run402 4.39.0 → 4.40.0

package/sdk/dist/node/gitvault-mirror-backend.js

@@ -0,0 +1,374 @@
+/**
+ * gitvault-mirror-and-recover — mirror storage backends (design D1/D2/D7,
+ * task 2.2).
+ *
+ * S3-or-directory behind ONE interface, so the writer/reconcile engine
+ * (`gitvault-mirror.ts`) and the recovery engine (`gitvault-recover.ts`)
+ * never know which one they are talking to.
+ *
+ * `@run402/sdk` deliberately carries no AWS SDK dependency (see the package's
+ * own dependency list — every crypto primitive is a narrowly-scoped,
+ * individually-audited package, never a broad vendor SDK). The S3 backend
+ * here is therefore a MINIMAL, hand-rolled AWS Signature Version 4 client
+ * (Node's built-in `fetch` + `node:crypto`), covering exactly the four
+ * operations the mirror needs: HEAD (existence/size), PUT (create-only where
+ * the bucket honors `If-None-Match`), GET, and `ListObjectsV2`. This is a
+ * DELIBERATE, DOCUMENTED SCOPE LIMIT: it does not implement the full AWS SDK
+ * credential provider chain (no IMDS/EC2-role, no SSO, no assume-role) — only
+ * the two mechanisms design D2 names: a NAMED PROFILE read from the
+ * standard `~/.aws/credentials` + `~/.aws/config` files, and the AMBIENT
+ * environment chain (`AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY`/
+ * `AWS_SESSION_TOKEN`). Multipart upload is out of scope too — gitvault
+ * objects are already capped well under S3's 5 GiB single-PUT limit by the
+ * protocol's own object-size bounds (§4.6/§4.7).
+ */
+import { createHash, createHmac } from "node:crypto";
+import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { LocalError } from "../errors.js";
+function fail(code, message, context, details, nextActions) {
+    throw new LocalError(message, context, { code, details, ...(nextActions ? { next_actions: nextActions } : {}) });
+}
+// ─── Directory backend ────────────────────────────────────────────────────────
+/**
+ * A local (or network-mounted) directory, laid out identically to the bucket
+ * (`<root>/source/<repo_id>/head/<gen>`, etc. — but the backend is
+ * repo-scoped, so `root` IS already `<destination>/source/<repo_id>`). Writes
+ * are atomic (temp file + rename); create-only is REAL create-only via
+ * `wx` (`O_CREAT|O_EXCL`) — never a silent overwrite of a differently-keyed
+ * torn write.
+ */
+export class DirectoryMirrorBackend {
+    root;
+    constructor(root) {
+        this.root = root;
+    }
+    describe() {
+        return this.root;
+    }
+    resolve(key) {
+        if (key.includes("..") || key.startsWith("/"))
+            fail("GITVAULT_MIRROR_KEY_INVALID", `unsafe mirror key: ${key}`, "resolving gitvault mirror path", { key });
+        return join(this.root, ...key.split("/"));
+    }
+    async head(key) {
+        const path = this.resolve(key);
+        if (!existsSync(path))
+            return null;
+        const st = statSync(path);
+        if (!st.isFile())
+            return null;
+        return { size_bytes: String(st.size) };
+    }
+    async get(key) {
+        const path = this.resolve(key);
+        if (!existsSync(path))
+            return null;
+        try {
+            return new Uint8Array(readFileSync(path));
+        }
+        catch {
+            return null;
+        }
+    }
+    async putCreateOnly(key, bytes) {
+        const path = this.resolve(key);
+        if (existsSync(path))
+            return { created: false };
+        const dir = dirname(path);
+        mkdirSync(dir, { recursive: true });
+        const tmp = `${path}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
+        writeFileSync(tmp, bytes, { flag: "wx" });
+        try {
+            // Real create-only: `wx` on the FINAL path too, so a concurrent writer
+            // racing us loses the rename, not the data — the loser's temp file is
+            // cleaned up and it reports `created: false` (the winner's bytes are
+            // trusted; the caller compares hashes if it cares which one landed).
+            renameSync(tmp, path);
+        }
+        catch (e) {
+            try {
+                unlinkSync(tmp);
+            }
+            catch {
+                /* best-effort cleanup */
+            }
+            if (e.code === "EEXIST" || existsSync(path))
+                return { created: false };
+            throw e;
+        }
+        return { created: true };
+    }
+    async list(prefix = "") {
+        const out = [];
+        const walk = (dir, rel) => {
+            if (!existsSync(dir))
+                return;
+            for (const entry of readdirSync(dir, { withFileTypes: true })) {
+                if (entry.name.endsWith(".tmp"))
+                    continue;
+                const childRel = rel ? `${rel}/${entry.name}` : entry.name;
+                const childAbs = join(dir, entry.name);
+                if (entry.isDirectory())
+                    walk(childAbs, childRel);
+                else if (entry.isFile())
+                    out.push(childRel);
+            }
+        };
+        walk(this.root, "");
+        return out.filter((k) => k.startsWith(prefix)).sort();
+    }
+}
+function hmacSha256(key, data) {
+    return createHmac("sha256", key).update(data, "utf8").digest();
+}
+function sha256Hex(data) {
+    return createHash("sha256").update(data).digest("hex");
+}
+function amzDate(now) {
+    const iso = now.toISOString().replace(/[:-]|\.\d{3}/g, "");
+    return { dateTime: `${iso}`, date: iso.slice(0, 8) };
+}
+function signingKey(secretKey, date, region, service) {
+    const kDate = hmacSha256(`AWS4${secretKey}`, date);
+    const kRegion = hmacSha256(kDate, region);
+    const kService = hmacSha256(kRegion, service);
+    return hmacSha256(kService, "aws4_request");
+}
+/** One SigV4-signed request against an S3-compatible endpoint. */
+async function s3Request(input) {
+    const host = input.endpoint ? new URL(input.endpoint).host : `${input.bucket}.s3.${input.region}.amazonaws.com`;
+    const proto = input.endpoint ? new URL(input.endpoint).protocol.replace(":", "") : "https";
+    const canonicalUri = `/${input.key.split("/").map(encodeURIComponent).join("/")}`;
+    const query = { ...(input.query ?? {}) };
+    const sortedQueryKeys = Object.keys(query).sort();
+    const canonicalQuery = sortedQueryKeys.map((k) => `${encodeURIComponent(k)}=${encodeURIComponent(query[k])}`).join("&");
+    const now = new Date();
+    const { date, dateTime } = amzDate(now);
+    const bodyHash = sha256Hex(Buffer.from(input.body ?? new Uint8Array(0)));
+    const headers = {
+        host,
+        "x-amz-content-sha256": bodyHash,
+        "x-amz-date": dateTime,
+        ...(input.credentials.session_token ? { "x-amz-security-token": input.credentials.session_token } : {}),
+        ...(input.extraHeaders ?? {}),
+    };
+    const sortedHeaderKeys = Object.keys(headers).sort();
+    const canonicalHeaders = sortedHeaderKeys.map((k) => `${k}:${headers[k].trim()}\n`).join("");
+    const signedHeaders = sortedHeaderKeys.join(";");
+    const canonicalRequest = [input.method, canonicalUri, canonicalQuery, canonicalHeaders, signedHeaders, bodyHash].join("\n");
+    const scope = `${date}/${input.region}/s3/aws4_request`;
+    const stringToSign = ["AWS4-HMAC-SHA256", dateTime, scope, sha256Hex(canonicalRequest)].join("\n");
+    const key = signingKey(input.credentials.secret_access_key, date, input.region, "s3");
+    const signature = createHmac("sha256", key).update(stringToSign, "utf8").digest("hex");
+    const authorization = `AWS4-HMAC-SHA256 Credential=${input.credentials.access_key_id}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`;
+    const url = `${proto}://${host}${canonicalUri}${canonicalQuery ? `?${canonicalQuery}` : ""}`;
+    return fetch(url, {
+        method: input.method,
+        headers: { ...headers, authorization },
+        ...(input.body ? { body: input.body } : {}),
+    });
+}
+/** Resolve a NAMED PROFILE (`~/.aws/credentials` + `~/.aws/config`) or the AMBIENT environment chain — see the module doc's documented scope limit. */
+export function resolveMirrorCredentials(credential) {
+    if (credential.kind === "ambient") {
+        const accessKeyId = process.env.AWS_ACCESS_KEY_ID;
+        const secretAccessKey = process.env.AWS_SECRET_ACCESS_KEY;
+        if (!accessKeyId || !secretAccessKey) {
+            fail("GITVAULT_MIRROR_CREDENTIALS_UNRESOLVED", "no ambient AWS credentials found (AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY unset)", "resolving gitvault mirror credentials", undefined, [{ action: "export AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY, or configure a named profile with `run402 gitvault mirror set ... --profile <name>`" }]);
+        }
+        return { access_key_id: accessKeyId, secret_access_key: secretAccessKey, ...(process.env.AWS_SESSION_TOKEN ? { session_token: process.env.AWS_SESSION_TOKEN } : {}) };
+    }
+    const credsPath = join(homedir(), ".aws", "credentials");
+    let text;
+    try {
+        text = readFileSync(credsPath, "utf8");
+    }
+    catch {
+        fail("GITVAULT_MIRROR_CREDENTIALS_UNRESOLVED", `no AWS credentials file at ${credsPath}`, "resolving gitvault mirror credentials", { profile: credential.profile }, [{ action: `run 'aws configure --profile ${credential.profile}', or configure the destination for --ambient credentials instead` }]);
+    }
+    const section = parseIniSection(text, credential.profile);
+    const accessKeyId = section.aws_access_key_id;
+    const secretAccessKey = section.aws_secret_access_key;
+    if (!accessKeyId || !secretAccessKey) {
+        fail("GITVAULT_MIRROR_CREDENTIALS_UNRESOLVED", `profile '${credential.profile}' is missing aws_access_key_id/aws_secret_access_key in ${credsPath}`, "resolving gitvault mirror credentials", { profile: credential.profile }, [{ action: `run 'aws configure --profile ${credential.profile}'` }]);
+    }
+    return { access_key_id: accessKeyId, secret_access_key: secretAccessKey, ...(section.aws_session_token ? { session_token: section.aws_session_token } : {}) };
+}
+/** A minimal INI-section parser — no dependency, no more than the shape `~/.aws/credentials` actually needs. */
+function parseIniSection(text, section) {
+    const out = {};
+    let inSection = false;
+    for (const rawLine of text.split(/\r?\n/)) {
+        const line = rawLine.trim();
+        if (line === "" || line.startsWith("#") || line.startsWith(";"))
+            continue;
+        const header = /^\[(.+)\]$/.exec(line);
+        if (header) {
+            inSection = header[1].trim() === section;
+            continue;
+        }
+        if (!inSection)
+            continue;
+        const eq = line.indexOf("=");
+        if (eq === -1)
+            continue;
+        out[line.slice(0, eq).trim()] = line.slice(eq + 1).trim();
+    }
+    return out;
+}
+export class S3MirrorBackend {
+    bucket;
+    prefix;
+    region;
+    credential;
+    endpoint;
+    constructor(bucket, prefix, region, credential, endpoint) {
+        this.bucket = bucket;
+        this.prefix = prefix;
+        this.region = region;
+        this.credential = credential;
+        this.endpoint = endpoint;
+    }
+    describe() {
+        return `s3://${this.bucket}/${this.prefix}`;
+    }
+    fullKey(key) {
+        return this.prefix ? `${this.prefix}/${key}` : key;
+    }
+    creds() {
+        return resolveMirrorCredentials(this.credential);
+    }
+    async head(key) {
+        const r = await s3Request({ method: "HEAD", bucket: this.bucket, region: this.region, endpoint: this.endpoint, key: this.fullKey(key), credentials: this.creds() });
+        if (r.status === 404)
+            return null;
+        if (!r.ok)
+            fail("GITVAULT_MIRROR_S3_ERROR", `HEAD ${key} failed (HTTP ${r.status})`, "reading gitvault mirror object", { key, status: r.status });
+        const len = r.headers.get("content-length");
+        return { size_bytes: len ?? "0" };
+    }
+    async get(key) {
+        const r = await s3Request({ method: "GET", bucket: this.bucket, region: this.region, endpoint: this.endpoint, key: this.fullKey(key), credentials: this.creds() });
+        if (r.status === 404)
+            return null;
+        if (!r.ok)
+            fail("GITVAULT_MIRROR_S3_ERROR", `GET ${key} failed (HTTP ${r.status})`, "reading gitvault mirror object", { key, status: r.status });
+        return new Uint8Array(await r.arrayBuffer());
+    }
+    async putCreateOnly(key, bytes) {
+        // `If-None-Match: *` create-only PUT — the same conditional-write
+        // mechanism the primary vault bucket's own policy mandates (protocol
+        // §3). Documented as "recommended, not required" (design D7): this is
+        // the customer's bucket and their policy, so a provider/bucket that
+        // rejects the header (older buckets, some S3-compatible stores) falls
+        // back to read-and-compare instead of hard-failing the sync.
+        const r = await s3Request({
+            method: "PUT",
+            bucket: this.bucket,
+            region: this.region,
+            endpoint: this.endpoint,
+            key: this.fullKey(key),
+            credentials: this.creds(),
+            body: bytes,
+            extraHeaders: { "if-none-match": "*", "content-length": String(bytes.length) },
+        });
+        if (r.status === 412 || r.status === 409)
+            return { created: false };
+        if (r.ok)
+            return { created: true };
+        if (r.status === 400 || r.status === 501) {
+            // The condition itself was rejected (unsupported by this bucket/provider)
+            // rather than failing — read-and-compare fallback.
+            const existing = await this.head(key);
+            if (existing)
+                return { created: false };
+            const retry = await s3Request({ method: "PUT", bucket: this.bucket, region: this.region, endpoint: this.endpoint, key: this.fullKey(key), credentials: this.creds(), body: bytes, extraHeaders: { "content-length": String(bytes.length) } });
+            if (!retry.ok)
+                fail("GITVAULT_MIRROR_S3_ERROR", `PUT ${key} failed (HTTP ${retry.status})`, "writing gitvault mirror object", { key, status: retry.status });
+            return { created: true };
+        }
+        fail("GITVAULT_MIRROR_S3_ERROR", `PUT ${key} failed (HTTP ${r.status})`, "writing gitvault mirror object", { key, status: r.status });
+    }
+    async list(prefix = "") {
+        const out = [];
+        let continuationToken;
+        const fullPrefix = this.fullKey(prefix);
+        for (;;) {
+            const query = { "list-type": "2", prefix: fullPrefix };
+            if (continuationToken)
+                query["continuation-token"] = continuationToken;
+            const r = await s3Request({ method: "GET", bucket: this.bucket, region: this.region, endpoint: this.endpoint, key: "", query, credentials: this.creds() });
+            if (!r.ok)
+                fail("GITVAULT_MIRROR_S3_ERROR", `ListObjectsV2 failed (HTTP ${r.status})`, "listing gitvault mirror objects", { status: r.status });
+            const xml = await r.text();
+            for (const m of xml.matchAll(/<Key>([^<]*)<\/Key>/g)) {
+                const full = decodeXmlEntities(m[1]);
+                out.push(this.prefix ? full.slice(this.prefix.length + 1) : full);
+            }
+            const truncated = /<IsTruncated>true<\/IsTruncated>/.test(xml);
+            if (!truncated)
+                break;
+            const next = /<NextContinuationToken>([^<]*)<\/NextContinuationToken>/.exec(xml);
+            if (!next)
+                break;
+            continuationToken = decodeXmlEntities(next[1]);
+        }
+        return out.sort();
+    }
+}
+function decodeXmlEntities(s) {
+    return s.replace(/&(amp|lt|gt|quot|apos|#\d+);/g, (m, entity) => {
+        switch (entity) {
+            case "amp": return "&";
+            case "lt": return "<";
+            case "gt": return ">";
+            case "quot": return "\"";
+            case "apos": return "'";
+            default: return entity.startsWith("#") ? String.fromCharCode(Number(entity.slice(1))) : m;
+        }
+    });
+}
+// ─── Factory ──────────────────────────────────────────────────────────────────
+/** Open the backend for one vault's mirror config — repo-scoped: the directory backend's root and the S3 prefix both already carry `source/<repo_id>`. */
+export function openGitvaultMirrorBackend(destination, repoId, credential) {
+    if (destination.kind === "directory") {
+        return new DirectoryMirrorBackend(join(destination.path, "source", repoId));
+    }
+    if (!credential)
+        fail("GITVAULT_MIRROR_CREDENTIAL_REQUIRED", "an s3 mirror destination needs a credential", "opening gitvault mirror backend");
+    const prefix = destination.prefix ? `${destination.prefix}/source/${repoId}` : `source/${repoId}`;
+    return new S3MirrorBackend(destination.bucket, prefix, destination.region, credential, destination.endpoint);
+}
+/**
+ * List every `repo_id` mirrored under a destination's root (`source/<repo_id>/…`),
+ * WITHOUT repo-scoping the backend first — the discovery step `recover
+ * <source>` needs before it can even open the repo-scoped backend {@link
+ * openGitvaultMirrorBackend} expects. Used only to resolve which vault a bare
+ * destination URL (no `--repo`) names.
+ */
+export async function discoverMirroredRepoIds(destination, credential) {
+    const root = destination.kind === "directory"
+        ? new DirectoryMirrorBackend(destination.path)
+        : (() => {
+            if (!credential)
+                fail("GITVAULT_MIRROR_CREDENTIAL_REQUIRED", "an s3 mirror destination needs a credential", "discovering mirrored gitvault repos");
+            return new S3MirrorBackend(destination.bucket, destination.prefix, destination.region, credential, destination.endpoint);
+        })();
+    const keys = await root.list("source/");
+    const ids = new Set();
+    for (const key of keys) {
+        const m = /^source\/(src_[0-9a-f]{32})\//.exec(key);
+        if (m)
+            ids.add(m[1]);
+    }
+    return [...ids].sort();
+}
+/** Best-effort recursive delete of an empty (or now-empty) mirror root — used by `mirror remove --purge` semantics if ever added; NOT called by plain `mirror remove` (design: config removal never touches the customer's bytes). Exported for tests. */
+export function _rmMirrorRoot(destination, repoId) {
+    if (destination.kind !== "directory")
+        return;
+    rmSync(join(destination.path, "source", repoId), { recursive: true, force: true });
+}
+//# sourceMappingURL=gitvault-mirror-backend.js.map

package/sdk/dist/node/gitvault-mirror-backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitvault-mirror-backend.js","sourceRoot":"","sources":["../../src/node/gitvault-mirror-backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACpI,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAG1C,SAAS,IAAI,CAAC,IAAY,EAAE,OAAe,EAAE,OAAe,EAAE,OAAiB,EAAE,WAAuB;IACtG,MAAM,IAAI,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AACnH,CAAC;AAiCD,iFAAiF;AAEjF;;;;;;;GAOG;AACH,MAAM,OAAO,sBAAsB;IACJ;IAA7B,YAA6B,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;IAE7C,QAAQ;QACN,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAEO,OAAO,CAAC,GAAW;QACzB,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,6BAA6B,EAAE,sBAAsB,GAAG,EAAE,EAAE,gCAAgC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3J,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE;YAAE,OAAO,IAAI,CAAC;QAC9B,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,IAAI,CAAC;YACH,OAAO,IAAI,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,GAAW,EAAE,KAAiB;QAChD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAChF,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC;YACH,uEAAuE;YACvE,sEAAsE;YACtE,qEAAqE;YACrE,qEAAqE;YACrE,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC;gBACH,UAAU,CAAC,GAAG,CAAC,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,yBAAyB;YAC3B,CAAC;YACD,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAClG,MAAM,CAAC,CAAC;QACV,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,EAAE;QACpB,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,GAAW,EAAQ,EAAE;YAC9C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,OAAO;YAC7B,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC9D,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAAE,SAAS;gBAC1C,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;gBAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBACvC,IAAI,KAAK,CAAC,WAAW,EAAE;oBAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;qBAC7C,IAAI,KAAK,CAAC,MAAM,EAAE;oBAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACpB,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACxD,CAAC;CACF;AAUD,SAAS,UAAU,CAAC,GAAoB,EAAE,IAAY;IACpD,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AACjE,CAAC;AAED,SAAS,SAAS,CAAC,IAAqB;IACtC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,OAAO,CAAC,GAAS;IACxB,MAAM,GAAG,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IAC3D,OAAO,EAAE,QAAQ,EAAE,GAAG,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,UAAU,CAAC,SAAiB,EAAE,IAAY,EAAE,MAAc,EAAE,OAAe;IAClF,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,SAAS,EAAE,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9C,OAAO,UAAU,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;AAC9C,CAAC;AAED,kEAAkE;AAClE,KAAK,UAAU,SAAS,CAAC,KAUxB;IACC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,OAAO,KAAK,CAAC,MAAM,gBAAgB,CAAC;IAChH,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC3F,MAAM,YAAY,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAClF,MAAM,KAAK,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;IACzC,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,MAAM,cAAc,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzH,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,OAAO,GAA2B;QACtC,IAAI;QACJ,sBAAsB,EAAE,QAAQ;QAChC,YAAY,EAAE,QAAQ;QACtB,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,KAAK,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvG,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC;KAC9B,CAAC;IACF,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9F,MAAM,aAAa,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,gBAAgB,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5H,MAAM,KAAK,GAAG,GAAG,IAAI,IAAI,KAAK,CAAC,MAAM,kBAAkB,CAAC;IACxD,MAAM,YAAY,GAAG,CAAC,kBAAkB,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnG,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACtF,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvF,MAAM,aAAa,GAAG,+BAA+B,KAAK,CAAC,WAAW,CAAC,aAAa,IAAI,KAAK,mBAAmB,aAAa,eAAe,SAAS,EAAE,CAAC;IACxJ,MAAM,GAAG,GAAG,GAAG,KAAK,MAAM,IAAI,GAAG,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC7F,OAAO,KAAK,CAAC,GAAG,EAAE;QAChB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE;QACtC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAA2B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnE,CAAC,CAAC;AACL,CAAC;AAED,uJAAuJ;AACvJ,MAAM,UAAU,wBAAwB,CAAC,UAAoC;IAC3E,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAClD,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QAC1D,IAAI,CAAC,WAAW,IAAI,CAAC,eAAe,EAAE,CAAC;YACrC,IAAI,CAAC,wCAAwC,EAAE,oFAAoF,EAAE,uCAAuC,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,yIAAyI,EAAE,CAAC,CAAC,CAAC;QACpV,CAAC;QACD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAAE,eAAe,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACxK,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;IACzD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,wCAAwC,EAAE,8BAA8B,SAAS,EAAE,EAAE,uCAAuC,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,gCAAgC,UAAU,CAAC,OAAO,mEAAmE,EAAE,CAAC,CAAC,CAAC;IAC3S,CAAC;IACD,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAC9C,MAAM,eAAe,GAAG,OAAO,CAAC,qBAAqB,CAAC;IACtD,IAAI,CAAC,WAAW,IAAI,CAAC,eAAe,EAAE,CAAC;QACrC,IAAI,CAAC,wCAAwC,EAAE,YAAY,UAAU,CAAC,OAAO,2DAA2D,SAAS,EAAE,EAAE,uCAAuC,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,gCAAgC,UAAU,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC;IACtS,CAAC;IACD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAAE,eAAe,EAAE,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAChK,CAAC;AAED,gHAAgH;AAChH,SAAS,eAAe,CAAC,IAAY,EAAE,OAAe;IACpD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC1E,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,MAAM,EAAE,CAAC;YACX,SAAS,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,KAAK,OAAO,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,IAAI,CAAC,SAAS;YAAE,SAAS;QACzB,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAS;QACxB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,OAAO,eAAe;IAEP;IACA;IACA;IACA;IACA;IALnB,YACmB,MAAc,EACd,MAAc,EACd,MAAc,EACd,UAAoC,EACpC,QAAiB;QAJjB,WAAM,GAAN,MAAM,CAAQ;QACd,WAAM,GAAN,MAAM,CAAQ;QACd,WAAM,GAAN,MAAM,CAAQ;QACd,eAAU,GAAV,UAAU,CAA0B;QACpC,aAAQ,GAAR,QAAQ,CAAS;IACjC,CAAC;IAEJ,QAAQ;QACN,OAAO,QAAQ,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;IAC9C,CAAC;IAEO,OAAO,CAAC,GAAW;QACzB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IACrD,CAAC;IAEO,KAAK;QACX,OAAO,wBAAwB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW;QACpB,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACpK,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAClC,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,IAAI,CAAC,0BAA0B,EAAE,QAAQ,GAAG,iBAAiB,CAAC,CAAC,MAAM,GAAG,EAAE,gCAAgC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAClJ,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC5C,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,GAAG,EAAE,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACnK,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAClC,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,IAAI,CAAC,0BAA0B,EAAE,OAAO,GAAG,iBAAiB,CAAC,CAAC,MAAM,GAAG,EAAE,gCAAgC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACjJ,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,GAAW,EAAE,KAAiB;QAChD,kEAAkE;QAClE,qEAAqE;QACrE,sEAAsE;QACtE,oEAAoE;QACpE,sEAAsE;QACtE,6DAA6D;QAC7D,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC;YACxB,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;YACtB,WAAW,EAAE,IAAI,CAAC,KAAK,EAAE;YACzB,IAAI,EAAE,KAAK;YACX,YAAY,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE;SAC/E,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACpE,IAAI,CAAC,CAAC,EAAE;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACzC,0EAA0E;YAC1E,mDAAmD;YACnD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,QAAQ;gBAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9O,IAAI,CAAC,KAAK,CAAC,EAAE;gBAAE,IAAI,CAAC,0BAA0B,EAAE,OAAO,GAAG,iBAAiB,KAAK,CAAC,MAAM,GAAG,EAAE,gCAAgC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7J,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QACD,IAAI,CAAC,0BAA0B,EAAE,OAAO,GAAG,iBAAiB,CAAC,CAAC,MAAM,GAAG,EAAE,gCAAgC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACxI,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,EAAE;QACpB,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,IAAI,iBAAqC,CAAC;QAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACxC,SAAS,CAAC;YACR,MAAM,KAAK,GAA2B,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;YAC/E,IAAI,iBAAiB;gBAAE,KAAK,CAAC,oBAAoB,CAAC,GAAG,iBAAiB,CAAC;YACvE,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC3J,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,IAAI,CAAC,0BAA0B,EAAE,8BAA8B,CAAC,CAAC,MAAM,GAAG,EAAE,iCAAiC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YAChJ,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;gBACrD,MAAM,IAAI,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;gBACtC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACpE,CAAC;YACD,MAAM,SAAS,GAAG,kCAAkC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/D,IAAI,CAAC,SAAS;gBAAE,MAAM;YACtB,MAAM,IAAI,GAAG,yDAAyD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjF,IAAI,CAAC,IAAI;gBAAE,MAAM;YACjB,iBAAiB,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;CACF;AAED,SAAS,iBAAiB,CAAC,CAAS;IAClC,OAAO,CAAC,CAAC,OAAO,CAAC,+BAA+B,EAAE,CAAC,CAAC,EAAE,MAAc,EAAE,EAAE;QACtE,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,KAAK,CAAC,CAAC,OAAO,GAAG,CAAC;YACvB,KAAK,IAAI,CAAC,CAAC,OAAO,GAAG,CAAC;YACtB,KAAK,IAAI,CAAC,CAAC,OAAO,GAAG,CAAC;YACtB,KAAK,MAAM,CAAC,CAAC,OAAO,IAAI,CAAC;YACzB,KAAK,MAAM,CAAC,CAAC,OAAO,GAAG,CAAC;YACxB,OAAO,CAAC,CAAC,OAAO,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,iFAAiF;AAEjF,0JAA0J;AAC1J,MAAM,UAAU,yBAAyB,CAAC,WAAsC,EAAE,MAAc,EAAE,UAAqC;IACrI,IAAI,WAAW,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACrC,OAAO,IAAI,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,UAAU;QAAE,IAAI,CAAC,qCAAqC,EAAE,6CAA6C,EAAE,iCAAiC,CAAC,CAAC;IAC/I,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,MAAM,WAAW,MAAM,EAAE,CAAC,CAAC,CAAC,UAAU,MAAM,EAAE,CAAC;IAClG,OAAO,IAAI,eAAe,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;AAC/G,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,WAAsC,EAAE,UAAqC;IACzH,MAAM,IAAI,GAA0B,WAAW,CAAC,IAAI,KAAK,WAAW;QAClE,CAAC,CAAC,IAAI,sBAAsB,CAAC,WAAW,CAAC,IAAI,CAAC;QAC9C,CAAC,CAAC,CAAC,GAAG,EAAE;YACJ,IAAI,CAAC,UAAU;gBAAE,IAAI,CAAC,qCAAqC,EAAE,6CAA6C,EAAE,qCAAqC,CAAC,CAAC;YACnJ,OAAO,IAAI,eAAe,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC3H,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,+BAA+B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpD,IAAI,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,0PAA0P;AAC1P,MAAM,UAAU,aAAa,CAAC,WAAsC,EAAE,MAAc;IAClF,IAAI,WAAW,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO;IAC7C,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACrF,CAAC"}

package/sdk/dist/node/gitvault-mirror-config.d.ts

@@ -0,0 +1,53 @@
+import { GitvaultKeystore } from "./gitvault-keystore.js";
+/** Where the mirror writes objects. Directory is a plain local (or network-mounted) path; S3 is `s3://<bucket>/<prefix>`. */
+export type GitvaultMirrorDestination = {
+    kind: "directory";
+    path: string;
+} | {
+    kind: "s3";
+    bucket: string;
+    prefix: string;
+    region: string;
+    endpoint?: string;
+};
+/** How the S3 destination authenticates. Never a raw key — see the module doc. */
+export type GitvaultMirrorCredential = {
+    kind: "profile";
+    profile: string;
+} | {
+    kind: "ambient";
+};
+/** `mirrors/<repo_id>.json` — the ONLY thing this file persists: where, and which named credential to resolve at use time. */
+export interface GitvaultMirrorConfig {
+    version: 1;
+    repo_id: string;
+    destination: GitvaultMirrorDestination;
+    /** Present only for an `s3` destination — a directory destination needs no credential. */
+    credential?: GitvaultMirrorCredential;
+    created_at: string;
+    updated_at: string;
+}
+export declare function mirrorsDir(keystore: GitvaultKeystore): string;
+export declare function mirrorConfigPath(keystore: GitvaultKeystore, repoId: string): string;
+/** Read the mirror config for one vault, or `null` when none is configured. */
+export declare function readMirrorConfig(keystore: GitvaultKeystore, repoId: string): GitvaultMirrorConfig | null;
+/** Every repo id with a mirror configured on this machine. */
+export declare function listMirroredRepoIds(keystore: GitvaultKeystore): string[];
+/** Set (create or replace) the mirror destination for one vault. */
+export declare function saveMirrorConfig(keystore: GitvaultKeystore, input: {
+    repo_id: string;
+    destination: GitvaultMirrorDestination;
+    credential?: GitvaultMirrorCredential;
+}, now?: () => Date): GitvaultMirrorConfig;
+/** Remove the mirror config for one vault. Never touches the mirror's own bytes — this only stops future pushes/syncs from targeting it. */
+export declare function removeMirrorConfig(keystore: GitvaultKeystore, repoId: string): {
+    removed: boolean;
+};
+/** Parse `s3://<bucket>/<prefix>` or a plain filesystem path into a {@link GitvaultMirrorDestination}. */
+export declare function parseMirrorDestinationUrl(url: string, options?: {
+    region?: string;
+    endpoint?: string;
+}): GitvaultMirrorDestination;
+/** Render a destination back to the address form a human typed (for `status`/errors). */
+export declare function formatMirrorDestination(destination: GitvaultMirrorDestination): string;
+//# sourceMappingURL=gitvault-mirror-config.d.ts.map

package/sdk/dist/node/gitvault-mirror-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitvault-mirror-config.d.ts","sourceRoot":"","sources":["../../src/node/gitvault-mirror-config.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,gBAAgB,EAAyC,MAAM,wBAAwB,CAAC;AAMjG,6HAA6H;AAC7H,MAAM,MAAM,yBAAyB,GACjC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtF,kFAAkF;AAClF,MAAM,MAAM,wBAAwB,GAChC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC;AAExB,8HAA8H;AAC9H,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,CAAC,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,yBAAyB,CAAC;IACvC,0FAA0F;IAC1F,UAAU,CAAC,EAAE,wBAAwB,CAAC;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,UAAU,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,CAE7D;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAGnF;AAED,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAaxG;AAED,8DAA8D;AAC9D,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,EAAE,CAQxE;AAED,oEAAoE;AACpE,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,yBAAyB,CAAC;IAAC,UAAU,CAAC,EAAE,wBAAwB,CAAA;CAAE,EAAE,GAAG,GAAE,MAAM,IAAuB,GAAG,oBAAoB,CAehO;AAED,4IAA4I;AAC5I,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CASnG;AAED,0GAA0G;AAC1G,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,yBAAyB,CAYtI;AAED,yFAAyF;AACzF,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,yBAAyB,GAAG,MAAM,CAEtF"}

package/sdk/dist/node/gitvault-mirror-config.js

@@ -0,0 +1,112 @@
+/**
+ * gitvault-mirror-and-recover — mirror destination config (design D1/D2,
+ * task 2.1).
+ *
+ * Per-vault mirror configuration lives BESIDE the keystore, in its own
+ * sibling directory (`<keystore root>/mirrors/<repo_id>.json`) — never in
+ * `run402.config.json` (that file is committed to the repository, and a
+ * mirror destination is a per-machine operational fact, not something to
+ * share with every clone) and never containing a raw secret value. The
+ * credential field names an AWS profile OR selects the ambient environment
+ * chain (`AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY`/`AWS_SESSION_TOKEN`) —
+ * resolved at USE time by {@link ../node/gitvault-mirror-backend.js}, never
+ * read or cached here. D1 is the reason this file exists at all: run402
+ * never holds a credential to the customer's bucket, so the credential must
+ * live somewhere run402 code never uploads or transmits — this config file,
+ * read only by the client's own machine.
+ */
+import { existsSync, readdirSync, unlinkSync } from "node:fs";
+import { join } from "node:path";
+import { LocalError } from "../errors.js";
+import { GITVAULT_SRC_RE } from "../namespaces/gitvault.crypto.js";
+import { readFileNoFollow, writeFileAtomic0600 } from "./gitvault-keystore.js";
+function fail(code, message, context, details, nextActions) {
+    throw new LocalError(message, context, { code, details, ...(nextActions ? { next_actions: nextActions } : {}) });
+}
+export function mirrorsDir(keystore) {
+    return join(keystore.rootDir, "mirrors");
+}
+export function mirrorConfigPath(keystore, repoId) {
+    if (!GITVAULT_SRC_RE.test(repoId))
+        fail("GITVAULT_BAD_REPO_ID", `not a src_ id: ${repoId}`, "resolving gitvault mirror config path");
+    return join(mirrorsDir(keystore), `${repoId}.json`);
+}
+/** Read the mirror config for one vault, or `null` when none is configured. */
+export function readMirrorConfig(keystore, repoId) {
+    const text = readFileNoFollow(mirrorConfigPath(keystore, repoId));
+    if (!text)
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch (e) {
+        fail("GITVAULT_MIRROR_CONFIG_CORRUPT", `mirror config for ${repoId} is not valid JSON: ${e.message}`, "reading gitvault mirror config", { repo_id: repoId });
+    }
+    if (parsed.version !== 1 || parsed.repo_id !== repoId || !parsed.destination) {
+        fail("GITVAULT_MIRROR_CONFIG_CORRUPT", `mirror config for ${repoId} is not a version-1 gitvault mirror config`, "reading gitvault mirror config", { repo_id: repoId });
+    }
+    return parsed;
+}
+/** Every repo id with a mirror configured on this machine. */
+export function listMirroredRepoIds(keystore) {
+    const dir = mirrorsDir(keystore);
+    if (!existsSync(dir))
+        return [];
+    return readdirSync(dir)
+        .filter((n) => n.endsWith(".json"))
+        .map((n) => n.slice(0, -5))
+        .filter((id) => GITVAULT_SRC_RE.test(id))
+        .sort();
+}
+/** Set (create or replace) the mirror destination for one vault. */
+export function saveMirrorConfig(keystore, input, now = () => new Date()) {
+    if (input.destination.kind === "s3" && !input.credential) {
+        fail("GITVAULT_MIRROR_CREDENTIAL_REQUIRED", "an s3 mirror destination needs a credential — pass --profile <name> or --ambient", "configuring gitvault mirror");
+    }
+    const existing = readMirrorConfig(keystore, input.repo_id);
+    const full = {
+        version: 1,
+        repo_id: input.repo_id,
+        destination: input.destination,
+        ...(input.credential ? { credential: input.credential } : {}),
+        created_at: existing?.created_at ?? now().toISOString(),
+        updated_at: now().toISOString(),
+    };
+    writeFileAtomic0600(mirrorConfigPath(keystore, input.repo_id), JSON.stringify(full, null, 2));
+    return full;
+}
+/** Remove the mirror config for one vault. Never touches the mirror's own bytes — this only stops future pushes/syncs from targeting it. */
+export function removeMirrorConfig(keystore, repoId) {
+    const path = mirrorConfigPath(keystore, repoId);
+    if (!existsSync(path))
+        return { removed: false };
+    try {
+        unlinkSync(path);
+    }
+    catch (e) {
+        fail("GITVAULT_MIRROR_CONFIG_REMOVE_FAILED", `could not remove mirror config for ${repoId}: ${e.message}`, "removing gitvault mirror config", { repo_id: repoId });
+    }
+    return { removed: true };
+}
+/** Parse `s3://<bucket>/<prefix>` or a plain filesystem path into a {@link GitvaultMirrorDestination}. */
+export function parseMirrorDestinationUrl(url, options = {}) {
+    if (url.startsWith("s3://")) {
+        const rest = url.slice("s3://".length);
+        const slash = rest.indexOf("/");
+        const bucket = slash === -1 ? rest : rest.slice(0, slash);
+        const prefix = slash === -1 ? "" : rest.slice(slash + 1).replace(/\/+$/, "");
+        if (!bucket)
+            fail("GITVAULT_MIRROR_DESTINATION_INVALID", `${url} names no bucket`, "parsing gitvault mirror destination", { url });
+        const region = options.region ?? process.env.AWS_REGION ?? process.env.AWS_DEFAULT_REGION;
+        if (!region)
+            fail("GITVAULT_MIRROR_REGION_REQUIRED", `an s3 destination needs a region — pass --region or set AWS_REGION`, "parsing gitvault mirror destination", { url });
+        return { kind: "s3", bucket, prefix, region, ...(options.endpoint ? { endpoint: options.endpoint } : {}) };
+    }
+    return { kind: "directory", path: url };
+}
+/** Render a destination back to the address form a human typed (for `status`/errors). */
+export function formatMirrorDestination(destination) {
+    return destination.kind === "s3" ? `s3://${destination.bucket}/${destination.prefix}` : destination.path;
+}
+//# sourceMappingURL=gitvault-mirror-config.js.map

package/sdk/dist/node/gitvault-mirror-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitvault-mirror-config.js","sourceRoot":"","sources":["../../src/node/gitvault-mirror-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAoB,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAEjG,SAAS,IAAI,CAAC,IAAY,EAAE,OAAe,EAAE,OAAe,EAAE,OAAiB,EAAE,WAAuB;IACtG,MAAM,IAAI,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AACnH,CAAC;AAuBD,MAAM,UAAU,UAAU,CAAC,QAA0B;IACnD,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAA0B,EAAE,MAAc;IACzE,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,sBAAsB,EAAE,kBAAkB,MAAM,EAAE,EAAE,uCAAuC,CAAC,CAAC;IACrI,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,GAAG,MAAM,OAAO,CAAC,CAAC;AACtD,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,gBAAgB,CAAC,QAA0B,EAAE,MAAc;IACzE,MAAM,IAAI,GAAG,gBAAgB,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,MAA4B,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAyB,CAAC;IACpD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,gCAAgC,EAAE,qBAAqB,MAAM,uBAAwB,CAAW,CAAC,OAAO,EAAE,EAAE,gCAAgC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1K,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC7E,IAAI,CAAC,gCAAgC,EAAE,qBAAqB,MAAM,4CAA4C,EAAE,gCAAgC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IACzK,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,mBAAmB,CAAC,QAA0B;IAC5D,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACjC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,OAAO,WAAW,CAAC,GAAG,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;SAClC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;SAC1B,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;SACxC,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,gBAAgB,CAAC,QAA0B,EAAE,KAAyG,EAAE,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;IACxM,IAAI,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QACzD,IAAI,CAAC,qCAAqC,EAAE,kFAAkF,EAAE,6BAA6B,CAAC,CAAC;IACjK,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAyB;QACjC,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,UAAU,EAAE,QAAQ,EAAE,UAAU,IAAI,GAAG,EAAE,CAAC,WAAW,EAAE;QACvD,UAAU,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE;KAChC,CAAC;IACF,mBAAmB,CAAC,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4IAA4I;AAC5I,MAAM,UAAU,kBAAkB,CAAC,QAA0B,EAAE,MAAc;IAC3E,MAAM,IAAI,GAAG,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACjD,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,sCAAsC,EAAE,sCAAsC,MAAM,KAAM,CAAW,CAAC,OAAO,EAAE,EAAE,iCAAiC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IAChL,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,yBAAyB,CAAC,GAAW,EAAE,UAAkD,EAAE;IACzG,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,qCAAqC,EAAE,GAAG,GAAG,kBAAkB,EAAE,qCAAqC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACnI,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAC1F,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,iCAAiC,EAAE,oEAAoE,EAAE,qCAAqC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3K,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC7G,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAC1C,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,uBAAuB,CAAC,WAAsC;IAC5E,OAAO,WAAW,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,WAAW,CAAC,MAAM,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC;AAC3G,CAAC"}