@cef-ai/cli 2.7.6 → 2.8.1

package/dist/lib/eval-auth.js

@@ -0,0 +1,385 @@
+/**
+ * Credentials for `cef eval`.
+ *
+ * THE STORE is the agent service's bucket on the DDC S3 gateway
+ * (`as-<first 60 hex of the AS pubkey>`, the bucket ROC uses), reached with a
+ * short-lived S3 credential minted for the owner's wallet: a DDC delegation
+ * token naming the gateway as subject, signed by the wallet, registered at
+ * `POST /auth/credentials`. The same mint ROC does in the browser. Explicit
+ * credentials (`--access-key` / `--secret` / `--bucket`) skip it.
+ *
+ * THE WALLET comes from a keystore JSON (`--keystore` + `--password`, the
+ * export of a Cere wallet) or a secret phrase (`--secret-phrase`). Both are
+ * ed25519; the same key signs vault-api requests (publishing `workflow.start`,
+ * reading the run's events).
+ *
+ * THE DDC ACCESS TOKEN `cef push` uses (`$CEF_DDC_ACCESS_TOKEN`, minted in
+ * ROC's Access tab) CANNOT OPEN THE STORE, and no CLI-side delegation fixes
+ * that — see {@link ddcTokenCannotOpenStore} for the three reasons. A person
+ * who has only that token is told so, and what to use instead, rather than
+ * being asked for a wallet they may not have.
+ *
+ * THE ORCHESTRATOR (deployments, jobs) takes the CLI access token
+ * (`--access-token` / `$CEF_ACCESS_TOKEN`), as `cef deploy` does.
+ *
+ * A MINTED CREDENTIAL LIVES ONE HOUR, and a run can take longer. It is served
+ * through a {@link CredentialSource}: re-minted before it expires (the S3
+ * client asks again inside its own refresh window), re-minted once when the
+ * gateway refuses it anyway (403), and kept in a 0600 file cache so the next
+ * command reuses it instead of minting another — the gateway caps live
+ * credentials per wallet, and one per command reaches that cap quickly.
+ */
+import { chmod, mkdir, open, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { CredentialLimitError, registerCredential } from "@cef-ai/account";
+import { inspectAccessTokenScope, ss58Address } from "./access-token.js";
+import { envConfig } from "./env.js";
+async function ddcSdk() {
+    try {
+        return (await import("@cere-ddc-sdk/ddc-client"));
+    }
+    catch {
+        throw new Error("[cef eval] signing with a wallet needs the optional dependency @cere-ddc-sdk/ddc-client; install it, "
+            + "or pass explicit gateway credentials (--access-key/--secret/--bucket)");
+    }
+}
+/** The wallet from options, then `$CEF_KEYSTORE`/`$CEF_KEYSTORE_PASSWORD`, then `$CEF_SECRET_PHRASE`; undefined when none. */
+export async function loadWallet(opts) {
+    const keystore = opts.keystore ?? process.env.CEF_KEYSTORE;
+    const phrase = (opts.secretPhrase ?? process.env.CEF_SECRET_PHRASE ?? "").trim();
+    if (keystore && phrase) {
+        throw new Error("[cef eval] give a keystore or a secret phrase, not both — they may be different identities");
+    }
+    if (keystore) {
+        const password = opts.password ?? process.env.CEF_KEYSTORE_PASSWORD ?? "";
+        const file = keystore.startsWith("~") ? path.join(os.homedir(), keystore.slice(1)) : path.resolve(keystore);
+        const json = JSON.parse(await readFile(file, "utf8"));
+        const content = json.encoding?.content ?? [];
+        if (!content.includes("ed25519")) {
+            throw new Error(`[cef eval] ${keystore} is not an ed25519 keystore (encoding.content: ${content.join(", ") || "unknown"})`);
+        }
+        const { JsonSigner } = await ddcSdk();
+        const signer = new JsonSigner(json, { passphrase: password });
+        await signer.isReady();
+        return signer;
+    }
+    if (phrase) {
+        const { UriSigner } = await ddcSdk();
+        const signer = new UriSigner(phrase, { type: "ed25519" });
+        await signer.isReady();
+        return signer;
+    }
+    return undefined;
+}
+/** The AS bucket on the S3 gateway, as ROC derives it. */
+export function deriveAsBucketName(asPubKey) {
+    const hex = asPubKey.replace(/^0x/i, "").toLowerCase().replace(/[^0-9a-f]/g, "");
+    return `as-${hex.slice(0, 60)}`;
+}
+/** The gateway base URL: the env's auth-info URL minus `/auth/info`. */
+export function gatewayBaseUrl(env) {
+    return envConfig(env).s3GatewayAuthInfo.replace(/\/auth\/info\/?$/, "");
+}
+export const CREDENTIAL_TTL_SECONDS = 3600;
+/** A credential with less than this left is replaced before use. More than the S3 client's own 5 min refresh window. */
+export const CREDENTIAL_REFRESH_MARGIN_MS = 10 * 60_000;
+/** Explicit keys: served as given, never replaced. */
+export function staticCredentials(c) {
+    return { get: async () => c, invalidate: async () => false };
+}
+/**
+ * Minted on demand: reused while it has more than `refreshMarginMs` left,
+ * replaced (from the cache if another command already minted a fresh one,
+ * else by minting) once it does not. Concurrent callers share one mint.
+ */
+export function mintedCredentials(opts) {
+    const now = opts.now ?? Date.now;
+    const margin = opts.refreshMarginMs ?? CREDENTIAL_REFRESH_MARGIN_MS;
+    const fresh = (c) => !!c && (c.expiresAt === undefined || c.expiresAt - now() > margin);
+    let current;
+    let pending;
+    const replace = async () => {
+        const cached = await opts.cache?.read().catch(() => undefined);
+        if (fresh(cached))
+            return cached;
+        const minted = await opts.mint();
+        await opts.cache?.write(minted).catch(() => { });
+        return minted;
+    };
+    return {
+        async get() {
+            if (fresh(current))
+                return current;
+            pending ??= replace().then((c) => {
+                current = c;
+                pending = undefined;
+                return c;
+            }, (e) => {
+                pending = undefined;
+                throw e;
+            });
+            return pending;
+        },
+        async invalidate() {
+            const dropped = current;
+            current = undefined;
+            if (dropped)
+                await opts.cache?.clear(dropped.accessKeyId).catch(() => { });
+            return true;
+        },
+    };
+}
+/** The default cache file: `$CEF_EVAL_CREDENTIAL_CACHE`, else `~/.cef/eval-credentials.json`; `off` disables. */
+export function defaultCredentialCacheFile() {
+    const env = process.env.CEF_EVAL_CREDENTIAL_CACHE;
+    if (env === "off" || env === "0" || env === "false")
+        return undefined;
+    return env || path.join(os.homedir(), ".cef", "eval-credentials.json");
+}
+/** How long a cache update waits for another process's lock before going ahead without it. */
+export const CREDENTIAL_CACHE_LOCK_WAIT_MS = 2000;
+/** A lock older than this was left by a process that died holding it. */
+const CREDENTIAL_CACHE_LOCK_STALE_MS = 10_000;
+/**
+ * Hold `<file>.lock` (created exclusively) while `fn` runs. A lock older than
+ * the stale limit is taken over; one still held after the wait is ignored —
+ * the cache only saves mints, so a rare lost entry beats a stuck command.
+ */
+async function withFileLock(file, fn) {
+    const lock = `${file}.lock`;
+    const deadline = Date.now() + CREDENTIAL_CACHE_LOCK_WAIT_MS;
+    let held = false;
+    while (!held) {
+        try {
+            await (await open(lock, "wx", 0o600)).close();
+            held = true;
+        }
+        catch (e) {
+            if (e.code !== "EEXIST")
+                break;
+            const age = await stat(lock).then((st) => Date.now() - st.mtimeMs, () => 0);
+            if (age > CREDENTIAL_CACHE_LOCK_STALE_MS)
+                await rm(lock, { force: true });
+            else if (Date.now() >= deadline)
+                break;
+            else
+                await new Promise((r) => setTimeout(r, 5 + Math.random() * 20));
+        }
+    }
+    try {
+        return await fn();
+    }
+    finally {
+        if (held)
+            await rm(lock, { force: true });
+    }
+}
+/**
+ * A JSON file of credentials keyed by `key` (gateway + wallet), readable by
+ * its owner only. Each entry holds a secret that expires within the hour.
+ *
+ * SHARED BY CONCURRENT COMMANDS. Every change is a read-modify-write of the
+ * whole file, so two `cef eval` processes writing at once would each drop the
+ * other's entry — and a dropped entry means another mint, against a gateway
+ * that caps live credentials per wallet. Each change therefore re-reads and
+ * merges under an exclusive `<file>.lock`, and replaces the file by renaming a
+ * fully written temp file, so a reader never sees half a file.
+ */
+export function fileCredentialCache(file, key) {
+    const readAll = async () => {
+        try {
+            const raw = JSON.parse(await readFile(file, "utf8"));
+            return raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
+        }
+        catch {
+            return {};
+        }
+    };
+    const update = async (change) => {
+        await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
+        await withFileLock(file, async () => {
+            const all = await readAll();
+            if (!change(all))
+                return;
+            const tmp = `${file}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
+            await writeFile(tmp, JSON.stringify(all, null, 2) + "\n", { mode: 0o600 });
+            await chmod(tmp, 0o600);
+            await rename(tmp, file);
+        });
+    };
+    return {
+        async read() {
+            const c = (await readAll())[key];
+            return c && typeof c.accessKeyId === "string" && typeof c.secretAccessKey === "string" ? c : undefined;
+        },
+        async write(c) {
+            await update((all) => {
+                const t = Date.now();
+                // Drop expired entries while here, so the file does not collect dead secrets.
+                for (const [k, v] of Object.entries(all))
+                    if (typeof v.expiresAt === "number" && v.expiresAt <= t)
+                        delete all[k];
+                all[key] = c;
+                return true;
+            });
+        },
+        async clear(accessKeyId) {
+            await update((all) => {
+                if (all[key]?.accessKeyId !== accessKeyId)
+                    return false;
+                delete all[key];
+                return true;
+            });
+        },
+    };
+}
+/** Mint a short-lived S3 credential for the wallet, as ROC does in the browser. */
+export async function mintGatewayCredentials(opts) {
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    const endpoint = (opts.endpoint ?? gatewayBaseUrl(opts.env)).replace(/\/+$/, "");
+    const res = await fetchImpl(`${endpoint}/auth/info`);
+    if (!res.ok)
+        throw new Error(`[cef eval] ${endpoint}/auth/info answered ${res.status}`);
+    const info = (await res.json());
+    if (!info.gateway_public_key)
+        throw new Error(`[cef eval] ${endpoint}/auth/info named no gateway_public_key`);
+    const gatewayKey = info.gateway_public_key.replace(/^0x/i, "");
+    const subject = ss58Address(Uint8Array.from(gatewayKey.match(/../g).map((h) => Number.parseInt(h, 16))));
+    const { AuthToken } = await ddcSdk();
+    const token = AuthToken.fullAccess({ subject, canDelegate: true });
+    await token.sign(opts.signer);
+    const mintedAt = Date.now();
+    let cred;
+    try {
+        cred = await registerCredential({
+            gatewayUrl: endpoint,
+            signer: opts.signer,
+            delegationToken: token.toString(),
+            label: "cef-eval",
+            expiresInSeconds: CREDENTIAL_TTL_SECONDS,
+            fetchFn: fetchImpl,
+        });
+    }
+    catch (e) {
+        if (e instanceof CredentialLimitError) {
+            throw new Error(`[cef eval] the wallet ${opts.signer.address} already holds as many live S3 credentials as the gateway allows `
+                + `(${endpoint}). \`cef eval\` reuses its own for an hour (~/.cef/eval-credentials.json), but ROC and other `
+                + "tools mint theirs. Wait for older ones to expire, revoke unused ones, or pass explicit --access-key/--secret.", { cause: e });
+        }
+        throw e;
+    }
+    const expiresAt = cred.expiresAt ? Date.parse(cred.expiresAt) : NaN;
+    return {
+        endpoint,
+        bucket: deriveAsBucketName(opts.asPubKey),
+        accessKeyId: cred.accessKeyId,
+        secretAccessKey: cred.secretAccessKey,
+        ...(cred.region || info.region ? { region: cred.region || info.region } : {}),
+        expiresAt: Number.isFinite(expiresAt) ? expiresAt : mintedAt + CREDENTIAL_TTL_SECONDS * 1000,
+    };
+}
+/**
+ * Why `cef push`'s DDC access token cannot be turned into an S3 credential,
+ * as an error that says what to use instead.
+ *
+ * The gateway serves an object by minting a DDC token whose `prev` is the
+ * delegation token the credential was registered with, scoped to the S3
+ * bucket's own DDC bucket. For a ROC-minted registry token that chain cannot
+ * verify, for three independent reasons:
+ *
+ *  1. BUCKET. The token is limited to the agent service's registry bucket
+ *     (`CEF_BUCKET`); datasets live in the gateway bucket `as-<pubkey>`, which
+ *     the gateway created as a separate DDC bucket. A chain whose hops name
+ *     different buckets is refused (the gateway's own 403 says "re-register
+ *     with a wallet-wide token").
+ *  2. NO SUBJECT, NO DELEGATION. It is a bearer token (`canDelegate` false,
+ *     no subject); the gateway's hop must be signed by the previous hop's
+ *     subject, and the gateway's key is not it.
+ *  3. WHO REGISTERS. `POST /auth/credentials` files the credential under the
+ *     key that signs the request; only the owner's key yields an owner
+ *     credential, and `/auth/credentials/delegated` takes only an on-chain
+ *     proxy of the owner.
+ */
+export function ddcTokenCannotOpenStore(token, bucket) {
+    let scope = "";
+    try {
+        const s = inspectAccessTokenScope(token);
+        const parts = [
+            s.bucketId !== undefined ? `limited to DDC bucket ${s.bucketId}` : "",
+            s.subject ? "" : "names no subject",
+            s.canDelegate ? "" : "cannot be delegated",
+        ].filter(Boolean);
+        if (parts.length > 0)
+            scope = ` (this one is ${parts.join(", ")})`;
+    }
+    catch {
+        // Not a readable token: the generic explanation still holds.
+    }
+    return new Error("[cef eval] $CEF_DDC_ACCESS_TOKEN authorizes `cef push` to the agent service's registry bucket, but it cannot "
+        + `open dataset storage${scope}: datasets live in the S3 gateway bucket ${bucket}, a different DDC bucket, `
+        + "and the gateway issues S3 credentials only for a key that signs the request and roots the delegation. "
+        + "Use an S3 access key/secret issued for the owner's wallet (--access-key/--secret, or "
+        + "$CEF_EVAL_KEY/$CEF_EVAL_SECRET), or the owner's wallet itself (--keystore/--password or --secret-phrase).");
+}
+/**
+ * Gateway access, in this order:
+ *
+ *  1. explicit keys (`--access-key`/`--secret`, `$CEF_EVAL_KEY`/`$CEF_EVAL_SECRET`);
+ *  2. a wallet (`--keystore`/`--secret-phrase` or their env vars): credentials
+ *     minted on demand, cached across commands, refreshed before they expire;
+ *  3. `$CEF_DDC_ACCESS_TOKEN` alone: refused, saying why and what to use —
+ *     it cannot mint (see {@link ddcTokenCannotOpenStore}), so it is checked
+ *     only when nothing that can is present.
+ */
+export async function resolveGatewayAccess(opts, wallet, deps = {}) {
+    const accessKeyId = opts.accessKey ?? process.env.CEF_EVAL_KEY;
+    const secretAccessKey = opts.secret ?? process.env.CEF_EVAL_SECRET;
+    const endpoint = (opts.endpoint ?? process.env.CEF_EVAL_ENDPOINT ?? gatewayBaseUrl(opts.env)).replace(/\/+$/, "");
+    const asPubKey = opts.asPubkey ?? process.env.CEF_AS_PUBKEY;
+    const bucket = opts.bucket ?? process.env.CEF_EVAL_BUCKET ?? (asPubKey ? deriveAsBucketName(asPubKey) : undefined);
+    // Half a pair is a mistake, not a request for the wallet path: say which half is missing.
+    if (!!accessKeyId !== !!secretAccessKey) {
+        const given = accessKeyId
+            ? (opts.accessKey !== undefined ? "--access-key" : "$CEF_EVAL_KEY")
+            : (opts.secret !== undefined ? "--secret" : "$CEF_EVAL_SECRET");
+        const missing = accessKeyId ? "--secret (or $CEF_EVAL_SECRET)" : "--access-key (or $CEF_EVAL_KEY)";
+        throw new Error(`[cef eval] ${given} is set but ${missing} is not — explicit gateway credentials need both`);
+    }
+    if (accessKeyId && secretAccessKey) {
+        if (!bucket)
+            throw new Error("[cef eval] explicit gateway credentials need --bucket or --as-pubkey");
+        return {
+            endpoint,
+            bucket,
+            ...(opts.region ? { region: opts.region } : {}),
+            credentials: staticCredentials({ accessKeyId, secretAccessKey, ...(opts.region ? { region: opts.region } : {}) }),
+        };
+    }
+    if (!asPubKey || !bucket)
+        throw new Error("[cef eval] --as-pubkey (or $CEF_AS_PUBKEY) is required — it names the bucket");
+    const signer = wallet ?? (await loadWallet(opts));
+    if (!signer) {
+        const ddcToken = (process.env.CEF_DDC_ACCESS_TOKEN ?? "").trim();
+        if (ddcToken)
+            throw ddcTokenCannotOpenStore(ddcToken, bucket);
+        throw new Error("[cef eval] no credential for the S3 gateway — pass --keystore/--password or --secret-phrase "
+            + "(the agent service owner's wallet), or explicit --access-key/--secret");
+    }
+    const mint = deps.mint ?? mintGatewayCredentials;
+    const cacheFile = deps.cacheFile === undefined ? defaultCredentialCacheFile() : deps.cacheFile ?? undefined;
+    const credentials = mintedCredentials({
+        mint: async () => {
+            const m = await mint({ env: opts.env, endpoint, asPubKey, signer });
+            return {
+                accessKeyId: m.accessKeyId, secretAccessKey: m.secretAccessKey,
+                ...(m.region ? { region: m.region } : {}), ...(m.expiresAt !== undefined ? { expiresAt: m.expiresAt } : {}),
+            };
+        },
+        ...(cacheFile ? { cache: fileCredentialCache(cacheFile, `${endpoint}|${signer.address}`) } : {}),
+    });
+    // Mint (or load) now, so a missing wallet permission fails before any work starts.
+    const first = await credentials.get();
+    return { endpoint, bucket, ...(first.region ? { region: first.region } : {}), credentials };
+}
+//# sourceMappingURL=eval-auth.js.map

package/dist/lib/eval-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eval-auth.js","sourceRoot":"","sources":["../../src/lib/eval-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7F,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAE3E,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAuBrC,KAAK,UAAU,MAAM;IACnB,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAsB,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,uGAAuG;cACnG,uEAAuE,CAC5E,CAAC;IACJ,CAAC;AACH,CAAC;AAQD,8HAA8H;AAC9H,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAmB;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IAC3D,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjF,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,4FAA4F,CAAC,CAAC;IAChH,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC;QAC1E,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC5G,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAA0C,CAAC;QAC/F,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,cAAc,QAAQ,kDAAkD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,GAAG,CAC3G,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC9D,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAC1D,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACjF,OAAO,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AAClC,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;AAC1E,CAAC;AAeD,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAC3C,wHAAwH;AACxH,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,MAAM,CAAC;AAUxD,sDAAsD;AACtD,MAAM,UAAU,iBAAiB,CAAC,CAAoB;IACpD,OAAO,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;AAC/D,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAKjC;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,IAAI,4BAA4B,CAAC;IACpE,MAAM,KAAK,GAAG,CAAC,CAAgC,EAA0B,EAAE,CACzE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,GAAG,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC;IACrE,IAAI,OAAsC,CAAC;IAC3C,IAAI,OAA+C,CAAC;IACpD,MAAM,OAAO,GAAG,KAAK,IAAgC,EAAE;QACrD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC/D,IAAI,KAAK,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACjC,MAAM,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAChD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,GAAG;YACP,IAAI,KAAK,CAAC,OAAO,CAAC;gBAAE,OAAO,OAAO,CAAC;YACnC,OAAO,KAAK,OAAO,EAAE,CAAC,IAAI,CACxB,CAAC,CAAC,EAAE,EAAE;gBACJ,OAAO,GAAG,CAAC,CAAC;gBACZ,OAAO,GAAG,SAAS,CAAC;gBACpB,OAAO,CAAC,CAAC;YACX,CAAC,EACD,CAAC,CAAU,EAAE,EAAE;gBACb,OAAO,GAAG,SAAS,CAAC;gBACpB,MAAM,CAAC,CAAC;YACV,CAAC,CACF,CAAC;YACF,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,KAAK,CAAC,UAAU;YACd,MAAM,OAAO,GAAG,OAAO,CAAC;YACxB,OAAO,GAAG,SAAS,CAAC;YACpB,IAAI,OAAO;gBAAE,MAAM,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC1E,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iHAAiH;AACjH,MAAM,UAAU,0BAA0B;IACxC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IAClD,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IACtE,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,uBAAuB,CAAC,CAAC;AACzE,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,MAAM,6BAA6B,GAAG,IAAI,CAAC;AAClD,yEAAyE;AACzE,MAAM,8BAA8B,GAAG,MAAM,CAAC;AAE9C;;;;GAIG;AACH,KAAK,UAAU,YAAY,CAAI,IAAY,EAAE,EAAoB;IAC/D,MAAM,IAAI,GAAG,GAAG,IAAI,OAAO,CAAC;IAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,6BAA6B,CAAC;IAC5D,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,OAAO,CAAC,IAAI,EAAE,CAAC;QACb,IAAI,CAAC;YACH,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;YAC9C,IAAI,GAAG,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM;YAC1D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;YAC5E,IAAI,GAAG,GAAG,8BAA8B;gBAAE,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;iBACrE,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;gBAAE,MAAM;;gBAClC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,EAAE,CAAC;IACpB,CAAC;YAAS,CAAC;QACT,IAAI,IAAI;YAAE,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,GAAW;IAC3D,MAAM,OAAO,GAAG,KAAK,IAAgD,EAAE;QACrE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAY,CAAC;YAChE,OAAO,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAAyC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,EAAE,MAA2D,EAAiB,EAAE;QAClG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClE,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;YAClC,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;gBAAE,OAAO;YACzB,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;YAChF,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC3E,MAAM,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACxB,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,IAAI;YACR,MAAM,CAAC,GAAG,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;YACjC,OAAO,CAAC,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzG,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,CAAC;YACX,MAAM,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;gBACnB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBACrB,8EAA8E;gBAC9E,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;oBAAE,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC;wBAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;gBACjH,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,WAAW;YACrB,MAAM,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;gBACnB,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE,WAAW,KAAK,WAAW;oBAAE,OAAO,KAAK,CAAC;gBACxD,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;gBAChB,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAM5C;IACC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACjF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,QAAQ,YAAY,CAAC,CAAC;IACrD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,cAAc,QAAQ,uBAAuB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACxF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqD,CAAC;IACpF,IAAI,CAAC,IAAI,CAAC,kBAAkB;QAAE,MAAM,IAAI,KAAK,CAAC,cAAc,QAAQ,wCAAwC,CAAC,CAAC;IAC9G,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1G,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,SAAS,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC5B,IAAI,IAAoD,CAAC;IACzD,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,kBAAkB,CAAC;YAC9B,UAAU,EAAE,QAAQ;YACpB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,eAAe,EAAE,KAAK,CAAC,QAAQ,EAAE;YACjC,KAAK,EAAE,UAAU;YACjB,gBAAgB,EAAE,sBAAsB;YACxC,OAAO,EAAE,SAAS;SACnB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,oBAAoB,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,CAAC,MAAM,CAAC,OAAO,mEAAmE;kBAC3G,IAAI,QAAQ,+FAA+F;kBAC3G,+GAA+G,EACnH,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,CAAC;IACV,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACpE,OAAO;QACL,QAAQ;QACR,MAAM,EAAE,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC;QACzC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,GAAG,sBAAsB,GAAG,IAAI;KAC7F,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,MAAc;IACnE,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG;YACZ,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE;YACrE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB;YACnC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB;SAC3C,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAClB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,GAAG,iBAAiB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;IAC/D,CAAC;IACD,OAAO,IAAI,KAAK,CACd,+GAA+G;UAC3G,uBAAuB,KAAK,4CAA4C,MAAM,4BAA4B;UAC1G,wGAAwG;UACxG,uFAAuF;UACvF,2GAA2G,CAChH,CAAC;AACJ,CAAC;AAqBD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAsB,EACtB,MAAmB,EACnB,OAA4E,EAAE;IAE9E,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IAC/D,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IACnE,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClH,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACnH,0FAA0F;IAC1F,IAAI,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,eAAe,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,WAAW;YACvB,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,eAAe,CAAC;YACnE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,iCAAiC,CAAC;QACnG,MAAM,IAAI,KAAK,CAAC,cAAc,KAAK,eAAe,OAAO,kDAAkD,CAAC,CAAC;IAC/G,CAAC;IACD,IAAI,WAAW,IAAI,eAAe,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;QACrG,OAAO;YACL,QAAQ;YACR,MAAM;YACN,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,WAAW,EAAE,iBAAiB,CAAC,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;SAClH,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAC1H,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACjE,IAAI,QAAQ;YAAE,MAAM,uBAAuB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9D,MAAM,IAAI,KAAK,CACb,8FAA8F;cAC1F,uEAAuE,CAC5E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,sBAAsB,CAAC;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,0BAA0B,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC;IAC5G,MAAM,WAAW,GAAG,iBAAiB,CAAC;QACpC,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YACpE,OAAO;gBACL,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe;gBAC9D,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5G,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,mBAAmB,CAAC,SAAS,EAAE,GAAG,QAAQ,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjG,CAAC,CAAC;IACH,mFAAmF;IACnF,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC;IACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC;AAC9F,CAAC"}

package/dist/lib/eval-auth.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=eval-auth.test.d.ts.map

package/dist/lib/eval-auth.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eval-auth.test.d.ts","sourceRoot":"","sources":["../../src/lib/eval-auth.test.ts"],"names":[],"mappings":""}

package/dist/lib/eval-auth.test.js

@@ -0,0 +1,192 @@
+import { mkdtemp, readdir, readFile, rm, stat } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { CREDENTIAL_REFRESH_MARGIN_MS, ddcTokenCannotOpenStore, fileCredentialCache, mintGatewayCredentials, mintedCredentials, resolveGatewayAccess, } from "./eval-auth.js";
+let dir;
+beforeEach(async () => {
+    dir = await mkdtemp(path.join(os.tmpdir(), "cef-eval-auth-"));
+});
+afterEach(async () => {
+    await rm(dir, { recursive: true, force: true });
+});
+const HOUR = 3600_000;
+/** A mint that hands out `k1`, `k2`, … each valid for an hour from `now()`. */
+function minter(now) {
+    let n = 0;
+    const mint = async () => {
+        n++;
+        return { accessKeyId: `k${n}`, secretAccessKey: `s${n}`, expiresAt: now() + HOUR };
+    };
+    return { mint, count: () => n };
+}
+describe("a minted credential", () => {
+    it("is reused while it has time left, and replaced before it expires", async () => {
+        let t = 0;
+        const m = minter(() => t);
+        const source = mintedCredentials({ mint: m.mint, now: () => t });
+        expect((await source.get()).accessKeyId).toBe("k1");
+        t = HOUR - CREDENTIAL_REFRESH_MARGIN_MS - 1;
+        expect((await source.get()).accessKeyId).toBe("k1");
+        // Inside the margin: a long run must not carry it to the gateway's 403.
+        t = HOUR - CREDENTIAL_REFRESH_MARGIN_MS + 1;
+        expect((await source.get()).accessKeyId).toBe("k2");
+        expect(m.count()).toBe(2);
+    });
+    it("is minted once for callers asking at the same time", async () => {
+        const m = minter(() => 0);
+        const source = mintedCredentials({ mint: m.mint, now: () => 0 });
+        const got = await Promise.all([source.get(), source.get(), source.get()]);
+        expect(got.map((c) => c.accessKeyId)).toEqual(["k1", "k1", "k1"]);
+        expect(m.count()).toBe(1);
+    });
+    it("is replaced after the gateway refused it", async () => {
+        const m = minter(() => 0);
+        const source = mintedCredentials({ mint: m.mint, now: () => 0 });
+        await source.get();
+        expect(await source.invalidate()).toBe(true);
+        expect((await source.get()).accessKeyId).toBe("k2");
+    });
+    it("is shared between commands through an owner-only cache file", async () => {
+        const file = path.join(dir, "nested", "creds.json");
+        const t = Date.now();
+        const m = minter(() => t);
+        const first = mintedCredentials({ mint: m.mint, now: () => t, cache: fileCredentialCache(file, "gw|alice") });
+        expect((await first.get()).accessKeyId).toBe("k1");
+        // A second command: same gateway and wallet, no new mint.
+        const second = mintedCredentials({ mint: m.mint, now: () => t, cache: fileCredentialCache(file, "gw|alice") });
+        expect((await second.get()).accessKeyId).toBe("k1");
+        expect(m.count()).toBe(1);
+        // Another wallet does not get alice's.
+        const other = mintedCredentials({ mint: m.mint, now: () => t, cache: fileCredentialCache(file, "gw|bob") });
+        expect((await other.get()).accessKeyId).toBe("k2");
+        expect((await stat(file)).mode & 0o777).toBe(0o600);
+        // A refused credential leaves the cache, so the next command does not pick it up again.
+        await second.invalidate();
+        expect(Object.keys(JSON.parse(await readFile(file, "utf8")))).toEqual(["gw|bob"]);
+    });
+    it("keeps every entry when several commands write the cache at once", async () => {
+        const file = path.join(dir, "creds.json");
+        const expiresAt = Date.now() + HOUR;
+        const wallets = Array.from({ length: 8 }, (_, i) => `gw|w${i}`);
+        // Each write is a read-modify-write of the whole file; unserialised, they drop each other's entries.
+        await Promise.all(wallets.map((k) => fileCredentialCache(file, k).write({ accessKeyId: k, secretAccessKey: "s", expiresAt })));
+        expect(Object.keys(JSON.parse(await readFile(file, "utf8"))).sort()).toEqual(wallets);
+        expect((await stat(file)).mode & 0o777).toBe(0o600);
+        expect((await readdir(dir)).sort()).toEqual(["creds.json"]);
+    });
+    it("is not reused from the cache when it is about to expire", async () => {
+        const file = path.join(dir, "creds.json");
+        let t = Date.now();
+        const m = minter(() => t);
+        await mintedCredentials({ mint: m.mint, now: () => t, cache: fileCredentialCache(file, "k") }).get();
+        t += HOUR - CREDENTIAL_REFRESH_MARGIN_MS + 1;
+        expect((await mintedCredentials({ mint: m.mint, now: () => t, cache: fileCredentialCache(file, "k") }).get()).accessKeyId).toBe("k2");
+    });
+});
+describe("resolving gateway access", () => {
+    const signer = { address: "5Alice" };
+    it("mints through the source and keeps the bucket the AS pubkey names", async () => {
+        let n = 0;
+        const access = await resolveGatewayAccess({ asPubkey: `0x${"ab".repeat(32)}`, endpoint: "https://gw.example/" }, signer, {
+            cacheFile: null,
+            mint: async () => ({ endpoint: "x", bucket: "x", accessKeyId: `k${++n}`, secretAccessKey: "s", expiresAt: Date.now() + HOUR }),
+        });
+        expect(access).toMatchObject({ endpoint: "https://gw.example", bucket: `as-${"ab".repeat(30)}` });
+        expect((await access.credentials.get()).accessKeyId).toBe("k1");
+        expect(n).toBe(1);
+    });
+    it("serves explicit keys as given, and cannot replace them", async () => {
+        const access = await resolveGatewayAccess({ accessKey: "AK", secret: "SK", bucket: "b", endpoint: "https://gw" });
+        expect(await access.credentials.get()).toEqual({ accessKeyId: "AK", secretAccessKey: "SK" });
+        expect(await access.credentials.invalidate()).toBe(false);
+    });
+    it.each([
+        [{ accessKey: "AK" }, /--access-key is set but --secret \(or \$CEF_EVAL_SECRET\) is not/],
+        [{ secret: "SK" }, /--secret is set but --access-key \(or \$CEF_EVAL_KEY\) is not/],
+    ])("refuses half of an explicit key pair instead of falling through to the wallet (%o)", async (half, error) => {
+        const saved = { key: process.env.CEF_EVAL_KEY, secret: process.env.CEF_EVAL_SECRET };
+        delete process.env.CEF_EVAL_KEY;
+        delete process.env.CEF_EVAL_SECRET;
+        try {
+            // A wallet is present, so without the check this would quietly mint and ignore the flag.
+            await expect(resolveGatewayAccess({ asPubkey: `0x${"ab".repeat(32)}`, endpoint: "https://gw", ...half }, signer, {
+                cacheFile: null,
+                mint: async () => ({ endpoint: "x", bucket: "x", accessKeyId: "minted", secretAccessKey: "s", expiresAt: Date.now() + HOUR }),
+            })).rejects.toThrow(error);
+        }
+        finally {
+            if (saved.key !== undefined)
+                process.env.CEF_EVAL_KEY = saved.key;
+            if (saved.secret !== undefined)
+                process.env.CEF_EVAL_SECRET = saved.secret;
+        }
+    });
+});
+describe("choosing a credential when $CEF_DDC_ACCESS_TOKEN is set", () => {
+    const ENV = ["CEF_DDC_ACCESS_TOKEN", "CEF_KEYSTORE", "CEF_SECRET_PHRASE", "CEF_EVAL_KEY", "CEF_EVAL_SECRET"];
+    const saved = {};
+    let registryToken = "";
+    beforeEach(async () => {
+        for (const k of ENV) {
+            saved[k] = process.env[k];
+            delete process.env[k];
+        }
+        // What ROC's Access tab mints for `cef push`: full access, one bucket, no subject.
+        const ddc = (await import("@cere-ddc-sdk/ddc-client"));
+        const owner = new ddc.UriSigner("//cef-eval-test-owner");
+        await owner.isReady();
+        registryToken = (await ddc.AuthToken.fullAccess({ bucketId: 4044n }).sign(owner)).toString();
+        process.env.CEF_DDC_ACCESS_TOKEN = registryToken;
+    });
+    afterEach(() => {
+        for (const k of ENV) {
+            if (saved[k] === undefined)
+                delete process.env[k];
+            else
+                process.env[k] = saved[k];
+        }
+    });
+    const AS = `0x${"cd".repeat(32)}`;
+    const neverMint = async () => { throw new Error("must not mint"); };
+    it("refuses the token alone, naming its bucket, the dataset bucket, and what to use instead", async () => {
+        const err = await resolveGatewayAccess({ asPubkey: AS, endpoint: "https://gw" }, undefined, { cacheFile: null, mint: neverMint })
+            .then(() => undefined, (e) => e);
+        expect(err?.message).toMatch(/\$CEF_DDC_ACCESS_TOKEN .*cannot open dataset storage/);
+        expect(err?.message).toContain("limited to DDC bucket 4044");
+        expect(err?.message).toContain("cannot be delegated");
+        expect(err?.message).toContain(`as-${"cd".repeat(30)}`);
+        expect(err?.message).toContain("--access-key/--secret");
+    });
+    it("uses explicit keys over the token", async () => {
+        const access = await resolveGatewayAccess({ asPubkey: AS, accessKey: "AK", secret: "SK", endpoint: "https://gw" });
+        expect(await access.credentials.get()).toEqual({ accessKeyId: "AK", secretAccessKey: "SK" });
+    });
+    it("mints with a wallet when one is given beside the token", async () => {
+        let minted = 0;
+        const access = await resolveGatewayAccess({ asPubkey: AS, endpoint: "https://gw" }, { address: "5Alice" }, {
+            cacheFile: null,
+            mint: async () => ({ endpoint: "x", bucket: "x", accessKeyId: `k${++minted}`, secretAccessKey: "s", expiresAt: Date.now() + HOUR }),
+        });
+        expect((await access.credentials.get()).accessKeyId).toBe("k1");
+    });
+    it("still explains a string that is not a token", () => {
+        expect(ddcTokenCannotOpenStore("not a token!", "as-x").message).toMatch(/cannot open dataset storage: datasets live in the S3 gateway bucket as-x/);
+    });
+});
+describe("minting at the credential cap", () => {
+    it("says what to do instead of surfacing the gateway's 400", async () => {
+        const { UriSigner } = (await import("@cere-ddc-sdk/ddc-client"));
+        const wallet = new UriSigner("//Alice", { type: "ed25519" });
+        await wallet.isReady();
+        const fetchImpl = (async (url) => {
+            if (String(url).endsWith("/auth/info")) {
+                return new Response(JSON.stringify({ gateway_public_key: "11".repeat(32) }), { status: 200 });
+            }
+            return new Response("credential limit reached", { status: 400 });
+        });
+        await expect(mintGatewayCredentials({ endpoint: "https://gw", asPubKey: "0x00", signer: wallet, fetchImpl }))
+            .rejects.toThrow(/already holds as many live S3 credentials as the gateway allows.*--access-key\/--secret/s);
+    });
+});
+//# sourceMappingURL=eval-auth.test.js.map

package/dist/lib/eval-auth.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eval-auth.test.js","sourceRoot":"","sources":["../../src/lib/eval-auth.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAErE,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,GAGrB,MAAM,gBAAgB,CAAC;AAExB,IAAI,GAAW,CAAC;AAChB,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAChE,CAAC,CAAC,CAAC;AACH,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAClD,CAAC,CAAC,CAAC;AAEH,MAAM,IAAI,GAAG,QAAQ,CAAC;AAEtB,+EAA+E;AAC/E,SAAS,MAAM,CAAC,GAAiB;IAC/B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,MAAM,IAAI,GAAG,KAAK,IAAgC,EAAE;QAClD,CAAC,EAAE,CAAC;QACJ,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;IACrF,CAAC,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;AAClC,CAAC;AAED,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,MAAM,GAAG,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QACjE,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC,GAAG,IAAI,GAAG,4BAA4B,GAAG,CAAC,CAAC;QAC5C,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,wEAAwE;QACxE,CAAC,GAAG,IAAI,GAAG,4BAA4B,GAAG,CAAC,CAAC;QAC5C,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,MAAM,GAAG,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QACjE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC1E,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAClE,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,MAAM,GAAG,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QACjE,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC;QACnB,MAAM,CAAC,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,KAAK,GAAG,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;QAC9G,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,0DAA0D;QAC1D,MAAM,MAAM,GAAG,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;QAC/G,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1B,uCAAuC;QACvC,MAAM,KAAK,GAAG,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC5G,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpD,wFAAwF;QACxF,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;QAC1B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QACpC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAChE,qGAAqG;QACrG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAClC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,eAAe,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5F,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACtF,MAAM,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;QACrG,CAAC,IAAI,IAAI,GAAG,4BAA4B,GAAG,CAAC,CAAC;QAC7C,MAAM,CAAC,CAAC,MAAM,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxI,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAgB,CAAC;IAEnD,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,MAAM,MAAM,GAAG,MAAM,oBAAoB,CACvC,EAAE,QAAQ,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,qBAAqB,EAAE,EACrE,MAAM,EACN;YACE,SAAS,EAAE,IAAI;YACf,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;SAC/H,CACF,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAClG,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;QAClH,MAAM,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,MAAM,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,kEAAkE,CAAC;QACzF,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,+DAA+D,CAAC;KACpF,CAAC,CAAC,oFAAoF,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QAC7G,MAAM,KAAK,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;QACrF,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAChC,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QACnC,IAAI,CAAC;YACH,yFAAyF;YACzF,MAAM,MAAM,CAAC,oBAAoB,CAAC,EAAE,QAAQ,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAI,EAAE,EAAE,MAAM,EAAE;gBAC/G,SAAS,EAAE,IAAI;gBACf,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;aAC9H,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;gBAAS,CAAC;YACT,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC;YAClE,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,eAAe,GAAG,KAAK,CAAC,MAAM,CAAC;QAC7E,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yDAAyD,EAAE,GAAG,EAAE;IACvE,MAAM,GAAG,GAAG,CAAC,sBAAsB,EAAE,cAAc,EAAE,mBAAmB,EAAE,cAAc,EAAE,iBAAiB,CAAU,CAAC;IACtH,MAAM,KAAK,GAAuC,EAAE,CAAC;IACrD,IAAI,aAAa,GAAG,EAAE,CAAC;IACvB,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACpB,KAAK,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC1B,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;QACD,mFAAmF;QACnF,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAGpD,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QACzD,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;QACtB,aAAa,GAAG,CAAC,MAAM,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC7F,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,aAAa,CAAC;IACnD,CAAC,CAAC,CAAC;IACH,SAAS,CAAC,GAAG,EAAE;QACb,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACpB,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;;gBAC7C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,KAAK,IAAoB,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;IAEpF,EAAE,CAAC,yFAAyF,EAAE,KAAK,IAAI,EAAE;QACvG,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;aAC9H,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC,CAAU,EAAE,EAAE,CAAC,CAAU,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,sDAAsD,CAAC,CAAC;QACrF,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;QAC7D,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;QACtD,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACxD,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;QACnH,MAAM,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAgB,EAAE;YACvH,SAAS,EAAE,IAAI;YACf,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;SACpI,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,uBAAuB,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,0EAA0E,CAAC,CAAC;IACtJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAE9D,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAC7D,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,GAAiB,EAAE,EAAE;YAC7C,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBACvC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAChG,CAAC;YACD,OAAO,IAAI,QAAQ,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACnE,CAAC,CAAiB,CAAC;QACnB,MAAM,MAAM,CAAC,sBAAsB,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;aAC1G,OAAO,CAAC,OAAO,CAAC,0FAA0F,CAAC,CAAC;IACjH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}