codexgpt 1.0.0

package/dist/git/objectQuarantine.js

@@ -0,0 +1,243 @@
+import { createHash } from "node:crypto";
+import fsp from "node:fs/promises";
+import path from "node:path";
+import { inflateSync } from "node:zlib";
+import { gateRError } from "./durableState.js";
+const MAX_OBJECTS = 4096;
+const MAX_COMPRESSED_OBJECT_BYTES = 64 * 1024 * 1024;
+const MAX_INFLATED_OBJECT_BYTES = 128 * 1024 * 1024;
+const MAX_TOTAL_COMPRESSED_BYTES = 128 * 1024 * 1024;
+function isInside(child, parent) {
+    const relative = path.relative(parent, child);
+    return relative !== "" && !relative.startsWith("..") && !path.isAbsolute(relative);
+}
+function oidPattern(format) {
+    return format === "sha1" ? /^[a-f0-9]{40}$/ : /^[a-f0-9]{64}$/;
+}
+function objectPath(root, oid) {
+    const resolvedRoot = path.resolve(root);
+    const file = path.join(resolvedRoot, oid.slice(0, 2), oid.slice(2));
+    if (!isInside(file, resolvedRoot))
+        throw gateRError();
+    return file;
+}
+async function assertRealDirectory(directory) {
+    try {
+        const lexical = await fsp.lstat(directory);
+        if (!lexical.isDirectory() || lexical.isSymbolicLink())
+            throw gateRError();
+    }
+    catch {
+        throw gateRError();
+    }
+}
+async function ensureDirectChildDirectory(parent, child) {
+    const resolvedParent = path.resolve(parent);
+    const resolvedChild = path.resolve(child);
+    if (!isInside(resolvedChild, resolvedParent) || path.dirname(resolvedChild) !== resolvedParent)
+        throw gateRError();
+    await assertRealDirectory(resolvedParent);
+    try {
+        await fsp.mkdir(resolvedChild, { mode: 0o700 });
+    }
+    catch (error) {
+        if (error.code !== "EEXIST")
+            throw gateRError();
+    }
+    await assertRealDirectory(resolvedParent);
+    await assertRealDirectory(resolvedChild);
+}
+async function readLooseObject(file, containmentRoot) {
+    try {
+        const resolvedRoot = path.resolve(containmentRoot);
+        if (!isInside(path.resolve(file), resolvedRoot))
+            throw gateRError();
+        await assertRealDirectory(resolvedRoot);
+        await assertRealDirectory(path.dirname(file));
+        const lexical = await fsp.lstat(file);
+        if (!lexical.isFile() || lexical.isSymbolicLink() || lexical.nlink !== 1 || lexical.size < 2 || lexical.size > MAX_COMPRESSED_OBJECT_BYTES) {
+            throw gateRError();
+        }
+        const handle = await fsp.open(file, "r");
+        try {
+            const before = await handle.stat({ bigint: true });
+            if (!before.isFile() || before.nlink !== 1n || before.size > BigInt(MAX_COMPRESSED_OBJECT_BYTES))
+                throw gateRError();
+            const compressed = await handle.readFile();
+            const after = await handle.stat({ bigint: true });
+            if (before.dev !== after.dev || before.ino !== after.ino || before.size !== after.size || before.mtimeNs !== after.mtimeNs)
+                throw gateRError();
+            return compressed;
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    catch {
+        throw gateRError();
+    }
+}
+function verifyLooseObject(compressed, oid, format) {
+    let inflated;
+    try {
+        inflated = inflateSync(compressed, { maxOutputLength: MAX_INFLATED_OBJECT_BYTES });
+    }
+    catch {
+        throw gateRError();
+    }
+    try {
+        const nul = inflated.indexOf(0);
+        if (nul < 6 || nul > 80)
+            throw gateRError();
+        const header = inflated.subarray(0, nul).toString("ascii");
+        const match = /^(blob|tree|commit|tag) ([0-9]+)$/.exec(header);
+        if (!match)
+            throw gateRError();
+        const declared = Number(match[2]);
+        if (!Number.isSafeInteger(declared) || declared !== inflated.length - nul - 1)
+            throw gateRError();
+        if (createHash(format).update(inflated).digest("hex") !== oid)
+            throw gateRError();
+    }
+    finally {
+        inflated.fill(0);
+    }
+}
+async function verifyExistingDestination(file, objectRoot, oid, format) {
+    const compressed = await readLooseObject(file, objectRoot);
+    try {
+        verifyLooseObject(compressed, oid, format);
+    }
+    finally {
+        compressed.fill(0);
+    }
+}
+async function destinationExists(file) {
+    try {
+        await fsp.lstat(file);
+        return true;
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return false;
+        throw gateRError();
+    }
+}
+async function inventoryLooseObjects(root, format) {
+    const resolvedRoot = path.resolve(root);
+    await assertRealDirectory(resolvedRoot);
+    const prefixes = await fsp.readdir(resolvedRoot, { withFileTypes: true }).catch(() => {
+        throw gateRError();
+    });
+    if (prefixes.length > 256)
+        throw gateRError();
+    const suffixPattern = format === "sha1" ? /^[a-f0-9]{38}$/u : /^[a-f0-9]{62}$/u;
+    const objects = [];
+    for (const prefix of prefixes.sort((left, right) => left.name.localeCompare(right.name))) {
+        if (!/^[a-f0-9]{2}$/u.test(prefix.name) || !prefix.isDirectory() || prefix.isSymbolicLink())
+            throw gateRError();
+        const directory = path.join(resolvedRoot, prefix.name);
+        await assertRealDirectory(directory);
+        const entries = await fsp.readdir(directory, { withFileTypes: true }).catch(() => {
+            throw gateRError();
+        });
+        for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
+            if (!suffixPattern.test(entry.name) || !entry.isFile() || entry.isSymbolicLink())
+                throw gateRError();
+            objects.push(`${prefix.name}${entry.name}`);
+            if (objects.length > MAX_OBJECTS)
+                throw gateRError();
+        }
+    }
+    return objects;
+}
+export class GitObjectQuarantine {
+    #journal;
+    constructor(options) {
+        this.#journal = options.journal;
+    }
+    async promoteAll(input) {
+        const objects = await inventoryLooseObjects(input.quarantineRoot, input.repository.objectFormat);
+        if (objects.length === 0)
+            return [];
+        return this.promote({
+            ...input,
+            objects: objects.map((oid) => ({ oid }))
+        });
+    }
+    async promote(input) {
+        if (!Array.isArray(input.objects) || input.objects.length < 1 || input.objects.length > MAX_OBJECTS)
+            throw gateRError();
+        const unique = new Set();
+        for (const object of input.objects) {
+            if (!oidPattern(input.repository.objectFormat).test(object.oid) || unique.has(object.oid))
+                throw gateRError();
+            unique.add(object.oid);
+        }
+        const commonDir = path.resolve(input.repository.commonDir);
+        const quarantineRoot = path.resolve(input.quarantineRoot);
+        if (commonDir === quarantineRoot)
+            throw gateRError();
+        await assertRealDirectory(commonDir);
+        await assertRealDirectory(quarantineRoot);
+        const objectRoot = path.join(commonDir, "objects");
+        await ensureDirectChildDirectory(commonDir, objectRoot);
+        const results = [];
+        let totalCompressedBytes = 0;
+        for (const object of input.objects) {
+            const source = objectPath(quarantineRoot, object.oid);
+            const destination = objectPath(objectRoot, object.oid);
+            await this.#journal({ oid: object.oid, transition: "promotion_planned" });
+            try {
+                if (await destinationExists(destination)) {
+                    await verifyExistingDestination(destination, objectRoot, object.oid, input.repository.objectFormat);
+                    await this.#journal({ oid: object.oid, transition: "already_present" });
+                    results.push({ oid: object.oid, status: "already_present" });
+                    continue;
+                }
+                const compressed = await readLooseObject(source, quarantineRoot);
+                try {
+                    totalCompressedBytes += compressed.length;
+                    if (totalCompressedBytes > MAX_TOTAL_COMPRESSED_BYTES)
+                        throw gateRError();
+                    verifyLooseObject(compressed, object.oid, input.repository.objectFormat);
+                    await ensureDirectChildDirectory(objectRoot, path.dirname(destination));
+                    let handle = null;
+                    try {
+                        handle = await fsp.open(destination, "wx", 0o444);
+                        await handle.writeFile(compressed);
+                        await handle.sync();
+                    }
+                    catch (error) {
+                        if (error.code === "EEXIST") {
+                            await verifyExistingDestination(destination, objectRoot, object.oid, input.repository.objectFormat);
+                            await this.#journal({ oid: object.oid, transition: "already_present" });
+                            results.push({ oid: object.oid, status: "already_present" });
+                            continue;
+                        }
+                        try {
+                            await fsp.unlink(destination);
+                        }
+                        catch { }
+                        throw gateRError();
+                    }
+                    finally {
+                        await handle?.close().catch(() => { });
+                    }
+                    await verifyExistingDestination(destination, objectRoot, object.oid, input.repository.objectFormat);
+                    await this.#journal({ oid: object.oid, transition: "promoted" });
+                    results.push({ oid: object.oid, status: "promoted" });
+                }
+                finally {
+                    compressed.fill(0);
+                }
+            }
+            catch (error) {
+                await Promise.resolve(this.#journal({ oid: object.oid, transition: "failed" })).catch(() => { });
+                throw error instanceof Error && error.message === "GIT_RECOVERY_REQUIRED" ? error : gateRError();
+            }
+        }
+        return results;
+    }
+}
+//# sourceMappingURL=objectQuarantine.js.map

package/dist/git/objectQuarantine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"objectQuarantine.js","sourceRoot":"","sources":["../../src/git/objectQuarantine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,GAAG,MAAM,kBAAkB,CAAC;AACnC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAkB/C,MAAM,WAAW,GAAG,IAAI,CAAC;AACzB,MAAM,2BAA2B,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACrD,MAAM,yBAAyB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AACpD,MAAM,0BAA0B,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAErD,SAAS,QAAQ,CAAC,KAAa,EAAE,MAAc;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9C,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;AACrF,CAAC;AAED,SAAS,UAAU,CAAC,MAAuB;IACzC,OAAO,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;AACjE,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,GAAW;IAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;QAAE,MAAM,UAAU,EAAE,CAAC;IACtD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,SAAiB;IAClD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,OAAO,CAAC,cAAc,EAAE;YAAE,MAAM,UAAU,EAAE,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,UAAU,EAAE,CAAC;IACrB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,MAAc,EAAE,KAAa;IACrE,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,cAAc,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,cAAc;QAAE,MAAM,UAAU,EAAE,CAAC;IACnH,MAAM,mBAAmB,CAAC,cAAc,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,UAAU,EAAE,CAAC;IAC7E,CAAC;IACD,MAAM,mBAAmB,CAAC,cAAc,CAAC,CAAC;IAC1C,MAAM,mBAAmB,CAAC,aAAa,CAAC,CAAC;AAC3C,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,eAAuB;IAClE,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC;YAAE,MAAM,UAAU,EAAE,CAAC;QACpE,MAAM,mBAAmB,CAAC,YAAY,CAAC,CAAC;QACxC,MAAM,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,OAAO,CAAC,cAAc,EAAE,IAAI,OAAO,CAAC,KAAK,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,GAAG,2BAA2B,EAAE,CAAC;YAC3I,MAAM,UAAU,EAAE,CAAC;QACrB,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,KAAK,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,2BAA2B,CAAC;gBAAE,MAAM,UAAU,EAAE,CAAC;YACrH,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;gBAAE,MAAM,UAAU,EAAE,CAAC;YAC/I,OAAO,UAAU,CAAC;QACpB,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,UAAU,EAAE,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,UAAkB,EAAE,GAAW,EAAE,MAAuB;IACjF,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,WAAW,CAAC,UAAU,EAAE,EAAE,eAAe,EAAE,yBAAyB,EAAE,CAAC,CAAC;IACrF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,UAAU,EAAE,CAAC;IACrB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,EAAE;YAAE,MAAM,UAAU,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,mCAAmC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/D,IAAI,CAAC,KAAK;YAAE,MAAM,UAAU,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,KAAK,QAAQ,CAAC,MAAM,GAAG,GAAG,GAAG,CAAC;YAAE,MAAM,UAAU,EAAE,CAAC;QAClG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG;YAAE,MAAM,UAAU,EAAE,CAAC;IACpF,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,IAAY,EACZ,UAAkB,EAClB,GAAW,EACX,MAAuB;IAEvB,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,iBAAiB,CAAC,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;YAAS,CAAC;QACT,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAC3C,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACrE,MAAM,UAAU,EAAE,CAAC;IACrB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,IAAY,EAAE,MAAuB;IACxE,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,mBAAmB,CAAC,YAAY,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;QACnF,MAAM,UAAU,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,UAAU,EAAE,CAAC;IAC9C,MAAM,aAAa,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC;IAChF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACzF,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,MAAM,CAAC,cAAc,EAAE;YAAE,MAAM,UAAU,EAAE,CAAC;QAChH,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YAC/E,MAAM,UAAU,EAAE,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACvF,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,cAAc,EAAE;gBAAE,MAAM,UAAU,EAAE,CAAC;YACrG,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5C,IAAI,OAAO,CAAC,MAAM,GAAG,WAAW;gBAAE,MAAM,UAAU,EAAE,CAAC;QACvD,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,OAAO,mBAAmB;IACrB,QAAQ,CAA2D;IAE5E,YAAY,OAEX;QACC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAGhB;QACC,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;QACjG,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC,OAAO,CAAC;YAClB,GAAG,KAAK;YACR,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;SACzC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAIb;QACC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,WAAW;YAAE,MAAM,UAAU,EAAE,CAAC;QACxH,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QACjC,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACnC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC;gBAAE,MAAM,UAAU,EAAE,CAAC;YAC9G,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC3D,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAC1D,IAAI,SAAS,KAAK,cAAc;YAAE,MAAM,UAAU,EAAE,CAAC;QACrD,MAAM,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACrC,MAAM,mBAAmB,CAAC,cAAc,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACnD,MAAM,0BAA0B,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QACxD,MAAM,OAAO,GAA+B,EAAE,CAAC;QAC/C,IAAI,oBAAoB,GAAG,CAAC,CAAC;QAE7B,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,UAAU,CAAC,cAAc,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;YACtD,MAAM,WAAW,GAAG,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;YACvD,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC1E,IAAI,CAAC;gBACH,IAAI,MAAM,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC;oBACzC,MAAM,yBAAyB,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;oBACpG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC,CAAC;oBACxE,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;oBAC7D,SAAS;gBACX,CAAC;gBACD,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;gBACjE,IAAI,CAAC;oBACH,oBAAoB,IAAI,UAAU,CAAC,MAAM,CAAC;oBAC1C,IAAI,oBAAoB,GAAG,0BAA0B;wBAAE,MAAM,UAAU,EAAE,CAAC;oBAC1E,iBAAiB,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;oBAEzE,MAAM,0BAA0B,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;oBACxE,IAAI,MAAM,GAA0B,IAAI,CAAC;oBACzC,IAAI,CAAC;wBACH,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;wBAClD,MAAM,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;wBACnC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;oBACtB,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;4BACvD,MAAM,yBAAyB,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;4BACpG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC,CAAC;4BACxE,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;4BAC7D,SAAS;wBACX,CAAC;wBACD,IAAI,CAAC;4BAAC,MAAM,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;wBAAC,CAAC;wBAAC,MAAM,CAAC,CAAC,CAAC;wBAChD,MAAM,UAAU,EAAE,CAAC;oBACrB,CAAC;4BAAS,CAAC;wBACT,MAAM,MAAM,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;oBACxC,CAAC;oBACD,MAAM,yBAAyB,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;oBACpG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;oBACjE,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;gBACxD,CAAC;wBAAS,CAAC;oBACT,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAChG,MAAM,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,uBAAuB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;YACnG,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}

package/dist/git/opaqueRecordStore.js

@@ -0,0 +1,187 @@
+import fs from "node:fs";
+import path from "node:path";
+import { createHmac, randomBytes } from "node:crypto";
+import { z } from "zod";
+import { AtomicJsonFileStore } from "../transactions/atomicStateFile.js";
+import { canonicalGateRJson, deriveGateRSubkey, openGitState, sealGitState } from "./durableState.js";
+function opaqueRecordSchema(maxCiphertextCharacters) {
+    const sealedSchema = z.object({
+        schemaVersion: z.literal(1),
+        iv: z.string().min(16).max(32),
+        ciphertext: z.string().min(4).max(maxCiphertextCharacters),
+        tag: z.string().min(20).max(32)
+    }).strict();
+    return z.object({
+        schemaVersion: z.literal(1),
+        recordId: z.string().min(8).max(240).regex(/^[A-Za-z][A-Za-z0-9_-]+$/u),
+        kind: z.string().min(1).max(64).regex(/^[a-z][a-z0-9_]*$/u),
+        generation: z.number().int().positive().safe(),
+        state: z.enum(["active", "consumed", "revoked"]),
+        issuedAt: z.string().datetime({ offset: true }),
+        expiresAt: z.string().datetime({ offset: true }),
+        value: sealedSchema,
+        recordMac: z.string().regex(/^[a-f0-9]{64}$/u)
+    }).strict();
+}
+function withoutMac(record) {
+    const { recordMac: _ignored, ...rest } = record;
+    return rest;
+}
+export class DurableOpaqueRecordStoreV4 {
+    #directory;
+    #atomic;
+    #recordSchema;
+    #sealKey;
+    #macKey;
+    #now;
+    #maxPlaintextBytes;
+    constructor(options) {
+        if (!/^[a-z][a-z0-9-]{0,47}$/u.test(options.namespace)) {
+            throw new Error("GIT_RECOVERY_REQUIRED");
+        }
+        this.#directory = path.join(path.resolve(options.stateRoot), "git", options.namespace);
+        const maxCiphertextCharacters = options.maxCiphertextCharacters ?? 400_000;
+        this.#maxPlaintextBytes = options.maxPlaintextBytes ?? 262_144;
+        if (!Number.isSafeInteger(maxCiphertextCharacters) ||
+            maxCiphertextCharacters < 400_000 ||
+            maxCiphertextCharacters > 64_000_000 ||
+            !Number.isSafeInteger(this.#maxPlaintextBytes) ||
+            this.#maxPlaintextBytes < 262_144 ||
+            this.#maxPlaintextBytes > 48_000_000) {
+            throw new Error("GIT_RECOVERY_REQUIRED");
+        }
+        this.#recordSchema = opaqueRecordSchema(maxCiphertextCharacters);
+        this.#atomic = new AtomicJsonFileStore(options.stateRoot, this.#recordSchema);
+        this.#sealKey = deriveGateRSubkey(options.masterKey, `${options.namespace}-sealed`);
+        this.#macKey = deriveGateRSubkey(options.masterKey, `${options.namespace}-mac`);
+        this.#now = options.now ?? Date.now;
+    }
+    put(input) {
+        const now = this.#now();
+        if (input.expiresAt <= now || input.expiresAt > now + 366 * 24 * 60 * 60_000) {
+            throw new Error("GIT_STATE_TOKEN_INVALID");
+        }
+        const file = this.#path(input.recordId);
+        if (fs.existsSync(file))
+            throw new Error("GIT_STATE_TOKEN_INVALID");
+        const base = {
+            schemaVersion: 1,
+            recordId: input.recordId,
+            kind: input.kind,
+            generation: 1,
+            state: "active",
+            issuedAt: new Date(now).toISOString(),
+            expiresAt: new Date(input.expiresAt).toISOString(),
+            value: sealGitState(this.#sealKey, `opaque-v4:${input.kind}:${input.recordId}`, input.value, randomBytes, this.#maxPlaintextBytes)
+        };
+        this.#atomic.write(file, this.#recordSchema.parse({
+            ...base,
+            recordMac: createHmac("sha256", this.#macKey)
+                .update(canonicalGateRJson(base))
+                .digest("hex")
+        }));
+    }
+    get(recordId, kind) {
+        const record = this.#read(recordId);
+        if (record.kind !== kind ||
+            record.state !== "active" ||
+            Date.parse(record.issuedAt) > this.#now() ||
+            Date.parse(record.expiresAt) < this.#now())
+            throw new Error("GIT_STATE_TOKEN_INVALID");
+        return openGitState(this.#sealKey, `opaque-v4:${kind}:${recordId}`, record.value, this.#maxPlaintextBytes);
+    }
+    consume(recordId, kind) {
+        const value = this.get(recordId, kind);
+        this.#transition(recordId, "consumed");
+        return value;
+    }
+    replace(recordId, kind, value) {
+        const current = this.#read(recordId);
+        if (current.kind !== kind || current.state !== "active") {
+            throw new Error("GIT_STATE_TOKEN_INVALID");
+        }
+        const base = {
+            ...withoutMac(current),
+            generation: current.generation + 1,
+            value: sealGitState(this.#sealKey, `opaque-v4:${kind}:${recordId}`, value, randomBytes, this.#maxPlaintextBytes)
+        };
+        this.#atomic.write(this.#path(recordId), this.#recordSchema.parse({
+            ...base,
+            recordMac: createHmac("sha256", this.#macKey)
+                .update(canonicalGateRJson(base))
+                .digest("hex")
+        }));
+    }
+    revoke(recordId) {
+        const record = this.#read(recordId);
+        if (record.state === "active")
+            this.#transition(recordId, "revoked");
+    }
+    list(kind, options = {}) {
+        let names;
+        try {
+            names = fs.readdirSync(this.#directory);
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return [];
+            throw new Error("GIT_RECOVERY_REQUIRED");
+        }
+        const output = [];
+        for (const name of names.filter((value) => /^[a-f0-9]{64}\.json$/u.test(value)).sort()) {
+            const record = this.#atomic.read(path.join(this.#directory, name));
+            const expected = createHmac("sha256", this.#macKey)
+                .update(canonicalGateRJson(withoutMac(record)))
+                .digest("hex");
+            if (record.recordMac !== expected)
+                throw new Error("GIT_RECOVERY_REQUIRED");
+            if (record.kind === kind &&
+                record.state === "active" &&
+                (options.includeExpired === true || Date.parse(record.expiresAt) >= this.#now())) {
+                output.push({
+                    recordId: record.recordId,
+                    value: openGitState(this.#sealKey, `opaque-v4:${kind}:${record.recordId}`, record.value, this.#maxPlaintextBytes)
+                });
+            }
+        }
+        return output;
+    }
+    dispose() {
+        this.#sealKey.fill(0);
+        this.#macKey.fill(0);
+    }
+    #transition(recordId, state) {
+        const current = this.#read(recordId);
+        const base = {
+            ...withoutMac(current),
+            generation: current.generation + 1,
+            state
+        };
+        this.#atomic.write(this.#path(recordId), this.#recordSchema.parse({
+            ...base,
+            recordMac: createHmac("sha256", this.#macKey)
+                .update(canonicalGateRJson(base))
+                .digest("hex")
+        }));
+    }
+    #read(recordId) {
+        const record = this.#atomic.read(this.#path(recordId));
+        const expected = createHmac("sha256", this.#macKey)
+            .update(canonicalGateRJson(withoutMac(record)))
+            .digest("hex");
+        if (record.recordMac !== expected)
+            throw new Error("GIT_RECOVERY_REQUIRED");
+        return record;
+    }
+    #path(recordId) {
+        if (!/^[A-Za-z][A-Za-z0-9_-]{7,239}$/u.test(recordId)) {
+            throw new Error("GIT_STATE_TOKEN_INVALID");
+        }
+        const key = createHmac("sha256", this.#macKey)
+            .update("opaque-record-path\0")
+            .update(recordId)
+            .digest("hex");
+        return path.join(this.#directory, `${key}.json`);
+    }
+}
+//# sourceMappingURL=opaqueRecordStore.js.map

package/dist/git/opaqueRecordStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"opaqueRecordStore.js","sourceRoot":"","sources":["../../src/git/opaqueRecordStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,EACZ,YAAY,EAEb,MAAM,mBAAmB,CAAC;AAc3B,SAAS,kBAAkB,CAAC,uBAA+B;IACzD,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;QAC5B,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC;QAC1D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;KAChC,CAAC,CAAC,MAAM,EAAE,CAAC;IACZ,OAAO,CAAC,CAAC,MAAM,CAAC;QACd,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC;QACvE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC;QAC3D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE;QAC9C,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;QAChD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC/C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAChD,KAAK,EAAE,YAAY;QACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC;KAC/C,CAAC,CAAC,MAAM,EAAE,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CAAC,MAAsB;IACxC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;IAChD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,0BAA0B;IAC5B,UAAU,CAAS;IACnB,OAAO,CAAsC;IAC7C,aAAa,CAA4B;IACzC,QAAQ,CAAS;IACjB,OAAO,CAAS;IAChB,IAAI,CAAe;IACnB,kBAAkB,CAAS;IAEpC,YAAY,OAOX;QACC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACvF,MAAM,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,IAAI,OAAO,CAAC;QAC3E,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,IAAI,OAAO,CAAC;QAC/D,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,uBAAuB,CAAC;YAC9C,uBAAuB,GAAG,OAAO;YACjC,uBAAuB,GAAG,UAAU;YACpC,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,kBAAkB,CAAC;YAC9C,IAAI,CAAC,kBAAkB,GAAG,OAAO;YACjC,IAAI,CAAC,kBAAkB,GAAG,UAAU,EACpC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,CAAC,aAAa,GAAG,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;QACjE,IAAI,CAAC,OAAO,GAAG,IAAI,mBAAmB,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAC9E,IAAI,CAAC,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,OAAO,CAAC,SAAS,SAAS,CAAC,CAAC;QACpF,IAAI,CAAC,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,OAAO,CAAC,SAAS,MAAM,CAAC,CAAC;QAChF,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACtC,CAAC;IAED,GAAG,CAAI,KAKN;QACC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;YAC7E,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG;YACX,aAAa,EAAE,CAAU;YACzB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,UAAU,EAAE,CAAC;YACb,KAAK,EAAE,QAAiB;YACxB,QAAQ,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;YACrC,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;YAClD,KAAK,EAAE,YAAY,CACjB,IAAI,CAAC,QAAQ,EACb,aAAa,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,EAC3C,KAAK,CAAC,KAAK,EACX,WAAW,EACX,IAAI,CAAC,kBAAkB,CACxB;SACF,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;YAChD,GAAG,IAAI;YACP,SAAS,EAAE,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC;iBAC1C,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;iBAChC,MAAM,CAAC,KAAK,CAAC;SACjB,CAAC,CAAC,CAAC;IACN,CAAC;IAED,GAAG,CAAI,QAAgB,EAAE,IAAY;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpC,IACE,MAAM,CAAC,IAAI,KAAK,IAAI;YACpB,MAAM,CAAC,KAAK,KAAK,QAAQ;YACzB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE;YACzC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE;YAC1C,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,OAAO,YAAY,CACjB,IAAI,CAAC,QAAQ,EACb,aAAa,IAAI,IAAI,QAAQ,EAAE,EAC/B,MAAM,CAAC,KAAK,EACZ,IAAI,CAAC,kBAAkB,CACnB,CAAC;IACT,CAAC;IAED,OAAO,CAAI,QAAgB,EAAE,IAAY;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAI,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACvC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CAAI,QAAgB,EAAE,IAAY,EAAE,KAAQ;QACjD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,IAAI,GAAG;YACX,GAAG,UAAU,CAAC,OAAO,CAAC;YACtB,UAAU,EAAE,OAAO,CAAC,UAAU,GAAG,CAAC;YAClC,KAAK,EAAE,YAAY,CACjB,IAAI,CAAC,QAAQ,EACb,aAAa,IAAI,IAAI,QAAQ,EAAE,EAC/B,KAAK,EACL,WAAW,EACX,IAAI,CAAC,kBAAkB,CACxB;SACF,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;YAChE,GAAG,IAAI;YACP,SAAS,EAAE,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC;iBAC1C,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;iBAChC,MAAM,CAAC,KAAK,CAAC;SACjB,CAAC,CAAC,CAAC;IACN,CAAC;IAED,MAAM,CAAC,QAAgB;QACrB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ;YAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,CAAI,IAAY,EAAE,UAAwC,EAAE;QAC9D,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC;YACH,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,MAAM,GAA0C,EAAE,CAAC;QACzD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACvF,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;YACnE,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC;iBAChD,MAAM,CAAC,kBAAkB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;iBAC9C,MAAM,CAAC,KAAK,CAAC,CAAC;YACjB,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC5E,IACE,MAAM,CAAC,IAAI,KAAK,IAAI;gBACpB,MAAM,CAAC,KAAK,KAAK,QAAQ;gBACzB,CAAC,OAAO,CAAC,cAAc,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,EAChF,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC;oBACV,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,KAAK,EAAE,YAAY,CACjB,IAAI,CAAC,QAAQ,EACb,aAAa,IAAI,IAAI,MAAM,CAAC,QAAQ,EAAE,EACtC,MAAM,CAAC,KAAK,EACZ,IAAI,CAAC,kBAAkB,CACnB;iBACP,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO;QACL,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IAED,WAAW,CAAC,QAAgB,EAAE,KAA6B;QACzD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG;YACX,GAAG,UAAU,CAAC,OAAO,CAAC;YACtB,UAAU,EAAE,OAAO,CAAC,UAAU,GAAG,CAAC;YAClC,KAAK;SACN,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;YAChE,GAAG,IAAI;YACP,SAAS,EAAE,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC;iBAC1C,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;iBAChC,MAAM,CAAC,KAAK,CAAC;SACjB,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,QAAgB;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC;aAChD,MAAM,CAAC,kBAAkB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;aAC9C,MAAM,CAAC,KAAK,CAAC,CAAC;QACjB,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC5E,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,QAAgB;QACpB,IAAI,CAAC,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC;aAC3C,MAAM,CAAC,sBAAsB,CAAC;aAC9B,MAAM,CAAC,QAAQ,CAAC;aAChB,MAAM,CAAC,KAAK,CAAC,CAAC;QACjB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,GAAG,OAAO,CAAC,CAAC;IACnD,CAAC;CACF"}