checkly 8.22.0 → 8.23.0

package/dist/services/embedded-packages/npmrc.js

@@ -1,11 +1,19 @@
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
+import Debug from 'debug';
+import { parseComposableUrl, parseFetchableUrl } from './url.js';
+const debug = Debug('checkly:cli:services:embedded-packages');
 export const DEFAULT_REGISTRY_URL = 'https://registry.npmjs.org/';
+/** The prefix that marks an environment variable as npm configuration. */
+export const NPM_CONFIG_ENV_PREFIX = 'npm_config_';
 export class NpmrcEnvVarError extends Error {
     constructor(key, varName) {
-        super(`The .npmrc value for '${key}' references the environment variable`
-            + ` '${varName}', which is not set`);
+        super(
+        // Not necessarily an .npmrc: the value may equally have come from
+        // pnpm's auth.ini or an npm_config_* environment variable.
+        `The npm configuration value for '${key}' references the environment`
+            + ` variable '${varName}', which is not set`);
         this.name = 'NpmrcEnvVarError';
     }
 }
@@ -38,31 +46,50 @@ export function parseNpmrc(content) {
     return config;
 }
 /**
- * Extracts npm configuration from `npm_config_*` environment variables
- * (e.g. `npm_config_registry`, commonly set in CI and by package managers
- * running lifecycle scripts). In npm's precedence order these sit above
- * every `.npmrc` file. The prefix is matched case-insensitively; the key
- * is stored both verbatim and lowercased, because plain keys are written
- * in any case (`NPM_CONFIG_REGISTRY`) while nerf-darted auth keys carry a
- * case-sensitive spelling (`npm_config_//host/:_authToken`).
+ * Every `npm_config_*` variable in an environment, as the config key it
+ * carries plus the variable's verbatim name. The prefix is matched
+ * case-insensitively; the name is kept because only it is something the
+ * user can search their environment for.
  */
-export function npmrcConfigFromEnv(env) {
-    const config = new Map();
-    const prefix = 'npm_config_';
-    for (const [name, value] of Object.entries(env)) {
-        if (value === undefined || !name.toLowerCase().startsWith(prefix)) {
+function* npmConfigEnvEntries(env) {
+    for (const [variable, value] of Object.entries(env)) {
+        if (value === undefined || !variable.toLowerCase().startsWith(NPM_CONFIG_ENV_PREFIX)) {
             continue;
         }
-        const key = name.slice(prefix.length);
+        const key = variable.slice(NPM_CONFIG_ENV_PREFIX.length);
         // npm drops env config entries with empty values rather than treating
         // them as set-to-empty.
         if (key === '' || value === '') {
             continue;
         }
-        config.set(key, value);
-        if (!config.has(key.toLowerCase())) {
-            config.set(key.toLowerCase(), value);
-        }
+        yield { key, value, variable };
+    }
+}
+/**
+ * Records an env-derived entry under both the verbatim key and, unless one
+ * is already present, its lowercased alias. Shared so that the config map
+ * and the origins map cannot drift apart: they must key identically, or a
+ * value resolves while its origin does not.
+ */
+function setEnvEntry(map, key, value) {
+    map.set(key, value);
+    if (!map.has(key.toLowerCase())) {
+        map.set(key.toLowerCase(), value);
+    }
+}
+/**
+ * Extracts npm configuration from `npm_config_*` environment variables
+ * (e.g. `npm_config_registry`, commonly set in CI and by package managers
+ * running lifecycle scripts). In npm's precedence order these sit above
+ * every `.npmrc` file. The key is stored both verbatim and lowercased,
+ * because plain keys are written in any case (`NPM_CONFIG_REGISTRY`) while
+ * nerf-darted auth keys carry a case-sensitive spelling
+ * (`npm_config_//host/:_authToken`).
+ */
+export function npmrcConfigFromEnv(env) {
+    const config = new Map();
+    for (const { key, value } of npmConfigEnvEntries(env)) {
+        setEnvEntry(config, key, value);
     }
     return config;
 }
@@ -72,9 +99,16 @@ export function npmrcConfigFromEnv(env) {
  * earlier paths winning over later ones (pass project first, then user).
  * Missing files are skipped.
  */
-export async function loadNpmrcConfig(filePaths, env = process.env) {
+export async function loadNpmrcConfig(files, env = process.env) {
     const merged = npmrcConfigFromEnv(env);
-    for (const filePath of filePaths) {
+    const unreadable = [];
+    const origins = new Map();
+    // Keyed exactly as the config map above, so every spelling that resolves
+    // a value can also name the variable the user actually set.
+    for (const { key, variable } of npmConfigEnvEntries(env)) {
+        setEnvEntry(origins, key, { kind: 'env', variable });
+    }
+    for (const { path: filePath, optional = false } of files) {
         let content;
         try {
             content = await fs.readFile(filePath, 'utf8');
@@ -85,29 +119,81 @@ export async function loadNpmrcConfig(filePaths, env = process.env) {
             }
             // An unreadable .npmrc (e.g. bad permissions) must not silently drop
             // registry credentials — that would surface later as a baffling 401.
-            throw new Error(`Unable to read npm configuration from '${filePath}'`, { cause: err });
+            // Optional files belong to another tool rather than to this project,
+            // so an unreadable one must not take the whole command down with it.
+            // It is still recorded so an authentication failure can say the file
+            // was skipped. Note this covers more than bad permissions on the file
+            // itself — an unsearchable parent directory lands here too — so the
+            // reported wording must not claim the file exists.
+            if (!optional) {
+                throw new Error(`Unable to read npm configuration from '${filePath}'`, { cause: err });
+            }
+            debug('skipping unreadable optional config %s: %s', filePath, err.message);
+            unreadable.push(filePath);
+            continue;
         }
         for (const [key, value] of parseNpmrc(content)) {
             if (!merged.has(key)) {
                 merged.set(key, value);
+                origins.set(key, { kind: 'file', path: filePath });
+            }
+        }
+    }
+    return { config: merged, files: files.map(file => file.path), unreadable, origins };
+}
+/**
+ * The file pnpm keeps its global registry credentials in. pnpm 11 stopped
+ * writing them to `.npmrc`: `pnpm login` writes `auth.ini` in pnpm's global
+ * config directory instead, so a logged-in pnpm user looks unauthenticated
+ * to anything that only reads `.npmrc`.
+ *
+ * The directory resolution mirrors pnpm's own `getConfigDir` branch for
+ * branch. Note that `PNPM_HOME` is deliberately NOT consulted: pnpm uses it
+ * for the data and state directories, never for the config directory.
+ */
+export function pnpmAuthIniPath(env, platform, homedir) {
+    const xdgConfigHome = env.XDG_CONFIG_HOME;
+    if (xdgConfigHome !== undefined && xdgConfigHome !== '') {
+        return path.join(xdgConfigHome, 'pnpm', 'auth.ini');
+    }
+    switch (platform) {
+        case 'darwin':
+            return path.join(homedir, 'Library', 'Preferences', 'pnpm', 'auth.ini');
+        case 'win32': {
+            const localAppData = env.LOCALAPPDATA;
+            if (localAppData !== undefined && localAppData !== '') {
+                return path.join(localAppData, 'pnpm', 'config', 'auth.ini');
             }
+            return path.join(homedir, '.config', 'pnpm', 'auth.ini');
         }
+        default:
+            return path.join(homedir, '.config', 'pnpm', 'auth.ini');
     }
-    return merged;
 }
 /**
- * The `.npmrc` locations relevant to a project, in npm's precedence order:
+ * The configuration files relevant to a project, highest precedence first:
  * the directory the Checkly project lives in (the nearest project config,
- * which may be a workspace member), the workspace root, then the
- * user-level file. (npm's global and builtin configs are not consulted.)
- */
-export function defaultNpmrcPaths(workspaceRoot, homedir = os.homedir(), contextDir) {
-    const paths = [
-        ...(contextDir !== undefined ? [path.join(contextDir, '.npmrc')] : []),
-        path.join(workspaceRoot, '.npmrc'),
-        path.join(homedir, '.npmrc'),
+ * which may be a workspace member), the workspace root, then pnpm's global
+ * `auth.ini` and the user-level `.npmrc` in whichever order the project's
+ * package manager implies. (npm's global and builtin configs are not
+ * consulted.)
+ */
+export function defaultNpmrcPaths(options) {
+    const { workspaceRoot, contextDir, homedir = os.homedir(), pnpmAuthFile, pnpmAuthFilePreferred } = options;
+    const userNpmrc = { path: path.join(homedir, '.npmrc') };
+    // Not a file this project chose to have, so an unreadable one is skipped
+    // rather than failing the command.
+    const authIni = pnpmAuthFile !== undefined
+        ? [{ path: pnpmAuthFile, optional: true }]
+        : [];
+    const files = [
+        ...(contextDir !== undefined ? [{ path: path.join(contextDir, '.npmrc') }] : []),
+        { path: path.join(workspaceRoot, '.npmrc') },
+        ...(pnpmAuthFilePreferred === true ? [...authIni, userNpmrc] : [userNpmrc, ...authIni]),
     ];
-    return [...new Set(paths)];
+    // Dedupe by path, keeping the highest-precedence occurrence: `new Set` on
+    // the records themselves would compare by identity and never match.
+    return files.filter((file, index) => files.findIndex(other => other.path === file.path) === index);
 }
 function expandValue(key, value, env) {
     return value.replace(/\$\{([^}]+)\}/g, (_, varName) => {
@@ -118,55 +204,334 @@ function expandValue(key, value, env) {
         return envValue;
     });
 }
-function getExpanded(config, key, env) {
-    const value = config.get(key) ?? config.get(key.toLowerCase());
-    if (value === undefined) {
+/**
+ * Looks a key up, falling back to its lowercased spelling, and reports
+ * which spelling actually matched. Callers that trace a value back to the
+ * file it came from need the matched key, not the one they asked for: only
+ * the former is a key in `LoadedNpmrcConfig`'s `origins`.
+ */
+function getExpandedEntry(config, key, env) {
+    // npm matches config keys case-insensitively, so both spellings count.
+    for (const candidate of key === key.toLowerCase() ? [key] : [key, key.toLowerCase()]) {
+        const value = config.get(candidate);
+        if (value !== undefined) {
+            return { value: expandValue(candidate, value, env), key: candidate };
+        }
+    }
+    return undefined;
+}
+/**
+ * The same lookup for a credential, where a blank value counts as no value
+ * at all: an entry left empty rather than deleted — by a token rotation, or
+ * a logout that clears the line — must not shadow a credential that still
+ * works. npm and pnpm both test credential values for truthiness for the
+ * same reason.
+ *
+ * What it falls through to is another *key*: another credential kind at the
+ * same prefix, the other slash-spelling of the same dart, or a shallower
+ * nerf dart. That is as far as it goes, and
+ * deliberately so — it matches npm, whose `hasAuth` likewise only tries
+ * other credential kinds at the same or a shallower dart. It does not fall
+ * through to the other case spelling of the same key, which would reach
+ * past a blank into a different file.
+ *
+ * It does not reach the same key in a lower-precedence file: the merge in
+ * `loadNpmrcConfig` is first-writer-wins per key, so a blank `_authToken`
+ * in a project `.npmrc` still masks a working one in `~/.npmrc`. Skipping
+ * blanks during the merge would fix that, and was tried, but it makes this
+ * CLI send a credential npm and pnpm would not — they keep blank values
+ * read from files — so a project that deliberately blanks an entry to force
+ * anonymous access would have the developer's personal token sent instead.
+ * The mask covers only the spelling that is blank: the walk still probes
+ * the other slash-spelling of the same dart, whichever file supplies it,
+ * exactly as npm's walk does.
+ *
+ * Deliberately confined to credentials. A blank `registry` is a broken
+ * setting rather than an absent one, and treating it as absent would fall
+ * back to the public registry and send private package names to it. That
+ * holds for values read from files; a blank `npm_config_registry` never
+ * reaches the config at all, because `npmConfigEnvEntries` drops empty
+ * environment values at load, matching npm.
+ *
+ * A blank value and an unset `${VAR}` are deliberately not the same thing,
+ * here as in npm and pnpm: a blank value is an entry that exists and holds
+ * nothing, while an unset variable is a reference to something that does
+ * not exist — a typo, or a secret missing from the environment — which
+ * `expandValue` reports by name rather than papering over.
+ */
+function getCredentialEntry(config, key, env) {
+    // `getExpandedEntry` already stops at the first spelling that exists, so
+    // mapping its blank result to undefined is the whole difference.
+    const entry = getExpandedEntry(config, key, env);
+    return entry?.value === '' ? undefined : entry;
+}
+/**
+ * The scope of a package name (`@acme/foo` → `@acme`), or undefined when
+ * the name is unscoped. A leading `@` with no slash is not a scope: it is a
+ * malformed name, and treating it as one would silently truncate it.
+ */
+function packageScope(packageName) {
+    if (!packageName.startsWith('@')) {
         return undefined;
     }
-    return expandValue(key, value, env);
+    const separator = packageName.indexOf('/');
+    return separator > 1 ? packageName.slice(0, separator) : undefined;
 }
 /**
- * Resolves the registry URL for a package name: the `@scope:registry` entry
- * if the package is scoped and one exists, the `registry` entry otherwise,
- * falling back to the public npm registry. Always ends with a slash.
+ * Resolves the registry for a package name: the `@scope:registry` entry if
+ * the package is scoped and one exists, the `registry` entry otherwise,
+ * falling back to the public npm registry.
  */
-export function resolveRegistryUrl(config, packageName, env = process.env) {
+export function resolveRegistry(config, packageName, env = process.env) {
     let registry;
-    if (packageName.startsWith('@')) {
-        const scope = packageName.slice(0, packageName.indexOf('/'));
-        registry = getExpanded(config, `${scope}:registry`, env);
-    }
-    registry ??= getExpanded(config, 'registry', env);
-    registry ??= DEFAULT_REGISTRY_URL;
-    return registry.endsWith('/') ? registry : `${registry}/`;
-}
-/**
- * Resolves the `Authorization` header value applicable to a URL, matching
- * npm's "nerf dart" scheme: credentials are keyed by the registry URL minus
- * its protocol (`//host/path/:_authToken=...`). The URL's path is walked
- * upward so credentials configured for a registry root also apply to
- * tarball URLs beneath it. Supports `_authToken` (Bearer), `_auth`
- * (pre-encoded Basic), and `username` + `_password` (base64-encoded, per
- * npm convention). Returns undefined when no credentials match.
- */
-export function resolveAuthHeader(config, url, env = process.env) {
-    const parsed = new URL(url);
-    const segments = parsed.pathname.split('/').filter(segment => segment !== '');
+    const scope = packageScope(packageName);
+    if (scope !== undefined) {
+        registry = getExpandedEntry(config, `${scope}:registry`, env);
+        // npm and pnpm both treat a blank `@scope:registry` as unset and use the
+        // global `registry`, whatever that points at — including the public
+        // registry, if that is what the project configured. Only a usable value
+        // counts as the fallback: with nothing to fall back to, the blank entry
+        // is kept, so the caller reports the key to fix instead of quietly
+        // assuming the public registry nobody configured.
+        if (registry?.value === '') {
+            // An unexpandable global entry is no more usable than a missing one,
+            // and reporting it would name a key that is not the one in use, so it
+            // counts as nothing to fall back to.
+            const fallback = attempt(() => getExpandedEntry(config, 'registry', env));
+            if (fallback.error !== undefined) {
+                debug('ignoring unusable global registry while %s is blank: %s', registry.key, fallback.error.message);
+            }
+            if (fallback.value !== undefined && fallback.value.value !== '') {
+                debug('%s is blank, falling back to the registry configured by %s', registry.key, fallback.value.key);
+                registry = fallback.value;
+            }
+        }
+    }
+    registry ??= getExpandedEntry(config, 'registry', env);
+    if (registry === undefined) {
+        return { usable: true, url: DEFAULT_REGISTRY_URL };
+    }
+    // The trailing slash goes on first: it is part of what a registry URL
+    // means here, and `//host/npm` composes differently from `//host/npm/`.
+    const url = registry.value.endsWith('/') ? registry.value : `${registry.value}/`;
+    return parseComposableUrl(url) !== undefined
+        ? { usable: true, url, key: registry.key }
+        : { usable: false, key: registry.key };
+}
+/**
+ * The nerf darts a URL's credentials may be keyed by, deepest path first:
+ * `https://host/a/b` yields `//host/a/b/`, `//host/a/`, `//host/`. The path
+ * is walked upward because a credential configured for a registry root
+ * also applies to everything served beneath it.
+ *
+ * Only the canonical slash-terminated spelling is produced;
+ * lookup-candidate construction in `resolveAuthHeader` expands each dart
+ * into both accepted spellings with `dartSpellings`.
+ */
+function nerfDarts(url) {
+    const segments = url.pathname.split('/').filter(segment => segment !== '');
+    const darts = [];
     for (let depth = segments.length; depth >= 0; depth--) {
-        const nerfDart = `//${parsed.host}/${segments.slice(0, depth).map(segment => `${segment}/`).join('')}`;
-        const authToken = getExpanded(config, `${nerfDart}:_authToken`, env);
-        if (authToken !== undefined) {
-            return `Bearer ${authToken}`;
-        }
-        const auth = getExpanded(config, `${nerfDart}:_auth`, env);
-        if (auth !== undefined) {
-            return `Basic ${auth}`;
-        }
-        const username = getExpanded(config, `${nerfDart}:username`, env);
-        const password = getExpanded(config, `${nerfDart}:_password`, env);
-        if (username !== undefined && password !== undefined) {
-            const decodedPassword = Buffer.from(password, 'base64').toString('utf8');
-            return `Basic ${Buffer.from(`${username}:${decodedPassword}`, 'utf8').toString('base64')}`;
+        const prefix = segments.slice(0, depth).map(segment => `${segment}/`).join('');
+        darts.push(`//${url.host}/${prefix}`);
+    }
+    return darts;
+}
+/**
+ * Both accepted spellings of a nerf dart, in npm's probe order: the
+ * canonical slash-terminated form (`//host/a/`), then the slashless one
+ * (`//host/a`). npm probes both at every depth of its walk, and pnpm
+ * normalises the slashless spelling to the canonical one when it loads the
+ * config, so a hand-written `//host/a:_authToken` authenticates under both
+ * package managers — and must do so here too.
+ *
+ * That parity argument is established for plain darts only. The expansion
+ * is nevertheless applied to every candidate spelling — the
+ * scope-qualified colon form and the path form included — because those
+ * spellings are already read more generously than npm reads them (see
+ * `resolveAuthHeader`), and tolerating the missing slash uniformly beats a
+ * per-form rule about which keys forgive it.
+ */
+function dartSpellings(dart) {
+    return [dart, dart.slice(0, -1)];
+}
+/**
+ * The credentials configured under one key prefix, in npm's own order:
+ * `_authToken` (Bearer), then `username` + `_password` (base64-encoded, per
+ * npm convention), then `_auth` (pre-encoded Basic).
+ *
+ * A prefix is a nerf dart in either slash-spelling, optionally qualified by
+ * a scope (`//host/:@acme`). Both halves of a `username` + `_password` pair
+ * must live under the same prefix: pairing a scoped username with an
+ * unscoped password — or one spelling's username with the other spelling's
+ * password — would send a credential neither entry describes.
+ *
+ * pnpm's `tokenHelper` is deliberately absent from this list. It names an
+ * external command to run for a token, and running a command found in a
+ * config file is a decision well beyond resolving a credential. A user who
+ * has only that configured resolves no credential here and fails as if
+ * none were configured.
+ */
+function credentialsAt(config, prefix, env, { skipUnexpandable = false } = {}) {
+    // `skipUnexpandable` is per key, not per prefix: one entry referencing a
+    // variable that is not set says nothing about the other credential kinds
+    // configured beside it.
+    const entry = (kind) => {
+        const key = `${prefix}:${kind}`;
+        try {
+            return getCredentialEntry(config, key, env);
+        }
+        catch (err) {
+            if (skipUnexpandable && err instanceof NpmrcEnvVarError) {
+                debug('skipping credential %s: %s', key, err.message);
+                return undefined;
+            }
+            throw err;
+        }
+    };
+    const authToken = entry('_authToken');
+    if (authToken !== undefined) {
+        return { header: `Bearer ${authToken.value}`, keys: [authToken.key] };
+    }
+    // The pair outranks `_auth`, which is npm's order (`getCredentialsByURI`
+    // tries `_authToken`, then `username` + `_password`, then `_auth`) and
+    // matters when a legacy `_auth` line has been left behind beside a pair
+    // written later: npm authenticates with the pair, and so must this.
+    //
+    // Neither half is worth failing over alone — a leftover `username` from a
+    // setup that moved to a token must not abort a download that a credential
+    // further along the walk would have authenticated. Whether a half is
+    // usable is only knowable after expanding it, since a `${VAR}` set to the
+    // empty string is as absent as a literal blank, so both are attempted and
+    // an unexpandable one is held rather than thrown.
+    const username = attempt(() => entry('username'));
+    const password = attempt(() => entry('_password'));
+    if (username.value !== undefined && password.value !== undefined) {
+        const decodedPassword = Buffer.from(password.value.value, 'base64').toString('utf8');
+        const encoded = Buffer.from(`${username.value.value}:${decodedPassword}`, 'utf8').toString('base64');
+        return { header: `Basic ${encoded}`, keys: [username.value.key, password.value.key] };
+    }
+    // Both halves are here in some form, so the pair was meant and a variable
+    // is genuinely missing — worth naming rather than falling through to a
+    // credential the user did not intend to use.
+    const unexpandable = username.error ?? password.error;
+    if (unexpandable !== undefined) {
+        if (found(username) && found(password)) {
+            throw unexpandable;
+        }
+        // Dropped because its other half never materialised, so no pair was
+        // ever going to form here. Traceable rather than silent: "the CLI
+        // ignored my entry" is the report this explains.
+        debug('ignoring half a credential pair at %s: %s', prefix, unexpandable.message);
+    }
+    const auth = entry('_auth');
+    if (auth !== undefined) {
+        return { header: `Basic ${auth.value}`, keys: [auth.key] };
+    }
+    return undefined;
+}
+/** Whether a held lookup produced anything at all, usable or not. */
+function found(attempted) {
+    return attempted.value !== undefined || attempted.error !== undefined;
+}
+/**
+ * Runs a lookup, holding an `NpmrcEnvVarError` instead of raising it so the
+ * caller can decide whether the key it names was ever going to be used.
+ */
+function attempt(lookup) {
+    try {
+        return { value: lookup() };
+    }
+    catch (err) {
+        if (err instanceof NpmrcEnvVarError) {
+            return { error: err };
+        }
+        throw err;
+    }
+}
+/**
+ * Resolves the `Authorization` header applicable to a URL, matching npm's
+ * "nerf dart" scheme: credentials are keyed by the registry URL minus its
+ * protocol (`//host/path/:_authToken=...`). Every dart is probed in both
+ * slash-spellings, canonical first at each depth — `dartSpellings` says
+ * why both are honored. npm's walk agrees at every depth above the
+ * request's own; at that deepest depth npm probes only the URL's literal
+ * spelling, a difference observable only with a key at exactly the
+ * request's full path — not a key anything writes.
+ *
+ * `pnpm login --scope=@acme` writes a scope-qualified key instead
+ * (`//host/:@acme:_authToken=...`, or equivalently `//host/@acme/:_authToken`),
+ * so the package being downloaded decides which keys apply. Mirroring pnpm,
+ * every scoped key is tried before any unscoped one — a shallow scoped
+ * credential outranks a deeper unscoped one, rather than the two being
+ * interleaved by depth. An unscoped package never falls back to a scoped
+ * key: a scoped token belongs to one organisation by construction, and
+ * reusing it elsewhere would send that organisation's credential somewhere
+ * it was never meant to go.
+ *
+ * Scope-qualified keys are honored for every project, not only pnpm ones:
+ * npm, yarn, bun and pnpm 10 ignore the spelling entirely, but writing one
+ * is an unambiguous statement of which token that scope should use, and
+ * refusing to read it would leave a user whose only login is
+ * `pnpm login --scope` unauthenticated for exactly the packages the key
+ * names.
+ *
+ * Returns undefined when no credentials match.
+ */
+export function resolveAuthHeader(config, url, packageName, env = process.env) {
+    // The same rule the request itself has to pass. Callers check it first,
+    // so this is belt and braces — but the safe answer for a URL that could
+    // not be validated is no credentials rather than a thrown parse error.
+    const parsed = parseFetchableUrl(url);
+    if (parsed === undefined) {
+        return undefined;
+    }
+    const canonicalDarts = nerfDarts(parsed);
+    const darts = canonicalDarts.flatMap(dartSpellings);
+    const scope = packageScope(packageName);
+    const scoped = scope !== undefined ? darts.map(dart => `${dart}:${scope}`) : [];
+    for (const prefix of [...scoped, ...darts]) {
+        const credentials = credentialsAt(config, prefix, env);
+        if (credentials !== undefined) {
+            return credentials;
+        }
+    }
+    // pnpm accepts a second spelling, `//host/@acme/:_authToken`, which it
+    // binds to the registry the scope segment was stripped from rather than to
+    // the path — so it covers every `@acme` package on that host, including
+    // tarball URLs that never mention the scope at that depth, as GitHub
+    // Packages' `/download/@acme/...` URLs do not.
+    //
+    // It is tried last rather than with the colon form, which is where pnpm
+    // ranks it. The spelling is indistinguishable from an ordinary nerf dart
+    // for the path `/@acme/`, which is exactly how npm, yarn and bun read it,
+    // so giving it pnpm's rank would let it outrank a deeper unscoped key that
+    // authenticates a working setup today.
+    //
+    // Tried last it can only supply a credential where nothing else matched,
+    // and an unexpandable one is skipped rather than fatal — but only when
+    // this walk is the sole reading of that key. For a URL whose path does
+    // contain the scope, such as the `${registry}/@acme/foo/-/…` this CLI
+    // composes, `//host/@acme/` is an ordinary nerf dart the unscoped walk
+    // above already visited, and there it is a key that plainly applies to
+    // this request, so a variable missing from it is fatal like any other.
+    // The tolerance is for the other shape — GitHub Packages' `/download/…`,
+    // or a CDN URL — where the key names a location this request never
+    // touches and must not abort a download that would otherwise go out.
+    //
+    // A skip is only visible on the debug channel, so a download that then
+    // fails to authenticate reports finding no credentials at all.
+    // Composed from the canonical darts alone: the concatenation relies on
+    // the dart's trailing slash — a slashless dart would yield `//host@acme/`,
+    // a key nothing writes. The composed key then gets both of its own
+    // spellings, like every other candidate.
+    const pathForm = scope !== undefined
+        ? canonicalDarts.flatMap(dart => dartSpellings(`${dart}${scope}/`))
+        : [];
+    for (const prefix of pathForm) {
+        const credentials = credentialsAt(config, prefix, env, { skipUnexpandable: true });
+        if (credentials !== undefined) {
+            return credentials;
         }
     }
     return undefined;

package/dist/services/embedded-packages/npmrc.js.map

@@ -1 +1 @@
-{"version":3,"file":"npmrc.js","sourceRoot":"","sources":["../../../src/services/embedded-packages/npmrc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACjC,OAAO,EAAE,MAAM,SAAS,CAAA;AACxB,OAAO,IAAI,MAAM,WAAW,CAAA;AAE5B,MAAM,CAAC,MAAM,oBAAoB,GAAG,6BAA6B,CAAA;AASjE,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAa,GAAW,EAAE,OAAe;QACvC,KAAK,CACH,yBAAyB,GAAG,uCAAuC;cACjE,KAAK,OAAO,qBAAqB,CACpC,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAA;IAChC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAE,OAAe;IACzC,MAAM,MAAM,GAAgB,IAAI,GAAG,EAAE,CAAA;IAErC,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAA;QAC3B,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAChE,SAAQ;QACV,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACnC,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;YACrB,SAAQ;QACV,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAA;QAC3C,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAC5C,yDAAyD;QACzD,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QAC5B,CAAC;QACD,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;YACf,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACxB,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAE,GAAsB;IACxD,MAAM,MAAM,GAAgB,IAAI,GAAG,EAAE,CAAA;IAErC,MAAM,MAAM,GAAG,aAAa,CAAA;IAC5B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAClE,SAAQ;QACV,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACrC,sEAAsE;QACtE,wBAAwB;QACxB,IAAI,GAAG,KAAK,EAAE,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YAC/B,SAAQ;QACV,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACtB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,CAAA;QACtC,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,SAAmB,EACnB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAgB,kBAAkB,CAAC,GAAG,CAAC,CAAA;IAEnD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,OAAe,CAAA;QACnB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QAC/C,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAI,GAAG,EAAE,IAAI,KAAK,QAAQ,IAAI,GAAG,EAAE,IAAI,KAAK,SAAS,IAAI,GAAG,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAChF,SAAQ;YACV,CAAC;YACD,qEAAqE;YACrE,qEAAqE;YACrE,MAAM,IAAI,KAAK,CAAC,0CAA0C,QAAQ,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QACxF,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YACxB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,aAAqB,EACrB,OAAO,GAAG,EAAE,CAAC,OAAO,EAAE,EACtB,UAAmB;IAEnB,MAAM,KAAK,GAAG;QACZ,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC;KAC7B,CAAA;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;AAC5B,CAAC;AAED,SAAS,WAAW,CAAE,GAAW,EAAE,KAAa,EAAE,GAAsB;IACtE,OAAO,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,OAAe,EAAE,EAAE;QAC5D,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,CAAA;QAC7B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QAC1C,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,WAAW,CAAE,MAAmB,EAAE,GAAW,EAAE,GAAsB;IAC5E,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAA;IAC9D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAA;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAmB,EACnB,WAAmB,EACnB,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,QAA4B,CAAA;IAEhC,IAAI,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;QAC5D,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,GAAG,KAAK,WAAW,EAAE,GAAG,CAAC,CAAA;IAC1D,CAAC;IAED,QAAQ,KAAK,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,CAAA;IACjD,QAAQ,KAAK,oBAAoB,CAAA;IAEjC,OAAO,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,GAAG,CAAA;AAC3D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAmB,EACnB,GAAW,EACX,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IAE3B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,CAAA;IAC7E,KAAK,IAAI,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACtD,MAAM,QAAQ,GAAG,KAAK,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAA;QAEtG,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,EAAE,GAAG,QAAQ,aAAa,EAAE,GAAG,CAAC,CAAA;QACpE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,UAAU,SAAS,EAAE,CAAA;QAC9B,CAAC;QAED,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,GAAG,QAAQ,QAAQ,EAAE,GAAG,CAAC,CAAA;QAC1D,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,SAAS,IAAI,EAAE,CAAA;QACxB,CAAC;QAED,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,GAAG,QAAQ,WAAW,EAAE,GAAG,CAAC,CAAA;QACjE,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,GAAG,QAAQ,YAAY,EAAE,GAAG,CAAC,CAAA;QAClE,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACrD,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YACxE,OAAO,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,eAAe,EAAE,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAA;QAC5F,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC"}
+{"version":3,"file":"npmrc.js","sourceRoot":"","sources":["../../../src/services/embedded-packages/npmrc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACjC,OAAO,EAAE,MAAM,SAAS,CAAA;AACxB,OAAO,IAAI,MAAM,WAAW,CAAA;AAE5B,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAA;AAEhE,MAAM,KAAK,GAAG,KAAK,CAAC,wCAAwC,CAAC,CAAA;AAE7D,MAAM,CAAC,MAAM,oBAAoB,GAAG,6BAA6B,CAAA;AAYjE,0EAA0E;AAC1E,MAAM,CAAC,MAAM,qBAAqB,GAAG,aAAa,CAAA;AAqClD,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAa,GAAW,EAAE,OAAe;QACvC,KAAK;QACH,kEAAkE;QAClE,2DAA2D;QAC3D,oCAAoC,GAAG,8BAA8B;cACnE,cAAc,OAAO,qBAAqB,CAC7C,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAA;IAChC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAE,OAAe;IACzC,MAAM,MAAM,GAAgB,IAAI,GAAG,EAAE,CAAA;IAErC,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAA;QAC3B,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAChE,SAAQ;QACV,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACnC,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;YACrB,SAAQ;QACV,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAA;QAC3C,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAC5C,yDAAyD;QACzD,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QAC5B,CAAC;QACD,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;YACf,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACxB,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;GAKG;AACH,QAAQ,CAAC,CAAC,mBAAmB,CAC3B,GAAsB;IAEtB,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACpD,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC;YACrF,SAAQ;QACV,CAAC;QACD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAA;QACxD,sEAAsE;QACtE,wBAAwB;QACxB,IAAI,GAAG,KAAK,EAAE,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YAC/B,SAAQ;QACV,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAA;IAChC,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAK,GAAmB,EAAE,GAAW,EAAE,KAAQ;IACjE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IACnB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAChC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,CAAA;IACnC,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAE,GAAsB;IACxD,MAAM,MAAM,GAAgB,IAAI,GAAG,EAAE,CAAA;IAErC,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;IACjC,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAkB,EAClB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAgB,kBAAkB,CAAC,GAAG,CAAC,CAAA;IACnD,MAAM,UAAU,GAAa,EAAE,CAAA;IAC/B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAA;IAE/C,yEAAyE;IACzE,4DAA4D;IAC5D,KAAK,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;QACzD,WAAW,CAAe,OAAO,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;IACpE,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,GAAG,KAAK,EAAE,IAAI,KAAK,EAAE,CAAC;QACzD,IAAI,OAAe,CAAA;QACnB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QAC/C,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAI,GAAG,EAAE,IAAI,KAAK,QAAQ,IAAI,GAAG,EAAE,IAAI,KAAK,SAAS,IAAI,GAAG,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAChF,SAAQ;YACV,CAAC;YACD,qEAAqE;YACrE,qEAAqE;YACrE,qEAAqE;YACrE,qEAAqE;YACrE,qEAAqE;YACrE,sEAAsE;YACtE,oEAAoE;YACpE,mDAAmD;YACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,0CAA0C,QAAQ,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;YACxF,CAAC;YACD,KAAK,CAAC,4CAA4C,EAAE,QAAQ,EAAG,GAAa,CAAC,OAAO,CAAC,CAAA;YACrF,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACzB,SAAQ;QACV,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;gBACtB,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;YACpD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAA;AACrF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC7B,GAAsB,EACtB,QAAyB,EACzB,OAAe;IAEf,MAAM,aAAa,GAAG,GAAG,CAAC,eAAe,CAAA;IACzC,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,EAAE,EAAE,CAAC;QACxD,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;IACrD,CAAC;IACD,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;QACzE,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,CAAA;YACrC,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,EAAE,EAAE,CAAC;gBACtD,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAA;YAC9D,CAAC;YACD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;QAC1D,CAAC;QACD;YACE,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;IAC5D,CAAC;AACH,CAAC;AA6BD;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAE,OAA0B;IAC3D,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,OAAO,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,qBAAqB,EAAE,GAAG,OAAO,CAAA;IAE1G,MAAM,SAAS,GAAc,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAA;IACnE,yEAAyE;IACzE,mCAAmC;IACnC,MAAM,OAAO,GAAgB,YAAY,KAAK,SAAS;QACrD,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC1C,CAAC,CAAC,EAAE,CAAA;IAEN,MAAM,KAAK,GAAgB;QACzB,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,EAAE;QAC5C,GAAG,CAAC,qBAAqB,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,OAAO,CAAC,CAAC;KACxF,CAAA;IAED,0EAA0E;IAC1E,oEAAoE;IACpE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAA;AACpG,CAAC;AAED,SAAS,WAAW,CAAE,GAAW,EAAE,KAAa,EAAE,GAAsB;IACtE,OAAO,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,OAAe,EAAE,EAAE;QAC5D,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,CAAA;QAC7B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QAC1C,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CACvB,MAAmB,EACnB,GAAW,EACX,GAAsB;IAEtB,uEAAuE;IACvE,KAAK,MAAM,SAAS,IAAI,GAAG,KAAK,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QACrF,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACnC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAA;QACtE,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,SAAS,kBAAkB,CACzB,MAAmB,EACnB,GAAW,EACX,GAAsB;IAEtB,yEAAyE;IACzE,iEAAiE;IACjE,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IAChD,OAAO,KAAK,EAAE,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAA;AAChD,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAE,WAAmB;IACxC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC1C,OAAO,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AACpE,CAAC;AA6BD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAmB,EACnB,WAAmB,EACnB,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,QAAoD,CAAA;IAExD,MAAM,KAAK,GAAG,YAAY,CAAC,WAAW,CAAC,CAAA;IACvC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,QAAQ,GAAG,gBAAgB,CAAC,MAAM,EAAE,GAAG,KAAK,WAAW,EAAE,GAAG,CAAC,CAAA;QAE7D,yEAAyE;QACzE,oEAAoE;QACpE,wEAAwE;QACxE,wEAAwE;QACxE,mEAAmE;QACnE,kDAAkD;QAClD,IAAI,QAAQ,EAAE,KAAK,KAAK,EAAE,EAAE,CAAC;YAC3B,qEAAqE;YACrE,sEAAsE;YACtE,qCAAqC;YACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAA;YACzE,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBACjC,KAAK,CAAC,yDAAyD,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YACxG,CAAC;YAED,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;gBAChE,KAAK,CAAC,4DAA4D,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBACrG,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAA;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IAED,QAAQ,KAAK,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,CAAA;IAEtD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,oBAAoB,EAAE,CAAA;IACpD,CAAC;IAED,sEAAsE;IACtE,wEAAwE;IACxE,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,GAAG,CAAA;IAChF,OAAO,kBAAkB,CAAC,GAAG,CAAC,KAAK,SAAS;QAC1C,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE;QAC1C,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAA;AAC1C,CAAC;AAiBD;;;;;;;;;GASG;AACH,SAAS,SAAS,CAAE,GAAQ;IAC1B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,CAAA;IAE1E,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,IAAI,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACtD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC9E,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC,CAAA;IACvC,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,aAAa,CAAE,IAAY;IAClC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;AAClC,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,aAAa,CACpB,MAAmB,EACnB,MAAc,EACd,GAAsB,EACtB,EAAE,gBAAgB,GAAG,KAAK,KAAqC,EAAE;IAEjE,yEAAyE;IACzE,yEAAyE;IACzE,wBAAwB;IACxB,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE;QAC7B,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,IAAI,EAAE,CAAA;QAC/B,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;QAC7C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,gBAAgB,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;gBACxD,KAAK,CAAC,4BAA4B,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;gBACrD,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC,CAAA;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY,CAAC,CAAA;IACrC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,MAAM,EAAE,UAAU,SAAS,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAA;IACvE,CAAC;IAED,yEAAyE;IACzE,uEAAuE;IACvE,wEAAwE;IACxE,oEAAoE;IACpE,EAAE;IACF,0EAA0E;IAC1E,0EAA0E;IAC1E,qEAAqE;IACrE,0EAA0E;IAC1E,0EAA0E;IAC1E,kDAAkD;IAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAA;IACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAA;IAElD,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACjE,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QACpF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,eAAe,EAAE,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;QACpG,OAAO,EAAE,MAAM,EAAE,SAAS,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAA;IACvF,CAAC;IAED,0EAA0E;IAC1E,uEAAuE;IACvE,6CAA6C;IAC7C,MAAM,YAAY,GAAG,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAA;IACrD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvC,MAAM,YAAY,CAAA;QACpB,CAAC;QACD,oEAAoE;QACpE,kEAAkE;QAClE,iDAAiD;QACjD,KAAK,CAAC,2CAA2C,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,CAAA;IAClF,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAA;IAC3B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,MAAM,EAAE,SAAS,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAA;IAC5D,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,qEAAqE;AACrE,SAAS,KAAK,CAAE,SAAwD;IACtE,OAAO,SAAS,CAAC,KAAK,KAAK,SAAS,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS,CAAA;AACvE,CAAC;AAED;;;GAGG;AACH,SAAS,OAAO,CAAK,MAAe;IAClC,IAAI,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAA;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;YACpC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAA;QACvB,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAmB,EACnB,GAAW,EACX,WAAmB,EACnB,MAAyB,OAAO,CAAC,GAAG;IAEpC,wEAAwE;IACxE,wEAAwE;IACxE,uEAAuE;IACvE,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;IACrC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,cAAc,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;IACxC,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;IACnD,MAAM,KAAK,GAAG,YAAY,CAAC,WAAW,CAAC,CAAA;IAEvC,MAAM,MAAM,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC/E,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;QAC3C,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAA;QACtD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,WAAW,CAAA;QACpB,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,2EAA2E;IAC3E,wEAAwE;IACxE,qEAAqE;IACrE,+CAA+C;IAC/C,EAAE;IACF,wEAAwE;IACxE,yEAAyE;IACzE,0EAA0E;IAC1E,2EAA2E;IAC3E,uCAAuC;IACvC,EAAE;IACF,yEAAyE;IACzE,uEAAuE;IACvE,uEAAuE;IACvE,sEAAsE;IACtE,uEAAuE;IACvE,uEAAuE;IACvE,uEAAuE;IACvE,yEAAyE;IACzE,mEAAmE;IACnE,qEAAqE;IACrE,EAAE;IACF,uEAAuE;IACvE,+DAA+D;IAC/D,uEAAuE;IACvE,2EAA2E;IAC3E,mEAAmE;IACnE,yCAAyC;IACzC,MAAM,QAAQ,GAAG,KAAK,KAAK,SAAS;QAClC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,GAAG,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC;QACnE,CAAC,CAAC,EAAE,CAAA;IACN,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAA;QAClF,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,WAAW,CAAA;QACpB,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC"}