@vibesdotdev/infra-deploy 0.0.1 → 1.0.0-rc.4

package/dist/cli/npm/publish/proof-registry.d.ts

@@ -0,0 +1,74 @@
+/**
+ * The local proof registry the installed release proof installs from: sealed
+ * artifacts served verbatim, optional upstream proxying, and source npmrc files.
+ */
+import type { ChildEnvRuntime } from "../../shared/runtime-execution.ts";
+import type { RuntimeExecution } from "@vibesdotdev/kernel/execution";
+import type { PackageJson, RegistryReleasePublishTarget } from "./types.ts";
+/** Node resolution of `name` from `fromDir`, bounded by `workspaceRoot`. */
+export declare function resolveInstalledPackageDirectory(options: {
+    runtime: ChildEnvRuntime;
+    workspaceRoot: string;
+    fromDir: string;
+    name: string;
+}): Promise<string | null>;
+/**
+ * Where the proof fetches external packages from: a default registry, scoped
+ * registries, and each origin's read token and renewer.
+ */
+export type ReleaseConsumerSourceRegistry = {
+    defaultRegistry: string;
+    scopedRegistries?: Readonly<Record<string, string>>;
+    tokensByRegistry?: Readonly<Record<string, string | undefined>>;
+    renewSessionTokensByRegistry?: Readonly<Record<string, () => Promise<string | null | undefined>>>;
+};
+/**
+ * The source registries of a release's targets; one registry per scope and at
+ * most one authenticated origin per run.
+ */
+export declare function buildReleaseConsumerSourceRegistry(options: {
+    targets: readonly RegistryReleasePublishTarget[];
+    readToken?: string;
+    renewReadToken?: () => Promise<string | null | undefined>;
+}): ReleaseConsumerSourceRegistry;
+/** The source registry a package is fetched from. */
+export declare function registryForProofPackage(name: string, source: ReleaseConsumerSourceRegistry): string;
+/** The npmrc that reads every source registry with its token. */
+export declare function releaseConsumerSourceNpmrc(source: ReleaseConsumerSourceRegistry): string;
+/** Atomically write the source-registry npmrc (mode 0600). */
+export declare function writeReleaseConsumerSourceNpmrc(npmrcPath: string, source: ReleaseConsumerSourceRegistry, 
+/** The runtime whose logger reports a scratch file a failed write could not scrub. */
+runtime: ChildEnvRuntime): Promise<void>;
+/**
+ * Serve sealed artifacts verbatim from a local registry for the proof install,
+ * optionally proxying misses upstream and withholding named packages.
+ */
+export declare function startProofLocalRegistry(runtime: ChildEnvRuntime, artifacts: readonly {
+    manifest: PackageJson & {
+        name: string;
+        version: string;
+    };
+    tarball: string;
+}[], options?: {
+    /**
+     * When set, packument misses proxy to this upstream registry so consumer
+     * install can resolve unsealed public transitive dependencies. Sealed
+     * artifacts always win. Omit for withhold proofs that must fail closed.
+     */
+    upstreamRegistry?: string;
+    /**
+     * Packages the proof must fail without. Their packuments and tarballs are
+     * never proxied upstream, so an install that needs one fails on it rather
+     * than on an unsealed public transitive.
+     */
+    withhold?: ReadonlySet<string>;
+}): Promise<{
+    origin: string;
+    close(): Promise<void>;
+}>;
+/** The package.json inside a proof artifact tarball. */
+export declare function readProofArtifactManifest(execution: RuntimeExecution, runtime: ChildEnvRuntime, tarball: string): Promise<PackageJson & {
+    name: string;
+    version: string;
+}>;
+//# sourceMappingURL=proof-registry.d.ts.map

package/dist/cli/npm/publish/proof-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof-registry.d.ts","sourceRoot":"","sources":["../../../../src/cli/npm/publish/proof-registry.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAOzE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAWtE,OAAO,KAAK,EAAE,WAAW,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAE5E,4EAA4E;AAC5E,wBAAsB,gCAAgC,CAAC,OAAO,EAAE;IAC9D,OAAO,EAAE,eAAe,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiBzB;AAED;;;GAGG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,gBAAgB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAChE,4BAA4B,CAAC,EAAE,QAAQ,CACrC,MAAM,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC,CACzD,CAAC;CACH,CAAC;AAQF;;;GAGG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAAE;IAC1D,OAAO,EAAE,SAAS,4BAA4B,EAAE,CAAC;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;CAC3D,GAAG,6BAA6B,CA2ChC;AAED,qDAAqD;AACrD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,6BAA6B,GACpC,MAAM,CAMR;AAED,iEAAiE;AACjE,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,6BAA6B,GACpC,MAAM,CAwBR;AAED,8DAA8D;AAC9D,wBAAsB,+BAA+B,CACnD,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,6BAA6B;AACrC,sFAAsF;AACtF,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,IAAI,CAAC,CAMf;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,eAAe,EACxB,SAAS,EAAE,SAAS;IAClB,QAAQ,EAAE,WAAW,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,OAAO,EAAE,MAAM,CAAC;CACjB,EAAE,EACH,OAAO,GAAE;IACP;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC3B,GACL,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC,CAuMrD;AAED,wDAAwD;AACxD,wBAAsB,yBAAyB,CAC7C,SAAS,EAAE,gBAAgB,EAC3B,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,WAAW,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAwD1D"}

package/dist/cli/npm/publish/proof-registry.js

@@ -0,0 +1,335 @@
+import { hashBase64, hashHex } from "@vibesdotdev/crypto";
+import { resolveFileSystemAdapter } from "@vibesdotdev/filesystem";
+import { getRuntimePath } from "@vibesdotdev/paths";
+import { getRuntimeHttpListener, valueFreeFailure, settle, CapabilityError } from "@vibesdotdev/kernel";
+import { proofRegistryPackumentSchema } from "../../../schemas/proof-registry.js";
+import { z } from "zod/v4";
+import { rcompare, satisfies, valid } from "semver";
+import { runRuntimeCommand } from "../../shared/runtime-execution.js";
+import { pathExists } from "./fs-paths.js";
+import { authConfigLine } from "./npm-exec.js";
+import { normalizeRegistryUrl, PUBLIC_NPM_REGISTRY, } from "./registry-credentials.js";
+import { writeSensitiveNpmrcAtomically } from "./sensitive-temp.js";
+import { parsePublisherManifest } from "./publisher-manifest.js";
+/** Node resolution of `name` from `fromDir`, bounded by `workspaceRoot`. */
+export async function resolveInstalledPackageDirectory(options) {
+    const paths = await getRuntimePath(options.runtime);
+    let cursor = options.fromDir;
+    while (true) {
+        const position = paths.relative(options.workspaceRoot, cursor);
+        if (position.startsWith("../") || position.startsWith("..\\") || paths.isAbsolute(position)) {
+            return null;
+        }
+        const candidate = paths.join(cursor, "node_modules", ...options.name.split("/"));
+        if (await pathExists(options.runtime, paths.join(candidate, "package.json"), { binding: false })) {
+            return candidate;
+        }
+        if (cursor === options.workspaceRoot)
+            return null;
+        const parent = paths.dirname(cursor);
+        if (parent === cursor)
+            return null;
+        cursor = parent;
+    }
+}
+function packageScope(name) {
+    if (!name.startsWith("@"))
+        return undefined;
+    const slash = name.indexOf("/");
+    return slash > 1 ? name.slice(0, slash) : undefined;
+}
+/**
+ * The source registries of a release's targets; one registry per scope and at
+ * most one authenticated origin per run.
+ */
+export function buildReleaseConsumerSourceRegistry(options) {
+    const scopedRegistries = {};
+    const registries = new Set();
+    for (const target of options.targets) {
+        const registry = normalizeRegistryUrl(target.registry);
+        registries.add(registry);
+        const scope = packageScope(target.name);
+        if (!scope)
+            continue;
+        const prior = scopedRegistries[scope];
+        if (prior && prior !== registry) {
+            throw new Error(`Release consumer proof scope ${scope} maps to multiple registries: ${prior}, ${registry}`);
+        }
+        scopedRegistries[scope] = registry;
+    }
+    const uniqueRegistries = [...registries];
+    if ((options.readToken || options.renewReadToken) &&
+        uniqueRegistries.length !== 1) {
+        throw new Error("External proof authentication requires one registry per run; one token is never shared across origins");
+    }
+    if (options.renewReadToken && !options.readToken) {
+        throw new Error("External proof session renewal requires an initial Registry read credential");
+    }
+    const source = {
+        defaultRegistry: PUBLIC_NPM_REGISTRY,
+        scopedRegistries,
+        tokensByRegistry: options.readToken
+            ? { [uniqueRegistries[0]]: options.readToken }
+            : undefined,
+    };
+    if (options.renewReadToken) {
+        source.renewSessionTokensByRegistry = {
+            [uniqueRegistries[0]]: options.renewReadToken,
+        };
+    }
+    return source;
+}
+/** The source registry a package is fetched from. */
+export function registryForProofPackage(name, source) {
+    const scope = packageScope(name);
+    return normalizeRegistryUrl((scope ? source.scopedRegistries?.[scope] : undefined) ??
+        source.defaultRegistry);
+}
+/** The npmrc that reads every source registry with its token. */
+export function releaseConsumerSourceNpmrc(source) {
+    const defaultRegistry = normalizeRegistryUrl(source.defaultRegistry);
+    const scoped = Object.entries(source.scopedRegistries ?? {})
+        .map(([scope, registry]) => [
+        scope.startsWith("@") ? scope : `@${scope}`,
+        normalizeRegistryUrl(registry),
+    ])
+        .sort(([left], [right]) => left.localeCompare(right));
+    const registries = new Set([
+        defaultRegistry,
+        ...scoped.map(([, registry]) => registry),
+    ]);
+    const lines = [
+        `registry=${defaultRegistry}`,
+        ...scoped.map(([scope, registry]) => `${scope}:registry=${registry}`),
+        ...[...registries].sort().flatMap((registry) => {
+            const token = source.tokensByRegistry?.[registry];
+            return token ? [`${authConfigLine(registry)}=${token}`] : [];
+        }),
+    ];
+    return `${lines.join("\n")}\n`;
+}
+/** Atomically write the source-registry npmrc (mode 0600). */
+export async function writeReleaseConsumerSourceNpmrc(npmrcPath, source, 
+/** The runtime whose logger reports a scratch file a failed write could not scrub. */
+runtime) {
+    await writeSensitiveNpmrcAtomically(npmrcPath, releaseConsumerSourceNpmrc(source), runtime);
+}
+/**
+ * Serve sealed artifacts verbatim from a local registry for the proof install,
+ * optionally proxying misses upstream and withholding named packages.
+ */
+export async function startProofLocalRegistry(runtime, artifacts, options = {}) {
+    const byPackage = new Map();
+    for (const artifact of artifacts) {
+        const files = await resolveFileSystemAdapter(runtime, { binding: false });
+        const bytes = z.instanceof(Uint8Array).parse(await files.readFile(artifact.tarball));
+        const versions = byPackage.get(artifact.manifest.name) ?? new Map();
+        const identity = {
+            manifest: artifact.manifest,
+            tarball: artifact.tarball,
+            integrity: `sha512-${await hashBase64(runtime, "sha512", bytes)}`,
+            shasum: await hashHex(runtime, "sha1", bytes),
+        };
+        const existing = versions.get(artifact.manifest.version);
+        if (existing && existing.integrity !== identity.integrity) {
+            throw new Error(`Proof-local Registry found conflicting bytes for ${artifact.manifest.name}@${artifact.manifest.version}`);
+        }
+        versions.set(artifact.manifest.version, identity);
+        byPackage.set(artifact.manifest.name, versions);
+    }
+    let origin = "";
+    const listener = await getRuntimeHttpListener(runtime);
+    const binding = await listener.listen({
+        hostname: "127.0.0.1",
+        port: 0,
+        fetch: async (request) => {
+            const response = await settle(async () => {
+                const pathname = decodeURIComponent(new URL(request.url).pathname.slice(1));
+                if (pathname.startsWith("__tarball/")) {
+                    const [encodedName, version] = pathname
+                        .slice("__tarball/".length)
+                        .split("/");
+                    const name = Buffer.from(encodedName ?? "", "base64url").toString("utf8");
+                    const artifact = version
+                        ? byPackage.get(name)?.get(version)
+                        : undefined;
+                    if (!artifact) {
+                        return new Response("missing sealed artifact", { status: 404 });
+                    }
+                    return new Response(z.instanceof(Uint8Array).parse(await (await resolveFileSystemAdapter(runtime, { binding: false })).readFile(artifact.tarball)), {
+                        status: 200,
+                        headers: { "content-type": "application/octet-stream" },
+                    });
+                }
+                const withheldName = [...(options.withhold ?? [])].find((name) => pathname === name || pathname.startsWith(`${name}/-/`));
+                if (withheldName) {
+                    return new Response(JSON.stringify({
+                        error: `package withheld from proof registry: ${withheldName}`,
+                    }), { status: 404, headers: { "content-type": "application/json" } });
+                }
+                const versions = byPackage.get(pathname);
+                // Merge public versions without allowing a sealed caret range to select
+                // newer upstream bytes. Exact older pins and incompatible majors stay usable.
+                const upstream = options.upstreamRegistry
+                    ? normalizeRegistryUrl(options.upstreamRegistry)
+                    : undefined;
+                let upstreamPackument;
+                // Proxy whatever upstream returns byte-for-byte on the miss path: npm
+                // rewrites verified npmjs tarball hosts to the configured registry, so a
+                // miss is often a tarball request, not a packument. Only JSON parses are
+                // considered for the sealed merge below.
+                let upstreamBody;
+                if (upstream) {
+                    const upstreamUrl = `${upstream.replace(/\/$/, "")}/${pathname}`;
+                    const fetched = await settle(async () => {
+                        const response = await fetch(upstreamUrl, {
+                            headers: { accept: "application/json" },
+                            redirect: "follow",
+                        });
+                        // Do not read error payloads; their status is the useful evidence.
+                        const body = response.ok
+                            ? new Uint8Array(await response.arrayBuffer())
+                            : undefined;
+                        if (!response.ok)
+                            await response.body?.cancel();
+                        return { response, body };
+                    });
+                    if (!fetched.ok) {
+                        return Response.json({
+                            error: "proof registry upstream transport failed",
+                            reason: "proof-upstream-transport-failed",
+                            cause: valueFreeFailure(fetched.cause),
+                        }, { status: 502 });
+                    }
+                    const { response: upstreamResponse, body } = fetched.value;
+                    if (upstreamResponse.status !== 404) {
+                        if (!upstreamResponse.ok || body === undefined) {
+                            return Response.json({
+                                error: "proof registry upstream request failed",
+                                reason: "proof-upstream-http-failed",
+                                upstreamStatus: upstreamResponse.status,
+                            }, { status: 502 });
+                        }
+                        const contentType = upstreamResponse.headers.get("content-type") ?? "application/octet-stream";
+                        upstreamBody = { status: upstreamResponse.status, contentType, body };
+                        // Tarballs are opaque. Package documents cross the metadata boundary.
+                        if (!pathname.includes("/-/")) {
+                            const parsed = await settle(() => proofRegistryPackumentSchema.parse(JSON.parse(new TextDecoder().decode(body))));
+                            if (!parsed.ok) {
+                                return Response.json({
+                                    error: "proof registry upstream metadata is unreadable",
+                                    reason: "proof-upstream-metadata-invalid",
+                                    cause: valueFreeFailure(parsed.cause),
+                                }, { status: 502 });
+                            }
+                            upstreamPackument = parsed.value;
+                            if (upstreamPackument.name !== pathname) {
+                                return Response.json({
+                                    error: "proof registry upstream metadata identity mismatch",
+                                    reason: "proof-upstream-identity-invalid",
+                                }, { status: 502 });
+                            }
+                        }
+                    }
+                }
+                if (!versions) {
+                    if (upstreamBody) {
+                        return new Response(new Uint8Array(upstreamBody.body), {
+                            status: upstreamBody.status,
+                            headers: { "content-type": upstreamBody.contentType },
+                        });
+                    }
+                    return new Response(JSON.stringify({
+                        error: "package absent from sealed proof registry",
+                    }), { status: 404, headers: { "content-type": "application/json" } });
+                }
+                const versionRecords = Object.fromEntries([...versions.entries()].map(([version, artifact]) => [
+                    version,
+                    {
+                        ...artifact.manifest,
+                        dist: {
+                            integrity: artifact.integrity,
+                            shasum: artifact.shasum,
+                            tarball: `${origin}/__tarball/${Buffer.from(pathname).toString("base64url")}/${version}`,
+                        },
+                    },
+                ]));
+                const latest = [...versions.keys()].sort(rcompare)[0];
+                if (latest === undefined) {
+                    throw new Error(`Proof-local Registry has no sealed version for ${pathname}`);
+                }
+                for (const [version, record] of Object.entries(upstreamPackument?.versions ?? {})) {
+                    if (versions.has(version))
+                        continue;
+                    if (!valid(version))
+                        continue;
+                    if ([...versions.keys()].some((sealed) => rcompare(version, sealed) < 0 &&
+                        satisfies(version, `^${sealed}`)))
+                        continue;
+                    versionRecords[version] = record;
+                }
+                return new Response(JSON.stringify({
+                    name: pathname,
+                    "dist-tags": { latest },
+                    versions: versionRecords,
+                }), { status: 200, headers: { "content-type": "application/json" } });
+            });
+            if (response.ok)
+                return response.value;
+            return Response.json({
+                error: "proof registry request failed",
+                cause: valueFreeFailure(response.cause),
+            }, { status: 500 });
+        },
+    });
+    origin = binding.origin;
+    return { origin, close: () => binding.stop() };
+}
+/** The package.json inside a proof artifact tarball. */
+export async function readProofArtifactManifest(execution, runtime, tarball) {
+    const listed = await runRuntimeCommand({
+        runtime,
+        execution,
+        command: "tar",
+        args: ["-tzf", tarball],
+        cwd: (await getRuntimePath(runtime)).dirname(tarball),
+    });
+    if (listed.code !== 0) {
+        throw new Error(`Release proof cannot list ${tarball}: ${listed.stderr}`);
+    }
+    const manifestPaths = listed.stdout
+        .split(/\r?\n/)
+        .map((entry) => entry.trim())
+        .filter(Boolean)
+        .filter((entry) => {
+        const parts = entry.replace(/^\.\/+/, "").split("/");
+        return (parts.length === 2 && parts[0] !== ".." && parts[1] === "package.json");
+    });
+    if (manifestPaths.length !== 1) {
+        throw new Error(`Release proof artifact ${tarball} must contain exactly one top-level package.json; found ${manifestPaths.length}`);
+    }
+    const extracted = await runRuntimeCommand({
+        runtime,
+        execution,
+        command: "tar",
+        args: ["-xOf", tarball, "--", manifestPaths[0]],
+        cwd: (await getRuntimePath(runtime)).dirname(tarball),
+    });
+    if (extracted.code !== 0) {
+        throw new Error(`Release proof cannot read ${tarball}: ${extracted.stderr}`);
+    }
+    let manifest;
+    try {
+        manifest = parsePublisherManifest(JSON.parse(extracted.stdout));
+    }
+    catch (error) {
+        throw new CapabilityError(`Release proof artifact ${tarball} has malformed package.json`, "INVALID_INPUT", { reason: "proof-artifact-manifest-invalid", cause: error });
+    }
+    if (!manifest.name || !manifest.version) {
+        throw new Error(`Release proof artifact ${tarball} has no package name or version`);
+    }
+    const name = manifest.name;
+    const version = manifest.version;
+    return { ...manifest, name, version };
+}
+//# sourceMappingURL=proof-registry.js.map

package/dist/cli/npm/publish/proof-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof-registry.js","sourceRoot":"","sources":["../../../../src/cli/npm/publish/proof-registry.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACxG,OAAO,EAAE,4BAA4B,EAA6B,MAAM,oCAAoC,CAAC;AAC7G,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAE3B,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAGjE,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,OAKtD;IACC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAC7B,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAC/D,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5F,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACjF,IAAI,MAAM,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YACjG,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,MAAM,KAAK,OAAO,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC;QAClD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,GAAG,MAAM,CAAC;IAClB,CAAC;AACH,CAAC;AAeD,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kCAAkC,CAAC,OAIlD;IACC,MAAM,gBAAgB,GAA2B,EAAE,CAAC;IACpD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvD,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzB,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,KAAK,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,gCAAgC,KAAK,iCAAiC,KAAK,KAAK,QAAQ,EAAE,CAC3F,CAAC;QACJ,CAAC;QACD,gBAAgB,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC;IACrC,CAAC;IACD,MAAM,gBAAgB,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;IACzC,IACE,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,cAAc,CAAC;QAC7C,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAC7B,CAAC;QACD,MAAM,IAAI,KAAK,CACb,uGAAuG,CACxG,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAkC;QAC5C,eAAe,EAAE,mBAAmB;QACpC,gBAAgB;QAChB,gBAAgB,EAAE,OAAO,CAAC,SAAS;YACjC,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAE,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE;YAC/C,CAAC,CAAC,SAAS;KACd,CAAC;IACF,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QAC3B,MAAM,CAAC,4BAA4B,GAAG;YACpC,CAAC,gBAAgB,CAAC,CAAC,CAAE,CAAC,EAAE,OAAO,CAAC,cAAc;SAC/C,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,uBAAuB,CACrC,IAAY,EACZ,MAAqC;IAErC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,OAAO,oBAAoB,CACzB,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpD,MAAM,CAAC,eAAe,CACzB,CAAC;AACJ,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,0BAA0B,CACxC,MAAqC;IAErC,MAAM,eAAe,GAAG,oBAAoB,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAAC;SACzD,GAAG,CACF,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,CACpB;QACE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE;QAC3C,oBAAoB,CAAC,QAAQ,CAAC;KACtB,CACb;SACA,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;QACzB,eAAe;QACf,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC;KAC1C,CAAC,CAAC;IACH,MAAM,KAAK,GAAG;QACZ,YAAY,eAAe,EAAE;QAC7B,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,aAAa,QAAQ,EAAE,CAAC;QACrE,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;YAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC,QAAQ,CAAC,CAAC;YAClD,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,CAAC,CAAC;KACH,CAAC;IACF,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,SAAiB,EACjB,MAAqC;AACrC,sFAAsF;AACtF,OAAwB;IAExB,MAAM,6BAA6B,CACjC,SAAS,EACT,0BAA0B,CAAC,MAAM,CAAC,EAClC,OAAO,CACR,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAwB,EACxB,SAGG,EACH,UAaI,EAAE;IAEN,MAAM,SAAS,GAAG,IAAI,GAAG,EAWtB,CAAC;IACJ,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1E,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACrF,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;QACpE,MAAM,QAAQ,GAAG;YACf,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,SAAS,EAAE,UAAU,MAAM,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE;YACjE,MAAM,EAAE,MAAM,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC;SAC9C,CAAC;QACF,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,QAAQ,IAAI,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CACb,oDAAoD,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,CAC1G,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAClD,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;QACpC,QAAQ,EAAE,WAAW;QACrB,IAAI,EAAE,CAAC;QACP,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACvB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,IAAI,EAAE;gBACvC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5E,IAAI,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;oBACtC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,QAAQ;yBACpC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC;yBAC1B,KAAK,CAAC,GAAG,CAAC,CAAC;oBACd,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAC/D,MAAM,CACP,CAAC;oBACF,MAAM,QAAQ,GAAG,OAAO;wBACtB,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC;wBACnC,CAAC,CAAC,SAAS,CAAC;oBACd,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACd,OAAO,IAAI,QAAQ,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;oBAClE,CAAC;oBACD,OAAO,IAAI,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,wBAAwB,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE;wBAClJ,MAAM,EAAE,GAAG;wBACX,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;qBACxD,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CACrD,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,KAAK,CAAC,CACjE,CAAC;gBACF,IAAI,YAAY,EAAE,CAAC;oBACjB,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;wBACb,KAAK,EAAE,yCAAyC,YAAY,EAAE;qBAC/D,CAAC,EACF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;gBACJ,CAAC;gBACD,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACzC,wEAAwE;gBACxE,8EAA8E;gBAC9E,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB;oBACvC,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,gBAAgB,CAAC;oBAChD,CAAC,CAAC,SAAS,CAAC;gBACd,IAAI,iBAA2E,CAAC;gBAChF,sEAAsE;gBACtE,yEAAyE;gBACzE,yEAAyE;gBACzE,yCAAyC;gBACzC,IAAI,YAAmF,CAAC;gBACxF,IAAI,QAAQ,EAAE,CAAC;oBACb,MAAM,WAAW,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,QAAQ,EAAE,CAAC;oBACjE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,IAAI,EAAE;wBACtC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE;4BACxC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;4BACvC,QAAQ,EAAE,QAAQ;yBACnB,CAAC,CAAC;wBACH,mEAAmE;wBACnE,MAAM,IAAI,GAAG,QAAQ,CAAC,EAAE;4BACtB,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC;4BAC9C,CAAC,CAAC,SAAS,CAAC;wBACd,IAAI,CAAC,QAAQ,CAAC,EAAE;4BAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;wBAChD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;oBAC5B,CAAC,CAAC,CAAC;oBACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;wBAChB,OAAO,QAAQ,CAAC,IAAI,CAAC;4BACnB,KAAK,EAAE,0CAA0C;4BACjD,MAAM,EAAE,iCAAiC;4BACzC,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC;yBACvC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;oBACtB,CAAC;oBACD,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;oBAC3D,IAAI,gBAAgB,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;wBACpC,IAAI,CAAC,gBAAgB,CAAC,EAAE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;4BAC/C,OAAO,QAAQ,CAAC,IAAI,CAAC;gCACnB,KAAK,EAAE,wCAAwC;gCAC/C,MAAM,EAAE,4BAA4B;gCACpC,cAAc,EAAE,gBAAgB,CAAC,MAAM;6BACxC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;wBACtB,CAAC;wBACD,MAAM,WAAW,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,0BAA0B,CAAC;wBAC/F,YAAY,GAAG,EAAE,MAAM,EAAE,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;wBACtE,sEAAsE;wBACtE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;4BAC9B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,4BAA4B,CAAC,KAAK,CAClE,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAC3C,CAAC,CAAC;4BACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gCACf,OAAO,QAAQ,CAAC,IAAI,CAAC;oCACnB,KAAK,EAAE,gDAAgD;oCACvD,MAAM,EAAE,iCAAiC;oCACzC,KAAK,EAAE,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC;iCACtC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;4BACtB,CAAC;4BACD,iBAAiB,GAAG,MAAM,CAAC,KAAK,CAAC;4BACjC,IAAI,iBAAiB,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gCACxC,OAAO,QAAQ,CAAC,IAAI,CAAC;oCACnB,KAAK,EAAE,oDAAoD;oCAC3D,MAAM,EAAE,iCAAiC;iCAC1C,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;4BACtB,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,IAAI,YAAY,EAAE,CAAC;wBACjB,OAAO,IAAI,QAAQ,CAAC,IAAI,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE;4BACrD,MAAM,EAAE,YAAY,CAAC,MAAM;4BAC3B,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,CAAC,WAAW,EAAE;yBACtD,CAAC,CAAC;oBACL,CAAC;oBACD,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;wBACb,KAAK,EAAE,2CAA2C;qBACnD,CAAC,EACF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;gBACJ,CAAC;gBACD,MAAM,cAAc,GAAyC,MAAM,CAAC,WAAW,CAC7E,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACnD,OAAO;oBACP;wBACE,GAAG,QAAQ,CAAC,QAAQ;wBACpB,IAAI,EAAE;4BACJ,SAAS,EAAE,QAAQ,CAAC,SAAS;4BAC7B,MAAM,EAAE,QAAQ,CAAC,MAAM;4BACvB,OAAO,EAAE,GAAG,MAAM,cAAc,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,OAAO,EAAE;yBACzF;qBACF;iBACF,CAAC,CACH,CAAC;gBACF,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBACtD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACzB,MAAM,IAAI,KAAK,CAAC,kDAAkD,QAAQ,EAAE,CAAC,CAAC;gBAChF,CAAC;gBACD,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAC5C,iBAAiB,EAAE,QAAQ,IAAI,EAAE,CAClC,EAAE,CAAC;oBACF,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;wBAAE,SAAS;oBACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;wBAAE,SAAS;oBAC9B,IACE,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CACvB,CAAC,MAAM,EAAE,EAAE,CACT,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC;wBAC7B,SAAS,CAAC,OAAO,EAAE,IAAI,MAAM,EAAE,CAAC,CACnC;wBAED,SAAS;oBACX,cAAc,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC;gBACnC,CAAC;gBACD,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;oBACb,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,EAAE,MAAM,EAAE;oBACvB,QAAQ,EAAE,cAAc;iBACzB,CAAC,EACF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,IAAI,QAAQ,CAAC,EAAE;gBAAE,OAAO,QAAQ,CAAC,KAAK,CAAC;YACvC,OAAO,QAAQ,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,+BAA+B;gBACtC,KAAK,EAAE,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC;aACxC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACtB,CAAC;KACF,CAAC,CAAC;IACH,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;AACjD,CAAC;AAED,wDAAwD;AACxD,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,SAA2B,EAC3B,OAAwB,EACxB,OAAe;IAEf,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;QACrC,OAAO;QACP,SAAS;QACT,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;QACvB,GAAG,EAAE,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;KACtD,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,6BAA6B,OAAO,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM;SAChC,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC;SACf,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QAChB,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrD,OAAO,CACL,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,cAAc,CACvE,CAAC;IACJ,CAAC,CAAC,CAAC;IACL,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,0BAA0B,OAAO,2DAA2D,aAAa,CAAC,MAAM,EAAE,CACnH,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC;QACxC,OAAO;QACP,SAAS;QACT,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAE,CAAC;QAChD,GAAG,EAAE,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;KACtD,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,6BAA6B,OAAO,KAAK,SAAS,CAAC,MAAM,EAAE,CAC5D,CAAC;IACJ,CAAC;IACD,IAAI,QAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,QAAQ,GAAG,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,eAAe,CACvB,0BAA0B,OAAO,6BAA6B,EAC9D,eAAe,EACf,EAAE,MAAM,EAAE,iCAAiC,EAAE,KAAK,EAAE,KAAK,EAAE,CAC5D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,0BAA0B,OAAO,iCAAiC,CACnE,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACjC,OAAO,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACxC,CAAC"}

package/dist/cli/npm/publish/proof-source-credentials.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Read credentials for the release proof's source registries: one token per
+ * configured origin, renewed from the caller's session when it nears expiry or
+ * a concealed 404 suggests it went stale. Every token ever held is tracked so
+ * cleanup and npm output can redact it.
+ */
+import { type RuntimeRef } from "@vibesdotdev/kernel";
+import { type ReleaseConsumerSourceRegistry } from "./proof-registry.ts";
+/** The proof's source-registry credentials. */
+export type ProofSourceCredentials = {
+    /** Every token held during the proof (initial and renewed), for redaction. */
+    readonly redactValues: string[];
+    /** The source registry with the current token of each origin. */
+    sourceRegistryWithCurrentTokens(override?: readonly [registry: string, token: string][]): ReleaseConsumerSourceRegistry;
+    /**
+     * Renew `registry`'s token when it nears expiry (or, with `force`, when the
+     * caller saw a concealed 404). Rewrites the proof npmrc; true when renewed.
+     */
+    ensureFresh(registry: string, refreshOptions?: {
+        force?: boolean;
+    }): Promise<boolean>;
+};
+/**
+ * Validate the source registry's tokens and renewers against its configured
+ * origins, and return the renewable credential set the proof reads through.
+ */
+export declare function createProofSourceCredentials(options: {
+    /** The runtime whose logger reports a token that does not decode or a scratch file a write could not scrub. */
+    runtime: RuntimeRef;
+    sourceRegistry: ReleaseConsumerSourceRegistry;
+    /** The proof npmrc a renewal rewrites; resolved lazily, after validation. */
+    npmrcPath: () => string;
+    now?: () => number;
+}): ProofSourceCredentials;
+/**
+ * Write a consumer's source-registry npmrc with each session read credential
+ * renewed first when it nears expiry. A release reaches its consumer installs
+ * long after it resolved the credential, and the Registry answers an expired
+ * one with a concealed 404 for every package.
+ */
+export declare function writeFreshReleaseConsumerSourceNpmrc(npmrcPath: string, sourceRegistry: ReleaseConsumerSourceRegistry, runtime: RuntimeRef, now?: () => number): Promise<void>;
+//# sourceMappingURL=proof-source-credentials.d.ts.map

package/dist/cli/npm/publish/proof-source-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof-source-credentials.d.ts","sourceRoot":"","sources":["../../../../src/cli/npm/publish/proof-source-credentials.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAA4B,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEhF,OAAO,EACL,KAAK,6BAA6B,EAEnC,MAAM,qBAAqB,CAAC;AAS7B,+CAA+C;AAC/C,MAAM,MAAM,sBAAsB,GAAG;IACnC,8EAA8E;IAC9E,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAChC,iEAAiE;IACjE,+BAA+B,CAC7B,QAAQ,CAAC,EAAE,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,GACtD,6BAA6B,CAAC;IACjC;;;OAGG;IACH,WAAW,CACT,QAAQ,EAAE,MAAM,EAChB,cAAc,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GACnC,OAAO,CAAC,OAAO,CAAC,CAAC;CACrB,CAAC;AAEF;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE;IACpD,+GAA+G;IAC/G,OAAO,EAAE,UAAU,CAAC;IACpB,cAAc,EAAE,6BAA6B,CAAC;IAC9C,6EAA6E;IAC7E,SAAS,EAAE,MAAM,MAAM,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,GAAG,sBAAsB,CA6IzB;AAED;;;;;GAKG;AACH,wBAAsB,oCAAoC,CACxD,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,6BAA6B,EAC7C,OAAO,EAAE,UAAU,EACnB,GAAG,CAAC,EAAE,MAAM,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAgBf"}

package/dist/cli/npm/publish/proof-source-credentials.js

@@ -0,0 +1,129 @@
+/**
+ * Read credentials for the release proof's source registries: one token per
+ * configured origin, renewed from the caller's session when it nears expiry or
+ * a concealed 404 suggests it went stale. Every token ever held is tracked so
+ * cleanup and npm output can redact it.
+ */
+import { settle, valueFreeFailure } from "@vibesdotdev/kernel";
+import { readString } from "./command-options.js";
+import { writeReleaseConsumerSourceNpmrc, } from "./proof-registry.js";
+import { normalizeRegistryUrl, REGISTRY_SESSION_JWT_MIN_LIFETIME_MS, registryReadCredentialRenewalError, registrySessionJwtClaims, registrySessionJwtContinuityMatches, } from "./registry-credentials.js";
+/**
+ * Validate the source registry's tokens and renewers against its configured
+ * origins, and return the renewable credential set the proof reads through.
+ */
+export function createProofSourceCredentials(options) {
+    const { sourceRegistry } = options;
+    const configuredSourceRegistries = new Set([
+        normalizeRegistryUrl(sourceRegistry.defaultRegistry),
+        ...Object.values(sourceRegistry.scopedRegistries ?? {}).map(normalizeRegistryUrl),
+    ]);
+    const sourceTokens = new Map();
+    for (const [registry, rawToken] of Object.entries(sourceRegistry.tokensByRegistry ?? {})) {
+        const token = readString(rawToken);
+        if (!token)
+            continue;
+        const normalizedRegistry = normalizeRegistryUrl(registry);
+        if (!configuredSourceRegistries.has(normalizedRegistry)) {
+            throw new Error(`Release consumer proof refused a read credential for unconfigured Registry origin ${normalizedRegistry}`);
+        }
+        const prior = sourceTokens.get(normalizedRegistry);
+        if (prior && prior !== token) {
+            throw new Error(`Release consumer proof received multiple read credentials for Registry origin ${normalizedRegistry}`);
+        }
+        sourceTokens.set(normalizedRegistry, token);
+    }
+    const sourceRenewers = new Map();
+    const managerMintedSourceTokens = new Map();
+    for (const [registry, renew] of Object.entries(sourceRegistry.renewSessionTokensByRegistry ?? {})) {
+        const normalizedRegistry = normalizeRegistryUrl(registry);
+        if (!configuredSourceRegistries.has(normalizedRegistry)) {
+            throw new Error(`Release consumer proof refused session renewal for unconfigured Registry origin ${normalizedRegistry}`);
+        }
+        if (!sourceTokens.has(normalizedRegistry)) {
+            throw new Error(`Release consumer proof session renewal for ${normalizedRegistry} has no initial read credential`);
+        }
+        sourceRenewers.set(normalizedRegistry, renew);
+    }
+    const redactValues = [...new Set(sourceTokens.values())];
+    const sourceRegistryWithCurrentTokens = (override) => {
+        const current = {
+            defaultRegistry: sourceRegistry.defaultRegistry,
+            tokensByRegistry: Object.fromEntries(override ? new Map([...sourceTokens, ...override]) : sourceTokens),
+        };
+        if (sourceRegistry.scopedRegistries) {
+            current.scopedRegistries = sourceRegistry.scopedRegistries;
+        }
+        return current;
+    };
+    const ensureFresh = async (registry, refreshOptions = {}) => {
+        const normalizedRegistry = normalizeRegistryUrl(registry);
+        const renew = sourceRenewers.get(normalizedRegistry);
+        if (!renew)
+            return false;
+        const currentToken = sourceTokens.get(normalizedRegistry);
+        const currentClaims = currentToken
+            ? registrySessionJwtClaims(currentToken, options.runtime)
+            : undefined;
+        if (!currentToken || !currentClaims) {
+            throw registryReadCredentialRenewalError(normalizedRegistry, "cannot identify the current session JWT");
+        }
+        const nowMs = (options.now ?? Date.now)();
+        if (refreshOptions.force &&
+            managerMintedSourceTokens.get(normalizedRegistry) === currentToken &&
+            currentClaims.expiresAtMs > nowMs + REGISTRY_SESSION_JWT_MIN_LIFETIME_MS) {
+            return false;
+        }
+        if (!refreshOptions.force &&
+            currentClaims.expiresAtMs > nowMs + REGISTRY_SESSION_JWT_MIN_LIFETIME_MS) {
+            return false;
+        }
+        const renewed = await settle(renew);
+        if (!renewed.ok) {
+            throw registryReadCredentialRenewalError(normalizedRegistry, "failed", valueFreeFailure(renewed.cause));
+        }
+        const renewedToken = readString(renewed.value);
+        if (renewedToken && !redactValues.includes(renewedToken)) {
+            redactValues.push(renewedToken);
+        }
+        const renewedClaims = renewedToken
+            ? registrySessionJwtClaims(renewedToken, options.runtime)
+            : undefined;
+        if (!renewedToken || !renewedClaims) {
+            throw registryReadCredentialRenewalError(normalizedRegistry, "returned no signed JWT");
+        }
+        if (!registrySessionJwtContinuityMatches(currentClaims, renewedClaims)) {
+            throw registryReadCredentialRenewalError(normalizedRegistry, "returned different session authority");
+        }
+        if (renewedClaims.expiresAtMs <=
+            nowMs + REGISTRY_SESSION_JWT_MIN_LIFETIME_MS) {
+            throw registryReadCredentialRenewalError(normalizedRegistry, "returned another stale JWT");
+        }
+        await writeReleaseConsumerSourceNpmrc(options.npmrcPath(), sourceRegistryWithCurrentTokens([[normalizedRegistry, renewedToken]]), options.runtime);
+        sourceTokens.set(normalizedRegistry, renewedToken);
+        managerMintedSourceTokens.set(normalizedRegistry, renewedToken);
+        return true;
+    };
+    return { redactValues, sourceRegistryWithCurrentTokens, ensureFresh };
+}
+/**
+ * Write a consumer's source-registry npmrc with each session read credential
+ * renewed first when it nears expiry. A release reaches its consumer installs
+ * long after it resolved the credential, and the Registry answers an expired
+ * one with a concealed 404 for every package.
+ */
+export async function writeFreshReleaseConsumerSourceNpmrc(npmrcPath, sourceRegistry, runtime, now) {
+    const options = {
+        runtime,
+        sourceRegistry,
+        npmrcPath: () => npmrcPath,
+    };
+    if (now)
+        options.now = now;
+    const credentials = createProofSourceCredentials(options);
+    for (const registry of Object.keys(sourceRegistry.tokensByRegistry ?? {})) {
+        await credentials.ensureFresh(registry);
+    }
+    await writeReleaseConsumerSourceNpmrc(npmrcPath, credentials.sourceRegistryWithCurrentTokens(), runtime);
+}
+//# sourceMappingURL=proof-source-credentials.js.map

package/dist/cli/npm/publish/proof-source-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof-source-credentials.js","sourceRoot":"","sources":["../../../../src/cli/npm/publish/proof-source-credentials.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAmB,MAAM,qBAAqB,CAAC;AAChF,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAEL,+BAA+B,GAChC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,oBAAoB,EACpB,oCAAoC,EACpC,kCAAkC,EAClC,wBAAwB,EACxB,mCAAmC,GACpC,MAAM,2BAA2B,CAAC;AAoBnC;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAO5C;IACC,MAAM,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IACnC,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;QACzC,oBAAoB,CAAC,cAAc,CAAC,eAAe,CAAC;QACpD,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,GAAG,CACzD,oBAAoB,CACrB;KACF,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC/C,KAAK,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAC/C,cAAc,CAAC,gBAAgB,IAAI,EAAE,CACtC,EAAE,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAC1D,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CACb,qFAAqF,kBAAkB,EAAE,CAC1G,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACnD,IAAI,KAAK,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,iFAAiF,kBAAkB,EAAE,CACtG,CAAC;QACJ,CAAC;QACD,YAAY,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,cAAc,GAAG,IAAI,GAAG,EAG3B,CAAC;IACJ,MAAM,yBAAyB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5D,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAC5C,cAAc,CAAC,4BAA4B,IAAI,EAAE,CAClD,EAAE,CAAC;QACF,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAC1D,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CACb,mFAAmF,kBAAkB,EAAE,CACxG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,8CAA8C,kBAAkB,iCAAiC,CAClG,CAAC;QACJ,CAAC;QACD,cAAc,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACzD,MAAM,+BAA+B,GAAG,CACtC,QAAuD,EACxB,EAAE;QACjC,MAAM,OAAO,GAAkC;YAC7C,eAAe,EAAE,cAAc,CAAC,eAAe;YAC/C,gBAAgB,EAAE,MAAM,CAAC,WAAW,CAClC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,YAAY,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAClE;SACF,CAAC;QACF,IAAI,cAAc,CAAC,gBAAgB,EAAE,CAAC;YACpC,OAAO,CAAC,gBAAgB,GAAG,cAAc,CAAC,gBAAgB,CAAC;QAC7D,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IACF,MAAM,WAAW,GAAG,KAAK,EACvB,QAAgB,EAChB,iBAAsC,EAAE,EACtB,EAAE;QACpB,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,MAAM,YAAY,GAAG,YAAY,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAC1D,MAAM,aAAa,GAAG,YAAY;YAChC,CAAC,CAAC,wBAAwB,CAAC,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC;YACzD,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,CAAC,YAAY,IAAI,CAAC,aAAa,EAAE,CAAC;YACpC,MAAM,kCAAkC,CACtC,kBAAkB,EAClB,yCAAyC,CAC1C,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,IACE,cAAc,CAAC,KAAK;YACpB,yBAAyB,CAAC,GAAG,CAAC,kBAAkB,CAAC,KAAK,YAAY;YAClE,aAAa,CAAC,WAAW,GAAG,KAAK,GAAG,oCAAoC,EACxE,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IACE,CAAC,cAAc,CAAC,KAAK;YACrB,aAAa,CAAC,WAAW,GAAG,KAAK,GAAG,oCAAoC,EACxE,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,kCAAkC,CACtC,kBAAkB,EAClB,QAAQ,EACR,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAChC,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,YAAY,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACzD,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAClC,CAAC;QACD,MAAM,aAAa,GAAG,YAAY;YAChC,CAAC,CAAC,wBAAwB,CAAC,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC;YACzD,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,CAAC,YAAY,IAAI,CAAC,aAAa,EAAE,CAAC;YACpC,MAAM,kCAAkC,CACtC,kBAAkB,EAClB,wBAAwB,CACzB,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,mCAAmC,CAAC,aAAa,EAAE,aAAa,CAAC,EAAE,CAAC;YACvE,MAAM,kCAAkC,CACtC,kBAAkB,EAClB,sCAAsC,CACvC,CAAC;QACJ,CAAC;QACD,IACE,aAAa,CAAC,WAAW;YACzB,KAAK,GAAG,oCAAoC,EAC5C,CAAC;YACD,MAAM,kCAAkC,CACtC,kBAAkB,EAClB,4BAA4B,CAC7B,CAAC;QACJ,CAAC;QACD,MAAM,+BAA+B,CACnC,OAAO,CAAC,SAAS,EAAE,EACnB,+BAA+B,CAAC,CAAC,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC,CAAC,EACrE,OAAO,CAAC,OAAO,CAChB,CAAC;QACF,YAAY,CAAC,GAAG,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;QACnD,yBAAyB,CAAC,GAAG,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;QAChE,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,OAAO,EAAE,YAAY,EAAE,+BAA+B,EAAE,WAAW,EAAE,CAAC;AACxE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,SAAiB,EACjB,cAA6C,EAC7C,OAAmB,EACnB,GAAkB;IAElB,MAAM,OAAO,GAAuD;QAClE,OAAO;QACP,cAAc;QACd,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS;KAC3B,CAAC;IACF,IAAI,GAAG;QAAE,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC;IAC3B,MAAM,WAAW,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC;IAC1D,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,gBAAgB,IAAI,EAAE,CAAC,EAAE,CAAC;QAC1E,MAAM,WAAW,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,+BAA+B,CACnC,SAAS,EACT,WAAW,CAAC,+BAA+B,EAAE,EAC7C,OAAO,CACR,CAAC;AACJ,CAAC"}