@calltelemetry/ct-lab-mcp 0.8.104 → 0.8.106

package/dist/src/stig/distribution.js

@@ -0,0 +1,335 @@
+/**
+ * STIG template distribution: publish a sealed template as a signed qcow2 on the shared image store (build node,
+ * read-write) and sync it onto a node as a claimed Proxmox template (read-only mount, verified on the node).
+ *
+ * Mirrors the ct-meta `rhel8-stig-template` scripts publish.sh and sync.sh, with every side effect behind a port
+ * (./ports.ts). Plans are pure reads; applies need the digest of the plan they were shown.
+ */
+import { createHash } from "node:crypto";
+import { createReadStream, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync, chmodSync } from "node:fs";
+import { join } from "node:path";
+import { STIG_BUILD_NODE, STIG_EVIDENCE_FPR, STIG_IMAGE_KEEP_VERSIONS, STIG_NODE_NAMES, STIG_STORE, resolveStigNode, templateClaimName, } from "./nodes.js";
+import { assertIndexNames, indexRank, EXPORT_DONE, SYNC_DONE, assertTemplateName, buildExportScript, buildIndex, buildPublishReceipt, buildQmCreateScript, buildSyncReceipt, buildTemplateJson, indexHas, parseIndex, pyJson, scanFromSummary, validateTemplateJson, } from "./dist.js";
+import { STIG_POOL_LIMIT_PERCENT, STIG_RECEIPT_ANNOTATION, STIG_TTL_CAP_HOURS, redact, validateReceiptSummary } from "./model.js";
+import { listGuests, lowestFreeVmid } from "./pve.js";
+export const SYNC_CLAIM_TTL_HOURS = 6;
+const STORE_DIR = `${STIG_STORE.mount}/rhel8-stig`;
+const digest = (value) => createHash("sha256").update(JSON.stringify(value)).digest("hex");
+/** The detached job outlived the poll budget; it keeps running and nothing is cleaned up. Re-apply to keep waiting. */
+export class StillRunningError extends Error {
+    constructor(what) { super(`${what} is still running; re-apply with the same planDigest to keep waiting`); this.name = "StillRunningError"; }
+}
+async function sha256Stream(path) {
+    const h = createHash("sha256");
+    await new Promise((resolveP, reject) => { const s = createReadStream(path); s.on("data", (c) => h.update(c)); s.on("end", () => resolveP()); s.on("error", reject); });
+    return h.digest("hex");
+}
+const sha256Text = (text) => createHash("sha256").update(text).digest("hex");
+export const PUBLISH_STEPS = ["verify-published", "export", "template-json", "sign", "index", "upload", "prune", "verify", "receipt"];
+export const SYNC_STEPS = ["claim", "verify", "qm-create", "template", "renew", "receipt"];
+export class StigDistribution {
+    d;
+    constructor(d) {
+        this.d = d;
+    }
+    log(line) { this.d.log.info(redact(line)); }
+    sh(node) { return this.d.pveFor(node.host); }
+    buildNode() { return resolveStigNode(STIG_BUILD_NODE); }
+    distDir() { const p = join(this.d.baseDir, "dist"); mkdirSync(p, { recursive: true, mode: 0o700 }); chmodSync(p, 0o700); return p; }
+    /** true when index.json lists the template and the node-side verification (fingerprint, signatures, sha256) passes. */
+    async verifiedOn(node, template) {
+        try {
+            await this.d.store.verify(node.host, template, STIG_EVIDENCE_FPR);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    /* ----------------------------------------------------------------- publish */
+    async planPublish(i) {
+        const template = assertTemplateName(i.template);
+        const build = this.buildNode();
+        const published = await this.verifiedOn(build, template);
+        const force = i.force === true;
+        const noop = published && !force;
+        const guest = (await listGuests(this.sh(build))).find((g) => g.name === template && g.template === 1);
+        if (!noop) {
+            const thin = await this.d.storage.status(build.host, build.thin);
+            if (thin.type !== "lvmthin")
+                throw new Error(`refusing: ${build.thin} on ${build.name} is '${thin.type}', thin storage required`);
+            if (!guest)
+                throw new Error(`no template named ${template} on ${build.name}`);
+            if (!(await this.d.store.isWritable(build.host)))
+                throw new Error(`${STIG_STORE.mount} is not mounted rw on ${build.name}`);
+            const old = parseIndex(await this.d.store.readText(build.host, `${STORE_DIR}/index.json`));
+            assertIndexNames(old);
+            if (indexRank(old, template) >= STIG_IMAGE_KEEP_VERSIONS)
+                throw new Error(`refusing: ${template} sorts outside the newest ${STIG_IMAGE_KEEP_VERSIONS} versions in index.json and would be pruned at once`);
+        }
+        const vmid = guest?.vmid ?? null;
+        const claim = await this.d.claims.get(templateClaimName(template, build.name));
+        const raw = claim?.metadata.annotations?.[STIG_RECEIPT_ANNOTATION];
+        const receiptFound = typeof raw === "string";
+        return {
+            mode: "plan", template, vmid, buildNode: build.name, host: build.host, store: STIG_STORE.name, keepVersions: STIG_IMAGE_KEEP_VERSIONS,
+            noop, force, published, receiptFound, steps: PUBLISH_STEPS,
+            planDigest: digest({ kind: "publish", template, vmid, node: build.name, host: build.host, keep: STIG_IMAGE_KEEP_VERSIONS, force, noop }),
+        };
+    }
+    async publish(i) {
+        const plan = await this.planPublish(i);
+        if (!i.apply)
+            return plan;
+        if (!i.planDigest || i.planDigest !== plan.planDigest)
+            throw new Error("plan digest missing or stale; re-run the plan and apply with its planDigest");
+        if (plan.noop)
+            return { ok: true, noop: true, template: plan.template, message: `no-op: ${plan.template} is already published and verifies` };
+        const { template } = plan;
+        const vmid = plan.vmid;
+        const build = this.buildNode();
+        const sh = this.sh(build);
+        const work = mkdtempSync(join(this.distDir(), `publish-${template}.`));
+        chmodSync(work, 0o700);
+        try {
+            const cfgRun = await sh.run(`qm config ${vmid}`);
+            if (cfgRun.code !== 0 || !/^template: 1$/m.test(cfgRun.stdout))
+                throw new Error(`VM ${vmid} is not a Proxmox template`);
+            this.log(`publish ${template} vmid ${vmid}`);
+            await this.exec(build, `install -d ${STIG_STORE.mount}/import ${STORE_DIR}/${template}`);
+            // 1. export from the read-only base LV (detached; resumable)
+            const job = await this.d.store.runDetached(build.host, { name: `ct-stig-publish-${template}`, script: buildExportScript({ template, vmid }), doneMarker: EXPORT_DONE, polls: 56, intervalMs: 10_000 });
+            if (job.state === "failed")
+                throw new Error(`export failed: ${redact(job.log).slice(-300)}`);
+            if (job.state === "running")
+                throw new StillRunningError("export");
+            this.log(job.log.trim().split("\n").filter((l) => l.startsWith("lv_attr")).join(" "));
+            const qSha = ((await this.d.store.readText(build.host, `${STORE_DIR}/${template}.qcow2.sha256`)) ?? "").trim();
+            if (!/^[a-f0-9]{64}$/.test(qSha))
+                throw new Error("export produced no readable qcow2 sha256");
+            const qBytes = await this.d.store.fileSize(build.host, `${STIG_STORE.mount}/import/${template}.qcow2`);
+            const info = JSON.parse((await this.d.store.readText(build.host, `${STORE_DIR}/${template}.qemu-img-info.json`)) ?? "{}");
+            const vsize = info["virtual-size"];
+            if (!Number.isInteger(vsize))
+                throw new Error("qemu-img info has no virtual-size");
+            await this.exec(build, `mv ${STORE_DIR}/${template}.qemu-img-info.json ${STORE_DIR}/${template}/qemu-img-info.json; rm -f ${STORE_DIR}/${template}.qcow2.sha256; rm -f /root/ct-stig-publish-${template}.sh`);
+            // 2. template.json: hardware from qm config, scan counts from the template claim's receipt, digests of receipt and manifest
+            const claim = await this.d.claims.get(templateClaimName(template, build.name));
+            const raw = claim?.metadata.annotations?.[STIG_RECEIPT_ANNOTATION];
+            let summary = null;
+            if (typeof raw === "string") {
+                try {
+                    summary = validateReceiptSummary(JSON.parse(raw));
+                }
+                catch {
+                    summary = null;
+                }
+            }
+            if (summary && !summary.gate.failZero)
+                throw new Error(`refusing: the receipt of ${template} does not show fail=0 on both scans`);
+            const receiptSha = i.receiptPath ? await sha256Stream(i.receiptPath) : typeof raw === "string" ? sha256Text(raw) : null;
+            const manifestSha = i.manifestPath ? await sha256Stream(i.manifestPath) : null;
+            const nowMs = this.d.clock.now();
+            const tpl = buildTemplateJson({ template, vmid, qcowSha256: qSha, qcowBytes: qBytes, virtualBytes: vsize, qmConfig: cfgRun.stdout, scan: scanFromSummary(summary), receiptSha256: receiptSha, manifestSha256: manifestSha, publishedMs: nowMs });
+            const tplPath = join(work, "template.json");
+            writeFileSync(tplPath, pyJson(tpl));
+            const tjSha = await sha256Stream(tplPath);
+            // 3. sign the qcow2 (staged locally for gpg) and template.json
+            const qPath = join(work, `${template}.qcow2`);
+            this.log("staging qcow2 locally for signing");
+            await this.d.store.fetchFile(build.host, `${STIG_STORE.mount}/import/${template}.qcow2`, qPath);
+            if ((await sha256Stream(qPath)) !== qSha)
+                throw new Error("qcow2 changed in transit");
+            const signed = await this.d.gpg.signDetached([qPath, tplPath], STIG_EVIDENCE_FPR);
+            const sums = `${qSha}  ${template}.qcow2\n${tjSha}  template.json\n`;
+            // 4. index.json (newest first, keep N) + signature
+            const old = parseIndex(await this.d.store.readText(build.host, `${STORE_DIR}/index.json`));
+            assertIndexNames(old);
+            const { index, dropped } = buildIndex({ old, template, vmid, qcowSha256: qSha, qcowBytes: qBytes, templateJsonSha256: tjSha, publishedMs: nowMs });
+            const idxPath = join(work, "index.json");
+            writeFileSync(idxPath, pyJson(index));
+            await this.d.gpg.signDetached([idxPath], STIG_EVIDENCE_FPR);
+            // 5. upload; index.json goes last and atomically
+            const read = async (p) => readFileSync(p, "utf8");
+            const dir = `${STORE_DIR}/${template}`;
+            await this.d.store.writeText(build.host, `${dir}/template.json`, await read(tplPath));
+            await this.d.store.writeText(build.host, `${dir}/template.json.asc`, await read(`${tplPath}.asc`));
+            await this.d.store.writeText(build.host, `${dir}/${template}.qcow2.asc`, await read(`${qPath}.asc`));
+            await this.d.store.writeText(build.host, `${dir}/SHA256SUMS`, sums);
+            await this.d.store.writeText(build.host, `${STORE_DIR}/stig-evidence-signing.pub.asc`, signed.publicKey);
+            await this.d.store.writeText(build.host, `${STORE_DIR}/index.json.new`, await read(idxPath));
+            await this.d.store.writeText(build.host, `${STORE_DIR}/index.json.asc.new`, await read(`${idxPath}.asc`));
+            await this.exec(build, `cd ${STORE_DIR} && mv index.json.new index.json && mv index.json.asc.new index.json.asc`);
+            // 6. prune dropped versions: never 'latest', never one a node is importing
+            const pruned = [];
+            const skipped = [];
+            for (const v of dropped) {
+                if (v === index.latest)
+                    continue;
+                if (await this.anyNodeImporting(v)) {
+                    skipped.push(v);
+                    this.log(`skip prune of ${v}: in use`);
+                    continue;
+                }
+                await this.exec(build, `rm -rf ${STIG_STORE.mount}/import/${v}.qcow2 ${STORE_DIR}/${v}`);
+                pruned.push(v);
+            }
+            // 7. verify from the build node (fingerprint, signatures, sha256), then the receipt
+            await this.d.store.verify(build.host, template, STIG_EVIDENCE_FPR);
+            const receipt = buildPublishReceipt({ template: tpl, index, buildNode: build.name, pruned });
+            const receiptPath = join(this.distDir(), `publish-${template}.json`);
+            writeFileSync(receiptPath, pyJson(receipt));
+            return { ok: true, noop: false, receipt, receiptPath, skippedPrune: skipped };
+        }
+        finally {
+            rmSync(work, { recursive: true, force: true });
+        }
+    }
+    async exec(node, script) {
+        const r = await this.d.store.exec(node.host, script);
+        if (r.code !== 0)
+            throw new Error(`store command failed on ${node.name} (exit ${r.code}): ${redact(r.stderr).slice(0, 200)}`);
+    }
+    /** An unreachable node counts as busy: pruning is the one irreversible step. */
+    async anyNodeImporting(version) {
+        for (const name of STIG_NODE_NAMES) {
+            try {
+                if (await this.d.store.importing(resolveStigNode(name).host, version))
+                    return true;
+            }
+            catch {
+                return true;
+            }
+        }
+        return false;
+    }
+    /* -------------------------------------------------------------------- sync */
+    async planSync(i) {
+        const template = assertTemplateName(i.template);
+        const node = resolveStigNode(i.node);
+        const claimName = templateClaimName(template, node.name);
+        const guests = await listGuests(this.sh(node));
+        const existing = guests.find((g) => g.name === template && g.template === 1);
+        const claim = await this.d.claims.get(claimName);
+        const noop = Boolean(existing && claim);
+        let blockedBy = null;
+        let poolPercent = null;
+        const poolMaxPercent = STIG_POOL_LIMIT_PERCENT;
+        const adoptable = node.name === STIG_BUILD_NODE;
+        let syncMode = noop ? (node.name === STIG_BUILD_NODE ? "origin" : "already-present") : existing ? "adopted" : claim ? "resume" : "synced";
+        if (!noop && existing && !claim && !adoptable)
+            blockedBy = `a template named ${template} already exists on ${node.name} without its claim; refusing to adopt it off the build node (claim it by hand or retire it first)`;
+        if (!blockedBy && !noop && !existing) {
+            const st = await this.d.storage.status(node.host, node.thin);
+            poolPercent = st.percent;
+            if (st.type !== "lvmthin")
+                blockedBy = `${node.thin} on ${node.name} is '${st.type}', thin storage required`;
+            else if (!Number.isFinite(st.percent) || st.percent > poolMaxPercent)
+                blockedBy = `${node.thin} on ${node.name} at ${st.percent}% (max ${poolMaxPercent})`;
+        }
+        if (!blockedBy && !noop) {
+            const idx = parseIndex(await this.d.store.readText(node.host, `${STORE_DIR}/index.json`));
+            if (!indexHas(idx, template))
+                blockedBy = `${template} is not in the published index.json on ${node.name} (publish it, and check ${STIG_STORE.name} is mounted)`;
+        }
+        const vmid = existing ? existing.vmid : Number.isInteger(claim?.spec?.vmid) ? claim.spec.vmid : noop ? null : lowestFreeVmid(guests, (await this.d.claims.list()).filter((c) => (c.spec?.node ?? "minis") === node.claimNode));
+        return {
+            mode: "plan", template, node: node.name, host: node.host, claim: claimName, claimNode: node.claimNode, vmid, thin: node.thin, bridge: node.bridge,
+            noop, syncMode, poolPercent, poolMaxPercent, blockedBy, steps: SYNC_STEPS,
+            planDigest: digest({ kind: "sync", template, node: node.name, host: node.host, claim: claimName, vmid, thin: node.thin, bridge: node.bridge, noop, syncMode }),
+        };
+    }
+    async sync(i) {
+        const plan = await this.planSync(i);
+        if (!i.apply)
+            return plan;
+        if (!i.planDigest || i.planDigest !== plan.planDigest)
+            throw new Error("plan digest missing or stale; re-run the plan and apply with its planDigest");
+        if (plan.blockedBy)
+            throw new Error(`refusing: ${plan.blockedBy}`);
+        const node = resolveStigNode(plan.node);
+        const { template, claim: claimName } = plan;
+        const sh = this.sh(node);
+        let vmid = plan.vmid;
+        let mode = plan.syncMode === "resume" ? "synced" : plan.syncMode;
+        let state = plan.noop ? "final" : "start";
+        if (!plan.noop) {
+            // 1. claim first (a half-synced node is a claimed one the operator can reap)
+            let claim = await this.d.claims.get(claimName);
+            if (!claim) {
+                this.log(`claim ${claimName}: creating (vmid ${vmid}, ${SYNC_CLAIM_TTL_HOURS}h) on ${node.claimNode}`);
+                claim = await this.d.claims.create({ name: claimName, vmid, vmName: template, ttlHours: SYNC_CLAIM_TTL_HOURS, node: node.claimNode });
+            }
+            else
+                vmid = claim.spec.vmid;
+            state = "claimed";
+            try {
+                await this.d.claims.waitReady(claimName);
+                this.log(`claim=${claimName} node=${node.name} vmid=${vmid} Ready`);
+                // 2. verify on the node: pinned fingerprint, index, template.json and qcow2 sha256 + signatures
+                const verified = await this.d.store.verify(node.host, template, STIG_EVIDENCE_FPR);
+                const tplText = await this.d.store.readText(node.host, `${STORE_DIR}/${template}/template.json`);
+                if (!tplText)
+                    throw new Error("template.json is missing on the store");
+                if (sha256Text(tplText) !== verified.templateJsonSha256)
+                    throw new Error("template.json sha256 mismatch");
+                const tpl = validateTemplateJson(JSON.parse(tplText), template);
+                if (tpl.image.sha256 !== verified.qcow2Sha256)
+                    throw new Error("template.json image sha256 does not match the verified qcow2");
+                this.log(`verified on ${node.name}: index.json, template.json and ${template}.qcow2 signatures + sha256`);
+                if (plan.syncMode === "adopted")
+                    state = "final";
+                else {
+                    // 3. qm create + import-from onto thin storage, efidisk, cloud-init, qm template (detached; the import takes minutes)
+                    state = "created";
+                    const job = await this.d.store.runDetached(node.host, { name: `ct-stig-sync-${template}`, script: buildQmCreateScript({ template: tpl, vmid, thin: node.thin, bridge: node.bridge }), doneMarker: SYNC_DONE, polls: 55, intervalMs: 10_000 });
+                    if (job.state === "running")
+                        throw new StillRunningError("import");
+                    if (job.state === "failed")
+                        throw new Error(`qm create/import failed: ${redact(job.log).slice(-300)}`);
+                    await this.exec(node, `rm -f /root/ct-stig-sync-${template}.sh`);
+                    const cfg = await sh.run(`qm config ${vmid}`);
+                    if (cfg.code !== 0 || !/^template: 1$/m.test(cfg.stdout))
+                        throw new Error(`VM ${vmid} is not a template after the import`);
+                    state = "final"; // from here a receipt problem must never destroy the template
+                }
+            }
+            catch (e) {
+                if (!(e instanceof StillRunningError) && state !== "final")
+                    await this.cleanup(node, claimName, template, vmid, state === "created");
+                throw e;
+            }
+            await this.d.claims.renew(claimName, STIG_TTL_CAP_HOURS - 1);
+        }
+        else {
+            await this.d.store.verify(node.host, template, STIG_EVIDENCE_FPR);
+        }
+        // 4. receipt: thin mapped bytes of the template disk
+        const mapped = await this.d.storage.mappedBytes(node.host, vmid);
+        const idx = parseIndex(await this.d.store.readText(node.host, `${STORE_DIR}/index.json`));
+        const entry = idx.versions.find((v) => v.name === template);
+        const receipt = buildSyncReceipt({ template, node: node.name, vmid, claim: claimName, mode, qcowSha256: entry.qcow2_sha256, thin: node.thin, lvSizeBytes: mapped.lvSizeBytes, mappedPercent: mapped.mappedPercent, syncedMs: this.d.clock.now() });
+        const receiptPath = join(this.distDir(), `sync-${template}-${node.name}.json`);
+        writeFileSync(receiptPath, pyJson(receipt));
+        return { ok: true, noop: plan.noop, receipt, receiptPath };
+    }
+    /** Destroys a half-created VM (only if it is the one this sync named) and releases the claim. Never called once the template is final. */
+    async cleanup(node, claimName, template, vmid, created) {
+        this.log(`sync failed; releasing claim ${claimName}`);
+        try {
+            if (created) {
+                const g = (await listGuests(this.sh(node))).find((x) => x.vmid === vmid);
+                if (g && g.name === template && g.template !== 1)
+                    await this.sh(node).run(`qm destroy ${vmid} --purge`);
+            }
+        }
+        catch { /* best effort */ }
+        try {
+            const rec = await this.d.claims.get(claimName);
+            if (rec)
+                await this.d.claims.delete(claimName, rec.metadata.uid);
+        }
+        catch { /* best effort */ }
+    }
+}
+//# sourceMappingURL=distribution.js.map

package/dist/src/stig/distribution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"distribution.js","sourceRoot":"","sources":["../../../src/stig/distribution.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACnH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,eAAe,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,eAAe,EAAE,UAAU,EAAE,eAAe,EAAE,iBAAiB,GAE9H,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,gBAAgB,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,UAAU,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,gBAAgB,EAClK,iBAAiB,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,oBAAoB,GACvF,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAClI,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAGtD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AACtC,MAAM,SAAS,GAAG,GAAG,UAAU,CAAC,KAAK,aAAa,CAAC;AACnD,MAAM,MAAM,GAAG,CAAC,KAAc,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAE5G,uHAAuH;AACvH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,IAAY,IAAI,KAAK,CAAC,GAAG,IAAI,sEAAsE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC,CAAC,CAAC;CACrJ;AAED,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,IAAI,OAAO,CAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7K,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AACD,MAAM,UAAU,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAY7F,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,kBAAkB,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAU,CAAC;AAC/I,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,CAAU,CAAC;AAEpG,MAAM,OAAO,gBAAgB;IACE;IAA7B,YAA6B,CAAW;QAAX,MAAC,GAAD,CAAC,CAAU;IAAG,CAAC;IAEpC,GAAG,CAAC,IAAY,IAAU,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,EAAE,CAAC,IAAc,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvD,SAAS,KAAe,OAAO,eAAe,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO,KAAa,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAEpJ,uHAAuH;IAC/G,KAAK,CAAC,UAAU,CAAC,IAAc,EAAE,QAAgB;QACvD,IAAI,CAAC;YAAC,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;IACjH,CAAC;IAED,+EAA+E;IAE/E,KAAK,CAAC,WAAW,CAAC,CAAwC;QACxD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC;QAC/B,MAAM,IAAI,GAAG,SAAS,IAAI,CAAC,KAAK,CAAC;QACjC,MAAM,KAAK,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC;QACtG,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACjE,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,QAAQ,IAAI,CAAC,IAAI,0BAA0B,CAAC,CAAC;YAClI,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC9E,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,CAAC,KAAK,yBAAyB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5H,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,SAAS,aAAa,CAAC,CAAC,CAAC;YAC3F,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACtB,IAAI,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,wBAAwB;gBAAE,MAAM,IAAI,KAAK,CAAC,aAAa,QAAQ,6BAA6B,wBAAwB,qDAAqD,CAAC,CAAC;QAC7M,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,EAAE,IAAI,IAAI,IAAI,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/E,MAAM,GAAG,GAAG,KAAK,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,uBAAuB,CAAC,CAAC;QACnE,MAAM,YAAY,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC;QAC7C,OAAO;YACL,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,EAAE,YAAY,EAAE,wBAAwB;YACrI,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa;YAC1D,UAAU,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;SACzI,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,CAA2H;QACvI,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACvC,IAAI,CAAC,CAAC,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAC1B,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;QACtJ,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,IAAI,CAAC,QAAQ,oCAAoC,EAAE,CAAC;QAE9I,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAK,CAAC;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,QAAQ,GAAG,CAAC,CAAC,CAAC;QACvE,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;YACjD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,MAAM,IAAI,4BAA4B,CAAC,CAAC;YACxH,IAAI,CAAC,GAAG,CAAC,WAAW,QAAQ,SAAS,IAAI,EAAE,CAAC,CAAC;YAC7C,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,UAAU,CAAC,KAAK,WAAW,SAAS,IAAI,QAAQ,EAAE,CAAC,CAAC;YAEzF,6DAA6D;YAC7D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,mBAAmB,QAAQ,EAAE,EAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;YACvM,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC7F,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS;gBAAE,MAAM,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YACnE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YACtF,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,SAAS,IAAI,QAAQ,eAAe,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/G,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAC9F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC,KAAK,WAAW,QAAQ,QAAQ,CAAC,CAAC;YACvG,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,SAAS,IAAI,QAAQ,qBAAqB,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YAC1H,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACnF,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,SAAS,IAAI,QAAQ,uBAAuB,SAAS,IAAI,QAAQ,8BAA8B,SAAS,IAAI,QAAQ,8CAA8C,QAAQ,KAAK,CAAC,CAAC;YAE9M,4HAA4H;YAC5H,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/E,MAAM,GAAG,GAAG,KAAK,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,uBAAuB,CAAC,CAAC;YACnE,IAAI,OAAO,GAAG,IAAiD,CAAC;YAChE,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAAC,IAAI,CAAC;oBAAC,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,OAAO,GAAG,IAAI,CAAC;gBAAC,CAAC;YAAC,CAAC;YACrH,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,qCAAqC,CAAC,CAAC;YAClI,MAAM,UAAU,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACxH,MAAM,WAAW,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC/E,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;YACjP,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YAC5C,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACpC,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;YAE1C,+DAA+D;YAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,QAAQ,QAAQ,CAAC,CAAC;YAC9C,IAAI,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;YAC9C,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC,KAAK,WAAW,QAAQ,QAAQ,EAAE,KAAK,CAAC,CAAC;YAChG,IAAI,CAAC,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YACtF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,iBAAiB,CAAC,CAAC;YAClF,MAAM,IAAI,GAAG,GAAG,IAAI,KAAK,QAAQ,WAAW,KAAK,mBAAmB,CAAC;YAErE,mDAAmD;YACnD,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,SAAS,aAAa,CAAC,CAAC,CAAC;YAC3F,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACtB,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;YACnJ,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;YACzC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACtC,MAAM,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,EAAE,iBAAiB,CAAC,CAAC;YAE5D,iDAAiD;YACjD,MAAM,IAAI,GAAG,KAAK,EAAE,CAAS,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YAC1D,MAAM,GAAG,GAAG,GAAG,SAAS,IAAI,QAAQ,EAAE,CAAC;YACvC,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,GAAG,gBAAgB,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YACtF,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,GAAG,oBAAoB,EAAE,MAAM,IAAI,CAAC,GAAG,OAAO,MAAM,CAAC,CAAC,CAAC;YACnG,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,QAAQ,YAAY,EAAE,MAAM,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC;YACrG,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,GAAG,aAAa,EAAE,IAAI,CAAC,CAAC;YACpE,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,SAAS,gCAAgC,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YACzG,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,SAAS,iBAAiB,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAC7F,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,SAAS,qBAAqB,EAAE,MAAM,IAAI,CAAC,GAAG,OAAO,MAAM,CAAC,CAAC,CAAC;YAC1G,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,SAAS,0EAA0E,CAAC,CAAC;YAElH,2EAA2E;YAC3E,MAAM,MAAM,GAAa,EAAE,CAAC;YAAC,MAAM,OAAO,GAAa,EAAE,CAAC;YAC1D,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,IAAI,CAAC,KAAK,KAAK,CAAC,MAAM;oBAAE,SAAS;gBACjC,IAAI,MAAM,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;oBAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBAC1G,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,UAAU,CAAC,KAAK,WAAW,CAAC,UAAU,SAAS,IAAI,CAAC,EAAE,CAAC,CAAC;gBACzF,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjB,CAAC;YAED,oFAAoF;YACpF,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;YACnE,MAAM,OAAO,GAAG,mBAAmB,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC7F,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,QAAQ,OAAO,CAAC,CAAC;YACrE,aAAa,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YAC5C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;QAChF,CAAC;gBAAS,CAAC;YAAC,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;IAC/D,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,IAAc,EAAE,MAAc;QAC/C,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrD,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,IAAI,UAAU,CAAC,CAAC,IAAI,MAAM,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAChI,CAAC;IAED,gFAAgF;IACxE,KAAK,CAAC,gBAAgB,CAAC,OAAe;QAC5C,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;YACnC,IAAI,CAAC;gBAAC,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC;oBAAE,OAAO,IAAI,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,IAAI,CAAC;YAAC,CAAC;QACpH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,+EAA+E;IAE/E,KAAK,CAAC,QAAQ,CAAC,CAAqC;QAClD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,SAAS,GAAG,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC;QAC7E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAC,CAAC;QACxC,IAAI,SAAS,GAAkB,IAAI,CAAC;QAAC,IAAI,WAAW,GAAkB,IAAI,CAAC;QAC3E,MAAM,cAAc,GAAG,uBAAuB,CAAC;QAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,KAAK,eAAe,CAAC;QAChD,IAAI,QAAQ,GAAyB,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;QAChK,IAAI,CAAC,IAAI,IAAI,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS;YAAE,SAAS,GAAG,oBAAoB,QAAQ,sBAAsB,IAAI,CAAC,IAAI,mGAAmG,CAAC;QAC1N,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7D,WAAW,GAAG,EAAE,CAAC,OAAO,CAAC;YACzB,IAAI,EAAE,CAAC,IAAI,KAAK,SAAS;gBAAE,SAAS,GAAG,GAAG,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC,IAAI,0BAA0B,CAAC;iBACxG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,GAAG,cAAc;gBAAE,SAAS,GAAG,GAAG,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC,OAAO,UAAU,cAAc,GAAG,CAAC;QAC7J,CAAC;QACD,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,SAAS,aAAa,CAAC,CAAC,CAAC;YAC1F,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;gBAAE,SAAS,GAAG,GAAG,QAAQ,0CAA0C,IAAI,CAAC,IAAI,2BAA2B,UAAU,CAAC,IAAI,cAAc,CAAC;QACnK,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QAChO,OAAO;YACL,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM;YACjJ,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU;YACzE,UAAU,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;SAC/J,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,CAA2E;QACpF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,CAAC,CAAC,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAC1B,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;QACtJ,IAAI,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,IAAI,GAAG,IAAI,CAAC,IAAK,CAAC;QACtB,IAAI,IAAI,GAAW,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;QACzE,IAAI,KAAK,GAA8C,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QAErF,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,6EAA6E;YAC7E,IAAI,KAAK,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,IAAI,CAAC,GAAG,CAAC,SAAS,SAAS,oBAAoB,IAAI,KAAK,oBAAoB,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;gBACvG,KAAK,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,oBAAoB,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;YACxI,CAAC;;gBAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;YAC9B,KAAK,GAAG,SAAS,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;gBACzC,IAAI,CAAC,GAAG,CAAC,SAAS,SAAS,SAAS,IAAI,CAAC,IAAI,SAAS,IAAI,QAAQ,CAAC,CAAC;gBACpE,gGAAgG;gBAChG,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;gBACnF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,SAAS,IAAI,QAAQ,gBAAgB,CAAC,CAAC;gBACjG,IAAI,CAAC,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;gBACvE,IAAI,UAAU,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,kBAAkB;oBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;gBAC1G,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;gBAChE,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,WAAW;oBAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;gBAC/H,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,IAAI,mCAAmC,QAAQ,4BAA4B,CAAC,CAAC;gBAE1G,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;oBAAE,KAAK,GAAG,OAAO,CAAC;qBAC5C,CAAC;oBACJ,sHAAsH;oBACtH,KAAK,GAAG,SAAS,CAAC;oBAClB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,gBAAgB,QAAQ,EAAE,EAAE,MAAM,EAAE,mBAAmB,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;oBAC9O,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS;wBAAE,MAAM,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC;oBACnE,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ;wBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACvG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,4BAA4B,QAAQ,KAAK,CAAC,CAAC;oBACjE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;oBAC9C,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,MAAM,IAAI,qCAAqC,CAAC,CAAC;oBAC3H,KAAK,GAAG,OAAO,CAAC,CAAC,8DAA8D;gBACjF,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,CAAC,CAAC,YAAY,iBAAiB,CAAC,IAAI,KAAK,KAAK,OAAO;oBAAE,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC;gBACrI,MAAM,CAAC,CAAC;YACV,CAAC;YACD,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,kBAAkB,GAAG,CAAC,CAAC,CAAC;QAC/D,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QACpE,CAAC;QAED,qDAAqD;QACrD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACjE,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,SAAS,aAAa,CAAC,CAAC,CAAC;QAC1F,MAAM,KAAK,GAAI,GAAG,CAAC,QAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACnP,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,QAAQ,IAAI,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC;QAC/E,aAAa,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAC7D,CAAC;IAED,0IAA0I;IAClI,KAAK,CAAC,OAAO,CAAC,IAAc,EAAE,SAAiB,EAAE,QAAgB,EAAE,IAAY,EAAE,OAAgB;QACvG,IAAI,CAAC,GAAG,CAAC,gCAAgC,SAAS,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC;YACH,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,CAAC,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;gBACzE,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC;oBAAE,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,cAAc,IAAI,UAAU,CAAC,CAAC;YAC1G,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC/C,IAAI,GAAG;gBAAE,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC/B,CAAC;CACF"}

package/dist/src/stig/live.d.ts

@@ -1,5 +1,4 @@
-import type { BuildMaterial, ClaimPort, ClaimRecord, GuestShell, Materials, PackerPort, PveShell, RunOpts, SecretStore, ShellResult, StigDeps, StigProvider } from "./ports.js";
-import { type StigNode } from "./nodes.js";
+import type { BuildMaterial, ClaimPort, ClaimRecord, DetachedRun, GpgPort, GuestShell, ImageStorePort, Materials, PackerPort, PveShell, RunOpts, SecretStore, ShellResult, StigDeps, StigProvider, StoragePort } from "./ports.js";
 /** assets/stig next to dist/src/stig (published) or next to src/stig (dev). */
 export declare function defaultAssetsDir(): string;
 export declare class SshPveShell implements PveShell {
@@ -48,7 +47,7 @@ export declare class LabClaims implements ClaimPort {
         vmName: string;
         ttlHours: number;
         node: string;
-        stig: Record<string, unknown>;
+        stig?: Record<string, unknown>;
     }): Promise<ClaimRecord>;
     waitReady(name: string): Promise<ClaimRecord>;
     annotate(name: string, annotations: Record<string, string>): Promise<void>;
@@ -111,12 +110,65 @@ export declare class CliStigProvider implements StigProvider {
     }): Promise<void>;
     guestIp(vmid: number, hostAssetId: string): Promise<string>;
 }
+/** Thin-pool facts over root SSH (the canonical lab-inventory CLI has no storage-status verb). */
+export declare class SshStorage implements StoragePort {
+    private readonly shellFor;
+    constructor(shellFor: (host: string) => PveShell);
+    status(host: string, storage: string): Promise<{
+        type: string;
+        percent: number;
+    }>;
+    mappedBytes(host: string, vmid: number): Promise<{
+        lvSizeBytes: number;
+        mappedPercent: number;
+    }>;
+}
+/**
+ * The shared image store over root SSH to the node (rw on the build node, ro elsewhere). Root-SSH fallback: the
+ * canonical lab-inventory CLI has no image-store verb.
+ */
+export declare class SshImageStore implements ImageStorePort {
+    private readonly shellFor;
+    private readonly readVerifyScript;
+    private readonly user;
+    constructor(shellFor: (host: string) => PveShell, readVerifyScript: () => string, user?: string);
+    private sh;
+    isWritable(host: string): Promise<boolean>;
+    readText(host: string, path: string): Promise<string | null>;
+    writeText(host: string, path: string, content: string): Promise<void>;
+    fetchFile(host: string, path: string, localFile: string): Promise<void>;
+    fileSize(host: string, path: string): Promise<number>;
+    exec(host: string, script: string): Promise<ShellResult>;
+    importing(host: string, template: string): Promise<boolean>;
+    runDetached(host: string, a: {
+        name: string;
+        script: string;
+        doneMarker: string;
+        polls: number;
+        intervalMs: number;
+    }): Promise<DetachedRun>;
+    verify(host: string, template: string, fingerprint: string): Promise<{
+        qcow2Sha256: string;
+        templateJsonSha256: string;
+    }>;
+}
+/** Detached SHA-512 signatures with the evidence key. The key comes from Doppler by name into an ephemeral GNUPGHOME and is never logged. */
+export declare class GpgSigner implements GpgPort {
+    private readonly secrets;
+    private readonly gpgBin;
+    constructor(secrets: SecretStore, gpgBin?: string);
+    private gpg;
+    signDetached(files: string[], fingerprint: string): Promise<{
+        fingerprint: string;
+        publicKey: string;
+    }>;
+}
 export declare function defaultRunDir(): string;
 /** The lab-inventory CLI path when the canonical bridge is configured (CT_LAB_CANONICAL_CLI). */
 export declare function canonicalCli(env?: NodeJS.ProcessEnv): string | undefined;
 export declare function liveDeps(opts?: {
     baseDir?: string;
     log?: (line: string) => void;
-    node?: StigNode;
+    node?: string;
 }): StigDeps;
 //# sourceMappingURL=live.d.ts.map

package/dist/src/stig/live.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"live.d.ts","sourceRoot":"","sources":["../../../src/stig/live.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EACV,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAC9I,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAwB,KAAK,QAAQ,EAAE,MAAM,YAAY,CAAC;AASjE,+EAA+E;AAC/E,wBAAgB,gBAAgB,IAAI,MAAM,CAQzC;AAkBD,qBAAa,WAAY,YAAW,QAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAiE,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAA1F,IAAI,SAA+D,EAAmB,IAAI,SAAS;IAChI,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;CAI1D;AAED,qBAAa,aAAc,YAAW,UAAU;IAC9C,OAAO,CAAC,IAAI,CAAa;IAAC,OAAO,CAAC,OAAO,CAAM;IAAC,OAAO,CAAC,KAAK,CAAM;IAAC,OAAO,CAAC,EAAE,CAAM;IACpF,SAAS,CAAC,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAC/E,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAC3B,OAAO,CAAC,IAAI;IAIZ,OAAO,CAAC,GAAG;IAGL,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC;IAQ3G,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;IAO5F,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAKhE;AAED,qBAAa,cAAe,YAAW,WAAW;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO;IAAkD,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAhF,OAAO,SAAgD,EAAmB,MAAM,SAAsC;IAC7I,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAK9C,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAUtD;AAED,qBAAa,SAAU,YAAW,SAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAY;IAC/B,OAAO,CAAC,IAAI;IAIN,IAAI,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;IAK9B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAI9C,MAAM,CAAC,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC;IAK9I,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAK7C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAM1E,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAKvE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAI/D;AAED,qBAAa,SAAU,YAAW,UAAU;IAC9B,OAAO,CAAC,QAAQ,CAAC,GAAG;IAAU,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAxC,GAAG,EAAE,MAAM,EAAmB,UAAU,qBAA6C;IAC5G,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;IAMhC,KAAK,CAAC,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;CAW1G;AAED,qBAAa,aAAc,YAAW,SAAS;IAC7C,OAAO,CAAC,OAAO;IAIf,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAK7B,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAK3C,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAO9F,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;CAe3E;AAED;;;GAGG;AACH,qBAAa,eAAgB,YAAW,YAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,GAAG;IAAU,OAAO,CAAC,QAAQ,CAAC,IAAI;IAA6E,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAvI,GAAG,EAAE,MAAM,EAAmB,IAAI,GAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,CAAO,EAAmB,OAAO,SAAW;YAEjK,IAAI;IAWZ,KAAK,CAAC,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAiBzO,eAAe,CAAC,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ3G,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAIlE;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,iGAAiG;AACjG,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAGrF;AAED,wBAAgB,QAAQ,CAAC,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,IAAI,CAAC,EAAE,QAAQ,CAAA;CAAO,GAAG,QAAQ,CAajH"}
+{"version":3,"file":"live.d.ts","sourceRoot":"","sources":["../../../src/stig/live.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EACV,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAC3J,QAAQ,EAAE,YAAY,EAAE,WAAW,EACpC,MAAM,YAAY,CAAC;AAYpB,+EAA+E;AAC/E,wBAAgB,gBAAgB,IAAI,MAAM,CAQzC;AAkBD,qBAAa,WAAY,YAAW,QAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAA0C,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAnE,IAAI,SAAwC,EAAmB,IAAI,SAAS;IACzG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;CAI1D;AAED,qBAAa,aAAc,YAAW,UAAU;IAC9C,OAAO,CAAC,IAAI,CAAa;IAAC,OAAO,CAAC,OAAO,CAAM;IAAC,OAAO,CAAC,KAAK,CAAM;IAAC,OAAO,CAAC,EAAE,CAAM;IACpF,SAAS,CAAC,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAC/E,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAC3B,OAAO,CAAC,IAAI;IAIZ,OAAO,CAAC,GAAG;IAGL,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC;IAQ3G,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;IAO5F,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAKhE;AAED,qBAAa,cAAe,YAAW,WAAW;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO;IAAkD,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAhF,OAAO,SAAgD,EAAmB,MAAM,SAAsC;IAC7I,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAK9C,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAUtD;AAED,qBAAa,SAAU,YAAW,SAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAY;IAC/B,OAAO,CAAC,IAAI;IAIN,IAAI,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;IAK9B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAI9C,MAAM,CAAC,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC;IAK/I,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAK7C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAM1E,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAKvE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAI/D;AAED,qBAAa,SAAU,YAAW,UAAU;IAC9B,OAAO,CAAC,QAAQ,CAAC,GAAG;IAAU,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAxC,GAAG,EAAE,MAAM,EAAmB,UAAU,qBAA6C;IAC5G,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;IAMhC,KAAK,CAAC,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;CAW1G;AAED,qBAAa,aAAc,YAAW,SAAS;IAC7C,OAAO,CAAC,OAAO;IAIf,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAK7B,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAK3C,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAO9F,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;CAe3E;AAED;;;GAGG;AACH,qBAAa,eAAgB,YAAW,YAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,GAAG;IAAU,OAAO,CAAC,QAAQ,CAAC,IAAI;IAA6E,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAvI,GAAG,EAAE,MAAM,EAAmB,IAAI,GAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,CAAO,EAAmB,OAAO,SAAW;YAEjK,IAAI;IAWZ,KAAK,CAAC,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAiBzO,eAAe,CAAC,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ3G,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAIlE;AAMD,kGAAkG;AAClG,qBAAa,UAAW,YAAW,WAAW;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,QAAQ;IAC3D,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAMjF,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;CAUvG;AAED;;;GAGG;AACH,qBAAa,aAAc,YAAW,cAAc;IACtC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAA8B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAAgB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAA5G,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,QAAQ,EAAmB,gBAAgB,EAAE,MAAM,MAAM,EAAmB,IAAI,SAAS;IAClJ,OAAO,CAAC,EAAE;IACJ,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAO5D,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAM3D,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAClD,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAO3D,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC;IAoB3I,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,kBAAkB,EAAE,MAAM,CAAA;KAAE,CAAC;CAOhI;AAED,6IAA6I;AAC7I,qBAAa,SAAU,YAAW,OAAO;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAAe,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAA7C,OAAO,EAAE,WAAW,EAAmB,MAAM,SAA+B;IACzG,OAAO,CAAC,GAAG;IAUL,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CA2B9G;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,iGAAiG;AACjG,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAGrF;AAED,wBAAgB,QAAQ,CAAC,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,QAAQ,CAiB/G"}