@vibesdotdev/infra-deploy 0.0.2 → 1.0.0-rc.5

package/dist/cli/npm/put-attested-packument.js

@@ -0,0 +1,353 @@
+/**
+ * First-party PUT of an npm publish document that keeps `_vibes_source`.
+ *
+ * `npm publish` copies package.json into the PUT `versions` map and drops
+ * underscore-prefixed fields. packages.vibes.dev requires the attested stamp
+ * on that JSON body. Build the document from the packed tarball ourselves.
+ */
+import { resolveFileSystemAdapter } from '@vibesdotdev/filesystem';
+import { parseRegistryPublishManifest } from '@vibesdotdev/registry';
+import { CapabilityError, settle, settleNow, valueFreeFailure } from '@vibesdotdev/kernel';
+import { MAX_CAUSE_CHARS, redactCredentials } from '@vibesdotdev/shared/utils';
+import { gt, prerelease, valid } from 'semver';
+import { z } from 'zod/v4';
+/** The npm pack root member. Nested `package.json` files belong to bundled dependencies. */
+const NPM_PACK_MANIFEST = 'package/package.json';
+/** packages.vibes.dev answers every refusal with a value-free `{ error }` body. */
+const RegistryErrorBodySchema = z.object({ error: z.string() });
+/**
+ * The registry's `{ error }` text for a failed response, only when it is
+ * short and reads the same after the shared credential redaction (with the
+ * request's token as a secret). Any other body is never read into a failure.
+ */
+export async function registryErrorText(response, secrets) {
+    const read = await settle(() => response.text());
+    if (!read.ok)
+        return undefined;
+    const decoded = settleNow(() => JSON.parse(read.value));
+    if (!decoded.ok)
+        return undefined;
+    const body = RegistryErrorBodySchema.safeParse(decoded.value);
+    if (!body.success)
+        return undefined;
+    const text = body.data.error;
+    if (text.length === 0 || text.length > MAX_CAUSE_CHARS)
+        return undefined;
+    return redactCredentials(text, secrets) === text ? text : undefined;
+}
+export function registryRefusalDetails(response, secrets) {
+    const details = { status: response.status };
+    const retryAfter = response.headers.get('retry-after');
+    if (retryAfter !== null && /^[\w ,:-]{1,64}$/.test(retryAfter))
+        details.retryAfter = retryAfter;
+    const contentType = response.headers.get('content-type')?.split(';')[0]?.trim();
+    if (contentType)
+        details.contentType = contentType;
+    const notice = response.headers.get('npm-notice');
+    if (notice !== null && notice.length <= MAX_CAUSE_CHARS && redactCredentials(notice, secrets) === notice)
+        details.notice = notice;
+    return details;
+}
+export function tarballFilename(name, version) {
+    const unscoped = name.includes('/') ? name.split('/')[1] : name;
+    return `${unscoped}-${version}.tgz`;
+}
+async function gunzip(gzipBytes) {
+    const body = new Response(new Uint8Array(gzipBytes)).body;
+    if (body === null)
+        throw new Error('gzip body is missing');
+    const tar = body.pipeThrough(new DecompressionStream('gzip'));
+    return new Uint8Array(await new Response(tar).arrayBuffer());
+}
+export async function extractPackageJsonFromTgz(gzipBytes) {
+    const tarBytes = await gunzip(gzipBytes);
+    const decoder = new TextDecoder();
+    let manifestText;
+    let offset = 0;
+    while (offset + 512 <= tarBytes.length) {
+        const header = tarBytes.subarray(offset, offset + 512);
+        if (header.every((byte) => byte === 0))
+            break;
+        const name = readTarString(header, 0, 100);
+        const prefix = readTarString(header, 345, 155);
+        const fullName = (prefix ? `${prefix}/${name}` : name).replace(/^\.\//, '');
+        const size = readTarOctal(header, 124, 12);
+        const type = header[156];
+        const dataStart = offset + 512;
+        const dataEnd = dataStart + size;
+        if (dataEnd > tarBytes.length) {
+            throw new Error(`invalid tar entry size for ${fullName}`);
+        }
+        if ((type === 0 || type === 48) && fullName === NPM_PACK_MANIFEST) {
+            if (manifestText !== undefined) {
+                throw new CapabilityError(`packed tarball has duplicate ${NPM_PACK_MANIFEST}`, 'INVALID_INPUT', {
+                    reason: 'tarball-manifest-invalid'
+                });
+            }
+            manifestText = decoder.decode(tarBytes.subarray(dataStart, dataEnd));
+        }
+        offset = dataStart + Math.ceil(size / 512) * 512;
+    }
+    if (manifestText === undefined)
+        throw new Error('packed tarball has no package.json');
+    const decoded = settleNow(() => JSON.parse(manifestText));
+    if (!decoded.ok) {
+        throw new CapabilityError('packed package.json is not valid JSON', 'INVALID_INPUT', {
+            reason: 'registry-manifest-invalid',
+            cause: valueFreeFailure(decoded.cause)
+        });
+    }
+    return parseRegistryPublishManifest(decoded.value);
+}
+function readTarString(bytes, offset, length) {
+    const end = offset + length;
+    let actualEnd = offset;
+    while (actualEnd < end && bytes[actualEnd] !== 0)
+        actualEnd++;
+    return new TextDecoder().decode(bytes.subarray(offset, actualEnd));
+}
+function readTarOctal(bytes, offset, length) {
+    const raw = readTarString(bytes, offset, length).trim();
+    if (!raw)
+        return 0;
+    const parsed = Number.parseInt(raw, 8);
+    if (!Number.isFinite(parsed))
+        throw new Error(`invalid tar octal size: ${raw}`);
+    return parsed;
+}
+export function bytesToBase64(bytes) {
+    let binary = '';
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary);
+}
+/** Default dist-tag when no explicit tag is supplied: `rc` for prereleases, `latest` for stable releases. */
+export function defaultDistTagForVersion(version) {
+    return prerelease(version) !== null ? 'rc' : 'latest';
+}
+export async function buildAttestedPublishPayload(options) {
+    const manifest = await extractPackageJsonFromTgz(options.tarball);
+    if (!manifest.name || !manifest.version) {
+        throw new Error('packed package.json is missing name or version');
+    }
+    const name = manifest.name;
+    const version = manifest.version;
+    if (!manifest._vibes_source?.repo || !manifest._vibes_source.sha || !manifest._vibes_source.workspaceDigest) {
+        throw new Error(`packed ${name}@${version} is missing _vibes_source {repo, sha, workspaceDigest}`);
+    }
+    const attested = { ...manifest, name, version };
+    const file = tarballFilename(name, version);
+    const registry = options.registry.replace(/\/$/, '');
+    const tarballUrl = `${registry}/${name}/-/${file}`;
+    const resolvedTag = options.tag ?? defaultDistTagForVersion(version);
+    const payload = {
+        _id: name,
+        name,
+        'dist-tags': { [resolvedTag]: version },
+        versions: {
+            [version]: {
+                ...attested,
+                dist: { ...options.dist, tarball: tarballUrl }
+            }
+        },
+        _attachments: {
+            [file]: {
+                content_type: 'application/octet-stream',
+                data: bytesToBase64(options.tarball),
+                length: options.tarball.byteLength
+            }
+        }
+    };
+    if (options.access)
+        payload.access = options.access;
+    return {
+        name,
+        version,
+        payload,
+        url: `${registry}/${encodeURIComponent(name)}`
+    };
+}
+export async function putAttestedPackument(options) {
+    const tarball = 'bytes' in options.tarball
+        ? options.tarball.bytes
+        : z.instanceof(Uint8Array).parse(await (await resolveFileSystemAdapter(options.runtime, { binding: false })).readFile(options.tarball.path));
+    const built = await buildAttestedPublishPayload({
+        tarball,
+        registry: options.registry,
+        tag: options.tag,
+        access: options.access,
+        dist: options.dist
+    });
+    const fetchImpl = options.fetchImpl ?? fetch;
+    // `latest` names the current stable release line. A non-`latest` publish that displaces `latest`
+    // (see `latestDisplacedBy`) moves `latest` in the same PUT; prereleases never displace `latest`.
+    const resolvedTag = options.tag ?? defaultDistTagForVersion(built.version);
+    let latestTag = { state: 'unchanged' };
+    if (resolvedTag !== 'latest') {
+        const read = await settle(() => readDistTags({ ...options, fetchImpl, name: built.name }));
+        if (!read.ok)
+            latestTag = { state: 'unread', failure: valueFreeFailure(read.cause) };
+        else if (latestDisplacedBy(read.value.latest, built.version)) {
+            built.payload['dist-tags'].latest = built.version;
+            latestTag = { state: 'moved' };
+        }
+    }
+    const response = await writeWithSecondFactor({
+        runtime: options.runtime,
+        url: built.url,
+        body: JSON.stringify(built.payload),
+        token: options.token,
+        otp: options.otp,
+        webAuth: options.webAuth,
+        fetchImpl
+    });
+    if (!response.ok) {
+        const details = registryRefusalDetails(response, [options.token]);
+        const registryError = await registryErrorText(response, [options.token]);
+        const said = registryError === undefined ? '' : `: ${registryError}`;
+        throw new CapabilityError(`Attested publish PUT ${built.name}@${built.version} failed (${response.status})${said}`, 'UNAVAILABLE', {
+            reason: 'registry-put-failed',
+            // The registry sends `retry-after` only with its bounded-CAS 409; every other 409 is final.
+            // A rate limit or a server failure may run again; a retry after a PUT that did store is
+            // refused as an existing version, which the publisher skips.
+            retryable: (response.status === 409 && response.headers.has('retry-after')) || response.status === 429 || response.status >= 500,
+            details
+        });
+    }
+    return { name: built.name, version: built.version, status: response.status, latestTag };
+}
+const WebAuthChallengeSchema = z.object({ authUrl: z.string().url(), doneUrl: z.string().url() });
+const WebAuthDoneSchema = z.object({ token: z.string().min(1) });
+const ObjectBodySchema = z.looseObject({});
+/** The approval and wait URLs a 401 names when the registry offers its web second factor. */
+async function webAuthChallenge(response) {
+    const read = await settle(() => response.json());
+    if (!read.ok)
+        return undefined;
+    const challenge = WebAuthChallengeSchema.safeParse(read.value);
+    return challenge.success ? challenge.data : undefined;
+}
+/**
+ * One registry write (`PUT` of a JSON body) answered with the second factor the
+ * caller holds: a one-time password, or npm's web flow (the write asks for it, a
+ * 401 names the approval URL, `announce` shows it, and the write runs once more
+ * with the token the approval issues). The final response is returned unread.
+ */
+export async function writeWithSecondFactor(options) {
+    const headers = new Headers({
+        authorization: `Bearer ${options.token}`,
+        'content-type': 'application/json',
+        accept: 'application/json'
+    });
+    if (options.otp)
+        headers.set('npm-otp', options.otp);
+    else if (options.webAuth) {
+        for (const [name, value] of Object.entries(webAuthHeaders(options.webAuth)))
+            headers.set(name, value);
+    }
+    const write = () => options.fetchImpl(options.url, { method: 'PUT', headers, body: options.body });
+    const webAuth = options.webAuth;
+    if (webAuth === undefined || options.otp)
+        return write();
+    // Each unanswered approval expires; with `retryOnTimeout` the write asks for a fresh one until it is given.
+    for (;;) {
+        headers.delete('npm-otp');
+        const response = await write();
+        if (response.status !== 401)
+            return response;
+        const challenge = await webAuthChallenge(response.clone());
+        if (challenge === undefined)
+            return response;
+        await response.body?.cancel();
+        await webAuth.announce(challenge.authUrl);
+        const approved = await settle(() => webAuthToken({ ...options, webAuth, doneUrl: challenge.doneUrl }));
+        if (approved.ok) {
+            headers.set('npm-otp', approved.value);
+            return write();
+        }
+        const timedOut = approved.cause instanceof CapabilityError && approved.cause.reason === 'registry-web-auth-timeout';
+        if (!timedOut || webAuth.retryOnTimeout !== true)
+            throw approved.cause;
+    }
+}
+/** The headers npm's client sends with a web second factor (npm-registry-fetch `getHeaders`). */
+function webAuthHeaders(webAuth) {
+    return { 'npm-auth-type': 'web', 'npm-command': 'publish', 'npm-session': webAuth.session };
+}
+/** Waits on `doneUrl` (202 + `retry-after` while pending) for the one-time token the approval issues. */
+async function webAuthToken(options) {
+    const deadline = Date.now() + (options.webAuth.timeoutMs ?? 5 * 60_000);
+    let polls = 0;
+    while (Date.now() < deadline) {
+        const done = await options.fetchImpl(options.doneUrl, {
+            headers: { authorization: `Bearer ${options.token}`, accept: 'application/json', ...webAuthHeaders(options.webAuth) }
+        });
+        polls++;
+        if (done.status === 200) {
+            const body = await settle(() => done.json());
+            const issued = body.ok ? WebAuthDoneSchema.safeParse(body.value) : undefined;
+            if (issued?.success)
+                return issued.data.token;
+            throw new CapabilityError('Web second-factor approval answered 200 without a token', 'UNAVAILABLE', {
+                reason: 'registry-web-auth-invalid',
+                details: {
+                    ...registryRefusalDetails(done, [options.token]),
+                    polls,
+                    fields: Object.keys((body.ok && ObjectBodySchema.safeParse(body.value).data) || {}).sort()
+                }
+            });
+        }
+        const details = { ...registryRefusalDetails(done, [options.token]), polls };
+        await done.body?.cancel();
+        if (done.status !== 202) {
+            throw new CapabilityError(`Web second-factor approval was refused (${done.status})`, 'PERMISSION_DENIED', {
+                reason: 'registry-web-auth-refused',
+                details
+            });
+        }
+        const seconds = Number(done.headers.get('retry-after') ?? '1');
+        await options.runtime.lifecycle.delay(Math.max(1, Number.isFinite(seconds) ? seconds : 1) * 1_000);
+    }
+    throw new CapabilityError(`Web second-factor approval was not seen on doneUrl after ${polls} polls (each 202)`, 'UNAVAILABLE', {
+        reason: 'registry-web-auth-timeout',
+        retryable: true,
+        details: { polls }
+    });
+}
+/**
+ * Whether `published`, released on a tag other than `latest`, displaces the
+ * package's current `latest`. Prereleases (`1.0.0-rc.*`, etc.) are published on
+ * `rc` only and never displace `latest`. A stable release displaces `latest`
+ * when `latest` is absent (or not a version) or when `latest` is an older
+ * prerelease (`gt(published, latest)`). A stable published on another tag never
+ * displaces an existing stable `latest`. The publish PUT and the train's latest
+ * reconcile share this rule.
+ */
+export function latestDisplacedBy(latest, published) {
+    if (!valid(published) || prerelease(published) !== null)
+        return false;
+    if (latest === undefined || !valid(latest))
+        return true;
+    if (prerelease(latest) !== null)
+        return gt(published, latest);
+    return false;
+}
+const DistTagsSchema = z.object({ 'dist-tags': z.record(z.string(), z.string()).default({}) });
+/** The package's current dist-tags; empty for a package the registry does not hold yet. */
+export async function readDistTags(options) {
+    const registry = options.registry.replace(/\/$/, '');
+    const current = await options.fetchImpl(`${registry}/${encodeURIComponent(options.name)}`, {
+        headers: { authorization: `Bearer ${options.token}`, accept: 'application/json' }
+    });
+    if (current.status === 404) {
+        await current.body?.cancel();
+        return {};
+    }
+    if (!current.ok) {
+        const details = registryRefusalDetails(current, [options.token]);
+        const said = await registryErrorText(current, [options.token]);
+        throw new CapabilityError(`Reading ${options.name}'s dist-tags failed (${current.status})${said === undefined ? '' : `: ${said}`}`, 'UNAVAILABLE', { reason: 'registry-dist-tag-read-failed', retryable: current.status === 429 || current.status >= 500, details });
+    }
+    return DistTagsSchema.parse(await current.json())['dist-tags'];
+}
+//# sourceMappingURL=put-attested-packument.js.map

package/dist/cli/npm/put-attested-packument.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"put-attested-packument.js","sourceRoot":"","sources":["../../../src/cli/npm/put-attested-packument.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,4BAA4B,EAAgC,MAAM,uBAAuB,CAAC;AACnG,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAmB,MAAM,qBAAqB,CAAC;AAC5G,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC/E,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAC/C,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAE3B,4FAA4F;AAC5F,MAAM,iBAAiB,GAAG,sBAAsB,CAAC;AAEjD,mFAAmF;AACnF,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAEhE;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAkB,EAAE,OAA0B;IACrF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAClC,MAAM,IAAI,GAAG,uBAAuB,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9D,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;IAC7B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,eAAe;QAAE,OAAO,SAAS,CAAC;IACzE,OAAO,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrE,CAAC;AASD,MAAM,UAAU,sBAAsB,CAAC,QAAkB,EAAE,OAA0B;IACpF,MAAM,OAAO,GAA2B,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACpE,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACvD,IAAI,UAAU,KAAK,IAAI,IAAI,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC;IAChG,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAChF,IAAI,WAAW;QAAE,OAAO,CAAC,WAAW,GAAG,WAAW,CAAC;IACnD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,IAAI,eAAe,IAAI,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM;QAAE,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;IAClI,OAAO,OAAO,CAAC;AAChB,CAAC;AAmBD,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,OAAe;IAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,OAAO,GAAG,QAAQ,IAAI,OAAO,MAAM,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,SAAqB;IAC1C,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1D,IAAI,IAAI,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9D,OAAO,IAAI,UAAU,CAAC,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,SAAqB;IACpE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,IAAI,YAAgC,CAAC;IACrC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,CAAC;QACvD,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC;YAAE,MAAM;QAC9C,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC5E,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,SAAS,GAAG,MAAM,GAAG,GAAG,CAAC;QAC/B,MAAM,OAAO,GAAG,SAAS,GAAG,IAAI,CAAC;QACjC,IAAI,OAAO,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,EAAE,CAAC,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;YACnE,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,IAAI,eAAe,CAAC,gCAAgC,iBAAiB,EAAE,EAAE,eAAe,EAAE;oBAC/F,MAAM,EAAE,0BAA0B;iBAClC,CAAC,CAAC;YACJ,CAAC;YACD,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;IAClD,CAAC;IACD,IAAI,YAAY,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACtF,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,eAAe,CAAC,uCAAuC,EAAE,eAAe,EAAE;YACnF,MAAM,EAAE,2BAA2B;YACnC,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC;SACtC,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,4BAA4B,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,aAAa,CAAC,KAAiB,EAAE,MAAc,EAAE,MAAc;IACvE,MAAM,GAAG,GAAG,MAAM,GAAG,MAAM,CAAC;IAC5B,IAAI,SAAS,GAAG,MAAM,CAAC;IACvB,OAAO,SAAS,GAAG,GAAG,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC;QAAE,SAAS,EAAE,CAAC;IAC9D,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,YAAY,CAAC,KAAiB,EAAE,MAAc,EAAE,MAAc;IACtE,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACxD,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,CAAC;IACnB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;IAChF,OAAO,MAAM,CAAC;AACf,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAiB;IAC9C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACrB,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,wBAAwB,CAAC,OAAe;IACvD,OAAO,UAAU,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;AACvD,CAAC;AAKD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,OAOjD;IACA,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClE,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACjC,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,eAAe,EAAE,CAAC;QAC7G,MAAM,IAAI,KAAK,CACd,UAAU,IAAI,IAAI,OAAO,wDAAwD,CACjF,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAA4B,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACzE,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,GAAG,QAAQ,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC;IACnD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,IAAI,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACrE,MAAM,OAAO,GAA2B;QACvC,GAAG,EAAE,IAAI;QACT,IAAI;QACJ,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE;QACvC,QAAQ,EAAE;YACT,CAAC,OAAO,CAAC,EAAE;gBACV,GAAG,QAAQ;gBACX,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE;aAC9C;SACD;QACD,YAAY,EAAE;YACb,CAAC,IAAI,CAAC,EAAE;gBACP,YAAY,EAAE,0BAA0B;gBACxC,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC;gBACpC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU;aAClC;SACD;KACD,CAAC;IACF,IAAI,OAAO,CAAC,MAAM;QAAE,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IACpD,OAAO;QACN,IAAI;QACJ,OAAO;QACP,OAAO;QACP,GAAG,EAAE,GAAG,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE;KAC9C,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAkB1C;IACA,MAAM,OAAO,GAAG,OAAO,IAAI,OAAO,CAAC,OAAO;QACzC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK;QACvB,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,KAAK,CAC9B,MAAM,CAAC,MAAM,wBAAwB,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAC1G,CAAC;IACJ,MAAM,KAAK,GAAG,MAAM,2BAA2B,CAAC;QAC/C,OAAO;QACP,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI,EAAE,OAAO,CAAC,IAAI;KAClB,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,iGAAiG;IACjG,iGAAiG;IACjG,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,IAAI,wBAAwB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3E,IAAI,SAAS,GAAqB,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IACzD,IAAI,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3F,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,SAAS,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;aAChF,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9D,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC;YAClD,SAAS,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAChC,CAAC;IACF,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC;QAC5C,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;QACnC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS;KACT,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAClE,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACzE,MAAM,IAAI,GAAG,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,aAAa,EAAE,CAAC;QACrE,MAAM,IAAI,eAAe,CACxB,wBAAwB,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,YAAY,QAAQ,CAAC,MAAM,IAAI,IAAI,EAAE,EACxF,aAAa,EACb;YACC,MAAM,EAAE,qBAAqB;YAC7B,4FAA4F;YAC5F,wFAAwF;YACxF,6DAA6D;YAC7D,SAAS,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG;YAChI,OAAO;SACP,CACD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;AACzF,CAAC;AAED,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAClG,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACjE,MAAM,gBAAgB,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;AAE3C,6FAA6F;AAC7F,KAAK,UAAU,gBAAgB,CAAC,QAAgC;IAC/D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,SAAS,GAAG,sBAAsB,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/D,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAQ3C;IACA,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;QAC3B,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE;QACxC,cAAc,EAAE,kBAAkB;QAClC,MAAM,EAAE,kBAAkB;KAC1B,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,GAAG;QAAE,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;SAChD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvG,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACnG,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAChC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG;QAAE,OAAO,KAAK,EAAE,CAAC;IACzD,4GAA4G;IAC5G,SAAS,CAAC;QACT,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC1B,MAAM,QAAQ,GAAG,MAAM,KAAK,EAAE,CAAC;QAC/B,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,QAAQ,CAAC;QAC7C,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;QAC3D,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC;QAC7C,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,MAAM,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACvG,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;YACvC,OAAO,KAAK,EAAE,CAAC;QAChB,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,YAAY,eAAe,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,2BAA2B,CAAC;QACpH,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,cAAc,KAAK,IAAI;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC;IACxE,CAAC;AACF,CAAC;AAcD,iGAAiG;AACjG,SAAS,cAAc,CAAC,OAAuB;IAC9C,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;AAC7F,CAAC;AAED,yGAAyG;AACzG,KAAK,UAAU,YAAY,CAAC,OAM3B;IACA,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;IACxE,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE;YACrD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;SACrH,CAAC,CAAC;QACH,KAAK,EAAE,CAAC;QACR,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7E,IAAI,MAAM,EAAE,OAAO;gBAAE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;YAC9C,MAAM,IAAI,eAAe,CAAC,yDAAyD,EAAE,aAAa,EAAE;gBACnG,MAAM,EAAE,2BAA2B;gBACnC,OAAO,EAAE;oBACR,GAAG,sBAAsB,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;oBAChD,KAAK;oBACL,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;iBAC1F;aACD,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,EAAE,GAAG,sBAAsB,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;QAC5E,MAAM,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAC1B,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACzB,MAAM,IAAI,eAAe,CAAC,2CAA2C,IAAI,CAAC,MAAM,GAAG,EAAE,mBAAmB,EAAE;gBACzG,MAAM,EAAE,2BAA2B;gBACnC,OAAO;aACP,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,CAAC;QAC/D,MAAM,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,IAAI,eAAe,CAAC,4DAA4D,KAAK,mBAAmB,EAAE,aAAa,EAAE;QAC9H,MAAM,EAAE,2BAA2B;QACnC,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,EAAE,KAAK,EAAE;KAClB,CAAC,CAAC;AACJ,CAAC;AAOD;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAA0B,EAAE,SAAiB;IAC9E,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACtE,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,UAAU,CAAC,MAAM,CAAC,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC9D,OAAO,KAAK,CAAC;AACd,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AAE/F,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAmF;IACrH,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,GAAG,QAAQ,IAAI,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE;QAC1F,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;KACjF,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAC7B,OAAO,EAAE,CAAC;IACX,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,sBAAsB,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACjE,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/D,MAAM,IAAI,eAAe,CACxB,WAAW,OAAO,CAAC,IAAI,wBAAwB,OAAO,CAAC,MAAM,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,EACxG,aAAa,EACb,EAAE,MAAM,EAAE,+BAA+B,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,CAChH,CAAC;IACH,CAAC;IACD,OAAO,cAAc,CAAC,KAAK,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;AAChE,CAAC"}

package/dist/cli/npm/reconcile-latest.d.ts

@@ -0,0 +1,55 @@
+/**
+ * The release train's `latest` reconcile. After a train publishes, each graph
+ * package whose registry `latest` is displaced (`latestDisplacedBy`, the same
+ * rule the publish PUT applies) by its newest version on the release tag has
+ * `latest` moved through the registry's dist-tag operation, leaves first.
+ *
+ * Authority is the caller's: the bearer token is the one its publish ran
+ * under. A registry refusal (with its status and `{ error }` text) or a failed
+ * read is reported for that package, never retried around, and the reconcile
+ * continues with the next package.
+ */
+import { valueFreeFailure } from '@vibesdotdev/kernel';
+/** What the reconcile did to one package's `latest`. */
+export type LatestReconcileOutcome = {
+    name: string;
+    state: 'moved';
+    from: string | undefined;
+    to: string;
+} | {
+    name: string;
+    state: 'unchanged';
+    latest: string | undefined;
+    release: string;
+} | {
+    name: string;
+    state: 'untagged';
+}
+/** The registry answered the dist-tag operation with a refusal: its status and `{ error }` text. */
+ | {
+    name: string;
+    state: 'refused';
+    release: string;
+    status: number;
+    error: string | undefined;
+}
+/** The packument read or the request itself failed. */
+ | {
+    name: string;
+    state: 'failed';
+    failure: ReturnType<typeof valueFreeFailure>;
+};
+/**
+ * Reconcile `latest` for `packages`, which must be in dependency order
+ * (leaves first, as a release plan's `publishOrder` is). Each package is read
+ * and, when displaced, moved before the next is touched.
+ */
+export declare function reconcileLatestDistTags(options: {
+    registry: string;
+    token: string;
+    /** The release tag the train published on (e.g. `rc`). */
+    tag: string;
+    packages: readonly string[];
+    fetchImpl?: typeof fetch;
+}): Promise<LatestReconcileOutcome[]>;
+//# sourceMappingURL=reconcile-latest.d.ts.map

package/dist/cli/npm/reconcile-latest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile-latest.d.ts","sourceRoot":"","sources":["../../../src/cli/npm/reconcile-latest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAA2B,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAGhF,wDAAwD;AACxD,MAAM,MAAM,sBAAsB,GAC/B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACtE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACjF;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE;AACrC,oGAAoG;GAClG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE;AAChG,uDAAuD;GACrD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAA;CAAE,CAAC;AAEnF;;;;GAIG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,0DAA0D;IAC1D,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CACzB,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAcpC"}

package/dist/cli/npm/reconcile-latest.js

@@ -0,0 +1,59 @@
+/**
+ * The release train's `latest` reconcile. After a train publishes, each graph
+ * package whose registry `latest` is displaced (`latestDisplacedBy`, the same
+ * rule the publish PUT applies) by its newest version on the release tag has
+ * `latest` moved through the registry's dist-tag operation, leaves first.
+ *
+ * Authority is the caller's: the bearer token is the one its publish ran
+ * under. A registry refusal (with its status and `{ error }` text) or a failed
+ * read is reported for that package, never retried around, and the reconcile
+ * continues with the next package.
+ */
+import { CapabilityError, settle, valueFreeFailure } from '@vibesdotdev/kernel';
+import { latestDisplacedBy, readDistTags, registryErrorText } from "./put-attested-packument.js";
+/**
+ * Reconcile `latest` for `packages`, which must be in dependency order
+ * (leaves first, as a release plan's `publishOrder` is). Each package is read
+ * and, when displaced, moved before the next is touched.
+ */
+export async function reconcileLatestDistTags(options) {
+    if (options.tag === 'latest') {
+        throw new CapabilityError('The latest reconcile reads a release tag other than latest.', 'INVALID_INPUT', {
+            reason: 'latest-reconcile-tag-invalid'
+        });
+    }
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const registry = options.registry.replace(/\/$/, '');
+    const outcomes = [];
+    for (const name of options.packages) {
+        const reconciled = await settle(() => reconcileOne({ ...options, registry, fetchImpl, name }));
+        outcomes.push(reconciled.ok ? reconciled.value : { name, state: 'failed', failure: valueFreeFailure(reconciled.cause) });
+    }
+    return outcomes;
+}
+async function reconcileOne(options) {
+    const { name } = options;
+    const tags = await readDistTags(options);
+    const release = tags[options.tag];
+    if (release === undefined)
+        return { name, state: 'untagged' };
+    const latest = tags.latest;
+    if (!latestDisplacedBy(latest, release))
+        return { name, state: 'unchanged', latest, release };
+    const response = await options.fetchImpl(`${options.registry}/-/package/${encodeURIComponent(name)}/dist-tags/latest`, {
+        method: 'PUT',
+        headers: {
+            authorization: `Bearer ${options.token}`,
+            'content-type': 'application/json',
+            accept: 'application/json'
+        },
+        body: JSON.stringify(release)
+    });
+    if (!response.ok) {
+        const error = await registryErrorText(response, [options.token]);
+        return { name, state: 'refused', release, status: response.status, error };
+    }
+    await response.body?.cancel();
+    return { name, state: 'moved', from: latest, to: release };
+}
+//# sourceMappingURL=reconcile-latest.js.map

package/dist/cli/npm/reconcile-latest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile-latest.js","sourceRoot":"","sources":["../../../src/cli/npm/reconcile-latest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAYjG;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAO7C;IACA,IAAI,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,eAAe,CAAC,6DAA6D,EAAE,eAAe,EAAE;YACzG,MAAM,EAAE,8BAA8B;SACtC,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,QAAQ,GAA6B,EAAE,CAAC;IAC9C,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrC,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC/F,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC1H,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAM3B;IACA,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IACzB,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC9F,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,SAAS,CACvC,GAAG,OAAO,CAAC,QAAQ,cAAc,kBAAkB,CAAC,IAAI,CAAC,mBAAmB,EAC5E;QACC,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACR,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE;YACxC,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,kBAAkB;SAC1B;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;KAC7B,CACD,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACjE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;IAC5E,CAAC;IACD,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAC9B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;AAC5D,CAAC"}

package/dist/cli/npm/registries/npmjs.package-registry.descriptor.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Public npm. It carries the Vibes Registry's exact bytes (`mirrorOf`), never a
+ * separate pack, and its account asks for a browser second factor on writes.
+ */
+declare const _default: {
+    id: string;
+    kind: "infra/package-registry";
+    registryType: "npm" | "docker" | "maven" | "helm";
+    authRequired: boolean;
+    ssl: boolean;
+    name?: string | undefined;
+    description?: string | undefined;
+    tags?: string[] | undefined;
+    hardware?: string[] | undefined;
+    enabled?: boolean | undefined;
+    priority?: number | undefined;
+    capabilityId?: string | undefined;
+    requiredContext?: string[] | undefined;
+    optionalContext?: string[] | undefined;
+    retention?: string | {
+        reason: string;
+        maxAgeDays?: number | undefined;
+        maxEntries?: number | undefined;
+        maxBytes?: number | undefined;
+        cascadeFrom?: string | undefined;
+        ageField?: string | undefined;
+        enforcedBy?: string | undefined;
+    } | undefined;
+    url?: string | undefined;
+    service?: string | undefined;
+    scope?: string | undefined;
+    upstreamUrl?: string | undefined;
+    env?: {
+        name: string;
+        public?: boolean | undefined;
+        required?: boolean | undefined;
+        value?: string | undefined;
+        secret?: boolean | undefined;
+        description?: string | undefined;
+        storeKey?: string | undefined;
+        storeBinding?: boolean | undefined;
+    }[] | undefined;
+    publish?: {
+        credential: {
+            secret: string;
+        };
+        secondFactor: "web" | "none" | "otp";
+        mirrorOf?: string | undefined;
+    } | undefined;
+    config?: {
+        [x: string]: unknown;
+        adapter: string;
+    } | undefined;
+};
+export default _default;
+//# sourceMappingURL=npmjs.package-registry.descriptor.d.ts.map

package/dist/cli/npm/registries/npmjs.package-registry.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"npmjs.package-registry.descriptor.d.ts","sourceRoot":"","sources":["../../../../src/cli/npm/registries/npmjs.package-registry.descriptor.ts"],"names":[],"mappings":"AAEA;;;GAGG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACH,wBASG"}

package/dist/cli/npm/registries/npmjs.package-registry.descriptor.js

@@ -0,0 +1,16 @@
+import { PackageRegistryDescriptorSchema } from '@vibesdotdev/infra-core';
+/**
+ * Public npm. It carries the Vibes Registry's exact bytes (`mirrorOf`), never a
+ * separate pack, and its account asks for a browser second factor on writes.
+ */
+export default PackageRegistryDescriptorSchema.parse({
+    kind: 'infra/package-registry',
+    id: 'npmjs',
+    name: 'npm',
+    url: 'https://registry.npmjs.org',
+    registryType: 'npm',
+    authRequired: false,
+    publish: { credential: { secret: 'NPM_TOKEN' }, secondFactor: 'web', mirrorOf: 'vibes-registry' },
+    config: { adapter: 'npm-protocol' }
+});
+//# sourceMappingURL=npmjs.package-registry.descriptor.js.map

package/dist/cli/npm/registries/npmjs.package-registry.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"npmjs.package-registry.descriptor.js","sourceRoot":"","sources":["../../../../src/cli/npm/registries/npmjs.package-registry.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,yBAAyB,CAAC;AAE1E;;;GAGG;AACH,eAAe,+BAA+B,CAAC,KAAK,CAAC;IACpD,IAAI,EAAE,wBAAwB;IAC9B,EAAE,EAAE,OAAO;IACX,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,4BAA4B;IACjC,YAAY,EAAE,KAAK;IACnB,YAAY,EAAE,KAAK;IACnB,OAAO,EAAE,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE;IACjG,MAAM,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;CACnC,CAAC,CAAC"}

package/dist/cli/npm/registries/package-registries.plugin.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@vibesdotdev/kernel").RuntimePlugin;
+export default _default;
+//# sourceMappingURL=package-registries.plugin.d.ts.map

package/dist/cli/npm/registries/package-registries.plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-registries.plugin.d.ts","sourceRoot":"","sources":["../../../../src/cli/npm/registries/package-registries.plugin.ts"],"names":[],"mappings":";AAyBA,wBAoBG"}

package/dist/cli/npm/registries/package-registries.plugin.js

@@ -0,0 +1,44 @@
+/**
+ * The package registries a Vibes release writes to, as `infra/package-registry`
+ * descriptors, each with the npm-protocol implementation registered under its id.
+ * A workspace declares another npm-protocol registry the same way: a descriptor
+ * plus a loader that calls `createNpmProtocolPackageRegistry`.
+ */
+import { CapabilityError, createRuntimeImplementation, createRuntimePlugin, VibesRuntime } from '@vibesdotdev/kernel';
+import { PackageRegistryDescriptorSchema } from '@vibesdotdev/infra-core';
+import vibesRegistry from "./vibes-registry.package-registry.descriptor.js";
+import npmjs from "./npmjs.package-registry.descriptor.js";
+const registries = [vibesRegistry, npmjs];
+/** The npm-protocol implementation loads only when a registry resolves. */
+const loadNpmProtocolRegistry = () => import("../npm-protocol-package-registry.js");
+function hostRuntime(resolving, registered) {
+    const runtime = resolving ?? registered;
+    if (runtime instanceof VibesRuntime)
+        return runtime;
+    throw new CapabilityError('A package registry needs the full runtime that resolves it.', 'UNAVAILABLE', {
+        reason: 'runtime-unavailable',
+        details: { owner: 'infra-deploy/package-registries' }
+    });
+}
+export default createRuntimePlugin({
+    id: 'infra-deploy.package-registries',
+    name: 'Package registries',
+    descriptors: registries,
+    onRegister(runtime) {
+        for (const descriptor of registries) {
+            runtime.registerLoader('infra/package-registry', descriptor.id, async (resolving) => {
+                const { createNpmProtocolPackageRegistry } = await loadNpmProtocolRegistry();
+                return createRuntimeImplementation({
+                    id: descriptor.id,
+                    kind: 'infra/package-registry',
+                    priority: 10,
+                    implementation: createNpmProtocolPackageRegistry({
+                        descriptor: PackageRegistryDescriptorSchema.parse(descriptor),
+                        runtime: hostRuntime(resolving, runtime)
+                    })
+                });
+            });
+        }
+    }
+});
+//# sourceMappingURL=package-registries.plugin.js.map

package/dist/cli/npm/registries/package-registries.plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-registries.plugin.js","sourceRoot":"","sources":["../../../../src/cli/npm/registries/package-registries.plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,eAAe,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,YAAY,EAAmB,MAAM,qBAAqB,CAAC;AACvI,OAAO,EAAE,+BAA+B,EAAkC,MAAM,yBAAyB,CAAC;AAC1G,OAAO,aAAa,MAAM,iDAAiD,CAAC;AAC5E,OAAO,KAAK,MAAM,wCAAwC,CAAC;AAE3D,MAAM,UAAU,GAAgC,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;AAEvE,2EAA2E;AAC3E,MAAM,uBAAuB,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,qCAAqC,CAAC,CAAC;AAEpF,SAAS,WAAW,CAAC,SAAmC,EAAE,UAAsB;IAC/E,MAAM,OAAO,GAAG,SAAS,IAAI,UAAU,CAAC;IACxC,IAAI,OAAO,YAAY,YAAY;QAAE,OAAO,OAAO,CAAC;IACpD,MAAM,IAAI,eAAe,CAAC,6DAA6D,EAAE,aAAa,EAAE;QACvG,MAAM,EAAE,qBAAqB;QAC7B,OAAO,EAAE,EAAE,KAAK,EAAE,iCAAiC,EAAE;KACrD,CAAC,CAAC;AACJ,CAAC;AAED,eAAe,mBAAmB,CAAC;IAClC,EAAE,EAAE,iCAAiC;IACrC,IAAI,EAAE,oBAAoB;IAC1B,WAAW,EAAE,UAAU;IACvB,UAAU,CAAC,OAAmB;QAC7B,KAAK,MAAM,UAAU,IAAI,UAAU,EAAE,CAAC;YACrC,OAAO,CAAC,cAAc,CAAC,wBAAwB,EAAE,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,SAAwB,EAAE,EAAE;gBAClG,MAAM,EAAE,gCAAgC,EAAE,GAAG,MAAM,uBAAuB,EAAE,CAAC;gBAC7E,OAAO,2BAA2B,CAAC;oBAClC,EAAE,EAAE,UAAU,CAAC,EAAE;oBACjB,IAAI,EAAE,wBAAwB;oBAC9B,QAAQ,EAAE,EAAE;oBACZ,cAAc,EAAE,gCAAgC,CAAC;wBAChD,UAAU,EAAE,+BAA+B,CAAC,KAAK,CAAC,UAAU,CAAC;wBAC7D,OAAO,EAAE,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC;qBACxC,CAAC;iBACF,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;CACD,CAAC,CAAC"}