emdash 1.2.0 → 1.3.0

package/dist/artifact-fetch-DsRczRGG.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"artifact-fetch-DsRczRGG.mjs","names":["TRAILING_DOT"],"sources":["../../registry-verification/dist/fetch-B66dZAfm.js","../../registry-verification/dist/artifact.js","../src/registry/artifact-fetch.ts"],"sourcesContent":["import { n as verificationError } from \"./errors-D3_zxvwe.js\";\n\n//#region src/fetch.ts\nconst DIGITS = /^\\d+$/;\nconst IPV4_LITERAL = /^\\d{1,3}(?:\\.\\d{1,3}){3}$/;\nconst IPV4_PART = /^\\d{1,3}$/;\nconst IPV6_PART = /^[0-9a-f]{1,4}$/i;\nconst TRAILING_DOT = /\\.+$/;\nconst DEFAULT_FETCH_LIMITS = {\n\theaderTimeoutMs: 1e4,\n\ttotalTimeoutMs: 3e4,\n\tmaxBytes: 25 * 1024 * 1024,\n\tmaxRedirects: 3\n};\nasync function fetchVerifiedResource(value, options) {\n\tconst limits = {\n\t\theaderTimeoutMs: options.headerTimeoutMs ?? DEFAULT_FETCH_LIMITS.headerTimeoutMs,\n\t\ttotalTimeoutMs: options.totalTimeoutMs ?? DEFAULT_FETCH_LIMITS.totalTimeoutMs,\n\t\tmaxBytes: options.maxBytes ?? DEFAULT_FETCH_LIMITS.maxBytes,\n\t\tmaxRedirects: options.maxRedirects ?? DEFAULT_FETCH_LIMITS.maxRedirects\n\t};\n\tif (!areValidLimits(limits)) return verificationError(\"INVALID_URL\", \"Fetch limits must be positive integers.\");\n\tconst startedAt = Date.now();\n\tlet currentUrl = parseAndValidateUrl(value, void 0, options.allowHttpLocalhost === true);\n\tif (!currentUrl.success) return currentUrl;\n\tfor (let redirects = 0;; redirects += 1) {\n\t\tconst remaining = limits.totalTimeoutMs - (Date.now() - startedAt);\n\t\tif (remaining <= 0) return verificationError(\"RESOURCE_TIMEOUT\", \"The resource fetch exceeded its total timeout.\");\n\t\tconst host = isAllowedLoopback(currentUrl.value, options.allowHttpLocalhost === true) ? {\n\t\t\tsuccess: true,\n\t\t\tvalue: true\n\t\t} : await validateHost(currentUrl.value, options.resolveHostname, remaining);\n\t\tif (!host.success) return host;\n\t\tconst remainingAfterResolution = limits.totalTimeoutMs - (Date.now() - startedAt);\n\t\tif (remainingAfterResolution <= 0) return verificationError(\"RESOURCE_TIMEOUT\", \"The resource fetch exceeded its total timeout.\");\n\t\tconst response = await fetchResponse(options.fetch, currentUrl.value, Math.min(remainingAfterResolution, limits.headerTimeoutMs));\n\t\tif (!response.success) return response;\n\t\tif (isRedirect(response.value.status)) {\n\t\t\tif (redirects >= limits.maxRedirects) return verificationError(\"REDIRECT_LIMIT_EXCEEDED\", \"The resource exceeded the redirect limit.\");\n\t\t\tconst location = response.value.headers.get(\"location\");\n\t\t\tif (location === null) return verificationError(\"REDIRECT_LOCATION_MISSING\", \"The redirect response has no location header.\");\n\t\t\tcurrentUrl = parseAndValidateUrl(location, currentUrl.value, options.allowHttpLocalhost === true);\n\t\t\tif (!currentUrl.success) return currentUrl;\n\t\t\tcontinue;\n\t\t}\n\t\tif (!response.value.ok && !options.allowedStatuses?.includes(response.value.status)) return verificationError(\"RESOURCE_STATUS_ERROR\", `The resource returned HTTP ${response.value.status}.`);\n\t\tconst contentLength = response.value.headers.get(\"content-length\");\n\t\tif (contentLength !== null && (!DIGITS.test(contentLength) || Number(contentLength) > limits.maxBytes)) return verificationError(\"RESOURCE_SIZE_EXCEEDED\", \"The resource exceeds the byte limit.\");\n\t\tconst bytes = await readResponse(response.value, limits.maxBytes, startedAt, limits.totalTimeoutMs);\n\t\tif (!bytes.success) return bytes;\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: {\n\t\t\t\tbytes: bytes.value,\n\t\t\t\turl: currentUrl.value,\n\t\t\t\tstatus: response.value.status,\n\t\t\t\theaders: response.value.headers\n\t\t\t}\n\t\t};\n\t}\n}\nfunction parseAndValidateUrl(value, base, allowHttpLocalhost = false) {\n\tlet url;\n\ttry {\n\t\turl = new URL(value, base);\n\t} catch {\n\t\treturn verificationError(\"INVALID_URL\", \"The resource URL is invalid.\");\n\t}\n\tif (url.protocol !== \"https:\" && !isAllowedLoopback(url, allowHttpLocalhost) || url.username !== \"\" || url.password !== \"\") return verificationError(\"INVALID_URL\", \"Resource URLs must use HTTPS and cannot include credentials.\");\n\tif (!isAllowedLoopback(url, allowHttpLocalhost) && (isIpLiteral(url.hostname) || isLocalHostname(url.hostname))) return verificationError(\"HOST_REJECTED\", \"The resource host is not permitted.\");\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: url\n\t};\n}\nfunction isAllowedLoopback(url, enabled) {\n\tif (!enabled || url.protocol !== \"http:\" && url.protocol !== \"https:\") return false;\n\tconst hostname = url.hostname.toLowerCase().replace(TRAILING_DOT, \"\");\n\treturn hostname === \"localhost\" || hostname.endsWith(\".localhost\") || hostname === \"127.0.0.1\" || hostname === \"[::1]\" || hostname === \"::1\";\n}\nasync function validateHost(url, resolver, timeoutMs) {\n\ttry {\n\t\tconst addresses = await withTimeout(Promise.resolve().then(() => resolver(url.hostname)), timeoutMs);\n\t\tif (addresses.length === 0 || addresses.some(isForbiddenAddress)) return verificationError(\"HOST_REJECTED\", \"The resource host resolved to a forbidden address.\");\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: true\n\t\t};\n\t} catch (error) {\n\t\tif (isAbortError(error)) return verificationError(\"RESOURCE_TIMEOUT\", \"The resource fetch exceeded its total timeout.\");\n\t\treturn verificationError(\"HOST_REJECTED\", \"The resource host could not be validated.\");\n\t}\n}\nasync function fetchResponse(fetchImplementation, url, timeoutMs) {\n\tconst controller = new AbortController();\n\ttry {\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: await withTimeout(Promise.resolve().then(() => fetchImplementation(url, {\n\t\t\t\tmethod: \"GET\",\n\t\t\t\tredirect: \"manual\",\n\t\t\t\tsignal: controller.signal\n\t\t\t})), timeoutMs, () => controller.abort())\n\t\t};\n\t} catch (error) {\n\t\tif (controller.signal.aborted || isAbortError(error)) return verificationError(\"RESOURCE_TIMEOUT\", \"The resource response headers timed out.\");\n\t\treturn verificationError(\"FETCH_FAILED\", \"The resource request failed.\");\n\t}\n}\nasync function readResponse(response, maximumBytes, startedAt, totalTimeoutMs) {\n\tif (response.body === null) return {\n\t\tsuccess: true,\n\t\tvalue: new Uint8Array()\n\t};\n\tconst reader = response.body.getReader();\n\tconst chunks = [];\n\tlet length = 0;\n\ttry {\n\t\tfor (;;) {\n\t\t\tconst remaining = totalTimeoutMs - (Date.now() - startedAt);\n\t\t\tif (remaining <= 0) {\n\t\t\t\tawait reader.cancel();\n\t\t\t\treturn verificationError(\"RESOURCE_TIMEOUT\", \"The resource fetch exceeded its total timeout.\");\n\t\t\t}\n\t\t\tconst chunk = await readWithTimeout(reader, remaining);\n\t\t\tif (!chunk.success) {\n\t\t\t\tawait reader.cancel();\n\t\t\t\treturn chunk;\n\t\t\t}\n\t\t\tif (chunk.value.done) break;\n\t\t\tconst value = chunk.value.value;\n\t\t\tlength += value.length;\n\t\t\tif (length > maximumBytes) {\n\t\t\t\tawait reader.cancel();\n\t\t\t\treturn verificationError(\"RESOURCE_SIZE_EXCEEDED\", \"The resource exceeds the byte limit.\");\n\t\t\t}\n\t\t\tchunks.push(value);\n\t\t}\n\t} catch {\n\t\treturn verificationError(\"FETCH_FAILED\", \"The resource response could not be read.\");\n\t} finally {\n\t\treader.releaseLock();\n\t}\n\tconst output = new Uint8Array(length);\n\tlet offset = 0;\n\tfor (const chunk of chunks) {\n\t\toutput.set(chunk, offset);\n\t\toffset += chunk.length;\n\t}\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: output\n\t};\n}\nasync function readWithTimeout(reader, timeoutMs) {\n\ttry {\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: await withTimeout(Promise.resolve().then(() => reader.read()), timeoutMs)\n\t\t};\n\t} catch (error) {\n\t\tif (isAbortError(error)) return verificationError(\"RESOURCE_TIMEOUT\", \"The resource fetch exceeded its total timeout.\");\n\t\treturn verificationError(\"FETCH_FAILED\", \"The resource response could not be read.\");\n\t}\n}\n/**\n* Every operation has both fulfillment and rejection handlers, so an operation\n* that loses the timeout race cannot later become an unhandled rejection.\n*/\nfunction withTimeout(operation, timeoutMs, onTimeout) {\n\treturn new Promise((resolve, reject) => {\n\t\tlet settled = false;\n\t\tconst timeout = setTimeout(() => {\n\t\t\tif (settled) return;\n\t\t\tsettled = true;\n\t\t\tonTimeout?.();\n\t\t\treject(new DOMException(\"Timed out\", \"AbortError\"));\n\t\t}, timeoutMs);\n\t\toperation.then((value) => {\n\t\t\tif (settled) return void 0;\n\t\t\tsettled = true;\n\t\t\tclearTimeout(timeout);\n\t\t\tresolve(value);\n\t\t}, (error) => {\n\t\t\tif (settled) return void 0;\n\t\t\tsettled = true;\n\t\t\tclearTimeout(timeout);\n\t\t\treject(error);\n\t\t});\n\t});\n}\nfunction areValidLimits(limits) {\n\treturn Object.values(limits).every((value) => Number.isSafeInteger(value) && value > 0);\n}\nfunction isRedirect(status) {\n\treturn status === 301 || status === 302 || status === 303 || status === 307 || status === 308;\n}\nfunction isAbortError(error) {\n\treturn error instanceof DOMException && error.name === \"AbortError\";\n}\nfunction isIpLiteral(hostname) {\n\treturn IPV4_LITERAL.test(hostname) || hostname.includes(\":\");\n}\nfunction isLocalHostname(hostname) {\n\tconst normalized = hostname.toLowerCase();\n\treturn normalized === \"localhost\" || normalized.endsWith(\".localhost\") || normalized.endsWith(\".local\") || normalized.endsWith(\".internal\");\n}\nfunction isForbiddenAddress(address) {\n\tconst ipv4 = parseIpv4(address);\n\tif (ipv4 !== null) {\n\t\tconst [a, b] = ipv4;\n\t\treturn a === 0 || a === 10 || a === 127 || a === 100 && b >= 64 && b <= 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && (b === 0 || b === 168) || a === 198 && (b === 18 || b === 19) || a >= 224;\n\t}\n\tconst ipv6 = parseIpv6(address);\n\tif (ipv6 === null) return true;\n\tconst first = ipv6[0];\n\tconst isUnspecified = ipv6.every((part) => part === 0);\n\tconst isLoopback = ipv6.slice(0, 7).every((part) => part === 0) && ipv6[7] === 1;\n\tconst isPrivate = (first & 65024) === 64512;\n\tconst isLinkLocal = (first & 65472) === 65152;\n\tconst isMulticast = (first & 65280) === 65280;\n\tif (ipv6.slice(0, 5).every((part) => part === 0) && ipv6[5] === 65535) return isForbiddenAddress(`${ipv6[6] >>> 8}.${ipv6[6] & 255}.${ipv6[7] >>> 8}.${ipv6[7] & 255}`);\n\treturn isUnspecified || isLoopback || isPrivate || isLinkLocal || isMulticast;\n}\nfunction parseIpv4(value) {\n\tconst parts = value.split(\".\");\n\tif (parts.length !== 4) return null;\n\tconst numbers = parts.map((part) => IPV4_PART.test(part) ? Number(part) : NaN);\n\tif (numbers.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) return null;\n\treturn [\n\t\tnumbers[0],\n\t\tnumbers[1],\n\t\tnumbers[2],\n\t\tnumbers[3]\n\t];\n}\nfunction parseIpv6(value) {\n\tif (value.includes(\":::\") || value.split(\"::\").length > 2) return null;\n\tconst [before = \"\", after = \"\"] = value.split(\"::\");\n\tconst head = before === \"\" ? [] : before.split(\":\");\n\tconst tail = after === \"\" ? [] : after.split(\":\");\n\tconst parts = [...head, ...tail];\n\tif (parts.some((part) => !IPV6_PART.test(part)) || parts.length > 8) return null;\n\tif (!value.includes(\"::\") && parts.length !== 8) return null;\n\tconst zeroes = value.includes(\"::\") ? 8 - parts.length : 0;\n\treturn [\n\t\t...head,\n\t\t...Array.from({ length: zeroes }).fill(\"0\"),\n\t\t...tail\n\t].map((part) => Number.parseInt(part, 16));\n}\n\n//#endregion\nexport { fetchVerifiedResource as n, DEFAULT_FETCH_LIMITS as t };\n//# sourceMappingURL=fetch-B66dZAfm.js.map","import { n as unsupportedAuthDetails, t as UNSUPPORTED_AUTH_MESSAGE } from \"./auth-B730dpJ4.js\";\nimport { n as verificationError } from \"./errors-D3_zxvwe.js\";\nimport { multihashFromBlobCid, verifyMultihash } from \"./checksum.js\";\nimport { n as fetchVerifiedResource, t as DEFAULT_FETCH_LIMITS } from \"./fetch-B66dZAfm.js\";\nimport { RECORD_SCOPED_BLOB_CACHE_TYPE } from \"@emdash-cms/registry-lexicons\";\n\n//#region src/artifact.ts\nconst DID_DOCUMENT_MAX_BYTES = 256 * 1024;\nconst PLC_DID_PATTERN = /^did:plc:[a-z2-7]{24}$/;\nconst CID_PATTERN = /^b[a-z2-7]+$/;\nconst UNSAFE_PATH_SEGMENT = /[/\\\\?#]/;\nasync function fetchReleaseArtifact(input, options) {\n\tconst deadline = Date.now() + (options.totalTimeoutMs ?? DEFAULT_FETCH_LIMITS.totalTimeoutMs);\n\tconst { artifact } = input;\n\tif (!artifact.blob && !artifact.url) return verificationError(\"RELEASE_ARTIFACT_SOURCE_MISSING\", \"The release artifact must provide a blob or URL.\");\n\tif (artifact.requiresAuth === true || input.auth !== void 0) return unsupportedAuth(input.auth);\n\tconst blobCid = modernBlobCid(artifact.blob);\n\tconst blobMetadata = blobCid && artifact.blob && \"ref\" in artifact.blob ? artifact.blob : void 0;\n\tif (artifact.blob && !blobCid) return verificationError(\"BLOB_REF_INVALID\", \"Legacy blob references are not supported.\");\n\tif (blobCid) {\n\t\tconst expected = multihashFromBlobCid(blobCid);\n\t\tif (!expected.success) return expected;\n\t\tif (expected.value !== artifact.checksum) return verificationError(\"CHECKSUM_MISMATCH\", \"The artifact checksum does not match its blob reference CID.\");\n\t}\n\tlet lastError;\n\tfor (const cache of input.artifactCaches ?? []) {\n\t\tconst serviceEndpoint = recordScopedCacheEndpoint(cache);\n\t\tif (!serviceEndpoint || !blobCid) continue;\n\t\tconst cacheUrl = recordScopedBlobCacheUrl(serviceEndpoint, input.record, blobCid);\n\t\tif (!cacheUrl.success) {\n\t\t\tlastError = cacheUrl.error;\n\t\t\tcontinue;\n\t\t}\n\t\tconst attemptOptions = withinDeadline(options, deadline);\n\t\tif (!attemptOptions) return timedOut();\n\t\tconst result = await fetchAndVerify(\"artifact-cache\", cacheUrl.value, artifact.checksum, withBlobSizeLimit(attemptOptions, blobMetadata), blobMetadata);\n\t\tif (result.success) return result;\n\t\tlastError = result.error;\n\t}\n\tif (blobCid) {\n\t\tconst resolutionOptions = withinDeadline(options, deadline);\n\t\tif (!resolutionOptions) return timedOut();\n\t\tconst pds = input.pdsEndpoint ? {\n\t\t\tsuccess: true,\n\t\t\tvalue: input.pdsEndpoint\n\t\t} : await resolvePublisherPdsEndpoint(input.record.did, resolutionOptions);\n\t\tif (pds.success) {\n\t\t\tconst url = blobUrl(pds.value, input.record.did, blobCid);\n\t\t\tif (url.success) {\n\t\t\t\tconst attemptOptions = withinDeadline(options, deadline);\n\t\t\t\tif (!attemptOptions) return timedOut();\n\t\t\t\tconst result = await fetchAndVerify(\"blob\", url.value, artifact.checksum, withBlobSizeLimit(attemptOptions, blobMetadata), blobMetadata);\n\t\t\t\tif (result.success) return result;\n\t\t\t\tlastError = result.error;\n\t\t\t} else lastError = url.error;\n\t\t} else lastError = pds.error;\n\t}\n\tif (artifact.url) {\n\t\tconst attemptOptions = withinDeadline(options, deadline);\n\t\tif (!attemptOptions) return timedOut();\n\t\tconst result = await fetchAndVerify(\"url\", artifact.url, artifact.checksum, withBlobSizeLimit(attemptOptions, blobMetadata), blobMetadata);\n\t\tif (result.success) return result;\n\t\tlastError = result.error;\n\t}\n\treturn lastError ? {\n\t\tsuccess: false,\n\t\terror: lastError\n\t} : verificationError(\"FETCH_FAILED\", \"The release artifact could not be fetched.\");\n}\nfunction recordScopedBlobCacheUrl(serviceEndpoint, record, blobCid) {\n\ttry {\n\t\tconst endpoint = new URL(serviceEndpoint);\n\t\tif (endpoint.protocol !== \"https:\" || endpoint.username || endpoint.password || endpoint.pathname !== \"/\" || endpoint.search || endpoint.hash) throw new Error();\n\t\tconst segments = [\n\t\t\t\"r\",\n\t\t\trecord.did,\n\t\t\trecord.collection,\n\t\t\trecord.rkey,\n\t\t\trecord.cid,\n\t\t\tblobCid\n\t\t];\n\t\tif (!CID_PATTERN.test(record.cid) || !CID_PATTERN.test(blobCid) || segments.some((segment) => !isSafePathSegment(segment))) throw new Error();\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: new URL(segments.join(\"/\"), endpoint)\n\t\t};\n\t} catch {\n\t\treturn verificationError(\"INVALID_URL\", \"The record-scoped blob cache endpoint is invalid.\");\n\t}\n}\nfunction recordScopedImageCacheUrl(serviceEndpoint, preset, record, blobCid) {\n\tconst raw = recordScopedBlobCacheUrl(serviceEndpoint, record, blobCid);\n\tif (!raw.success) return raw;\n\tconst url = new URL(raw.value);\n\turl.pathname = `/img/${preset}${url.pathname}`;\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: url\n\t};\n}\nasync function resolvePublisherPdsEndpoint(publisherDid, options) {\n\tconst documentUrl = didDocumentUrl(publisherDid);\n\tif (!documentUrl) return verificationError(\"PDS_RESOLUTION_FAILED\", \"The publisher DID is not supported.\");\n\tconst fetched = await fetchVerifiedResource(documentUrl, {\n\t\t...options,\n\t\tmaxBytes: DID_DOCUMENT_MAX_BYTES\n\t});\n\tif (!fetched.success) return verificationError(\"PDS_RESOLUTION_FAILED\", \"The publisher DID document could not be fetched.\");\n\tlet document;\n\ttry {\n\t\tdocument = JSON.parse(new TextDecoder().decode(fetched.value.bytes));\n\t} catch {\n\t\treturn verificationError(\"PDS_RESOLUTION_FAILED\", \"The publisher DID document is malformed.\");\n\t}\n\tif (!isRecord(document) || document.id !== publisherDid || !Array.isArray(document.service)) return verificationError(\"PDS_RESOLUTION_FAILED\", \"The publisher DID document has no valid PDS service.\");\n\tconst service = document.service.find((value) => isRecord(value) && (value.id === `${publisherDid}#atproto_pds` || value.id === \"#atproto_pds\") && value.type === \"AtprotoPersonalDataServer\" && typeof value.serviceEndpoint === \"string\");\n\tif (!isRecord(service) || typeof service.serviceEndpoint !== \"string\") return verificationError(\"PDS_RESOLUTION_FAILED\", \"The publisher DID document has no valid PDS service.\");\n\ttry {\n\t\tconst endpoint = new URL(service.serviceEndpoint);\n\t\tif (!(options.allowHttpLocalhost === true && endpoint.protocol === \"http:\" && (endpoint.hostname === \"localhost\" || endpoint.hostname === \"127.0.0.1\")) && endpoint.protocol !== \"https:\" || endpoint.username || endpoint.password) throw new Error();\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: endpoint.href\n\t\t};\n\t} catch {\n\t\treturn verificationError(\"PDS_RESOLUTION_FAILED\", \"The publisher DID document has no valid PDS service.\");\n\t}\n}\nasync function fetchAndVerify(source, url, checksum, options, blobMetadata) {\n\tconst fetched = await fetchVerifiedResource(url, options);\n\tif (!fetched.success) return blobMetadata && fetched.error.code === \"RESOURCE_SIZE_EXCEEDED\" ? verificationError(\"BLOB_METADATA_MISMATCH\", \"The fetched artifact size does not match its signed blob metadata.\") : fetched;\n\tconst verified = await verifyMultihash(fetched.value.bytes, checksum);\n\tif (!verified.success) return verified;\n\tconst contentType = fetched.value.headers.get(\"content-type\")?.split(\";\", 1)[0]?.trim();\n\tif (blobMetadata && (fetched.value.bytes.byteLength !== blobMetadata.size || contentType !== void 0 && contentType !== blobMetadata.mimeType)) return verificationError(\"BLOB_METADATA_MISMATCH\", \"The fetched artifact does not match its signed blob metadata.\");\n\treturn {\n\t\tsuccess: true,\n\t\tvalue: {\n\t\t\tbytes: fetched.value.bytes,\n\t\t\tsource,\n\t\t\turl: fetched.value.url\n\t\t}\n\t};\n}\nfunction withBlobSizeLimit(options, blobMetadata) {\n\tif (!blobMetadata) return options;\n\treturn {\n\t\t...options,\n\t\tmaxBytes: Math.min(options.maxBytes ?? DEFAULT_FETCH_LIMITS.maxBytes, blobMetadata.size)\n\t};\n}\nfunction blobUrl(pdsEndpoint, publisherDid, cid) {\n\ttry {\n\t\tconst url = new URL(\"/xrpc/com.atproto.sync.getBlob\", pdsEndpoint);\n\t\turl.searchParams.set(\"did\", publisherDid);\n\t\turl.searchParams.set(\"cid\", cid);\n\t\treturn {\n\t\t\tsuccess: true,\n\t\t\tvalue: url\n\t\t};\n\t} catch {\n\t\treturn verificationError(\"PDS_RESOLUTION_FAILED\", \"The publisher PDS endpoint is invalid.\");\n\t}\n}\nfunction didDocumentUrl(did) {\n\tif (PLC_DID_PATTERN.test(did)) return `https://plc.directory/${encodeURIComponent(did)}`;\n\tif (!did.startsWith(\"did:web:\")) return null;\n\ttry {\n\t\tconst parts = did.slice(8).split(\":\").map(decodeURIComponent);\n\t\tconst host = parts.shift();\n\t\tif (!host || parts.some((part) => part === \"\" || part === \".\" || part === \"..\")) return null;\n\t\tconst path = parts.length === 0 ? \"/.well-known/did.json\" : `/${parts.join(\"/\")}/did.json`;\n\t\treturn new URL(path, `https://${host}`).href;\n\t} catch {\n\t\treturn null;\n\t}\n}\nfunction unsupportedAuth(auth) {\n\treturn verificationError(\"AUTH_METHOD_UNSUPPORTED\", UNSUPPORTED_AUTH_MESSAGE, unsupportedAuthDetails(auth));\n}\nfunction withinDeadline(options, deadline) {\n\tconst remaining = deadline - Date.now();\n\tif (remaining <= 0) return null;\n\treturn {\n\t\t...options,\n\t\ttotalTimeoutMs: remaining\n\t};\n}\nfunction timedOut() {\n\treturn verificationError(\"RESOURCE_TIMEOUT\", \"Artifact retrieval exceeded its total timeout.\");\n}\nfunction isRecord(value) {\n\treturn value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\nfunction modernBlobCid(blob) {\n\tif (!blob || !(\"ref\" in blob) || typeof blob.ref?.$link !== \"string\") return null;\n\treturn blob.ref.$link;\n}\nfunction recordScopedCacheEndpoint(value) {\n\tif (!isRecord(value) || value.$type !== RECORD_SCOPED_BLOB_CACHE_TYPE) return null;\n\treturn typeof value.serviceEndpoint === \"string\" ? value.serviceEndpoint : null;\n}\nfunction isSafePathSegment(value) {\n\tif (value.length === 0 || UNSAFE_PATH_SEGMENT.test(value)) return false;\n\tfor (const character of value) {\n\t\tconst codePoint = character.codePointAt(0);\n\t\tif (codePoint !== void 0 && (codePoint <= 31 || codePoint === 127)) return false;\n\t}\n\treturn true;\n}\n\n//#endregion\nexport { fetchReleaseArtifact, recordScopedBlobCacheUrl, recordScopedImageCacheUrl, resolvePublisherPdsEndpoint };\n//# sourceMappingURL=artifact.js.map","import type { ClientRequest, IncomingMessage } from \"node:http\";\nimport type { RequestOptions } from \"node:https\";\n\nimport { resolveAndValidateExternalUrlTarget, SsrfError } from \"../security/ssrf.js\";\n\nconst TRAILING_DOT = /\\.+$/;\nconst LOCALHOST_HOSTNAMES = new Set([\n\t\"localhost\",\n\t\"localhost.localdomain\",\n\t\"ip6-localhost\",\n\t\"ip6-loopback\",\n]);\n\nexport interface RegistryArtifactTransportInput {\n\turl: URL;\n\tallowedAddresses: readonly string[];\n\tsignal: AbortSignal;\n\tmaxResponseBytes: number;\n}\n\nexport interface RegistryArtifactTransport {\n\tfetch(input: RegistryArtifactTransportInput): Promise<{\n\t\tresponse: Response;\n\t\t/** Workers Fetch does not expose its connected peer; DNS validation still runs before dispatch. */\n\t\tconnectedAddress: string | null;\n\t}>;\n}\n\nexport interface RegistryArtifactFetchOptions {\n\tsignal: AbortSignal;\n\tmaxResponseBytes: number;\n}\n\nlet defaultTransport: RegistryArtifactTransport | null = null;\n\nexport function setDefaultRegistryArtifactTransport(\n\ttransport: RegistryArtifactTransport | null,\n): RegistryArtifactTransport | null {\n\tconst previous = defaultTransport;\n\tdefaultTransport = transport;\n\treturn previous;\n}\n\nfunction isLocalhostHostname(hostname: string): boolean {\n\tconst normalized = hostname.toLowerCase().replace(TRAILING_DOT, \"\");\n\treturn (\n\t\tLOCALHOST_HOSTNAMES.has(normalized) ||\n\t\tnormalized.endsWith(\".localhost\") ||\n\t\tnormalized === \"127.0.0.1\" ||\n\t\tnormalized === \"::1\" ||\n\t\tnormalized === \"[::1]\" ||\n\t\tnormalized.startsWith(\"::ffff:127.\") ||\n\t\tnormalized.startsWith(\"::ffff:7f00:\")\n\t);\n}\n\nasync function resolveSafeArtifactTarget(urlString: string): Promise<{\n\turl: URL;\n\taddresses: readonly string[];\n}> {\n\tlet url: URL;\n\ttry {\n\t\turl = new URL(urlString);\n\t} catch {\n\t\tthrow new Error(`Invalid artifact URL: ${urlString}`);\n\t}\n\tif (url.protocol !== \"https:\" && url.protocol !== \"http:\") {\n\t\tthrow new Error(`Artifact URL protocol not allowed: ${url.protocol}`);\n\t}\n\tif (url.username || url.password) {\n\t\tthrow new Error(\"Artifact URL must not contain embedded credentials\");\n\t}\n\n\tconst rawHostname = url.hostname.toLowerCase().replace(TRAILING_DOT, \"\");\n\tconst hostname = stripIpv6Brackets(rawHostname);\n\tconst localhost = isLocalhostHostname(hostname);\n\n\tif (!import.meta.env.DEV) {\n\t\tif (url.protocol === \"http:\") {\n\t\t\tthrow new Error(\"Artifact URL must use https\");\n\t\t}\n\t\tif (localhost) {\n\t\t\tthrow new Error(`Artifact URL points to localhost: ${hostname}`);\n\t\t}\n\t} else if (url.protocol === \"http:\" && !localhost) {\n\t\tthrow new Error(\"Artifact URL must use https (http allowed only for localhost in dev)\");\n\t}\n\n\tif (localhost) {\n\t\treturn { url, addresses: [] };\n\t}\n\n\ttry {\n\t\treturn await resolveAndValidateExternalUrlTarget(url.href);\n\t} catch (error) {\n\t\tif (error instanceof SsrfError) {\n\t\t\tthrow new Error(`Artifact URL rejected: ${error.message}`, { cause: error });\n\t\t}\n\t\tthrow error;\n\t}\n}\n\nexport async function assertSafeArtifactUrl(urlString: string): Promise<URL> {\n\treturn (await resolveSafeArtifactTarget(urlString)).url;\n}\n\nexport async function fetchRegistryArtifactUrl(\n\turlString: string,\n\toptions: RegistryArtifactFetchOptions,\n): Promise<Response> {\n\tif (!Number.isSafeInteger(options.maxResponseBytes) || options.maxResponseBytes < 0) {\n\t\tthrow new TypeError(\"Registry artifact response limit is invalid\");\n\t}\n\tconst target = await resolveSafeArtifactTarget(urlString);\n\tif (target.addresses.length === 0) {\n\t\treturn globalThis.fetch(target.url, { redirect: \"manual\", signal: options.signal });\n\t}\n\n\tconst transport = defaultTransport ?? (await createRuntimeRegistryArtifactTransport());\n\tconst result = await transport.fetch({\n\t\turl: target.url,\n\t\tallowedAddresses: target.addresses,\n\t\tsignal: options.signal,\n\t\tmaxResponseBytes: options.maxResponseBytes,\n\t});\n\tif (result.connectedAddress !== null && !target.addresses.includes(result.connectedAddress)) {\n\t\tawait result.response.body?.cancel().catch(() => undefined);\n\t\tthrow new Error(\"Registry artifact transport connected outside the validated address set\");\n\t}\n\treturn result.response;\n}\n\nasync function createRuntimeRegistryArtifactTransport(): Promise<RegistryArtifactTransport> {\n\treturn isCloudflareWorkersRuntime()\n\t\t? createWorkersRegistryArtifactTransport()\n\t\t: createNodeRegistryArtifactTransport();\n}\n\nexport function createWorkersRegistryArtifactTransport(\n\tworkerFetch: typeof globalThis.fetch = globalThis.fetch,\n): RegistryArtifactTransport {\n\treturn {\n\t\tasync fetch(input) {\n\t\t\tconst response = await workerFetch(input.url, {\n\t\t\t\tredirect: \"manual\",\n\t\t\t\tsignal: input.signal,\n\t\t\t\theaders: { \"Accept-Encoding\": \"identity\" },\n\t\t\t});\n\t\t\treturn {\n\t\t\t\tresponse: limitResponseBody(response, input.maxResponseBytes),\n\t\t\t\tconnectedAddress: null,\n\t\t\t};\n\t\t},\n\t};\n}\n\nfunction isCloudflareWorkersRuntime(): boolean {\n\treturn (\n\t\ttypeof navigator !== \"undefined\" &&\n\t\ttypeof navigator.userAgent === \"string\" &&\n\t\tnavigator.userAgent.includes(\"Cloudflare-Workers\")\n\t);\n}\n\nfunction limitResponseBody(response: Response, maxBytes: number): Response {\n\tif (!response.body) return response;\n\tlet received = 0;\n\tconst body = response.body.pipeThrough(\n\t\tnew TransformStream<Uint8Array, Uint8Array>({\n\t\t\ttransform(chunk, controller) {\n\t\t\t\treceived += chunk.byteLength;\n\t\t\t\tif (received > maxBytes) {\n\t\t\t\t\tcontroller.error(new RangeError(\"Registry artifact response exceeds its byte limit\"));\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tcontroller.enqueue(chunk);\n\t\t\t},\n\t\t}),\n\t);\n\treturn new Response(body, {\n\t\tstatus: response.status,\n\t\tstatusText: response.statusText,\n\t\theaders: response.headers,\n\t});\n}\n\nexport type RegistryArtifactNodeRequest = (\n\toptions: RequestOptions,\n\tcallback: (response: IncomingMessage) => void,\n) => ClientRequest;\n\nexport async function createNodeRegistryArtifactTransport(\n\tnodeRequest?: RegistryArtifactNodeRequest,\n): Promise<RegistryArtifactTransport> {\n\tconst request = nodeRequest ?? (await import(\"node:https\")).request;\n\treturn {\n\t\tasync fetch(input) {\n\t\t\tlet lastError: unknown;\n\t\t\tfor (const address of input.allowedAddresses) {\n\t\t\t\ttry {\n\t\t\t\t\tconst response = await new Promise<Response>((resolve, reject) => {\n\t\t\t\t\t\tconst chunks: Uint8Array[] = [];\n\t\t\t\t\t\tlet total = 0;\n\t\t\t\t\t\tconst req = request(\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\tprotocol: \"https:\",\n\t\t\t\t\t\t\t\thostname: stripIpv6Brackets(input.url.hostname),\n\t\t\t\t\t\t\t\tport: parseHttpsPort(input.url),\n\t\t\t\t\t\t\t\tpath: `${input.url.pathname}${input.url.search}`,\n\t\t\t\t\t\t\t\tmethod: \"GET\",\n\t\t\t\t\t\t\t\t// A pooled socket may have been opened for the same hostname\n\t\t\t\t\t\t\t\t// before this address set was resolved.\n\t\t\t\t\t\t\t\tagent: false,\n\t\t\t\t\t\t\t\theaders: {\n\t\t\t\t\t\t\t\t\tHost: input.url.host,\n\t\t\t\t\t\t\t\t\tConnection: \"close\",\n\t\t\t\t\t\t\t\t\t\"Accept-Encoding\": \"identity\",\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\tlookup: (_hostname, options, callback) => {\n\t\t\t\t\t\t\t\t\tconst family = address.includes(\":\") ? 6 : 4;\n\t\t\t\t\t\t\t\t\t// Node's default autoSelectFamily asks with `all: true` and expects a list.\n\t\t\t\t\t\t\t\t\tif (options.all) callback(null, [{ address, family }]);\n\t\t\t\t\t\t\t\t\telse callback(null, address, family);\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\tsignal: input.signal,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t(upstream) => {\n\t\t\t\t\t\t\t\tconst contentEncoding = upstream.headers[\"content-encoding\"];\n\t\t\t\t\t\t\t\tif (contentEncoding && contentEncoding.toLowerCase() !== \"identity\") {\n\t\t\t\t\t\t\t\t\tupstream.destroy(\n\t\t\t\t\t\t\t\t\t\tnew Error(\"Registry artifact response content encoding is unsupported\"),\n\t\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\tupstream.on(\"data\", (chunk: Uint8Array) => {\n\t\t\t\t\t\t\t\t\ttotal += chunk.byteLength;\n\t\t\t\t\t\t\t\t\tif (total > input.maxResponseBytes) {\n\t\t\t\t\t\t\t\t\t\tupstream.destroy(\n\t\t\t\t\t\t\t\t\t\t\tnew RangeError(\"Registry artifact response exceeds its byte limit\"),\n\t\t\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\tchunks.push(new Uint8Array(chunk));\n\t\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\t\tupstream.once(\"error\", reject);\n\t\t\t\t\t\t\t\tupstream.once(\"end\", () => {\n\t\t\t\t\t\t\t\t\tconst bytes = concatBytes(chunks, total);\n\t\t\t\t\t\t\t\t\tconst headers = new Headers();\n\t\t\t\t\t\t\t\t\tfor (let index = 0; index < upstream.rawHeaders.length; index += 2) {\n\t\t\t\t\t\t\t\t\t\theaders.append(upstream.rawHeaders[index], upstream.rawHeaders[index + 1]);\n\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\tresolve(\n\t\t\t\t\t\t\t\t\t\tparsedResponseToWebResponse({\n\t\t\t\t\t\t\t\t\t\t\tstatus: upstream.statusCode ?? 502,\n\t\t\t\t\t\t\t\t\t\t\theaders,\n\t\t\t\t\t\t\t\t\t\t\tbody: bytes,\n\t\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t);\n\t\t\t\t\t\treq.once(\"error\", reject);\n\t\t\t\t\t\treq.end();\n\t\t\t\t\t});\n\t\t\t\t\treturn { response, connectedAddress: address };\n\t\t\t\t} catch (error) {\n\t\t\t\t\tif (input.signal.aborted) throw error;\n\t\t\t\t\tlastError = error;\n\t\t\t\t}\n\t\t\t}\n\t\t\tthrow new Error(\"Registry artifact transport could not connect to an approved address\", {\n\t\t\t\tcause: lastError,\n\t\t\t});\n\t\t},\n\t};\n}\n\ninterface ParsedHttpResponse {\n\tstatus: number;\n\theaders: Headers;\n\tbody: Uint8Array;\n}\n\nfunction parsedResponseToWebResponse(parsed: ParsedHttpResponse): Response {\n\tconst bodyAllowed = ![204, 205, 304].includes(parsed.status);\n\tlet body: ArrayBuffer | null = null;\n\tif (bodyAllowed) {\n\t\tbody = new ArrayBuffer(parsed.body.byteLength);\n\t\tnew Uint8Array(body).set(parsed.body);\n\t}\n\treturn new Response(body, {\n\t\tstatus: parsed.status,\n\t\theaders: parsed.headers,\n\t});\n}\n\nfunction concatBytes(chunks: readonly Uint8Array[], total: number): Uint8Array {\n\tconst bytes = new Uint8Array(total);\n\tlet offset = 0;\n\tfor (const chunk of chunks) {\n\t\tbytes.set(chunk, offset);\n\t\toffset += chunk.byteLength;\n\t}\n\treturn bytes;\n}\n\nfunction parseHttpsPort(url: URL): number {\n\tconst port = url.port === \"\" ? 443 : Number(url.port);\n\tif (!Number.isSafeInteger(port) || port < 1 || port > 65_535) {\n\t\tthrow new TypeError(\"Registry artifact HTTPS port is invalid\");\n\t}\n\treturn port;\n}\n\nfunction stripIpv6Brackets(hostname: string): string {\n\treturn hostname.startsWith(\"[\") && hostname.endsWith(\"]\") ? hostname.slice(1, -1) : hostname;\n}\n"],"mappings":";;;;;AAGA,MAAM,SAAS;AACf,MAAM,eAAe;AACrB,MAAM,YAAY;AAClB,MAAM,YAAY;AAClB,MAAMA,iBAAe;AACrB,MAAM,uBAAuB;CAC5B,iBAAiB;CACjB,gBAAgB;CAChB,UAAU,KAAK,OAAO;CACtB,cAAc;CACd;AACD,eAAe,sBAAsB,OAAO,SAAS;CACpD,MAAM,SAAS;EACd,iBAAiB,QAAQ,mBAAmB,qBAAqB;EACjE,gBAAgB,QAAQ,kBAAkB,qBAAqB;EAC/D,UAAU,QAAQ,YAAY,qBAAqB;EACnD,cAAc,QAAQ,gBAAgB,qBAAqB;EAC3D;AACD,KAAI,CAAC,eAAe,OAAO,CAAE,QAAO,kBAAkB,eAAe,0CAA0C;CAC/G,MAAM,YAAY,KAAK,KAAK;CAC5B,IAAI,aAAa,oBAAoB,OAAO,KAAK,GAAG,QAAQ,uBAAuB,KAAK;AACxF,KAAI,CAAC,WAAW,QAAS,QAAO;AAChC,MAAK,IAAI,YAAY,IAAI,aAAa,GAAG;EACxC,MAAM,YAAY,OAAO,kBAAkB,KAAK,KAAK,GAAG;AACxD,MAAI,aAAa,EAAG,QAAO,kBAAkB,oBAAoB,iDAAiD;EAClH,MAAM,OAAO,kBAAkB,WAAW,OAAO,QAAQ,uBAAuB,KAAK,GAAG;GACvF,SAAS;GACT,OAAO;GACP,GAAG,MAAM,aAAa,WAAW,OAAO,QAAQ,iBAAiB,UAAU;AAC5E,MAAI,CAAC,KAAK,QAAS,QAAO;EAC1B,MAAM,2BAA2B,OAAO,kBAAkB,KAAK,KAAK,GAAG;AACvE,MAAI,4BAA4B,EAAG,QAAO,kBAAkB,oBAAoB,iDAAiD;EACjI,MAAM,WAAW,MAAM,cAAc,QAAQ,OAAO,WAAW,OAAO,KAAK,IAAI,0BAA0B,OAAO,gBAAgB,CAAC;AACjI,MAAI,CAAC,SAAS,QAAS,QAAO;AAC9B,MAAI,WAAW,SAAS,MAAM,OAAO,EAAE;AACtC,OAAI,aAAa,OAAO,aAAc,QAAO,kBAAkB,2BAA2B,4CAA4C;GACtI,MAAM,WAAW,SAAS,MAAM,QAAQ,IAAI,WAAW;AACvD,OAAI,aAAa,KAAM,QAAO,kBAAkB,6BAA6B,gDAAgD;AAC7H,gBAAa,oBAAoB,UAAU,WAAW,OAAO,QAAQ,uBAAuB,KAAK;AACjG,OAAI,CAAC,WAAW,QAAS,QAAO;AAChC;;AAED,MAAI,CAAC,SAAS,MAAM,MAAM,CAAC,QAAQ,iBAAiB,SAAS,SAAS,MAAM,OAAO,CAAE,QAAO,kBAAkB,yBAAyB,8BAA8B,SAAS,MAAM,OAAO,GAAG;EAC9L,MAAM,gBAAgB,SAAS,MAAM,QAAQ,IAAI,iBAAiB;AAClE,MAAI,kBAAkB,SAAS,CAAC,OAAO,KAAK,cAAc,IAAI,OAAO,cAAc,GAAG,OAAO,UAAW,QAAO,kBAAkB,0BAA0B,uCAAuC;EAClM,MAAM,QAAQ,MAAM,aAAa,SAAS,OAAO,OAAO,UAAU,WAAW,OAAO,eAAe;AACnG,MAAI,CAAC,MAAM,QAAS,QAAO;AAC3B,SAAO;GACN,SAAS;GACT,OAAO;IACN,OAAO,MAAM;IACb,KAAK,WAAW;IAChB,QAAQ,SAAS,MAAM;IACvB,SAAS,SAAS,MAAM;IACxB;GACD;;;AAGH,SAAS,oBAAoB,OAAO,MAAM,qBAAqB,OAAO;CACrE,IAAI;AACJ,KAAI;AACH,QAAM,IAAI,IAAI,OAAO,KAAK;SACnB;AACP,SAAO,kBAAkB,eAAe,+BAA+B;;AAExE,KAAI,IAAI,aAAa,YAAY,CAAC,kBAAkB,KAAK,mBAAmB,IAAI,IAAI,aAAa,MAAM,IAAI,aAAa,GAAI,QAAO,kBAAkB,eAAe,+DAA+D;AACnO,KAAI,CAAC,kBAAkB,KAAK,mBAAmB,KAAK,YAAY,IAAI,SAAS,IAAI,gBAAgB,IAAI,SAAS,EAAG,QAAO,kBAAkB,iBAAiB,sCAAsC;AACjM,QAAO;EACN,SAAS;EACT,OAAO;EACP;;AAEF,SAAS,kBAAkB,KAAK,SAAS;AACxC,KAAI,CAAC,WAAW,IAAI,aAAa,WAAW,IAAI,aAAa,SAAU,QAAO;CAC9E,MAAM,WAAW,IAAI,SAAS,aAAa,CAAC,QAAQA,gBAAc,GAAG;AACrE,QAAO,aAAa,eAAe,SAAS,SAAS,aAAa,IAAI,aAAa,eAAe,aAAa,WAAW,aAAa;;AAExI,eAAe,aAAa,KAAK,UAAU,WAAW;AACrD,KAAI;EACH,MAAM,YAAY,MAAM,YAAY,QAAQ,SAAS,CAAC,WAAW,SAAS,IAAI,SAAS,CAAC,EAAE,UAAU;AACpG,MAAI,UAAU,WAAW,KAAK,UAAU,KAAK,mBAAmB,CAAE,QAAO,kBAAkB,iBAAiB,qDAAqD;AACjK,SAAO;GACN,SAAS;GACT,OAAO;GACP;UACO,OAAO;AACf,MAAI,aAAa,MAAM,CAAE,QAAO,kBAAkB,oBAAoB,iDAAiD;AACvH,SAAO,kBAAkB,iBAAiB,4CAA4C;;;AAGxF,eAAe,cAAc,qBAAqB,KAAK,WAAW;CACjE,MAAM,aAAa,IAAI,iBAAiB;AACxC,KAAI;AACH,SAAO;GACN,SAAS;GACT,OAAO,MAAM,YAAY,QAAQ,SAAS,CAAC,WAAW,oBAAoB,KAAK;IAC9E,QAAQ;IACR,UAAU;IACV,QAAQ,WAAW;IACnB,CAAC,CAAC,EAAE,iBAAiB,WAAW,OAAO,CAAC;GACzC;UACO,OAAO;AACf,MAAI,WAAW,OAAO,WAAW,aAAa,MAAM,CAAE,QAAO,kBAAkB,oBAAoB,2CAA2C;AAC9I,SAAO,kBAAkB,gBAAgB,+BAA+B;;;AAG1E,eAAe,aAAa,UAAU,cAAc,WAAW,gBAAgB;AAC9E,KAAI,SAAS,SAAS,KAAM,QAAO;EAClC,SAAS;EACT,OAAO,IAAI,YAAY;EACvB;CACD,MAAM,SAAS,SAAS,KAAK,WAAW;CACxC,MAAM,SAAS,EAAE;CACjB,IAAI,SAAS;AACb,KAAI;AACH,WAAS;GACR,MAAM,YAAY,kBAAkB,KAAK,KAAK,GAAG;AACjD,OAAI,aAAa,GAAG;AACnB,UAAM,OAAO,QAAQ;AACrB,WAAO,kBAAkB,oBAAoB,iDAAiD;;GAE/F,MAAM,QAAQ,MAAM,gBAAgB,QAAQ,UAAU;AACtD,OAAI,CAAC,MAAM,SAAS;AACnB,UAAM,OAAO,QAAQ;AACrB,WAAO;;AAER,OAAI,MAAM,MAAM,KAAM;GACtB,MAAM,QAAQ,MAAM,MAAM;AAC1B,aAAU,MAAM;AAChB,OAAI,SAAS,cAAc;AAC1B,UAAM,OAAO,QAAQ;AACrB,WAAO,kBAAkB,0BAA0B,uCAAuC;;AAE3F,UAAO,KAAK,MAAM;;SAEZ;AACP,SAAO,kBAAkB,gBAAgB,2CAA2C;WAC3E;AACT,SAAO,aAAa;;CAErB,MAAM,SAAS,IAAI,WAAW,OAAO;CACrC,IAAI,SAAS;AACb,MAAK,MAAM,SAAS,QAAQ;AAC3B,SAAO,IAAI,OAAO,OAAO;AACzB,YAAU,MAAM;;AAEjB,QAAO;EACN,SAAS;EACT,OAAO;EACP;;AAEF,eAAe,gBAAgB,QAAQ,WAAW;AACjD,KAAI;AACH,SAAO;GACN,SAAS;GACT,OAAO,MAAM,YAAY,QAAQ,SAAS,CAAC,WAAW,OAAO,MAAM,CAAC,EAAE,UAAU;GAChF;UACO,OAAO;AACf,MAAI,aAAa,MAAM,CAAE,QAAO,kBAAkB,oBAAoB,iDAAiD;AACvH,SAAO,kBAAkB,gBAAgB,2CAA2C;;;;;;;AAOtF,SAAS,YAAY,WAAW,WAAW,WAAW;AACrD,QAAO,IAAI,SAAS,SAAS,WAAW;EACvC,IAAI,UAAU;EACd,MAAM,UAAU,iBAAiB;AAChC,OAAI,QAAS;AACb,aAAU;AACV,gBAAa;AACb,UAAO,IAAI,aAAa,aAAa,aAAa,CAAC;KACjD,UAAU;AACb,YAAU,MAAM,UAAU;AACzB,OAAI,QAAS,QAAO,KAAK;AACzB,aAAU;AACV,gBAAa,QAAQ;AACrB,WAAQ,MAAM;MACX,UAAU;AACb,OAAI,QAAS,QAAO,KAAK;AACzB,aAAU;AACV,gBAAa,QAAQ;AACrB,UAAO,MAAM;IACZ;GACD;;AAEH,SAAS,eAAe,QAAQ;AAC/B,QAAO,OAAO,OAAO,OAAO,CAAC,OAAO,UAAU,OAAO,cAAc,MAAM,IAAI,QAAQ,EAAE;;AAExF,SAAS,WAAW,QAAQ;AAC3B,QAAO,WAAW,OAAO,WAAW,OAAO,WAAW,OAAO,WAAW,OAAO,WAAW;;AAE3F,SAAS,aAAa,OAAO;AAC5B,QAAO,iBAAiB,gBAAgB,MAAM,SAAS;;AAExD,SAAS,YAAY,UAAU;AAC9B,QAAO,aAAa,KAAK,SAAS,IAAI,SAAS,SAAS,IAAI;;AAE7D,SAAS,gBAAgB,UAAU;CAClC,MAAM,aAAa,SAAS,aAAa;AACzC,QAAO,eAAe,eAAe,WAAW,SAAS,aAAa,IAAI,WAAW,SAAS,SAAS,IAAI,WAAW,SAAS,YAAY;;AAE5I,SAAS,mBAAmB,SAAS;CACpC,MAAM,OAAO,UAAU,QAAQ;AAC/B,KAAI,SAAS,MAAM;EAClB,MAAM,CAAC,GAAG,KAAK;AACf,SAAO,MAAM,KAAK,MAAM,MAAM,MAAM,OAAO,MAAM,OAAO,KAAK,MAAM,KAAK,OAAO,MAAM,OAAO,MAAM,OAAO,MAAM,OAAO,KAAK,MAAM,KAAK,MAAM,MAAM,QAAQ,MAAM,KAAK,MAAM,QAAQ,MAAM,QAAQ,MAAM,MAAM,MAAM,OAAO,KAAK;;CAEhO,MAAM,OAAO,UAAU,QAAQ;AAC/B,KAAI,SAAS,KAAM,QAAO;CAC1B,MAAM,QAAQ,KAAK;CACnB,MAAM,gBAAgB,KAAK,OAAO,SAAS,SAAS,EAAE;CACtD,MAAM,aAAa,KAAK,MAAM,GAAG,EAAE,CAAC,OAAO,SAAS,SAAS,EAAE,IAAI,KAAK,OAAO;CAC/E,MAAM,aAAa,QAAQ,WAAW;CACtC,MAAM,eAAe,QAAQ,WAAW;CACxC,MAAM,eAAe,QAAQ,WAAW;AACxC,KAAI,KAAK,MAAM,GAAG,EAAE,CAAC,OAAO,SAAS,SAAS,EAAE,IAAI,KAAK,OAAO,MAAO,QAAO,mBAAmB,GAAG,KAAK,OAAO,EAAE,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,OAAO,EAAE,GAAG,KAAK,KAAK,MAAM;AACvK,QAAO,iBAAiB,cAAc,aAAa,eAAe;;AAEnE,SAAS,UAAU,OAAO;CACzB,MAAM,QAAQ,MAAM,MAAM,IAAI;AAC9B,KAAI,MAAM,WAAW,EAAG,QAAO;CAC/B,MAAM,UAAU,MAAM,KAAK,SAAS,UAAU,KAAK,KAAK,GAAG,OAAO,KAAK,GAAG,IAAI;AAC9E,KAAI,QAAQ,MAAM,SAAS,CAAC,OAAO,UAAU,KAAK,IAAI,OAAO,KAAK,OAAO,IAAI,CAAE,QAAO;AACtF,QAAO;EACN,QAAQ;EACR,QAAQ;EACR,QAAQ;EACR,QAAQ;EACR;;AAEF,SAAS,UAAU,OAAO;AACzB,KAAI,MAAM,SAAS,MAAM,IAAI,MAAM,MAAM,KAAK,CAAC,SAAS,EAAG,QAAO;CAClE,MAAM,CAAC,SAAS,IAAI,QAAQ,MAAM,MAAM,MAAM,KAAK;CACnD,MAAM,OAAO,WAAW,KAAK,EAAE,GAAG,OAAO,MAAM,IAAI;CACnD,MAAM,OAAO,UAAU,KAAK,EAAE,GAAG,MAAM,MAAM,IAAI;CACjD,MAAM,QAAQ,CAAC,GAAG,MAAM,GAAG,KAAK;AAChC,KAAI,MAAM,MAAM,SAAS,CAAC,UAAU,KAAK,KAAK,CAAC,IAAI,MAAM,SAAS,EAAG,QAAO;AAC5E,KAAI,CAAC,MAAM,SAAS,KAAK,IAAI,MAAM,WAAW,EAAG,QAAO;CACxD,MAAM,SAAS,MAAM,SAAS,KAAK,GAAG,IAAI,MAAM,SAAS;AACzD,QAAO;EACN,GAAG;EACH,GAAG,MAAM,KAAK,EAAE,QAAQ,QAAQ,CAAC,CAAC,KAAK,IAAI;EAC3C,GAAG;EACH,CAAC,KAAK,SAAS,OAAO,SAAS,MAAM,GAAG,CAAC;;;;;AClP3C,MAAM,yBAAyB,MAAM;AACrC,MAAM,kBAAkB;AACxB,MAAM,cAAc;AACpB,MAAM,sBAAsB;AAC5B,eAAe,qBAAqB,OAAO,SAAS;CACnD,MAAM,WAAW,KAAK,KAAK,IAAI,QAAQ,kBAAkB,qBAAqB;CAC9E,MAAM,EAAE,aAAa;AACrB,KAAI,CAAC,SAAS,QAAQ,CAAC,SAAS,IAAK,QAAO,kBAAkB,mCAAmC,mDAAmD;AACpJ,KAAI,SAAS,iBAAiB,QAAQ,MAAM,SAAS,KAAK,EAAG,QAAO,gBAAgB,MAAM,KAAK;CAC/F,MAAM,UAAU,cAAc,SAAS,KAAK;CAC5C,MAAM,eAAe,WAAW,SAAS,QAAQ,SAAS,SAAS,OAAO,SAAS,OAAO,KAAK;AAC/F,KAAI,SAAS,QAAQ,CAAC,QAAS,QAAO,kBAAkB,oBAAoB,4CAA4C;AACxH,KAAI,SAAS;EACZ,MAAM,WAAW,qBAAqB,QAAQ;AAC9C,MAAI,CAAC,SAAS,QAAS,QAAO;AAC9B,MAAI,SAAS,UAAU,SAAS,SAAU,QAAO,kBAAkB,qBAAqB,+DAA+D;;CAExJ,IAAI;AACJ,MAAK,MAAM,SAAS,MAAM,kBAAkB,EAAE,EAAE;EAC/C,MAAM,kBAAkB,0BAA0B,MAAM;AACxD,MAAI,CAAC,mBAAmB,CAAC,QAAS;EAClC,MAAM,WAAW,yBAAyB,iBAAiB,MAAM,QAAQ,QAAQ;AACjF,MAAI,CAAC,SAAS,SAAS;AACtB,eAAY,SAAS;AACrB;;EAED,MAAM,iBAAiB,eAAe,SAAS,SAAS;AACxD,MAAI,CAAC,eAAgB,QAAO,UAAU;EACtC,MAAM,SAAS,MAAM,eAAe,kBAAkB,SAAS,OAAO,SAAS,UAAU,kBAAkB,gBAAgB,aAAa,EAAE,aAAa;AACvJ,MAAI,OAAO,QAAS,QAAO;AAC3B,cAAY,OAAO;;AAEpB,KAAI,SAAS;EACZ,MAAM,oBAAoB,eAAe,SAAS,SAAS;AAC3D,MAAI,CAAC,kBAAmB,QAAO,UAAU;EACzC,MAAM,MAAM,MAAM,cAAc;GAC/B,SAAS;GACT,OAAO,MAAM;GACb,GAAG,MAAM,4BAA4B,MAAM,OAAO,KAAK,kBAAkB;AAC1E,MAAI,IAAI,SAAS;GAChB,MAAM,MAAM,QAAQ,IAAI,OAAO,MAAM,OAAO,KAAK,QAAQ;AACzD,OAAI,IAAI,SAAS;IAChB,MAAM,iBAAiB,eAAe,SAAS,SAAS;AACxD,QAAI,CAAC,eAAgB,QAAO,UAAU;IACtC,MAAM,SAAS,MAAM,eAAe,QAAQ,IAAI,OAAO,SAAS,UAAU,kBAAkB,gBAAgB,aAAa,EAAE,aAAa;AACxI,QAAI,OAAO,QAAS,QAAO;AAC3B,gBAAY,OAAO;SACb,aAAY,IAAI;QACjB,aAAY,IAAI;;AAExB,KAAI,SAAS,KAAK;EACjB,MAAM,iBAAiB,eAAe,SAAS,SAAS;AACxD,MAAI,CAAC,eAAgB,QAAO,UAAU;EACtC,MAAM,SAAS,MAAM,eAAe,OAAO,SAAS,KAAK,SAAS,UAAU,kBAAkB,gBAAgB,aAAa,EAAE,aAAa;AAC1I,MAAI,OAAO,QAAS,QAAO;AAC3B,cAAY,OAAO;;AAEpB,QAAO,YAAY;EAClB,SAAS;EACT,OAAO;EACP,GAAG,kBAAkB,gBAAgB,6CAA6C;;AAEpF,SAAS,yBAAyB,iBAAiB,QAAQ,SAAS;AACnE,KAAI;EACH,MAAM,WAAW,IAAI,IAAI,gBAAgB;AACzC,MAAI,SAAS,aAAa,YAAY,SAAS,YAAY,SAAS,YAAY,SAAS,aAAa,OAAO,SAAS,UAAU,SAAS,KAAM,OAAM,IAAI,OAAO;EAChK,MAAM,WAAW;GAChB;GACA,OAAO;GACP,OAAO;GACP,OAAO;GACP,OAAO;GACP;GACA;AACD,MAAI,CAAC,YAAY,KAAK,OAAO,IAAI,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,SAAS,MAAM,YAAY,CAAC,kBAAkB,QAAQ,CAAC,CAAE,OAAM,IAAI,OAAO;AAC7I,SAAO;GACN,SAAS;GACT,OAAO,IAAI,IAAI,SAAS,KAAK,IAAI,EAAE,SAAS;GAC5C;SACM;AACP,SAAO,kBAAkB,eAAe,oDAAoD;;;AAG9F,SAAS,0BAA0B,iBAAiB,QAAQ,QAAQ,SAAS;CAC5E,MAAM,MAAM,yBAAyB,iBAAiB,QAAQ,QAAQ;AACtE,KAAI,CAAC,IAAI,QAAS,QAAO;CACzB,MAAM,MAAM,IAAI,IAAI,IAAI,MAAM;AAC9B,KAAI,WAAW,QAAQ,SAAS,IAAI;AACpC,QAAO;EACN,SAAS;EACT,OAAO;EACP;;AAEF,eAAe,4BAA4B,cAAc,SAAS;CACjE,MAAM,cAAc,eAAe,aAAa;AAChD,KAAI,CAAC,YAAa,QAAO,kBAAkB,yBAAyB,sCAAsC;CAC1G,MAAM,UAAU,MAAM,sBAAsB,aAAa;EACxD,GAAG;EACH,UAAU;EACV,CAAC;AACF,KAAI,CAAC,QAAQ,QAAS,QAAO,kBAAkB,yBAAyB,mDAAmD;CAC3H,IAAI;AACJ,KAAI;AACH,aAAW,KAAK,MAAM,IAAI,aAAa,CAAC,OAAO,QAAQ,MAAM,MAAM,CAAC;SAC7D;AACP,SAAO,kBAAkB,yBAAyB,2CAA2C;;AAE9F,KAAI,CAAC,SAAS,SAAS,IAAI,SAAS,OAAO,gBAAgB,CAAC,MAAM,QAAQ,SAAS,QAAQ,CAAE,QAAO,kBAAkB,yBAAyB,uDAAuD;CACtM,MAAM,UAAU,SAAS,QAAQ,MAAM,UAAU,SAAS,MAAM,KAAK,MAAM,OAAO,GAAG,aAAa,iBAAiB,MAAM,OAAO,mBAAmB,MAAM,SAAS,+BAA+B,OAAO,MAAM,oBAAoB,SAAS;AAC3O,KAAI,CAAC,SAAS,QAAQ,IAAI,OAAO,QAAQ,oBAAoB,SAAU,QAAO,kBAAkB,yBAAyB,uDAAuD;AAChL,KAAI;EACH,MAAM,WAAW,IAAI,IAAI,QAAQ,gBAAgB;AACjD,MAAI,EAAE,QAAQ,uBAAuB,QAAQ,SAAS,aAAa,YAAY,SAAS,aAAa,eAAe,SAAS,aAAa,iBAAiB,SAAS,aAAa,YAAY,SAAS,YAAY,SAAS,SAAU,OAAM,IAAI,OAAO;AACtP,SAAO;GACN,SAAS;GACT,OAAO,SAAS;GAChB;SACM;AACP,SAAO,kBAAkB,yBAAyB,uDAAuD;;;AAG3G,eAAe,eAAe,QAAQ,KAAK,UAAU,SAAS,cAAc;CAC3E,MAAM,UAAU,MAAM,sBAAsB,KAAK,QAAQ;AACzD,KAAI,CAAC,QAAQ,QAAS,QAAO,gBAAgB,QAAQ,MAAM,SAAS,2BAA2B,kBAAkB,0BAA0B,qEAAqE,GAAG;CACnN,MAAM,WAAW,MAAM,gBAAgB,QAAQ,MAAM,OAAO,SAAS;AACrE,KAAI,CAAC,SAAS,QAAS,QAAO;CAC9B,MAAM,cAAc,QAAQ,MAAM,QAAQ,IAAI,eAAe,EAAE,MAAM,KAAK,EAAE,CAAC,IAAI,MAAM;AACvF,KAAI,iBAAiB,QAAQ,MAAM,MAAM,eAAe,aAAa,QAAQ,gBAAgB,KAAK,KAAK,gBAAgB,aAAa,UAAW,QAAO,kBAAkB,0BAA0B,gEAAgE;AAClQ,QAAO;EACN,SAAS;EACT,OAAO;GACN,OAAO,QAAQ,MAAM;GACrB;GACA,KAAK,QAAQ,MAAM;GACnB;EACD;;AAEF,SAAS,kBAAkB,SAAS,cAAc;AACjD,KAAI,CAAC,aAAc,QAAO;AAC1B,QAAO;EACN,GAAG;EACH,UAAU,KAAK,IAAI,QAAQ,YAAY,qBAAqB,UAAU,aAAa,KAAK;EACxF;;AAEF,SAAS,QAAQ,aAAa,cAAc,KAAK;AAChD,KAAI;EACH,MAAM,MAAM,IAAI,IAAI,kCAAkC,YAAY;AAClE,MAAI,aAAa,IAAI,OAAO,aAAa;AACzC,MAAI,aAAa,IAAI,OAAO,IAAI;AAChC,SAAO;GACN,SAAS;GACT,OAAO;GACP;SACM;AACP,SAAO,kBAAkB,yBAAyB,yCAAyC;;;AAG7F,SAAS,eAAe,KAAK;AAC5B,KAAI,gBAAgB,KAAK,IAAI,CAAE,QAAO,yBAAyB,mBAAmB,IAAI;AACtF,KAAI,CAAC,IAAI,WAAW,WAAW,CAAE,QAAO;AACxC,KAAI;EACH,MAAM,QAAQ,IAAI,MAAM,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,mBAAmB;EAC7D,MAAM,OAAO,MAAM,OAAO;AAC1B,MAAI,CAAC,QAAQ,MAAM,MAAM,SAAS,SAAS,MAAM,SAAS,OAAO,SAAS,KAAK,CAAE,QAAO;EACxF,MAAM,OAAO,MAAM,WAAW,IAAI,0BAA0B,IAAI,MAAM,KAAK,IAAI,CAAC;AAChF,SAAO,IAAI,IAAI,MAAM,WAAW,OAAO,CAAC;SACjC;AACP,SAAO;;;AAGT,SAAS,gBAAgB,MAAM;AAC9B,QAAO,kBAAkB,2BAA2B,0BAA0B,uBAAuB,KAAK,CAAC;;AAE5G,SAAS,eAAe,SAAS,UAAU;CAC1C,MAAM,YAAY,WAAW,KAAK,KAAK;AACvC,KAAI,aAAa,EAAG,QAAO;AAC3B,QAAO;EACN,GAAG;EACH,gBAAgB;EAChB;;AAEF,SAAS,WAAW;AACnB,QAAO,kBAAkB,oBAAoB,iDAAiD;;AAE/F,SAAS,SAAS,OAAO;AACxB,QAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,MAAM;;AAE5E,SAAS,cAAc,MAAM;AAC5B,KAAI,CAAC,QAAQ,EAAE,SAAS,SAAS,OAAO,KAAK,KAAK,UAAU,SAAU,QAAO;AAC7E,QAAO,KAAK,IAAI;;AAEjB,SAAS,0BAA0B,OAAO;AACzC,KAAI,CAAC,SAAS,MAAM,IAAI,MAAM,UAAU,8BAA+B,QAAO;AAC9E,QAAO,OAAO,MAAM,oBAAoB,WAAW,MAAM,kBAAkB;;AAE5E,SAAS,kBAAkB,OAAO;AACjC,KAAI,MAAM,WAAW,KAAK,oBAAoB,KAAK,MAAM,CAAE,QAAO;AAClE,MAAK,MAAM,aAAa,OAAO;EAC9B,MAAM,YAAY,UAAU,YAAY,EAAE;AAC1C,MAAI,cAAc,KAAK,MAAM,aAAa,MAAM,cAAc,KAAM,QAAO;;AAE5E,QAAO;;;;;AC3MR,MAAM,eAAe;AACrB,MAAM,sBAAsB,IAAI,IAAI;CACnC;CACA;CACA;CACA;CACA,CAAC;AAsBF,IAAI,mBAAqD;AAUzD,SAAS,oBAAoB,UAA2B;CACvD,MAAM,aAAa,SAAS,aAAa,CAAC,QAAQ,cAAc,GAAG;AACnE,QACC,oBAAoB,IAAI,WAAW,IACnC,WAAW,SAAS,aAAa,IACjC,eAAe,eACf,eAAe,SACf,eAAe,WACf,WAAW,WAAW,cAAc,IACpC,WAAW,WAAW,eAAe;;AAIvC,eAAe,0BAA0B,WAGtC;CACF,IAAI;AACJ,KAAI;AACH,QAAM,IAAI,IAAI,UAAU;SACjB;AACP,QAAM,IAAI,MAAM,yBAAyB,YAAY;;AAEtD,KAAI,IAAI,aAAa,YAAY,IAAI,aAAa,QACjD,OAAM,IAAI,MAAM,sCAAsC,IAAI,WAAW;AAEtE,KAAI,IAAI,YAAY,IAAI,SACvB,OAAM,IAAI,MAAM,qDAAqD;CAItE,MAAM,WAAW,kBADG,IAAI,SAAS,aAAa,CAAC,QAAQ,cAAc,GAAG,CACzB;CAC/C,MAAM,YAAY,oBAAoB,SAAS;AAE/C,KAAI,CAAC,OAAO,KAAK,IAAI,KAAK;AACzB,MAAI,IAAI,aAAa,QACpB,OAAM,IAAI,MAAM,8BAA8B;AAE/C,MAAI,UACH,OAAM,IAAI,MAAM,qCAAqC,WAAW;YAEvD,IAAI,aAAa,WAAW,CAAC,UACvC,OAAM,IAAI,MAAM,uEAAuE;AAGxF,KAAI,UACH,QAAO;EAAE;EAAK,WAAW,EAAE;EAAE;AAG9B,KAAI;AACH,SAAO,MAAM,oCAAoC,IAAI,KAAK;UAClD,OAAO;AACf,MAAI,iBAAiB,UACpB,OAAM,IAAI,MAAM,0BAA0B,MAAM,WAAW,EAAE,OAAO,OAAO,CAAC;AAE7E,QAAM;;;AAQR,eAAsB,yBACrB,WACA,SACoB;AACpB,KAAI,CAAC,OAAO,cAAc,QAAQ,iBAAiB,IAAI,QAAQ,mBAAmB,EACjF,OAAM,IAAI,UAAU,8CAA8C;CAEnE,MAAM,SAAS,MAAM,0BAA0B,UAAU;AACzD,KAAI,OAAO,UAAU,WAAW,EAC/B,QAAO,WAAW,MAAM,OAAO,KAAK;EAAE,UAAU;EAAU,QAAQ,QAAQ;EAAQ,CAAC;CAIpF,MAAM,SAAS,OADG,oBAAqB,MAAM,wCAAwC,EACtD,MAAM;EACpC,KAAK,OAAO;EACZ,kBAAkB,OAAO;EACzB,QAAQ,QAAQ;EAChB,kBAAkB,QAAQ;EAC1B,CAAC;AACF,KAAI,OAAO,qBAAqB,QAAQ,CAAC,OAAO,UAAU,SAAS,OAAO,iBAAiB,EAAE;AAC5F,QAAM,OAAO,SAAS,MAAM,QAAQ,CAAC,YAAY,OAAU;AAC3D,QAAM,IAAI,MAAM,0EAA0E;;AAE3F,QAAO,OAAO;;AAGf,eAAe,yCAA6E;AAC3F,QAAO,4BAA4B,GAChC,wCAAwC,GACxC,qCAAqC;;AAGzC,SAAgB,uCACf,cAAuC,WAAW,OACtB;AAC5B,QAAO,EACN,MAAM,MAAM,OAAO;AAMlB,SAAO;GACN,UAAU,kBANM,MAAM,YAAY,MAAM,KAAK;IAC7C,UAAU;IACV,QAAQ,MAAM;IACd,SAAS,EAAE,mBAAmB,YAAY;IAC1C,CAAC,EAEqC,MAAM,iBAAiB;GAC7D,kBAAkB;GAClB;IAEF;;AAGF,SAAS,6BAAsC;AAC9C,QACC,OAAO,cAAc,eACrB,OAAO,UAAU,cAAc,YAC/B,UAAU,UAAU,SAAS,qBAAqB;;AAIpD,SAAS,kBAAkB,UAAoB,UAA4B;AAC1E,KAAI,CAAC,SAAS,KAAM,QAAO;CAC3B,IAAI,WAAW;CACf,MAAM,OAAO,SAAS,KAAK,YAC1B,IAAI,gBAAwC,EAC3C,UAAU,OAAO,YAAY;AAC5B,cAAY,MAAM;AAClB,MAAI,WAAW,UAAU;AACxB,cAAW,sBAAM,IAAI,WAAW,oDAAoD,CAAC;AACrF;;AAED,aAAW,QAAQ,MAAM;IAE1B,CAAC,CACF;AACD,QAAO,IAAI,SAAS,MAAM;EACzB,QAAQ,SAAS;EACjB,YAAY,SAAS;EACrB,SAAS,SAAS;EAClB,CAAC;;AAQH,eAAsB,oCACrB,aACqC;CACrC,MAAM,UAAU,gBAAgB,MAAM,OAAO,eAAe;AAC5D,QAAO,EACN,MAAM,MAAM,OAAO;EAClB,IAAI;AACJ,OAAK,MAAM,WAAW,MAAM,iBAC3B,KAAI;AAiEH,UAAO;IAAE,UAhEQ,MAAM,IAAI,SAAmB,SAAS,WAAW;KACjE,MAAM,SAAuB,EAAE;KAC/B,IAAI,QAAQ;KACZ,MAAM,MAAM,QACX;MACC,UAAU;MACV,UAAU,kBAAkB,MAAM,IAAI,SAAS;MAC/C,MAAM,eAAe,MAAM,IAAI;MAC/B,MAAM,GAAG,MAAM,IAAI,WAAW,MAAM,IAAI;MACxC,QAAQ;MAGR,OAAO;MACP,SAAS;OACR,MAAM,MAAM,IAAI;OAChB,YAAY;OACZ,mBAAmB;OACnB;MACD,SAAS,WAAW,SAAS,aAAa;OACzC,MAAM,SAAS,QAAQ,SAAS,IAAI,GAAG,IAAI;AAE3C,WAAI,QAAQ,IAAK,UAAS,MAAM,CAAC;QAAE;QAAS;QAAQ,CAAC,CAAC;WACjD,UAAS,MAAM,SAAS,OAAO;;MAErC,QAAQ,MAAM;MACd,GACA,aAAa;MACb,MAAM,kBAAkB,SAAS,QAAQ;AACzC,UAAI,mBAAmB,gBAAgB,aAAa,KAAK,YAAY;AACpE,gBAAS,wBACR,IAAI,MAAM,6DAA6D,CACvE;AACD;;AAED,eAAS,GAAG,SAAS,UAAsB;AAC1C,gBAAS,MAAM;AACf,WAAI,QAAQ,MAAM,kBAAkB;AACnC,iBAAS,wBACR,IAAI,WAAW,oDAAoD,CACnE;AACD;;AAED,cAAO,KAAK,IAAI,WAAW,MAAM,CAAC;QACjC;AACF,eAAS,KAAK,SAAS,OAAO;AAC9B,eAAS,KAAK,aAAa;OAC1B,MAAM,QAAQ,YAAY,QAAQ,MAAM;OACxC,MAAM,UAAU,IAAI,SAAS;AAC7B,YAAK,IAAI,QAAQ,GAAG,QAAQ,SAAS,WAAW,QAAQ,SAAS,EAChE,SAAQ,OAAO,SAAS,WAAW,QAAQ,SAAS,WAAW,QAAQ,GAAG;AAE3E,eACC,4BAA4B;QAC3B,QAAQ,SAAS,cAAc;QAC/B;QACA,MAAM;QACN,CAAC,CACF;QACA;OAEH;AACD,SAAI,KAAK,SAAS,OAAO;AACzB,SAAI,KAAK;MACR;IACiB,kBAAkB;IAAS;WACtC,OAAO;AACf,OAAI,MAAM,OAAO,QAAS,OAAM;AAChC,eAAY;;AAGd,QAAM,IAAI,MAAM,wEAAwE,EACvF,OAAO,WACP,CAAC;IAEH;;AASF,SAAS,4BAA4B,QAAsC;CAC1E,MAAM,cAAc,CAAC;EAAC;EAAK;EAAK;EAAI,CAAC,SAAS,OAAO,OAAO;CAC5D,IAAI,OAA2B;AAC/B,KAAI,aAAa;AAChB,SAAO,IAAI,YAAY,OAAO,KAAK,WAAW;AAC9C,MAAI,WAAW,KAAK,CAAC,IAAI,OAAO,KAAK;;AAEtC,QAAO,IAAI,SAAS,MAAM;EACzB,QAAQ,OAAO;EACf,SAAS,OAAO;EAChB,CAAC;;AAGH,SAAS,YAAY,QAA+B,OAA2B;CAC9E,MAAM,QAAQ,IAAI,WAAW,MAAM;CACnC,IAAI,SAAS;AACb,MAAK,MAAM,SAAS,QAAQ;AAC3B,QAAM,IAAI,OAAO,OAAO;AACxB,YAAU,MAAM;;AAEjB,QAAO;;AAGR,SAAS,eAAe,KAAkB;CACzC,MAAM,OAAO,IAAI,SAAS,KAAK,MAAM,OAAO,IAAI,KAAK;AACrD,KAAI,CAAC,OAAO,cAAc,KAAK,IAAI,OAAO,KAAK,OAAO,MACrD,OAAM,IAAI,UAAU,0CAA0C;AAE/D,QAAO;;AAGR,SAAS,kBAAkB,UAA0B;AACpD,QAAO,SAAS,WAAW,IAAI,IAAI,SAAS,SAAS,IAAI,GAAG,SAAS,MAAM,GAAG,GAAG,GAAG"}

package/dist/artifacts-D-O-qj9C.mjs

@@ -1,307 +0,0 @@
-import { d as __exportAll } from "./runner-wqt4BrIW.mjs";
-import { n as isMissingTableError } from "./db-errors-CBD5yMro.mjs";
-import { t as after } from "./after-PcEvMY_6.mjs";
-import { n as chunks, t as SQL_BATCH_SIZE } from "./chunks-Dr5Vr0zA.mjs";
-import { t as withTransaction } from "./transaction-BVYIo_yu.mjs";
-import { t as RedirectRepository } from "./redirect-B39kTQ_0.mjs";
-import { n as invalidateRedirectCache } from "./cache-x0z8t_m9.mjs";
-
-//#region src/redirects/artifacts.ts
-var artifacts_exports = /* @__PURE__ */ __exportAll({
-	createRedirectSource: () => createRedirectSource,
-	publishRedirectArtifacts: () => publishRedirectArtifacts,
-	publishRedirectChanges: () => publishRedirectChanges
-});
-const ARTIFACT_TARGET_BYTES = 64 * 1024;
-const GENERATION_PREFIX = "emdash-redirects-v1";
-const REPAIR_LEASE_MS = 6e4;
-/** Three bound parameters per link row keeps each insert within D1's limit. */
-const LINK_BATCH_SIZE = 30;
-const encoder = new TextEncoder();
-async function sha256Hex(value) {
-	const digest = await crypto.subtle.digest("SHA-256", encoder.encode(value));
-	return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
-}
-function fnv1a(value) {
-	let hash = 2166136261;
-	for (let i = 0; i < value.length; i++) {
-		hash ^= value.charCodeAt(i);
-		hash = Math.imul(hash, 16777619);
-	}
-	return hash >>> 0;
-}
-function toEntry(rule) {
-	return [
-		rule.id,
-		rule.source,
-		rule.destination,
-		rule.type
-	];
-}
-function entryBytes(entry) {
-	return encoder.encode(JSON.stringify(entry)).byteLength + 1;
-}
-async function createArtifact(kind, entries) {
-	const payload = JSON.stringify(entries);
-	return {
-		digest: await sha256Hex(`${kind}\n${payload}`),
-		kind,
-		payload
-	};
-}
-function generationId(digests) {
-	return sha256Hex([GENERATION_PREFIX, ...digests].join("\n"));
-}
-/** Splits enabled rows, in precedence order, into exact and pattern rules. */
-function toRuleSet(rows, version) {
-	const exact = [];
-	const patterns = [];
-	for (const { isPattern, ...rule } of rows) (isPattern ? patterns : exact).push(rule);
-	return {
-		version,
-		exact,
-		patterns
-	};
-}
-/**
-* Builds the artifacts for a rule set. Exact rules keep the last rule per
-* source, matching lookup semantics, and are sorted so the shards are
-* deterministic. Pattern rules keep precedence order across chunks.
-*/
-async function buildArtifacts(rules) {
-	const bySource = /* @__PURE__ */ new Map();
-	for (const rule of rules.exact) bySource.set(rule.source, toEntry(rule));
-	const exact = [...bySource.values()].toSorted((a, b) => a[1] < b[1] ? -1 : a[1] > b[1] ? 1 : 0);
-	const exactBytes = exact.reduce((total, entry) => total + entryBytes(entry), 0);
-	const shardCount = Math.max(1, Math.ceil(exactBytes / ARTIFACT_TARGET_BYTES));
-	const shards = Array.from({ length: shardCount }, () => []);
-	for (const entry of exact) shards[fnv1a(entry[1]) % shardCount].push(entry);
-	const artifacts = [];
-	for (const shard of shards) if (shard.length > 0) artifacts.push(await createArtifact("exact", shard));
-	let chunk = [];
-	let chunkBytes = 0;
-	for (const rule of rules.patterns) {
-		const entry = toEntry(rule);
-		const bytes = entryBytes(entry);
-		if (chunk.length > 0 && chunkBytes + bytes > ARTIFACT_TARGET_BYTES) {
-			artifacts.push(await createArtifact("pattern", chunk));
-			chunk = [];
-			chunkBytes = 0;
-		}
-		chunk.push(entry);
-		chunkBytes += bytes;
-	}
-	if (chunk.length > 0) artifacts.push(await createArtifact("pattern", chunk));
-	return {
-		generation: await generationId(artifacts.map((artifact) => artifact.digest)),
-		artifacts
-	};
-}
-/**
-* Publishes the enabled redirect rules as the active generation.
-*
-* The revision is read before the rules, so the published generation holds
-* at least the changes up to the revision it is labelled with. A publish at
-* the active revision replaces the active generation, which repairs a damaged
-* one; losing the compare-and-set to a newer revision leaves that publish
-* active.
-*/
-async function publishRedirectArtifacts(db) {
-	const state = await db.selectFrom("_emdash_redirect_state").select("revision").where("id", "=", 1).executeTakeFirst();
-	if (!state) throw new Error("Redirect state row is missing");
-	const revision = Number(state.revision);
-	const { generation, artifacts } = await buildArtifacts(toRuleSet((await db.selectFrom("_emdash_redirects").select([
-		"id",
-		"source",
-		"destination",
-		"type",
-		"is_pattern"
-	]).where("enabled", "=", 1).orderBy("created_at", (order) => order.asc().nullsFirst()).orderBy("id", "asc").execute()).map((row) => ({
-		id: row.id,
-		source: row.source,
-		destination: row.destination,
-		type: Number(row.type),
-		isPattern: Number(row.is_pattern) === 1
-	})), null));
-	await withTransaction(db, async (trx) => {
-		const digests = [...new Set(artifacts.map((artifact) => artifact.digest))];
-		const stored = /* @__PURE__ */ new Map();
-		for (const batch of chunks(digests, SQL_BATCH_SIZE)) {
-			const found = await trx.selectFrom("_emdash_redirect_artifacts").select([
-				"digest",
-				"kind",
-				"payload"
-			]).where("digest", "in", batch).execute();
-			for (const row of found) stored.set(row.digest, `${row.kind}\n${row.payload}`);
-		}
-		for (const artifact of artifacts) {
-			const content = `${artifact.kind}\n${artifact.payload}`;
-			if (stored.get(artifact.digest) === content) continue;
-			stored.set(artifact.digest, content);
-			await trx.insertInto("_emdash_redirect_artifacts").values(artifact).onConflict((conflict) => conflict.column("digest").doUpdateSet({
-				kind: artifact.kind,
-				payload: artifact.payload
-			})).execute();
-		}
-		const links = artifacts.map((artifact, position) => ({
-			generation,
-			position,
-			digest: artifact.digest
-		}));
-		for (const batch of chunks(links, LINK_BATCH_SIZE)) await trx.insertInto("_emdash_redirect_generation_artifacts").values(batch).onConflict((conflict) => conflict.columns(["generation", "position"]).doUpdateSet((eb) => ({ digest: eb.ref("excluded.digest") }))).execute();
-		await trx.deleteFrom("_emdash_redirect_generation_artifacts").where("generation", "=", generation).where("position", ">=", links.length).execute();
-		const activated = await trx.updateTable("_emdash_redirect_state").set({
-			generation,
-			generation_revision: revision
-		}).where("id", "=", 1).where("generation_revision", "<=", revision).executeTakeFirst();
-		if (BigInt(activated.numUpdatedRows) === 0n) return;
-		await trx.deleteFrom("_emdash_redirect_generation_artifacts").where((eb) => eb("generation", "<>", eb.selectFrom("_emdash_redirect_state").select("generation").where("id", "=", 1))).execute();
-		await trx.deleteFrom("_emdash_redirect_artifacts").where(({ exists, not, selectFrom }) => not(exists(selectFrom("_emdash_redirect_generation_artifacts").select("_emdash_redirect_generation_artifacts.digest").whereRef("_emdash_redirect_generation_artifacts.digest", "=", "_emdash_redirect_artifacts.digest")))).execute();
-	});
-}
-/**
-* Publishes after a redirect write, then invalidates this isolate's cache. A
-* failed publish is logged rather than failing the write: readers fall back
-* to the rules table and repair the stale generation.
-*/
-async function publishRedirectChanges(db) {
-	try {
-		await publishRedirectArtifacts(db);
-	} catch (error) {
-		console.error("[emdash:redirects] publishing redirect artifacts failed:", error);
-	}
-	invalidateRedirectCache();
-}
-function isArtifactEntry(value) {
-	return Array.isArray(value) && value.length === 4 && typeof value[0] === "string" && typeof value[1] === "string" && typeof value[2] === "string" && typeof value[3] === "number";
-}
-function parseEntries(payload) {
-	try {
-		const parsed = JSON.parse(payload);
-		return Array.isArray(parsed) && parsed.every(isArtifactEntry) ? parsed : null;
-	} catch {
-		return null;
-	}
-}
-/**
-* Loads and verifies the active generation. Returns null when nothing is
-* published, the generation is stale, or any artifact is missing, altered, or
-* out of place.
-*/
-async function loadPublishedRedirects(db) {
-	const rows = await db.selectFrom("_emdash_redirect_state as state").leftJoin("_emdash_redirect_generation_artifacts as link", "link.generation", "state.generation").leftJoin("_emdash_redirect_artifacts as artifact", "artifact.digest", "link.digest").select([
-		"state.revision",
-		"state.generation",
-		"state.generation_revision",
-		"link.position",
-		"link.digest",
-		"artifact.kind",
-		"artifact.payload"
-	]).where("state.id", "=", 1).orderBy("link.position", "asc").execute();
-	const state = rows[0];
-	if (!state?.generation) return null;
-	if (Number(state.revision) > Number(state.generation_revision)) return null;
-	const exact = [];
-	const patterns = [];
-	const digests = [];
-	const links = rows.filter((row) => row.position !== null);
-	for (const [index, link] of links.entries()) {
-		if (Number(link.position) !== index || !link.digest || link.payload === null || link.kind !== "exact" && link.kind !== "pattern") return null;
-		if (await sha256Hex(`${link.kind}\n${link.payload}`) !== link.digest) return null;
-		const entries = parseEntries(link.payload);
-		if (!entries) return null;
-		const target = link.kind === "exact" ? exact : patterns;
-		for (const [id, source, destination, type] of entries) target.push({
-			id,
-			source,
-			destination,
-			type
-		});
-		digests.push(link.digest);
-	}
-	if (await generationId(digests) !== state.generation) return null;
-	return {
-		version: state.generation,
-		exact,
-		patterns
-	};
-}
-async function loadRulesTable(db) {
-	return toRuleSet((await new RedirectRepository(db).findAllEnabled()).map(({ id, source, destination, type, isPattern }) => ({
-		id,
-		source,
-		destination,
-		type,
-		isPattern
-	})), null);
-}
-const REPAIR_STATE_KEY = Symbol.for("emdash:redirect-artifact-repair");
-const g = globalThis;
-const repairState = g[REPAIR_STATE_KEY] ?? (() => {
-	const state = { runningUntil: 0 };
-	g[REPAIR_STATE_KEY] = state;
-	return state;
-})();
-/**
-* Republishes the artifacts under a database lease so one isolate repairs a
-* stale or damaged generation while the others keep serving.
-*/
-async function repairRedirectArtifacts(db) {
-	const now = Date.now();
-	const expiresAt = now + REPAIR_LEASE_MS;
-	const lease = await db.updateTable("_emdash_redirect_state").set({ repair_expires_at: expiresAt }).where("id", "=", 1).where("repair_expires_at", "<", now).executeTakeFirst();
-	if (BigInt(lease.numUpdatedRows) === 0n) return;
-	try {
-		await publishRedirectArtifacts(db);
-	} finally {
-		await db.updateTable("_emdash_redirect_state").set({ repair_expires_at: 0 }).where("id", "=", 1).where("repair_expires_at", "=", expiresAt).execute();
-	}
-}
-function scheduleRedirectRepair(db) {
-	const now = Date.now();
-	if (repairState.runningUntil > now) return;
-	const runningUntil = now + REPAIR_LEASE_MS;
-	repairState.runningUntil = runningUntil;
-	after(async () => {
-		try {
-			await repairRedirectArtifacts(db);
-		} catch (error) {
-			console.error("[emdash:redirects] repairing redirect artifacts failed:", error);
-		} finally {
-			if (repairState.runningUntil === runningUntil) repairState.runningUntil = 0;
-		}
-	});
-}
-/**
-* The rule source the middleware caches: the published generation when it is
-* current and verifies, otherwise the rules table. Before the artifact tables exist the
-* rules table is read directly.
-*/
-function createRedirectSource(db) {
-	return {
-		async load() {
-			let published;
-			try {
-				published = await loadPublishedRedirects(db);
-			} catch (error) {
-				if (isMissingTableError(error)) return loadRulesTable(db);
-				throw error;
-			}
-			if (published) return published;
-			scheduleRedirectRepair(db);
-			return loadRulesTable(db);
-		},
-		async isCurrent(version) {
-			const state = await db.selectFrom("_emdash_redirect_state").select([
-				"revision",
-				"generation",
-				"generation_revision"
-			]).where("id", "=", 1).executeTakeFirst();
-			return state?.generation === version && Number(state.revision) <= Number(state.generation_revision);
-		}
-	};
-}
-
-//#endregion
-export { createRedirectSource as n, publishRedirectChanges as r, artifacts_exports as t };
-//# sourceMappingURL=artifacts-D-O-qj9C.mjs.map

package/dist/artifacts-D-O-qj9C.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"artifacts-D-O-qj9C.mjs","names":[],"sources":["../src/redirects/artifacts.ts"],"sourcesContent":["/**\n * Published redirect artifacts.\n *\n * Enabled redirect rules are published as compact, content-addressed JSON\n * artifacts grouped into a generation. The middleware loads the active\n * generation in one query and afterwards only polls the small state row, so a\n * site with many redirects never rescans `_emdash_redirects` on the read path.\n *\n * Exact rules are sharded by a hash of their source and pattern rules are\n * chunked in precedence order, so a single rule change usually rewrites one\n * artifact. Writers bump `_emdash_redirect_state.revision` through triggers.\n * A generation that is stale or fails verification is never served: readers\n * fall back to the rules table and schedule a repair.\n */\n\nimport type { Kysely } from \"kysely\";\n\nimport { after } from \"../after.js\";\nimport { RedirectRepository } from \"../database/repositories/redirect.js\";\nimport { withTransaction } from \"../database/transaction.js\";\nimport type { Database } from \"../database/types.js\";\nimport { chunks, SQL_BATCH_SIZE } from \"../utils/chunks.js\";\nimport { isMissingTableError } from \"../utils/db-errors.js\";\nimport {\n\tinvalidateRedirectCache,\n\ttype RedirectRule,\n\ttype RedirectRuleSet,\n\ttype RedirectSource,\n} from \"./cache.js\";\n\ntype ArtifactKind = \"exact\" | \"pattern\";\ntype ArtifactEntry = [id: string, source: string, destination: string, type: number];\n\ninterface RedirectArtifact {\n\tdigest: string;\n\tkind: ArtifactKind;\n\tpayload: string;\n}\n\ninterface RuleRow {\n\tid: string;\n\tsource: string;\n\tdestination: string;\n\ttype: number;\n\tis_pattern: number;\n}\n\nconst ARTIFACT_TARGET_BYTES = 64 * 1024;\nconst GENERATION_PREFIX = \"emdash-redirects-v1\";\nconst REPAIR_LEASE_MS = 60_000;\n/** Three bound parameters per link row keeps each insert within D1's limit. */\nconst LINK_BATCH_SIZE = 30;\n\nconst encoder = new TextEncoder();\n\nasync function sha256Hex(value: string): Promise<string> {\n\tconst digest = await crypto.subtle.digest(\"SHA-256\", encoder.encode(value));\n\treturn Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction fnv1a(value: string): number {\n\tlet hash = 0x811c9dc5;\n\tfor (let i = 0; i < value.length; i++) {\n\t\thash ^= value.charCodeAt(i);\n\t\thash = Math.imul(hash, 0x01000193);\n\t}\n\treturn hash >>> 0;\n}\n\nfunction toEntry(rule: RedirectRule): ArtifactEntry {\n\treturn [rule.id, rule.source, rule.destination, rule.type];\n}\n\nfunction entryBytes(entry: ArtifactEntry): number {\n\treturn encoder.encode(JSON.stringify(entry)).byteLength + 1;\n}\n\nasync function createArtifact(kind: ArtifactKind, entries: ArtifactEntry[]) {\n\tconst payload = JSON.stringify(entries);\n\treturn { digest: await sha256Hex(`${kind}\\n${payload}`), kind, payload };\n}\n\nfunction generationId(digests: string[]): Promise<string> {\n\treturn sha256Hex([GENERATION_PREFIX, ...digests].join(\"\\n\"));\n}\n\n/** Splits enabled rows, in precedence order, into exact and pattern rules. */\nfunction toRuleSet(\n\trows: Array<RedirectRule & { isPattern: boolean }>,\n\tversion: string | null,\n): RedirectRuleSet {\n\tconst exact: RedirectRule[] = [];\n\tconst patterns: RedirectRule[] = [];\n\tfor (const { isPattern, ...rule } of rows) {\n\t\t(isPattern ? patterns : exact).push(rule);\n\t}\n\treturn { version, exact, patterns };\n}\n\n/**\n * Builds the artifacts for a rule set. Exact rules keep the last rule per\n * source, matching lookup semantics, and are sorted so the shards are\n * deterministic. Pattern rules keep precedence order across chunks.\n */\nasync function buildArtifacts(\n\trules: RedirectRuleSet,\n): Promise<{ generation: string; artifacts: RedirectArtifact[] }> {\n\tconst bySource = new Map<string, ArtifactEntry>();\n\tfor (const rule of rules.exact) bySource.set(rule.source, toEntry(rule));\n\tconst exact = [...bySource.values()].toSorted((a, b) => (a[1] < b[1] ? -1 : a[1] > b[1] ? 1 : 0));\n\tconst exactBytes = exact.reduce((total, entry) => total + entryBytes(entry), 0);\n\tconst shardCount = Math.max(1, Math.ceil(exactBytes / ARTIFACT_TARGET_BYTES));\n\tconst shards: ArtifactEntry[][] = Array.from({ length: shardCount }, () => []);\n\tfor (const entry of exact) shards[fnv1a(entry[1]) % shardCount].push(entry);\n\n\tconst artifacts: RedirectArtifact[] = [];\n\tfor (const shard of shards) {\n\t\tif (shard.length > 0) artifacts.push(await createArtifact(\"exact\", shard));\n\t}\n\n\tlet chunk: ArtifactEntry[] = [];\n\tlet chunkBytes = 0;\n\tfor (const rule of rules.patterns) {\n\t\tconst entry = toEntry(rule);\n\t\tconst bytes = entryBytes(entry);\n\t\tif (chunk.length > 0 && chunkBytes + bytes > ARTIFACT_TARGET_BYTES) {\n\t\t\tartifacts.push(await createArtifact(\"pattern\", chunk));\n\t\t\tchunk = [];\n\t\t\tchunkBytes = 0;\n\t\t}\n\t\tchunk.push(entry);\n\t\tchunkBytes += bytes;\n\t}\n\tif (chunk.length > 0) artifacts.push(await createArtifact(\"pattern\", chunk));\n\n\treturn {\n\t\tgeneration: await generationId(artifacts.map((artifact) => artifact.digest)),\n\t\tartifacts,\n\t};\n}\n\n/**\n * Publishes the enabled redirect rules as the active generation.\n *\n * The revision is read before the rules, so the published generation holds\n * at least the changes up to the revision it is labelled with. A publish at\n * the active revision replaces the active generation, which repairs a damaged\n * one; losing the compare-and-set to a newer revision leaves that publish\n * active.\n */\nexport async function publishRedirectArtifacts(db: Kysely<Database>): Promise<void> {\n\tconst state = await db\n\t\t.selectFrom(\"_emdash_redirect_state\")\n\t\t.select(\"revision\")\n\t\t.where(\"id\", \"=\", 1)\n\t\t.executeTakeFirst();\n\tif (!state) throw new Error(\"Redirect state row is missing\");\n\tconst revision = Number(state.revision);\n\n\tconst rows: RuleRow[] = await db\n\t\t.selectFrom(\"_emdash_redirects\")\n\t\t.select([\"id\", \"source\", \"destination\", \"type\", \"is_pattern\"])\n\t\t.where(\"enabled\", \"=\", 1)\n\t\t.orderBy(\"created_at\", (order) => order.asc().nullsFirst())\n\t\t.orderBy(\"id\", \"asc\")\n\t\t.execute();\n\tconst { generation, artifacts } = await buildArtifacts(\n\t\ttoRuleSet(\n\t\t\trows.map((row) => ({\n\t\t\t\tid: row.id,\n\t\t\t\tsource: row.source,\n\t\t\t\tdestination: row.destination,\n\t\t\t\ttype: Number(row.type),\n\t\t\t\tisPattern: Number(row.is_pattern) === 1,\n\t\t\t})),\n\t\t\tnull,\n\t\t),\n\t);\n\n\tawait withTransaction(db, async (trx) => {\n\t\tconst digests = [...new Set(artifacts.map((artifact) => artifact.digest))];\n\t\tconst stored = new Map<string, string>();\n\t\tfor (const batch of chunks(digests, SQL_BATCH_SIZE)) {\n\t\t\tconst found = await trx\n\t\t\t\t.selectFrom(\"_emdash_redirect_artifacts\")\n\t\t\t\t.select([\"digest\", \"kind\", \"payload\"])\n\t\t\t\t.where(\"digest\", \"in\", batch)\n\t\t\t\t.execute();\n\t\t\tfor (const row of found) stored.set(row.digest, `${row.kind}\\n${row.payload}`);\n\t\t}\n\t\tfor (const artifact of artifacts) {\n\t\t\tconst content = `${artifact.kind}\\n${artifact.payload}`;\n\t\t\tif (stored.get(artifact.digest) === content) continue;\n\t\t\tstored.set(artifact.digest, content);\n\t\t\t// A stored row that does not match its digest was damaged; rewrite it.\n\t\t\tawait trx\n\t\t\t\t.insertInto(\"_emdash_redirect_artifacts\")\n\t\t\t\t.values(artifact)\n\t\t\t\t.onConflict((conflict) =>\n\t\t\t\t\tconflict.column(\"digest\").doUpdateSet({ kind: artifact.kind, payload: artifact.payload }),\n\t\t\t\t)\n\t\t\t\t.execute();\n\t\t}\n\n\t\tconst links = artifacts.map((artifact, position) => ({\n\t\t\tgeneration,\n\t\t\tposition,\n\t\t\tdigest: artifact.digest,\n\t\t}));\n\t\tfor (const batch of chunks(links, LINK_BATCH_SIZE)) {\n\t\t\tawait trx\n\t\t\t\t.insertInto(\"_emdash_redirect_generation_artifacts\")\n\t\t\t\t.values(batch)\n\t\t\t\t.onConflict((conflict) =>\n\t\t\t\t\tconflict\n\t\t\t\t\t\t.columns([\"generation\", \"position\"])\n\t\t\t\t\t\t.doUpdateSet((eb) => ({ digest: eb.ref(\"excluded.digest\") })),\n\t\t\t\t)\n\t\t\t\t.execute();\n\t\t}\n\t\tawait trx\n\t\t\t.deleteFrom(\"_emdash_redirect_generation_artifacts\")\n\t\t\t.where(\"generation\", \"=\", generation)\n\t\t\t.where(\"position\", \">=\", links.length)\n\t\t\t.execute();\n\n\t\tconst activated = await trx\n\t\t\t.updateTable(\"_emdash_redirect_state\")\n\t\t\t.set({ generation, generation_revision: revision })\n\t\t\t.where(\"id\", \"=\", 1)\n\t\t\t.where(\"generation_revision\", \"<=\", revision)\n\t\t\t.executeTakeFirst();\n\t\tif (BigInt(activated.numUpdatedRows) === 0n) return;\n\n\t\t// Another publish may have activated since this one; keep the active generation.\n\t\tawait trx\n\t\t\t.deleteFrom(\"_emdash_redirect_generation_artifacts\")\n\t\t\t.where((eb) =>\n\t\t\t\teb(\n\t\t\t\t\t\"generation\",\n\t\t\t\t\t\"<>\",\n\t\t\t\t\teb.selectFrom(\"_emdash_redirect_state\").select(\"generation\").where(\"id\", \"=\", 1),\n\t\t\t\t),\n\t\t\t)\n\t\t\t.execute();\n\t\tawait trx\n\t\t\t.deleteFrom(\"_emdash_redirect_artifacts\")\n\t\t\t.where(({ exists, not, selectFrom }) =>\n\t\t\t\tnot(\n\t\t\t\t\texists(\n\t\t\t\t\t\tselectFrom(\"_emdash_redirect_generation_artifacts\")\n\t\t\t\t\t\t\t.select(\"_emdash_redirect_generation_artifacts.digest\")\n\t\t\t\t\t\t\t.whereRef(\n\t\t\t\t\t\t\t\t\"_emdash_redirect_generation_artifacts.digest\",\n\t\t\t\t\t\t\t\t\"=\",\n\t\t\t\t\t\t\t\t\"_emdash_redirect_artifacts.digest\",\n\t\t\t\t\t\t\t),\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\t)\n\t\t\t.execute();\n\t});\n}\n\n/**\n * Publishes after a redirect write, then invalidates this isolate's cache. A\n * failed publish is logged rather than failing the write: readers fall back\n * to the rules table and repair the stale generation.\n */\nexport async function publishRedirectChanges(db: Kysely<Database>): Promise<void> {\n\ttry {\n\t\tawait publishRedirectArtifacts(db);\n\t} catch (error) {\n\t\tconsole.error(\"[emdash:redirects] publishing redirect artifacts failed:\", error);\n\t}\n\tinvalidateRedirectCache();\n}\n\nfunction isArtifactEntry(value: unknown): value is ArtifactEntry {\n\treturn (\n\t\tArray.isArray(value) &&\n\t\tvalue.length === 4 &&\n\t\ttypeof value[0] === \"string\" &&\n\t\ttypeof value[1] === \"string\" &&\n\t\ttypeof value[2] === \"string\" &&\n\t\ttypeof value[3] === \"number\"\n\t);\n}\n\nfunction parseEntries(payload: string): ArtifactEntry[] | null {\n\ttry {\n\t\tconst parsed: unknown = JSON.parse(payload);\n\t\treturn Array.isArray(parsed) && parsed.every(isArtifactEntry) ? parsed : null;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\n/**\n * Loads and verifies the active generation. Returns null when nothing is\n * published, the generation is stale, or any artifact is missing, altered, or\n * out of place.\n */\nasync function loadPublishedRedirects(db: Kysely<Database>): Promise<RedirectRuleSet | null> {\n\tconst rows = await db\n\t\t.selectFrom(\"_emdash_redirect_state as state\")\n\t\t.leftJoin(\n\t\t\t\"_emdash_redirect_generation_artifacts as link\",\n\t\t\t\"link.generation\",\n\t\t\t\"state.generation\",\n\t\t)\n\t\t.leftJoin(\"_emdash_redirect_artifacts as artifact\", \"artifact.digest\", \"link.digest\")\n\t\t.select([\n\t\t\t\"state.revision\",\n\t\t\t\"state.generation\",\n\t\t\t\"state.generation_revision\",\n\t\t\t\"link.position\",\n\t\t\t\"link.digest\",\n\t\t\t\"artifact.kind\",\n\t\t\t\"artifact.payload\",\n\t\t])\n\t\t.where(\"state.id\", \"=\", 1)\n\t\t.orderBy(\"link.position\", \"asc\")\n\t\t.execute();\n\n\tconst state = rows[0];\n\tif (!state?.generation) return null;\n\tif (Number(state.revision) > Number(state.generation_revision)) return null;\n\n\tconst exact: RedirectRule[] = [];\n\tconst patterns: RedirectRule[] = [];\n\tconst digests: string[] = [];\n\tconst links = rows.filter((row) => row.position !== null);\n\tfor (const [index, link] of links.entries()) {\n\t\tif (\n\t\t\tNumber(link.position) !== index ||\n\t\t\t!link.digest ||\n\t\t\tlink.payload === null ||\n\t\t\t(link.kind !== \"exact\" && link.kind !== \"pattern\")\n\t\t) {\n\t\t\treturn null;\n\t\t}\n\t\tif ((await sha256Hex(`${link.kind}\\n${link.payload}`)) !== link.digest) {\n\t\t\treturn null;\n\t\t}\n\t\tconst entries = parseEntries(link.payload);\n\t\tif (!entries) return null;\n\t\tconst target = link.kind === \"exact\" ? exact : patterns;\n\t\tfor (const [id, source, destination, type] of entries) {\n\t\t\ttarget.push({ id, source, destination, type });\n\t\t}\n\t\tdigests.push(link.digest);\n\t}\n\tif ((await generationId(digests)) !== state.generation) return null;\n\n\treturn { version: state.generation, exact, patterns };\n}\n\nasync function loadRulesTable(db: Kysely<Database>): Promise<RedirectRuleSet> {\n\tconst redirects = await new RedirectRepository(db).findAllEnabled();\n\treturn toRuleSet(\n\t\tredirects.map(({ id, source, destination, type, isPattern }) => ({\n\t\t\tid,\n\t\t\tsource,\n\t\t\tdestination,\n\t\t\ttype,\n\t\t\tisPattern,\n\t\t})),\n\t\tnull,\n\t);\n}\n\ninterface RepairState {\n\trunningUntil: number;\n}\n\nconst REPAIR_STATE_KEY = Symbol.for(\"emdash:redirect-artifact-repair\");\nconst g = globalThis as Record<symbol, unknown>;\nconst repairState: RepairState =\n\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- globalThis singleton pattern (see request-context.ts)\n\t(g[REPAIR_STATE_KEY] as RepairState | undefined) ??\n\t(() => {\n\t\tconst state: RepairState = { runningUntil: 0 };\n\t\tg[REPAIR_STATE_KEY] = state;\n\t\treturn state;\n\t})();\n\n/**\n * Republishes the artifacts under a database lease so one isolate repairs a\n * stale or damaged generation while the others keep serving.\n */\nasync function repairRedirectArtifacts(db: Kysely<Database>): Promise<void> {\n\tconst now = Date.now();\n\tconst expiresAt = now + REPAIR_LEASE_MS;\n\tconst lease = await db\n\t\t.updateTable(\"_emdash_redirect_state\")\n\t\t.set({ repair_expires_at: expiresAt })\n\t\t.where(\"id\", \"=\", 1)\n\t\t.where(\"repair_expires_at\", \"<\", now)\n\t\t.executeTakeFirst();\n\tif (BigInt(lease.numUpdatedRows) === 0n) return;\n\ttry {\n\t\tawait publishRedirectArtifacts(db);\n\t} finally {\n\t\tawait db\n\t\t\t.updateTable(\"_emdash_redirect_state\")\n\t\t\t.set({ repair_expires_at: 0 })\n\t\t\t.where(\"id\", \"=\", 1)\n\t\t\t.where(\"repair_expires_at\", \"=\", expiresAt)\n\t\t\t.execute();\n\t}\n}\n\nfunction scheduleRedirectRepair(db: Kysely<Database>): void {\n\tconst now = Date.now();\n\tif (repairState.runningUntil > now) return;\n\tconst runningUntil = now + REPAIR_LEASE_MS;\n\trepairState.runningUntil = runningUntil;\n\tafter(async () => {\n\t\ttry {\n\t\t\tawait repairRedirectArtifacts(db);\n\t\t} catch (error) {\n\t\t\tconsole.error(\"[emdash:redirects] repairing redirect artifacts failed:\", error);\n\t\t} finally {\n\t\t\tif (repairState.runningUntil === runningUntil) repairState.runningUntil = 0;\n\t\t}\n\t});\n}\n\n/**\n * The rule source the middleware caches: the published generation when it is\n * current and verifies, otherwise the rules table. Before the artifact tables exist the\n * rules table is read directly.\n */\nexport function createRedirectSource(db: Kysely<Database>): RedirectSource {\n\treturn {\n\t\tasync load() {\n\t\t\tlet published: RedirectRuleSet | null;\n\t\t\ttry {\n\t\t\t\tpublished = await loadPublishedRedirects(db);\n\t\t\t} catch (error) {\n\t\t\t\tif (isMissingTableError(error)) return loadRulesTable(db);\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t\tif (published) return published;\n\t\t\tscheduleRedirectRepair(db);\n\t\t\treturn loadRulesTable(db);\n\t\t},\n\t\tasync isCurrent(version) {\n\t\t\tconst state = await db\n\t\t\t\t.selectFrom(\"_emdash_redirect_state\")\n\t\t\t\t.select([\"revision\", \"generation\", \"generation_revision\"])\n\t\t\t\t.where(\"id\", \"=\", 1)\n\t\t\t\t.executeTakeFirst();\n\t\t\treturn (\n\t\t\t\tstate?.generation === version && Number(state.revision) <= Number(state.generation_revision)\n\t\t\t);\n\t\t},\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;AA+CA,MAAM,wBAAwB,KAAK;AACnC,MAAM,oBAAoB;AAC1B,MAAM,kBAAkB;;AAExB,MAAM,kBAAkB;AAExB,MAAM,UAAU,IAAI,aAAa;AAEjC,eAAe,UAAU,OAAgC;CACxD,MAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,QAAQ,OAAO,MAAM,CAAC;AAC3E,QAAO,MAAM,KAAK,IAAI,WAAW,OAAO,GAAG,SAAS,KAAK,SAAS,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG;;AAGjG,SAAS,MAAM,OAAuB;CACrC,IAAI,OAAO;AACX,MAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACtC,UAAQ,MAAM,WAAW,EAAE;AAC3B,SAAO,KAAK,KAAK,MAAM,SAAW;;AAEnC,QAAO,SAAS;;AAGjB,SAAS,QAAQ,MAAmC;AACnD,QAAO;EAAC,KAAK;EAAI,KAAK;EAAQ,KAAK;EAAa,KAAK;EAAK;;AAG3D,SAAS,WAAW,OAA8B;AACjD,QAAO,QAAQ,OAAO,KAAK,UAAU,MAAM,CAAC,CAAC,aAAa;;AAG3D,eAAe,eAAe,MAAoB,SAA0B;CAC3E,MAAM,UAAU,KAAK,UAAU,QAAQ;AACvC,QAAO;EAAE,QAAQ,MAAM,UAAU,GAAG,KAAK,IAAI,UAAU;EAAE;EAAM;EAAS;;AAGzE,SAAS,aAAa,SAAoC;AACzD,QAAO,UAAU,CAAC,mBAAmB,GAAG,QAAQ,CAAC,KAAK,KAAK,CAAC;;;AAI7D,SAAS,UACR,MACA,SACkB;CAClB,MAAM,QAAwB,EAAE;CAChC,MAAM,WAA2B,EAAE;AACnC,MAAK,MAAM,EAAE,WAAW,GAAG,UAAU,KACpC,EAAC,YAAY,WAAW,OAAO,KAAK,KAAK;AAE1C,QAAO;EAAE;EAAS;EAAO;EAAU;;;;;;;AAQpC,eAAe,eACd,OACiE;CACjE,MAAM,2BAAW,IAAI,KAA4B;AACjD,MAAK,MAAM,QAAQ,MAAM,MAAO,UAAS,IAAI,KAAK,QAAQ,QAAQ,KAAK,CAAC;CACxE,MAAM,QAAQ,CAAC,GAAG,SAAS,QAAQ,CAAC,CAAC,UAAU,GAAG,MAAO,EAAE,KAAK,EAAE,KAAK,KAAK,EAAE,KAAK,EAAE,KAAK,IAAI,EAAG;CACjG,MAAM,aAAa,MAAM,QAAQ,OAAO,UAAU,QAAQ,WAAW,MAAM,EAAE,EAAE;CAC/E,MAAM,aAAa,KAAK,IAAI,GAAG,KAAK,KAAK,aAAa,sBAAsB,CAAC;CAC7E,MAAM,SAA4B,MAAM,KAAK,EAAE,QAAQ,YAAY,QAAQ,EAAE,CAAC;AAC9E,MAAK,MAAM,SAAS,MAAO,QAAO,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,MAAM;CAE3E,MAAM,YAAgC,EAAE;AACxC,MAAK,MAAM,SAAS,OACnB,KAAI,MAAM,SAAS,EAAG,WAAU,KAAK,MAAM,eAAe,SAAS,MAAM,CAAC;CAG3E,IAAI,QAAyB,EAAE;CAC/B,IAAI,aAAa;AACjB,MAAK,MAAM,QAAQ,MAAM,UAAU;EAClC,MAAM,QAAQ,QAAQ,KAAK;EAC3B,MAAM,QAAQ,WAAW,MAAM;AAC/B,MAAI,MAAM,SAAS,KAAK,aAAa,QAAQ,uBAAuB;AACnE,aAAU,KAAK,MAAM,eAAe,WAAW,MAAM,CAAC;AACtD,WAAQ,EAAE;AACV,gBAAa;;AAEd,QAAM,KAAK,MAAM;AACjB,gBAAc;;AAEf,KAAI,MAAM,SAAS,EAAG,WAAU,KAAK,MAAM,eAAe,WAAW,MAAM,CAAC;AAE5E,QAAO;EACN,YAAY,MAAM,aAAa,UAAU,KAAK,aAAa,SAAS,OAAO,CAAC;EAC5E;EACA;;;;;;;;;;;AAYF,eAAsB,yBAAyB,IAAqC;CACnF,MAAM,QAAQ,MAAM,GAClB,WAAW,yBAAyB,CACpC,OAAO,WAAW,CAClB,MAAM,MAAM,KAAK,EAAE,CACnB,kBAAkB;AACpB,KAAI,CAAC,MAAO,OAAM,IAAI,MAAM,gCAAgC;CAC5D,MAAM,WAAW,OAAO,MAAM,SAAS;CASvC,MAAM,EAAE,YAAY,cAAc,MAAM,eACvC,WARuB,MAAM,GAC5B,WAAW,oBAAoB,CAC/B,OAAO;EAAC;EAAM;EAAU;EAAe;EAAQ;EAAa,CAAC,CAC7D,MAAM,WAAW,KAAK,EAAE,CACxB,QAAQ,eAAe,UAAU,MAAM,KAAK,CAAC,YAAY,CAAC,CAC1D,QAAQ,MAAM,MAAM,CACpB,SAAS,EAGJ,KAAK,SAAS;EAClB,IAAI,IAAI;EACR,QAAQ,IAAI;EACZ,aAAa,IAAI;EACjB,MAAM,OAAO,IAAI,KAAK;EACtB,WAAW,OAAO,IAAI,WAAW,KAAK;EACtC,EAAE,EACH,KACA,CACD;AAED,OAAM,gBAAgB,IAAI,OAAO,QAAQ;EACxC,MAAM,UAAU,CAAC,GAAG,IAAI,IAAI,UAAU,KAAK,aAAa,SAAS,OAAO,CAAC,CAAC;EAC1E,MAAM,yBAAS,IAAI,KAAqB;AACxC,OAAK,MAAM,SAAS,OAAO,SAAS,eAAe,EAAE;GACpD,MAAM,QAAQ,MAAM,IAClB,WAAW,6BAA6B,CACxC,OAAO;IAAC;IAAU;IAAQ;IAAU,CAAC,CACrC,MAAM,UAAU,MAAM,MAAM,CAC5B,SAAS;AACX,QAAK,MAAM,OAAO,MAAO,QAAO,IAAI,IAAI,QAAQ,GAAG,IAAI,KAAK,IAAI,IAAI,UAAU;;AAE/E,OAAK,MAAM,YAAY,WAAW;GACjC,MAAM,UAAU,GAAG,SAAS,KAAK,IAAI,SAAS;AAC9C,OAAI,OAAO,IAAI,SAAS,OAAO,KAAK,QAAS;AAC7C,UAAO,IAAI,SAAS,QAAQ,QAAQ;AAEpC,SAAM,IACJ,WAAW,6BAA6B,CACxC,OAAO,SAAS,CAChB,YAAY,aACZ,SAAS,OAAO,SAAS,CAAC,YAAY;IAAE,MAAM,SAAS;IAAM,SAAS,SAAS;IAAS,CAAC,CACzF,CACA,SAAS;;EAGZ,MAAM,QAAQ,UAAU,KAAK,UAAU,cAAc;GACpD;GACA;GACA,QAAQ,SAAS;GACjB,EAAE;AACH,OAAK,MAAM,SAAS,OAAO,OAAO,gBAAgB,CACjD,OAAM,IACJ,WAAW,wCAAwC,CACnD,OAAO,MAAM,CACb,YAAY,aACZ,SACE,QAAQ,CAAC,cAAc,WAAW,CAAC,CACnC,aAAa,QAAQ,EAAE,QAAQ,GAAG,IAAI,kBAAkB,EAAE,EAAE,CAC9D,CACA,SAAS;AAEZ,QAAM,IACJ,WAAW,wCAAwC,CACnD,MAAM,cAAc,KAAK,WAAW,CACpC,MAAM,YAAY,MAAM,MAAM,OAAO,CACrC,SAAS;EAEX,MAAM,YAAY,MAAM,IACtB,YAAY,yBAAyB,CACrC,IAAI;GAAE;GAAY,qBAAqB;GAAU,CAAC,CAClD,MAAM,MAAM,KAAK,EAAE,CACnB,MAAM,uBAAuB,MAAM,SAAS,CAC5C,kBAAkB;AACpB,MAAI,OAAO,UAAU,eAAe,KAAK,GAAI;AAG7C,QAAM,IACJ,WAAW,wCAAwC,CACnD,OAAO,OACP,GACC,cACA,MACA,GAAG,WAAW,yBAAyB,CAAC,OAAO,aAAa,CAAC,MAAM,MAAM,KAAK,EAAE,CAChF,CACD,CACA,SAAS;AACX,QAAM,IACJ,WAAW,6BAA6B,CACxC,OAAO,EAAE,QAAQ,KAAK,iBACtB,IACC,OACC,WAAW,wCAAwC,CACjD,OAAO,+CAA+C,CACtD,SACA,gDACA,KACA,oCACA,CACF,CACD,CACD,CACA,SAAS;GACV;;;;;;;AAQH,eAAsB,uBAAuB,IAAqC;AACjF,KAAI;AACH,QAAM,yBAAyB,GAAG;UAC1B,OAAO;AACf,UAAQ,MAAM,4DAA4D,MAAM;;AAEjF,0BAAyB;;AAG1B,SAAS,gBAAgB,OAAwC;AAChE,QACC,MAAM,QAAQ,MAAM,IACpB,MAAM,WAAW,KACjB,OAAO,MAAM,OAAO,YACpB,OAAO,MAAM,OAAO,YACpB,OAAO,MAAM,OAAO,YACpB,OAAO,MAAM,OAAO;;AAItB,SAAS,aAAa,SAAyC;AAC9D,KAAI;EACH,MAAM,SAAkB,KAAK,MAAM,QAAQ;AAC3C,SAAO,MAAM,QAAQ,OAAO,IAAI,OAAO,MAAM,gBAAgB,GAAG,SAAS;SAClE;AACP,SAAO;;;;;;;;AAST,eAAe,uBAAuB,IAAuD;CAC5F,MAAM,OAAO,MAAM,GACjB,WAAW,kCAAkC,CAC7C,SACA,iDACA,mBACA,mBACA,CACA,SAAS,0CAA0C,mBAAmB,cAAc,CACpF,OAAO;EACP;EACA;EACA;EACA;EACA;EACA;EACA;EACA,CAAC,CACD,MAAM,YAAY,KAAK,EAAE,CACzB,QAAQ,iBAAiB,MAAM,CAC/B,SAAS;CAEX,MAAM,QAAQ,KAAK;AACnB,KAAI,CAAC,OAAO,WAAY,QAAO;AAC/B,KAAI,OAAO,MAAM,SAAS,GAAG,OAAO,MAAM,oBAAoB,CAAE,QAAO;CAEvE,MAAM,QAAwB,EAAE;CAChC,MAAM,WAA2B,EAAE;CACnC,MAAM,UAAoB,EAAE;CAC5B,MAAM,QAAQ,KAAK,QAAQ,QAAQ,IAAI,aAAa,KAAK;AACzD,MAAK,MAAM,CAAC,OAAO,SAAS,MAAM,SAAS,EAAE;AAC5C,MACC,OAAO,KAAK,SAAS,KAAK,SAC1B,CAAC,KAAK,UACN,KAAK,YAAY,QAChB,KAAK,SAAS,WAAW,KAAK,SAAS,UAExC,QAAO;AAER,MAAK,MAAM,UAAU,GAAG,KAAK,KAAK,IAAI,KAAK,UAAU,KAAM,KAAK,OAC/D,QAAO;EAER,MAAM,UAAU,aAAa,KAAK,QAAQ;AAC1C,MAAI,CAAC,QAAS,QAAO;EACrB,MAAM,SAAS,KAAK,SAAS,UAAU,QAAQ;AAC/C,OAAK,MAAM,CAAC,IAAI,QAAQ,aAAa,SAAS,QAC7C,QAAO,KAAK;GAAE;GAAI;GAAQ;GAAa;GAAM,CAAC;AAE/C,UAAQ,KAAK,KAAK,OAAO;;AAE1B,KAAK,MAAM,aAAa,QAAQ,KAAM,MAAM,WAAY,QAAO;AAE/D,QAAO;EAAE,SAAS,MAAM;EAAY;EAAO;EAAU;;AAGtD,eAAe,eAAe,IAAgD;AAE7E,QAAO,WADW,MAAM,IAAI,mBAAmB,GAAG,CAAC,gBAAgB,EAExD,KAAK,EAAE,IAAI,QAAQ,aAAa,MAAM,iBAAiB;EAChE;EACA;EACA;EACA;EACA;EACA,EAAE,EACH,KACA;;AAOF,MAAM,mBAAmB,OAAO,IAAI,kCAAkC;AACtE,MAAM,IAAI;AACV,MAAM,cAEJ,EAAE,4BACI;CACN,MAAM,QAAqB,EAAE,cAAc,GAAG;AAC9C,GAAE,oBAAoB;AACtB,QAAO;IACJ;;;;;AAML,eAAe,wBAAwB,IAAqC;CAC3E,MAAM,MAAM,KAAK,KAAK;CACtB,MAAM,YAAY,MAAM;CACxB,MAAM,QAAQ,MAAM,GAClB,YAAY,yBAAyB,CACrC,IAAI,EAAE,mBAAmB,WAAW,CAAC,CACrC,MAAM,MAAM,KAAK,EAAE,CACnB,MAAM,qBAAqB,KAAK,IAAI,CACpC,kBAAkB;AACpB,KAAI,OAAO,MAAM,eAAe,KAAK,GAAI;AACzC,KAAI;AACH,QAAM,yBAAyB,GAAG;WACzB;AACT,QAAM,GACJ,YAAY,yBAAyB,CACrC,IAAI,EAAE,mBAAmB,GAAG,CAAC,CAC7B,MAAM,MAAM,KAAK,EAAE,CACnB,MAAM,qBAAqB,KAAK,UAAU,CAC1C,SAAS;;;AAIb,SAAS,uBAAuB,IAA4B;CAC3D,MAAM,MAAM,KAAK,KAAK;AACtB,KAAI,YAAY,eAAe,IAAK;CACpC,MAAM,eAAe,MAAM;AAC3B,aAAY,eAAe;AAC3B,OAAM,YAAY;AACjB,MAAI;AACH,SAAM,wBAAwB,GAAG;WACzB,OAAO;AACf,WAAQ,MAAM,2DAA2D,MAAM;YACtE;AACT,OAAI,YAAY,iBAAiB,aAAc,aAAY,eAAe;;GAE1E;;;;;;;AAQH,SAAgB,qBAAqB,IAAsC;AAC1E,QAAO;EACN,MAAM,OAAO;GACZ,IAAI;AACJ,OAAI;AACH,gBAAY,MAAM,uBAAuB,GAAG;YACpC,OAAO;AACf,QAAI,oBAAoB,MAAM,CAAE,QAAO,eAAe,GAAG;AACzD,UAAM;;AAEP,OAAI,UAAW,QAAO;AACtB,0BAAuB,GAAG;AAC1B,UAAO,eAAe,GAAG;;EAE1B,MAAM,UAAU,SAAS;GACxB,MAAM,QAAQ,MAAM,GAClB,WAAW,yBAAyB,CACpC,OAAO;IAAC;IAAY;IAAc;IAAsB,CAAC,CACzD,MAAM,MAAM,KAAK,EAAE,CACnB,kBAAkB;AACpB,UACC,OAAO,eAAe,WAAW,OAAO,MAAM,SAAS,IAAI,OAAO,MAAM,oBAAoB;;EAG9F"}

package/dist/audit-CCH3MA4Y.mjs

@@ -1,127 +0,0 @@
-import { c as encodeCursor, s as decodeCursor } from "./types-C-Xp0CcN.mjs";
-import { ulid } from "ulidx";
-
-//#region src/database/repositories/audit.ts
-/**
-* Audit repository for logging system events
-*
-* Tracks user actions for security, debugging, and compliance.
-* All mutations should create an audit log entry.
-*/
-var AuditRepository = class {
-	constructor(db) {
-		this.db = db;
-	}
-	/**
-	* Create an audit log entry
-	*/
-	async log(input) {
-		const id = ulid();
-		const row = {
-			id,
-			actor_id: input.actorId ?? null,
-			actor_ip: input.actorIp ?? null,
-			action: input.action,
-			resource_type: input.resourceType ?? null,
-			resource_id: input.resourceId ?? null,
-			details: input.details ? JSON.stringify(input.details) : null,
-			status: input.status ?? null
-		};
-		await this.db.insertInto("audit_logs").values(row).execute();
-		const log = await this.findById(id);
-		if (!log) throw new Error("Failed to create audit log");
-		return log;
-	}
-	/**
-	* Find audit log by ID
-	*/
-	async findById(id) {
-		const row = await this.db.selectFrom("audit_logs").selectAll().where("id", "=", id).executeTakeFirst();
-		return row ? this.rowToAuditLog(row) : null;
-	}
-	/**
-	* Query audit logs with filters and cursor-based pagination
-	*/
-	async findMany(query = {}) {
-		const limit = Math.min(Math.max(1, query.limit || 50), 100);
-		let q = this.db.selectFrom("audit_logs").selectAll().orderBy("timestamp", "desc").orderBy("id", "desc").limit(limit + 1);
-		if (query.actorId) q = q.where("actor_id", "=", query.actorId);
-		if (query.action) q = q.where("action", "=", query.action);
-		if (query.resourceType) q = q.where("resource_type", "=", query.resourceType);
-		if (query.resourceId) q = q.where("resource_id", "=", query.resourceId);
-		if (query.status) q = q.where("status", "=", query.status);
-		if (query.since) q = q.where("timestamp", ">=", query.since);
-		if (query.until) q = q.where("timestamp", "<=", query.until);
-		if (query.cursor) {
-			const decoded = decodeCursor(query.cursor);
-			q = q.where((eb) => eb.or([eb("timestamp", "<", decoded.orderValue), eb.and([eb("timestamp", "=", decoded.orderValue), eb("id", "<", decoded.id)])]));
-		}
-		const rows = await q.execute();
-		const items = rows.slice(0, limit).map((row) => this.rowToAuditLog(row));
-		const result = { items };
-		if (rows.length > limit && items.length > 0) {
-			const last = items.at(-1);
-			result.nextCursor = encodeCursor(last.timestamp, last.id);
-		}
-		return result;
-	}
-	/**
-	* Get all logs for a specific resource
-	*/
-	async findByResource(resourceType, resourceId, options = {}) {
-		let query = this.db.selectFrom("audit_logs").selectAll().where("resource_type", "=", resourceType).where("resource_id", "=", resourceId).orderBy("timestamp", "desc");
-		if (options.limit) query = query.limit(options.limit);
-		return (await query.execute()).map((row) => this.rowToAuditLog(row));
-	}
-	/**
-	* Get all logs for a specific user
-	*/
-	async findByActor(actorId, options = {}) {
-		let query = this.db.selectFrom("audit_logs").selectAll().where("actor_id", "=", actorId).orderBy("timestamp", "desc");
-		if (options.since) query = query.where("timestamp", ">=", options.since);
-		if (options.limit) query = query.limit(options.limit);
-		return (await query.execute()).map((row) => this.rowToAuditLog(row));
-	}
-	/**
-	* Count logs matching a query
-	*/
-	async count(query = {}) {
-		let q = this.db.selectFrom("audit_logs").select((eb) => eb.fn.count("id").as("count"));
-		if (query.actorId) q = q.where("actor_id", "=", query.actorId);
-		if (query.action) q = q.where("action", "=", query.action);
-		if (query.resourceType) q = q.where("resource_type", "=", query.resourceType);
-		if (query.resourceId) q = q.where("resource_id", "=", query.resourceId);
-		if (query.status) q = q.where("status", "=", query.status);
-		if (query.since) q = q.where("timestamp", ">=", query.since);
-		if (query.until) q = q.where("timestamp", "<=", query.until);
-		const result = await q.executeTakeFirst();
-		return Number(result?.count || 0);
-	}
-	/**
-	* Delete old audit logs (for retention policy)
-	*/
-	async deleteOlderThan(date) {
-		const result = await this.db.deleteFrom("audit_logs").where("timestamp", "<", date).executeTakeFirst();
-		return Number(result.numDeletedRows ?? 0);
-	}
-	/**
-	* Convert database row to AuditLog object
-	*/
-	rowToAuditLog(row) {
-		return {
-			id: row.id,
-			timestamp: row.timestamp,
-			actorId: row.actor_id,
-			actorIp: row.actor_ip,
-			action: row.action,
-			resourceType: row.resource_type,
-			resourceId: row.resource_id,
-			details: row.details ? JSON.parse(row.details) : null,
-			status: row.status
-		};
-	}
-};
-
-//#endregion
-export { AuditRepository as t };
-//# sourceMappingURL=audit-CCH3MA4Y.mjs.map

package/dist/audit-CCH3MA4Y.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"audit-CCH3MA4Y.mjs","names":[],"sources":["../src/database/repositories/audit.ts"],"sourcesContent":["import type { Kysely } from \"kysely\";\nimport { ulid } from \"ulidx\";\n\nimport type { Database, AuditLogTable } from \"../types.js\";\nimport { encodeCursor, decodeCursor, type FindManyResult } from \"./types.js\";\n\nexport type AuditAction =\n\t| \"create\"\n\t| \"update\"\n\t| \"delete\"\n\t| \"publish\"\n\t| \"unpublish\"\n\t| \"login\"\n\t| \"logout\"\n\t| \"password_change\"\n\t| \"settings_update\"\n\t| \"schema_change\"\n\t| \"plugin_tool_invoke\"\n\t| \"transfer_export_create\"\n\t| \"transfer_import_create\"\n\t| \"transfer_import_execute\"\n\t| \"transfer_import_cancel\"\n\t| \"transfer_import_abandon\"\n\t| \"transfer_import_complete\"\n\t| \"transfer_import_fail\"\n\t| \"transfer_approval_approve\"\n\t| \"transfer_approval_deny\";\n\nexport type AuditStatus = \"success\" | \"failure\" | \"denied\";\n\nexport interface AuditLog {\n\tid: string;\n\ttimestamp: string;\n\tactorId: string | null;\n\tactorIp: string | null;\n\taction: AuditAction;\n\tresourceType: string | null;\n\tresourceId: string | null;\n\tdetails: Record<string, unknown> | null;\n\tstatus: AuditStatus | null;\n}\n\nexport interface CreateAuditLogInput {\n\tactorId?: string;\n\tactorIp?: string;\n\taction: AuditAction;\n\tresourceType?: string;\n\tresourceId?: string;\n\tdetails?: Record<string, unknown>;\n\tstatus?: AuditStatus;\n}\n\nexport interface AuditLogQuery {\n\tactorId?: string;\n\taction?: AuditAction;\n\tresourceType?: string;\n\tresourceId?: string;\n\tstatus?: AuditStatus;\n\tsince?: string; // ISO date\n\tuntil?: string; // ISO date\n\tlimit?: number;\n\tcursor?: string;\n}\n\n/**\n * Audit repository for logging system events\n *\n * Tracks user actions for security, debugging, and compliance.\n * All mutations should create an audit log entry.\n */\nexport class AuditRepository {\n\tconstructor(private db: Kysely<Database>) {}\n\n\t/**\n\t * Create an audit log entry\n\t */\n\tasync log(input: CreateAuditLogInput): Promise<AuditLog> {\n\t\tconst id = ulid();\n\n\t\tconst row: Omit<AuditLogTable, \"timestamp\"> = {\n\t\t\tid,\n\t\t\tactor_id: input.actorId ?? null,\n\t\t\tactor_ip: input.actorIp ?? null,\n\t\t\taction: input.action,\n\t\t\tresource_type: input.resourceType ?? null,\n\t\t\tresource_id: input.resourceId ?? null,\n\t\t\tdetails: input.details ? JSON.stringify(input.details) : null,\n\t\t\tstatus: input.status ?? null,\n\t\t};\n\n\t\tawait this.db.insertInto(\"audit_logs\").values(row).execute();\n\n\t\tconst log = await this.findById(id);\n\t\tif (!log) {\n\t\t\tthrow new Error(\"Failed to create audit log\");\n\t\t}\n\t\treturn log;\n\t}\n\n\t/**\n\t * Find audit log by ID\n\t */\n\tasync findById(id: string): Promise<AuditLog | null> {\n\t\tconst row = await this.db\n\t\t\t.selectFrom(\"audit_logs\")\n\t\t\t.selectAll()\n\t\t\t.where(\"id\", \"=\", id)\n\t\t\t.executeTakeFirst();\n\n\t\treturn row ? this.rowToAuditLog(row) : null;\n\t}\n\n\t/**\n\t * Query audit logs with filters and cursor-based pagination\n\t */\n\tasync findMany(query: AuditLogQuery = {}): Promise<FindManyResult<AuditLog>> {\n\t\tconst limit = Math.min(Math.max(1, query.limit || 50), 100);\n\n\t\tlet q = this.db\n\t\t\t.selectFrom(\"audit_logs\")\n\t\t\t.selectAll()\n\t\t\t.orderBy(\"timestamp\", \"desc\")\n\t\t\t.orderBy(\"id\", \"desc\")\n\t\t\t.limit(limit + 1);\n\n\t\tif (query.actorId) {\n\t\t\tq = q.where(\"actor_id\", \"=\", query.actorId);\n\t\t}\n\n\t\tif (query.action) {\n\t\t\tq = q.where(\"action\", \"=\", query.action);\n\t\t}\n\n\t\tif (query.resourceType) {\n\t\t\tq = q.where(\"resource_type\", \"=\", query.resourceType);\n\t\t}\n\n\t\tif (query.resourceId) {\n\t\t\tq = q.where(\"resource_id\", \"=\", query.resourceId);\n\t\t}\n\n\t\tif (query.status) {\n\t\t\tq = q.where(\"status\", \"=\", query.status);\n\t\t}\n\n\t\tif (query.since) {\n\t\t\tq = q.where(\"timestamp\", \">=\", query.since);\n\t\t}\n\n\t\tif (query.until) {\n\t\t\tq = q.where(\"timestamp\", \"<=\", query.until);\n\t\t}\n\n\t\tif (query.cursor) {\n\t\t\tconst decoded = decodeCursor(query.cursor);\n\t\t\tq = q.where((eb) =>\n\t\t\t\teb.or([\n\t\t\t\t\teb(\"timestamp\", \"<\", decoded.orderValue),\n\t\t\t\t\teb.and([eb(\"timestamp\", \"=\", decoded.orderValue), eb(\"id\", \"<\", decoded.id)]),\n\t\t\t\t]),\n\t\t\t);\n\t\t}\n\n\t\tconst rows = await q.execute();\n\t\tconst items = rows.slice(0, limit).map((row) => this.rowToAuditLog(row));\n\t\tconst result: FindManyResult<AuditLog> = { items };\n\n\t\tif (rows.length > limit && items.length > 0) {\n\t\t\tconst last = items.at(-1)!;\n\t\t\tresult.nextCursor = encodeCursor(last.timestamp, last.id);\n\t\t}\n\n\t\treturn result;\n\t}\n\n\t/**\n\t * Get all logs for a specific resource\n\t */\n\tasync findByResource(\n\t\tresourceType: string,\n\t\tresourceId: string,\n\t\toptions: { limit?: number } = {},\n\t): Promise<AuditLog[]> {\n\t\tlet query = this.db\n\t\t\t.selectFrom(\"audit_logs\")\n\t\t\t.selectAll()\n\t\t\t.where(\"resource_type\", \"=\", resourceType)\n\t\t\t.where(\"resource_id\", \"=\", resourceId)\n\t\t\t.orderBy(\"timestamp\", \"desc\");\n\n\t\tif (options.limit) {\n\t\t\tquery = query.limit(options.limit);\n\t\t}\n\n\t\tconst rows = await query.execute();\n\t\treturn rows.map((row) => this.rowToAuditLog(row));\n\t}\n\n\t/**\n\t * Get all logs for a specific user\n\t */\n\tasync findByActor(\n\t\tactorId: string,\n\t\toptions: { limit?: number; since?: string } = {},\n\t): Promise<AuditLog[]> {\n\t\tlet query = this.db\n\t\t\t.selectFrom(\"audit_logs\")\n\t\t\t.selectAll()\n\t\t\t.where(\"actor_id\", \"=\", actorId)\n\t\t\t.orderBy(\"timestamp\", \"desc\");\n\n\t\tif (options.since) {\n\t\t\tquery = query.where(\"timestamp\", \">=\", options.since);\n\t\t}\n\n\t\tif (options.limit) {\n\t\t\tquery = query.limit(options.limit);\n\t\t}\n\n\t\tconst rows = await query.execute();\n\t\treturn rows.map((row) => this.rowToAuditLog(row));\n\t}\n\n\t/**\n\t * Count logs matching a query\n\t */\n\tasync count(query: Omit<AuditLogQuery, \"limit\" | \"cursor\"> = {}): Promise<number> {\n\t\tlet q = this.db.selectFrom(\"audit_logs\").select((eb) => eb.fn.count(\"id\").as(\"count\"));\n\n\t\tif (query.actorId) {\n\t\t\tq = q.where(\"actor_id\", \"=\", query.actorId);\n\t\t}\n\n\t\tif (query.action) {\n\t\t\tq = q.where(\"action\", \"=\", query.action);\n\t\t}\n\n\t\tif (query.resourceType) {\n\t\t\tq = q.where(\"resource_type\", \"=\", query.resourceType);\n\t\t}\n\n\t\tif (query.resourceId) {\n\t\t\tq = q.where(\"resource_id\", \"=\", query.resourceId);\n\t\t}\n\n\t\tif (query.status) {\n\t\t\tq = q.where(\"status\", \"=\", query.status);\n\t\t}\n\n\t\tif (query.since) {\n\t\t\tq = q.where(\"timestamp\", \">=\", query.since);\n\t\t}\n\n\t\tif (query.until) {\n\t\t\tq = q.where(\"timestamp\", \"<=\", query.until);\n\t\t}\n\n\t\tconst result = await q.executeTakeFirst();\n\t\treturn Number(result?.count || 0);\n\t}\n\n\t/**\n\t * Delete old audit logs (for retention policy)\n\t */\n\tasync deleteOlderThan(date: string): Promise<number> {\n\t\tconst result = await this.db\n\t\t\t.deleteFrom(\"audit_logs\")\n\t\t\t.where(\"timestamp\", \"<\", date)\n\t\t\t.executeTakeFirst();\n\n\t\treturn Number(result.numDeletedRows ?? 0);\n\t}\n\n\t/**\n\t * Convert database row to AuditLog object\n\t */\n\tprivate rowToAuditLog(row: {\n\t\tid: string;\n\t\ttimestamp: string;\n\t\tactor_id: string | null;\n\t\tactor_ip: string | null;\n\t\taction: string;\n\t\tresource_type: string | null;\n\t\tresource_id: string | null;\n\t\tdetails: string | null;\n\t\tstatus: string | null;\n\t}): AuditLog {\n\t\treturn {\n\t\t\tid: row.id,\n\t\t\ttimestamp: row.timestamp,\n\t\t\tactorId: row.actor_id,\n\t\t\tactorIp: row.actor_ip,\n\t\t\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- DB stores string; validated at insert but linter can't follow\n\t\t\taction: row.action as AuditAction,\n\t\t\tresourceType: row.resource_type,\n\t\t\tresourceId: row.resource_id,\n\t\t\tdetails: row.details ? JSON.parse(row.details) : null,\n\t\t\t// eslint-disable-next-line typescript/no-unsafe-type-assertion -- DB stores string; validated at insert but linter can't follow\n\t\t\tstatus: row.status as AuditStatus | null,\n\t\t};\n\t}\n}\n"],"mappings":";;;;;;;;;;AAsEA,IAAa,kBAAb,MAA6B;CAC5B,YAAY,AAAQ,IAAsB;EAAtB;;;;;CAKpB,MAAM,IAAI,OAA+C;EACxD,MAAM,KAAK,MAAM;EAEjB,MAAM,MAAwC;GAC7C;GACA,UAAU,MAAM,WAAW;GAC3B,UAAU,MAAM,WAAW;GAC3B,QAAQ,MAAM;GACd,eAAe,MAAM,gBAAgB;GACrC,aAAa,MAAM,cAAc;GACjC,SAAS,MAAM,UAAU,KAAK,UAAU,MAAM,QAAQ,GAAG;GACzD,QAAQ,MAAM,UAAU;GACxB;AAED,QAAM,KAAK,GAAG,WAAW,aAAa,CAAC,OAAO,IAAI,CAAC,SAAS;EAE5D,MAAM,MAAM,MAAM,KAAK,SAAS,GAAG;AACnC,MAAI,CAAC,IACJ,OAAM,IAAI,MAAM,6BAA6B;AAE9C,SAAO;;;;;CAMR,MAAM,SAAS,IAAsC;EACpD,MAAM,MAAM,MAAM,KAAK,GACrB,WAAW,aAAa,CACxB,WAAW,CACX,MAAM,MAAM,KAAK,GAAG,CACpB,kBAAkB;AAEpB,SAAO,MAAM,KAAK,cAAc,IAAI,GAAG;;;;;CAMxC,MAAM,SAAS,QAAuB,EAAE,EAAqC;EAC5E,MAAM,QAAQ,KAAK,IAAI,KAAK,IAAI,GAAG,MAAM,SAAS,GAAG,EAAE,IAAI;EAE3D,IAAI,IAAI,KAAK,GACX,WAAW,aAAa,CACxB,WAAW,CACX,QAAQ,aAAa,OAAO,CAC5B,QAAQ,MAAM,OAAO,CACrB,MAAM,QAAQ,EAAE;AAElB,MAAI,MAAM,QACT,KAAI,EAAE,MAAM,YAAY,KAAK,MAAM,QAAQ;AAG5C,MAAI,MAAM,OACT,KAAI,EAAE,MAAM,UAAU,KAAK,MAAM,OAAO;AAGzC,MAAI,MAAM,aACT,KAAI,EAAE,MAAM,iBAAiB,KAAK,MAAM,aAAa;AAGtD,MAAI,MAAM,WACT,KAAI,EAAE,MAAM,eAAe,KAAK,MAAM,WAAW;AAGlD,MAAI,MAAM,OACT,KAAI,EAAE,MAAM,UAAU,KAAK,MAAM,OAAO;AAGzC,MAAI,MAAM,MACT,KAAI,EAAE,MAAM,aAAa,MAAM,MAAM,MAAM;AAG5C,MAAI,MAAM,MACT,KAAI,EAAE,MAAM,aAAa,MAAM,MAAM,MAAM;AAG5C,MAAI,MAAM,QAAQ;GACjB,MAAM,UAAU,aAAa,MAAM,OAAO;AAC1C,OAAI,EAAE,OAAO,OACZ,GAAG,GAAG,CACL,GAAG,aAAa,KAAK,QAAQ,WAAW,EACxC,GAAG,IAAI,CAAC,GAAG,aAAa,KAAK,QAAQ,WAAW,EAAE,GAAG,MAAM,KAAK,QAAQ,GAAG,CAAC,CAAC,CAC7E,CAAC,CACF;;EAGF,MAAM,OAAO,MAAM,EAAE,SAAS;EAC9B,MAAM,QAAQ,KAAK,MAAM,GAAG,MAAM,CAAC,KAAK,QAAQ,KAAK,cAAc,IAAI,CAAC;EACxE,MAAM,SAAmC,EAAE,OAAO;AAElD,MAAI,KAAK,SAAS,SAAS,MAAM,SAAS,GAAG;GAC5C,MAAM,OAAO,MAAM,GAAG,GAAG;AACzB,UAAO,aAAa,aAAa,KAAK,WAAW,KAAK,GAAG;;AAG1D,SAAO;;;;;CAMR,MAAM,eACL,cACA,YACA,UAA8B,EAAE,EACV;EACtB,IAAI,QAAQ,KAAK,GACf,WAAW,aAAa,CACxB,WAAW,CACX,MAAM,iBAAiB,KAAK,aAAa,CACzC,MAAM,eAAe,KAAK,WAAW,CACrC,QAAQ,aAAa,OAAO;AAE9B,MAAI,QAAQ,MACX,SAAQ,MAAM,MAAM,QAAQ,MAAM;AAInC,UADa,MAAM,MAAM,SAAS,EACtB,KAAK,QAAQ,KAAK,cAAc,IAAI,CAAC;;;;;CAMlD,MAAM,YACL,SACA,UAA8C,EAAE,EAC1B;EACtB,IAAI,QAAQ,KAAK,GACf,WAAW,aAAa,CACxB,WAAW,CACX,MAAM,YAAY,KAAK,QAAQ,CAC/B,QAAQ,aAAa,OAAO;AAE9B,MAAI,QAAQ,MACX,SAAQ,MAAM,MAAM,aAAa,MAAM,QAAQ,MAAM;AAGtD,MAAI,QAAQ,MACX,SAAQ,MAAM,MAAM,QAAQ,MAAM;AAInC,UADa,MAAM,MAAM,SAAS,EACtB,KAAK,QAAQ,KAAK,cAAc,IAAI,CAAC;;;;;CAMlD,MAAM,MAAM,QAAiD,EAAE,EAAmB;EACjF,IAAI,IAAI,KAAK,GAAG,WAAW,aAAa,CAAC,QAAQ,OAAO,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,CAAC;AAEtF,MAAI,MAAM,QACT,KAAI,EAAE,MAAM,YAAY,KAAK,MAAM,QAAQ;AAG5C,MAAI,MAAM,OACT,KAAI,EAAE,MAAM,UAAU,KAAK,MAAM,OAAO;AAGzC,MAAI,MAAM,aACT,KAAI,EAAE,MAAM,iBAAiB,KAAK,MAAM,aAAa;AAGtD,MAAI,MAAM,WACT,KAAI,EAAE,MAAM,eAAe,KAAK,MAAM,WAAW;AAGlD,MAAI,MAAM,OACT,KAAI,EAAE,MAAM,UAAU,KAAK,MAAM,OAAO;AAGzC,MAAI,MAAM,MACT,KAAI,EAAE,MAAM,aAAa,MAAM,MAAM,MAAM;AAG5C,MAAI,MAAM,MACT,KAAI,EAAE,MAAM,aAAa,MAAM,MAAM,MAAM;EAG5C,MAAM,SAAS,MAAM,EAAE,kBAAkB;AACzC,SAAO,OAAO,QAAQ,SAAS,EAAE;;;;;CAMlC,MAAM,gBAAgB,MAA+B;EACpD,MAAM,SAAS,MAAM,KAAK,GACxB,WAAW,aAAa,CACxB,MAAM,aAAa,KAAK,KAAK,CAC7B,kBAAkB;AAEpB,SAAO,OAAO,OAAO,kBAAkB,EAAE;;;;;CAM1C,AAAQ,cAAc,KAUT;AACZ,SAAO;GACN,IAAI,IAAI;GACR,WAAW,IAAI;GACf,SAAS,IAAI;GACb,SAAS,IAAI;GAEb,QAAQ,IAAI;GACZ,cAAc,IAAI;GAClB,YAAY,IAAI;GAChB,SAAS,IAAI,UAAU,KAAK,MAAM,IAAI,QAAQ,GAAG;GAEjD,QAAQ,IAAI;GACZ"}