@xemahq/xema 0.59.1 → 0.60.1

package/dist/runtime/runner/native-runner.js

@@ -1,94 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.NativeRunner = void 0;
-const node_fs_1 = require("node:fs");
-const node_path_1 = require("node:path");
-const forked_worker_1 = require("../../dev/forked-worker");
-const paths_1 = require("../paths");
-const service_runner_1 = require("./service-runner");
-class NativeRunner {
-    kind = service_runner_1.ServiceRunnerKind.Native;
-    monorepoRoot;
-    constructor(opts = {}) {
-        const root = opts.monorepoRoot ?? (0, paths_1.findMonorepoRoot)();
-        if (!root) {
-            throw new Error('NativeRunner requires a monorepo checkout (built service dist/ trees). ' +
-                'Run inside the monorepo, or use the container substrate.');
-        }
-        this.monorepoRoot = root;
-    }
-    async start(input) {
-        const { entry, env, port, readinessTimeoutMs, onSpawned, onStoppedBeforeReady, } = input;
-        if (!entry.servicePath) {
-            throw new Error(`${entry.name}: no servicePath (platform-substrate service) — not bootable natively. ` +
-                `Use the container substrate for this service.`);
-        }
-        const watch = (0, forked_worker_1.resolveLaunchMode)() === forked_worker_1.LaunchMode.Watch;
-        const baseRoot = entry.sourceRoot ?? this.monorepoRoot;
-        const serviceRoot = this.resolveServiceRoot(entry.servicePath, baseRoot, watch);
-        if (!serviceRoot) {
-            const marker = watch ? (0, node_path_1.join)('src', 'main.ts') : (0, node_path_1.join)('dist', 'main.js');
-            const primary = (0, node_path_1.join)(baseRoot, entry.servicePath, marker);
-            throw new Error(watch
-                ? `${entry.name} source entry not found at ${primary}. --watch runs each ` +
-                    `service from source; a source checkout of ${entry.name} is required.`
-                : `${entry.name} dist not found at ${primary}. Run \`pnpm --filter ${entry.name} build\` first.`);
-        }
-        return this.forkService(entry, serviceRoot, port, readinessTimeoutMs, watch, env, onSpawned, onStoppedBeforeReady);
-    }
-    async forkService(entry, serviceRoot, port, readinessTimeoutMs, watch, env, onSpawned, onStoppedBeforeReady) {
-        const child = await (0, forked_worker_1.spawnForkedWorker)({
-            name: entry.name,
-            port,
-            siblingAppDir: serviceRoot,
-            readinessTimeoutMs,
-            watch,
-            env,
-            ...(onSpawned === undefined
-                ? {}
-                : {
-                    onSpawned: async (handle) => {
-                        await onSpawned({
-                            name: entry.name,
-                            url: handle.url,
-                            handle: `pid:${String(handle.pid)}`,
-                            close: () => handle.close(),
-                        });
-                    },
-                }),
-            ...(onStoppedBeforeReady === undefined
-                ? {}
-                : {
-                    onStoppedBeforeReady: async (handle) => {
-                        await onStoppedBeforeReady({
-                            name: entry.name,
-                            url: handle.url,
-                            handle: `pid:${String(handle.pid)}`,
-                            close: () => handle.close(),
-                        });
-                    },
-                }),
-        }, '/');
-        return {
-            name: entry.name,
-            url: child.url,
-            handle: `pid:${String(child.pid)}`,
-            close: () => child.close(),
-        };
-    }
-    resolveServiceRoot(servicePath, baseRoot, watch) {
-        const marker = watch ? (0, node_path_1.join)('src', 'main.ts') : (0, node_path_1.join)('dist', 'main.js');
-        const candidates = [
-            (0, node_path_1.join)(baseRoot, servicePath),
-            (0, node_path_1.join)(baseRoot, (0, node_path_1.dirname)(servicePath)),
-        ];
-        for (const candidate of candidates) {
-            if ((0, node_fs_1.existsSync)((0, node_path_1.join)(candidate, marker))) {
-                return candidate;
-            }
-        }
-        return null;
-    }
-}
-exports.NativeRunner = NativeRunner;
-//# sourceMappingURL=native-runner.js.map

package/dist/runtime/runner/native-runner.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"native-runner.js","sourceRoot":"","sources":["../../../src/runtime/runner/native-runner.ts"],"names":[],"mappings":";;;AAAA,qCAAqC;AACrC,yCAA0C;AAE1C,2DAIiC;AACjC,oCAA4C;AAC5C,qDAK0B;AAiB1B,MAAa,YAAY;IACd,IAAI,GAAG,kCAAiB,CAAC,MAAM,CAAC;IACxB,YAAY,CAAS;IAEtC,YAAY,OAA4B,EAAE;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,IAAI,IAAA,wBAAgB,GAAE,CAAC;QACrD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CACb,yEAAyE;gBACvE,0DAA0D,CAC7D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAwB;QAClC,MAAM,EACJ,KAAK,EACL,GAAG,EACH,IAAI,EACJ,kBAAkB,EAClB,SAAS,EACT,oBAAoB,GACrB,GAAG,KAAK,CAAC;QACV,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,IAAI,yEAAyE;gBACpF,+CAA+C,CAClD,CAAC;QACJ,CAAC;QAMD,MAAM,KAAK,GAAG,IAAA,iCAAiB,GAAE,KAAK,0BAAU,CAAC,KAAK,CAAC;QAIvD,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,YAAY,CAAC;QACvD,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CACzC,KAAK,CAAC,WAAW,EACjB,QAAQ,EACR,KAAK,CACN,CAAC;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAA,gBAAI,EAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAI,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACxE,MAAM,OAAO,GAAG,IAAA,gBAAI,EAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YAC1D,MAAM,IAAI,KAAK,CACb,KAAK;gBACH,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,8BAA8B,OAAO,sBAAsB;oBACxE,6CAA6C,KAAK,CAAC,IAAI,eAAe;gBACxE,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,sBAAsB,OAAO,yBAAyB,KAAK,CAAC,IAAI,iBAAiB,CACnG,CAAC;QACJ,CAAC;QAGD,OAAO,IAAI,CAAC,WAAW,CACrB,KAAK,EACL,WAAW,EACX,IAAI,EACJ,kBAAkB,EAClB,KAAK,EACL,GAAG,EACH,SAAS,EACT,oBAAoB,CACrB,CAAC;IACJ,CAAC;IASO,KAAK,CAAC,WAAW,CACvB,KAAkB,EAClB,WAAmB,EACnB,IAAY,EACZ,kBAA0B,EAC1B,KAAc,EACd,GAAqC,EACrC,SAAyC,EACzC,oBAA+D;QAE/D,MAAM,KAAK,GAAG,MAAM,IAAA,iCAAiB,EACnC;YACE,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI;YACJ,aAAa,EAAE,WAAW;YAC1B,kBAAkB;YAClB,KAAK;YACL,GAAG;YACH,GAAG,CAAC,SAAS,KAAK,SAAS;gBACzB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC;oBACE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;wBAC1B,MAAM,SAAS,CAAC;4BACd,IAAI,EAAE,KAAK,CAAC,IAAI;4BAChB,GAAG,EAAE,MAAM,CAAC,GAAG;4BACf,MAAM,EAAE,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;4BACnC,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE;yBAC5B,CAAC,CAAC;oBACL,CAAC;iBACF,CAAC;YACN,GAAG,CAAC,oBAAoB,KAAK,SAAS;gBACpC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC;oBACE,oBAAoB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;wBACrC,MAAM,oBAAoB,CAAC;4BACzB,IAAI,EAAE,KAAK,CAAC,IAAI;4BAChB,GAAG,EAAE,MAAM,CAAC,GAAG;4BACf,MAAM,EAAE,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;4BACnC,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE;yBAC5B,CAAC,CAAC;oBACL,CAAC;iBACF,CAAC;SACP,EACD,GAAG,CACJ,CAAC;QACF,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,MAAM,EAAE,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;YAClC,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE;SAC3B,CAAC;IACJ,CAAC;IAWO,kBAAkB,CACxB,WAAmB,EACnB,QAAgB,EAChB,KAAc;QAEd,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAA,gBAAI,EAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAI,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACxE,MAAM,UAAU,GAAG;YACjB,IAAA,gBAAI,EAAC,QAAQ,EAAE,WAAW,CAAC;YAC3B,IAAA,gBAAI,EAAC,QAAQ,EAAE,IAAA,mBAAO,EAAC,WAAW,CAAC,CAAC;SACrC,CAAC;QACF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,IAAA,oBAAU,EAAC,IAAA,gBAAI,EAAC,SAAS,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;gBACxC,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AA3JD,oCA2JC"}

package/dist/runtime/runner/service-runner.d.ts

@@ -1,28 +0,0 @@
-import type { RosterEntry } from '../roster';
-export interface RunningService {
-    readonly name: string;
-    readonly url: string;
-    readonly handle: string;
-    close(graceMs: number): Promise<void>;
-}
-export interface StartServiceInput {
-    readonly entry: RosterEntry;
-    readonly installationId: string;
-    readonly planHash: string;
-    readonly executionId: string;
-    readonly env: Readonly<Record<string, string>>;
-    readonly port: number;
-    readonly readinessTimeoutMs: number;
-    readonly onSpawned?: (service: RunningService) => Promise<void>;
-    readonly onStoppedBeforeReady?: (service: RunningService) => Promise<void>;
-}
-export declare enum ServiceRunnerKind {
-    Native = "native",
-    Container = "container",
-    Helm = "helm"
-}
-export interface ServiceRunner {
-    readonly kind: ServiceRunnerKind;
-    start(input: StartServiceInput): Promise<RunningService>;
-}
-//# sourceMappingURL=service-runner.d.ts.map

package/dist/runtime/runner/service-runner.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"service-runner.d.ts","sourceRoot":"","sources":["../../../src/runtime/runner/service-runner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAS7C,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAErB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAE5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAEhC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAE/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IAEpC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhE,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAC9B,OAAO,EAAE,cAAc,KACpB,OAAO,CAAC,IAAI,CAAC,CAAC;CACpB;AAED,oBAAY,iBAAiB;IAC3B,MAAM,WAAW;IACjB,SAAS,cAAc;IACvB,IAAI,SAAS;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAOjC,KAAK,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC1D"}

package/dist/runtime/runner/service-runner.js

@@ -1,10 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ServiceRunnerKind = void 0;
-var ServiceRunnerKind;
-(function (ServiceRunnerKind) {
-    ServiceRunnerKind["Native"] = "native";
-    ServiceRunnerKind["Container"] = "container";
-    ServiceRunnerKind["Helm"] = "helm";
-})(ServiceRunnerKind || (exports.ServiceRunnerKind = ServiceRunnerKind = {}));
-//# sourceMappingURL=service-runner.js.map

package/dist/runtime/runner/service-runner.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"service-runner.js","sourceRoot":"","sources":["../../../src/runtime/runner/service-runner.ts"],"names":[],"mappings":";;;AAyCA,IAAY,iBAIX;AAJD,WAAY,iBAAiB;IAC3B,sCAAiB,CAAA;IACjB,4CAAuB,CAAA;IACvB,kCAAa,CAAA;AACf,CAAC,EAJW,iBAAiB,iCAAjB,iBAAiB,QAI5B"}

package/dist/runtime/secrets/generated-platform-secrets.d.ts

@@ -1,16 +0,0 @@
-import { ManagedLocalSecretStore } from './managed-local-secret-store';
-export declare enum GeneratedSecretEncoding {
-    Base64Url = "base64url",
-    Hex = "hex"
-}
-export interface GeneratedSecretSpec {
-    readonly bytes: number;
-    readonly encoding: GeneratedSecretEncoding;
-    readonly reason: string;
-}
-export declare const GENERATED_PLATFORM_SECRETS: Readonly<Record<string, GeneratedSecretSpec>>;
-export declare function identityRealmInternalTokenVar(realm: string): string;
-export declare function mintGeneratedSecret(spec: GeneratedSecretSpec): string;
-export declare function resolveGeneratedPlatformSecrets(store: ManagedLocalSecretStore, supplied: ReadonlySet<string>): Promise<ReadonlyMap<string, string>>;
-export declare function withGeneratedPlatformSecrets(declared: ReadonlyMap<string, string>, installationIdentity: string): Promise<ReadonlyMap<string, string>>;
-//# sourceMappingURL=generated-platform-secrets.d.ts.map

package/dist/runtime/secrets/generated-platform-secrets.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"generated-platform-secrets.d.ts","sourceRoot":"","sources":["../../../src/runtime/secrets/generated-platform-secrets.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AA0CvE,oBAAY,uBAAuB;IAEjC,SAAS,cAAc;IAEvB,GAAG,QAAQ;CACZ;AAED,MAAM,WAAW,mBAAmB;IAElC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAC;IAK3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAOD,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAC/C,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAyFpC,CAAC;AAeF,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAWnE;AAGD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAErE;AAcD,wBAAsB,+BAA+B,CACnD,KAAK,EAAE,uBAAuB,EAC9B,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,GAC5B,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAiBtC;AAUD,wBAAsB,4BAA4B,CAChD,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,EACrC,oBAAoB,EAAE,MAAM,GAC3B,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAWtC"}

package/dist/runtime/secrets/generated-platform-secrets.js

@@ -1,115 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.GENERATED_PLATFORM_SECRETS = exports.GeneratedSecretEncoding = void 0;
-exports.identityRealmInternalTokenVar = identityRealmInternalTokenVar;
-exports.mintGeneratedSecret = mintGeneratedSecret;
-exports.resolveGeneratedPlatformSecrets = resolveGeneratedPlatformSecrets;
-exports.withGeneratedPlatformSecrets = withGeneratedPlatformSecrets;
-const node_crypto_1 = require("node:crypto");
-const managed_local_secret_store_1 = require("./managed-local-secret-store");
-var GeneratedSecretEncoding;
-(function (GeneratedSecretEncoding) {
-    GeneratedSecretEncoding["Base64Url"] = "base64url";
-    GeneratedSecretEncoding["Hex"] = "hex";
-})(GeneratedSecretEncoding || (exports.GeneratedSecretEncoding = GeneratedSecretEncoding = {}));
-exports.GENERATED_PLATFORM_SECRETS = {
-    IDENTITY_API_INTERNAL_TOKEN: {
-        bytes: 48,
-        encoding: GeneratedSecretEncoding.Base64Url,
-        reason: 'Opaque shared secret between every platform service and identity-api. ' +
-            'identity-api matches it back to the realm that owns it via a per-realm ' +
-            '`<REALM>_INTERNAL_TOKEN`, so the launcher must seed BOTH sides from this ' +
-            'one value — see identityRealmInternalTokenVar().',
-    },
-    LLM_REGISTRY_ENCRYPTION_KEY: {
-        bytes: 32,
-        encoding: GeneratedSecretEncoding.Hex,
-        reason: "llm-registry-api's getKey() does Buffer.from(value, 'hex') and throws " +
-            'unless the result is exactly 32 bytes (aes-256-gcm). Any other encoding ' +
-            'boots fine and fails on the first encrypt.',
-    },
-    CREDENTIAL_SEAL_SECRET: {
-        bytes: 48,
-        encoding: GeneratedSecretEncoding.Base64Url,
-        reason: 'Opaque. credential-broker-api derives its sealing key from this shared ' +
-            'secret; it is read as a string and never parsed back into bytes.',
-    },
-    MCP_BRIDGE_JWT_SECRET: {
-        bytes: 48,
-        encoding: GeneratedSecretEncoding.Base64Url,
-        reason: 'Opaque HMAC secret. mcp-gateway-api both mints (resolve.service) and ' +
-            'verifies (bridge-jwt.guard) with it, and agent-session-api presents it, ' +
-            'so all three must receive the same value.',
-    },
-    OAUTH_CONNECT_STATE_SECRET: {
-        bytes: 48,
-        encoding: GeneratedSecretEncoding.Base64Url,
-        reason: 'Opaque HMAC secret signing the OAuth `state` round-trip in ' +
-            'connector-gateway-api (signed-state.ts). Read as a string.',
-    },
-    INVOCATION_TOKEN_SECRET: {
-        bytes: 48,
-        encoding: GeneratedSecretEncoding.Base64Url,
-        reason: 'Opaque HMAC secret app-function-broker uses to MINT and VALIDATE ' +
-            'invocation tokens. Both sides are the same service.',
-    },
-    DISTRIBUTION_INTERNAL_SERVICE_TOKEN: {
-        bytes: 48,
-        encoding: GeneratedSecretEncoding.Base64Url,
-        reason: 'Opaque static bearer, timing-safe compared by container-registry-api ' +
-            "(shared-secret-service-token.guard) on Distribution's callbacks.",
-    },
-    BUILD_AUDIT_INTERNAL_SERVICE_TOKEN: {
-        bytes: 48,
-        encoding: GeneratedSecretEncoding.Base64Url,
-        reason: 'Opaque static bearer, timing-safe compared by container-registry-api ' +
-            'on the build-audit record path.',
-    },
-    BASE_IMAGE_CASCADE_SERVICE_TOKEN: {
-        bytes: 48,
-        encoding: GeneratedSecretEncoding.Base64Url,
-        reason: 'Opaque static bearer, timing-safe compared by container-registry-api ' +
-            'on the base-image cascade path.',
-    },
-    SCM_WEBHOOK_SECRET: {
-        bytes: 48,
-        encoding: GeneratedSecretEncoding.Base64Url,
-        reason: 'Opaque HMAC secret for SCM webhook signature validation. Read by BOTH ' +
-            'scm-connector-api and workflow-engine-api, so one platform-wide value ' +
-            'is what makes a delivery verify.',
-    },
-};
-function identityRealmInternalTokenVar(realm) {
-    const normalized = realm.trim().toUpperCase().replace(/[^A-Z0-9]+/g, '_');
-    if (normalized.length === 0 || /^_+$/.test(normalized)) {
-        throw new Error(`Cannot derive an internal-token variable name from realm "${realm}": ` +
-            'it contains no alphanumeric character, so the derived name would be ' +
-            'empty or all underscores and identity-api could never match it back ' +
-            'to this realm.');
-    }
-    return `${normalized}_INTERNAL_TOKEN`;
-}
-function mintGeneratedSecret(spec) {
-    return (0, node_crypto_1.randomBytes)(spec.bytes).toString(spec.encoding);
-}
-async function resolveGeneratedPlatformSecrets(store, supplied) {
-    const resolved = new Map();
-    for (const [name, spec] of Object.entries(exports.GENERATED_PLATFORM_SECRETS)) {
-        if (supplied.has(name)) {
-            continue;
-        }
-        const entry = `generated/${name}.${spec.encoding}`;
-        resolved.set(name, await store.getOrCreate(entry, () => mintGeneratedSecret(spec)));
-    }
-    return resolved;
-}
-async function withGeneratedPlatformSecrets(declared, installationIdentity) {
-    const store = new managed_local_secret_store_1.ManagedLocalSecretStore({ installationIdentity });
-    const generated = await resolveGeneratedPlatformSecrets(store, new Set(declared.keys()));
-    const merged = new Map(declared);
-    for (const [name, value] of generated) {
-        merged.set(name, value);
-    }
-    return merged;
-}
-//# sourceMappingURL=generated-platform-secrets.js.map

package/dist/runtime/secrets/generated-platform-secrets.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"generated-platform-secrets.js","sourceRoot":"","sources":["../../../src/runtime/secrets/generated-platform-secrets.ts"],"names":[],"mappings":";;;AA4KA,sEAWC;AAGD,kDAEC;AAcD,0EAoBC;AAUD,oEAcC;AAtPD,6CAA0C;AAE1C,6EAAuE;AA0CvE,IAAY,uBAKX;AALD,WAAY,uBAAuB;IAEjC,kDAAuB,CAAA;IAEvB,sCAAW,CAAA;AACb,CAAC,EALW,uBAAuB,uCAAvB,uBAAuB,QAKlC;AAkBY,QAAA,0BAA0B,GAEnC;IACF,2BAA2B,EAAE;QAC3B,KAAK,EAAE,EAAE;QACT,QAAQ,EAAE,uBAAuB,CAAC,SAAS;QAC3C,MAAM,EACJ,wEAAwE;YACxE,yEAAyE;YACzE,2EAA2E;YAC3E,kDAAkD;KACrD;IACD,2BAA2B,EAAE;QAC3B,KAAK,EAAE,EAAE;QACT,QAAQ,EAAE,uBAAuB,CAAC,GAAG;QACrC,MAAM,EACJ,wEAAwE;YACxE,0EAA0E;YAC1E,4CAA4C;KAC/C;IACD,sBAAsB,EAAE;QACtB,KAAK,EAAE,EAAE;QACT,QAAQ,EAAE,uBAAuB,CAAC,SAAS;QAC3C,MAAM,EACJ,yEAAyE;YACzE,kEAAkE;KACrE;IACD,qBAAqB,EAAE;QACrB,KAAK,EAAE,EAAE;QACT,QAAQ,EAAE,uBAAuB,CAAC,SAAS;QAC3C,MAAM,EACJ,uEAAuE;YACvE,0EAA0E;YAC1E,2CAA2C;KAC9C;IACD,0BAA0B,EAAE;QAC1B,KAAK,EAAE,EAAE;QACT,QAAQ,EAAE,uBAAuB,CAAC,SAAS;QAC3C,MAAM,EACJ,6DAA6D;YAC7D,4DAA4D;KAC/D;IACD,uBAAuB,EAAE;QACvB,KAAK,EAAE,EAAE;QACT,QAAQ,EAAE,uBAAuB,CAAC,SAAS;QAC3C,MAAM,EACJ,mEAAmE;YACnE,qDAAqD;KACxD;IAaD,mCAAmC,EAAE;QACnC,KAAK,EAAE,EAAE;QACT,QAAQ,EAAE,uBAAuB,CAAC,SAAS;QAC3C,MAAM,EACJ,uEAAuE;YACvE,kEAAkE;KACrE;IACD,kCAAkC,EAAE;QAClC,KAAK,EAAE,EAAE;QACT,QAAQ,EAAE,uBAAuB,CAAC,SAAS;QAC3C,MAAM,EACJ,uEAAuE;YACvE,iCAAiC;KACpC;IACD,gCAAgC,EAAE;QAChC,KAAK,EAAE,EAAE;QACT,QAAQ,EAAE,uBAAuB,CAAC,SAAS;QAC3C,MAAM,EACJ,uEAAuE;YACvE,iCAAiC;KACpC;IACD,kBAAkB,EAAE;QAClB,KAAK,EAAE,EAAE;QACT,QAAQ,EAAE,uBAAuB,CAAC,SAAS;QAC3C,MAAM,EACJ,wEAAwE;YACxE,wEAAwE;YACxE,kCAAkC;KACrC;CACF,CAAC;AAeF,SAAgB,6BAA6B,CAAC,KAAa;IACzD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IAC1E,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CACb,6DAA6D,KAAK,KAAK;YACrE,sEAAsE;YACtE,sEAAsE;YACtE,gBAAgB,CACnB,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,UAAU,iBAAiB,CAAC;AACxC,CAAC;AAGD,SAAgB,mBAAmB,CAAC,IAAyB;IAC3D,OAAO,IAAA,yBAAW,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACzD,CAAC;AAcM,KAAK,UAAU,+BAA+B,CACnD,KAA8B,EAC9B,QAA6B;IAE7B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,kCAA0B,CAAC,EAAE,CAAC;QACtE,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,SAAS;QACX,CAAC;QAKD,MAAM,KAAK,GAAG,aAAa,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnD,QAAQ,CAAC,GAAG,CACV,IAAI,EACJ,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAChE,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAUM,KAAK,UAAU,4BAA4B,CAChD,QAAqC,EACrC,oBAA4B;IAE5B,MAAM,KAAK,GAAG,IAAI,oDAAuB,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC;IACpE,MAAM,SAAS,GAAG,MAAM,+BAA+B,CACrD,KAAK,EACL,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CACzB,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,SAAS,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/runtime/secrets/resolver.d.ts

@@ -1,23 +0,0 @@
-import { Substrate, type XemaConfig } from '../config/schema';
-export type ResolvedSecrets = ReadonlyMap<string, string>;
-export interface SecretResolverOptions {
-    readonly env?: NodeJS.ProcessEnv;
-    readonly cwd?: string;
-    readonly prompt?: (name: string) => Promise<string>;
-}
-export declare class SecretResolver {
-    private readonly env;
-    private readonly cwd;
-    private readonly prompt;
-    constructor(opts?: SecretResolverOptions);
-    resolve(config: XemaConfig): Promise<ResolvedSecrets>;
-    private resolveOne;
-}
-export declare function secretEnvironment(resolved: ResolvedSecrets): Readonly<Record<string, string>>;
-export declare function assertSecretMaterializationSupported(config: XemaConfig, substrate: Substrate): void;
-export interface PostgresCredentials {
-    readonly username: string;
-    readonly password: string;
-}
-export declare function externalPostgresCredentials(config: XemaConfig, resolved: ResolvedSecrets): PostgresCredentials | undefined;
-//# sourceMappingURL=resolver.d.ts.map

package/dist/runtime/secrets/resolver.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../src/runtime/secrets/resolver.ts"],"names":[],"mappings":"AAQA,OAAO,EAIL,SAAS,EAGT,KAAK,UAAU,EAChB,MAAM,kBAAkB,CAAC;AAO1B,MAAM,MAAM,eAAe,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE1D,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAEjC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACrD;AAID,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAoB;IACxC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;gBAE/C,IAAI,GAAE,qBAA0B;IAWtC,OAAO,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,eAAe,CAAC;YAkB7C,UAAU;CAqCzB;AAOD,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,eAAe,GACxB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAQlC;AAQD,wBAAgB,oCAAoC,CAClD,MAAM,EAAE,UAAU,EAClB,SAAS,EAAE,SAAS,GACnB,IAAI,CAYN;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAMD,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,eAAe,GACxB,mBAAmB,GAAG,SAAS,CA+BjC"}

package/dist/runtime/secrets/resolver.js

@@ -1,266 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.SecretResolver = void 0;
-exports.secretEnvironment = secretEnvironment;
-exports.assertSecretMaterializationSupported = assertSecretMaterializationSupported;
-exports.externalPostgresCredentials = externalPostgresCredentials;
-const node_fs_1 = require("node:fs");
-const node_path_1 = require("node:path");
-const schema_1 = require("../config/schema");
-const read_only_no_follow_flags_1 = require("../read-only-no-follow-flags");
-const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
-class SecretResolver {
-    env;
-    cwd;
-    prompt;
-    constructor(opts = {}) {
-        this.env = opts.env ?? process.env;
-        this.cwd = opts.cwd ?? process.cwd();
-        this.prompt = opts.prompt ?? promptHidden;
-    }
-    async resolve(config) {
-        const resolved = new Map();
-        for (const [name, declaration] of Object.entries(config.secrets)) {
-            const value = await this.resolveOne(name, declaration);
-            if (value.length === 0) {
-                throw new Error(`Secret "${name}" resolved to an empty value.`);
-            }
-            if (value.includes('\0')) {
-                throw new Error(`Secret "${name}" contains a NUL byte.`);
-            }
-            resolved.set(name, value);
-        }
-        validateInfraReferences(config, resolved);
-        validateExternalPostgres(config, resolved);
-        return new SecretSnapshot(resolved);
-    }
-    async resolveOne(name, declaration) {
-        switch (declaration.from) {
-            case schema_1.SecretSource.Env: {
-                const envName = declaration.env ?? name;
-                if (!ENV_NAME.test(envName)) {
-                    throw new Error(`Secret "${name}" has invalid env source "${envName}". Use a valid environment variable name.`);
-                }
-                const value = this.env[envName];
-                if (value === undefined || value.length === 0) {
-                    throw new Error(`Secret "${name}" requires environment variable ${envName}, but it is unset or empty.`);
-                }
-                return value;
-            }
-            case schema_1.SecretSource.File: {
-                if (declaration.path === undefined) {
-                    throw new Error(`Secret "${name}" uses a file source but has no path.`);
-                }
-                const path = (0, node_path_1.isAbsolute)(declaration.path)
-                    ? declaration.path
-                    : (0, node_path_1.resolve)(this.cwd, declaration.path);
-                return readSecretFile(name, path);
-            }
-            case schema_1.SecretSource.Prompt:
-                return this.prompt(name);
-        }
-    }
-}
-exports.SecretResolver = SecretResolver;
-function secretEnvironment(resolved) {
-    const env = {};
-    for (const [name, value] of resolved) {
-        if (ENV_NAME.test(name)) {
-            env[name] = value;
-        }
-    }
-    return env;
-}
-function assertSecretMaterializationSupported(config, substrate) {
-    if (substrate !== schema_1.Substrate.Helm) {
-        return;
-    }
-    const hasDeclarations = Object.keys(config.secrets).length > 0;
-    const usesExternalPostgres = config.infra[schema_1.InfraComponent.Postgres]?.mode === schema_1.InfraMode.External;
-    if (hasDeclarations || usesExternalPostgres) {
-        throw new Error('The Helm substrate does not materialize launcher secrets or external PostgreSQL credentials. Configure Kubernetes Secrets through the service charts instead.');
-    }
-}
-function externalPostgresCredentials(config, resolved) {
-    const postgres = config.infra[schema_1.InfraComponent.Postgres];
-    if (postgres?.mode !== schema_1.InfraMode.External) {
-        return undefined;
-    }
-    const url = parsePostgresUrl(postgres);
-    const username = decodeURIComponent(url.username);
-    const inlinePassword = decodeURIComponent(url.password);
-    if (inlinePassword.length > 0) {
-        throw new Error('infra.postgres external URL must not contain a password; reference a declared secret with secretRef.');
-    }
-    if (username.length === 0) {
-        throw new Error('infra.postgres external URL must include an explicit username.');
-    }
-    if (postgres.secretRef === undefined) {
-        throw new Error('infra.postgres external configuration requires secretRef.');
-    }
-    const password = resolved.get(postgres.secretRef);
-    if (password === undefined || password.length === 0) {
-        throw new Error(`infra.postgres secretRef "${postgres.secretRef}" is unresolved.`);
-    }
-    return { username, password };
-}
-function validateInfraReferences(config, resolved) {
-    for (const [component, componentConfig] of Object.entries(config.infra)) {
-        if (componentConfig === undefined) {
-            continue;
-        }
-        const reference = componentConfig.secretRef;
-        if (reference === undefined) {
-            continue;
-        }
-        if (component !== schema_1.InfraComponent.Postgres) {
-            throw new Error(`infra.${component}.secretRef is unsupported; only external PostgreSQL passwords accept an infra secretRef.`);
-        }
-        if (!resolved.has(reference)) {
-            throw new Error(`infra.${component}.secretRef references undeclared or unresolved secret "${reference}".`);
-        }
-    }
-}
-function validateExternalPostgres(config, resolved) {
-    externalPostgresCredentials(config, resolved);
-}
-function parsePostgresUrl(config) {
-    if (config.url === undefined) {
-        throw new Error('infra.postgres external configuration has no URL.');
-    }
-    let url;
-    try {
-        url = new URL(config.url);
-    }
-    catch {
-        throw new Error('infra.postgres external URL is invalid.');
-    }
-    if (url.protocol !== 'postgres:' && url.protocol !== 'postgresql:') {
-        throw new Error('infra.postgres external URL must use the postgres or postgresql scheme.');
-    }
-    return url;
-}
-async function promptHidden(name) {
-    const input = process.stdin;
-    const output = process.stderr;
-    if (!input.isTTY || !output.isTTY || typeof input.setRawMode !== 'function') {
-        throw new Error(`Secret "${name}" requires an interactive terminal. Use an env or file source for unattended launches.`);
-    }
-    output.write(`Secret ${name}: `);
-    return new Promise((resolvePromise, rejectPromise) => {
-        const bytes = [];
-        const wasRaw = input.isRaw;
-        let settled = false;
-        const cleanup = () => {
-            input.off('data', onData);
-            input.off('end', onEnd);
-            input.off('error', onError);
-            input.setRawMode(wasRaw);
-            input.pause();
-            output.write('\n');
-        };
-        const finish = (operation) => {
-            if (settled) {
-                return;
-            }
-            settled = true;
-            cleanup();
-            operation();
-        };
-        const onEnd = () => {
-            finish(() => rejectPromise(new Error(`Secret prompt for "${name}" ended before a value was read.`)));
-        };
-        const onError = () => {
-            finish(() => rejectPromise(new Error(`Secret prompt for "${name}" failed.`)));
-        };
-        const onData = (chunk) => {
-            for (const byte of chunk) {
-                if (byte === 3) {
-                    finish(() => rejectPromise(new Error(`Secret prompt for "${name}" was cancelled.`)));
-                    return;
-                }
-                if (byte === 10 || byte === 13) {
-                    finish(() => resolvePromise(Buffer.concat(bytes).toString('utf8')));
-                    return;
-                }
-                if (byte === 8 || byte === 127) {
-                    const current = Buffer.concat(bytes);
-                    bytes.length = 0;
-                    if (current.length > 0) {
-                        bytes.push(current.subarray(0, current.length - 1));
-                    }
-                    continue;
-                }
-                bytes.push(Buffer.from([byte]));
-            }
-        };
-        input.setRawMode(true);
-        input.resume();
-        input.on('data', onData);
-        input.once('end', onEnd);
-        input.once('error', onError);
-    });
-}
-function readSecretFile(name, path) {
-    let descriptor;
-    try {
-        descriptor = (0, node_fs_1.openSync)(path, read_only_no_follow_flags_1.READ_ONLY_NO_FOLLOW_FLAGS);
-        const metadata = (0, node_fs_1.fstatSync)(descriptor);
-        if (!metadata.isFile()) {
-            throw new Error('source is not a regular file');
-        }
-        if (process.platform !== 'win32' && (metadata.mode & 0o077) !== 0) {
-            throw new Error(`source permissions are ${modeString(metadata.mode)}; expected no group or other access (0600 or stricter)`);
-        }
-        return (0, node_fs_1.readFileSync)(descriptor, 'utf8');
-    }
-    catch (error) {
-        const reason = error instanceof Error ? error.message : String(error);
-        throw new Error(`Secret "${name}" could not be read from ${path}: ${reason}`);
-    }
-    finally {
-        if (descriptor !== undefined) {
-            (0, node_fs_1.closeSync)(descriptor);
-        }
-    }
-}
-function modeString(mode) {
-    return (mode & 0o777).toString(8).padStart(4, '0');
-}
-class SecretSnapshot {
-    #values;
-    constructor(values) {
-        this.#values = new Map(values);
-        Object.freeze(this);
-    }
-    get size() {
-        return this.#values.size;
-    }
-    get(key) {
-        return this.#values.get(key);
-    }
-    has(key) {
-        return this.#values.has(key);
-    }
-    entries() {
-        return this.#values.entries();
-    }
-    keys() {
-        return this.#values.keys();
-    }
-    values() {
-        return this.#values.values();
-    }
-    forEach(callbackfn, thisArg) {
-        this.#values.forEach((value, key) => {
-            callbackfn.call(thisArg, value, key, this);
-        });
-    }
-    [Symbol.iterator]() {
-        return this.entries();
-    }
-    get [Symbol.toStringTag]() {
-        return 'SecretSnapshot';
-    }
-}
-//# sourceMappingURL=resolver.js.map

package/dist/runtime/secrets/resolver.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../../../src/runtime/secrets/resolver.ts"],"names":[],"mappings":";;;AAiHA,8CAUC;AAQD,oFAeC;AAWD,kEAkCC;AA/LD,qCAKiB;AACjB,yCAAgD;AAEhD,6CAQ0B;AAC1B,4EAAyE;AAgBzE,MAAM,QAAQ,GAAG,0BAA0B,CAAC;AAE5C,MAAa,cAAc;IACR,GAAG,CAAoB;IACvB,GAAG,CAAS;IACZ,MAAM,CAAoC;IAE3D,YAAY,OAA8B,EAAE;QAC1C,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC;IAC5C,CAAC;IAOD,KAAK,CAAC,OAAO,CAAC,MAAkB;QAC9B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACjE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YACvD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,+BAA+B,CAAC,CAAC;YAClE,CAAC;YACD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,wBAAwB,CAAC,CAAC;YAC3D,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC5B,CAAC;QAED,uBAAuB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC1C,wBAAwB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3C,OAAO,IAAI,cAAc,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,IAAY,EACZ,WAAyB;QAEzB,QAAQ,WAAW,CAAC,IAAI,EAAE,CAAC;YACzB,KAAK,qBAAY,CAAC,GAAG,CAAC,CAAC,CAAC;gBACtB,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,IAAI,IAAI,CAAC;gBACxC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC5B,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,6BAA6B,OAAO,2CAA2C,CAC/F,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAChC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC9C,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,mCAAmC,OAAO,6BAA6B,CACvF,CAAC;gBACJ,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,KAAK,qBAAY,CAAC,IAAI,CAAC,CAAC,CAAC;gBACvB,IAAI,WAAW,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;oBAGnC,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,uCAAuC,CACvD,CAAC;gBACJ,CAAC;gBACD,MAAM,IAAI,GAAG,IAAA,sBAAU,EAAC,WAAW,CAAC,IAAI,CAAC;oBACvC,CAAC,CAAC,WAAW,CAAC,IAAI;oBAClB,CAAC,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;gBACxC,OAAO,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACpC,CAAC;YACD,KAAK,qBAAY,CAAC,MAAM;gBACtB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;CACF;AAvED,wCAuEC;AAOD,SAAgB,iBAAiB,CAC/B,QAAyB;IAEzB,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;QACrC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAQD,SAAgB,oCAAoC,CAClD,MAAkB,EAClB,SAAoB;IAEpB,IAAI,SAAS,KAAK,kBAAS,CAAC,IAAI,EAAE,CAAC;QACjC,OAAO;IACT,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/D,MAAM,oBAAoB,GACxB,MAAM,CAAC,KAAK,CAAC,uBAAc,CAAC,QAAQ,CAAC,EAAE,IAAI,KAAK,kBAAS,CAAC,QAAQ,CAAC;IACrE,IAAI,eAAe,IAAI,oBAAoB,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,+JAA+J,CAChK,CAAC;IACJ,CAAC;AACH,CAAC;AAWD,SAAgB,2BAA2B,CACzC,MAAkB,EAClB,QAAyB;IAEzB,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,uBAAc,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,QAAQ,EAAE,IAAI,KAAK,kBAAS,CAAC,QAAQ,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,cAAc,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAExD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAClD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,6BAA6B,QAAQ,CAAC,SAAS,kBAAkB,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,uBAAuB,CAC9B,MAAkB,EAClB,QAAyB;IAEzB,KAAK,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAClC,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,CAAC;QAC5C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,IAAI,SAAS,KAAK,uBAAc,CAAC,QAAQ,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,SAAS,SAAS,0FAA0F,CAC7G,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,SAAS,SAAS,0DAA0D,SAAS,IAAI,CAC1F,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAC/B,MAAkB,EAClB,QAAyB;IAEzB,2BAA2B,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,gBAAgB,CAAC,MAA4B;IACpD,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAMD,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,wFAAwF,CACxG,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC;IACjC,OAAO,IAAI,OAAO,CAAS,CAAC,cAAc,EAAE,aAAa,EAAE,EAAE;QAC3D,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC;QAC3B,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACxB,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC5B,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACzB,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,SAAqB,EAAQ,EAAE;YAC7C,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,EAAE,CAAC;YACV,SAAS,EAAE,CAAC;QACd,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,GAAS,EAAE;YACvB,MAAM,CAAC,GAAG,EAAE,CACV,aAAa,CACX,IAAI,KAAK,CACP,sBAAsB,IAAI,kCAAkC,CAC7D,CACF,CACF,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,MAAM,CAAC,GAAG,EAAE,CACV,aAAa,CAAC,IAAI,KAAK,CAAC,sBAAsB,IAAI,WAAW,CAAC,CAAC,CAChE,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,KAAa,EAAQ,EAAE;YACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;oBACf,MAAM,CAAC,GAAG,EAAE,CACV,aAAa,CACX,IAAI,KAAK,CAAC,sBAAsB,IAAI,kBAAkB,CAAC,CACxD,CACF,CAAC;oBACF,OAAO;gBACT,CAAC;gBACD,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;oBAC/B,MAAM,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBACpE,OAAO;gBACT,CAAC;gBACD,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;oBAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBACrC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;oBACjB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACvB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;oBACtD,CAAC;oBACD,SAAS;gBACX,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClC,CAAC;QACH,CAAC,CAAC;QAEF,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACvB,KAAK,CAAC,MAAM,EAAE,CAAC;QACf,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,IAAY;IAChD,IAAI,UAA8B,CAAC;IACnC,IAAI,CAAC;QACH,UAAU,GAAG,IAAA,kBAAQ,EAAC,IAAI,EAAE,qDAAyB,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,IAAA,mBAAS,EAAC,UAAU,CAAC,CAAC;QACvC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CACb,0BAA0B,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,wDAAwD,CAC5G,CAAC;QACJ,CAAC;QACD,OAAO,IAAA,sBAAY,EAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,4BAA4B,IAAI,KAAK,MAAM,EAAE,CAC7D,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAA,mBAAS,EAAC,UAAU,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,cAAc;IACT,OAAO,CAA8B;IAE9C,YAAY,MAAmC;QAC7C,IAAI,CAAC,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED,GAAG,CAAC,GAAW;QACb,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,GAAG,CAAC,GAAW;QACb,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IAChC,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAC7B,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;IAC/B,CAAC;IAED,OAAO,CACL,UAIS,EACT,OAAiB;QAEjB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAClC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;IACL,CAAC;IAED,CAAC,MAAM,CAAC,QAAQ,CAAC;QACf,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACtB,OAAO,gBAAgB,CAAC;IAC1B,CAAC;CACF"}