@cleocode/core 2026.10.10 → 2026.10.11

package/dist/store/migration-safety.js

@@ -0,0 +1,587 @@
+/**
+ * The migration safety harness (T13448, saga T13339 / epic T13340).
+ *
+ * Every store move in the CleoDocs re-architecture (the T13360 migration, the
+ * T13361/T13362 legacy retirements) wraps its steps in this harness so a
+ * migration can never destroy or corrupt an existing project's store without
+ * a verified recovery path. Each registered step executes inside a fixed
+ * bracket:
+ *
+ *   1. **Pre-step backup** — a `VACUUM INTO` snapshot of the whole project
+ *      store via {@link planMigrationSnapshot} + {@link writeMigrationSnapshot}
+ *      (the same primitives the twin-collapse repairs use, T12535). The
+ *      snapshot is registered as a `migration` system backup
+ *      (`.cleo/backups/sqlite/cleo.db.<backupId>` plus its `<backupId>.meta.json`
+ *      sidecar), so `cleo backup list` shows it and the per-type rotation
+ *      applies. The sidecar is the step's **backup receipt**; its timestamp
+ *      feeds the destructive-step guard. Runs OUTSIDE the transaction
+ *      (`VACUUM INTO` requires it).
+ *   2. **`BEGIN IMMEDIATE`** (T13609) — single-writer exclusion for the whole
+ *      bracket: a concurrent writer can neither interleave between the
+ *      fingerprints, the run and the verify (masking or forging count/hash
+ *      results) nor be silently discarded by a later restore.
+ *   3. **Run** — the step's `run(ctx)` executes inside the transaction.
+ *      Table-rebuild recipes use `PRAGMA defer_foreign_keys = ON` (enforced
+ *      at COMMIT), never `PRAGMA foreign_keys = OFF` (a no-op in a
+ *      transaction).
+ *   4. **Verify** — machine-readable checks: per-table row counts before/after
+ *      (matching, or explained by the step's declared `expectedDelta`),
+ *      content-hash spot checks (an order-independent multiset hash over the
+ *      table's rows, sampled to `sampleSize` rowids when the table is larger),
+ *      and `PRAGMA foreign_key_check` (must return zero rows).
+ *   5. **Commit or roll back** (T13609) — only a fully verified step is
+ *      COMMITted; a refused, failed or throwing step is ROLLBACKed, so a
+ *      failed step is never visible in the live store. The restore path
+ *      remains the backstop for a commit that is later found bad.
+ *   6. **Report** — a JSON-serializable {@link MigrationStepReport} per step
+ *      (including the `transaction` outcome); a failed verification **halts**
+ *      the runner and names the failed step. {@link rollbackMigrationStep}
+ *      consumes exactly the report's backup receipt and before-fingerprints.
+ *
+ * **Destructive guard** — a step declared `destructive: true` refuses to run
+ * unless the harness options pass `force: true` AND the step's backup receipt
+ * is younger than the step start (which the harness itself guarantees by
+ * taking the snapshot first; a failed or skipped backup therefore refuses the
+ * step by construction).
+ *
+ * **Rollback** — {@link rollbackMigrationStep} restores the step's snapshot
+ * through {@link restoreStoreSnapshot} (the programmatic core of
+ * `cleo restore backup`, T13240: verified copy, live-writer refusal, the
+ * replaced store kept as a pinned `pre-restore-*` backup) and then re-proves
+ * the restored store against the pre-step fingerprints (counts and content
+ * hashes must match exactly).
+ *
+ * All store access here is read-only verification SQL plus the `VACUUM INTO`
+ * snapshot primitive; steps own their own writes and route them through the
+ * canonical accessors (gates 28/38).
+ *
+ * @module
+ * @task T13448
+ */
+import { createHash } from 'node:crypto';
+import { ExitCode } from '@cleocode/contracts/exit-codes.js';
+import { CleoError } from '../errors.js';
+import { getLogger } from '../logger.js';
+import { readBackupSidecar } from './backup-sidecar.js';
+import { resolveDualScopeDbPath } from './dual-scope-db.js';
+import { openCleoDbSnapshot } from './open-cleo-db.js';
+import { planMigrationSnapshot, writeMigrationSnapshot } from './pre-repair-snapshot.js';
+import { restoreStoreSnapshot } from './restore-store.js';
+/** Default number of rows content-hash spot-checked per oversized table. */
+export const DEFAULT_VERIFICATION_SAMPLE_SIZE = 200;
+/**
+ * Quote one SQLite identifier (table name) for interpolation.
+ */
+function quoteIdent(name) {
+    return `"${name.replace(/"/g, '""')}"`;
+}
+/**
+ * Error message helper — `Error.message` when available, String otherwise.
+ */
+function messageOf(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+/**
+ * Deterministic, unambiguous serialization of one node:sqlite value for
+ * hashing: every value kind gets a tag (`N` null, `n` number, `i` bigint,
+ * `s` length-prefixed string, `b` hex blob), so distinct value kinds can
+ * never collide.
+ */
+function encodeValue(value) {
+    if (value === null || value === undefined)
+        return 'N';
+    if (typeof value === 'number')
+        return `n:${value}`;
+    if (typeof value === 'bigint')
+        return `i:${value.toString()}`;
+    if (typeof value === 'string')
+        return `s:${value.length}:${value}`;
+    if (value instanceof Uint8Array)
+        return `b:${value.length}:${Buffer.from(value).toString('hex')}`;
+    return `x:${String(value)}`;
+}
+/**
+ * SHA-256 digest of one result row: sorted column names plus tagged values,
+ * so it is independent of the row's key order and of physical row order.
+ */
+function rowDigest(row) {
+    const hash = createHash('sha256');
+    for (const key of Object.keys(row).sort()) {
+        hash.update(encodeValue(key));
+        hash.update('=');
+        hash.update(encodeValue(row[key]));
+        hash.update(';');
+    }
+    return hash.digest('hex');
+}
+/**
+ * Combine per-row digests into one table hash: sort the digests and hash the
+ * list, making the fingerprint an order-independent multiset hash (a carried
+ * table survives a rowid-shuffling rebuild unchanged).
+ */
+function combineDigests(digests) {
+    const hash = createHash('sha256');
+    for (const digest of [...digests].sort()) {
+        hash.update(digest);
+        hash.update('\n');
+    }
+    return hash.digest('hex');
+}
+/**
+ * Pick `n` evenly-spaced entries from an already-sorted list (indexes
+ * `floor(i * len / n)`), de-duplicated. Deterministic: the same sorted input
+ * yields the same sample every time.
+ */
+function evenlySpaced(sorted, n) {
+    if (sorted.length <= n)
+        return [...sorted];
+    const out = [];
+    for (let i = 0; i < n; i++) {
+        const item = sorted[Math.floor((i * sorted.length) / n)];
+        if (item !== undefined && (out.length === 0 || out[out.length - 1] !== item)) {
+            out.push(item);
+        }
+    }
+    return out;
+}
+/**
+ * Capture an order-independent content fingerprint of one table.
+ *
+ * Tables with at most `sampleSize` rows (and `WITHOUT ROWID` tables, which
+ * have no rowid to sample) are hashed in full; larger rowid tables are
+ * spot-checked on `sampleSize` evenly-spaced rowids. Reads only.
+ *
+ * @param db - Live native handle.
+ * @param table - Table name.
+ * @param sampleSize - Full-scan cutoff / sample size (default 200).
+ * @returns The fingerprint.
+ * @task T13448
+ */
+export function fingerprintTable(db, table, sampleSize = DEFAULT_VERIFICATION_SAMPLE_SIZE) {
+    const quoted = quoteIdent(table);
+    const count = Number(db.prepare(`SELECT COUNT(*) AS n FROM ${quoted}`).get().n);
+    if (count === 0) {
+        return { table, count: 0, hash: combineDigests([]), full: true, sampledRowids: [] };
+    }
+    let rowids = null;
+    try {
+        rowids = db.prepare(`SELECT rowid AS r FROM ${quoted} ORDER BY rowid`).all().map((row) => row.r);
+    }
+    catch {
+        rowids = null; // WITHOUT ROWID table: no rowid to sample
+    }
+    let sample;
+    let full;
+    if (rowids === null) {
+        sample = null;
+        full = true;
+    }
+    else if (count <= sampleSize) {
+        sample = rowids;
+        full = true;
+    }
+    else {
+        sample = evenlySpaced(rowids, sampleSize);
+        full = false;
+    }
+    const digests = [];
+    if (sample !== null) {
+        const stmt = db.prepare(`SELECT * FROM ${quoted} WHERE rowid = ?`);
+        // Real stores carry integers beyond 2^53 (e.g. HLC timestamps); without
+        // big-int reads node:sqlite throws converting them to number.
+        stmt.setReadBigInts(true);
+        for (const rowid of sample) {
+            const row = stmt.get(rowid);
+            if (row !== undefined)
+                digests.push(rowDigest(row));
+        }
+    }
+    else {
+        const rowsStmt = db.prepare(`SELECT * FROM ${quoted}`);
+        rowsStmt.setReadBigInts(true);
+        const rows = rowsStmt.all();
+        for (const row of rows)
+            digests.push(rowDigest(row));
+    }
+    return { table, count, hash: combineDigests(digests), full, sampledRowids: sample ?? [] };
+}
+/**
+ * Run `PRAGMA foreign_key_check` and return the violation count. Zero is the
+ * only passing value; the pragma reports independently of the
+ * `foreign_keys` switch, so a migration that toggles FK enforcement mid-step
+ * is still checked. Read-only.
+ *
+ * @param db - Live native handle.
+ * @returns Number of FK violations.
+ * @task T13448
+ */
+export function countForeignKeyViolations(db) {
+    return db.prepare('PRAGMA foreign_key_check').all().length;
+}
+/**
+ * List user tables (everything except `sqlite_*` internals) in name order.
+ * Read-only.
+ */
+function listUserTables(db) {
+    return db
+        .prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%' ORDER BY name")
+        .all().map((row) => row.name);
+}
+/**
+ * Error text meaning "this table needs a loadable SQLite extension that this
+ * connection does not have" (e.g. `vec0` virtual tables without sqlite-vec).
+ * Only this read error may skip verification — such tables are
+ * content-addressed caches, never the source of truth; anything else stays
+ * fail-closed.
+ */
+const NO_SUCH_MODULE = /no such module/i;
+/**
+ * Capture the pre- or post-step fingerprint set for the tables in scope.
+ * Extension-backed unreadable tables (see {@link NO_SUCH_MODULE}) are
+ * returned as skipped, not fatal.
+ */
+function captureFingerprints(db, tables, sampleSize) {
+    const names = tables ?? listUserTables(db);
+    const fingerprints = [];
+    const skipped = [];
+    for (const table of names) {
+        try {
+            fingerprints.push(fingerprintTable(db, table, sampleSize));
+        }
+        catch (err) {
+            if (NO_SUCH_MODULE.test(messageOf(err))) {
+                skipped.push({ table, reason: messageOf(err) });
+                continue;
+            }
+            throw err;
+        }
+    }
+    return { fingerprints, skipped };
+}
+/**
+ * Run migration steps inside the backup → BEGIN IMMEDIATE → migrate → verify
+ * → COMMIT/ROLLBACK → report bracket (T13448, T13609). Each step's writes are
+ * atomic and write-exclusive: a refused, failed or throwing step is rolled
+ * back and never becomes visible in the live store, and no concurrent writer
+ * can interleave between the before-fingerprints, the run and the verify.
+ * Never throws for verification failures, refusals, or step errors: those are
+ * reported and halt the run (AC1, AC4). Throws only for invalid invocation
+ * (no steps).
+ *
+ * @param steps - The registered steps, in execution order.
+ * @param opts - The store handle, project, force flag and hooks.
+ * @returns The machine-readable run report. On `halted`/`refused`, the last
+ *   step report carries the backup receipt and before-fingerprints needed by
+ *   {@link rollbackMigrationStep} (the backstop for a commit later found bad).
+ * @task T13448
+ * @task T13609 — transactional bracket; failed steps are never visible
+ */
+export async function runMigrationSteps(steps, opts) {
+    if (steps.length === 0) {
+        // @sync-invariant none:input-shape nothing was asked of the store
+        throw new CleoError(ExitCode.INVALID_INPUT, 'runMigrationSteps: at least one step is required');
+    }
+    const dbPath = opts.dbPath ?? resolveDualScopeDbPath('project', opts.projectRoot);
+    const sampleSize = opts.sampleSize ?? DEFAULT_VERIFICATION_SAMPLE_SIZE;
+    const logger = getLogger('migration-safety');
+    const reports = [];
+    for (const step of steps) {
+        const startedAt = new Date();
+        const stepStartMs = startedAt.getTime();
+        const clockStart = Date.now();
+        const spec = step.verify ?? {};
+        const skipHash = new Set(spec.skipHash ?? []);
+        const stepSampleSize = spec.sampleSize ?? sampleSize;
+        const failures = [];
+        let backup = null;
+        let runError = null;
+        let status = 'completed';
+        const verifications = [];
+        let beforeTables = [];
+        let unreadableTables = [];
+        let addedTables = [];
+        let removedTables = [];
+        let fkViolations = 0;
+        let transaction = 'none';
+        // 1. Pre-step VACUUM INTO backup, registered as a migration system
+        //    backup whose sidecar is this step's receipt (T12535 machinery).
+        //    Runs OUTSIDE the transaction — VACUUM INTO requires it.
+        try {
+            const plan = planMigrationSnapshot(opts.db, dbPath);
+            const snapshotPath = writeMigrationSnapshot(opts.db, plan, `migration step: ${step.name}${step.description ? ` — ${step.description}` : ''} (T13448)`);
+            const receipt = readBackupSidecar(snapshotPath, 'migration');
+            backup = {
+                backupId: plan.backupId,
+                snapshotPath,
+                timestamp: receipt?.timestamp ?? new Date().toISOString(),
+            };
+        }
+        catch (err) {
+            status = 'failed';
+            runError = `pre-step backup failed: ${messageOf(err)}`;
+        }
+        // 2. BEGIN IMMEDIATE (T13609): single-writer exclusion for the whole
+        //    fingerprint → run → verify bracket, so a concurrent writer can
+        //    neither interleave (masking or forging count/hash results) nor be
+        //    silently discarded by a later restore. Writers wait on
+        //    busy_timeout, then fail with SQLITE_BUSY.
+        if (status === 'completed') {
+            try {
+                opts.db.exec('BEGIN IMMEDIATE');
+                transaction = 'rolled-back'; // until COMMIT proves otherwise
+            }
+            catch (err) {
+                status = 'failed';
+                runError = `BEGIN IMMEDIATE failed: ${messageOf(err)}`;
+            }
+        }
+        // 3. Destructive guard: refuse without force AND a receipt younger than
+        //    the step start (AC: owner directive 2026-10-10). Inside the lock,
+        //    before any fingerprint work.
+        if (status === 'completed' && step.destructive === true) {
+            const receiptFresh = backup !== null && Date.parse(backup.timestamp) >= stepStartMs;
+            if (opts.force !== true || !receiptFresh) {
+                status = 'refused';
+                failures.push('destructive step refused: requires force AND a backup receipt younger than the step start');
+            }
+        }
+        // 4. Before-fingerprints, inside the lock (T13609): the store they will
+        //    be compared against cannot move underneath the bracket.
+        if (status === 'completed') {
+            try {
+                const captured = captureFingerprints(opts.db, spec.tables, stepSampleSize);
+                beforeTables = captured.fingerprints;
+                unreadableTables = captured.skipped;
+            }
+            catch (err) {
+                status = 'failed';
+                runError = `before-fingerprint capture failed: ${messageOf(err)}`;
+            }
+        }
+        // 5. Run the step, inside the transaction.
+        if (status === 'completed') {
+            const log = (message) => {
+                logger.info({ step: step.name }, message);
+            };
+            try {
+                await step.run({ db: opts.db, projectRoot: opts.projectRoot, dbPath, log });
+            }
+            catch (err) {
+                status = 'failed';
+                runError = messageOf(err);
+            }
+        }
+        // 6. Verify: counts (or declared deltas), content-hash spot checks, FK.
+        if (status === 'completed') {
+            try {
+                fkViolations = countForeignKeyViolations(opts.db);
+                const beforeNames = new Set(beforeTables.map((fp) => fp.table));
+                const afterNames = new Set(listUserTables(opts.db));
+                addedTables = [...afterNames].filter((name) => !beforeNames.has(name));
+                removedTables = [...beforeNames].filter((name) => !afterNames.has(name));
+                // A table skipped before the step (unreadable, e.g. a vec0 virtual
+                // table without its extension) must still EXIST afterwards: removal
+                // of a skipped table is invisible to the count/hash checks, so a
+                // step that drops one on this connection would go undetected.
+                for (const skipped of unreadableTables) {
+                    if (!afterNames.has(skipped.table)) {
+                        failures.push(`table ${skipped.table} was unreadable before the step (${skipped.reason}) and is missing after it`);
+                    }
+                }
+                for (const before of beforeTables) {
+                    const expectedDelta = spec.expectedDelta?.[before.table] ?? 0;
+                    if (!afterNames.has(before.table)) {
+                        failures.push(`table ${before.table} was removed by the step`);
+                        verifications.push({
+                            table: before.table,
+                            before,
+                            after: null,
+                            expectedDelta,
+                            countOk: false,
+                            hashOk: null,
+                        });
+                        continue;
+                    }
+                    const after = fingerprintTable(opts.db, before.table, stepSampleSize);
+                    const countOk = after.count === before.count + expectedDelta;
+                    // A non-zero declared delta legitimately reshapes the table: the
+                    // count is the contract there, the hash check applies to carried
+                    // (zero-delta, not skip-listed) tables.
+                    const hashChecked = expectedDelta === 0 && !skipHash.has(before.table);
+                    const hashOk = hashChecked ? after.hash === before.hash : null;
+                    if (!countOk) {
+                        failures.push(`table ${before.table}: row count ${after.count} != ${before.count} + ${expectedDelta} (expected delta not explained)`);
+                    }
+                    if (hashOk === false) {
+                        failures.push(`table ${before.table}: content hash changed (carried-table spot check failed)`);
+                    }
+                    verifications.push({
+                        table: before.table,
+                        before,
+                        after,
+                        expectedDelta,
+                        countOk,
+                        hashOk,
+                    });
+                }
+                if (removedTables.length > 0) {
+                    failures.push(`tables removed by the step: ${removedTables.join(', ')}`);
+                }
+                // Guard for the blind spot: a table skipped in the before-capture
+                // (extension-backed, e.g. vec0 without sqlite-vec loaded) never made
+                // it into beforeTables, so the loop above cannot notice the step
+                // dropping it. Its absence afterwards is only explainable by the
+                // step — fail closed.
+                for (const unreadable of unreadableTables) {
+                    if (!afterNames.has(unreadable.table)) {
+                        failures.push(`table ${unreadable.table} was removed by the step (skipped before: ${unreadable.reason})`);
+                    }
+                }
+                if (fkViolations > 0) {
+                    failures.push(`PRAGMA foreign_key_check returned ${fkViolations} violation(s) after the step`);
+                }
+                if (failures.length > 0)
+                    status = 'failed';
+            }
+            catch (err) {
+                status = 'failed';
+                runError = `verification failed: ${messageOf(err)}`;
+            }
+        }
+        // 7. Commit only a fully verified step; roll everything else back, so a
+        //    failed step is never visible in the live store (T13609 AC1/AC3). A
+        //    COMMIT error (e.g. a deferred foreign-key violation surfacing at
+        //    commit time) rolls back too.
+        if (transaction === 'rolled-back') {
+            if (status === 'completed') {
+                try {
+                    opts.db.exec('COMMIT');
+                    transaction = 'committed';
+                }
+                catch (err) {
+                    try {
+                        opts.db.exec('ROLLBACK');
+                    }
+                    catch {
+                        // best effort — the transaction may already be closed
+                    }
+                    status = 'failed';
+                    if (runError === null)
+                        runError = `COMMIT failed: ${messageOf(err)}`;
+                }
+            }
+            else {
+                try {
+                    opts.db.exec('ROLLBACK');
+                }
+                catch {
+                    // best effort — the step may have closed the transaction itself
+                }
+            }
+        }
+        const report = {
+            step: step.name,
+            destructive: step.destructive === true,
+            status,
+            startedAt: startedAt.toISOString(),
+            durationMs: Date.now() - clockStart,
+            backup,
+            tables: verifications,
+            addedTables,
+            removedTables,
+            foreignKeyViolations: fkViolations,
+            unreadableTables,
+            transaction,
+            failures,
+            runError,
+        };
+        reports.push(report);
+        opts.onStepReport?.(report);
+        if (status === 'completed') {
+            logger.info({ step: step.name, backupId: backup?.backupId ?? null, tables: verifications.length }, 'migration step verified and committed (T13448)');
+        }
+        else {
+            logger.warn({ step: step.name, status, failures, runError, transaction }, 'migration step failed; transaction rolled back, store unchanged, restore path ready (T13448/T13609)');
+            return {
+                status: status === 'refused' ? 'refused' : 'halted',
+                steps: reports,
+                haltedStep: step.name,
+                failure: failures[0] ?? runError ?? 'step failed',
+            };
+        }
+    }
+    return { status: 'completed', steps: reports, haltedStep: null, failure: null };
+}
+/**
+ * Roll back one migration step: restore its pre-step snapshot through the
+ * programmatic core of `cleo restore backup` ({@link restoreStoreSnapshot} —
+ * verified copy, quiescence/live-writer refusal, the replaced store kept as
+ * a pinned `pre-restore-*` backup), then re-prove the restored store against
+ * the step's pre-step fingerprints. This is the tested rollback path of AC3.
+ *
+ * Note: the restore closes every in-process handle on the store (T13240
+ * quiescence) — discard any native handle captured before calling this and
+ * re-open through the chokepoint afterwards.
+ *
+ * @param params - The step, its backup receipt and its before-fingerprints.
+ * @returns The rollback report; `verified` is the assertion surface.
+ * @task T13448
+ */
+export async function rollbackMigrationStep(params) {
+    const sampleSize = params.sampleSize ?? DEFAULT_VERIFICATION_SAMPLE_SIZE;
+    const result = await restoreStoreSnapshot({
+        projectRoot: params.projectRoot,
+        cwd: params.cwd,
+        snapshot: params.backup.snapshotPath,
+        ...(params.confirmOwnerStore !== undefined
+            ? { confirmOwnerStore: params.confirmOwnerStore }
+            : {}),
+    });
+    const failures = [];
+    const tables = [];
+    if (!result.restored) {
+        failures.push('restoreStoreSnapshot did not place the snapshot');
+    }
+    const restored = openCleoDbSnapshot(result.target, { readOnly: true });
+    try {
+        for (const expected of params.before) {
+            let actual = null;
+            let skipped = null;
+            try {
+                actual = fingerprintTable(restored.db, expected.table, sampleSize);
+            }
+            catch (err) {
+                if (NO_SUCH_MODULE.test(messageOf(err))) {
+                    // Extension-backed cache table (e.g. vec0 without sqlite-vec on
+                    // this read-only connection): nothing to compare, cannot fail.
+                    skipped = messageOf(err);
+                }
+                else {
+                    actual = null; // table absent from (or unreadable in) the restored store
+                }
+            }
+            const countOk = skipped !== null || (actual !== null && actual.count === expected.count);
+            const hashOk = skipped !== null || (actual !== null && actual.hash === expected.hash);
+            if (skipped === null && !countOk) {
+                failures.push(`rollback verify: ${expected.table} row count ${actual?.count ?? 'unreadable'} != pre-step ${expected.count}`);
+            }
+            if (skipped === null && !hashOk) {
+                failures.push(`rollback verify: ${expected.table} content hash differs from the pre-step snapshot`);
+            }
+            tables.push({ table: expected.table, expected, actual, countOk, hashOk, skipped });
+        }
+    }
+    finally {
+        restored.close();
+    }
+    return {
+        step: params.step,
+        restored: result.restored,
+        verified: failures.length === 0,
+        undo: result.undo,
+        keptBackupId: result.kept?.backupId ?? null,
+        tables,
+        failures,
+    };
+}
+//# sourceMappingURL=migration-safety.js.map

package/dist/store/migration-safety.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-safety.js","sourceRoot":"","sources":["../../src/store/migration-safety.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AACzF,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAgP1D,4EAA4E;AAC5E,MAAM,CAAC,MAAM,gCAAgC,GAAG,GAAG,CAAC;AAEpD;;GAEG;AACH,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;AACzC,CAAC;AAED;;GAEG;AACH,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,KAAK,EAAE,CAAC;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,KAAK,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC;IACnE,IAAI,KAAK,YAAY,UAAU;QAAE,OAAO,KAAK,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IAClG,OAAO,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS,CAAC,GAA4B;IAC7C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjB,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,OAA0B;IAChD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAI,MAAoB,EAAE,CAAS;IACtD,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAQ,EAAE,CAAC;IACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACzD,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;YAC7E,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAC9B,EAAgB,EAChB,KAAa,EACb,aAAqB,gCAAgC;IAErD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,MAAM,CACjB,EAAE,CAAC,OAAO,CAAC,6BAA6B,MAAM,EAAE,CAAC,CAAC,GAAG,EAAoB,CAAC,CAAC,CAC7E,CAAC;IACF,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;IACtF,CAAC;IACD,IAAI,MAAM,GAAkC,IAAI,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,GACJ,EAAE,CAAC,OAAO,CAAC,0BAA0B,MAAM,iBAAiB,CAAC,CAAC,GAAG,EAGlE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,IAAI,CAAC,CAAC,0CAA0C;IAC3D,CAAC;IACD,IAAI,MAAqC,CAAC;IAC1C,IAAI,IAAa,CAAC;IAClB,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,GAAG,IAAI,CAAC;QACd,IAAI,GAAG,IAAI,CAAC;IACd,CAAC;SAAM,IAAI,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,MAAM,GAAG,MAAM,CAAC;QAChB,IAAI,GAAG,IAAI,CAAC;IACd,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAC1C,IAAI,GAAG,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,iBAAiB,MAAM,kBAAkB,CAAC,CAAC;QACnE,wEAAwE;QACxE,8DAA8D;QAC9D,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC1B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAwC,CAAC;YACnE,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CAAC,iBAAiB,MAAM,EAAE,CAAC,CAAC;QACvD,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,EAAoC,CAAC;QAC9D,KAAK,MAAM,GAAG,IAAI,IAAI;YAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;AAC5F,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CAAC,EAAgB;IACxD,OAAO,EAAE,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,EAAgB;IACtC,OACE,EAAE;SACC,OAAO,CACN,gGAAgG,CACjG;SACA,GAAG,EACP,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAEzC;;;;GAIG;AACH,SAAS,mBAAmB,CAC1B,EAAgB,EAChB,MAAqC,EACrC,UAAkB;IAElB,MAAM,KAAK,GAAG,MAAM,IAAI,cAAc,CAAC,EAAE,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAuB,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACxC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAChD,SAAS;YACX,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAA+B,EAC/B,IAA6B;IAE7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,kEAAkE;QAClE,MAAM,IAAI,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,kDAAkD,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,sBAAsB,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAClF,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,gCAAgC,CAAC;IACvE,MAAM,MAAM,GAAG,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAC7C,MAAM,OAAO,GAA0B,EAAE,CAAC;IAE1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC;QACxC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC;QACrD,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,MAAM,GAA6B,IAAI,CAAC;QAC5C,IAAI,QAAQ,GAAkB,IAAI,CAAC;QACnC,IAAI,MAAM,GAAwB,WAAW,CAAC;QAC9C,MAAM,aAAa,GAAwB,EAAE,CAAC;QAC9C,IAAI,YAAY,GAAuB,EAAE,CAAC;QAC1C,IAAI,gBAAgB,GAAsB,EAAE,CAAC;QAC7C,IAAI,WAAW,GAAa,EAAE,CAAC;QAC/B,IAAI,aAAa,GAAa,EAAE,CAAC;QACjC,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,IAAI,WAAW,GAAuC,MAAM,CAAC;QAE7D,mEAAmE;QACnE,qEAAqE;QACrE,6DAA6D;QAC7D,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACpD,MAAM,YAAY,GAAG,sBAAsB,CACzC,IAAI,CAAC,EAAE,EACP,IAAI,EACJ,mBAAmB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,CAC3F,CAAC;YACF,MAAM,OAAO,GAAG,iBAAiB,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;YAC7D,MAAM,GAAG;gBACP,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,YAAY;gBACZ,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aAC1D,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,QAAQ,CAAC;YAClB,QAAQ,GAAG,2BAA2B,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QACzD,CAAC;QAED,qEAAqE;QACrE,oEAAoE;QACpE,uEAAuE;QACvE,4DAA4D;QAC5D,+CAA+C;QAC/C,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;gBAChC,WAAW,GAAG,aAAa,CAAC,CAAC,gCAAgC;YAC/D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,QAAQ,CAAC;gBAClB,QAAQ,GAAG,2BAA2B,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACzD,CAAC;QACH,CAAC;QAED,wEAAwE;QACxE,uEAAuE;QACvE,kCAAkC;QAClC,IAAI,MAAM,KAAK,WAAW,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YACxD,MAAM,YAAY,GAAG,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,WAAW,CAAC;YACpF,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACzC,MAAM,GAAG,SAAS,CAAC;gBACnB,QAAQ,CAAC,IAAI,CACX,2FAA2F,CAC5F,CAAC;YACJ,CAAC;QACH,CAAC;QAED,wEAAwE;QACxE,6DAA6D;QAC7D,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;gBAC3E,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC;gBACrC,gBAAgB,GAAG,QAAQ,CAAC,OAAO,CAAC;YACtC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,QAAQ,CAAC;gBAClB,QAAQ,GAAG,sCAAsC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACpE,CAAC;QACH,CAAC;QAED,2CAA2C;QAC3C,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,CAAC,OAAe,EAAQ,EAAE;gBACpC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;YAC5C,CAAC,CAAC;YACF,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,QAAQ,CAAC;gBAClB,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,wEAAwE;QACxE,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,YAAY,GAAG,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAClD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;gBAChE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;gBACpD,WAAW,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;gBACvE,aAAa,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;gBACzE,mEAAmE;gBACnE,oEAAoE;gBACpE,iEAAiE;gBACjE,8DAA8D;gBAC9D,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;oBACvC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;wBACnC,QAAQ,CAAC,IAAI,CACX,SAAS,OAAO,CAAC,KAAK,oCAAoC,OAAO,CAAC,MAAM,2BAA2B,CACpG,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;oBAClC,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAC9D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;wBAClC,QAAQ,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,KAAK,0BAA0B,CAAC,CAAC;wBAC/D,aAAa,CAAC,IAAI,CAAC;4BACjB,KAAK,EAAE,MAAM,CAAC,KAAK;4BACnB,MAAM;4BACN,KAAK,EAAE,IAAI;4BACX,aAAa;4BACb,OAAO,EAAE,KAAK;4BACd,MAAM,EAAE,IAAI;yBACb,CAAC,CAAC;wBACH,SAAS;oBACX,CAAC;oBACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;oBACtE,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,GAAG,aAAa,CAAC;oBAC7D,iEAAiE;oBACjE,iEAAiE;oBACjE,wCAAwC;oBACxC,MAAM,WAAW,GAAG,aAAa,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBACvE,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;oBAC/D,IAAI,CAAC,OAAO,EAAE,CAAC;wBACb,QAAQ,CAAC,IAAI,CACX,SAAS,MAAM,CAAC,KAAK,eAAe,KAAK,CAAC,KAAK,OAAO,MAAM,CAAC,KAAK,MAAM,aAAa,iCAAiC,CACvH,CAAC;oBACJ,CAAC;oBACD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;wBACrB,QAAQ,CAAC,IAAI,CACX,SAAS,MAAM,CAAC,KAAK,0DAA0D,CAChF,CAAC;oBACJ,CAAC;oBACD,aAAa,CAAC,IAAI,CAAC;wBACjB,KAAK,EAAE,MAAM,CAAC,KAAK;wBACnB,MAAM;wBACN,KAAK;wBACL,aAAa;wBACb,OAAO;wBACP,MAAM;qBACP,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC7B,QAAQ,CAAC,IAAI,CAAC,+BAA+B,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC3E,CAAC;gBACD,kEAAkE;gBAClE,qEAAqE;gBACrE,iEAAiE;gBACjE,iEAAiE;gBACjE,sBAAsB;gBACtB,KAAK,MAAM,UAAU,IAAI,gBAAgB,EAAE,CAAC;oBAC1C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;wBACtC,QAAQ,CAAC,IAAI,CACX,SAAS,UAAU,CAAC,KAAK,6CAA6C,UAAU,CAAC,MAAM,GAAG,CAC3F,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;oBACrB,QAAQ,CAAC,IAAI,CACX,qCAAqC,YAAY,8BAA8B,CAChF,CAAC;gBACJ,CAAC;gBACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;oBAAE,MAAM,GAAG,QAAQ,CAAC;YAC7C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,QAAQ,CAAC;gBAClB,QAAQ,GAAG,wBAAwB,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACtD,CAAC;QACH,CAAC;QAED,wEAAwE;QACxE,wEAAwE;QACxE,sEAAsE;QACtE,kCAAkC;QAClC,IAAI,WAAW,KAAK,aAAa,EAAE,CAAC;YAClC,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBACH,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBACvB,WAAW,GAAG,WAAW,CAAC;gBAC5B,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,CAAC;wBACH,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;oBAC3B,CAAC;oBAAC,MAAM,CAAC;wBACP,sDAAsD;oBACxD,CAAC;oBACD,MAAM,GAAG,QAAQ,CAAC;oBAClB,IAAI,QAAQ,KAAK,IAAI;wBAAE,QAAQ,GAAG,kBAAkB,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvE,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC;oBACH,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC3B,CAAC;gBAAC,MAAM,CAAC;oBACP,gEAAgE;gBAClE,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAwB;YAClC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW,KAAK,IAAI;YACtC,MAAM;YACN,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;YAClC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU;YACnC,MAAM;YACN,MAAM,EAAE,aAAa;YACrB,WAAW;YACX,aAAa;YACb,oBAAoB,EAAE,YAAY;YAClC,gBAAgB;YAChB,WAAW;YACX,QAAQ;YACR,QAAQ;SACT,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,IAAI,CAAC,YAAY,EAAE,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CACT,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,IAAI,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,EACrF,gDAAgD,CACjD,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CACT,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,EAC5D,qGAAqG,CACtG,CAAC;YACF,OAAO;gBACL,MAAM,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;gBACnD,KAAK,EAAE,OAAO;gBACd,UAAU,EAAE,IAAI,CAAC,IAAI;gBACrB,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,IAAI,aAAa;aAClD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAClF,CAAC;AA6DD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAA+B;IAE/B,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,gCAAgC,CAAC;IACzE,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC;QACxC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY;QACpC,GAAG,CAAC,MAAM,CAAC,iBAAiB,KAAK,SAAS;YACxC,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE;YACjD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,MAAM,GAA0B,EAAE,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACrC,IAAI,MAAM,GAA4B,IAAI,CAAC;YAC3C,IAAI,OAAO,GAAkB,IAAI,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;YACrE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBACxC,gEAAgE;oBAChE,+DAA+D;oBAC/D,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;gBAC3B,CAAC;qBAAM,CAAC;oBACN,MAAM,GAAG,IAAI,CAAC,CAAC,0DAA0D;gBAC3E,CAAC;YACH,CAAC;YACD,MAAM,OAAO,GAAG,OAAO,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC;YACzF,MAAM,MAAM,GAAG,OAAO,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAC,CAAC;YACtF,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjC,QAAQ,CAAC,IAAI,CACX,oBAAoB,QAAQ,CAAC,KAAK,cAAc,MAAM,EAAE,KAAK,IAAI,YAAY,gBAAgB,QAAQ,CAAC,KAAK,EAAE,CAC9G,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChC,QAAQ,CAAC,IAAI,CACX,oBAAoB,QAAQ,CAAC,KAAK,kDAAkD,CACrF,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;QAC/B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,YAAY,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,IAAI;QAC3C,MAAM;QACN,QAAQ;KACT,CAAC;AACJ,CAAC"}

package/dist/store/portable-bundle.d.ts

@@ -33,6 +33,7 @@
  */
 import type { PortableBundleManifest, PortableBundleScope, PortableDatabaseEntry, PortableExportResult, PortableImportResult, PortableSectionBase, PortableSkippedProject, PortableUnmigratedLegacyReport } from '@cleocode/contracts';
 import { type SectionRules } from './portable-bundle-scan.js';
+import { type SealedCredentialCell } from './vault-manifest.js';
 /** Symbolic error codes raised by the portable bundle export/import. */
 export type PortableBundleErrorCode = 'E_PRIMARY_STORE_MISSING' | 'E_PRIMARY_STORE_UNREADABLE' | 'E_NO_PROJECT' | 'E_REGISTRY_UNREADABLE' | 'E_PASSPHRASE_REQUIRED' | 'E_BUNDLE_DECRYPT' | 'E_BUNDLE_FORMAT' | 'E_BUNDLE_INTEGRITY' | 'E_DATA_EXISTS' | 'E_TARGET_AMBIGUOUS' | 'E_RESTORE_MISMATCH' | 'E_REDACTION_FAILED' | 'E_PROJECT_STORE_UNAVAILABLE';
 /**
@@ -117,6 +118,13 @@ export interface ExportPortableBundleInput {
      * cloud vault leaves tracked files to git (T13019). Project scope only.
      */
     gitTrackedFiles?: ReadonlySet<string>;
+    /**
+     * Seal the primary store snapshot's credential cells before they are
+     * cleared; the sealed cells are written to the snapshot's
+     * sealed-credentials table (`vault-manifest.ts`). The cloud vault seals under the
+     * account key, so a joining device gets usable credentials (T13530).
+     */
+    sealCredentials?: (snapshotPath: string) => Promise<readonly SealedCredentialCell[]>;
 }
 /** A registered project row read from the global registry snapshot. */
 interface RegistryRow {

package/dist/store/portable-bundle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"portable-bundle.d.ts","sourceRoot":"","sources":["../../src/store/portable-bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAQH,OAAO,KAAK,EAGV,sBAAsB,EACtB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EAEpB,oBAAoB,EAEpB,mBAAmB,EACnB,sBAAsB,EAEtB,8BAA8B,EAC/B,MAAM,qBAAqB,CAAC;AAe7B,OAAO,EAaL,KAAK,YAAY,EAIlB,MAAM,2BAA2B,CAAC;AAYnC,wEAAwE;AACxE,MAAM,MAAM,uBAAuB,GAC/B,yBAAyB,GACzB,4BAA4B,GAC5B,cAAc,GACd,uBAAuB,GACvB,uBAAuB,GACvB,kBAAkB,GAClB,iBAAiB,GACjB,oBAAoB,GACpB,eAAe,GACf,oBAAoB,GACpB,oBAAoB,GACpB,oBAAoB,GACpB,6BAA6B,CAAC;AAElC;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAcxF,CAAC;AAEF;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;aAU1B,IAAI,EAAE,uBAAuB;aAE7B,OAAO,CAAC,EAAE,oBAAoB;IAXhD,iCAAiC;IACjC,SAAgB,QAAQ,EAAE,MAAM,CAAC;IAEjC;;;;OAIG;gBAEe,IAAI,EAAE,uBAAuB,EAC7C,OAAO,EAAE,MAAM,EACC,OAAO,CAAC,EAAE,oBAAoB,YAAA;CAMjD;AAMD,8CAA8C;AAC9C,MAAM,WAAW,yBAAyB;IACxC;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,oBAAoB;IACpB,KAAK,EAAE,mBAAmB,CAAC;IAC3B,qDAAqD;IACrD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0BAA0B;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+FAA+F;IAC/F,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IAC1C;;;;OAIG;IACH,oBAAoB,CAAC,EAAE;QACrB,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACxC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;KAC1C,CAAC;IACF,mEAAmE;IACnE,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IAC3D;;;;;OAKG;IACH,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC;;;;OAIG;IACH,eAAe,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACvC;AAMD,uEAAuE;AACvE,UAAU,WAAW;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAQ1D;AAUD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,SAAS,WAAW,EAAE,EAC5B,QAAQ,EAAE,MAAM,EAChB,UAAU,GAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAA2B,GAC3D;IAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;IAAC,OAAO,EAAE,sBAAsB,EAAE,CAAA;CAAE,CAwChE;AAyRD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,SAAS,qBAAqB,EAAE,GAC1C,8BAA8B,CAsBhC;AAmFD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,sBAAsB,GAAG,MAAM,CAM5E;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,oBAAoB,CAAC,CAyL/B;AAkDD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,KAAK,CAAC,EAAE,yBAAyB,CAAC,sBAAsB,CAAC,GACxD,YAAY,CAOd;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,sBAAsB,GAAG,mBAAmB,EAAE,CAQnF"}
+{"version":3,"file":"portable-bundle.d.ts","sourceRoot":"","sources":["../../src/store/portable-bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAQH,OAAO,KAAK,EAGV,sBAAsB,EACtB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EAEpB,oBAAoB,EAEpB,mBAAmB,EACnB,sBAAsB,EAEtB,8BAA8B,EAC/B,MAAM,qBAAqB,CAAC;AAe7B,OAAO,EAaL,KAAK,YAAY,EAIlB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,KAAK,oBAAoB,EAA0B,MAAM,qBAAqB,CAAC;AAYxF,wEAAwE;AACxE,MAAM,MAAM,uBAAuB,GAC/B,yBAAyB,GACzB,4BAA4B,GAC5B,cAAc,GACd,uBAAuB,GACvB,uBAAuB,GACvB,kBAAkB,GAClB,iBAAiB,GACjB,oBAAoB,GACpB,eAAe,GACf,oBAAoB,GACpB,oBAAoB,GACpB,oBAAoB,GACpB,6BAA6B,CAAC;AAElC;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAcxF,CAAC;AAEF;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;aAU1B,IAAI,EAAE,uBAAuB;aAE7B,OAAO,CAAC,EAAE,oBAAoB;IAXhD,iCAAiC;IACjC,SAAgB,QAAQ,EAAE,MAAM,CAAC;IAEjC;;;;OAIG;gBAEe,IAAI,EAAE,uBAAuB,EAC7C,OAAO,EAAE,MAAM,EACC,OAAO,CAAC,EAAE,oBAAoB,YAAA;CAMjD;AAMD,8CAA8C;AAC9C,MAAM,WAAW,yBAAyB;IACxC;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,oBAAoB;IACpB,KAAK,EAAE,mBAAmB,CAAC;IAC3B,qDAAqD;IACrD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0BAA0B;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+FAA+F;IAC/F,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IAC1C;;;;OAIG;IACH,oBAAoB,CAAC,EAAE;QACrB,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACxC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;KAC1C,CAAC;IACF,mEAAmE;IACnE,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IAC3D;;;;;OAKG;IACH,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC;;;;OAIG;IACH,eAAe,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,oBAAoB,EAAE,CAAC,CAAC;CACtF;AAMD,uEAAuE;AACvE,UAAU,WAAW;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAQ1D;AAUD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,SAAS,WAAW,EAAE,EAC5B,QAAQ,EAAE,MAAM,EAChB,UAAU,GAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAA2B,GAC3D;IAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;IAAC,OAAO,EAAE,sBAAsB,EAAE,CAAA;CAAE,CAwChE;AA+RD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,SAAS,qBAAqB,EAAE,GAC1C,8BAA8B,CAsBhC;AAmFD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,sBAAsB,GAAG,MAAM,CAM5E;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,oBAAoB,CAAC,CA0L/B;AAkDD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,KAAK,CAAC,EAAE,yBAAyB,CAAC,sBAAsB,CAAC,GACxD,YAAY,CAOd;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,sBAAsB,GAAG,mBAAmB,EAAE,CAQnF"}