gcb-host 0.0.0 → 0.0.1

package/lib/config.js

@@ -0,0 +1,408 @@
+/**
+ * Broker configuration: loaded from a YAML file that lives on the host, outside every
+ * mount the agent container can see, and validated eagerly so a broken or over-broad
+ * configuration stops the daemon at startup instead of silently denying (or silently
+ * allowing) at push time.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import path, { posix } from 'node:path';
+import { parseDocument } from 'yaml';
+import { parseAllowEntry } from './policy.js';
+/** The file every command looks for when no configuration path is given. */
+export const DEFAULT_CONFIG_FILE = 'broker.config.yml';
+/**
+ * Where the configuration lives when nothing says otherwise.
+ *
+ * This convention is what makes the commands usable without repeating paths: run them from the
+ * deployment directory and `./broker.config.yml` is found, or export `GIT_BROKER_CONFIG` once.
+ * An explicit `--config` always wins.
+ *
+ * @param explicit - the `--config` argument, if any.
+ * @param env - the environment to read.
+ * @returns an absolute path.
+ */
+export function resolveConfigPath(explicit, env = process.env) {
+    return path.resolve(explicit ?? env['GIT_BROKER_CONFIG'] ?? DEFAULT_CONFIG_FILE);
+}
+/**
+ * The deployment directory implied by a configuration path.
+ *
+ * The key, the configuration and the log directory are siblings, so the file's own location says
+ * where the deployment is.
+ *
+ * @param configPath - the configuration path.
+ * @returns the absolute directory.
+ */
+export function deploymentDir(configPath) {
+    return path.dirname(path.resolve(configPath));
+}
+/**
+ * Fixed paths inside the sidecar.
+ *
+ * A contract with the compose file `compose` prints: it and `init --mode sidecar` both read these
+ * from here, because a mismatch is a broker that starts and then cannot find its own key.
+ */
+/**
+ * The file name the authorized person's refresh token is kept under.
+ *
+ * It sits beside the private key, because the broker reads the key and can find the token without being
+ * told anything else — one rule, used by the writer, the reader and the mount, so they cannot drift.
+ */
+export const USER_TOKEN_FILE = 'user.refresh';
+/**
+ * Where the authorized person's refresh token is, given the key it sits beside.
+ *
+ * posix, not path: these are paths inside the deployment, and the process reading them need not be the
+ * platform they belong to.
+ *
+ * @param privateKeyPath - the key, as the process that reads it sees the path.
+ * @returns the refresh token path.
+ */
+export function userTokenPath(privateKeyPath) {
+    return posix.join(posix.dirname(privateKeyPath), USER_TOKEN_FILE);
+}
+export const SIDECAR = {
+    configPath: '/etc/git-cred-broker/broker.config.yml',
+    keyPath: '/etc/git-cred-broker/app.pem',
+    // Beside the key, because that is how the provider derives it without being told.
+    // Derived from the key rather than written again: the mount target and the reader's path at once.
+    userTokenPath: posix.join(posix.dirname('/etc/git-cred-broker/app.pem'), USER_TOKEN_FILE),
+    auditDir: '/var/log/git-cred-broker',
+    auditPath: '/var/log/git-cred-broker/audit.jsonl',
+    socketDir: '/run/git-broker',
+    socketPath: '/run/git-broker/broker.sock',
+};
+/**
+ * Which deployment a configuration was written for.
+ *
+ * Derived from the paths rather than stored, because the paths are what decide whether the broker
+ * can find its key. This lives here, not with the CLI, so the daemon can use it to explain a
+ * mismatch instead of reporting a bare ENOENT about a path that only exists in the other layout.
+ *
+ * @param config - a validated configuration.
+ * @returns the deployment it suits.
+ */
+export function inferMode(config) {
+    const block = config.hosts['github.com'];
+    const keyPath = block?.provider === 'github-app' ? block.privateKeyPath : undefined;
+    return keyPath === SIDECAR.keyPath && config.socketPath === SIDECAR.socketPath ? 'sidecar' : 'host';
+}
+/**
+ * Refuse to start when a person's token is named but not there.
+ *
+ * Same reasoning as the key: a path that does not resolve is a deployment mistake, and the process
+ * that runs the broker is the one whose paths count.
+ *
+ * @param config - the loaded configuration.
+ */
+export function assertUserTokensReadable(config) {
+    for (const [host, block] of Object.entries(config.hosts)) {
+        if (block.provider !== 'github-app')
+            continue;
+        for (const [owner, tokenPath] of Object.entries(block.userTokens ?? {})) {
+            if (existsSync(tokenPath))
+                continue;
+            throw new Error(`cannot read the token for ${host}/${owner}: ${tokenPath} does not exist.\n` +
+                `       Create a fine-grained token with pull requests: read and write, contents: read and\n` +
+                `       metadata: read, for the repositories the allowlist names, and put it there — or drop\n` +
+                `       userTokens to keep opening pull requests as the app.`);
+        }
+    }
+}
+/**
+ * Check that each recorded private key is readable, before the caller tries to read it.
+ *
+ * Both the daemon and `diagnose` need this, because both read the key, and a bare
+ * `ENOENT ... /etc/git-cred-broker/app.pem` says nothing: that path exists only inside the sidecar,
+ * so the mistake is where the command was run, not that the key is missing. The layout is
+ * recoverable from the configuration itself, so name it and give the way out.
+ *
+ * @param config - the validated configuration.
+ * @throws {Error} when a key file is missing, with the remedy in the message.
+ */
+export function assertKeysReadable(config) {
+    const mode = inferMode(config);
+    for (const [host, block] of Object.entries(config.hosts)) {
+        if (block.provider !== 'github-app' || block.privateKeyPath === undefined)
+            continue;
+        if (existsSync(block.privateKeyPath))
+            continue;
+        const remedy = mode === 'sidecar'
+            ? `${block.privateKeyPath} exists only inside the sidecar container, so this has to run there —\n` +
+                '       or against a configuration that records host paths instead:\n' +
+                '         gcb init --mode host --socket-path <the path the host process binds>'
+            : `${block.privateKeyPath} is the host's path. Install the key there (init does), or if this\n` +
+                '       deployment is a sidecar, re-run init with --mode sidecar so the configuration records\n' +
+                '       the paths the sidecar actually mounts.';
+        throw new Error(`cannot read the private key for ${host}: ${remedy}`);
+    }
+}
+/** Providers this build knows how to construct. */
+export const KNOWN_PROVIDERS = ['github-app', 'static'];
+/**
+ * Whether a value is a plain object.
+ *
+ * @param value - the value to test.
+ * @returns true for a non-null, non-array object.
+ */
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * Read an optional string field, recording a type error instead of coercing.
+ *
+ * @param record - the object to read from.
+ * @param key - the field name.
+ * @param errors - the error accumulator.
+ * @param at - the human-readable location, for messages.
+ * @returns the string, or undefined when absent or invalid.
+ */
+function stringField(record, key, errors, at) {
+    const value = record[key];
+    if (value === undefined || value === null)
+        return undefined;
+    if (typeof value !== 'string') {
+        errors.push(`${at}.${key} must be a string`);
+        return undefined;
+    }
+    return value;
+}
+/**
+ * Read an optional numeric field.
+ *
+ * @param record - the object to read from.
+ * @param key - the field name.
+ * @param errors - the error accumulator.
+ * @param at - the human-readable location, for messages.
+ * @returns the number, or undefined when absent or invalid.
+ */
+function numberField(record, key, errors, at) {
+    const value = record[key];
+    if (value === undefined || value === null)
+        return undefined;
+    if (typeof value !== 'number' || !Number.isFinite(value)) {
+        errors.push(`${at}.${key} must be a finite number`);
+        return undefined;
+    }
+    return value;
+}
+/**
+ * Read an optional boolean field.
+ *
+ * @param record - the object to read from.
+ * @param key - the field name.
+ * @param errors - the error accumulator.
+ * @param at - the human-readable location, for messages.
+ * @returns the boolean, or undefined when absent or invalid.
+ */
+function booleanField(record, key, errors, at) {
+    const value = record[key];
+    if (value === undefined || value === null)
+        return undefined;
+    if (typeof value !== 'boolean') {
+        errors.push(`${at}.${key} must be a boolean`);
+        return undefined;
+    }
+    return value;
+}
+/**
+ * Read an optional string-or-number field (the app ID may be written either way).
+ *
+ * @param record - the object to read from.
+ * @param key - the field name.
+ * @param errors - the error accumulator.
+ * @param at - the human-readable location, for messages.
+ * @returns the value, or undefined when absent or invalid.
+ */
+function stringOrNumberField(record, key, errors, at) {
+    const value = record[key];
+    if (value === undefined || value === null)
+        return undefined;
+    if (typeof value === 'string' || typeof value === 'number')
+        return value;
+    errors.push(`${at}.${key} must be a string or a number`);
+    return undefined;
+}
+/**
+ * The same map with its keys lower-cased.
+ *
+ * These keys are owners, and owners are case-insensitive on GitHub while every comparison in this
+ * codebase is made against a lower-cased one. Normalising at the edge is what keeps a configuration that
+ * looks right from silently doing nothing.
+ *
+ * @param value - the map, as written, or nothing when the field is absent.
+ * @returns the map with lower-cased keys, or nothing.
+ */
+function lowerCasedKeys(value) {
+    if (value === undefined)
+        return undefined;
+    const out = {};
+    for (const [key, entry] of Object.entries(value))
+        out[key.toLowerCase()] = entry;
+    return out;
+}
+/**
+ * Read an optional map of strings, for REST permission names.
+ *
+ * @param value - the raw value.
+ * @param errors - the error accumulator.
+ * @param at - the human-readable location, for messages.
+ * @returns the map, or undefined when absent or invalid.
+ */
+function stringMapField(value, errors, at, field = 'permissions') {
+    if (value === undefined || value === null)
+        return undefined;
+    if (!isRecord(value)) {
+        errors.push(`${at}.${field} must be an object of names to values`);
+        return undefined;
+    }
+    const out = {};
+    for (const [key, entry] of Object.entries(value)) {
+        if (typeof entry !== 'string') {
+            errors.push(`${at}.${field}["${key}"] must be a string`);
+            continue;
+        }
+        out[key] = entry;
+    }
+    return out;
+}
+/**
+ * Validate a parsed configuration object.
+ *
+ * @param raw - the parsed JSON.
+ * @param source - where it came from, for error messages.
+ * @returns the validated configuration with defaults applied.
+ * @throws {Error} when any field is missing or malformed.
+ */
+export function validateConfig(raw, source = '<config>') {
+    if (!isRecord(raw)) {
+        throw new Error(`invalid config (${source}): top level must be an object`);
+    }
+    const errors = [];
+    const socketPathRaw = raw['socketPath'];
+    if (typeof socketPathRaw !== 'string' || !socketPathRaw) {
+        errors.push('socketPath is required (absolute path of the broker unix socket)');
+    }
+    const auditRaw = raw['auditPath'];
+    if (auditRaw !== undefined && auditRaw !== null && typeof auditRaw !== 'string') {
+        errors.push('auditPath must be a string when present');
+    }
+    const socketModeRaw = raw['socketMode'];
+    if (socketModeRaw !== undefined && !Number.isInteger(socketModeRaw)) {
+        errors.push('socketMode must be an integer (octal literal, e.g. 432 for 0660)');
+    }
+    const skewRaw = raw['tokenCacheSkewSeconds'];
+    if (skewRaw !== undefined && (typeof skewRaw !== 'number' || !Number.isFinite(skewRaw))) {
+        errors.push('tokenCacheSkewSeconds must be a number');
+    }
+    const hostsRaw = raw['hosts'];
+    const hosts = {};
+    if (!isRecord(hostsRaw) || Object.keys(hostsRaw).length === 0) {
+        errors.push('hosts must be a non-empty object keyed by host as git reports it (e.g. "github.com")');
+    }
+    else {
+        for (const [host, blockRaw] of Object.entries(hostsRaw)) {
+            const at = `hosts["${host}"]`;
+            if (!isRecord(blockRaw)) {
+                errors.push(`${at} must be an object`);
+                continue;
+            }
+            const provider = blockRaw['provider'];
+            if (provider !== 'static' && provider !== 'github-app') {
+                errors.push(`${at}.provider must be one of: ${KNOWN_PROVIDERS.join(', ')}`);
+                continue;
+            }
+            const allowRaw = blockRaw['allow'];
+            if (!Array.isArray(allowRaw) || allowRaw.length === 0) {
+                errors.push(`${at}.allow must be a non-empty array; the broker is default deny, so an empty allowlist is almost certainly a mistake`);
+                continue;
+            }
+            const allow = [];
+            for (const entry of allowRaw) {
+                if (typeof entry !== 'string') {
+                    errors.push(`${at}.allow must contain only strings`);
+                    continue;
+                }
+                // A malformed entry would match nothing and therefore deny, which is safe but silent:
+                // the operator would believe they had allowed a repository. Reject it loudly instead.
+                if (!parseAllowEntry(entry)) {
+                    errors.push(`${at}.allow entry ${JSON.stringify(entry)} is not a valid "owner/repo" pattern ` +
+                        '(a whole segment may be "*", but a partial wildcard like "wid*" is not)');
+                    continue;
+                }
+                allow.push(entry);
+            }
+            if (provider === 'static') {
+                const block = {
+                    provider: 'static',
+                    allow,
+                    allowInsecureHttp: booleanField(blockRaw, 'allowInsecureHttp', errors, at),
+                    username: stringField(blockRaw, 'username', errors, at),
+                    password: stringField(blockRaw, 'password', errors, at),
+                    passwordPath: stringField(blockRaw, 'passwordPath', errors, at),
+                    passwordEnv: stringField(blockRaw, 'passwordEnv', errors, at),
+                    expiresInSeconds: numberField(blockRaw, 'expiresInSeconds', errors, at),
+                };
+                hosts[host] = block;
+            }
+            else {
+                const block = {
+                    provider: 'github-app',
+                    allow,
+                    allowInsecureHttp: booleanField(blockRaw, 'allowInsecureHttp', errors, at),
+                    clientId: stringField(blockRaw, 'clientId', errors, at),
+                    appId: stringOrNumberField(blockRaw, 'appId', errors, at),
+                    privateKeyPath: stringField(blockRaw, 'privateKeyPath', errors, at),
+                    // Keys are owners, and every other owner in this codebase is compared lower-cased. A key spelled
+                    // `An-Org` used to validate and then never match, which meant the pull request was created as the app
+                    // while the operator believed a person would author it.
+                    userTokens: lowerCasedKeys(stringMapField(blockRaw['userTokens'], errors, at, 'userTokens')),
+                    privateKeyPem: stringField(blockRaw, 'privateKeyPem', errors, at),
+                    permissions: stringMapField(blockRaw['permissions'], errors, at),
+                    apiBaseUrl: stringField(blockRaw, 'apiBaseUrl', errors, at),
+                    apiVersion: stringField(blockRaw, 'apiVersion', errors, at),
+                    installationCacheSeconds: numberField(blockRaw, 'installationCacheSeconds', errors, at),
+                    verifyAppPermissions: booleanField(blockRaw, 'verifyAppPermissions', errors, at),
+                };
+                hosts[host] = block;
+            }
+        }
+    }
+    if (errors.length > 0) {
+        const error = new Error(`invalid config (${source}):\n - ${errors.join('\n - ')}`);
+        error.name = 'ConfigError';
+        throw error;
+    }
+    return {
+        socketPath: typeof socketPathRaw === 'string' ? socketPathRaw : '',
+        socketMode: typeof socketModeRaw === 'number' ? socketModeRaw : 0o660,
+        auditPath: typeof auditRaw === 'string' ? auditRaw : null,
+        tokenCacheSkewSeconds: typeof skewRaw === 'number' ? skewRaw : 300,
+        hosts,
+    };
+}
+/**
+ * Read and validate a configuration file.
+ *
+ * @param path - path to the YAML config.
+ * @returns the validated configuration.
+ */
+export function loadConfig(path) {
+    let text;
+    try {
+        text = readFileSync(path, 'utf8');
+    }
+    catch (error) {
+        throw new Error(`cannot read config ${path}: ${error.message}`);
+    }
+    const document = parseDocument(text, {
+        schema: 'core',
+        uniqueKeys: true,
+        prettyErrors: true,
+    });
+    if (document.errors.length > 0) {
+        throw new Error(`config ${path} is not valid YAML: ${document.errors.map((error) => error.message).join('; ')}`);
+    }
+    return validateConfig(document.toJS({ maxAliasCount: 0 }), path);
+}
+//# sourceMappingURL=config.js.map

package/lib/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AAErC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG9C,4EAA4E;AAC5E,MAAM,CAAC,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAEvD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAiB,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG;IACvF,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,GAAG,CAAC,mBAAmB,CAAC,IAAI,mBAAmB,CAAC,CAAC;AACnF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,UAAkB;IAC9C,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;AAChD,CAAC;AAKD;;;;;GAKG;AACH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,cAAc,CAAC;AAE9C;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,cAAsB;IAClD,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,eAAe,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,UAAU,EAAE,wCAAwC;IACpD,OAAO,EAAE,8BAA8B;IACvC,kFAAkF;IAClF,kGAAkG;IAClG,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,8BAA8B,CAAC,EAAE,eAAe,CAAC;IACzF,QAAQ,EAAE,0BAA0B;IACpC,SAAS,EAAE,sCAAsC;IACjD,SAAS,EAAE,iBAAiB;IAC5B,UAAU,EAAE,6BAA6B;CACjC,CAAC;AAEX;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CAAC,MAAoB;IAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,KAAK,EAAE,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;IACpF,OAAO,OAAO,KAAK,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;AACtG,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAoB;IAC3D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,IAAI,KAAK,CAAC,QAAQ,KAAK,YAAY;YAAE,SAAS;QAC9C,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;YACxE,IAAI,UAAU,CAAC,SAAS,CAAC;gBAAE,SAAS;YACpC,MAAM,IAAI,KAAK,CACb,6BAA6B,IAAI,IAAI,KAAK,KAAK,SAAS,oBAAoB;gBAC5E,6FAA6F;gBAC7F,+FAA+F;gBAC/F,6DAA6D,CAC9D,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AAEH,MAAM,UAAU,kBAAkB,CAAC,MAAoB;IACrD,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,IAAI,KAAK,CAAC,QAAQ,KAAK,YAAY,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS;YAAE,SAAS;QACpF,IAAI,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC;YAAE,SAAS;QAE/C,MAAM,MAAM,GACV,IAAI,KAAK,SAAS;YAChB,CAAC,CAAC,GAAG,KAAK,CAAC,cAAc,yEAAyE;gBAChG,sEAAsE;gBACtE,+EAA+E;YACjF,CAAC,CAAC,GAAG,KAAK,CAAC,cAAc,sEAAsE;gBAC7F,gGAAgG;gBAChG,+CAA+C,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,mDAAmD;AACnD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAU,CAAC;AAEjE;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,WAAW,CAClB,MAA+B,EAC/B,GAAW,EACX,MAAgB,EAChB,EAAU;IAEV,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,GAAG,mBAAmB,CAAC,CAAC;QAC7C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,WAAW,CAClB,MAA+B,EAC/B,GAAW,EACX,MAAgB,EAChB,EAAU;IAEV,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,GAAG,0BAA0B,CAAC,CAAC;QACpD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,YAAY,CACnB,MAA+B,EAC/B,GAAW,EACX,MAAgB,EAChB,EAAU;IAEV,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,GAAG,oBAAoB,CAAC,CAAC;QAC9C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAC1B,MAA+B,EAC/B,GAAW,EACX,MAAgB,EAChB,EAAU;IAEV,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACzE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,GAAG,+BAA+B,CAAC,CAAC;IACzD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,cAAc,CAAC,KAAyC;IAC/D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC;IACjF,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AAEH,SAAS,cAAc,CACrB,KAAc,EACd,MAAgB,EAChB,EAAU,EACV,KAAK,GAAG,aAAa;IAErB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,uCAAuC,CAAC,CAAC;QACnE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,KAAK,GAAG,qBAAqB,CAAC,CAAC;YACzD,SAAS;QACX,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,GAAY,EAAE,MAAM,GAAG,UAAU;IAC9D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,gCAAgC,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC;IACxC,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,CAAC,aAAa,EAAE,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;IAClC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChF,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC;IACxC,IAAI,aAAa,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC;QACpE,MAAM,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAC7C,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACxF,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,KAAK,GAA+B,EAAE,CAAC;IAC7C,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,CAAC,IAAI,CAAC,sFAAsF,CAAC,CAAC;IACtG,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxD,MAAM,EAAE,GAAG,UAAU,IAAI,IAAI,CAAC;YAC9B,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACxB,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;gBACvC,SAAS;YACX,CAAC;YAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;YACtC,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;gBACvD,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,6BAA6B,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC5E,SAAS;YACX,CAAC;YAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtD,MAAM,CAAC,IAAI,CACT,GAAG,EAAE,mHAAmH,CACzH,CAAC;gBACF,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;gBAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAC9B,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,kCAAkC,CAAC,CAAC;oBACrD,SAAS;gBACX,CAAC;gBACD,sFAAsF;gBACtF,sFAAsF;gBACtF,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC5B,MAAM,CAAC,IAAI,CACT,GAAG,EAAE,gBAAgB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,uCAAuC;wBAC/E,yEAAyE,CAC5E,CAAC;oBACF,SAAS;gBACX,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC;YAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC1B,MAAM,KAAK,GAAqB;oBAC9B,QAAQ,EAAE,QAAQ;oBAClB,KAAK;oBACL,iBAAiB,EAAE,YAAY,CAAC,QAAQ,EAAE,mBAAmB,EAAE,MAAM,EAAE,EAAE,CAAC;oBAC1E,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,CAAC;oBACvD,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,CAAC;oBACvD,YAAY,EAAE,WAAW,CAAC,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,CAAC;oBAC/D,WAAW,EAAE,WAAW,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC;oBAC7D,gBAAgB,EAAE,WAAW,CAAC,QAAQ,EAAE,kBAAkB,EAAE,MAAM,EAAE,EAAE,CAAC;iBACxE,CAAC;gBACF,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;YACtB,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,GAAwB;oBACjC,QAAQ,EAAE,YAAY;oBACtB,KAAK;oBACL,iBAAiB,EAAE,YAAY,CAAC,QAAQ,EAAE,mBAAmB,EAAE,MAAM,EAAE,EAAE,CAAC;oBAC1E,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,CAAC;oBACvD,KAAK,EAAE,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC;oBACzD,cAAc,EAAE,WAAW,CAAC,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,CAAC;oBACnE,iGAAiG;oBACrG,sGAAsG;oBACtG,wDAAwD;oBACxD,UAAU,EAAE,cAAc,CAAC,cAAc,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,YAAY,CAAC,CAAC;oBACxF,aAAa,EAAE,WAAW,CAAC,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,EAAE,CAAC;oBACjE,WAAW,EAAE,cAAc,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC;oBAChE,UAAU,EAAE,WAAW,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,CAAC;oBAC3D,UAAU,EAAE,WAAW,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,CAAC;oBAC3D,wBAAwB,EAAE,WAAW,CAAC,QAAQ,EAAE,0BAA0B,EAAE,MAAM,EAAE,EAAE,CAAC;oBACvF,oBAAoB,EAAE,YAAY,CAAC,QAAQ,EAAE,sBAAsB,EAAE,MAAM,EAAE,EAAE,CAAC;iBACjF,CAAC;gBACF,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,mBAAmB,MAAM,UAAU,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnF,KAAK,CAAC,IAAI,GAAG,aAAa,CAAC;QAC3B,MAAM,KAAK,CAAC;IACd,CAAC;IAED,OAAO;QACL,UAAU,EAAE,OAAO,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE;QAClE,UAAU,EAAE,OAAO,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK;QACrE,SAAS,EAAE,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;QACzD,qBAAqB,EAAE,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG;QAClE,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE;QACnC,MAAM,EAAE,MAAM;QACd,UAAU,EAAE,IAAI;QAChB,YAAY,EAAE,IAAI;KACnB,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,uBAAuB,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnH,CAAC;IACD,OAAO,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;AACnE,CAAC"}

package/lib/daemon.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Daemon entry point logic: load configuration, build providers, serve the socket.
+ *
+ * Startup is fail-fast on purpose. A broker that cannot read its private key, or whose
+ * configuration is over-broad or malformed, must not come up and quietly serve nothing — an
+ * operator has to see the failure. `--check` performs the same validation and provider
+ * construction without binding the socket, which is what a deployment script should run
+ * before restarting the service.
+ */
+import type { Writable } from 'node:stream';
+import type { ProviderDeps } from './providers/index.ts';
+import type { BrokerConfig, Provider } from 'gcb-core';
+/** The daemon's parsed command line. */
+export interface DaemonArgs {
+    readonly configPath: string | undefined;
+    readonly checkOnly: boolean;
+    readonly help: boolean;
+}
+/**
+ * Parse the daemon's command line.
+ *
+ * @param argv - arguments after the script name.
+ * @returns the parsed arguments.
+ */
+export declare function parseArgs(argv: readonly string[]): DaemonArgs;
+/**
+ * Build providers for every configured host.
+ *
+ * @param config - the validated configuration.
+ * @param deps - injectable dependencies, for tests.
+ * @returns host -> provider.
+ */
+export declare function buildProviders(config: BrokerConfig, deps?: ProviderDeps): Map<string, Provider>;
+/**
+ * Run the daemon.
+ *
+ * @param argv - arguments after the script name.
+ * @param io - injectable streams.
+ * @returns the process exit code, once the daemon has shut down.
+ */
+export declare function runDaemon(argv: readonly string[], io?: {
+    stderr?: Writable;
+    stdout?: Writable;
+}): Promise<number>;
+//# sourceMappingURL=daemon.d.ts.map

package/lib/daemon.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAM5C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAQvD,wCAAwC;AACxC,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,CAmB7D;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,GAAE,YAAiB,GAAG,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAYnG;AAED;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,GAAE;IAAE,MAAM,CAAC,EAAE,QAAQ,CAAC;IAAC,MAAM,CAAC,EAAE,QAAQ,CAAA;CAAO,GAChD,OAAO,CAAC,MAAM,CAAC,CA6DjB"}

package/lib/daemon.js

@@ -0,0 +1,123 @@
+import { createAudit } from './audit.js';
+import { startBroker } from './broker.js';
+import { assertKeysReadable, assertUserTokensReadable, loadConfig, resolveConfigPath } from './config.js';
+import { createProvider } from './providers/index.js';
+/** Usage text. */
+const USAGE = 'usage: gcb daemon [--config <path>] [--check]\n' +
+    '       --config defaults to $GIT_BROKER_CONFIG, then ./broker.config.yml\n' +
+    '       --check validates the configuration and the key, then exits without binding the socket';
+/**
+ * Parse the daemon's command line.
+ *
+ * @param argv - arguments after the script name.
+ * @returns the parsed arguments.
+ */
+export function parseArgs(argv) {
+    let configPath;
+    let checkOnly = false;
+    let help = false;
+    for (let index = 0; index < argv.length; index += 1) {
+        const argument = argv[index];
+        if (argument === undefined)
+            continue;
+        if (argument === '--config') {
+            configPath = argv[index + 1];
+            index += 1;
+        }
+        else if (argument.startsWith('--config=')) {
+            configPath = argument.slice('--config='.length);
+        }
+        else if (argument === '--check') {
+            checkOnly = true;
+        }
+        else if (argument === '--help' || argument === '-h') {
+            help = true;
+        }
+    }
+    return { configPath, checkOnly, help };
+}
+/**
+ * Build providers for every configured host.
+ *
+ * @param config - the validated configuration.
+ * @param deps - injectable dependencies, for tests.
+ * @returns host -> provider.
+ */
+export function buildProviders(config, deps = {}) {
+    const providers = new Map();
+    for (const [host, block] of Object.entries(config.hosts)) {
+        providers.set(host, createProvider(host, block, {
+            ...deps,
+            skewSeconds: deps.skewSeconds ?? config.tokenCacheSkewSeconds,
+        }));
+    }
+    return providers;
+}
+/**
+ * Run the daemon.
+ *
+ * @param argv - arguments after the script name.
+ * @param io - injectable streams.
+ * @returns the process exit code, once the daemon has shut down.
+ */
+export async function runDaemon(argv, io = {}) {
+    const { stderr = process.stderr, stdout = process.stdout } = io;
+    const { configPath, checkOnly, help } = parseArgs(argv);
+    if (help) {
+        stdout.write(`${USAGE}\n`);
+        return 0;
+    }
+    // Same convention as the management commands: --config, else GIT_BROKER_CONFIG, else
+    // ./broker.config.yml. A wrong pick is loud, because it must load and validate to start at all.
+    const resolved = resolveConfigPath(configPath);
+    let config;
+    let providers;
+    try {
+        config = loadConfig(resolved);
+        assertKeysReadable(config);
+        assertUserTokensReadable(config);
+        providers = buildProviders(config, {
+            log: (message) => stderr.write(`gcb daemon: ${message}\n`),
+        });
+    }
+    catch (error) {
+        stderr.write(`gcb daemon: ${error.message}\n`);
+        return 1;
+    }
+    const summary = [...providers.entries()]
+        .map(([host, provider]) => {
+        const count = config.hosts[host]?.allow.length ?? 0;
+        return `${host}(${provider.name}, ${count} allow ${count === 1 ? 'entry' : 'entries'})`;
+    })
+        .join(', ');
+    stderr.write(`gcb daemon: config ${resolved} ok: ${summary}\n`);
+    if (checkOnly)
+        return 0;
+    const audit = createAudit({ path: config.auditPath, stderr });
+    let broker;
+    try {
+        broker = await startBroker({
+            config,
+            audit,
+            providers,
+            log: (message) => stderr.write(`gcb daemon: ${message}\n`),
+        });
+    }
+    catch (error) {
+        stderr.write(`gcb daemon: cannot start: ${error.message}\n`);
+        return 1;
+    }
+    await new Promise((resolve) => {
+        const shutdown = (signal) => {
+            stderr.write(`gcb daemon: ${signal} received, shutting down\n`);
+            broker
+                .close()
+                .then(() => audit.close())
+                .then(() => resolve());
+        };
+        process.once('SIGTERM', () => shutdown('SIGTERM'));
+        process.once('SIGINT', () => shutdown('SIGINT'));
+    });
+    return 0;
+}
+//# sourceMappingURL=daemon.js.map

package/lib/daemon.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon.js","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC1G,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAItD,kBAAkB;AAClB,MAAM,KAAK,GACT,iDAAiD;IACjD,4EAA4E;IAC5E,+FAA+F,CAAC;AASlG;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,IAAuB;IAC/C,IAAI,UAA8B,CAAC;IACnC,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,QAAQ,KAAK,SAAS;YAAE,SAAS;QACrC,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC5B,UAAU,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC7B,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;aAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5C,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAClD,CAAC;aAAM,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;aAAM,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtD,IAAI,GAAG,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,MAAoB,EAAE,IAAI,GAAiB,EAAE;IAC1E,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,SAAS,CAAC,GAAG,CACX,IAAI,EACJ,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE;YAC1B,GAAG,IAAI;YACP,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,qBAAqB;SAC9D,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAuB,EACvB,EAAE,GAA6C,EAAE;IAEjD,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC;IAChE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,CAAC;IACX,CAAC;IACD,qFAAqF;IACrF,gGAAgG;IAChG,MAAM,QAAQ,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAE/C,IAAI,MAAoB,CAAC;IACzB,IAAI,SAAgC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC9B,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC3B,wBAAwB,CAAC,MAAM,CAAC,CAAC;QACjC,SAAS,GAAG,cAAc,CAAC,MAAM,EAAE;YACjC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,OAAO,IAAI,CAAC;SAC3D,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,eAAgB,KAAe,CAAC,OAAO,IAAI,CAAC,CAAC;QAC1D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC;SACrC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE;QACxB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;QACpD,OAAO,GAAG,IAAI,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC;IAC1F,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,CAAC,KAAK,CAAC,sBAAsB,QAAQ,QAAQ,OAAO,IAAI,CAAC,CAAC;IAEhE,IAAI,SAAS;QAAE,OAAO,CAAC,CAAC;IAExB,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9D,IAAI,MAA+C,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,WAAW,CAAC;YACzB,MAAM;YACN,KAAK;YACL,SAAS;YACT,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,OAAO,IAAI,CAAC;SAC3D,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,6BAA8B,KAAe,CAAC,OAAO,IAAI,CAAC,CAAC;QACxE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAClC,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAQ,EAAE;YACxC,MAAM,CAAC,KAAK,CAAC,eAAe,MAAM,4BAA4B,CAAC,CAAC;YAChE,MAAM;iBACH,KAAK,EAAE;iBACP,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;iBACzB,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3B,CAAC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,CAAC;AACX,CAAC"}