@wavehouse/chtypes 0.5.2 → 1.0.0

package/dist/ocifetch/http.js

@@ -0,0 +1,549 @@
+/**
+ * The v1 HTTP stack (`docs/guides/fetch-v1.md` §2, §7): one retry table, one
+ * redirect policy, the anonymous bearer-token flow (for mirrors), the system
+ * CA store, and `HTTPS_PROXY`/`NO_PROXY`.
+ *
+ * Deliberately **not** global `fetch`: Node's built-in `fetch` (undici) does
+ * not honor `HTTPS_PROXY` without a process-wide flag. `https.Agent({
+ * proxyEnv })` and `tls.getCACertificates` are both real APIs on the v1 Node
+ * floor (>=22.21) — measured on macOS (Node 22.23.2) during this lane's own
+ * work: `tls.getCACertificates('system')` returns the Keychain roots,
+ * `tls.getCACertificates('default')` returns Node's bundled Mozilla set, and
+ * an `https.Agent({ proxyEnv: process.env })` request to an `https:` origin
+ * issues a `CONNECT` to the host named by `HTTPS_PROXY` before anything else.
+ * The Linux leg of that measurement is `v1-network`'s to make (not yet wired
+ * — lane 0B).
+ */
+import { readFileSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import * as http from 'node:http';
+import * as https from 'node:https';
+import * as tls from 'node:tls';
+import { fileURLToPath } from 'node:url';
+import { CONNECT_TIMEOUT_S, IDLE_READ_TIMEOUT_S, MAX_REDIRECTS, RETRY_AFTER_STATUSES, RETRY_ATTEMPTS, RETRY_FIRST_WAIT_S, RETRY_MULTIPLIER, RETRY_STATUSES, } from './constants.gen.js';
+import { ArtifactCorruptError, SourceForbiddenError, SourceUnauthorizedError, SourceUnreachableError } from './errors.js';
+/**
+ * The ceiling past which a `Retry-After` is refused rather than shortened
+ * (`docs/guides/fetch-v1.md` §7, A6). Not yet pinned by a fixture (lane 0B);
+ * `IDLE_READ_TIMEOUT_S` is this lane's own reasoned choice — the fetch layer
+ * declines to sit idle waiting longer than it would already time out a read
+ * for. **Flag for the merge/integration lane**: adjust this to match
+ * `retry-after-over-budget`'s actual fixture value once it exists.
+ */
+export const RETRY_AFTER_BUDGET_S = IDLE_READ_TIMEOUT_S;
+/**
+ * Runs `attempt` under the shared retry table (`docs/guides/fetch-v1.md`
+ * §7): 5 attempts, waits doubling from 4s, honoring `Retry-After` on 429/503
+ * and refusing one past `RETRY_AFTER_BUDGET_S`. `attempt` returns `{ok:
+ * true}` with its own value already produced as a side effect (buffering a
+ * body, or writing a file) — this loop only decides whether to retry.
+ * `attempt` throwing directly (rather than returning `{ok: false, ...}`)
+ * skips the retry loop entirely — used for a failure that is never
+ * transient, such as an oversize response (`CORRUPT`, never retried).
+ */
+export async function withRetry(clock, attempt) {
+    let last;
+    for (let n = 1; n <= RETRY_ATTEMPTS; n++) {
+        const { outcome, value } = await attempt(n);
+        if (outcome.ok)
+            return value;
+        last = outcome;
+        const isLast = n === RETRY_ATTEMPTS;
+        if (!outcome.retryable || isLast)
+            break;
+        let waitSeconds = RETRY_FIRST_WAIT_S * RETRY_MULTIPLIER ** (n - 1);
+        if (outcome.retryAfterSeconds !== undefined) {
+            if (outcome.retryAfterSeconds > RETRY_AFTER_BUDGET_S) {
+                throw new SourceUnreachableError(`chtypes: Retry-After named ${outcome.retryAfterSeconds}s, past the ${RETRY_AFTER_BUDGET_S}s retry budget; refusing rather than sleeping it`, { retryAfterRefused: outcome.retryAfterSeconds });
+            }
+            waitSeconds = Math.max(0, outcome.retryAfterSeconds);
+        }
+        await clock.sleep(waitSeconds);
+    }
+    const statusPart = last?.status !== undefined ? `, last status ${last.status}` : '';
+    throw new SourceUnreachableError(`chtypes: ${last?.message ?? 'request failed'} (after ${RETRY_ATTEMPTS} attempts${statusPart})`);
+}
+/** Is this status one the retry table retries on 408/429/500/502/503/504? */
+function isRetryableStatus(status) {
+    return RETRY_STATUSES.includes(status);
+}
+/**
+ * A connection-level failure meaning "nothing is answering here at all" —
+ * refused, no route, or DNS failed to resolve a name — as opposed to a
+ * timeout waiting for a slow or stalled peer. The retry table's backoff
+ * schedule is for a peer that IS there but answering badly (a status code,
+ * or a stall); a dead host gets **zero** sleep and fails this base
+ * immediately, so the caller's multi-base loop moves on at once
+ * (`connection-refused-then-next-base`: sleeps `[]`, not `[4]`). A timeout
+ * (this server's own `connect timeout` on a stalled socket, `ETIMEDOUT`,
+ * `ECONNRESET` mid-stream) stays in the normal backoff-and-retry path
+ * (`stall-timeout-retried`: sleeps `[4]`).
+ */
+function isDeadHostError(err) {
+    const code = err?.code;
+    return code === 'ECONNREFUSED' || code === 'ENOTFOUND' || code === 'EAI_AGAIN' || code === 'EHOSTUNREACH' || code === 'ENETUNREACH';
+}
+/**
+ * `Retry-After`, in both forms (`docs/guides/fetch-v1.md` §7): a delta in
+ * seconds, or an HTTP-date, for which the delay is the date minus the
+ * response's own `Date` header (or `clock.now()` when absent).
+ */
+export function parseRetryAfterSeconds(value, responseDateHeader, clock) {
+    const trimmed = value.trim();
+    if (/^\d+$/.test(trimmed))
+        return Number.parseInt(trimmed, 10);
+    const target = Date.parse(trimmed);
+    if (Number.isNaN(target))
+        return undefined;
+    const base = responseDateHeader !== undefined ? Date.parse(responseDateHeader) : Number.NaN;
+    const from = Number.isNaN(base) ? clock.now() : base;
+    return Math.max(0, (target - from) / 1000);
+}
+function flattenHeaders(raw) {
+    const out = {};
+    for (const [k, v] of Object.entries(raw)) {
+        if (v === undefined)
+            continue;
+        out[k.toLowerCase()] = Array.isArray(v) ? v.join(', ') : v;
+    }
+    return out;
+}
+/** The system + bundled CA roots, per `docs/guides/fetch-v1.md` §2. */
+function systemAndDefaultCertificates() {
+    const out = [];
+    try {
+        out.push(...tls.getCACertificates('default'));
+    }
+    catch {
+        // Older runtime without this half of the API: fall back to the platform default.
+    }
+    try {
+        out.push(...tls.getCACertificates('system'));
+    }
+    catch {
+        // No system store reachable (e.g. a minimal container); default-only is still correct.
+    }
+    return out;
+}
+let cachedAgent;
+function httpsAgent() {
+    cachedAgent ??= new https.Agent({
+        // A real, measured Node >=22.21 API — see this file's header comment.
+        proxyEnv: process.env,
+        ca: systemAndDefaultCertificates(),
+    });
+    return cachedAgent;
+}
+let cachedPlainAgent;
+function httpAgent() {
+    cachedPlainAgent ??= new http.Agent({ proxyEnv: process.env });
+    return cachedPlainAgent;
+}
+function isSameOrigin(a, b) {
+    return a.protocol === b.protocol && a.hostname === b.hostname && (a.port || defaultPort(a)) === (b.port || defaultPort(b));
+}
+function defaultPort(u) {
+    return u.protocol === 'https:' ? '443' : '80';
+}
+const USER_AGENT_DEV_VERSION = '0.0.0-dev';
+/** The package's own version, from its `package.json` (one level above `src/` and `dist/` alike). */
+function readPackageVersion() {
+    try {
+        const raw = JSON.parse(readFileSync(new URL('../../package.json', import.meta.url), 'utf8'));
+        const v = raw !== null && typeof raw === 'object' ? raw['version'] : undefined;
+        return typeof v === 'string' && /^[0-9A-Za-z.+-]+$/.test(v) ? v : USER_AGENT_DEV_VERSION;
+    }
+    catch {
+        return USER_AGENT_DEV_VERSION;
+    }
+}
+/**
+ * `chtypes-ts/<version>`, the User-Agent on every request this module makes
+ * (`docs/guides/fetch-v1.md` §2): delivery hosts may refuse a generic library
+ * agent. Never omitted; `0.0.0-dev` when the version cannot be read.
+ */
+export const USER_AGENT = `chtypes-ts/${readPackageVersion()}`;
+/** One connection attempt with no retry and no redirect following — the unit `requestBuffered`/`requestToSink` build on. */
+function rawRequest(url, method, callerHeaders) {
+    // The one place a request is made: manifests, blobs, referrers, tag lists,
+    // token exchanges and every redirect hop come through here, so the agent is
+    // set here and nowhere else. It replaces any caller-supplied one.
+    const headers = {};
+    for (const [k, v] of Object.entries(callerHeaders))
+        if (k.toLowerCase() !== 'user-agent')
+            headers[k] = v;
+    headers['user-agent'] = USER_AGENT;
+    return new Promise((resolve, reject) => {
+        const mod = url.protocol === 'https:' ? https : http;
+        const agent = url.protocol === 'https:' ? httpsAgent() : httpAgent();
+        const req = mod.request(url, {
+            method,
+            agent,
+            headers,
+            timeout: CONNECT_TIMEOUT_S * 1000,
+        }, (res) => {
+            resolve({ status: res.statusCode ?? 0, headers: flattenHeaders(res.headers), stream: res });
+        });
+        req.once('timeout', () => req.destroy(new Error('connect timeout')));
+        req.once('error', reject);
+        req.end();
+    });
+}
+/**
+ * `anonBearerToken` (freshly obtained for this exact host via the mirror
+ * token flow) is always applied when present. `token` (the static
+ * `CHTYPES_DOWNLOAD_TOKEN`) is restricted to `tokenHosts` — an exact-host
+ * allowlist of the configured bases, never "whatever host we happen to be
+ * calling" (`docs/guides/fetch-v1.md` §2).
+ */
+function buildHeaders(url, base, token, tokenHosts, anonBearerToken) {
+    const headers = { ...base };
+    if (anonBearerToken !== undefined) {
+        headers['authorization'] = `Bearer ${anonBearerToken}`;
+    }
+    else if (token !== undefined && tokenHosts !== undefined && tokenHosts.includes(url.host)) {
+        headers['authorization'] = `Bearer ${token}`;
+    }
+    return headers;
+}
+function parseBearerChallenge(headerValue) {
+    if (headerValue === undefined)
+        return undefined;
+    const m = /^\s*Bearer\s+(.*)$/i.exec(headerValue);
+    if (m?.[1] === undefined)
+        return undefined;
+    const params = {};
+    const re = /(\w+)="([^"]*)"/g;
+    let mm = re.exec(m[1]);
+    while (mm !== null) {
+        if (mm[1] !== undefined && mm[2] !== undefined)
+            params[mm[1]] = mm[2];
+        mm = re.exec(m[1]);
+    }
+    if (params['realm'] === undefined)
+        return undefined;
+    return { realm: params['realm'], service: params['service'], scope: params['scope'] };
+}
+/** Fetches an anonymous bearer token from a mirror's realm. `undefined` on any failure — the caller falls back to a plain 401. */
+async function fetchAnonymousToken(challenge, clock) {
+    try {
+        const realm = new URL(challenge.realm);
+        if (challenge.service !== undefined)
+            realm.searchParams.set('service', challenge.service);
+        if (challenge.scope !== undefined)
+            realm.searchParams.set('scope', challenge.scope);
+        const res = await rawRequest(realm, 'GET', {});
+        const body = await drain(res.stream, 1 << 20).catch(() => undefined);
+        void clock;
+        if (body === undefined || res.status !== 200)
+            return undefined;
+        const parsed = JSON.parse(body.toString('utf8'));
+        if (parsed === null || typeof parsed !== 'object')
+            return undefined;
+        const token = parsed['token'] ?? parsed['access_token'];
+        return typeof token === 'string' ? token : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Drains a stream into a `Buffer`. Rejects with `ArtifactCorruptError` (never retryable) past `maxBytes`, or the stream's own error otherwise. */
+function drain(stream, maxBytes) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let total = 0;
+        stream.on('data', (chunk) => {
+            total += chunk.length;
+            if (total > maxBytes) {
+                stream.destroy();
+                reject(new ArtifactCorruptError(`chtypes: response exceeds the ${maxBytes}-byte limit`));
+                return;
+            }
+            chunks.push(chunk);
+        });
+        stream.on('end', () => resolve(Buffer.concat(chunks)));
+        stream.on('error', reject);
+    });
+}
+/**
+ * GET/HEAD a small, fully-buffered object (a manifest, a referrers listing,
+ * `tags/list`, a bundle) — redirects, retries, the anonymous token flow, the
+ * system CA store and the proxy all handled. Throws
+ * `SourceUnauthorizedError`/`SourceForbiddenError` on a 401/403 that survives
+ * (neither code is retryable) and `ArtifactCorruptError` on an oversize body
+ * (never retryable — an oversize response is a content problem, not a
+ * transient one). Any other non-2xx status is returned to the caller to
+ * interpret (404 in particular means different things to a tag and a digest
+ * GET, decided in `oci.ts`).
+ */
+export async function requestBuffered(startUrl, options) {
+    const method = options.method ?? 'GET';
+    return withRetry(options.clock, async () => {
+        let url = new URL(startUrl);
+        const firstOrigin = url;
+        let redirects = 0;
+        let bearerToken;
+        let triedAnonToken = false;
+        let authDropped = false;
+        options.onRequest?.(url.toString());
+        for (;;) {
+            let res;
+            try {
+                const headers = buildHeaders(url, options.headers, authDropped ? undefined : options.token, options.tokenHosts, bearerToken);
+                res = await rawRequest(url, method, headers);
+            }
+            catch (err) {
+                return {
+                    outcome: {
+                        ok: false,
+                        retryable: !isDeadHostError(err),
+                        status: undefined,
+                        retryAfterSeconds: undefined,
+                        message: `${method} ${url.toString()} failed: ${err.message}`,
+                    },
+                };
+            }
+            if (res.status >= 300 && res.status < 400 && res.headers['location'] !== undefined) {
+                res.stream.resume();
+                if (redirects >= MAX_REDIRECTS) {
+                    return {
+                        outcome: {
+                            ok: false,
+                            retryable: false,
+                            status: res.status,
+                            retryAfterSeconds: undefined,
+                            message: `too many redirects (> ${MAX_REDIRECTS}) fetching ${startUrl}`,
+                        },
+                    };
+                }
+                const next = new URL(res.headers['location'], url);
+                redirects += 1;
+                const crossOrigin = !isSameOrigin(firstOrigin, next) || !isSameOrigin(url, next);
+                url = next;
+                if (crossOrigin) {
+                    // Authorization (and our own Bearer token) never survive a cross-origin hop.
+                    authDropped = true;
+                    bearerToken = undefined;
+                }
+                continue;
+            }
+            if (res.status === 401) {
+                const challenge = parseBearerChallenge(res.headers['www-authenticate']);
+                res.stream.resume();
+                if (!triedAnonToken && challenge !== undefined) {
+                    triedAnonToken = true;
+                    const token = await fetchAnonymousToken(challenge, options.clock);
+                    if (token !== undefined) {
+                        bearerToken = token;
+                        continue;
+                    }
+                }
+                throw new SourceUnauthorizedError(`chtypes: ${method} ${startUrl}: 401 from ${url.host}`);
+            }
+            if (res.status === 403) {
+                res.stream.resume();
+                throw new SourceForbiddenError(`chtypes: ${method} ${startUrl}: 403 from ${url.host}`);
+            }
+            if (isRetryableStatus(res.status) || (res.status === 404 && options.retryOn404 === true)) {
+                let retryAfterSeconds;
+                if (RETRY_AFTER_STATUSES.includes(res.status) && res.headers['retry-after'] !== undefined) {
+                    retryAfterSeconds = parseRetryAfterSeconds(res.headers['retry-after'], res.headers['date'], options.clock);
+                }
+                await drain(res.stream, options.maxBytes).catch(() => undefined);
+                return {
+                    outcome: {
+                        ok: false,
+                        retryable: true,
+                        status: res.status,
+                        retryAfterSeconds,
+                        message: `${method} ${url.toString()} returned ${res.status}`,
+                    },
+                };
+            }
+            let body;
+            try {
+                body = await drain(res.stream, options.maxBytes);
+            }
+            catch (err) {
+                if (err instanceof ArtifactCorruptError)
+                    throw err;
+                return {
+                    outcome: {
+                        ok: false,
+                        retryable: true,
+                        status: res.status,
+                        retryAfterSeconds: undefined,
+                        message: `${method} ${url.toString()}: ${err.message}`,
+                    },
+                };
+            }
+            return {
+                outcome: { ok: true, retryable: false, status: res.status, retryAfterSeconds: undefined, message: '' },
+                value: { status: res.status, headers: res.headers, url: url.toString(), body },
+            };
+        }
+    });
+}
+/**
+ * GET a (potentially large) object straight to a sink — the layer blob.
+ * Every retry **restarts the sink from scratch**: a transient failure
+ * partway through a download cannot be resumed, so the caller's sink
+ * (`unpack.ts`'s temp file + hasher) must support `reset()`. `maxBytes`
+ * should be the exact size the manifest's layer descriptor declares —
+ * exceeding it is `ArtifactCorruptError`, never retried, exactly like an
+ * oversize manifest.
+ */
+export async function requestToSink(startUrl, options, sink) {
+    return withRetry(options.clock, async () => {
+        let url = new URL(startUrl);
+        const firstOrigin = url;
+        let redirects = 0;
+        let bearerToken;
+        let triedAnonToken = false;
+        let authDropped = false;
+        options.onRequest?.(url.toString());
+        for (;;) {
+            let res;
+            try {
+                const headers = buildHeaders(url, options.headers, authDropped ? undefined : options.token, options.tokenHosts, bearerToken);
+                res = await rawRequest(url, 'GET', headers);
+            }
+            catch (err) {
+                return {
+                    outcome: {
+                        ok: false,
+                        retryable: !isDeadHostError(err),
+                        status: undefined,
+                        retryAfterSeconds: undefined,
+                        message: `GET ${url.toString()} failed: ${err.message}`,
+                    },
+                };
+            }
+            if (res.status >= 300 && res.status < 400 && res.headers['location'] !== undefined) {
+                res.stream.resume();
+                if (redirects >= MAX_REDIRECTS) {
+                    return {
+                        outcome: {
+                            ok: false,
+                            retryable: false,
+                            status: res.status,
+                            retryAfterSeconds: undefined,
+                            message: `too many redirects (> ${MAX_REDIRECTS}) fetching ${startUrl}`,
+                        },
+                    };
+                }
+                const next = new URL(res.headers['location'], url);
+                redirects += 1;
+                const crossOrigin = !isSameOrigin(firstOrigin, next) || !isSameOrigin(url, next);
+                url = next;
+                if (crossOrigin) {
+                    authDropped = true;
+                    bearerToken = undefined;
+                }
+                continue;
+            }
+            if (res.status === 401) {
+                const challenge = parseBearerChallenge(res.headers['www-authenticate']);
+                res.stream.resume();
+                if (!triedAnonToken && challenge !== undefined) {
+                    triedAnonToken = true;
+                    const token = await fetchAnonymousToken(challenge, options.clock);
+                    if (token !== undefined) {
+                        bearerToken = token;
+                        continue;
+                    }
+                }
+                throw new SourceUnauthorizedError(`chtypes: GET ${startUrl}: 401 from ${url.host}`);
+            }
+            if (res.status === 403) {
+                res.stream.resume();
+                throw new SourceForbiddenError(`chtypes: GET ${startUrl}: 403 from ${url.host}`);
+            }
+            if (isRetryableStatus(res.status) || (res.status === 404 && options.retryOn404 === true)) {
+                let retryAfterSeconds;
+                if (RETRY_AFTER_STATUSES.includes(res.status) && res.headers['retry-after'] !== undefined) {
+                    retryAfterSeconds = parseRetryAfterSeconds(res.headers['retry-after'], res.headers['date'], options.clock);
+                }
+                res.stream.resume();
+                return {
+                    outcome: {
+                        ok: false,
+                        retryable: true,
+                        status: res.status,
+                        retryAfterSeconds,
+                        message: `GET ${url.toString()} returned ${res.status}`,
+                    },
+                };
+            }
+            if (res.status !== 200 && res.status !== 206) {
+                res.stream.resume();
+                return {
+                    outcome: { ok: true, retryable: false, status: res.status, retryAfterSeconds: undefined, message: '' },
+                    value: { status: res.status, headers: res.headers, url: url.toString(), size: 0 },
+                };
+            }
+            sink.reset();
+            let size = 0;
+            let oversize = false;
+            try {
+                await new Promise((resolve, reject) => {
+                    res.stream.on('data', (chunk) => {
+                        size += chunk.length;
+                        if (size > options.maxBytes) {
+                            oversize = true;
+                            res.stream.destroy();
+                            reject(new ArtifactCorruptError(`chtypes: layer exceeds the ${options.maxBytes}-byte limit`));
+                            return;
+                        }
+                        sink.write(chunk);
+                    });
+                    res.stream.on('end', resolve);
+                    res.stream.on('error', reject);
+                });
+            }
+            catch (err) {
+                if (oversize)
+                    throw err;
+                return {
+                    outcome: {
+                        ok: false,
+                        retryable: true,
+                        status: res.status,
+                        retryAfterSeconds: undefined,
+                        message: `GET ${url.toString()}: ${err.message}`,
+                    },
+                };
+            }
+            return {
+                outcome: { ok: true, retryable: false, status: res.status, retryAfterSeconds: undefined, message: '' },
+                value: { status: res.status, headers: res.headers, url: url.toString(), size },
+            };
+        }
+    });
+}
+/**
+ * Reads a `file://` base directly — no retry, no redirect, no query string
+ * ever appended (a fixture rule: a route tree served from `file://` is a
+ * plain static tree). ENOENT reads as a 404 so callers share one not-found
+ * path across transports. An oversize file is `ArtifactCorruptError`, the
+ * same verdict a too-large network response gets.
+ */
+export async function readFileUrl(url, maxBytes) {
+    const filePath = fileURLToPath(url);
+    try {
+        const body = await readFile(filePath);
+        if (body.length > maxBytes) {
+            throw new ArtifactCorruptError(`chtypes: ${filePath} exceeds the ${maxBytes}-byte limit`);
+        }
+        return { status: 200, headers: {}, url, body };
+    }
+    catch (err) {
+        if (err instanceof ArtifactCorruptError)
+            throw err;
+        if (err.code === 'ENOENT') {
+            return { status: 404, headers: {}, url, body: Buffer.alloc(0) };
+        }
+        throw err;
+    }
+}
+//# sourceMappingURL=http.js.map

package/dist/ocifetch/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/ocifetch/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,KAAK,MAAM,YAAY,CAAC;AACpC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,oBAAoB,EACpB,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,GACf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAG1H;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,mBAAmB,CAAC;AAwCxD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,KAAY,EACZ,OAAmF;IAEnF,IAAI,IAAgC,CAAC;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,cAAc,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;QAC5C,IAAI,OAAO,CAAC,EAAE;YAAE,OAAO,KAAU,CAAC;QAClC,IAAI,GAAG,OAAO,CAAC;QACf,MAAM,MAAM,GAAG,CAAC,KAAK,cAAc,CAAC;QACpC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM;YAAE,MAAM;QACxC,IAAI,WAAW,GAAG,kBAAkB,GAAG,gBAAgB,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACnE,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YAC5C,IAAI,OAAO,CAAC,iBAAiB,GAAG,oBAAoB,EAAE,CAAC;gBACrD,MAAM,IAAI,sBAAsB,CAC9B,8BAA8B,OAAO,CAAC,iBAAiB,eAAe,oBAAoB,kDAAkD,EAC5I,EAAE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,EAAE,CACjD,CAAC;YACJ,CAAC;YACD,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpF,MAAM,IAAI,sBAAsB,CAC9B,YAAY,IAAI,EAAE,OAAO,IAAI,gBAAgB,WAAW,cAAc,YAAY,UAAU,GAAG,CAChG,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAQ,cAAoC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,eAAe,CAAC,GAAY;IACnC,MAAM,IAAI,GAAI,GAAyC,EAAE,IAAI,CAAC;IAC9D,OAAO,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,aAAa,CAAC;AACtI,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAa,EACb,kBAAsC,EACtC,KAAY;IAEZ,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,IAAI,GAAG,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IAC5F,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACrD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,cAAc,CAAC,GAA6B;IACnD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,uEAAuE;AACvE,SAAS,4BAA4B;IACnC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,iFAAiF;IACnF,CAAC;IACD,IAAI,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,uFAAuF;IACzF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,IAAI,WAAoC,CAAC;AACzC,SAAS,UAAU;IACjB,WAAW,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC;QAC9B,sEAAsE;QACtE,QAAQ,EAAE,OAAO,CAAC,GAAG;QACrB,EAAE,EAAE,4BAA4B,EAAE;KACb,CAAC,CAAC;IACzB,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,IAAI,gBAAwC,CAAC;AAC7C,SAAS,SAAS;IAChB,gBAAgB,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAuB,CAAC,CAAC;IACpF,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,SAAS,YAAY,CAAC,CAAM,EAAE,CAAM;IAClC,OAAO,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7H,CAAC;AAED,SAAS,WAAW,CAAC,CAAM;IACzB,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED,MAAM,sBAAsB,GAAG,WAAW,CAAC;AAE3C,qGAAqG;AACrG,SAAS,kBAAkB;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,oBAAoB,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACtG,MAAM,CAAC,GAAG,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAE,GAA+B,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5G,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC;IAC3F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,sBAAsB,CAAC;IAChC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,cAAc,kBAAkB,EAAE,EAAE,CAAC;AAQ/D,4HAA4H;AAC5H,SAAS,UAAU,CAAC,GAAQ,EAAE,MAAsB,EAAE,aAAqC;IACzF,2EAA2E;IAC3E,4EAA4E;IAC5E,kEAAkE;IAClE,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC;QAAE,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,YAAY;YAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACzG,OAAO,CAAC,YAAY,CAAC,GAAG,UAAU,CAAC;IACnC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QACrD,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QACrE,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CACrB,GAAG,EACH;YACE,MAAM;YACN,KAAK;YACL,OAAO;YACP,OAAO,EAAE,iBAAiB,GAAG,IAAI;SAClC,EACD,CAAC,GAAG,EAAE,EAAE;YACN,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9F,CAAC,CACF,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;QACrE,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CACnB,GAAQ,EACR,IAAkD,EAClD,KAAyB,EACzB,UAAyC,EACzC,eAAmC;IAEnC,MAAM,OAAO,GAA2B,EAAE,GAAG,IAAI,EAAE,CAAC;IACpD,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,eAAe,EAAE,CAAC;IACzD,CAAC;SAAM,IAAI,KAAK,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5F,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,KAAK,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAeD,SAAS,oBAAoB,CAAC,WAA+B;IAC3D,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,CAAC,GAAG,qBAAqB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAClD,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,EAAE,GAAG,kBAAkB,CAAC;IAC9B,IAAI,EAAE,GAA2B,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC;QACnB,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QACtE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACpD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;AACxF,CAAC;AAED,kIAAkI;AAClI,KAAK,UAAU,mBAAmB,CAAC,SAA0B,EAAE,KAAY;IACzE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,SAAS,CAAC,OAAO,KAAK,SAAS;YAAE,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;QAC1F,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;QACpF,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACrE,KAAK,KAAK,CAAC;QACX,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAS,CAAC;QAC/D,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1D,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACpE,MAAM,KAAK,GAAI,MAAkC,CAAC,OAAO,CAAC,IAAK,MAAkC,CAAC,cAAc,CAAC,CAAC;QAClH,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,mJAAmJ;AACnJ,SAAS,KAAK,CAAC,MAA4B,EAAE,QAAgB;IAC3D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAClC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;YACtB,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACrB,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,oBAAoB,CAAC,iCAAiC,QAAQ,aAAa,CAAC,CAAC,CAAC;gBACzF,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAgB,EAAE,OAAuB;IAC7E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC;IACvC,OAAO,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QACzC,IAAI,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5B,MAAM,WAAW,GAAG,GAAG,CAAC;QACxB,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,WAA+B,CAAC;QACpC,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,OAAO,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QACpC,SAAS,CAAC;YACR,IAAI,GAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,YAAY,CAC1B,GAAG,EACH,OAAO,CAAC,OAAO,EACf,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EACvC,OAAO,CAAC,UAAU,EAClB,WAAW,CACZ,CAAC;gBACF,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YAC/C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO;oBACL,OAAO,EAAE;wBACP,EAAE,EAAE,KAAK;wBACT,SAAS,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC;wBAChC,MAAM,EAAE,SAAS;wBACjB,iBAAiB,EAAE,SAAS;wBAC5B,OAAO,EAAE,GAAG,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,YAAa,GAAa,CAAC,OAAO,EAAE;qBACzE;iBACF,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;gBACnF,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACpB,IAAI,SAAS,IAAI,aAAa,EAAE,CAAC;oBAC/B,OAAO;wBACL,OAAO,EAAE;4BACP,EAAE,EAAE,KAAK;4BACT,SAAS,EAAE,KAAK;4BAChB,MAAM,EAAE,GAAG,CAAC,MAAM;4BAClB,iBAAiB,EAAE,SAAS;4BAC5B,OAAO,EAAE,yBAAyB,aAAa,cAAc,QAAQ,EAAE;yBACxE;qBACF,CAAC;gBACJ,CAAC;gBACD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC;gBACnD,SAAS,IAAI,CAAC,CAAC;gBACf,MAAM,WAAW,GAAG,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACjF,GAAG,GAAG,IAAI,CAAC;gBACX,IAAI,WAAW,EAAE,CAAC;oBAChB,6EAA6E;oBAC7E,WAAW,GAAG,IAAI,CAAC;oBACnB,WAAW,GAAG,SAAS,CAAC;gBAC1B,CAAC;gBACD,SAAS;YACX,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,MAAM,SAAS,GAAG,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC;gBACxE,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACpB,IAAI,CAAC,cAAc,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;oBAC/C,cAAc,GAAG,IAAI,CAAC;oBACtB,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;oBAClE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;wBACxB,WAAW,GAAG,KAAK,CAAC;wBACpB,SAAS;oBACX,CAAC;gBACH,CAAC;gBACD,MAAM,IAAI,uBAAuB,CAAC,YAAY,MAAM,IAAI,QAAQ,cAAc,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5F,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACpB,MAAM,IAAI,oBAAoB,CAAC,YAAY,MAAM,IAAI,QAAQ,cAAc,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YACzF,CAAC;YACD,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,EAAE,CAAC;gBACzF,IAAI,iBAAqC,CAAC;gBAC1C,IAAK,oBAA0C,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,SAAS,EAAE,CAAC;oBACjH,iBAAiB,GAAG,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC7G,CAAC;gBACD,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBACjE,OAAO;oBACL,OAAO,EAAE;wBACP,EAAE,EAAE,KAAK;wBACT,SAAS,EAAE,IAAI;wBACf,MAAM,EAAE,GAAG,CAAC,MAAM;wBAClB,iBAAiB;wBACjB,OAAO,EAAE,GAAG,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,aAAa,GAAG,CAAC,MAAM,EAAE;qBAC9D;iBACF,CAAC;YACJ,CAAC;YACD,IAAI,IAAY,CAAC;YACjB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YACnD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,oBAAoB;oBAAE,MAAM,GAAG,CAAC;gBACnD,OAAO;oBACL,OAAO,EAAE;wBACP,EAAE,EAAE,KAAK;wBACT,SAAS,EAAE,IAAI;wBACf,MAAM,EAAE,GAAG,CAAC,MAAM;wBAClB,iBAAiB,EAAE,SAAS;wBAC5B,OAAO,EAAE,GAAG,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,KAAM,GAAa,CAAC,OAAO,EAAE;qBAClE;iBACF,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE;gBACtG,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;aAC/E,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAMD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,QAAgB,EAChB,OAAuB,EACvB,IAAmD;IAEnD,OAAO,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QACzC,IAAI,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5B,MAAM,WAAW,GAAG,GAAG,CAAC;QACxB,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,WAA+B,CAAC;QACpC,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,OAAO,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QACpC,SAAS,CAAC;YACR,IAAI,GAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,YAAY,CAC1B,GAAG,EACH,OAAO,CAAC,OAAO,EACf,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EACvC,OAAO,CAAC,UAAU,EAClB,WAAW,CACZ,CAAC;gBACF,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YAC9C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO;oBACL,OAAO,EAAE;wBACP,EAAE,EAAE,KAAK;wBACT,SAAS,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC;wBAChC,MAAM,EAAE,SAAS;wBACjB,iBAAiB,EAAE,SAAS;wBAC5B,OAAO,EAAE,OAAO,GAAG,CAAC,QAAQ,EAAE,YAAa,GAAa,CAAC,OAAO,EAAE;qBACnE;iBACF,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;gBACnF,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACpB,IAAI,SAAS,IAAI,aAAa,EAAE,CAAC;oBAC/B,OAAO;wBACL,OAAO,EAAE;4BACP,EAAE,EAAE,KAAK;4BACT,SAAS,EAAE,KAAK;4BAChB,MAAM,EAAE,GAAG,CAAC,MAAM;4BAClB,iBAAiB,EAAE,SAAS;4BAC5B,OAAO,EAAE,yBAAyB,aAAa,cAAc,QAAQ,EAAE;yBACxE;qBACF,CAAC;gBACJ,CAAC;gBACD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC;gBACnD,SAAS,IAAI,CAAC,CAAC;gBACf,MAAM,WAAW,GAAG,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACjF,GAAG,GAAG,IAAI,CAAC;gBACX,IAAI,WAAW,EAAE,CAAC;oBAChB,WAAW,GAAG,IAAI,CAAC;oBACnB,WAAW,GAAG,SAAS,CAAC;gBAC1B,CAAC;gBACD,SAAS;YACX,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,MAAM,SAAS,GAAG,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC;gBACxE,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACpB,IAAI,CAAC,cAAc,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;oBAC/C,cAAc,GAAG,IAAI,CAAC;oBACtB,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;oBAClE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;wBACxB,WAAW,GAAG,KAAK,CAAC;wBACpB,SAAS;oBACX,CAAC;gBACH,CAAC;gBACD,MAAM,IAAI,uBAAuB,CAAC,gBAAgB,QAAQ,cAAc,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACpB,MAAM,IAAI,oBAAoB,CAAC,gBAAgB,QAAQ,cAAc,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,EAAE,CAAC;gBACzF,IAAI,iBAAqC,CAAC;gBAC1C,IAAK,oBAA0C,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,SAAS,EAAE,CAAC;oBACjH,iBAAiB,GAAG,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC7G,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACpB,OAAO;oBACL,OAAO,EAAE;wBACP,EAAE,EAAE,KAAK;wBACT,SAAS,EAAE,IAAI;wBACf,MAAM,EAAE,GAAG,CAAC,MAAM;wBAClB,iBAAiB;wBACjB,OAAO,EAAE,OAAO,GAAG,CAAC,QAAQ,EAAE,aAAa,GAAG,CAAC,MAAM,EAAE;qBACxD;iBACF,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC7C,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACpB,OAAO;oBACL,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE;oBACtG,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;iBAClF,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;oBAC1C,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;wBACtC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;wBACrB,IAAI,IAAI,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;4BAC5B,QAAQ,GAAG,IAAI,CAAC;4BAChB,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;4BACrB,MAAM,CAAC,IAAI,oBAAoB,CAAC,8BAA8B,OAAO,CAAC,QAAQ,aAAa,CAAC,CAAC,CAAC;4BAC9F,OAAO;wBACT,CAAC;wBACD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBACpB,CAAC,CAAC,CAAC;oBACH,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;oBAC9B,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBACjC,CAAC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,QAAQ;oBAAE,MAAM,GAAG,CAAC;gBACxB,OAAO;oBACL,OAAO,EAAE;wBACP,EAAE,EAAE,KAAK;wBACT,SAAS,EAAE,IAAI;wBACf,MAAM,EAAE,GAAG,CAAC,MAAM;wBAClB,iBAAiB,EAAE,SAAS;wBAC5B,OAAO,EAAE,OAAO,GAAG,CAAC,QAAQ,EAAE,KAAM,GAAa,CAAC,OAAO,EAAE;qBAC5D;iBACF,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE;gBACtG,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;aAC/E,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,QAAgB;IAC7D,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,oBAAoB,CAAC,YAAY,QAAQ,gBAAgB,QAAQ,aAAa,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,oBAAoB;YAAE,MAAM,GAAG,CAAC;QACnD,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/ocifetch/index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * The v1 fetch layer's public surface: the seam (`docs/guides/fetch-v1.md`
+ * §9) and the types a caller needs to use it. Nothing outside this module
+ * imports from `./oci.js`, `./dsse.js`, `./http.js`, `./unpack.js`,
+ * `./layout.js` or `./lock.js` directly — the FFI/loader lane (not yet
+ * built) wires `resolve_installed` and `ensure` in through here once it
+ * lands.
+ */
+export { keyIdOfRawKey } from './dsse.js';
+export { cacheRoot } from './layout.js';
+export { ensure, fetchSigned, listInstalled, listTags, resolveInstalled, verifyInstalled } from './ensure.js';
+export type { FetchSignedResult } from './ensure.js';
+export { ArtifactCorruptError, ArtifactMissingError, ArtifactPinnedError, ArtifactUnpublishedError, ArtifactUntrustedError, FetchV1Error, SourceForbiddenError, SourceIncompatibleError, SourceUnauthorizedError, SourceUnreachableError, } from './errors.js';
+export type { FetchV1ErrorCode } from './errors.js';
+export type { ArtifactPredicate, Clock, FetchV1Options, PlatformKey, Resolved, ResolvedDigests, TrustedKey, VerifyResult, } from './types.js';
+export { hostPlatformKey, isPlatformKey, realClock } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/ocifetch/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ocifetch/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,QAAQ,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9G,YAAY,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,EACtB,YAAY,EACZ,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,YAAY,EACV,iBAAiB,EACjB,KAAK,EACL,cAAc,EACd,WAAW,EACX,QAAQ,EACR,eAAe,EACf,UAAU,EACV,YAAY,GACb,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC"}

package/dist/ocifetch/index.js

@@ -0,0 +1,14 @@
+/**
+ * The v1 fetch layer's public surface: the seam (`docs/guides/fetch-v1.md`
+ * §9) and the types a caller needs to use it. Nothing outside this module
+ * imports from `./oci.js`, `./dsse.js`, `./http.js`, `./unpack.js`,
+ * `./layout.js` or `./lock.js` directly — the FFI/loader lane (not yet
+ * built) wires `resolve_installed` and `ensure` in through here once it
+ * lands.
+ */
+export { keyIdOfRawKey } from './dsse.js';
+export { cacheRoot } from './layout.js';
+export { ensure, fetchSigned, listInstalled, listTags, resolveInstalled, verifyInstalled } from './ensure.js';
+export { ArtifactCorruptError, ArtifactMissingError, ArtifactPinnedError, ArtifactUnpublishedError, ArtifactUntrustedError, FetchV1Error, SourceForbiddenError, SourceIncompatibleError, SourceUnauthorizedError, SourceUnreachableError, } from './errors.js';
+export { hostPlatformKey, isPlatformKey, realClock } from './types.js';
+//# sourceMappingURL=index.js.map

package/dist/ocifetch/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/ocifetch/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,QAAQ,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9G,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,EACtB,YAAY,EACZ,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AAYrB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC"}