@cotal-ai/core 0.8.3 → 0.9.1

package/dist/provision.js

@@ -17,7 +17,7 @@
 import { join } from "node:path";
 import { encodeOperator, encodeAccount, encodeUser, fmtCreds, } from "@nats-io/jwt";
 import { createOperator, createAccount, fromPublic, fromSeed } from "@nats-io/nkeys";
-import { token, spacePrefix, chatSubject, assertValidChannel, channelInAllow, unicastSubject, anycastSubject, controlServiceSubject, CONTROL_PRIVILEGED, CONTROL_SELF_SERVICE, CONTROL_DELIVERY, chatStream, dmStream, taskStream, dlvStream, inboxStream, chatHistDurable, dmDurable, taskDurable, dlvDurable, presenceBucket, channelBucket, membersBucket, aclBucket, membershipBucket, deliveryBucket, connzRequestSubject, accountConnectSubject, accountDisconnectSubject, MEMBERSHIP_INBOX_PREFIX, FANOUT_DURABLE, INBOX_READER_DURABLE, } from "./subjects.js";
+import { token, spacePrefix, chatSubject, assertValidChannel, channelInAllow, unicastSubject, anycastSubject, controlServiceSubject, CONTROL_PRIVILEGED, CONTROL_SELF_SERVICE, CONTROL_ADMIN, CONTROL_DELIVERY, chatStream, dmStream, taskStream, dlvStream, inboxStream, chatHistDurable, dmDurable, taskDurable, dlvDurable, presenceBucket, channelBucket, membersBucket, aclBucket, aclKey, membershipBucket, deliveryBucket, managerBucket, MANAGER_LEASE_KEY, connzRequestSubject, accountConnectSubject, accountDisconnectSubject, MEMBERSHIP_INBOX_PREFIX, FANOUT_DURABLE, INBOX_READER_DURABLE, } from "./subjects.js";
 // Unlimited account limits — without explicit limits a JWT account defaults to 0 conns
 // (every connect denied). JetStream needs storage on the data account but MUST stay off
 // the system account (the server refuses to start otherwise).
@@ -112,8 +112,8 @@ export async function provisionAgent(provisioner, auth, identity, opts = {}) {
  *  (`fromPublic`) — the agent seed is never part of the signature, it's only folded into
  *  the resulting creds file. The "agent" profile is scoped to publish only as itself and only to
  *  its declared `allowPublish` channels (post ACL, default-deny), and to read only within
- *  `allowSubscribe` (live tail bind-only + per-channel history grants); "manager" and "observer"
- *  stay permissive here and are scoped in steps 6–7. */
+ *  `allowSubscribe` (live tail bind-only + per-channel history grants). Every profile is now
+ *  enumerated least-privilege — there is no allow-all cred (the former `manager` is deleted). */
 export async function mintCreds(auth, identity, profile, opts = {}) {
     const signer = fromSeed(new TextEncoder().encode(auth.account.signingSeed));
     const perms = permissionsFor(profile, auth.space, identity.id, opts);
@@ -122,16 +122,44 @@ export async function mintCreds(auth, identity, profile, opts = {}) {
     return new TextDecoder().decode(creds);
 }
 /** Build the NATS user permission object for a profile: a default-deny allow-list scoped to
- *  exactly what each profile does. "manager" stays permissive (the privileged provisioner
- *  host). Subject/stream/durable names come from the shared builders so the ACLs can't drift
- *  from the wire layout. */
+ *  exactly what each profile does. Every profile is now enumerated least-privilege — the former
+ *  allow-all `manager` is gone (its roles split across supervisor/provisioner/operator/purger and the
+ *  PR 1.5 CLI-surface profiles). Subject/stream/durable names come from the shared builders so the ACLs
+ *  can't drift from the wire layout. */
 function permissionsFor(profile, space, id, opts) {
     if (profile === "delivery")
         return deliveryPermissions(space, id); // scoped server-side Plane-3 infra
     if (profile === "membership-rw")
         return membershipRwPermissions(space, id); // scoped graph-feed reader/writer
-    if (profile === "manager")
-        return {}; // privileged: allow-all defaults
+    if (profile === "supervisor")
+        return supervisorPermissions(space, id); // always-on daemon (closure (ii) gate)
+    if (profile === "provisioner")
+        return provisionerPermissions(space, id); // ephemeral onboarding authority (closure (ii))
+    if (profile === "deprovisioner") {
+        // Ephemeral, TARGET-PINNED teardown (#159 B) — the counterpart to `provisioner`. It deletes exactly
+        // ONE departed agent's id-keyed footprint, so the target id is REQUIRED and baked into the grants.
+        if (!opts.deprovisionTarget)
+            throw new Error("permissionsFor: deprovisioner requires opts.deprovisionTarget (the departed agent's id)");
+        return deprovisionerPermissions(space, id, opts.deprovisionTarget);
+    }
+    if (profile === "purger")
+        return purgerPermissions(space, id); // ephemeral history-purge (closure (ii))
+    if (profile === "operator")
+        return operatorPermissions(space, id); // human-CLI client (send/dm/ask) (closure (ii))
+    if (profile === "probe")
+        return probePermissions(id); // connect-only liveness/auth preflight (PR 1.5)
+    if (profile === "channel-writer")
+        return channelWriterPermissions(space, id); // channel-registry writes (PR 1.5)
+    if (profile === "channel-purger")
+        return channelPurgerPermissions(space, id); // channel-writer + CHAT purge (PR 1.5)
+    if (profile === "teardown")
+        return teardownPermissions(space, id); // sole STREAM.DELETE holder (PR 1.5)
+    if (profile === "control-caller-privileged")
+        return controlCallerPermissions(space, id, CONTROL_PRIVILEGED); // ps/start (PR 1.5)
+    if (profile === "control-caller-admin")
+        return controlCallerPermissions(space, id, CONTROL_ADMIN); // stop/attach (PR 1.5)
+    if (profile === "deployer")
+        return deployerPermissions(space, id); // spawn -f deploy authority (PR 1.5)
     const CHAT = chatStream(space), DM = dmStream(space), TASK = taskStream(space);
     const KV = `KV_${presenceBucket(space)}`;
     const CHKV = `KV_${channelBucket(space)}`; // channel registry (read-only for everyone)
@@ -190,6 +218,11 @@ function permissionsFor(profile, space, id, opts) {
         return { sub: { allow: sub }, pub: { allow } };
     }
     // ---- agent ----
+    // No silent fallthrough: every non-agent profile is handled above, so anything else reaching here is a
+    // stale/unwired profile string (e.g. a JS caller bypassing the closed `Profile` union). Fail loud rather
+    // than mint it agent perms by accident (the no-fallbacks rule; matches the deleted `manager`'s intent).
+    if (profile !== "agent")
+        throw new Error(`permissionsFor: unhandled profile "${profile}" — add an explicit arm, do not fall through to agent`);
     const allowPublish = opts.allowPublish ?? []; // post ACL — DEFAULT-DENY (publish must be declared)
     const allowSubscribe = opts.allowSubscribe?.length ? opts.allowSubscribe : ["general"]; // read ACL
     // Re-assert at the mint chokepoint (covers mint/spawn paths that bypass the file loader): a policy
@@ -306,7 +339,418 @@ function permissionsFor(profile, space, id, opts) {
     // Replies to this agent's durable join/leave/list requests ride `ctl.delivery.<id>.>` (NOT the
     // per-id _INBOX), so the scoped delivery daemon can answer without broad inbox-publish.
     const deliveryReplies = `${controlServiceSubject(space, CONTROL_DELIVERY, id)}.>`;
-    return { pub: { allow: pubAllow, deny: pubDeny }, sub: { allow: [inbox, deliveryReplies, ...subChat] } };
+    // Bounded control replies (closure (i)): the manager's lifecycle tiers now reply on
+    // `ctl.<tier>.<id>.reply.>` (not the per-id `_INBOX`), so each agent must subscribe the reply subtree
+    // for the tiers it may call. Every agent can self-stop ⇒ always grant the self tier; the privileged
+    // tier's reply is granted only with the spawn capability (which also grants the request publish above).
+    // Admin is manager-only — agents never call it, so no admin reply sub.
+    const controlReplies = [`${controlServiceSubject(space, CONTROL_SELF_SERVICE, id)}.reply.>`];
+    if (opts.capabilities?.includes("spawn"))
+        controlReplies.push(`${controlServiceSubject(space, CONTROL_PRIVILEGED, id)}.reply.>`);
+    return { pub: { allow: pubAllow, deny: pubDeny }, sub: { allow: [inbox, deliveryReplies, ...controlReplies, ...subChat] } };
+}
+/** The long-lived SUPERVISOR permission set (closure (ii), residual 2) — the always-on manager daemon
+ *  (`manager.ts` `this.ep`), carved down from the former allow-all `manager`. THIS is the cred whose
+ *  STANDING breadth was the residual-2 gate: tightening it removes the always-on DM/DLV body-read AND the
+ *  stream-admin tamper from the one connection that never goes away. It does exactly three things — serve
+ *  the three lifecycle control tiers (bounded replies), hold the singleton manager lease, and publish +
+ *  watch presence (the roster) — and nothing else. Provisioning (DM/DLV/TASK consumer-create + ACL
+ *  writes) moves to the EPHEMERAL `provisioner` (opened per-spawn); destructive history-purge moves to the
+ *  EPHEMERAL `purger`. So the supervisor holds NO chat/inst/svc publish (it never posts — only
+ *  `setActivity`, a presence write), NO DM/DLV read of any kind (no consumer-create, no native sub), NO
+ *  stream CREATE/DELETE/PURGE/UPDATE, NO channel-registry access (the daemon sets `watchChannels:false`).
+ *  `$JS` is an ENUMERATED allow-list — exactly the presence-watch + lease-KV verbs — never `$JS.>`. A
+ *  leaked supervisor cred can hold/serve control and read the public roster; it cannot read a DM, forge an
+ *  actor, provision, purge, or tamper with a stream. */
+function supervisorPermissions(space, id) {
+    const PKV = `KV_${presenceBucket(space)}`, MKV = `KV_${managerBucket(space)}`;
+    // The three SERVED lifecycle tiers (manager.ts serveControl): subscribe `ctl.<tier>.*` (queue-grouped)
+    // and reply on the bounded `ctl.<tier>.<caller>.reply.<uuid>` subtree. Plain NATS request/reply — no
+    // `$JS.ACK` for control replies (panel blocker #6).
+    const tiers = [CONTROL_PRIVILEGED, CONTROL_SELF_SERVICE, CONTROL_ADMIN];
+    const ctlServe = tiers.map((t) => controlServiceSubject(space, t, "*")); // ctl.<tier>.*
+    const ctlReplies = tiers.map((t) => `${controlServiceSubject(space, t, "*")}.reply.>`);
+    return {
+        pub: {
+            allow: [
+                "$JS.API.INFO",
+                // Singleton manager lease (managerBucket, pre-created at `cotal up`): OPEN-ONLY bind + CAS the one
+                // lease key (acquire/renew/release) + read it. NO STREAM.CREATE (pre-created), DELETE, or PURGE.
+                `$JS.API.STREAM.INFO.${MKV}`,
+                `$JS.API.STREAM.MSG.GET.${MKV}`, // readManagerLease + CAS-conflict kv.get (auth-mode kvm.open ⇒ MSG.GET)
+                `$KV.${managerBucket(space)}.${MANAGER_LEASE_KEY}`, // the SINGLE lease key (create/update/delete = $KV publishes)
+                // Presence: publish OWN key + watch the roster. Own key only (no peer-key forge — residual 3); no
+                // presence-stream purge/delete (no force-offline tamper). No presence kv.get (roster is the in-memory
+                // watch cache + sweep), so no STREAM.MSG.GET on presence.
+                `$KV.${presenceBucket(space)}.${id}`,
+                `$JS.API.STREAM.INFO.${PKV}`,
+                `$JS.API.CONSUMER.CREATE.${PKV}.>`, // kv.watch ordered consumer (roster)
+                `$JS.API.CONSUMER.INFO.${PKV}.>`,
+                "$JS.FC.>", // ordered-consumer flow control
+                // Control: reply to any caller on each SERVED tier (bounded). It SERVES (does not call), so no
+                // request-publish grant and no position-1 wildcard.
+                ...ctlReplies,
+            ],
+        },
+        sub: {
+            // Own reply inbox + the three served control tiers (queue-grouped). NO chat/inst/dlv native sub (the
+            // supervisor reads no feed), NO broad `$JS.>`/`$KV.>` (the residual-2 read/admin path is gone).
+            allow: [`_INBOX_${id}.>`, ...ctlServe],
+        },
+    };
+}
+/** The human-CLI OPERATOR permission set (closure (ii), residual 2) — the ephemeral key the headless
+ *  client commands mint (`cotal send dm|msg|ask`, `cotal dm`, `personas list --running`, via
+ *  `openTransient`). It does exactly what those do: POST as itself (chat/DM/anycast — self-scoped, can
+ *  never forge another actor), and READ the public roster (presence) + the channel registry to resolve a
+ *  name→id and a channel's delivery class. Much narrower than the old broad `manager`: NO serve-control,
+ *  NO DM/DLV body read, NO chat-history read, NO stream CREATE/DELETE/PURGE, NO ACL write, NO lease, NO
+ *  provisioning. A leaked operator cred can post as itself and read the roster — the same surface as the
+ *  human who ran the command. (The interactive `cotal join` console — chat read + own-DM receive — is a
+ *  separate, fuller surface, deferred: it needs the unprovisioned-console DM self-create fixed first.) */
+function operatorPermissions(space, id) {
+    const PKV = `KV_${presenceBucket(space)}`, CHKV = `KV_${channelBucket(space)}`;
+    return {
+        pub: {
+            allow: [
+                // Post AS itself only — self-scoped, so a leaked operator cred can never forge a message
+                // attributable to another actor.
+                chatSubject(space, id, ">"), // chat.<id>.>  — multicast any channel as me
+                unicastSubject(space, "*", id), // inst.*.<id>  — DM any peer as me
+                anycastSubject(space, "*", id), // svc.*.<id>   — anycast any role as me
+                `$KV.${presenceBucket(space)}.${id}`, // own presence key (when a caller registers; own key only)
+                "$JS.API.INFO",
+                // Presence watch (name→id resolution + the live roster) — read-only ordered consumer. No
+                // STREAM.MSG.GET (the roster is the in-memory watch cache).
+                `$JS.API.STREAM.INFO.${PKV}`,
+                `$JS.API.CONSUMER.CREATE.${PKV}.>`,
+                `$JS.API.CONSUMER.INFO.${PKV}.>`,
+                // Channel registry read — the transient endpoint opens+watches it, and multicast reads a
+                // channel's delivery class. Read-only (no `$KV.<channel>` write — that's the provisioner).
+                `$JS.API.STREAM.INFO.${CHKV}`,
+                `$JS.API.STREAM.MSG.GET.${CHKV}`,
+                // Keyed KV get rides `DIRECT.GET.<stream>.$KV.<bucket>.<key>` — the key is in the SUBJECT, so
+                // the grant needs the trailing `.>` (unlike STREAM.MSG.GET, which carries it in the payload).
+                `$JS.API.DIRECT.GET.${CHKV}.>`,
+                `$JS.API.CONSUMER.CREATE.${CHKV}.>`,
+                `$JS.API.CONSUMER.INFO.${CHKV}.>`,
+                "$JS.FC.>", // ordered-consumer flow control
+            ],
+        },
+        // Own reply inbox only (presence/channel watch ordered-consumer delivery + any request replies land
+        // here). NO chat/inst/dlv native sub — the operator posts and reads the roster, it receives no feed.
+        sub: { allow: [`_INBOX_${id}.>`] },
+    };
+}
+/** Connect-only PROBE (PR 1.5) — the liveness/auth preflight (`preflight.ts preflightTarget`, minted on
+ *  ~every CLI command that resolves a mesh). `probeConnect` opens a connection to prove the broker is up
+ *  and the creds are accepted, then closes it — it performs NO pub/sub. So the tightest possible grant:
+ *  deny ALL publish, subscribe only to the own reply inbox. A leaked probe cred can open a socket and do
+ *  nothing else. (Was the broad `manager` cred — minted on nearly every command, the worst over-grant.) */
+function probePermissions(id) {
+    return { pub: { deny: [">"] }, sub: { allow: [`_INBOX_${id}.>`] } };
+}
+/** CHANNEL-WRITER (PR 1.5) — edits the channel registry ONLY: `cotal channels set/default` and the
+ *  `spawn -f` new-channel seed (`seedChannelRegistry`). It VALUE-writes `$KV.<channelBucket>` (a channel's
+ *  config key) and read-before-writes it. NO stream data, NO other bucket, NO chat/DM — a leaked
+ *  channel-writer can only rewrite channel config, never post, read a body, or tear a stream down. */
+function channelWriterPermissions(space, id) {
+    const CHKV = `KV_${channelBucket(space)}`;
+    return {
+        pub: {
+            allow: [
+                "$JS.API.INFO",
+                `$KV.${channelBucket(space)}.>`, // create/update/delete a channel config key
+                `$JS.API.STREAM.INFO.${CHKV}`, // kvm.open/create existence check
+                `$JS.API.STREAM.CREATE.${CHKV}`, // kvm.create is create-if-matching (bucket already exists post-up)
+                // read-before-write: kvm.open rides STREAM.MSG.GET; kvm.create (direct=true) rides keyed DIRECT.GET.
+                `$JS.API.STREAM.MSG.GET.${CHKV}`,
+                `$JS.API.DIRECT.GET.${CHKV}.>`,
+            ],
+        },
+        sub: { allow: [`_INBOX_${id}.>`] },
+    };
+}
+/** CHANNEL-PURGER (PR 1.5) — the `cotal web` dashboard's ONLY write path: delete a channel
+ *  (`clearChannel` = filtered `STREAM.PURGE.CHAT` to drop the channel's messages + a `$KV.<channelBucket>`
+ *  key delete). Pre-minted once by `web` so the account signing seed falls out of scope; the dashboard's
+ *  READ side runs on the separate read-only `admin` cred. = channel-writer + the scoped CHAT purge. */
+function channelPurgerPermissions(space, id) {
+    const CHKV = `KV_${channelBucket(space)}`;
+    // `clearChannel` only kvm.OPENs the (already-created) bucket, key-deletes, and purges — it never
+    // kvm.creates, so — unlike channel-writer's set/default back-compat path — this cred gets NO
+    // `STREAM.CREATE`. Compose the shared channel-KV read + delete verbs + the scoped CHAT purge explicitly.
+    return {
+        pub: {
+            allow: [
+                "$JS.API.INFO",
+                `$KV.${channelBucket(space)}.>`, // delete the channel's registry key
+                `$JS.API.STREAM.INFO.${CHKV}`, // kvm.open existence check
+                `$JS.API.STREAM.MSG.GET.${CHKV}`, // read-before-delete
+                `$JS.API.DIRECT.GET.${CHKV}.>`,
+                `$JS.API.STREAM.PURGE.${chatStream(space)}`, // drop the channel's chat messages
+            ],
+        },
+        sub: { allow: [`_INBOX_${id}.>`] },
+    };
+}
+/** TEARDOWN (PR 1.5) — `cotal down -f` space teardown. The SOLE cred that keeps `STREAM.DELETE` (the
+ *  face-b tamper verb). `down -f` is multi-step: `connectProbe` (presence-watch + channel-registry read)
+ *  → `requestControl(CONTROL_ADMIN, ps/stop)` to politely stop the managed agents → `deleteChannels`
+ *  (channel-registry key delete + CHAT purge) → `deleteSpace` (STREAM.DELETE all 12 space streams/buckets).
+ *  So it reads state, CALLS admin control, deletes channels, and deletes streams — but NEVER reads a
+ *  DM/DLV body, posts chat, or forges. Isolated here so no standing operator/provisioner/supervisor cred
+ *  can delete a stream; a leaked teardown can wipe a space you own + stop its agents (that IS its job),
+ *  nothing else. Minted ephemerally per teardown from the local trust material (same-checkout `down -f`). */
+function teardownPermissions(space, id) {
+    const CHAT = chatStream(space);
+    const PKV = `KV_${presenceBucket(space)}`, CHKV = `KV_${channelBucket(space)}`;
+    // deleteSpace() deletes EVERY stream + KV bucket setup creates (5 streams + 7 buckets); each needs
+    // INFO (jsm existence) + DELETE. This is the ONLY cred that holds STREAM.DELETE (face-b isolated here).
+    const del = [
+        CHAT, dmStream(space), taskStream(space), inboxStream(space), dlvStream(space),
+        PKV, CHKV, `KV_${membersBucket(space)}`, `KV_${aclBucket(space)}`,
+        `KV_${membershipBucket(space)}`, `KV_${deliveryBucket(space)}`, `KV_${managerBucket(space)}`,
+    ].flatMap((s) => [`$JS.API.STREAM.INFO.${s}`, `$JS.API.STREAM.DELETE.${s}`]);
+    return {
+        pub: {
+            allow: [
+                "$JS.API.INFO",
+                // connectProbe read: presence watch (name→id + roster) + channel registry read.
+                `$JS.API.CONSUMER.CREATE.${PKV}.>`,
+                `$JS.API.CONSUMER.INFO.${PKV}.>`,
+                `$JS.API.STREAM.MSG.GET.${CHKV}`,
+                `$JS.API.DIRECT.GET.${CHKV}.>`,
+                `$JS.API.CONSUMER.CREATE.${CHKV}.>`,
+                `$JS.API.CONSUMER.INFO.${CHKV}.>`,
+                "$JS.FC.>", // ordered-consumer flow control
+                // Stop the managed agents via the admin control tier (ps + per-agent stop).
+                controlServiceSubject(space, CONTROL_ADMIN, id),
+                ...del,
+                // deleteChannels/clearChannel: purge the channel's chat messages + delete its registry key.
+                `$JS.API.STREAM.PURGE.${CHAT}`,
+                `$KV.${channelBucket(space)}.>`,
+            ],
+        },
+        // Own inbox (connectProbe presence-watch delivery + JS API responses) + the BOUNDED admin control-reply
+        // subtree: the agent-stop step is `requestControl(CONTROL_ADMIN, ps/stop)`, whose reply rides
+        // `ctl.admin.<id>.reply.<uuid>` (NOT `_INBOX`) — without this grant those calls hang and the agents are
+        // never stopped before the streams are deleted.
+        sub: { allow: [`_INBOX_${id}.>`, `${controlServiceSubject(space, CONTROL_ADMIN, id)}.reply.>`] },
+    };
+}
+/** CONTROL-CALLER (PR 1.5) — the operator's lifecycle commands (`cotal ps/start/stop/attach`,
+ *  `manager/commands.ts`). It CALLS ONE of the running manager's control tiers and reads the bounded
+ *  reply on its own inbox. That is ALL — no `$JS`, no `$KV`, no chat/DM: it forges nothing, reads no body.
+ *
+ *  The tiers are SPLIT because the manager's control authz is SUBJECT-gated, NOT caller-identity-gated
+ *  (`manager.ts authorizeNamed`: `if (admin) return undefined` — ANY caller reaching `ctl.<admin>` may
+ *  stop/attach ANY agent; the privileged tier restricts named ops to the caller's OWN spawned child).
+ *  So the BROKER grant is load-bearing: holding `ctl.<admin>.<id>` pub *is* cross-agent stop/attach
+ *  power — the manager does not re-narrow it by `req.from.id`. Therefore:
+ *   • `control-caller-privileged` (ps/start) gets ONLY `ctl.<privileged>.<id>` — structurally barred from
+ *     cross-agent admin ops by the broker. This is the high-frequency path; it never needs admin reach.
+ *   • `control-caller-admin` (stop/attach) gets ONLY `ctl.<admin>.<id>` — it genuinely needs cross-agent
+ *     reach. Its containment is NOT a manager re-check (there is none): it is the broker gating the admin
+ *     subject + the cred being ephemeral (mint → one request → disconnect, from the local signing seed). */
+function controlCallerPermissions(space, id, tier) {
+    const reqSubject = controlServiceSubject(space, tier, id);
+    return {
+        pub: { allow: [reqSubject] }, // exactly ONE tier — ps/start XOR stop/attach
+        // Own inbox + the BOUNDED control-reply subtree. `requestControl` issues a `noMux` request whose reply
+        // rides `ctl.<tier>.<id>.reply.<uuid>` (UNDER its own request subject, NOT `_INBOX`), so it must be able
+        // to subscribe that subtree — without this grant the reply sub is broker-denied and every control call
+        // hangs to timeout (endpoint.ts:803-806 predicts exactly this).
+        sub: { allow: [`_INBOX_${id}.>`, `${reqSubject}.reply.>`] },
+    };
+}
+/** DEPLOYER (PR 1.5) — the `cotal spawn -f` manifest-deploy authority. `spawn -f` drives ONE
+ *  `connectProbe` endpoint that both READS live state (roster/presence watch, channel registry,
+ *  membership feed, manager-singleton lease) AND control-CALLS the running manager's admin tier
+ *  (`launch` + `ps` readiness — both `CONTROL_ADMIN`). Those interleave on one connection, so a strict
+ *  3-connection split would only refactor `live.ts` for marginal gain; `deployer` is that one coherent,
+ *  ephemeral deploy cred. It is the SOLE profile that combines reads + admin-control — NOT a template a
+ *  4th command should reach for (revisit the connection split before adding a second such caller).
+ *
+ *  Boundaries (all enforced by omission / default-deny): NO self-post (`chat`/`inst`/`svc`), NO `$JS.>`,
+ *  NO `STREAM.DELETE`/`PURGE`/`UPDATE`, NO DM/DLV/TASK `CONSUMER.CREATE` (no body-read surface), NO `$KV`
+ *  writes (channel seeding rides a SEPARATE `channel-writer` cred), admin tier ONLY (no privileged, no
+ *  serve). It holds `ctl.<admin>.<id>` because manifest launch/ps genuinely need the admin tier — and
+ *  that IS real cross-agent power: the manager's admin authz is subject-gated, not caller-identity-gated
+ *  (`authorizeNamed`: `if (admin) return undefined`), so holding the admin pub grant lets it stop/attach/
+ *  launch ANY agent, with no manager-side `req.from.id` re-check. The BROKER gating that subject is the
+ *  boundary. Containment is therefore the LIFETIME, not a manager re-check: minted from LOCAL same-checkout
+ *  auth for one `spawn -f`, memory-only, dropped after deploy. If it is ever persisted, handed to
+ *  user-supplied `--creds`, or reused as a general "read + admin" cred, revisit. */
+function deployerPermissions(space, id) {
+    const PKV = `KV_${presenceBucket(space)}`, CHKV = `KV_${channelBucket(space)}`;
+    const MSHIP = `KV_${membershipBucket(space)}`, MGRKV = `KV_${managerBucket(space)}`;
+    // Read verbs for a KV bucket SCANNED/WATCHED via an ordered consumer (presence, channel registry, and
+    // the membership feed — `readMembership` enumerates keys via `kv.keys()`): existence + kv.get (both
+    // STREAM.MSG.GET and keyed DIRECT.GET forms) + the ordered consumer. NO `$KV.<bucket>` publish → no write.
+    const kvScan = (bucket) => [
+        `$JS.API.STREAM.INFO.${bucket}`,
+        `$JS.API.STREAM.MSG.GET.${bucket}`,
+        `$JS.API.DIRECT.GET.${bucket}.>`,
+        `$JS.API.CONSUMER.CREATE.${bucket}.>`,
+        `$JS.API.CONSUMER.INFO.${bucket}.>`,
+    ];
+    // A KV bucket read by a KEYED point-get only (`readManagerLease` = kvm.open + `kv.get(LEASE_KEY)`, no
+    // scan/watch): existence + kv.get, but NO ordered-consumer verbs (nothing enumerates or watches it).
+    const kvPointRead = (bucket) => [
+        `$JS.API.STREAM.INFO.${bucket}`,
+        `$JS.API.STREAM.MSG.GET.${bucket}`,
+        `$JS.API.DIRECT.GET.${bucket}.>`,
+    ];
+    return {
+        pub: {
+            allow: [
+                "$JS.API.INFO",
+                ...kvScan(PKV), // presence watch — roster + name→id
+                ...kvScan(CHKV), // channel registry read (readChannelRegistry + classifyChannels)
+                ...kvScan(MSHIP), // membership FEED read (readMembership → detectUnmanagedActors) — the membership_ bucket
+                ...kvPointRead(MGRKV), // manager-singleton lease keyed read (waitManagerReady) — point-get, NO write, NO watch
+                "$JS.FC.>", // ordered-consumer flow control
+                // Admin control tier ONLY — launch + ps readiness (both CONTROL_ADMIN). No privileged subject.
+                controlServiceSubject(space, CONTROL_ADMIN, id),
+            ],
+        },
+        // Own inbox (presence/registry watch delivery + JS API responses) + the BOUNDED admin control-reply
+        // subtree: `requestControl(CONTROL_ADMIN, launch/ps)` subscribes `ctl.admin.<id>.reply.<uuid>`, so
+        // without this grant the launch + ps-readiness calls hang to timeout.
+        sub: { allow: [`_INBOX_${id}.>`, `${controlServiceSubject(space, CONTROL_ADMIN, id)}.reply.>`] },
+    };
+}
+/** The ephemeral PURGER permission set (closure (ii), residual 2) — minted per-purge inside the daemon's
+ *  `opPurge` and `cotal history clear`. Isolates the DESTRUCTIVE history-purge grant
+ *  (`STREAM.PURGE.CHAT` + `STREAM.PURGE.DM`) off the always-on supervisor: `--dms` purges the DM stream,
+ *  exactly the grant the supervisor must not hold. It PURGES but never READS — no DM/chat consumer, no
+ *  `MSG.GET` — so a leaked purger can drop history but cannot read a body. Short-lived (one purge call). */
+function purgerPermissions(space, id) {
+    const CHAT = chatStream(space), DM = dmStream(space);
+    return {
+        pub: {
+            allow: [
+                "$JS.API.INFO", // jetstreamManager bootstrap; STREAM.PURGE needs no prior STREAM.INFO
+                `$JS.API.STREAM.PURGE.${CHAT}`, // clearSpaceHistory chat purge
+                `$JS.API.STREAM.PURGE.${DM}`, // clearSpaceHistory includeDms — the isolated DM-purge grant
+            ],
+            // NOTE: this profile does NOT cover `clearChannel` (web/`down -f` channel-delete) — that also does a
+            // `$KV.<channelBucket>.<ch>` registry delete this cred lacks; it stays on the broad operator/CLI cred.
+        },
+        sub: { allow: [`_INBOX_${id}.>`] },
+    };
+}
+/** The ephemeral PROVISIONER permission set (closure (ii), residual 2) — the onboarding authority,
+ *  carved off the long-lived manager. Minted short-lived for per-spawn provisioning (pre-create each
+ *  agent's bind-only DM/DLV/TASK durables + record its read ACL via `commitAcl`) — the daemon opens it per
+ *  spawn (`manager.ts withProvisioner`). It is ALSO the cred that creates the space's streams + KV buckets
+ *  and seeds the channel registry via `setupSpaceStreams` (exercised by the manager-split smoke) — and
+ *  `cotal up`'s ephemeral setup cred (`up.ts authSetup`) now mints THIS profile, not the broad `manager`.
+ *  NEVER minted for an agent — `cotal mint` whitelists
+ *  agent/observer/admin only, like `manager`/`delivery`.
+ *
+ *  This profile HOLDS the DM/DLV `CONSUMER.CREATE` push-consumer surface — the irreducible onboarding
+ *  power (the create-time `deliver_subject` of a push consumer is not ACL-constrained, so whoever can
+ *  create a DM/DLV consumer can stream the bodies). That is exactly why it is split OFF the always-on
+ *  supervisor and made EPHEMERAL: the daemon opens a provisioner connection per spawn and drains it
+ *  immediately, so the surface exists only for the provisioning window, not as a standing target. The
+ *  cred is MEMORY-ONLY (never written to `.cotal`); short-`exp`/revocation is the auth-callout follow-up.
+ *
+ *  `$JS` is an ENUMERATED allow-list, never `$JS.>`: STREAM.CREATE + INFO for the space streams/buckets,
+ *  DM/DLV/TASK consumer CREATE/DURABLE.CREATE/INFO — and deliberately NO `MSG.NEXT`/`MSG.GET`/`ACK` on
+ *  DM/DLV (it creates the bind-only mailbox but never reads it), NO STREAM.DELETE/PURGE/UPDATE/MSG.DELETE
+ *  (it provisions, it does not tear down or tamper). KV value-writes are scoped to exactly the two
+ *  registries provisioning touches: the read-ACL bucket (`commitAcl`) and the channel registry (seed). */
+function provisionerPermissions(space, id) {
+    const CHAT = chatStream(space), DM = dmStream(space), TASK = taskStream(space);
+    const INBOX = inboxStream(space), DLV = dlvStream(space);
+    // Every backing stream the provisioner pre-creates — the 5 message streams + the KV buckets (a bucket's
+    // backing stream is `KV_<bucket>`). `managerBucket` is now pre-created here too (so the supervisor binds
+    // its lease open-only); members/membership/delivery are written by other creds but created at setup here.
+    const buckets = [
+        presenceBucket, channelBucket, membersBucket, aclBucket, membershipBucket, deliveryBucket, managerBucket,
+    ].map((b) => `KV_${b(space)}`);
+    // STREAM.CREATE + INFO for each (idempotent setup at `cotal up`; CREATE is create-if-matching, INFO covers
+    // the client's existence checks). NO DELETE/PURGE/UPDATE — provisioning never tears a stream down.
+    const streamSetup = [CHAT, DM, TASK, INBOX, DLV, ...buckets].flatMap((s) => [
+        `$JS.API.STREAM.CREATE.${s}`,
+        `$JS.API.STREAM.INFO.${s}`,
+    ]);
+    // DM/DLV/TASK durable pre-create (bind-only mailboxes): both the new-API CREATE and legacy DURABLE.CREATE
+    // forms (the client's consumer-add path varies by version), plus INFO (the add returns ConsumerInfo).
+    // NO MSG.NEXT/MSG.GET/ACK — the provisioner creates the consumer but MUST NOT read its body.
+    const consumerCreate = [DM, DLV, TASK].flatMap((s) => [
+        `$JS.API.CONSUMER.CREATE.${s}.>`,
+        `$JS.API.CONSUMER.DURABLE.CREATE.${s}.>`,
+        `$JS.API.CONSUMER.INFO.${s}.>`,
+    ]);
+    return {
+        pub: {
+            allow: [
+                "$JS.API.INFO",
+                ...streamSetup,
+                ...consumerCreate,
+                // KV value-writes — exactly the two registries provisioning writes: the agent read-ACL registry
+                // (`commitAcl` at provision) and the channel registry (seed defaults at `cotal up`, channel admin).
+                // NO presence/members/membership/delivery writes (the agent's own key, the delivery cred, and the
+                // membership-rw cred own those).
+                `$KV.${aclBucket(space)}.>`,
+                `$KV.${channelBucket(space)}.>`,
+                // ...and READ both: commitAcl read-before-writes the ACL (`kvm.open`, direct=false ⇒ STREAM.MSG.GET);
+                // the channel seed read-before-writes defaults (`kvm.create`, direct=true ⇒ DIRECT.GET). Grant both
+                // read verbs on both buckets to cover the open/create-path variance — reads of registries it already
+                // writes, no escalation. Without these the read-before-write rejects and provisioning/seed throws.
+                `$JS.API.STREAM.MSG.GET.KV_${aclBucket(space)}`,
+                `$JS.API.DIRECT.GET.KV_${aclBucket(space)}.>`, // keyed get: `.>` (the key rides the subject)
+                `$JS.API.STREAM.MSG.GET.KV_${channelBucket(space)}`,
+                `$JS.API.DIRECT.GET.KV_${channelBucket(space)}.>`, // keyed get: `.>` (the key rides the subject)
+            ],
+        },
+        // Replies only: every stream/consumer/KV-create PubAck and JS API response lands on the per-id inbox.
+        // NO chat/inst/dlv/ctl subscription — the provisioner never serves control nor reads any feed.
+        sub: { allow: [`_INBOX_${id}.>`] },
+    };
+}
+/** The ephemeral, TARGET-PINNED DEPROVISIONER permission set (#159 Part B) — the teardown counterpart
+ *  to {@link provisionerPermissions}, minted per departed agent inside the manager's `deprovision` tail
+ *  (`withProvisioner`-style: a fresh scoped cred per teardown is cheap). It deletes exactly the id-keyed
+ *  footprint the provisioner created for ONE agent: that agent's two bind-only durables (`dm_<id>`,
+ *  `dlv_<id>`) and its read-ACL row — pinned BY NAME to the `target` id, so a leaked deprovisioner cred
+ *  can tear down that one (already-dead) agent and NOTHING else.
+ *
+ *  Deliberately NOT granted (least-privilege / correctness): the role-SHARED `svc_<role>` TASK durable
+ *  (one consumer for ALL agents of a role — deleting it on one agent's exit would break its siblings; it
+ *  lives until space teardown), any peer's `dm_`/`dlv_`/ACL (the grants are target-name-pinned, never
+ *  `.>`), any MSG.NEXT/MSG.GET/ACK (it deletes mailboxes, never reads a body), and any STREAM
+ *  DELETE/PURGE (it removes per-agent consumers, never a stream). The `chathist_<id>` history consumers
+ *  need no grant here — they are ephemeral (`mem_storage`, 30s inactive threshold) and agent-deleted
+ *  after each read, so they self-clean on the agent's disconnect.
+ *
+ *  Blast radius of a leaked cred (minted for target T): it can delete T's `dm_<T>`/`dlv_<T>` durables +
+ *  purge T's ACL row — a denial-of-DELIVERY for T (broken DM/DLV bind + the reader DEFERs on the absent
+ *  ACL) if fired while T is still alive. It CANNOT read T's bodies, impersonate T, reach any peer, or
+ *  delete a stream — and it is ephemeral (one per-exit teardown, minted then dropped). Contained and
+ *  recoverable (re-provision T). */
+function deprovisionerPermissions(space, id, target) {
+    const DM = dmStream(space), DLV = dlvStream(space);
+    return {
+        pub: {
+            allow: [
+                "$JS.API.INFO", // jetstreamManager bootstrap
+                // Delete the target's two bind-only durables BY EXACT NAME (id-keyed) — no `.>`, no cross-agent reach.
+                `$JS.API.CONSUMER.DELETE.${DM}.${dmDurable(target)}`,
+                `$JS.API.CONSUMER.DELETE.${DLV}.${dlvDurable(target)}`,
+                // Purge the target's read-ACL row (own-target key only — the reader then treats it as an unknown
+                // owner). `kvm.open` binds the pre-created bucket; the purge rides `$KV.<aclBucket>.<key>`.
+                `$JS.API.STREAM.INFO.KV_${aclBucket(space)}`,
+                `$KV.${aclBucket(space)}.${aclKey(target)}`,
+            ],
+        },
+        // Replies only: the CONSUMER.DELETE PubAcks + KV purge ack land on the per-id inbox. NO chat/DM/ctl
+        // subscription — the deprovisioner serves nothing and reads no feed.
+        sub: { allow: [`_INBOX_${id}.>`] },
+    };
 }
 /** The scoped `delivery` daemon permission set (server-side Plane-3 infra; NEVER allow-all, never
  *  minted for an agent — `cotal mint` excludes it, like `manager`). Least-privilege: exactly what the

package/dist/provision.js.map

@@ -1 +1 @@
-{"version":3,"file":"provision.js","sourceRoot":"","sources":["../src/provision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,cAAc,EACd,aAAa,EACb,UAAU,EACV,QAAQ,GACT,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACrF,OAAO,EACL,KAAK,EACL,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EAChB,UAAU,EACV,QAAQ,EACR,UAAU,EACV,SAAS,EACT,WAAW,EACX,eAAe,EACf,SAAS,EACT,WAAW,EACX,UAAU,EACV,cAAc,EACd,aAAa,EACb,aAAa,EACb,SAAS,EACT,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACnB,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,cAAc,EACd,oBAAoB,GACrB,MAAM,eAAe,CAAC;AAsBvB,uFAAuF;AACvF,wFAAwF;AACxF,8DAA8D;AAC9D,MAAM,WAAW,GAAG;IAClB,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IACtD,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI;CAC9B,CAAC;AACX,MAAM,WAAW,GAAG,EAAE,GAAG,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,EAAE,CAAC;AAC1E,MAAM,UAAU,GAAG,EAAE,GAAG,WAAW,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;AAEvE;;;;;;;yEAOyE;AACzE,MAAM,UAAU,cAAc,CAAC,IAAe;IAC5C,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;QAC/B,OAAO,EAAE;YACP,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG;YACrB,IAAI,EAAE,EAAE;YACR,GAAG,EAAE,EAAE;YACP,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;YACrC,UAAU,EAAE,EAAE;SACf;QACD,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;KAC1B,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAa;IACjD,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC,CAAC,yCAAyC;IACvE,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC;IAEpC,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,SAAS,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC;IACnG,MAAM,UAAU,GAAG,MAAM,aAAa,CACpC,KAAK,CAAC,KAAK,CAAC,EACZ,GAAG,EACH,EAAE,YAAY,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,EAC5D,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAE1F,MAAM,GAAG,GAAG,CAAC,CAAa,EAAE,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO;QACL,KAAK;QACL,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE;QACxD,OAAO,EAAE;YACP,GAAG,EAAE,GAAG,CAAC,YAAY,EAAE;YACvB,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YACxB,GAAG,EAAE,UAAU;YACf,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE;SAChC;QACD,oGAAoG;QACpG,kGAAkG;QAClG,GAAG,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE;KACrE,CAAC;AACJ,CAAC;AAiED;;;;;kGAKkG;AAClG,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,WAA+B,EAC/B,IAAe,EACf,QAAkB,EAClB,OAAsB,EAAE;IAExB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACxE,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,gGAAgG;IAChG,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,SAAS,EAAE,GAAG,cAAc,CAAC;QAAE,kBAAkB,CAAC,EAAE,CAAC,CAAC;IAC3E,8FAA8F;IAC9F,4FAA4F;IAC5F,iEAAiE;IACjE,KAAK,MAAM,EAAE,IAAI,SAAS;QACxB,IAAI,CAAC,cAAc,CAAC,cAAc,EAAE,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CACb,8BAA8B,EAAE,mCAAmC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAChG,CAAC;IACN,MAAM,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAChD,MAAM,WAAW,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACjD,sGAAsG;IACtG,mGAAmG;IACnG,uGAAuG;IACvG,iGAAiG;IACjG,iGAAiG;IACjG,+DAA+D;IAC/D,IAAI,IAAI,CAAC,iBAAiB,KAAK,KAAK;QAAE,MAAM,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;IAC/F,IAAI,IAAI,CAAC,IAAI;QAAE,MAAM,WAAW,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/D,OAAO,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;wDAMwD;AACxD,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAe,EACf,QAAkB,EAClB,OAAgB,EAChB,OAAiB,EAAE;IAEnB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,MAAM,UAAU,CAC9B,OAAO,EACP,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,EACvB,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAC5B,KAAK,EACL,EAAE,MAAM,EAAE,CACX,CAAC;IACF,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnF,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED;;;4BAG4B;AAC5B,SAAS,cAAc,CACrB,OAAgB,EAChB,KAAa,EACb,EAAU,EACV,IAAc;IAEd,IAAI,OAAO,KAAK,UAAU;QAAE,OAAO,mBAAmB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,mCAAmC;IACtG,IAAI,OAAO,KAAK,eAAe;QAAE,OAAO,uBAAuB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,kCAAkC;IAC9G,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC,CAAC,iCAAiC;IACvE,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/E,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,4CAA4C;IACvF,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,wDAAwD;IACvG,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,4DAA4D;IACzG,MAAM,KAAK,GAAG,UAAU,EAAE,IAAI,CAAC;IAE/B,IAAI,OAAO,KAAK,UAAU,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QAClD,sFAAsF;QACtF,gFAAgF;QAChF,wFAAwF;QACxF,+EAA+E;QAC/E,yFAAyF;QACzF,yFAAyF;QACzF,4FAA4F;QAC5F,yFAAyF;QACzF,8EAA8E;QAC9E,MAAM,GAAG,GACP,OAAO,KAAK,OAAO;YACjB,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC;YACpC,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG;YACZ,cAAc;YACd,uBAAuB,IAAI,EAAE;YAC7B,uBAAuB,EAAE,EAAE;YAC3B,sFAAsF;YACtF,yEAAyE;YACzE,2BAA2B,IAAI,EAAE;YACjC,2BAA2B,IAAI,IAAI;YACnC,yBAAyB,IAAI,IAAI;YACjC,6BAA6B,IAAI,IAAI;YACrC,2BAA2B,IAAI,IAAI;YACnC,WAAW,IAAI,IAAI;YACnB,2BAA2B,EAAE,IAAI,EAAE,+CAA+C;YAClF,yBAAyB,EAAE,IAAI;YAC/B,oFAAoF;YACpF,8FAA8F;YAC9F,uBAAuB,IAAI,EAAE;YAC7B,0BAA0B,IAAI,EAAE;YAChC,2BAA2B,IAAI,IAAI;YACnC,yBAAyB,IAAI,IAAI;YACjC,2BAA2B,IAAI,IAAI,EAAG,6BAA6B;YACnE,gGAAgG;YAChG,mGAAmG;YACnG,oGAAoG;YACpG,uBAAuB,KAAK,EAAE;YAC9B,0BAA0B,KAAK,EAAE;YACjC,2BAA2B,KAAK,IAAI;YACpC,yBAAyB,KAAK,IAAI;YAClC,2BAA2B,KAAK,IAAI;YACpC,UAAU,EAAE,gCAAgC;SAC7C,CAAC;QACF,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACxB,sFAAsF;YACtF,sFAAsF;YACtF,KAAK,CAAC,IAAI,CACR,uBAAuB,EAAE,EAAE,EAC3B,2BAA2B,EAAE,EAAE,EAC/B,2BAA2B,EAAE,IAAI,EACjC,yBAAyB,EAAE,IAAI,EAC/B,6BAA6B,EAAE,IAAI,EACnC,2BAA2B,EAAE,IAAI,EACjC,WAAW,EAAE,IAAI,CAClB,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;IACjD,CAAC;IAED,kBAAkB;IAClB,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,qDAAqD;IACnG,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW;IACnG,mGAAmG;IACnG,sFAAsF;IACtF,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,cAAc,EAAE,GAAG,YAAY,CAAC;QAAE,kBAAkB,CAAC,EAAE,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,kBAAkB,CAAC;IACnD,MAAM,SAAS,GAAG,eAAe,CAAC,EAAE,CAAC,EAAE,GAAG,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,0CAA0C;IAC/F,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5D,MAAM,QAAQ,GAAG;QACf,gGAAgG;QAChG,6EAA6E;QAC7E,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACvD,cAAc,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE,0CAA0C;QAC1E,cAAc,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE,2CAA2C;QAC3E,qBAAqB,CAAC,KAAK,EAAE,oBAAoB,EAAE,EAAE,CAAC,EAAE,oDAAoD;QAC5G,+FAA+F;QAC/F,iGAAiG;QACjG,gGAAgG;QAChG,qBAAqB,CAAC,KAAK,EAAE,gBAAgB,EAAE,EAAE,CAAC;QAClD,yEAAyE;QACzE,cAAc;QACd,4FAA4F;QAC5F,iGAAiG;QACjG,gGAAgG;QAChG,wFAAwF;QACxF,uBAAuB,IAAI,EAAE,EAAE,uBAAuB,EAAE,EAAE,EAAE,uBAAuB,IAAI,EAAE;QACzF,iGAAiG;QACjG,4FAA4F;QAC5F,4FAA4F;QAC5F,0FAA0F;QAC1F,uEAAuE;QACvE,iGAAiG;QACjG,gGAAgG;QAChG,8FAA8F;QAC9F,8FAA8F;QAC9F,wFAAwF;QACxF,6FAA6F;QAC7F,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,2BAA2B,IAAI,IAAI,SAAS,IAAI,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC;QAC5G,yBAAyB,IAAI,IAAI,SAAS,EAAE;QAC5C,6BAA6B,IAAI,IAAI,SAAS,EAAE;QAChD,2BAA2B,IAAI,IAAI,SAAS,EAAE;QAC9C,qFAAqF;QACrF,yBAAyB,EAAE,IAAI,GAAG,EAAE;QACpC,6BAA6B,EAAE,IAAI,GAAG,EAAE;QACxC,WAAW,EAAE,IAAI,GAAG,IAAI;QACxB,+FAA+F;QAC/F,8FAA8F;QAC9F,gGAAgG;QAChG,0FAA0F;QAC1F,yBAAyB,GAAG,IAAI,IAAI,EAAE;QACtC,6BAA6B,GAAG,IAAI,IAAI,EAAE;QAC1C,WAAW,GAAG,IAAI,IAAI,IAAI;QAC1B,2EAA2E;QAC3E,2BAA2B,EAAE,IAAI;QACjC,yBAAyB,EAAE,IAAI;QAC/B,UAAU;QACV,OAAO,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,4CAA4C;QAClF,yFAAyF;QACzF,+FAA+F;QAC/F,0BAA0B,IAAI,EAAE;QAChC,2BAA2B,IAAI,IAAI;QACnC,yBAAyB,IAAI,IAAI;QACjC,mGAAmG;QACnG,oGAAoG;QACpG,uDAAuD;QACvD,uBAAuB,KAAK,EAAE;QAC9B,0BAA0B,KAAK,EAAE;QACjC,iGAAiG;QACjG,kGAAkG;QAClG,qGAAqG;QACrG,sGAAsG;QACtG,uFAAuF;KACxF,CAAC;IACF,IAAI,IAAI,EAAE,CAAC;QACT,yFAAyF;QACzF,oFAAoF;QACpF,wFAAwF;QACxF,QAAQ,CAAC,IAAI,CACX,yBAAyB,IAAI,IAAI,IAAI,EAAE,EACvC,6BAA6B,IAAI,IAAI,IAAI,EAAE,EAC3C,WAAW,IAAI,IAAI,IAAI,IAAI,CAC5B,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,2FAA2F;QAC3F,sFAAsF;QACtF,sFAAsF;QACtF,0FAA0F;QAC1F,6EAA6E;QAC7E,QAAQ,CAAC,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,qFAAqF;IACrF,mFAAmF;IACnF,sFAAsF;IACtF,iFAAiF;IACjF,MAAM,OAAO,GAAG;QACd,2BAA2B,EAAE,EAAE;QAC/B,2BAA2B,EAAE,IAAI;QACjC,mCAAmC,EAAE,IAAI;QACzC,2BAA2B,IAAI,EAAE;QACjC,2BAA2B,IAAI,IAAI;QACnC,mCAAmC,IAAI,IAAI;QAC3C,iGAAiG;QACjG,8EAA8E;QAC9E,2BAA2B,GAAG,EAAE;QAChC,2BAA2B,GAAG,IAAI;QAClC,mCAAmC,GAAG,IAAI;KAC3C,CAAC;IACF,iGAAiG;IACjG,iGAAiG;IACjG,mGAAmG;IACnG,oGAAoG;IACpG,gGAAgG;IAChG,6GAA6G;IAC7G,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;IACxE,+FAA+F;IAC/F,wFAAwF;IACxF,MAAM,eAAe,GAAG,GAAG,qBAAqB,CAAC,KAAK,EAAE,gBAAgB,EAAE,EAAE,CAAC,IAAI,CAAC;IAClF,OAAO,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,EAAE,EAAE,CAAC;AAC3G,CAAC;AAED;;;;;;;;6CAQ6C;AAC7C,SAAS,mBAAmB,CAAC,KAAa,EAAE,EAAU;IACpD,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,EAAE,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACnF,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC/E,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;IAC9G,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC;QACjC,uBAAuB,MAAM,EAAE;QAC/B,0BAA0B,MAAM,EAAE,EAAE,SAAS;QAC7C,2BAA2B,MAAM,IAAI,EAAE,4BAA4B;QACnE,yBAAyB,MAAM,IAAI;QACnC,2BAA2B,MAAM,IAAI;KACtC,CAAC;IACF,MAAM,GAAG,GAAG;QACV,cAAc;QACd,uBAAuB,IAAI,EAAE,EAAE,uBAAuB,KAAK,EAAE,EAAE,uBAAuB,GAAG,EAAE;QAC3F,oGAAoG;QACpG,2FAA2F;QAC3F,8FAA8F;QAC9F,0CAA0C;QAC1C,2BAA2B,IAAI,IAAI;QACnC,mCAAmC,IAAI,IAAI;QAC3C,yBAAyB,IAAI,IAAI;QACjC,6BAA6B,IAAI,IAAI;QACrC,2BAA2B,IAAI,IAAI;QACnC,WAAW,IAAI,IAAI;QACnB,oGAAoG;QACpG,wEAAwE;QACxE,2BAA2B,KAAK,IAAI,oBAAoB,IAAI;QAC5D,mCAAmC,KAAK,IAAI,oBAAoB,EAAE;QAClE,yBAAyB,KAAK,IAAI,oBAAoB,EAAE;QACxD,6BAA6B,KAAK,IAAI,oBAAoB,EAAE;QAC5D,2BAA2B,KAAK,IAAI,oBAAoB,EAAE;QAC1D,WAAW,KAAK,IAAI,oBAAoB,IAAI;QAC5C,UAAU,EAAE,gCAAgC;QAC5C,oGAAoG;QACpG,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC;QAC/D,oGAAoG;QACpG,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI;QAC/B,oFAAoF;QACpF,uBAAuB,GAAG,EAAE,EAAE,0BAA0B,GAAG,EAAE;QAC7D,OAAO,cAAc,CAAC,KAAK,CAAC,UAAU;QACtC,wFAAwF;QACxF,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,QAAQ;QAC7B,4FAA4F;QAC5F,4FAA4F;QAC5F,kGAAkG;QAClG,iEAAiE;QACjE,GAAG,CAAC,yBAAyB;KAC9B,CAAC;IACF,MAAM,GAAG,GAAG;QACV,UAAU,EAAE,IAAI;QAChB,GAAG,CAAC,iBAAiB,EAAE,6EAA6E;KACrG,CAAC;IACF,OAAO,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;AACtD,CAAC;AAED;;;;;;6EAM6E;AAC7E,SAAS,uBAAuB,CAAC,KAAa,EAAE,EAAU;IACxD,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,qBAAqB;IAC/D,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,2CAA2C;IAC1F,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC;QACjC,uBAAuB,MAAM,EAAE;QAC/B,0BAA0B,MAAM,EAAE,EAAE,SAAS;QAC7C,2BAA2B,MAAM,IAAI,EAAE,sCAAsC;QAC7E,yBAAyB,MAAM,IAAI;QACnC,2BAA2B,MAAM,IAAI;KACtC,CAAC;IACF,MAAM,GAAG,GAAG;QACV,cAAc;QACd,GAAG,MAAM,CAAC,GAAG,CAAC;QACd,GAAG,MAAM,CAAC,KAAK,CAAC;QAChB,OAAO,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,0CAA0C;QAC9E,UAAU,EAAE,gCAAgC;KAC7C,CAAC;IACF,OAAO,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;AACrE,CAAC;AAED;;;;;;;;;;2CAU2C;AAC3C,SAAS,6BAA6B,CAAC,SAAiB;IACtD,OAAO;QACL,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,EAAE;QAChD,GAAG,EAAE;YACH,KAAK,EAAE;gBACL,GAAG,uBAAuB,IAAI;gBAC9B,qBAAqB,CAAC,SAAS,CAAC;gBAChC,wBAAwB,CAAC,SAAS,CAAC;aACpC;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;;0FAK0F;AAC1F,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,IAAe,EAAE,QAAkB;IACnF,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW;QACvB,MAAM,IAAI,KAAK,CACb,iPAAiP,CAClP,CAAC;IACJ,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IACxE,MAAM,KAAK,GAAG,6BAA6B,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,MAAM,UAAU,CAC9B,qBAAqB,EACrB,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,EACvB,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EACxB,KAAK,EACL,EAAE,MAAM,EAAE,CACX,CAAC;IACF,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnF,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED;kDACkD;AAClD,MAAM,UAAU,YAAY,CAAC,IAAe,EAAE,IAAwD;IACpG,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC;IACtC,4FAA4F;IAC5F,8FAA8F;IAC9F,+FAA+F;IAC/F,+FAA+F;IAC/F,gGAAgG;IAChG,iGAAiG;IACjG,kGAAkG;IAClG,OAAO;QACD,IAAI;QACJ,IAAI;;yBAEa,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC1C,IAAI,CAAC,QAAQ,CAAC,GAAG;kBACX,IAAI,CAAC,GAAG,CAAC,GAAG;;;IAG1B,IAAI,CAAC,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG;IACrC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG;;CAEhC,CAAC;AACF,CAAC"}
+{"version":3,"file":"provision.js","sourceRoot":"","sources":["../src/provision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,cAAc,EACd,aAAa,EACb,UAAU,EACV,QAAQ,GACT,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACrF,OAAO,EACL,KAAK,EACL,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,oBAAoB,EACpB,aAAa,EACb,gBAAgB,EAChB,UAAU,EACV,QAAQ,EACR,UAAU,EACV,SAAS,EACT,WAAW,EACX,eAAe,EACf,SAAS,EACT,WAAW,EACX,UAAU,EACV,cAAc,EACd,aAAa,EACb,aAAa,EACb,SAAS,EACT,MAAM,EACN,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,cAAc,EACd,oBAAoB,GACrB,MAAM,eAAe,CAAC;AA0CvB,uFAAuF;AACvF,wFAAwF;AACxF,8DAA8D;AAC9D,MAAM,WAAW,GAAG;IAClB,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IACtD,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI;CAC9B,CAAC;AACX,MAAM,WAAW,GAAG,EAAE,GAAG,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,EAAE,CAAC;AAC1E,MAAM,UAAU,GAAG,EAAE,GAAG,WAAW,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;AAEvE;;;;;;;yEAOyE;AACzE,MAAM,UAAU,cAAc,CAAC,IAAe;IAC5C,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;QAC/B,OAAO,EAAE;YACP,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG;YACrB,IAAI,EAAE,EAAE;YACR,GAAG,EAAE,EAAE;YACP,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;YACrC,UAAU,EAAE,EAAE;SACf;QACD,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;KAC1B,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAa;IACjD,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC,CAAC,yCAAyC;IACvE,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC;IAEpC,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,SAAS,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC;IACnG,MAAM,UAAU,GAAG,MAAM,aAAa,CACpC,KAAK,CAAC,KAAK,CAAC,EACZ,GAAG,EACH,EAAE,YAAY,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,EAC5D,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAE1F,MAAM,GAAG,GAAG,CAAC,CAAa,EAAE,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO;QACL,KAAK;QACL,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE;QACxD,OAAO,EAAE;YACP,GAAG,EAAE,GAAG,CAAC,YAAY,EAAE;YACvB,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YACxB,GAAG,EAAE,UAAU;YACf,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE;SAChC;QACD,oGAAoG;QACpG,kGAAkG;QAClG,GAAG,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE;KACrE,CAAC;AACJ,CAAC;AAuED;;;;;kGAKkG;AAClG,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,WAA+B,EAC/B,IAAe,EACf,QAAkB,EAClB,OAAsB,EAAE;IAExB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACxE,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,gGAAgG;IAChG,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,SAAS,EAAE,GAAG,cAAc,CAAC;QAAE,kBAAkB,CAAC,EAAE,CAAC,CAAC;IAC3E,8FAA8F;IAC9F,4FAA4F;IAC5F,iEAAiE;IACjE,KAAK,MAAM,EAAE,IAAI,SAAS;QACxB,IAAI,CAAC,cAAc,CAAC,cAAc,EAAE,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CACb,8BAA8B,EAAE,mCAAmC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAChG,CAAC;IACN,MAAM,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAChD,MAAM,WAAW,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACjD,sGAAsG;IACtG,mGAAmG;IACnG,uGAAuG;IACvG,iGAAiG;IACjG,iGAAiG;IACjG,+DAA+D;IAC/D,IAAI,IAAI,CAAC,iBAAiB,KAAK,KAAK;QAAE,MAAM,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;IAC/F,IAAI,IAAI,CAAC,IAAI;QAAE,MAAM,WAAW,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/D,OAAO,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;iGAMiG;AACjG,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAe,EACf,QAAkB,EAClB,OAAgB,EAChB,OAAiB,EAAE;IAEnB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,MAAM,UAAU,CAC9B,OAAO,EACP,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,EACvB,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAC5B,KAAK,EACL,EAAE,MAAM,EAAE,CACX,CAAC;IACF,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnF,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED;;;;wCAIwC;AACxC,SAAS,cAAc,CACrB,OAAgB,EAChB,KAAa,EACb,EAAU,EACV,IAAc;IAEd,IAAI,OAAO,KAAK,UAAU;QAAE,OAAO,mBAAmB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,mCAAmC;IACtG,IAAI,OAAO,KAAK,eAAe;QAAE,OAAO,uBAAuB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,kCAAkC;IAC9G,IAAI,OAAO,KAAK,YAAY;QAAE,OAAO,qBAAqB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,uCAAuC;IAC9G,IAAI,OAAO,KAAK,aAAa;QAAE,OAAO,sBAAsB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,gDAAgD;IACzH,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;QAChC,oGAAoG;QACpG,mGAAmG;QACnG,IAAI,CAAC,IAAI,CAAC,iBAAiB;YACzB,MAAM,IAAI,KAAK,CAAC,yFAAyF,CAAC,CAAC;QAC7G,OAAO,wBAAwB,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,iBAAiB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,yCAAyC;IACxG,IAAI,OAAO,KAAK,UAAU;QAAE,OAAO,mBAAmB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,gDAAgD;IACnH,IAAI,OAAO,KAAK,OAAO;QAAE,OAAO,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC,gDAAgD;IACtG,IAAI,OAAO,KAAK,gBAAgB;QAAE,OAAO,wBAAwB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,mCAAmC;IACjH,IAAI,OAAO,KAAK,gBAAgB;QAAE,OAAO,wBAAwB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,uCAAuC;IACrH,IAAI,OAAO,KAAK,UAAU;QAAE,OAAO,mBAAmB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,qCAAqC;IACxG,IAAI,OAAO,KAAK,2BAA2B;QAAE,OAAO,wBAAwB,CAAC,KAAK,EAAE,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC,oBAAoB;IACjI,IAAI,OAAO,KAAK,sBAAsB;QAAE,OAAO,wBAAwB,CAAC,KAAK,EAAE,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC,uBAAuB;IAC1H,IAAI,OAAO,KAAK,UAAU;QAAE,OAAO,mBAAmB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,qCAAqC;IACxG,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/E,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,4CAA4C;IACvF,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,wDAAwD;IACvG,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,4DAA4D;IACzG,MAAM,KAAK,GAAG,UAAU,EAAE,IAAI,CAAC;IAE/B,IAAI,OAAO,KAAK,UAAU,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QAClD,sFAAsF;QACtF,gFAAgF;QAChF,wFAAwF;QACxF,+EAA+E;QAC/E,yFAAyF;QACzF,yFAAyF;QACzF,4FAA4F;QAC5F,yFAAyF;QACzF,8EAA8E;QAC9E,MAAM,GAAG,GACP,OAAO,KAAK,OAAO;YACjB,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC;YACpC,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG;YACZ,cAAc;YACd,uBAAuB,IAAI,EAAE;YAC7B,uBAAuB,EAAE,EAAE;YAC3B,sFAAsF;YACtF,yEAAyE;YACzE,2BAA2B,IAAI,EAAE;YACjC,2BAA2B,IAAI,IAAI;YACnC,yBAAyB,IAAI,IAAI;YACjC,6BAA6B,IAAI,IAAI;YACrC,2BAA2B,IAAI,IAAI;YACnC,WAAW,IAAI,IAAI;YACnB,2BAA2B,EAAE,IAAI,EAAE,+CAA+C;YAClF,yBAAyB,EAAE,IAAI;YAC/B,oFAAoF;YACpF,8FAA8F;YAC9F,uBAAuB,IAAI,EAAE;YAC7B,0BAA0B,IAAI,EAAE;YAChC,2BAA2B,IAAI,IAAI;YACnC,yBAAyB,IAAI,IAAI;YACjC,2BAA2B,IAAI,IAAI,EAAG,6BAA6B;YACnE,gGAAgG;YAChG,mGAAmG;YACnG,oGAAoG;YACpG,uBAAuB,KAAK,EAAE;YAC9B,0BAA0B,KAAK,EAAE;YACjC,2BAA2B,KAAK,IAAI;YACpC,yBAAyB,KAAK,IAAI;YAClC,2BAA2B,KAAK,IAAI;YACpC,UAAU,EAAE,gCAAgC;SAC7C,CAAC;QACF,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACxB,sFAAsF;YACtF,sFAAsF;YACtF,KAAK,CAAC,IAAI,CACR,uBAAuB,EAAE,EAAE,EAC3B,2BAA2B,EAAE,EAAE,EAC/B,2BAA2B,EAAE,IAAI,EACjC,yBAAyB,EAAE,IAAI,EAC/B,6BAA6B,EAAE,IAAI,EACnC,2BAA2B,EAAE,IAAI,EACjC,WAAW,EAAE,IAAI,CAClB,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;IACjD,CAAC;IAED,kBAAkB;IAClB,uGAAuG;IACvG,yGAAyG;IACzG,wGAAwG;IACxG,IAAI,OAAO,KAAK,OAAO;QACrB,MAAM,IAAI,KAAK,CAAC,sCAAsC,OAAO,uDAAuD,CAAC,CAAC;IACxH,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,qDAAqD;IACnG,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW;IACnG,mGAAmG;IACnG,sFAAsF;IACtF,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,cAAc,EAAE,GAAG,YAAY,CAAC;QAAE,kBAAkB,CAAC,EAAE,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,kBAAkB,CAAC;IACnD,MAAM,SAAS,GAAG,eAAe,CAAC,EAAE,CAAC,EAAE,GAAG,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,0CAA0C;IAC/F,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5D,MAAM,QAAQ,GAAG;QACf,gGAAgG;QAChG,6EAA6E;QAC7E,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACvD,cAAc,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE,0CAA0C;QAC1E,cAAc,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE,2CAA2C;QAC3E,qBAAqB,CAAC,KAAK,EAAE,oBAAoB,EAAE,EAAE,CAAC,EAAE,oDAAoD;QAC5G,+FAA+F;QAC/F,iGAAiG;QACjG,gGAAgG;QAChG,qBAAqB,CAAC,KAAK,EAAE,gBAAgB,EAAE,EAAE,CAAC;QAClD,yEAAyE;QACzE,cAAc;QACd,4FAA4F;QAC5F,iGAAiG;QACjG,gGAAgG;QAChG,wFAAwF;QACxF,uBAAuB,IAAI,EAAE,EAAE,uBAAuB,EAAE,EAAE,EAAE,uBAAuB,IAAI,EAAE;QACzF,iGAAiG;QACjG,4FAA4F;QAC5F,4FAA4F;QAC5F,0FAA0F;QAC1F,uEAAuE;QACvE,iGAAiG;QACjG,gGAAgG;QAChG,8FAA8F;QAC9F,8FAA8F;QAC9F,wFAAwF;QACxF,6FAA6F;QAC7F,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,2BAA2B,IAAI,IAAI,SAAS,IAAI,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC;QAC5G,yBAAyB,IAAI,IAAI,SAAS,EAAE;QAC5C,6BAA6B,IAAI,IAAI,SAAS,EAAE;QAChD,2BAA2B,IAAI,IAAI,SAAS,EAAE;QAC9C,qFAAqF;QACrF,yBAAyB,EAAE,IAAI,GAAG,EAAE;QACpC,6BAA6B,EAAE,IAAI,GAAG,EAAE;QACxC,WAAW,EAAE,IAAI,GAAG,IAAI;QACxB,+FAA+F;QAC/F,8FAA8F;QAC9F,gGAAgG;QAChG,0FAA0F;QAC1F,yBAAyB,GAAG,IAAI,IAAI,EAAE;QACtC,6BAA6B,GAAG,IAAI,IAAI,EAAE;QAC1C,WAAW,GAAG,IAAI,IAAI,IAAI;QAC1B,2EAA2E;QAC3E,2BAA2B,EAAE,IAAI;QACjC,yBAAyB,EAAE,IAAI;QAC/B,UAAU;QACV,OAAO,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,4CAA4C;QAClF,yFAAyF;QACzF,+FAA+F;QAC/F,0BAA0B,IAAI,EAAE;QAChC,2BAA2B,IAAI,IAAI;QACnC,yBAAyB,IAAI,IAAI;QACjC,mGAAmG;QACnG,oGAAoG;QACpG,uDAAuD;QACvD,uBAAuB,KAAK,EAAE;QAC9B,0BAA0B,KAAK,EAAE;QACjC,iGAAiG;QACjG,kGAAkG;QAClG,qGAAqG;QACrG,sGAAsG;QACtG,uFAAuF;KACxF,CAAC;IACF,IAAI,IAAI,EAAE,CAAC;QACT,yFAAyF;QACzF,oFAAoF;QACpF,wFAAwF;QACxF,QAAQ,CAAC,IAAI,CACX,yBAAyB,IAAI,IAAI,IAAI,EAAE,EACvC,6BAA6B,IAAI,IAAI,IAAI,EAAE,EAC3C,WAAW,IAAI,IAAI,IAAI,IAAI,CAC5B,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,2FAA2F;QAC3F,sFAAsF;QACtF,sFAAsF;QACtF,0FAA0F;QAC1F,6EAA6E;QAC7E,QAAQ,CAAC,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,qFAAqF;IACrF,mFAAmF;IACnF,sFAAsF;IACtF,iFAAiF;IACjF,MAAM,OAAO,GAAG;QACd,2BAA2B,EAAE,EAAE;QAC/B,2BAA2B,EAAE,IAAI;QACjC,mCAAmC,EAAE,IAAI;QACzC,2BAA2B,IAAI,EAAE;QACjC,2BAA2B,IAAI,IAAI;QACnC,mCAAmC,IAAI,IAAI;QAC3C,iGAAiG;QACjG,8EAA8E;QAC9E,2BAA2B,GAAG,EAAE;QAChC,2BAA2B,GAAG,IAAI;QAClC,mCAAmC,GAAG,IAAI;KAC3C,CAAC;IACF,iGAAiG;IACjG,iGAAiG;IACjG,mGAAmG;IACnG,oGAAoG;IACpG,gGAAgG;IAChG,6GAA6G;IAC7G,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;IACxE,+FAA+F;IAC/F,wFAAwF;IACxF,MAAM,eAAe,GAAG,GAAG,qBAAqB,CAAC,KAAK,EAAE,gBAAgB,EAAE,EAAE,CAAC,IAAI,CAAC;IAClF,oFAAoF;IACpF,sGAAsG;IACtG,oGAAoG;IACpG,wGAAwG;IACxG,uEAAuE;IACvE,MAAM,cAAc,GAAG,CAAC,GAAG,qBAAqB,CAAC,KAAK,EAAE,oBAAoB,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC;IAC7F,IAAI,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC;QACtC,cAAc,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,KAAK,EAAE,kBAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC;IACzF,OAAO,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,cAAc,EAAE,GAAG,OAAO,CAAC,EAAE,EAAE,CAAC;AAC9H,CAAC;AAED;;;;;;;;;;;;wDAYwD;AACxD,SAAS,qBAAqB,CAAC,KAAa,EAAE,EAAU;IACtD,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC9E,uGAAuG;IACvG,qGAAqG;IACrG,oDAAoD;IACpD,MAAM,KAAK,GAAG,CAAC,kBAAkB,EAAE,oBAAoB,EAAE,aAAa,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe;IACxF,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,qBAAqB,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;IACvF,OAAO;QACL,GAAG,EAAE;YACH,KAAK,EAAE;gBACL,cAAc;gBACd,mGAAmG;gBACnG,iGAAiG;gBACjG,uBAAuB,GAAG,EAAE;gBAC5B,0BAA0B,GAAG,EAAE,EAAE,wEAAwE;gBACzG,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI,iBAAiB,EAAE,EAAE,8DAA8D;gBAClH,kGAAkG;gBAClG,sGAAsG;gBACtG,0DAA0D;gBAC1D,OAAO,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE;gBACpC,uBAAuB,GAAG,EAAE;gBAC5B,2BAA2B,GAAG,IAAI,EAAE,qCAAqC;gBACzE,yBAAyB,GAAG,IAAI;gBAChC,UAAU,EAAE,gCAAgC;gBAC5C,+FAA+F;gBAC/F,oDAAoD;gBACpD,GAAG,UAAU;aACd;SACF;QACD,GAAG,EAAE;YACH,qGAAqG;YACrG,gGAAgG;YAChG,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC;SACvC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;0GAQ0G;AAC1G,SAAS,mBAAmB,CAAC,KAAa,EAAE,EAAU;IACpD,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC/E,OAAO;QACL,GAAG,EAAE;YACH,KAAK,EAAE;gBACL,yFAAyF;gBACzF,iCAAiC;gBACjC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,6CAA6C;gBAC1E,cAAc,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE,mCAAmC;gBACnE,cAAc,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE,wCAAwC;gBACxE,OAAO,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,2DAA2D;gBACjG,cAAc;gBACd,yFAAyF;gBACzF,4DAA4D;gBAC5D,uBAAuB,GAAG,EAAE;gBAC5B,2BAA2B,GAAG,IAAI;gBAClC,yBAAyB,GAAG,IAAI;gBAChC,yFAAyF;gBACzF,2FAA2F;gBAC3F,uBAAuB,IAAI,EAAE;gBAC7B,0BAA0B,IAAI,EAAE;gBAChC,8FAA8F;gBAC9F,8FAA8F;gBAC9F,sBAAsB,IAAI,IAAI;gBAC9B,2BAA2B,IAAI,IAAI;gBACnC,yBAAyB,IAAI,IAAI;gBACjC,UAAU,EAAE,gCAAgC;aAC7C;SACF;QACD,oGAAoG;QACpG,qGAAqG;QACrG,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE;KACnC,CAAC;AACJ,CAAC;AAED;;;;2GAI2G;AAC3G,SAAS,gBAAgB,CAAC,EAAU;IAClC,OAAO,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;AACtE,CAAC;AAED;;;sGAGsG;AACtG,SAAS,wBAAwB,CAAC,KAAa,EAAE,EAAU;IACzD,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC1C,OAAO;QACL,GAAG,EAAE;YACH,KAAK,EAAE;gBACL,cAAc;gBACd,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,4CAA4C;gBAC7E,uBAAuB,IAAI,EAAE,EAAE,kCAAkC;gBACjE,yBAAyB,IAAI,EAAE,EAAE,mEAAmE;gBACpG,qGAAqG;gBACrG,0BAA0B,IAAI,EAAE;gBAChC,sBAAsB,IAAI,IAAI;aAC/B;SACF;QACD,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE;KACnC,CAAC;AACJ,CAAC;AAED;;;uGAGuG;AACvG,SAAS,wBAAwB,CAAC,KAAa,EAAE,EAAU;IACzD,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC1C,iGAAiG;IACjG,6FAA6F;IAC7F,yGAAyG;IACzG,OAAO;QACL,GAAG,EAAE;YACH,KAAK,EAAE;gBACL,cAAc;gBACd,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,oCAAoC;gBACrE,uBAAuB,IAAI,EAAE,EAAE,2BAA2B;gBAC1D,0BAA0B,IAAI,EAAE,EAAE,qBAAqB;gBACvD,sBAAsB,IAAI,IAAI;gBAC9B,wBAAwB,UAAU,CAAC,KAAK,CAAC,EAAE,EAAE,mCAAmC;aACjF;SACF;QACD,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE;KACnC,CAAC;AACJ,CAAC;AAED;;;;;;;6GAO6G;AAC7G,SAAS,mBAAmB,CAAC,KAAa,EAAE,EAAU;IACpD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC/E,mGAAmG;IACnG,wGAAwG;IACxG,MAAM,GAAG,GAAG;QACV,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,KAAK,CAAC;QAC9E,GAAG,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,SAAS,CAAC,KAAK,CAAC,EAAE;QACjE,MAAM,gBAAgB,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE;KAC7F,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,EAAE,EAAE,yBAAyB,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7E,OAAO;QACL,GAAG,EAAE;YACH,KAAK,EAAE;gBACL,cAAc;gBACd,gFAAgF;gBAChF,2BAA2B,GAAG,IAAI;gBAClC,yBAAyB,GAAG,IAAI;gBAChC,0BAA0B,IAAI,EAAE;gBAChC,sBAAsB,IAAI,IAAI;gBAC9B,2BAA2B,IAAI,IAAI;gBACnC,yBAAyB,IAAI,IAAI;gBACjC,UAAU,EAAE,gCAAgC;gBAC5C,4EAA4E;gBAC5E,qBAAqB,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,CAAC;gBAC/C,GAAG,GAAG;gBACN,4FAA4F;gBAC5F,wBAAwB,IAAI,EAAE;gBAC9B,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI;aAChC;SACF;QACD,wGAAwG;QACxG,8FAA8F;QAC9F,wGAAwG;QACxG,gDAAgD;QAChD,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,qBAAqB,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE;KACjG,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;4GAa4G;AAC5G,SAAS,wBAAwB,CAAC,KAAa,EAAE,EAAU,EAAE,IAAY;IACvE,MAAM,UAAU,GAAG,qBAAqB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1D,OAAO;QACL,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,8CAA8C;QAC5E,uGAAuG;QACvG,yGAAyG;QACzG,uGAAuG;QACvG,gEAAgE;QAChE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,UAAU,UAAU,CAAC,EAAE;KAC5D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;oFAiBoF;AACpF,SAAS,mBAAmB,CAAC,KAAa,EAAE,EAAU;IACpD,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC/E,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IACpF,sGAAsG;IACtG,oGAAoG;IACpG,2GAA2G;IAC3G,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC;QACjC,uBAAuB,MAAM,EAAE;QAC/B,0BAA0B,MAAM,EAAE;QAClC,sBAAsB,MAAM,IAAI;QAChC,2BAA2B,MAAM,IAAI;QACrC,yBAAyB,MAAM,IAAI;KACpC,CAAC;IACF,sGAAsG;IACtG,qGAAqG;IACrG,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC;QACtC,uBAAuB,MAAM,EAAE;QAC/B,0BAA0B,MAAM,EAAE;QAClC,sBAAsB,MAAM,IAAI;KACjC,CAAC;IACF,OAAO;QACL,GAAG,EAAE;YACH,KAAK,EAAE;gBACL,cAAc;gBACd,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,oCAAoC;gBACpD,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,iEAAiE;gBAClF,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,yFAAyF;gBAC3G,GAAG,WAAW,CAAC,KAAK,CAAC,EAAE,wFAAwF;gBAC/G,UAAU,EAAE,gCAAgC;gBAC5C,+FAA+F;gBAC/F,qBAAqB,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,CAAC;aAChD;SACF;QACD,oGAAoG;QACpG,mGAAmG;QACnG,sEAAsE;QACtE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,qBAAqB,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE;KACjG,CAAC;AACJ,CAAC;AAED;;;;4GAI4G;AAC5G,SAAS,iBAAiB,CAAC,KAAa,EAAE,EAAU;IAClD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrD,OAAO;QACL,GAAG,EAAE;YACH,KAAK,EAAE;gBACL,cAAc,EAAE,sEAAsE;gBACtF,wBAAwB,IAAI,EAAE,EAAE,+BAA+B;gBAC/D,wBAAwB,EAAE,EAAE,EAAE,6DAA6D;aAC5F;YACD,qGAAqG;YACrG,uGAAuG;SACxG;QACD,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE;KACnC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;0GAoB0G;AAC1G,SAAS,sBAAsB,CAAC,KAAa,EAAE,EAAU;IACvD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,EAAE,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACzD,wGAAwG;IACxG,yGAAyG;IACzG,0GAA0G;IAC1G,MAAM,OAAO,GAAG;QACd,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,gBAAgB,EAAE,cAAc,EAAE,aAAa;KACzG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/B,2GAA2G;IAC3G,mGAAmG;IACnG,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC1E,yBAAyB,CAAC,EAAE;QAC5B,uBAAuB,CAAC,EAAE;KAC3B,CAAC,CAAC;IACH,0GAA0G;IAC1G,sGAAsG;IACtG,6FAA6F;IAC7F,MAAM,cAAc,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACpD,2BAA2B,CAAC,IAAI;QAChC,mCAAmC,CAAC,IAAI;QACxC,yBAAyB,CAAC,IAAI;KAC/B,CAAC,CAAC;IACH,OAAO;QACL,GAAG,EAAE;YACH,KAAK,EAAE;gBACL,cAAc;gBACd,GAAG,WAAW;gBACd,GAAG,cAAc;gBACjB,gGAAgG;gBAChG,oGAAoG;gBACpG,kGAAkG;gBAClG,iCAAiC;gBACjC,OAAO,SAAS,CAAC,KAAK,CAAC,IAAI;gBAC3B,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI;gBAC/B,sGAAsG;gBACtG,oGAAoG;gBACpG,qGAAqG;gBACrG,mGAAmG;gBACnG,6BAA6B,SAAS,CAAC,KAAK,CAAC,EAAE;gBAC/C,yBAAyB,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,8CAA8C;gBAC7F,6BAA6B,aAAa,CAAC,KAAK,CAAC,EAAE;gBACnD,yBAAyB,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,8CAA8C;aAClG;SACF;QACD,sGAAsG;QACtG,+FAA+F;QAC/F,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE;KACnC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;oCAmBoC;AACpC,SAAS,wBAAwB,CAAC,KAAa,EAAE,EAAU,EAAE,MAAc;IACzE,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACnD,OAAO;QACL,GAAG,EAAE;YACH,KAAK,EAAE;gBACL,cAAc,EAAE,6BAA6B;gBAC7C,uGAAuG;gBACvG,2BAA2B,EAAE,IAAI,SAAS,CAAC,MAAM,CAAC,EAAE;gBACpD,2BAA2B,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE;gBACtD,iGAAiG;gBACjG,4FAA4F;gBAC5F,0BAA0B,SAAS,CAAC,KAAK,CAAC,EAAE;gBAC5C,OAAO,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE;aAC5C;SACF;QACD,oGAAoG;QACpG,qEAAqE;QACrE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE;KACnC,CAAC;AACJ,CAAC;AAED;;;;;;;;6CAQ6C;AAC7C,SAAS,mBAAmB,CAAC,KAAa,EAAE,EAAU;IACpD,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,EAAE,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACnF,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC/E,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;IAC9G,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC;QACjC,uBAAuB,MAAM,EAAE;QAC/B,0BAA0B,MAAM,EAAE,EAAE,SAAS;QAC7C,2BAA2B,MAAM,IAAI,EAAE,4BAA4B;QACnE,yBAAyB,MAAM,IAAI;QACnC,2BAA2B,MAAM,IAAI;KACtC,CAAC;IACF,MAAM,GAAG,GAAG;QACV,cAAc;QACd,uBAAuB,IAAI,EAAE,EAAE,uBAAuB,KAAK,EAAE,EAAE,uBAAuB,GAAG,EAAE;QAC3F,oGAAoG;QACpG,2FAA2F;QAC3F,8FAA8F;QAC9F,0CAA0C;QAC1C,2BAA2B,IAAI,IAAI;QACnC,mCAAmC,IAAI,IAAI;QAC3C,yBAAyB,IAAI,IAAI;QACjC,6BAA6B,IAAI,IAAI;QACrC,2BAA2B,IAAI,IAAI;QACnC,WAAW,IAAI,IAAI;QACnB,oGAAoG;QACpG,wEAAwE;QACxE,2BAA2B,KAAK,IAAI,oBAAoB,IAAI;QAC5D,mCAAmC,KAAK,IAAI,oBAAoB,EAAE;QAClE,yBAAyB,KAAK,IAAI,oBAAoB,EAAE;QACxD,6BAA6B,KAAK,IAAI,oBAAoB,EAAE;QAC5D,2BAA2B,KAAK,IAAI,oBAAoB,EAAE;QAC1D,WAAW,KAAK,IAAI,oBAAoB,IAAI;QAC5C,UAAU,EAAE,gCAAgC;QAC5C,oGAAoG;QACpG,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC;QAC/D,oGAAoG;QACpG,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI;QAC/B,oFAAoF;QACpF,uBAAuB,GAAG,EAAE,EAAE,0BAA0B,GAAG,EAAE;QAC7D,OAAO,cAAc,CAAC,KAAK,CAAC,UAAU;QACtC,wFAAwF;QACxF,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,QAAQ;QAC7B,4FAA4F;QAC5F,4FAA4F;QAC5F,kGAAkG;QAClG,iEAAiE;QACjE,GAAG,CAAC,yBAAyB;KAC9B,CAAC;IACF,MAAM,GAAG,GAAG;QACV,UAAU,EAAE,IAAI;QAChB,GAAG,CAAC,iBAAiB,EAAE,6EAA6E;KACrG,CAAC;IACF,OAAO,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;AACtD,CAAC;AAED;;;;;;6EAM6E;AAC7E,SAAS,uBAAuB,CAAC,KAAa,EAAE,EAAU;IACxD,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,qBAAqB;IAC/D,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,2CAA2C;IAC1F,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC;QACjC,uBAAuB,MAAM,EAAE;QAC/B,0BAA0B,MAAM,EAAE,EAAE,SAAS;QAC7C,2BAA2B,MAAM,IAAI,EAAE,sCAAsC;QAC7E,yBAAyB,MAAM,IAAI;QACnC,2BAA2B,MAAM,IAAI;KACtC,CAAC;IACF,MAAM,GAAG,GAAG;QACV,cAAc;QACd,GAAG,MAAM,CAAC,GAAG,CAAC;QACd,GAAG,MAAM,CAAC,KAAK,CAAC;QAChB,OAAO,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,0CAA0C;QAC9E,UAAU,EAAE,gCAAgC;KAC7C,CAAC;IACF,OAAO,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;AACrE,CAAC;AAED;;;;;;;;;;2CAU2C;AAC3C,SAAS,6BAA6B,CAAC,SAAiB;IACtD,OAAO;QACL,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,EAAE;QAChD,GAAG,EAAE;YACH,KAAK,EAAE;gBACL,GAAG,uBAAuB,IAAI;gBAC9B,qBAAqB,CAAC,SAAS,CAAC;gBAChC,wBAAwB,CAAC,SAAS,CAAC;aACpC;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;;0FAK0F;AAC1F,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,IAAe,EAAE,QAAkB;IACnF,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW;QACvB,MAAM,IAAI,KAAK,CACb,iPAAiP,CAClP,CAAC;IACJ,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IACxE,MAAM,KAAK,GAAG,6BAA6B,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,MAAM,UAAU,CAC9B,qBAAqB,EACrB,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,EACvB,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EACxB,KAAK,EACL,EAAE,MAAM,EAAE,CACX,CAAC;IACF,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnF,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED;kDACkD;AAClD,MAAM,UAAU,YAAY,CAAC,IAAe,EAAE,IAAwD;IACpG,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC;IACtC,4FAA4F;IAC5F,8FAA8F;IAC9F,+FAA+F;IAC/F,+FAA+F;IAC/F,gGAAgG;IAChG,iGAAiG;IACjG,kGAAkG;IAClG,OAAO;QACD,IAAI;QACJ,IAAI;;yBAEa,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC1C,IAAI,CAAC,QAAQ,CAAC,GAAG;kBACX,IAAI,CAAC,GAAG,CAAC,GAAG;;;IAG1B,IAAI,CAAC,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG;IACrC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG;;CAEhC,CAAC;AACF,CAAC"}

package/dist/runtime.d.ts

@@ -9,8 +9,10 @@ export type RuntimeKind = string;
 export interface AttachSession {
     readonly cols: number;
     readonly rows: number;
-    /** Scrollback so a late attach sees output that already scrolled past. */
-    backlog(): Buffer;
+    /** A snapshot to bootstrap a late/concurrent attach: bytes that repaint the current screen.
+     *  May be async — a backend can reconstruct a full-screen (alternate-screen) TUI's buffer rather
+     *  than replay raw scrollback, so an attach paints correctly without the child having to repaint. */
+    backlog(): Buffer | Promise<Buffer>;
     /** Subscribe to live output; returns an unsubscribe fn. */
     onData(fn: (chunk: Buffer) => void): () => void;
     /** Fires when the underlying process exits; returns an unsubscribe fn. */

package/dist/runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD;0FAC0F;AAC1F,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC;AAEjC;;2BAE2B;AAC3B,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,OAAO,IAAI,MAAM,CAAC;IAClB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAChD,0EAA0E;IAC1E,MAAM,CAAC,EAAE,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;IACnC,yCAAyC;IACzC,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,kCAAkC;IAClC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1C;AAED;2DAC2D;AAC3D,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B;iFAC6E;IAC7E,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,IAAI,SAAS,GAAG,QAAQ,CAAC;IAC/B;;uCAEmC;IACnC,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IAC1C,SAAS,IAAI,IAAI,CAAC;IAClB;mCAC+B;IAC/B,MAAM,IAAI,aAAa,CAAC;CACzB;AAED;sEACsE;AACtE,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,WAAW,CAAC;CACjE;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAgB,SAAQ,SAAS;IAChD,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,kFAAkF;IAClF,SAAS,IAAI,OAAO,CAAC;IACrB;kEAC8D;IAC9D,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;CAC5C"}
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD;0FAC0F;AAC1F,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC;AAEjC;;2BAE2B;AAC3B,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;yGAEqG;IACrG,OAAO,IAAI,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,2DAA2D;IAC3D,MAAM,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAChD,0EAA0E;IAC1E,MAAM,CAAC,EAAE,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;IACnC,yCAAyC;IACzC,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,kCAAkC;IAClC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1C;AAED;2DAC2D;AAC3D,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B;iFAC6E;IAC7E,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,IAAI,SAAS,GAAG,QAAQ,CAAC;IAC/B;;uCAEmC;IACnC,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IAC1C,SAAS,IAAI,IAAI,CAAC;IAClB;mCAC+B;IAC/B,MAAM,IAAI,aAAa,CAAC;CACzB;AAED;sEACsE;AACtE,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,WAAW,CAAC;CACjE;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAgB,SAAQ,SAAS;IAChD,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,kFAAkF;IAClF,SAAS,IAAI,OAAO,CAAC;IACrB;kEAC8D;IAC9D,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;CAC5C"}

package/dist/spaces.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spaces.d.ts","sourceRoot":"","sources":["../src/spaces.ts"],"names":[],"mappings":"AAYA,qCAAqC;AACrC,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;2EAE2E;AAC3E,wBAAsB,UAAU,CAAC,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAmDnF;AAED;;0FAE0F;AAC1F,wBAAsB,WAAW,CAAC,IAAI,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAoB1G"}
+{"version":3,"file":"spaces.d.ts","sourceRoot":"","sources":["../src/spaces.ts"],"names":[],"mappings":"AA4BA,qCAAqC;AACrC,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;2EAE2E;AAC3E,wBAAsB,UAAU,CAAC,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAmDnF;AAED;;0FAE0F;AAC1F,wBAAsB,WAAW,CAAC,IAAI,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA8B1G"}