ysk-server-core 1.0.0 → 1.1.0

package/dist/hosting/git-auth.js

@@ -0,0 +1,314 @@
+/**
+ * Project Git auth: HTTPS token + SSH deploy key + known_hosts pin.
+ * Tokens never go in the remote URL or GET responses.
+ */
+import { chmodSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync, } from 'node:fs';
+import { join } from 'node:path';
+import { tl } from 'ysk-server-shared';
+import { decryptPrivateKey, encryptPrivateKey, resolveMasterKey, } from '../security/ssh-identity/crypto.js';
+import { createSshIdentity, getSshIdentity, getSshIdentityInternal, } from '../security/ssh-identity/store.js';
+import { fingerprintFromPublicKey } from '../security/ssh-identity/generate.js';
+const TOKEN_AAD = (projectId) => `git-token:${projectId}`;
+export function gitSecretsDir(dataDir) {
+    return join(dataDir, 'secrets', 'git');
+}
+function tokenPath(dataDir, projectId) {
+    return join(gitSecretsDir(dataDir), `${projectId}.tok`);
+}
+function keyPath(dataDir, projectId) {
+    return join(gitSecretsDir(dataDir), `${projectId}.key`);
+}
+function knownHostsPath(dataDir, projectId) {
+    return join(gitSecretsDir(dataDir), `${projectId}.known_hosts`);
+}
+function askpassPath(dataDir) {
+    return join(gitSecretsDir(dataDir), 'askpass.sh');
+}
+export function parseGitRemoteHost(url) {
+    const u = url.trim();
+    if (!u)
+        return { scheme: 'other' };
+    if (u.startsWith('/') || u.startsWith('file://'))
+        return { scheme: 'file' };
+    if (u.startsWith('https://') || u.startsWith('http://')) {
+        try {
+            return { scheme: 'https', host: new URL(u).hostname || undefined };
+        }
+        catch {
+            return { scheme: 'https' };
+        }
+    }
+    if (u.startsWith('git@')) {
+        const host = u.slice(4).split(/[:/]/)[0]?.trim();
+        return { scheme: 'ssh', host: host || undefined };
+    }
+    if (u.startsWith('ssh://')) {
+        try {
+            return { scheme: 'ssh', host: new URL(u).hostname || undefined };
+        }
+        catch {
+            return { scheme: 'ssh' };
+        }
+    }
+    return { scheme: 'other' };
+}
+function ensureGitSecretsDir(dataDir) {
+    mkdirSync(gitSecretsDir(dataDir), { recursive: true, mode: 0o700 });
+    try {
+        chmodSync(gitSecretsDir(dataDir), 0o700);
+    }
+    catch {
+        /* ignore */
+    }
+}
+export function hasGitHttpsToken(dataDir, projectId) {
+    return existsSync(tokenPath(dataDir, projectId));
+}
+export function saveGitHttpsToken(dataDir, projectId, token) {
+    const t = token.trim();
+    if (!t || t.length > 4096) {
+        throw new Error('invalid token');
+    }
+    ensureGitSecretsDir(dataDir);
+    const master = resolveMasterKey(dataDir);
+    const blob = encryptPrivateKey(master.key, TOKEN_AAD(projectId), t);
+    const p = tokenPath(dataDir, projectId);
+    writeFileSync(p, blob, { mode: 0o600 });
+    try {
+        chmodSync(p, 0o600);
+    }
+    catch {
+        /* ignore */
+    }
+}
+export function readGitHttpsToken(dataDir, projectId) {
+    const p = tokenPath(dataDir, projectId);
+    if (!existsSync(p))
+        return undefined;
+    const master = resolveMasterKey(dataDir);
+    return decryptPrivateKey(master.key, TOKEN_AAD(projectId), readFileSync(p, 'utf8'));
+}
+export function clearGitHttpsToken(dataDir, projectId) {
+    const p = tokenPath(dataDir, projectId);
+    if (existsSync(p))
+        unlinkSync(p);
+}
+export function isGitHostPinned(dataDir, projectId, host) {
+    if (!host)
+        return false;
+    const p = knownHostsPath(dataDir, projectId);
+    if (!existsSync(p))
+        return false;
+    const text = readFileSync(p, 'utf8');
+    return text.split('\n').some((line) => {
+        const first = line.trim().split(/\s+/)[0] ?? '';
+        return first === host || first.split(',').includes(host);
+    });
+}
+export function parseSshKeyscan(stdout) {
+    const out = [];
+    for (const line of stdout.split('\n')) {
+        const s = line.trim();
+        if (!s || s.startsWith('#'))
+            continue;
+        const parts = s.split(/\s+/);
+        if (parts.length < 3)
+            continue;
+        const type = parts[1];
+        const key = parts[2];
+        let fingerprint = type;
+        try {
+            fingerprint = fingerprintFromPublicKey(`${type} ${key}`);
+        }
+        catch {
+            /* keep type */
+        }
+        out.push({ type, fingerprint, raw: s });
+    }
+    return out;
+}
+export async function scanGitHostKeys(hostExec, host) {
+    if (!host || /[\s;|&$`]/.test(host))
+        return [];
+    const r = await hostExec.runCommand(['ssh-keyscan', '-T', '5', '-t', 'ed25519,rsa,ecdsa', host], {
+        timeoutMs: 15_000,
+    });
+    if (r.exitCode !== 0 && !r.stdout)
+        return [];
+    return parseSshKeyscan(r.stdout || '');
+}
+export function pinGitHostKeys(dataDir, projectId, host, keys) {
+    ensureGitSecretsDir(dataDir);
+    const lines = keys.map((k) => k.raw).filter(Boolean);
+    if (!lines.length)
+        throw new Error('no host keys to pin');
+    const p = knownHostsPath(dataDir, projectId);
+    const existing = existsSync(p) ? readFileSync(p, 'utf8') : '';
+    const kept = existing
+        .split('\n')
+        .filter((line) => {
+        const first = line.trim().split(/\s+/)[0] ?? '';
+        return first && first !== host && !first.split(',').includes(host);
+    });
+    writeFileSync(p, `${[...kept, ...lines].filter(Boolean).join('\n')}\n`, { mode: 0o600 });
+    try {
+        chmodSync(p, 0o600);
+    }
+    catch {
+        /* ignore */
+    }
+}
+export function clearGitHostPin(dataDir, projectId) {
+    const p = knownHostsPath(dataDir, projectId);
+    if (existsSync(p))
+        unlinkSync(p);
+}
+export function materializeGitDeployKey(dataDir, projectId, identityId) {
+    const row = getSshIdentityInternal(dataDir, identityId);
+    if (!row)
+        return undefined;
+    const master = resolveMasterKey(dataDir);
+    const pem = decryptPrivateKey(master.key, identityId, row.privateKeyEnc);
+    ensureGitSecretsDir(dataDir);
+    const p = keyPath(dataDir, projectId);
+    writeFileSync(p, pem.endsWith('\n') ? pem : `${pem}\n`, { mode: 0o600 });
+    try {
+        chmodSync(p, 0o600);
+    }
+    catch {
+        /* ignore */
+    }
+    return p;
+}
+export function clearGitDeployKeyFile(dataDir, projectId) {
+    const p = keyPath(dataDir, projectId);
+    if (existsSync(p))
+        unlinkSync(p);
+}
+export function ensureGitAskpass(dataDir) {
+    ensureGitSecretsDir(dataDir);
+    const p = askpassPath(dataDir);
+    const body = `#!/bin/sh
+# YSK Server git askpass — token from env, never from argv
+prompt=$(printf '%s' "$1" | tr '[:upper:]' '[:lower:]')
+case "$prompt" in
+  *username*) printf '%s\\n' "\${YSK_GIT_USERNAME:-git}" ;;
+  *) printf '%s\\n' "\${YSK_GIT_TOKEN}" ;;
+esac
+`;
+    writeFileSync(p, body, { mode: 0o700 });
+    try {
+        chmodSync(p, 0o700);
+    }
+    catch {
+        /* ignore */
+    }
+    return p;
+}
+export function createProjectGitDeployKey(input) {
+    const created = createSshIdentity(input.dataDir, {
+        name: `git-${(input.projectName || input.projectId).slice(0, 24)}`,
+        comment: `ysk-git-${input.projectId.slice(0, 8)}`,
+        algorithm: 'ed25519',
+        purpose: 'panel_outbound',
+        binding: { projectId: input.projectId },
+        createdBy: input.actor,
+    });
+    if (!created.ok || !created.identity) {
+        return { ok: false, notes: created.notes.length ? created.notes : [tl('notes.git.unknown')] };
+    }
+    try {
+        materializeGitDeployKey(input.dataDir, input.projectId, created.identity.id);
+    }
+    catch (e) {
+        return {
+            ok: false,
+            notes: [e instanceof Error ? e.message : tl('notes.git.unknown')],
+        };
+    }
+    return {
+        ok: true,
+        identityId: created.identity.id,
+        publicKey: created.identity.publicKey,
+        fingerprint: created.identity.fingerprintSha256,
+        notes: [tl('notes.git.deployKeyCreated'), ...created.notes],
+    };
+}
+export function describeGitAuth(input) {
+    const parsed = parseGitRemoteHost(input.gitUrl ?? '');
+    const kind = input.authKind ?? 'none';
+    const pub = {
+        kind,
+        scheme: parsed.scheme,
+        host: parsed.host,
+        hasToken: hasGitHttpsToken(input.dataDir, input.projectId),
+        hostPinned: isGitHostPinned(input.dataDir, input.projectId, parsed.host),
+    };
+    if (kind === 'ssh' && input.identityId) {
+        const id = getSshIdentity(input.dataDir, input.identityId);
+        if (id) {
+            pub.publicKey = id.publicKey;
+            pub.fingerprint = id.fingerprintSha256;
+        }
+    }
+    return pub;
+}
+/**
+ * Env for git clone/fetch/pull. SSH without a pinned host is blocked.
+ */
+export function resolveGitAuthRuntime(input) {
+    const parsed = parseGitRemoteHost(input.gitUrl);
+    if (parsed.scheme === 'file' || parsed.scheme === 'other' || !input.gitUrl.trim()) {
+        return {};
+    }
+    if (parsed.scheme === 'ssh') {
+        if (!parsed.host) {
+            return { blocked: { code: 'hostkey', message: tl('notes.git.hostkey') } };
+        }
+        if (!isGitHostPinned(input.dataDir, input.projectId, parsed.host)) {
+            return { blocked: { code: 'hostkey', message: tl('notes.git.needPinHost') } };
+        }
+        let identityFile = keyPath(input.dataDir, input.projectId);
+        if (!existsSync(identityFile) && input.identityId) {
+            identityFile = materializeGitDeployKey(input.dataDir, input.projectId, input.identityId) ?? '';
+        }
+        if (!identityFile || !existsSync(identityFile)) {
+            return { blocked: { code: 'auth', message: tl('notes.git.auth') } };
+        }
+        const kh = knownHostsPath(input.dataDir, input.projectId);
+        const ssh = [
+            'ssh',
+            '-i',
+            identityFile,
+            '-o',
+            'IdentitiesOnly=yes',
+            '-o',
+            `UserKnownHostsFile=${kh}`,
+            '-o',
+            'StrictHostKeyChecking=yes',
+            '-o',
+            'BatchMode=yes',
+        ].join(' ');
+        return {
+            env: {
+                GIT_SSH_COMMAND: ssh,
+                GIT_TERMINAL_PROMPT: '0',
+            },
+        };
+    }
+    // HTTPS
+    const token = readGitHttpsToken(input.dataDir, input.projectId);
+    if (!token)
+        return {};
+    const ask = ensureGitAskpass(input.dataDir);
+    return {
+        env: {
+            GIT_ASKPASS: ask,
+            GIT_TERMINAL_PROMPT: '0',
+            GIT_CONFIG_NOSYSTEM: '1',
+            YSK_GIT_TOKEN: token,
+            YSK_GIT_USERNAME: 'git',
+        },
+    };
+}
+//# sourceMappingURL=git-auth.js.map

package/dist/hosting/git-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-auth.js","sourceRoot":"","sources":["../../src/hosting/git-auth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,YAAY,EACZ,UAAU,EACV,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAEvC,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,sBAAsB,GACvB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAGhF,MAAM,SAAS,GAAG,CAAC,SAAiB,EAAE,EAAE,CAAC,aAAa,SAAS,EAAE,CAAC;AAwBlE,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,OAAO,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,SAAS,CAAC,OAAe,EAAE,SAAiB;IACnD,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,GAAG,SAAS,MAAM,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,OAAO,CAAC,OAAe,EAAE,SAAiB;IACjD,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,GAAG,SAAS,MAAM,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,cAAc,CAAC,OAAe,EAAE,SAAiB;IACxD,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,GAAG,SAAS,cAAc,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACrB,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACnC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5E,IAAI,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAC;QACrE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACjD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI,SAAS,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAe;IAC1C,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpE,IAAI,CAAC;QACH,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,SAAiB;IACjE,OAAO,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,SAAiB,EAAE,KAAa;IACjF,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACvB,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;IACnC,CAAC;IACD,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IACpE,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACxC,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,SAAiB;IAClE,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACxC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACrC,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACzC,OAAO,iBAAiB,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,SAAiB;IACnE,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACxC,IAAI,UAAU,CAAC,CAAC,CAAC;QAAE,UAAU,CAAC,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,SAAiB,EAAE,IAAa;IAC/E,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,CAAC,GAAG,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC7C,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACjC,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACrC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACtC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACtB,IAAI,WAAW,GAAG,IAAI,CAAC;QACvB,IAAI,CAAC;YACH,WAAW,GAAG,wBAAwB,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAsB,EACtB,IAAY;IAEZ,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAC/C,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,CAAC,EAAE;QAC/F,SAAS,EAAE,MAAM;KAClB,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAC7C,OAAO,eAAe,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,OAAe,EACf,SAAiB,EACjB,IAAY,EACZ,IAAsB;IAEtB,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC1D,MAAM,CAAC,GAAG,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,MAAM,IAAI,GAAG,QAAQ;SAClB,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IACL,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzF,IAAI,CAAC;QACH,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,SAAiB;IAChE,MAAM,CAAC,GAAG,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC7C,IAAI,UAAU,CAAC,CAAC,CAAC;QAAE,UAAU,CAAC,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,OAAe,EACf,SAAiB,EACjB,UAAkB;IAElB,MAAM,GAAG,GAAG,sBAAsB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACxD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;IACzE,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC7B,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACtC,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,IAAI,CAAC;QACH,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAE,SAAiB;IACtE,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACtC,IAAI,UAAU,CAAC,CAAC,CAAC;QAAE,UAAU,CAAC,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC7B,MAAM,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG;;;;;;;CAOd,CAAC;IACA,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAKzC;IACC,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE;QAC/C,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;QAClE,OAAO,EAAE,WAAW,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;QACjD,SAAS,EAAE,SAAS;QACpB,OAAO,EAAE,gBAAgB;QACzB,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE;QACvC,SAAS,EAAE,KAAK,CAAC,KAAK;KACvB,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC;IAChG,CAAC;IACD,IAAI,CAAC;QACH,uBAAuB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC;SAClE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE;QAC/B,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS;QACrC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,iBAAiB;QAC/C,KAAK,EAAE,CAAC,EAAE,CAAC,4BAA4B,CAAC,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAM/B;IACC,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,IAAI,MAAM,CAAC;IACtC,MAAM,GAAG,GAAkB;QACzB,IAAI;QACJ,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC;QAC1D,UAAU,EAAE,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC;KACzE,CAAC;IACF,IAAI,IAAI,KAAK,KAAK,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACvC,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC3D,IAAI,EAAE,EAAE,CAAC;YACP,GAAG,CAAC,SAAS,GAAG,EAAE,CAAC,SAAS,CAAC;YAC7B,GAAG,CAAC,WAAW,GAAG,EAAE,CAAC,iBAAiB,CAAC;QACzC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAMrC;IACC,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QAClF,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,mBAAmB,CAAC,EAAE,EAAE,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAClE,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,uBAAuB,CAAC,EAAE,EAAE,CAAC;QAChF,CAAC;QACD,IAAI,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YAClD,YAAY,GAAG,uBAAuB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACjG,CAAC;QACD,IAAI,CAAC,YAAY,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC/C,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC;QACtE,CAAC;QACD,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG;YACV,KAAK;YACL,IAAI;YACJ,YAAY;YACZ,IAAI;YACJ,oBAAoB;YACpB,IAAI;YACJ,sBAAsB,EAAE,EAAE;YAC1B,IAAI;YACJ,2BAA2B;YAC3B,IAAI;YACJ,eAAe;SAChB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,OAAO;YACL,GAAG,EAAE;gBACH,eAAe,EAAE,GAAG;gBACpB,mBAAmB,EAAE,GAAG;aACzB;SACF,CAAC;IACJ,CAAC;IACD,QAAQ;IACR,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO;QACL,GAAG,EAAE;YACH,WAAW,EAAE,GAAG;YAChB,mBAAmB,EAAE,GAAG;YACxB,mBAAmB,EAAE,GAAG;YACxB,aAAa,EAAE,KAAK;YACpB,gBAAgB,EAAE,KAAK;SACxB;KACF,CAAC;AACJ,CAAC"}

package/dist/hosting/git-control.d.ts

@@ -0,0 +1,110 @@
+/**
+ * Project Git control: status, fetch, checkout, reset, log.
+ * Deploy source on the host — not a developer Git client.
+ */
+import type { HostExecutor } from '../host/executor.js';
+import { type GitErrorCode } from './git-errors.js';
+export declare const GIT_PROTECTED: readonly [".env"];
+export type GitCommitRow = {
+    hash: string;
+    subject: string;
+    at?: string;
+};
+export type GitStatus = {
+    ok: boolean;
+    gitInstalled: boolean;
+    isRepo: boolean;
+    remoteUrl?: string;
+    branch?: string;
+    detached: boolean;
+    commit?: string;
+    commitSubject?: string;
+    dirty: boolean;
+    dirtyFiles: string[];
+    ahead: number;
+    behind: number;
+    shallow: boolean;
+    heads: string[];
+    lastError?: {
+        code: GitErrorCode;
+        message: string;
+    };
+    notes: string[];
+};
+export type GitOpResult = {
+    ok: boolean;
+    action: string;
+    notes: string[];
+    code?: GitErrorCode;
+    stdout?: string;
+    stderr?: string;
+    commit?: string;
+    branch?: string;
+};
+export type GitAuthEnv = Record<string, string>;
+/** Paths that should not block pull (panel rewrites them after sync). */
+export declare function isProtectedGitPath(rel: string): boolean;
+export declare function parsePorcelain(raw: string): string[];
+export declare function blockingDirtyFiles(files: string[]): string[];
+export declare function restoreEnvFile(appDir: string, envVars: Record<string, string> | undefined): string | undefined;
+export declare function probeGitStatus(input: {
+    host: HostExecutor;
+    appDir: string;
+    storedUrl?: string;
+}): Promise<GitStatus>;
+export declare function gitLog(input: {
+    host: HostExecutor;
+    appDir: string;
+    limit?: number;
+}): Promise<{
+    ok: boolean;
+    items: GitCommitRow[];
+    notes: string[];
+}>;
+export declare function gitDiff(input: {
+    host: HostExecutor;
+    appDir: string;
+}): Promise<{
+    ok: boolean;
+    text: string;
+    notes: string[];
+}>;
+export declare function gitFetch(input: {
+    host: HostExecutor;
+    appDir: string;
+    unshallow?: boolean;
+    env?: GitAuthEnv;
+}): Promise<GitOpResult>;
+export declare function gitCheckoutRef(input: {
+    host: HostExecutor;
+    appDir: string;
+    ref: string;
+    env?: GitAuthEnv;
+}): Promise<GitOpResult>;
+export declare function gitResetHard(input: {
+    host: HostExecutor;
+    appDir: string;
+    ref?: string;
+    env?: GitAuthEnv;
+}): Promise<GitOpResult>;
+export type ParsedGitRemoteRefs = {
+    defaultBranch?: string;
+    branches: string[];
+    tags: string[];
+};
+/** Parse `git ls-remote --heads --tags --symref` stdout. */
+export declare function parseGitLsRemote(stdout: string): ParsedGitRemoteRefs;
+export declare function listGitRemoteRefs(input: {
+    host: HostExecutor;
+    gitUrl: string;
+    env?: GitAuthEnv;
+}): Promise<{
+    ok: boolean;
+    defaultBranch?: string;
+    branches: string[];
+    tags: string[];
+    notes: string[];
+    code?: GitErrorCode;
+}>;
+export { classifyGitError, type GitErrorCode } from './git-errors.js';
+//# sourceMappingURL=git-control.d.ts.map

package/dist/hosting/git-control.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-control.d.ts","sourceRoot":"","sources":["../../src/hosting/git-control.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAoB,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAGtE,eAAO,MAAM,aAAa,mBAAoB,CAAC;AAE/C,MAAM,MAAM,YAAY,GAAG;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB,EAAE,EAAE,OAAO,CAAC;IACZ,YAAY,EAAE,OAAO,CAAC;IACtB,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,CAAC,EAAE;QAAE,IAAI,EAAE,YAAY,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACpD,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AASF,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAuBhD,yEAAyE;AACzE,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAGvD;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAOpD;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAE5D;AAED,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,GAC1C,MAAM,GAAG,SAAS,CAQpB;AAED,wBAAsB,cAAc,CAAC,KAAK,EAAE;IAC1C,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,SAAS,CAAC,CA2FrB;AAED,wBAAsB,MAAM,CAAC,KAAK,EAAE;IAClC,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,YAAY,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAwBnE;AAED,wBAAsB,OAAO,CAAC,KAAK,EAAE;IACnC,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAmB1D;AAED,wBAAsB,QAAQ,CAAC,KAAK,EAAE;IACpC,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,GAAG,CAAC,EAAE,UAAU,CAAC;CAClB,GAAG,OAAO,CAAC,WAAW,CAAC,CAavB;AAED,wBAAsB,cAAc,CAAC,KAAK,EAAE;IAC1C,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,UAAU,CAAC;CAClB,GAAG,OAAO,CAAC,WAAW,CAAC,CA8BvB;AAED,wBAAsB,YAAY,CAAC,KAAK,EAAE;IACxC,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,UAAU,CAAC;CAClB,GAAG,OAAO,CAAC,WAAW,CAAC,CAgCvB;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB,CAAC;AAEF,4DAA4D;AAC5D,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,mBAAmB,CA8BpE;AAED,wBAAsB,iBAAiB,CAAC,KAAK,EAAE;IAC7C,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,UAAU,CAAC;CAClB,GAAG,OAAO,CAAC;IACV,EAAE,EAAE,OAAO,CAAC;IACZ,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,IAAI,CAAC,EAAE,YAAY,CAAC;CACrB,CAAC,CAwCD;AAED,OAAO,EAAE,gBAAgB,EAAE,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC"}