threadforge 0.1.1 → 0.2.1

package/dist/plugins/ScopedPostgres.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Scoped PostgreSQL Plugin
+ *
+ * Wraps the standard postgres() plugin to provide per-project
+ * schema isolation. Each project gets its own Postgres schema
+ * (project_{projectId}), and every connection checkout runs
+ * SET search_path to route queries to the correct schema.
+ *
+ * If ctx._projectId is null (shared services like auth),
+ * returns the raw pool unscoped.
+ */
+import type { HealthCheckResult, NginxResult, PostgresOptions, ScopedPluginContext } from "./types.js";
+interface PgQueryResult {
+    rows: Record<string, unknown>[];
+    rowCount: number | null;
+    command: string;
+    fields: unknown[];
+}
+interface PgClient {
+    query(text: string, params?: unknown[]): Promise<PgQueryResult>;
+    release(err?: Error | boolean): void;
+}
+interface PgPool {
+    query(text: string, params?: unknown[]): Promise<PgQueryResult>;
+    connect(): Promise<PgClient>;
+    end(): Promise<void>;
+    on(event: string, listener: (client: PgClient) => void): void;
+    totalCount: number;
+    idleCount: number;
+    waitingCount: number;
+}
+interface ScopedPostgresPlugin {
+    name: "postgres";
+    version: string;
+    inject: "pg";
+    validate(): void;
+    env(): Record<string, string>;
+    connect(ctx: ScopedPluginContext): Promise<ScopedPool | PgPool>;
+    healthCheck(pool: ScopedPool | PgPool): Promise<HealthCheckResult>;
+    disconnect(pool: ScopedPool | PgPool): Promise<void>;
+    metrics(pool: ScopedPool | PgPool): Record<string, number>;
+    nginx(): NginxResult;
+}
+/**
+ * Create a ScopedPool that wraps a pg.Pool and sets the search_path
+ * on every connection checkout.
+ */
+declare class ScopedPool {
+    _pool: PgPool;
+    _schemaName: string;
+    _schemaCreated: boolean;
+    constructor(pool: PgPool, schemaName: string);
+    /**
+     * Ensure the project schema exists (idempotent).
+     */
+    _ensureSchema(): Promise<void>;
+    /**
+     * Get a scoped connection from the pool.
+     * Sets search_path before returning the client.
+     */
+    connect(): Promise<PgClient>;
+    /**
+     * Run a query with the scoped search_path.
+     * Acquires a connection via connect() which explicitly sets search_path,
+     * preventing race conditions with idle connections whose search_path was reset.
+     */
+    query(text: string, params?: unknown[]): Promise<PgQueryResult>;
+    get totalCount(): number;
+    get idleCount(): number;
+    get waitingCount(): number;
+    end(): Promise<void>;
+}
+/**
+ * Create a scoped Postgres plugin.
+ */
+export declare function scopedPostgres(options?: PostgresOptions): ScopedPostgresPlugin;
+export {};
+//# sourceMappingURL=ScopedPostgres.d.ts.map

package/dist/plugins/ScopedPostgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ScopedPostgres.d.ts","sourceRoot":"","sources":["../../src/plugins/ScopedPostgres.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEvG,UAAU,aAAa;IACrB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAChC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,OAAO,EAAE,CAAC;CACnB;AAED,UAAU,QAAQ;IAChB,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,GAAG,IAAI,CAAC;CACtC;AAED,UAAU,MAAM;IACd,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAChE,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7B,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACrB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,KAAK,IAAI,GAAG,IAAI,CAAC;IAC9D,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB;AAeD,UAAU,oBAAoB;IAC5B,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,IAAI,CAAC;IACb,QAAQ,IAAI,IAAI,CAAC;IACjB,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,OAAO,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,UAAU,GAAG,MAAM,CAAC,CAAC;IAChE,WAAW,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACnE,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,OAAO,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3D,KAAK,IAAI,WAAW,CAAC;CACtB;AAmBD;;;GAGG;AACH,cAAM,UAAU;IACd,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,OAAO,CAAC;gBAEZ,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM;IAe5C;;OAEG;IACG,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IAsBpC;;;OAGG;IACG,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC;IA6BlC;;;;OAIG;IACG,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC;IASrE,IAAI,UAAU,IAAI,MAAM,CAEvB;IACD,IAAI,SAAS,IAAI,MAAM,CAEtB;IACD,IAAI,YAAY,IAAI,MAAM,CAEzB;IAEK,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAG3B;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,OAAO,GAAE,eAAoB,GAAG,oBAAoB,CA6DlF"}

package/dist/plugins/ScopedPostgres.js

@@ -0,0 +1,190 @@
+/**
+ * Scoped PostgreSQL Plugin
+ *
+ * Wraps the standard postgres() plugin to provide per-project
+ * schema isolation. Each project gets its own Postgres schema
+ * (project_{projectId}), and every connection checkout runs
+ * SET search_path to route queries to the correct schema.
+ *
+ * If ctx._projectId is null (shared services like auth),
+ * returns the raw pool unscoped.
+ */
+import { postgres } from "./index.js";
+const SCHEMA_RE = /^[a-z_][a-z0-9_]{0,62}$/;
+/** C-PLUGIN-3: Validate schema name at every usage point */
+function validateSchemaName(schemaName) {
+    if (!SCHEMA_RE.test(schemaName)) {
+        throw new Error(`Invalid schema name: "${schemaName}". Must match /^[a-z_][a-z0-9_]{0,62}$/`);
+    }
+    if (Buffer.byteLength(schemaName, "utf8") > 63) {
+        throw new Error(`Invalid schema name: "${schemaName}". Exceeds 63 byte limit`);
+    }
+}
+/** C-PLUGIN-3: Quote identifier with proper double-quote escaping */
+function quoteIdent(schemaName) {
+    return `"${schemaName.replace(/"/g, '""')}"`;
+}
+/**
+ * Create a ScopedPool that wraps a pg.Pool and sets the search_path
+ * on every connection checkout.
+ */
+class ScopedPool {
+    _pool;
+    _schemaName;
+    _schemaCreated;
+    constructor(pool, schemaName) {
+        validateSchemaName(schemaName);
+        this._pool = pool;
+        this._schemaName = schemaName;
+        this._schemaCreated = false;
+        // Set search_path once when a new connection is created in the pool
+        const quoted = quoteIdent(this._schemaName);
+        this._pool.on("connect", (client) => {
+            client.query(`SET search_path TO ${quoted}, public`).catch((err) => {
+                console.error(`[ScopedPostgres] Failed to set search_path for ${this._schemaName}:`, err.message);
+            });
+        });
+    }
+    /**
+     * Ensure the project schema exists (idempotent).
+     */
+    async _ensureSchema() {
+        if (this._schemaCreated)
+            return;
+        // C-PLUGIN-3: Re-validate at every usage point
+        validateSchemaName(this._schemaName);
+        const client = await this._pool.connect();
+        try {
+            // Advisory lock prevents race when multiple workers create the same schema
+            const hash = Buffer.from(this._schemaName).reduce((h, b) => ((h << 5) - h + b) | 0, 5381);
+            const lockId = Math.abs(hash) * 65536 + this._schemaName.length;
+            await client.query("SELECT pg_advisory_lock($1)", [lockId]);
+            try {
+                const quoted = quoteIdent(this._schemaName);
+                await client.query(`CREATE SCHEMA IF NOT EXISTS ${quoted}`);
+                this._schemaCreated = true;
+            }
+            finally {
+                await client.query("SELECT pg_advisory_unlock($1)", [lockId]);
+            }
+        }
+        finally {
+            client.release();
+        }
+    }
+    /**
+     * Get a scoped connection from the pool.
+     * Sets search_path before returning the client.
+     */
+    async connect() {
+        // C-PLUGIN-3: Re-validate at every usage point
+        validateSchemaName(this._schemaName);
+        const client = await this._pool.connect();
+        try {
+            const quoted = quoteIdent(this._schemaName);
+            await client.query(`SET search_path TO ${quoted}, public`);
+        }
+        catch (err) {
+            client.release(err);
+            throw err;
+        }
+        const originalRelease = client.release.bind(client);
+        client.release = (err) => {
+            if (!err) {
+                client.query("SET search_path TO public").then(() => originalRelease(), (queryErr) => {
+                    // Log the failure but release cleanly to avoid destroying the pooled client
+                    console.warn(`[ScopedPostgres] Failed to reset search_path on release: ${queryErr.message}`);
+                    originalRelease();
+                });
+            }
+            else {
+                originalRelease(err);
+            }
+        };
+        return client;
+    }
+    /**
+     * Run a query with the scoped search_path.
+     * Acquires a connection via connect() which explicitly sets search_path,
+     * preventing race conditions with idle connections whose search_path was reset.
+     */
+    async query(text, params) {
+        const client = await this.connect();
+        try {
+            return await client.query(text, params);
+        }
+        finally {
+            client.release();
+        }
+    }
+    get totalCount() {
+        return this._pool.totalCount;
+    }
+    get idleCount() {
+        return this._pool.idleCount;
+    }
+    get waitingCount() {
+        return this._pool.waitingCount;
+    }
+    async end() {
+        return this._pool.end();
+    }
+}
+/**
+ * Create a scoped Postgres plugin.
+ */
+export function scopedPostgres(options = {}) {
+    const basePlugin = postgres(options);
+    return {
+        name: "postgres",
+        version: "1.0.0",
+        inject: "pg",
+        validate: basePlugin.validate,
+        env: basePlugin.env,
+        async connect(ctx) {
+            // Get the raw pool from the base plugin
+            const pool = (await basePlugin.connect(ctx));
+            // If no project ID, return unscoped pool (shared services)
+            const projectId = ctx._projectId;
+            if (!projectId)
+                return pool;
+            const rawSchema = ctx._projectSchema ?? (projectId ? `project_${projectId}` : null);
+            if (!rawSchema)
+                return pool;
+            if (!/^[a-z_][a-z0-9_]{0,62}$/.test(rawSchema)) {
+                throw new Error(`Invalid schema name: "${rawSchema}"`);
+            }
+            const schemaName = rawSchema;
+            const scoped = new ScopedPool(pool, schemaName);
+            // Create schema on first connect
+            await scoped._ensureSchema();
+            ctx.logger.info("PostgreSQL scoped", { schema: schemaName, project: projectId });
+            return scoped;
+        },
+        async healthCheck(pool) {
+            // ScopedPool or raw pool — both support query()
+            if (pool.query) {
+                try {
+                    await pool.query("SELECT 1");
+                    return { status: "ok", total: pool.totalCount, idle: pool.idleCount };
+                }
+                catch (e) {
+                    return { status: "error", error: e.message };
+                }
+            }
+            return basePlugin.healthCheck(pool);
+        },
+        async disconnect(pool) {
+            await pool.end();
+        },
+        metrics(pool) {
+            return {
+                pool_total: pool.totalCount ?? 0,
+                pool_idle: pool.idleCount ?? 0,
+                pool_waiting: pool.waitingCount ?? 0,
+            };
+        },
+        nginx: basePlugin.nginx,
+    };
+}
+//# sourceMappingURL=ScopedPostgres.js.map

package/dist/plugins/ScopedPostgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ScopedPostgres.js","sourceRoot":"","sources":["../../src/plugins/ScopedPostgres.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAmDtC,MAAM,SAAS,GAAG,yBAAyB,CAAC;AAE5C,4DAA4D;AAC5D,SAAS,kBAAkB,CAAC,UAAkB;IAC5C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,yBAAyB,UAAU,yCAAyC,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,yBAAyB,UAAU,0BAA0B,CAAC,CAAC;IACjF,CAAC;AACH,CAAC;AAED,qEAAqE;AACrE,SAAS,UAAU,CAAC,UAAkB;IACpC,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU;IACd,KAAK,CAAS;IACd,WAAW,CAAS;IACpB,cAAc,CAAU;IAExB,YAAY,IAAY,EAAE,UAAkB;QAC1C,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC;QAC9B,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC;QAE5B,oEAAoE;QACpE,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,MAAgB,EAAE,EAAE;YAC5C,MAAM,CAAC,KAAK,CAAC,sBAAsB,MAAM,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,GAAU,EAAE,EAAE;gBACxE,OAAO,CAAC,KAAK,CAAC,kDAAkD,IAAI,CAAC,WAAW,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACpG,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa;QACjB,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO;QAChC,+CAA+C;QAC/C,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC1C,IAAI,CAAC;YACH,2EAA2E;YAC3E,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;YAC1G,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;YAChE,MAAM,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5D,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBAC5C,MAAM,MAAM,CAAC,KAAK,CAAC,+BAA+B,MAAM,EAAE,CAAC,CAAC;gBAC5D,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;YAC7B,CAAC;oBAAS,CAAC;gBACT,MAAM,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO;QACX,+CAA+C;QAC/C,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC5C,MAAM,MAAM,CAAC,KAAK,CAAC,sBAAsB,MAAM,UAAU,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,OAAO,CAAC,GAAY,CAAC,CAAC;YAC7B,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,CAAC,OAAO,GAAG,CAAC,GAAqB,EAAQ,EAAE;YAC/C,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,IAAI,CAC5C,GAAG,EAAE,CAAC,eAAe,EAAE,EACvB,CAAC,QAAe,EAAE,EAAE;oBAClB,4EAA4E;oBAC5E,OAAO,CAAC,IAAI,CAAC,4DAA4D,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;oBAC7F,eAAe,EAAE,CAAC;gBACpB,CAAC,CACF,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,eAAe,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;QACH,CAAC,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAC,IAAY,EAAE,MAAkB;QAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;IAC/B,CAAC;IACD,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;IAC9B,CAAC;IACD,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,GAAG;QACP,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IAC1B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,UAA2B,EAAE;IAC1D,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAA0B,CAAC;IAE9D,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,OAAO;QAChB,MAAM,EAAE,IAAI;QAEZ,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,GAAG,EAAE,UAAU,CAAC,GAAG;QAEnB,KAAK,CAAC,OAAO,CAAC,GAAwB;YACpC,wCAAwC;YACxC,MAAM,IAAI,GAAG,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAW,CAAC;YAEvD,2DAA2D;YAC3D,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC;YACjC,IAAI,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC;YAE5B,MAAM,SAAS,GAAG,GAAG,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACpF,IAAI,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC;YAC5B,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CAAC,yBAAyB,SAAS,GAAG,CAAC,CAAC;YACzD,CAAC;YACD,MAAM,UAAU,GAAG,SAAS,CAAC;YAC7B,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAEhD,iCAAiC;YACjC,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC;YAE7B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YACjF,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,IAAyB;YACzC,gDAAgD;YAChD,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;oBAC7B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;gBACxE,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC;gBAC1D,CAAC;YACH,CAAC;YACD,OAAO,UAAU,CAAC,WAAW,CAAC,IAAc,CAAC,CAAC;QAChD,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,IAAyB;YACxC,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;QACnB,CAAC;QAED,OAAO,CAAC,IAAyB;YAC/B,OAAO;gBACL,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,CAAC;gBAChC,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,CAAC;gBAC9B,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,CAAC;aACrC,CAAC;QACJ,CAAC;QAED,KAAK,EAAE,UAAU,CAAC,KAAK;KACxB,CAAC;AACJ,CAAC"}

package/dist/plugins/ScopedRedis.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Scoped Redis Plugin
+ *
+ * Wraps the standard redis() plugin to provide per-project
+ * key isolation. Each project's keys are prefixed with {projectId}:
+ * so project A can't see project B's data.
+ *
+ * If ioredis is available, uses its built-in keyPrefix option.
+ * Otherwise, wraps the built-in RESP client with a PrefixedRedisClient.
+ *
+ * If ctx._projectId is null (shared services like auth),
+ * returns the unprefixed client.
+ */
+import type { HealthCheckResult, IoRedisLikeClient, RedisOptions, ScopedPluginContext } from "./types.js";
+type RespValue = string | number | Buffer | null | Error | RespValue[];
+interface RedisClient {
+    status: string;
+    get(key: string): Promise<string | null>;
+    set(...args: string[]): Promise<RespValue>;
+    del(...keys: string[]): Promise<RespValue>;
+    hget(key: string, field: string): Promise<string | null>;
+    hset(key: string, field: string, value: string): Promise<RespValue>;
+    hgetall(key: string): Promise<Record<string, string>>;
+    keys(pattern: string): Promise<string[] | RespValue>;
+    expire(key: string, seconds: string): Promise<RespValue>;
+    ttl(key: string): Promise<RespValue>;
+    ping(): Promise<RespValue>;
+    incr(key: string): Promise<RespValue>;
+    decr(key: string): Promise<RespValue>;
+    lpush(key: string, ...values: string[]): Promise<RespValue>;
+    rpush(key: string, ...values: string[]): Promise<RespValue>;
+    lrange(key: string, start: string | number, end: string | number): Promise<string[] | RespValue>;
+    sadd(key: string, ...members: string[]): Promise<RespValue>;
+    smembers(key: string): Promise<string[] | RespValue>;
+    publish(channel: string, message: string): Promise<RespValue>;
+    disconnect(): void;
+    quit(): Promise<RespValue>;
+}
+interface ScopedRedisPlugin {
+    name: "redis";
+    version: string;
+    inject: "redis";
+    validate(): void;
+    env(): Record<string, string>;
+    connect(ctx: ScopedPluginContext): Promise<RedisClient | PrefixedRedisClient | IoRedisLikeClient>;
+    healthCheck(c: RedisClient | PrefixedRedisClient | IoRedisLikeClient): Promise<HealthCheckResult>;
+    disconnect(c: RedisClient | PrefixedRedisClient | IoRedisLikeClient): Promise<void>;
+    metrics(c: RedisClient | PrefixedRedisClient | IoRedisLikeClient): Record<string, number>;
+}
+/**
+ * Wraps the built-in RESP client to prefix all key operations.
+ */
+declare class PrefixedRedisClient {
+    _client: RedisClient;
+    _prefix: string;
+    constructor(client: RedisClient, prefix: string);
+    _pk(key: string): string;
+    get status(): string;
+    get(k: string): Promise<string | null>;
+    set(...a: string[]): Promise<RespValue>;
+    del(...keys: string[]): Promise<RespValue>;
+    incr(k: string): Promise<RespValue>;
+    decr(k: string): Promise<RespValue>;
+    expire(k: string, s: string): Promise<RespValue>;
+    ttl(k: string): Promise<RespValue>;
+    hget(k: string, f: string): Promise<string | null>;
+    hset(k: string, f: string, v: string): Promise<RespValue>;
+    hgetall(k: string): Promise<Record<string, string>>;
+    lpush(k: string, ...v: string[]): Promise<RespValue>;
+    rpush(k: string, ...v: string[]): Promise<RespValue>;
+    lrange(k: string, s: string | number, e: string | number): Promise<string[] | RespValue>;
+    sadd(k: string, ...m: string[]): Promise<RespValue>;
+    smembers(k: string): Promise<string[] | RespValue>;
+    keys(p: string): Promise<string[] | RespValue>;
+    publish(ch: string, m: string): Promise<RespValue>;
+    ping(): Promise<RespValue>;
+    quit(): Promise<RespValue>;
+    disconnect(): void;
+}
+/**
+ * Create a scoped Redis plugin.
+ *
+ * @param {Object} [options] - Same options as redis() plugin
+ * @returns {Object} Plugin descriptor
+ */
+export declare function scopedRedis(options?: RedisOptions): ScopedRedisPlugin;
+export {};
+//# sourceMappingURL=ScopedRedis.d.ts.map

package/dist/plugins/ScopedRedis.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ScopedRedis.d.ts","sourceRoot":"","sources":["../../src/plugins/ScopedRedis.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAE1G,KAAK,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,KAAK,GAAG,SAAS,EAAE,CAAC;AAEvE,UAAU,WAAW;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACzC,GAAG,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC3C,GAAG,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC3C,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACzD,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACpE,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACrD,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACzD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC;IAC3B,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACtC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5D,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5D,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACjG,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5D,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACrD,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC9D,UAAU,IAAI,IAAI,CAAC;IACnB,IAAI,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC;CAC5B;AAED,UAAU,iBAAiB;IACzB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,IAAI,IAAI,CAAC;IACjB,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,OAAO,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,WAAW,GAAG,mBAAmB,GAAG,iBAAiB,CAAC,CAAC;IAClG,WAAW,CAAC,CAAC,EAAE,WAAW,GAAG,mBAAmB,GAAG,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAClG,UAAU,CAAC,CAAC,EAAE,WAAW,GAAG,mBAAmB,GAAG,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpF,OAAO,CAAC,CAAC,EAAE,WAAW,GAAG,mBAAmB,GAAG,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3F;AAMD;;GAEG;AACH,cAAM,mBAAmB;IACvB,OAAO,EAAE,WAAW,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;gBAEJ,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM;IAK/C,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAIxB,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAGtC,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC;IAIvC,GAAG,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC;IAG1C,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAGnC,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAGnC,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAGhD,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAIlC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAGlD,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAGzD,OAAO,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAInD,KAAK,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC;IAGpD,KAAK,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC;IAGpD,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC;IAIxF,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC;IAGnD,QAAQ,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC;IAIlD,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC;IAG9C,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAIlD,IAAI,IAAI,OAAO,CAAC,SAAS,CAAC;IAG1B,IAAI,IAAI,OAAO,CAAC,SAAS,CAAC;IAG1B,UAAU,IAAI,IAAI;CAGnB;AASD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,OAAO,GAAE,YAAiB,GAAG,iBAAiB,CAkFzE"}

package/dist/plugins/ScopedRedis.js

@@ -0,0 +1,169 @@
+async function importModuleDynamically(specifier) {
+    return (await import(specifier));
+}
+/**
+ * Wraps the built-in RESP client to prefix all key operations.
+ */
+class PrefixedRedisClient {
+    _client;
+    _prefix;
+    constructor(client, prefix) {
+        this._client = client;
+        this._prefix = prefix;
+    }
+    _pk(key) {
+        return `${this._prefix}${key}`;
+    }
+    get status() {
+        return this._client.status;
+    }
+    get(k) {
+        return this._client.get(this._pk(k));
+    }
+    set(...a) {
+        a[0] = this._pk(a[0]);
+        return this._client.set(...a);
+    }
+    del(...keys) {
+        return this._client.del(...keys.map((k) => this._pk(k)));
+    }
+    incr(k) {
+        return this._client.incr(this._pk(k));
+    }
+    decr(k) {
+        return this._client.decr(this._pk(k));
+    }
+    expire(k, s) {
+        return this._client.expire(this._pk(k), s);
+    }
+    ttl(k) {
+        return this._client.ttl(this._pk(k));
+    }
+    hget(k, f) {
+        return this._client.hget(this._pk(k), f);
+    }
+    hset(k, f, v) {
+        return this._client.hset(this._pk(k), f, v);
+    }
+    hgetall(k) {
+        return this._client.hgetall(this._pk(k));
+    }
+    lpush(k, ...v) {
+        return this._client.lpush(this._pk(k), ...v);
+    }
+    rpush(k, ...v) {
+        return this._client.rpush(this._pk(k), ...v);
+    }
+    lrange(k, s, e) {
+        return this._client.lrange(this._pk(k), s, e);
+    }
+    sadd(k, ...m) {
+        return this._client.sadd(this._pk(k), ...m);
+    }
+    smembers(k) {
+        return this._client.smembers(this._pk(k));
+    }
+    keys(p) {
+        return this._client.keys(this._pk(p));
+    }
+    publish(ch, m) {
+        return this._client.publish(this._pk(ch), m);
+    }
+    ping() {
+        return this._client.ping();
+    }
+    quit() {
+        return this._client.quit();
+    }
+    disconnect() {
+        this._client.disconnect?.();
+    }
+}
+/**
+ * Build the Redis URL from options, falling back to localhost defaults.
+ */
+function buildRedisUrl(options) {
+    return options.url ?? `redis://${options.host ?? "127.0.0.1"}:${options.port ?? 6379}/${options.db ?? 0}`;
+}
+/**
+ * Create a scoped Redis plugin.
+ *
+ * @param {Object} [options] - Same options as redis() plugin
+ * @returns {Object} Plugin descriptor
+ */
+export function scopedRedis(options = {}) {
+    return {
+        name: "redis",
+        version: "1.0.0",
+        inject: "redis",
+        validate() {
+            const url = buildRedisUrl(options);
+            try {
+                new URL(url);
+            }
+            catch {
+                throw new Error(`Invalid Redis URL: ${url}`);
+            }
+        },
+        env() {
+            // HIGH-5: Sanitize URL before propagating to env — strip credentials
+            // to prevent exposure via /proc/<pid>/environ. The connect() function
+            // uses the original `url` variable from closure scope.
+            const raw = buildRedisUrl(options);
+            try {
+                const parsed = new URL(raw);
+                parsed.username = "";
+                parsed.password = "";
+                return { FORGE_REDIS_URL: parsed.toString() };
+            }
+            catch {
+                return { FORGE_REDIS_URL: raw };
+            }
+        },
+        async connect(ctx) {
+            const projectId = ctx._projectId;
+            const prefix = projectId ? `${projectId}:` : "";
+            const url = buildRedisUrl(options);
+            // Try ioredis first — it has built-in keyPrefix support
+            try {
+                const R = (await importModuleDynamically("ioredis")).default;
+                const c = new R(url, {
+                    keyPrefix: prefix,
+                    maxRetriesPerRequest: 3,
+                    lazyConnect: true,
+                });
+                await c.connect();
+                if (prefix) {
+                    ctx.logger.info("Redis scoped (ioredis)", { prefix, project: projectId });
+                }
+                return c;
+            }
+            catch {
+                // Fall through to built-in RESP client
+            }
+            // Built-in RESP client — need manual prefix wrapping
+            const { _mkRedis } = await import("./index.js");
+            const client = (await _mkRedis(url, ctx));
+            if (!prefix)
+                return client;
+            ctx.logger.info("Redis scoped (built-in)", { prefix, project: projectId });
+            return new PrefixedRedisClient(client, prefix);
+        },
+        async healthCheck(c) {
+            const inner = c._client ?? c;
+            try {
+                return { status: (await inner.ping()) === "PONG" ? "ok" : "degraded" };
+            }
+            catch (e) {
+                return { status: "error", error: e.message };
+            }
+        },
+        async disconnect(c) {
+            await (c._client ?? c).quit?.();
+        },
+        metrics(c) {
+            return { connected: (c._client ?? c).status === "ready" ? 1 : 0 };
+        },
+    };
+}
+//# sourceMappingURL=ScopedRedis.js.map

package/dist/plugins/ScopedRedis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ScopedRedis.js","sourceRoot":"","sources":["../../src/plugins/ScopedRedis.ts"],"names":[],"mappings":"AAqDA,KAAK,UAAU,uBAAuB,CAAC,SAAiB;IACtD,OAAO,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAA4B,CAAC;AAC9D,CAAC;AAED;;GAEG;AACH,MAAM,mBAAmB;IACvB,OAAO,CAAc;IACrB,OAAO,CAAS;IAEhB,YAAY,MAAmB,EAAE,MAAc;QAC7C,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IAED,GAAG,CAAC,GAAW;QACb,OAAO,GAAG,IAAI,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC;IACjC,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7B,CAAC;IAED,GAAG,CAAC,CAAS;QACX,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,GAAG,CAAC,GAAG,CAAW;QAChB,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,CAAC;IACD,GAAG,CAAC,GAAG,IAAc;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,CAAC,CAAS;QACZ,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,CAAS;QACZ,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,CAAC,CAAS,EAAE,CAAS;QACzB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,GAAG,CAAC,CAAS;QACX,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC;IAED,IAAI,CAAC,CAAS,EAAE,CAAS;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,CAAC,CAAS,EAAE,CAAS,EAAE,CAAS;QAClC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,CAAC,CAAS;QACf,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,CAAS,EAAE,GAAG,CAAW;QAC7B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,KAAK,CAAC,CAAS,EAAE,GAAG,CAAW;QAC7B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,CAAC,CAAS,EAAE,CAAkB,EAAE,CAAkB;QACtD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,CAAC,CAAS,EAAE,GAAG,CAAW;QAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,QAAQ,CAAC,CAAS;QAChB,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,IAAI,CAAC,CAAS;QACZ,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,CAAC,EAAU,EAAE,CAAS;QAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAC7B,CAAC;IACD,IAAI;QACF,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAC7B,CAAC;IACD,UAAU;QACR,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;IAC9B,CAAC;CACF;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,OAAqB;IAC1C,OAAO,OAAO,CAAC,GAAG,IAAI,WAAW,OAAO,CAAC,IAAI,IAAI,WAAW,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI,IAAI,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;AAC5G,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,UAAwB,EAAE;IACpD,OAAO;QACL,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,OAAO;QAChB,MAAM,EAAE,OAAO;QAEf,QAAQ;YACN,MAAM,GAAG,GAAW,aAAa,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YACf,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,EAAE,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,GAAG;YACD,qEAAqE;YACrE,sEAAsE;YACtE,uDAAuD;YACvD,MAAM,GAAG,GAAW,aAAa,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC5B,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC;gBACrB,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC;gBACrB,OAAO,EAAE,eAAe,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC;YAClC,CAAC;QACH,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,GAAwB;YACpC,MAAM,SAAS,GAA8B,GAAG,CAAC,UAAU,CAAC;YAC5D,MAAM,MAAM,GAAW,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,MAAM,GAAG,GAAW,aAAa,CAAC,OAAO,CAAC,CAAC;YAE3C,wDAAwD;YACxD,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,CAAC,MAAM,uBAAuB,CAAC,SAAS,CAAC,CAAC,CAAC,OAGA,CAAC;gBACtD,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,EAAE;oBACnB,SAAS,EAAE,MAAM;oBACjB,oBAAoB,EAAE,CAAC;oBACvB,WAAW,EAAE,IAAI;iBAClB,CAAC,CAAC;gBACH,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;gBAClB,IAAI,MAAM,EAAE,CAAC;oBACX,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC5E,CAAC;gBACD,OAAO,CAAC,CAAC;YACX,CAAC;YAAC,MAAM,CAAC;gBACP,uCAAuC;YACzC,CAAC;YAED,qDAAqD;YACrD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;YAChD,MAAM,MAAM,GAAgB,CAAC,MAAM,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAgB,CAAC;YAEtE,IAAI,CAAC,MAAM;gBAAE,OAAO,MAAM,CAAC;YAE3B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YAC3E,OAAO,IAAI,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjD,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,CAAwD;YACxE,MAAM,KAAK,GAAI,CAAyB,CAAC,OAAO,IAAI,CAAC,CAAC;YACtD,IAAI,CAAC;gBACH,OAAO,EAAE,MAAM,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;YACzE,CAAC;YAAC,OAAO,CAAU,EAAE,CAAC;gBACpB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC;YAC1D,CAAC;QACH,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,CAAwD;YACvE,MAAM,CAAE,CAAyB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC3D,CAAC;QAED,OAAO,CAAC,CAAwD;YAC9D,OAAO,EAAE,SAAS,EAAE,CAAE,CAAyB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,CAAC;KACF,CAAC;AACJ,CAAC"}