emdash 0.41.0 → 0.42.0

package/dist/artifact-fetch-B9W4CEST.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"artifact-fetch-B9W4CEST.mjs","names":["TRAILING_DOT"],"sources":["../../registry-verification/dist/fetch-B66dZAfm.js","../../registry-verification/dist/artifact.js","../src/registry/artifact-fetch.ts"],"sourcesContent":["import { n as verificationError } from \"./errors-D3_zxvwe.js\";\n\n//#region src/fetch.ts\nconst DIGITS = /^\\d+$/;\nconst IPV4_LITERAL = /^\\d{1,3}(?:\\.\\d{1,3}){3}$/;\nconst IPV4_PART = /^\\d{1,3}$/;\nconst IPV6_PART = /^[0-9a-f]{1,4}$/i;\nconst TRAILING_DOT = /\\.+$/;\nconst DEFAULT_FETCH_LIMITS = {\n\theaderTimeoutMs: 1e4,\n\ttotalTimeoutMs: 3e4,\n\tmaxBytes: 25 * 1024 * 1024,\n\tmaxRedirects: 3\n};\nasync function fetchVerifiedResource(value, options) {\n\tconst limits = {\n\t\theaderTimeoutMs: options.headerTimeoutMs ?? DEFAULT_FETCH_LIMITS.headerTimeoutMs,\n\t\ttotalTimeoutMs: options.totalTimeoutMs ?? DEFAULT_FETCH_LIMITS.totalTimeoutMs,\n\t\tmaxBytes: options.maxBytes ?? DEFAULT_FETCH_LIMITS.maxBytes,\n\t\tmaxRedirects: options.maxRedirects ?? DEFAULT_FETCH_LIMITS.maxRedirects\n\t};\n\tif (!areValidLimits(limits)) return verificationError(\"INVALID_URL\", \"Fetch limits must be positive integers.\");\n\tconst startedAt = Date.now();\n\tlet currentUrl = parseAndValidateUrl(value, void 0, options.allowHttpLocalhost === true);\n\tif (!currentUrl.success) return currentUrl;\n\tfor (let redirects = 0;; redirects += 1) {\n\t\tconst remaining = limits.totalTimeoutMs - (Date.now() - startedAt);\n\t\tif (remaining <= 0) return verificationError(\"RESOURCE_TIMEOUT\", \"The resource fetch exceeded its total timeout.\");\n\t\tconst host = isAllowedLoopback(currentUrl.value, options.allowHttpLocalhost === true) ? {\n\t\t\tsuccess: true,\n\t\t\tvalue: true\n\t\t} : await validateHost(currentUrl.value, options.resolveHostname, remaining);\n\t\tif (!host.success) return host;\n\t\tconst remainingAfterResolution = limits.totalTimeoutMs - (Date.now() - startedAt);\n\t\tif (remainingAfterResolution <= 0) return verificationError(\"RESOURCE_TIMEOUT\", \"The resource fetch exceeded its total timeout.\");\n\t\tconst response = await fetchResponse(options.fetch, currentUrl.value, Math.min(remainingAfterResolution, limits.headerTimeoutMs));\n\t\tif (!response.success) return response;\n\t\tif (isRedirect(response.value.status)) {\n\t\t\tif (redirects >= limits.maxRedirects) return verificationError(\"REDIRECT_LIMIT_EXCEEDED\", \"The resource exceeded the redirect limit.\");\n\t\t\tconst location = response.value.headers.get(\"location\");\n\t\t\tif (location === null) return verificationError(\"REDIRECT_LOCATION_MISSING\", \"The redirect response has no location header.\");\n\t\t\tcurrentUrl = parseAndValidateUrl(location, currentUrl.value, options.allowHttpLocalhost === true);\n\t\t\tif (!currentUrl.success) return currentUrl;\n\t\t\tcontinue;\n\t\t}\n\t\tif (!response.value.ok && !options.allowedStatuses?.includes(response.value.status)) return verificationError(\"RESOURCE_STATUS_ERROR\", `The resource returned HTTP ${response.value.status}.`);\n\t\tconst contentLength = response.value.headers.get(\"content-length\");\n\t\tif (contentLength !== null && (!DIGITS.test(contentLength) || Number(contentLength) > limits.maxBytes)) return verificationError(\"RESOURCE_SIZE_EXCEEDED\", \"The resource exceeds the byte limit.\");\n\t\tconst bytes = await readResponse(response.value, limits.maxBytes, startedAt, limits.totalTimeoutMs);\n\t\tif (!bytes.success) return bytes;\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: {\n\t\t\t\tbytes: bytes.value,\n\t\t\t\turl: currentUrl.value,\n\t\t\t\tstatus: response.value.status,\n\t\t\t\theaders: response.value.headers\n\t\t\t}\n\t\t};\n\t}\n}\nfunction parseAndValidateUrl(value, base, allowHttpLocalhost = false) {\n\tlet url;\n\ttry {\n\t\turl = new URL(value, base);\n\t} catch {\n\t\treturn verificationError(\"INVALID_URL\", \"The resource URL is invalid.\");\n\t}\n\tif (url.protocol !== \"https:\" && !isAllowedLoopback(url, allowHttpLocalhost) || url.username !== \"\" || url.password !== \"\") return verificationError(\"INVALID_URL\", \"Resource URLs must use HTTPS and cannot include credentials.\");\n\tif (!isAllowedLoopback(url, allowHttpLocalhost) && (isIpLiteral(url.hostname) || isLocalHostname(url.hostname))) return verificationError(\"HOST_REJECTED\", \"The resource host is not permitted.\");\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: url\n\t};\n}\nfunction isAllowedLoopback(url, enabled) {\n\tif (!enabled || url.protocol !== \"http:\" && url.protocol !== \"https:\") return false;\n\tconst hostname = url.hostname.toLowerCase().replace(TRAILING_DOT, \"\");\n\treturn hostname === \"localhost\" || hostname.endsWith(\".localhost\") || hostname === \"127.0.0.1\" || hostname === \"[::1]\" || hostname === \"::1\";\n}\nasync function validateHost(url, resolver, timeoutMs) {\n\ttry {\n\t\tconst addresses = await withTimeout(Promise.resolve().then(() => resolver(url.hostname)), timeoutMs);\n\t\tif (addresses.length === 0 || addresses.some(isForbiddenAddress)) return verificationError(\"HOST_REJECTED\", \"The resource host resolved to a forbidden address.\");\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: true\n\t\t};\n\t} catch (error) {\n\t\tif (isAbortError(error)) return verificationError(\"RESOURCE_TIMEOUT\", \"The resource fetch exceeded its total timeout.\");\n\t\treturn verificationError(\"HOST_REJECTED\", \"The resource host could not be validated.\");\n\t}\n}\nasync function fetchResponse(fetchImplementation, url, timeoutMs) {\n\tconst controller = new AbortController();\n\ttry {\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: await withTimeout(Promise.resolve().then(() => fetchImplementation(url, {\n\t\t\t\tmethod: \"GET\",\n\t\t\t\tredirect: \"manual\",\n\t\t\t\tsignal: controller.signal\n\t\t\t})), timeoutMs, () => controller.abort())\n\t\t};\n\t} catch (error) {\n\t\tif (controller.signal.aborted || isAbortError(error)) return verificationError(\"RESOURCE_TIMEOUT\", \"The resource response headers timed out.\");\n\t\treturn verificationError(\"FETCH_FAILED\", \"The resource request failed.\");\n\t}\n}\nasync function readResponse(response, maximumBytes, startedAt, totalTimeoutMs) {\n\tif (response.body === null) return {\n\t\tsuccess: true,\n\t\tvalue: new Uint8Array()\n\t};\n\tconst reader = response.body.getReader();\n\tconst chunks = [];\n\tlet length = 0;\n\ttry {\n\t\tfor (;;) {\n\t\t\tconst remaining = totalTimeoutMs - (Date.now() - startedAt);\n\t\t\tif (remaining <= 0) {\n\t\t\t\tawait reader.cancel();\n\t\t\t\treturn verificationError(\"RESOURCE_TIMEOUT\", \"The resource fetch exceeded its total timeout.\");\n\t\t\t}\n\t\t\tconst chunk = await readWithTimeout(reader, remaining);\n\t\t\tif (!chunk.success) {\n\t\t\t\tawait reader.cancel();\n\t\t\t\treturn chunk;\n\t\t\t}\n\t\t\tif (chunk.value.done) break;\n\t\t\tconst value = chunk.value.value;\n\t\t\tlength += value.length;\n\t\t\tif (length > maximumBytes) {\n\t\t\t\tawait reader.cancel();\n\t\t\t\treturn verificationError(\"RESOURCE_SIZE_EXCEEDED\", \"The resource exceeds the byte limit.\");\n\t\t\t}\n\t\t\tchunks.push(value);\n\t\t}\n\t} catch {\n\t\treturn verificationError(\"FETCH_FAILED\", \"The resource response could not be read.\");\n\t} finally {\n\t\treader.releaseLock();\n\t}\n\tconst output = new Uint8Array(length);\n\tlet offset = 0;\n\tfor (const chunk of chunks) {\n\t\toutput.set(chunk, offset);\n\t\toffset += chunk.length;\n\t}\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: output\n\t};\n}\nasync function readWithTimeout(reader, timeoutMs) {\n\ttry {\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: await withTimeout(Promise.resolve().then(() => reader.read()), timeoutMs)\n\t\t};\n\t} catch (error) {\n\t\tif (isAbortError(error)) return verificationError(\"RESOURCE_TIMEOUT\", \"The resource fetch exceeded its total timeout.\");\n\t\treturn verificationError(\"FETCH_FAILED\", \"The resource response could not be read.\");\n\t}\n}\n/**\n* Every operation has both fulfillment and rejection handlers, so an operation\n* that loses the timeout race cannot later become an unhandled rejection.\n*/\nfunction withTimeout(operation, timeoutMs, onTimeout) {\n\treturn new Promise((resolve, reject) => {\n\t\tlet settled = false;\n\t\tconst timeout = setTimeout(() => {\n\t\t\tif (settled) return;\n\t\t\tsettled = true;\n\t\t\tonTimeout?.();\n\t\t\treject(new DOMException(\"Timed out\", \"AbortError\"));\n\t\t}, timeoutMs);\n\t\toperation.then((value) => {\n\t\t\tif (settled) return void 0;\n\t\t\tsettled = true;\n\t\t\tclearTimeout(timeout);\n\t\t\tresolve(value);\n\t\t}, (error) => {\n\t\t\tif (settled) return void 0;\n\t\t\tsettled = true;\n\t\t\tclearTimeout(timeout);\n\t\t\treject(error);\n\t\t});\n\t});\n}\nfunction areValidLimits(limits) {\n\treturn Object.values(limits).every((value) => Number.isSafeInteger(value) && value > 0);\n}\nfunction isRedirect(status) {\n\treturn status === 301 || status === 302 || status === 303 || status === 307 || status === 308;\n}\nfunction isAbortError(error) {\n\treturn error instanceof DOMException && error.name === \"AbortError\";\n}\nfunction isIpLiteral(hostname) {\n\treturn IPV4_LITERAL.test(hostname) || hostname.includes(\":\");\n}\nfunction isLocalHostname(hostname) {\n\tconst normalized = hostname.toLowerCase();\n\treturn normalized === \"localhost\" || normalized.endsWith(\".localhost\") || normalized.endsWith(\".local\") || normalized.endsWith(\".internal\");\n}\nfunction isForbiddenAddress(address) {\n\tconst ipv4 = parseIpv4(address);\n\tif (ipv4 !== null) {\n\t\tconst [a, b] = ipv4;\n\t\treturn a === 0 || a === 10 || a === 127 || a === 100 && b >= 64 && b <= 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && (b === 0 || b === 168) || a === 198 && (b === 18 || b === 19) || a >= 224;\n\t}\n\tconst ipv6 = parseIpv6(address);\n\tif (ipv6 === null) return true;\n\tconst first = ipv6[0];\n\tconst isUnspecified = ipv6.every((part) => part === 0);\n\tconst isLoopback = ipv6.slice(0, 7).every((part) => part === 0) && ipv6[7] === 1;\n\tconst isPrivate = (first & 65024) === 64512;\n\tconst isLinkLocal = (first & 65472) === 65152;\n\tconst isMulticast = (first & 65280) === 65280;\n\tif (ipv6.slice(0, 5).every((part) => part === 0) && ipv6[5] === 65535) return isForbiddenAddress(`${ipv6[6] >>> 8}.${ipv6[6] & 255}.${ipv6[7] >>> 8}.${ipv6[7] & 255}`);\n\treturn isUnspecified || isLoopback || isPrivate || isLinkLocal || isMulticast;\n}\nfunction parseIpv4(value) {\n\tconst parts = value.split(\".\");\n\tif (parts.length !== 4) return null;\n\tconst numbers = parts.map((part) => IPV4_PART.test(part) ? Number(part) : NaN);\n\tif (numbers.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) return null;\n\treturn [\n\t\tnumbers[0],\n\t\tnumbers[1],\n\t\tnumbers[2],\n\t\tnumbers[3]\n\t];\n}\nfunction parseIpv6(value) {\n\tif (value.includes(\":::\") || value.split(\"::\").length > 2) return null;\n\tconst [before = \"\", after = \"\"] = value.split(\"::\");\n\tconst head = before === \"\" ? [] : before.split(\":\");\n\tconst tail = after === \"\" ? [] : after.split(\":\");\n\tconst parts = [...head, ...tail];\n\tif (parts.some((part) => !IPV6_PART.test(part)) || parts.length > 8) return null;\n\tif (!value.includes(\"::\") && parts.length !== 8) return null;\n\tconst zeroes = value.includes(\"::\") ? 8 - parts.length : 0;\n\treturn [\n\t\t...head,\n\t\t...Array.from({ length: zeroes }).fill(\"0\"),\n\t\t...tail\n\t].map((part) => Number.parseInt(part, 16));\n}\n\n//#endregion\nexport { fetchVerifiedResource as n, DEFAULT_FETCH_LIMITS as t };\n//# sourceMappingURL=fetch-B66dZAfm.js.map","import { n as unsupportedAuthDetails, t as UNSUPPORTED_AUTH_MESSAGE } from \"./auth-B730dpJ4.js\";\nimport { n as verificationError } from \"./errors-D3_zxvwe.js\";\nimport { multihashFromBlobCid, verifyMultihash } from \"./checksum.js\";\nimport { n as fetchVerifiedResource, t as DEFAULT_FETCH_LIMITS } from \"./fetch-B66dZAfm.js\";\nimport { RECORD_SCOPED_BLOB_CACHE_TYPE } from \"@emdash-cms/registry-lexicons\";\n\n//#region src/artifact.ts\nconst DID_DOCUMENT_MAX_BYTES = 256 * 1024;\nconst PLC_DID_PATTERN = /^did:plc:[a-z2-7]{24}$/;\nconst CID_PATTERN = /^b[a-z2-7]+$/;\nconst UNSAFE_PATH_SEGMENT = /[/\\\\?#]/;\nasync function fetchReleaseArtifact(input, options) {\n\tconst deadline = Date.now() + (options.totalTimeoutMs ?? DEFAULT_FETCH_LIMITS.totalTimeoutMs);\n\tconst { artifact } = input;\n\tif (!artifact.blob && !artifact.url) return verificationError(\"RELEASE_ARTIFACT_SOURCE_MISSING\", \"The release artifact must provide a blob or URL.\");\n\tif (artifact.requiresAuth === true || input.auth !== void 0) return unsupportedAuth(input.auth);\n\tconst blobCid = modernBlobCid(artifact.blob);\n\tconst blobMetadata = blobCid && artifact.blob && \"ref\" in artifact.blob ? artifact.blob : void 0;\n\tif (artifact.blob && !blobCid) return verificationError(\"BLOB_REF_INVALID\", \"Legacy blob references are not supported.\");\n\tif (blobCid) {\n\t\tconst expected = multihashFromBlobCid(blobCid);\n\t\tif (!expected.success) return expected;\n\t\tif (expected.value !== artifact.checksum) return verificationError(\"CHECKSUM_MISMATCH\", \"The artifact checksum does not match its blob reference CID.\");\n\t}\n\tlet lastError;\n\tfor (const cache of input.artifactCaches ?? []) {\n\t\tconst serviceEndpoint = recordScopedCacheEndpoint(cache);\n\t\tif (!serviceEndpoint || !blobCid) continue;\n\t\tconst cacheUrl = recordScopedBlobCacheUrl(serviceEndpoint, input.record, blobCid);\n\t\tif (!cacheUrl.success) {\n\t\t\tlastError = cacheUrl.error;\n\t\t\tcontinue;\n\t\t}\n\t\tconst attemptOptions = withinDeadline(options, deadline);\n\t\tif (!attemptOptions) return timedOut();\n\t\tconst result = await fetchAndVerify(\"artifact-cache\", cacheUrl.value, artifact.checksum, withBlobSizeLimit(attemptOptions, blobMetadata), blobMetadata);\n\t\tif (result.success) return result;\n\t\tlastError = result.error;\n\t}\n\tif (blobCid) {\n\t\tconst resolutionOptions = withinDeadline(options, deadline);\n\t\tif (!resolutionOptions) return timedOut();\n\t\tconst pds = input.pdsEndpoint ? {\n\t\t\tsuccess: true,\n\t\t\tvalue: input.pdsEndpoint\n\t\t} : await resolvePublisherPdsEndpoint(input.record.did, resolutionOptions);\n\t\tif (pds.success) {\n\t\t\tconst url = blobUrl(pds.value, input.record.did, blobCid);\n\t\t\tif (url.success) {\n\t\t\t\tconst attemptOptions = withinDeadline(options, deadline);\n\t\t\t\tif (!attemptOptions) return timedOut();\n\t\t\t\tconst result = await fetchAndVerify(\"blob\", url.value, artifact.checksum, withBlobSizeLimit(attemptOptions, blobMetadata), blobMetadata);\n\t\t\t\tif (result.success) return result;\n\t\t\t\tlastError = result.error;\n\t\t\t} else lastError = url.error;\n\t\t} else lastError = pds.error;\n\t}\n\tif (artifact.url) {\n\t\tconst attemptOptions = withinDeadline(options, deadline);\n\t\tif (!attemptOptions) return timedOut();\n\t\tconst result = await fetchAndVerify(\"url\", artifact.url, artifact.checksum, withBlobSizeLimit(attemptOptions, blobMetadata), blobMetadata);\n\t\tif (result.success) return result;\n\t\tlastError = result.error;\n\t}\n\treturn lastError ? {\n\t\tsuccess: false,\n\t\terror: lastError\n\t} : verificationError(\"FETCH_FAILED\", \"The release artifact could not be fetched.\");\n}\nfunction recordScopedBlobCacheUrl(serviceEndpoint, record, blobCid) {\n\ttry {\n\t\tconst endpoint = new URL(serviceEndpoint);\n\t\tif (endpoint.protocol !== \"https:\" || endpoint.username || endpoint.password || endpoint.pathname !== \"/\" || endpoint.search || endpoint.hash) throw new Error();\n\t\tconst segments = [\n\t\t\t\"r\",\n\t\t\trecord.did,\n\t\t\trecord.collection,\n\t\t\trecord.rkey,\n\t\t\trecord.cid,\n\t\t\tblobCid\n\t\t];\n\t\tif (!CID_PATTERN.test(record.cid) || !CID_PATTERN.test(blobCid) || segments.some((segment) => !isSafePathSegment(segment))) throw new Error();\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: new URL(segments.join(\"/\"), endpoint)\n\t\t};\n\t} catch {\n\t\treturn verificationError(\"INVALID_URL\", \"The record-scoped blob cache endpoint is invalid.\");\n\t}\n}\nfunction recordScopedImageCacheUrl(serviceEndpoint, preset, record, blobCid) {\n\tconst raw = recordScopedBlobCacheUrl(serviceEndpoint, record, blobCid);\n\tif (!raw.success) return raw;\n\tconst url = new URL(raw.value);\n\turl.pathname = `/img/${preset}${url.pathname}`;\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: url\n\t};\n}\nasync function resolvePublisherPdsEndpoint(publisherDid, options) {\n\tconst documentUrl = didDocumentUrl(publisherDid);\n\tif (!documentUrl) return verificationError(\"PDS_RESOLUTION_FAILED\", \"The publisher DID is not supported.\");\n\tconst fetched = await fetchVerifiedResource(documentUrl, {\n\t\t...options,\n\t\tmaxBytes: DID_DOCUMENT_MAX_BYTES\n\t});\n\tif (!fetched.success) return verificationError(\"PDS_RESOLUTION_FAILED\", \"The publisher DID document could not be fetched.\");\n\tlet document;\n\ttry {\n\t\tdocument = JSON.parse(new TextDecoder().decode(fetched.value.bytes));\n\t} catch {\n\t\treturn verificationError(\"PDS_RESOLUTION_FAILED\", \"The publisher DID document is malformed.\");\n\t}\n\tif (!isRecord(document) || document.id !== publisherDid || !Array.isArray(document.service)) return verificationError(\"PDS_RESOLUTION_FAILED\", \"The publisher DID document has no valid PDS service.\");\n\tconst service = document.service.find((value) => isRecord(value) && (value.id === `${publisherDid}#atproto_pds` || value.id === \"#atproto_pds\") && value.type === \"AtprotoPersonalDataServer\" && typeof value.serviceEndpoint === \"string\");\n\tif (!isRecord(service) || typeof service.serviceEndpoint !== \"string\") return verificationError(\"PDS_RESOLUTION_FAILED\", \"The publisher DID document has no valid PDS service.\");\n\ttry {\n\t\tconst endpoint = new URL(service.serviceEndpoint);\n\t\tif (!(options.allowHttpLocalhost === true && endpoint.protocol === \"http:\" && (endpoint.hostname === \"localhost\" || endpoint.hostname === \"127.0.0.1\")) && endpoint.protocol !== \"https:\" || endpoint.username || endpoint.password) throw new Error();\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: endpoint.href\n\t\t};\n\t} catch {\n\t\treturn verificationError(\"PDS_RESOLUTION_FAILED\", \"The publisher DID document has no valid PDS service.\");\n\t}\n}\nasync function fetchAndVerify(source, url, checksum, options, blobMetadata) {\n\tconst fetched = await fetchVerifiedResource(url, options);\n\tif (!fetched.success) return blobMetadata && fetched.error.code === \"RESOURCE_SIZE_EXCEEDED\" ? verificationError(\"BLOB_METADATA_MISMATCH\", \"The fetched artifact size does not match its signed blob metadata.\") : fetched;\n\tconst verified = await verifyMultihash(fetched.value.bytes, checksum);\n\tif (!verified.success) return verified;\n\tconst contentType = fetched.value.headers.get(\"content-type\")?.split(\";\", 1)[0]?.trim();\n\tif (blobMetadata && (fetched.value.bytes.byteLength !== blobMetadata.size || contentType !== void 0 && contentType !== blobMetadata.mimeType)) return verificationError(\"BLOB_METADATA_MISMATCH\", \"The fetched artifact does not match its signed blob metadata.\");\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: {\n\t\t\tbytes: fetched.value.bytes,\n\t\t\tsource,\n\t\t\turl: fetched.value.url\n\t\t}\n\t};\n}\nfunction withBlobSizeLimit(options, blobMetadata) {\n\tif (!blobMetadata) return options;\n\treturn {\n\t\t...options,\n\t\tmaxBytes: Math.min(options.maxBytes ?? DEFAULT_FETCH_LIMITS.maxBytes, blobMetadata.size)\n\t};\n}\nfunction blobUrl(pdsEndpoint, publisherDid, cid) {\n\ttry {\n\t\tconst url = new URL(\"/xrpc/com.atproto.sync.getBlob\", pdsEndpoint);\n\t\turl.searchParams.set(\"did\", publisherDid);\n\t\turl.searchParams.set(\"cid\", cid);\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: url\n\t\t};\n\t} catch {\n\t\treturn verificationError(\"PDS_RESOLUTION_FAILED\", \"The publisher PDS endpoint is invalid.\");\n\t}\n}\nfunction didDocumentUrl(did) {\n\tif (PLC_DID_PATTERN.test(did)) return `https://plc.directory/${encodeURIComponent(did)}`;\n\tif (!did.startsWith(\"did:web:\")) return null;\n\ttry {\n\t\tconst parts = did.slice(8).split(\":\").map(decodeURIComponent);\n\t\tconst host = parts.shift();\n\t\tif (!host || parts.some((part) => part === \"\" || part === \".\" || part === \"..\")) return null;\n\t\tconst path = parts.length === 0 ? \"/.well-known/did.json\" : `/${parts.join(\"/\")}/did.json`;\n\t\treturn new URL(path, `https://${host}`).href;\n\t} catch {\n\t\treturn null;\n\t}\n}\nfunction unsupportedAuth(auth) {\n\treturn verificationError(\"AUTH_METHOD_UNSUPPORTED\", UNSUPPORTED_AUTH_MESSAGE, unsupportedAuthDetails(auth));\n}\nfunction withinDeadline(options, deadline) {\n\tconst remaining = deadline - Date.now();\n\tif (remaining <= 0) return null;\n\treturn {\n\t\t...options,\n\t\ttotalTimeoutMs: remaining\n\t};\n}\nfunction timedOut() {\n\treturn verificationError(\"RESOURCE_TIMEOUT\", \"Artifact retrieval exceeded its total timeout.\");\n}\nfunction isRecord(value) {\n\treturn value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\nfunction modernBlobCid(blob) {\n\tif (!blob || !(\"ref\" in blob) || typeof blob.ref?.$link !== \"string\") return null;\n\treturn blob.ref.$link;\n}\nfunction recordScopedCacheEndpoint(value) {\n\tif (!isRecord(value) || value.$type !== RECORD_SCOPED_BLOB_CACHE_TYPE) return null;\n\treturn typeof value.serviceEndpoint === \"string\" ? value.serviceEndpoint : null;\n}\nfunction isSafePathSegment(value) {\n\tif (value.length === 0 || UNSAFE_PATH_SEGMENT.test(value)) return false;\n\tfor (const character of value) {\n\t\tconst codePoint = character.codePointAt(0);\n\t\tif (codePoint !== void 0 && (codePoint <= 31 || codePoint === 127)) return false;\n\t}\n\treturn true;\n}\n\n//#endregion\nexport { fetchReleaseArtifact, recordScopedBlobCacheUrl, recordScopedImageCacheUrl, resolvePublisherPdsEndpoint };\n//# sourceMappingURL=artifact.js.map","import type { ClientRequest, IncomingMessage } from \"node:http\";\nimport type { RequestOptions } from \"node:https\";\n\nimport { resolveAndValidateExternalUrlTarget, SsrfError } from \"../security/ssrf.js\";\n\nconst TRAILING_DOT = /\\.+$/;\nconst LOCALHOST_HOSTNAMES = new Set([\n\t\"localhost\",\n\t\"localhost.localdomain\",\n\t\"ip6-localhost\",\n\t\"ip6-loopback\",\n]);\n\nexport interface RegistryArtifactTransportInput {\n\turl: URL;\n\tallowedAddresses: readonly string[];\n\tsignal: AbortSignal;\n\tmaxResponseBytes: number;\n}\n\nexport interface RegistryArtifactTransport {\n\tfetch(input: RegistryArtifactTransportInput): Promise<{\n\t\tresponse: Response;\n\t\t/** Workers Fetch does not expose its connected peer; DNS validation still runs before dispatch. */\n\t\tconnectedAddress: string | null;\n\t}>;\n}\n\nexport interface RegistryArtifactFetchOptions {\n\tsignal: AbortSignal;\n\tmaxResponseBytes: number;\n}\n\nlet defaultTransport: RegistryArtifactTransport | null = null;\n\nexport function setDefaultRegistryArtifactTransport(\n\ttransport: RegistryArtifactTransport | null,\n): RegistryArtifactTransport | null {\n\tconst previous = defaultTransport;\n\tdefaultTransport = transport;\n\treturn previous;\n}\n\nfunction isLocalhostHostname(hostname: string): boolean {\n\tconst normalized = hostname.toLowerCase().replace(TRAILING_DOT, \"\");\n\treturn (\n\t\tLOCALHOST_HOSTNAMES.has(normalized) ||\n\t\tnormalized.endsWith(\".localhost\") ||\n\t\tnormalized === \"127.0.0.1\" ||\n\t\tnormalized === \"::1\" ||\n\t\tnormalized === \"[::1]\" ||\n\t\tnormalized.startsWith(\"::ffff:127.\") ||\n\t\tnormalized.startsWith(\"::ffff:7f00:\")\n\t);\n}\n\nasync function resolveSafeArtifactTarget(urlString: string): Promise<{\n\turl: URL;\n\taddresses: readonly string[];\n}> {\n\tlet url: URL;\n\ttry {\n\t\turl = new URL(urlString);\n\t} catch {\n\t\tthrow new Error(`Invalid artifact URL: ${urlString}`);\n\t}\n\tif (url.protocol !== \"https:\" && url.protocol !== \"http:\") {\n\t\tthrow new Error(`Artifact URL protocol not allowed: ${url.protocol}`);\n\t}\n\tif (url.username || url.password) {\n\t\tthrow new Error(\"Artifact URL must not contain embedded credentials\");\n\t}\n\n\tconst rawHostname = url.hostname.toLowerCase().replace(TRAILING_DOT, \"\");\n\tconst hostname = stripIpv6Brackets(rawHostname);\n\tconst localhost = isLocalhostHostname(hostname);\n\n\tif (!import.meta.env.DEV) {\n\t\tif (url.protocol === \"http:\") {\n\t\t\tthrow new Error(\"Artifact URL must use https\");\n\t\t}\n\t\tif (localhost) {\n\t\t\tthrow new Error(`Artifact URL points to localhost: ${hostname}`);\n\t\t}\n\t} else if (url.protocol === \"http:\" && !localhost) {\n\t\tthrow new Error(\"Artifact URL must use https (http allowed only for localhost in dev)\");\n\t}\n\n\tif (localhost) {\n\t\treturn { url, addresses: [] };\n\t}\n\n\ttry {\n\t\treturn await resolveAndValidateExternalUrlTarget(url.href);\n\t} catch (error) {\n\t\tif (error instanceof SsrfError) {\n\t\t\tthrow new Error(`Artifact URL rejected: ${error.message}`, { cause: error });\n\t\t}\n\t\tthrow error;\n\t}\n}\n\nexport async function assertSafeArtifactUrl(urlString: string): Promise<URL> {\n\treturn (await resolveSafeArtifactTarget(urlString)).url;\n}\n\nexport async function fetchRegistryArtifactUrl(\n\turlString: string,\n\toptions: RegistryArtifactFetchOptions,\n): Promise<Response> {\n\tif (!Number.isSafeInteger(options.maxResponseBytes) || options.maxResponseBytes < 0) {\n\t\tthrow new TypeError(\"Registry artifact response limit is invalid\");\n\t}\n\tconst target = await resolveSafeArtifactTarget(urlString);\n\tif (target.addresses.length === 0) {\n\t\treturn globalThis.fetch(target.url, { redirect: \"manual\", signal: options.signal });\n\t}\n\n\tconst transport = defaultTransport ?? (await createRuntimeRegistryArtifactTransport());\n\tconst result = await transport.fetch({\n\t\turl: target.url,\n\t\tallowedAddresses: target.addresses,\n\t\tsignal: options.signal,\n\t\tmaxResponseBytes: options.maxResponseBytes,\n\t});\n\tif (result.connectedAddress !== null && !target.addresses.includes(result.connectedAddress)) {\n\t\tawait result.response.body?.cancel().catch(() => undefined);\n\t\tthrow new Error(\"Registry artifact transport connected outside the validated address set\");\n\t}\n\treturn result.response;\n}\n\nasync function createRuntimeRegistryArtifactTransport(): Promise<RegistryArtifactTransport> {\n\treturn isCloudflareWorkersRuntime()\n\t\t? createWorkersRegistryArtifactTransport()\n\t\t: createNodeRegistryArtifactTransport();\n}\n\nexport function createWorkersRegistryArtifactTransport(\n\tworkerFetch: typeof globalThis.fetch = globalThis.fetch,\n): RegistryArtifactTransport {\n\treturn {\n\t\tasync fetch(input) {\n\t\t\tconst response = await workerFetch(input.url, {\n\t\t\t\tredirect: \"manual\",\n\t\t\t\tsignal: input.signal,\n\t\t\t\theaders: { \"Accept-Encoding\": \"identity\" },\n\t\t\t});\n\t\t\treturn {\n\t\t\t\tresponse: limitResponseBody(response, input.maxResponseBytes),\n\t\t\t\tconnectedAddress: null,\n\t\t\t};\n\t\t},\n\t};\n}\n\nfunction isCloudflareWorkersRuntime(): boolean {\n\treturn (\n\t\ttypeof navigator !== \"undefined\" &&\n\t\ttypeof navigator.userAgent === \"string\" &&\n\t\tnavigator.userAgent.includes(\"Cloudflare-Workers\")\n\t);\n}\n\nfunction limitResponseBody(response: Response, maxBytes: number): Response {\n\tif (!response.body) return response;\n\tlet received = 0;\n\tconst body = response.body.pipeThrough(\n\t\tnew TransformStream<Uint8Array, Uint8Array>({\n\t\t\ttransform(chunk, controller) {\n\t\t\t\treceived += chunk.byteLength;\n\t\t\t\tif (received > maxBytes) {\n\t\t\t\t\tcontroller.error(new RangeError(\"Registry artifact response exceeds its byte limit\"));\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tcontroller.enqueue(chunk);\n\t\t\t},\n\t\t}),\n\t);\n\treturn new Response(body, {\n\t\tstatus: response.status,\n\t\tstatusText: response.statusText,\n\t\theaders: response.headers,\n\t});\n}\n\nexport type RegistryArtifactNodeRequest = (\n\toptions: RequestOptions,\n\tcallback: (response: IncomingMessage) => void,\n) => ClientRequest;\n\nexport async function createNodeRegistryArtifactTransport(\n\tnodeRequest?: RegistryArtifactNodeRequest,\n): Promise<RegistryArtifactTransport> {\n\tconst request = nodeRequest ?? (await import(\"node:https\")).request;\n\treturn {\n\t\tasync fetch(input) {\n\t\t\tlet lastError: unknown;\n\t\t\tfor (const address of input.allowedAddresses) {\n\t\t\t\ttry {\n\t\t\t\t\tconst response = await new Promise<Response>((resolve, reject) => {\n\t\t\t\t\t\tconst chunks: Uint8Array[] = [];\n\t\t\t\t\t\tlet total = 0;\n\t\t\t\t\t\tconst req = request(\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\tprotocol: \"https:\",\n\t\t\t\t\t\t\t\thostname: stripIpv6Brackets(input.url.hostname),\n\t\t\t\t\t\t\t\tport: parseHttpsPort(input.url),\n\t\t\t\t\t\t\t\tpath: `${input.url.pathname}${input.url.search}`,\n\t\t\t\t\t\t\t\tmethod: \"GET\",\n\t\t\t\t\t\t\t\t// A pooled socket may have been opened for the same hostname\n\t\t\t\t\t\t\t\t// before this address set was resolved.\n\t\t\t\t\t\t\t\tagent: false,\n\t\t\t\t\t\t\t\theaders: {\n\t\t\t\t\t\t\t\t\tHost: input.url.host,\n\t\t\t\t\t\t\t\t\tConnection: \"close\",\n\t\t\t\t\t\t\t\t\t\"Accept-Encoding\": \"identity\",\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\tlookup: (_hostname, options, callback) => {\n\t\t\t\t\t\t\t\t\tconst family = address.includes(\":\") ? 6 : 4;\n\t\t\t\t\t\t\t\t\t// Node's default autoSelectFamily asks with `all: true` and expects a list.\n\t\t\t\t\t\t\t\t\tif (options.all) callback(null, [{ address, family }]);\n\t\t\t\t\t\t\t\t\telse callback(null, address, family);\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\tsignal: input.signal,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t(upstream) => {\n\t\t\t\t\t\t\t\tconst contentEncoding = upstream.headers[\"content-encoding\"];\n\t\t\t\t\t\t\t\tif (contentEncoding && contentEncoding.toLowerCase() !== \"identity\") {\n\t\t\t\t\t\t\t\t\tupstream.destroy(\n\t\t\t\t\t\t\t\t\t\tnew Error(\"Registry artifact response content encoding is unsupported\"),\n\t\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\tupstream.on(\"data\", (chunk: Uint8Array) => {\n\t\t\t\t\t\t\t\t\ttotal += chunk.byteLength;\n\t\t\t\t\t\t\t\t\tif (total > input.maxResponseBytes) {\n\t\t\t\t\t\t\t\t\t\tupstream.destroy(\n\t\t\t\t\t\t\t\t\t\t\tnew RangeError(\"Registry artifact response exceeds its byte limit\"),\n\t\t\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\tchunks.push(new Uint8Array(chunk));\n\t\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\t\tupstream.once(\"error\", reject);\n\t\t\t\t\t\t\t\tupstream.once(\"end\", () => {\n\t\t\t\t\t\t\t\t\tconst bytes = concatBytes(chunks, total);\n\t\t\t\t\t\t\t\t\tconst headers = new Headers();\n\t\t\t\t\t\t\t\t\tfor (let index = 0; index < upstream.rawHeaders.length; index += 2) {\n\t\t\t\t\t\t\t\t\t\theaders.append(upstream.rawHeaders[index], upstream.rawHeaders[index + 1]);\n\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\tresolve(\n\t\t\t\t\t\t\t\t\t\tparsedResponseToWebResponse({\n\t\t\t\t\t\t\t\t\t\t\tstatus: upstream.statusCode ?? 502,\n\t\t\t\t\t\t\t\t\t\t\theaders,\n\t\t\t\t\t\t\t\t\t\t\tbody: bytes,\n\t\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t);\n\t\t\t\t\t\treq.once(\"error\", reject);\n\t\t\t\t\t\treq.end();\n\t\t\t\t\t});\n\t\t\t\t\treturn { response, connectedAddress: address };\n\t\t\t\t} catch (error) {\n\t\t\t\t\tif (input.signal.aborted) throw error;\n\t\t\t\t\tlastError = error;\n\t\t\t\t}\n\t\t\t}\n\t\t\tthrow new Error(\"Registry artifact transport could not connect to an approved address\", {\n\t\t\t\tcause: lastError,\n\t\t\t});\n\t\t},\n\t};\n}\n\ninterface ParsedHttpResponse {\n\tstatus: number;\n\theaders: Headers;\n\tbody: Uint8Array;\n}\n\nfunction parsedResponseToWebResponse(parsed: ParsedHttpResponse): Response {\n\tconst bodyAllowed = ![204, 205, 304].includes(parsed.status);\n\tlet body: ArrayBuffer | null = null;\n\tif (bodyAllowed) {\n\t\tbody = new ArrayBuffer(parsed.body.byteLength);\n\t\tnew Uint8Array(body).set(parsed.body);\n\t}\n\treturn new Response(body, {\n\t\tstatus: parsed.status,\n\t\theaders: parsed.headers,\n\t});\n}\n\nfunction concatBytes(chunks: readonly Uint8Array[], total: number): Uint8Array {\n\tconst bytes = new Uint8Array(total);\n\tlet offset = 0;\n\tfor (const chunk of chunks) {\n\t\tbytes.set(chunk, offset);\n\t\toffset += chunk.byteLength;\n\t}\n\treturn bytes;\n}\n\nfunction parseHttpsPort(url: URL): number {\n\tconst port = url.port === \"\" ? 443 : Number(url.port);\n\tif (!Number.isSafeInteger(port) || port < 1 || port > 65_535) {\n\t\tthrow new TypeError(\"Registry artifact HTTPS port is invalid\");\n\t}\n\treturn port;\n}\n\nfunction stripIpv6Brackets(hostname: string): string {\n\treturn hostname.startsWith(\"[\") && hostname.endsWith(\"]\") ? hostname.slice(1, -1) : hostname;\n}\n"],"mappings":";;;;;AAGA,MAAM,SAAS;AACf,MAAM,eAAe;AACrB,MAAM,YAAY;AAClB,MAAM,YAAY;AAClB,MAAMA,iBAAe;AACrB,MAAM,uBAAuB;CAC5B,iBAAiB;CACjB,gBAAgB;CAChB,UAAU,KAAK,OAAO;CACtB,cAAc;CACd;AACD,eAAe,sBAAsB,OAAO,SAAS;CACpD,MAAM,SAAS;EACd,iBAAiB,QAAQ,mBAAmB,qBAAqB;EACjE,gBAAgB,QAAQ,kBAAkB,qBAAqB;EAC/D,UAAU,QAAQ,YAAY,qBAAqB;EACnD,cAAc,QAAQ,gBAAgB,qBAAqB;EAC3D;AACD,KAAI,CAAC,eAAe,OAAO,CAAE,QAAO,kBAAkB,eAAe,0CAA0C;CAC/G,MAAM,YAAY,KAAK,KAAK;CAC5B,IAAI,aAAa,oBAAoB,OAAO,KAAK,GAAG,QAAQ,uBAAuB,KAAK;AACxF,KAAI,CAAC,WAAW,QAAS,QAAO;AAChC,MAAK,IAAI,YAAY,IAAI,aAAa,GAAG;EACxC,MAAM,YAAY,OAAO,kBAAkB,KAAK,KAAK,GAAG;AACxD,MAAI,aAAa,EAAG,QAAO,kBAAkB,oBAAoB,iDAAiD;EAClH,MAAM,OAAO,kBAAkB,WAAW,OAAO,QAAQ,uBAAuB,KAAK,GAAG;GACvF,SAAS;GACT,OAAO;GACP,GAAG,MAAM,aAAa,WAAW,OAAO,QAAQ,iBAAiB,UAAU;AAC5E,MAAI,CAAC,KAAK,QAAS,QAAO;EAC1B,MAAM,2BAA2B,OAAO,kBAAkB,KAAK,KAAK,GAAG;AACvE,MAAI,4BAA4B,EAAG,QAAO,kBAAkB,oBAAoB,iDAAiD;EACjI,MAAM,WAAW,MAAM,cAAc,QAAQ,OAAO,WAAW,OAAO,KAAK,IAAI,0BAA0B,OAAO,gBAAgB,CAAC;AACjI,MAAI,CAAC,SAAS,QAAS,QAAO;AAC9B,MAAI,WAAW,SAAS,MAAM,OAAO,EAAE;AACtC,OAAI,aAAa,OAAO,aAAc,QAAO,kBAAkB,2BAA2B,4CAA4C;GACtI,MAAM,WAAW,SAAS,MAAM,QAAQ,IAAI,WAAW;AACvD,OAAI,aAAa,KAAM,QAAO,kBAAkB,6BAA6B,gDAAgD;AAC7H,gBAAa,oBAAoB,UAAU,WAAW,OAAO,QAAQ,uBAAuB,KAAK;AACjG,OAAI,CAAC,WAAW,QAAS,QAAO;AAChC;;AAED,MAAI,CAAC,SAAS,MAAM,MAAM,CAAC,QAAQ,iBAAiB,SAAS,SAAS,MAAM,OAAO,CAAE,QAAO,kBAAkB,yBAAyB,8BAA8B,SAAS,MAAM,OAAO,GAAG;EAC9L,MAAM,gBAAgB,SAAS,MAAM,QAAQ,IAAI,iBAAiB;AAClE,MAAI,kBAAkB,SAAS,CAAC,OAAO,KAAK,cAAc,IAAI,OAAO,cAAc,GAAG,OAAO,UAAW,QAAO,kBAAkB,0BAA0B,uCAAuC;EAClM,MAAM,QAAQ,MAAM,aAAa,SAAS,OAAO,OAAO,UAAU,WAAW,OAAO,eAAe;AACnG,MAAI,CAAC,MAAM,QAAS,QAAO;AAC3B,SAAO;GACN,SAAS;GACT,OAAO;IACN,OAAO,MAAM;IACb,KAAK,WAAW;IAChB,QAAQ,SAAS,MAAM;IACvB,SAAS,SAAS,MAAM;IACxB;GACD;;;AAGH,SAAS,oBAAoB,OAAO,MAAM,qBAAqB,OAAO;CACrE,IAAI;AACJ,KAAI;AACH,QAAM,IAAI,IAAI,OAAO,KAAK;SACnB;AACP,SAAO,kBAAkB,eAAe,+BAA+B;;AAExE,KAAI,IAAI,aAAa,YAAY,CAAC,kBAAkB,KAAK,mBAAmB,IAAI,IAAI,aAAa,MAAM,IAAI,aAAa,GAAI,QAAO,kBAAkB,eAAe,+DAA+D;AACnO,KAAI,CAAC,kBAAkB,KAAK,mBAAmB,KAAK,YAAY,IAAI,SAAS,IAAI,gBAAgB,IAAI,SAAS,EAAG,QAAO,kBAAkB,iBAAiB,sCAAsC;AACjM,QAAO;EACN,SAAS;EACT,OAAO;EACP;;AAEF,SAAS,kBAAkB,KAAK,SAAS;AACxC,KAAI,CAAC,WAAW,IAAI,aAAa,WAAW,IAAI,aAAa,SAAU,QAAO;CAC9E,MAAM,WAAW,IAAI,SAAS,aAAa,CAAC,QAAQA,gBAAc,GAAG;AACrE,QAAO,aAAa,eAAe,SAAS,SAAS,aAAa,IAAI,aAAa,eAAe,aAAa,WAAW,aAAa;;AAExI,eAAe,aAAa,KAAK,UAAU,WAAW;AACrD,KAAI;EACH,MAAM,YAAY,MAAM,YAAY,QAAQ,SAAS,CAAC,WAAW,SAAS,IAAI,SAAS,CAAC,EAAE,UAAU;AACpG,MAAI,UAAU,WAAW,KAAK,UAAU,KAAK,mBAAmB,CAAE,QAAO,kBAAkB,iBAAiB,qDAAqD;AACjK,SAAO;GACN,SAAS;GACT,OAAO;GACP;UACO,OAAO;AACf,MAAI,aAAa,MAAM,CAAE,QAAO,kBAAkB,oBAAoB,iDAAiD;AACvH,SAAO,kBAAkB,iBAAiB,4CAA4C;;;AAGxF,eAAe,cAAc,qBAAqB,KAAK,WAAW;CACjE,MAAM,aAAa,IAAI,iBAAiB;AACxC,KAAI;AACH,SAAO;GACN,SAAS;GACT,OAAO,MAAM,YAAY,QAAQ,SAAS,CAAC,WAAW,oBAAoB,KAAK;IAC9E,QAAQ;IACR,UAAU;IACV,QAAQ,WAAW;IACnB,CAAC,CAAC,EAAE,iBAAiB,WAAW,OAAO,CAAC;GACzC;UACO,OAAO;AACf,MAAI,WAAW,OAAO,WAAW,aAAa,MAAM,CAAE,QAAO,kBAAkB,oBAAoB,2CAA2C;AAC9I,SAAO,kBAAkB,gBAAgB,+BAA+B;;;AAG1E,eAAe,aAAa,UAAU,cAAc,WAAW,gBAAgB;AAC9E,KAAI,SAAS,SAAS,KAAM,QAAO;EAClC,SAAS;EACT,OAAO,IAAI,YAAY;EACvB;CACD,MAAM,SAAS,SAAS,KAAK,WAAW;CACxC,MAAM,SAAS,EAAE;CACjB,IAAI,SAAS;AACb,KAAI;AACH,WAAS;GACR,MAAM,YAAY,kBAAkB,KAAK,KAAK,GAAG;AACjD,OAAI,aAAa,GAAG;AACnB,UAAM,OAAO,QAAQ;AACrB,WAAO,kBAAkB,oBAAoB,iDAAiD;;GAE/F,MAAM,QAAQ,MAAM,gBAAgB,QAAQ,UAAU;AACtD,OAAI,CAAC,MAAM,SAAS;AACnB,UAAM,OAAO,QAAQ;AACrB,WAAO;;AAER,OAAI,MAAM,MAAM,KAAM;GACtB,MAAM,QAAQ,MAAM,MAAM;AAC1B,aAAU,MAAM;AAChB,OAAI,SAAS,cAAc;AAC1B,UAAM,OAAO,QAAQ;AACrB,WAAO,kBAAkB,0BAA0B,uCAAuC;;AAE3F,UAAO,KAAK,MAAM;;SAEZ;AACP,SAAO,kBAAkB,gBAAgB,2CAA2C;WAC3E;AACT,SAAO,aAAa;;CAErB,MAAM,SAAS,IAAI,WAAW,OAAO;CACrC,IAAI,SAAS;AACb,MAAK,MAAM,SAAS,QAAQ;AAC3B,SAAO,IAAI,OAAO,OAAO;AACzB,YAAU,MAAM;;AAEjB,QAAO;EACN,SAAS;EACT,OAAO;EACP;;AAEF,eAAe,gBAAgB,QAAQ,WAAW;AACjD,KAAI;AACH,SAAO;GACN,SAAS;GACT,OAAO,MAAM,YAAY,QAAQ,SAAS,CAAC,WAAW,OAAO,MAAM,CAAC,EAAE,UAAU;GAChF;UACO,OAAO;AACf,MAAI,aAAa,MAAM,CAAE,QAAO,kBAAkB,oBAAoB,iDAAiD;AACvH,SAAO,kBAAkB,gBAAgB,2CAA2C;;;;;;;AAOtF,SAAS,YAAY,WAAW,WAAW,WAAW;AACrD,QAAO,IAAI,SAAS,SAAS,WAAW;EACvC,IAAI,UAAU;EACd,MAAM,UAAU,iBAAiB;AAChC,OAAI,QAAS;AACb,aAAU;AACV,gBAAa;AACb,UAAO,IAAI,aAAa,aAAa,aAAa,CAAC;KACjD,UAAU;AACb,YAAU,MAAM,UAAU;AACzB,OAAI,QAAS,QAAO,KAAK;AACzB,aAAU;AACV,gBAAa,QAAQ;AACrB,WAAQ,MAAM;MACX,UAAU;AACb,OAAI,QAAS,QAAO,KAAK;AACzB,aAAU;AACV,gBAAa,QAAQ;AACrB,UAAO,MAAM;IACZ;GACD;;AAEH,SAAS,eAAe,QAAQ;AAC/B,QAAO,OAAO,OAAO,OAAO,CAAC,OAAO,UAAU,OAAO,cAAc,MAAM,IAAI,QAAQ,EAAE;;AAExF,SAAS,WAAW,QAAQ;AAC3B,QAAO,WAAW,OAAO,WAAW,OAAO,WAAW,OAAO,WAAW,OAAO,WAAW;;AAE3F,SAAS,aAAa,OAAO;AAC5B,QAAO,iBAAiB,gBAAgB,MAAM,SAAS;;AAExD,SAAS,YAAY,UAAU;AAC9B,QAAO,aAAa,KAAK,SAAS,IAAI,SAAS,SAAS,IAAI;;AAE7D,SAAS,gBAAgB,UAAU;CAClC,MAAM,aAAa,SAAS,aAAa;AACzC,QAAO,eAAe,eAAe,WAAW,SAAS,aAAa,IAAI,WAAW,SAAS,SAAS,IAAI,WAAW,SAAS,YAAY;;AAE5I,SAAS,mBAAmB,SAAS;CACpC,MAAM,OAAO,UAAU,QAAQ;AAC/B,KAAI,SAAS,MAAM;EAClB,MAAM,CAAC,GAAG,KAAK;AACf,SAAO,MAAM,KAAK,MAAM,MAAM,MAAM,OAAO,MAAM,OAAO,KAAK,MAAM,KAAK,OAAO,MAAM,OAAO,MAAM,OAAO,MAAM,OAAO,KAAK,MAAM,KAAK,MAAM,MAAM,QAAQ,MAAM,KAAK,MAAM,QAAQ,MAAM,QAAQ,MAAM,MAAM,MAAM,OAAO,KAAK;;CAEhO,MAAM,OAAO,UAAU,QAAQ;AAC/B,KAAI,SAAS,KAAM,QAAO;CAC1B,MAAM,QAAQ,KAAK;CACnB,MAAM,gBAAgB,KAAK,OAAO,SAAS,SAAS,EAAE;CACtD,MAAM,aAAa,KAAK,MAAM,GAAG,EAAE,CAAC,OAAO,SAAS,SAAS,EAAE,IAAI,KAAK,OAAO;CAC/E,MAAM,aAAa,QAAQ,WAAW;CACtC,MAAM,eAAe,QAAQ,WAAW;CACxC,MAAM,eAAe,QAAQ,WAAW;AACxC,KAAI,KAAK,MAAM,GAAG,EAAE,CAAC,OAAO,SAAS,SAAS,EAAE,IAAI,KAAK,OAAO,MAAO,QAAO,mBAAmB,GAAG,KAAK,OAAO,EAAE,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,OAAO,EAAE,GAAG,KAAK,KAAK,MAAM;AACvK,QAAO,iBAAiB,cAAc,aAAa,eAAe;;AAEnE,SAAS,UAAU,OAAO;CACzB,MAAM,QAAQ,MAAM,MAAM,IAAI;AAC9B,KAAI,MAAM,WAAW,EAAG,QAAO;CAC/B,MAAM,UAAU,MAAM,KAAK,SAAS,UAAU,KAAK,KAAK,GAAG,OAAO,KAAK,GAAG,IAAI;AAC9E,KAAI,QAAQ,MAAM,SAAS,CAAC,OAAO,UAAU,KAAK,IAAI,OAAO,KAAK,OAAO,IAAI,CAAE,QAAO;AACtF,QAAO;EACN,QAAQ;EACR,QAAQ;EACR,QAAQ;EACR,QAAQ;EACR;;AAEF,SAAS,UAAU,OAAO;AACzB,KAAI,MAAM,SAAS,MAAM,IAAI,MAAM,MAAM,KAAK,CAAC,SAAS,EAAG,QAAO;CAClE,MAAM,CAAC,SAAS,IAAI,QAAQ,MAAM,MAAM,MAAM,KAAK;CACnD,MAAM,OAAO,WAAW,KAAK,EAAE,GAAG,OAAO,MAAM,IAAI;CACnD,MAAM,OAAO,UAAU,KAAK,EAAE,GAAG,MAAM,MAAM,IAAI;CACjD,MAAM,QAAQ,CAAC,GAAG,MAAM,GAAG,KAAK;AAChC,KAAI,MAAM,MAAM,SAAS,CAAC,UAAU,KAAK,KAAK,CAAC,IAAI,MAAM,SAAS,EAAG,QAAO;AAC5E,KAAI,CAAC,MAAM,SAAS,KAAK,IAAI,MAAM,WAAW,EAAG,QAAO;CACxD,MAAM,SAAS,MAAM,SAAS,KAAK,GAAG,IAAI,MAAM,SAAS;AACzD,QAAO;EACN,GAAG;EACH,GAAG,MAAM,KAAK,EAAE,QAAQ,QAAQ,CAAC,CAAC,KAAK,IAAI;EAC3C,GAAG;EACH,CAAC,KAAK,SAAS,OAAO,SAAS,MAAM,GAAG,CAAC;;;;;AClP3C,MAAM,yBAAyB,MAAM;AACrC,MAAM,kBAAkB;AACxB,MAAM,cAAc;AACpB,MAAM,sBAAsB;AAC5B,eAAe,qBAAqB,OAAO,SAAS;CACnD,MAAM,WAAW,KAAK,KAAK,IAAI,QAAQ,kBAAkB,qBAAqB;CAC9E,MAAM,EAAE,aAAa;AACrB,KAAI,CAAC,SAAS,QAAQ,CAAC,SAAS,IAAK,QAAO,kBAAkB,mCAAmC,mDAAmD;AACpJ,KAAI,SAAS,iBAAiB,QAAQ,MAAM,SAAS,KAAK,EAAG,QAAO,gBAAgB,MAAM,KAAK;CAC/F,MAAM,UAAU,cAAc,SAAS,KAAK;CAC5C,MAAM,eAAe,WAAW,SAAS,QAAQ,SAAS,SAAS,OAAO,SAAS,OAAO,KAAK;AAC/F,KAAI,SAAS,QAAQ,CAAC,QAAS,QAAO,kBAAkB,oBAAoB,4CAA4C;AACxH,KAAI,SAAS;EACZ,MAAM,WAAW,qBAAqB,QAAQ;AAC9C,MAAI,CAAC,SAAS,QAAS,QAAO;AAC9B,MAAI,SAAS,UAAU,SAAS,SAAU,QAAO,kBAAkB,qBAAqB,+DAA+D;;CAExJ,IAAI;AACJ,MAAK,MAAM,SAAS,MAAM,kBAAkB,EAAE,EAAE;EAC/C,MAAM,kBAAkB,0BAA0B,MAAM;AACxD,MAAI,CAAC,mBAAmB,CAAC,QAAS;EAClC,MAAM,WAAW,yBAAyB,iBAAiB,MAAM,QAAQ,QAAQ;AACjF,MAAI,CAAC,SAAS,SAAS;AACtB,eAAY,SAAS;AACrB;;EAED,MAAM,iBAAiB,eAAe,SAAS,SAAS;AACxD,MAAI,CAAC,eAAgB,QAAO,UAAU;EACtC,MAAM,SAAS,MAAM,eAAe,kBAAkB,SAAS,OAAO,SAAS,UAAU,kBAAkB,gBAAgB,aAAa,EAAE,aAAa;AACvJ,MAAI,OAAO,QAAS,QAAO;AAC3B,cAAY,OAAO;;AAEpB,KAAI,SAAS;EACZ,MAAM,oBAAoB,eAAe,SAAS,SAAS;AAC3D,MAAI,CAAC,kBAAmB,QAAO,UAAU;EACzC,MAAM,MAAM,MAAM,cAAc;GAC/B,SAAS;GACT,OAAO,MAAM;GACb,GAAG,MAAM,4BAA4B,MAAM,OAAO,KAAK,kBAAkB;AAC1E,MAAI,IAAI,SAAS;GAChB,MAAM,MAAM,QAAQ,IAAI,OAAO,MAAM,OAAO,KAAK,QAAQ;AACzD,OAAI,IAAI,SAAS;IAChB,MAAM,iBAAiB,eAAe,SAAS,SAAS;AACxD,QAAI,CAAC,eAAgB,QAAO,UAAU;IACtC,MAAM,SAAS,MAAM,eAAe,QAAQ,IAAI,OAAO,SAAS,UAAU,kBAAkB,gBAAgB,aAAa,EAAE,aAAa;AACxI,QAAI,OAAO,QAAS,QAAO;AAC3B,gBAAY,OAAO;SACb,aAAY,IAAI;QACjB,aAAY,IAAI;;AAExB,KAAI,SAAS,KAAK;EACjB,MAAM,iBAAiB,eAAe,SAAS,SAAS;AACxD,MAAI,CAAC,eAAgB,QAAO,UAAU;EACtC,MAAM,SAAS,MAAM,eAAe,OAAO,SAAS,KAAK,SAAS,UAAU,kBAAkB,gBAAgB,aAAa,EAAE,aAAa;AAC1I,MAAI,OAAO,QAAS,QAAO;AAC3B,cAAY,OAAO;;AAEpB,QAAO,YAAY;EAClB,SAAS;EACT,OAAO;EACP,GAAG,kBAAkB,gBAAgB,6CAA6C;;AAEpF,SAAS,yBAAyB,iBAAiB,QAAQ,SAAS;AACnE,KAAI;EACH,MAAM,WAAW,IAAI,IAAI,gBAAgB;AACzC,MAAI,SAAS,aAAa,YAAY,SAAS,YAAY,SAAS,YAAY,SAAS,aAAa,OAAO,SAAS,UAAU,SAAS,KAAM,OAAM,IAAI,OAAO;EAChK,MAAM,WAAW;GAChB;GACA,OAAO;GACP,OAAO;GACP,OAAO;GACP,OAAO;GACP;GACA;AACD,MAAI,CAAC,YAAY,KAAK,OAAO,IAAI,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,SAAS,MAAM,YAAY,CAAC,kBAAkB,QAAQ,CAAC,CAAE,OAAM,IAAI,OAAO;AAC7I,SAAO;GACN,SAAS;GACT,OAAO,IAAI,IAAI,SAAS,KAAK,IAAI,EAAE,SAAS;GAC5C;SACM;AACP,SAAO,kBAAkB,eAAe,oDAAoD;;;AAG9F,SAAS,0BAA0B,iBAAiB,QAAQ,QAAQ,SAAS;CAC5E,MAAM,MAAM,yBAAyB,iBAAiB,QAAQ,QAAQ;AACtE,KAAI,CAAC,IAAI,QAAS,QAAO;CACzB,MAAM,MAAM,IAAI,IAAI,IAAI,MAAM;AAC9B,KAAI,WAAW,QAAQ,SAAS,IAAI;AACpC,QAAO;EACN,SAAS;EACT,OAAO;EACP;;AAEF,eAAe,4BAA4B,cAAc,SAAS;CACjE,MAAM,cAAc,eAAe,aAAa;AAChD,KAAI,CAAC,YAAa,QAAO,kBAAkB,yBAAyB,sCAAsC;CAC1G,MAAM,UAAU,MAAM,sBAAsB,aAAa;EACxD,GAAG;EACH,UAAU;EACV,CAAC;AACF,KAAI,CAAC,QAAQ,QAAS,QAAO,kBAAkB,yBAAyB,mDAAmD;CAC3H,IAAI;AACJ,KAAI;AACH,aAAW,KAAK,MAAM,IAAI,aAAa,CAAC,OAAO,QAAQ,MAAM,MAAM,CAAC;SAC7D;AACP,SAAO,kBAAkB,yBAAyB,2CAA2C;;AAE9F,KAAI,CAAC,SAAS,SAAS,IAAI,SAAS,OAAO,gBAAgB,CAAC,MAAM,QAAQ,SAAS,QAAQ,CAAE,QAAO,kBAAkB,yBAAyB,uDAAuD;CACtM,MAAM,UAAU,SAAS,QAAQ,MAAM,UAAU,SAAS,MAAM,KAAK,MAAM,OAAO,GAAG,aAAa,iBAAiB,MAAM,OAAO,mBAAmB,MAAM,SAAS,+BAA+B,OAAO,MAAM,oBAAoB,SAAS;AAC3O,KAAI,CAAC,SAAS,QAAQ,IAAI,OAAO,QAAQ,oBAAoB,SAAU,QAAO,kBAAkB,yBAAyB,uDAAuD;AAChL,KAAI;EACH,MAAM,WAAW,IAAI,IAAI,QAAQ,gBAAgB;AACjD,MAAI,EAAE,QAAQ,uBAAuB,QAAQ,SAAS,aAAa,YAAY,SAAS,aAAa,eAAe,SAAS,aAAa,iBAAiB,SAAS,aAAa,YAAY,SAAS,YAAY,SAAS,SAAU,OAAM,IAAI,OAAO;AACtP,SAAO;GACN,SAAS;GACT,OAAO,SAAS;GAChB;SACM;AACP,SAAO,kBAAkB,yBAAyB,uDAAuD;;;AAG3G,eAAe,eAAe,QAAQ,KAAK,UAAU,SAAS,cAAc;CAC3E,MAAM,UAAU,MAAM,sBAAsB,KAAK,QAAQ;AACzD,KAAI,CAAC,QAAQ,QAAS,QAAO,gBAAgB,QAAQ,MAAM,SAAS,2BAA2B,kBAAkB,0BAA0B,qEAAqE,GAAG;CACnN,MAAM,WAAW,MAAM,gBAAgB,QAAQ,MAAM,OAAO,SAAS;AACrE,KAAI,CAAC,SAAS,QAAS,QAAO;CAC9B,MAAM,cAAc,QAAQ,MAAM,QAAQ,IAAI,eAAe,EAAE,MAAM,KAAK,EAAE,CAAC,IAAI,MAAM;AACvF,KAAI,iBAAiB,QAAQ,MAAM,MAAM,eAAe,aAAa,QAAQ,gBAAgB,KAAK,KAAK,gBAAgB,aAAa,UAAW,QAAO,kBAAkB,0BAA0B,gEAAgE;AAClQ,QAAO;EACN,SAAS;EACT,OAAO;GACN,OAAO,QAAQ,MAAM;GACrB;GACA,KAAK,QAAQ,MAAM;GACnB;EACD;;AAEF,SAAS,kBAAkB,SAAS,cAAc;AACjD,KAAI,CAAC,aAAc,QAAO;AAC1B,QAAO;EACN,GAAG;EACH,UAAU,KAAK,IAAI,QAAQ,YAAY,qBAAqB,UAAU,aAAa,KAAK;EACxF;;AAEF,SAAS,QAAQ,aAAa,cAAc,KAAK;AAChD,KAAI;EACH,MAAM,MAAM,IAAI,IAAI,kCAAkC,YAAY;AAClE,MAAI,aAAa,IAAI,OAAO,aAAa;AACzC,MAAI,aAAa,IAAI,OAAO,IAAI;AAChC,SAAO;GACN,SAAS;GACT,OAAO;GACP;SACM;AACP,SAAO,kBAAkB,yBAAyB,yCAAyC;;;AAG7F,SAAS,eAAe,KAAK;AAC5B,KAAI,gBAAgB,KAAK,IAAI,CAAE,QAAO,yBAAyB,mBAAmB,IAAI;AACtF,KAAI,CAAC,IAAI,WAAW,WAAW,CAAE,QAAO;AACxC,KAAI;EACH,MAAM,QAAQ,IAAI,MAAM,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,mBAAmB;EAC7D,MAAM,OAAO,MAAM,OAAO;AAC1B,MAAI,CAAC,QAAQ,MAAM,MAAM,SAAS,SAAS,MAAM,SAAS,OAAO,SAAS,KAAK,CAAE,QAAO;EACxF,MAAM,OAAO,MAAM,WAAW,IAAI,0BAA0B,IAAI,MAAM,KAAK,IAAI,CAAC;AAChF,SAAO,IAAI,IAAI,MAAM,WAAW,OAAO,CAAC;SACjC;AACP,SAAO;;;AAGT,SAAS,gBAAgB,MAAM;AAC9B,QAAO,kBAAkB,2BAA2B,0BAA0B,uBAAuB,KAAK,CAAC;;AAE5G,SAAS,eAAe,SAAS,UAAU;CAC1C,MAAM,YAAY,WAAW,KAAK,KAAK;AACvC,KAAI,aAAa,EAAG,QAAO;AAC3B,QAAO;EACN,GAAG;EACH,gBAAgB;EAChB;;AAEF,SAAS,WAAW;AACnB,QAAO,kBAAkB,oBAAoB,iDAAiD;;AAE/F,SAAS,SAAS,OAAO;AACxB,QAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,MAAM;;AAE5E,SAAS,cAAc,MAAM;AAC5B,KAAI,CAAC,QAAQ,EAAE,SAAS,SAAS,OAAO,KAAK,KAAK,UAAU,SAAU,QAAO;AAC7E,QAAO,KAAK,IAAI;;AAEjB,SAAS,0BAA0B,OAAO;AACzC,KAAI,CAAC,SAAS,MAAM,IAAI,MAAM,UAAU,8BAA+B,QAAO;AAC9E,QAAO,OAAO,MAAM,oBAAoB,WAAW,MAAM,kBAAkB;;AAE5E,SAAS,kBAAkB,OAAO;AACjC,KAAI,MAAM,WAAW,KAAK,oBAAoB,KAAK,MAAM,CAAE,QAAO;AAClE,MAAK,MAAM,aAAa,OAAO;EAC9B,MAAM,YAAY,UAAU,YAAY,EAAE;AAC1C,MAAI,cAAc,KAAK,MAAM,aAAa,MAAM,cAAc,KAAM,QAAO;;AAE5E,QAAO;;;;;AC3MR,MAAM,eAAe;AACrB,MAAM,sBAAsB,IAAI,IAAI;CACnC;CACA;CACA;CACA;CACA,CAAC;AAsBF,IAAI,mBAAqD;AAUzD,SAAS,oBAAoB,UAA2B;CACvD,MAAM,aAAa,SAAS,aAAa,CAAC,QAAQ,cAAc,GAAG;AACnE,QACC,oBAAoB,IAAI,WAAW,IACnC,WAAW,SAAS,aAAa,IACjC,eAAe,eACf,eAAe,SACf,eAAe,WACf,WAAW,WAAW,cAAc,IACpC,WAAW,WAAW,eAAe;;AAIvC,eAAe,0BAA0B,WAGtC;CACF,IAAI;AACJ,KAAI;AACH,QAAM,IAAI,IAAI,UAAU;SACjB;AACP,QAAM,IAAI,MAAM,yBAAyB,YAAY;;AAEtD,KAAI,IAAI,aAAa,YAAY,IAAI,aAAa,QACjD,OAAM,IAAI,MAAM,sCAAsC,IAAI,WAAW;AAEtE,KAAI,IAAI,YAAY,IAAI,SACvB,OAAM,IAAI,MAAM,qDAAqD;CAItE,MAAM,WAAW,kBADG,IAAI,SAAS,aAAa,CAAC,QAAQ,cAAc,GAAG,CACzB;CAC/C,MAAM,YAAY,oBAAoB,SAAS;AAE/C,KAAI,CAAC,OAAO,KAAK,IAAI,KAAK;AACzB,MAAI,IAAI,aAAa,QACpB,OAAM,IAAI,MAAM,8BAA8B;AAE/C,MAAI,UACH,OAAM,IAAI,MAAM,qCAAqC,WAAW;YAEvD,IAAI,aAAa,WAAW,CAAC,UACvC,OAAM,IAAI,MAAM,uEAAuE;AAGxF,KAAI,UACH,QAAO;EAAE;EAAK,WAAW,EAAE;EAAE;AAG9B,KAAI;AACH,SAAO,MAAM,oCAAoC,IAAI,KAAK;UAClD,OAAO;AACf,MAAI,iBAAiB,UACpB,OAAM,IAAI,MAAM,0BAA0B,MAAM,WAAW,EAAE,OAAO,OAAO,CAAC;AAE7E,QAAM;;;AAQR,eAAsB,yBACrB,WACA,SACoB;AACpB,KAAI,CAAC,OAAO,cAAc,QAAQ,iBAAiB,IAAI,QAAQ,mBAAmB,EACjF,OAAM,IAAI,UAAU,8CAA8C;CAEnE,MAAM,SAAS,MAAM,0BAA0B,UAAU;AACzD,KAAI,OAAO,UAAU,WAAW,EAC/B,QAAO,WAAW,MAAM,OAAO,KAAK;EAAE,UAAU;EAAU,QAAQ,QAAQ;EAAQ,CAAC;CAIpF,MAAM,SAAS,OADG,oBAAqB,MAAM,wCAAwC,EACtD,MAAM;EACpC,KAAK,OAAO;EACZ,kBAAkB,OAAO;EACzB,QAAQ,QAAQ;EAChB,kBAAkB,QAAQ;EAC1B,CAAC;AACF,KAAI,OAAO,qBAAqB,QAAQ,CAAC,OAAO,UAAU,SAAS,OAAO,iBAAiB,EAAE;AAC5F,QAAM,OAAO,SAAS,MAAM,QAAQ,CAAC,YAAY,OAAU;AAC3D,QAAM,IAAI,MAAM,0EAA0E;;AAE3F,QAAO,OAAO;;AAGf,eAAe,yCAA6E;AAC3F,QAAO,4BAA4B,GAChC,wCAAwC,GACxC,qCAAqC;;AAGzC,SAAgB,uCACf,cAAuC,WAAW,OACtB;AAC5B,QAAO,EACN,MAAM,MAAM,OAAO;AAMlB,SAAO;GACN,UAAU,kBANM,MAAM,YAAY,MAAM,KAAK;IAC7C,UAAU;IACV,QAAQ,MAAM;IACd,SAAS,EAAE,mBAAmB,YAAY;IAC1C,CAAC,EAEqC,MAAM,iBAAiB;GAC7D,kBAAkB;GAClB;IAEF;;AAGF,SAAS,6BAAsC;AAC9C,QACC,OAAO,cAAc,eACrB,OAAO,UAAU,cAAc,YAC/B,UAAU,UAAU,SAAS,qBAAqB;;AAIpD,SAAS,kBAAkB,UAAoB,UAA4B;AAC1E,KAAI,CAAC,SAAS,KAAM,QAAO;CAC3B,IAAI,WAAW;CACf,MAAM,OAAO,SAAS,KAAK,YAC1B,IAAI,gBAAwC,EAC3C,UAAU,OAAO,YAAY;AAC5B,cAAY,MAAM;AAClB,MAAI,WAAW,UAAU;AACxB,cAAW,sBAAM,IAAI,WAAW,oDAAoD,CAAC;AACrF;;AAED,aAAW,QAAQ,MAAM;IAE1B,CAAC,CACF;AACD,QAAO,IAAI,SAAS,MAAM;EACzB,QAAQ,SAAS;EACjB,YAAY,SAAS;EACrB,SAAS,SAAS;EAClB,CAAC;;AAQH,eAAsB,oCACrB,aACqC;CACrC,MAAM,UAAU,gBAAgB,MAAM,OAAO,eAAe;AAC5D,QAAO,EACN,MAAM,MAAM,OAAO;EAClB,IAAI;AACJ,OAAK,MAAM,WAAW,MAAM,iBAC3B,KAAI;AAiEH,UAAO;IAAE,UAhEQ,MAAM,IAAI,SAAmB,SAAS,WAAW;KACjE,MAAM,SAAuB,EAAE;KAC/B,IAAI,QAAQ;KACZ,MAAM,MAAM,QACX;MACC,UAAU;MACV,UAAU,kBAAkB,MAAM,IAAI,SAAS;MAC/C,MAAM,eAAe,MAAM,IAAI;MAC/B,MAAM,GAAG,MAAM,IAAI,WAAW,MAAM,IAAI;MACxC,QAAQ;MAGR,OAAO;MACP,SAAS;OACR,MAAM,MAAM,IAAI;OAChB,YAAY;OACZ,mBAAmB;OACnB;MACD,SAAS,WAAW,SAAS,aAAa;OACzC,MAAM,SAAS,QAAQ,SAAS,IAAI,GAAG,IAAI;AAE3C,WAAI,QAAQ,IAAK,UAAS,MAAM,CAAC;QAAE;QAAS;QAAQ,CAAC,CAAC;WACjD,UAAS,MAAM,SAAS,OAAO;;MAErC,QAAQ,MAAM;MACd,GACA,aAAa;MACb,MAAM,kBAAkB,SAAS,QAAQ;AACzC,UAAI,mBAAmB,gBAAgB,aAAa,KAAK,YAAY;AACpE,gBAAS,wBACR,IAAI,MAAM,6DAA6D,CACvE;AACD;;AAED,eAAS,GAAG,SAAS,UAAsB;AAC1C,gBAAS,MAAM;AACf,WAAI,QAAQ,MAAM,kBAAkB;AACnC,iBAAS,wBACR,IAAI,WAAW,oDAAoD,CACnE;AACD;;AAED,cAAO,KAAK,IAAI,WAAW,MAAM,CAAC;QACjC;AACF,eAAS,KAAK,SAAS,OAAO;AAC9B,eAAS,KAAK,aAAa;OAC1B,MAAM,QAAQ,YAAY,QAAQ,MAAM;OACxC,MAAM,UAAU,IAAI,SAAS;AAC7B,YAAK,IAAI,QAAQ,GAAG,QAAQ,SAAS,WAAW,QAAQ,SAAS,EAChE,SAAQ,OAAO,SAAS,WAAW,QAAQ,SAAS,WAAW,QAAQ,GAAG;AAE3E,eACC,4BAA4B;QAC3B,QAAQ,SAAS,cAAc;QAC/B;QACA,MAAM;QACN,CAAC,CACF;QACA;OAEH;AACD,SAAI,KAAK,SAAS,OAAO;AACzB,SAAI,KAAK;MACR;IACiB,kBAAkB;IAAS;WACtC,OAAO;AACf,OAAI,MAAM,OAAO,QAAS,OAAM;AAChC,eAAY;;AAGd,QAAM,IAAI,MAAM,wEAAwE,EACvF,OAAO,WACP,CAAC;IAEH;;AASF,SAAS,4BAA4B,QAAsC;CAC1E,MAAM,cAAc,CAAC;EAAC;EAAK;EAAK;EAAI,CAAC,SAAS,OAAO,OAAO;CAC5D,IAAI,OAA2B;AAC/B,KAAI,aAAa;AAChB,SAAO,IAAI,YAAY,OAAO,KAAK,WAAW;AAC9C,MAAI,WAAW,KAAK,CAAC,IAAI,OAAO,KAAK;;AAEtC,QAAO,IAAI,SAAS,MAAM;EACzB,QAAQ,OAAO;EACf,SAAS,OAAO;EAChB,CAAC;;AAGH,SAAS,YAAY,QAA+B,OAA2B;CAC9E,MAAM,QAAQ,IAAI,WAAW,MAAM;CACnC,IAAI,SAAS;AACb,MAAK,MAAM,SAAS,QAAQ;AAC3B,QAAM,IAAI,OAAO,OAAO;AACxB,YAAU,MAAM;;AAEjB,QAAO;;AAGR,SAAS,eAAe,KAAkB;CACzC,MAAM,OAAO,IAAI,SAAS,KAAK,MAAM,OAAO,IAAI,KAAK;AACrD,KAAI,CAAC,OAAO,cAAc,KAAK,IAAI,OAAO,KAAK,OAAO,MACrD,OAAM,IAAI,UAAU,0CAA0C;AAE/D,QAAO;;AAGR,SAAS,kBAAkB,UAA0B;AACpD,QAAO,SAAS,WAAW,IAAI,IAAI,SAAS,SAAS,IAAI,GAAG,SAAS,MAAM,GAAG,GAAG,GAAG"}

package/dist/audit-CrgmE9LE.mjs

@@ -1,127 +0,0 @@
-import { c as encodeCursor, s as decodeCursor } from "./types-aOOxRSx6.mjs";
-import { ulid } from "ulidx";
-
-//#region src/database/repositories/audit.ts
-/**
-* Audit repository for logging system events
-*
-* Tracks user actions for security, debugging, and compliance.
-* All mutations should create an audit log entry.
-*/
-var AuditRepository = class {
-	constructor(db) {
-		this.db = db;
-	}
-	/**
-	* Create an audit log entry
-	*/
-	async log(input) {
-		const id = ulid();
-		const row = {
-			id,
-			actor_id: input.actorId ?? null,
-			actor_ip: input.actorIp ?? null,
-			action: input.action,
-			resource_type: input.resourceType ?? null,
-			resource_id: input.resourceId ?? null,
-			details: input.details ? JSON.stringify(input.details) : null,
-			status: input.status ?? null
-		};
-		await this.db.insertInto("audit_logs").values(row).execute();
-		const log = await this.findById(id);
-		if (!log) throw new Error("Failed to create audit log");
-		return log;
-	}
-	/**
-	* Find audit log by ID
-	*/
-	async findById(id) {
-		const row = await this.db.selectFrom("audit_logs").selectAll().where("id", "=", id).executeTakeFirst();
-		return row ? this.rowToAuditLog(row) : null;
-	}
-	/**
-	* Query audit logs with filters and cursor-based pagination
-	*/
-	async findMany(query = {}) {
-		const limit = Math.min(Math.max(1, query.limit || 50), 100);
-		let q = this.db.selectFrom("audit_logs").selectAll().orderBy("timestamp", "desc").orderBy("id", "desc").limit(limit + 1);
-		if (query.actorId) q = q.where("actor_id", "=", query.actorId);
-		if (query.action) q = q.where("action", "=", query.action);
-		if (query.resourceType) q = q.where("resource_type", "=", query.resourceType);
-		if (query.resourceId) q = q.where("resource_id", "=", query.resourceId);
-		if (query.status) q = q.where("status", "=", query.status);
-		if (query.since) q = q.where("timestamp", ">=", query.since);
-		if (query.until) q = q.where("timestamp", "<=", query.until);
-		if (query.cursor) {
-			const decoded = decodeCursor(query.cursor);
-			q = q.where((eb) => eb.or([eb("timestamp", "<", decoded.orderValue), eb.and([eb("timestamp", "=", decoded.orderValue), eb("id", "<", decoded.id)])]));
-		}
-		const rows = await q.execute();
-		const items = rows.slice(0, limit).map((row) => this.rowToAuditLog(row));
-		const result = { items };
-		if (rows.length > limit && items.length > 0) {
-			const last = items.at(-1);
-			result.nextCursor = encodeCursor(last.timestamp, last.id);
-		}
-		return result;
-	}
-	/**
-	* Get all logs for a specific resource
-	*/
-	async findByResource(resourceType, resourceId, options = {}) {
-		let query = this.db.selectFrom("audit_logs").selectAll().where("resource_type", "=", resourceType).where("resource_id", "=", resourceId).orderBy("timestamp", "desc");
-		if (options.limit) query = query.limit(options.limit);
-		return (await query.execute()).map((row) => this.rowToAuditLog(row));
-	}
-	/**
-	* Get all logs for a specific user
-	*/
-	async findByActor(actorId, options = {}) {
-		let query = this.db.selectFrom("audit_logs").selectAll().where("actor_id", "=", actorId).orderBy("timestamp", "desc");
-		if (options.since) query = query.where("timestamp", ">=", options.since);
-		if (options.limit) query = query.limit(options.limit);
-		return (await query.execute()).map((row) => this.rowToAuditLog(row));
-	}
-	/**
-	* Count logs matching a query
-	*/
-	async count(query = {}) {
-		let q = this.db.selectFrom("audit_logs").select((eb) => eb.fn.count("id").as("count"));
-		if (query.actorId) q = q.where("actor_id", "=", query.actorId);
-		if (query.action) q = q.where("action", "=", query.action);
-		if (query.resourceType) q = q.where("resource_type", "=", query.resourceType);
-		if (query.resourceId) q = q.where("resource_id", "=", query.resourceId);
-		if (query.status) q = q.where("status", "=", query.status);
-		if (query.since) q = q.where("timestamp", ">=", query.since);
-		if (query.until) q = q.where("timestamp", "<=", query.until);
-		const result = await q.executeTakeFirst();
-		return Number(result?.count || 0);
-	}
-	/**
-	* Delete old audit logs (for retention policy)
-	*/
-	async deleteOlderThan(date) {
-		const result = await this.db.deleteFrom("audit_logs").where("timestamp", "<", date).executeTakeFirst();
-		return Number(result.numDeletedRows ?? 0);
-	}
-	/**
-	* Convert database row to AuditLog object
-	*/
-	rowToAuditLog(row) {
-		return {
-			id: row.id,
-			timestamp: row.timestamp,
-			actorId: row.actor_id,
-			actorIp: row.actor_ip,
-			action: row.action,
-			resourceType: row.resource_type,
-			resourceId: row.resource_id,
-			details: row.details ? JSON.parse(row.details) : null,
-			status: row.status
-		};
-	}
-};
-
-//#endregion
-export { AuditRepository as t };
-//# sourceMappingURL=audit-CrgmE9LE.mjs.map

package/dist/audit-CrgmE9LE.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"audit-CrgmE9LE.mjs","names":[],"sources":["../src/database/repositories/audit.ts"],"sourcesContent":["import type { Kysely } from \"kysely\";\nimport { ulid } from \"ulidx\";\n\nimport type { Database, AuditLogTable } from \"../types.js\";\nimport { encodeCursor, decodeCursor, type FindManyResult } from \"./types.js\";\n\nexport type AuditAction =\n\t| \"create\"\n\t| \"update\"\n\t| \"delete\"\n\t| \"publish\"\n\t| \"unpublish\"\n\t| \"login\"\n\t| \"logout\"\n\t| \"password_change\"\n\t| \"settings_update\"\n\t| \"schema_change\"\n\t| \"plugin_tool_invoke\"\n\t| \"transfer_export_create\"\n\t| \"transfer_import_create\"\n\t| \"transfer_import_execute\"\n\t| \"transfer_import_cancel\"\n\t| \"transfer_import_abandon\"\n\t| \"transfer_import_complete\"\n\t| \"transfer_import_fail\"\n\t| \"transfer_approval_approve\"\n\t| \"transfer_approval_deny\";\n\nexport type AuditStatus = \"success\" | \"failure\" | \"denied\";\n\nexport interface AuditLog {\n\tid: string;\n\ttimestamp: string;\n\tactorId: string | null;\n\tactorIp: string | null;\n\taction: AuditAction;\n\tresourceType: string | null;\n\tresourceId: string | null;\n\tdetails: Record<string, unknown> | null;\n\tstatus: AuditStatus | null;\n}\n\nexport interface CreateAuditLogInput {\n\tactorId?: string;\n\tactorIp?: string;\n\taction: AuditAction;\n\tresourceType?: string;\n\tresourceId?: string;\n\tdetails?: Record<string, unknown>;\n\tstatus?: AuditStatus;\n}\n\nexport interface AuditLogQuery {\n\tactorId?: string;\n\taction?: AuditAction;\n\tresourceType?: string;\n\tresourceId?: string;\n\tstatus?: AuditStatus;\n\tsince?: string; // ISO date\n\tuntil?: string; // ISO date\n\tlimit?: number;\n\tcursor?: string;\n}\n\n/**\n * Audit repository for logging system events\n *\n * Tracks user actions for security, debugging, and compliance.\n * All mutations should create an audit log entry.\n */\nexport class AuditRepository {\n\tconstructor(private db: Kysely<Database>) {}\n\n\t/**\n\t * Create an audit log entry\n\t */\n\tasync log(input: CreateAuditLogInput): Promise<AuditLog> {\n\t\tconst id = ulid();\n\n\t\tconst row: Omit<AuditLogTable, \"timestamp\"> = {\n\t\t\tid,\n\t\t\tactor_id: input.actorId ?? null,\n\t\t\tactor_ip: input.actorIp ?? null,\n\t\t\taction: input.action,\n\t\t\tresource_type: input.resourceType ?? null,\n\t\t\tresource_id: input.resourceId ?? null,\n\t\t\tdetails: input.details ? JSON.stringify(input.details) : null,\n\t\t\tstatus: input.status ?? null,\n\t\t};\n\n\t\tawait this.db.insertInto(\"audit_logs\").values(row).execute();\n\n\t\tconst log = await this.findById(id);\n\t\tif (!log) {\n\t\t\tthrow new Error(\"Failed to create audit log\");\n\t\t}\n\t\treturn log;\n\t}\n\n\t/**\n\t * Find audit log by ID\n\t */\n\tasync findById(id: string): Promise<AuditLog | null> {\n\t\tconst row = await this.db\n\t\t\t.selectFrom(\"audit_logs\")\n\t\t\t.selectAll()\n\t\t\t.where(\"id\", \"=\", id)\n\t\t\t.executeTakeFirst();\n\n\t\treturn row ? this.rowToAuditLog(row) : null;\n\t}\n\n\t/**\n\t * Query audit logs with filters and cursor-based pagination\n\t */\n\tasync findMany(query: AuditLogQuery = {}): Promise<FindManyResult<AuditLog>> {\n\t\tconst limit = Math.min(Math.max(1, query.limit || 50), 100);\n\n\t\tlet q = this.db\n\t\t\t.selectFrom(\"audit_logs\")\n\t\t\t.selectAll()\n\t\t\t.orderBy(\"timestamp\", \"desc\")\n\t\t\t.orderBy(\"id\", \"desc\")\n\t\t\t.limit(limit + 1);\n\n\t\tif (query.actorId) {\n\t\t\tq = q.where(\"actor_id\", \"=\", query.actorId);\n\t\t}\n\n\t\tif (query.action) {\n\t\t\tq = q.where(\"action\", \"=\", query.action);\n\t\t}\n\n\t\tif (query.resourceType) {\n\t\t\tq = q.where(\"resource_type\", \"=\", query.resourceType);\n\t\t}\n\n\t\tif (query.resourceId) {\n\t\t\tq = q.where(\"resource_id\", \"=\", query.resourceId);\n\t\t}\n\n\t\tif (query.status) {\n\t\t\tq = q.where(\"status\", \"=\", query.status);\n\t\t}\n\n\t\tif (query.since) {\n\t\t\tq = q.where(\"timestamp\", \">=\", query.since);\n\t\t}\n\n\t\tif (query.until) {\n\t\t\tq = q.where(\"timestamp\", \"<=\", query.until);\n\t\t}\n\n\t\tif (query.cursor) {\n\t\t\tconst decoded = decodeCursor(query.cursor);\n\t\t\tq = q.where((eb) =>\n\t\t\t\teb.or([\n\t\t\t\t\teb(\"timestamp\", \"<\", decoded.orderValue),\n\t\t\t\t\teb.and([eb(\"timestamp\", \"=\", decoded.orderValue), eb(\"id\", \"<\", decoded.id)]),\n\t\t\t\t]),\n\t\t\t);\n\t\t}\n\n\t\tconst rows = await q.execute();\n\t\tconst items = rows.slice(0, limit).map((row) => this.rowToAuditLog(row));\n\t\tconst result: FindManyResult<AuditLog> = { items };\n\n\t\tif (rows.length > limit && items.length > 0) {\n\t\t\tconst last = items.at(-1)!;\n\t\t\tresult.nextCursor = encodeCursor(last.timestamp, last.id);\n\t\t}\n\n\t\treturn result;\n\t}\n\n\t/**\n\t * Get all logs for a specific resource\n\t */\n\tasync findByResource(\n\t\tresourceType: string,\n\t\tresourceId: string,\n\t\toptions: { limit?: number } = {},\n\t): Promise<AuditLog[]> {\n\t\tlet query = this.db\n\t\t\t.selectFrom(\"audit_logs\")\n\t\t\t.selectAll()\n\t\t\t.where(\"resource_type\", \"=\", resourceType)\n\t\t\t.where(\"resource_id\", \"=\", resourceId)\n\t\t\t.orderBy(\"timestamp\", \"desc\");\n\n\t\tif (options.limit) {\n\t\t\tquery = query.limit(options.limit);\n\t\t}\n\n\t\tconst rows = await query.execute();\n\t\treturn rows.map((row) => this.rowToAuditLog(row));\n\t}\n\n\t/**\n\t * Get all logs for a specific user\n\t */\n\tasync findByActor(\n\t\tactorId: string,\n\t\toptions: { limit?: number; since?: string } = {},\n\t): Promise<AuditLog[]> {\n\t\tlet query = this.db\n\t\t\t.selectFrom(\"audit_logs\")\n\t\t\t.selectAll()\n\t\t\t.where(\"actor_id\", \"=\", actorId)\n\t\t\t.orderBy(\"timestamp\", \"desc\");\n\n\t\tif (options.since) {\n\t\t\tquery = query.where(\"timestamp\", \">=\", options.since);\n\t\t}\n\n\t\tif (options.limit) {\n\t\t\tquery = query.limit(options.limit);\n\t\t}\n\n\t\tconst rows = await query.execute();\n\t\treturn rows.map((row) => this.rowToAuditLog(row));\n\t}\n\n\t/**\n\t * Count logs matching a query\n\t */\n\tasync count(query: Omit<AuditLogQuery, \"limit\" | \"cursor\"> = {}): Promise<number> {\n\t\tlet q = this.db.selectFrom(\"audit_logs\").select((eb) => eb.fn.count(\"id\").as(\"count\"));\n\n\t\tif (query.actorId) {\n\t\t\tq = q.where(\"actor_id\", \"=\", query.actorId);\n\t\t}\n\n\t\tif (query.action) {\n\t\t\tq = q.where(\"action\", \"=\", query.action);\n\t\t}\n\n\t\tif (query.resourceType) {\n\t\t\tq = q.where(\"resource_type\", \"=\", query.resourceType);\n\t\t}\n\n\t\tif (query.resourceId) {\n\t\t\tq = q.where(\"resource_id\", \"=\", query.resourceId);\n\t\t}\n\n\t\tif (query.status) {\n\t\t\tq = q.where(\"status\", \"=\", query.status);\n\t\t}\n\n\t\tif (query.since) {\n\t\t\tq = q.where(\"timestamp\", \">=\", query.since);\n\t\t}\n\n\t\tif (query.until) {\n\t\t\tq = q.where(\"timestamp\", \"<=\", query.until);\n\t\t}\n\n\t\tconst result = await q.executeTakeFirst();\n\t\treturn Number(result?.count || 0);\n\t}\n\n\t/**\n\t * Delete old audit logs (for retention policy)\n\t */\n\tasync deleteOlderThan(date: string): Promise<number> {\n\t\tconst result = await this.db\n\t\t\t.deleteFrom(\"audit_logs\")\n\t\t\t.where(\"timestamp\", \"<\", date)\n\t\t\t.executeTakeFirst();\n\n\t\treturn Number(result.numDeletedRows ?? 0);\n\t}\n\n\t/**\n\t * Convert database row to AuditLog object\n\t */\n\tprivate rowToAuditLog(row: {\n\t\tid: string;\n\t\ttimestamp: string;\n\t\tactor_id: string | null;\n\t\tactor_ip: string | null;\n\t\taction: string;\n\t\tresource_type: string | null;\n\t\tresource_id: string | null;\n\t\tdetails: string | null;\n\t\tstatus: string | null;\n\t}): AuditLog {\n\t\treturn {\n\t\t\tid: row.id,\n\t\t\ttimestamp: row.timestamp,\n\t\t\tactorId: row.actor_id,\n\t\t\tactorIp: row.actor_ip,\n\t\t\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- DB stores string; validated at insert but linter can't follow\n\t\t\taction: row.action as AuditAction,\n\t\t\tresourceType: row.resource_type,\n\t\t\tresourceId: row.resource_id,\n\t\t\tdetails: row.details ? JSON.parse(row.details) : null,\n\t\t\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- DB stores string; validated at insert but linter can't follow\n\t\t\tstatus: row.status as AuditStatus | null,\n\t\t};\n\t}\n}\n"],"mappings":";;;;;;;;;;AAsEA,IAAa,kBAAb,MAA6B;CAC5B,YAAY,AAAQ,IAAsB;EAAtB;;;;;CAKpB,MAAM,IAAI,OAA+C;EACxD,MAAM,KAAK,MAAM;EAEjB,MAAM,MAAwC;GAC7C;GACA,UAAU,MAAM,WAAW;GAC3B,UAAU,MAAM,WAAW;GAC3B,QAAQ,MAAM;GACd,eAAe,MAAM,gBAAgB;GACrC,aAAa,MAAM,cAAc;GACjC,SAAS,MAAM,UAAU,KAAK,UAAU,MAAM,QAAQ,GAAG;GACzD,QAAQ,MAAM,UAAU;GACxB;AAED,QAAM,KAAK,GAAG,WAAW,aAAa,CAAC,OAAO,IAAI,CAAC,SAAS;EAE5D,MAAM,MAAM,MAAM,KAAK,SAAS,GAAG;AACnC,MAAI,CAAC,IACJ,OAAM,IAAI,MAAM,6BAA6B;AAE9C,SAAO;;;;;CAMR,MAAM,SAAS,IAAsC;EACpD,MAAM,MAAM,MAAM,KAAK,GACrB,WAAW,aAAa,CACxB,WAAW,CACX,MAAM,MAAM,KAAK,GAAG,CACpB,kBAAkB;AAEpB,SAAO,MAAM,KAAK,cAAc,IAAI,GAAG;;;;;CAMxC,MAAM,SAAS,QAAuB,EAAE,EAAqC;EAC5E,MAAM,QAAQ,KAAK,IAAI,KAAK,IAAI,GAAG,MAAM,SAAS,GAAG,EAAE,IAAI;EAE3D,IAAI,IAAI,KAAK,GACX,WAAW,aAAa,CACxB,WAAW,CACX,QAAQ,aAAa,OAAO,CAC5B,QAAQ,MAAM,OAAO,CACrB,MAAM,QAAQ,EAAE;AAElB,MAAI,MAAM,QACT,KAAI,EAAE,MAAM,YAAY,KAAK,MAAM,QAAQ;AAG5C,MAAI,MAAM,OACT,KAAI,EAAE,MAAM,UAAU,KAAK,MAAM,OAAO;AAGzC,MAAI,MAAM,aACT,KAAI,EAAE,MAAM,iBAAiB,KAAK,MAAM,aAAa;AAGtD,MAAI,MAAM,WACT,KAAI,EAAE,MAAM,eAAe,KAAK,MAAM,WAAW;AAGlD,MAAI,MAAM,OACT,KAAI,EAAE,MAAM,UAAU,KAAK,MAAM,OAAO;AAGzC,MAAI,MAAM,MACT,KAAI,EAAE,MAAM,aAAa,MAAM,MAAM,MAAM;AAG5C,MAAI,MAAM,MACT,KAAI,EAAE,MAAM,aAAa,MAAM,MAAM,MAAM;AAG5C,MAAI,MAAM,QAAQ;GACjB,MAAM,UAAU,aAAa,MAAM,OAAO;AAC1C,OAAI,EAAE,OAAO,OACZ,GAAG,GAAG,CACL,GAAG,aAAa,KAAK,QAAQ,WAAW,EACxC,GAAG,IAAI,CAAC,GAAG,aAAa,KAAK,QAAQ,WAAW,EAAE,GAAG,MAAM,KAAK,QAAQ,GAAG,CAAC,CAAC,CAC7E,CAAC,CACF;;EAGF,MAAM,OAAO,MAAM,EAAE,SAAS;EAC9B,MAAM,QAAQ,KAAK,MAAM,GAAG,MAAM,CAAC,KAAK,QAAQ,KAAK,cAAc,IAAI,CAAC;EACxE,MAAM,SAAmC,EAAE,OAAO;AAElD,MAAI,KAAK,SAAS,SAAS,MAAM,SAAS,GAAG;GAC5C,MAAM,OAAO,MAAM,GAAG,GAAG;AACzB,UAAO,aAAa,aAAa,KAAK,WAAW,KAAK,GAAG;;AAG1D,SAAO;;;;;CAMR,MAAM,eACL,cACA,YACA,UAA8B,EAAE,EACV;EACtB,IAAI,QAAQ,KAAK,GACf,WAAW,aAAa,CACxB,WAAW,CACX,MAAM,iBAAiB,KAAK,aAAa,CACzC,MAAM,eAAe,KAAK,WAAW,CACrC,QAAQ,aAAa,OAAO;AAE9B,MAAI,QAAQ,MACX,SAAQ,MAAM,MAAM,QAAQ,MAAM;AAInC,UADa,MAAM,MAAM,SAAS,EACtB,KAAK,QAAQ,KAAK,cAAc,IAAI,CAAC;;;;;CAMlD,MAAM,YACL,SACA,UAA8C,EAAE,EAC1B;EACtB,IAAI,QAAQ,KAAK,GACf,WAAW,aAAa,CACxB,WAAW,CACX,MAAM,YAAY,KAAK,QAAQ,CAC/B,QAAQ,aAAa,OAAO;AAE9B,MAAI,QAAQ,MACX,SAAQ,MAAM,MAAM,aAAa,MAAM,QAAQ,MAAM;AAGtD,MAAI,QAAQ,MACX,SAAQ,MAAM,MAAM,QAAQ,MAAM;AAInC,UADa,MAAM,MAAM,SAAS,EACtB,KAAK,QAAQ,KAAK,cAAc,IAAI,CAAC;;;;;CAMlD,MAAM,MAAM,QAAiD,EAAE,EAAmB;EACjF,IAAI,IAAI,KAAK,GAAG,WAAW,aAAa,CAAC,QAAQ,OAAO,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,CAAC;AAEtF,MAAI,MAAM,QACT,KAAI,EAAE,MAAM,YAAY,KAAK,MAAM,QAAQ;AAG5C,MAAI,MAAM,OACT,KAAI,EAAE,MAAM,UAAU,KAAK,MAAM,OAAO;AAGzC,MAAI,MAAM,aACT,KAAI,EAAE,MAAM,iBAAiB,KAAK,MAAM,aAAa;AAGtD,MAAI,MAAM,WACT,KAAI,EAAE,MAAM,eAAe,KAAK,MAAM,WAAW;AAGlD,MAAI,MAAM,OACT,KAAI,EAAE,MAAM,UAAU,KAAK,MAAM,OAAO;AAGzC,MAAI,MAAM,MACT,KAAI,EAAE,MAAM,aAAa,MAAM,MAAM,MAAM;AAG5C,MAAI,MAAM,MACT,KAAI,EAAE,MAAM,aAAa,MAAM,MAAM,MAAM;EAG5C,MAAM,SAAS,MAAM,EAAE,kBAAkB;AACzC,SAAO,OAAO,QAAQ,SAAS,EAAE;;;;;CAMlC,MAAM,gBAAgB,MAA+B;EACpD,MAAM,SAAS,MAAM,KAAK,GACxB,WAAW,aAAa,CACxB,MAAM,aAAa,KAAK,KAAK,CAC7B,kBAAkB;AAEpB,SAAO,OAAO,OAAO,kBAAkB,EAAE;;;;;CAM1C,AAAQ,cAAc,KAUT;AACZ,SAAO;GACN,IAAI,IAAI;GACR,WAAW,IAAI;GACf,SAAS,IAAI;GACb,SAAS,IAAI;GAEb,QAAQ,IAAI;GACZ,cAAc,IAAI;GAClB,YAAY,IAAI;GAChB,SAAS,IAAI,UAAU,KAAK,MAAM,IAAI,QAAQ,GAAG;GAEjD,QAAQ,IAAI;GACZ"}