@zincapp/znvault-migrate 1.0.0

package/dist/core/runner.js

@@ -0,0 +1,301 @@
+import { readFileSync, existsSync } from 'node:fs';
+import { isAbsolute, join } from 'node:path';
+import { discover } from './migration-files.js';
+import { readBaselineMarker } from './baseline-marker.js';
+import { canonicalChecksumFile } from './checksum.js';
+import { plan } from './planner.js';
+/**
+ * Orchestrates migration discovery, planning, locking, and execution.
+ *
+ * Ports MigrationRunner.kt + MigrateMain.kt orchestration EXACTLY:
+ *  - status(): read-only — ensureTable + plan; preflight(version-check only).
+ *  - run(): write path — preflight(requireWritePrimary=true) → ensureTable (before lock,
+ *    Kotlin parity) → acquire → seedIfVirgin → plan → reconcile → pending → release.
+ *
+ * `zn_*` helper procedures (0000_ files) are NOT created by this engine — see the
+ * doc comment on run() for details.
+ *
+ * Engine-agnostic core: the six MySQL-specific collaborators (preflight, lock
+ * acquire/isHeld/release, migration-file apply, reconcile, definer-object cleanup,
+ * schema_migrations repo) are delegated to an injected `EngineAdapter` operating
+ * on a live `Conn`. The runner's own control flow — ordering, guards, error
+ * strings — is unchanged from the MySQL-only source.
+ */
+export class MigrationRunner {
+    adapter;
+    conn;
+    migrationsDir;
+    appliedBy;
+    integrityDirs;
+    scaffolding;
+    repo;
+    /**
+     * @param adapter        The engine adapter — implements the six MySQL-specific
+     *                       collaborators (preflight, lock, migration-file apply,
+     *                       reconcile, definer-object cleanup, schema_migrations repo).
+     * @param conn           The live connection the adapter's methods operate on.
+     * @param migrationsDir  The CURRENT phase's migrations directory — the one whose
+     *                       files are classified and applied.
+     * @param appliedBy      The applied-by identity recorded on each row.
+     * @param integrityDirs  Additional directories that share this DB's
+     *                       schema_migrations history (the OTHER migration phase's dir,
+     *                       e.g. the pre/ dir when this runner is running post/). Used
+     *                       only to widen the orphan/checksum integrity lookup so a row
+     *                       applied by a sibling phase is not mistaken for a
+     *                       renamed/deleted file. Defaults to none (single-dir configs).
+     * @param scaffolding    Optional migration-helper scaffolding config for THIS phase.
+     *                       When set, `run()` applies `<migrationsDir>/<filename>` at the
+     *                       start of the phase (after discover(), before seeding/reconcile/
+     *                       pending) and, unconditionally, drops every object the given
+     *                       `leaseUser` defined once the reconcile+pending work concludes
+     *                       (success or failure) — see the ordering note on run(). Undefined
+     *                       (the default) means no scaffolding: byte-identical to the
+     *                       pre-scaffolding runner.
+     */
+    constructor(adapter, conn, migrationsDir, appliedBy, integrityDirs = [], scaffolding) {
+        this.adapter = adapter;
+        this.conn = conn;
+        this.migrationsDir = migrationsDir;
+        this.appliedBy = appliedBy;
+        this.integrityDirs = integrityDirs;
+        this.scaffolding = scaffolding;
+        this.repo = adapter.schemaMigrationsRepo(conn);
+    }
+    /**
+     * Build the union of migration files across this phase's dir and any sibling
+     * integrity dirs (pre ∪ post), for the planner's integrity lookup. Missing dirs
+     * are skipped defensively (discover() throws on a non-existent path). If two dirs
+     * ever declare the same version prefix, the current phase's file wins the lookup.
+     */
+    allTrackedFiles(phaseFiles) {
+        const byVersion = new Map(phaseFiles.map((f) => [f.version, f]));
+        for (const dir of this.integrityDirs) {
+            if (dir === this.migrationsDir || !existsSync(dir))
+                continue;
+            for (const f of discover(dir)) {
+                if (!byVersion.has(f.version))
+                    byVersion.set(f.version, f);
+            }
+        }
+        return [...byVersion.values()];
+    }
+    /**
+     * Read-only status: how many migrations are in each state.
+     * Does NOT acquire the lock or apply any helpers.
+     * Mirrors MigrateMain: preflight(requireWritePrimary=false) for 'status'.
+     */
+    async status() {
+        await this.adapter.preflight(this.conn, false); // version-check only; skip read-only check
+        await this.repo.ensureTable();
+        const phaseFiles = discover(this.migrationsDir);
+        const p = plan(phaseFiles, await this.repo.all(), canonicalChecksumFile, this.allTrackedFiles(phaseFiles));
+        return { applied: p.applied.length, reconcile: p.reconcile.length, pending: p.pending.length };
+    }
+    /**
+     * Apply all pending and reconcile migrations.
+     *
+     * Order (load-bearing — matches Kotlin MigrationRunner.run() exactly):
+     *  1. preflight(requireWritePrimary=true) — refuse read-only replicas.
+     *  2. ensureTable() BEFORE the lock (the only pre-lock mutation, per Kotlin parity).
+     *  3. acquire(db) — GET_LOCK.
+     *  3a. scaffolding (if configured) — apply THIS phase's helper objects (migration_utils.sql
+     *      or equivalent) before any seeding/reconcile/pending work touches the DB.
+     *  4. seedBaselineIfVirgin — seed baselined rows when schema_migrations is empty.
+     *  5. plan() — classify remaining files.
+     *  6. reconcile — asserts-first; re-run body only when unmet or no asserts.
+     *  7. pending — claim(success=0) → exec → markSuccess(success=1).
+     *  7a. finally (nested, scoped to 6+7): scaffolding cleanup — if configured and the
+     *      lock is still held, drop every object the lease user defined
+     *      (dropDefinerObjects), unconditionally — runs whether 6/7 succeeded or threw.
+     *      A cleanup failure is logged, never rethrown (must not mask a primary error).
+     *      The lock-held check itself (lockHeld()) is also non-throwing — a dead
+     *      connection can make the underlying IS_USED_LOCK query reject rather than
+     *      resolve false, and this guard must not mask a primary error either.
+     *  8. finally: release lock; if release was not clean and no primary error, throw tripwire.
+     *
+     * The `zn_*` helper procedures (0000_ files) are NO LONGER created here. They are
+     * now provisioned ahead of the migration phase by vault's routines-apply step,
+     * owned by a persistent routines DB account — see the vault-side dynsec-routines-
+     * provisioning feature (docs/superpowers/specs/2026-07-01-dynsec-routines-
+     * provisioning-design.md). Root cause: DROP+CREATE'ing them here made the
+     * ephemeral migrate user their DEFINER, and MySQL 8.4 refuses `DROP USER` for an
+     * account referenced as a stored-routine DEFINER (ER 4006) — which broke lease
+     * revocation on every migration run. Migrations now only `CALL zn_*`; they never
+     * (re)create the procedures themselves.
+     */
+    async run() {
+        await this.adapter.preflight(this.conn, true); // refuse read-only replica
+        // ensureTable BEFORE the lock — the CREATE TABLE IF NOT EXISTS is the sole
+        // pre-lock mutation. This matches Kotlin to allow a fresh DB to get the table
+        // without contention risk (only one runner is expected in normal operation).
+        await this.repo.ensureTable();
+        await this.adapter.acquireLock(this.conn);
+        let primary = null;
+        try {
+            const files = discover(this.migrationsDir);
+            // NOTE: 0000_ helper files are discovered above (discover() does not filter
+            // them out) but are intentionally never applied here — plan() excludes them
+            // from all buckets (migration-planner.ts) and seedBaselineIfVirgin() skips
+            // them too, so they are inert as far as this engine is concerned. See the
+            // class doc comment on run() for why per-run creation was removed.
+            // Step 3a: Scaffolding — create THIS phase's migration-helper objects (dropped
+            // after reconcile+pending, unconditionally — see the finally block below).
+            // Applied before any seeding/reconcile/pending work so bodies can CALL them.
+            if (this.scaffolding && this.adapter.applyScaffolding) {
+                const scaffoldPath = isAbsolute(this.scaffolding.filename)
+                    ? this.scaffolding.filename
+                    : join(this.migrationsDir, this.scaffolding.filename);
+                await this.adapter.applyScaffolding(this.conn, scaffoldPath);
+            }
+            // Step 4: Seed baseline rows for a virgin DB (schema_migrations is empty).
+            const seeded = await this.seedBaselineIfVirgin(files);
+            // Step 5: Plan. Integrity lookup spans this dir ∪ the sibling phase dir(s)
+            // (they share one schema_migrations table); classification stays scoped to
+            // `files` (this phase only ever applies its own directory).
+            const p = plan(files, await this.repo.all(), canonicalChecksumFile, this.allTrackedFiles(files));
+            let reconciled = 0;
+            let applied = 0;
+            try {
+                // Step 6: Reconcile — asserts-first; re-run body only when asserts are absent
+                // or one failed (indicating the migration was only partially applied).
+                for (const f of p.reconcile) {
+                    await this.requireLockHeld();
+                    await this.reconcile(f.path);
+                    reconciled++;
+                }
+                // Step 7: Pending — claim(success=0) → execute body → markSuccess(success=1).
+                // A throw in executeStatements leaves the row at success=0 for later reconcile.
+                for (const f of p.pending) {
+                    await this.requireLockHeld();
+                    const checksum = canonicalChecksumFile(f.path);
+                    await this.repo.claim(f.version, checksum, this.appliedBy); // autocommit → durable
+                    const start = Date.now();
+                    await this.executeStatements(f.path); // throws → row stays success=0
+                    await this.requireLockHeld();
+                    await this.repo.markSuccess(f.version, Date.now() - start);
+                    applied++;
+                }
+            }
+            finally {
+                // Step 7a: Scaffolding cleanup — drop every object the lease user defined,
+                // so the ephemeral migrate user is never left a DEFINER (ER-4006). Runs
+                // whether the reconcile/pending block above succeeded or threw (unconditional),
+                // but ONLY when scaffolding is configured AND the lock is still held (a lost
+                // lock means another runner may be concurrently active — do not touch the DB).
+                if (this.scaffolding && (await this.lockHeld())) {
+                    try {
+                        await this.adapter.dropOwnedObjects(this.conn, this.scaffolding.leaseUser);
+                    }
+                    catch (cleanupErr) {
+                        // Log but do not rethrow — this must never mask a primary phase error.
+                        // A failed/partial sweep surfaces later via the eventual DROP USER
+                        // re-hitting ER-4006, which is visible and actionable.
+                        console.warn(`scaffolding cleanup (dropDefinerObjects) failed for lease user '${this.scaffolding.leaseUser}': ${cleanupErr instanceof Error ? cleanupErr.message : String(cleanupErr)}`);
+                    }
+                }
+            }
+            return { seeded, reconciled, applied, pendingRemaining: 0 };
+        }
+        catch (e) {
+            primary = e;
+            throw e;
+        }
+        finally {
+            // release() never throws — it must not mask the primary error.
+            // A non-clean release is the lost-lock tripwire: surface it only when
+            // there is no primary error to preserve.
+            const released = await this.adapter.releaseLock(this.conn);
+            if (!released && primary === null) {
+                // eslint-disable-next-line no-unsafe-finally
+                throw new Error('Lock was not held at release — a concurrent runner may have run. Re-run status and verify schema_migrations.');
+            }
+        }
+    }
+    /**
+     * Abort immediately if this session no longer holds the GET_LOCK.
+     * A killed session or proxy reconnect would silently drop the lock server-side.
+     */
+    async requireLockHeld() {
+        if (!(await this.adapter.lockHeld(this.conn))) {
+            throw new Error('Lost the migration lock mid-run (session killed or reconnected). Aborting to avoid concurrent DDL.');
+        }
+    }
+    /**
+     * Non-throwing counterpart to requireLockHeld() — used by cleanup paths (e.g.
+     * scaffolding's finally block) that must NOT touch the DB once the lock is lost,
+     * but also must not themselves throw while already unwinding another error.
+     *
+     * `lock.isHeld()` runs `SELECT IS_USED_LOCK(...)`, which can itself REJECT on a
+     * dead connection (killed session / proxy reconnect — exactly the scenario this
+     * guard exists for), not just resolve to false. Since callers await this from a
+     * `finally` block, an unswallowed rejection here would replace/mask whatever
+     * primary error is already in flight (a throwing `finally` overrides the pending
+     * exception). Treat any error the same as "lock not held": skip the guarded
+     * cleanup rather than risk touching a possibly-dead connection or masking the
+     * real error.
+     */
+    async lockHeld() {
+        try {
+            return await this.adapter.lockHeld(this.conn);
+        }
+        catch (e) {
+            console.warn(`lock.isHeld() failed while checking scaffolding cleanup eligibility (treating as lock-not-held): ${e instanceof Error ? e.message : String(e)}`);
+            return false;
+        }
+    }
+    /**
+     * Execute every SQL statement in a file (text protocol, one at a time).
+     * A failed CALL zn_assert_* signals SIGNAL '45000', which propagates as an
+     * Error and leaves any pending claim row at success=0.
+     *
+     * The split+per-statement-execute logic lives on the adapter (`applyMigrationFile`)
+     * — core only reads the file and hands the SQL text over.
+     */
+    async executeStatements(path) {
+        const sql = readFileSync(path, 'utf8');
+        await this.adapter.applyMigrationFile(this.conn, sql);
+    }
+    /**
+     * Reconcile a success=0 row per spec step 7a.
+     *
+     * Run the file's trailing CALL zn_assert_* postconditions FIRST:
+     *  - If they exist and all pass → the migration is already fully applied;
+     *    markSuccess WITHOUT re-running the body (avoids double-apply hazard for
+     *    non-idempotent bodies).
+     *  - If there are no asserts, OR any assert throws → re-run the ENTIRE
+     *    (idempotent) body, then markSuccess.
+     *
+     * The asserts-first logic (and the requireLockHeld() guard before markSuccess)
+     * lives on the adapter (`reconcile`) — core only reads the file, derives the
+     * version, and delegates.
+     */
+    async reconcile(path) {
+        const fileSql = readFileSync(path, 'utf8');
+        const version = path.split('/').pop();
+        await this.adapter.reconcile(this.conn, version, fileSql, this.repo);
+    }
+    /**
+     * Seed baselined rows for a virgin DB (schema_migrations has no rows yet).
+     *
+     * Reads the BASELINE_MARKER from baseline/00-baseline-schema.sql and seeds
+     * a baselined row for every non-0000_ file whose prefix <= the marker.
+     * Returns the number of rows seeded.
+     */
+    async seedBaselineIfVirgin(files) {
+        if ((await this.repo.all()).length > 0)
+            return 0;
+        const marker = readBaselineMarker(join(this.migrationsDir, 'baseline', '00-baseline-schema.sql'));
+        if (!marker)
+            return 0; // no baseline file (unit/throwaway DB) → nothing to seed
+        let n = 0;
+        for (const f of files) {
+            if (f.version.startsWith('0000_'))
+                continue; // helpers are never seeded
+            if (f.prefix <= marker) {
+                await this.repo.seedBaseline(f.version, canonicalChecksumFile(f.path), this.appliedBy);
+                n++;
+            }
+        }
+        return n;
+    }
+}

package/dist/core/runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.js","sourceRoot":"","sources":["../../src/core/runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAKpC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,eAAe;IA2BP;IACA;IACA;IACA;IACA;IACA;IA/BX,IAAI,CAAuB;IAEnC;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,YACmB,OAAsB,EACtB,IAAU,EACV,aAAqB,EACrB,SAAiB,EACjB,gBAA0B,EAAE,EAC5B,WAAqD;QALrD,YAAO,GAAP,OAAO,CAAe;QACtB,SAAI,GAAJ,IAAI,CAAM;QACV,kBAAa,GAAb,aAAa,CAAQ;QACrB,cAAS,GAAT,SAAS,CAAQ;QACjB,kBAAa,GAAb,aAAa,CAAe;QAC5B,gBAAW,GAAX,WAAW,CAA0C;QAEtE,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;IAED;;;;;OAKG;IACK,eAAe,CAAC,UAAuC;QAC7D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACrC,IAAI,GAAG,KAAK,IAAI,CAAC,aAAa,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC7D,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;oBAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IACjC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,2CAA2C;QAC3F,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAChD,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;QAC3G,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;IACjG,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,KAAK,CAAC,GAAG;QACP,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,2BAA2B;QAE1E,2EAA2E;QAC3E,8EAA8E;QAC9E,6EAA6E;QAC7E,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAE9B,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,OAAO,GAAY,IAAI,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAE3C,4EAA4E;YAC5E,4EAA4E;YAC5E,2EAA2E;YAC3E,0EAA0E;YAC1E,mEAAmE;YAEnE,+EAA+E;YAC/E,2EAA2E;YAC3E,6EAA6E;YAC7E,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;gBACtD,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC;oBACxD,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ;oBAC3B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;gBACxD,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;YAC/D,CAAC;YAED,2EAA2E;YAC3E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAEtD,2EAA2E;YAC3E,2EAA2E;YAC3E,4DAA4D;YAC5D,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;YAEjG,IAAI,UAAU,GAAG,CAAC,CAAC;YACnB,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,IAAI,CAAC;gBACH,8EAA8E;gBAC9E,uEAAuE;gBACvE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;oBAC5B,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;oBAC7B,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;oBAC7B,UAAU,EAAE,CAAC;gBACf,CAAC;gBAED,8EAA8E;gBAC9E,gFAAgF;gBAChF,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;oBAC1B,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;oBAC7B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;oBAC/C,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,uBAAuB;oBACnF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;oBACzB,MAAM,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,+BAA+B;oBACrE,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;oBAC7B,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;oBAC3D,OAAO,EAAE,CAAC;gBACZ,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,2EAA2E;gBAC3E,wEAAwE;gBACxE,gFAAgF;gBAChF,6EAA6E;gBAC7E,+EAA+E;gBAC/E,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;oBAChD,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;oBAC7E,CAAC;oBAAC,OAAO,UAAU,EAAE,CAAC;wBACpB,uEAAuE;wBACvE,mEAAmE;wBACnE,uDAAuD;wBACvD,OAAO,CAAC,IAAI,CACV,mEAAmE,IAAI,CAAC,WAAW,CAAC,SAAS,MAC3F,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CACtE,EAAE,CACH,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC;QAC9D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,GAAG,CAAC,CAAC;YACZ,MAAM,CAAC,CAAC;QACV,CAAC;gBAAS,CAAC;YACT,+DAA+D;YAC/D,sEAAsE;YACtE,yCAAyC;YACzC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3D,IAAI,CAAC,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBAClC,6CAA6C;gBAC7C,MAAM,IAAI,KAAK,CACb,8GAA8G,CAC/G,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,eAAe;QAC3B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,oGAAoG,CACrG,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;OAaG;IACK,KAAK,CAAC,QAAQ;QACpB,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CACV,oGACE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAC3C,EAAE,CACH,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,iBAAiB,CAAC,IAAY;QAC1C,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACxD,CAAC;IAED;;;;;;;;;;;;;OAaG;IACK,KAAK,CAAC,SAAS,CAAC,IAAY;QAClC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAG,CAAC;QACvC,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,oBAAoB,CAAC,KAAkC;QACnE,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,wBAAwB,CAAC,CAAC,CAAC;QAClG,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,CAAC,yDAAyD;QAChF,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;gBAAE,SAAS,CAAC,2BAA2B;YACxE,IAAI,CAAC,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC;gBACvB,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;gBACvF,CAAC,EAAE,CAAC;YACN,CAAC;QACH,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;CACF"}

package/dist/core/types.d.ts

@@ -0,0 +1,24 @@
+export interface MigrationFile {
+    version: string;
+    prefix: string;
+    path: string;
+}
+export interface MigrationRow {
+    version: string;
+    checksum: string;
+    checksumAlgo: string;
+    success: boolean;
+    baselined: boolean;
+}
+export interface MigrationPlan {
+    applied: MigrationFile[];
+    reconcile: MigrationFile[];
+    pending: MigrationFile[];
+}
+export interface RunResult {
+    seeded: number;
+    reconciled: number;
+    applied: number;
+    pendingRemaining: number;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/core/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAAG,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;CAAE;AAEjF,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,OAAO,EAAE,aAAa,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;CAC1B"}

package/dist/core/types.js

@@ -0,0 +1 @@
+export {};

package/dist/core/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/core/types.ts"],"names":[],"mappings":""}

package/dist/index.d.ts

@@ -0,0 +1,13 @@
+export type { MigrationConfig } from './config.js';
+export { validateMigrationConfig } from './config.js';
+export { MigrationRunner } from './core/runner.js';
+export type { MigrationFile, MigrationRow, RunResult, MigrationPlan } from './core/types.js';
+export type { EngineAdapter, Conn, SchemaMigrationsRepo, EngineCredentials } from './adapters/engine-adapter.js';
+export { mysqlAdapter } from './adapters/mysql/mysql-adapter.js';
+export { ChecksumMismatchError, OrphanTrackedRowError } from './core/planner.js';
+export { DuplicatePrefixError } from './core/migration-files.js';
+export { runMigrations, defaultDeps } from './lease/run-migrations.js';
+export type { RunMigrationsOpts, RunMigrationsDeps } from './lease/run-migrations.js';
+export type { Lease } from './lease/dynamic-secrets-client.js';
+export { makeDynamicSecretsClient } from './lease/dynamic-secrets-client.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAE7F,YAAY,EAAE,aAAa,EAAE,IAAI,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjH,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAGjE,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAIjE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACvE,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACtF,YAAY,EAAE,KAAK,EAAE,MAAM,mCAAmC,CAAC;AAC/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC"}

package/dist/index.js

@@ -0,0 +1,13 @@
+// Path: znvault-migrate/src/index.ts
+// Public API surface for @zincapp/znvault-migrate.
+// Consumed by znvault-plugin-payara (Phase 2) and znvault-cli (Phase 3).
+export { validateMigrationConfig } from './config.js';
+export { MigrationRunner } from './core/runner.js';
+export { mysqlAdapter } from './adapters/mysql/mysql-adapter.js';
+// Error classes surfaced by the core so consumers can catch/discriminate them.
+export { ChecksumMismatchError, OrphanTrackedRowError } from './core/planner.js';
+export { DuplicatePrefixError } from './core/migration-files.js';
+// Lease layer (Task 7): mint a dynamic-secrets lease → open a connection via
+// the selected engine adapter → run the migration engine → revoke the lease.
+export { runMigrations, defaultDeps } from './lease/run-migrations.js';
+export { makeDynamicSecretsClient } from './lease/dynamic-secrets-client.js';

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,qCAAqC;AACrC,mDAAmD;AACnD,yEAAyE;AAGzE,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAInD,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAEjE,+EAA+E;AAC/E,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,6EAA6E;AAC7E,6EAA6E;AAC7E,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAGvE,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC"}

package/dist/lease/dynamic-secrets-client.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Dynamic-secrets REST client for ZN-Vault.
+ *
+ * These are raw async functions hitting the Vault REST API — NOT the znvault-cli
+ * command handlers (which call inquirer.prompt / process.exit and are unusable as
+ * lifecycle primitives).
+ *
+ * Key design (Codex F6.1): a 404 / 410 / non-ACTIVE-lease response on revokeCredential
+ * is treated as SUCCESS — the lease is already gone. This is critical because a
+ * timed-out-then-retried revoke hits a now-non-ACTIVE lease on the 2nd attempt and
+ * must not be retried into an error.
+ */
+export interface Lease {
+    leaseId: string;
+    username: string;
+    password: string;
+    /** MySQL hostname returned by the Vault dynamic-secrets connection. */
+    host: string;
+    /** MySQL port returned by the Vault dynamic-secrets connection. */
+    port: number;
+    /** MySQL database name returned by the Vault dynamic-secrets connection (may be undefined if the connection doesn't pin a database). */
+    database?: string;
+}
+export interface VaultHttp {
+    post(path: string, body: unknown): Promise<{
+        status: number;
+        body: any;
+    }>;
+}
+/**
+ * Create a dynamic-secrets client bound to the given HTTP transport.
+ *
+ * @param http - The vault HTTP client (e.g. the plugin's existing VaultHttp).
+ */
+export declare function makeDynamicSecretsClient(http: VaultHttp): {
+    issueCredential(roleId: string, opts: {
+        ttlSeconds: number;
+    }): Promise<Lease>;
+    revokeCredential(leaseId: string, opts: {
+        reason: string;
+    }): Promise<void>;
+};
+//# sourceMappingURL=dynamic-secrets-client.d.ts.map

package/dist/lease/dynamic-secrets-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dynamic-secrets-client.d.ts","sourceRoot":"","sources":["../../src/lease/dynamic-secrets-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,KAAK;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,wIAAwI;IACxI,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,GAAG,CAAA;KAAE,CAAC,CAAC;CAC3E;AAmCD;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,SAAS,GAAG;IACzD,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9E,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5E,CAkEA"}

package/dist/lease/dynamic-secrets-client.js

@@ -0,0 +1,110 @@
+/**
+ * Dynamic-secrets REST client for ZN-Vault.
+ *
+ * These are raw async functions hitting the Vault REST API — NOT the znvault-cli
+ * command handlers (which call inquirer.prompt / process.exit and are unusable as
+ * lifecycle primitives).
+ *
+ * Key design (Codex F6.1): a 404 / 410 / non-ACTIVE-lease response on revokeCredential
+ * is treated as SUCCESS — the lease is already gone. This is critical because a
+ * timed-out-then-retried revoke hits a now-non-ACTIVE lease on the 2nd attempt and
+ * must not be retried into an error.
+ */
+/**
+ * Classify a revoke error as "already gone" (the lease no longer exists).
+ *
+ * A lease is already gone when:
+ *  - The error carries HTTP status 404 (not found) or 410 (gone).
+ *  - The error carries a response body indicating a non-ACTIVE or not-found lease state
+ *    (e.g. status: 'EXPIRED', 'REVOKED', 'NOT_FOUND').
+ *
+ * Any other error (500, network failure, etc.) is NOT already-gone.
+ */
+function isAlreadyGone(e) {
+    if (e == null || typeof e !== 'object')
+        return false;
+    const obj = e;
+    // 404 / 410 by HTTP status
+    const status = obj['status'];
+    if (status === 404 || status === 410)
+        return true;
+    // Response body carries a non-ACTIVE lease status
+    const body = obj['body'];
+    if (body != null && typeof body === 'object') {
+        const bodyStatus = body['status'];
+        if (typeof bodyStatus === 'string' &&
+            bodyStatus !== 'ACTIVE') {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Create a dynamic-secrets client bound to the given HTTP transport.
+ *
+ * @param http - The vault HTTP client (e.g. the plugin's existing VaultHttp).
+ */
+export function makeDynamicSecretsClient(http) {
+    return {
+        /**
+         * Issue a new dynamic-secrets credential for the given role.
+         *
+         * POST /v1/dynamic-secrets/roles/:roleId/credentials
+         * → { leaseId, username, password, host, port, database? }
+         *
+         * CRITICAL: validates that host and port are present in the response.
+         * If missing, the just-minted lease is revoked (best-effort) before
+         * throwing so the orphaned credential is not left to expire passively.
+         * Mirrors the znvault-cli mysql broker pattern (spec F2).
+         */
+        async issueCredential(roleId, opts) {
+            const path = `/v1/dynamic-secrets/roles/${roleId}/credentials`;
+            const res = await http.post(path, { ttlSeconds: opts.ttlSeconds });
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            const body = res.body;
+            // Validate that the server returned host and port (spec F2 — no --host fallback).
+            if (!body.host || body.port === undefined) {
+                // Best-effort revoke of the just-minted partial lease before throwing.
+                // Wrap in try/catch so a revoke failure does not mask the validation error.
+                try {
+                    const revokePath = `/v1/dynamic-secrets/leases/${body.leaseId}/revoke`;
+                    await http.post(revokePath, { reason: 'incomplete credential' });
+                }
+                catch {
+                    // Intentionally swallowed — cleanup job + TTL will expire the lease.
+                }
+                throw new Error(`Vault did not return host/port in the credential for role '${roleId}'. ` +
+                    `Please upgrade vault to a version that returns host/port in dynamic-secret credentials.`);
+            }
+            return {
+                leaseId: body.leaseId,
+                username: body.username,
+                password: body.password,
+                host: body.host,
+                port: body.port,
+                database: body.database,
+            };
+        },
+        /**
+         * Revoke an existing dynamic-secrets credential lease.
+         *
+         * POST /v1/dynamic-secrets/leases/:leaseId/revoke
+         *
+         * CRITICAL (Codex F6.1): a 404 / 410 / non-ACTIVE-lease error is treated as
+         * SUCCESS — the lease is already gone. Resolve, do NOT throw.
+         */
+        async revokeCredential(leaseId, opts) {
+            const path = `/v1/dynamic-secrets/leases/${leaseId}/revoke`;
+            try {
+                await http.post(path, { reason: opts.reason });
+            }
+            catch (e) {
+                if (isAlreadyGone(e)) {
+                    // Lease is already gone — treat as success per spec F6.1.
+                    return;
+                }
+                throw e;
+            }
+        },
+    };
+}

package/dist/lease/dynamic-secrets-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dynamic-secrets-client.js","sourceRoot":"","sources":["../../src/lease/dynamic-secrets-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAkBH;;;;;;;;;GASG;AACH,SAAS,aAAa,CAAC,CAAU;IAC/B,IAAI,CAAC,IAAI,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACrD,MAAM,GAAG,GAAG,CAA4B,CAAC;IAEzC,2BAA2B;IAC3B,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7B,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAElD,kDAAkD;IAClD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,IAAI,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7C,MAAM,UAAU,GAAI,IAAgC,CAAC,QAAQ,CAAC,CAAC;QAC/D,IACE,OAAO,UAAU,KAAK,QAAQ;YAC9B,UAAU,KAAK,QAAQ,EACvB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAe;IAItD,OAAO;QACL;;;;;;;;;;WAUG;QACH,KAAK,CAAC,eAAe,CAAC,MAAc,EAAE,IAA4B;YAChE,MAAM,IAAI,GAAG,6BAA6B,MAAM,cAAc,CAAC;YAC/D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;YACnE,8DAA8D;YAC9D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAW,CAAC;YAE7B,kFAAkF;YAClF,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC1C,uEAAuE;gBACvE,4EAA4E;gBAC5E,IAAI,CAAC;oBACH,MAAM,UAAU,GAAG,8BAA8B,IAAI,CAAC,OAAiB,SAAS,CAAC;oBACjF,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAAC;gBACnE,CAAC;gBAAC,MAAM,CAAC;oBACP,qEAAqE;gBACvE,CAAC;gBACD,MAAM,IAAI,KAAK,CACb,8DAA8D,MAAM,KAAK;oBACzE,yFAAyF,CAC1F,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,OAAiB;gBAC/B,QAAQ,EAAE,IAAI,CAAC,QAAkB;gBACjC,QAAQ,EAAE,IAAI,CAAC,QAAkB;gBACjC,IAAI,EAAE,IAAI,CAAC,IAAc;gBACzB,IAAI,EAAE,IAAI,CAAC,IAAc;gBACzB,QAAQ,EAAE,IAAI,CAAC,QAA8B;aAC9C,CAAC;QACJ,CAAC;QAED;;;;;;;WAOG;QACH,KAAK,CAAC,gBAAgB,CAAC,OAAe,EAAE,IAAwB;YAC9D,MAAM,IAAI,GAAG,8BAA8B,OAAO,SAAS,CAAC;YAC5D,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACjD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrB,0DAA0D;oBAC1D,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,CAAC;YACV,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}