAAb,EACA,SAAAC,EACA,UAAAa,CACF,CACF,CAKO,SAASC,GAAyCjB,EAAiB,CACxE,OAAOA,EAAM,OAAQQ,GAAMA,EAAE,SAAWC,EAAuB,KAAK,CACtE,CAMO,SAASS,GAA8ClB,EAAqB,CAEjF,OADmBiB,GAAcjB,CAAK,EACpB,OAAS,CAC7B,CArVA,IAAAmB,GAAAC,EAAA,kBAYAC,MC+DO,SAASC,GAAWC,EAAqBC,EAAgD,CAC9F,GAAI,CAACD,GAAaA,EAAU,SAAW,EACrC,MAAO,CAAC,EAMV,GAAI,CAACC,GAAS,cACGD,EAAU,KAAME,GAAMA,GAAKC,EAAiBD,CAAC,CAAC,EAE3D,MAAME,EAAU,SACd,wGACF,EAIJ,OAAOJ,EAAU,OAAQK,GAAa,CACpC,GAAI,CAACA,EACH,MAAO,GAIT,IAAMC,EAAQD,EAAS,QAAQ,MAAO,GAAG,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO,EACpE,GAAIC,EAAM,SAAW,EAAG,MAAO,GAG/B,IAAMC,EAAWD,EAAMA,EAAM,OAAS,CAAC,EACvC,MAAI,WAAOC,CAAQ,EACjB,MAAO,GAMT,QAAWC,KAAQF,EACjB,GAAIE,IAAS,gBACTA,EAAK,WAAW,GAAG,GAAKA,EAAK,OAAS,KACxC,MAAO,GAKX,IAAMC,EAAoBH,EAAM,MAAM,EAAG,EAAE,EAC3C,QAAWI,KAAWD,EACpB,GAAIE,GAAiB,KAAMC,GAAYF,EAAQ,YAAY,IAAME,EAAQ,YAAY,CAAC,EACpF,MAAO,GAIX,MAAO,EACT,CAAC,CACH,CA/HA,IASAC,GAUaF,GAnBbG,GAAAC,EAAA,kBAQAC,IACAH,GAAuB,gBAUVF,GAAmB,CAAC,WAAY,WAAY,aAAc,iBAAiB,ICIjF,SAASM,GAAmBC,EAAoBC,EAAgC,CACrF,GACED,EAAW,SAAS,IAAI,GACxBA,EAAW,SAAS,MAAM,GAC1BA,EAAW,WAAW,KAAK,GAC3BA,EAAW,SAAS,KAAK,EAEzB,MAAME,EAAU,SACd,qCAAqCF,CAAU,eAAeC,CAAgB,EAChF,CAEJ,CAWO,SAASE,GAAmBH,EAAoBC,EAAgC,CACrF,IAAMG,EAAYC,EAAiBL,CAAU,EAC7C,GAAI,CAACI,EAAU,MACb,MAAMF,EAAU,SAASE,EAAU,QAAU,mBAAmB,EAGlE,GAAIE,EAAmBN,CAAU,EAC/B,MAAME,EAAU,SAAS,gCAAgCD,CAAgB,GAAG,CAEhF,CAtDA,IAAAM,GAAAC,EAAA,kBAIAC,IACAC,OCLA,IAAAC,GAAA,GAAAC,GAAAD,GAAA,yBAAAE,KAwBA,SAASC,GAAiBC,EAAiBC,EAAuB,IAAI,IAAiB,CACrF,IAAMC,EAAoB,CAAC,EAGrBC,EAAc,eAAaH,CAAO,EACxC,GAAIC,EAAQ,IAAIE,CAAQ,EAEtB,OAAOD,EAETD,EAAQ,IAAIE,CAAQ,EAEpB,IAAMC,EAAa,cAAYJ,CAAO,EAEtC,QAAWK,KAASD,EAAS,CAC3B,IAAME,EAAgB,OAAKN,EAASK,CAAK,EACnCE,EAAW,WAASD,CAAQ,EAElC,GAAIC,EAAM,YAAY,EAAG,CACvB,IAAMC,EAAWT,GAAiBO,EAAUL,CAAO,EACnDC,EAAQ,KAAK,GAAGM,CAAQ,CAC1B,MAAWD,EAAM,OAAO,GACtBL,EAAQ,KAAKI,CAAQ,CAEzB,CAEA,OAAOJ,CACT,CAgBA,eAAsBJ,GACpBW,EACAC,EAA6B,CAAC,EAC9BC,EACuB,CACvB,GAAIC,EAAO,IAAM,OACf,MAAMC,EAAU,SAAS,gEAAgE,EAI3F,QAAWC,KAAKL,EAAO,CACrB,IAAMM,EAAe,UAAQD,CAAC,EAC9B,GAAI,CACF,GAAO,WAASC,CAAO,EAAE,YAAY,EAAG,CACtC,IAAMC,EAAY,cAAYD,CAAO,EAAE,KAAME,GAAMC,EAAwB,IAAID,CAAC,CAAC,EACjF,GAAID,EACF,MAAMH,EAAU,SACd,IAAIG,CAAM,0FACZ,CAEJ,CACF,OAASC,EAAG,CACV,GAAIE,EAAYF,CAAC,EAAG,MAAMA,CAE5B,CACF,CAGA,IAAMG,EAAgBX,EAAM,QAASK,GAAM,CACzC,IAAMC,EAAe,UAAQD,CAAC,EAC9B,GAAI,CAEF,OADiB,WAASC,CAAO,EACpB,YAAY,EAAIhB,GAAiBgB,CAAO,EAAI,CAACA,CAAO,CACnE,MAAiB,CACf,MAAMF,EAAU,KAAK,wBAAwBC,CAAC,GAAI,CAAE,SAAUA,CAAE,CAAC,CACnE,CACF,CAAC,EACKO,EAAc,CAAC,GAAG,IAAI,IAAID,CAAa,CAAC,EAGxCE,EAAqBb,EAAM,IAAKK,GAAW,UAAQA,CAAC,CAAC,EACrDS,EAAgBC,GACpBF,EAAmB,IAAKR,GAAM,CAC5B,GAAI,CAEF,OADiB,WAASA,CAAC,EACd,YAAY,EAAIA,EAAS,UAAQA,CAAC,CACjD,MAAQ,CACN,OAAY,UAAQA,CAAC,CACvB,CACF,CAAC,CACH,EAGMW,EAAeJ,EAAY,IAAKN,GAAY,CAChD,GAAIQ,GAAiBA,EAAc,OAAS,EAAG,CAC7C,IAAMG,EAAW,WAASH,EAAeR,CAAO,EAChD,GAAIW,GAAO,OAAOA,GAAQ,UAAY,CAACA,EAAI,WAAW,IAAI,EACxD,OAAOA,EAAI,QAAQ,MAAO,GAAG,CAEjC,CACA,OAAY,WAASX,CAAO,CAC9B,CAAC,EAMKY,EAHcC,GAAoBH,EAAc,CACpD,QAASf,EAAQ,aAAe,EAClC,CAAC,EAC+B,IAAKmB,GAAMA,EAAE,IAAI,EAG3CC,EAAc,IAAI,IAAIC,GAAWJ,CAAW,CAAC,EACnD,GAAIG,EAAY,OAAS,EACvB,MAAO,CAAC,EAIV,IAAME,EAA0B,CAAC,EAC3BC,EAA6B,CAAC,EACpC,QAASC,EAAI,EAAGA,EAAIb,EAAY,OAAQa,IAClCJ,EAAY,IAAIH,EAAYO,CAAC,CAAC,IAChCF,EAAc,KAAKX,EAAYa,CAAC,CAAC,EACjCD,EAAiB,KAAKN,EAAYO,CAAC,CAAC,GAKxC,IAAMhC,EAAwB,CAAC,EAC3BiC,EAAY,EAChB,GAAI,CAACxB,EACH,MAAME,EAAU,OACd,uHAEF,EAGF,QAASqB,EAAI,EAAGA,EAAIF,EAAc,OAAQE,IAAK,CAC7C,IAAME,EAAWJ,EAAcE,CAAC,EAC1BG,EAAaJ,EAAiBC,CAAC,EAErC,GAAI,CAEFI,GAAmBD,EAAYD,CAAQ,EAEvC,IAAM7B,EAAW,WAAS6B,CAAQ,EAGlC,GAAI7B,EAAM,OAAS,EACjB,SAOF,GAHAgC,GAAmBF,EAAYD,CAAQ,EAGnC7B,EAAM,KAAOI,EAAe,YAC9B,MAAME,EAAU,SACd,QAAQuB,CAAQ,0CAA0CzB,EAAe,aAAe,KAAO,KAAK,KACtG,EAGF,GADAwB,GAAa5B,EAAM,KACf4B,EAAYxB,EAAe,aAC7B,MAAME,EAAU,SACd,sDAAsDF,EAAe,cAAgB,KAAO,KAAK,KACnG,EAGF,IAAM6B,EAAa,eAAaJ,CAAQ,EAClC,CAAE,IAAAK,EAAI,EAAI,MAAMC,EAAaF,CAAO,EAE1CtC,EAAQ,KAAK,CACX,KAAMmC,EACN,QAAAG,EACA,KAAMA,EAAQ,OACd,IAAAC,EACF,CAAC,CACH,OAASE,EAAO,CAEd,GAAIxB,EAAYwB,CAAK,EACnB,MAAMA,EAGR,IAAMC,EAAeD,aAAiB,MAAQA,EAAM,QAAU,OAAOA,CAAK,EAC1E,MAAM9B,EAAU,KAAK,wBAAwBuB,CAAQ,MAAMQ,CAAY,GAAI,CAAE,SAAAR,CAAS,CAAC,CACzF,CACF,CAGA,GAAIlC,EAAQ,OAASS,EAAe,cAClC,MAAME,EAAU,SACd,gDAAgDF,EAAe,aAAa,SAC9E,EAGF,OAAOT,CACT,CA5NA,IAKA2C,EACAC,EANAC,GAAAC,EAAA,kBAKAH,EAAoB,mBACpBC,EAAsB,qBAEtBG,IACAC,KACAC,IACAC,KACAC,IACAC,KACAC,OCdA,IAAAC,GAAA,GAAAC,GAAAD,GAAA,aAAAE,GAAA,cAAAC,EAAA,mBAAAC,GAAA,gBAAAC,GAAA,YAAAC,EAAA,eAAAC,GAAA,uBAAAC,GAAA,WAAAC,EAAA,gBAAAC,EAAA,+BAAAC,EAAA,iBAAAC,GAAA,qBAAAC,GAAA,iBAAAC,GAAA,cAAAC,EAAA,2BAAAC,EAAA,yBAAAA,EAAA,gCAAAC,GAAA,qBAAAC,GAAA,sBAAAC,EAAA,kBAAAC,GAAA,eAAAC,GAAA,yBAAAC,EAAA,uBAAAC,GAAA,SAAAC,EAAA,cAAAC,EAAA,cAAAC,EAAA,4BAAAC,EAAA,0BAAAC,GAAA,yBAAAC,GAAA,uBAAAC,GAAA,yBAAAC,GAAA,iBAAAC,EAAA,kBAAAC,GAAA,0BAAAC,GAAA,6BAAAC,GAAA,yBAAAC,GAAA,wBAAAC,GAAA,YAAAC,GAAA,sBAAAC,GAAA,qBAAAC,GAAA,eAAAC,GAAA,mBAAAC,EAAA,0BAAAC,GAAA,sBAAAC,GAAA,WAAAC,EAAA,kBAAAC,GAAA,qBAAAC,EAAA,mBAAAC,GAAA,uBAAAC,EAAA,mBAAAC,GAAA,iBAAAC,GAAA,qBAAAC,GAAA,gBAAAC,EAAA,wBAAAC,GAAA,cAAAC,GAAA,wBAAAC,GAAA,oBAAAC,GAAA,mBAAAC,GAAA,mBAAAC,GAAA,mBAAAC,GAAA,uBAAAC,GAAA,uBAAAC,GAAA,wBAAAC,GAAA,qBAAAC,EAAA,kBAAAC,GAAA,2BAAAC,GAAA,qBAAAC,EAAA,kBAAAC,IAAA,eAAAC,GAAArE,ICgBAsE,ICWAC,ICCAC,ICdO,IAAMC,EAAN,KAAmB,CAAnB,cAEL,KAAQ,SAAW,IAAI,IAKvB,GAA+BC,EAAUC,EAAiD,CACnF,KAAK,SAAS,IAAID,CAAe,GACpC,KAAK,SAAS,IAAIA,EAAiB,IAAI,GAAK,EAE9C,KAAK,SAAS,IAAIA,CAAe,GAAG,IAAIC,CAAO,CACjD,CAKA,IAAgCD,EAAUC,EAAiD,CACzF,IAAMC,EAAgB,KAAK,SAAS,IAAIF,CAAe,EACnDE,IACFA,EAAc,OAAOD,CAAO,EACxBC,EAAc,OAAS,GACzB,KAAK,SAAS,OAAOF,CAAe,EAG1C,CAMA,KAAiCA,KAAaG,EAA2B,CACvE,IAAMD,EAAgB,KAAK,SAAS,IAAIF,CAAe,EACvD,GAAI,CAACE,EAAe,OAIpB,IAAME,EAAe,MAAM,KAAKF,CAAa,EAE7C,QAAWD,KAAWG,EACpB,GAAI,CACFH,EAAQ,GAAGE,CAAI,CACjB,OAASE,EAAO,CAKdH,EAAc,OAAOD,CAAO,EAExBD,IAAU,SACZ,WAAW,IAAM,CACf,IAAMM,EAAMD,aAAiB,MAAQA,EAAQ,IAAI,MAAM,OAAOA,CAAK,CAAC,EACpE,KAAK,KAAK,QAASC,EAAK,OAAON,CAAK,CAAC,CACvC,EAAG,CAAC,CAER,CAEJ,CACF,ECtDAO,IAYAA,IAYO,SAASC,EAAeC,EAA2D,CACxF,GAA4BA,GAAW,KAAM,OAC7C,GAAIA,EAAO,SAAW,EAAG,OAAOA,EAEhC,GAAIA,EAAO,OAASC,EAAkB,UACpC,MAAMC,EAAU,WAAW,WAAWD,EAAkB,SAAS,iBAAiB,EAGpF,IAAME,EAAaH,EAAO,IAAI,CAACI,EAAOC,IAAM,CAC1C,GAAI,OAAOD,GAAU,SACnB,MAAMF,EAAU,WAAW,kBAAkBG,CAAC,mBAAmB,EAEnE,IAAMC,EAAUF,EAAM,KAAK,EAAE,YAAY,EACzC,GAAIE,EAAQ,OAASL,EAAkB,WACrC,MAAMC,EAAU,WACd,2BAA2BD,EAAkB,UAAU,kBACzD,EAEF,GAAIK,EAAQ,OAASL,EAAkB,WACrC,MAAMC,EAAU,WACd,+BAA+BD,EAAkB,UAAU,kBAC7D,EAEF,GAAI,CAACM,GAAc,KAAKD,CAAO,EAC7B,MAAMJ,EAAU,WACd,qFAAqFD,EAAkB,UAAU,oBACnH,EAEF,OAAOK,CACT,CAAC,EAEKE,EAAS,CAAC,GAAG,IAAI,IAAIL,CAAU,CAAC,EACtC,GAAIK,EAAO,SAAWL,EAAW,OAC/B,MAAMD,EAAU,WAAW,kCAAkC,EAG/D,OAAOM,CACT,CAiBA,eAAsBC,GAAqBC,EAAoC,CAC7E,IAAMC,EAASD,EAAM,KAClBE,GAAMA,EAAE,OAASC,GAA8BD,EAAE,OAAS,IAAIC,CAA0B,EAC3F,EACA,GAAI,CAACF,EAAQ,OAIb,IAAMG,EAAUH,EAAO,QACjBI,EACJ,OAAOD,EAAQ,MAAS,WACpB,MAAMA,EAAQ,KAAK,EAClBH,EAAO,QAAmB,SAAS,MAAM,EAEhDK,GAAqBD,CAAI,CAC3B,CFpEA,IAAME,GAA0B,IAgB1BC,GAAyB,IAWzBC,GAAuB,IAWvBC,GAA+BF,GAAyBC,GAexDE,GAAa,MAMnB,SAASC,GAAUC,EAA+B,CAChD,IAAMC,EAAS,IAAI,gBACfD,GAAS,QAAU,QAAWC,EAAO,IAAI,QAAS,OAAOD,EAAQ,KAAK,CAAC,EACvEA,GAAS,SAAW,QAAWC,EAAO,IAAI,SAAUD,EAAQ,MAAM,EACtE,IAAME,EAAQD,EAAO,SAAS,EAC9B,OAAOC,EAAQ,IAAIA,CAAK,GAAK,EAC/B,CAqBO,IAAMC,EAAN,cAAsBC,CAAa,CAexC,YAAYJ,EAAyB,CACnC,MAAM,EAHR,KAAQ,cAAwC,CAAC,EAI/C,KAAK,OAASA,EAAQ,QAAUK,EAChC,KAAK,uBAAyBL,EAAQ,eACtC,KAAK,QAAUA,EAAQ,SAAW,GAClC,KAAK,OAASA,EAAQ,OACtB,KAAK,QAAUA,EAAQ,SAAWN,GAIlC,KAAK,cAAgBM,EAAQ,SAAWL,GACxC,KAAK,mBAAqBK,EAAQ,SAAWH,GAI7C,KAAK,MAAQG,EAAQ,OAAS,WAAW,MAAM,KAAK,UAAU,EAC9D,KAAK,iBAAmBA,EAAQ,iBAChC,KAAK,eAAiBA,EAAQ,gBAAkBM,EAAU,WAC5D,CAMA,iBAAiBC,EAAuC,CACtD,KAAK,cAAgBA,CACvB,CASA,MAAc,eACZC,EACAR,EACAS,EACAC,EAAoB,KAAK,QACE,CAC3B,IAAIC,EAAU,IAAM,CAAC,EAErB,GAAI,CAIF,IAAMJ,EAAU,MAAM,KAAK,aAAaP,EAAQ,OAAiC,EAC3EY,EAAU,KAAK,oBAAoBZ,EAAQ,OAAQU,CAAS,EAClEC,EAAUC,EAAQ,QAElB,IAAMC,EAA4B,CAChC,GAAGb,EACH,QAAAO,EACA,YAAa,KAAK,SAAW,CAACA,EAAQ,cAAgB,UAAY,OAClE,OAAQK,EAAQ,MAClB,EAEA,KAAK,KAAK,UAAWJ,EAAKK,CAAY,EAEtC,IAAMC,EAAW,MAAM,KAAK,MAAMN,EAAKK,CAAY,EAGnD,GAFAF,EAAQ,EAEJ,CAACG,EAAS,GACZ,MAAM,MAAMC,EAAU,iBAAiBD,EAAUL,CAAa,EAGhE,YAAK,KAAK,WAAY,KAAK,UAAUK,CAAQ,EAAGN,CAAG,EAE5C,CAAE,KADI,MAAM,KAAK,cAAiB,KAAK,UAAUM,CAAQ,CAAC,EAClD,OAAQA,EAAS,MAAO,CACzC,OAASE,EAAO,CACdL,EAAQ,EAIR,IAAMM,EAAYF,EAAU,eAAeC,EAAOP,CAAa,EAC/D,WAAK,KAAK,QAASQ,EAAWT,CAAG,EAC3BS,CACR,CACF,CAKA,MAAc,QACZT,EACAR,EACAS,EACAC,EACY,CACZ,GAAM,CAAE,KAAAQ,CAAK,EAAI,MAAM,KAAK,eAAkBV,EAAKR,EAASS,EAAeC,CAAS,EACpF,OAAOQ,CACT,CAKA,MAAc,kBACZV,EACAR,EACAS,EAC2B,CAC3B,OAAO,KAAK,eAAkBD,EAAKR,EAASS,CAAa,CAC3D,CAMA,MAAc,aACZU,EAAwC,CAAC,EACR,CAIjC,MAAO,CACL,GAAG,KAAK,cACR,GAAI,KAAK,OAAS,CAAE,WAAY,KAAK,MAAO,EAAI,CAAC,EACjD,GAAI,MAAM,KAAK,uBAAuB,EACtC,GAAGA,CACL,CACF,CAEQ,oBACNC,EACAV,EAAoB,KAAK,QAIzB,CACA,IAAMW,EAAa,IAAI,gBACjBC,EAAY,WAAW,IAAMD,EAAW,MAAM,EAAGX,CAAS,EAEhE,GAAIU,EAAgB,CAClB,IAAMG,EAAQ,IAAMF,EAAW,MAAM,EACrCD,EAAe,iBAAiB,QAASG,CAAK,EAC1CH,EAAe,SAASC,EAAW,MAAM,CAC/C,CAEA,MAAO,CACL,OAAQA,EAAW,OACnB,QAAS,IAAM,aAAaC,CAAS,CACvC,CACF,CAEQ,UAAUR,EAA8B,CAC9C,GAAI,CACF,OAAOA,EAAS,MAAM,CACxB,MAAQ,CACN,OAAOA,CACT,CACF,CAEA,MAAc,cAAiBA,EAAgC,CAC7D,GAAI,EAAAA,EAAS,QAAQ,IAAI,gBAAgB,IAAM,KAAOA,EAAS,SAAW,KAG1E,OAAOA,EAAS,KAAK,CACvB,CAMA,MAAM,OACJU,EACAxB,EAA4B,CAAC,EACM,CACnC,GAAI,CAACwB,EAAM,OACT,MAAMT,EAAU,SAAS,oBAAoB,EAE/C,QAAWU,KAAQD,EACjB,GAAI,CAACC,EAAK,IACR,MAAMV,EAAU,KAAK,kCAAkCU,EAAK,IAAI,GAAI,CAClE,SAAUA,EAAK,IACjB,CAAC,EAKLC,EAAiB1B,EAAQ,QAAQ,EACjC,IAAM2B,EAAiBC,GAAuB5B,EAAQ,cAAc,EAC9D6B,EAASC,EAAe9B,EAAQ,MAAM,EAC5C,MAAM+B,GAAqBP,CAAK,EAEhC,IAAMQ,EACJhC,EAAQ,OAASA,EAAQ,WAAaA,EAAQ,IAC1C,CAAE,MAAOA,EAAQ,MAAO,UAAWA,EAAQ,UAAW,IAAKA,EAAQ,GAAI,EACvE,OACA,CAAE,KAAAiC,EAAM,QAASC,CAAY,EAAI,MAAM,KAAK,iBAAiBV,EAAO,CACxE,OAAAK,EACA,IAAK7B,EAAQ,KAAOF,GACpB,SAAUE,EAAQ,SAClB,MAAAgC,EACA,QAAShC,EAAQ,OACnB,CAAC,EAKD,OAAO,KAAK,QACV,GAAG,KAAK,MAAM,GAAG,KAAK,cAAc,GACpC,CACE,OAAQ,OACR,KAAAiC,EACA,QAASN,EACL,CAAE,GAAGO,EAAa,kBAAmBP,CAAe,EACpDO,EACJ,OAAQlC,EAAQ,QAAU,IAC5B,EACA,SAKAA,EAAQ,OAASA,EAAQ,UAAY,KAAK,mBAAqB,KAAK,aACtE,CACF,CAEA,MAAM,gBAAgBA,EAAwD,CAC5E,OAAO,KAAK,QACV,GAAG,KAAK,MAAM,GAAGM,EAAU,WAAW,GAAGP,GAAUC,CAAO,CAAC,GAC3D,CAAE,OAAQ,KAAM,EAChB,kBACF,CACF,CAEA,MAAM,cAAcmC,EAAiC,CACnD,OAAO,KAAK,QACV,GAAG,KAAK,MAAM,GAAG7B,EAAU,WAAW,mBAAmB6B,CAAE,CAAC,CAAC,GAC7D,CAAE,OAAQ,KAAM,EAChB,gBACF,CACF,CAEA,MAAM,uBAAuBA,EAAYN,EAAuC,CAC9E,IAAMO,EAAaN,EAAeD,CAAM,EACxC,OAAO,KAAK,QACV,GAAG,KAAK,MAAM,GAAGvB,EAAU,WAAW,mBAAmB6B,CAAE,CAAC,CAAC,GAC7D,CACE,OAAQ,QACR,QAAS,CAAE,eAAgB,kBAAmB,EAC9C,KAAM,KAAK,UAAU,CAAE,OAAQC,CAAW,CAAC,CAC7C,EACA,0BACF,CACF,CAEA,MAAM,iBAAiBD,EAA+C,CACpE,OAAO,KAAK,QACV,GAAG,KAAK,MAAM,GAAG7B,EAAU,WAAW,mBAAmB6B,CAAE,CAAC,CAAC,GAC7D,CAAE,OAAQ,QAAS,EACnB,mBACF,CACF,CAQA,MAAM,UAAUE,EAAcC,EAAqBT,EAA6C,CAC9F,IAAMO,EAAaN,EAAeD,CAAM,EAClCI,EAAmD,CAAC,EACtDK,IAAYL,EAAK,WAAaK,GAC9BF,IAAe,SAAWH,EAAK,OAASG,GAE5C,GAAM,CAAE,KAAAlB,EAAM,OAAAqB,CAAO,EAAI,MAAM,KAAK,kBAClC,GAAG,KAAK,MAAM,GAAGjC,EAAU,OAAO,mBAAmB+B,CAAI,CAAC,CAAC,GAC3D,CACE,OAAQ,MACR,QAAS,CAAE,eAAgB,kBAAmB,EAC9C,KAAM,KAAK,UAAUJ,CAAI,CAC3B,EACA,YACF,EAEA,MAAO,CAAE,GAAGf,EAAM,SAAUqB,IAAW,GAAI,CAC7C,CAEA,MAAM,YAAYvC,EAAoD,CACpE,OAAO,KAAK,QACV,GAAG,KAAK,MAAM,GAAGM,EAAU,OAAO,GAAGP,GAAUC,CAAO,CAAC,GACvD,CAAE,OAAQ,KAAM,EAChB,cACF,CACF,CAEA,MAAM,UAAUqC,EAA+B,CAC7C,OAAO,KAAK,QACV,GAAG,KAAK,MAAM,GAAG/B,EAAU,OAAO,mBAAmB+B,CAAI,CAAC,CAAC,GAC3D,CAAE,OAAQ,KAAM,EAChB,YACF,CACF,CAEA,MAAM,aAAaA,EAA6C,CAC9D,OAAO,KAAK,QACV,GAAG,KAAK,MAAM,GAAG/B,EAAU,OAAO,mBAAmB+B,CAAI,CAAC,CAAC,GAC3D,CAAE,OAAQ,QAAS,EACnB,eACF,CACF,CAEA,MAAM,aAAaA,EAA6C,CAC9D,OAAO,KAAK,QACV,GAAG,KAAK,MAAM,GAAG/B,EAAU,cAAc,mBAAmB+B,CAAI,CAAC,CAAC,GAClE,CAAE,OAAQ,MAAO,EACjB,eACF,CACF,CAEA,MAAM,aAAaA,EAA0C,CAC3D,OAAO,KAAK,QACV,GAAG,KAAK,MAAM,GAAG/B,EAAU,WAAW,mBAAmB+B,CAAI,CAAC,CAAC,GAC/D,CAAE,OAAQ,KAAM,EAChB,gBACF,CACF,CAEA,MAAM,iBAAiBA,EAA8C,CACnE,OAAO,KAAK,QACV,GAAG,KAAK,MAAM,GAAG/B,EAAU,eAAe,mBAAmB+B,CAAI,CAAC,CAAC,GACnE,CAAE,OAAQ,KAAM,EAChB,oBACF,CACF,CAEA,MAAM,eAAeA,EAA4C,CAC/D,OAAO,KAAK,QACV,GAAG,KAAK,MAAM,GAAG/B,EAAU,aAAa,mBAAmB+B,CAAI,CAAC,CAAC,GACjE,CAAE,OAAQ,KAAM,EAChB,kBACF,CACF,CAEA,MAAM,eAAeA,EAA+C,CAClE,OAAO,KAAK,QACV,GAAG,KAAK,MAAM,GAAG/B,EAAU,gBAAgB,GAC3C,CACE,OAAQ,OACR,QAAS,CAAE,eAAgB,kBAAmB,EAC9C,KAAM,KAAK,UAAU,CAAE,OAAQ+B,CAAK,CAAC,CACvC,EACA,iBACF,CACF,CAMA,MAAM,YAAYG,EAAcX,EAAiD,CAC/E,IAAMO,EAAaN,EAAeD,CAAM,EAClCI,EAA4C,CAAC,EACnD,OAAIO,IAAQ,SAAWP,EAAK,IAAMO,GAC9BJ,IAAe,SAAWH,EAAK,OAASG,GAErC,KAAK,QACV,GAAG,KAAK,MAAM,GAAG9B,EAAU,MAAM,GACjC,CACE,OAAQ,OACR,QAAS,CAAE,eAAgB,kBAAmB,EAC9C,KAAM,KAAK,UAAU2B,CAAI,CAC3B,EACA,cACF,CACF,CAEA,MAAM,WAAWjC,EAAmD,CAClE,OAAO,KAAK,QACV,GAAG,KAAK,MAAM,GAAGM,EAAU,MAAM,GAAGP,GAAUC,CAAO,CAAC,GACtD,CAAE,OAAQ,KAAM,EAChB,aACF,CACF,CAEA,MAAM,YAAYyC,EAA6C,CAC7D,OAAO,KAAK,QACV,GAAG,KAAK,MAAM,GAAGnC,EAAU,MAAM,mBAAmBmC,CAAK,CAAC,CAAC,GAC3D,CAAE,OAAQ,QAAS,EACnB,cACF,CACF,CAEA,MAAM,SAASA,EAA+B,CAC5C,OAAO,KAAK,QACV,GAAG,KAAK,MAAM,GAAGnC,EAAU,MAAM,mBAAmBmC,CAAK,CAAC,CAAC,GAC3D,CAAE,OAAQ,KAAM,EAChB,WACF,CACF,CAMA,MAAM,YAA0C,CAC9C,OAAO,KAAK,QAAQ,GAAG,KAAK,MAAM,GAAGnC,EAAU,OAAO,GAAI,CAAE,OAAQ,KAAM,EAAG,aAAa,CAC5F,CAEA,MAAM,WAAqC,CACzC,OAAO,KAAK,QAAQ,GAAG,KAAK,MAAM,GAAGA,EAAU,MAAM,GAAI,CAAE,OAAQ,KAAM,EAAG,YAAY,CAC1F,CAEA,MAAM,MAA8B,CAClC,OAAO,KAAK,QAAsB,GAAG,KAAK,MAAM,GAAGA,EAAU,IAAI,GAAI,CAAE,OAAQ,KAAM,EAAG,MAAM,CAChG,CAMA,MAAM,SAASkB,EAAqBkB,EAA6B,CAAC,EAAqB,CACrF,IAAMC,EAAYnB,EAAM,KAAMoB,GAAMA,EAAE,OAAS,cAAgBA,EAAE,OAAS,aAAa,EACvF,GAAI,CAACD,GAAaA,EAAU,KAAO,IAAM,KACvC,MAAO,GAGT,IAAIE,EACJ,GAAI,OAAO,OAAW,KAAe,OAAO,SAASF,EAAU,OAAO,EACpEE,EAAeF,EAAU,QAAQ,SAAS,OAAO,UACxC,OAAO,KAAS,KAAeA,EAAU,mBAAmB,KACrEE,EAAe,MAAMF,EAAU,QAAQ,KAAK,UACnC,OAAO,KAAS,KAAeA,EAAU,mBAAmB,KACrEE,EAAe,MAAMF,EAAU,QAAQ,KAAK,MAE5C,OAAO,GAGT,IAAMV,EAAwB,CAAE,MAAOT,EAAM,IAAKoB,GAAMA,EAAE,IAAI,EAAG,MAAOC,CAAa,EAWrF,OAViB,MAAM,KAAK,QAC1B,GAAG,KAAK,MAAM,GAAGvC,EAAU,SAAS,GACpC,CACE,OAAQ,OACR,QAAS,CAAE,eAAgB,kBAAmB,EAC9C,KAAM,KAAK,UAAU2B,CAAI,CAC3B,EACA,WACF,GAEgB,KAClB,CACF,EGzkBAa,ICIAC,IAGAC,IAMA,eAAsBC,IAAuC,CAC3D,IAAMC,EAAe,KAAK,UAAUC,GAAoB,KAAM,CAAC,EAG3DC,EACA,OAAO,OAAW,IAEpBA,EAAU,OAAO,KAAKF,EAAc,OAAO,EAG3CE,EAAU,IAAI,KAAK,CAACF,CAAY,EAAG,CAAE,KAAM,kBAAmB,CAAC,EAGjE,GAAM,CAAE,IAAAG,CAAI,EAAI,MAAMC,EAAaF,CAAO,EAE1C,MAAO,CACL,KAAMG,EACN,QAAAH,EACA,KAAMF,EAAa,OACnB,IAAAG,CACF,CACF,CAWA,eAAsBG,GACpBC,EACAC,EACAC,EACuB,CAEvB,GACEA,EAAQ,YAAc,IACtBA,EAAQ,KACRA,EAAQ,OACRA,EAAQ,WACRF,EAAM,KAAMG,GAAMA,EAAE,OAASL,CAA0B,EAEvD,OAAOE,EAGT,GAAI,CAGF,GAFc,MAAMC,EAAU,SAASD,EAAOE,CAAO,EAE1C,CACT,IAAME,EAAY,MAAMZ,GAAgB,EACxC,MAAO,CAAC,GAAGQ,EAAOI,CAAS,CAC7B,CACF,MAAiB,CAEjB,CAEA,OAAOJ,CACT,CD1BO,SAASK,GACdC,EACuC,CACvC,GAAM,CAAE,OAAAC,EAAQ,WAAAC,EAAY,aAAAC,CAAa,EAAIH,EAE7C,MAAO,CACL,OAAQ,MAAOI,EAAoBC,EAA6B,CAAC,IAAM,CAGrE,GAFA,MAAMH,EAAW,EAEb,CAACC,EACH,MAAMG,EAAU,OAAO,wCAAwC,EAGjE,IAAMC,EAAYN,EAAO,EACrBO,EAAc,MAAML,EAAaC,EAAOC,CAAO,EACnD,OAAAG,EAAc,MAAMC,GAAsBD,EAAaD,EAAWF,CAAO,EAElEE,EAAU,OAAOC,EAAaH,CAAO,CAC9C,EAEA,KAAM,MAAOA,IACX,MAAMH,EAAW,EACVD,EAAO,EAAE,gBAAgBI,CAAO,GAGzC,IAAK,MAAOK,IACV,MAAMR,EAAW,EACVD,EAAO,EAAE,cAAcS,CAAE,GAGlC,IAAK,MAAOA,EAAYL,KACtB,MAAMH,EAAW,EACVD,EAAO,EAAE,uBAAuBS,EAAIL,EAAQ,MAAM,GAG3D,OAAQ,MAAOK,IACb,MAAMR,EAAW,EACVD,EAAO,EAAE,iBAAiBS,CAAE,EAEvC,CACF,CASO,SAASC,GAAqBX,EAAsC,CACzE,GAAM,CAAE,OAAAC,EAAQ,WAAAC,CAAW,EAAIF,EAE/B,MAAO,CAML,IAAK,MAAOY,EAAcP,EAAsD,CAAC,KAC/E,MAAMH,EAAW,EACVD,EAAO,EAAE,UAAUW,EAAMP,EAAQ,WAAYA,EAAQ,MAAM,GAGpE,KAAM,MAAOA,IACX,MAAMH,EAAW,EACVD,EAAO,EAAE,YAAYI,CAAO,GAGrC,IAAK,MAAOO,IACV,MAAMV,EAAW,EACVD,EAAO,EAAE,UAAUW,CAAI,GAGhC,OAAQ,MAAOA,IACb,MAAMV,EAAW,EACVD,EAAO,EAAE,aAAaW,CAAI,GAGnC,OAAQ,MAAOA,IACb,MAAMV,EAAW,EACVD,EAAO,EAAE,aAAaW,CAAI,GAGnC,SAAU,MAAOA,IACf,MAAMV,EAAW,EACVD,EAAO,EAAE,eAAeW,CAAI,GAGrC,IAAK,MAAOA,IACV,MAAMV,EAAW,EACVD,EAAO,EAAE,aAAaW,CAAI,GAGnC,QAAS,MAAOA,IACd,MAAMV,EAAW,EACVD,EAAO,EAAE,iBAAiBW,CAAI,GAGvC,MAAO,MAAOA,IACZ,MAAMV,EAAW,EACVD,EAAO,EAAE,eAAeW,CAAI,EAEvC,CACF,CAKO,SAASC,GAAsBb,EAAuC,CAC3E,GAAM,CAAE,OAAAC,EAAQ,WAAAC,CAAW,EAAIF,EAE/B,MAAO,CACL,IAAK,UACH,MAAME,EAAW,EACVD,EAAO,EAAE,WAAW,EAE/B,CACF,CAKO,SAASa,GAAoBd,EAAqC,CACvE,GAAM,CAAE,OAAAC,EAAQ,WAAAC,CAAW,EAAIF,EAE/B,MAAO,CACL,OAAQ,MAAOK,EAA+C,CAAC,KAC7D,MAAMH,EAAW,EACVD,EAAO,EAAE,YAAYI,EAAQ,IAAKA,EAAQ,MAAM,GAGzD,KAAM,MAAOA,IACX,MAAMH,EAAW,EACVD,EAAO,EAAE,WAAWI,CAAO,GAGpC,IAAK,MAAOU,IACV,MAAMb,EAAW,EACVD,EAAO,EAAE,SAASc,CAAK,GAGhC,OAAQ,MAAOA,IACb,MAAMb,EAAW,EACVD,EAAO,EAAE,YAAYc,CAAK,EAErC,CACF,CJpJO,IAAeC,EAAf,KAAoB,CAgCzB,YAAYC,EAA6B,CAAC,EAAG,CAR7C,KAAQ,YAAoC,KAC5C,KAAU,eAAwC,KAKlD,KAAQ,WAA4C,KA2BlD,GAlBAA,EAAU,CACR,GAAGA,EACH,OAAQA,EAAQ,QAAU,OAC1B,MAAOA,EAAQ,OAAS,OACxB,OAAQA,EAAQ,QAAU,MAC5B,EACA,KAAK,cAAgBA,EAKjBA,EAAQ,SAAW,QACrBC,GAAeD,EAAQ,MAAM,EAM3BA,EAAQ,OAASA,EAAQ,QAC3B,MAAME,EAAU,OAAO,gDAAgD,EAKrE,OAAOF,EAAQ,OAAU,UAC3BG,EAAcH,EAAQ,KAAK,EAC3B,KAAK,WAAaA,EAAQ,OACjBA,EAAQ,QACjB,KAAK,WAAaA,EAAQ,OAK5B,KAAK,KAAO,IAAII,EAAQ,CACtB,GAAGJ,EACH,eAAgB,IAAM,KAAK,eAAe,EAC1C,iBAAkB,KAAK,qBAAqB,CAC9C,CAAC,EAED,IAAMK,EAAM,CACV,OAAQ,IAAM,KAAK,KACnB,WAAY,IAAM,KAAK,kBAAkB,CAC3C,EAEA,KAAK,YAAcC,GAAyB,CAC1C,GAAGD,EACH,aAAc,CAACE,EAAOC,IAAS,KAAK,aAAaD,EAAOC,CAAI,CAC9D,CAAC,EACD,KAAK,QAAUC,GAAqBJ,CAAG,EACvC,KAAK,QAAUK,GAAsBL,CAAG,EACxC,KAAK,OAASM,GAAoBN,CAAG,CACvC,CAaA,MAAgB,mBAAmC,CACjD,OAAK,KAAK,cACR,KAAK,YAAc,KAAK,oBAAoB,GAEvC,KAAK,WACd,CAEA,MAAc,qBAAqC,CACjD,GAAI,CACF,KAAK,eAAiB,MAAM,KAAK,KAAK,UAAU,CAClD,OAASO,EAAO,CAEd,WAAK,YAAc,KACbA,CACR,CACF,CAYA,MAAM,MAA8B,CAClC,aAAM,KAAK,kBAAkB,EACtB,KAAK,KAAK,KAAK,CACxB,CAKA,MAAM,OAAOL,EAAoBP,EAAgE,CAC/F,OAAO,KAAK,YAAY,OAAOO,EAAOP,CAAO,CAC/C,CAKA,MAAM,QAAS,CACb,OAAO,KAAK,QAAQ,IAAI,CAC1B,CAOA,MAAM,WAAqC,CACzC,OAAI,KAAK,eAAuB,KAAK,gBACrC,MAAM,KAAK,kBAAkB,EAEtB,KAAK,eACd,CAEA,GAA+Ba,EAAUC,EAAiD,CACxF,KAAK,KAAK,GAAGD,EAAOC,CAAO,CAC7B,CAEA,IAAgCD,EAAUC,EAAiD,CACzF,KAAK,KAAK,IAAID,EAAOC,CAAO,CAC9B,CAMA,WAAWC,EAAuC,CAChD,KAAK,KAAK,iBAAiBA,CAAO,CACpC,CAKA,cAAqB,CACnB,KAAK,KAAK,iBAAiB,CAAC,CAAC,CAC/B,CAQO,SAASC,EAAqC,CAGnD,GAAI,KAAK,cAAc,QACrB,MAAMd,EAAU,OAAO,gDAAgD,EAEzE,GAAI,OAAOc,GAAU,SAAU,CAC7B,GAAI,CAACA,EACH,MAAMd,EAAU,SAAS,2DAA2D,EAEtFC,EAAca,CAAK,EACnB,KAAK,WAAaA,EAClB,MACF,CACA,GAAI,OAAOA,GAAU,WACnB,MAAMd,EAAU,SACd,kFACF,EAEF,KAAK,WAAac,CACpB,CAYA,MAAc,gBAAkD,CAC9D,GAAI,KAAK,aAAe,KAAM,MAAO,CAAC,EACtC,IAAMC,EAAQ,OAAO,KAAK,YAAe,WAAa,MAAM,KAAK,WAAW,EAAI,KAAK,WACrF,GAAI,CAACA,EACH,MAAMf,EAAU,eAAe,mCAAmC,EAEpE,GAAI,OAAOe,GAAU,SACnB,MAAMf,EAAU,eAAe,6CAA6C,EAE9E,MAAO,CAAE,cAAe,UAAUe,CAAK,EAAG,CAC5C,CACF,EDvQAC,IOFAC,IACA,IAAAC,GAAkB,eCJlB,IAAAC,GAAkB,eAELC,GAAoB,CAC/B,OAAQ,KAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAClC,MAAO,KAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,CACpC,EDCAC,IAUA,IAAMC,GAAkB,KAAE,OAAOC,EAAiB,EAAE,OAAO,EAQrDC,GAA2C,CAC/C,OAAQ,eACR,MAAO,YACT,EAYO,SAASC,IAA4C,CAC1D,GAAIC,EAAO,IAAM,OAAQ,MAAO,CAAC,EAEjC,IAAMC,EAAM,CACV,OAAQ,QAAQ,IAAI,cAAgB,OACpC,MAAO,QAAQ,IAAI,YAAc,MACnC,EAEA,GAAI,CACF,OAAOL,GAAgB,MAAMK,CAAG,CAClC,OAASC,EAAO,CACd,GAAIA,aAAiB,KAAE,SAAU,CAC/B,IAAMC,EAAQD,EAAM,OAAO,CAAC,EACtBE,EAAQD,EAAM,KAAK,CAAC,EACpBE,GAAUD,GAASN,GAAiBM,CAAK,IAAM,iCACrD,MAAME,EAAU,OAAO,WAAWD,CAAM,KAAKF,EAAM,OAAO,EAAE,CAC9D,CACA,MAAMG,EAAU,OAAO,mCAAmC,CAC5D,CACF,CEpEAC,IAGA,eAAsBC,GACpBC,EACAC,EAA6B,CAAC,EACT,CACrB,GAAM,CAAE,SAAAC,EAAU,KAAAC,CAAK,EAAI,KAAM,QAAO,eAAe,EACjD,CAAE,gBAAAC,CAAgB,EAAI,KAAM,QAAO,mBAAmB,EAEtD,CAAE,OAAAC,EAAQ,IAAAC,EAAK,SAAAC,EAAU,MAAAC,EAAO,QAAAC,CAAQ,EAAIR,EAC5CS,EAAW,IAAIR,EACfS,EAAsB,CAAC,EAE7B,QAAWC,KAAQZ,EAAO,CAExB,GACE,CAAC,OAAO,SAASY,EAAK,OAAO,GAC7B,EAAE,OAAO,KAAS,KAAeA,EAAK,mBAAmB,MAEzD,MAAMC,EAAU,KAAK,8CAA8CD,EAAK,IAAI,GAAI,CAC9E,SAAUA,EAAK,IACjB,CAAC,EAIH,GAAI,CAACA,EAAK,IACR,MAAMC,EAAU,KAAK,8BAA8BD,EAAK,IAAI,GAAI,CAAE,SAAUA,EAAK,IAAK,CAAC,EAIzF,IAAME,EAAe,IAAIX,EAAK,CAACS,EAAK,OAAO,EAAGA,EAAK,KAAM,CAAE,KAAM,0BAA2B,CAAC,EAC7FF,EAAS,OAAO,UAAWI,CAAY,EACvCH,EAAU,KAAKC,EAAK,GAAG,CACzB,CAEAF,EAAS,OAAO,YAAa,KAAK,UAAUC,CAAS,CAAC,EAElDN,GAAUA,EAAO,OAAS,GAAGK,EAAS,OAAO,SAAU,KAAK,UAAUL,CAAM,CAAC,EAC7EC,GAAKI,EAAS,OAAO,MAAOJ,CAAG,EAC/BC,GAAUG,EAAS,OAAO,WAAYH,CAAQ,EAC9CC,GAAO,OAAOE,EAAS,OAAO,QAAS,MAAM,EAC7CF,GAAO,WAAWE,EAAS,OAAO,YAAa,MAAM,EACrDF,GAAO,KAAKE,EAAS,OAAO,MAAO,MAAM,EACzCD,GAASC,EAAS,OAAO,UAAWD,CAAO,EAE/C,IAAMM,EAAU,IAAIX,EAAgBM,CAAQ,EACtCM,EAAS,CAAC,EAChB,cAAiBC,KAASF,EAAQ,OAAO,EACvCC,EAAO,KAAK,OAAO,KAAKC,CAAK,CAAC,EAEhC,IAAMC,EAAO,OAAO,OAAOF,CAAM,EAEjC,MAAO,CACL,KAAME,EAAK,OAAO,MAAMA,EAAK,WAAYA,EAAK,WAAaA,EAAK,UAAU,EAC1E,QAAS,CACP,eAAgBH,EAAQ,YACxB,iBAAkB,OAAO,WAAWG,CAAI,EAAE,SAAS,CACrD,CACF,CACF,CCzDAC,ICAAC,IDIAC,KACAC,IACAC,KACAC,KAEAC,IACAC,KEJO,SAASC,GACdC,EACAC,EACAC,EACAC,EAAwB,GAChB,CACR,IAAMC,EAAOJ,IAAU,EAAIC,EAAWC,EACtC,OAAOC,EAAe,GAAGH,CAAK,IAAII,CAAI,GAAKA,CAC7C,CZmGAC,KAtEO,IAAMC,EAAN,cAAmBA,CAAS,CACjC,YAAYC,EAA6B,CAAC,EAAG,CAC3C,GAAIC,EAAO,IAAM,OACf,MAAMC,EAAU,SAAS,6DAA6D,EAYxF,IAAMC,EAAMC,GAAc,EAC1B,MAAM,CACJ,GAAGJ,EACH,OAAQA,EAAQ,QAAUG,EAAI,OAC9B,MAAOH,EAAQ,QAAUA,EAAQ,QAAU,OAAYG,EAAI,MAC7D,CAAC,CACH,CAYA,MAAM,OACJE,EACAL,EACmC,CACnC,OAAO,MAAM,OAAOK,EAAOL,CAAO,CACpC,CAEA,MAAgB,aACdK,EACAL,EACuB,CAEvB,IAAMM,EAAQ,OAAOD,GAAU,SAAW,CAACA,CAAK,EAAIA,EAEpD,GAAI,CAAC,MAAM,QAAQC,CAAK,GAAK,CAACA,EAAM,MAAOC,GAAM,OAAOA,GAAM,QAAQ,EACpE,MAAML,EAAU,SACd,0EACF,EAGF,GAAII,EAAM,SAAW,EACnB,MAAMJ,EAAU,SAAS,qBAAqB,EAGhD,GAAM,CAAE,oBAAAM,CAAoB,EAAI,KAAM,uCACtC,OAAOA,EAAoBF,EAAON,EAAS,KAAK,gBAAkB,MAAS,CAC7E,CAEU,sBAA0C,CAClD,OAAOS,EACT,CACF,EAGOC,GAAQX","names":["validateIdempotencyKey","value","ShipError","key","IDEMPOTENCY_KEY_CONSTRAINTS","isShipError","error","isBlockedExtension","filename","dotIndex","ext","BLOCKED_EXTENSIONS","hasUnsafeChars","UNSAFE_FILENAME_CHARS","hasUnbuiltMarker","filePath","s","UNBUILT_PROJECT_MARKERS","classifyToken","token","API_KEY","TokenKind","DEPLOY_TOKEN","assertShipJsonSyntax","text","withoutBom","parsed","DEPLOYMENT_CONFIG_FILENAME","validatePrefixedCredential","shape","label","hexPart","validateApiKey","apiKey","validateDeployToken","deployToken","validateToken","validateCaller","caller","CALLER","validateApiUrl","apiUrl","url","isDeployment","input","isPlatformDomain","domain","platformDomain","isCustomDomain","extractSubdomain","generateDeploymentUrl","deployment","generateDomainUrl","serializeLabels","labels","deserializeLabels","labelsJson","validatePassword","trimmed","PASSWORD_CONSTRAINTS","DeploymentStatus","API_PATHS","DomainStatus","AccountPlan","ErrorType","CLIENT_ONLY_ERROR_TYPES","ERROR_CATEGORIES","SERVER_PRODUCIBLE_ERROR_TYPES","MAX_FOREIGN_MESSAGE_LENGTH","AUTH_BASE_PATH","AuthMethod","OAuthScope","SPA_DEFAULT_CONFIG","DEFAULT_API","FileValidationStatus","LABEL_CONSTRAINTS","LABEL_PATTERN","init_dist","__esmMin","t","_ShipError","type","message","status","details","authDetails","response","operationName","bodyType","json","obj","retryAfterHeader","seconds","existing","cause","op","resource","id","errorType","md5Blob","blob","SparkMD5","spark","chunkSize","start","end","md5Buffer","buffer","createHash","hash","md5Path","path","createReadStream","resolve","reject","stream","err","ShipError","chunk","calculateMD5","input","init_md5","__esmMin","init_dist","__setTestEnvironment","env","_testEnvironment","detectEnvironment","getENV","init_env","__esmMin","findCommonParent","dirPaths","normalizedPaths","p","pathSegments","commonSegments","minLength","i","segment","segments","normalizeWebPath","path","init_path","__esmMin","optimizeDeployPaths","filePaths","options","path","normalizeWebPath","extractFileName","commonPrefix","findCommonDirectory","filePath","deployPath","prefixToRemove","pathSegments","commonSegments","minLength","segments","i","segment","init_deploy_paths","__esmMin","init_path","formatFileSize","bytes","decimals","k","sizes","i","validateFileName","filename","hasUnsafeChars","reservedNames","nameWithoutPath","validateFiles","files","config","errors","warnings","fileStatuses","issue","file","hasUnbuiltMarker","f","FileValidationStatus","totalSize","fileStatus","statusMessage","nameValidation","isBlockedExtension","validFiles","canDeploy","getValidFiles","allValidFilesReady","init_file_validation","__esmMin","init_dist","filterJunk","filePaths","options","p","hasUnbuiltMarker","ShipError","filePath","parts","basename","part","directorySegments","segment","JUNK_DIRECTORIES","junkDir","import_junk","init_junk","__esmMin","init_dist","validateDeployPath","deployPath","sourceIdentifier","ShipError","validateDeployFile","nameCheck","validateFileName","isBlockedExtension","init_security","__esmMin","init_dist","init_file_validation","node_files_exports","__export","processFilesForNode","findAllFilePaths","dirPath","visited","results","realPath","entries","entry","fullPath","stats","subFiles","paths","options","platformLimits","getENV","ShipError","p","absPath","marker","e","UNBUILT_PROJECT_MARKERS","isShipError","absolutePaths","uniquePaths","inputAbsolutePaths","inputBasePath","findCommonParent","contentPaths","rel","deployPaths","optimizeDeployPaths","f","filteredSet","filterJunk","validAbsPaths","validDeployPaths","i","totalSize","filePath","deployPath","validateDeployPath","validateDeployFile","content","md5","calculateMD5","error","errorMessage","fs","path","init_node_files","__esmMin","init_dist","init_deploy_paths","init_env","init_junk","init_md5","init_path","init_security","src_exports","__export","API_KEY","API_PATHS","AUTH_BASE_PATH","AccountPlan","ApiHttp","AuthMethod","BLOCKED_EXTENSIONS","CALLER","DEFAULT_API","DEPLOYMENT_CONFIG_FILENAME","DEPLOY_TOKEN","DeploymentStatus","DomainStatus","ErrorType","FileValidationStatus","IDEMPOTENCY_KEY_CONSTRAINTS","JUNK_DIRECTORIES","LABEL_CONSTRAINTS","LABEL_PATTERN","OAuthScope","PASSWORD_CONSTRAINTS","SPA_DEFAULT_CONFIG","Ship","ShipError","TokenKind","UNBUILT_PROJECT_MARKERS","UNSAFE_FILENAME_CHARS","__setTestEnvironment","allValidFilesReady","assertShipJsonSyntax","calculateMD5","classifyToken","createAccountResource","createDeploymentResource","createDomainResource","createTokenResource","node_default","deserializeLabels","extractSubdomain","filterJunk","formatFileSize","generateDeploymentUrl","generateDomainUrl","getENV","getValidFiles","hasUnbuiltMarker","hasUnsafeChars","isBlockedExtension","isCustomDomain","isDeployment","isPlatformDomain","isShipError","optimizeDeployPaths","pluralize","processFilesForNode","serializeLabels","validateApiKey","validateApiUrl","validateCaller","validateDeployFile","validateDeployPath","validateDeployToken","validateFileName","validateFiles","validateIdempotencyKey","validatePassword","validateToken","__toCommonJS","init_dist","init_dist","init_dist","SimpleEvents","event","handler","eventHandlers","args","handlerArray","error","err","init_dist","validateLabels","labels","LABEL_CONSTRAINTS","ShipError","normalized","label","i","cleaned","LABEL_PATTERN","unique","validateDeployConfig","files","config","f","DEPLOYMENT_CONFIG_FILENAME","content","text","assertShipJsonSyntax","DEFAULT_REQUEST_TIMEOUT","DEFAULT_DEPLOY_TIMEOUT","BUILD_SERVICE_BUDGET","DEFAULT_DEPLOY_BUILD_TIMEOUT","DEPLOY_VIA","listQuery","options","params","query","ApiHttp","SimpleEvents","DEFAULT_API","API_PATHS","headers","url","operationName","timeoutMs","cleanup","timeout","fetchOptions","response","ShipError","error","shipError","data","customHeaders","existingSignal","controller","timeoutId","abort","files","file","validatePassword","idempotencyKey","validateIdempotencyKey","labels","validateLabels","validateDeployConfig","flags","body","bodyHeaders","id","normalized","name","deployment","status","ttl","token","_options","indexFile","f","indexContent","init_dist","init_dist","init_md5","createSPAConfig","configString","SPA_DEFAULT_CONFIG","content","md5","calculateMD5","DEPLOYMENT_CONFIG_FILENAME","detectAndConfigureSPA","files","apiClient","options","f","spaConfig","createDeploymentResource","ctx","getApi","ensureInit","processInput","input","options","ShipError","apiClient","staticFiles","detectAndConfigureSPA","id","createDomainResource","name","createAccountResource","createTokenResource","token","Ship","options","validateCaller","ShipError","validateToken","ApiHttp","ctx","createDeploymentResource","input","opts","createDomainResource","createAccountResource","createTokenResource","error","event","handler","headers","token","value","init_env","init_dist","import_zod","import_zod","CREDENTIAL_FIELDS","init_env","EnvConfigSchema","CREDENTIAL_FIELDS","ENV_VAR_BY_FIELD","readEnvConfig","getENV","raw","error","issue","field","envVar","ShipError","init_dist","createDeployBody","files","context","FormData","File","FormDataEncoder","labels","via","password","flags","captcha","formData","checksums","file","ShipError","fileInstance","encoder","chunks","chunk","body","init_dist","init_dist","init_deploy_paths","init_env","init_file_validation","init_junk","init_md5","init_security","pluralize","count","singular","plural","includeCount","word","init_node_files","Ship","options","getENV","ShipError","env","readEnvConfig","input","paths","p","processFilesForNode","createDeployBody","node_default"]}
+{"version":3,"sources":["../node_modules/.pnpm/@shipstatic+types@2.5.0/node_modules/@shipstatic/types/dist/index.js","../src/shared/lib/md5.ts","../src/shared/lib/env.ts","../src/shared/lib/path.ts","../src/shared/lib/deploy-paths.ts","../src/shared/lib/file-validation.ts","../src/shared/lib/junk.ts","../src/shared/lib/security.ts","../src/node/core/node-files.ts","../src/index.ts","../src/node/index.ts","../src/shared/base-ship.ts","../src/shared/api/http.ts","../src/shared/events.ts","../src/shared/lib/validation.ts","../src/shared/resources.ts","../src/shared/lib/spa.ts","../src/node/core/config.ts","../src/shared/core/credential-schema.ts","../src/node/core/deploy-body.ts","../src/shared/index.ts","../src/shared/core/constants.ts","../src/shared/lib/text.ts"],"sourcesContent":["/**\n * @file Shared TypeScript types, constants, and utilities for the ShipStatic platform.\n * This package is the single source of truth for all shared data structures.\n */\n// =============================================================================\n// DEPLOYMENT TYPES\n// =============================================================================\n/**\n * Deployment status constants\n */\nexport const DeploymentStatus = {\n    PENDING: 'pending',\n    SUCCESS: 'success',\n    FAILED: 'failed',\n    DELETING: 'deleting',\n};\n/**\n * Which client made a deployment — the origin-tracking vocabulary.\n *\n * A closed set with many authors: the CLI, the SDK, the dashboard, both MCP\n * transports, the GitHub Action, the n8n node and the VS Code extension each\n * name themselves here. It lived in the API's config until 2026-08-06, where\n * being server-side made it unenforceable in the one direction that matters —\n * every client wrote a bare string, and a value outside the set was **silently\n * dropped** by the server, so a typo did not fail anywhere. It stopped\n * recording where deploys came from and said nothing.\n */\nexport const DeploymentVia = {\n    WEB: 'web',\n    SDK: 'sdk',\n    CLI: 'cli',\n    MCP: 'mcp',\n    GIT: 'git',\n    N8N: 'n8n',\n    GPT: 'gpt',\n    VSC: 'vsc',\n};\n// =============================================================================\n// DOMAIN TYPES\n// =============================================================================\n/**\n * Domain status constants\n *\n * - PENDING: DNS not configured\n * - PARTIAL: DNS partially configured\n * - SUCCESS: DNS fully verified\n * - PAUSED: Domain paused due to plan enforcement (billing)\n */\nexport const DomainStatus = {\n    PENDING: 'pending',\n    PARTIAL: 'partial',\n    SUCCESS: 'success',\n    PAUSED: 'paused',\n};\n/**\n * The envelope an `Idempotency-Key` must fit, and how long a replay lasts.\n *\n * Format lives here rather than on the server alone by the format-vs-policy\n * rule: a client can decide offline whether a key is well-formed, and the\n * API would reject the same value the same way.\n */\nexport const IDEMPOTENCY_KEY_CONSTRAINTS = {\n    /**\n     * HTTP header name. Here for the same reason {@link CALLER.HEADER} is: a\n     * wire header has two ends, and the package that owns the value's format\n     * is the only place both ends can read its name from.\n     */\n    HEADER: 'Idempotency-Key',\n    MAX_LENGTH: 256,\n    /** How long a stored 201 stays replayable. */\n    WINDOW_SECONDS: 24 * 60 * 60,\n};\n/**\n * Normalize a `via` value from any transport — trimmed, lowercased, and a\n * member of {@link DeploymentVia}, or `undefined`.\n *\n * A format rule by this package's own test: a client can decide offline\n * whether a value is well-formed, and the API reaches the same verdict on the\n * same input. It lived server-side until 2026-08-06, which meant clients could\n * only learn their label was unusable by noticing analytics had gone quiet.\n *\n * **Not knowing your `via` is not an error** — an unrecognized value yields\n * `undefined` rather than throwing, because origin tracking is telemetry and a\n * deploy must never fail over it. A caller that has an honest default should\n * prefer it (`normalizeVia(process.env.SHIP_VIA) ?? DeploymentVia.CLI`): the\n * deploy really did come from the CLI, so recording that beats recording\n * nothing.\n */\nexport function normalizeVia(value) {\n    if (!value || typeof value !== 'string')\n        return undefined;\n    const via = value.trim().toLowerCase();\n    return Object.values(DeploymentVia).includes(via)\n        ? via\n        : undefined;\n}\n/**\n * Validate an idempotency key, returning the trimmed value or `undefined`\n * when none was supplied. Throws {@link ShipError.validation} when the value\n * cannot be sent — the same verdict the API would reach, reached earlier.\n */\nexport function validateIdempotencyKey(value) {\n    if (value === undefined || value === null)\n        return undefined;\n    if (typeof value !== 'string') {\n        throw ShipError.validation('Idempotency key must be a string.');\n    }\n    const key = value.trim();\n    if (!key) {\n        throw ShipError.validation('Idempotency key must not be empty.');\n    }\n    if (key.length > IDEMPOTENCY_KEY_CONSTRAINTS.MAX_LENGTH) {\n        throw ShipError.validation(`Idempotency key must be at most ${IDEMPOTENCY_KEY_CONSTRAINTS.MAX_LENGTH} characters.`);\n    }\n    return key;\n}\n// =============================================================================\n// ACCOUNT TYPES\n// =============================================================================\n/**\n * Account plan constants\n */\nexport const AccountPlan = {\n    FREE: 'free',\n    STANDARD: 'standard',\n    SPONSORED: 'sponsored',\n    ENTERPRISE: 'enterprise',\n    SUSPENDED: 'suspended',\n    TERMINATING: 'terminating',\n    TERMINATED: 'terminated',\n};\n// =============================================================================\n// WIRE SURFACE\n// =============================================================================\n/**\n * Every path the public API answers on, declared once.\n *\n * The URL surface was written out in four places — the API's mounts, the\n * SDK's client, the dashboard's client, and the post-deploy smoke — so a\n * rename meant finding all four. The first three now read this table.\n *\n * The smoke (`cloudflare/api/smoke.mjs`) deliberately still spells its own:\n * five of its nine paths are `/admin/*`, which this table excludes by\n * design, and splitting one list between a registry and literals reads worse\n * than keeping it uniform.\n *\n * **What this guarantees, exactly.** Collection paths are mounted from here,\n * so producer and consumer cannot diverge. Item paths are declared here and\n * consumed by clients, but the API spells them relative to their mount\n * (`/:deployment/config`), so the table does not *generate* them — it is\n * held to them by `api/tests/architecture/api-paths.test.ts`, which fails if\n * any entry names a path no route answers. Some entries have no client yet\n * (`DEPLOYMENT_CONFIG`, `DOMAIN_PROPAGATION` — endpoints the SDK\n * deliberately does not reach); the fence is what keeps those honest rather\n * than merely asserted.\n *\n * **The operator surface is deliberately absent.** `/admin/*` paths belong\n * to `web/my`, for the same reason its row types do: this package is\n * published, and the operator surface is not public (see `CLAUDE.md`, \"Admin\n * types\"). A path here is a promise to every npm consumer; `/admin` is a\n * promise to one dashboard.\n *\n * Item paths are functions rather than templates so the key is interpolated\n * in one place, encoded the same way by every caller.\n */\nexport const API_PATHS = {\n    DEPLOYMENTS: '/deployments',\n    DEPLOYMENT: (deployment) => `/deployments/${deployment}`,\n    DEPLOYMENT_CONFIG: (deployment) => `/deployments/${deployment}/config`,\n    DOMAINS: '/domains',\n    DOMAIN: (domain) => `/domains/${domain}`,\n    DOMAIN_VERIFY: (domain) => `/domains/${domain}/verify`,\n    DOMAIN_DNS: (domain) => `/domains/${domain}/dns`,\n    DOMAIN_RECORDS: (domain) => `/domains/${domain}/records`,\n    DOMAIN_SHARE: (domain) => `/domains/${domain}/share`,\n    DOMAIN_PROPAGATION: (domain) => `/domains/${domain}/propagation`,\n    DOMAINS_VALIDATE: '/domains/validate',\n    TOKENS: '/tokens',\n    TOKEN: (token) => `/tokens/${token}`,\n    ACCOUNT: '/account',\n    ACCOUNT_KEY: '/account/key',\n    ACCOUNT_CLAIM: '/account/claim',\n    ACTIVITIES: '/activities',\n    LABELS: '/labels',\n    LIMITS: '/limits',\n    PING: '/ping',\n    SETUP: '/setup',\n    SPA_CHECK: '/spa-check',\n    UPLOAD: '/upload',\n};\n/**\n * The deploy request's multipart field names — the other half of the wire\n * surface beside {@link API_PATHS}. `POST /deployments` (and the first-party\n * `/upload`) is multipart/form-data, and these are the names the API reads.\n *\n * Declared once because the body has three independent WRITERS — the SDK's\n * Node and browser body builders, and the n8n community node's hand-rolled\n * client (which cannot import this under n8n Cloud's zero-dependency rule,\n * and fences its restated copy instead) — and until this export every writer\n * restated the strings the API parses, with nothing comparing them.\n *\n * `FILES` carries one entry per file (the API reads it with `getAll`); every\n * other field is single. The `@internal` flags are serialized as the literal\n * string `'true'` and belong to first-party surfaces only.\n */\nexport const DEPLOY_FIELDS = {\n    /** One entry per file — read with `getAll`. */\n    FILES: 'files[]',\n    /** JSON array of MD5 hex digests, index-aligned with `FILES`. */\n    CHECKSUMS: 'checksums',\n    /** JSON array of label strings. */\n    LABELS: 'labels',\n    /** The deploying surface's {@link DeploymentVia} member. */\n    VIA: 'via',\n    /** Plaintext password — the API hashes it server-side. */\n    PASSWORD: 'password',\n    /** @internal Server-processing flag — first-party `/upload` only. */\n    BUILD: 'build',\n    /** @internal Server-processing flag — first-party `/upload` only. */\n    PRERENDER: 'prerender',\n    /** @internal Server-processing flag — first-party `/upload` only. */\n    SPA: 'spa',\n    /** @internal reCAPTCHA proof — `web/www`'s public uploader only. */\n    CAPTCHA: 'captcha',\n};\n// =============================================================================\n// ERROR SYSTEM\n// =============================================================================\n/**\n * All possible error types in the ShipStatic platform.\n *\n * Developer-friendly key names map to stable wire-format string values.\n * Both the value and the type are exported under the same name so callers\n * can use `ErrorType.Validation` (value comparison) and `: ErrorType` (type\n * annotation) without ceremony — matching the pattern other status objects\n * (`DeploymentStatus`, `DomainStatus`, `AccountPlan`, `AuthMethod`) follow.\n */\nexport const ErrorType = {\n    /**\n     * Validation failed. Input shape is wrong.\n     *\n     * Carries 400 when an API judged it — including a client-side pre-check of a\n     * rule the server enforces too, which keeps the error identical wherever it\n     * was caught. **Statusless** when a client rejects something no API judges,\n     * such as a CLI's own command grammar: `status` is documented \"(API\n     * contexts)\" on `ErrorResponse`, so there is none to report.\n     */\n    Validation: 'validation_failed',\n    /** Resource not found (404). */\n    NotFound: 'not_found',\n    /** Authenticated but not allowed (403). User lacks permission for this action. */\n    Forbidden: 'forbidden',\n    /** Rate limit exceeded (429). */\n    RateLimit: 'rate_limit_exceeded',\n    /** Authentication required or failed (401). Missing/invalid credentials. */\n    Authentication: 'authentication_failed',\n    /** Business rule violation. Catch-all for 4xx state-rule errors that aren't more specific. */\n    Business: 'business_logic_error',\n    /** API server error (500). Generic server-side fault. */\n    Api: 'internal_server_error',\n    /**\n     * The platform is closed for maintenance (503). A deliberate operator\n     * state, not a fault — nothing errored; the API is refusing work on\n     * purpose, and deployed sites keep serving throughout.\n     *\n     * Distinct from `Api` at 503, which the platform already uses for a\n     * dependency that failed (moderation unavailable). A consumer has to tell\n     * \"we closed the door\" from \"something broke\": the two get opposite words\n     * and opposite retry behaviour.\n     */\n    Maintenance: 'maintenance',\n    /** Network/connection error. Client-side only — set by HTTP clients on fetch failure; never produced server-side. */\n    Network: 'network_error',\n    /** Operation was cancelled. Client-side only — set on `AbortSignal` abort; never produced server-side. */\n    Cancelled: 'operation_cancelled',\n    /** File operation error. Client-side only — set by SDK during local file processing; never produced server-side. */\n    File: 'file_error',\n    /** Configuration error. Client-side only — set by SDK during config parsing/validation; never produced server-side. */\n    Config: 'config_error',\n};\n/**\n * Error types that originate exclusively on the client (HTTP clients, SDK\n * file processing, local config parsing). These never appear on the wire\n * from the server, so `fromHttpResponse` will not trust them even if a\n * misbehaving server claims one in `body.error`.\n */\nconst CLIENT_ONLY_ERROR_TYPES = new Set([\n    ErrorType.Network,\n    ErrorType.Cancelled,\n    ErrorType.File,\n    ErrorType.Config,\n]);\n/**\n * Categorizes error types for the `isClientError` / `isNetworkError` /\n * `isAuthError` helpers. Each `Set` is typed against the wider `ErrorType`\n * union so `.has(error.type)` accepts any value from the union.\n */\nconst ERROR_CATEGORIES = {\n    /**\n     * Client-attributable types. Exhaustive over the 4xx-carrying types, and\n     * over the statusless ones too — those are raised locally and have no\n     * status for `isClientError`'s second arm to read, so omitting one makes it\n     * read as a server fault. The rule is the membership test: every type in\n     * `CLIENT_ONLY_ERROR_TYPES` except `Network` (which `isNetworkError` owns)\n     * belongs here.\n     *\n     * `Cancelled` was missing until 2026-07-29, which is exactly that failure:\n     * a caller who aborted their own deploy was told \"server error: please try\n     * again\" — the CLI's fallback for everything this set does not claim.\n     */\n    client: new Set([\n        ErrorType.Business,\n        ErrorType.Cancelled,\n        ErrorType.Config,\n        ErrorType.File,\n        ErrorType.Forbidden,\n        ErrorType.NotFound,\n        ErrorType.RateLimit,\n        ErrorType.Validation,\n    ]),\n    network: new Set([ErrorType.Network]),\n    auth: new Set([ErrorType.Authentication]),\n};\n/**\n * Error types the server can legitimately produce on the wire. Used by\n * `ShipError.fromHttpResponse` to validate the body's `error` field before\n * trusting it as `ShipError.type`. Derived by exclusion from\n * `CLIENT_ONLY_ERROR_TYPES` so adding a new server-producible type to\n * `ErrorType` is automatically picked up.\n */\nconst SERVER_PRODUCIBLE_ERROR_TYPES = new Set(Object.values(ErrorType).filter((t) => !CLIENT_ONLY_ERROR_TYPES.has(t)));\n/**\n * Ceiling on a message adopted from a **non-JSON** error body — a foreign\n * responder's, never this platform's. Generous for the plain-text one-liners\n * intermediaries actually send (`error code: 1015`), far below a document.\n * Our own messages are never measured against it: a JSON body is the API's\n * contract, and truncating a long validation message would be the bug.\n */\nconst MAX_FOREIGN_MESSAGE_LENGTH = 200;\n/**\n * Did the runtime say the exchange never completed?\n *\n * WHATWG has `fetch` reject with a **TypeError** on network error, and undici,\n * Chromium and Firefox comply. Bun does not: it rejects with a plain `Error`\n * carrying a system `code` string. Captured 2026-08-05 (the capture script is\n * in `tests/errors.test.ts`, \"runtime failure shapes\"):\n *\n * | failure       | Node 22 / undici          | Bun 1.3.14                                   |\n * |---------------|---------------------------|----------------------------------------------|\n * | refused       | `TypeError: fetch failed` | `Error` `code: 'ConnectionRefused'`          |\n * | DNS failure   | `TypeError: fetch failed` | `Error` `code: 'ConnectionRefused'`          |\n * | reset         | `TypeError: fetch failed` | `Error` `code: 'ECONNRESET'`                 |\n * | TLS rejected  | `TypeError: fetch failed` | `Error` `code: 'UNKNOWN_CERTIFICATE_…ERROR'` |\n *\n * So the test is the **evidence, not a list of dialect strings**: a string\n * `code` is a runtime naming a transport-level failure. An allowlist of codes\n * was written first and rejected — the TLS row alone would mean enumerating\n * BoringSSL's certificate table, and a code nobody guessed is precisely the bug\n * this closes. Two kinds of error are deliberately NOT caught: ordinary JS\n * faults carry no `code` at all, and a `DOMException`'s is a **number**, so\n * aborts and timeouts fall through to their own arms.\n *\n * The accepted trade: a caller's `TokenProvider` that throws a coded error\n * (`ENOENT` from a keychain read) is typed `Network` rather than `Api`. Both\n * are wrong for it, `Network` is the cheaper wrong — it says \"nothing was\n * exchanged\", which is true, where `Api` claims a server answered.\n */\nfunction isTransportFailure(cause) {\n    if (typeof cause.code === 'string')\n        return true;\n    // Spec runtimes put no code on the rejection itself. The message test is what\n    // keeps fetch's ARGUMENT errors out — `Failed to parse URL from …` is a\n    // caller's config mistake, not a transport failure.\n    return cause instanceof TypeError && cause.message.includes('fetch');\n}\n/**\n * Simple unified error class for both API and SDK\n */\nexport class ShipError extends Error {\n    type;\n    status;\n    details;\n    constructor(type, message, status, details) {\n        super(message);\n        this.type = type;\n        this.status = status;\n        this.details = details;\n        this.name = 'ShipError';\n    }\n    /** Convert to wire format */\n    toResponse() {\n        // Strip authentication details when they carry an `internal` telemetry\n        // tag (see `ShipError.authentication` JSDoc) — these are server-side\n        // diagnostics like 'session_invalid' that must not leak to clients.\n        const authDetails = this.details;\n        const details = this.type === ErrorType.Authentication && authDetails?.internal ? undefined : this.details;\n        return {\n            error: this.type,\n            message: this.message,\n            status: this.status,\n            details,\n        };\n    }\n    /**\n     * Construct a `ShipError` from an HTTP error response.\n     *\n     * Best-effort body parse for `{ message, error?, details? }`. Message\n     * resolution: `body.message` → `body.error` → `\"<operationName> failed with\n     * status <N>\"`.\n     *\n     * Type resolution: trusts `body.error` when it's a known server-producible\n     * `ErrorType` (preserves the wire's intent — server's\n     * `ShipError.validation(...)` round-trips back to `ErrorType.Validation`\n     * on the client). Falls back to status-derived (401 → Authentication,\n     * 403 → Forbidden, 429 → RateLimit, else → Api) for non-API responses\n     * (CDN errors, intermediaries) or malformed bodies. Client-only types\n     * (`Network`, `Cancelled`, `File`, `Config`) are filtered out of the\n     * trusted set — a misbehaving server claiming one of those is ignored.\n     *\n     * `operationName` (e.g. `\"Get account\"`) is used to compose the fallback\n     * message. Defaults to `\"Request\"`. Same convention as `fromFetchError`.\n     *\n     * Async because it reads the response body. Returns rather than throws so\n     * callers can compose; most will `throw await ShipError.fromHttpResponse(...)`.\n     */\n    static async fromHttpResponse(response, operationName) {\n        let message;\n        let details;\n        let bodyType;\n        try {\n            const contentType = response.headers.get('content-type');\n            if (contentType?.includes('application/json')) {\n                const json = await response.json();\n                if (json && typeof json === 'object') {\n                    const obj = json;\n                    if (typeof obj.message === 'string')\n                        message = obj.message;\n                    else if (typeof obj.error === 'string')\n                        message = obj.error;\n                    details = obj.details;\n                    if (typeof obj.error === 'string' && SERVER_PRODUCIBLE_ERROR_TYPES.has(obj.error)) {\n                        bodyType = obj.error;\n                    }\n                }\n            }\n            else {\n                // A non-JSON body did not come from this platform — every API error\n                // is `ErrorResponse` JSON — so it is an intermediary's output, and\n                // the two kinds it produces need opposite treatment. A CDN's plain\n                // `error code: 1015` is the most useful thing there is to say. A\n                // proxy's HTML error page is a *document*, not a message: adopting it\n                // verbatim made a misconfigured `apiUrl` print 2,059 characters of\n                // markup as the error. Trust it only when it reads as a message.\n                const text = (await response.text()).trim();\n                if (text && !text.startsWith('<') && text.length <= MAX_FOREIGN_MESSAGE_LENGTH) {\n                    message = text;\n                }\n            }\n        }\n        catch {\n            // Body unreadable; fall through to operationName-derived message.\n        }\n        // Rate-limit (and 503) timing rides the `Retry-After` HEADER, which a\n        // body-only reader would drop. Lift it into `details` as seconds so\n        // consumers can back off from the typed error alone, without keeping the\n        // raw Response around. Body-carried fields are preserved and win.\n        const retryAfterHeader = response.headers.get('retry-after');\n        if (retryAfterHeader !== null) {\n            const value = retryAfterHeader.trim();\n            const seconds = /^\\d+$/.test(value)\n                ? Number(value)\n                : Math.ceil((Date.parse(value) - Date.now()) / 1000);\n            if (Number.isFinite(seconds) && seconds >= 0) {\n                const existing = details && typeof details === 'object' ? details : {};\n                if (existing.retryAfter === undefined) {\n                    details = { ...existing, retryAfter: seconds };\n                }\n            }\n        }\n        message = message || `${operationName || 'Request'} failed with status ${response.status}`;\n        const type = bodyType ??\n            (response.status === 401\n                ? ErrorType.Authentication\n                : response.status === 403\n                    ? ErrorType.Forbidden\n                    : response.status === 429\n                        ? ErrorType.RateLimit\n                        : ErrorType.Api);\n        return new ShipError(type, message, response.status, details);\n    }\n    /**\n     * Construct a `ShipError` from an error caught around a `fetch()` call.\n     *\n     * The mirror of `fromHttpResponse` for the *other* side of the HTTP error\n     * story — the network layer failing (offline, CORS, abort) rather than the\n     * server returning a non-OK response.\n     *\n     * Routing:\n     * - Already a `ShipError` → returned as-is (caller's intent preserved)\n     * - `AbortError` → `ShipError.cancelled(...)`\n     * - A transport failure → `ShipError.network(...)` — see `isTransportFailure`\n     *   for what each runtime offers as evidence\n     * - Any other `Error` → `ShipError(Api, ...)` (no HTTP status — fetch never reached the server)\n     * - Anything else (string, undefined, etc.) → `ShipError(Api, ...)`\n     *\n     * The optional `operationName` is composed into the message for context:\n     * `\"Get account was cancelled\"`, `\"Get account failed: ...\"`. Defaults to\n     * `\"Request\"` when omitted.\n     */\n    static fromFetchError(cause, operationName) {\n        if (isShipError(cause))\n            return cause;\n        const op = operationName || 'Request';\n        if (cause instanceof Error) {\n            if (cause.name === 'AbortError') {\n                return ShipError.cancelled(`${op} was cancelled`);\n            }\n            if (isTransportFailure(cause)) {\n                return ShipError.network(`${op} failed: ${cause.message}`, { cause });\n            }\n            return new ShipError(ErrorType.Api, `${op} failed: ${cause.message}`);\n        }\n        return new ShipError(ErrorType.Api, `${op} failed: Unknown error`);\n    }\n    // Factory methods. Uniform shape `(message, details?)` with two principled\n    // exceptions: `notFound` composes its message from (resource, id?), and\n    // `business` / `api` accept an optional status because they're the\n    // multi-status fallbacks.\n    static validation(message, details) {\n        return new ShipError(ErrorType.Validation, message, 400, details);\n    }\n    static notFound(resource, id) {\n        const message = id ? `${resource} ${id} not found` : `${resource} not found`;\n        return new ShipError(ErrorType.NotFound, message, 404);\n    }\n    static forbidden(message, details) {\n        return new ShipError(ErrorType.Forbidden, message, 403, details);\n    }\n    static rateLimit(message = 'Too many requests', details) {\n        return new ShipError(ErrorType.RateLimit, message, 429, details);\n    }\n    /**\n     * Construct an Authentication (401) error.\n     *\n     * **Telemetry pattern — `details: { internal: '<tag>' }`.** When the\n     * server creates an auth error with an `internal` key in `details`\n     * (e.g. `{ internal: 'session_invalid' }`), `toResponse()` strips the\n     * entire `details` object before serialization. This keeps the wire\n     * response a clean \"Authentication failed\" while preserving granular\n     * server-side telemetry (which strategy/check failed) for logs and tests.\n     *\n     * Use this pattern in API auth code; do not put client-visible info under\n     * `internal`. Other `details` keys round-trip normally.\n     */\n    static authentication(message = 'Authentication required', details) {\n        return new ShipError(ErrorType.Authentication, message, 401, details);\n    }\n    static business(message, status = 400, details) {\n        return new ShipError(ErrorType.Business, message, status, details);\n    }\n    static network(message, details) {\n        return new ShipError(ErrorType.Network, message, undefined, details);\n    }\n    static cancelled(message, details) {\n        return new ShipError(ErrorType.Cancelled, message, undefined, details);\n    }\n    static file(message, details) {\n        return new ShipError(ErrorType.File, message, undefined, details);\n    }\n    static config(message, details) {\n        return new ShipError(ErrorType.Config, message, undefined, details);\n    }\n    static api(message, status = 500, details) {\n        return new ShipError(ErrorType.Api, message, status, details);\n    }\n    /**\n     * The platform is closed for maintenance (503).\n     *\n     * `message` is REQUIRED and has no default here. The API is the only\n     * producer of that sentence, and a default in this file would be a second\n     * owner of one fact — see CLAUDE.md, \"The Constellation Law\" (stopping\n     * rule). It is also the one factory whose status is fixed rather than\n     * defaulted: a maintenance refusal is 503 or it is not this error.\n     */\n    static maintenance(message, details) {\n        return new ShipError(ErrorType.Maintenance, message, 503, details);\n    }\n    // Semantic-category guards. For specific-type checks, use\n    // `error.type === ErrorType.X` directly or the generic `isType(t)`.\n    /**\n     * The caller is at fault — by HTTP's own definition of a 4xx, or by a type\n     * that is client-attributable without ever having a status (`Config`,\n     * `File`, raised locally by the SDK).\n     *\n     * Both arms are load-bearing, because type and status are independent\n     * axes. `fromHttpResponse` trusts `body.error` only when it names a\n     * server-producible type; a non-OK response without one is status-derived,\n     * so a CDN 404 or any intermediary error arrives as `Api` — a server-fault\n     * *type* carrying a client *status*. Judging by type alone would report it\n     * as a platform failure and bury the server's own message.\n     */\n    isClientError() {\n        if (ERROR_CATEGORIES.client.has(this.type))\n            return true;\n        return this.status !== undefined && this.status >= 400 && this.status < 500;\n    }\n    isNetworkError() {\n        return ERROR_CATEGORIES.network.has(this.type);\n    }\n    isAuthError() {\n        return ERROR_CATEGORIES.auth.has(this.type);\n    }\n    isType(errorType) {\n        return this.type === errorType;\n    }\n}\n/**\n * Type guard to check if an unknown value is a ShipError.\n *\n * Uses structural checking instead of instanceof to handle module duplication\n * in bundled applications where multiple copies of the ShipError class may exist.\n *\n * @example\n * if (isShipError(error)) {\n *   console.log(error.status, error.message);\n * }\n */\nexport function isShipError(error) {\n    return (error !== null &&\n        typeof error === 'object' &&\n        'name' in error &&\n        error.name === 'ShipError' &&\n        'status' in error);\n}\n// =============================================================================\n// EXTENSION BLOCKLIST\n// =============================================================================\n/**\n * Blocked file extensions — files that cannot be uploaded.\n *\n * We accept any file type by default and derive Content-Type from the\n * extension at serve time (via mime-db in the API worker). Unknown extensions\n * are served as `application/octet-stream` with `X-Content-Type-Options: nosniff`.\n *\n * The blocklist targets file types that pose direct security risks when hosted:\n * executables, disk images, malware vectors, dangerous scripts, and shortcuts.\n */\nexport const BLOCKED_EXTENSIONS = new Set([\n    // Executables\n    'exe',\n    'msi',\n    'dll',\n    'scr',\n    'bat',\n    'cmd',\n    'com',\n    'pif',\n    'app',\n    'deb',\n    'rpm',\n    // Installers\n    'pkg',\n    'mpkg',\n    // Disk images\n    'dmg',\n    'iso',\n    'img',\n    // Malware vectors\n    'cab',\n    'cpl',\n    'chm',\n    // Dangerous scripts\n    'ps1',\n    'vbs',\n    'vbe',\n    'ws',\n    'wsf',\n    'wsc',\n    'wsh',\n    'reg',\n    // Java\n    'jar',\n    'jnlp',\n    // Mobile/browser packages\n    'apk',\n    'crx',\n    // Shortcut/link\n    'lnk',\n    'inf',\n    'hta',\n]);\n/**\n * Check if a filename has a blocked extension.\n * Extracts the extension from the filename and checks against the blocklist.\n * Case-insensitive. Returns false for files without extensions.\n *\n * @example\n * isBlockedExtension('virus.exe')     // true\n * isBlockedExtension('app.dmg')       // true\n * isBlockedExtension('style.css')     // false\n * isBlockedExtension('data.custom')   // false\n * isBlockedExtension('README')        // false\n */\nexport function isBlockedExtension(filename) {\n    const dotIndex = filename.lastIndexOf('.');\n    if (dotIndex === -1 || dotIndex === filename.length - 1)\n        return false;\n    const ext = filename.slice(dotIndex + 1).toLowerCase();\n    return BLOCKED_EXTENSIONS.has(ext);\n}\n// =============================================================================\n// PICKER ACCEPT HINT\n// =============================================================================\n/**\n * The extensions a browser file picker offers by default, grouped by role.\n *\n * Private on purpose: the only published form is `WEB_FILE_ACCEPT`, the\n * attribute value itself. A published set would invite a call site to ask it\n * whether a file is allowed — which is the one thing this list must never\n * answer. See `WEB_FILE_ACCEPT`.\n *\n * Extensionless files (`LICENSE`, most `.well-known` entries) are inexpressible\n * in `accept`, and reach a deployment by folder pick, ZIP, or drag-and-drop.\n */\nconst WEB_FILE_EXTENSIONS = [\n    // Markup & documents\n    'html',\n    'htm',\n    'xhtml',\n    'xml',\n    'txt',\n    'md',\n    'markdown',\n    'pdf',\n    'csv',\n    // Data & config\n    'json',\n    'jsonc',\n    'webmanifest',\n    'map',\n    'toml',\n    'yaml',\n    'yml',\n    'rss',\n    'atom',\n    // Styles\n    'css',\n    'scss',\n    'sass',\n    'less',\n    // Scripts & modules\n    'js',\n    'mjs',\n    'cjs',\n    'jsx',\n    'ts',\n    'tsx',\n    'wasm',\n    'vue',\n    'svelte',\n    // Images\n    'png',\n    'jpg',\n    'jpeg',\n    'gif',\n    'webp',\n    'avif',\n    'svg',\n    'ico',\n    'bmp',\n    'tif',\n    'tiff',\n    'heic',\n    'heif',\n    // Fonts\n    'woff',\n    'woff2',\n    'ttf',\n    'otf',\n    'eot',\n    // Audio\n    'mp3',\n    'wav',\n    'ogg',\n    'oga',\n    'opus',\n    'm4a',\n    'aac',\n    'flac',\n    'weba',\n    // Video\n    'mp4',\n    'webm',\n    'ogv',\n    'mov',\n    'm4v',\n    'avi',\n    // 3D models\n    'glb',\n    'gltf',\n    'usdz',\n    // Text tracks\n    'vtt',\n    'srt',\n    // Archive — a whole site in one file\n    'zip',\n];\n/**\n * The `accept` attribute value for a browser file picker offering web files.\n *\n * **This is a hint, never a rule.** `BLOCKED_EXTENSIONS` is the platform's\n * gate and the only thing that decides what may be hosted; this constant\n * decides what a *file dialog* shows first. The two are not two halves of one\n * policy, and this one must never be consulted to accept or reject a file.\n *\n * The distinction is structural, not stylistic. `accept` can express only an\n * allowlist, while the platform's rule is a blocklist — so this list is\n * necessarily *narrower* than what the platform hosts, and reading it as\n * authority would reject files the platform serves happily. It is also not\n * enforcement in the browser's own terms: every file dialog offers an\n * all-files escape, and **drag-and-drop ignores `accept` entirely**. The\n * dropzone and the picker must reach the same verdict on the same files, and\n * they do — because the verdict is `validateFiles`, downstream of both.\n *\n * Kept beside `BLOCKED_EXTENSIONS` so one file holds both, which is what lets\n * `tests/validation-constants.test.ts` fence the invariant that matters: the\n * picker must never offer a file the platform will refuse.\n */\nexport const WEB_FILE_ACCEPT = WEB_FILE_EXTENSIONS.map((ext) => `.${ext}`).join(',');\n// =============================================================================\n// FILENAME CHARACTER VALIDATION\n// =============================================================================\n/**\n * Characters that are unsafe in filenames for static hosting.\n *\n * Blocks only characters that genuinely break the upload→serve round-trip:\n * - # ? %        URL round-trip breakers (fragment, query, encoding ambiguity)\n * - \\            Path separator confusion (upload splits on backslash)\n * - < > \"        XSS vectors with zero legitimate use in filenames\n * - \\x00-\\x1f \\x7f  Control characters (header injection, display corruption)\n *\n * Everything else is allowed — browser percent-encodes, Worker decodes, R2 matches.\n */\n// biome-ignore lint/suspicious/noControlCharactersInRegex: blocking control characters is this regex's purpose\nexport const UNSAFE_FILENAME_CHARS = /[\\x00-\\x1f\\x7f#?%\\\\<>\"]/;\n/**\n * Check if a filename contains unsafe characters.\n *\n * @example\n * hasUnsafeChars('saved_resource(1).html')  // false — parentheses are safe\n * hasUnsafeChars('page[slug].js')           // false — brackets are safe\n * hasUnsafeChars('file#anchor.html')        // true  — # breaks URL resolution\n * hasUnsafeChars('file<tag>.html')          // true  — < is an XSS vector\n */\nexport function hasUnsafeChars(filename) {\n    return UNSAFE_FILENAME_CHARS.test(filename);\n}\n// =============================================================================\n// UNBUILT PROJECT MARKERS\n// =============================================================================\n/**\n * Path segment names that indicate an unbuilt project was uploaded instead of build output.\n * Used for early detection in CLI, browser, and server validation.\n */\nexport const UNBUILT_PROJECT_MARKERS = new Set([\n    'node_modules',\n    'package.json',\n]);\n/**\n * Check if a file path contains an unbuilt project marker.\n *\n * @example\n * hasUnbuiltMarker('node_modules/react/index.js')  // true\n * hasUnbuiltMarker('package.json')                  // true\n * hasUnbuiltMarker('dist/index.html')               // false\n */\nexport function hasUnbuiltMarker(filePath) {\n    const segments = filePath.replace(/\\\\/g, '/').split('/').filter(Boolean);\n    return segments.some((s) => UNBUILT_PROJECT_MARKERS.has(s));\n}\n// =============================================================================\n// CREDENTIAL SHAPES\n// =============================================================================\n// The one address for credential vocabulary: where human identity lives\n// (AUTH_BASE_PATH), how a request is authorized (AuthMethod), the shapes\n// that distinguish populations on the wire (API_KEY, DEPLOY_TOKEN, CALLER),\n// the single dispatch over them (TokenKind, classifyToken), and the\n// delegated-access scopes (OAuthScope).\n/**\n * Where human identity is mounted on the API host. The API mounts Better\n * Auth at this path (sign-in, sign-out, session reads, admin impersonation)\n * and the web console's auth client posts to it — shared here so the two\n * halves of the auth pair agree by construction, the same way both sides\n * already share the credential prefixes below.\n */\nexport const AUTH_BASE_PATH = '/auth';\n/**\n * How a request (or recorded activity) was authorized.\n *\n * Client populations: `SESSION` (first-party cookie), `API_KEY` (`ship-`\n * key), `TOKEN` (`deploy-` deploy token), `AGENT` (anonymous public deploy —\n * no credential; the platform grants the public-account identity per\n * request), `OAUTH` (delegated access token). Server populations: `WEBHOOK`\n * (signed webhook processing), `SYSTEM` (scheduled/background jobs).\n */\nexport const AuthMethod = {\n    SESSION: 'session',\n    API_KEY: 'apiKey',\n    TOKEN: 'token',\n    AGENT: 'agent',\n    OAUTH: 'oauth',\n    WEBHOOK: 'webhook',\n    SYSTEM: 'system',\n};\n/**\n * Shape constants for API keys (`ship-{64 hex chars}`).\n * Single source of truth used by validation utilities and auth middleware.\n */\nexport const API_KEY = {\n    /** Prefix that identifies an API key. */\n    PREFIX: 'ship-',\n    /** Number of hex characters following the prefix. */\n    HEX_LENGTH: 64,\n    /** Total length of an API key including prefix (`PREFIX.length + HEX_LENGTH = 69`). */\n    TOTAL_LENGTH: 69,\n    /** Number of trailing characters used to display a redacted hint (e.g. last 4). */\n    HINT_LENGTH: 4,\n};\n/**\n * Shape constants for deploy tokens (`deploy-{64 hex chars}`).\n * Single source of truth used by validation utilities and auth middleware.\n */\nexport const DEPLOY_TOKEN = {\n    /** Prefix that identifies a deploy token. */\n    PREFIX: 'deploy-',\n    /** Number of hex characters following the prefix. */\n    HEX_LENGTH: 64,\n    /** Total length of a deploy token including prefix (`PREFIX.length + HEX_LENGTH = 71`). */\n    TOTAL_LENGTH: 71,\n};\n/**\n * Shape constants for caller identifiers (the `X-Caller` instance-identity\n * header — rate-limit bucketing for multi-tenant orchestrators). The API\n * normalizes case and silently ignores malformed values (the header is\n * unauthenticated); clients validate at the boundary via `validateCaller`,\n * so a value the server would drop fails fast instead.\n */\nexport const CALLER = {\n    /** HTTP header name. */\n    HEADER: 'X-Caller',\n    /** Maximum identifier length. */\n    MAX_LENGTH: 128,\n    /** Allowed characters: alphanumeric, dot, underscore, hyphen. */\n    PATTERN: /^[a-zA-Z0-9._-]+$/,\n};\n/**\n * Token populations distinguishable by shape. The platform carries every\n * client token in one wire slot (`Authorization: Bearer <value>`) and\n * classifies by value, never by a side channel — this is the classifier.\n *\n * `API_KEY` and `DEPLOY_TOKEN` *are* `AuthMethod.API_KEY` and\n * `AuthMethod.TOKEN` — the equality is structural, so a classification flows\n * straight into an auth method and the pair can never drift. `OPAQUE` is any\n * other value — shape says nothing about it, so only a lookup can. Today the\n * server refuses every opaque bearer; the OAuth access-token population\n * resolves there when the authorization server ships.\n */\nexport const TokenKind = {\n    API_KEY: AuthMethod.API_KEY,\n    DEPLOY_TOKEN: AuthMethod.TOKEN,\n    OPAQUE: 'opaque',\n};\n/**\n * Classify a client token by shape. The single dispatch used by both sides\n * of the wire: API auth middleware (which population is this credential?)\n * and SDK validation (which format rules apply before sending?). Sharing it\n * is what guarantees client and server can never disagree on dispatch.\n */\nexport function classifyToken(token) {\n    if (token.startsWith(API_KEY.PREFIX))\n        return TokenKind.API_KEY;\n    if (token.startsWith(DEPLOY_TOKEN.PREFIX))\n        return TokenKind.DEPLOY_TOKEN;\n    return TokenKind.OPAQUE;\n}\n/**\n * OAuth scope vocabulary for delegated third-party access tokens.\n * Single source of truth used by the authorization server (advertised in\n * `scopes_supported`), the API's scope-enforcement middleware, and consent UI\n * copy. The standard `offline_access` scope (refresh tokens) is not platform\n * vocabulary and is deliberately absent — the middleware never checks it.\n *\n * Deliberately absent by design: any `tokens:*` scope, `account:write`, or\n * admin scope — a delegated app must never mint credentials, delete the\n * account, or act as admin.\n */\nexport const OAuthScope = {\n    ACCOUNT_READ: 'account:read',\n    DEPLOYMENTS_READ: 'deployments:read',\n    DEPLOYMENTS_WRITE: 'deployments:write',\n    DOMAINS_READ: 'domains:read',\n    DOMAINS_WRITE: 'domains:write',\n};\n// =============================================================================\n// DEPLOYMENT CONFIGURATION CONSTANTS\n// =============================================================================\nexport const DEPLOYMENT_CONFIG_FILENAME = 'ship.json';\n/** Default ship.json config for SPA routing. Single source of truth — used by both API and SDK. */\nexport const SPA_DEFAULT_CONFIG = {\n    rewrites: [{ source: '/(.*)', destination: '/index.html' }],\n};\n/**\n * The `/spa-check` pre-flight's client-side envelope: which file is the\n * check's subject, and how large it may be before a client skips the call.\n *\n * One fact with three holders until this export — the API's config declared\n * the cap, the SDK's `checkSPA` hardcoded `100 * 1024`, and prose restated\n * \"100KB\". `INDEX_FILE` is the selection rule (the file whose content rides\n * `SPACheckRequest.index`), restated by every client that builds the request.\n *\n * Neither member is a validation boundary: a client over the cap simply\n * skips the pre-flight, because the server answers an oversized index\n * `isSPA: false` anyway. A consumer that cannot import this (n8n) needs no\n * size copy at all — outcome parity is the server's, not the client's.\n */\nexport const SPA_CHECK_CONSTRAINTS = {\n    /** The file whose content is the check's subject. */\n    INDEX_FILE: 'index.html',\n    /** Skip the pre-flight above this size — the server would answer false. */\n    MAX_INDEX_BYTES: 100 * 1024,\n};\n/**\n * Assert that a ship.json file is *syntactically* loadable. Syntax only —\n * never schema.\n *\n * ship.json is validated and compiled on the server, deliberately: the schema\n * and the compiler evolve, and a client that judged them would reject configs\n * a newer platform accepts. That reasoning bounds what a client may check to\n * the properties which are true of *every* past and future schema:\n *\n *   1. it parses as JSON — JSON syntax is frozen (RFC 8259), so text that\n *      does not parse can never be a valid config;\n *   2. its top level is an object — ship.json is `{ ... }` in every version.\n *\n * Both are monotonic: neither can ever reject something the server would\n * accept. Everything beyond them (field names, types, rule semantics, which\n * keys are permitted) stays server-side, where it can change.\n *\n * The payoff is the common case. Hand-edited JSON fails on a trailing comma,\n * a `//` comment, single quotes, unquoted keys, or smart quotes pasted from\n * documentation — mistakes that otherwise cost a full upload round-trip to\n * discover. A UTF-8 BOM (Windows editors, PowerShell redirects) is stripped\n * before parsing rather than rejected, because the server accepts it too;\n * diverging there would reintroduce exactly the false rejection this\n * function exists to avoid.\n *\n * @throws {ShipError} `ErrorType.Config` — the same type the server's own\n * config rejection carries, so the error contract is identical wherever the\n * failure is detected.\n */\nexport function assertShipJsonSyntax(text) {\n    const withoutBom = text.charCodeAt(0) === 0xfeff ? text.slice(1) : text;\n    let parsed;\n    try {\n        parsed = JSON.parse(withoutBom);\n    }\n    catch (error) {\n        throw ShipError.config(`invalid JSON format in config: ${error.message}`, {\n            filePath: DEPLOYMENT_CONFIG_FILENAME,\n        });\n    }\n    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {\n        throw ShipError.config(`${DEPLOYMENT_CONFIG_FILENAME} must contain a JSON object`, {\n            filePath: DEPLOYMENT_CONFIG_FILENAME,\n        });\n    }\n}\n// =============================================================================\n// VALIDATION UTILITIES\n// =============================================================================\n/**\n * Shared rule for prefixed credentials: `{PREFIX}{HEX_LENGTH hex chars}`.\n * The regex derives from the shape constants, so the validators can never\n * drift from the shapes `classifyToken` dispatches on.\n */\nfunction validatePrefixedCredential(value, shape, label) {\n    if (!value.startsWith(shape.PREFIX)) {\n        throw ShipError.validation(`${label} must start with \"${shape.PREFIX}\"`);\n    }\n    if (value.length !== shape.TOTAL_LENGTH) {\n        throw ShipError.validation(`${label} must be ${shape.TOTAL_LENGTH} characters total (${shape.PREFIX} + ${shape.HEX_LENGTH} hex chars)`);\n    }\n    const hexPart = value.slice(shape.PREFIX.length);\n    if (!new RegExp(`^[a-f0-9]{${shape.HEX_LENGTH}}$`, 'i').test(hexPart)) {\n        throw ShipError.validation(`${label} must contain ${shape.HEX_LENGTH} hexadecimal characters after \"${shape.PREFIX}\" prefix`);\n    }\n}\n/**\n * Validate API key format\n */\nexport function validateApiKey(apiKey) {\n    validatePrefixedCredential(apiKey, API_KEY, 'API key');\n}\n/**\n * Validate deploy token format\n */\nexport function validateDeployToken(deployToken) {\n    validatePrefixedCredential(deployToken, DEPLOY_TOKEN, 'Deploy token');\n}\n/**\n * Validate a client token of any population. Classifies by shape and applies\n * the matching format rules: `ship-` keys and `deploy-` deploy tokens are\n * validated strictly; opaque tokens (OAuth access tokens, future populations)\n * only need to be non-empty — their validity is the server's to decide.\n */\nexport function validateToken(token) {\n    switch (classifyToken(token)) {\n        case TokenKind.API_KEY:\n            validateApiKey(token);\n            return;\n        case TokenKind.DEPLOY_TOKEN:\n            validateDeployToken(token);\n            return;\n        case TokenKind.OPAQUE:\n            if (!token)\n                throw ShipError.validation('Token must be a non-empty string');\n    }\n}\n/**\n * Validate a caller identifier against the `CALLER` shape. The server\n * silently ignores malformed values (the header is unauthenticated); clients\n * call this at configuration time so the drop never silently happens.\n */\nexport function validateCaller(caller) {\n    if (!caller || caller.length > CALLER.MAX_LENGTH || !CALLER.PATTERN.test(caller)) {\n        throw ShipError.validation(`Caller must be 1-${CALLER.MAX_LENGTH} characters: letters, digits, dots, underscores, or hyphens`);\n    }\n}\n/**\n * Validate API URL format\n */\nexport function validateApiUrl(apiUrl) {\n    try {\n        const url = new URL(apiUrl);\n        if (!['http:', 'https:'].includes(url.protocol)) {\n            throw ShipError.validation('API URL must use http:// or https:// protocol');\n        }\n        if (url.pathname !== '/' && url.pathname !== '') {\n            throw ShipError.validation('API URL must not contain a path');\n        }\n        if (url.search || url.hash) {\n            throw ShipError.validation('API URL must not contain query parameters or fragments');\n        }\n    }\n    catch (error) {\n        if (isShipError(error)) {\n            throw error;\n        }\n        throw ShipError.validation('API URL must be a valid URL');\n    }\n}\n/**\n * Check if a string matches the deployment identifier pattern (word-word-alphanumeric7).\n * Example: \"happy-cat-abc1234.shipstatic.com\"\n */\nexport function isDeployment(input) {\n    return /^[a-z]+-[a-z]+-[a-z0-9]{7}(\\.[a-z0-9.-]+)?$/i.test(input);\n}\n// =============================================================================\n// PLATFORM CONSTANTS\n// =============================================================================\n/** Default API URL if not otherwise configured. */\nexport const DEFAULT_API = 'https://api.shipstatic.com';\n/**\n * The Node SDK's ambient configuration pair — the ONLY environment variables\n * the SDK reads, and therefore the COMPLETE list an embedding host must\n * scrub (per `npm/ship`'s strict-isolation contract, scrubbing is the host's\n * job, not the SDK's). A host that derives its scrub from this object's\n * values — as the VS Code extension's child-process env block does — picks\n * up a grown contract at the next pin bump instead of by remembered prose.\n *\n * Browser builds read no environment at all, and the CLI-only variables\n * (`SHIP_PASSWORD`, `SHIP_VIA`) are deliberately NOT here: they are the\n * CLI's operational levers, not the SDK's ambient contract — see\n * `npm/ship/CLAUDE.md`, \"CLI-only env vars\".\n */\nexport const SHIP_ENV = {\n    /** The one credential slot — any platform token. */\n    TOKEN: 'SHIP_TOKEN',\n    /** The API endpoint override. */\n    API_URL: 'SHIP_API_URL',\n};\n/**\n * Where a human creates an API key — the console deep link quoted by every\n * surface that teaches authentication (the CLI's config wizard, the VS Code\n * and n8n listings, the n8n rate-limit hint and credential copy). Written\n * out in five files across three repos until this export.\n *\n * Production-branded by design: published artifacts name the product, never\n * an environment (root `CLAUDE.md`, \"Environment-Aware URLs\").\n */\nexport const MY_API_KEY_URL = 'https://my.shipstatic.com/api-key';\n/**\n * How long an anonymous deployment lives before it expires.\n *\n * The lifetime of the public tier, and one fact with several readers. The API\n * stamps a deployment's `expires` from it and gives a claim code exactly the\n * same window — a live site with a dead claim link is a coherence bug, so the\n * two are one constant rather than two that agree. Both MCP transports quote\n * the duration in prose an agent reads, and derive it from here rather than\n * writing it out, which they did in eight places until this export existed.\n *\n * Seconds, spelled in the name: this platform has both second- and\n * millisecond-valued durations, and the pair is only safe when each says which\n * it is.\n */\nexport const PUBLIC_DEPLOYMENT_TTL_SECONDS = 3 * 24 * 60 * 60;\n// =============================================================================\n// FILE UPLOAD TYPES\n// =============================================================================\n/**\n * File status constants for validation state tracking\n */\nexport const FileValidationStatus = {\n    /** File is pending validation */\n    PENDING: 'pending',\n    /** File failed during processing (before validation) */\n    PROCESSING_ERROR: 'processing_error',\n    /** File was excluded by validation warning (not an error) */\n    EXCLUDED: 'excluded',\n    /** File failed validation (blocks deployment) */\n    VALIDATION_FAILED: 'validation_failed',\n    /** File passed validation and is ready for deployment */\n    READY: 'ready',\n};\n// =============================================================================\n// DOMAIN UTILITIES\n// =============================================================================\n/**\n * Check if a domain is a platform domain (subdomain of our platform).\n * Platform domains are free and don't require DNS verification.\n *\n * @example isPlatformDomain(\"www.shipstatic.com\", \"shipstatic.com\") → true\n * @example isPlatformDomain(\"example.com\", \"shipstatic.com\") → false\n */\nexport function isPlatformDomain(domain, platformDomain) {\n    return domain.endsWith(`.${platformDomain}`);\n}\n/**\n * Check if a domain is a custom domain (not a platform subdomain).\n * Custom domains are billable and require DNS verification.\n *\n * @example isCustomDomain(\"example.com\", \"shipstatic.com\") → true\n * @example isCustomDomain(\"www.shipstatic.com\", \"shipstatic.com\") → false\n */\nexport function isCustomDomain(domain, platformDomain) {\n    return !isPlatformDomain(domain, platformDomain);\n}\n/**\n * Extract subdomain from a platform domain.\n * Returns null if not a platform domain.\n *\n * @example extractSubdomain(\"www.shipstatic.com\", \"shipstatic.com\") → \"www\"\n * @example extractSubdomain(\"example.com\", \"shipstatic.com\") → null\n */\nexport function extractSubdomain(domain, platformDomain) {\n    if (!isPlatformDomain(domain, platformDomain)) {\n        return null;\n    }\n    return domain.slice(0, -(platformDomain.length + 1)); // +1 for the dot\n}\n/**\n * Generate HTTPS URL for a deployment hostname.\n */\nexport function generateDeploymentUrl(deployment) {\n    return `https://${deployment}`;\n}\n/**\n * Generate HTTPS URL for a domain.\n */\nexport function generateDomainUrl(domain) {\n    return `https://${domain}`;\n}\n// =============================================================================\n// LABEL UTILITIES\n// =============================================================================\n/**\n * Label validation constraints shared across UI and API.\n * These rules define the single source of truth for label validation.\n */\nexport const LABEL_CONSTRAINTS = {\n    /** Minimum label length in characters */\n    MIN_LENGTH: 3,\n    /** Maximum label length in characters (concise labels, matches Stack Overflow's original limit) */\n    MAX_LENGTH: 25,\n    /** Maximum number of labels allowed per resource */\n    MAX_COUNT: 10,\n    /** Allowed separator characters between label segments */\n    SEPARATORS: '._-',\n};\n/**\n * Label validation pattern.\n * Must start and end with alphanumeric (a-z, 0-9).\n * Can contain separators (. _ -) between segments, but not consecutive.\n *\n * Valid examples: 'production', 'v1.2.3', 'api_v2', 'us-east-1'\n * Invalid examples: 'ab' (too short), '-prod' (starts with separator), 'foo--bar' (consecutive separators)\n */\nexport const LABEL_PATTERN = /^[a-z0-9]+(?:[._-][a-z0-9]+)*$/;\n/**\n * Serialize labels array to JSON string for database storage.\n * Returns null for empty or undefined arrays.\n *\n * @example serializeLabels(['web', 'production']) → '[\"web\",\"production\"]'\n * @example serializeLabels([]) → null\n * @example serializeLabels(undefined) → null\n */\nexport function serializeLabels(labels) {\n    if (!labels || labels.length === 0)\n        return null;\n    return JSON.stringify(labels);\n}\n/**\n * Deserialize labels from JSON string to array.\n * Always returns an array — empty array for null/empty/invalid input.\n *\n * @example deserializeLabels('[\"web\",\"production\"]') → ['web', 'production']\n * @example deserializeLabels(null) → []\n * @example deserializeLabels('') → []\n */\nexport function deserializeLabels(labelsJson) {\n    if (!labelsJson)\n        return [];\n    try {\n        const parsed = JSON.parse(labelsJson);\n        return Array.isArray(parsed) ? parsed : [];\n    }\n    catch {\n        return [];\n    }\n}\n// =============================================================================\n// PASSWORD UTILITIES\n// =============================================================================\n/**\n * Length constraints for the optional deployment password\n * (`DeploymentUploadOptions.password`). Single source of truth shared across\n * platform consumers.\n */\nexport const PASSWORD_CONSTRAINTS = {\n    /** Minimum password length in characters */\n    MIN_LENGTH: 6,\n    /** Maximum password length in characters */\n    MAX_LENGTH: 128,\n};\n/**\n * Validate an optional deployment password and return it normalized.\n *\n * Absent (`undefined` / `null`) → returns `undefined`. Present → trim\n * leading/trailing whitespace, then validate against `PASSWORD_CONSTRAINTS`\n * length bounds (internal whitespace is significant and counts toward\n * length). Throws `ShipError.validation` on breach; returns the trimmed\n * value.\n *\n * The trim is canonical: at upload, the API hashes the trimmed value; at\n * unlock, the router trims submissions before hashing. Submission and storage\n * agree byte-for-byte. Length validation runs on the trimmed value because\n * that's the user's actual intent — and it disarms a class of invisible\n * foot-guns (trailing newlines from copy/paste, mobile auto-spacing,\n * password-manager artifacts).\n *\n * Single source of truth shared by SDK (client-side validation, return\n * ignored) and API (server-side enforcement, return threaded into config).\n * Length is part of the wire-format contract; strength rules, if added later,\n * stay server-side. See `CLAUDE.md` \"Validation: format vs policy\".\n */\nexport function validatePassword(value) {\n    if (value === undefined || value === null)\n        return undefined;\n    if (typeof value !== 'string') {\n        throw ShipError.validation('Password must be a string');\n    }\n    const trimmed = value.trim();\n    if (trimmed.length < PASSWORD_CONSTRAINTS.MIN_LENGTH ||\n        trimmed.length > PASSWORD_CONSTRAINTS.MAX_LENGTH) {\n        throw ShipError.validation(`Password must be between ${PASSWORD_CONSTRAINTS.MIN_LENGTH} and ${PASSWORD_CONSTRAINTS.MAX_LENGTH} characters`);\n    }\n    return trimmed;\n}\n","/**\n * @file MD5 utility for Blob, Buffer, or file path inputs.\n */\nimport { ShipError } from '@shipstatic/types';\n\nexport interface MD5Result {\n  md5: string;\n}\n\nasync function md5Blob(blob: Blob): Promise<MD5Result> {\n  const SparkMD5 = (await import('spark-md5')).default;\n  const spark = new SparkMD5.ArrayBuffer();\n  const chunkSize = 2097152; // 2 MB\n  for (let start = 0; start < blob.size; start += chunkSize) {\n    const end = Math.min(start + chunkSize, blob.size);\n    spark.append(await blob.slice(start, end).arrayBuffer());\n  }\n  return { md5: spark.end() };\n}\n\nasync function md5Buffer(buffer: Buffer): Promise<MD5Result> {\n  // biome-ignore lint/style/useNodejsImportProtocol: the browser build shims bare specifiers only — `node:` bypasses esbuild alias resolution (see tsup.config.ts)\n  const { createHash } = await import('crypto');\n  const hash = createHash('md5');\n  hash.update(buffer);\n  return { md5: hash.digest('hex') };\n}\n\nasync function md5Path(path: string): Promise<MD5Result> {\n  // biome-ignore lint/style/useNodejsImportProtocol: see md5Buffer — bare specifier is load-bearing for the browser shim\n  const { createHash } = await import('crypto');\n  // biome-ignore lint/style/useNodejsImportProtocol: see md5Buffer — bare specifier is load-bearing for the browser shim\n  const { createReadStream } = await import('fs');\n  return new Promise((resolve, reject) => {\n    const hash = createHash('md5');\n    const stream = createReadStream(path);\n    // A local read that failed — no request was made and no server rule was\n    // being mirrored, so there is no status to report and this is the `File`\n    // type by definition (see CLAUDE.md, \"What a status means\"). The path\n    // rides `details`, per the factory's own convention, rather than being\n    // spelled into prose twice.\n    stream.on('error', (err) =>\n      reject(ShipError.file(`Failed to read file for MD5: ${err.message}`, { filePath: path })),\n    );\n    stream.on('data', (chunk) => hash.update(chunk));\n    stream.on('end', () => resolve({ md5: hash.digest('hex') }));\n  });\n}\n\nexport async function calculateMD5(input: Blob | Buffer | string): Promise<MD5Result> {\n  if (input instanceof Blob) return md5Blob(input);\n  if (typeof Buffer !== 'undefined' && Buffer.isBuffer(input)) return md5Buffer(input);\n  if (typeof input === 'string') return md5Path(input);\n  throw ShipError.business('Invalid input for MD5 calculation');\n}\n","/**\n * @file Environment detection utilities for the Ship SDK.\n * Helps in determining whether the SDK is running in a Node.js, browser, or unknown environment.\n */\n\n/**\n * Represents the detected or simulated JavaScript execution environment.\n */\nexport type ExecutionEnvironment = 'browser' | 'node' | 'unknown';\n\n/** @internal Environment override for testing. */\nlet _testEnvironment: ExecutionEnvironment | null = null;\n\n/**\n * **FOR TESTING PURPOSES ONLY.**\n *\n * Allows tests to override the detected environment, forcing the SDK to behave\n * as if it's running in the specified environment.\n *\n * @param env - The environment to simulate ('node', 'browser', 'unknown'),\n *              or `null` to clear the override and revert to actual environment detection.\n * @internal\n */\nexport function __setTestEnvironment(env: ExecutionEnvironment | null): void {\n  _testEnvironment = env;\n}\n\n/**\n * Detects the actual JavaScript execution environment (Node.js, browser, or unknown)\n * by checking for characteristic global objects.\n * @returns The detected environment as {@link ExecutionEnvironment}.\n * @internal\n */\nfunction detectEnvironment(): ExecutionEnvironment {\n  // Check for Node.js environment\n  if (typeof process !== 'undefined' && process.versions && process.versions.node) {\n    return 'node';\n  }\n\n  // Check for Browser environment (including Web Workers)\n  if (typeof window !== 'undefined' || typeof self !== 'undefined') {\n    return 'browser';\n  }\n\n  return 'unknown';\n}\n\n/**\n * Gets the current effective execution environment.\n *\n * This function first checks if a test environment override is active via {@link __setTestEnvironment}.\n * If not, it detects the actual environment (Node.js, browser, or unknown).\n *\n * @returns The current execution environment: 'browser', 'node', or 'unknown'.\n * @public\n */\nexport function getENV(): ExecutionEnvironment {\n  // Return test override if set\n  if (_testEnvironment) {\n    return _testEnvironment;\n  }\n\n  // Detect actual environment\n  return detectEnvironment();\n}\n","/**\n * @file Path helper utilities that work in both browser and Node.js environments.\n * Provides environment-agnostic path manipulation functions.\n */\n\n/**\n * Finds the common parent directory from an array of directory paths.\n * The basis of `pathDetect`: the common parent is the prefix stripped from\n * every deploy path so a deployment's root is the site's root.\n *\n * @param dirPaths - Array of directory paths (not file paths - directories containing the files)\n * @returns The common parent directory path, or empty string if none found\n */\nexport function findCommonParent(dirPaths: string[]): string {\n  if (!dirPaths || dirPaths.length === 0) return '';\n\n  const normalizedPaths = dirPaths\n    .filter((p) => p && typeof p === 'string')\n    .map((p) => p.replace(/\\\\/g, '/'));\n\n  if (normalizedPaths.length === 0) return '';\n  if (normalizedPaths.length === 1) return normalizedPaths[0];\n\n  const pathSegments = normalizedPaths.map((p) => p.split('/').filter(Boolean));\n  const commonSegments = [];\n  const minLength = Math.min(...pathSegments.map((p) => p.length));\n\n  for (let i = 0; i < minLength; i++) {\n    const segment = pathSegments[0][i];\n    if (pathSegments.every((segments) => segments[i] === segment)) {\n      commonSegments.push(segment);\n    } else {\n      break;\n    }\n  }\n\n  return commonSegments.join('/');\n}\n\n/**\n * Converts backslashes to forward slashes for cross-platform compatibility.\n * Does not remove leading slashes (preserves absolute paths).\n * @param path - The path to normalize\n * @returns Path with forward slashes\n */\nexport function normalizeSlashes(path: string): string {\n  return path.replace(/\\\\/g, '/');\n}\n\n/**\n * Normalizes a path for web usage by converting backslashes to forward slashes\n * and removing leading slashes.\n * @param path - The path to normalize\n * @returns Normalized path suitable for web deployment\n */\nexport function normalizeWebPath(path: string): string {\n  return path.replace(/\\\\/g, '/').replace(/\\/+/g, '/').replace(/^\\/+/, '');\n}\n","/**\n * @file Deploy path optimization - the core logic that makes Ship deployments clean and intuitive.\n * Automatically strips common parent directories to create clean deployment URLs.\n */\n\nimport { normalizeWebPath } from './path.js';\n\n/**\n * Represents a file ready for deployment with its optimized path\n */\nexport interface DeployFile {\n  /** The clean deployment path (e.g., \"assets/style.css\") */\n  path: string;\n  /** Original filename */\n  name: string;\n}\n\n/**\n * Core path optimization logic.\n * Transforms messy local paths into clean deployment paths.\n *\n * @example\n * Input:  [\"dist/index.html\", \"dist/assets/app.js\"]\n * Output: [\"index.html\", \"assets/app.js\"]\n *\n * @param filePaths - Raw file paths from the local filesystem\n * @param options - Path processing options\n */\nexport function optimizeDeployPaths(\n  filePaths: string[],\n  options: { flatten?: boolean } = {},\n): DeployFile[] {\n  // When flattening is disabled, keep original structure\n  if (options.flatten === false) {\n    return filePaths.map((path) => ({\n      path: normalizeWebPath(path),\n      name: extractFileName(path),\n    }));\n  }\n\n  // Find the common directory prefix to strip\n  const commonPrefix = findCommonDirectory(filePaths);\n\n  return filePaths.map((filePath) => {\n    let deployPath = normalizeWebPath(filePath);\n\n    // Strip the common prefix to create clean deployment paths\n    if (commonPrefix) {\n      const prefixToRemove = commonPrefix.endsWith('/') ? commonPrefix : `${commonPrefix}/`;\n      if (deployPath.startsWith(prefixToRemove)) {\n        deployPath = deployPath.substring(prefixToRemove.length);\n      }\n    }\n\n    // Fallback to filename if path becomes empty\n    if (!deployPath) {\n      deployPath = extractFileName(filePath);\n    }\n\n    return {\n      path: deployPath,\n      name: extractFileName(filePath),\n    };\n  });\n}\n\n/**\n * Finds the common directory shared by all file paths.\n * This is what gets stripped to create clean deployment URLs.\n *\n * @example\n * [\"dist/index.html\", \"dist/assets/app.js\"] → \"dist\"\n * [\"src/components/A.tsx\", \"src/utils/B.ts\"] → \"src\"\n * [\"file1.txt\", \"file2.txt\", \"subdir/file3.txt\"] → \"\" (no common directory)\n */\nfunction findCommonDirectory(filePaths: string[]): string {\n  if (!filePaths.length) return '';\n\n  // Normalize all paths first\n  const normalizedPaths = filePaths.map((path) => normalizeWebPath(path));\n\n  // Find the common prefix among all file paths (not just directories)\n  const pathSegments = normalizedPaths.map((path) => path.split('/'));\n  const commonSegments: string[] = [];\n  const minLength = Math.min(...pathSegments.map((segments) => segments.length));\n\n  // Check each segment level to find the longest common prefix\n  for (let i = 0; i < minLength - 1; i++) {\n    // -1 because we don't want to include the filename\n    const segment = pathSegments[0][i];\n    if (pathSegments.every((segments) => segments[i] === segment)) {\n      commonSegments.push(segment);\n    } else {\n      break;\n    }\n  }\n\n  return commonSegments.join('/');\n}\n\n/**\n * Extracts just the filename from a file path\n */\nfunction extractFileName(path: string): string {\n  return path.split(/[/\\\\]/).pop() || path;\n}\n","/**\n * @file File validation utilities for Ship SDK\n * Provides client-side validation for file uploads before deployment\n */\n\nimport type {\n  FileValidationResult,\n  FileValidationStatusType,\n  PlatformLimits,\n  ValidatableFile,\n  ValidationIssue,\n} from '@shipstatic/types';\nimport {\n  FileValidationStatus as FILE_VALIDATION_STATUS,\n  hasUnbuiltMarker,\n  hasUnsafeChars,\n  isBlockedExtension,\n} from '@shipstatic/types';\n\n// Re-exported because it constrains three exported generics (validateFiles,\n// getValidFiles, allValidFilesReady) — a consumer cannot name the bound\n// otherwise, which is why the tests were inventing their own copy.\nexport type { ValidatableFile };\nexport { FILE_VALIDATION_STATUS };\n\n/**\n * Format file size to human-readable string\n */\nexport function formatFileSize(bytes: number, decimals: number = 1): string {\n  if (bytes === 0) return '0 Bytes';\n  const k = 1024;\n  const sizes = ['Bytes', 'KB', 'MB', 'GB'];\n  const i = Math.floor(Math.log(bytes) / Math.log(k));\n  return `${parseFloat((bytes / k ** i).toFixed(decimals))} ${sizes[i]}`;\n}\n\n/**\n * Validate filename for deployment safety\n *\n * Blocks only characters that genuinely break the upload→serve round-trip:\n * - # ? %     URL round-trip breakers (fragment, query, encoding ambiguity)\n * - \\         Path separator confusion (buildFileKey splits on backslash)\n * - < > \"     XSS vectors with zero legitimate use in filenames\n * - \\x00-\\x1f \\x7f  Control characters (header injection, display corruption)\n *\n * Everything else is allowed — browser percent-encodes, Worker decodes, R2 matches.\n *\n * Additional checks: path traversal, reserved names, leading/trailing dots or spaces.\n */\nexport function validateFileName(filename: string): { valid: boolean; reason?: string } {\n  if (hasUnsafeChars(filename)) {\n    return { valid: false, reason: 'File name contains unsafe characters' };\n  }\n\n  if (filename.startsWith(' ') || filename.endsWith(' ')) {\n    return { valid: false, reason: 'File name cannot start/end with spaces' };\n  }\n\n  if (filename.endsWith('.')) {\n    return { valid: false, reason: 'File name cannot end with dots' };\n  }\n\n  const reservedNames = /^(CON|PRN|AUX|NUL|COM[1-9]|LPT[1-9])(\\.|$)/i;\n  const nameWithoutPath = filename.split('/').pop() || filename;\n  if (reservedNames.test(nameWithoutPath)) {\n    return { valid: false, reason: 'File name uses a reserved system name' };\n  }\n\n  if (filename.includes('..')) {\n    return { valid: false, reason: 'File name contains path traversal pattern' };\n  }\n\n  return { valid: true };\n}\n\n/**\n * Validate files against configuration limits with severity-based reporting\n *\n * Validation categorizes issues by severity:\n * - **Errors**: Block deployment (file too large, blocked extension, etc.)\n * - **Warnings**: Exclude files but allow deployment (empty files, etc.)\n *\n * @param files - Array of files to validate\n * @param config - Validation configuration from ship.getLimits()\n * @returns Validation result with errors and warnings\n *\n * @example\n * ```typescript\n * const config = await ship.getLimits();\n * const result = validateFiles(files, config);\n *\n * if (!result.canDeploy) {\n *   // Has errors - deployment blocked\n *   console.error('Deployment blocked:', result.errors);\n * } else if (result.warnings.length > 0) {\n *   // Has warnings - deployment proceeds, some files excluded\n *   console.warn('Files excluded:', result.warnings);\n *   await ship.deploy(result.validFiles);\n * } else {\n *   // All files valid\n *   await ship.deploy(result.validFiles);\n * }\n * ```\n */\nexport function validateFiles<T extends ValidatableFile>(\n  files: T[],\n  config: PlatformLimits,\n): FileValidationResult<T> {\n  const errors: ValidationIssue[] = [];\n  const warnings: ValidationIssue[] = [];\n  let fileStatuses: T[] = []; // Use 'let' for atomic enforcement later\n\n  // Check at least 1 file required\n  if (files.length === 0) {\n    const issue: ValidationIssue = {\n      file: '(no files)',\n      message: 'At least one file must be provided',\n    };\n    errors.push(issue);\n\n    return {\n      files: [],\n      validFiles: [],\n      errors,\n      warnings: [],\n      canDeploy: false,\n    };\n  }\n\n  // Check for unbuilt project markers (node_modules/, etc.)\n  for (const file of files) {\n    if (hasUnbuiltMarker(file.name)) {\n      errors.push({\n        file: file.name,\n        message: `Unbuilt project detected — deploy your build output (dist/, build/, out/), not the project folder`,\n      });\n      return {\n        files: files.map((f) => ({\n          ...f,\n          status: FILE_VALIDATION_STATUS.VALIDATION_FAILED,\n          statusMessage: 'Unbuilt project detected',\n        })),\n        validFiles: [],\n        errors,\n        warnings: [],\n        canDeploy: false,\n      };\n    }\n  }\n\n  // Check file count limit\n  if (files.length > config.maxFilesCount) {\n    const issue: ValidationIssue = {\n      file: `(${files.length} files)`,\n      message: `File count (${files.length}) exceeds limit of ${config.maxFilesCount}`,\n    };\n    errors.push(issue);\n\n    return {\n      files: files.map((f) => ({\n        ...f,\n        status: FILE_VALIDATION_STATUS.VALIDATION_FAILED,\n        statusMessage: issue.message,\n      })),\n      validFiles: [],\n      errors,\n      warnings: [],\n      canDeploy: false,\n    };\n  }\n\n  // Validate each file\n  let totalSize = 0;\n\n  for (const file of files) {\n    let fileStatus: FileValidationStatusType = FILE_VALIDATION_STATUS.READY;\n    let statusMessage = 'Ready for upload';\n\n    // Pre-compute filename validation\n    const nameValidation = file.name\n      ? validateFileName(file.name)\n      : { valid: false, reason: 'File name cannot be empty' };\n\n    // Check for processing errors\n    if (file.status === FILE_VALIDATION_STATUS.PROCESSING_ERROR) {\n      fileStatus = FILE_VALIDATION_STATUS.VALIDATION_FAILED;\n      statusMessage = file.statusMessage || 'File failed during processing';\n      errors.push({\n        file: file.name,\n        message: statusMessage,\n      });\n    }\n\n    // EMPTY FILE - Warning (not error)\n    else if (file.size === 0) {\n      fileStatus = FILE_VALIDATION_STATUS.EXCLUDED;\n      statusMessage = 'File is empty (0 bytes) and cannot be deployed due to storage limitations';\n      warnings.push({\n        file: file.name,\n        message: statusMessage,\n      });\n      // Skip other validations for excluded files\n      fileStatuses.push({\n        ...file,\n        status: fileStatus,\n        statusMessage,\n      });\n      continue;\n    }\n\n    // Negative file size - Error\n    else if (file.size < 0) {\n      fileStatus = FILE_VALIDATION_STATUS.VALIDATION_FAILED;\n      statusMessage = 'File size must be positive';\n      errors.push({\n        file: file.name,\n        message: statusMessage,\n      });\n    }\n\n    // File name validation\n    else if (!file.name || file.name.trim().length === 0) {\n      fileStatus = FILE_VALIDATION_STATUS.VALIDATION_FAILED;\n      statusMessage = 'File name cannot be empty';\n      errors.push({\n        file: file.name || '(empty)',\n        message: statusMessage,\n      });\n    } else if (file.name.includes('\\0')) {\n      fileStatus = FILE_VALIDATION_STATUS.VALIDATION_FAILED;\n      statusMessage = 'File name contains invalid characters (null byte)';\n      errors.push({\n        file: file.name,\n        message: statusMessage,\n      });\n    } else if (!nameValidation.valid) {\n      fileStatus = FILE_VALIDATION_STATUS.VALIDATION_FAILED;\n      statusMessage = nameValidation.reason || 'Invalid file name';\n      errors.push({\n        file: file.name,\n        message: statusMessage,\n      });\n    }\n\n    // Blocked extension check\n    else if (isBlockedExtension(file.name)) {\n      fileStatus = FILE_VALIDATION_STATUS.VALIDATION_FAILED;\n      statusMessage = `File extension not allowed: \"${file.name}\"`;\n      errors.push({\n        file: file.name,\n        message: statusMessage,\n      });\n    }\n\n    // File size validation\n    else if (file.size > config.maxFileSize) {\n      fileStatus = FILE_VALIDATION_STATUS.VALIDATION_FAILED;\n      statusMessage = `File size (${formatFileSize(file.size)}) exceeds limit of ${formatFileSize(config.maxFileSize)}`;\n      errors.push({\n        file: file.name,\n        message: statusMessage,\n      });\n    }\n\n    // Total size validation\n    else {\n      totalSize += file.size;\n      if (totalSize > config.maxTotalSize) {\n        fileStatus = FILE_VALIDATION_STATUS.VALIDATION_FAILED;\n        statusMessage = `Total size would exceed limit of ${formatFileSize(config.maxTotalSize)}`;\n        errors.push({\n          file: file.name,\n          message: statusMessage,\n        });\n      }\n    }\n\n    fileStatuses.push({\n      ...file,\n      status: fileStatus,\n      statusMessage,\n    });\n  }\n\n  // ATOMIC ENFORCEMENT: Two-phase validation for optimal UX + atomic semantics\n  // Phase 1 (above): Validate files individually to collect ALL errors\n  // Phase 2 (below): Mark all files as failed if any errors exist\n  //\n  // Why two phases? We validate individually for better UX (users see all problems\n  // at once and can fix everything in one pass), then enforce atomicity to maintain\n  // deployment transaction semantics (all-or-nothing).\n  if (errors.length > 0) {\n    fileStatuses = fileStatuses.map((file) => {\n      // Keep EXCLUDED files as-is (they're warnings, not errors)\n      if (file.status === FILE_VALIDATION_STATUS.EXCLUDED) {\n        return file;\n      }\n\n      // Mark ALL other files as VALIDATION_FAILED (atomic deployment)\n      return {\n        ...file,\n        status: FILE_VALIDATION_STATUS.VALIDATION_FAILED,\n        statusMessage:\n          file.status === FILE_VALIDATION_STATUS.VALIDATION_FAILED\n            ? file.statusMessage // Keep original error message for the file that actually failed\n            : 'Deployment failed due to validation errors in bundle',\n      };\n    });\n  }\n\n  // Build atomic result\n  // validFiles is empty if ANY errors exist (all-or-nothing)\n  const validFiles =\n    errors.length === 0\n      ? fileStatuses.filter((f) => f.status === FILE_VALIDATION_STATUS.READY)\n      : [];\n  const canDeploy = errors.length === 0;\n\n  return {\n    files: fileStatuses,\n    validFiles,\n    errors,\n    warnings,\n    canDeploy,\n  };\n}\n\n/**\n * Get only the valid files from validation results\n */\nexport function getValidFiles<T extends ValidatableFile>(files: T[]): T[] {\n  return files.filter((f) => f.status === FILE_VALIDATION_STATUS.READY);\n}\n\n/**\n * Check if all valid files have required properties for upload\n * (Can be extended to check for MD5, etc.)\n */\nexport function allValidFilesReady<T extends ValidatableFile>(files: T[]): boolean {\n  const validFiles = getValidFiles(files);\n  return validFiles.length > 0;\n}\n","/**\n * @file Utility for filtering out junk files and directories from file paths\n *\n * This module provides functionality to filter out common system junk files and directories\n * from a list of file paths. It uses the 'junk' package to identify junk filenames and\n * a custom list to filter out common junk directories.\n */\n\nimport { hasUnbuiltMarker, ShipError } from '@shipstatic/types';\nimport { isJunk } from 'junk';\n\n/**\n * List of directory names considered as junk\n *\n * Files within these directories (at any level in the path hierarchy) will be excluded.\n * The comparison is case-insensitive for cross-platform compatibility.\n *\n * @internal\n */\nexport const JUNK_DIRECTORIES = ['__MACOSX', '.Trashes', '.fseventsd', '.Spotlight-V100'] as const;\n\n/**\n * Filters an array of file paths, removing those considered junk\n *\n * Throws if any path contains an unbuilt project marker (e.g. `node_modules`, `package.json`).\n * This check runs first because the dot-file filter below would strip paths like\n * `node_modules/.pnpm/...`, destroying the evidence.\n *\n * A path is filtered out if any of these conditions are met:\n * 1. The basename is identified as junk by the 'junk' package (e.g., .DS_Store, Thumbs.db)\n * 2. Any path segment starts with a dot (e.g., .env, .git, .htaccess)\n *    Exception: `.well-known` is allowed (RFC 8615 — ACME, security.txt, app links)\n * 3. Any path segment exceeds 255 characters (filesystem limit)\n * 4. Any directory segment in the path matches an entry in JUNK_DIRECTORIES (case-insensitive)\n *\n * All path separators are normalized to forward slashes for consistent cross-platform behavior.\n *\n * Dot files are filtered for security — they typically contain sensitive configuration\n * (.env, .git) or are not meant to be served publicly. This matches server-side filtering.\n *\n * @param filePaths - An array of file path strings to filter\n * @param options - Optional settings\n * @param options.allowUnbuilt - When true, skip the unbuilt project marker check (for server-processed uploads)\n * @returns A new array containing only non-junk file paths\n * @throws {ShipError} If any path contains an unbuilt project marker (unless allowUnbuilt is true)\n *\n * @example\n * ```typescript\n * import { filterJunk } from '@shipstatic/ship';\n *\n * // Filter an array of file paths\n * const paths = ['index.html', '.DS_Store', '.gitattributes', '__MACOSX/file.txt', 'app.js'];\n * const clean = filterJunk(paths);\n * // Result: ['index.html', 'app.js']\n * ```\n *\n * @example\n * ```typescript\n * // Use with browser File objects\n * import { filterJunk } from '@shipstatic/ship';\n *\n * const files: File[] = [...]; // From input or drag-drop\n *\n * // Extract paths from File objects\n * const filePaths = files.map(f => f.webkitRelativePath || f.name);\n *\n * // Filter out junk paths\n * const validPaths = new Set(filterJunk(filePaths));\n *\n * // Filter the original File array\n * const validFiles = files.filter(f =>\n *   validPaths.has(f.webkitRelativePath || f.name)\n * );\n * ```\n */\nexport function filterJunk(filePaths: string[], options?: { allowUnbuilt?: boolean }): string[] {\n  if (!filePaths || filePaths.length === 0) {\n    return [];\n  }\n\n  // Reject unbuilt projects before the dot-file filter removes evidence.\n  // pnpm stores files under node_modules/.pnpm/ — the dot-file filter below\n  // strips .pnpm/ paths, destroying the only signal that this is an unbuilt project.\n  if (!options?.allowUnbuilt) {\n    const marker = filePaths.find((p) => p && hasUnbuiltMarker(p));\n    if (marker) {\n      throw ShipError.business(\n        'Unbuilt project detected — deploy your build output (dist/, build/, out/), not the project folder',\n      );\n    }\n  }\n\n  return filePaths.filter((filePath) => {\n    if (!filePath) {\n      return false; // Exclude null or undefined paths\n    }\n\n    // Normalize path separators to forward slashes and split into segments\n    const parts = filePath.replace(/\\\\/g, '/').split('/').filter(Boolean);\n    if (parts.length === 0) return true;\n\n    // Check if the basename is a junk file (using junk package)\n    const basename = parts[parts.length - 1];\n    if (isJunk(basename)) {\n      return false;\n    }\n\n    // Filter out dot files and directories (security: prevents .env, .git, etc.)\n    // .well-known is not junk — it's a standard directory (RFC 8615)\n    // Path position constraints enforced at upload (buildFileKey) and serving (isBlockedDotFile)\n    for (const part of parts) {\n      if (part === '.well-known') continue;\n      if (part.startsWith('.') || part.length > 255) {\n        return false;\n      }\n    }\n\n    // Check if any directory segment is in our junk directories list\n    const directorySegments = parts.slice(0, -1);\n    for (const segment of directorySegments) {\n      if (JUNK_DIRECTORIES.some((junkDir) => segment.toLowerCase() === junkDir.toLowerCase())) {\n        return false;\n      }\n    }\n\n    return true;\n  });\n}\n","/**\n * @file Shared security validation for the deploy pipeline.\n * Used by both Node.js and browser file processing pipelines.\n */\nimport { isBlockedExtension, ShipError } from '@shipstatic/types';\nimport { validateFileName } from './file-validation.js';\n\n/**\n * Validate a deploy path for security concerns.\n * Rejects paths containing path traversal patterns or null bytes.\n *\n * Checks for:\n * - Null bytes (\\0) — path injection\n * - /../ — directory traversal within path\n * - ../ at start — upward traversal\n * - /.. at end — trailing traversal\n *\n * Does NOT reject double dots in filenames (e.g., \"foo..bar.txt\" is safe).\n *\n * @param deployPath - The deployment path to validate\n * @param sourceIdentifier - Human-readable identifier for error messages\n * @throws {ShipError} If the path contains unsafe patterns\n */\nexport function validateDeployPath(deployPath: string, sourceIdentifier: string): void {\n  if (\n    deployPath.includes('\\0') ||\n    deployPath.includes('/../') ||\n    deployPath.startsWith('../') ||\n    deployPath.endsWith('/..')\n  ) {\n    throw ShipError.business(\n      `Security error: Unsafe file path \"${deployPath}\" for file: ${sourceIdentifier}`,\n    );\n  }\n}\n\n/**\n * Validate a deploy file's name and extension.\n * Rejects unsafe filenames (shell/URL-dangerous chars, reserved names)\n * and blocked file extensions (.exe, .msi, .dll, etc.).\n *\n * @param deployPath - The deployment path to validate\n * @param sourceIdentifier - Human-readable identifier for error messages\n * @throws {ShipError} If the filename is unsafe or extension is blocked\n */\nexport function validateDeployFile(deployPath: string, sourceIdentifier: string): void {\n  const nameCheck = validateFileName(deployPath);\n  if (!nameCheck.valid) {\n    throw ShipError.business(nameCheck.reason || 'Invalid file name');\n  }\n\n  if (isBlockedExtension(deployPath)) {\n    throw ShipError.business(`File extension not allowed: \"${sourceIdentifier}\"`);\n  }\n}\n","/**\n * @file Node.js-specific file utilities for the Ship SDK.\n * Provides helpers for recursively discovering, filtering, and preparing files for deploy in Node.js.\n */\n\nimport * as fs from 'node:fs';\nimport * as path from 'node:path';\nimport type { PlatformLimits } from '@shipstatic/types';\nimport { isShipError, ShipError, UNBUILT_PROJECT_MARKERS } from '@shipstatic/types';\nimport { optimizeDeployPaths } from '../../shared/lib/deploy-paths.js';\nimport { getENV } from '../../shared/lib/env.js';\nimport { filterJunk } from '../../shared/lib/junk.js';\nimport { calculateMD5 } from '../../shared/lib/md5.js';\nimport { findCommonParent } from '../../shared/lib/path.js';\nimport { validateDeployFile, validateDeployPath } from '../../shared/lib/security.js';\nimport type { DeploymentOptions, StaticFile } from '../../shared/types.js';\n\n/**\n * Recursive function to walk directory and return all file paths.\n * Includes symlink loop protection to prevent infinite recursion.\n * @param dirPath - Directory path to traverse\n * @param visited - Set of already visited real paths (for cycle detection)\n * @returns Array of absolute file paths in the directory\n */\nfunction findAllFilePaths(dirPath: string, visited: Set<string> = new Set()): string[] {\n  const results: string[] = [];\n\n  // Resolve the real path to detect symlink cycles\n  const realPath = fs.realpathSync(dirPath);\n  if (visited.has(realPath)) {\n    // Already visited this directory (symlink cycle) - skip to prevent infinite loop\n    return results;\n  }\n  visited.add(realPath);\n\n  const entries = fs.readdirSync(dirPath);\n\n  for (const entry of entries) {\n    const fullPath = path.join(dirPath, entry);\n    const stats = fs.statSync(fullPath);\n\n    if (stats.isDirectory()) {\n      const subFiles = findAllFilePaths(fullPath, visited);\n      results.push(...subFiles);\n    } else if (stats.isFile()) {\n      results.push(fullPath);\n    }\n  }\n\n  return results;\n}\n\n/**\n * Processes Node.js file and directory paths into an array of StaticFile objects ready for deploy.\n * Computes content paths relative to the upload root before filtering, so only the deployed\n * directory structure is evaluated — not the user's filesystem above it.\n *\n * @param paths - File or directory paths to scan and process.\n * @param options - Processing options (pathDetect, etc.).\n * @param platformLimits - Per-instance platform limits (file-size / count /\n *   total-size caps) from the originating Ship's `GET /limits` fetch. Passed\n *   in rather than read from a module global so concurrent Ships against\n *   different API URLs cannot clobber each other's caps.\n * @returns Promise resolving to an array of StaticFile objects.\n * @throws {ShipClientError} If called outside Node.js or if fs/path modules fail.\n */\nexport async function processFilesForNode(\n  paths: string[],\n  options: DeploymentOptions = {},\n  platformLimits?: PlatformLimits,\n): Promise<StaticFile[]> {\n  if (getENV() !== 'node') {\n    throw ShipError.business('processFilesForNode can only be called in Node.js environment.');\n  }\n\n  // Check input directories for unbuilt project markers before recursive walk\n  for (const p of paths) {\n    const absPath = path.resolve(p);\n    try {\n      if (fs.statSync(absPath).isDirectory()) {\n        const marker = fs.readdirSync(absPath).find((e) => UNBUILT_PROJECT_MARKERS.has(e));\n        if (marker) {\n          throw ShipError.business(\n            `\"${marker}\" detected — deploy your build output (dist/, build/, out/), not the project folder`,\n          );\n        }\n      }\n    } catch (e) {\n      if (isShipError(e)) throw e;\n      // Path errors handled in the existing flatMap below\n    }\n  }\n\n  // 1. Discover all unique, absolute file paths from the input list\n  const absolutePaths = paths.flatMap((p) => {\n    const absPath = path.resolve(p);\n    try {\n      const stats = fs.statSync(absPath);\n      return stats.isDirectory() ? findAllFilePaths(absPath) : [absPath];\n    } catch (_error) {\n      throw ShipError.file(`Path does not exist: ${p}`, { filePath: p });\n    }\n  });\n  const uniquePaths = [...new Set(absolutePaths)];\n\n  // 2. Determine base path for content paths (from INPUT paths, not discovered files)\n  const inputAbsolutePaths = paths.map((p) => path.resolve(p));\n  const inputBasePath = findCommonParent(\n    inputAbsolutePaths.map((p) => {\n      try {\n        const stats = fs.statSync(p);\n        return stats.isDirectory() ? p : path.dirname(p);\n      } catch {\n        return path.dirname(p);\n      }\n    }),\n  );\n\n  // 3. Compute content paths (relative to upload root)\n  const contentPaths = uniquePaths.map((absPath) => {\n    if (inputBasePath && inputBasePath.length > 0) {\n      const rel = path.relative(inputBasePath, absPath);\n      if (rel && typeof rel === 'string' && !rel.startsWith('..')) {\n        return rel.replace(/\\\\/g, '/');\n      }\n    }\n    return path.basename(absPath);\n  });\n\n  // 4. Optimize paths for deployment (strip common root, flatten)\n  const deployFiles = optimizeDeployPaths(contentPaths, {\n    flatten: options.pathDetect !== false,\n  });\n  const deployPaths = deployFiles.map((f) => f.path);\n\n  // 5. Filter junk from deploy paths\n  const filteredSet = new Set(filterJunk(deployPaths));\n  if (filteredSet.size === 0) {\n    return [];\n  }\n\n  // 6. Collect valid file pairs (absolute path for reading, deploy path for output)\n  const validAbsPaths: string[] = [];\n  const validDeployPaths: string[] = [];\n  for (let i = 0; i < uniquePaths.length; i++) {\n    if (filteredSet.has(deployPaths[i])) {\n      validAbsPaths.push(uniquePaths[i]);\n      validDeployPaths.push(deployPaths[i]);\n    }\n  }\n\n  // 7. Process files into StaticFile objects\n  const results: StaticFile[] = [];\n  let totalSize = 0;\n  if (!platformLimits) {\n    throw ShipError.config(\n      'Platform limits not provided. processFilesForNode requires the limits ' +\n        'argument — pass `ship.getLimits()` result.',\n    );\n  }\n\n  for (let i = 0; i < validAbsPaths.length; i++) {\n    const filePath = validAbsPaths[i];\n    const deployPath = validDeployPaths[i];\n\n    try {\n      // Security validation (shared with browser) — fail fast before any I/O\n      validateDeployPath(deployPath, filePath);\n\n      const stats = fs.statSync(filePath);\n\n      // Skip empty files — R2 cannot store zero-byte objects\n      if (stats.size === 0) {\n        continue;\n      }\n\n      // Filename and extension validation (shared with browser)\n      validateDeployFile(deployPath, filePath);\n\n      // Validate file sizes\n      if (stats.size > platformLimits.maxFileSize) {\n        throw ShipError.business(\n          `File ${filePath} is too large. Maximum allowed size is ${platformLimits.maxFileSize / (1024 * 1024)}MB.`,\n        );\n      }\n      totalSize += stats.size;\n      if (totalSize > platformLimits.maxTotalSize) {\n        throw ShipError.business(\n          `Total deploy size is too large. Maximum allowed is ${platformLimits.maxTotalSize / (1024 * 1024)}MB.`,\n        );\n      }\n\n      const content = fs.readFileSync(filePath);\n      const { md5 } = await calculateMD5(content);\n\n      results.push({\n        path: deployPath,\n        content,\n        size: content.length,\n        md5,\n      });\n    } catch (error) {\n      // Re-throw ShipError instances directly\n      if (isShipError(error)) {\n        throw error;\n      }\n      // Convert file system errors to ShipError with clear message\n      const errorMessage = error instanceof Error ? error.message : String(error);\n      throw ShipError.file(`Failed to read file \"${filePath}\": ${errorMessage}`, { filePath });\n    }\n  }\n\n  // Final validation\n  if (results.length > platformLimits.maxFilesCount) {\n    throw ShipError.business(\n      `Too many files to deploy. Maximum allowed is ${platformLimits.maxFilesCount} files.`,\n    );\n  }\n\n  return results;\n}\n","/**\n * @file Main entry point for the Ship SDK.\n *\n * This is the Node.js entry: file-system deploy input plus the `SHIP_*`\n * env-var fallback. Browser consumers resolve this same package to the\n * browser build through the `browser` condition in the exports map —\n * bundlers select it automatically; there is no separate import path.\n */\n\n// Re-export everything from the Node.js index, including both named and default exports\nexport * from './node/index.js';\nexport { default } from './node/index.js';\n","/**\n * @file Ship SDK for Node.js environments.\n *\n * The Node-side `Ship` adds two things on top of the base class:\n *   1. Environment detection — refuses to construct outside Node.\n *   2. `SHIP_TOKEN` / `SHIP_API_URL` env-var resolution as the universal\n *      \"process boundary\" credential source — the industry's one-token\n *      convention. Constructor arguments win over env vars.\n *\n * The SDK does NOT read `~/.shiprc` or `package.json` `\"ship\"` keys — that's\n * the CLI's job (see `cli/shiprc.ts`). Keeping file resolution out of the SDK\n * is what lets embedded consumers (MCP, n8n, GitHub Action) safely write\n * `new Ship({})` for anonymous public deployments without inheriting the host\n * developer's personal credentials.\n */\n\nimport { ShipError } from '@shipstatic/types';\nimport { Ship as BaseShip } from '../shared/base-ship.js';\nimport { getENV } from '../shared/lib/env.js';\nimport type {\n  DeployBodyCreator,\n  DeployInput,\n  DeploymentCreateResponse,\n  DeploymentOptions,\n  ShipClientOptions,\n  StaticFile,\n} from '../shared/types.js';\nimport { readEnvConfig } from './core/config.js';\nimport { createDeployBody } from './core/deploy-body.js';\n\n// Export all shared functionality\nexport * from '../shared/index.js';\n\n/**\n * Ship SDK Client for Node.js environments.\n *\n * @example\n * ```typescript\n * // Authenticated — explicit token (API key, deploy token, or OAuth bearer)\n * const ship = new Ship({ token: 'ship-xxxx' });\n *\n * // Authenticated — picks up SHIP_TOKEN from env\n * const ship = new Ship({});\n *\n * // Anonymous public deploy — works when neither constructor nor env provides a token\n * const ship = new Ship({});\n * await ship.deploy('./dist');\n * ```\n */\nexport class Ship extends BaseShip {\n  constructor(options: ShipClientOptions = {}) {\n    if (getENV() !== 'node') {\n      throw ShipError.business('Node.js Ship class can only be used in Node.js environment.');\n    }\n\n    // Layer env vars under constructor options. The merged result is what the\n    // base class sees, so the credential and the HTTP client are fully formed\n    // by the time the constructor returns — no async config phase needed.\n    //\n    // Truthiness (not `??`) is deliberate: an empty-string token is absence\n    // (shell expansion of unset CI variables), so `token: ''` falls through\n    // to `SHIP_TOKEN` instead of locking in a phantom credential. A client\n    // constructed with `session: true` has chosen its identity — the ambient\n    // token does not ride along.\n    const env = readEnvConfig();\n    super({\n      ...options,\n      apiUrl: options.apiUrl || env.apiUrl,\n      token: options.token || (options.session ? undefined : env.token),\n    });\n  }\n\n  /**\n   * Deploy file or directory paths to ShipStatic. Convenience shortcut for\n   * `ship.deployments.upload()`.\n   *\n   * Wrong-platform inputs (e.g. `File[]`) fail at compile time. For\n   * platform-neutral code, use `ship.deployments.upload()`, which accepts\n   * the wider `DeployInput` and validates at runtime — that asymmetry is\n   * intentional: the convenience shortcut narrows; the resource-layer\n   * contract stays platform-neutral.\n   */\n  async deploy(\n    input: string | string[],\n    options?: DeploymentOptions,\n  ): Promise<DeploymentCreateResponse> {\n    return super.deploy(input, options);\n  }\n\n  protected async processInput(\n    input: DeployInput,\n    options: DeploymentOptions,\n  ): Promise<StaticFile[]> {\n    // Normalize string to string[] and validate.\n    const paths = typeof input === 'string' ? [input] : input;\n\n    if (!Array.isArray(paths) || !paths.every((p) => typeof p === 'string')) {\n      throw ShipError.business(\n        'Invalid input type for Node.js environment. Expected string or string[].',\n      );\n    }\n\n    if (paths.length === 0) {\n      throw ShipError.business('No files to deploy.');\n    }\n\n    const { processFilesForNode } = await import('./core/node-files.js');\n    return processFilesForNode(paths, options, this.platformLimits ?? undefined);\n  }\n\n  protected getDeployBodyCreator(): DeployBodyCreator {\n    return createDeployBody;\n  }\n}\n\n// Default export (for `import Ship from '@shipstatic/ship'`)\nexport default Ship;\n\n// Node-only utilities (path-walking + MD5 over the local filesystem)\nexport { processFilesForNode } from './core/node-files.js';\n","/**\n * @file Base Ship SDK class — shared functionality across environments.\n *\n * The constructor is fully synchronous: an `ApiHttp` instance is built immediately\n * with whatever credentials the caller supplied (and, in Node, env vars merged in\n * by the subclass before `super()`). The only deferred work is the one-shot\n * `GET /limits` fetch that hydrates platform limits — that's lazy and runs on\n * first API call via `ensureInitialized()`.\n *\n * Subclasses only override what genuinely differs per environment:\n *   - `processInput()` — Node reads paths from disk; Browser handles `File[]`\n *   - `getDeployBodyCreator()` — Node streams Buffers; Browser builds Blobs\n *\n * Everything else (the credential slot, resources, events, lazy platform-limits)\n * lives here.\n */\n\nimport type {\n  AccountResource,\n  DeploymentCreateResponse,\n  DeploymentResource,\n  DomainResource,\n  PingResponse,\n  PlatformLimits,\n  StaticFile,\n  TokenResource,\n} from '@shipstatic/types';\nimport { ShipError, validateCaller, validateToken } from '@shipstatic/types';\n\nimport { ApiHttp } from './api/http.js';\nimport {\n  createAccountResource,\n  createDeploymentResource,\n  createDomainResource,\n  createTokenResource,\n  type DeployInput,\n} from './resources.js';\nimport type {\n  DeployBodyCreator,\n  DeploymentOptions,\n  ShipClientOptions,\n  ShipEvents,\n  TokenProvider,\n} from './types.js';\n\n/**\n * Abstract base class for Ship SDK implementations.\n */\nexport abstract class Ship {\n  // Resource handles, created once at construction. Each is a thin facade\n  // bound to `this.http` plus the lazy-init callback.\n  // Parameterized with the SDK's extended options (timeout, callbacks,\n  // signal…) — the interface's documented extension point, so typed\n  // consumers can pass them without casts.\n  public readonly deployments: DeploymentResource<DeploymentOptions>;\n  public readonly domains: DomainResource;\n  public readonly account: AccountResource;\n  public readonly tokens: TokenResource;\n\n  // The HTTP client and merged options are private — subclasses interact\n  // with the base class through the abstract methods below, never by\n  // reaching into these fields. Tests bypass via `(ship as any).http = ...`.\n  private readonly http: ApiHttp;\n  private readonly clientOptions: ShipClientOptions;\n\n  // Lazy-init plumbing for the one-shot `GET /limits` fetch.\n  // `platformLimits` is INSTANCE state (not a module-level singleton): two\n  // Ships against different `apiUrl`s — staging + prod, multi-tenant\n  // orchestrators, n8n with multiple credentials — must not clobber each\n  // other's limits. Each instance owns its hydrated copy.\n  // `protected` so subclasses' `processInput` can pass it down to the\n  // platform-specific file-validation utilities.\n  private initPromise: Promise<void> | null = null;\n  protected platformLimits: PlatformLimits | null = null;\n\n  // The credential slot — one platform token (any population) or a provider\n  // that supplies one per request. Read dynamically on every request through\n  // `getAuthHeaders`, so `setToken` takes effect without rebuilding the client.\n  private credential: string | TokenProvider | null = null;\n\n  constructor(options: ShipClientOptions = {}) {\n    // SDK-boundary normalization: an empty-string token is absence of\n    // credential intent, never a credential. Empty strings reach here from\n    // shell-expansion of unset CI variables, empty form fields in browser\n    // apps, and any other path that produces `''` instead of `undefined`.\n    // Normalizing once at the SDK boundary covers every entry point: CLI,\n    // Browser SDK, Node SDK, embedded consumers, and direct base-class use.\n    options = {\n      ...options,\n      apiUrl: options.apiUrl || undefined,\n      token: options.token || undefined,\n      caller: options.caller || undefined,\n    };\n    this.clientOptions = options;\n\n    // Caller identity is validated at the boundary like the token: a value\n    // the API would silently drop (the header is unauthenticated) is a\n    // configuration error here, never a quiet fallback to IP bucketing.\n    if (options.caller !== undefined) {\n      validateCaller(options.caller);\n    }\n\n    // One client, one identity. A token and a cookie session are different\n    // principals — holding both is a configuration error, not a precedence\n    // question.\n    if (options.token && options.session) {\n      throw ShipError.config('Provide either `token` or `session`, not both.');\n    }\n\n    // Static tokens are validated at the boundary (prefix-classified, same\n    // rules the server applies); providers are invoked per request instead.\n    if (typeof options.token === 'string') {\n      validateToken(options.token);\n      this.credential = options.token;\n    } else if (options.token) {\n      this.credential = options.token;\n    }\n\n    // Build the HTTP client once. The `getAuthHeaders` callback reads\n    // `this.credential` dynamically on every request.\n    this.http = new ApiHttp({\n      ...options,\n      getAuthHeaders: () => this.getAuthHeaders(),\n      createDeployBody: this.getDeployBodyCreator(),\n    });\n\n    const ctx = {\n      getApi: () => this.http,\n      ensureInit: () => this.ensureInitialized(),\n    };\n\n    this.deployments = createDeploymentResource({\n      ...ctx,\n      processInput: (input, opts) => this.processInput(input, opts),\n    });\n    this.domains = createDomainResource(ctx);\n    this.account = createAccountResource(ctx);\n    this.tokens = createTokenResource(ctx);\n  }\n\n  // Environment-specific behavior.\n  protected abstract processInput(\n    input: DeployInput,\n    options: DeploymentOptions,\n  ): Promise<StaticFile[]>;\n  protected abstract getDeployBodyCreator(): DeployBodyCreator;\n\n  /**\n   * Lazy initialization — fetches platform limits (file size / count caps) once,\n   * on the first API call. Subsequent calls reuse the resolved promise.\n   */\n  protected async ensureInitialized(): Promise<void> {\n    if (!this.initPromise) {\n      this.initPromise = this.fetchPlatformLimits();\n    }\n    return this.initPromise;\n  }\n\n  private async fetchPlatformLimits(): Promise<void> {\n    try {\n      this.platformLimits = await this.http.getLimits();\n    } catch (error) {\n      // Reset so the next API call can retry initialization.\n      this.initPromise = null;\n      throw error;\n    }\n  }\n\n  /**\n   * Ping the API server, resolving its answer: `{ success, timestamp }`, where\n   * `timestamp` is the server clock in unix SECONDS.\n   *\n   * It resolves the response rather than a bare `true` because every other\n   * method here does — narrowing to a boolean discarded the one thing ping\n   * carries beyond liveness, and made `success` mean a boolean on the wire and\n   * something else by the time it reached a caller. A non-OK response throws in\n   * transport, so a resolved value always means the API answered.\n   */\n  async ping(): Promise<PingResponse> {\n    await this.ensureInitialized();\n    return this.http.ping();\n  }\n\n  /**\n   * Deploy project (convenience shortcut to `ship.deployments.upload()`).\n   */\n  async deploy(input: DeployInput, options?: DeploymentOptions): Promise<DeploymentCreateResponse> {\n    return this.deployments.upload(input, options);\n  }\n\n  /**\n   * Get current account information (convenience shortcut to `ship.account.get()`).\n   */\n  async whoami() {\n    return this.account.get();\n  }\n\n  /**\n   * Get platform limits (max file size, file count, total size).\n   * Reuses the response fetched during initialization. Per-instance state —\n   * does not leak between concurrent Ships against different API URLs.\n   */\n  async getLimits(): Promise<PlatformLimits> {\n    if (this.platformLimits) return this.platformLimits;\n    await this.ensureInitialized();\n    // biome-ignore lint/style/noNonNullAssertion: ensureInitialized() hydrates platformLimits or throws\n    return this.platformLimits!;\n  }\n\n  on<K extends keyof ShipEvents>(event: K, handler: (...args: ShipEvents[K]) => void): void {\n    this.http.on(event, handler);\n  }\n\n  off<K extends keyof ShipEvents>(event: K, handler: (...args: ShipEvents[K]) => void): void {\n    this.http.off(event, handler);\n  }\n\n  /**\n   * Set global headers included in every request.\n   * Useful for injecting custom headers (e.g. for admin impersonation).\n   */\n  setHeaders(headers: Record<string, string>): void {\n    this.http.setGlobalHeaders(headers);\n  }\n\n  /**\n   * Clear all custom global headers.\n   */\n  clearHeaders(): void {\n    this.http.setGlobalHeaders({});\n  }\n\n  /**\n   * Sets the client token — any platform token (API key, deploy token, OAuth\n   * access token) or a {@link TokenProvider} invoked per request. Replaces\n   * whatever credential the client held before.\n   * @param token A platform token, sent verbatim, or a provider function\n   */\n  public setToken(token: string | TokenProvider): void {\n    // One client, one identity — the constructor's token/session exclusion\n    // holds for the client's whole life, not just its first moment.\n    if (this.clientOptions.session) {\n      throw ShipError.config('Provide either `token` or `session`, not both.');\n    }\n    if (typeof token === 'string') {\n      if (!token) {\n        throw ShipError.business('Invalid token provided. Token must be a non-empty string.');\n      }\n      validateToken(token);\n      this.credential = token;\n      return;\n    }\n    if (typeof token !== 'function') {\n      throw ShipError.business(\n        'Invalid token provided. Token must be a non-empty string or a provider function.',\n      );\n    }\n    this.credential = token;\n  }\n\n  /**\n   * Resolve the credential slot into request headers. Async because a\n   * provider may mint or refresh its token per request.\n   *\n   * Anonymity requires proven absence of credentials: a configured provider\n   * that yields nothing is an error — the request fails typed rather than\n   * silently proceeding as an anonymous public deploy. Empty-string\n   * normalization at the constructor is the same invariant's boundary\n   * condition: `''` is absence of intent, so it never reaches this point.\n   */\n  private async getAuthHeaders(): Promise<Record<string, string>> {\n    if (this.credential === null) return {};\n    const value = typeof this.credential === 'function' ? await this.credential() : this.credential;\n    if (!value) {\n      throw ShipError.authentication('Token provider returned no token.');\n    }\n    if (typeof value !== 'string') {\n      throw ShipError.authentication('Token provider returned a non-string value.');\n    }\n    return { Authorization: `Bearer ${value}` };\n  }\n}\n","/**\n * @file HTTP client for Ship API.\n */\nimport type {\n  AccountGetResponse,\n  Deployment,\n  DeploymentCreateResponse,\n  DeploymentDeleteResponse,\n  DeploymentListResponse,\n  Domain,\n  DomainDeleteResponse,\n  DomainDnsResponse,\n  DomainListResponse,\n  DomainRecordsResponse,\n  DomainShareResponse,\n  DomainValidateResponse,\n  DomainVerifyResponse,\n  ListOptions,\n  PingResponse,\n  PlatformLimits,\n  SPACheckRequest,\n  SPACheckResponse,\n  StaticFile,\n  Token,\n  TokenCreateResponse,\n  TokenDeleteResponse,\n  TokenListResponse,\n} from '@shipstatic/types';\nimport {\n  API_PATHS,\n  CALLER,\n  DEFAULT_API,\n  IDEMPOTENCY_KEY_CONSTRAINTS,\n  ShipError,\n  SPA_CHECK_CONSTRAINTS,\n  validateIdempotencyKey,\n} from '@shipstatic/types';\nimport { SimpleEvents } from '../events.js';\nimport { validateDeployConfig, validateLabels, validatePassword } from '../lib/validation.js';\nimport type {\n  ApiDeployOptions,\n  DeployBodyCreator,\n  DomainSetResult,\n  Fetch,\n  ShipClientOptions,\n} from '../types.js';\n\n// =============================================================================\n// CONSTANTS\n// =============================================================================\n\nconst DEFAULT_REQUEST_TIMEOUT = 30_000;\n\n/**\n * Deploys get their own ceilings, because one budget cannot fit every\n * operation this client performs.\n *\n * 30s is right for a metadata read — `/ping`, `/account`, a page of a list —\n * where anything slower is a fault rather than a big payload. A deploy is\n * bounded by the PLATFORM's limits instead: `DEPLOYMENT.MAX_TOTAL_SIZE` is\n * 50MB, and 50MB in 30s needs ~13 Mbit/s of sustained UPLOAD, above what most\n * residential links give. A deployment the API explicitly permits was being\n * aborted here by default — which is the exact failure `Idempotency-Key`\n * exists to repair, so the cause had to go and not merely the remedy.\n *\n * 5 minutes covers 50MB at ~1.4 Mbit/s.\n */\nconst DEFAULT_DEPLOY_TIMEOUT = 300_000;\n\n/**\n * The server's own budget for a build, mirrored here because the client has\n * to outlast it: the API gives the build service\n * `PERFORMANCE.BUILD_SERVICE_TIMEOUT` (`cloudflare/api/src/lib/config.ts`),\n * and that work begins only after the upload lands.\n *\n * **Raising it there must raise it here.** The two sit in different repos, so\n * nothing can fence the pair; the constraint is stated at both ends instead.\n */\nconst BUILD_SERVICE_BUDGET = 300_000;\n\n/**\n * A deploy that also builds: the upload, then the build, then the commit.\n *\n * Written as a sum rather than a number, so the name and the value compose\n * the same way — `DEPLOY` plus `BUILD` on one side, the deploy budget plus\n * the build budget on the other. A magic `600_000` would state the result\n * and hide the reasoning, and the reasoning is the part that has to survive\n * someone tuning either half.\n */\nconst DEFAULT_DEPLOY_BUILD_TIMEOUT = DEFAULT_DEPLOY_TIMEOUT + BUILD_SERVICE_BUDGET;\n\n/**\n * This client's identity in a deployment's `via` field.\n *\n * Every surface that deploys names itself: the CLI sends `cli`, the GitHub\n * Action `git`, the MCP server `mcp`, the VS Code extension `vsc`, the web\n * apps `web`. A direct SDK call is `sdk`. Each surface owns its own string —\n * there is deliberately no central registry, since integrations outside this\n * repo mint their own.\n *\n * Applied at this one wire boundary, so `via` is populated on every deploy\n * from every platform: an absent value means an unattributed caller (raw\n * HTTP), never \"probably the SDK\".\n */\nconst DEPLOY_VIA = 'sdk';\n\n/**\n * Serialize pagination options into a query string, or '' when there are\n * none — the paginated list endpoints accept `limit` and `cursor`.\n */\nfunction listQuery(options?: ListOptions): string {\n  const params = new URLSearchParams();\n  if (options?.limit !== undefined) params.set('limit', String(options.limit));\n  if (options?.cursor !== undefined) params.set('cursor', options.cursor);\n  const query = params.toString();\n  return query ? `?${query}` : '';\n}\n\n// =============================================================================\n// TYPES\n// =============================================================================\n\nexport interface ApiHttpOptions extends ShipClientOptions {\n  /** Resolves the credential slot per request — async so token providers can mint/refresh. */\n  getAuthHeaders: () => Record<string, string> | Promise<Record<string, string>>;\n  createDeployBody: DeployBodyCreator;\n}\n\ninterface RequestResult<T> {\n  data: T;\n  status: number;\n}\n\n// =============================================================================\n// HTTP CLIENT\n// =============================================================================\n\nexport class ApiHttp extends SimpleEvents {\n  private readonly apiUrl: string;\n  private readonly getAuthHeadersCallback: () =>\n    | Record<string, string>\n    | Promise<Record<string, string>>;\n  private readonly session: boolean;\n  private readonly caller: string | undefined;\n  private readonly timeout: number;\n  private readonly deployTimeout: number;\n  private readonly deployBuildTimeout: number;\n  private readonly fetch: Fetch;\n  private readonly createDeployBody: DeployBodyCreator;\n  private readonly deployEndpoint: string;\n  private globalHeaders: Record<string, string> = {};\n\n  constructor(options: ApiHttpOptions) {\n    super();\n    this.apiUrl = options.apiUrl || DEFAULT_API;\n    this.getAuthHeadersCallback = options.getAuthHeaders;\n    this.session = options.session ?? false;\n    this.caller = options.caller;\n    this.timeout = options.timeout ?? DEFAULT_REQUEST_TIMEOUT;\n    // An explicit timeout is the caller's whole answer and applies to deploys\n    // too — they asked for a ceiling, not for one with an exception. Only the\n    // DEFAULT splits by operation.\n    this.deployTimeout = options.timeout ?? DEFAULT_DEPLOY_TIMEOUT;\n    this.deployBuildTimeout = options.timeout ?? DEFAULT_DEPLOY_BUILD_TIMEOUT;\n    // Bind to globalThis when falling back to the platform `fetch` — browsers\n    // require `this === window` on `window.fetch` and throw \"Illegal invocation\"\n    // when it's invoked as a property of any other object.\n    this.fetch = options.fetch ?? globalThis.fetch.bind(globalThis);\n    this.createDeployBody = options.createDeployBody;\n    this.deployEndpoint = options.deployEndpoint || API_PATHS.DEPLOYMENTS;\n  }\n\n  /**\n   * Set global headers included in every request.\n   * Priority: globalHeaders (lowest) < instance auth < per-request headers (highest)\n   */\n  setGlobalHeaders(headers: Record<string, string>): void {\n    this.globalHeaders = headers;\n  }\n\n  // ===========================================================================\n  // CORE REQUEST INFRASTRUCTURE\n  // ===========================================================================\n\n  /**\n   * Execute HTTP request with timeout, events, and error handling\n   */\n  private async executeRequest<T>(\n    url: string,\n    options: RequestInit,\n    operationName: string,\n    timeoutMs: number = this.timeout,\n  ): Promise<RequestResult<T>> {\n    let cleanup = () => {};\n\n    try {\n      // Credential resolution runs inside the error boundary: a token\n      // provider that throws or yields nothing fails the request through\n      // the same typed path (and `error` event) as any transport failure.\n      const headers = await this.mergeHeaders(options.headers as Record<string, string>);\n      const timeout = this.createTimeoutSignal(options.signal, timeoutMs);\n      cleanup = timeout.cleanup;\n\n      const fetchOptions: RequestInit = {\n        ...options,\n        headers,\n        credentials: this.session && !headers.Authorization ? 'include' : undefined,\n        signal: timeout.signal,\n      };\n\n      this.emit('request', url, fetchOptions);\n\n      const response = await this.fetch(url, fetchOptions);\n      cleanup();\n\n      if (!response.ok) {\n        throw await ShipError.fromHttpResponse(response, operationName);\n      }\n\n      this.emit('response', this.safeClone(response), url);\n      const data = await this.parseResponse<T>(this.safeClone(response));\n      return { data, status: response.status };\n    } catch (error) {\n      cleanup();\n      // Normalize anything thrown above (credential resolution, fetch\n      // failure, abort, response error) into a ShipError.\n      // fromFetchError passes existing ShipErrors through unchanged.\n      const shipError = ShipError.fromFetchError(error, operationName);\n      this.emit('error', shipError, url);\n      throw shipError;\n    }\n  }\n\n  /**\n   * Simple request - returns data only\n   */\n  private async request<T>(\n    url: string,\n    options: RequestInit,\n    operationName: string,\n    timeoutMs?: number,\n  ): Promise<T> {\n    const { data } = await this.executeRequest<T>(url, options, operationName, timeoutMs);\n    return data;\n  }\n\n  /**\n   * Request with status - returns data and HTTP status code\n   */\n  private async requestWithStatus<T>(\n    url: string,\n    options: RequestInit,\n    operationName: string,\n  ): Promise<RequestResult<T>> {\n    return this.executeRequest<T>(url, options, operationName);\n  }\n\n  // ===========================================================================\n  // REQUEST HELPERS\n  // ===========================================================================\n\n  private async mergeHeaders(\n    customHeaders: Record<string, string> = {},\n  ): Promise<Record<string, string>> {\n    // `caller` is instance identity metadata, like the credential: the\n    // rate limiter buckets by X-Caller on every write, so it rides every\n    // request rather than any single operation.\n    return {\n      ...this.globalHeaders,\n      ...(this.caller ? { [CALLER.HEADER]: this.caller } : {}),\n      ...(await this.getAuthHeadersCallback()),\n      ...customHeaders,\n    };\n  }\n\n  private createTimeoutSignal(\n    existingSignal?: AbortSignal | null,\n    timeoutMs: number = this.timeout,\n  ): {\n    signal: AbortSignal;\n    cleanup: () => void;\n  } {\n    const controller = new AbortController();\n    const timeoutId = setTimeout(() => controller.abort(), timeoutMs);\n\n    if (existingSignal) {\n      const abort = () => controller.abort();\n      existingSignal.addEventListener('abort', abort);\n      if (existingSignal.aborted) controller.abort();\n    }\n\n    return {\n      signal: controller.signal,\n      cleanup: () => clearTimeout(timeoutId),\n    };\n  }\n\n  private safeClone(response: Response): Response {\n    try {\n      return response.clone();\n    } catch {\n      return response;\n    }\n  }\n\n  private async parseResponse<T>(response: Response): Promise<T> {\n    if (response.headers.get('Content-Length') === '0' || response.status === 204) {\n      return undefined as T;\n    }\n    return response.json() as Promise<T>;\n  }\n\n  // ===========================================================================\n  // PUBLIC API - DEPLOYMENTS\n  // ===========================================================================\n\n  async deploy(\n    files: StaticFile[],\n    options: ApiDeployOptions = {},\n  ): Promise<DeploymentCreateResponse> {\n    if (!files.length) {\n      throw ShipError.business('No files to deploy');\n    }\n    for (const file of files) {\n      if (!file.md5) {\n        throw ShipError.file(`MD5 checksum missing for file: ${file.path}`, {\n          filePath: file.path,\n        });\n      }\n    }\n\n    // Fast-fail on definitely-invalid input before constructing a multipart body.\n    validatePassword(options.password);\n    const idempotencyKey = validateIdempotencyKey(options.idempotencyKey);\n    const labels = validateLabels(options.labels);\n    await validateDeployConfig(files);\n\n    const flags =\n      options.build || options.prerender || options.spa\n        ? { build: options.build, prerender: options.prerender, spa: options.spa }\n        : undefined;\n    const { body, headers: bodyHeaders } = await this.createDeployBody(files, {\n      labels,\n      via: options.via ?? DEPLOY_VIA,\n      password: options.password,\n      flags,\n      captcha: options.captcha,\n    });\n\n    // The key rides a header, not the body, because it must be readable\n    // before the request is parsed — the API replays a stored 201 ahead of\n    // the write budget, so a retry costs nothing.\n    return this.request<DeploymentCreateResponse>(\n      `${this.apiUrl}${this.deployEndpoint}`,\n      {\n        method: 'POST',\n        body,\n        headers: idempotencyKey\n          ? { ...bodyHeaders, [IDEMPOTENCY_KEY_CONSTRAINTS.HEADER]: idempotencyKey }\n          : bodyHeaders,\n        signal: options.signal || null,\n      },\n      'Deploy',\n      // Only `build`/`prerender` reach the build service\n      // (`api/src/lib/upload-processing.ts:35`); `spa` is local detection\n      // bounded by the AI tier's own 10s, so it does not earn the longer\n      // ceiling.\n      options.build || options.prerender ? this.deployBuildTimeout : this.deployTimeout,\n    );\n  }\n\n  async listDeployments(options?: ListOptions): Promise<DeploymentListResponse> {\n    return this.request(\n      `${this.apiUrl}${API_PATHS.DEPLOYMENTS}${listQuery(options)}`,\n      { method: 'GET' },\n      'List deployments',\n    );\n  }\n\n  async getDeployment(id: string): Promise<Deployment> {\n    return this.request(\n      `${this.apiUrl}${API_PATHS.DEPLOYMENT(encodeURIComponent(id))}`,\n      { method: 'GET' },\n      'Get deployment',\n    );\n  }\n\n  async updateDeploymentLabels(id: string, labels: string[]): Promise<Deployment> {\n    const normalized = validateLabels(labels);\n    return this.request(\n      `${this.apiUrl}${API_PATHS.DEPLOYMENT(encodeURIComponent(id))}`,\n      {\n        method: 'PATCH',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify({ labels: normalized }),\n      },\n      'Update deployment labels',\n    );\n  }\n\n  async deleteDeployment(id: string): Promise<DeploymentDeleteResponse> {\n    return this.request<DeploymentDeleteResponse>(\n      `${this.apiUrl}${API_PATHS.DEPLOYMENT(encodeURIComponent(id))}`,\n      { method: 'DELETE' },\n      'Delete deployment',\n    );\n  }\n\n  // ===========================================================================\n  // PUBLIC API - DOMAINS\n  // ===========================================================================\n  // All domain methods accept FQDN (Fully Qualified Domain Name) as the `name` parameter.\n  // The SDK does not validate or normalize - the API handles all domain semantics.\n\n  async setDomain(name: string, deployment?: string, labels?: string[]): Promise<DomainSetResult> {\n    const normalized = validateLabels(labels);\n    const body: { deployment?: string; labels?: string[] } = {};\n    if (deployment) body.deployment = deployment;\n    if (normalized !== undefined) body.labels = normalized;\n\n    const { data, status } = await this.requestWithStatus<Domain>(\n      `${this.apiUrl}${API_PATHS.DOMAIN(encodeURIComponent(name))}`,\n      {\n        method: 'PUT',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify(body),\n      },\n      'Set domain',\n    );\n\n    return { ...data, isCreate: status === 201 };\n  }\n\n  async listDomains(options?: ListOptions): Promise<DomainListResponse> {\n    return this.request(\n      `${this.apiUrl}${API_PATHS.DOMAINS}${listQuery(options)}`,\n      { method: 'GET' },\n      'List domains',\n    );\n  }\n\n  async getDomain(name: string): Promise<Domain> {\n    return this.request(\n      `${this.apiUrl}${API_PATHS.DOMAIN(encodeURIComponent(name))}`,\n      { method: 'GET' },\n      'Get domain',\n    );\n  }\n\n  async deleteDomain(name: string): Promise<DomainDeleteResponse> {\n    return this.request<DomainDeleteResponse>(\n      `${this.apiUrl}${API_PATHS.DOMAIN(encodeURIComponent(name))}`,\n      { method: 'DELETE' },\n      'Delete domain',\n    );\n  }\n\n  async verifyDomain(name: string): Promise<DomainVerifyResponse> {\n    return this.request(\n      `${this.apiUrl}${API_PATHS.DOMAIN_VERIFY(encodeURIComponent(name))}`,\n      { method: 'POST' },\n      'Verify domain',\n    );\n  }\n\n  async getDomainDns(name: string): Promise<DomainDnsResponse> {\n    return this.request(\n      `${this.apiUrl}${API_PATHS.DOMAIN_DNS(encodeURIComponent(name))}`,\n      { method: 'GET' },\n      'Get domain DNS',\n    );\n  }\n\n  async getDomainRecords(name: string): Promise<DomainRecordsResponse> {\n    return this.request(\n      `${this.apiUrl}${API_PATHS.DOMAIN_RECORDS(encodeURIComponent(name))}`,\n      { method: 'GET' },\n      'Get domain records',\n    );\n  }\n\n  async getDomainShare(name: string): Promise<DomainShareResponse> {\n    return this.request(\n      `${this.apiUrl}${API_PATHS.DOMAIN_SHARE(encodeURIComponent(name))}`,\n      { method: 'GET' },\n      'Get domain share',\n    );\n  }\n\n  async validateDomain(name: string): Promise<DomainValidateResponse> {\n    return this.request(\n      `${this.apiUrl}${API_PATHS.DOMAINS_VALIDATE}`,\n      {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify({ domain: name }),\n      },\n      'Validate domain',\n    );\n  }\n\n  // ===========================================================================\n  // PUBLIC API - TOKENS\n  // ===========================================================================\n\n  async createToken(ttl?: number, labels?: string[]): Promise<TokenCreateResponse> {\n    const normalized = validateLabels(labels);\n    const body: { ttl?: number; labels?: string[] } = {};\n    if (ttl !== undefined) body.ttl = ttl;\n    if (normalized !== undefined) body.labels = normalized;\n\n    return this.request(\n      `${this.apiUrl}${API_PATHS.TOKENS}`,\n      {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify(body),\n      },\n      'Create token',\n    );\n  }\n\n  async listTokens(options?: ListOptions): Promise<TokenListResponse> {\n    return this.request(\n      `${this.apiUrl}${API_PATHS.TOKENS}${listQuery(options)}`,\n      { method: 'GET' },\n      'List tokens',\n    );\n  }\n\n  async deleteToken(token: string): Promise<TokenDeleteResponse> {\n    return this.request<TokenDeleteResponse>(\n      `${this.apiUrl}${API_PATHS.TOKEN(encodeURIComponent(token))}`,\n      { method: 'DELETE' },\n      'Delete token',\n    );\n  }\n\n  async getToken(token: string): Promise<Token> {\n    return this.request<Token>(\n      `${this.apiUrl}${API_PATHS.TOKEN(encodeURIComponent(token))}`,\n      { method: 'GET' },\n      'Get token',\n    );\n  }\n\n  // ===========================================================================\n  // PUBLIC API - ACCOUNT & CONFIG\n  // ===========================================================================\n\n  async getAccount(): Promise<AccountGetResponse> {\n    return this.request(`${this.apiUrl}${API_PATHS.ACCOUNT}`, { method: 'GET' }, 'Get account');\n  }\n\n  async getLimits(): Promise<PlatformLimits> {\n    return this.request(`${this.apiUrl}${API_PATHS.LIMITS}`, { method: 'GET' }, 'Get limits');\n  }\n\n  async ping(): Promise<PingResponse> {\n    return this.request<PingResponse>(`${this.apiUrl}${API_PATHS.PING}`, { method: 'GET' }, 'Ping');\n  }\n\n  // ===========================================================================\n  // PUBLIC API - SPA CHECK\n  // ===========================================================================\n\n  async checkSPA(files: StaticFile[], _options: ApiDeployOptions = {}): Promise<boolean> {\n    const indexFile = files.find(\n      (f) =>\n        f.path === SPA_CHECK_CONSTRAINTS.INDEX_FILE ||\n        f.path === `/${SPA_CHECK_CONSTRAINTS.INDEX_FILE}`,\n    );\n    if (!indexFile || indexFile.size > SPA_CHECK_CONSTRAINTS.MAX_INDEX_BYTES) {\n      return false;\n    }\n\n    let indexContent: string;\n    if (typeof Buffer !== 'undefined' && Buffer.isBuffer(indexFile.content)) {\n      indexContent = indexFile.content.toString('utf-8');\n    } else if (typeof Blob !== 'undefined' && indexFile.content instanceof Blob) {\n      indexContent = await indexFile.content.text();\n    } else if (typeof File !== 'undefined' && indexFile.content instanceof File) {\n      indexContent = await indexFile.content.text();\n    } else {\n      return false;\n    }\n\n    const body: SPACheckRequest = { files: files.map((f) => f.path), index: indexContent };\n    const response = await this.request<SPACheckResponse>(\n      `${this.apiUrl}${API_PATHS.SPA_CHECK}`,\n      {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify(body),\n      },\n      'SPA check',\n    );\n\n    return response.isSPA;\n  }\n}\n","/**\n * Event system for Ship SDK\n * Lightweight, reliable event handling with proper error boundaries\n */\n\nimport type { ShipEvents } from './types.js';\n\n/**\n * Lightweight typed event emitter.\n *\n * Public API: `on()` / `off()`. `emit()` is internal — only the SDK\n * publishes events. Throwing handlers are evicted automatically and\n * surfaced as `error` events on the next tick.\n */\nexport class SimpleEvents {\n  // biome-ignore lint/complexity/noBannedTypes: the registry is heterogeneous by design — per-event signatures are enforced at the on()/emit() boundary\n  private handlers = new Map<string, Set<Function>>();\n\n  /**\n   * Add event handler\n   */\n  on<K extends keyof ShipEvents>(event: K, handler: (...args: ShipEvents[K]) => void): void {\n    if (!this.handlers.has(event as string)) {\n      this.handlers.set(event as string, new Set());\n    }\n    this.handlers.get(event as string)?.add(handler);\n  }\n\n  /**\n   * Remove event handler\n   */\n  off<K extends keyof ShipEvents>(event: K, handler: (...args: ShipEvents[K]) => void): void {\n    const eventHandlers = this.handlers.get(event as string);\n    if (eventHandlers) {\n      eventHandlers.delete(handler);\n      if (eventHandlers.size === 0) {\n        this.handlers.delete(event as string);\n      }\n    }\n  }\n\n  /**\n   * Emit event (internal use only)\n   * @internal\n   */\n  emit<K extends keyof ShipEvents>(event: K, ...args: ShipEvents[K]): void {\n    const eventHandlers = this.handlers.get(event as string);\n    if (!eventHandlers) return;\n\n    // Snapshot handlers so a handler that mutates the set during iteration\n    // (e.g. by removing itself) doesn't skip or duplicate calls.\n    const handlerArray = Array.from(eventHandlers);\n\n    for (const handler of handlerArray) {\n      try {\n        handler(...args);\n      } catch (error) {\n        // A throwing handler is treated as broken — drop it so we don't\n        // repeatedly invoke it and re-emit the failure as an `error` event\n        // for observability. Defer the re-emit so the next tick has a clean\n        // call stack and we can't recurse if the error handler also throws.\n        eventHandlers.delete(handler);\n\n        if (event !== 'error') {\n          setTimeout(() => {\n            const err = error instanceof Error ? error : new Error(String(error));\n            this.emit('error', err, String(event));\n          }, 0);\n        }\n      }\n    }\n  }\n}\n","/**\n * @file Client-side input validation for SDK request boundaries.\n *\n * These validators run before request construction, and this module is the\n * one import surface for them (`http.ts` takes all three from here). The\n * rules themselves live in `@shipstatic/types` — constants\n * (`LABEL_CONSTRAINTS`, `LABEL_PATTERN`) and whole checks\n * (`validatePassword`, `assertShipJsonSyntax`) alike — so the SDK and the\n * API can never disagree about what a value must look like.\n *\n * Every check here is format, never policy: length envelopes, patterns, JSON\n * syntax. Anything that can evolve server-side — password strength, plan\n * caps, the ship.json schema — is deliberately absent, because a client that\n * judged it would reject input a newer platform accepts. See\n * `@shipstatic/types/CLAUDE.md` \"Validation: format vs policy\".\n */\n\nimport type { StaticFile } from '@shipstatic/types';\nimport {\n  assertShipJsonSyntax,\n  DEPLOYMENT_CONFIG_FILENAME,\n  LABEL_CONSTRAINTS,\n  LABEL_PATTERN,\n  ShipError,\n} from '@shipstatic/types';\n\n// Re-export the canonical password validator from `@shipstatic/types` so\n// existing SDK callers (`http.ts`) keep their `from '../lib/validation.js'`\n// import path unchanged. The types-tier definition is the single source of\n// truth — see `@shipstatic/types/CLAUDE.md` \"Validation: format vs policy\".\nexport { validatePassword } from '@shipstatic/types';\n\n/**\n * Validate and normalize an array of labels.\n *\n * Lowercases and trims each entry, enforces per-label length and pattern\n * (`LABEL_CONSTRAINTS` / `LABEL_PATTERN`), count cap, and uniqueness after\n * normalization. Returns the normalized array. An empty array is valid and\n * signals \"clear all labels\" on label-update operations.\n */\nexport function validateLabels(labels: string[]): string[];\nexport function validateLabels(labels: string[] | undefined | null): string[] | undefined;\nexport function validateLabels(labels: string[] | undefined | null): string[] | undefined {\n  if (labels === undefined || labels === null) return undefined;\n  if (labels.length === 0) return labels;\n\n  if (labels.length > LABEL_CONSTRAINTS.MAX_COUNT) {\n    throw ShipError.validation(`Maximum ${LABEL_CONSTRAINTS.MAX_COUNT} labels allowed`);\n  }\n\n  const normalized = labels.map((label, i) => {\n    if (typeof label !== 'string') {\n      throw ShipError.validation(`Label at index ${i} must be a string`);\n    }\n    const cleaned = label.trim().toLowerCase();\n    if (cleaned.length < LABEL_CONSTRAINTS.MIN_LENGTH) {\n      throw ShipError.validation(\n        `Labels must be at least ${LABEL_CONSTRAINTS.MIN_LENGTH} characters long`,\n      );\n    }\n    if (cleaned.length > LABEL_CONSTRAINTS.MAX_LENGTH) {\n      throw ShipError.validation(\n        `Labels must be no more than ${LABEL_CONSTRAINTS.MAX_LENGTH} characters long`,\n      );\n    }\n    if (!LABEL_PATTERN.test(cleaned)) {\n      throw ShipError.validation(\n        `Labels must start and end with alphanumeric characters, with optional separators (${LABEL_CONSTRAINTS.SEPARATORS}) between segments`,\n      );\n    }\n    return cleaned;\n  });\n\n  const unique = [...new Set(normalized)];\n  if (unique.length !== normalized.length) {\n    throw ShipError.validation('Duplicate labels are not allowed');\n  }\n\n  return unique;\n}\n\n/**\n * Validate a deploy's root `ship.json` — syntax only, never schema.\n *\n * The same format-not-policy split the password and label validators follow,\n * drawn one layer further out: ship.json's schema and its compiler live on\n * the server and evolve there, so a client that judged them would reject\n * configs a newer platform accepts. `assertShipJsonSyntax` (the types-tier\n * definition, and the single source of truth) checks only what holds for\n * every past and future schema — the text parses as JSON, and its top level\n * is an object.\n *\n * Scope matches the API's `findDeploymentConfigFile`: the exact name at the\n * deploy root, optional leading slash and nothing else, so a\n * `config/ship.json` stays an ordinary asset the platform never reads.\n */\nexport async function validateDeployConfig(files: StaticFile[]): Promise<void> {\n  const config = files.find(\n    (f) => f.path === DEPLOYMENT_CONFIG_FILENAME || f.path === `/${DEPLOYMENT_CONFIG_FILENAME}`,\n  );\n  if (!config) return;\n\n  // Node hands the pipeline a `Buffer`; the browser a `File`/`Blob`, which is\n  // the only one of the two carrying `.text()`.\n  const content = config.content as Blob;\n  const text =\n    typeof content.text === 'function'\n      ? await content.text()\n      : (config.content as Buffer).toString('utf8');\n\n  assertShipJsonSyntax(text);\n}\n","/**\n * Ship SDK resource factory functions.\n */\nimport {\n  type AccountResource,\n  type DeployInput,\n  type DeploymentResource,\n  type DomainResource,\n  type ListOptions,\n  ShipError,\n  type StaticFile,\n  type TokenResource,\n} from '@shipstatic/types';\n\nexport type {\n  AccountResource,\n  DeployInput,\n  DeploymentResource,\n  DomainResource,\n  StaticFile,\n  TokenResource,\n};\n\nimport type { ApiHttp } from './api/http.js';\nimport { detectAndConfigureSPA } from './lib/spa.js';\nimport type { DeploymentOptions } from './types.js';\n\n/**\n * Shared context for all resource factories.\n */\nexport interface ResourceContext {\n  getApi: () => ApiHttp;\n  ensureInit: () => Promise<void>;\n}\n\n/**\n * Extended context for deployment resource.\n */\nexport interface DeploymentResourceContext extends ResourceContext {\n  processInput: (input: DeployInput, options: DeploymentOptions) => Promise<StaticFile[]>;\n}\n\n/**\n * Upload deployment resource with all CRUD operations.\n *\n * There is no client-side auth branching: an upload from a credential-less\n * client simply carries no `Authorization` header, and the API grants the\n * public-account agent identity per request (claim URL + expiry on the\n * response). The SDK stays a transparent pipe either way.\n */\nexport function createDeploymentResource(\n  ctx: DeploymentResourceContext,\n): DeploymentResource<DeploymentOptions> {\n  const { getApi, ensureInit, processInput } = ctx;\n\n  return {\n    upload: async (input: DeployInput, options: DeploymentOptions = {}) => {\n      await ensureInit();\n\n      if (!processInput) {\n        throw ShipError.config('processInput function is not provided.');\n      }\n\n      const apiClient = getApi();\n      let staticFiles = await processInput(input, options);\n      staticFiles = await detectAndConfigureSPA(staticFiles, apiClient, options);\n\n      return apiClient.deploy(staticFiles, options);\n    },\n\n    list: async (options?: ListOptions) => {\n      await ensureInit();\n      return getApi().listDeployments(options);\n    },\n\n    get: async (id: string) => {\n      await ensureInit();\n      return getApi().getDeployment(id);\n    },\n\n    set: async (id: string, options: { labels: string[] }) => {\n      await ensureInit();\n      return getApi().updateDeploymentLabels(id, options.labels);\n    },\n\n    delete: async (id: string) => {\n      await ensureInit();\n      return getApi().deleteDeployment(id);\n    },\n  };\n}\n\n/**\n * Create domain resource with all CRUD operations.\n *\n * @remarks\n * The `name` parameter in all methods is an FQDN (Fully Qualified Domain Name).\n * The SDK does not validate or normalize domain names - the API handles all domain semantics.\n */\nexport function createDomainResource(ctx: ResourceContext): DomainResource {\n  const { getApi, ensureInit } = ctx;\n\n  return {\n    // INTENTIONAL DESIGN: The API does NOT support unlinking domains (setting deployment to null).\n    // Once a domain is linked to a deployment, it must always have a deployment.\n    // Supported: reserve (omit deployment), link, switch deployments atomically, delete entirely.\n    // Not supported: unlink after linking (creates ambiguous state with no clear use case).\n    // See npm/ship/CLAUDE.md \"Domain Write Semantics\" for full rationale.\n    set: async (name: string, options: { deployment?: string; labels?: string[] } = {}) => {\n      await ensureInit();\n      return getApi().setDomain(name, options.deployment, options.labels);\n    },\n\n    list: async (options?: ListOptions) => {\n      await ensureInit();\n      return getApi().listDomains(options);\n    },\n\n    get: async (name: string) => {\n      await ensureInit();\n      return getApi().getDomain(name);\n    },\n\n    delete: async (name: string) => {\n      await ensureInit();\n      return getApi().deleteDomain(name);\n    },\n\n    verify: async (name: string) => {\n      await ensureInit();\n      return getApi().verifyDomain(name);\n    },\n\n    validate: async (name: string) => {\n      await ensureInit();\n      return getApi().validateDomain(name);\n    },\n\n    dns: async (name: string) => {\n      await ensureInit();\n      return getApi().getDomainDns(name);\n    },\n\n    records: async (name: string) => {\n      await ensureInit();\n      return getApi().getDomainRecords(name);\n    },\n\n    share: async (name: string) => {\n      await ensureInit();\n      return getApi().getDomainShare(name);\n    },\n  };\n}\n\n/**\n * Create account resource (whoami functionality).\n */\nexport function createAccountResource(ctx: ResourceContext): AccountResource {\n  const { getApi, ensureInit } = ctx;\n\n  return {\n    get: async () => {\n      await ensureInit();\n      return getApi().getAccount();\n    },\n  };\n}\n\n/**\n * Create token resource for managing deploy tokens.\n */\nexport function createTokenResource(ctx: ResourceContext): TokenResource {\n  const { getApi, ensureInit } = ctx;\n\n  return {\n    create: async (options: { ttl?: number; labels?: string[] } = {}) => {\n      await ensureInit();\n      return getApi().createToken(options.ttl, options.labels);\n    },\n\n    list: async (options?: ListOptions) => {\n      await ensureInit();\n      return getApi().listTokens(options);\n    },\n\n    get: async (token: string) => {\n      await ensureInit();\n      return getApi().getToken(token);\n    },\n\n    delete: async (token: string) => {\n      await ensureInit();\n      return getApi().deleteToken(token);\n    },\n  };\n}\n","/**\n * @file SPA detection and auto-configuration utilities.\n *\n * Provides SPA detection and ship.json generation functionality\n * that can be used by both Node.js and browser environments.\n */\n\nimport { DEPLOYMENT_CONFIG_FILENAME, SPA_DEFAULT_CONFIG } from '@shipstatic/types';\nimport type { ApiHttp } from '../api/http.js';\nimport type { DeploymentOptions, StaticFile } from '../types.js';\nimport { calculateMD5 } from './md5.js';\n\n/**\n * Creates ship.json configuration for SPA projects.\n * @returns Promise resolving to StaticFile with SPA configuration\n */\nexport async function createSPAConfig(): Promise<StaticFile> {\n  const configString = JSON.stringify(SPA_DEFAULT_CONFIG, null, 2);\n\n  // Create content that works in both browser and Node.js environments\n  let content: Buffer | Blob;\n  if (typeof Buffer !== 'undefined') {\n    // Node.js environment\n    content = Buffer.from(configString, 'utf-8');\n  } else {\n    // Browser environment\n    content = new Blob([configString], { type: 'application/json' });\n  }\n\n  const { md5 } = await calculateMD5(content);\n\n  return {\n    path: DEPLOYMENT_CONFIG_FILENAME,\n    content,\n    size: configString.length,\n    md5,\n  };\n}\n\n/**\n * Detects SPA projects and auto-generates configuration.\n * This function can be used by both Node.js and browser environments.\n *\n * @param files - Array of StaticFiles to analyze\n * @param apiClient - HTTP client for API communication\n * @param options - Deployment options containing SPA detection settings\n * @returns Promise resolving to files array with optional SPA config added\n */\nexport async function detectAndConfigureSPA(\n  files: StaticFile[],\n  apiClient: ApiHttp,\n  options: DeploymentOptions,\n): Promise<StaticFile[]> {\n  // Skip if disabled, config already exists, or server will handle detection\n  if (\n    options.spaDetect === false ||\n    options.spa ||\n    options.build ||\n    options.prerender ||\n    files.some((f) => f.path === DEPLOYMENT_CONFIG_FILENAME)\n  ) {\n    return files;\n  }\n\n  try {\n    const isSPA = await apiClient.checkSPA(files, options);\n\n    if (isSPA) {\n      const spaConfig = await createSPAConfig();\n      return [...files, spaConfig];\n    }\n  } catch (_error) {\n    // SPA detection failed, continue silently without auto-config\n  }\n\n  return files;\n}\n","/**\n * @file Environment variable resolution for the Node.js Ship SDK.\n *\n * The SDK has exactly one ambient credential source: process environment\n * variables. `SHIP_TOKEN` (any platform token — the value's prefix says what\n * it is) and `SHIP_API_URL` are honored as the universal \"process boundary\" —\n * the one-token idiom used across the industry (`GITHUB_TOKEN`, `NPM_TOKEN`,\n * `VERCEL_TOKEN`). Constructor arguments win over env vars.\n *\n * File-based config (`~/.shiprc`, `package.json` `\"ship\"` key) is the CLI's\n * responsibility — see `src/node/cli/shiprc.ts`. The SDK does not read files,\n * which is what lets embedded consumers (MCP, the VS Code extension, GitHub\n * Action) construct `new Ship({})` for anonymous deployments without leaking\n * the host developer's personal credentials.\n */\n\nimport { SHIP_ENV, ShipError } from '@shipstatic/types';\nimport { z } from 'zod';\nimport { CREDENTIAL_FIELDS } from '../../shared/core/credential-schema.js';\nimport { getENV } from '../../shared/lib/env.js';\nimport type { ShipClientOptions } from '../../shared/types.js';\n\n// `.strict()` matches the file-config schema. The `raw` object below is\n// constructed from a fixed set of keys, so .strict() doesn't catch user\n// typos here (env vars we don't read are simply never put into `raw` in\n// the first place). What it does catch is a *contributor* error — adding\n// a new env-var read without updating `CREDENTIAL_FIELDS` produces a clear\n// validation failure rather than a silently-stripped value. Nearly free\n// (one method call), and keeps both schemas reading the same.\nconst EnvConfigSchema = z.object(CREDENTIAL_FIELDS).strict();\n\n/**\n * Map a `ShipClientOptions` field name (camelCase) back to the env var that\n * supplied it (SCREAMING_SNAKE_CASE), so validation errors point users at\n * the actual variable they need to fix. Kept as an explicit table rather\n * than a regex because the set is small, fixed, and unambiguous.\n */\nconst ENV_VAR_BY_FIELD: Record<string, string> = {\n  apiUrl: SHIP_ENV.API_URL,\n  token: SHIP_ENV.TOKEN,\n};\n\n/**\n * Read `SHIP_*` environment variables and validate the result.\n *\n * Empty strings (CI/Docker often sets env vars to `\"\"` instead of unsetting them)\n * are normalized to `undefined` before validation, so they don't trigger zod's\n * \"min length 1\" check or accidentally override a valid constructor argument.\n *\n * Returns an empty object outside Node.js — browser/edge runtimes have no\n * `process.env` we should reach into.\n */\nexport function readEnvConfig(): Partial<ShipClientOptions> {\n  if (getENV() !== 'node') return {};\n\n  const raw = {\n    apiUrl: process.env[SHIP_ENV.API_URL] || undefined,\n    token: process.env[SHIP_ENV.TOKEN] || undefined,\n  };\n\n  try {\n    return EnvConfigSchema.parse(raw);\n  } catch (error) {\n    if (error instanceof z.ZodError) {\n      const issue = error.issues[0];\n      const field = issue.path[0] as string | undefined;\n      const envVar = (field && ENV_VAR_BY_FIELD[field]) ?? 'SHIP environment configuration';\n      throw ShipError.config(`Invalid ${envVar}: ${issue.message}`);\n    }\n    throw ShipError.config('Invalid environment configuration');\n  }\n}\n","/**\n * @file Single source of truth for ambient-config field validation.\n *\n * Both the SDK env reader (`node/core/config.ts`) and the CLI file loader\n * (`node/cli/shiprc.ts`) import these — if we tighten or relax a rule,\n * both layers update together. The `token` field accepts any platform token;\n * strict prefix-classified format validation happens once, at the `Ship`\n * constructor boundary, for every source uniformly.\n *\n * Lives in its own file because it's a pure data constant: tests that mock\n * runtime config behavior shouldn't have to forward this through their mocks.\n */\n\nimport { z } from 'zod';\n\nexport const CREDENTIAL_FIELDS = {\n  apiUrl: z.string().url().optional(),\n  token: z.string().min(1).optional(),\n};\n","/**\n * Node.js-specific deploy body creation.\n */\nimport { DEPLOY_FIELDS, ShipError } from '@shipstatic/types';\nimport type { DeployBody, DeployBodyContext, StaticFile } from '../../shared/types.js';\n\nexport async function createDeployBody(\n  files: StaticFile[],\n  context: DeployBodyContext = {},\n): Promise<DeployBody> {\n  const { FormData, File } = await import('formdata-node');\n  const { FormDataEncoder } = await import('form-data-encoder');\n\n  const { labels, via, password, flags, captcha } = context;\n  const formData = new FormData();\n  const checksums: string[] = [];\n\n  for (const file of files) {\n    // 1. Validate content type\n    if (\n      !Buffer.isBuffer(file.content) &&\n      !(typeof Blob !== 'undefined' && file.content instanceof Blob)\n    ) {\n      throw ShipError.file(`Unsupported file.content type for Node.js: ${file.path}`, {\n        filePath: file.path,\n      });\n    }\n\n    // 2. Validate md5\n    if (!file.md5) {\n      throw ShipError.file(`File missing md5 checksum: ${file.path}`, { filePath: file.path });\n    }\n\n    // 3. Create File and append — API derives Content-Type from extension\n    const fileInstance = new File([file.content], file.path, { type: 'application/octet-stream' });\n    formData.append(DEPLOY_FIELDS.FILES, fileInstance);\n    checksums.push(file.md5);\n  }\n\n  formData.append(DEPLOY_FIELDS.CHECKSUMS, JSON.stringify(checksums));\n\n  if (labels && labels.length > 0) formData.append(DEPLOY_FIELDS.LABELS, JSON.stringify(labels));\n  if (via) formData.append(DEPLOY_FIELDS.VIA, via);\n  if (password) formData.append(DEPLOY_FIELDS.PASSWORD, password);\n  if (flags?.build) formData.append(DEPLOY_FIELDS.BUILD, 'true');\n  if (flags?.prerender) formData.append(DEPLOY_FIELDS.PRERENDER, 'true');\n  if (flags?.spa) formData.append(DEPLOY_FIELDS.SPA, 'true');\n  if (captcha) formData.append(DEPLOY_FIELDS.CAPTCHA, captcha);\n\n  const encoder = new FormDataEncoder(formData);\n  const chunks = [];\n  for await (const chunk of encoder.encode()) {\n    chunks.push(Buffer.from(chunk));\n  }\n  const body = Buffer.concat(chunks);\n\n  return {\n    body: body.buffer.slice(body.byteOffset, body.byteOffset + body.byteLength) as ArrayBuffer,\n    headers: {\n      'Content-Type': encoder.contentType,\n      'Content-Length': Buffer.byteLength(body).toString(),\n    },\n  };\n}\n","/**\n * @file Shared SDK exports - environment agnostic.\n */\n\nexport type { Account, Deployment, Domain, PingResponse } from '@shipstatic/types';\n// Re-export types from @shipstatic/types\nexport { ErrorType, ShipError } from '@shipstatic/types';\nexport * from './api/http.js';\nexport { Ship } from './base-ship.js';\nexport * from './core/constants.js';\nexport * from './lib/deploy-paths.js';\nexport * from './lib/env.js';\nexport * from './lib/file-validation.js';\nexport * from './lib/junk.js';\n// Shared utilities\nexport * from './lib/md5.js';\nexport * from './lib/security.js';\nexport * from './lib/text.js';\n// Core functionality\nexport * from './resources.js';\nexport * from './types.js';\n","/**\n * @file SDK-specific constants.\n * Platform constants are now in @shipstatic/types.\n */\n\n// Re-export platform constants for convenience\nexport { DEFAULT_API } from '@shipstatic/types';\n","/**\n * Utility functions for string manipulation.\n */\n\n/**\n * Simple utility to pluralize a word based on a count.\n * @param count The number to determine pluralization.\n * @param singular The singular form of the word.\n * @param plural The plural form of the word.\n * @param includeCount Whether to include the count in the returned string. Defaults to true.\n * @returns A string with the count and the correctly pluralized word.\n */\nexport function pluralize(\n  count: number,\n  singular: string,\n  plural: string,\n  includeCount: boolean = true,\n): string {\n  const word = count === 1 ? singular : plural;\n  return includeCount ? `${count} ${word}` : word;\n}\n"],"mappings":"4mBAwFO,SAASA,GAAaC,EAAO,CAChC,GAAI,CAACA,GAAS,OAAOA,GAAU,SAC3B,OACJ,IAAMC,EAAMD,EAAM,KAAK,EAAE,YAAY,EACrC,OAAO,OAAO,OAAOE,EAAa,EAAE,SAASD,CAAG,EAC1CA,EACA,MACV,CAMO,SAASE,GAAuBH,EAAO,CAC1C,GAA2BA,GAAU,KACjC,OACJ,GAAI,OAAOA,GAAU,SACjB,MAAMI,EAAU,WAAW,mCAAmC,EAElE,IAAMC,EAAML,EAAM,KAAK,EACvB,GAAI,CAACK,EACD,MAAMD,EAAU,WAAW,oCAAoC,EAEnE,GAAIC,EAAI,OAASC,EAA4B,WACzC,MAAMF,EAAU,WAAW,mCAAmCE,EAA4B,UAAU,cAAc,EAEtH,OAAOD,CACX,CA4PA,SAASE,GAAmBC,EAAO,CAC/B,OAAI,OAAOA,EAAM,MAAS,SACf,GAIJA,aAAiB,WAAaA,EAAM,QAAQ,SAAS,OAAO,CACvE,CA6PO,SAASC,EAAYC,EAAO,CAC/B,OAAQA,IAAU,MACd,OAAOA,GAAU,UACjB,SAAUA,GACVA,EAAM,OAAS,aACf,WAAYA,CACpB,CAsEO,SAASC,EAAmBC,EAAU,CACzC,IAAMC,EAAWD,EAAS,YAAY,GAAG,EACzC,GAAIC,IAAa,IAAMA,IAAaD,EAAS,OAAS,EAClD,MAAO,GACX,IAAME,EAAMF,EAAS,MAAMC,EAAW,CAAC,EAAE,YAAY,EACrD,OAAOE,GAAmB,IAAID,CAAG,CACrC,CAiJO,SAASE,GAAeJ,EAAU,CACrC,OAAOK,GAAsB,KAAKL,CAAQ,CAC9C,CAoBO,SAASM,EAAiBC,EAAU,CAEvC,OADiBA,EAAS,QAAQ,MAAO,GAAG,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO,EACvD,KAAMC,GAAMC,EAAwB,IAAID,CAAC,CAAC,CAC9D,CAmGO,SAASE,GAAcC,EAAO,CACjC,OAAIA,EAAM,WAAWC,GAAQ,MAAM,EACxBC,EAAU,QACjBF,EAAM,WAAWG,GAAa,MAAM,EAC7BD,EAAU,aACdA,EAAU,MACrB,CA4EO,SAASE,GAAqBC,EAAM,CACvC,IAAMC,EAAaD,EAAK,WAAW,CAAC,IAAM,MAASA,EAAK,MAAM,CAAC,EAAIA,EAC/DE,EACJ,GAAI,CACAA,EAAS,KAAK,MAAMD,CAAU,CAClC,OACOnB,EAAO,CACV,MAAMN,EAAU,OAAO,kCAAkCM,EAAM,OAAO,GAAI,CACtE,SAAUqB,CACd,CAAC,CACL,CACA,GAAID,IAAW,MAAQ,OAAOA,GAAW,UAAY,MAAM,QAAQA,CAAM,EACrE,MAAM1B,EAAU,OAAO,GAAG2B,CAA0B,8BAA+B,CAC/E,SAAUA,CACd,CAAC,CAET,CASA,SAASC,GAA2BhC,EAAOiC,EAAOC,EAAO,CACrD,GAAI,CAAClC,EAAM,WAAWiC,EAAM,MAAM,EAC9B,MAAM7B,EAAU,WAAW,GAAG8B,CAAK,qBAAqBD,EAAM,MAAM,GAAG,EAE3E,GAAIjC,EAAM,SAAWiC,EAAM,aACvB,MAAM7B,EAAU,WAAW,GAAG8B,CAAK,YAAYD,EAAM,YAAY,sBAAsBA,EAAM,MAAM,MAAMA,EAAM,UAAU,aAAa,EAE1I,IAAME,EAAUnC,EAAM,MAAMiC,EAAM,OAAO,MAAM,EAC/C,GAAI,CAAC,IAAI,OAAO,aAAaA,EAAM,UAAU,KAAM,GAAG,EAAE,KAAKE,CAAO,EAChE,MAAM/B,EAAU,WAAW,GAAG8B,CAAK,iBAAiBD,EAAM,UAAU,kCAAkCA,EAAM,MAAM,UAAU,CAEpI,CAIO,SAASG,GAAeC,EAAQ,CACnCL,GAA2BK,EAAQb,GAAS,SAAS,CACzD,CAIO,SAASc,GAAoBC,EAAa,CAC7CP,GAA2BO,EAAab,GAAc,cAAc,CACxE,CAOO,SAASc,EAAcjB,EAAO,CACjC,OAAQD,GAAcC,CAAK,EAAG,CAC1B,KAAKE,EAAU,QACXW,GAAeb,CAAK,EACpB,OACJ,KAAKE,EAAU,aACXa,GAAoBf,CAAK,EACzB,OACJ,KAAKE,EAAU,OACX,GAAI,CAACF,EACD,MAAMnB,EAAU,WAAW,kCAAkC,CACzE,CACJ,CAMO,SAASqC,GAAeC,EAAQ,CACnC,GAAI,CAACA,GAAUA,EAAO,OAASC,EAAO,YAAc,CAACA,EAAO,QAAQ,KAAKD,CAAM,EAC3E,MAAMtC,EAAU,WAAW,oBAAoBuC,EAAO,UAAU,6DAA6D,CAErI,CAIO,SAASC,GAAeC,EAAQ,CACnC,GAAI,CACA,IAAMC,EAAM,IAAI,IAAID,CAAM,EAC1B,GAAI,CAAC,CAAC,QAAS,QAAQ,EAAE,SAASC,EAAI,QAAQ,EAC1C,MAAM1C,EAAU,WAAW,+CAA+C,EAE9E,GAAI0C,EAAI,WAAa,KAAOA,EAAI,WAAa,GACzC,MAAM1C,EAAU,WAAW,iCAAiC,EAEhE,GAAI0C,EAAI,QAAUA,EAAI,KAClB,MAAM1C,EAAU,WAAW,wDAAwD,CAE3F,OACOM,EAAO,CACV,MAAID,EAAYC,CAAK,EACXA,EAEJN,EAAU,WAAW,6BAA6B,CAC5D,CACJ,CAKO,SAAS2C,GAAaC,EAAO,CAChC,MAAO,+CAA+C,KAAKA,CAAK,CACpE,CA8EO,SAASC,GAAiBC,EAAQC,EAAgB,CACrD,OAAOD,EAAO,SAAS,IAAIC,CAAc,EAAE,CAC/C,CAQO,SAASC,GAAeF,EAAQC,EAAgB,CACnD,MAAO,CAACF,GAAiBC,EAAQC,CAAc,CACnD,CAQO,SAASE,GAAiBH,EAAQC,EAAgB,CACrD,OAAKF,GAAiBC,EAAQC,CAAc,EAGrCD,EAAO,MAAM,EAAG,EAAEC,EAAe,OAAS,EAAE,EAFxC,IAGf,CAIO,SAASG,GAAsBC,EAAY,CAC9C,MAAO,WAAWA,CAAU,EAChC,CAIO,SAASC,GAAkBN,EAAQ,CACtC,MAAO,WAAWA,CAAM,EAC5B,CAmCO,SAASO,GAAgBC,EAAQ,CACpC,MAAI,CAACA,GAAUA,EAAO,SAAW,EACtB,KACJ,KAAK,UAAUA,CAAM,CAChC,CASO,SAASC,GAAkBC,EAAY,CAC1C,GAAI,CAACA,EACD,MAAO,CAAC,EACZ,GAAI,CACA,IAAM9B,EAAS,KAAK,MAAM8B,CAAU,EACpC,OAAO,MAAM,QAAQ9B,CAAM,EAAIA,EAAS,CAAC,CAC7C,MACM,CACF,MAAO,CAAC,CACZ,CACJ,CAoCO,SAAS+B,EAAiB7D,EAAO,CACpC,GAA2BA,GAAU,KACjC,OACJ,GAAI,OAAOA,GAAU,SACjB,MAAMI,EAAU,WAAW,2BAA2B,EAE1D,IAAM0D,EAAU9D,EAAM,KAAK,EAC3B,GAAI8D,EAAQ,OAASC,EAAqB,YACtCD,EAAQ,OAASC,EAAqB,WACtC,MAAM3D,EAAU,WAAW,4BAA4B2D,EAAqB,UAAU,QAAQA,EAAqB,UAAU,aAAa,EAE9I,OAAOD,CACX,CA52CA,IAUaE,GAiBA9D,GAqBA+D,GAaA3D,EA6DA4D,GA2CAC,EAwCAC,EAgCAC,EAiDPC,GAWAC,GAiCAC,GAQAC,GAwCOrE,EA6QAW,GA6EP2D,GAwGOC,GAgBA1D,GAoBAI,EA+BAuD,GAUAC,GAaArD,GAcAE,GAeAiB,EAoBAlB,EA6BAqD,GAUA/C,EAEAgD,GAiBAC,EAmJAC,EAcAC,EAeAC,GAeAC,GAOAC,EAmEAC,EAkBAC,GAyCAxB,EAr0CbyB,EAAAC,EAAA,kBAUazB,GAAmB,CAC5B,QAAS,UACT,QAAS,UACT,OAAQ,SACR,SAAU,UACd,EAYa9D,GAAgB,CACzB,IAAK,MACL,IAAK,MACL,IAAK,MACL,IAAK,MACL,IAAK,MACL,IAAK,MACL,IAAK,MACL,IAAK,KACT,EAYa+D,GAAe,CACxB,QAAS,UACT,QAAS,UACT,QAAS,UACT,OAAQ,QACZ,EAQa3D,EAA8B,CAMvC,OAAQ,kBACR,WAAY,IAEZ,eAAgB,KAAU,EAC9B,EAmDa4D,GAAc,CACvB,KAAM,OACN,SAAU,WACV,UAAW,YACX,WAAY,aACZ,UAAW,YACX,YAAa,cACb,WAAY,YAChB,EAmCaC,EAAY,CACrB,YAAa,eACb,WAAaZ,GAAe,gBAAgBA,CAAU,GACtD,kBAAoBA,GAAe,gBAAgBA,CAAU,UAC7D,QAAS,WACT,OAASL,GAAW,YAAYA,CAAM,GACtC,cAAgBA,GAAW,YAAYA,CAAM,UAC7C,WAAaA,GAAW,YAAYA,CAAM,OAC1C,eAAiBA,GAAW,YAAYA,CAAM,WAC9C,aAAeA,GAAW,YAAYA,CAAM,SAC5C,mBAAqBA,GAAW,YAAYA,CAAM,eAClD,iBAAkB,oBAClB,OAAQ,UACR,MAAQ3B,GAAU,WAAWA,CAAK,GAClC,QAAS,WACT,YAAa,eACb,cAAe,iBACf,WAAY,cACZ,OAAQ,UACR,OAAQ,UACR,KAAM,QACN,MAAO,SACP,UAAW,aACX,OAAQ,SACZ,EAgBa6C,EAAgB,CAEzB,MAAO,UAEP,UAAW,YAEX,OAAQ,SAER,IAAK,MAEL,SAAU,WAEV,MAAO,QAEP,UAAW,YAEX,IAAK,MAEL,QAAS,SACb,EAaaC,EAAY,CAUrB,WAAY,oBAEZ,SAAU,YAEV,UAAW,YAEX,UAAW,sBAEX,eAAgB,wBAEhB,SAAU,uBAEV,IAAK,wBAWL,YAAa,cAEb,QAAS,gBAET,UAAW,sBAEX,KAAM,aAEN,OAAQ,cACZ,EAOMC,GAA0B,IAAI,IAAI,CACpCD,EAAU,QACVA,EAAU,UACVA,EAAU,KACVA,EAAU,MACd,CAAC,EAMKE,GAAmB,CAarB,OAAQ,IAAI,IAAI,CACZF,EAAU,SACVA,EAAU,UACVA,EAAU,OACVA,EAAU,KACVA,EAAU,UACVA,EAAU,SACVA,EAAU,UACVA,EAAU,UACd,CAAC,EACD,QAAS,IAAI,IAAI,CAACA,EAAU,OAAO,CAAC,EACpC,KAAM,IAAI,IAAI,CAACA,EAAU,cAAc,CAAC,CAC5C,EAQMG,GAAgC,IAAI,IAAI,OAAO,OAAOH,CAAS,EAAE,OAAQqB,GAAM,CAACpB,GAAwB,IAAIoB,CAAC,CAAC,CAAC,EAQ/GjB,GAA6B,IAwCtBrE,EAAN,MAAMuF,UAAkB,KAAM,CACjC,KACA,OACA,QACA,YAAYC,EAAMC,EAASC,EAAQC,EAAS,CACxC,MAAMF,CAAO,EACb,KAAK,KAAOD,EACZ,KAAK,OAASE,EACd,KAAK,QAAUC,EACf,KAAK,KAAO,WAChB,CAEA,YAAa,CAIT,IAAMC,EAAc,KAAK,QACnBD,EAAU,KAAK,OAAS1B,EAAU,gBAAkB2B,GAAa,SAAW,OAAY,KAAK,QACnG,MAAO,CACH,MAAO,KAAK,KACZ,QAAS,KAAK,QACd,OAAQ,KAAK,OACb,QAAAD,CACJ,CACJ,CAuBA,aAAa,iBAAiBE,EAAUC,EAAe,CACnD,IAAIL,EACAE,EACAI,EACJ,GAAI,CAEA,GADoBF,EAAS,QAAQ,IAAI,cAAc,GACtC,SAAS,kBAAkB,EAAG,CAC3C,IAAMG,EAAO,MAAMH,EAAS,KAAK,EACjC,GAAIG,GAAQ,OAAOA,GAAS,SAAU,CAClC,IAAMC,EAAMD,EACR,OAAOC,EAAI,SAAY,SACvBR,EAAUQ,EAAI,QACT,OAAOA,EAAI,OAAU,WAC1BR,EAAUQ,EAAI,OAClBN,EAAUM,EAAI,QACV,OAAOA,EAAI,OAAU,UAAY7B,GAA8B,IAAI6B,EAAI,KAAK,IAC5EF,EAAWE,EAAI,MAEvB,CACJ,KACK,CAQD,IAAMzE,GAAQ,MAAMqE,EAAS,KAAK,GAAG,KAAK,EACtCrE,GAAQ,CAACA,EAAK,WAAW,GAAG,GAAKA,EAAK,QAAU6C,KAChDoB,EAAUjE,EAElB,CACJ,MACM,CAEN,CAKA,IAAM0E,EAAmBL,EAAS,QAAQ,IAAI,aAAa,EAC3D,GAAIK,IAAqB,KAAM,CAC3B,IAAMtG,EAAQsG,EAAiB,KAAK,EAC9BC,EAAU,QAAQ,KAAKvG,CAAK,EAC5B,OAAOA,CAAK,EACZ,KAAK,MAAM,KAAK,MAAMA,CAAK,EAAI,KAAK,IAAI,GAAK,GAAI,EACvD,GAAI,OAAO,SAASuG,CAAO,GAAKA,GAAW,EAAG,CAC1C,IAAMC,EAAWT,GAAW,OAAOA,GAAY,SAAWA,EAAU,CAAC,EACjES,EAAS,aAAe,SACxBT,EAAU,CAAE,GAAGS,EAAU,WAAYD,CAAQ,EAErD,CACJ,CACAV,EAAUA,GAAW,GAAGK,GAAiB,SAAS,uBAAuBD,EAAS,MAAM,GACxF,IAAML,EAAOO,IACRF,EAAS,SAAW,IACf5B,EAAU,eACV4B,EAAS,SAAW,IAChB5B,EAAU,UACV4B,EAAS,SAAW,IAChB5B,EAAU,UACVA,EAAU,KAC5B,OAAO,IAAIsB,EAAUC,EAAMC,EAASI,EAAS,OAAQF,CAAO,CAChE,CAoBA,OAAO,eAAevF,EAAO0F,EAAe,CACxC,GAAIzF,EAAYD,CAAK,EACjB,OAAOA,EACX,IAAMiG,EAAKP,GAAiB,UAC5B,OAAI1F,aAAiB,MACbA,EAAM,OAAS,aACRmF,EAAU,UAAU,GAAGc,CAAE,gBAAgB,EAEhDlG,GAAmBC,CAAK,EACjBmF,EAAU,QAAQ,GAAGc,CAAE,YAAYjG,EAAM,OAAO,GAAI,CAAE,MAAAA,CAAM,CAAC,EAEjE,IAAImF,EAAUtB,EAAU,IAAK,GAAGoC,CAAE,YAAYjG,EAAM,OAAO,EAAE,EAEjE,IAAImF,EAAUtB,EAAU,IAAK,GAAGoC,CAAE,wBAAwB,CACrE,CAKA,OAAO,WAAWZ,EAASE,EAAS,CAChC,OAAO,IAAIJ,EAAUtB,EAAU,WAAYwB,EAAS,IAAKE,CAAO,CACpE,CACA,OAAO,SAASW,EAAUC,EAAI,CAC1B,IAAMd,EAAUc,EAAK,GAAGD,CAAQ,IAAIC,CAAE,aAAe,GAAGD,CAAQ,aAChE,OAAO,IAAIf,EAAUtB,EAAU,SAAUwB,EAAS,GAAG,CACzD,CACA,OAAO,UAAUA,EAASE,EAAS,CAC/B,OAAO,IAAIJ,EAAUtB,EAAU,UAAWwB,EAAS,IAAKE,CAAO,CACnE,CACA,OAAO,UAAUF,EAAU,oBAAqBE,EAAS,CACrD,OAAO,IAAIJ,EAAUtB,EAAU,UAAWwB,EAAS,IAAKE,CAAO,CACnE,CAcA,OAAO,eAAeF,EAAU,0BAA2BE,EAAS,CAChE,OAAO,IAAIJ,EAAUtB,EAAU,eAAgBwB,EAAS,IAAKE,CAAO,CACxE,CACA,OAAO,SAASF,EAASC,EAAS,IAAKC,EAAS,CAC5C,OAAO,IAAIJ,EAAUtB,EAAU,SAAUwB,EAASC,EAAQC,CAAO,CACrE,CACA,OAAO,QAAQF,EAASE,EAAS,CAC7B,OAAO,IAAIJ,EAAUtB,EAAU,QAASwB,EAAS,OAAWE,CAAO,CACvE,CACA,OAAO,UAAUF,EAASE,EAAS,CAC/B,OAAO,IAAIJ,EAAUtB,EAAU,UAAWwB,EAAS,OAAWE,CAAO,CACzE,CACA,OAAO,KAAKF,EAASE,EAAS,CAC1B,OAAO,IAAIJ,EAAUtB,EAAU,KAAMwB,EAAS,OAAWE,CAAO,CACpE,CACA,OAAO,OAAOF,EAASE,EAAS,CAC5B,OAAO,IAAIJ,EAAUtB,EAAU,OAAQwB,EAAS,OAAWE,CAAO,CACtE,CACA,OAAO,IAAIF,EAASC,EAAS,IAAKC,EAAS,CACvC,OAAO,IAAIJ,EAAUtB,EAAU,IAAKwB,EAASC,EAAQC,CAAO,CAChE,CAUA,OAAO,YAAYF,EAASE,EAAS,CACjC,OAAO,IAAIJ,EAAUtB,EAAU,YAAawB,EAAS,IAAKE,CAAO,CACrE,CAeA,eAAgB,CACZ,OAAIxB,GAAiB,OAAO,IAAI,KAAK,IAAI,EAC9B,GACJ,KAAK,SAAW,QAAa,KAAK,QAAU,KAAO,KAAK,OAAS,GAC5E,CACA,gBAAiB,CACb,OAAOA,GAAiB,QAAQ,IAAI,KAAK,IAAI,CACjD,CACA,aAAc,CACV,OAAOA,GAAiB,KAAK,IAAI,KAAK,IAAI,CAC9C,CACA,OAAOqC,EAAW,CACd,OAAO,KAAK,OAASA,CACzB,CACJ,EAgCa7F,GAAqB,IAAI,IAAI,CAEtC,MACA,MACA,MACA,MACA,MACA,MACA,MACA,MACA,MACA,MACA,MAEA,MACA,OAEA,MACA,MACA,MAEA,MACA,MACA,MAEA,MACA,MACA,MACA,KACA,MACA,MACA,MACA,MAEA,MACA,OAEA,MACA,MAEA,MACA,MACA,KACJ,CAAC,EAkCK2D,GAAsB,CAExB,OACA,MACA,QACA,MACA,MACA,KACA,WACA,MACA,MAEA,OACA,QACA,cACA,MACA,OACA,OACA,MACA,MACA,OAEA,MACA,OACA,OACA,OAEA,KACA,MACA,MACA,MACA,KACA,MACA,OACA,MACA,SAEA,MACA,MACA,OACA,MACA,OACA,OACA,MACA,MACA,MACA,MACA,OACA,OACA,OAEA,OACA,QACA,MACA,MACA,MAEA,MACA,MACA,MACA,MACA,OACA,MACA,MACA,OACA,OAEA,MACA,OACA,MACA,MACA,MACA,MAEA,MACA,OACA,OAEA,MACA,MAEA,KACJ,EAsBaC,GAAkBD,GAAoB,IAAK5D,GAAQ,IAAIA,CAAG,EAAE,EAAE,KAAK,GAAG,EAgBtEG,GAAwB,0BAoBxBI,EAA0B,IAAI,IAAI,CAC3C,eACA,cACJ,CAAC,EA4BYuD,GAAiB,QAUjBC,GAAa,CACtB,QAAS,UACT,QAAS,SACT,MAAO,QACP,MAAO,QACP,MAAO,QACP,QAAS,UACT,OAAQ,QACZ,EAKarD,GAAU,CAEnB,OAAQ,QAER,WAAY,GAEZ,aAAc,GAEd,YAAa,CACjB,EAKaE,GAAe,CAExB,OAAQ,UAER,WAAY,GAEZ,aAAc,EAClB,EAQaiB,EAAS,CAElB,OAAQ,WAER,WAAY,IAEZ,QAAS,mBACb,EAaalB,EAAY,CACrB,QAASoD,GAAW,QACpB,aAAcA,GAAW,MACzB,OAAQ,QACZ,EAyBaC,GAAa,CACtB,aAAc,eACd,iBAAkB,mBAClB,kBAAmB,oBACnB,aAAc,eACd,cAAe,eACnB,EAIa/C,EAA6B,YAE7BgD,GAAqB,CAC9B,SAAU,CAAC,CAAE,OAAQ,QAAS,YAAa,aAAc,CAAC,CAC9D,EAeaC,EAAwB,CAEjC,WAAY,aAEZ,gBAAiB,IAAM,IAC3B,EA8IaC,EAAc,6BAcdC,EAAW,CAEpB,MAAO,aAEP,QAAS,cACb,EAUaC,GAAiB,oCAejBC,GAAgC,KAAc,GAO9CC,EAAuB,CAEhC,QAAS,UAET,iBAAkB,mBAElB,SAAU,WAEV,kBAAmB,oBAEnB,MAAO,OACX,EAwDaC,EAAoB,CAE7B,WAAY,EAEZ,WAAY,GAEZ,UAAW,GAEX,WAAY,KAChB,EASaC,GAAgB,iCAyChBxB,EAAuB,CAEhC,WAAY,EAEZ,WAAY,GAChB,ICj0CA,eAAe8C,GAAQC,EAAgC,CACrD,IAAMC,GAAY,KAAM,QAAO,WAAW,GAAG,QACvCC,EAAQ,IAAID,EAAS,YACrBE,EAAY,QAClB,QAASC,EAAQ,EAAGA,EAAQJ,EAAK,KAAMI,GAASD,EAAW,CACzD,IAAME,EAAM,KAAK,IAAID,EAAQD,EAAWH,EAAK,IAAI,EACjDE,EAAM,OAAO,MAAMF,EAAK,MAAMI,EAAOC,CAAG,EAAE,YAAY,CAAC,CACzD,CACA,MAAO,CAAE,IAAKH,EAAM,IAAI,CAAE,CAC5B,CAEA,eAAeI,GAAUC,EAAoC,CAE3D,GAAM,CAAE,WAAAC,CAAW,EAAI,KAAM,QAAO,QAAQ,EACtCC,EAAOD,EAAW,KAAK,EAC7B,OAAAC,EAAK,OAAOF,CAAM,EACX,CAAE,IAAKE,EAAK,OAAO,KAAK,CAAE,CACnC,CAEA,eAAeC,GAAQC,EAAkC,CAEvD,GAAM,CAAE,WAAAH,CAAW,EAAI,KAAM,QAAO,QAAQ,EAEtC,CAAE,iBAAAI,CAAiB,EAAI,KAAM,QAAO,IAAI,EAC9C,OAAO,IAAI,QAAQ,CAACC,EAASC,IAAW,CACtC,IAAML,EAAOD,EAAW,KAAK,EACvBO,EAASH,EAAiBD,CAAI,EAMpCI,EAAO,GAAG,QAAUC,GAClBF,EAAOG,EAAU,KAAK,gCAAgCD,EAAI,OAAO,GAAI,CAAE,SAAUL,CAAK,CAAC,CAAC,CAC1F,EACAI,EAAO,GAAG,OAASG,GAAUT,EAAK,OAAOS,CAAK,CAAC,EAC/CH,EAAO,GAAG,MAAO,IAAMF,EAAQ,CAAE,IAAKJ,EAAK,OAAO,KAAK,CAAE,CAAC,CAAC,CAC7D,CAAC,CACH,CAEA,eAAsBU,EAAaC,EAAmD,CACpF,GAAIA,aAAiB,KAAM,OAAOrB,GAAQqB,CAAK,EAC/C,GAAI,OAAO,OAAW,KAAe,OAAO,SAASA,CAAK,EAAG,OAAOd,GAAUc,CAAK,EACnF,GAAI,OAAOA,GAAU,SAAU,OAAOV,GAAQU,CAAK,EACnD,MAAMH,EAAU,SAAS,mCAAmC,CAC9D,CAtDA,IAAAI,EAAAC,EAAA,kBAGAC,MCoBO,SAASC,GAAqBC,EAAwC,CAC3EC,GAAmBD,CACrB,CAQA,SAASE,IAA0C,CAEjD,OAAI,OAAO,QAAY,KAAe,QAAQ,UAAY,QAAQ,SAAS,KAClE,OAIL,OAAO,OAAW,KAAe,OAAO,KAAS,IAC5C,UAGF,SACT,CAWO,SAASC,GAA+B,CAE7C,OAAIF,IAKGC,GAAkB,CAC3B,CAhEA,IAWID,GAXJG,EAAAC,EAAA,kBAWIJ,GAAgD,OCE7C,SAASK,GAAiBC,EAA4B,CAC3D,GAAI,CAACA,GAAYA,EAAS,SAAW,EAAG,MAAO,GAE/C,IAAMC,EAAkBD,EACrB,OAAQE,GAAMA,GAAK,OAAOA,GAAM,QAAQ,EACxC,IAAKA,GAAMA,EAAE,QAAQ,MAAO,GAAG,CAAC,EAEnC,GAAID,EAAgB,SAAW,EAAG,MAAO,GACzC,GAAIA,EAAgB,SAAW,EAAG,OAAOA,EAAgB,CAAC,EAE1D,IAAME,EAAeF,EAAgB,IAAKC,GAAMA,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO,CAAC,EACtEE,EAAiB,CAAC,EAClBC,EAAY,KAAK,IAAI,GAAGF,EAAa,IAAKD,GAAMA,EAAE,MAAM,CAAC,EAE/D,QAASI,EAAI,EAAGA,EAAID,EAAWC,IAAK,CAClC,IAAMC,EAAUJ,EAAa,CAAC,EAAEG,CAAC,EACjC,GAAIH,EAAa,MAAOK,GAAaA,EAASF,CAAC,IAAMC,CAAO,EAC1DH,EAAe,KAAKG,CAAO,MAE3B,MAEJ,CAEA,OAAOH,EAAe,KAAK,GAAG,CAChC,CAkBO,SAASK,GAAiBC,EAAsB,CACrD,OAAOA,EAAK,QAAQ,MAAO,GAAG,EAAE,QAAQ,OAAQ,GAAG,EAAE,QAAQ,OAAQ,EAAE,CACzE,CAzDA,IAAAC,GAAAC,EAAA,oBC4BO,SAASC,GACdC,EACAC,EAAiC,CAAC,EACpB,CAEd,GAAIA,EAAQ,UAAY,GACtB,OAAOD,EAAU,IAAKE,IAAU,CAC9B,KAAMC,GAAiBD,CAAI,EAC3B,KAAME,GAAgBF,CAAI,CAC5B,EAAE,EAIJ,IAAMG,EAAeC,GAAoBN,CAAS,EAElD,OAAOA,EAAU,IAAKO,GAAa,CACjC,IAAIC,EAAaL,GAAiBI,CAAQ,EAG1C,GAAIF,EAAc,CAChB,IAAMI,EAAiBJ,EAAa,SAAS,GAAG,EAAIA,EAAe,GAAGA,CAAY,IAC9EG,EAAW,WAAWC,CAAc,IACtCD,EAAaA,EAAW,UAAUC,EAAe,MAAM,EAE3D,CAGA,OAAKD,IACHA,EAAaJ,GAAgBG,CAAQ,GAGhC,CACL,KAAMC,EACN,KAAMJ,GAAgBG,CAAQ,CAChC,CACF,CAAC,CACH,CAWA,SAASD,GAAoBN,EAA6B,CACxD,GAAI,CAACA,EAAU,OAAQ,MAAO,GAM9B,IAAMU,EAHkBV,EAAU,IAAKE,GAASC,GAAiBD,CAAI,CAAC,EAGjC,IAAKA,GAASA,EAAK,MAAM,GAAG,CAAC,EAC5DS,EAA2B,CAAC,EAC5BC,EAAY,KAAK,IAAI,GAAGF,EAAa,IAAKG,GAAaA,EAAS,MAAM,CAAC,EAG7E,QAASC,EAAI,EAAGA,EAAIF,EAAY,EAAGE,IAAK,CAEtC,IAAMC,EAAUL,EAAa,CAAC,EAAEI,CAAC,EACjC,GAAIJ,EAAa,MAAOG,GAAaA,EAASC,CAAC,IAAMC,CAAO,EAC1DJ,EAAe,KAAKI,CAAO,MAE3B,MAEJ,CAEA,OAAOJ,EAAe,KAAK,GAAG,CAChC,CAKA,SAASP,GAAgBF,EAAsB,CAC7C,OAAOA,EAAK,MAAM,OAAO,EAAE,IAAI,GAAKA,CACtC,CAzGA,IAAAc,GAAAC,EAAA,kBAKAC,OCuBO,SAASC,GAAeC,EAAeC,EAAmB,EAAW,CAC1E,GAAID,IAAU,EAAG,MAAO,UACxB,IAAME,EAAI,KACJC,EAAQ,CAAC,QAAS,KAAM,KAAM,IAAI,EAClCC,EAAI,KAAK,MAAM,KAAK,IAAIJ,CAAK,EAAI,KAAK,IAAIE,CAAC,CAAC,EAClD,MAAO,GAAG,YAAYF,EAAQE,GAAKE,GAAG,QAAQH,CAAQ,CAAC,CAAC,IAAIE,EAAMC,CAAC,CAAC,EACtE,CAeO,SAASC,GAAiBC,EAAuD,CACtF,GAAIC,GAAeD,CAAQ,EACzB,MAAO,CAAE,MAAO,GAAO,OAAQ,sCAAuC,EAGxE,GAAIA,EAAS,WAAW,GAAG,GAAKA,EAAS,SAAS,GAAG,EACnD,MAAO,CAAE,MAAO,GAAO,OAAQ,wCAAyC,EAG1E,GAAIA,EAAS,SAAS,GAAG,EACvB,MAAO,CAAE,MAAO,GAAO,OAAQ,gCAAiC,EAGlE,IAAME,EAAgB,8CAChBC,EAAkBH,EAAS,MAAM,GAAG,EAAE,IAAI,GAAKA,EACrD,OAAIE,EAAc,KAAKC,CAAe,EAC7B,CAAE,MAAO,GAAO,OAAQ,uCAAwC,EAGrEH,EAAS,SAAS,IAAI,EACjB,CAAE,MAAO,GAAO,OAAQ,2CAA4C,EAGtE,CAAE,MAAO,EAAK,CACvB,CA+BO,SAASI,GACdC,EACAC,EACyB,CACzB,IAAMC,EAA4B,CAAC,EAC7BC,EAA8B,CAAC,EACjCC,EAAoB,CAAC,EAGzB,GAAIJ,EAAM,SAAW,EAAG,CACtB,IAAMK,EAAyB,CAC7B,KAAM,aACN,QAAS,oCACX,EACA,OAAAH,EAAO,KAAKG,CAAK,EAEV,CACL,MAAO,CAAC,EACR,WAAY,CAAC,EACb,OAAAH,EACA,SAAU,CAAC,EACX,UAAW,EACb,CACF,CAGA,QAAWI,KAAQN,EACjB,GAAIO,EAAiBD,EAAK,IAAI,EAC5B,OAAAJ,EAAO,KAAK,CACV,KAAMI,EAAK,KACX,QAAS,wGACX,CAAC,EACM,CACL,MAAON,EAAM,IAAKQ,IAAO,CACvB,GAAGA,EACH,OAAQC,EAAuB,kBAC/B,cAAe,0BACjB,EAAE,EACF,WAAY,CAAC,EACb,OAAAP,EACA,SAAU,CAAC,EACX,UAAW,EACb,EAKJ,GAAIF,EAAM,OAASC,EAAO,cAAe,CACvC,IAAMI,EAAyB,CAC7B,KAAM,IAAIL,EAAM,MAAM,UACtB,QAAS,eAAeA,EAAM,MAAM,sBAAsBC,EAAO,aAAa,EAChF,EACA,OAAAC,EAAO,KAAKG,CAAK,EAEV,CACL,MAAOL,EAAM,IAAKQ,IAAO,CACvB,GAAGA,EACH,OAAQC,EAAuB,kBAC/B,cAAeJ,EAAM,OACvB,EAAE,EACF,WAAY,CAAC,EACb,OAAAH,EACA,SAAU,CAAC,EACX,UAAW,EACb,CACF,CAGA,IAAIQ,EAAY,EAEhB,QAAWJ,KAAQN,EAAO,CACxB,IAAIW,EAAuCF,EAAuB,MAC9DG,EAAgB,mBAGdC,EAAiBP,EAAK,KACxBZ,GAAiBY,EAAK,IAAI,EAC1B,CAAE,MAAO,GAAO,OAAQ,2BAA4B,EAGxD,GAAIA,EAAK,SAAWG,EAAuB,iBACzCE,EAAaF,EAAuB,kBACpCG,EAAgBN,EAAK,eAAiB,gCACtCJ,EAAO,KAAK,CACV,KAAMI,EAAK,KACX,QAASM,CACX,CAAC,UAIMN,EAAK,OAAS,EAAG,CACxBK,EAAaF,EAAuB,SACpCG,EAAgB,4EAChBT,EAAS,KAAK,CACZ,KAAMG,EAAK,KACX,QAASM,CACX,CAAC,EAEDR,EAAa,KAAK,CAChB,GAAGE,EACH,OAAQK,EACR,cAAAC,CACF,CAAC,EACD,QACF,MAGSN,EAAK,KAAO,GACnBK,EAAaF,EAAuB,kBACpCG,EAAgB,6BAChBV,EAAO,KAAK,CACV,KAAMI,EAAK,KACX,QAASM,CACX,CAAC,GAIM,CAACN,EAAK,MAAQA,EAAK,KAAK,KAAK,EAAE,SAAW,GACjDK,EAAaF,EAAuB,kBACpCG,EAAgB,4BAChBV,EAAO,KAAK,CACV,KAAMI,EAAK,MAAQ,UACnB,QAASM,CACX,CAAC,GACQN,EAAK,KAAK,SAAS,IAAI,GAChCK,EAAaF,EAAuB,kBACpCG,EAAgB,oDAChBV,EAAO,KAAK,CACV,KAAMI,EAAK,KACX,QAASM,CACX,CAAC,GACSC,EAAe,MAUlBC,EAAmBR,EAAK,IAAI,GACnCK,EAAaF,EAAuB,kBACpCG,EAAgB,gCAAgCN,EAAK,IAAI,IACzDJ,EAAO,KAAK,CACV,KAAMI,EAAK,KACX,QAASM,CACX,CAAC,GAIMN,EAAK,KAAOL,EAAO,aAC1BU,EAAaF,EAAuB,kBACpCG,EAAgB,cAAcxB,GAAekB,EAAK,IAAI,CAAC,sBAAsBlB,GAAea,EAAO,WAAW,CAAC,GAC/GC,EAAO,KAAK,CACV,KAAMI,EAAK,KACX,QAASM,CACX,CAAC,IAKDF,GAAaJ,EAAK,KACdI,EAAYT,EAAO,eACrBU,EAAaF,EAAuB,kBACpCG,EAAgB,oCAAoCxB,GAAea,EAAO,YAAY,CAAC,GACvFC,EAAO,KAAK,CACV,KAAMI,EAAK,KACX,QAASM,CACX,CAAC,KArCHD,EAAaF,EAAuB,kBACpCG,EAAgBC,EAAe,QAAU,oBACzCX,EAAO,KAAK,CACV,KAAMI,EAAK,KACX,QAASM,CACX,CAAC,GAoCHR,EAAa,KAAK,CAChB,GAAGE,EACH,OAAQK,EACR,cAAAC,CACF,CAAC,CACH,CASIV,EAAO,OAAS,IAClBE,EAAeA,EAAa,IAAKE,GAE3BA,EAAK,SAAWG,EAAuB,SAClCH,EAIF,CACL,GAAGA,EACH,OAAQG,EAAuB,kBAC/B,cACEH,EAAK,SAAWG,EAAuB,kBACnCH,EAAK,cACL,sDACR,CACD,GAKH,IAAMS,EACJb,EAAO,SAAW,EACdE,EAAa,OAAQI,GAAMA,EAAE,SAAWC,EAAuB,KAAK,EACpE,CAAC,EACDO,EAAYd,EAAO,SAAW,EAEpC,MAAO,CACL,MAAOE,EACP,WAAAW,EACA,OAAAb,EACA,SAAAC,EACA,UAAAa,CACF,CACF,CAKO,SAASC,GAAyCjB,EAAiB,CACxE,OAAOA,EAAM,OAAQQ,GAAMA,EAAE,SAAWC,EAAuB,KAAK,CACtE,CAMO,SAASS,GAA8ClB,EAAqB,CAEjF,OADmBiB,GAAcjB,CAAK,EACpB,OAAS,CAC7B,CArVA,IAAAmB,GAAAC,EAAA,kBAYAC,MC+DO,SAASC,GAAWC,EAAqBC,EAAgD,CAC9F,GAAI,CAACD,GAAaA,EAAU,SAAW,EACrC,MAAO,CAAC,EAMV,GAAI,CAACC,GAAS,cACGD,EAAU,KAAME,GAAMA,GAAKC,EAAiBD,CAAC,CAAC,EAE3D,MAAME,EAAU,SACd,wGACF,EAIJ,OAAOJ,EAAU,OAAQK,GAAa,CACpC,GAAI,CAACA,EACH,MAAO,GAIT,IAAMC,EAAQD,EAAS,QAAQ,MAAO,GAAG,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO,EACpE,GAAIC,EAAM,SAAW,EAAG,MAAO,GAG/B,IAAMC,EAAWD,EAAMA,EAAM,OAAS,CAAC,EACvC,MAAI,WAAOC,CAAQ,EACjB,MAAO,GAMT,QAAWC,KAAQF,EACjB,GAAIE,IAAS,gBACTA,EAAK,WAAW,GAAG,GAAKA,EAAK,OAAS,KACxC,MAAO,GAKX,IAAMC,EAAoBH,EAAM,MAAM,EAAG,EAAE,EAC3C,QAAWI,KAAWD,EACpB,GAAIE,GAAiB,KAAMC,GAAYF,EAAQ,YAAY,IAAME,EAAQ,YAAY,CAAC,EACpF,MAAO,GAIX,MAAO,EACT,CAAC,CACH,CA/HA,IASAC,GAUaF,GAnBbG,GAAAC,EAAA,kBAQAC,IACAH,GAAuB,gBAUVF,GAAmB,CAAC,WAAY,WAAY,aAAc,iBAAiB,ICIjF,SAASM,GAAmBC,EAAoBC,EAAgC,CACrF,GACED,EAAW,SAAS,IAAI,GACxBA,EAAW,SAAS,MAAM,GAC1BA,EAAW,WAAW,KAAK,GAC3BA,EAAW,SAAS,KAAK,EAEzB,MAAME,EAAU,SACd,qCAAqCF,CAAU,eAAeC,CAAgB,EAChF,CAEJ,CAWO,SAASE,GAAmBH,EAAoBC,EAAgC,CACrF,IAAMG,EAAYC,GAAiBL,CAAU,EAC7C,GAAI,CAACI,EAAU,MACb,MAAMF,EAAU,SAASE,EAAU,QAAU,mBAAmB,EAGlE,GAAIE,EAAmBN,CAAU,EAC/B,MAAME,EAAU,SAAS,gCAAgCD,CAAgB,GAAG,CAEhF,CAtDA,IAAAM,GAAAC,EAAA,kBAIAC,IACAC,OCLA,IAAAC,GAAA,GAAAC,GAAAD,GAAA,yBAAAE,KAwBA,SAASC,GAAiBC,EAAiBC,EAAuB,IAAI,IAAiB,CACrF,IAAMC,EAAoB,CAAC,EAGrBC,EAAc,eAAaH,CAAO,EACxC,GAAIC,EAAQ,IAAIE,CAAQ,EAEtB,OAAOD,EAETD,EAAQ,IAAIE,CAAQ,EAEpB,IAAMC,EAAa,cAAYJ,CAAO,EAEtC,QAAWK,KAASD,EAAS,CAC3B,IAAME,EAAgB,OAAKN,EAASK,CAAK,EACnCE,EAAW,WAASD,CAAQ,EAElC,GAAIC,EAAM,YAAY,EAAG,CACvB,IAAMC,EAAWT,GAAiBO,EAAUL,CAAO,EACnDC,EAAQ,KAAK,GAAGM,CAAQ,CAC1B,MAAWD,EAAM,OAAO,GACtBL,EAAQ,KAAKI,CAAQ,CAEzB,CAEA,OAAOJ,CACT,CAgBA,eAAsBJ,GACpBW,EACAC,EAA6B,CAAC,EAC9BC,EACuB,CACvB,GAAIC,EAAO,IAAM,OACf,MAAMC,EAAU,SAAS,gEAAgE,EAI3F,QAAWC,KAAKL,EAAO,CACrB,IAAMM,EAAe,UAAQD,CAAC,EAC9B,GAAI,CACF,GAAO,WAASC,CAAO,EAAE,YAAY,EAAG,CACtC,IAAMC,EAAY,cAAYD,CAAO,EAAE,KAAME,GAAMC,EAAwB,IAAID,CAAC,CAAC,EACjF,GAAID,EACF,MAAMH,EAAU,SACd,IAAIG,CAAM,0FACZ,CAEJ,CACF,OAASC,EAAG,CACV,GAAIE,EAAYF,CAAC,EAAG,MAAMA,CAE5B,CACF,CAGA,IAAMG,EAAgBX,EAAM,QAASK,GAAM,CACzC,IAAMC,EAAe,UAAQD,CAAC,EAC9B,GAAI,CAEF,OADiB,WAASC,CAAO,EACpB,YAAY,EAAIhB,GAAiBgB,CAAO,EAAI,CAACA,CAAO,CACnE,MAAiB,CACf,MAAMF,EAAU,KAAK,wBAAwBC,CAAC,GAAI,CAAE,SAAUA,CAAE,CAAC,CACnE,CACF,CAAC,EACKO,EAAc,CAAC,GAAG,IAAI,IAAID,CAAa,CAAC,EAGxCE,EAAqBb,EAAM,IAAKK,GAAW,UAAQA,CAAC,CAAC,EACrDS,EAAgBC,GACpBF,EAAmB,IAAKR,GAAM,CAC5B,GAAI,CAEF,OADiB,WAASA,CAAC,EACd,YAAY,EAAIA,EAAS,UAAQA,CAAC,CACjD,MAAQ,CACN,OAAY,UAAQA,CAAC,CACvB,CACF,CAAC,CACH,EAGMW,EAAeJ,EAAY,IAAKN,GAAY,CAChD,GAAIQ,GAAiBA,EAAc,OAAS,EAAG,CAC7C,IAAMG,EAAW,WAASH,EAAeR,CAAO,EAChD,GAAIW,GAAO,OAAOA,GAAQ,UAAY,CAACA,EAAI,WAAW,IAAI,EACxD,OAAOA,EAAI,QAAQ,MAAO,GAAG,CAEjC,CACA,OAAY,WAASX,CAAO,CAC9B,CAAC,EAMKY,EAHcC,GAAoBH,EAAc,CACpD,QAASf,EAAQ,aAAe,EAClC,CAAC,EAC+B,IAAKmB,GAAMA,EAAE,IAAI,EAG3CC,EAAc,IAAI,IAAIC,GAAWJ,CAAW,CAAC,EACnD,GAAIG,EAAY,OAAS,EACvB,MAAO,CAAC,EAIV,IAAME,EAA0B,CAAC,EAC3BC,EAA6B,CAAC,EACpC,QAASC,EAAI,EAAGA,EAAIb,EAAY,OAAQa,IAClCJ,EAAY,IAAIH,EAAYO,CAAC,CAAC,IAChCF,EAAc,KAAKX,EAAYa,CAAC,CAAC,EACjCD,EAAiB,KAAKN,EAAYO,CAAC,CAAC,GAKxC,IAAMhC,EAAwB,CAAC,EAC3BiC,EAAY,EAChB,GAAI,CAACxB,EACH,MAAME,EAAU,OACd,uHAEF,EAGF,QAASqB,EAAI,EAAGA,EAAIF,EAAc,OAAQE,IAAK,CAC7C,IAAME,EAAWJ,EAAcE,CAAC,EAC1BG,EAAaJ,EAAiBC,CAAC,EAErC,GAAI,CAEFI,GAAmBD,EAAYD,CAAQ,EAEvC,IAAM7B,EAAW,WAAS6B,CAAQ,EAGlC,GAAI7B,EAAM,OAAS,EACjB,SAOF,GAHAgC,GAAmBF,EAAYD,CAAQ,EAGnC7B,EAAM,KAAOI,EAAe,YAC9B,MAAME,EAAU,SACd,QAAQuB,CAAQ,0CAA0CzB,EAAe,aAAe,KAAO,KAAK,KACtG,EAGF,GADAwB,GAAa5B,EAAM,KACf4B,EAAYxB,EAAe,aAC7B,MAAME,EAAU,SACd,sDAAsDF,EAAe,cAAgB,KAAO,KAAK,KACnG,EAGF,IAAM6B,EAAa,eAAaJ,CAAQ,EAClC,CAAE,IAAAK,EAAI,EAAI,MAAMC,EAAaF,CAAO,EAE1CtC,EAAQ,KAAK,CACX,KAAMmC,EACN,QAAAG,EACA,KAAMA,EAAQ,OACd,IAAAC,EACF,CAAC,CACH,OAASE,EAAO,CAEd,GAAIxB,EAAYwB,CAAK,EACnB,MAAMA,EAGR,IAAMC,EAAeD,aAAiB,MAAQA,EAAM,QAAU,OAAOA,CAAK,EAC1E,MAAM9B,EAAU,KAAK,wBAAwBuB,CAAQ,MAAMQ,CAAY,GAAI,CAAE,SAAAR,CAAS,CAAC,CACzF,CACF,CAGA,GAAIlC,EAAQ,OAASS,EAAe,cAClC,MAAME,EAAU,SACd,gDAAgDF,EAAe,aAAa,SAC9E,EAGF,OAAOT,CACT,CA5NA,IAKA2C,EACAC,EANAC,GAAAC,EAAA,kBAKAH,EAAoB,mBACpBC,EAAsB,qBAEtBG,IACAC,KACAC,IACAC,KACAC,IACAC,KACAC,OCdA,IAAAC,GAAA,GAAAC,GAAAD,GAAA,aAAAE,GAAA,cAAAC,EAAA,mBAAAC,GAAA,gBAAAC,GAAA,YAAAC,EAAA,eAAAC,GAAA,uBAAAC,GAAA,WAAAC,EAAA,gBAAAC,EAAA,+BAAAC,EAAA,kBAAAC,EAAA,iBAAAC,GAAA,qBAAAC,GAAA,kBAAAC,GAAA,iBAAAC,GAAA,cAAAC,EAAA,2BAAAC,EAAA,yBAAAA,EAAA,gCAAAC,EAAA,qBAAAC,GAAA,sBAAAC,EAAA,kBAAAC,GAAA,mBAAAC,GAAA,eAAAC,GAAA,yBAAAC,EAAA,kCAAAC,GAAA,aAAAC,EAAA,0BAAAC,EAAA,uBAAAC,GAAA,SAAAC,GAAA,cAAAC,EAAA,cAAAC,EAAA,4BAAAC,EAAA,0BAAAC,GAAA,oBAAAC,GAAA,yBAAAC,GAAA,uBAAAC,GAAA,yBAAAC,GAAA,iBAAAC,EAAA,kBAAAC,GAAA,0BAAAC,GAAA,6BAAAC,GAAA,yBAAAC,GAAA,wBAAAC,GAAA,YAAAC,GAAA,sBAAAC,GAAA,qBAAAC,GAAA,eAAAC,GAAA,mBAAAC,GAAA,0BAAAC,GAAA,sBAAAC,GAAA,WAAAC,EAAA,kBAAAC,GAAA,qBAAAC,EAAA,mBAAAC,GAAA,uBAAAC,EAAA,mBAAAC,GAAA,iBAAAC,GAAA,qBAAAC,GAAA,gBAAAC,EAAA,iBAAAC,GAAA,wBAAAC,GAAA,cAAAC,GAAA,wBAAAC,GAAA,oBAAAC,GAAA,mBAAAC,GAAA,mBAAAC,GAAA,mBAAAC,GAAA,uBAAAC,GAAA,uBAAAC,GAAA,wBAAAC,GAAA,qBAAAC,GAAA,kBAAAC,GAAA,2BAAAC,GAAA,qBAAAC,EAAA,kBAAAC,IAAA,eAAAC,GAAA7E,ICgBA8E,ICWAC,ICCAC,ICdO,IAAMC,EAAN,KAAmB,CAAnB,cAEL,KAAQ,SAAW,IAAI,IAKvB,GAA+BC,EAAUC,EAAiD,CACnF,KAAK,SAAS,IAAID,CAAe,GACpC,KAAK,SAAS,IAAIA,EAAiB,IAAI,GAAK,EAE9C,KAAK,SAAS,IAAIA,CAAe,GAAG,IAAIC,CAAO,CACjD,CAKA,IAAgCD,EAAUC,EAAiD,CACzF,IAAMC,EAAgB,KAAK,SAAS,IAAIF,CAAe,EACnDE,IACFA,EAAc,OAAOD,CAAO,EACxBC,EAAc,OAAS,GACzB,KAAK,SAAS,OAAOF,CAAe,EAG1C,CAMA,KAAiCA,KAAaG,EAA2B,CACvE,IAAMD,EAAgB,KAAK,SAAS,IAAIF,CAAe,EACvD,GAAI,CAACE,EAAe,OAIpB,IAAME,EAAe,MAAM,KAAKF,CAAa,EAE7C,QAAWD,KAAWG,EACpB,GAAI,CACFH,EAAQ,GAAGE,CAAI,CACjB,OAASE,EAAO,CAKdH,EAAc,OAAOD,CAAO,EAExBD,IAAU,SACZ,WAAW,IAAM,CACf,IAAMM,EAAMD,aAAiB,MAAQA,EAAQ,IAAI,MAAM,OAAOA,CAAK,CAAC,EACpE,KAAK,KAAK,QAASC,EAAK,OAAON,CAAK,CAAC,CACvC,EAAG,CAAC,CAER,CAEJ,CACF,ECtDAO,IAYAA,IAYO,SAASC,EAAeC,EAA2D,CACxF,GAA4BA,GAAW,KAAM,OAC7C,GAAIA,EAAO,SAAW,EAAG,OAAOA,EAEhC,GAAIA,EAAO,OAASC,EAAkB,UACpC,MAAMC,EAAU,WAAW,WAAWD,EAAkB,SAAS,iBAAiB,EAGpF,IAAME,EAAaH,EAAO,IAAI,CAACI,EAAOC,IAAM,CAC1C,GAAI,OAAOD,GAAU,SACnB,MAAMF,EAAU,WAAW,kBAAkBG,CAAC,mBAAmB,EAEnE,IAAMC,EAAUF,EAAM,KAAK,EAAE,YAAY,EACzC,GAAIE,EAAQ,OAASL,EAAkB,WACrC,MAAMC,EAAU,WACd,2BAA2BD,EAAkB,UAAU,kBACzD,EAEF,GAAIK,EAAQ,OAASL,EAAkB,WACrC,MAAMC,EAAU,WACd,+BAA+BD,EAAkB,UAAU,kBAC7D,EAEF,GAAI,CAACM,GAAc,KAAKD,CAAO,EAC7B,MAAMJ,EAAU,WACd,qFAAqFD,EAAkB,UAAU,oBACnH,EAEF,OAAOK,CACT,CAAC,EAEKE,EAAS,CAAC,GAAG,IAAI,IAAIL,CAAU,CAAC,EACtC,GAAIK,EAAO,SAAWL,EAAW,OAC/B,MAAMD,EAAU,WAAW,kCAAkC,EAG/D,OAAOM,CACT,CAiBA,eAAsBC,GAAqBC,EAAoC,CAC7E,IAAMC,EAASD,EAAM,KAClBE,GAAMA,EAAE,OAASC,GAA8BD,EAAE,OAAS,IAAIC,CAA0B,EAC3F,EACA,GAAI,CAACF,EAAQ,OAIb,IAAMG,EAAUH,EAAO,QACjBI,EACJ,OAAOD,EAAQ,MAAS,WACpB,MAAMA,EAAQ,KAAK,EAClBH,EAAO,QAAmB,SAAS,MAAM,EAEhDK,GAAqBD,CAAI,CAC3B,CF5DA,IAAME,GAA0B,IAgB1BC,GAAyB,IAWzBC,GAAuB,IAWvBC,GAA+BF,GAAyBC,GAexDE,GAAa,MAMnB,SAASC,GAAUC,EAA+B,CAChD,IAAMC,EAAS,IAAI,gBACfD,GAAS,QAAU,QAAWC,EAAO,IAAI,QAAS,OAAOD,EAAQ,KAAK,CAAC,EACvEA,GAAS,SAAW,QAAWC,EAAO,IAAI,SAAUD,EAAQ,MAAM,EACtE,IAAME,EAAQD,EAAO,SAAS,EAC9B,OAAOC,EAAQ,IAAIA,CAAK,GAAK,EAC/B,CAqBO,IAAMC,EAAN,cAAsBC,CAAa,CAexC,YAAYJ,EAAyB,CACnC,MAAM,EAHR,KAAQ,cAAwC,CAAC,EAI/C,KAAK,OAASA,EAAQ,QAAUK,EAChC,KAAK,uBAAyBL,EAAQ,eACtC,KAAK,QAAUA,EAAQ,SAAW,GAClC,KAAK,OAASA,EAAQ,OACtB,KAAK,QAAUA,EAAQ,SAAWN,GAIlC,KAAK,cAAgBM,EAAQ,SAAWL,GACxC,KAAK,mBAAqBK,EAAQ,SAAWH,GAI7C,KAAK,MAAQG,EAAQ,OAAS,WAAW,MAAM,KAAK,UAAU,EAC9D,KAAK,iBAAmBA,EAAQ,iBAChC,KAAK,eAAiBA,EAAQ,gBAAkBM,EAAU,WAC5D,CAMA,iBAAiBC,EAAuC,CACtD,KAAK,cAAgBA,CACvB,CASA,MAAc,eACZC,EACAR,EACAS,EACAC,EAAoB,KAAK,QACE,CAC3B,IAAIC,EAAU,IAAM,CAAC,EAErB,GAAI,CAIF,IAAMJ,EAAU,MAAM,KAAK,aAAaP,EAAQ,OAAiC,EAC3EY,EAAU,KAAK,oBAAoBZ,EAAQ,OAAQU,CAAS,EAClEC,EAAUC,EAAQ,QAElB,IAAMC,EAA4B,CAChC,GAAGb,EACH,QAAAO,EACA,YAAa,KAAK,SAAW,CAACA,EAAQ,cAAgB,UAAY,OAClE,OAAQK,EAAQ,MAClB,EAEA,KAAK,KAAK,UAAWJ,EAAKK,CAAY,EAEtC,IAAMC,EAAW,MAAM,KAAK,MAAMN,EAAKK,CAAY,EAGnD,GAFAF,EAAQ,EAEJ,CAACG,EAAS,GACZ,MAAM,MAAMC,EAAU,iBAAiBD,EAAUL,CAAa,EAGhE,YAAK,KAAK,WAAY,KAAK,UAAUK,CAAQ,EAAGN,CAAG,EAE5C,CAAE,KADI,MAAM,KAAK,cAAiB,KAAK,UAAUM,CAAQ,CAAC,EAClD,OAAQA,EAAS,MAAO,CACzC,OAASE,EAAO,CACdL,EAAQ,EAIR,IAAMM,EAAYF,EAAU,eAAeC,EAAOP,CAAa,EAC/D,WAAK,KAAK,QAASQ,EAAWT,CAAG,EAC3BS,CACR,CACF,CAKA,MAAc,QACZT,EACAR,EACAS,EACAC,EACY,CACZ,GAAM,CAAE,KAAAQ,CAAK,EAAI,MAAM,KAAK,eAAkBV,EAAKR,EAASS,EAAeC,CAAS,EACpF,OAAOQ,CACT,CAKA,MAAc,kBACZV,EACAR,EACAS,EAC2B,CAC3B,OAAO,KAAK,eAAkBD,EAAKR,EAASS,CAAa,CAC3D,CAMA,MAAc,aACZU,EAAwC,CAAC,EACR,CAIjC,MAAO,CACL,GAAG,KAAK,cACR,GAAI,KAAK,OAAS,CAAE,CAACC,EAAO,MAAM,EAAG,KAAK,MAAO,EAAI,CAAC,EACtD,GAAI,MAAM,KAAK,uBAAuB,EACtC,GAAGD,CACL,CACF,CAEQ,oBACNE,EACAX,EAAoB,KAAK,QAIzB,CACA,IAAMY,EAAa,IAAI,gBACjBC,EAAY,WAAW,IAAMD,EAAW,MAAM,EAAGZ,CAAS,EAEhE,GAAIW,EAAgB,CAClB,IAAMG,EAAQ,IAAMF,EAAW,MAAM,EACrCD,EAAe,iBAAiB,QAASG,CAAK,EAC1CH,EAAe,SAASC,EAAW,MAAM,CAC/C,CAEA,MAAO,CACL,OAAQA,EAAW,OACnB,QAAS,IAAM,aAAaC,CAAS,CACvC,CACF,CAEQ,UAAUT,EAA8B,CAC9C,GAAI,CACF,OAAOA,EAAS,MAAM,CACxB,MAAQ,CACN,OAAOA,CACT,CACF,CAEA,MAAc,cAAiBA,EAAgC,CAC7D,GAAI,EAAAA,EAAS,QAAQ,IAAI,gBAAgB,IAAM,KAAOA,EAAS,SAAW,KAG1E,OAAOA,EAAS,KAAK,CACvB,CAMA,MAAM,OACJW,EACAzB,EAA4B,CAAC,EACM,CACnC,GAAI,CAACyB,EAAM,OACT,MAAMV,EAAU,SAAS,oBAAoB,EAE/C,QAAWW,KAAQD,EACjB,GAAI,CAACC,EAAK,IACR,MAAMX,EAAU,KAAK,kCAAkCW,EAAK,IAAI,GAAI,CAClE,SAAUA,EAAK,IACjB,CAAC,EAKLC,EAAiB3B,EAAQ,QAAQ,EACjC,IAAM4B,EAAiBC,GAAuB7B,EAAQ,cAAc,EAC9D8B,EAASC,EAAe/B,EAAQ,MAAM,EAC5C,MAAMgC,GAAqBP,CAAK,EAEhC,IAAMQ,EACJjC,EAAQ,OAASA,EAAQ,WAAaA,EAAQ,IAC1C,CAAE,MAAOA,EAAQ,MAAO,UAAWA,EAAQ,UAAW,IAAKA,EAAQ,GAAI,EACvE,OACA,CAAE,KAAAkC,EAAM,QAASC,CAAY,EAAI,MAAM,KAAK,iBAAiBV,EAAO,CACxE,OAAAK,EACA,IAAK9B,EAAQ,KAAOF,GACpB,SAAUE,EAAQ,SAClB,MAAAiC,EACA,QAASjC,EAAQ,OACnB,CAAC,EAKD,OAAO,KAAK,QACV,GAAG,KAAK,MAAM,GAAG,KAAK,cAAc,GACpC,CACE,OAAQ,OACR,KAAAkC,EACA,QAASN,EACL,CAAE,GAAGO,EAAa,CAACC,EAA4B,MAAM,EAAGR,CAAe,EACvEO,EACJ,OAAQnC,EAAQ,QAAU,IAC5B,EACA,SAKAA,EAAQ,OAASA,EAAQ,UAAY,KAAK,mBAAqB,KAAK,aACtE,CACF,CAEA,MAAM,gBAAgBA,EAAwD,CAC5E,OAAO,KAAK,QACV,GAAG,KAAK,MAAM,GAAGM,EAAU,WAAW,GAAGP,GAAUC,CAAO,CAAC,GAC3D,CAAE,OAAQ,KAAM,EAChB,kBACF,CACF,CAEA,MAAM,cAAcqC,EAAiC,CACnD,OAAO,KAAK,QACV,GAAG,KAAK,MAAM,GAAG/B,EAAU,WAAW,mBAAmB+B,CAAE,CAAC,CAAC,GAC7D,CAAE,OAAQ,KAAM,EAChB,gBACF,CACF,CAEA,MAAM,uBAAuBA,EAAYP,EAAuC,CAC9E,IAAMQ,EAAaP,EAAeD,CAAM,EACxC,OAAO,KAAK,QACV,GAAG,KAAK,MAAM,GAAGxB,EAAU,WAAW,mBAAmB+B,CAAE,CAAC,CAAC,GAC7D,CACE,OAAQ,QACR,QAAS,CAAE,eAAgB,kBAAmB,EAC9C,KAAM,KAAK,UAAU,CAAE,OAAQC,CAAW,CAAC,CAC7C,EACA,0BACF,CACF,CAEA,MAAM,iBAAiBD,EAA+C,CACpE,OAAO,KAAK,QACV,GAAG,KAAK,MAAM,GAAG/B,EAAU,WAAW,mBAAmB+B,CAAE,CAAC,CAAC,GAC7D,CAAE,OAAQ,QAAS,EACnB,mBACF,CACF,CAQA,MAAM,UAAUE,EAAcC,EAAqBV,EAA6C,CAC9F,IAAMQ,EAAaP,EAAeD,CAAM,EAClCI,EAAmD,CAAC,EACtDM,IAAYN,EAAK,WAAaM,GAC9BF,IAAe,SAAWJ,EAAK,OAASI,GAE5C,GAAM,CAAE,KAAApB,EAAM,OAAAuB,CAAO,EAAI,MAAM,KAAK,kBAClC,GAAG,KAAK,MAAM,GAAGnC,EAAU,OAAO,mBAAmBiC,CAAI,CAAC,CAAC,GAC3D,CACE,OAAQ,MACR,QAAS,CAAE,eAAgB,kBAAmB,EAC9C,KAAM,KAAK,UAAUL,CAAI,CAC3B,EACA,YACF,EAEA,MAAO,CAAE,GAAGhB,EAAM,SAAUuB,IAAW,GAAI,CAC7C,CAEA,MAAM,YAAYzC,EAAoD,CACpE,OAAO,KAAK,QACV,GAAG,KAAK,MAAM,GAAGM,EAAU,OAAO,GAAGP,GAAUC,CAAO,CAAC,GACvD,CAAE,OAAQ,KAAM,EAChB,cACF,CACF,CAEA,MAAM,UAAUuC,EAA+B,CAC7C,OAAO,KAAK,QACV,GAAG,KAAK,MAAM,GAAGjC,EAAU,OAAO,mBAAmBiC,CAAI,CAAC,CAAC,GAC3D,CAAE,OAAQ,KAAM,EAChB,YACF,CACF,CAEA,MAAM,aAAaA,EAA6C,CAC9D,OAAO,KAAK,QACV,GAAG,KAAK,MAAM,GAAGjC,EAAU,OAAO,mBAAmBiC,CAAI,CAAC,CAAC,GAC3D,CAAE,OAAQ,QAAS,EACnB,eACF,CACF,CAEA,MAAM,aAAaA,EAA6C,CAC9D,OAAO,KAAK,QACV,GAAG,KAAK,MAAM,GAAGjC,EAAU,cAAc,mBAAmBiC,CAAI,CAAC,CAAC,GAClE,CAAE,OAAQ,MAAO,EACjB,eACF,CACF,CAEA,MAAM,aAAaA,EAA0C,CAC3D,OAAO,KAAK,QACV,GAAG,KAAK,MAAM,GAAGjC,EAAU,WAAW,mBAAmBiC,CAAI,CAAC,CAAC,GAC/D,CAAE,OAAQ,KAAM,EAChB,gBACF,CACF,CAEA,MAAM,iBAAiBA,EAA8C,CACnE,OAAO,KAAK,QACV,GAAG,KAAK,MAAM,GAAGjC,EAAU,eAAe,mBAAmBiC,CAAI,CAAC,CAAC,GACnE,CAAE,OAAQ,KAAM,EAChB,oBACF,CACF,CAEA,MAAM,eAAeA,EAA4C,CAC/D,OAAO,KAAK,QACV,GAAG,KAAK,MAAM,GAAGjC,EAAU,aAAa,mBAAmBiC,CAAI,CAAC,CAAC,GACjE,CAAE,OAAQ,KAAM,EAChB,kBACF,CACF,CAEA,MAAM,eAAeA,EAA+C,CAClE,OAAO,KAAK,QACV,GAAG,KAAK,MAAM,GAAGjC,EAAU,gBAAgB,GAC3C,CACE,OAAQ,OACR,QAAS,CAAE,eAAgB,kBAAmB,EAC9C,KAAM,KAAK,UAAU,CAAE,OAAQiC,CAAK,CAAC,CACvC,EACA,iBACF,CACF,CAMA,MAAM,YAAYG,EAAcZ,EAAiD,CAC/E,IAAMQ,EAAaP,EAAeD,CAAM,EAClCI,EAA4C,CAAC,EACnD,OAAIQ,IAAQ,SAAWR,EAAK,IAAMQ,GAC9BJ,IAAe,SAAWJ,EAAK,OAASI,GAErC,KAAK,QACV,GAAG,KAAK,MAAM,GAAGhC,EAAU,MAAM,GACjC,CACE,OAAQ,OACR,QAAS,CAAE,eAAgB,kBAAmB,EAC9C,KAAM,KAAK,UAAU4B,CAAI,CAC3B,EACA,cACF,CACF,CAEA,MAAM,WAAWlC,EAAmD,CAClE,OAAO,KAAK,QACV,GAAG,KAAK,MAAM,GAAGM,EAAU,MAAM,GAAGP,GAAUC,CAAO,CAAC,GACtD,CAAE,OAAQ,KAAM,EAChB,aACF,CACF,CAEA,MAAM,YAAY2C,EAA6C,CAC7D,OAAO,KAAK,QACV,GAAG,KAAK,MAAM,GAAGrC,EAAU,MAAM,mBAAmBqC,CAAK,CAAC,CAAC,GAC3D,CAAE,OAAQ,QAAS,EACnB,cACF,CACF,CAEA,MAAM,SAASA,EAA+B,CAC5C,OAAO,KAAK,QACV,GAAG,KAAK,MAAM,GAAGrC,EAAU,MAAM,mBAAmBqC,CAAK,CAAC,CAAC,GAC3D,CAAE,OAAQ,KAAM,EAChB,WACF,CACF,CAMA,MAAM,YAA0C,CAC9C,OAAO,KAAK,QAAQ,GAAG,KAAK,MAAM,GAAGrC,EAAU,OAAO,GAAI,CAAE,OAAQ,KAAM,EAAG,aAAa,CAC5F,CAEA,MAAM,WAAqC,CACzC,OAAO,KAAK,QAAQ,GAAG,KAAK,MAAM,GAAGA,EAAU,MAAM,GAAI,CAAE,OAAQ,KAAM,EAAG,YAAY,CAC1F,CAEA,MAAM,MAA8B,CAClC,OAAO,KAAK,QAAsB,GAAG,KAAK,MAAM,GAAGA,EAAU,IAAI,GAAI,CAAE,OAAQ,KAAM,EAAG,MAAM,CAChG,CAMA,MAAM,SAASmB,EAAqBmB,EAA6B,CAAC,EAAqB,CACrF,IAAMC,EAAYpB,EAAM,KACrBqB,GACCA,EAAE,OAASC,EAAsB,YACjCD,EAAE,OAAS,IAAIC,EAAsB,UAAU,EACnD,EACA,GAAI,CAACF,GAAaA,EAAU,KAAOE,EAAsB,gBACvD,MAAO,GAGT,IAAIC,EACJ,GAAI,OAAO,OAAW,KAAe,OAAO,SAASH,EAAU,OAAO,EACpEG,EAAeH,EAAU,QAAQ,SAAS,OAAO,UACxC,OAAO,KAAS,KAAeA,EAAU,mBAAmB,KACrEG,EAAe,MAAMH,EAAU,QAAQ,KAAK,UACnC,OAAO,KAAS,KAAeA,EAAU,mBAAmB,KACrEG,EAAe,MAAMH,EAAU,QAAQ,KAAK,MAE5C,OAAO,GAGT,IAAMX,EAAwB,CAAE,MAAOT,EAAM,IAAKqB,GAAMA,EAAE,IAAI,EAAG,MAAOE,CAAa,EAWrF,OAViB,MAAM,KAAK,QAC1B,GAAG,KAAK,MAAM,GAAG1C,EAAU,SAAS,GACpC,CACE,OAAQ,OACR,QAAS,CAAE,eAAgB,kBAAmB,EAC9C,KAAM,KAAK,UAAU4B,CAAI,CAC3B,EACA,WACF,GAEgB,KAClB,CACF,EGrlBAe,ICIAC,IAGAC,IAMA,eAAsBC,IAAuC,CAC3D,IAAMC,EAAe,KAAK,UAAUC,GAAoB,KAAM,CAAC,EAG3DC,EACA,OAAO,OAAW,IAEpBA,EAAU,OAAO,KAAKF,EAAc,OAAO,EAG3CE,EAAU,IAAI,KAAK,CAACF,CAAY,EAAG,CAAE,KAAM,kBAAmB,CAAC,EAGjE,GAAM,CAAE,IAAAG,CAAI,EAAI,MAAMC,EAAaF,CAAO,EAE1C,MAAO,CACL,KAAMG,EACN,QAAAH,EACA,KAAMF,EAAa,OACnB,IAAAG,CACF,CACF,CAWA,eAAsBG,GACpBC,EACAC,EACAC,EACuB,CAEvB,GACEA,EAAQ,YAAc,IACtBA,EAAQ,KACRA,EAAQ,OACRA,EAAQ,WACRF,EAAM,KAAMG,GAAMA,EAAE,OAASL,CAA0B,EAEvD,OAAOE,EAGT,GAAI,CAGF,GAFc,MAAMC,EAAU,SAASD,EAAOE,CAAO,EAE1C,CACT,IAAME,EAAY,MAAMZ,GAAgB,EACxC,MAAO,CAAC,GAAGQ,EAAOI,CAAS,CAC7B,CACF,MAAiB,CAEjB,CAEA,OAAOJ,CACT,CD1BO,SAASK,GACdC,EACuC,CACvC,GAAM,CAAE,OAAAC,EAAQ,WAAAC,EAAY,aAAAC,CAAa,EAAIH,EAE7C,MAAO,CACL,OAAQ,MAAOI,EAAoBC,EAA6B,CAAC,IAAM,CAGrE,GAFA,MAAMH,EAAW,EAEb,CAACC,EACH,MAAMG,EAAU,OAAO,wCAAwC,EAGjE,IAAMC,EAAYN,EAAO,EACrBO,EAAc,MAAML,EAAaC,EAAOC,CAAO,EACnD,OAAAG,EAAc,MAAMC,GAAsBD,EAAaD,EAAWF,CAAO,EAElEE,EAAU,OAAOC,EAAaH,CAAO,CAC9C,EAEA,KAAM,MAAOA,IACX,MAAMH,EAAW,EACVD,EAAO,EAAE,gBAAgBI,CAAO,GAGzC,IAAK,MAAOK,IACV,MAAMR,EAAW,EACVD,EAAO,EAAE,cAAcS,CAAE,GAGlC,IAAK,MAAOA,EAAYL,KACtB,MAAMH,EAAW,EACVD,EAAO,EAAE,uBAAuBS,EAAIL,EAAQ,MAAM,GAG3D,OAAQ,MAAOK,IACb,MAAMR,EAAW,EACVD,EAAO,EAAE,iBAAiBS,CAAE,EAEvC,CACF,CASO,SAASC,GAAqBX,EAAsC,CACzE,GAAM,CAAE,OAAAC,EAAQ,WAAAC,CAAW,EAAIF,EAE/B,MAAO,CAML,IAAK,MAAOY,EAAcP,EAAsD,CAAC,KAC/E,MAAMH,EAAW,EACVD,EAAO,EAAE,UAAUW,EAAMP,EAAQ,WAAYA,EAAQ,MAAM,GAGpE,KAAM,MAAOA,IACX,MAAMH,EAAW,EACVD,EAAO,EAAE,YAAYI,CAAO,GAGrC,IAAK,MAAOO,IACV,MAAMV,EAAW,EACVD,EAAO,EAAE,UAAUW,CAAI,GAGhC,OAAQ,MAAOA,IACb,MAAMV,EAAW,EACVD,EAAO,EAAE,aAAaW,CAAI,GAGnC,OAAQ,MAAOA,IACb,MAAMV,EAAW,EACVD,EAAO,EAAE,aAAaW,CAAI,GAGnC,SAAU,MAAOA,IACf,MAAMV,EAAW,EACVD,EAAO,EAAE,eAAeW,CAAI,GAGrC,IAAK,MAAOA,IACV,MAAMV,EAAW,EACVD,EAAO,EAAE,aAAaW,CAAI,GAGnC,QAAS,MAAOA,IACd,MAAMV,EAAW,EACVD,EAAO,EAAE,iBAAiBW,CAAI,GAGvC,MAAO,MAAOA,IACZ,MAAMV,EAAW,EACVD,EAAO,EAAE,eAAeW,CAAI,EAEvC,CACF,CAKO,SAASC,GAAsBb,EAAuC,CAC3E,GAAM,CAAE,OAAAC,EAAQ,WAAAC,CAAW,EAAIF,EAE/B,MAAO,CACL,IAAK,UACH,MAAME,EAAW,EACVD,EAAO,EAAE,WAAW,EAE/B,CACF,CAKO,SAASa,GAAoBd,EAAqC,CACvE,GAAM,CAAE,OAAAC,EAAQ,WAAAC,CAAW,EAAIF,EAE/B,MAAO,CACL,OAAQ,MAAOK,EAA+C,CAAC,KAC7D,MAAMH,EAAW,EACVD,EAAO,EAAE,YAAYI,EAAQ,IAAKA,EAAQ,MAAM,GAGzD,KAAM,MAAOA,IACX,MAAMH,EAAW,EACVD,EAAO,EAAE,WAAWI,CAAO,GAGpC,IAAK,MAAOU,IACV,MAAMb,EAAW,EACVD,EAAO,EAAE,SAASc,CAAK,GAGhC,OAAQ,MAAOA,IACb,MAAMb,EAAW,EACVD,EAAO,EAAE,YAAYc,CAAK,EAErC,CACF,CJpJO,IAAeC,EAAf,KAAoB,CAgCzB,YAAYC,EAA6B,CAAC,EAAG,CAR7C,KAAQ,YAAoC,KAC5C,KAAU,eAAwC,KAKlD,KAAQ,WAA4C,KA2BlD,GAlBAA,EAAU,CACR,GAAGA,EACH,OAAQA,EAAQ,QAAU,OAC1B,MAAOA,EAAQ,OAAS,OACxB,OAAQA,EAAQ,QAAU,MAC5B,EACA,KAAK,cAAgBA,EAKjBA,EAAQ,SAAW,QACrBC,GAAeD,EAAQ,MAAM,EAM3BA,EAAQ,OAASA,EAAQ,QAC3B,MAAME,EAAU,OAAO,gDAAgD,EAKrE,OAAOF,EAAQ,OAAU,UAC3BG,EAAcH,EAAQ,KAAK,EAC3B,KAAK,WAAaA,EAAQ,OACjBA,EAAQ,QACjB,KAAK,WAAaA,EAAQ,OAK5B,KAAK,KAAO,IAAII,EAAQ,CACtB,GAAGJ,EACH,eAAgB,IAAM,KAAK,eAAe,EAC1C,iBAAkB,KAAK,qBAAqB,CAC9C,CAAC,EAED,IAAMK,EAAM,CACV,OAAQ,IAAM,KAAK,KACnB,WAAY,IAAM,KAAK,kBAAkB,CAC3C,EAEA,KAAK,YAAcC,GAAyB,CAC1C,GAAGD,EACH,aAAc,CAACE,EAAOC,IAAS,KAAK,aAAaD,EAAOC,CAAI,CAC9D,CAAC,EACD,KAAK,QAAUC,GAAqBJ,CAAG,EACvC,KAAK,QAAUK,GAAsBL,CAAG,EACxC,KAAK,OAASM,GAAoBN,CAAG,CACvC,CAaA,MAAgB,mBAAmC,CACjD,OAAK,KAAK,cACR,KAAK,YAAc,KAAK,oBAAoB,GAEvC,KAAK,WACd,CAEA,MAAc,qBAAqC,CACjD,GAAI,CACF,KAAK,eAAiB,MAAM,KAAK,KAAK,UAAU,CAClD,OAASO,EAAO,CAEd,WAAK,YAAc,KACbA,CACR,CACF,CAYA,MAAM,MAA8B,CAClC,aAAM,KAAK,kBAAkB,EACtB,KAAK,KAAK,KAAK,CACxB,CAKA,MAAM,OAAOL,EAAoBP,EAAgE,CAC/F,OAAO,KAAK,YAAY,OAAOO,EAAOP,CAAO,CAC/C,CAKA,MAAM,QAAS,CACb,OAAO,KAAK,QAAQ,IAAI,CAC1B,CAOA,MAAM,WAAqC,CACzC,OAAI,KAAK,eAAuB,KAAK,gBACrC,MAAM,KAAK,kBAAkB,EAEtB,KAAK,eACd,CAEA,GAA+Ba,EAAUC,EAAiD,CACxF,KAAK,KAAK,GAAGD,EAAOC,CAAO,CAC7B,CAEA,IAAgCD,EAAUC,EAAiD,CACzF,KAAK,KAAK,IAAID,EAAOC,CAAO,CAC9B,CAMA,WAAWC,EAAuC,CAChD,KAAK,KAAK,iBAAiBA,CAAO,CACpC,CAKA,cAAqB,CACnB,KAAK,KAAK,iBAAiB,CAAC,CAAC,CAC/B,CAQO,SAASC,EAAqC,CAGnD,GAAI,KAAK,cAAc,QACrB,MAAMd,EAAU,OAAO,gDAAgD,EAEzE,GAAI,OAAOc,GAAU,SAAU,CAC7B,GAAI,CAACA,EACH,MAAMd,EAAU,SAAS,2DAA2D,EAEtFC,EAAca,CAAK,EACnB,KAAK,WAAaA,EAClB,MACF,CACA,GAAI,OAAOA,GAAU,WACnB,MAAMd,EAAU,SACd,kFACF,EAEF,KAAK,WAAac,CACpB,CAYA,MAAc,gBAAkD,CAC9D,GAAI,KAAK,aAAe,KAAM,MAAO,CAAC,EACtC,IAAMC,EAAQ,OAAO,KAAK,YAAe,WAAa,MAAM,KAAK,WAAW,EAAI,KAAK,WACrF,GAAI,CAACA,EACH,MAAMf,EAAU,eAAe,mCAAmC,EAEpE,GAAI,OAAOe,GAAU,SACnB,MAAMf,EAAU,eAAe,6CAA6C,EAE9E,MAAO,CAAE,cAAe,UAAUe,CAAK,EAAG,CAC5C,CACF,EDvQAC,IOFAC,IACA,IAAAC,GAAkB,eCJlB,IAAAC,GAAkB,eAELC,GAAoB,CAC/B,OAAQ,KAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAClC,MAAO,KAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,CACpC,EDCAC,IAUA,IAAMC,GAAkB,KAAE,OAAOC,EAAiB,EAAE,OAAO,EAQrDC,GAA2C,CAC/C,OAAQC,EAAS,QACjB,MAAOA,EAAS,KAClB,EAYO,SAASC,IAA4C,CAC1D,GAAIC,EAAO,IAAM,OAAQ,MAAO,CAAC,EAEjC,IAAMC,EAAM,CACV,OAAQ,QAAQ,IAAIH,EAAS,OAAO,GAAK,OACzC,MAAO,QAAQ,IAAIA,EAAS,KAAK,GAAK,MACxC,EAEA,GAAI,CACF,OAAOH,GAAgB,MAAMM,CAAG,CAClC,OAASC,EAAO,CACd,GAAIA,aAAiB,KAAE,SAAU,CAC/B,IAAMC,EAAQD,EAAM,OAAO,CAAC,EACtBE,EAAQD,EAAM,KAAK,CAAC,EACpBE,GAAUD,GAASP,GAAiBO,CAAK,IAAM,iCACrD,MAAME,EAAU,OAAO,WAAWD,CAAM,KAAKF,EAAM,OAAO,EAAE,CAC9D,CACA,MAAMG,EAAU,OAAO,mCAAmC,CAC5D,CACF,CEpEAC,IAGA,eAAsBC,GACpBC,EACAC,EAA6B,CAAC,EACT,CACrB,GAAM,CAAE,SAAAC,EAAU,KAAAC,CAAK,EAAI,KAAM,QAAO,eAAe,EACjD,CAAE,gBAAAC,CAAgB,EAAI,KAAM,QAAO,mBAAmB,EAEtD,CAAE,OAAAC,EAAQ,IAAAC,EAAK,SAAAC,EAAU,MAAAC,EAAO,QAAAC,CAAQ,EAAIR,EAC5CS,EAAW,IAAIR,EACfS,EAAsB,CAAC,EAE7B,QAAWC,KAAQZ,EAAO,CAExB,GACE,CAAC,OAAO,SAASY,EAAK,OAAO,GAC7B,EAAE,OAAO,KAAS,KAAeA,EAAK,mBAAmB,MAEzD,MAAMC,EAAU,KAAK,8CAA8CD,EAAK,IAAI,GAAI,CAC9E,SAAUA,EAAK,IACjB,CAAC,EAIH,GAAI,CAACA,EAAK,IACR,MAAMC,EAAU,KAAK,8BAA8BD,EAAK,IAAI,GAAI,CAAE,SAAUA,EAAK,IAAK,CAAC,EAIzF,IAAME,EAAe,IAAIX,EAAK,CAACS,EAAK,OAAO,EAAGA,EAAK,KAAM,CAAE,KAAM,0BAA2B,CAAC,EAC7FF,EAAS,OAAOK,EAAc,MAAOD,CAAY,EACjDH,EAAU,KAAKC,EAAK,GAAG,CACzB,CAEAF,EAAS,OAAOK,EAAc,UAAW,KAAK,UAAUJ,CAAS,CAAC,EAE9DN,GAAUA,EAAO,OAAS,GAAGK,EAAS,OAAOK,EAAc,OAAQ,KAAK,UAAUV,CAAM,CAAC,EACzFC,GAAKI,EAAS,OAAOK,EAAc,IAAKT,CAAG,EAC3CC,GAAUG,EAAS,OAAOK,EAAc,SAAUR,CAAQ,EAC1DC,GAAO,OAAOE,EAAS,OAAOK,EAAc,MAAO,MAAM,EACzDP,GAAO,WAAWE,EAAS,OAAOK,EAAc,UAAW,MAAM,EACjEP,GAAO,KAAKE,EAAS,OAAOK,EAAc,IAAK,MAAM,EACrDN,GAASC,EAAS,OAAOK,EAAc,QAASN,CAAO,EAE3D,IAAMO,EAAU,IAAIZ,EAAgBM,CAAQ,EACtCO,EAAS,CAAC,EAChB,cAAiBC,KAASF,EAAQ,OAAO,EACvCC,EAAO,KAAK,OAAO,KAAKC,CAAK,CAAC,EAEhC,IAAMC,EAAO,OAAO,OAAOF,CAAM,EAEjC,MAAO,CACL,KAAME,EAAK,OAAO,MAAMA,EAAK,WAAYA,EAAK,WAAaA,EAAK,UAAU,EAC1E,QAAS,CACP,eAAgBH,EAAQ,YACxB,iBAAkB,OAAO,WAAWG,CAAI,EAAE,SAAS,CACrD,CACF,CACF,CCzDAC,ICAAC,IDIAC,KACAC,IACAC,KACAC,KAEAC,IACAC,KEJO,SAASC,GACdC,EACAC,EACAC,EACAC,EAAwB,GAChB,CACR,IAAMC,EAAOJ,IAAU,EAAIC,EAAWC,EACtC,OAAOC,EAAe,GAAGH,CAAK,IAAII,CAAI,GAAKA,CAC7C,CZmGAC,KAtEO,IAAMC,GAAN,cAAmBA,CAAS,CACjC,YAAYC,EAA6B,CAAC,EAAG,CAC3C,GAAIC,EAAO,IAAM,OACf,MAAMC,EAAU,SAAS,6DAA6D,EAYxF,IAAMC,EAAMC,GAAc,EAC1B,MAAM,CACJ,GAAGJ,EACH,OAAQA,EAAQ,QAAUG,EAAI,OAC9B,MAAOH,EAAQ,QAAUA,EAAQ,QAAU,OAAYG,EAAI,MAC7D,CAAC,CACH,CAYA,MAAM,OACJE,EACAL,EACmC,CACnC,OAAO,MAAM,OAAOK,EAAOL,CAAO,CACpC,CAEA,MAAgB,aACdK,EACAL,EACuB,CAEvB,IAAMM,EAAQ,OAAOD,GAAU,SAAW,CAACA,CAAK,EAAIA,EAEpD,GAAI,CAAC,MAAM,QAAQC,CAAK,GAAK,CAACA,EAAM,MAAOC,GAAM,OAAOA,GAAM,QAAQ,EACpE,MAAML,EAAU,SACd,0EACF,EAGF,GAAII,EAAM,SAAW,EACnB,MAAMJ,EAAU,SAAS,qBAAqB,EAGhD,GAAM,CAAE,oBAAAM,CAAoB,EAAI,KAAM,uCACtC,OAAOA,EAAoBF,EAAON,EAAS,KAAK,gBAAkB,MAAS,CAC7E,CAEU,sBAA0C,CAClD,OAAOS,EACT,CACF,EAGOC,GAAQX","names":["normalizeVia","value","via","DeploymentVia","validateIdempotencyKey","ShipError","key","IDEMPOTENCY_KEY_CONSTRAINTS","isTransportFailure","cause","isShipError","error","isBlockedExtension","filename","dotIndex","ext","BLOCKED_EXTENSIONS","hasUnsafeChars","UNSAFE_FILENAME_CHARS","hasUnbuiltMarker","filePath","s","UNBUILT_PROJECT_MARKERS","classifyToken","token","API_KEY","TokenKind","DEPLOY_TOKEN","assertShipJsonSyntax","text","withoutBom","parsed","DEPLOYMENT_CONFIG_FILENAME","validatePrefixedCredential","shape","label","hexPart","validateApiKey","apiKey","validateDeployToken","deployToken","validateToken","validateCaller","caller","CALLER","validateApiUrl","apiUrl","url","isDeployment","input","isPlatformDomain","domain","platformDomain","isCustomDomain","extractSubdomain","generateDeploymentUrl","deployment","generateDomainUrl","serializeLabels","labels","deserializeLabels","labelsJson","validatePassword","trimmed","PASSWORD_CONSTRAINTS","DeploymentStatus","DomainStatus","AccountPlan","API_PATHS","DEPLOY_FIELDS","ErrorType","CLIENT_ONLY_ERROR_TYPES","ERROR_CATEGORIES","SERVER_PRODUCIBLE_ERROR_TYPES","MAX_FOREIGN_MESSAGE_LENGTH","WEB_FILE_EXTENSIONS","WEB_FILE_ACCEPT","AUTH_BASE_PATH","AuthMethod","OAuthScope","SPA_DEFAULT_CONFIG","SPA_CHECK_CONSTRAINTS","DEFAULT_API","SHIP_ENV","MY_API_KEY_URL","PUBLIC_DEPLOYMENT_TTL_SECONDS","FileValidationStatus","LABEL_CONSTRAINTS","LABEL_PATTERN","init_dist","__esmMin","t","_ShipError","type","message","status","details","authDetails","response","operationName","bodyType","json","obj","retryAfterHeader","seconds","existing","op","resource","id","errorType","md5Blob","blob","SparkMD5","spark","chunkSize","start","end","md5Buffer","buffer","createHash","hash","md5Path","path","createReadStream","resolve","reject","stream","err","ShipError","chunk","calculateMD5","input","init_md5","__esmMin","init_dist","__setTestEnvironment","env","_testEnvironment","detectEnvironment","getENV","init_env","__esmMin","findCommonParent","dirPaths","normalizedPaths","p","pathSegments","commonSegments","minLength","i","segment","segments","normalizeWebPath","path","init_path","__esmMin","optimizeDeployPaths","filePaths","options","path","normalizeWebPath","extractFileName","commonPrefix","findCommonDirectory","filePath","deployPath","prefixToRemove","pathSegments","commonSegments","minLength","segments","i","segment","init_deploy_paths","__esmMin","init_path","formatFileSize","bytes","decimals","k","sizes","i","validateFileName","filename","hasUnsafeChars","reservedNames","nameWithoutPath","validateFiles","files","config","errors","warnings","fileStatuses","issue","file","hasUnbuiltMarker","f","FileValidationStatus","totalSize","fileStatus","statusMessage","nameValidation","isBlockedExtension","validFiles","canDeploy","getValidFiles","allValidFilesReady","init_file_validation","__esmMin","init_dist","filterJunk","filePaths","options","p","hasUnbuiltMarker","ShipError","filePath","parts","basename","part","directorySegments","segment","JUNK_DIRECTORIES","junkDir","import_junk","init_junk","__esmMin","init_dist","validateDeployPath","deployPath","sourceIdentifier","ShipError","validateDeployFile","nameCheck","validateFileName","isBlockedExtension","init_security","__esmMin","init_dist","init_file_validation","node_files_exports","__export","processFilesForNode","findAllFilePaths","dirPath","visited","results","realPath","entries","entry","fullPath","stats","subFiles","paths","options","platformLimits","getENV","ShipError","p","absPath","marker","e","UNBUILT_PROJECT_MARKERS","isShipError","absolutePaths","uniquePaths","inputAbsolutePaths","inputBasePath","findCommonParent","contentPaths","rel","deployPaths","optimizeDeployPaths","f","filteredSet","filterJunk","validAbsPaths","validDeployPaths","i","totalSize","filePath","deployPath","validateDeployPath","validateDeployFile","content","md5","calculateMD5","error","errorMessage","fs","path","init_node_files","__esmMin","init_dist","init_deploy_paths","init_env","init_junk","init_md5","init_path","init_security","src_exports","__export","API_KEY","API_PATHS","AUTH_BASE_PATH","AccountPlan","ApiHttp","AuthMethod","BLOCKED_EXTENSIONS","CALLER","DEFAULT_API","DEPLOYMENT_CONFIG_FILENAME","DEPLOY_FIELDS","DEPLOY_TOKEN","DeploymentStatus","DeploymentVia","DomainStatus","ErrorType","FileValidationStatus","IDEMPOTENCY_KEY_CONSTRAINTS","JUNK_DIRECTORIES","LABEL_CONSTRAINTS","LABEL_PATTERN","MY_API_KEY_URL","OAuthScope","PASSWORD_CONSTRAINTS","PUBLIC_DEPLOYMENT_TTL_SECONDS","SHIP_ENV","SPA_CHECK_CONSTRAINTS","SPA_DEFAULT_CONFIG","Ship","ShipError","TokenKind","UNBUILT_PROJECT_MARKERS","UNSAFE_FILENAME_CHARS","WEB_FILE_ACCEPT","__setTestEnvironment","allValidFilesReady","assertShipJsonSyntax","calculateMD5","classifyToken","createAccountResource","createDeploymentResource","createDomainResource","createTokenResource","node_default","deserializeLabels","extractSubdomain","filterJunk","formatFileSize","generateDeploymentUrl","generateDomainUrl","getENV","getValidFiles","hasUnbuiltMarker","hasUnsafeChars","isBlockedExtension","isCustomDomain","isDeployment","isPlatformDomain","isShipError","normalizeVia","optimizeDeployPaths","pluralize","processFilesForNode","serializeLabels","validateApiKey","validateApiUrl","validateCaller","validateDeployFile","validateDeployPath","validateDeployToken","validateFileName","validateFiles","validateIdempotencyKey","validatePassword","validateToken","__toCommonJS","init_dist","init_dist","init_dist","SimpleEvents","event","handler","eventHandlers","args","handlerArray","error","err","init_dist","validateLabels","labels","LABEL_CONSTRAINTS","ShipError","normalized","label","i","cleaned","LABEL_PATTERN","unique","validateDeployConfig","files","config","f","DEPLOYMENT_CONFIG_FILENAME","content","text","assertShipJsonSyntax","DEFAULT_REQUEST_TIMEOUT","DEFAULT_DEPLOY_TIMEOUT","BUILD_SERVICE_BUDGET","DEFAULT_DEPLOY_BUILD_TIMEOUT","DEPLOY_VIA","listQuery","options","params","query","ApiHttp","SimpleEvents","DEFAULT_API","API_PATHS","headers","url","operationName","timeoutMs","cleanup","timeout","fetchOptions","response","ShipError","error","shipError","data","customHeaders","CALLER","existingSignal","controller","timeoutId","abort","files","file","validatePassword","idempotencyKey","validateIdempotencyKey","labels","validateLabels","validateDeployConfig","flags","body","bodyHeaders","IDEMPOTENCY_KEY_CONSTRAINTS","id","normalized","name","deployment","status","ttl","token","_options","indexFile","f","SPA_CHECK_CONSTRAINTS","indexContent","init_dist","init_dist","init_md5","createSPAConfig","configString","SPA_DEFAULT_CONFIG","content","md5","calculateMD5","DEPLOYMENT_CONFIG_FILENAME","detectAndConfigureSPA","files","apiClient","options","f","spaConfig","createDeploymentResource","ctx","getApi","ensureInit","processInput","input","options","ShipError","apiClient","staticFiles","detectAndConfigureSPA","id","createDomainResource","name","createAccountResource","createTokenResource","token","Ship","options","validateCaller","ShipError","validateToken","ApiHttp","ctx","createDeploymentResource","input","opts","createDomainResource","createAccountResource","createTokenResource","error","event","handler","headers","token","value","init_env","init_dist","import_zod","import_zod","CREDENTIAL_FIELDS","init_env","EnvConfigSchema","CREDENTIAL_FIELDS","ENV_VAR_BY_FIELD","SHIP_ENV","readEnvConfig","getENV","raw","error","issue","field","envVar","ShipError","init_dist","createDeployBody","files","context","FormData","File","FormDataEncoder","labels","via","password","flags","captcha","formData","checksums","file","ShipError","fileInstance","DEPLOY_FIELDS","encoder","chunks","chunk","body","init_dist","init_dist","init_deploy_paths","init_env","init_file_validation","init_junk","init_md5","init_security","pluralize","count","singular","plural","includeCount","word","init_node_files","Ship","options","getENV","ShipError","env","readEnvConfig","input","paths","p","processFilesForNode","createDeployBody","node_default"]}