@wavehouse/chtypes 0.5.2 → 1.0.2

package/dist/ocifetch/types.d.ts

@@ -0,0 +1,167 @@
+/**
+ * Shared types for the v1 fetch layer: the seam (`docs/guides/fetch-v1.md`
+ * §9, the v1 fetch-layer plan's §1.3) and the pieces behind it. Nothing
+ * outside this module imports from anywhere but `index.ts`.
+ */
+import { PLATFORMS } from './constants.gen.js';
+/**
+ * Every `GET …/manifests/<ref>` — by tag or by digest — sends this `Accept`
+ * header (the delivery side's review): our own host ignores it, but a
+ * mirror may need it to answer with the right media type, and a mirror can
+ * be asked for a manifest exactly as our host can.
+ */
+export declare const MANIFEST_ACCEPT_HEADER: string;
+/** One of the three platform keys v1 ships: no darwin-amd64 (A18). */
+export type PlatformKey = (typeof PLATFORMS)[number]['key'];
+/** True for exactly the three v1 platform keys. */
+export declare function isPlatformKey(value: string): value is PlatformKey;
+/** `PLATFORMS`'s row for one key — never `undefined` for a `PlatformKey`. */
+export declare function platformInfo(key: PlatformKey): {
+    readonly key: PlatformKey;
+    readonly os: string;
+    readonly architecture: string;
+};
+/** This host's platform key, or `undefined` when v1 does not ship this os/arch (e.g. darwin-amd64). */
+export declare function hostPlatformKey(osName: string, archName: string): PlatformKey | undefined;
+/** A version request exactly as given: `"26.8"`, `"26.8.15"` or `"26.8.15.10"`. */
+export type VersionRequest = string;
+/** The digests of every object a resolve touched, as the guide's `Resolved` names them. */
+export interface ResolvedDigests {
+    readonly index?: string;
+    readonly manifest: string;
+    readonly layer: string;
+    readonly bundle: string;
+    readonly bundleManifest?: string;
+}
+/**
+ * The signed predicate (`layout-v2.md` §4.1), verified and carried through
+ * **verbatim** — the fetch layer never interprets `abi_fingerprint`,
+ * `library_sha256`, `library_bytes` or `glibc_floor` beyond the checks
+ * `docs/guides/fetch-v1.md` §4 and §5 name.
+ */
+export interface ArtifactPredicate {
+    readonly abi: number;
+    readonly abi_fingerprint: string;
+    readonly clickhouse_version: string;
+    readonly channel: string;
+    readonly clickhouse_minor: string;
+    readonly clickhouse_commit: string;
+    readonly os: string;
+    readonly arch: string;
+    readonly build: string;
+    readonly core_commit: string;
+    readonly inputs_sha256: string;
+    readonly library: string;
+    readonly library_sha256: string;
+    readonly library_bytes: number;
+    readonly glibc_floor?: string;
+}
+/** An in-toto Statement v1, decoded and duplicate-key-checked (`dsse.ts`). */
+export interface Statement {
+    readonly _type: string;
+    readonly subject: readonly {
+        readonly name: string;
+        readonly digest: {
+            readonly sha256: string;
+        };
+    }[];
+    readonly predicateType: string;
+    /** Opaque beyond what `dsse.ts` itself checks; callers of `fetchSigned` read this themselves. */
+    readonly predicate: Readonly<Record<string, unknown>>;
+}
+/** One verified Sigstore bundle's outcome, inside `verifyAnyBundle`. */
+export interface VerifiedBundle {
+    readonly statement: Statement;
+    /** The trusted key id that verified it. */
+    readonly signedBy: string;
+    readonly bundleDigest: string;
+}
+/** What a fetch returns on success (`docs/guides/fetch-v1.md` §9). */
+export interface Resolved {
+    readonly abiGeneration: 1;
+    readonly platform: PlatformKey;
+    readonly request: VersionRequest;
+    readonly version: string;
+    readonly channel?: string;
+    readonly build: string;
+    /** Absolute path to the unpacked library file. */
+    readonly libraryPath: string;
+    /** `<layout>/unpacked/sha256/<manifest-hex>`. */
+    readonly dir: string;
+    readonly digests: ResolvedDigests;
+    readonly predicate: ArtifactPredicate;
+    /** The key id that verified the signature, or `""` under allow-unsigned. */
+    readonly signedBy: string;
+    /** A base URL, `"cache"`, or `"system:<dir>"`. */
+    readonly source: string;
+    readonly alreadyInstalled: boolean;
+    readonly warnings: readonly string[];
+}
+/** One `verify_installed` row. */
+export interface VerifyResult {
+    readonly platform: PlatformKey;
+    readonly dir: string;
+    readonly ok: boolean;
+    readonly detail: string;
+}
+/**
+ * Test-only injection point (plan §3.2 "Sleeps are asserted exactly"): every
+ * binding's fetch core takes an injected `sleep(seconds)` and `now()` so
+ * retry cases run instantly and deterministically. Production code uses
+ * `realClock()`.
+ */
+export interface Clock {
+    now(): number;
+    sleep(seconds: number): Promise<void>;
+}
+export declare function realClock(): Clock;
+export interface TrustedKey {
+    readonly keyid: string;
+    readonly ed25519Hex: string;
+}
+/**
+ * Options shared by every seam entry point. All optional; every default
+ * matches `docs/guides/fetch-v1.md`.
+ */
+export interface FetchV1Options {
+    /** Overrides `DEFAULT_BASES` / `CHTYPES_ARTIFACTS_URL`, in order. */
+    readonly bases?: readonly string[];
+    /** Overrides the OCI layout root (`CHTYPES_CACHE`). */
+    readonly cacheDir?: string;
+    /** Overrides `SYSTEM_CACHE_DIRS`. */
+    readonly systemDirs?: readonly string[];
+    /** Replaces (never appends to) the default trust list. */
+    readonly trustedKeys?: readonly TrustedKey[];
+    readonly allowUnsigned?: boolean;
+    /** Sent as `Authorization: Bearer <token>` to configured base hosts only. */
+    readonly token?: string;
+    /** `resolve_installed`'s mode for `ensure`: cache/system dirs only, no network. */
+    readonly offline?: boolean;
+    /** Skip resolution; fetch the lock's pinned digests directly. */
+    readonly frozen?: boolean;
+    /** Path to the lock file (`LOCK_DEFAULT_FILE` under the caller's cwd by default). */
+    readonly lockPath?: string;
+    /** Write (or update) the lock after a successful `ensure`. */
+    readonly lockWrite?: boolean;
+    /** Every platform the index offers, not only the host's — `lockWrite` only. */
+    readonly lockAllPlatforms?: boolean;
+    /** Re-resolve every locked request and rewrite the lock, ignoring `frozen`. */
+    readonly update?: boolean;
+    /** Overrides the host platform (tests, and a cross-platform lock write). */
+    readonly platform?: PlatformKey;
+    readonly clock?: Clock;
+    /** Test-only: runs after the index's temp-write, before its atomic rename. */
+    readonly beforeIndexRename?: () => Promise<void> | void;
+    /** Test-only: an explicit `now()`-relative deadline is not used; retries read `clock`. */
+    readonly httpLog?: (event: Readonly<Record<string, unknown>>) => void;
+}
+/** Thrown-safe helper: the exact platform this call targets. */
+export declare function resolvePlatformOption(option: PlatformKey | undefined, osName: string, archName: string): PlatformKey;
+/** Every digest in this module is `sha256:<64 hex>` (OCI's own spelling); this is the one place that parses it. */
+export declare function hexOfDigest(digest: string): string;
+/** `<hex>` back to `sha256:<hex>`. */
+export declare function digestOfHex(hex: string): string;
+export declare function trimTrailingSlash(s: string): string;
+/** `${repositoryRoot}${suffix}` with the OCI `/v2` segment inserted for http(s), never for `file:`. */
+export declare function endpointUrl(repositoryRoot: string, suffix: string): string;
+//# sourceMappingURL=types.d.ts.map

package/dist/ocifetch/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/ocifetch/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAyC,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEtF;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,QAAgD,CAAC;AAEpF,sEAAsE;AACtE,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;AAE5D,mDAAmD;AACnD,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,WAAW,CAEjE;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,GAAG,EAAE,WAAW,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAMhI;AAED,uGAAuG;AACvG,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAIzF;AAED,mFAAmF;AACnF,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC;AAEpC,2FAA2F;AAC3F,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,8EAA8E;AAC9E,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE;YAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,EAAE,CAAC;IACrG,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,iGAAiG;IACjG,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AAED,wEAAwE;AACxE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,2CAA2C;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,sEAAsE;AACtE,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,kDAAkD;IAClD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,iDAAiD;IACjD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,kDAAkD;IAClD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED,kCAAkC;AAClC,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,KAAK;IACpB,GAAG,IAAI,MAAM,CAAC;IACd,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,wBAAgB,SAAS,IAAI,KAAK,CAQjC;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,qEAAqE;IACrE,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,uDAAuD;IACvD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,qCAAqC;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,0DAA0D;IAC1D,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IAC7C,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,6EAA6E;IAC7E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,mFAAmF;IACnF,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,qFAAqF;IACrF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,+EAA+E;IAC/E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,8EAA8E;IAC9E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACxD,0FAA0F;IAC1F,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC;CACvE;AAED,gEAAgE;AAChE,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,WAAW,CAWpH;AAED,mHAAmH;AACnH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAMlD;AAED,sCAAsC;AACtC,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE/C;AAgBD,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,uGAAuG;AACvG,wBAAgB,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAM1E"}

package/dist/ocifetch/types.js

@@ -0,0 +1,88 @@
+/**
+ * Shared types for the v1 fetch layer: the seam (`docs/guides/fetch-v1.md`
+ * §9, the v1 fetch-layer plan's §1.3) and the pieces behind it. Nothing
+ * outside this module imports from anywhere but `index.ts`.
+ */
+import { MEDIA_TYPE_INDEX, MEDIA_TYPE_MANIFEST, PLATFORMS } from './constants.gen.js';
+/**
+ * Every `GET …/manifests/<ref>` — by tag or by digest — sends this `Accept`
+ * header (the delivery side's review): our own host ignores it, but a
+ * mirror may need it to answer with the right media type, and a mirror can
+ * be asked for a manifest exactly as our host can.
+ */
+export const MANIFEST_ACCEPT_HEADER = `${MEDIA_TYPE_INDEX}, ${MEDIA_TYPE_MANIFEST}`;
+/** True for exactly the three v1 platform keys. */
+export function isPlatformKey(value) {
+    return PLATFORMS.some((p) => p.key === value);
+}
+/** `PLATFORMS`'s row for one key — never `undefined` for a `PlatformKey`. */
+export function platformInfo(key) {
+    const row = PLATFORMS.find((p) => p.key === key);
+    if (row === undefined)
+        throw new Error(`chtypes: unreachable: ${key} is not in PLATFORMS`);
+    return row;
+}
+/** This host's platform key, or `undefined` when v1 does not ship this os/arch (e.g. darwin-amd64). */
+export function hostPlatformKey(osName, archName) {
+    const arch = archName === 'x64' ? 'amd64' : archName;
+    const key = `${osName}-${arch}`;
+    return isPlatformKey(key) ? key : undefined;
+}
+export function realClock() {
+    return {
+        now: () => Date.now(),
+        sleep: (seconds) => new Promise((resolve) => {
+            setTimeout(resolve, Math.max(0, seconds) * 1000);
+        }),
+    };
+}
+/** Thrown-safe helper: the exact platform this call targets. */
+export function resolvePlatformOption(option, osName, archName) {
+    if (option !== undefined)
+        return option;
+    const host = hostPlatformKey(osName, archName);
+    if (host === undefined) {
+        throw new Error(`chtypes: this host (${osName}-${archName}) is not one of v1's platforms (${PLATFORMS
+            .map((p) => p.key)
+            .join(', ')})`);
+    }
+    return host;
+}
+/** Every digest in this module is `sha256:<64 hex>` (OCI's own spelling); this is the one place that parses it. */
+export function hexOfDigest(digest) {
+    const [algo, hex] = digest.split(':', 2);
+    if (algo !== 'sha256' || hex === undefined || !/^[0-9a-f]{64}$/.test(hex)) {
+        throw new Error(`chtypes: not a sha256 digest: ${JSON.stringify(digest)}`);
+    }
+    return hex;
+}
+/** `<hex>` back to `sha256:<hex>`. */
+export function digestOfHex(hex) {
+    return `sha256:${hex}`;
+}
+// --------------------------------------------------------------- URL shape
+//
+// A "repository root" (what `docs/guides/fetch-v1.md` §2 calls a base, and
+// what the generic `fetchSigned` seam calls `repository`) is one string that
+// already carries the registry origin AND the repository path, e.g.
+// `https://registry.wavehouse.dev/chtypes/v1` — exactly `DEFAULT_BASES`'
+// own spelling, with no `/v2` segment. The real OCI distribution path DOES
+// carry `/v2/` (`oras`/`docker` insert it from a plain `host/repo:tag`
+// reference the same way), so an http(s) root gets `/v2` spliced in between
+// its origin and its own path. A `file://` root is different on purpose: the
+// fixture trees are static mirrors of the real URL paths *including* the
+// literal `v2` directory, so nothing is inserted — see
+// `tests/fixtures/fetch-v1/trees/*/v2/...` (lane 0B) once it exists.
+export function trimTrailingSlash(s) {
+    return s.endsWith('/') ? s.slice(0, -1) : s;
+}
+/** `${repositoryRoot}${suffix}` with the OCI `/v2` segment inserted for http(s), never for `file:`. */
+export function endpointUrl(repositoryRoot, suffix) {
+    const root = trimTrailingSlash(repositoryRoot);
+    if (root.startsWith('file:'))
+        return `${root}${suffix}`;
+    const u = new URL(root);
+    const repoPath = trimTrailingSlash(u.pathname);
+    return `${u.origin}/v2${repoPath}${suffix}`;
+}
+//# sourceMappingURL=types.js.map

package/dist/ocifetch/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/ocifetch/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEtF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,gBAAgB,KAAK,mBAAmB,EAAE,CAAC;AAKpF,mDAAmD;AACnD,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAQ,SAAiD,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC;AACzF,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,YAAY,CAAC,GAAgB;IAC3C,MAAM,GAAG,GAAI,SAAqG,CAAC,IAAI,CACrH,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CACrB,CAAC;IACF,IAAI,GAAG,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,sBAAsB,CAAC,CAAC;IAC3F,OAAO,GAAwF,CAAC;AAClG,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,QAAgB;IAC9D,MAAM,IAAI,GAAG,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;IACrD,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC;IAChC,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9C,CAAC;AAgGD,MAAM,UAAU,SAAS;IACvB,OAAO;QACL,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;QACrB,KAAK,EAAE,CAAC,OAAe,EAAE,EAAE,CACzB,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YACtB,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;QACnD,CAAC,CAAC;KACL,CAAC;AACJ,CAAC;AA4CD,gEAAgE;AAChE,MAAM,UAAU,qBAAqB,CAAC,MAA+B,EAAE,MAAc,EAAE,QAAgB;IACrG,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,uBAAuB,MAAM,IAAI,QAAQ,mCAAoC,SAAwC;aAClH,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;aACjB,IAAI,CAAC,IAAI,CAAC,GAAG,CACjB,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,mHAAmH;AACnH,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACzC,IAAI,IAAI,KAAK,QAAQ,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sCAAsC;AACtC,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,OAAO,UAAU,GAAG,EAAE,CAAC;AACzB,CAAC;AAED,4EAA4E;AAC5E,EAAE;AACF,2EAA2E;AAC3E,6EAA6E;AAC7E,oEAAoE;AACpE,yEAAyE;AACzE,2EAA2E;AAC3E,uEAAuE;AACvE,4EAA4E;AAC5E,6EAA6E;AAC7E,yEAAyE;AACzE,uDAAuD;AACvD,qEAAqE;AAErE,MAAM,UAAU,iBAAiB,CAAC,CAAS;IACzC,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,WAAW,CAAC,cAAsB,EAAE,MAAc;IAChE,MAAM,IAAI,GAAG,iBAAiB,CAAC,cAAc,CAAC,CAAC;IAC/C,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,GAAG,IAAI,GAAG,MAAM,EAAE,CAAC;IACxD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC/C,OAAO,GAAG,CAAC,CAAC,MAAM,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC;AAC9C,CAAC"}

package/dist/ocifetch/unpack.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Bytes and unpack (`docs/guides/fetch-v1.md` §5): download the layer to a
+ * temp file **while hashing**, verify size and sha256 against the manifest's
+ * own layer descriptor **before any decompression**, zstd-decode (multi-frame
+ * accepted, a window log past the limit refused before a frame's decoder
+ * commits to it), unpack with the tightened v1 tar rules (`../tar.ts`'s
+ * `extractTarStream`: regular files and directories only, no duplicate entry
+ * names, a hard cap on total unpacked bytes), then re-hash the installed
+ * library against the signed predicate.
+ *
+ * **Multi-frame zstd needs its own loop here — measured, not assumed.**
+ * Node's built-in `zlib.createZstdDecompress()` (and `zstdDecompressSync`)
+ * decode only the **first** frame of a concatenated multi-frame stream and
+ * then stop silently (no error, no second frame): verified on this Mac
+ * (Node 22.23.2) by concatenating two independently-produced zstd frames and
+ * observing the decoder emit only the first frame's content, with
+ * `bytesWritten` on the stream reporting exactly the first frame's
+ * compressed length. `bytesWritten` is therefore how many input bytes one
+ * frame consumed, so `decompressAllFrames` below runs one `createZstdDecompress`
+ * per frame, each capped at `ZSTD_d_windowLogMax`, advancing through the
+ * buffer by exactly that many bytes each time — the same "loop over frames"
+ * the plan already calls out for Rust's `ruzstd`, just also true here.
+ *
+ * Every check below runs in the order the guide names, and a failure at any
+ * step leaves nothing a later `--offline` read could mistake for a verified
+ * install: the temp layer file and a partially-unpacked destination are both
+ * the caller's (`ensure.ts`'s) to remove, since only it knows whether the
+ * destination is a fresh temp directory or an existing one being replaced.
+ */
+import { type ExtractedEntry } from '../tar.js';
+import type { RequestOptions } from './http.js';
+import { type Descriptor } from './oci.js';
+/**
+ * Verifies already-in-memory layer bytes against their own descriptor, then
+ * zstd-decodes and unpacks into `destDir` (guide §5, steps 1-4) — the shared
+ * core both `fetchVerifyAndUnpackLayer` (downloaded bytes) and
+ * `localverify.ts` (bytes read straight from a local `blobs/sha256/<hex>`,
+ * for a pre-seeded cache entry) build on.
+ */
+export declare function verifyAndUnpackLayerBytes(layerBytes: Buffer, layer: Descriptor, destDir: string): Promise<readonly ExtractedEntry[]>;
+/**
+ * Downloads `layer` (verified against its own descriptor) and unpacks it
+ * into `destDir`, which must already exist and be empty. `tempLayerPath` is
+ * a caller-owned scratch file for the compressed bytes (removed by the
+ * caller once this returns, success or failure).
+ */
+export declare function fetchVerifyAndUnpackLayer(bases: readonly string[], layer: Descriptor, tempLayerPath: string, destDir: string, options: RequestOptions): Promise<readonly ExtractedEntry[]>;
+/** The sha256 (lowercase hex) and byte length of the unpacked library, as the canonical `verified.json` records them. */
+export declare function measureLibrary(libraryPath: string): Promise<{
+    readonly sha256: string;
+    readonly bytes: number;
+}>;
+/** Re-hashes the installed library against the signed predicate's `library_sha256`/`library_bytes` (guide §5 step 5). */
+export declare function verifyInstalledLibrary(libraryPath: string, expectedSha256Hex: string, expectedBytes: number): Promise<void>;
+//# sourceMappingURL=unpack.d.ts.map

package/dist/ocifetch/unpack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unpack.d.ts","sourceRoot":"","sources":["../../src/ocifetch/unpack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAMH,OAAO,EAAoB,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAGlE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAiB,KAAK,UAAU,EAAwC,MAAM,UAAU,CAAC;AA0FhG;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC,CAgB1I;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,KAAK,EAAE,UAAU,EACjB,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC,CAWpC;AAED,yHAAyH;AACzH,wBAAsB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAatH;AAED,yHAAyH;AACzH,wBAAsB,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBjI"}

package/dist/ocifetch/unpack.js

@@ -0,0 +1,205 @@
+/**
+ * Bytes and unpack (`docs/guides/fetch-v1.md` §5): download the layer to a
+ * temp file **while hashing**, verify size and sha256 against the manifest's
+ * own layer descriptor **before any decompression**, zstd-decode (multi-frame
+ * accepted, a window log past the limit refused before a frame's decoder
+ * commits to it), unpack with the tightened v1 tar rules (`../tar.ts`'s
+ * `extractTarStream`: regular files and directories only, no duplicate entry
+ * names, a hard cap on total unpacked bytes), then re-hash the installed
+ * library against the signed predicate.
+ *
+ * **Multi-frame zstd needs its own loop here — measured, not assumed.**
+ * Node's built-in `zlib.createZstdDecompress()` (and `zstdDecompressSync`)
+ * decode only the **first** frame of a concatenated multi-frame stream and
+ * then stop silently (no error, no second frame): verified on this Mac
+ * (Node 22.23.2) by concatenating two independently-produced zstd frames and
+ * observing the decoder emit only the first frame's content, with
+ * `bytesWritten` on the stream reporting exactly the first frame's
+ * compressed length. `bytesWritten` is therefore how many input bytes one
+ * frame consumed, so `decompressAllFrames` below runs one `createZstdDecompress`
+ * per frame, each capped at `ZSTD_d_windowLogMax`, advancing through the
+ * buffer by exactly that many bytes each time — the same "loop over frames"
+ * the plan already calls out for Rust's `ruzstd`, just also true here.
+ *
+ * Every check below runs in the order the guide names, and a failure at any
+ * step leaves nothing a later `--offline` read could mistake for a verified
+ * install: the temp layer file and a partially-unpacked destination are both
+ * the caller's (`ensure.ts`'s) to remove, since only it knows whether the
+ * destination is a fresh temp directory or an existing one being replaced.
+ */
+import { createHash } from 'node:crypto';
+import { closeSync, createReadStream, ftruncateSync, openSync, writeSync } from 'node:fs';
+import { Readable } from 'node:stream';
+import * as zlib from 'node:zlib';
+import { extractTarStream } from '../tar.js';
+import { MAX_UNPACKED_BYTES, ZSTD_WINDOW_LOG_MAX } from './constants.gen.js';
+import { ArtifactCorruptError } from './errors.js';
+import { fetchBlobToSink, verifyDigestAndSize } from './oci.js';
+/**
+ * Streams into a file on disk while hashing, synchronously: `requestToSink`
+ * (`http.ts`) calls `write` from inside a plain callback with no backpressure
+ * of its own, so a sync write keeps every chunk in order with no risk of two
+ * writes racing. `reset()` is called once before the first attempt and again
+ * before every retry — a retried download restarts the file from empty,
+ * exactly as it restarts the hash. Also keeps an in-memory copy: the
+ * decompressor needs the whole compressed buffer anyway (see this module's
+ * header), so a second disk read would buy nothing.
+ */
+class HashingFileSink {
+    fd;
+    hash = createHash('sha256');
+    bytesWritten = 0;
+    chunks = [];
+    constructor(path) {
+        this.fd = openSync(path, 'w');
+    }
+    reset() {
+        this.hash = createHash('sha256');
+        this.bytesWritten = 0;
+        this.chunks = [];
+        ftruncateSync(this.fd, 0);
+    }
+    write(chunk) {
+        writeSync(this.fd, chunk);
+        this.hash.update(chunk);
+        this.chunks.push(chunk);
+        this.bytesWritten += chunk.length;
+    }
+    /** Closes the file and returns what was actually written — never call `write` after this. */
+    finish() {
+        const sha256 = this.hash.digest('hex');
+        const bytes = Buffer.concat(this.chunks);
+        closeSync(this.fd);
+        return { sha256, size: this.bytesWritten, bytes };
+    }
+    /** For an error path: close without finalizing the hash (which `digest()` would do anyway, uselessly). */
+    abort() {
+        try {
+            closeSync(this.fd);
+        }
+        catch {
+            // Already closed, or never fully opened — nothing left to release.
+        }
+    }
+}
+/**
+ * Decodes every zstd frame in `compressed`, one `createZstdDecompress`
+ * instance per frame (see this module's header for why), each capped at
+ * `windowLogMax`. Yields decompressed chunks in order. Throws
+ * `ArtifactCorruptError` on a decode error (including a window log past the
+ * cap) or on a frame that consumes zero input bytes (would loop forever
+ * otherwise).
+ */
+async function* decompressAllZstdFrames(compressed, windowLogMax) {
+    let offset = 0;
+    while (offset < compressed.length) {
+        const remaining = compressed.subarray(offset);
+        const decoder = zlib.createZstdDecompress({ params: { [zlib.constants.ZSTD_d_windowLogMax]: windowLogMax } });
+        const chunks = [];
+        let consumed = 0;
+        try {
+            await new Promise((resolve, reject) => {
+                decoder.on('data', (chunk) => chunks.push(chunk));
+                decoder.on('end', () => {
+                    consumed = decoder.bytesWritten;
+                    resolve();
+                });
+                decoder.on('error', reject);
+                decoder.end(remaining);
+            });
+        }
+        catch (err) {
+            throw new ArtifactCorruptError(`chtypes: zstd decode failed: ${errorText(err)}`, { cause: err });
+        }
+        if (consumed <= 0) {
+            throw new ArtifactCorruptError('chtypes: zstd stream made no forward progress (a malformed or empty frame)');
+        }
+        for (const chunk of chunks)
+            yield chunk;
+        offset += consumed;
+    }
+}
+/**
+ * Verifies already-in-memory layer bytes against their own descriptor, then
+ * zstd-decodes and unpacks into `destDir` (guide §5, steps 1-4) — the shared
+ * core both `fetchVerifyAndUnpackLayer` (downloaded bytes) and
+ * `localverify.ts` (bytes read straight from a local `blobs/sha256/<hex>`,
+ * for a pre-seeded cache entry) build on.
+ */
+export async function verifyAndUnpackLayerBytes(layerBytes, layer, destDir) {
+    const sha256 = createHash('sha256').update(layerBytes).digest('hex');
+    // Size and sha256 against the descriptor, BEFORE any decompression
+    // (guide §5 step 1) — `tampered-layer` must show no unpack attempted.
+    verifyDigestAndSize(layer, sha256, layerBytes.length, `layer ${layer.digest}`);
+    const decompressed = Readable.from(decompressAllZstdFrames(layerBytes, ZSTD_WINDOW_LOG_MAX));
+    try {
+        return await extractTarStream([decompressed], destDir, {
+            refuseDuplicateNames: true,
+            maxTotalBytes: MAX_UNPACKED_BYTES,
+        });
+    }
+    catch (err) {
+        if (err instanceof ArtifactCorruptError)
+            throw err;
+        throw new ArtifactCorruptError(`chtypes: layer ${layer.digest} failed to decode or unpack: ${errorText(err)}`, { cause: err });
+    }
+}
+/**
+ * Downloads `layer` (verified against its own descriptor) and unpacks it
+ * into `destDir`, which must already exist and be empty. `tempLayerPath` is
+ * a caller-owned scratch file for the compressed bytes (removed by the
+ * caller once this returns, success or failure).
+ */
+export async function fetchVerifyAndUnpackLayer(bases, layer, tempLayerPath, destDir, options) {
+    const sink = new HashingFileSink(tempLayerPath);
+    let downloaded;
+    try {
+        await fetchBlobToSink(bases, layer, options, sink);
+        downloaded = sink.finish();
+    }
+    catch (err) {
+        sink.abort();
+        throw err;
+    }
+    return verifyAndUnpackLayerBytes(downloaded.bytes, layer, destDir);
+}
+/** The sha256 (lowercase hex) and byte length of the unpacked library, as the canonical `verified.json` records them. */
+export async function measureLibrary(libraryPath) {
+    const hash = createHash('sha256');
+    let size = 0;
+    await new Promise((resolve, reject) => {
+        const s = createReadStream(libraryPath);
+        s.on('data', (chunk) => {
+            size += chunk.length;
+            hash.update(chunk);
+        });
+        s.on('end', resolve);
+        s.on('error', reject);
+    });
+    return { sha256: hash.digest('hex'), bytes: size };
+}
+/** Re-hashes the installed library against the signed predicate's `library_sha256`/`library_bytes` (guide §5 step 5). */
+export async function verifyInstalledLibrary(libraryPath, expectedSha256Hex, expectedBytes) {
+    const hash = createHash('sha256');
+    let size = 0;
+    await new Promise((resolve, reject) => {
+        const s = createReadStream(libraryPath);
+        s.on('data', (chunk) => {
+            size += chunk.length;
+            hash.update(chunk);
+        });
+        s.on('end', resolve);
+        s.on('error', reject);
+    });
+    if (size !== expectedBytes) {
+        throw new ArtifactCorruptError(`chtypes: installed library is ${size} bytes, the signed predicate named ${expectedBytes}`);
+    }
+    const actual = hash.digest('hex');
+    if (actual !== expectedSha256Hex) {
+        throw new ArtifactCorruptError("chtypes: installed library's sha256 does not match the signed predicate's library_sha256");
+    }
+}
+function errorText(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+//# sourceMappingURL=unpack.js.map

package/dist/ocifetch/unpack.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unpack.js","sourceRoot":"","sources":["../../src/ocifetch/unpack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC1F,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAuB,MAAM,WAAW,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEnD,OAAO,EAAkC,eAAe,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAEhG;;;;;;;;;GASG;AACH,MAAM,eAAe;IACX,EAAE,CAAS;IACX,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC5B,YAAY,GAAG,CAAC,CAAC;IACjB,MAAM,GAAa,EAAE,CAAC;IAE9B,YAAY,IAAY;QACtB,IAAI,CAAC,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,KAAK;QACH,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QACjB,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,KAAa;QACjB,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,MAAM,CAAC;IACpC,CAAC;IAED,6FAA6F;IAC7F,MAAM;QACJ,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC;IACpD,CAAC;IAED,0GAA0G;IAC1G,KAAK;QACH,IAAI,CAAC;YACH,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;QACrE,CAAC;IACH,CAAC;CACF;AAED;;;;;;;GAOG;AACH,KAAK,SAAS,CAAC,CAAC,uBAAuB,CAAC,UAAkB,EAAE,YAAoB;IAC9E,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;QAC9G,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC1C,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC1D,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACrB,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC;oBAChC,OAAO,EAAE,CAAC;gBACZ,CAAC,CAAC,CAAC;gBACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC5B,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACzB,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,oBAAoB,CAAC,gCAAgC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,oBAAoB,CAAC,4EAA4E,CAAC,CAAC;QAC/G,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,MAAM;YAAE,MAAM,KAAK,CAAC;QACxC,MAAM,IAAI,QAAQ,CAAC;IACrB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,UAAkB,EAAE,KAAiB,EAAE,OAAe;IACpG,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrE,mEAAmE;IACnE,sEAAsE;IACtE,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,SAAS,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAE/E,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,uBAAuB,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAC7F,IAAI,CAAC;QACH,OAAO,MAAM,gBAAgB,CAAC,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE;YACrD,oBAAoB,EAAE,IAAI;YAC1B,aAAa,EAAE,kBAAkB;SAClC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,oBAAoB;YAAE,MAAM,GAAG,CAAC;QACnD,MAAM,IAAI,oBAAoB,CAAC,kBAAkB,KAAK,CAAC,MAAM,gCAAgC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACjI,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAwB,EACxB,KAAiB,EACjB,aAAqB,EACrB,OAAe,EACf,OAAuB;IAEvB,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,aAAa,CAAC,CAAC;IAChD,IAAI,UAA2D,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,eAAe,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACnD,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,yBAAyB,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AACrE,CAAC;AAED,yHAAyH;AACzH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,WAAmB;IACtD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACxC,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC7B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACrB,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACrD,CAAC;AAED,yHAAyH;AACzH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,WAAmB,EAAE,iBAAyB,EAAE,aAAqB;IAChH,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACxC,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC7B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACrB,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IACH,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3B,MAAM,IAAI,oBAAoB,CAAC,iCAAiC,IAAI,sCAAsC,aAAa,EAAE,CAAC,CAAC;IAC7H,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,MAAM,KAAK,iBAAiB,EAAE,CAAC;QACjC,MAAM,IAAI,oBAAoB,CAAC,0FAA0F,CAAC,CAAC;IAC7H,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC"}