@calltelemetry/ct-lab-mcp 0.8.97 → 0.8.99

package/dist/src/stig/live.js

@@ -0,0 +1,339 @@
+/**
+ * Live adapters for the STIG runner ports: root SSH to Proxmox (`qm`), SSH to the clone, Doppler CLI, Packer,
+ * the guarded ApplianceClaim tools, and key material. These are the only STIG code that touches the lab.
+ *
+ * Nothing here logs a secret: stdin carries passwords and hashes, argv carries only public values, and Doppler
+ * mutations discard the CLI's output (it prints cleartext).
+ */
+import { execFile, spawn } from "node:child_process";
+import { createWriteStream, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync, chmodSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { pbkdf2Sync, randomBytes } from "node:crypto";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+import { redact } from "./model.js";
+import { handleCreateApplianceClaim, handleDeleteApplianceClaim, handleGetApplianceClaim, handlePauseApplianceClaim, handleRenewApplianceClaim, queryKubernetesApi, } from "../tools/appliance-claim-tools.js";
+import { awaitClaimReconciled } from "../tools/claim-reconcile-gate.js";
+import { runLabKubectl } from "../tools/kubernetes-backend.js";
+const execFileP = promisify(execFile);
+const here = dirname(fileURLToPath(import.meta.url));
+/** assets/stig next to dist/src/stig (published) or next to src/stig (dev). */
+export function defaultAssetsDir() {
+    for (const rel of ["../../../assets/stig", "../../assets/stig"]) {
+        const p = resolve(here, rel);
+        if (existsSync(join(p, "SHA256SUMS")))
+            return p;
+    }
+    throw new Error("STIG recipe assets (assets/stig) not found");
+}
+const shq = (s) => `'${s.replace(/'/g, `'\\''`)}'`;
+function run(file, args, opts = {}) {
+    return new Promise((resolveP) => {
+        const child = spawn(file, args, { env: opts.env ?? process.env, stdio: ["pipe", "pipe", "pipe"] });
+        let stdout = "";
+        let stderr = "";
+        let settled = false;
+        const finish = (code) => { if (!settled) {
+            settled = true;
+            clearTimeout(timer);
+            resolveP({ code, stdout, stderr });
+        } };
+        const timer = setTimeout(() => { child.kill("SIGKILL"); finish(124); }, opts.timeoutMs ?? 120_000);
+        child.stdout.on("data", (d) => { stdout += d; });
+        child.stderr.on("data", (d) => { stderr += d; });
+        child.on("error", (e) => { stderr += String(e.message); finish(127); });
+        child.on("close", (code) => finish(code ?? 1));
+        if (opts.stdin !== undefined)
+            child.stdin.end(opts.stdin);
+        else
+            child.stdin.end();
+    });
+}
+export class SshPveShell {
+    host;
+    user;
+    constructor(host = process.env.CT_LAB_STIG_PVE_HOST ?? "192.168.123.178", user = "root") {
+        this.host = host;
+        this.user = user;
+    }
+    run(script, opts) {
+        // The script is one quoted argument so stdin stays free for data (a password hash).
+        return run("ssh", ["-o", "BatchMode=yes", "-o", "ConnectTimeout=10", `${this.user}@${this.host}`, `bash -c ${shq(script)}`], opts);
+    }
+}
+export class SshGuestShell {
+    user = "ctadmin";
+    keyFile = "";
+    known = "";
+    ip = "";
+    configure(cfg) { this.user = cfg.user; this.keyFile = cfg.keyFile; this.known = cfg.knownHostsFile; }
+    setTarget(ip) { this.ip = ip; }
+    opts(hostKey) {
+        return ["-i", this.keyFile, "-o", "BatchMode=yes", "-o", "IdentitiesOnly=yes", "-o", "PasswordAuthentication=no",
+            "-o", `UserKnownHostsFile=${this.known}`, "-o", "ConnectTimeout=10", "-o", "LogLevel=ERROR", "-o", `StrictHostKeyChecking=${hostKey}`];
+    }
+    ssh(command, o, hostKey = "yes") {
+        return run("ssh", [...this.opts(hostKey), `${this.user}@${this.ip}`, command], o);
+    }
+    async runScript(script, o) {
+        if (!o?.sudo)
+            return this.ssh("bash -s", { stdin: script, timeoutMs: o?.timeoutMs });
+        // Upload the script, then run it under sudo with the password (plus any extra data) on stdin.
+        const path = `/var/tmp/ct-stig-${randomBytes(6).toString("hex")}.sh`;
+        const up = await this.ssh(`umask 077; cat > ${path}`, { stdin: script });
+        if (up.code !== 0)
+            return up;
+        return this.ssh(`sudo -S -p '' bash -c ${shq(`bash ${path}; rc=$?; rm -f ${path}; exit $rc`)}`, { stdin: o.stdin ?? "", timeoutMs: o.timeoutMs });
+    }
+    async waitSsh(hostKey, tries, intervalMs = 10_000) {
+        for (let n = 0; n < tries; n++) {
+            if ((await this.ssh("true", { timeoutMs: 20_000 }, hostKey)).code === 0)
+                return true;
+            await new Promise((r) => setTimeout(r, intervalMs));
+        }
+        return false;
+    }
+    async fileExists(path) { return (await this.ssh(`test -f ${shq(path)}`)).code === 0; }
+    async fetchDir(remote, localDir) {
+        mkdirSync(localDir, { recursive: true });
+        const r = await run("scp", ["-q", "-r", ...this.opts("yes"), `${this.user}@${this.ip}:${remote}/.`, localDir], { timeoutMs: 300_000 });
+        if (r.code !== 0)
+            throw new Error(`scp failed: ${redact(r.stderr).slice(0, 200)}`);
+    }
+}
+export class DopplerSecrets {
+    project;
+    config;
+    constructor(project = process.env.DOPPLER_PROJECT ?? "ai-workspace", config = process.env.DOPPLER_CONFIG ?? "dev") {
+        this.project = project;
+        this.config = config;
+    }
+    async get(name) {
+        if (!/^[A-Z][A-Z0-9_]{2,127}$/.test(name))
+            throw new Error("invalid secret name");
+        const r = await run("doppler", ["secrets", "get", name, "--project", this.project, "--config", this.config, "--plain"]);
+        return r.code === 0 && r.stdout.length > 0 ? r.stdout.replace(/\n$/, "") : undefined;
+    }
+    async set(name, value) {
+        if (!/^[A-Z][A-Z0-9_]{2,127}$/.test(name))
+            throw new Error("invalid secret name");
+        // Value on stdin (not argv); the CLI echoes cleartext, so its output is discarded unread.
+        await new Promise((resolveP, reject) => {
+            const child = spawn("doppler", ["secrets", "set", name, "--project", this.project, "--config", this.config], { stdio: ["pipe", "ignore", "ignore"] });
+            child.on("error", reject);
+            child.on("close", (code) => (code === 0 ? resolveP() : reject(new Error(`doppler secrets set ${name} failed`))));
+            child.stdin.end(value);
+        });
+    }
+}
+export class LabClaims {
+    ns = "ct-lab";
+    text(result) {
+        const block = result?.content?.[0];
+        return block?.type === "text" ? JSON.parse(block.text) : null;
+    }
+    async list() {
+        const api = await queryKubernetesApi(`/apis/calltelemetry.com/v1alpha1/namespaces/${this.ns}/applianceclaims`);
+        if (api?.items)
+            return api.items;
+        return JSON.parse((await runLabKubectl(["get", "applianceclaims", "-n", this.ns, "-o", "json"])).stdout).items ?? [];
+    }
+    async get(name) {
+        const r = await handleGetApplianceClaim({ name, namespace: this.ns });
+        return r.isError ? null : (this.text(r)?.claim ?? null);
+    }
+    async create(a) {
+        const r = await handleCreateApplianceClaim({ name: a.name, vmid: a.vmid, vmName: a.vmName, node: "minis", profile: "bare", ttlHours: a.ttlHours, stig: a.stig });
+        if (r.isError)
+            throw new Error(`claim creation failed: ${r.content?.[0]?.text ?? "unknown"}`);
+        return this.text(r).claim;
+    }
+    async waitReady(name) {
+        const out = await awaitClaimReconciled(name, this.ns);
+        if (!out.reconciled)
+            throw new Error(`claim ${name} did not reach Ready (${out.detail}); no guest was touched`);
+        return (await this.get(name));
+    }
+    async annotate(name, annotations) {
+        const body = { metadata: { annotations } };
+        const path = `/apis/calltelemetry.com/v1alpha1/namespaces/${this.ns}/applianceclaims/${name}`;
+        const patched = await queryKubernetesApi(path, { method: "PATCH", body });
+        if (!patched)
+            await runLabKubectl(["patch", "applianceclaim", name, "-n", this.ns, "--type=merge", "-p", JSON.stringify(body)]);
+    }
+    async renew(name, extendHours) {
+        const r = await handleRenewApplianceClaim({ name, namespace: this.ns, extendHours, dryRun: false });
+        if (r.isError)
+            throw new Error(`claim renew failed: ${r.content?.[0]?.text ?? "unknown"}`);
+        return { ttlHours: this.text(r).ttlHours };
+    }
+    async pause(name, paused, reason) {
+        const r = await handlePauseApplianceClaim({ name, namespace: this.ns, paused, pausedReason: reason });
+        if (r.isError)
+            throw new Error(`claim pause failed: ${r.content?.[0]?.text ?? "unknown"}`);
+    }
+    async delete(name, expectedUid) {
+        const r = await handleDeleteApplianceClaim({ name, namespace: this.ns, expectedUid });
+        if (r.isError)
+            throw new Error(`claim delete failed: ${r.content?.[0]?.text ?? "unknown"}`);
+    }
+}
+export class PackerCli {
+    cwd;
+    pluginPath;
+    constructor(cwd, pluginPath = process.env.CT_LAB_STIG_PACKER_PLUGIN_PATH) {
+        this.cwd = cwd;
+        this.pluginPath = pluginPath;
+    }
+    async version() {
+        const r = await run("packer", ["version"], { timeoutMs: 20_000 });
+        const m = /Packer v(\d+\.\d+\.\d+)/.exec(r.stdout);
+        if (!m)
+            throw new Error("packer is not installed or its version is unreadable");
+        return m[1];
+    }
+    build(a) {
+        const args = ["build", "-on-error=abort", ...Object.entries(a.vars).flatMap(([k, v]) => ["-var", `${k}=${v}`]), "template.pkr.hcl"];
+        const env = { ...process.env, ...a.env, ...(this.pluginPath ? { PACKER_PLUGIN_PATH: this.pluginPath } : {}), PACKER_NO_COLOR: "1" };
+        return new Promise((resolveP) => {
+            const log = createWriteStream(a.logFile, { flags: "a", mode: 0o600 });
+            const child = spawn("packer", args, { cwd: this.cwd, env, stdio: ["ignore", "pipe", "pipe"] });
+            child.stdout.pipe(log, { end: false });
+            child.stderr.pipe(log, { end: false });
+            child.on("error", () => { log.end(); resolveP(127); });
+            child.on("close", (code) => { log.end(); resolveP(code ?? 1); });
+        });
+    }
+}
+export class NodeMaterials {
+    openssl() {
+        if (process.env.OPENSSL_BIN)
+            return process.env.OPENSSL_BIN;
+        return existsSync("/opt/homebrew/opt/openssl@3/bin/openssl") ? "/opt/homebrew/opt/openssl@3/bin/openssl" : "openssl";
+    }
+    randomAlnum(length) {
+        let out = "";
+        while (out.length < length)
+            out += randomBytes(48).toString("base64").replace(/[^A-Za-z0-9]/g, "");
+        return out.slice(0, length);
+    }
+    async sha512Crypt(plain) {
+        const r = await run(this.openssl(), ["passwd", "-6", "-stdin"], { stdin: plain });
+        if (r.code !== 0 || !r.stdout.startsWith("$6$"))
+            throw new Error("OpenSSL 3 sha512-crypt failed");
+        return r.stdout.trim();
+    }
+    async sshKeypair(dir, label) {
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        const file = join(dir, "id_key");
+        for (const f of [file, `${file}.pub`])
+            if (existsSync(f))
+                (await execFileP("rm", ["-f", f]));
+        await execFileP("ssh-keygen", ["-q", "-t", "ecdsa", "-b", "256", "-N", "", "-C", label, "-f", file]); // ed25519 is rejected in FIPS mode
+        return { privateKeyFile: file, publicKey: readFileSync(`${file}.pub`, "utf8").trim() };
+    }
+    async buildMaterial(runDir, label) {
+        const key = await this.sshKeypair(runDir, `ctbuild-${label}`);
+        const stripped = (n) => randomBytes(n).toString("base64").replace(/[\n/+=]/g, "");
+        const buildPassword = stripped(30);
+        const grubPassword = stripped(30);
+        const luksBootstrap = stripped(40);
+        for (const [f, v] of [["build_password", buildPassword], ["grub_password", grubPassword], ["luks_bootstrap", luksBootstrap]]) {
+            writeFileSync(join(runDir, f), v, { mode: 0o600 });
+            chmodSync(join(runDir, f), 0o600);
+        }
+        const salt = randomBytes(64);
+        const dk = pbkdf2Sync(Buffer.from(grubPassword), salt, 10000, 64, "sha512");
+        return {
+            sshPrivateKeyFile: key.privateKeyFile, sshPublicKey: key.publicKey, buildPassword, luksBootstrap,
+            buildPasswordHash: await this.sha512Crypt(buildPassword),
+            grubPbkdf2: `grub.pbkdf2.sha512.10000.${salt.toString("hex").toUpperCase()}.${dk.toString("hex").toUpperCase()}`,
+        };
+    }
+}
+/**
+ * Canonical provider: the `lab-inventory stig` verbs (plan, then apply with the plan digest). Secrets travel in 0600
+ * files inside a private temp directory that is removed afterwards; argv carries only public values.
+ */
+export class CliStigProvider {
+    cli;
+    exec;
+    tmpRoot;
+    constructor(cli, exec = run, tmpRoot = tmpdir()) {
+        this.cli = cli;
+        this.exec = exec;
+        this.tmpRoot = tmpRoot;
+    }
+    async call(args, timeoutMs = 120_000) {
+        const r = await this.exec(this.cli, args, { timeoutMs });
+        let json = null;
+        try {
+            json = JSON.parse(r.stdout);
+        }
+        catch { /* not JSON */ }
+        if (r.code !== 0) {
+            const why = json?.blocking_reasons?.length ? json.blocking_reasons.join(", ") : redact(r.stderr || r.stdout).slice(0, 300);
+            throw new Error(`lab-inventory ${args.slice(0, 2).join(" ")} refused or failed: ${why}`);
+        }
+        return json;
+    }
+    async clone(a) {
+        const dir = mkdtempSync(join(this.tmpRoot, "stig-cli-"));
+        chmodSync(dir, 0o700);
+        try {
+            const keyFile = join(dir, "key.pub");
+            const hashFile = join(dir, "hash");
+            writeFileSync(keyFile, a.sshPublicKey, { mode: 0o600 });
+            writeFileSync(hashFile, a.passwordHash, { mode: 0o600 });
+            const base = ["stig", "clone", "--operation-id", a.operationId, "--name", a.name, "--template-name", a.templateName,
+                "--ssh-key-file", keyFile, "--password-hash-file", hashFile, "--vmid", String(a.vmid),
+                ...a.dns.flatMap((d) => ["--dns", d]), ...a.claimedVmids.flatMap((v) => ["--claimed-vmid", String(v)])];
+            const plan = await this.call(base);
+            if (!plan?.eligible || !plan.plan_digest)
+                throw new Error(`lab-inventory stig clone plan is not eligible: ${(plan?.blocking_reasons ?? []).join(", ")}`);
+            const receipt = await this.call([...base, "--apply", "--confirm-name", a.name, "--plan-digest", plan.plan_digest], 1_800_000);
+            if (receipt?.status !== "completed" || receipt.vmid !== a.vmid)
+                throw new Error("lab-inventory stig clone did not report the planned VMID as completed");
+            return { vmid: receipt.vmid };
+        }
+        finally {
+            rmSync(dir, { recursive: true, force: true });
+        }
+    }
+    async destroyTemplate(a) {
+        const base = ["stig", "destroy-template", "--operation-id", a.operationId, "--name", a.name, "--vmid", String(a.vmid)];
+        const plan = await this.call(base);
+        if (!plan?.eligible || !plan.plan_digest)
+            throw new Error(`lab-inventory stig destroy-template plan is not eligible: ${(plan?.blocking_reasons ?? []).join(", ")}`);
+        const receipt = await this.call([...base, "--apply", "--confirm-name", a.name, "--plan-digest", plan.plan_digest], 600_000);
+        if (receipt?.status !== "completed")
+            throw new Error("lab-inventory stig destroy-template did not complete");
+    }
+    async guestIp(vmid) {
+        const out = await this.call(["stig", "guest-ip", "--vmid", String(vmid), "--timeout", "20"], 60_000);
+        return typeof out?.ipv4 === "string" ? out.ipv4 : "";
+    }
+}
+export function defaultRunDir() {
+    return process.env.CT_LAB_STIG_RUN_DIR ?? join(process.env.HOME ?? ".", ".ct-lab-stig");
+}
+/** The lab-inventory CLI path when the canonical bridge is configured (CT_LAB_CANONICAL_CLI). */
+export function canonicalCli(env = process.env) {
+    const p = env.CT_LAB_CANONICAL_CLI?.trim();
+    return p && existsSync(p) ? p : undefined;
+}
+export function liveDeps(opts = {}) {
+    const assetsDir = defaultAssetsDir();
+    const baseDir = opts.baseDir ?? defaultRunDir();
+    mkdirSync(baseDir, { recursive: true, mode: 0o700 });
+    return {
+        provider: canonicalCli() ? new CliStigProvider(canonicalCli()) : undefined,
+        pve: new SshPveShell(), guest: new SshGuestShell(), secrets: new DopplerSecrets(), claims: new LabClaims(),
+        packer: new PackerCli(assetsDir), materials: new NodeMaterials(),
+        clock: { now: () => Date.now(), sleep: (ms) => new Promise((r) => setTimeout(r, ms)) },
+        log: { info: (line) => (opts.log ?? ((l) => process.stderr.write(`[stig] ${l}\n`)))(line) },
+        baseDir, assetsDir, readAsset: (rel) => readFileSync(join(assetsDir, rel), "utf8"),
+    };
+}
+//# sourceMappingURL=live.js.map

package/dist/src/stig/live.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"live.js","sourceRoot":"","sources":["../../../src/stig/live.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAChI,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAItC,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACpC,OAAO,EACL,0BAA0B,EAAE,0BAA0B,EAAE,uBAAuB,EAAE,yBAAyB,EAC1G,yBAAyB,EAAE,kBAAkB,GAC9C,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAE/D,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AACtC,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACrD,+EAA+E;AAC/E,MAAM,UAAU,gBAAgB;IAC9B,KAAK,MAAM,GAAG,IAAI,CAAC,sBAAsB,EAAE,mBAAmB,CAAC,EAAE,CAAC;QAChE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC7B,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAEnE,SAAS,GAAG,CAAC,IAAY,EAAE,IAAc,EAAE,OAA8C,EAAE;IACzF,OAAO,IAAI,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;QAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACnG,IAAI,MAAM,GAAG,EAAE,CAAC;QAAC,IAAI,MAAM,GAAG,EAAE,CAAC;QAAC,IAAI,OAAO,GAAG,KAAK,CAAC;QACtD,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;YAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC;QAChI,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC;QACnG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/C,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;;YAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IACpF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,OAAO,WAAW;IACO;IAA+E;IAA5G,YAA6B,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,iBAAiB,EAAmB,OAAO,MAAM;QAA5F,SAAI,GAAJ,IAAI,CAAwD;QAAmB,SAAI,GAAJ,IAAI,CAAS;IAAG,CAAC;IAC7H,GAAG,CAAC,MAAc,EAAE,IAAc;QAChC,oFAAoF;QACpF,OAAO,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,WAAW,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IACrI,CAAC;CACF;AAED,MAAM,OAAO,aAAa;IAChB,IAAI,GAAG,SAAS,CAAC;IAAS,OAAO,GAAG,EAAE,CAAC;IAAS,KAAK,GAAG,EAAE,CAAC;IAAS,EAAE,GAAG,EAAE,CAAC;IACpF,SAAS,CAAC,GAA8D,IAAU,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;IACtK,SAAS,CAAC,EAAU,IAAU,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACrC,IAAI,CAAC,OAAe;QAC1B,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,2BAA2B;YAC9G,IAAI,EAAE,sBAAsB,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,yBAAyB,OAAO,EAAE,CAAC,CAAC;IAC3I,CAAC;IACO,GAAG,CAAC,OAAe,EAAE,CAAW,EAAE,OAAO,GAAG,KAAK;QACvD,OAAO,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IACpF,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,CAA0D;QACxF,IAAI,CAAC,CAAC,EAAE,IAAI;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QACrF,8FAA8F;QAC9F,MAAM,IAAI,GAAG,oBAAoB,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC;QACrE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACzE,IAAI,EAAE,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC,GAAG,CAAC,yBAAyB,GAAG,CAAC,QAAQ,IAAI,kBAAkB,IAAI,YAAY,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IACpJ,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,OAA6B,EAAE,KAAa,EAAE,UAAU,GAAG,MAAM;QAC7E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrF,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,IAAY,IAAsB,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;IAChH,KAAK,CAAC,QAAQ,CAAC,MAAc,EAAE,QAAgB;QAC7C,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,IAAI,MAAM,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QACvI,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;CACF;AAED,MAAM,OAAO,cAAc;IACI;IAA0E;IAAvG,YAA6B,UAAU,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,cAAc,EAAmB,SAAS,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,KAAK;QAAtH,YAAO,GAAP,OAAO,CAAgD;QAAmB,WAAM,GAAN,MAAM,CAAsC;IAAG,CAAC;IACvJ,KAAK,CAAC,GAAG,CAAC,IAAY;QACpB,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAClF,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;QACxH,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvF,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,IAAY,EAAE,KAAa;QACnC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAClF,0FAA0F;QAC1F,MAAM,IAAI,OAAO,CAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;YAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;YACtJ,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,uBAAuB,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YACjH,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,OAAO,SAAS;IACH,EAAE,GAAG,QAAQ,CAAC;IACvB,IAAI,CAAC,MAAW;QACtB,MAAM,KAAK,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QACnC,OAAO,KAAK,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,CAAC;IACD,KAAK,CAAC,IAAI;QACR,MAAM,GAAG,GAAQ,MAAM,kBAAkB,CAAC,+CAA+C,IAAI,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACpH,IAAI,GAAG,EAAE,KAAK;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC;QACjC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,aAAa,CAAC,CAAC,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;IACvH,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,IAAY;QACpB,MAAM,CAAC,GAAG,MAAM,uBAAuB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACtE,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC;IAC1D,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,CAAkG;QAC7G,MAAM,CAAC,GAAG,MAAM,0BAA0B,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACjK,IAAI,CAAC,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA2B,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAS,EAAE,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC;QACvG,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5B,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,IAAY;QAC1B,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,GAAG,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,yBAAyB,GAAG,CAAC,MAAM,yBAAyB,CAAC,CAAC;QAChH,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAE,CAAC;IACjC,CAAC;IACD,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,WAAmC;QAC9D,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,+CAA+C,IAAI,CAAC,EAAE,oBAAoB,IAAI,EAAE,CAAC;QAC9F,MAAM,OAAO,GAAQ,MAAM,kBAAkB,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC,OAAO;YAAE,MAAM,aAAa,CAAC,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClI,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,IAAY,EAAE,WAAmB;QAC3C,MAAM,CAAC,GAAG,MAAM,yBAAyB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACpG,IAAI,CAAC,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAwB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAS,EAAE,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC;QACpG,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC7C,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,IAAY,EAAE,MAAe,EAAE,MAAe;QACxD,MAAM,CAAC,GAAG,MAAM,yBAAyB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;QACtG,IAAI,CAAC,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAwB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAS,EAAE,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,WAAmB;QAC5C,MAAM,CAAC,GAAG,MAAM,0BAA0B,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;QACtF,IAAI,CAAC,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAyB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAS,EAAE,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC;IACvG,CAAC;CACF;AAED,MAAM,OAAO,SAAS;IACS;IAA8B;IAA3D,YAA6B,GAAW,EAAmB,aAAa,OAAO,CAAC,GAAG,CAAC,8BAA8B;QAArF,QAAG,GAAH,GAAG,CAAQ;QAAmB,eAAU,GAAV,UAAU,CAA6C;IAAG,CAAC;IACtH,KAAK,CAAC,OAAO;QACX,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAClE,MAAM,CAAC,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAChF,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,KAAK,CAAC,CAAiF;QACrF,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACpI,MAAM,GAAG,GAAsB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC;QACvJ,OAAO,IAAI,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;YAC9B,MAAM,GAAG,GAAG,iBAAiB,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACtE,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YAC/F,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;YAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/E,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,OAAO,aAAa;IAChB,OAAO;QACb,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;QAC5D,OAAO,UAAU,CAAC,yCAAyC,CAAC,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvH,CAAC;IACD,WAAW,CAAC,MAAc;QACxB,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,OAAO,GAAG,CAAC,MAAM,GAAG,MAAM;YAAE,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QACnG,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9B,CAAC;IACD,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAClG,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,GAAW,EAAE,KAAa;QACzC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACjC,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,MAAM,CAAC;YAAE,IAAI,UAAU,CAAC,CAAC,CAAC;gBAAE,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7F,MAAM,SAAS,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,mCAAmC;QACzI,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,CAAC,GAAG,IAAI,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACzF,CAAC;IACD,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,KAAa;QAC/C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,WAAW,KAAK,EAAE,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC1F,MAAM,aAAa,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;QAAC,MAAM,YAAY,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;QAAC,MAAM,aAAa,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC1G,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,aAAa,CAAC,EAAE,CAAC,eAAe,EAAE,YAAY,CAAC,EAAE,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAU,EAAE,CAAC;YACtI,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC7B,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC5E,OAAO;YACL,iBAAiB,EAAE,GAAG,CAAC,cAAc,EAAE,YAAY,EAAE,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,aAAa;YAChG,iBAAiB,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC;YACxD,UAAU,EAAE,4BAA4B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE;SACjH,CAAC;IACJ,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,eAAe;IACG;IAA8B;IAAkG;IAA7J,YAA6B,GAAW,EAAmB,OAA4E,GAAG,EAAmB,UAAU,MAAM,EAAE;QAAlJ,QAAG,GAAH,GAAG,CAAQ;QAAmB,SAAI,GAAJ,IAAI,CAA2E;QAAmB,YAAO,GAAP,OAAO,CAAW;IAAG,CAAC;IAE3K,KAAK,CAAC,IAAI,CAAC,IAAc,EAAE,SAAS,GAAG,OAAO;QACpD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QACzD,IAAI,IAAI,GAAQ,IAAI,CAAC;QACrB,IAAI,CAAC;YAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;QAC7D,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACjB,MAAM,GAAG,GAAG,IAAI,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC3H,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,CAA+J;QACzK,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;QACzD,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAAC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACzE,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAAC,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAClH,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC,YAAY;gBACjH,gBAAgB,EAAE,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;gBACrF,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1G,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW;gBAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,IAAI,EAAE,gBAAgB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACzJ,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC,CAAC;YAC9H,IAAI,OAAO,EAAE,MAAM,KAAK,WAAW,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;YACzJ,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;QAChC,CAAC;gBAAS,CAAC;YAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,CAAsD;QAC1E,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACvH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,IAAI,EAAE,gBAAgB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpK,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,CAAC;QAC5H,IAAI,OAAO,EAAE,MAAM,KAAK,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC/G,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAY;QACxB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QACrG,OAAO,OAAO,GAAG,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,CAAC;CACF;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,EAAE,cAAc,CAAC,CAAC;AAC1F,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,YAAY,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC/D,MAAM,CAAC,GAAG,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC;IAC3C,OAAO,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,OAA2D,EAAE;IACpF,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,aAAa,EAAE,CAAC;IAChD,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,OAAO;QACL,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,YAAY,EAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QAC3E,GAAG,EAAE,IAAI,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,aAAa,EAAE,EAAE,OAAO,EAAE,IAAI,cAAc,EAAE,EAAE,MAAM,EAAE,IAAI,SAAS,EAAE;QAC1G,MAAM,EAAE,IAAI,SAAS,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,IAAI,aAAa,EAAE;QAChE,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE;QACtF,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE;QAC3F,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC;KACnF,CAAC;AACJ,CAAC"}

package/dist/src/stig/model.d.ts

@@ -0,0 +1,160 @@
+/**
+ * RHEL 8.10 STIG model: descriptor, receipt summary, guards and state machine (pure, no I/O).
+ *
+ * Mirror of ct-appliance-operator `src/stig.mjs` (docs/design/stig-claims.md). Both are tested against the same
+ * fixtures; keep them in step. The executor (Packer, qm, oscap) lives in ./runner.ts.
+ */
+import { isDeepStrictEqual } from "node:util";
+export declare const STIG_ANNOTATION = "calltelemetry.com/stig";
+export declare const STIG_RECEIPT_ANNOTATION = "calltelemetry.com/stig-receipt";
+export declare const STIG_STEP_ANNOTATION = "calltelemetry.com/stig-step";
+export declare const STIG_DESCRIPTOR_SCHEMA = "calltelemetry-stig-claim/v1";
+export declare const STIG_RECEIPT_SCHEMA = "calltelemetry-stig-receipt-summary/v1";
+export declare const STIG_ANNOTATION_MAX_BYTES = 2048;
+export declare const STIG_TTL_CAP_HOURS = 8760;
+export declare const STIG_POOL_LIMIT_PERCENT = 70;
+export declare const STIG_TEMPLATE_PREFIX = "rhel810-stig-";
+export declare const STIG_MODES: readonly ["build-template", "clone", "validate"];
+export type StigMode = (typeof STIG_MODES)[number];
+export declare const STIG_DATASTREAM_SHA256 = "82592d3cff74a82ce652a65ba67cd755cf57550269798d4c449c2069417c1028";
+export declare const STIG_TAILORING_SHA256 = "43560c40096a28b180685fe1383344a6d454a3a18666f2ead4a1ddd3d72ed7fd";
+export declare const STIG_PROFILE_ID = "xccdf_com.calltelemetry_profile_stig_ct";
+export declare const STIG_DVD_ISO = "synology-cisco-isos:iso/rhel-8.10-x86_64-dvd.iso";
+export declare const STIG_PINS: Readonly<{
+    ssg: "0.1.82";
+    stig: "V2R8";
+    packer: "1.16.0";
+    packerProxmoxPlugin: "1.2.4";
+}>;
+export declare const STIG_STEPS: Readonly<Record<StigMode, readonly string[]>>;
+/** Steps during which a clone's disk is being fully re-allocated; only one clone may be here at a time. */
+export declare const STIG_REENCRYPT_STEPS: readonly string[];
+export declare const COUNT_KEYS: readonly ["pass", "fail", "notapplicable", "notchecked", "informational", "error"];
+export type StigCounts = Record<(typeof COUNT_KEYS)[number], number>;
+export interface StigDescriptor {
+    schema: typeof STIG_DESCRIPTOR_SCHEMA;
+    mode: StigMode;
+    profile: "rhel8-stig";
+    template?: {
+        ref: string;
+        vmid: number;
+    };
+    tailoring: {
+        ref: string;
+        sha256?: string;
+    };
+    site: {
+        dns: string[];
+        ntp: string[];
+        adminKeyRef: string;
+    };
+    pins: {
+        ssg: string;
+        stig: string;
+        packer: string;
+        packerProxmoxPlugin: string;
+    };
+}
+export declare const DISA_COUNT_KEYS: readonly ["pass", "fail", "notapplicable", "notchecked", "informational", "error", "unknown"];
+export type DisaCounts = Record<(typeof DISA_COUNT_KEYS)[number], number>;
+export declare const DISA_PROFILE_ID = "xccdf_mil.disa.stig_profile_MAC-1_Classified";
+export declare const DISA_BENCHMARK_FILE = "U_RHEL_8_V2R8_STIG_SCAP_1-3_Benchmark.xml";
+/** DISA's official V2R8 SCAP benchmark result (v3 templates scan with both SSG and DISA). */
+export interface DisaScan {
+    profile: string;
+    benchmarkSha256: string;
+    counts: DisaCounts;
+}
+export interface StigReceiptSummary {
+    schema: typeof STIG_RECEIPT_SCHEMA;
+    mode: StigMode;
+    template: string;
+    counts: StigCounts;
+    gate: {
+        failZero: boolean;
+        disaFailZero?: boolean;
+    };
+    disa?: DisaScan;
+    versions: Record<string, string>;
+    sha256: Record<string, string>;
+    keyDigest?: string;
+    validatedAt: string;
+}
+type Json = Record<string, any>;
+/** Throws when a value carries secret material by value. Names of secrets (e.g. `doppler:KEY`) are fine. */
+export declare function assertNoSecrets(value: unknown, path?: string): void;
+/** Masks anything secret-looking in a log line. Applied to every line the runner emits. */
+export declare function redact(text: string): string;
+export declare function validateStigDescriptor(d: unknown): {
+    ok: boolean;
+    errors: string[];
+    value: StigDescriptor | null;
+};
+export declare function stigDescriptor(claim: any): Json | null;
+/** The default descriptor for a mode, from the verified pins and site values. */
+export declare function defaultDescriptor(mode: StigMode, opts: {
+    template?: {
+        ref: string;
+        vmid: number;
+    };
+    tailoringSha256?: string;
+    dns?: string[];
+    ntp?: string[];
+    adminKeyRef: string;
+}): StigDescriptor;
+export declare function parseKv(text: string): Record<string, string>;
+export declare function countArfResults(xml: string): StigCounts;
+/** Same counting as the shell recipe: `grep -c "^Result.*<kind>$"` over `oscap xccdf eval` stdout. */
+export declare function parseOscapStdoutCounts(text: string): StigCounts;
+export declare function countsFromKv(kv: Record<string, string>): StigCounts;
+/** fail=0 gate. With a DISA scan present, BOTH scans must be fail=0 (and error=0); an empty scan never passes. */
+export declare function receiptGate(counts: Partial<StigCounts> | undefined, disa?: Partial<DisaCounts>): {
+    failZero: boolean;
+    disaFailZero?: boolean;
+};
+export declare function disaCountsFromKv(kv: Record<string, string>, prefix?: string): DisaCounts;
+export declare function buildReceiptSummary(receipt: Json, opts?: {
+    mode?: StigMode;
+    validatedAt?: string;
+    keyDigest?: string;
+    arfSha256?: string;
+    reportSha256?: string;
+    openscap?: string;
+    disa?: DisaScan;
+}): StigReceiptSummary;
+export declare function validateReceiptSummary(s: unknown): StigReceiptSummary | null;
+/** Same projection the operator performs (CT_OPERATOR_STIG=1), so a tool can show what status.stig will carry. */
+export declare function stigStatusPreview(claim: any, now?: string): {
+    stig: StigReceiptSummary;
+    conditions?: Json[];
+} | null;
+export { isDeepStrictEqual };
+export declare function capTtl(hours: number): number;
+export type RenewalPlan = {
+    ok: true;
+    elapsedHours: number;
+    extendHours: number;
+    previousTtlHours: number;
+    newTtlHours: number;
+} | {
+    ok: false;
+    error: string;
+    elapsedHours: number;
+};
+export declare function planTemplateRenewal(claim: any, now?: number, marginHours?: number): RenewalPlan;
+export declare function assertPoolBelow(percent: unknown, limit?: number): void;
+export declare function assertSingleReencrypt(claims: any[], selfName: string): void;
+export declare function assertTemplateReleaseAllowed(input: {
+    guest: {
+        vmid: number;
+        name: string;
+        template?: number | boolean;
+    };
+    claim: any;
+    destroyConfirmed: boolean;
+}): {
+    ok: true;
+    sequence: string[];
+};
+export declare function nextStigStep(mode: string, current: string): string | null;
+//# sourceMappingURL=model.d.ts.map

package/dist/src/stig/model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../../src/stig/model.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,eAAO,MAAM,eAAe,2BAA2B,CAAC;AACxD,eAAO,MAAM,uBAAuB,mCAAmC,CAAC;AACxE,eAAO,MAAM,oBAAoB,gCAAgC,CAAC;AAClE,eAAO,MAAM,sBAAsB,gCAAgC,CAAC;AACpE,eAAO,MAAM,mBAAmB,0CAA0C,CAAC;AAC3E,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAC9C,eAAO,MAAM,kBAAkB,OAAO,CAAC;AACvC,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAC1C,eAAO,MAAM,oBAAoB,kBAAkB,CAAC;AACpD,eAAO,MAAM,UAAU,kDAAmD,CAAC;AAC3E,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AACnD,eAAO,MAAM,sBAAsB,qEAAqE,CAAC;AACzG,eAAO,MAAM,qBAAqB,qEAAqE,CAAC;AACxG,eAAO,MAAM,eAAe,4CAA4C,CAAC;AACzE,eAAO,MAAM,YAAY,qDAAqD,CAAC;AAC/E,eAAO,MAAM,SAAS;;;;;EAAiG,CAAC;AAExH,eAAO,MAAM,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC,CAInE,CAAC;AACH,2GAA2G;AAC3G,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAA0B,CAAC;AAE7E,eAAO,MAAM,UAAU,oFAAqF,CAAC;AAC7G,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;AAErE,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,OAAO,sBAAsB,CAAC;IACtC,IAAI,EAAE,QAAQ,CAAC;IACf,OAAO,EAAE,YAAY,CAAC;IACtB,QAAQ,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,SAAS,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5D,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE,CAAC;CAClF;AAED,eAAO,MAAM,eAAe,+FAAsC,CAAC;AACnE,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;AAC1E,eAAO,MAAM,eAAe,iDAAiD,CAAC;AAC9E,eAAO,MAAM,mBAAmB,8CAA8C,CAAC;AAE/E,6FAA6F;AAC7F,MAAM,WAAW,QAAQ;IAAG,OAAO,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE;AAE1F,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,OAAO,mBAAmB,CAAC;IACnC,IAAI,EAAE,QAAQ,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,UAAU,CAAC;IACnB,IAAI,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACpD,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAQD,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAahC,4GAA4G;AAC5G,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,SAAM,GAAG,IAAI,CAchE;AAED,2FAA2F;AAC3F,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAM3C;AAQD,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,OAAO,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAAA;CAAE,CA+ClH;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,CAOtD;AAED,iFAAiF;AACjF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;IAAE,QAAQ,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,cAAc,CAWnM;AAID,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQ5D;AAID,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAMvD;AAED,sGAAsG;AACtG,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAO/D;AAED,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,UAAU,CAInE;AAQD,kHAAkH;AAClH,wBAAgB,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG,SAAS,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,CAK9I;AAED,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,SAAY,GAAG,UAAU,CAI3F;AAED,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,IAAI,EACb,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,QAAQ,CAAA;CAAO,GACtJ,kBAAkB,CAqBpB;AAMD,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,OAAO,GAAG,kBAAkB,GAAG,IAAI,CAiB5E;AAED,kHAAkH;AAClH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,SAA2B,GAAG;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,UAAU,CAAC,EAAE,IAAI,EAAE,CAAA;CAAE,GAAG,IAAI,CAUtI;AACD,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAI7B,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAK5C;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACtG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,SAAa,EAAE,WAAW,SAAI,GAAG,WAAW,CAO9F;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,SAA0B,GAAG,IAAI,CAGvF;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAU3E;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAAE,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAAC,KAAK,EAAE,GAAG,CAAC;IAAC,gBAAgB,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CASnM;AAID,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMzE"}