@wavehouse/chtypes 2.0.0-dev.1 → 2.0.0-dev.11
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +97 -0
- package/README.md +5 -1
- package/dist/abi2/buildinfo.d.ts +1 -1
- package/dist/abi2/buildinfo.js +3 -3
- package/dist/abi2/buildinfo.js.map +1 -1
- package/dist/abi2/calls.gen.d.ts +5 -5
- package/dist/abi2/calls.gen.d.ts.map +1 -1
- package/dist/abi2/calls.gen.js +11 -11
- package/dist/abi2/calls.gen.js.map +1 -1
- package/dist/abi2/decls.gen.d.ts +2 -1
- package/dist/abi2/decls.gen.d.ts.map +1 -1
- package/dist/abi2/decls.gen.js +78 -20
- package/dist/abi2/decls.gen.js.map +1 -1
- package/dist/abi2/errmap.gen.js +1 -1
- package/dist/abi2/errors.d.ts +21 -40
- package/dist/abi2/errors.d.ts.map +1 -1
- package/dist/abi2/errors.js +20 -44
- package/dist/abi2/errors.js.map +1 -1
- package/dist/abi2/index.d.ts +2 -2
- package/dist/abi2/index.d.ts.map +1 -1
- package/dist/abi2/index.js +1 -1
- package/dist/abi2/index.js.map +1 -1
- package/dist/abi2/libc.gen.d.ts +2 -0
- package/dist/abi2/libc.gen.d.ts.map +1 -1
- package/dist/abi2/libc.gen.js +11 -1
- package/dist/abi2/libc.gen.js.map +1 -1
- package/dist/abi2/loader.d.ts +4 -2
- package/dist/abi2/loader.d.ts.map +1 -1
- package/dist/abi2/loader.js +2 -2
- package/dist/abi2/loader.js.map +1 -1
- package/dist/abi2/raw.d.ts.map +1 -1
- package/dist/abi2/raw.js +4 -1
- package/dist/abi2/raw.js.map +1 -1
- package/dist/abi2/vocab.gen.d.ts +90 -1
- package/dist/abi2/vocab.gen.d.ts.map +1 -1
- package/dist/abi2/vocab.gen.js +144 -4
- package/dist/abi2/vocab.gen.js.map +1 -1
- package/dist/cli.d.ts +11 -5
- package/dist/cli.d.ts.map +1 -1
- package/dist/cli.js +130 -20
- package/dist/cli.js.map +1 -1
- package/dist/documents.d.ts +100 -7
- package/dist/documents.d.ts.map +1 -1
- package/dist/documents.js +135 -8
- package/dist/documents.js.map +1 -1
- package/dist/env.d.ts +8 -1
- package/dist/env.d.ts.map +1 -1
- package/dist/env.js +17 -8
- package/dist/env.js.map +1 -1
- package/dist/index.d.ts +10 -7
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +8 -5
- package/dist/index.js.map +1 -1
- package/dist/library.d.ts +13 -2
- package/dist/library.d.ts.map +1 -1
- package/dist/library.js +24 -5
- package/dist/library.js.map +1 -1
- package/dist/ocifetch/channel.d.ts +84 -0
- package/dist/ocifetch/channel.d.ts.map +1 -1
- package/dist/ocifetch/channel.js +157 -2
- package/dist/ocifetch/channel.js.map +1 -1
- package/dist/ocifetch/constants.gen.d.ts +28 -0
- package/dist/ocifetch/constants.gen.d.ts.map +1 -1
- package/dist/ocifetch/constants.gen.js +30 -1
- package/dist/ocifetch/constants.gen.js.map +1 -1
- package/dist/ocifetch/dsse.d.ts +5 -1
- package/dist/ocifetch/dsse.d.ts.map +1 -1
- package/dist/ocifetch/dsse.js +10 -3
- package/dist/ocifetch/dsse.js.map +1 -1
- package/dist/ocifetch/ensure.d.ts +68 -8
- package/dist/ocifetch/ensure.d.ts.map +1 -1
- package/dist/ocifetch/ensure.js +305 -66
- package/dist/ocifetch/ensure.js.map +1 -1
- package/dist/ocifetch/errors.d.ts +101 -25
- package/dist/ocifetch/errors.d.ts.map +1 -1
- package/dist/ocifetch/errors.js +74 -36
- package/dist/ocifetch/errors.js.map +1 -1
- package/dist/ocifetch/hold.d.ts +66 -0
- package/dist/ocifetch/hold.d.ts.map +1 -0
- package/dist/ocifetch/hold.js +150 -0
- package/dist/ocifetch/hold.js.map +1 -0
- package/dist/ocifetch/http.d.ts +10 -2
- package/dist/ocifetch/http.d.ts.map +1 -1
- package/dist/ocifetch/http.js +31 -12
- package/dist/ocifetch/http.js.map +1 -1
- package/dist/ocifetch/index.d.ts +10 -5
- package/dist/ocifetch/index.d.ts.map +1 -1
- package/dist/ocifetch/index.js +8 -3
- package/dist/ocifetch/index.js.map +1 -1
- package/dist/ocifetch/localverify.d.ts +3 -1
- package/dist/ocifetch/localverify.d.ts.map +1 -1
- package/dist/ocifetch/localverify.js +6 -1
- package/dist/ocifetch/localverify.js.map +1 -1
- package/dist/ocifetch/lock.d.ts +2 -1
- package/dist/ocifetch/lock.d.ts.map +1 -1
- package/dist/ocifetch/lock.js +7 -5
- package/dist/ocifetch/lock.js.map +1 -1
- package/dist/ocifetch/oci.d.ts +45 -3
- package/dist/ocifetch/oci.d.ts.map +1 -1
- package/dist/ocifetch/oci.js +125 -58
- package/dist/ocifetch/oci.js.map +1 -1
- package/dist/ocifetch/prune.d.ts +48 -0
- package/dist/ocifetch/prune.d.ts.map +1 -0
- package/dist/ocifetch/prune.js +383 -0
- package/dist/ocifetch/prune.js.map +1 -0
- package/dist/ocifetch/referrers.d.ts +24 -0
- package/dist/ocifetch/referrers.d.ts.map +1 -1
- package/dist/ocifetch/referrers.js +92 -5
- package/dist/ocifetch/referrers.js.map +1 -1
- package/dist/ocifetch/resolve.d.ts +37 -0
- package/dist/ocifetch/resolve.d.ts.map +1 -0
- package/dist/ocifetch/resolve.js +90 -0
- package/dist/ocifetch/resolve.js.map +1 -0
- package/dist/ocifetch/retired.d.ts +61 -0
- package/dist/ocifetch/retired.d.ts.map +1 -0
- package/dist/ocifetch/retired.js +236 -0
- package/dist/ocifetch/retired.js.map +1 -0
- package/dist/ocifetch/revocation.d.ts +151 -0
- package/dist/ocifetch/revocation.d.ts.map +1 -0
- package/dist/ocifetch/revocation.js +481 -0
- package/dist/ocifetch/revocation.js.map +1 -0
- package/dist/ocifetch/types.d.ts +18 -2
- package/dist/ocifetch/types.d.ts.map +1 -1
- package/dist/ocifetch/types.js.map +1 -1
- package/dist/registry.d.ts +80 -3
- package/dist/registry.d.ts.map +1 -1
- package/dist/registry.js +168 -9
- package/dist/registry.js.map +1 -1
- package/dist/schema.d.ts +52 -9
- package/dist/schema.d.ts.map +1 -1
- package/dist/schema.js +6 -6
- package/dist/schema.js.map +1 -1
- package/dist/server.d.ts +27 -0
- package/dist/server.d.ts.map +1 -0
- package/dist/server.js +35 -0
- package/dist/server.js.map +1 -0
- package/dist/settings.d.ts +101 -9
- package/dist/settings.d.ts.map +1 -1
- package/dist/settings.js +201 -27
- package/dist/settings.js.map +1 -1
- package/dist/setup.d.ts +3 -2
- package/dist/setup.d.ts.map +1 -1
- package/dist/setup.js +2 -3
- package/dist/setup.js.map +1 -1
- package/package.json +2 -2
|
@@ -0,0 +1,481 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Build-level revocation (`docs/guides/fetch-v1.md`, "Build-level revocation";
|
|
3
|
+
* public issue #625). A revocation is a signed referrer of a platform manifest,
|
|
4
|
+
* read from the listing its signature lookup reads; one that verifies refuses the
|
|
5
|
+
* build with `ArtifactRevokedError` and is stored in the build's cache entry, and
|
|
6
|
+
* one that does not is ignored with one warning. A 410 whose body's
|
|
7
|
+
* `errors[0].detail.revoked` is an object is the same code (`retired.ts`). A
|
|
8
|
+
* status that cannot be read fails open with one warning, or in strict mode is the
|
|
9
|
+
* transport's error. Generation 2 only (`Channel.revocation`): the v1 contract has
|
|
10
|
+
* none of it.
|
|
11
|
+
*
|
|
12
|
+
* Four paths check, each with its own budget, exactly as Go's `revocation.go`:
|
|
13
|
+
*
|
|
14
|
+
* - an install reads its revocation candidates from the trust listing it already
|
|
15
|
+
* made, under the retry table;
|
|
16
|
+
* - `--frozen` reads one listing, warm or cold, under the retry table;
|
|
17
|
+
* - a build already installed and used without a download (a registry open,
|
|
18
|
+
* preload, an ensure that finds it installed) is checked at most once per
|
|
19
|
+
* process (the memo below), one attempt per base, no backoff, and one deadline
|
|
20
|
+
* for the whole check;
|
|
21
|
+
* - `--lock` and `update` refuse a revoked build on every platform they pin.
|
|
22
|
+
*/
|
|
23
|
+
import { randomBytes } from 'node:crypto';
|
|
24
|
+
import { readFile, rename, unlink, writeFile } from 'node:fs/promises';
|
|
25
|
+
import path from 'node:path';
|
|
26
|
+
import { activeChannel, testOnly } from './channel.js';
|
|
27
|
+
import { BUNDLE_MAX_BYTES, CACHE_REVOCATION_RECORD, CODE_SOURCE_FORBIDDEN, CODE_SOURCE_UNAUTHORIZED, CODE_SOURCE_UNREACHABLE, PREDICATE_TYPE_REVOCATION, REVOCATION_CHECK_S, STATEMENT_TYPE, } from './constants.gen.js';
|
|
28
|
+
import { parseStatement, verifyBundleSignature } from './dsse.js';
|
|
29
|
+
import { ArtifactCorruptError, ArtifactRevokedError, SourceForbiddenError, SourceUnauthorizedError, SourceUnreachableError, } from './errors.js';
|
|
30
|
+
import { fetchBlobBytesByDigest, fetchManifestByDigest } from './oci.js';
|
|
31
|
+
import { readListing } from './referrers.js';
|
|
32
|
+
import { isGone, sanitizeRetiredText } from './retired.js';
|
|
33
|
+
/** Whether the active contract has revocation at all. */
|
|
34
|
+
export function revocationOn() {
|
|
35
|
+
return activeChannel().revocation;
|
|
36
|
+
}
|
|
37
|
+
function underDir(root, dir) {
|
|
38
|
+
const rel = path.relative(root, dir);
|
|
39
|
+
return rel !== '' && rel !== '.' && !rel.startsWith('..') && !path.isAbsolute(rel);
|
|
40
|
+
}
|
|
41
|
+
/** The subject an installed build's `Resolved` names. */
|
|
42
|
+
export function subjectOf(ctx, res) {
|
|
43
|
+
return {
|
|
44
|
+
manifest: res.digests.manifest,
|
|
45
|
+
layer: res.digests.layer,
|
|
46
|
+
predicate: res.predicate,
|
|
47
|
+
version: res.version,
|
|
48
|
+
platform: res.platform,
|
|
49
|
+
build: res.build,
|
|
50
|
+
request: res.request,
|
|
51
|
+
dir: res.dir,
|
|
52
|
+
writable: res.dir !== '' && underDir(ctx.cacheRoot, res.dir),
|
|
53
|
+
};
|
|
54
|
+
}
|
|
55
|
+
function stringPredicate(pred, key) {
|
|
56
|
+
const v = pred[key];
|
|
57
|
+
return typeof v === 'string' ? v : '';
|
|
58
|
+
}
|
|
59
|
+
/** The subject of a build not yet installed: the signed statement verified for it. */
|
|
60
|
+
export function subjectOfStatement(statement, manifest, layer, platform, request) {
|
|
61
|
+
const pred = statement.predicate;
|
|
62
|
+
return {
|
|
63
|
+
manifest,
|
|
64
|
+
layer,
|
|
65
|
+
predicate: pred,
|
|
66
|
+
version: stringPredicate(pred, 'clickhouse_version'),
|
|
67
|
+
platform,
|
|
68
|
+
build: stringPredicate(pred, 'build'),
|
|
69
|
+
request,
|
|
70
|
+
dir: '',
|
|
71
|
+
writable: false,
|
|
72
|
+
};
|
|
73
|
+
}
|
|
74
|
+
// ---------------------------------------------------------------- verification
|
|
75
|
+
function isInt(v) {
|
|
76
|
+
return typeof v === 'number' && Number.isInteger(v);
|
|
77
|
+
}
|
|
78
|
+
function show(v) {
|
|
79
|
+
return typeof v === 'string' ? JSON.stringify(v) : String(v);
|
|
80
|
+
}
|
|
81
|
+
/**
|
|
82
|
+
* One revocation bundle against `sub` (the guide's five rules): the signature
|
|
83
|
+
* under `keys`, the statement and predicate types, the subject and manifest, the
|
|
84
|
+
* build's identity, and the advisory's shape. The revocation, or why it does not
|
|
85
|
+
* verify. A signed payload that is not a statement is ignored, never CORRUPT.
|
|
86
|
+
*/
|
|
87
|
+
export function verifyRevocation(body, keys, sub) {
|
|
88
|
+
const signed = verifyBundleSignature(body, keys);
|
|
89
|
+
if (signed === undefined)
|
|
90
|
+
return { reason: 'no signature verifies under a trusted key' };
|
|
91
|
+
let st;
|
|
92
|
+
try {
|
|
93
|
+
st = parseStatement(signed.payload);
|
|
94
|
+
}
|
|
95
|
+
catch (err) {
|
|
96
|
+
if (err instanceof ArtifactCorruptError)
|
|
97
|
+
return { reason: err.message };
|
|
98
|
+
throw err;
|
|
99
|
+
}
|
|
100
|
+
if (st._type !== STATEMENT_TYPE)
|
|
101
|
+
return { reason: `statement _type ${JSON.stringify(st._type)}, expected ${JSON.stringify(STATEMENT_TYPE)}` };
|
|
102
|
+
if (st.predicateType !== PREDICATE_TYPE_REVOCATION) {
|
|
103
|
+
return { reason: `predicateType ${JSON.stringify(st.predicateType)}, expected ${JSON.stringify(PREDICATE_TYPE_REVOCATION)}` };
|
|
104
|
+
}
|
|
105
|
+
const layerHex = sub.layer.startsWith('sha256:') ? sub.layer.slice('sha256:'.length) : sub.layer;
|
|
106
|
+
if (!st.subject.some((s) => s.digest.sha256 === layerHex))
|
|
107
|
+
return { reason: `no subject digest is the build's layer ${sub.layer}` };
|
|
108
|
+
const pred = st.predicate;
|
|
109
|
+
const m = pred['manifest'];
|
|
110
|
+
if (m !== sub.manifest)
|
|
111
|
+
return { reason: `predicate manifest ${show(m)} is not the build's ${sub.manifest}` };
|
|
112
|
+
const got = pred['abi'];
|
|
113
|
+
const want = sub.predicate['abi'];
|
|
114
|
+
if (!isInt(got) || !isInt(want) || got !== want)
|
|
115
|
+
return { reason: `predicate abi ${show(got)} is not the build's ${show(want)}` };
|
|
116
|
+
for (const f of ['abi_fingerprint', 'os', 'arch', 'clickhouse_version', 'build']) {
|
|
117
|
+
const g = pred[f];
|
|
118
|
+
const w = sub.predicate[f];
|
|
119
|
+
if (typeof g !== 'string' || typeof w !== 'string' || g !== w)
|
|
120
|
+
return { reason: `predicate ${f} ${show(g)} is not the build's ${show(w)}` };
|
|
121
|
+
}
|
|
122
|
+
const adv = pred['advisory'];
|
|
123
|
+
const advObj = adv !== null && typeof adv === 'object' && !Array.isArray(adv) ? adv : {};
|
|
124
|
+
const id = advObj['id'];
|
|
125
|
+
const url = advObj['url'];
|
|
126
|
+
if (typeof id !== 'string' || id === '' || typeof url !== 'string' || url === '') {
|
|
127
|
+
return { reason: 'predicate advisory does not name an id and a URL' };
|
|
128
|
+
}
|
|
129
|
+
const strs = {};
|
|
130
|
+
for (const f of ['class', 'summary', 'superseded_by', 'revoked_at']) {
|
|
131
|
+
const v = pred[f];
|
|
132
|
+
if (typeof v !== 'string')
|
|
133
|
+
return { reason: `predicate ${f} is not a string` };
|
|
134
|
+
strs[f] = v;
|
|
135
|
+
}
|
|
136
|
+
const advisory = {
|
|
137
|
+
id: sanitizeRetiredText(id),
|
|
138
|
+
url: sanitizeRetiredText(url),
|
|
139
|
+
class: sanitizeRetiredText(strs['class']),
|
|
140
|
+
summary: sanitizeRetiredText(strs['summary']),
|
|
141
|
+
build: sub.build,
|
|
142
|
+
supersededBy: sanitizeRetiredText(strs['superseded_by']),
|
|
143
|
+
revokedAt: sanitizeRetiredText(strs['revoked_at']),
|
|
144
|
+
};
|
|
145
|
+
return { revocation: { signed: true, manifest: sub.manifest, advisories: [advisory] } };
|
|
146
|
+
}
|
|
147
|
+
/**
|
|
148
|
+
* The guide's message for a verified revocation: `<version> <platform> build
|
|
149
|
+
* <build> (manifest <digest>) is revoked: <id> <url> (<class>); superseded by
|
|
150
|
+
* build <superseded_by>: <summary>`, a part whose field is empty left out.
|
|
151
|
+
*/
|
|
152
|
+
export function revokedText(sub, rev) {
|
|
153
|
+
const a = rev.advisories[0];
|
|
154
|
+
let msg = `${sub.version} ${sub.platform} build ${sub.build} (manifest ${sub.manifest}) is revoked: ${a.id} ${a.url}`;
|
|
155
|
+
if (a.class !== '')
|
|
156
|
+
msg += ` (${a.class})`;
|
|
157
|
+
if (a.supersededBy !== '')
|
|
158
|
+
msg += `; superseded by build ${a.supersededBy}`;
|
|
159
|
+
if (a.summary !== '')
|
|
160
|
+
msg += `: ${a.summary}`;
|
|
161
|
+
return msg;
|
|
162
|
+
}
|
|
163
|
+
function codeOf(err) {
|
|
164
|
+
if (err instanceof SourceUnauthorizedError)
|
|
165
|
+
return CODE_SOURCE_UNAUTHORIZED;
|
|
166
|
+
if (err instanceof SourceForbiddenError)
|
|
167
|
+
return CODE_SOURCE_FORBIDDEN;
|
|
168
|
+
return CODE_SOURCE_UNREACHABLE;
|
|
169
|
+
}
|
|
170
|
+
function requestFor(ctx, single, signal) {
|
|
171
|
+
return { ...ctx.request, maxBytes: 0, ...(single ? { single: true } : {}), ...(signal !== undefined ? { signal } : {}) };
|
|
172
|
+
}
|
|
173
|
+
/** One referrer's bundle: its manifest by digest, then its one layer, at most `BUNDLE_MAX_BYTES`. */
|
|
174
|
+
async function fetchReferrerBundle(bases, cand, options) {
|
|
175
|
+
const manifest = await fetchManifestByDigest(bases, cand.digest, options);
|
|
176
|
+
if (manifest.layer.size !== undefined && manifest.layer.size > BUNDLE_MAX_BYTES) {
|
|
177
|
+
throw new ArtifactCorruptError(`chtypes: referrer ${cand.digest}'s layer names ${manifest.layer.size} bytes, over the ${BUNDLE_MAX_BYTES}-byte bundle cap`);
|
|
178
|
+
}
|
|
179
|
+
return fetchBlobBytesByDigest(bases, manifest.layer, options);
|
|
180
|
+
}
|
|
181
|
+
/**
|
|
182
|
+
* Fetches and verifies each revocation candidate in turn; the first that
|
|
183
|
+
* verifies is the answer. A candidate whose bytes cannot be fetched leaves the
|
|
184
|
+
* status unread; one fetched but corrupt or not verifying is ignored with a
|
|
185
|
+
* warning. Its only error is a 410's.
|
|
186
|
+
*/
|
|
187
|
+
export async function checkCandidates(ctx, bases, cands, sub, single, signal) {
|
|
188
|
+
const out = { verified: undefined, warnings: [], unread: undefined };
|
|
189
|
+
for (const cand of cands) {
|
|
190
|
+
let body;
|
|
191
|
+
let reason = '';
|
|
192
|
+
try {
|
|
193
|
+
body = await fetchReferrerBundle(bases, cand, requestFor(ctx, single, signal));
|
|
194
|
+
}
|
|
195
|
+
catch (err) {
|
|
196
|
+
if (isGone(err))
|
|
197
|
+
throw err;
|
|
198
|
+
if (!(err instanceof ArtifactCorruptError)) {
|
|
199
|
+
out.unread = { text: `revocation ${cand.digest} could not be read: ${err instanceof Error ? err.message : String(err)}`, code: codeOf(err) };
|
|
200
|
+
continue;
|
|
201
|
+
}
|
|
202
|
+
reason = err.message;
|
|
203
|
+
}
|
|
204
|
+
if (body !== undefined) {
|
|
205
|
+
const v = verifyRevocation(body, ctx.trustedKeys, sub);
|
|
206
|
+
if ('revocation' in v) {
|
|
207
|
+
out.verified = { bundle: body, revocation: v.revocation };
|
|
208
|
+
return out;
|
|
209
|
+
}
|
|
210
|
+
reason = v.reason;
|
|
211
|
+
}
|
|
212
|
+
out.warnings.push(`chtypes: revocation ${cand.digest} for manifest ${sub.manifest} does not verify and is ignored: ${reason}`);
|
|
213
|
+
}
|
|
214
|
+
return out;
|
|
215
|
+
}
|
|
216
|
+
/**
|
|
217
|
+
* One network check of `sub`: its listing, then its candidates. A listing that
|
|
218
|
+
* names no signature referrer is an unread status.
|
|
219
|
+
*/
|
|
220
|
+
export async function checkListing(ctx, sub, single, signal) {
|
|
221
|
+
const l = await readListing(ctx.bases, sub.manifest, requestFor(ctx, single, signal));
|
|
222
|
+
if (!l.found) {
|
|
223
|
+
const cause = l.failure ?? new Error('no listing names a signature for this manifest');
|
|
224
|
+
return { verified: undefined, warnings: [], unread: { text: cause.message, code: codeOf(l.failure) } };
|
|
225
|
+
}
|
|
226
|
+
return checkCandidates(ctx, ctx.bases, l.revocations, sub, single, signal);
|
|
227
|
+
}
|
|
228
|
+
/**
|
|
229
|
+
* The guide's fail-open warning, without the `chtypes: ` every warning starts
|
|
230
|
+
* with: `revocation status not checked for manifest <digest> (bases: <base>,
|
|
231
|
+
* <base>): <cause>`. A base's password is redacted.
|
|
232
|
+
*/
|
|
233
|
+
function notCheckedText(sub, bases, cause) {
|
|
234
|
+
const shown = bases.map((b) => {
|
|
235
|
+
try {
|
|
236
|
+
const u = new URL(b);
|
|
237
|
+
if (u.password !== '') {
|
|
238
|
+
u.password = 'xxxxx';
|
|
239
|
+
return u.toString();
|
|
240
|
+
}
|
|
241
|
+
}
|
|
242
|
+
catch {
|
|
243
|
+
// Not a URL: shown as given.
|
|
244
|
+
}
|
|
245
|
+
return b;
|
|
246
|
+
});
|
|
247
|
+
return `revocation status not checked for manifest ${sub.manifest} (bases: ${shown.join(', ')}): ${cause}`;
|
|
248
|
+
}
|
|
249
|
+
function strictError(unread, text) {
|
|
250
|
+
const message = `chtypes: ${text}`;
|
|
251
|
+
if (unread.code === CODE_SOURCE_UNAUTHORIZED)
|
|
252
|
+
return new SourceUnauthorizedError(message);
|
|
253
|
+
if (unread.code === CODE_SOURCE_FORBIDDEN)
|
|
254
|
+
return new SourceForbiddenError(message);
|
|
255
|
+
return new SourceUnreachableError(message);
|
|
256
|
+
}
|
|
257
|
+
/**
|
|
258
|
+
* Turns an outcome into the call's answer, its warnings pushed on `warn`: a
|
|
259
|
+
* verified revocation is stored in an installed, writable entry (when `store`)
|
|
260
|
+
* and refuses the build, or with the override becomes one warning; an unread
|
|
261
|
+
* status is one warning, or in strict mode the transport's error.
|
|
262
|
+
*/
|
|
263
|
+
export async function settle(ctx, sub, out, store, warn) {
|
|
264
|
+
warn.push(...out.warnings);
|
|
265
|
+
if (out.verified !== undefined) {
|
|
266
|
+
if (store && sub.writable) {
|
|
267
|
+
// A read-only cache still refuses, for this call and process.
|
|
268
|
+
await writeRevocationRecord(sub.dir, out.verified.bundle).catch(() => { });
|
|
269
|
+
}
|
|
270
|
+
const text = revokedText(sub, out.verified.revocation);
|
|
271
|
+
if (ctx.allowRevoked) {
|
|
272
|
+
warn.push(`chtypes: allowing a revoked build: ${text}`);
|
|
273
|
+
return;
|
|
274
|
+
}
|
|
275
|
+
throw new ArtifactRevokedError(`chtypes: ${text}`, out.verified.revocation);
|
|
276
|
+
}
|
|
277
|
+
if (out.unread !== undefined) {
|
|
278
|
+
const text = notCheckedText(sub, ctx.bases, out.unread.text);
|
|
279
|
+
if (ctx.requireRevocationCheck)
|
|
280
|
+
throw strictError(out.unread, text);
|
|
281
|
+
warn.push(`chtypes: ${text}`);
|
|
282
|
+
}
|
|
283
|
+
}
|
|
284
|
+
// ------------------------------------------------------------------ the stored record
|
|
285
|
+
/** Stores a verified revocation's bundle, byte for byte, in an installed build's entry: a temporary file, then a rename. */
|
|
286
|
+
export async function writeRevocationRecord(dir, bundle) {
|
|
287
|
+
const dest = path.join(dir, CACHE_REVOCATION_RECORD);
|
|
288
|
+
const existing = await readFile(dest).catch(() => undefined);
|
|
289
|
+
if (existing !== undefined && existing.equals(bundle))
|
|
290
|
+
return;
|
|
291
|
+
const tmp = path.join(dir, `.${CACHE_REVOCATION_RECORD}.tmp-${process.pid}-${randomBytes(6).toString('hex')}`);
|
|
292
|
+
try {
|
|
293
|
+
await writeFile(tmp, bundle);
|
|
294
|
+
await rename(tmp, dest);
|
|
295
|
+
}
|
|
296
|
+
catch (err) {
|
|
297
|
+
await unlink(tmp).catch(() => { });
|
|
298
|
+
throw err;
|
|
299
|
+
}
|
|
300
|
+
}
|
|
301
|
+
/** The revocation an install let through under the override, stored in the entry it installed (a failed write is ignored). */
|
|
302
|
+
export async function storePending(ctx, dir, pending) {
|
|
303
|
+
if (pending !== undefined && dir !== '' && underDir(ctx.cacheRoot, dir)) {
|
|
304
|
+
await writeRevocationRecord(dir, pending.bundle).catch(() => { });
|
|
305
|
+
}
|
|
306
|
+
}
|
|
307
|
+
/**
|
|
308
|
+
* Reads `sub`'s stored record, if its entry holds one: verified, it decides the
|
|
309
|
+
* call (returns `true`; a refusal is thrown); one that does not verify is a
|
|
310
|
+
* warning, and the call goes on.
|
|
311
|
+
*/
|
|
312
|
+
export async function checkStored(ctx, sub, warn) {
|
|
313
|
+
if (sub.dir === '')
|
|
314
|
+
return false;
|
|
315
|
+
const file = path.join(sub.dir, CACHE_REVOCATION_RECORD);
|
|
316
|
+
let body;
|
|
317
|
+
try {
|
|
318
|
+
body = await readFile(file);
|
|
319
|
+
}
|
|
320
|
+
catch {
|
|
321
|
+
return false;
|
|
322
|
+
}
|
|
323
|
+
const v = verifyRevocation(body, ctx.trustedKeys, sub);
|
|
324
|
+
if ('reason' in v) {
|
|
325
|
+
warn.push(`chtypes: revocation record ${file} for manifest ${sub.manifest} does not verify and is ignored: ${v.reason}`);
|
|
326
|
+
return false;
|
|
327
|
+
}
|
|
328
|
+
await settle(ctx, sub, { verified: { bundle: body, revocation: v.revocation }, warnings: [], unread: undefined }, false, warn);
|
|
329
|
+
return true;
|
|
330
|
+
}
|
|
331
|
+
/** The revocation `res`'s stored record holds, when it verifies, and its message (`chtypes verify`'s). */
|
|
332
|
+
export async function storedRevocation(ctx, res) {
|
|
333
|
+
const sub = subjectOf(ctx, res);
|
|
334
|
+
let body;
|
|
335
|
+
try {
|
|
336
|
+
body = await readFile(path.join(sub.dir, CACHE_REVOCATION_RECORD));
|
|
337
|
+
}
|
|
338
|
+
catch {
|
|
339
|
+
return undefined;
|
|
340
|
+
}
|
|
341
|
+
const v = verifyRevocation(body, ctx.trustedKeys, sub);
|
|
342
|
+
return 'revocation' in v ? { revocation: v.revocation, text: revokedText(sub, v.revocation) } : undefined;
|
|
343
|
+
}
|
|
344
|
+
/** The check every call that answers from the cache with no request makes (`--offline`, `--frozen --offline`): the stored record. */
|
|
345
|
+
export async function checkInstalledStored(ctx, res) {
|
|
346
|
+
if (!revocationOn())
|
|
347
|
+
return [];
|
|
348
|
+
const warn = [];
|
|
349
|
+
await checkStored(ctx, subjectOf(ctx, res), warn);
|
|
350
|
+
return warn;
|
|
351
|
+
}
|
|
352
|
+
/** `--frozen`'s check of the build installed under its pin: the stored record, then one listing under the retry table. */
|
|
353
|
+
export async function checkFrozenInstalled(ctx, res) {
|
|
354
|
+
if (!revocationOn())
|
|
355
|
+
return [];
|
|
356
|
+
const warn = [];
|
|
357
|
+
const sub = subjectOf(ctx, res);
|
|
358
|
+
if (await checkStored(ctx, sub, warn))
|
|
359
|
+
return warn;
|
|
360
|
+
const out = await checkListing(ctx, sub, false);
|
|
361
|
+
await settle(ctx, sub, out, true, warn);
|
|
362
|
+
return warn;
|
|
363
|
+
}
|
|
364
|
+
/** The installed-build check's in-process outcomes, by platform manifest digest: at most one check per build per process. */
|
|
365
|
+
const memo = new Map();
|
|
366
|
+
let deadlineSeconds = REVOCATION_CHECK_S;
|
|
367
|
+
/** Forgets every kept outcome, as a new process would. A conformance runner calls it before every case. Test-only. */
|
|
368
|
+
export function resetRevocationMemoForTests() {
|
|
369
|
+
testOnly('resetRevocationMemoForTests');
|
|
370
|
+
memo.clear();
|
|
371
|
+
}
|
|
372
|
+
/** Shortens (or, with `undefined`, restores) the installed-build check's one deadline. Test-only. */
|
|
373
|
+
export function setRevocationCheckDeadlineForTests(seconds) {
|
|
374
|
+
testOnly('setRevocationCheckDeadlineForTests');
|
|
375
|
+
deadlineSeconds = seconds ?? REVOCATION_CHECK_S;
|
|
376
|
+
}
|
|
377
|
+
function newEntry() {
|
|
378
|
+
let finish;
|
|
379
|
+
const done = new Promise((resolve) => {
|
|
380
|
+
finish = resolve;
|
|
381
|
+
});
|
|
382
|
+
return { done, finish, state: 'not-revoked', found: undefined };
|
|
383
|
+
}
|
|
384
|
+
/** One network check under the installed-build check's budget. Passing the deadline is an unread status. */
|
|
385
|
+
async function checkWithDeadline(ctx, sub) {
|
|
386
|
+
const controller = new AbortController();
|
|
387
|
+
const timer = setTimeout(() => controller.abort(), deadlineSeconds * 1000);
|
|
388
|
+
try {
|
|
389
|
+
const out = await checkListing(ctx, sub, true, controller.signal);
|
|
390
|
+
if (out.verified === undefined && out.unread !== undefined && controller.signal.aborted) {
|
|
391
|
+
out.unread = { ...out.unread, text: `the check passed its ${deadlineSeconds}s deadline: ${out.unread.text}` };
|
|
392
|
+
}
|
|
393
|
+
return out;
|
|
394
|
+
}
|
|
395
|
+
finally {
|
|
396
|
+
clearTimeout(timer);
|
|
397
|
+
}
|
|
398
|
+
}
|
|
399
|
+
function keep(manifest, out) {
|
|
400
|
+
const e = memo.get(manifest);
|
|
401
|
+
if (e === undefined)
|
|
402
|
+
return;
|
|
403
|
+
if (out.verified !== undefined) {
|
|
404
|
+
e.state = 'revoked';
|
|
405
|
+
e.found = out.verified;
|
|
406
|
+
}
|
|
407
|
+
else {
|
|
408
|
+
e.state = 'not-revoked';
|
|
409
|
+
}
|
|
410
|
+
}
|
|
411
|
+
/**
|
|
412
|
+
* The installed-build check: the stored record, then, unless offline, the kept
|
|
413
|
+
* outcome or one check of its own, with one attempt per base, no backoff and one
|
|
414
|
+
* deadline. Concurrent checks of one build share one; a kept "not checked"
|
|
415
|
+
* answers only a call without strict mode, and a check that ends in an error
|
|
416
|
+
* keeps nothing. Warnings go on `warn`; a refusal is thrown.
|
|
417
|
+
*/
|
|
418
|
+
export async function checkInstalledOnce(ctx, res, warn) {
|
|
419
|
+
if (!revocationOn())
|
|
420
|
+
return;
|
|
421
|
+
const sub = subjectOf(ctx, res);
|
|
422
|
+
if ((await checkStored(ctx, sub, warn)) || ctx.offline)
|
|
423
|
+
return;
|
|
424
|
+
for (;;) {
|
|
425
|
+
let e = memo.get(sub.manifest);
|
|
426
|
+
const lead = e === undefined;
|
|
427
|
+
if (e === undefined) {
|
|
428
|
+
e = newEntry();
|
|
429
|
+
memo.set(sub.manifest, e);
|
|
430
|
+
}
|
|
431
|
+
if (!lead) {
|
|
432
|
+
await e.done;
|
|
433
|
+
const current = memo.get(sub.manifest) === e;
|
|
434
|
+
const { state, found } = e;
|
|
435
|
+
if (!current)
|
|
436
|
+
continue; // that check kept nothing: check again
|
|
437
|
+
if (state === 'revoked') {
|
|
438
|
+
await settle(ctx, sub, { verified: found, warnings: [], unread: undefined }, true, warn);
|
|
439
|
+
}
|
|
440
|
+
else if (state === 'not-checked' && ctx.requireRevocationCheck) {
|
|
441
|
+
// A strict call never takes a kept "not checked": it checks for itself,
|
|
442
|
+
// and keeps a better answer when it gets one.
|
|
443
|
+
const out = await checkWithDeadline(ctx, sub);
|
|
444
|
+
if (out.unread === undefined)
|
|
445
|
+
keep(sub.manifest, out);
|
|
446
|
+
await settle(ctx, sub, out, true, warn);
|
|
447
|
+
}
|
|
448
|
+
return; // not revoked, or not checked and already warned
|
|
449
|
+
}
|
|
450
|
+
let out;
|
|
451
|
+
try {
|
|
452
|
+
out = await checkWithDeadline(ctx, sub);
|
|
453
|
+
await settle(ctx, sub, out, true, warn);
|
|
454
|
+
if (out.verified !== undefined) {
|
|
455
|
+
e.state = 'revoked';
|
|
456
|
+
e.found = out.verified;
|
|
457
|
+
}
|
|
458
|
+
else if (out.unread !== undefined) {
|
|
459
|
+
e.state = 'not-checked';
|
|
460
|
+
}
|
|
461
|
+
else {
|
|
462
|
+
e.state = 'not-revoked';
|
|
463
|
+
}
|
|
464
|
+
}
|
|
465
|
+
catch (err) {
|
|
466
|
+
if (out?.verified !== undefined) {
|
|
467
|
+
e.state = 'revoked';
|
|
468
|
+
e.found = out.verified;
|
|
469
|
+
}
|
|
470
|
+
else {
|
|
471
|
+
memo.delete(sub.manifest); // a 410 or a strict failure: keep nothing
|
|
472
|
+
}
|
|
473
|
+
throw err;
|
|
474
|
+
}
|
|
475
|
+
finally {
|
|
476
|
+
e.finish();
|
|
477
|
+
}
|
|
478
|
+
return;
|
|
479
|
+
}
|
|
480
|
+
}
|
|
481
|
+
//# sourceMappingURL=revocation.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"revocation.js","sourceRoot":"","sources":["../../src/ocifetch/revocation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,yBAAyB,EACzB,kBAAkB,EAClB,cAAc,GACf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAClE,OAAO,EAEL,oBAAoB,EACpB,oBAAoB,EAEpB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,GAEvB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AACzE,OAAO,EAA2B,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAsB3D,yDAAyD;AACzD,MAAM,UAAU,YAAY;IAC1B,OAAO,aAAa,EAAE,CAAC,UAAU,CAAC;AACpC,CAAC;AAqBD,SAAS,QAAQ,CAAC,IAAY,EAAE,GAAW;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrC,OAAO,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AACrF,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,SAAS,CAAC,GAAsB,EAAE,GAAa;IAC7D,OAAO;QACL,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ;QAC9B,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK;QACxB,SAAS,EAAE,GAAG,CAAC,SAAyD;QACxE,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,QAAQ,EAAE,GAAG,CAAC,GAAG,KAAK,EAAE,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC;KAC7D,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAAuC,EAAE,GAAW;IAC3E,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,kBAAkB,CAAC,SAAoB,EAAE,QAAgB,EAAE,KAAa,EAAE,QAAgB,EAAE,OAAe;IACzH,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC;IACjC,OAAO;QACL,QAAQ;QACR,KAAK;QACL,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,eAAe,CAAC,IAAI,EAAE,oBAAoB,CAAC;QACpD,QAAQ;QACR,KAAK,EAAE,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC;QACrC,OAAO;QACP,GAAG,EAAE,EAAE;QACP,QAAQ,EAAE,KAAK;KAChB,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,SAAS,KAAK,CAAC,CAAU;IACvB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,IAAI,CAAC,CAAU;IACtB,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,IAA2B,EAAE,GAAsB;IAChG,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;IACzF,IAAI,EAAa,CAAC;IAClB,IAAI,CAAC;QACH,EAAE,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,oBAAoB;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;QACxE,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,EAAE,CAAC,KAAK,KAAK,cAAc;QAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC;IAC9I,IAAI,EAAE,CAAC,aAAa,KAAK,yBAAyB,EAAE,CAAC;QACnD,OAAO,EAAE,MAAM,EAAE,iBAAiB,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,aAAa,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,yBAAyB,CAAC,EAAE,EAAE,CAAC;IAChI,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;IACjG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,0CAA0C,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;IACpI,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC;IAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3B,IAAI,CAAC,KAAK,GAAG,CAAC,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,sBAAsB,IAAI,CAAC,CAAC,CAAC,uBAAuB,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC9G,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IACxB,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB,IAAI,CAAC,GAAG,CAAC,uBAAuB,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IAClI,KAAK,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,EAAE,OAAO,CAAC,EAAE,CAAC;QACjF,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,MAAM,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,uBAAuB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC9I,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAA+B,CAAC,CAAC,CAAC,EAAE,CAAC;IACtH,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,EAAE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACjF,OAAO,EAAE,MAAM,EAAE,kDAAkD,EAAE,CAAC;IACxE,CAAC;IACD,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,CAAC,EAAE,CAAC;QACpE,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,kBAAkB,EAAE,CAAC;QAC/E,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAa;QACzB,EAAE,EAAE,mBAAmB,CAAC,EAAE,CAAC;QAC3B,GAAG,EAAE,mBAAmB,CAAC,GAAG,CAAC;QAC7B,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAE,CAAC;QAC1C,OAAO,EAAE,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAE,CAAC;QAC9C,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,YAAY,EAAE,mBAAmB,CAAC,IAAI,CAAC,eAAe,CAAE,CAAC;QACzD,SAAS,EAAE,mBAAmB,CAAC,IAAI,CAAC,YAAY,CAAE,CAAC;KACpD,CAAC;IACF,OAAO,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;AAC1F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAsB,EAAE,GAAe;IACjE,MAAM,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAE,CAAC;IAC7B,IAAI,GAAG,GAAG,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,QAAQ,UAAU,GAAG,CAAC,KAAK,cAAc,GAAG,CAAC,QAAQ,iBAAiB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;IACtH,IAAI,CAAC,CAAC,KAAK,KAAK,EAAE;QAAE,GAAG,IAAI,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC;IAC3C,IAAI,CAAC,CAAC,YAAY,KAAK,EAAE;QAAE,GAAG,IAAI,yBAAyB,CAAC,CAAC,YAAY,EAAE,CAAC;IAC5E,IAAI,CAAC,CAAC,OAAO,KAAK,EAAE;QAAE,GAAG,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;IAC9C,OAAO,GAAG,CAAC;AACb,CAAC;AA0BD,SAAS,MAAM,CAAC,GAAY;IAC1B,IAAI,GAAG,YAAY,uBAAuB;QAAE,OAAO,wBAAwB,CAAC;IAC5E,IAAI,GAAG,YAAY,oBAAoB;QAAE,OAAO,qBAAqB,CAAC;IACtE,OAAO,uBAAuB,CAAC;AACjC,CAAC;AAED,SAAS,UAAU,CAAC,GAAsB,EAAE,MAAe,EAAE,MAA+B;IAC1F,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC3H,CAAC;AAED,qGAAqG;AACrG,KAAK,UAAU,mBAAmB,CAAC,KAAwB,EAAE,IAAwB,EAAE,OAAuB;IAC5G,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1E,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,gBAAgB,EAAE,CAAC;QAChF,MAAM,IAAI,oBAAoB,CAAC,qBAAqB,IAAI,CAAC,MAAM,kBAAkB,QAAQ,CAAC,KAAK,CAAC,IAAI,oBAAoB,gBAAgB,kBAAkB,CAAC,CAAC;IAC9J,CAAC;IACD,OAAO,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAChE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAsB,EACtB,KAAwB,EACxB,KAAoC,EACpC,GAAsB,EACtB,MAAe,EACf,MAAoB;IAEpB,MAAM,GAAG,GAAsB,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACxF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAwB,CAAC;QAC7B,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACjF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,MAAM,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;YAC3B,IAAI,CAAC,CAAC,GAAG,YAAY,oBAAoB,CAAC,EAAE,CAAC;gBAC3C,GAAG,CAAC,MAAM,GAAG,EAAE,IAAI,EAAE,cAAc,IAAI,CAAC,MAAM,uBAAuB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7I,SAAS;YACX,CAAC;YACD,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC;QACvB,CAAC;QACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YACvD,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;gBACtB,GAAG,CAAC,QAAQ,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC;gBAC1D,OAAO,GAAG,CAAC;YACb,CAAC;YACD,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QACpB,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,uBAAuB,IAAI,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAAQ,oCAAoC,MAAM,EAAE,CAAC,CAAC;IACjI,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAsB,EAAE,GAAsB,EAAE,MAAe,EAAE,MAAoB;IACtH,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtF,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,IAAI,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACvF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;IACzG,CAAC;IACD,OAAO,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAC7E,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,GAAsB,EAAE,KAAwB,EAAE,KAAa;IACrF,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC5B,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;YACrB,IAAI,CAAC,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;gBACtB,CAAC,CAAC,QAAQ,GAAG,OAAO,CAAC;gBACrB,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;YACtB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,6BAA6B;QAC/B,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC,CAAC;IACH,OAAO,8CAA8C,GAAG,CAAC,QAAQ,YAAY,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,EAAE,CAAC;AAC7G,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,IAAY;IAC/C,MAAM,OAAO,GAAG,YAAY,IAAI,EAAE,CAAC;IACnC,IAAI,MAAM,CAAC,IAAI,KAAK,wBAAwB;QAAE,OAAO,IAAI,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAC1F,IAAI,MAAM,CAAC,IAAI,KAAK,qBAAqB;QAAE,OAAO,IAAI,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACpF,OAAO,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,GAAsB,EAAE,GAAsB,EAAE,GAAsB,EAAE,KAAc,EAAE,IAAc;IACjI,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,KAAK,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC1B,8DAA8D;YAC9D,MAAM,qBAAqB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACvD,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,sCAAsC,IAAI,EAAE,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QACD,MAAM,IAAI,oBAAoB,CAAC,YAAY,IAAI,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7D,IAAI,GAAG,CAAC,sBAAsB;YAAE,MAAM,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACpE,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED,uFAAuF;AAEvF,4HAA4H;AAC5H,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,GAAW,EAAE,MAAc;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC7D,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;QAAE,OAAO;IAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,uBAAuB,QAAQ,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/G,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAClC,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,8HAA8H;AAC9H,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAsB,EAAE,GAAW,EAAE,OAAoC;IAC1G,IAAI,OAAO,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC;QACxE,MAAM,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAsB,EAAE,GAAsB,EAAE,IAAc;IAC9F,IAAI,GAAG,CAAC,GAAG,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IACzD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IACvD,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,8BAA8B,IAAI,iBAAiB,GAAG,CAAC,QAAQ,oCAAoC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACzH,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAC/H,OAAO,IAAI,CAAC;AACd,CAAC;AAED,0GAA0G;AAC1G,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAsB,EAAE,GAAa;IAC1E,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IACvD,OAAO,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5G,CAAC;AAED,qIAAqI;AACrI,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAsB,EAAE,GAAa;IAC9E,IAAI,CAAC,YAAY,EAAE;QAAE,OAAO,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IAClD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,0HAA0H;AAC1H,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAsB,EAAE,GAAa;IAC9E,IAAI,CAAC,YAAY,EAAE;QAAE,OAAO,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChC,IAAI,MAAM,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAChD,MAAM,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACxC,OAAO,IAAI,CAAC;AACd,CAAC;AAaD,6HAA6H;AAC7H,MAAM,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAC;AAE1C,IAAI,eAAe,GAAG,kBAA4B,CAAC;AAEnD,sHAAsH;AACtH,MAAM,UAAU,2BAA2B;IACzC,QAAQ,CAAC,6BAA6B,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK,EAAE,CAAC;AACf,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,kCAAkC,CAAC,OAA2B;IAC5E,QAAQ,CAAC,oCAAoC,CAAC,CAAC;IAC/C,eAAe,GAAG,OAAO,IAAI,kBAAkB,CAAC;AAClD,CAAC;AAED,SAAS,QAAQ;IACf,IAAI,MAAmB,CAAC;IACxB,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QACzC,MAAM,GAAG,OAAO,CAAC;IACnB,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAClE,CAAC;AAED,4GAA4G;AAC5G,KAAK,UAAU,iBAAiB,CAAC,GAAsB,EAAE,GAAsB;IAC7E,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,eAAe,GAAG,IAAI,CAAC,CAAC;IAC3E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAClE,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACxF,GAAG,CAAC,MAAM,GAAG,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,wBAAwB,eAAe,eAAe,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QAChH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,QAAgB,EAAE,GAAsB;IACpD,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO;IAC5B,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC/B,CAAC,CAAC,KAAK,GAAG,SAAS,CAAC;QACpB,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC;IACzB,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,KAAK,GAAG,aAAa,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAsB,EAAE,GAAa,EAAE,IAAc;IAC5F,IAAI,CAAC,YAAY,EAAE;QAAE,OAAO;IAC5B,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO;QAAE,OAAO;IAC/D,SAAS,CAAC;QACR,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,CAAC,KAAK,SAAS,CAAC;QAC7B,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACpB,CAAC,GAAG,QAAQ,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC5B,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,CAAC,CAAC,IAAI,CAAC;YACb,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC7C,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YAC3B,IAAI,CAAC,OAAO;gBAAE,SAAS,CAAC,uCAAuC;YAC/D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAC3F,CAAC;iBAAM,IAAI,KAAK,KAAK,aAAa,IAAI,GAAG,CAAC,sBAAsB,EAAE,CAAC;gBACjE,wEAAwE;gBACxE,8CAA8C;gBAC9C,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBAC9C,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;oBAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;gBACtD,MAAM,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAC1C,CAAC;YACD,OAAO,CAAC,iDAAiD;QAC3D,CAAC;QAED,IAAI,GAAkC,CAAC;QACvC,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACxC,MAAM,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YACxC,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC/B,CAAC,CAAC,KAAK,GAAG,SAAS,CAAC;gBACpB,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC;YACzB,CAAC;iBAAM,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACpC,CAAC,CAAC,KAAK,GAAG,aAAa,CAAC;YAC1B,CAAC;iBAAM,CAAC;gBACN,CAAC,CAAC,KAAK,GAAG,aAAa,CAAC;YAC1B,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAChC,CAAC,CAAC,KAAK,GAAG,SAAS,CAAC;gBACpB,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,0CAA0C;YACvE,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,CAAC,CAAC,MAAM,EAAE,CAAC;QACb,CAAC;QACD,OAAO;IACT,CAAC;AACH,CAAC"}
|
package/dist/ocifetch/types.d.ts
CHANGED
|
@@ -4,6 +4,7 @@
|
|
|
4
4
|
* outside this module imports from anywhere but `index.ts`.
|
|
5
5
|
*/
|
|
6
6
|
import { PLATFORMS } from './constants.gen.js';
|
|
7
|
+
import type { Revocation } from './errors.js';
|
|
7
8
|
/**
|
|
8
9
|
* Every `GET …/manifests/<ref>` — by tag or by digest — sends this `Accept`
|
|
9
10
|
* header (the delivery side's review): our own host ignores it, but a
|
|
@@ -101,9 +102,16 @@ export interface Resolved {
|
|
|
101
102
|
/** One `verify_installed` row. */
|
|
102
103
|
export interface VerifyResult {
|
|
103
104
|
readonly platform: PlatformKey;
|
|
105
|
+
readonly version: string;
|
|
104
106
|
readonly dir: string;
|
|
105
107
|
readonly ok: boolean;
|
|
106
108
|
readonly detail: string;
|
|
109
|
+
/**
|
|
110
|
+
* Set, and `detail` its message, when the entry holds a stored revocation that
|
|
111
|
+
* verifies (guide, "Build-level revocation"): `chtypes verify` reports the
|
|
112
|
+
* build as revoked and exits 11.
|
|
113
|
+
*/
|
|
114
|
+
readonly revocation?: Revocation | undefined;
|
|
107
115
|
}
|
|
108
116
|
/**
|
|
109
117
|
* Test-only injection point (plan §3.2 "Sleeps are asserted exactly"): every
|
|
@@ -136,7 +144,7 @@ export interface FetchV1Options {
|
|
|
136
144
|
readonly allowUnsigned?: boolean;
|
|
137
145
|
/** Sent as `Authorization: Bearer <token>` to configured base hosts only. */
|
|
138
146
|
readonly token?: string;
|
|
139
|
-
/** `resolve_installed`'s mode for `ensure`: cache/system dirs only, no network. */
|
|
147
|
+
/** `resolve_installed`'s mode for `ensure`: cache/system dirs only, no network. Unset reads `CHTYPES_OFFLINE` ("1" is on); offline is on when this is true OR the variable is "1"; neither turns the other off (public issue #528). */
|
|
140
148
|
readonly offline?: boolean;
|
|
141
149
|
/** Skip resolution; fetch the lock's pinned digests directly. */
|
|
142
150
|
readonly frozen?: boolean;
|
|
@@ -144,7 +152,7 @@ export interface FetchV1Options {
|
|
|
144
152
|
readonly lockPath?: string;
|
|
145
153
|
/** Write (or update) the lock after a successful `ensure`. */
|
|
146
154
|
readonly lockWrite?: boolean;
|
|
147
|
-
/**
|
|
155
|
+
/** Pin every platform the index offers, not only the host's (guide §6) — `lockWrite` only. On unless `false`. */
|
|
148
156
|
readonly lockAllPlatforms?: boolean;
|
|
149
157
|
/** Re-resolve every locked request and rewrite the lock, ignoring `frozen`. */
|
|
150
158
|
readonly update?: boolean;
|
|
@@ -157,6 +165,14 @@ export interface FetchV1Options {
|
|
|
157
165
|
* `CHTYPES_CACHE_STRICT` (`1` is on), else off.
|
|
158
166
|
*/
|
|
159
167
|
readonly strictCache?: boolean;
|
|
168
|
+
/**
|
|
169
|
+
* Use a build a verified revocation refuses, with one warning naming the
|
|
170
|
+
* advisory (guide, "Build-level revocation"). Per call and never an environment
|
|
171
|
+
* variable; ignored with `lockWrite` or `update`, and never applies to a 410.
|
|
172
|
+
*/
|
|
173
|
+
readonly allowRevoked?: boolean;
|
|
174
|
+
/** A revocation status that cannot be read is the transport's error rather than one warning. */
|
|
175
|
+
readonly requireRevocationCheck?: boolean;
|
|
160
176
|
readonly clock?: Clock;
|
|
161
177
|
/** Test-only: runs after the index's temp-write, before its atomic rename. */
|
|
162
178
|
readonly beforeIndexRename?: () => Promise<void> | void;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/ocifetch/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAyC,SAAS,EAAE,MAAM,oBAAoB,CAAC;
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/ocifetch/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAyC,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACtF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,QAAgD,CAAC;AAEpF,sEAAsE;AACtE,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;AAE5D,mDAAmD;AACnD,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,WAAW,CAEjE;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,GAAG,EAAE,WAAW,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAMhI;AAED,uGAAuG;AACvG,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAIzF;AAED,mFAAmF;AACnF,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC;AAEpC,2FAA2F;AAC3F,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,8EAA8E;AAC9E,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE;YAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,EAAE,CAAC;IACrG,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,iGAAiG;IACjG,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AAED,wEAAwE;AACxE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,2CAA2C;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,sEAAsE;AACtE,MAAM,WAAW,QAAQ;IACvB,+FAA+F;IAC/F,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,kDAAkD;IAClD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,iDAAiD;IACjD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,kDAAkD;IAClD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED,kCAAkC;AAClC,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;CAC9C;AAED;;;;;GAKG;AACH,MAAM,WAAW,KAAK;IACpB,GAAG,IAAI,MAAM,CAAC;IACd,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,wBAAgB,SAAS,IAAI,KAAK,CAQjC;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,qEAAqE;IACrE,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,uDAAuD;IACvD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,qCAAqC;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,0DAA0D;IAC1D,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IAC7C,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,6EAA6E;IAC7E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,uOAAuO;IACvO,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,qFAAqF;IACrF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,iHAAiH;IACjH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,gGAAgG;IAChG,QAAQ,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,8EAA8E;IAC9E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACxD,0FAA0F;IAC1F,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC;CACvE;AAED,gEAAgE;AAChE,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,WAAW,CAWpH;AAED,mHAAmH;AACnH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAMlD;AAED,sCAAsC;AACtC,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE/C;AAgBD,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,uGAAuG;AACvG,wBAAgB,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAM1E"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/ocifetch/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;
|
|
1
|
+
{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/ocifetch/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAGtF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,gBAAgB,KAAK,mBAAmB,EAAE,CAAC;AAKpF,mDAAmD;AACnD,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAQ,SAAiD,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC;AACzF,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,YAAY,CAAC,GAAgB;IAC3C,MAAM,GAAG,GAAI,SAAqG,CAAC,IAAI,CACrH,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CACrB,CAAC;IACF,IAAI,GAAG,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,sBAAsB,CAAC,CAAC;IAC3F,OAAO,GAAwF,CAAC;AAClG,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,QAAgB;IAC9D,MAAM,IAAI,GAAG,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;IACrD,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC;IAChC,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9C,CAAC;AAwGD,MAAM,UAAU,SAAS;IACvB,OAAO;QACL,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;QACrB,KAAK,EAAE,CAAC,OAAe,EAAE,EAAE,CACzB,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YACtB,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;QACnD,CAAC,CAAC;KACL,CAAC;AACJ,CAAC;AA2DD,gEAAgE;AAChE,MAAM,UAAU,qBAAqB,CAAC,MAA+B,EAAE,MAAc,EAAE,QAAgB;IACrG,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,uBAAuB,MAAM,IAAI,QAAQ,mCAAoC,SAAwC;aAClH,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;aACjB,IAAI,CAAC,IAAI,CAAC,GAAG,CACjB,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,mHAAmH;AACnH,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACzC,IAAI,IAAI,KAAK,QAAQ,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sCAAsC;AACtC,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,OAAO,UAAU,GAAG,EAAE,CAAC;AACzB,CAAC;AAED,4EAA4E;AAC5E,EAAE;AACF,2EAA2E;AAC3E,6EAA6E;AAC7E,oEAAoE;AACpE,yEAAyE;AACzE,2EAA2E;AAC3E,uEAAuE;AACvE,4EAA4E;AAC5E,6EAA6E;AAC7E,yEAAyE;AACzE,uDAAuD;AACvD,qEAAqE;AAErE,MAAM,UAAU,iBAAiB,CAAC,CAAS;IACzC,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,WAAW,CAAC,cAAsB,EAAE,MAAc;IAChE,MAAM,IAAI,GAAG,iBAAiB,CAAC,cAAc,CAAC,CAAC;IAC/C,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,GAAG,IAAI,GAAG,MAAM,EAAE,CAAC;IACxD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC/C,OAAO,GAAG,CAAC,CAAC,MAAM,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC;AAC9C,CAAC"}
|