@cotal-ai/auth 0.16.0 → 0.18.0

package/dist/auth-admin.d.ts

@@ -1,9 +1,12 @@
 import { type RetirementDeps } from "./retirement-barrier.js";
 import { type LifecycleRegistry } from "./lifecycle-registry.js";
-/** The LISTENER profile (SPEC 13.9 "Auth control rail" row): serve + bounded replies on the
- *  auth-admin control subtree, plus the ONE leader-served lease read the holder-check performs.
+/** The LISTENER profile (SPEC 13.9 "Auth endpoint rail" row): serve + bounded replies on the auth
+ *  endpoint's class rail, plus the ONE leader-served gate read the authz check performs.
  *  No store writes, no consumer authority, no scanner reach. */
-export declare function authAdminListenerGrants(space: string, connId: string): {
+export declare function authAdminListenerGrants(space: string, connId: string, responder: {
+    instanceId: string;
+    epoch: number;
+}): {
     publish: string[];
     subscribe: string[];
 };

package/dist/auth-admin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-admin.d.ts","sourceRoot":"","sources":["../src/auth-admin.ts"],"names":[],"mappings":"AAmDA,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAA8C,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAK7G;;gEAEgE;AAChE,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAejH;AA8BD,MAAM,WAAW,iBAAiB;IAChC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,GAAG,EAAE,iBAAiB,CAAC;IACvB,UAAU,EAAE,cAAc,CAAC;IAC3B,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAsI7B"}
+{"version":3,"file":"auth-admin.d.ts","sourceRoot":"","sources":["../src/auth-admin.ts"],"names":[],"mappings":"AAuEA,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAA8C,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAW7G;;gEAEgE;AAChE,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,SAAS,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAyB5C;AA2DD,MAAM,WAAW,iBAAiB;IAChC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,GAAG,EAAE,iBAAiB,CAAC;IACvB,UAAU,EAAE,cAAc,CAAC;IAC3B,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAuL7B"}

package/dist/auth-admin.js

@@ -1,79 +1,84 @@
-/**
- * The AUTH service's CONTROL RAIL listener (#29 piece 3, SPEC 13.2 `CONTROL_AUTH_ADMIN`): the
- * GENERIC "retire a lifecycle (owner, actor, lifecycleUid)" operation, served by the auth plane
- * itself — the despawn→retirement trigger's serve side, and the D5 split's other half
- * (retirement is the AUTH plane's operation; it never rides the DELIVERY daemon's rail).
- *
- * AUTHZ (the panel-confirmed RAIL-TIME rule, never mint-only):
- *  - Caller attribution is SUBJECT-derived and broker-enforced: the request subject is
- *    `ctl.auth-admin.<owner>.<actor>`, and only a credential minted with THAT principal's
- *    request-publish grant can reach it ({@link retirementRequesterGrants}); the body's claims
- *    never authorize (the reply-rail discipline).
- *  - The SPACE-MANAGER LEASE holder-check runs FRESH per request: a leader-served
- *    `STREAM.MSG.GET` read of the ONE `lease` key in the manager bucket, requiring
- *    `lease.holder == principalKey(subjectOwner, subjectActor).key` (the lease holder IS the
- *    manager endpoint's principal dot-form). This closes the post-lease-loss window: a manager
- *    that lost its lease after minting a requester credential is refused AT THE RAIL. Absent
- *    lease (TTL-expired, no manager) refuses fail-closed — never guesses.
- *  - The GENERIC surface never names a caller class (a manager despawn is ONE caller); the
- *    lease check is this service's serve-time authz, not subject grammar.
- *
- * IDEMPOTENCE (the confirmed four-outcome table, surfaced as OPERATOR results): already-retired
- * (uid match) → success; a frozen gate under the SAME opId → the barrier resumes it; a FOREIGN
- * operation holding the gate → refuse naming the operation; a different current uid → refuse
- * (stale trigger). The requester sends a STABLE opId across retries, so an epCall retry never
- * mints a second operation.
- *
- * UX (the piece-3 faces): every refusal is WHAT/WHY/NEXT in operator vocabulary — the lease-loss
- * refusal states the despawn was a FULL NO-OP (the target is unchanged and still running,
- * nothing was applied) with `cotal supervise` → retry as the NEXT; the vocabulary bridge
- * ("despawn started this agent's retirement") lives at the CLI surface that renders these.
- *
- * SEAL COMPOSITION (critic's three checks): the listener holds NO scanner/plane authority — the
- * retirement runs through the injected {@link RetirementDeps}, whose drain rides the plane's ONE
- * sealed records scanner exactly like the boot resume; the lease read is a leader read, no
- * consumer-create anywhere; the requester credential is request + reply-inbox ONLY.
- */
-import { jetstreamManager } from "@nats-io/jetstream";
-import { CONTROL_AUTH_ADMIN, EpEnvelopeError, MANAGER_LEASE_KEY, assertBoundedOwner, assertLifecycleToken, managerBucket, principalKey, retirementFrontierStreams, spacePrefix, } from "@cotal-ai/core";
+import { Kvm } from "@nats-io/kv";
+import { AUTH_ENDPOINT, EP_CMD_RETIRE_LIFECYCLE, EpEnvelopeError, assertLifecycleToken, deriveReplySubject, endpointToken, epAuthBucket, epClassQueueGroup, epResponderReplyPattern, assertCommandToken, spacePrefix, mintLifecycleUid, parseEpSubject, principalKey, retirementFrontierStreams, serveIssuanceGateKv, } from "@cotal-ai/core";
 import { openAuthorityClient } from "./authority-client.js";
 import { runAgentRetirementBarrier } from "./retirement-barrier.js";
 import { observeGate, readLifecycleHeadForOperation } from "./lifecycle-registry.js";
 const enc = new TextEncoder();
 const dec = new TextDecoder();
-/** The LISTENER profile (SPEC 13.9 "Auth control rail" row): serve + bounded replies on the
- *  auth-admin control subtree, plus the ONE leader-served lease read the holder-check performs.
+/** The auth endpoint's one class rail, per-command (never a cross-command `>`): the grant and the
+ *  runtime subscription are built from THIS, so a widened subscription cannot outrun its grant. */
+function authClassRail(space) {
+    return `${spacePrefix(space)}.ep.one.${endpointToken(AUTH_ENDPOINT)}.${assertCommandToken(EP_CMD_RETIRE_LIFECYCLE)}.>`;
+}
+/** The LISTENER profile (SPEC 13.9 "Auth endpoint rail" row): serve + bounded replies on the auth
+ *  endpoint's class rail, plus the ONE leader-served gate read the authz check performs.
  *  No store writes, no consumer authority, no scanner reach. */
-export function authAdminListenerGrants(space, connId) {
+export function authAdminListenerGrants(space, connId, responder) {
     return {
         publish: [
-            // REPLIES ONLY. The handler only ever `msg.respond`s to `<request-subject>.reply.…` (boundReply,
-            // below), so the listener never needs to publish a bare REQUEST subject. Granting the request
-            // subtree (`…auth-admin.>`) would let a compromised listener credential self-publish a
-            // `retireLifecycle` as the lease holder and pass its own subject-derived lease check (self-forge);
-            // scoping to `*.*.reply.>` closes that. The requester credential (provision.ts) is already
-            // broker-bound to publish only its OWN `<owner>.<actor>` request subject.
-            `${spacePrefix(space)}.ctl.${CONTROL_AUTH_ADMIN}.*.*.reply.>`,
+            // REPLIES ONLY, and on the REPLY PLANE — which is a stronger statement than the `ctl` rail
+            // could make. There, request and reply shared one subtree, so the grant had to carve replies
+            // out of it by shape (`*.*.reply.>`) to stop a compromised listener self-publishing a request
+            // as the lease holder and passing its own subject-derived check (self-forge). Here the planes
+            // are DISJOINT: `ep.reply.…` cannot express a request subject at all, so the self-forge is
+            // closed by the grammar rather than by a pattern. The instance triple and epoch are pinned;
+            // only the caller suffixes span (addressing is confined by nonce possession, §13.2).
+            epResponderReplyPattern(space, AUTH_ENDPOINT, responder.instanceId, responder.epoch),
             "$JS.API.INFO",
-            `$JS.API.STREAM.MSG.GET.KV_${managerBucket(space)}`,
+            // The ONE leader-served read the authz check performs: the serve-issuance GATE, a point-get
+            // of `epgate.<endpoint>.<instanceId>` proving the requesting manager instance's serve grant
+            // is CURRENT and that the row belongs to the SUBJECT-derived caller principal. No consumer
+            // authority, no store writes.
+            `$JS.API.STREAM.MSG.GET.KV_${epAuthBucket(space)}`,
         ],
-        subscribe: [`${spacePrefix(space)}.ctl.${CONTROL_AUTH_ADMIN}.*.*`, `_INBOX_${connId}.>`],
+        // The class rail, QUEUE-QUALIFIED and per-command (§13.9, `endpoint-grants.ts:293-300`): the
+        // NATS `"<subject> <queue>"` grant form. A PLAIN subject row would let this credential
+        // plain-subscribe the class rail and observe EVERY request's nonce — the property the queue
+        // qualification exists to protect. The runtime's queue subscription is not a substitute: it
+        // constrains what this process does, not what the credential permits.
+        subscribe: [`${authClassRail(space)} ${epClassQueueGroup(AUTH_ENDPOINT)}`, `_INBOX_${connId}.>`],
     };
 }
+const RETIRE_ARG_KEYS = ["opId", "serveEndpoint", "serveInstanceId", "serveEpoch"];
+/** The request id a reply MUST echo. This is the MINIMAL correctness guard from the full
+ *  `EndpointRequest`/`EndpointReply` envelope, which this rail does NOT yet carry (named residual:
+ *  the rail moved to `ep` SUBJECTS while still exchanging the ctl-era `{op,args}` / `{ok,data,error}`
+ *  bodies, and SPEC 1421 states those envelopes are DELETED). Without the echo, a caller binding a
+ *  reply on (endpoint, nonce) alone can accept a malformed or WRONG-ID `{ok:true}` and clear a
+ *  retirement hold on it. The full envelope migration is its own cut; this edge is not deferrable. */
+function parseRequestId(raw) {
+    if (typeof raw !== "string" || !/^[A-Za-z0-9_-]{1,64}$/.test(raw))
+        throw new EpEnvelopeError("failed-precondition", `the request requires an "id" ([A-Za-z0-9_-]{1,64}); the reply echoes it so a caller cannot accept another request's answer`);
+    return raw;
+}
 function parseRetireArgs(raw) {
+    const shape = "{ opId, serveEndpoint, serveInstanceId, serveEpoch }";
     if (raw === null || typeof raw !== "object")
-        throw new EpEnvelopeError("failed-precondition", "retireLifecycle requires args { owner, actor, lifecycleUid, opId }");
+        throw new EpEnvelopeError("failed-precondition", `retireLifecycle requires args ${shape}`);
     const a = raw;
+    // The TARGET (owner, actor, lifecycleUid) is no longer an argument: `handle` mode carries it in
+    // the subject, broker-enforced and grant-pinned, so the handler reads it from there. Sending it
+    // in the body is now a CLOSED-SHAPE violation rather than a redundancy to reconcile — which
+    // removes the whole body-vs-subject mismatch class instead of managing it.
     for (const k of Object.keys(a))
-        if (!["owner", "actor", "lifecycleUid", "opId"].includes(k))
-            throw new EpEnvelopeError("failed-precondition", `retireLifecycle args carry the unknown field "${k}" (closed shape)`);
-    if (typeof a.owner !== "string" || typeof a.actor !== "string" || typeof a.lifecycleUid !== "string" || typeof a.opId !== "string")
-        throw new EpEnvelopeError("failed-precondition", "retireLifecycle requires string args { owner, actor, lifecycleUid, opId }");
+        if (!RETIRE_ARG_KEYS.includes(k))
+            throw new EpEnvelopeError("failed-precondition", `retireLifecycle args carry the unknown field "${k}" (closed shape; the target rides the SUBJECT)`);
+    if (typeof a.opId !== "string" ||
+        typeof a.serveEndpoint !== "string" || typeof a.serveInstanceId !== "string" ||
+        typeof a.serveEpoch !== "number" || !Number.isInteger(a.serveEpoch) || a.serveEpoch < 0)
+        throw new EpEnvelopeError("failed-precondition", `retireLifecycle requires args ${shape} (serveEpoch a non-negative integer)`);
     return {
-        owner: assertBoundedOwner(a.owner, "owner"),
-        actor: assertBoundedOwner(a.actor, "actor"),
-        lifecycleUid: assertLifecycleToken(a.lifecycleUid, "lifecycleUid"),
+        // opId is OPERATION IDENTITY, not an authz input: it is the stable per-lifecycle id that makes
+        // a retry, a same-name-spawn nudge, and a boot resume converge on ONE operation. It has no
+        // subject counterpart to be cross-checked against (the subject's nonce varies per request,
+        // which is the opposite property), and it authorizes nothing.
         opId: assertLifecycleToken(a.opId, "opId"),
+        // LOOKUP COORDINATES, not authz inputs: they select WHICH gate row to read. The row they
+        // select must then survive the principal cross-check below, so naming a foreign row buys a
+        // refusal, never an authorization.
+        serveEndpoint: endpointToken(a.serveEndpoint),
+        serveInstanceId: assertLifecycleToken(a.serveInstanceId, "serveInstanceId"),
+        serveEpoch: a.serveEpoch,
     };
 }
 /**
@@ -83,45 +88,75 @@ function parseRetireArgs(raw) {
  */
 export async function openAuthAdminListener(opts) {
     const { space, log } = opts;
+    // The auth plane's responder identity. The plane is SINGLE per space by construction (§13.13:
+    // at most one authority plane holds the sealed scanners, by a broker-visible claim), so the
+    // instance id is per-process and the epoch is fixed: there is no successor to fence and no
+    // registration whose epoch could advance beneath us. It exists because the reply plane pins the
+    // responder triple in the grant; callers read replies through a filter that wildcards these
+    // positions (`ep.reply.*.*.*.<cO>.<cA>.<cUid>.*`), so they never need to learn it.
+    const responder = { instanceId: mintLifecycleUid(), epoch: 0 };
     const client = await openAuthorityClient({
         server: opts.server, space, dataAccount: opts.dataAccount,
         label: `cotal:auth-admin:${space}`,
-        grants: (id) => authAdminListenerGrants(space, id),
+        grants: (id) => authAdminListenerGrants(space, id, responder),
         log,
     });
-    let jsm;
+    let epAuthKv;
     try {
-        jsm = await jetstreamManager(client.nc);
+        // Bind the endpoint-auth bucket once for the 3b-3 serve-issuance-gate holder check (point-get,
+        // no consumer). Lazy bind (kvm.open) — the space's stores are pre-created at `cotal up`.
+        epAuthKv = await new Kvm(client.nc).open(epAuthBucket(space));
     }
     catch (e) {
         await client.close();
         throw e;
     }
-    const prefix = `${spacePrefix(space)}.ctl.${CONTROL_AUTH_ADMIN}.`;
-    const sub = client.nc.subscribe(`${prefix}*.*`, {
+    const sub = client.nc.subscribe(authClassRail(space), {
+        queue: epClassQueueGroup(AUTH_ENDPOINT),
         callback: (err, msg) => {
             if (err)
                 return;
             void (async () => {
-                // boundReply (the serveControl discipline): the reply target must live under the
-                // SENDER'S OWN request subject — the listener holds a subtree-wide reply grant, so a
-                // caller-selected foreign reply target is refused here, never published to.
-                if (msg.reply === undefined || !msg.reply.startsWith(`${msg.subject}.reply.`)) {
-                    log(`auth-admin: dropped a request on ${msg.subject} with an unbound reply target (${msg.reply ?? "none"})`);
+                // The reply target is DERIVED from the parsed request, never taken from the wire. On the
+                // `ctl` rail this was a guard: the listener held a subtree-wide reply grant, so a
+                // caller-selected foreign reply target had to be refused by inspecting `msg.reply`. Here
+                // there is no argument through which a payload-supplied reply target could arrive — the
+                // guard became structural, so the check it replaced cannot be forgotten.
+                const parsed = parseEpSubject(msg.subject);
+                if (parsed === null || parsed.plane !== "request") {
+                    // null = MUST NOT handle (§13.2). Never a reply: an unparseable subject has no
+                    // derivable reply target, and answering one would be the confused deputy itself.
+                    log(`auth-admin: dropped an unparseable request subject ${msg.subject}`);
                     return;
                 }
+                const request = parsed;
+                // The echoed id is stamped HERE, outside the handler, so EVERY reply carries it - including
+                // the thrown-error path. A reply the caller cannot bind to its own request is one it must
+                // ignore, so an unstamped error reply would silently become a timeout instead of a refusal.
+                let echoId;
+                try {
+                    echoId = parseRequestId(JSON.parse(dec.decode(msg.data)).id);
+                }
+                catch {
+                    echoId = undefined;
+                }
                 let reply;
                 try {
-                    reply = await handle(msg.subject.slice(prefix.length), msg.data);
+                    reply = await handle(request, msg.data);
                 }
                 catch (e) {
                     reply = { ok: false, error: e instanceof Error ? e.message : String(e) };
                 }
+                // A request with no usable id gets an unbindable reply BY CONSTRUCTION: the caller requires
+                // the echo, so it will refuse this answer rather than accept an unattributable one.
+                if (echoId !== undefined)
+                    reply.id = echoId;
+                const target = deriveReplySubject(space, request, responder);
                 try {
-                    msg.respond(enc.encode(JSON.stringify(reply)));
+                    client.nc.publish(target, enc.encode(JSON.stringify(reply)));
                 }
                 catch (e) {
-                    log(`auth-admin: reply publish failed on ${msg.subject}: ${e instanceof Error ? e.message : String(e)}`);
+                    log(`auth-admin: reply publish failed on ${target}: ${e instanceof Error ? e.message : String(e)}`);
                 }
             })();
         },
@@ -139,11 +174,17 @@ export async function openAuthAdminListener(opts) {
     // same-opId join whose coordinates differ is REFUSED as a full no-op; only a coordinate-IDENTICAL
     // request (the intended nudge/retry) joins the in-flight barrier.
     const barrierFlight = new Map();
-    const handle = async (principalTail, body) => {
-        const tokens = principalTail.split(".");
-        if (tokens.length !== 2)
-            return { ok: false, error: `auth-admin: the request subject must carry exactly <owner>.<actor>` };
-        const requester = principalKey(tokens[0], tokens[1]).key;
+    const handle = async (request, body) => {
+        if (request.command !== EP_CMD_RETIRE_LIFECYCLE)
+            return { ok: false, error: `command "${request.command}" not supported on the auth endpoint` };
+        // The TARGET comes from the subject (`handle` mode, arity 3) — broker-enforced and
+        // grant-pinned, so it is not a claim the caller can vary independently of what it may publish.
+        if (request.target === null || request.target.mode !== "handle")
+            return { ok: false, error: `retire-lifecycle requires a handle target (<owner>.<actor>.<lifecycleUid>) in the subject` };
+        const target = { owner: request.target.tOwner, actor: request.target.tActor, lifecycleUid: request.target.tUid };
+        // The CALLER principal likewise comes from the subject, and is now an AUTHZ INPUT (the
+        // cross-check below), not just the audit line it was on the `ctl` rail.
+        const requester = principalKey(request.caller.owner, request.caller.actor).key;
         let req;
         try {
             req = JSON.parse(dec.decode(body));
@@ -154,44 +195,61 @@ export async function openAuthAdminListener(opts) {
         if (req.op !== "retireLifecycle")
             return { ok: false, error: `op "${String(req.op)}" not supported on the auth admin service` };
         const args = parseRetireArgs(req.args);
-        // THE RAIL-TIME LEASE RE-CHECK (fresh, leader-served, fail-closed).
-        let lease;
+        // THE RAIL-TIME REGISTRATION RE-CHECK (fresh, leader-served, fail-closed) — P2 item 3 (3b-3):
+        // the requesting manager instance's SERVE GRANT must be current. Read the serve-issuance gate
+        // (registration-record-derived, REPLACING the old name-derived manager-lease holder check): the
+        // requester declares its (serveEndpoint, serveInstanceId, serveEpoch); an absent/retired gate means
+        // no registered instance, and a gate whose current processEpoch moved past the declared one means
+        // the requester was SUPERSEDED (a deposed predecessor after a restart) — refused as a full no-op.
+        // The row this NAMES must also BELONG to the subject-derived caller principal (the cross-check
+        // below). Before #350 it did not have to: every instance of one space shares the manager
+        // principal, and the two-token `ctl` subject could not express the caller beyond that alias, so
+        // any current instance's gate authorized. That is no longer true, and the coordinates above no
+        // longer authorize — they only select which row to read.
+        // ALIAS-LEVEL, not incarnation-level: a DIFFERENT INSTANCE OF THE SAME PRINCIPAL still passes
+        // (the gate is keyed by the persisted instanceId and its row carries no lifecycle uid). What is
+        // refused is a row belonging to a DIFFERENT PRINCIPAL.
+        let serveGate;
         try {
-            const m = await jsm.streams.getMessage(`KV_${managerBucket(space)}`, { last_by_subj: `$KV.${managerBucket(space)}.${MANAGER_LEASE_KEY}` });
-            // A DEL/PURGE marker (a gracefully-stopped manager DELETES its lease) and a TTL-expunged
-            // row both read ABSENT — never parsed, never a crash-shaped refusal.
-            const op = m?.header?.get("KV-Operation");
-            lease = m === null || op === "DEL" || op === "PURGE" || m.data.length === 0
-                ? undefined
-                : JSON.parse(dec.decode(m.data));
+            serveGate = await serveIssuanceGateKv(epAuthKv, space, { endpoint: args.serveEndpoint, instanceId: args.serveInstanceId }).observe();
         }
         catch (e) {
-            const code = e?.code;
-            if (code !== 10037) // 10037 = no message: a genuinely absent lease, handled below
-                return { ok: false, error: `the retirement request cannot be authorized right now: the space-manager lease could not be read (${e instanceof Error ? e.message : String(e)}). Nothing was applied - the agent is unchanged. NEXT: check the broker and retry the despawn.` };
+            return { ok: false, error: `the retirement request cannot be authorized right now: the manager serve-issuance gate could not be read (${e instanceof Error ? e.message : String(e)}). Nothing was applied - the agent is unchanged. NEXT: check the broker and retry the despawn.` };
         }
-        if (lease === undefined || typeof lease.holder !== "string")
-            return { ok: false, error: `no manager currently holds the space lease, so nothing may retire agents in "${space}". The despawn was a FULL no-op - the agent is unchanged and still running. NEXT: start or recover the manager (\`cotal supervise\`), then retry the despawn.` };
-        if (lease.holder !== requester)
-            return { ok: false, error: `the requesting manager lost the space lease (it is held by ${lease.holder}), so this despawn was REFUSED as a FULL no-op - the agent is unchanged and still running, nothing was torn down. NEXT: recover the manager (\`cotal supervise\`), then retry the despawn under the current lease holder.` };
+        if (serveGate === null || serveGate.state === "retired")
+            return { ok: false, error: `no manager instance currently holds a serve registration for "${space}" (instance ${args.serveInstanceId} is ${serveGate === null ? "unregistered" : "retired"}), so nothing may retire agents. The despawn was a FULL no-op - the agent is unchanged and still running. NEXT: start or recover the manager (\`cotal supervise\`), then retry the despawn.` };
+        // THE PRINCIPAL CROSS-CHECK (#350). The two serve coordinates above only SELECTED this row;
+        // they do not authorize. The row must belong to the SUBJECT-derived caller principal — which
+        // the broker enforced when it admitted the publish. Without this, naming any currently
+        // registered instance's row authorizes the caller, which is what the `ctl` rail did: its
+        // two-token subject could not express the caller beyond an alias, so there was nothing to
+        // compare the row against.
+        // ALIAS-LEVEL, not incarnation-level: the gate is keyed by the PERSISTED instanceId and its
+        // schema carries no uid, while the caller triple's uid is per-process. A same-principal zombie
+        // predecessor holding the current epoch value still passes. Closing that needs a gate-row
+        // schema change; it is deliberately not in this cut.
+        if (serveGate.principal !== requester)
+            return { ok: false, error: `the retirement request was REFUSED: the serve registration named (${args.serveEndpoint}/${args.serveInstanceId}) belongs to ${serveGate.principal}, not to the requesting principal ${requester}. A caller may only be authorized by its OWN serve registration. The despawn was a FULL no-op - the agent is unchanged and still running. NEXT: name your OWN principal's serve registration (any current instance of ${requester} will do), or call as the principal that owns this one.` };
+        if (serveGate.processEpoch !== args.serveEpoch)
+            return { ok: false, error: `the requesting manager instance ${args.serveInstanceId} was SUPERSEDED (it registered at epoch ${args.serveEpoch}, the current serve grant is epoch ${serveGate.processEpoch}), so this despawn was REFUSED as a FULL no-op - the agent is unchanged and still running, nothing was torn down. NEXT: recover the manager (\`cotal supervise\`), then retry the despawn under the current serving instance.` };
         // IDEMPOTENCE (the four-outcome table, in operator vocabulary).
-        const head = await readLifecycleHeadForOperation(opts.reg, args.owner, args.actor);
+        const head = await readLifecycleHeadForOperation(opts.reg, target.owner, target.actor);
         if (head === undefined)
-            return { ok: false, error: `no lifecycle exists for "${args.owner}/${args.actor}"; there is nothing to retire.` };
-        if (head.mapping.state === "retired" && head.mapping.lifecycleUid === args.lifecycleUid)
-            return { ok: true, data: { alreadyRetired: true, lifecycleUid: args.lifecycleUid } };
-        if (head.mapping.lifecycleUid !== args.lifecycleUid)
-            return { ok: false, error: `the despawn names a stale incarnation of "${args.owner}/${args.actor}" (current is ${head.mapping.lifecycleUid}); nothing was retired. NEXT: refresh the agent list and retry against the current incarnation.` };
-        const gate = await observeGate(opts.reg, args.lifecycleUid);
+            return { ok: false, error: `no lifecycle exists for "${target.owner}/${target.actor}"; there is nothing to retire.` };
+        if (head.mapping.state === "retired" && head.mapping.lifecycleUid === target.lifecycleUid)
+            return { ok: true, data: { alreadyRetired: true, lifecycleUid: target.lifecycleUid } };
+        if (head.mapping.lifecycleUid !== target.lifecycleUid)
+            return { ok: false, error: `the despawn names a stale incarnation of "${target.owner}/${target.actor}" (current is ${head.mapping.lifecycleUid}); nothing was retired. NEXT: refresh the agent list and retry against the current incarnation.` };
+        const gate = await observeGate(opts.reg, target.lifecycleUid);
         if (gate !== undefined && gate.row.state === "frozen" && gate.row.op !== undefined && gate.row.op.opId !== args.opId)
-            return { ok: false, error: `another operation (${gate.row.op.kind} ${gate.row.op.opId}) already holds "${args.owner}/${args.actor}"; this despawn did not start a second one. NEXT: wait for that operation to finish (or its resume on the next auth-service boot), then retry.` };
+            return { ok: false, error: `another operation (${gate.row.op.kind} ${gate.row.op.opId}) already holds "${target.owner}/${target.actor}"; this despawn did not start a second one. NEXT: wait for that operation to finish (or its resume on the next auth-service boot), then retry.` };
         // EXECUTE (create-or-resume: the barrier's own freeze CAS + durable intent make the same
         // opId resumable and a re-request idempotent). The drain, cleaner, and repair credentials
         // all come from the plane's reviewed deps - this listener holds none of those rights.
         const existing = barrierFlight.get(args.opId);
         if (existing !== undefined &&
-            (existing.owner !== args.owner || existing.actor !== args.actor || existing.lifecycleUid !== args.lifecycleUid))
-            return { ok: false, error: `operation id ${args.opId} is already in flight for a different lifecycle (${existing.owner}/${existing.actor} ${existing.lifecycleUid}); this despawn of "${args.owner}/${args.actor}" (${args.lifecycleUid}) was a FULL no-op - nothing was retired and it is still running. NEXT: retry the despawn (the manager derives a distinct operation id per lifecycle).` };
+            (existing.owner !== target.owner || existing.actor !== target.actor || existing.lifecycleUid !== target.lifecycleUid))
+            return { ok: false, error: `operation id ${args.opId} is already in flight for a different lifecycle (${existing.owner}/${existing.actor} ${existing.lifecycleUid}); this despawn of "${target.owner}/${target.actor}" (${target.lifecycleUid}) was a FULL no-op - nothing was retired and it is still running. NEXT: retry the despawn (the manager derives a distinct operation id per lifecycle).` };
         let flight = existing?.promise;
         if (flight === undefined) {
             // A despawn cannot know the target's pool work, and the barrier never takes a pool hint: it
@@ -199,17 +257,17 @@ export async function openAuthAdminListener(opts) {
             // obligations (#F). Discovery is never a gap - the barrier never closes a frontier over
             // un-cleaned accepted pool work (SPEC 13.1/13.9).
             flight = runAgentRetirementBarrier(opts.reg, {
-                owner: args.owner, actor: args.actor, lifecycleUid: args.lifecycleUid, opId: args.opId,
+                owner: target.owner, actor: target.actor, lifecycleUid: target.lifecycleUid, opId: args.opId,
                 frontierStreams: retirementFrontierStreams(space),
             }, opts.retirement);
             const settle = flight;
             void settle.catch(() => { }).finally(() => { if (barrierFlight.get(args.opId)?.promise === settle)
                 barrierFlight.delete(args.opId); });
-            barrierFlight.set(args.opId, { owner: args.owner, actor: args.actor, lifecycleUid: args.lifecycleUid, promise: flight });
+            barrierFlight.set(args.opId, { owner: target.owner, actor: target.actor, lifecycleUid: target.lifecycleUid, promise: flight });
         }
         const result = await flight;
-        log(`auth-admin: retired ${args.owner}/${args.actor} (${args.lifecycleUid}) by despawn request from ${requester} (op ${args.opId})`);
-        return { ok: true, data: { retired: true, lifecycleUid: args.lifecycleUid, opId: result.opId, evictedPrincipals: result.evictedPrincipals } };
+        log(`auth-admin: retired ${target.owner}/${target.actor} (${target.lifecycleUid}) by despawn request from ${requester} (op ${args.opId})`);
+        return { ok: true, data: { retired: true, lifecycleUid: target.lifecycleUid, opId: result.opId, evictedPrincipals: result.evictedPrincipals } };
     };
     return {
         close: async () => {

package/dist/auth-admin.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-admin.js","sourceRoot":"","sources":["../src/auth-admin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,EAAE,gBAAgB,EAAyB,MAAM,oBAAoB,CAAC;AAE7E,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,aAAa,EACb,YAAY,EACZ,yBAAyB,EACzB,WAAW,GAEZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAwB,MAAM,uBAAuB,CAAC;AAClF,OAAO,EAAE,yBAAyB,EAAuB,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAAE,WAAW,EAAE,6BAA6B,EAA0B,MAAM,yBAAyB,CAAC;AAE7G,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAC9B,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAE9B;;gEAEgE;AAChE,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,MAAc;IACnE,OAAO;QACL,OAAO,EAAE;YACP,iGAAiG;YACjG,8FAA8F;YAC9F,uFAAuF;YACvF,mGAAmG;YACnG,2FAA2F;YAC3F,0EAA0E;YAC1E,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,kBAAkB,cAAc;YAC7D,cAAc;YACd,6BAA6B,aAAa,CAAC,KAAK,CAAC,EAAE;SACpD;QACD,SAAS,EAAE,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,kBAAkB,MAAM,EAAE,UAAU,MAAM,IAAI,CAAC;KACzF,CAAC;AACJ,CAAC;AAcD,SAAS,eAAe,CAAC,GAAY;IACnC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QACzC,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,oEAAoE,CAAC,CAAC;IACzH,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YACzF,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,iDAAiD,CAAC,kBAAkB,CAAC,CAAC;IACzH,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAChI,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,2EAA2E,CAAC,CAAC;IAChI,OAAO;QACL,KAAK,EAAE,kBAAkB,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC;QAC3C,KAAK,EAAE,kBAAkB,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC;QAC3C,YAAY,EAAE,oBAAoB,CAAC,CAAC,CAAC,YAAY,EAAE,cAAc,CAAC;QAClE,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC;KAC3C,CAAC;AACJ,CAAC;AAMD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAO3C;IACC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC5B,MAAM,MAAM,GAAoB,MAAM,mBAAmB,CAAC;QACxD,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW;QACzD,KAAK,EAAE,oBAAoB,KAAK,EAAE;QAClC,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,uBAAuB,CAAC,KAAK,EAAE,EAAE,CAAC;QAClD,GAAG;KACJ,CAAC,CAAC;IACH,IAAI,GAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,CAAC,CAAC;IACV,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,kBAAkB,GAAG,CAAC;IAClE,MAAM,GAAG,GAAiB,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,MAAM,KAAK,EAAE;QAC5D,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACrB,IAAI,GAAG;gBAAE,OAAO;YAChB,KAAK,CAAC,KAAK,IAAI,EAAE;gBACf,iFAAiF;gBACjF,qFAAqF;gBACrF,4EAA4E;gBAC5E,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,OAAO,SAAS,CAAC,EAAE,CAAC;oBAC9E,GAAG,CAAC,oCAAoC,GAAG,CAAC,OAAO,kCAAkC,GAAG,CAAC,KAAK,IAAI,MAAM,GAAG,CAAC,CAAC;oBAC7G,OAAO;gBACT,CAAC;gBACD,IAAI,KAAsD,CAAC;gBAC3D,IAAI,CAAC;oBACH,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;gBACnE,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,KAAK,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3E,CAAC;gBACD,IAAI,CAAC;oBACH,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACjD,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,GAAG,CAAC,uCAAuC,GAAG,CAAC,OAAO,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC3G,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;KACF,CAAC,CAAC;IAEH,iGAAiG;IACjG,wGAAwG;IACxG,uGAAuG;IACvG,wGAAwG;IACxG,EAAE;IACF,yGAAyG;IACzG,qGAAqG;IACrG,uGAAuG;IACvG,wGAAwG;IACxG,yGAAyG;IACzG,kGAAkG;IAClG,kEAAkE;IAClE,MAAM,aAAa,GAAG,IAAI,GAAG,EAAyH,CAAC;IAEvJ,MAAM,MAAM,GAAG,KAAK,EAAE,aAAqB,EAAE,IAAgB,EAA4D,EAAE;QACzH,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oEAAoE,EAAE,CAAC;QAC3H,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAE,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC,GAAG,CAAC;QAC3D,IAAI,GAAqC,CAAC;QAC1C,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAqC,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC;QAC1E,CAAC;QACD,IAAI,GAAG,CAAC,EAAE,KAAK,iBAAiB;YAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,2CAA2C,EAAE,CAAC;QAChG,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEvC,oEAAoE;QACpE,IAAI,KAAmC,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI,iBAAiB,EAAE,EAAE,CAAC,CAAC;YAC3I,yFAAyF;YACzF,qEAAqE;YACrE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;YAC1C,KAAK,GAAG,CAAC,KAAK,IAAI,IAAI,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;gBACzE,CAAC,CAAC,SAAS;gBACX,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAsB,CAAC;QAC3D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,GAAI,CAAwB,EAAE,IAAI,CAAC;YAC7C,IAAI,IAAI,KAAK,KAAK,EAAE,8DAA8D;gBAChF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qGAAqG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,gGAAgG,EAAE,CAAC;QACjR,CAAC;QACD,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;YACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gFAAgF,KAAK,+JAA+J,EAAE,CAAC;QACpR,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8DAA8D,KAAK,CAAC,MAAM,2NAA2N,EAAE,CAAC;QAErU,gEAAgE;QAChE,MAAM,IAAI,GAAG,MAAM,6BAA6B,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACnF,IAAI,IAAI,KAAK,SAAS;YACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,gCAAgC,EAAE,CAAC;QACpH,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY;YACrF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;QACvF,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY;YACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6CAA6C,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,iBAAiB,IAAI,CAAC,OAAO,CAAC,YAAY,iGAAiG,EAAE,CAAC;QAChP,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5D,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;YAClH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,oBAAoB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,gJAAgJ,EAAE,CAAC;QAEtR,yFAAyF;QACzF,0FAA0F;QAC1F,sFAAsF;QACtF,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,SAAS;YACtB,CAAC,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY,CAAC;YACjH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,IAAI,CAAC,IAAI,oDAAoD,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,YAAY,uBAAuB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,YAAY,wJAAwJ,EAAE,CAAC;QACpY,IAAI,MAAM,GAAG,QAAQ,EAAE,OAAO,CAAC;QAC/B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,4FAA4F;YAC5F,6FAA6F;YAC7F,wFAAwF;YACxF,kDAAkD;YAClD,MAAM,GAAG,yBAAyB,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC3C,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI;gBACtF,eAAe,EAAE,yBAAyB,CAAC,KAAK,CAAC;aAClD,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACpB,MAAM,MAAM,GAAG,MAAM,CAAC;YACtB,KAAK,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,KAAK,MAAM;gBAAE,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACtI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3H,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC;QAC5B,GAAG,CAAC,uBAAuB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,YAAY,6BAA6B,SAAS,QAAQ,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;QACrI,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,EAAE,CAAC;IAChJ,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,IAAI,CAAC;gBAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,6BAA6B,CAAC,CAAC;YAClE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"auth-admin.js","sourceRoot":"","sources":["../src/auth-admin.ts"],"names":[],"mappings":"AAkDA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,uBAAuB,EACvB,kBAAkB,EAClB,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,yBAAyB,EACzB,mBAAmB,GAEpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAwB,MAAM,uBAAuB,CAAC;AAClF,OAAO,EAAE,yBAAyB,EAAuB,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAAE,WAAW,EAAE,6BAA6B,EAA0B,MAAM,yBAAyB,CAAC;AAE7G,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAC9B,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAE9B;mGACmG;AACnG,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,WAAW,aAAa,CAAC,aAAa,CAAC,IAAI,kBAAkB,CAAC,uBAAuB,CAAC,IAAI,CAAC;AACzH,CAAC;AAED;;gEAEgE;AAChE,MAAM,UAAU,uBAAuB,CACrC,KAAa,EACb,MAAc,EACd,SAAgD;IAEhD,OAAO;QACL,OAAO,EAAE;YACP,2FAA2F;YAC3F,6FAA6F;YAC7F,8FAA8F;YAC9F,8FAA8F;YAC9F,2FAA2F;YAC3F,4FAA4F;YAC5F,qFAAqF;YACrF,uBAAuB,CAAC,KAAK,EAAE,aAAa,EAAE,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC;YACpF,cAAc;YACd,4FAA4F;YAC5F,4FAA4F;YAC5F,2FAA2F;YAC3F,8BAA8B;YAC9B,6BAA6B,YAAY,CAAC,KAAK,CAAC,EAAE;SACnD;QACD,6FAA6F;QAC7F,uFAAuF;QACvF,4FAA4F;QAC5F,4FAA4F;QAC5F,sEAAsE;QACtE,SAAS,EAAE,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,aAAa,CAAC,EAAE,EAAE,UAAU,MAAM,IAAI,CAAC;KACjG,CAAC;AACJ,CAAC;AAeD,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,iBAAiB,EAAE,YAAY,CAAC,CAAC;AAEnF;;;;;sGAKsG;AACtG,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC;QAC/D,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,4HAA4H,CAAC,CAAC;IACjL,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,GAAY;IACnC,MAAM,KAAK,GAAG,sDAAsD,CAAC;IACrE,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QACzC,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,iCAAiC,KAAK,EAAE,CAAC,CAAC;IAC7F,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,gGAAgG;IAChG,gGAAgG;IAChG,4FAA4F;IAC5F,2EAA2E;IAC3E,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC9D,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,iDAAiD,CAAC,gDAAgD,CAAC,CAAC;IACvJ,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAC1B,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ;QAC5E,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,GAAG,CAAC;QACzF,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,iCAAiC,KAAK,sCAAsC,CAAC,CAAC;IACjI,OAAO;QACL,+FAA+F;QAC/F,2FAA2F;QAC3F,2FAA2F;QAC3F,8DAA8D;QAC9D,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC;QAC1C,yFAAyF;QACzF,2FAA2F;QAC3F,mCAAmC;QACnC,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC;QAC7C,eAAe,EAAE,oBAAoB,CAAC,CAAC,CAAC,eAAe,EAAE,iBAAiB,CAAC;QAC3E,UAAU,EAAE,CAAC,CAAC,UAAU;KACzB,CAAC;AACJ,CAAC;AAMD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAO3C;IACC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC5B,8FAA8F;IAC9F,4FAA4F;IAC5F,2FAA2F;IAC3F,gGAAgG;IAChG,4FAA4F;IAC5F,mFAAmF;IACnF,MAAM,SAAS,GAAG,EAAE,UAAU,EAAE,gBAAgB,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAC/D,MAAM,MAAM,GAAoB,MAAM,mBAAmB,CAAC;QACxD,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW;QACzD,KAAK,EAAE,oBAAoB,KAAK,EAAE;QAClC,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,uBAAuB,CAAC,KAAK,EAAE,EAAE,EAAE,SAAS,CAAC;QAC7D,GAAG;KACJ,CAAC,CAAC;IACH,IAAI,QAAkC,CAAC;IACvC,IAAI,CAAC;QACH,+FAA+F;QAC/F,yFAAyF;QACzF,QAAQ,GAAG,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,CAAC,CAAC;IACV,CAAC;IACD,MAAM,GAAG,GAAiB,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE;QAClE,KAAK,EAAE,iBAAiB,CAAC,aAAa,CAAC;QACvC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACrB,IAAI,GAAG;gBAAE,OAAO;YAChB,KAAK,CAAC,KAAK,IAAI,EAAE;gBACf,yFAAyF;gBACzF,kFAAkF;gBAClF,yFAAyF;gBACzF,wFAAwF;gBACxF,yEAAyE;gBACzE,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC3C,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;oBAClD,+EAA+E;oBAC/E,iFAAiF;oBACjF,GAAG,CAAC,sDAAsD,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;oBACzE,OAAO;gBACT,CAAC;gBACD,MAAM,OAAO,GAAoB,MAAM,CAAC;gBACxC,4FAA4F;gBAC5F,0FAA0F;gBAC1F,4FAA4F;gBAC5F,IAAI,MAA0B,CAAC;gBAC/B,IAAI,CAAC;oBAAC,MAAM,GAAG,cAAc,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAsB,CAAC,EAAE,CAAC,CAAC;gBAAC,CAAC;gBAC3F,MAAM,CAAC;oBAAC,MAAM,GAAG,SAAS,CAAC;gBAAC,CAAC;gBAC7B,IAAI,KAAmE,CAAC;gBACxE,IAAI,CAAC;oBACH,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC1C,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,KAAK,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3E,CAAC;gBACD,4FAA4F;gBAC5F,oFAAoF;gBACpF,IAAI,MAAM,KAAK,SAAS;oBAAE,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC;gBAC5C,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;gBAC7D,IAAI,CAAC;oBACH,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC/D,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,GAAG,CAAC,uCAAuC,MAAM,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACtG,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;KACF,CAAC,CAAC;IAEH,iGAAiG;IACjG,wGAAwG;IACxG,uGAAuG;IACvG,wGAAwG;IACxG,EAAE;IACF,yGAAyG;IACzG,qGAAqG;IACrG,uGAAuG;IACvG,wGAAwG;IACxG,yGAAyG;IACzG,kGAAkG;IAClG,kEAAkE;IAClE,MAAM,aAAa,GAAG,IAAI,GAAG,EAAyH,CAAC;IAEvJ,MAAM,MAAM,GAAG,KAAK,EAAE,OAAwB,EAAE,IAAgB,EAAyE,EAAE;QACzI,IAAI,OAAO,CAAC,OAAO,KAAK,uBAAuB;YAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,OAAO,CAAC,OAAO,sCAAsC,EAAE,CAAC;QACjG,mFAAmF;QACnF,+FAA+F;QAC/F,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ;YAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2FAA2F,EAAE,CAAC;QAC3H,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACjH,uFAAuF;QACvF,wEAAwE;QACxE,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC;QAC/E,IAAI,GAAmD,CAAC;QACxD,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAqC,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC;QAC1E,CAAC;QACD,IAAI,GAAG,CAAC,EAAE,KAAK,iBAAiB;YAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,2CAA2C,EAAE,CAAC;QAChG,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEvC,8FAA8F;QAC9F,8FAA8F;QAC9F,gGAAgG;QAChG,oGAAoG;QACpG,kGAAkG;QAClG,kGAAkG;QAClG,+FAA+F;QAC/F,yFAAyF;QACzF,gGAAgG;QAChG,+FAA+F;QAC/F,yDAAyD;QACzD,8FAA8F;QAC9F,gGAAgG;QAChG,uDAAuD;QACvD,IAAI,SAAiF,CAAC;QACtF,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QACvI,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6GAA6G,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,gGAAgG,EAAE,CAAC;QACvR,CAAC;QACD,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS;YACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iEAAiE,KAAK,eAAe,IAAI,CAAC,eAAe,OAAO,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,6LAA6L,EAAE,CAAC;QAC5X,4FAA4F;QAC5F,6FAA6F;QAC7F,uFAAuF;QACvF,yFAAyF;QACzF,0FAA0F;QAC1F,2BAA2B;QAC3B,4FAA4F;QAC5F,+FAA+F;QAC/F,0FAA0F;QAC1F,qDAAqD;QACrD,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS;YACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qEAAqE,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,eAAe,gBAAgB,SAAS,CAAC,SAAS,qCAAqC,SAAS,yNAAyN,SAAS,yDAAyD,EAAE,CAAC;QAC3f,IAAI,SAAS,CAAC,YAAY,KAAK,IAAI,CAAC,UAAU;YAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,IAAI,CAAC,eAAe,2CAA2C,IAAI,CAAC,UAAU,sCAAsC,SAAS,CAAC,YAAY,+NAA+N,EAAE,CAAC;QAE5a,gEAAgE;QAChE,MAAM,IAAI,GAAG,MAAM,6BAA6B,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACvF,IAAI,IAAI,KAAK,SAAS;YACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,gCAAgC,EAAE,CAAC;QACxH,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY;YACvF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC;QACzF,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY;YACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6CAA6C,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,iBAAiB,IAAI,CAAC,OAAO,CAAC,YAAY,iGAAiG,EAAE,CAAC;QACpP,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAC9D,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;YAClH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,oBAAoB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,gJAAgJ,EAAE,CAAC;QAE1R,yFAAyF;QACzF,0FAA0F;QAC1F,sFAAsF;QACtF,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,SAAS;YACtB,CAAC,QAAQ,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY,CAAC;YACvH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,IAAI,CAAC,IAAI,oDAAoD,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,YAAY,uBAAuB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,MAAM,MAAM,CAAC,YAAY,wJAAwJ,EAAE,CAAC;QAC1Y,IAAI,MAAM,GAAG,QAAQ,EAAE,OAAO,CAAC;QAC/B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,4FAA4F;YAC5F,6FAA6F;YAC7F,wFAAwF;YACxF,kDAAkD;YAClD,MAAM,GAAG,yBAAyB,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC3C,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI;gBAC5F,eAAe,EAAE,yBAAyB,CAAC,KAAK,CAAC;aAClD,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACpB,MAAM,MAAM,GAAG,MAAM,CAAC;YACtB,KAAK,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,KAAK,MAAM;gBAAE,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACtI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACjI,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC;QAC5B,GAAG,CAAC,uBAAuB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,YAAY,6BAA6B,SAAS,QAAQ,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;QAC3I,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,EAAE,CAAC;IAClJ,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,IAAI,CAAC;gBAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,6BAA6B,CAAC,CAAC;YAClE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/commands.js

@@ -7,7 +7,7 @@
  */
 import { readFileSync, writeFileSync } from "node:fs";
 import { CotalEndpoint, mintCreds, newIdentity, registry } from "@cotal-ai/core";
-import { CLI_USER_ACTOR, findCotalRoot, getSpaceAuth, homeCotalDir, loadMeshes, resolveSpace, userAuthStateDir, workspaceSecretStore } from "@cotal-ai/workspace";
+import { CLI_USER_ACTOR, findCotalRoot, getSpaceAuth, homeCotalDir, loadMeshes, probeLiveness, resolveSpace, userAuthStateDir, workspaceSecretStore } from "@cotal-ai/workspace";
 import { deleteIdpSession, establishIdpSession, loadIdpSession, normalizeIdpUrl, revokeIdpSession, } from "./login.js";
 import { deriveOwnerForIdpSubject } from "./derive.js";
 import { findManagedActor, grantActor, loadActorLedger, revokeActor } from "./ledger.js";
@@ -250,14 +250,15 @@ async function runAgentBearer(args) {
             throw new Error(`agent-bearer: can't read the actor token file at ${tokenFile} (${e instanceof Error ? e.message : String(e)}) - respawn this agent to re-provision it`);
         }
         const info = loadAuthServiceInfo(dir);
-        const alive = (pid) => { try {
-            process.kill(pid, 0);
-            return true;
-        }
-        catch {
-            return false;
-        } };
-        if (!info || !alive(info.pid))
+        // Proof required: only `alive` counts as running. The old two-state probe called EPERM dead, so
+        // a service running as ANOTHER USER produced "not running - restart it with `cotal up`" about a
+        // service that was up the whole time; the contract resolves EPERM to alive and fixes exactly
+        // that. `unknown` still refuses, because telling an operator to talk to an endpoint whose
+        // liveness cannot be established is worse than telling them to restart.
+        const svc = info === undefined ? "absent" : probeLiveness(info.pid);
+        if (svc === "unknown")
+            throw new Error(`agent-bearer: the user-auth service for space "${space}" records pid ${info.pid}, whose liveness cannot be determined - the kernel answered neither "running" nor "no such process" (a seccomp filter or LSM policy does this inside some sandboxes). Refusing rather than reporting it down: verify with \`ps -p ${info.pid}\` before restarting anything.`);
+        if (svc !== "alive" || info === undefined)
             throw new Error(`agent-bearer: the user-auth service for space "${space}" is not running - restart it with \`cotal up\``);
         let res;
         try {

package/dist/commands.js.map

@@ -1 +1 @@
-{"version":3,"file":"commands.js","sourceRoot":"","sources":["../src/commands.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAmD,MAAM,gBAAgB,CAAC;AAClI,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,EAAE,oBAAoB,EAAwB,MAAM,qBAAqB,CAAC;AACxL,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACzF,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEjF,MAAM,iBAAiB,GAAG,WAAW,CAAC;AAEtC;;kFAEkF;AAClF,KAAK,UAAU,OAAO,CAAC,EAAuB;IAC5C,IAAI,CAAC;QACH,MAAM,EAAE,EAAE,CAAC;IACb,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAgB;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAgD,CAAC;IACrE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,gGAAgG,CAAC,CAAC;QAChH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC;IAC1B,MAAM,OAAO,CAAC,KAAK,IAAI,EAAE;QACvB,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QACpC,yFAAyF;QACzF,+DAA+D;QAC/D,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,MAAM,mBAAmB,CAAC;YACxD,GAAG,EAAE,YAAY,EAAE;YACnB,MAAM,EAAE,GAAG;YACX,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,iBAAiB;YAClD,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE;gBACd,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC,uBAAuB,IAAI,CAAC,CAAC;gBACtF,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,eAAe,uBAAuB,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC;gBAClF,OAAO,CAAC,GAAG,CAAC,8CAA8C,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,GAAG,EAAE,CAAC,wBAAwB,CAAC,CAAC;YACpH,CAAC;SACF,CAAC,CAAC;QACH,6FAA6F;QAC7F,gGAAgG;QAChG,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAC9C,OAAO,CAAC,GAAG,CACT,kBAAkB,GAAG,OAAO,GAAG,uBAAuB,YAAY,EAAE,UAAU,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,GAAG,CAClI,CAAC;QACF,4FAA4F;QAC5F,uEAAuE;QACvE,OAAO,CAAC,GAAG,CACT,uEAAuE,cAAc,UAAU,GAAG,6GAA6G,CAChN,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAgB;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,MAA0B,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC;IAC1B,MAAM,OAAO,CAAC,KAAK,IAAI,EAAE;QACvB,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,qBAAqB,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,0FAA0F;YAC1F,4FAA4F;YAC5F,2FAA2F;YAC3F,0BAA0B;YAC1B,MAAM,IAAI,KAAK,CACb,+CAA+C,GAAG,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;gBACpG,kEAAkE,GAAG,oEAAoE,CAC5I,CAAC;QACJ,CAAC;QACD,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,iBAAiB,GAAG,sDAAsD,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;qFAGqF;AACrF,SAAS,UAAU,CAAC,KAAc;IAChC,MAAM,CAAC,GAAG,KAAK,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,OAAO,EAAE,GAAG,EAAE,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;AACzF,CAAC;AAED;;;;;oGAKoG;AACpG,KAAK,UAAU,iBAAiB,CAC9B,EAAsD,EACtD,MAAwC;IAExC,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACnF,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC5H,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG;QACjB,MAAM,IAAI,KAAK,CACb,8EAA8E,EAAE,CAAC,KAAK,2HAA2H,CAClN,CAAC;IACJ,IAAI,MAAM,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC;IACtC,OAAO,wBAAwB,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAI,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,CAAqB,EAAE,IAAc,EAAY,EAAE,CAC9D,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAE7E;;;;;kFAKkF;AAClF,KAAK,UAAU,qBAAqB,CAAC,KAAa,EAAE,SAAiB;IACnE,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAE,EAAE,CAC/B,qCAAqC,GAAG,gPAAgP,CAAC;IAC3R,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IACnE,IAAI,CAAC,IAAI;QAAE,OAAO,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IACzD,IAAI,CAAC,IAAI;QAAE,OAAO,QAAQ,CAAC,gCAAgC,CAAC,CAAC;IAC7D,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;IACzB,MAAM,EAAE,GAAG,IAAI,aAAa,CAAC;QAC3B,KAAK;QACL,OAAO,EAAE,IAAI,CAAC,MAAM;QACpB,KAAK,EAAE,MAAM,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,YAAY,CAAC;QAC9C,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE;QAC3D,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,KAAK;QACd,aAAa,EAAE,KAAK;QACpB,aAAa,EAAE,KAAK;QACpB,gBAAgB,EAAE,KAAK;KACxB,CAAC,CAAC;IACH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,oBAAoB,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;QACjF,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,qCAAqC,CAAC,CAAC,KAAK,EAAE,CAAC;QACjE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAoE,CAAC;QAC5F,OAAO,CAAC,CAAC,YAAY;YACnB,CAAC,CAAC,gCAAgC,CAAC,CAAC,MAAM,IAAI,CAAC,yBAAyB;YACxE,CAAC,CAAC,wCAAwC,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,SAAS,IAAI,GAAG,0CAA0C,CAAC;IACpI,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,QAAQ,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAgB;IACtC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,MAGnB,CAAC;IACF,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IAC1B,MAAM,OAAO,CAAC,KAAK,IAAI,EAAE;QACvB,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACnB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACjB,OAAO,CAAC,GAAG,CAAC,mFAAmF,CAAC,CAAC;gBACjG,OAAO;YACT,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;gBACvF,OAAO,CAAC,GAAG,CACT,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,IAAI,IAAI,GAAG,YAAY,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CACzM,CAAC;YACJ,OAAO;QACT,CAAC;QACD,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACpB,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,yIAAyI,CAAC,CAAC;YACvK,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAClD,uFAAuF;YACvF,2FAA2F;YAC3F,wFAAwF;YACxF,8DAA8D;YAC9D,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC1B,KAAK;gBACL,KAAK;gBACL,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;gBACnD,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;gBACrD,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;gBACjD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpD,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,YAAY,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClM,OAAO;QACT,CAAC;QACD,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrB,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;YACnG,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAClD,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;gBACpC,IAAI,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC;oBACrC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,KAAK,yGAAyG,KAAK,0GAA0G,CAAC,CAAC;gBAC7P,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,IAAI,KAAK,sBAAsB,CAAC,CAAC;gBAClE,OAAO;YACT,CAAC;YACD,2FAA2F;YAC3F,sFAAsF;YACtF,2FAA2F;YAC3F,4FAA4F;YAC5F,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,IAAI,KAAK,kDAAkD,CAAC,CAAC;YAC3F,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,qBAAqB,CAAC,KAAK,EAAE,GAAG,KAAK,IAAI,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;YAC5E,OAAO;QACT,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;gGAIgG;AAChG,KAAK,UAAU,cAAc,CAAC,IAAgB;IAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,MAGd,CAAC;IACF,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC;IAClC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS;QAClD,MAAM,IAAI,KAAK,CAAC,8HAA8H,CAAC,CAAC;IAClJ,+FAA+F;IAC/F,gGAAgG;IAChG,6CAA6C;IAC7C,MAAM,MAAM,GAAG,CAAC,KAAsB,EAAE,MAAe,EAAE,EAAE;QACzD,MAAM,IAAI,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,IAAI,CAAC;YACH,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAA4B,CAAC,CAAC,CAAC;QACxI,CAAC;QAAC,MAAM,CAAC,CAAC,uCAAuC,CAAC,CAAC;IACrD,CAAC,CAAC;IACF,IAAI,CAAC;QACH,IAAI,UAAkB,CAAC;QACvB,IAAI,CAAC;YACH,UAAU,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,oDAAoD,SAAS,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC;QAC3K,CAAC;QACD,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,EAAE,GAAG,IAAI,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC;QACtG,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,kDAAkD,KAAK,iDAAiD,CAAC,CAAC;QAC5H,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,WAAW,EAAE;gBACxC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,GAAG,EAAE,EAAE;gBACpF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;gBAClD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,yDAAyD,IAAI,CAAC,GAAG,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC;QACtK,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuB,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,CAAC,KAAK,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuB,CAAC;QACvE,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,KAAK;YAC7C,MAAM,IAAI,KAAK,CAAC,kHAAkH,CAAC,CAAC;QACtI,MAAM,CAAC,IAAI,CAAC,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,QAAQ,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED,MAAM,YAAY,GAAc;IAC9B;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE,SAAS;QAChB,OAAO,EAAE,oHAAoH;QAC7H,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,2BAA2B,EAAE;YACzF,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,0CAA0C,EAAE;YAC3G,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,+DAA+D,EAAE;SAC7H;QACD,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;KACnD;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE,yFAAyF;QAClG,KAAK,EAAE,oLAAoL;QAC3L,WAAW,EAAE,yCAAyC;QACtD,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,sDAAsD,EAAE;YACpH,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,+DAA+D,EAAE;YACjI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,gDAAgD,EAAE;YAChH,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,kIAAkI,EAAE;YAClM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,2GAA2G,EAAE;YACrL,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,4FAA4F,EAAE;YACpK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,uCAAuC,EAAE;YACpG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,wDAAwD,EAAE;YACtH,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,yFAAyF,EAAE;SACnK;QACD,GAAG,EAAE,QAAQ;KACd;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE,SAAS;QAChB,OAAO,EAAE,wGAAwG;QACjH,KAAK,EAAE,0FAA0F;QACjG,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,iCAAiC,EAAE;YACrG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,mCAAmC,EAAE;YACjG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,yBAAyB,EAAE;YACzF,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,yBAAyB,EAAE;YACvF,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,+CAA+C,EAAE;YACrH,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,8DAA8D,EAAE;SACtI;QACD,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;KACnD;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE,uGAAuG;QAChH,KAAK,EAAE,gDAAgD;QACvD,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,uCAAuC,EAAE;YAC/G,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,6BAA6B,EAAE;SACjG;QACD,GAAG,EAAE,QAAQ;KACd;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE,yEAAyE;QAClF,KAAK,EAAE,8BAA8B;QACrC,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,uCAAuC,EAAE;SAChH;QACD,GAAG,EAAE,SAAS;KACf;CACF,CAAC;AAEF,QAAQ,CAAC,QAAQ,CAAC,GAAG,YAAY,CAAC,CAAC"}
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../src/commands.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAmD,MAAM,gBAAgB,CAAC;AAClI,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,oBAAoB,EAAwB,MAAM,qBAAqB,CAAC;AACvM,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACzF,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEjF,MAAM,iBAAiB,GAAG,WAAW,CAAC;AAEtC;;kFAEkF;AAClF,KAAK,UAAU,OAAO,CAAC,EAAuB;IAC5C,IAAI,CAAC;QACH,MAAM,EAAE,EAAE,CAAC;IACb,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAgB;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAgD,CAAC;IACrE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,gGAAgG,CAAC,CAAC;QAChH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC;IAC1B,MAAM,OAAO,CAAC,KAAK,IAAI,EAAE;QACvB,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QACpC,yFAAyF;QACzF,+DAA+D;QAC/D,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,MAAM,mBAAmB,CAAC;YACxD,GAAG,EAAE,YAAY,EAAE;YACnB,MAAM,EAAE,GAAG;YACX,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,iBAAiB;YAClD,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE;gBACd,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC,uBAAuB,IAAI,CAAC,CAAC;gBACtF,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,eAAe,uBAAuB,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC;gBAClF,OAAO,CAAC,GAAG,CAAC,8CAA8C,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,GAAG,EAAE,CAAC,wBAAwB,CAAC,CAAC;YACpH,CAAC;SACF,CAAC,CAAC;QACH,6FAA6F;QAC7F,gGAAgG;QAChG,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAC9C,OAAO,CAAC,GAAG,CACT,kBAAkB,GAAG,OAAO,GAAG,uBAAuB,YAAY,EAAE,UAAU,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,GAAG,CAClI,CAAC;QACF,4FAA4F;QAC5F,uEAAuE;QACvE,OAAO,CAAC,GAAG,CACT,uEAAuE,cAAc,UAAU,GAAG,6GAA6G,CAChN,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAgB;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,MAA0B,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC;IAC1B,MAAM,OAAO,CAAC,KAAK,IAAI,EAAE;QACvB,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,qBAAqB,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,0FAA0F;YAC1F,4FAA4F;YAC5F,2FAA2F;YAC3F,0BAA0B;YAC1B,MAAM,IAAI,KAAK,CACb,+CAA+C,GAAG,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;gBACpG,kEAAkE,GAAG,oEAAoE,CAC5I,CAAC;QACJ,CAAC;QACD,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,iBAAiB,GAAG,sDAAsD,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;qFAGqF;AACrF,SAAS,UAAU,CAAC,KAAc;IAChC,MAAM,CAAC,GAAG,KAAK,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,OAAO,EAAE,GAAG,EAAE,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;AACzF,CAAC;AAED;;;;;oGAKoG;AACpG,KAAK,UAAU,iBAAiB,CAC9B,EAAsD,EACtD,MAAwC;IAExC,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACnF,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC5H,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG;QACjB,MAAM,IAAI,KAAK,CACb,8EAA8E,EAAE,CAAC,KAAK,2HAA2H,CAClN,CAAC;IACJ,IAAI,MAAM,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC;IACtC,OAAO,wBAAwB,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAI,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,CAAqB,EAAE,IAAc,EAAY,EAAE,CAC9D,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAE7E;;;;;kFAKkF;AAClF,KAAK,UAAU,qBAAqB,CAAC,KAAa,EAAE,SAAiB;IACnE,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAE,EAAE,CAC/B,qCAAqC,GAAG,gPAAgP,CAAC;IAC3R,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IACnE,IAAI,CAAC,IAAI;QAAE,OAAO,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IACzD,IAAI,CAAC,IAAI;QAAE,OAAO,QAAQ,CAAC,gCAAgC,CAAC,CAAC;IAC7D,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;IACzB,MAAM,EAAE,GAAG,IAAI,aAAa,CAAC;QAC3B,KAAK;QACL,OAAO,EAAE,IAAI,CAAC,MAAM;QACpB,KAAK,EAAE,MAAM,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,YAAY,CAAC;QAC9C,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE;QAC3D,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,KAAK;QACd,aAAa,EAAE,KAAK;QACpB,aAAa,EAAE,KAAK;QACpB,gBAAgB,EAAE,KAAK;KACxB,CAAC,CAAC;IACH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,oBAAoB,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;QACjF,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,qCAAqC,CAAC,CAAC,KAAK,EAAE,CAAC;QACjE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAoE,CAAC;QAC5F,OAAO,CAAC,CAAC,YAAY;YACnB,CAAC,CAAC,gCAAgC,CAAC,CAAC,MAAM,IAAI,CAAC,yBAAyB;YACxE,CAAC,CAAC,wCAAwC,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,SAAS,IAAI,GAAG,0CAA0C,CAAC;IACpI,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,QAAQ,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAgB;IACtC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,MAGnB,CAAC;IACF,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IAC1B,MAAM,OAAO,CAAC,KAAK,IAAI,EAAE;QACvB,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACnB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACjB,OAAO,CAAC,GAAG,CAAC,mFAAmF,CAAC,CAAC;gBACjG,OAAO;YACT,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;gBACvF,OAAO,CAAC,GAAG,CACT,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,IAAI,IAAI,GAAG,YAAY,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CACzM,CAAC;YACJ,OAAO;QACT,CAAC;QACD,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACpB,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,yIAAyI,CAAC,CAAC;YACvK,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAClD,uFAAuF;YACvF,2FAA2F;YAC3F,wFAAwF;YACxF,8DAA8D;YAC9D,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC1B,KAAK;gBACL,KAAK;gBACL,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;gBACnD,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;gBACrD,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;gBACjD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpD,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,YAAY,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClM,OAAO;QACT,CAAC;QACD,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrB,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;YACnG,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAClD,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;gBACpC,IAAI,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC;oBACrC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,KAAK,yGAAyG,KAAK,0GAA0G,CAAC,CAAC;gBAC7P,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,IAAI,KAAK,sBAAsB,CAAC,CAAC;gBAClE,OAAO;YACT,CAAC;YACD,2FAA2F;YAC3F,sFAAsF;YACtF,2FAA2F;YAC3F,4FAA4F;YAC5F,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,IAAI,KAAK,kDAAkD,CAAC,CAAC;YAC3F,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,qBAAqB,CAAC,KAAK,EAAE,GAAG,KAAK,IAAI,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;YAC5E,OAAO;QACT,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;gGAIgG;AAChG,KAAK,UAAU,cAAc,CAAC,IAAgB;IAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,MAGd,CAAC;IACF,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC;IAClC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS;QAClD,MAAM,IAAI,KAAK,CAAC,8HAA8H,CAAC,CAAC;IAClJ,+FAA+F;IAC/F,gGAAgG;IAChG,6CAA6C;IAC7C,MAAM,MAAM,GAAG,CAAC,KAAsB,EAAE,MAAe,EAAE,EAAE;QACzD,MAAM,IAAI,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,IAAI,CAAC;YACH,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAA4B,CAAC,CAAC,CAAC;QACxI,CAAC;QAAC,MAAM,CAAC,CAAC,uCAAuC,CAAC,CAAC;IACrD,CAAC,CAAC;IACF,IAAI,CAAC;QACH,IAAI,UAAkB,CAAC;QACvB,IAAI,CAAC;YACH,UAAU,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,oDAAoD,SAAS,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC;QAC3K,CAAC;QACD,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACtC,gGAAgG;QAChG,gGAAgG;QAChG,6FAA6F;QAC7F,0FAA0F;QAC1F,wEAAwE;QACxE,MAAM,GAAG,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpE,IAAI,GAAG,KAAK,SAAS;YACnB,MAAM,IAAI,KAAK,CACb,kDAAkD,KAAK,iBAAiB,IAAK,CAAC,GAAG,qOAAqO,IAAK,CAAC,GAAG,gCAAgC,CAChW,CAAC;QACJ,IAAI,GAAG,KAAK,OAAO,IAAI,IAAI,KAAK,SAAS;YACvC,MAAM,IAAI,KAAK,CAAC,kDAAkD,KAAK,iDAAiD,CAAC,CAAC;QAC5H,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,WAAW,EAAE;gBACxC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,GAAG,EAAE,EAAE;gBACpF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;gBAClD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,yDAAyD,IAAI,CAAC,GAAG,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC;QACtK,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuB,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,CAAC,KAAK,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuB,CAAC;QACvE,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,KAAK;YAC7C,MAAM,IAAI,KAAK,CAAC,kHAAkH,CAAC,CAAC;QACtI,MAAM,CAAC,IAAI,CAAC,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,QAAQ,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED,MAAM,YAAY,GAAc;IAC9B;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE,SAAS;QAChB,OAAO,EAAE,oHAAoH;QAC7H,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,2BAA2B,EAAE;YACzF,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,0CAA0C,EAAE;YAC3G,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,+DAA+D,EAAE;SAC7H;QACD,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;KACnD;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE,yFAAyF;QAClG,KAAK,EAAE,oLAAoL;QAC3L,WAAW,EAAE,yCAAyC;QACtD,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,sDAAsD,EAAE;YACpH,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,+DAA+D,EAAE;YACjI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,gDAAgD,EAAE;YAChH,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,kIAAkI,EAAE;YAClM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,2GAA2G,EAAE;YACrL,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,4FAA4F,EAAE;YACpK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,uCAAuC,EAAE;YACpG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,wDAAwD,EAAE;YACtH,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,yFAAyF,EAAE;SACnK;QACD,GAAG,EAAE,QAAQ;KACd;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE,SAAS;QAChB,OAAO,EAAE,wGAAwG;QACjH,KAAK,EAAE,0FAA0F;QACjG,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,iCAAiC,EAAE;YACrG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,mCAAmC,EAAE;YACjG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,yBAAyB,EAAE;YACzF,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,yBAAyB,EAAE;YACvF,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,+CAA+C,EAAE;YACrH,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,8DAA8D,EAAE;SACtI;QACD,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;KACnD;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE,uGAAuG;QAChH,KAAK,EAAE,gDAAgD;QACvD,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,uCAAuC,EAAE;YAC/G,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,6BAA6B,EAAE;SACjG;QACD,GAAG,EAAE,QAAQ;KACd;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE,yEAAyE;QAClF,KAAK,EAAE,8BAA8B;QACrC,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,uCAAuC,EAAE;SAChH;QACD,GAAG,EAAE,SAAS;KACf;CACF,CAAC;AAEF,QAAQ,CAAC,QAAQ,CAAC,GAAG,YAAY,CAAC,CAAC"}