@dharma-ai-labs/agent-fabric 0.2.109 → 0.2.111

package/dist/demoEnrollment.js

@@ -3,6 +3,7 @@ import { chmod, mkdir, readFile, rename, unlink, writeFile } from 'node:fs/promi
 import { dirname, resolve } from 'node:path';
 import { loadOrCreateDeviceIdentity, normalizeHqUrl } from '@dharma-ai-labs/agent-fabric-relay-client';
 import { verifyInitialServerSigningKeyset } from '@dharma-ai-labs/agent-fabric-contracts';
+import { acceptDemoSigningUpdate, recoverDemoSigningEnrollment, resolveDemoSigningTrust } from './demoSigningTrust.js';
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 const CODE = /^[A-Za-z0-9_-]{43}$/;
 const BROWSER_CODE = /^[0-9A-F]{20}$/;
@@ -54,9 +55,12 @@ export function scopePath(input, origin) {
         .digest('hex').slice(0, 32);
     return resolve(input.stateRoot, 'demo', scope, 'device.json');
 }
-export async function loadDemoSigningTrust(input) {
-    const config = JSON.parse(await readFile(scopePath(input, normalizeHqUrl(input.hqUrl)), 'utf8'));
+export async function loadDemoSigningTrust(input, deps = {}) {
+    const origin = normalizeHqUrl(input.hqUrl);
+    const configPath = scopePath(input, origin);
+    const config = JSON.parse(await readFile(configPath, 'utf8'));
     if (config.schema !== 'dharma.demo-device/v1' || !config.signedReady
+        || config.hqUrl !== origin || !UUID.test(config.deviceId)
         || config.organizationId !== input.organizationId || config.repositoryId !== input.repositoryId
         || config.normalizedRepository !== input.normalizedRepository
         || config.installationId !== input.installationId
@@ -64,12 +68,20 @@ export async function loadDemoSigningTrust(input) {
         || !config.serverSigningKeyset) {
         throw new Error('Demo signing trust is not pinned to this approved device. Re-enroll through browser approval.');
     }
+    const identity = await loadOrCreateDeviceIdentity({ hqUrl: origin,
+        organizationId: `${input.organizationId}:${input.repositoryId}`,
+        installationId: input.installationId, store: deps.store });
+    if (config.publicKeyEd25519 !== identity.publicKeyEd25519) {
+        throw new Error('Demo signing trust does not match its protected device identity.');
+    }
+    const trusted = await resolveDemoSigningTrust(config, deps);
+    if (trusted.serverPublicKeyEd25519 !== config.serverPublicKeyEd25519
+        || JSON.stringify(trusted.serverSigningKeyset) !== JSON.stringify(config.serverSigningKeyset)) {
+        await writePrivateJson(configPath, trusted);
+    }
     const publicKey = createPublicKey({ key: { kty: 'OKP', crv: 'Ed25519',
-            x: config.serverPublicKeyEd25519 }, format: 'jwk' });
-    const verification = verifyInitialServerSigningKeyset(config.serverSigningKeyset, publicKey, input.organizationId);
-    if (!verification.ok)
-        throw new Error(`Demo signing trust is invalid: ${verification.reason}.`);
-    return { publicKey, keyset: config.serverSigningKeyset, deviceId: config.deviceId };
+            x: trusted.serverPublicKeyEd25519 }, format: 'jwk' });
+    return { publicKey, keyset: trusted.serverSigningKeyset, deviceId: config.deviceId };
 }
 async function writePrivateJson(path, value) {
     const directory = dirname(path);
@@ -102,9 +114,11 @@ function approvalUri(value, origin, input) {
     }
     return url.toString();
 }
-function signedStatusRequest(origin, input, deviceId, privateJwk, sequence) {
+function signedStatusRequest(origin, input, deviceId, privateJwk, sequence, signingGeneration) {
     const url = new URL(`/api/demo/fabric/repositories/${input.repositoryId}/status`, origin);
     url.searchParams.set('orgId', input.organizationId);
+    if (signingGeneration !== undefined)
+        url.searchParams.set('signingGeneration', String(signingGeneration));
     const sessionId = randomUUID();
     const messageId = randomUUID();
     const timestamp = new Date().toISOString();
@@ -130,7 +144,7 @@ export async function verifyDemoDevice(input, deps = {}) {
     const origin = normalizeHqUrl(input.hqUrl);
     const configPath = scopePath(input, origin);
     const pendingPath = `${configPath}.pending-status.json`;
-    const config = JSON.parse(await readFile(configPath, 'utf8'));
+    let config = JSON.parse(await readFile(configPath, 'utf8'));
     if (config.schema !== 'dharma.demo-device/v1' || config.hqUrl !== origin
         || config.organizationId !== input.organizationId || config.repositoryId !== input.repositoryId
         || config.normalizedRepository !== input.normalizedRepository
@@ -144,19 +158,25 @@ export async function verifyDemoDevice(input, deps = {}) {
     if (config.publicKeyEd25519 !== identity.publicKeyEd25519) {
         throw new Error('Demo device key does not match its protected local identity.');
     }
+    if (config.serverSigningKeyset)
+        config = await resolveDemoSigningTrust(config, { store: deps.store });
     let hasPending = false;
-    let pending = signedStatusRequest(origin, input, config.deviceId, identity.privateJwk, config.nextSequence);
+    let pending = signedStatusRequest(origin, input, config.deviceId, identity.privateJwk, config.nextSequence, config.serverSigningKeyset?.generation);
     try {
         const existing = JSON.parse(await readFile(pendingPath, 'utf8'));
-        if (existing.deviceId !== config.deviceId || existing.url !== pending.url
+        const existingUrl = new URL(existing.url);
+        existingUrl.searchParams.delete('signingGeneration');
+        const expectedUrl = new URL(pending.url);
+        expectedUrl.searchParams.delete('signingGeneration');
+        if (existing.deviceId !== config.deviceId || existingUrl.toString() !== expectedUrl.toString()
             || !Number.isSafeInteger(existing.sequence) || existing.sequence < config.nextSequence
             || !Number.isFinite(Date.parse(existing.createdAt))) {
             throw new Error('Pending Demo device status does not match this identity.');
         }
         hasPending = true;
-        pending = Date.now() - Date.parse(existing.createdAt) < 4 * 60_000
+        pending = Date.now() - Date.parse(existing.createdAt) < 4 * 60_000 && existing.url === pending.url
             ? existing
-            : signedStatusRequest(origin, input, config.deviceId, identity.privateJwk, existing.sequence);
+            : signedStatusRequest(origin, input, config.deviceId, identity.privateJwk, existing.sequence, config.serverSigningKeyset?.generation);
     }
     catch (error) {
         if (error.code !== 'ENOENT') {
@@ -182,7 +202,7 @@ export async function verifyDemoDevice(input, deps = {}) {
             .filter((sequence) => sequence >= config.nextSequence);
         let recovered = false;
         for (const sequence of candidates) {
-            pending = signedStatusRequest(origin, input, config.deviceId, identity.privateJwk, sequence);
+            pending = signedStatusRequest(origin, input, config.deviceId, identity.privateJwk, sequence, config.serverSigningKeyset?.generation);
             try {
                 status = await requestStatus();
                 recovered = true;
@@ -205,6 +225,12 @@ export async function verifyDemoDevice(input, deps = {}) {
     config.nextSequence = pending.sequence + 1;
     await writePrivateJson(configPath, config);
     await unlink(pendingPath).catch(() => { });
+    // Sequence consumption is saved even when a delivered trust update is rejected.
+    // No acknowledgement or package activation occurs until protected storage confirms it.
+    if (status.signingTrustUpdate !== undefined) {
+        config = await acceptDemoSigningUpdate(config, status.signingTrustUpdate, { store: deps.store });
+        await writePrivateJson(configPath, config);
+    }
     return { ok: true, stage: 'device_signed_ready',
         organizationId: input.organizationId, repositoryId: input.repositoryId,
         normalizedRepository: input.normalizedRepository, deviceId: config.deviceId,
@@ -235,6 +261,8 @@ export async function connectDemoDevice(input, deps = {}) {
     let deviceId = '';
     let serverPublicKeyEd25519 = '';
     let serverSigningKeyset;
+    let signingTrustUpdate;
+    let enrollmentApproval;
     let transientFailures = 0;
     while (Date.now() < deadline) {
         let polled;
@@ -268,6 +296,8 @@ export async function connectDemoDevice(input, deps = {}) {
             const verification = verifyInitialServerSigningKeyset(serverSigningKeyset, createPublicKey({ key: { kty: 'OKP', crv: 'Ed25519', x: serverPublicKeyEd25519 }, format: 'jwk' }), input.organizationId);
             if (!verification.ok)
                 throw new Error(`Demo enrollment signing trust was rejected: ${verification.reason}.`);
+            signingTrustUpdate = polled.signingTrustUpdate;
+            enrollmentApproval = polled.enrollmentApproval;
             break;
         }
         if (polled.status !== 'pending')
@@ -278,26 +308,74 @@ export async function connectDemoDevice(input, deps = {}) {
         throw new Error('Demo device approval timed out. Resume from the same prompt while its grant is valid.');
     const configPath = scopePath(input, origin);
     try {
-        const existing = JSON.parse(await readFile(configPath, 'utf8'));
-        if (existing.deviceId !== deviceId || existing.publicKeyEd25519 !== identity.publicKeyEd25519) {
+        let existing = JSON.parse(await readFile(configPath, 'utf8'));
+        if (existing.schema !== 'dharma.demo-device/v1' || existing.hqUrl !== origin
+            || existing.organizationId !== input.organizationId || existing.repositoryId !== input.repositoryId
+            || existing.normalizedRepository !== input.normalizedRepository || existing.installationId !== input.installationId
+            || existing.deviceId !== deviceId || existing.publicKeyEd25519 !== identity.publicKeyEd25519) {
             throw new Error('Existing Demo device belongs to another approved identity.');
         }
-        if (existing.serverPublicKeyEd25519 && existing.serverPublicKeyEd25519 !== serverPublicKeyEd25519) {
-            throw new Error('Existing Demo signing root differs. Use supported browser-authorized recovery.');
+        if (existing.serverSigningKeyset) {
+            try {
+                existing = await resolveDemoSigningTrust(existing, { store: deps.store });
+            }
+            catch (error) {
+                if (!(error instanceof Error) || !error.message.startsWith('Demo signing trust rejected: expired.'))
+                    throw error;
+                existing = await recoverDemoSigningEnrollment(existing, { serverPublicKeyEd25519, serverSigningKeyset }, enrollmentApproval, { store: deps.store });
+                if (signingTrustUpdate !== undefined) {
+                    existing = await acceptDemoSigningUpdate(existing, signingTrustUpdate, { store: deps.store });
+                }
+            }
+            await writePrivateJson(configPath, existing);
+        }
+        // Repeated approval polling must not replace a newer protected generation
+        // with the enrollment predecessor. Signed status reconciles from its head.
+        if (!existing.serverSigningKeyset) {
+            let restored = { ...existing, serverPublicKeyEd25519, serverSigningKeyset };
+            if (signingTrustUpdate !== undefined)
+                restored = await acceptDemoSigningUpdate(restored, signingTrustUpdate, { store: deps.store });
+            await writePrivateJson(configPath, restored);
         }
-        await writePrivateJson(configPath, { ...existing, serverPublicKeyEd25519, serverSigningKeyset });
         return verifyDemoDevice(input, deps);
     }
     catch (error) {
         if (error.code !== 'ENOENT')
             throw error;
     }
-    await writePrivateJson(configPath, { schema: 'dharma.demo-device/v1',
+    let config = { schema: 'dharma.demo-device/v1',
         hqUrl: origin, organizationId: input.organizationId, repositoryId: input.repositoryId,
         normalizedRepository: input.normalizedRepository, installationId: input.installationId,
         deviceId, publicKeyEd25519: identity.publicKeyEd25519,
         enrolledAt: new Date().toISOString(), signedReady: false, nextSequence: 1,
-        serverPublicKeyEd25519, serverSigningKeyset });
+        serverPublicKeyEd25519, serverSigningKeyset };
+    const pendingEnrollmentPath = `${configPath}.pending-enrollment.json`;
+    try {
+        const pending = JSON.parse(await readFile(pendingEnrollmentPath, 'utf8'));
+        if (Object.keys(pending).length !== Object.keys(config).length
+            || Object.keys(pending).some(key => !Object.hasOwn(config, key))
+            || pending.schema !== config.schema || pending.signedReady !== false || pending.nextSequence !== 1
+            || !Number.isFinite(Date.parse(pending.enrolledAt)) || !pending.serverSigningKeyset
+            || ['hqUrl', 'organizationId', 'repositoryId', 'normalizedRepository', 'installationId',
+                'deviceId', 'publicKeyEd25519', 'serverPublicKeyEd25519'].some(key => pending[key] !== config[key])) {
+            throw new Error('Pending Demo enrollment does not match the approved identity. Preserve it for recovery.');
+        }
+        config = pending;
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
+    // Persist the credential-free enrollment binding before the protected trust
+    // write. A restart can recover its exact timestamp from this intent record.
+    await writePrivateJson(pendingEnrollmentPath, config);
+    const predecessorGeneration = config.serverSigningKeyset.generation;
+    config = await resolveDemoSigningTrust(config, { store: deps.store });
+    if (signingTrustUpdate !== undefined && config.serverSigningKeyset.generation === predecessorGeneration) {
+        config = await acceptDemoSigningUpdate(config, signingTrustUpdate, { store: deps.store });
+    }
+    await writePrivateJson(configPath, config);
+    await unlink(pendingEnrollmentPath);
     return verifyDemoDevice(input, deps);
 }
 //# sourceMappingURL=demoEnrollment.js.map

package/dist/demoEnrollment.js.map

@@ -1 +1 @@
-{"version":3,"file":"demoEnrollment.js","sourceRoot":"","sources":["../src/demoEnrollment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAmB,MAAM,aAAa,CAAC;AAC1G,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACrF,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,0BAA0B,EAAE,cAAc,EAA0B,MAAM,2CAA2C,CAAC;AAC/H,OAAO,EAAE,gCAAgC,EAAmC,MAAM,wCAAwC,CAAC;AAE3H,MAAM,IAAI,GAAG,4EAA4E,CAAC;AAC1F,MAAM,IAAI,GAAG,qBAAqB,CAAC;AACnC,MAAM,YAAY,GAAG,gBAAgB,CAAC;AA0CtC,SAAS,WAAW,CAAC,KAA+B;IAClD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;WAC/C,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;WAClE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;WAC7D,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,oBAAoB;WAC5D,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;IACpG,CAAC;AACH,CAAC;AAED,MAAM,kBAAmB,SAAQ,KAAK;IACf;IAAwC;IAA7D,YAAqB,IAAY,EAAE,OAAe,EAAW,MAAc;QACzE,KAAK,CAAC,GAAG,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;QADV,SAAI,GAAJ,IAAI,CAAQ;QAA4B,WAAM,GAAN,MAAM,CAAQ;IAE3E,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,IAAa,EAAE,MAAc;IAC7C,MAAM,IAAI,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAA+B,CAAC,CAAC,CAAC,EAAE,CAAC;IACrF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QACvF,CAAC,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjD,MAAM,IAAI,GAAG,OAAO,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI;QACzD,CAAC,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,MAAM,EAAE,CAAC;IACnE,MAAM,OAAO,GAAG,OAAO,MAAM,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO;QAClE,CAAC,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,6BAA6B,CAAC;IACpF,OAAO,IAAI,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,KAAK,YAAY,SAAS;WAC5B,CAAC,KAAK,YAAY,kBAAkB;eAClC,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,QAAkB;IAChD,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC9D,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;WACtD,IAAgC,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,IAA+B,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAsB,EAAE,MAAc;IAC9D,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,KAAK,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;SACnG,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9B,OAAO,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAAsB;IAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAqB,CAAC;IACrH,IAAI,MAAM,CAAC,MAAM,KAAK,uBAAuB,IAAI,CAAC,MAAM,CAAC,WAAW;WAC/D,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;WAC5F,MAAM,CAAC,oBAAoB,KAAK,KAAK,CAAC,oBAAoB;WAC1D,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;WAC9C,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,IAAI,EAAE,CAAC;WAChE,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,+FAA+F,CAAC,CAAC;IACnH,CAAC;IACD,MAAM,SAAS,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS;YACnE,CAAC,EAAE,MAAM,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,gCAAgC,CACnD,MAAM,CAAC,mBAAmB,EAAE,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IAC/D,IAAI,CAAC,YAAY,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;IAChG,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,mBAAmB,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;AACtF,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAc;IAC1D,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,UAAU,EAAE,MAAM,CAAC;IAChD,MAAM,SAAS,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACtF,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC9B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,MAAc,EAAE,KAA+B;IAClF,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC9F,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAC7B,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAAC,CAAC;IACzE,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,sBAAsB;WAC/D,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC;WACvE,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;WAC7C,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,KAAK,CAAC;WACpD,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;WAC5C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,cAAc;WACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,KAAK,CAAC,YAAY;WAC3D,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAc,EAAE,KAAsB,EACjE,QAAgB,EAAE,UAAsB,EAAE,QAAgB;IAC1D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,iCAAiC,KAAK,CAAC,YAAY,SAAS,EAAE,MAAM,CAAC,CAAC;IAC1F,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;QACzC,QAAQ,EAAE,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;QACnE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK;QACzC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,QAAQ,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS;KACzE,CAAC,CAAC,CAAC;IACJ,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAChG,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE;YAC/E,oBAAoB,EAAE,QAAQ;YAC9B,qBAAqB,EAAE,SAAS;YAChC,qBAAqB,EAAE,SAAS;YAChC,oBAAoB,EAAE,SAAS;YAC/B,gBAAgB,EAAE,KAAK;YACvB,mBAAmB,EAAE,MAAM,CAAC,QAAQ,CAAC;YACrC,oBAAoB,EAAE,SAAS;SAChC,EAAE,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAsB,EAC3D,OAA8F,EAAE;IAChG,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,GAAG,UAAU,sBAAsB,CAAC;IACxD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAqB,CAAC;IAClF,IAAI,MAAM,CAAC,MAAM,KAAK,uBAAuB,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM;WACnE,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;WAC5F,MAAM,CAAC,oBAAoB,KAAK,KAAK,CAAC,oBAAoB;WAC1D,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;WAC7E,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,EAAE,KAAK,EAAE,MAAM;QAC/D,cAAc,EAAE,GAAG,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,YAAY,EAAE;QAC/D,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAC7D,IAAI,MAAM,CAAC,gBAAgB,KAAK,QAAQ,CAAC,gBAAgB,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,OAAO,GAAG,mBAAmB,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAC9D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAmB,CAAC;QACnF,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,IAAI,QAAQ,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG;eACpE,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,GAAG,MAAM,CAAC,YAAY;eACnF,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC9E,CAAC;QACD,UAAU,GAAG,IAAI,CAAC;QAClB,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,MAAM;YAChE,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,mBAAmB,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAClD,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,kEAAkE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACxG,CAAC;IACH,CAAC;IACD,MAAM,aAAa,GAAG,KAAK,IAAI,EAAE;QAC/B,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC7C,OAAO,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACjE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO;SACxC,CAAC,CAAC,CAAC;IACN,CAAC,CAAC;IACF,IAAI,MAAM,GAAmC,IAAI,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,aAAa,EAAE,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC,wBAAwB,KAAK,OAAO,CAAC,QAAQ,CAAC;eAClE,CAAC,CAAC,KAAK,YAAY,kBAAkB,CAAC;eACtC,KAAK,CAAC,IAAI,KAAK,mCAAmC;YAAE,MAAM,KAAK,CAAC;QACrE,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,EAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;aAC5D,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC;QACzD,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;YAClC,OAAO,GAAG,mBAAmB,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAC7F,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,aAAa,EAAE,CAAC;gBAC/B,SAAS,GAAG,IAAI,CAAC;gBACjB,MAAM;YACR,CAAC;YAAC,OAAO,cAAc,EAAE,CAAC;gBACxB,IAAI,CAAC,CAAC,cAAc,YAAY,kBAAkB,CAAC;uBAC9C,cAAc,CAAC,IAAI,KAAK,mCAAmC;oBAAE,MAAM,cAAc,CAAC;YACzF,CAAC;QACH,CAAC;QACD,IAAI,CAAC,SAAS;YAAE,MAAM,KAAK,CAAC;IAC9B,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;WACtG,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,oBAAoB,KAAK,KAAK,CAAC,oBAAoB,EAAE,CAAC;QACvG,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,YAAY,GAAG,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IAC3C,MAAM,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC3C,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC1C,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,KAAK,EAAE,qBAA8B;QAC/D,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY;QACtE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ;QAC3E,UAAU,EAAE,sBAAsB,EAAE,eAAwB,EAAE,CAAC;AACnE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAA+B,EACrE,OAAsC,EAAE;IACxC,WAAW,CAAC,KAAK,CAAC,CAAC;IACnB,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,YAAoB,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IACxH,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,EAAE,KAAK,EAAE,MAAM;QAC/D,cAAc,EAAE,GAAG,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,YAAY,EAAE;QAC/D,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,OAAO,CAAC,GAAG,MAAM,8BAA8B,EAAE;QAC5F,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY;YAClF,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ;YAC3E,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,EAAE,CAAC;KACjD,CAAC,CAAC,CAAC;IACJ,IAAI,OAAO,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,IAAI,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;WAC7F,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnH,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,eAAe,GAAG,WAAW,CAAC,OAAO,CAAC,eAAe,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC5E,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC,eAAe,CAAC,CAAC;IACnF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAC7D,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,IAAI,EAAE,GAAG,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC;IAC3F,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,sBAAsB,GAAG,EAAE,CAAC;IAChC,IAAI,mBAA2D,CAAC;IAChE,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,MAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,OAAO,CAAC,GAAG,MAAM,mCAAmC,EAAE;gBAC1F,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,cAAc,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;aACtF,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC9C,iBAAiB,IAAI,CAAC,CAAC;YACvB,IAAI,iBAAiB,IAAI,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,8GAA8G,EAC5H,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACtB,CAAC;YACD,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;YACjE,SAAS;QACX,CAAC;QACD,iBAAiB,GAAG,CAAC,CAAC;QACtB,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC5F,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;YACnF,CAAC;YACD,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACnC,sBAAsB,GAAG,MAAM,CAAC,MAAM,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC;YACrE,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;gBACvF,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;YACpF,CAAC;YACD,mBAAmB,GAAG,MAAM,CAAC,mBAAiD,CAAC;YAC/E,MAAM,YAAY,GAAG,gCAAgC,CAAC,mBAAmB,EACvE,eAAe,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,sBAAsB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAClG,KAAK,CAAC,cAAc,CAAC,CAAC;YACxB,IAAI,CAAC,YAAY,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;YAC7G,MAAM;QACR,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC;QACvH,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC,CAAC;IACxH,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAqB,CAAC;QACpF,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,gBAAgB,KAAK,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YAC9F,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,QAAQ,CAAC,sBAAsB,IAAI,QAAQ,CAAC,sBAAsB,KAAK,sBAAsB,EAAE,CAAC;YAClG,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;QACpG,CAAC;QACD,MAAM,gBAAgB,CAAC,UAAU,EAAE,EAAE,GAAG,QAAQ,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACjG,OAAO,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;IACtE,CAAC;IACD,MAAM,gBAAgB,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,uBAAuB;QAClE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY;QACrF,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc;QACtF,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QACrD,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;QACzE,sBAAsB,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACjD,OAAO,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AACvC,CAAC"}
+{"version":3,"file":"demoEnrollment.js","sourceRoot":"","sources":["../src/demoEnrollment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAmB,MAAM,aAAa,CAAC;AAC1G,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACrF,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,0BAA0B,EAAE,cAAc,EAA0B,MAAM,2CAA2C,CAAC;AAC/H,OAAO,EAAE,gCAAgC,EAAmC,MAAM,wCAAwC,CAAC;AAC3H,OAAO,EAAE,uBAAuB,EAAE,4BAA4B,EAAE,uBAAuB,EAAgC,MAAM,uBAAuB,CAAC;AAErJ,MAAM,IAAI,GAAG,4EAA4E,CAAC;AAC1F,MAAM,IAAI,GAAG,qBAAqB,CAAC;AACnC,MAAM,YAAY,GAAG,gBAAgB,CAAC;AA0CtC,SAAS,WAAW,CAAC,KAA+B;IAClD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;WAC/C,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;WAClE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;WAC7D,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,oBAAoB;WAC5D,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;IACpG,CAAC;AACH,CAAC;AAED,MAAM,kBAAmB,SAAQ,KAAK;IACf;IAAwC;IAA7D,YAAqB,IAAY,EAAE,OAAe,EAAW,MAAc;QACzE,KAAK,CAAC,GAAG,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;QADV,SAAI,GAAJ,IAAI,CAAQ;QAA4B,WAAM,GAAN,MAAM,CAAQ;IAE3E,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,IAAa,EAAE,MAAc;IAC7C,MAAM,IAAI,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAA+B,CAAC,CAAC,CAAC,EAAE,CAAC;IACrF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QACvF,CAAC,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjD,MAAM,IAAI,GAAG,OAAO,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI;QACzD,CAAC,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,MAAM,EAAE,CAAC;IACnE,MAAM,OAAO,GAAG,OAAO,MAAM,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO;QAClE,CAAC,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,6BAA6B,CAAC;IACpF,OAAO,IAAI,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,KAAK,YAAY,SAAS;WAC5B,CAAC,KAAK,YAAY,kBAAkB;eAClC,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,QAAkB;IAChD,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC9D,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;WACtD,IAAgC,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,IAA+B,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAsB,EAAE,MAAc;IAC9D,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,KAAK,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;SACnG,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9B,OAAO,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAAsB,EAAE,OAAgC,EAAE;IACnG,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAqB,CAAC;IAClF,IAAI,MAAM,CAAC,MAAM,KAAK,uBAAuB,IAAI,CAAC,MAAM,CAAC,WAAW;WAC/D,MAAM,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;WACtD,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;WAC5F,MAAM,CAAC,oBAAoB,KAAK,KAAK,CAAC,oBAAoB;WAC1D,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;WAC9C,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,IAAI,EAAE,CAAC;WAChE,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,+FAA+F,CAAC,CAAC;IACnH,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,EAAE,KAAK,EAAE,MAAM;QAC/D,cAAc,EAAE,GAAG,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,YAAY,EAAE;QAC/D,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAC7D,IAAI,MAAM,CAAC,gBAAgB,KAAK,QAAQ,CAAC,gBAAgB,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC5D,IAAI,OAAO,CAAC,sBAAsB,KAAK,MAAM,CAAC,sBAAsB;WAC/D,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAChG,MAAM,gBAAgB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,SAAS,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS;YACnE,CAAC,EAAE,OAAO,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACxD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,mBAAoB,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;AACxF,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAc;IAC1D,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,UAAU,EAAE,MAAM,CAAC;IAChD,MAAM,SAAS,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACtF,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC9B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,MAAc,EAAE,KAA+B;IAClF,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC9F,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAC7B,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAAC,CAAC;IACzE,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,sBAAsB;WAC/D,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC;WACvE,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;WAC7C,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,KAAK,CAAC;WACpD,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;WAC5C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,cAAc;WACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,KAAK,CAAC,YAAY;WAC3D,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAc,EAAE,KAAsB,EACjE,QAAgB,EAAE,UAAsB,EAAE,QAAgB,EAAE,iBAA0B;IACtF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,iCAAiC,KAAK,CAAC,YAAY,SAAS,EAAE,MAAM,CAAC,CAAC;IAC1F,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IACpD,IAAI,iBAAiB,KAAK,SAAS;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC1G,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;QACzC,QAAQ,EAAE,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;QACnE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK;QACzC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,QAAQ,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS;KACzE,CAAC,CAAC,CAAC;IACJ,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAChG,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE;YAC/E,oBAAoB,EAAE,QAAQ;YAC9B,qBAAqB,EAAE,SAAS;YAChC,qBAAqB,EAAE,SAAS;YAChC,oBAAoB,EAAE,SAAS;YAC/B,gBAAgB,EAAE,KAAK;YACvB,mBAAmB,EAAE,MAAM,CAAC,QAAQ,CAAC;YACrC,oBAAoB,EAAE,SAAS;SAChC,EAAE,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAsB,EAC3D,OAA8F,EAAE;IAChG,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,GAAG,UAAU,sBAAsB,CAAC;IACxD,IAAI,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAqB,CAAC;IAChF,IAAI,MAAM,CAAC,MAAM,KAAK,uBAAuB,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM;WACnE,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;WAC5F,MAAM,CAAC,oBAAoB,KAAK,KAAK,CAAC,oBAAoB;WAC1D,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;WAC7E,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,EAAE,KAAK,EAAE,MAAM;QAC/D,cAAc,EAAE,GAAG,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,YAAY,EAAE;QAC/D,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAC7D,IAAI,MAAM,CAAC,gBAAgB,KAAK,QAAQ,CAAC,gBAAgB,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,MAAM,CAAC,mBAAmB;QAAE,MAAM,GAAG,MAAM,uBAAuB,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACtG,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,OAAO,GAAG,mBAAmB,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAC9D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC;IACpF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAmB,CAAC;QACnF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC1C,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACrD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACzC,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACrD,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,IAAI,WAAW,CAAC,QAAQ,EAAE,KAAK,WAAW,CAAC,QAAQ,EAAE;eACzF,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,GAAG,MAAM,CAAC,YAAY;eACnF,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC9E,CAAC;QACD,UAAU,GAAG,IAAI,CAAC;QAClB,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,QAAQ,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG;YAChG,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,mBAAmB,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAClD,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC;IACtF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,kEAAkE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACxG,CAAC;IACH,CAAC;IACD,MAAM,aAAa,GAAG,KAAK,IAAI,EAAE;QAC/B,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC7C,OAAO,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACjE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO;SACxC,CAAC,CAAC,CAAC;IACN,CAAC,CAAC;IACF,IAAI,MAAM,GAAmC,IAAI,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,aAAa,EAAE,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC,wBAAwB,KAAK,OAAO,CAAC,QAAQ,CAAC;eAClE,CAAC,CAAC,KAAK,YAAY,kBAAkB,CAAC;eACtC,KAAK,CAAC,IAAI,KAAK,mCAAmC;YAAE,MAAM,KAAK,CAAC;QACrE,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,EAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;aAC5D,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC;QACzD,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;YAClC,OAAO,GAAG,mBAAmB,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,UAAU,EAAE,QAAQ,EACzF,MAAM,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC;YAC1C,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,aAAa,EAAE,CAAC;gBAC/B,SAAS,GAAG,IAAI,CAAC;gBACjB,MAAM;YACR,CAAC;YAAC,OAAO,cAAc,EAAE,CAAC;gBACxB,IAAI,CAAC,CAAC,cAAc,YAAY,kBAAkB,CAAC;uBAC9C,cAAc,CAAC,IAAI,KAAK,mCAAmC;oBAAE,MAAM,cAAc,CAAC;YACzF,CAAC;QACH,CAAC;QACD,IAAI,CAAC,SAAS;YAAE,MAAM,KAAK,CAAC;IAC9B,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;WACtG,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,oBAAoB,KAAK,KAAK,CAAC,oBAAoB,EAAE,CAAC;QACvG,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,YAAY,GAAG,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IAC3C,MAAM,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC3C,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC1C,gFAAgF;IAChF,uFAAuF;IACvF,IAAI,MAAM,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAC5C,MAAM,GAAG,MAAM,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACjG,MAAM,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,KAAK,EAAE,qBAA8B;QAC/D,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY;QACtE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ;QAC3E,UAAU,EAAE,sBAAsB,EAAE,eAAwB,EAAE,CAAC;AACnE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAA+B,EACrE,OAAsC,EAAE;IACxC,WAAW,CAAC,KAAK,CAAC,CAAC;IACnB,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,YAAoB,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IACxH,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,EAAE,KAAK,EAAE,MAAM;QAC/D,cAAc,EAAE,GAAG,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,YAAY,EAAE;QAC/D,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,OAAO,CAAC,GAAG,MAAM,8BAA8B,EAAE;QAC5F,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY;YAClF,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ;YAC3E,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,EAAE,CAAC;KACjD,CAAC,CAAC,CAAC;IACJ,IAAI,OAAO,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,IAAI,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;WAC7F,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnH,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,eAAe,GAAG,WAAW,CAAC,OAAO,CAAC,eAAe,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC5E,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC,eAAe,CAAC,CAAC;IACnF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAC7D,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,IAAI,EAAE,GAAG,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC;IAC3F,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,sBAAsB,GAAG,EAAE,CAAC;IAChC,IAAI,mBAA2D,CAAC;IAChE,IAAI,kBAA2B,CAAC;IAChC,IAAI,kBAA2B,CAAC;IAChC,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,MAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,OAAO,CAAC,GAAG,MAAM,mCAAmC,EAAE;gBAC1F,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,cAAc,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;aACtF,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC9C,iBAAiB,IAAI,CAAC,CAAC;YACvB,IAAI,iBAAiB,IAAI,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,8GAA8G,EAC5H,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACtB,CAAC;YACD,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;YACjE,SAAS;QACX,CAAC;QACD,iBAAiB,GAAG,CAAC,CAAC;QACtB,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC5F,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;YACnF,CAAC;YACD,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACnC,sBAAsB,GAAG,MAAM,CAAC,MAAM,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC;YACrE,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;gBACvF,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;YACpF,CAAC;YACD,mBAAmB,GAAG,MAAM,CAAC,mBAAiD,CAAC;YAC/E,MAAM,YAAY,GAAG,gCAAgC,CAAC,mBAAmB,EACvE,eAAe,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,sBAAsB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAClG,KAAK,CAAC,cAAc,CAAC,CAAC;YACxB,IAAI,CAAC,YAAY,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;YAC7G,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;YAC/C,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;YAC/C,MAAM;QACR,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC;QACvH,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC,CAAC;IACxH,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,IAAI,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAqB,CAAC;QAClF,IAAI,QAAQ,CAAC,MAAM,KAAK,uBAAuB,IAAI,QAAQ,CAAC,KAAK,KAAK,MAAM;eACvE,QAAQ,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,IAAI,QAAQ,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;eAChG,QAAQ,CAAC,oBAAoB,KAAK,KAAK,CAAC,oBAAoB,IAAI,QAAQ,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;eAChH,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,gBAAgB,KAAK,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YAC/F,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,QAAQ,CAAC,mBAAmB,EAAE,CAAC;YACjC,IAAI,CAAC;gBAAC,QAAQ,GAAG,MAAM,uBAAuB,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YAAC,CAAC;YAClF,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,uCAAuC,CAAC;oBAAE,MAAM,KAAK,CAAC;gBACjH,QAAQ,GAAG,MAAM,4BAA4B,CAAC,QAAQ,EAAE,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,EACrG,kBAAkB,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC7C,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;oBACrC,QAAQ,GAAG,MAAM,uBAAuB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;gBAChG,CAAC;YACH,CAAC;YACD,MAAM,gBAAgB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC/C,CAAC;QACD,0EAA0E;QAC1E,2EAA2E;QAC3E,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,CAAC;YAClC,IAAI,QAAQ,GAAG,EAAE,GAAG,QAAQ,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,CAAC;YAC5E,IAAI,kBAAkB,KAAK,SAAS;gBAAE,QAAQ,GAAG,MAAM,uBAAuB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YACpI,MAAM,gBAAgB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;IACtE,CAAC;IACD,IAAI,MAAM,GAAqB,EAAE,MAAM,EAAE,uBAAuB;QAC9D,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY;QACrF,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc;QACtF,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QACrD,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;QACzE,sBAAsB,EAAE,mBAAmB,EAAE,CAAC;IAChD,MAAM,qBAAqB,GAAG,GAAG,UAAU,0BAA0B,CAAC;IACtE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAqB,CAAC;QAC9F,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM;eACzD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;eAC7D,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,WAAW,KAAK,KAAK,IAAI,OAAO,CAAC,YAAY,KAAK,CAAC;eAC/F,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB;eAC/E,CAAC,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,sBAAsB,EAAE,gBAAgB;gBACtF,UAAU,EAAE,kBAAkB,EAAE,wBAAwB,CAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAClH,MAAM,IAAI,KAAK,CAAC,yFAAyF,CAAC,CAAC;QAC7G,CAAC;QACD,MAAM,GAAG,OAAO,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;IACtE,CAAC;IACD,4EAA4E;IAC5E,4EAA4E;IAC5E,MAAM,gBAAgB,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IACtD,MAAM,qBAAqB,GAAG,MAAM,CAAC,mBAAoB,CAAC,UAAU,CAAC;IACrE,MAAM,GAAG,MAAM,uBAAuB,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACtE,IAAI,kBAAkB,KAAK,SAAS,IAAI,MAAM,CAAC,mBAAoB,CAAC,UAAU,KAAK,qBAAqB,EAAE,CAAC;QACzG,MAAM,GAAG,MAAM,uBAAuB,CAAC,MAAM,EAAE,kBAAkB,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC3C,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;IACpC,OAAO,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AACvC,CAAC"}

package/dist/demoEnrollment.test.js

@@ -43,6 +43,78 @@ function options(stateRoot) {
         installationId: '40000000-0000-4000-8000-000000000001',
         stateRoot, maximumWaitMs: 1_000 };
 }
+test('fresh browser approval replaces expired trust without replacing device identity or resetting its sequence', async (t) => {
+    t.mock.timers.enable({ apis: ['Date'], now: new Date('2026-09-27T03:00:00Z') });
+    const stateRoot = await mkdtemp(resolve(tmpdir(), 'dharma-demo-reenroll-'));
+    const values = new Map();
+    let interruptReplacement = false;
+    const store = { backend: 'linux-secret-service',
+        async get(account) { return values.get(account) ?? null; },
+        async put(account, value) {
+            values.set(account, value);
+            if (interruptReplacement && /^demo-signing-[0-9a-f]{32}$/.test(account)) {
+                interruptReplacement = false;
+                throw new Error('interrupted after protected replacement');
+            }
+        },
+        async delete(account) { values.delete(account); } };
+    const initial = approvedEnrollment();
+    let approved = initial;
+    let approvals = 0;
+    const sequences = [];
+    let devicePublicKey = '';
+    const fetcher = async (resource, init) => {
+        const url = new URL(String(resource));
+        if (url.pathname.endsWith('/enrollments')) {
+            devicePublicKey = JSON.parse(String(init?.body)).publicKeyEd25519;
+            return new Response(JSON.stringify({ ok: true, status: 'pending', organizationId: orgId,
+                repositoryId, deviceCode, expiresAt: new Date(Date.now() + 60_000).toISOString(),
+                verificationUri: `${hqUrl}/demo/fabric/approve?orgId=${orgId}&repositoryId=${repositoryId}&code=${browserCode}` }));
+        }
+        if (url.pathname.endsWith('/poll'))
+            return new Response(JSON.stringify(approved));
+        sequences.push(Number(new Headers(init?.headers).get('x-dharma-sequence')));
+        return new Response(JSON.stringify({ ok: true, organizationId: orgId, repositoryId,
+            deviceId, normalizedRepository }));
+    };
+    const connected = await connectDemoDevice(options(stateRoot), { store, fetcher,
+        onApprovalRequired: async () => { approvals += 1; } });
+    const before = JSON.parse(await readFile(connected.configPath, 'utf8'));
+    const originalAnchor = [...values.values()].find(value => value.includes('dharma.demo-signing-anchor/v1'));
+    t.mock.timers.tick(48 * 60 * 60_000);
+    await assert.rejects(loadDemoSigningTrust(options(stateRoot), { store }), /expired/i);
+    const successor = generateKeyPairSync('ed25519');
+    const pin = successor.publicKey.export({ format: 'jwk' }).x;
+    const issuedAt = new Date(Date.now() - 1_000).toISOString();
+    const expiresAt = new Date(Date.now() + 24 * 60 * 60_000).toISOString();
+    const body = { ...initial.serverSigningKeyset, generation: 3, signedByKeyVersion: 'successor',
+        issuedAt, expiresAt, keys: [...initial.serverSigningKeyset.keys.map(key => ({ ...key, status: 'overlap' })),
+            { keyVersion: 'successor', publicKeyEd25519: pin, status: 'active', notBefore: issuedAt, notAfter: expiresAt }] };
+    const { signature: _signature, ...unsigned } = body;
+    approved = { ...initial, serverPublicKeyEd25519: pin,
+        serverSigningKeyset: { ...unsigned, signature: signCanonicalObject(unsigned, successor.privateKey) },
+        enrollmentApproval: { schema: 'dharma.demo-enrollment-approval/v1', organizationId: orgId,
+            repositoryId, participantId: '20000000-0000-4000-8000-000000000001', deviceId,
+            enrollmentId: '50000000-0000-4000-8000-000000000002', publicKeyEd25519: devicePublicKey,
+            approvedAt: new Date().toISOString(), expiresAt: new Date(Date.now() + 60_000).toISOString() } };
+    interruptReplacement = true;
+    await assert.rejects(connectDemoDevice(options(stateRoot), { store, fetcher,
+        onApprovalRequired: async () => { approvals += 1; } }), /interrupted after protected replacement/);
+    const trusted = await loadDemoSigningTrust(options(stateRoot), { store });
+    assert.equal(trusted.publicKey.export({ format: 'jwk' }).x, pin);
+    const renewed = await verifyDemoDevice(options(stateRoot), { store, fetcher });
+    const after = JSON.parse(await readFile(renewed.configPath, 'utf8'));
+    assert.equal(approvals, 2);
+    assert.deepEqual(sequences, [1, 2]);
+    assert.equal(after.deviceId, before.deviceId);
+    assert.equal(after.publicKeyEd25519, before.publicKeyEd25519);
+    assert.equal(after.enrolledAt, before.enrolledAt);
+    assert.equal(after.nextSequence, 3);
+    assert.equal(after.serverPublicKeyEd25519, pin);
+    assert.equal(after.serverSigningKeyset.keys[0].notAfter, initial.serverSigningKeyset.keys[0].notAfter);
+    assert.ok([...values.values()].includes(originalAnchor), 'old protected trust must survive unchanged');
+    assert.doesNotMatch([...values.values()].filter(value => value.includes('demo-signing')).join(''), /grant|privateJwk|privateKey/i);
+});
 test('Demo enrollment verifies the browser origin, waits for approval and signs a scoped status request', async () => {
     const stateRoot = await mkdtemp(resolve(tmpdir(), 'dharma-demo-cli-'));
     const calls = [];
@@ -82,8 +154,9 @@ test('Demo enrollment verifies the browser origin, waits for approval and signs
             deviceId, normalizedRepository }), { status: 200 });
     };
     const approvals = [];
+    const store = memoryStore();
     const connected = await connectDemoDevice(options(stateRoot), {
-        store: memoryStore(), fetcher, sleep: async () => { },
+        store, fetcher, sleep: async () => { },
         onApprovalRequired: async (url) => { approvals.push(url); },
     });
     assert.equal(connected.stage, 'device_signed_ready');
@@ -96,7 +169,7 @@ test('Demo enrollment verifies the browser origin, waits for approval and signs
     assert.equal(config.deviceId, deviceId);
     assert.equal(config.grant, undefined);
     assert.equal(config.privateKey, undefined);
-    assert.equal((await loadDemoSigningTrust(options(stateRoot))).deviceId, deviceId);
+    assert.equal((await loadDemoSigningTrust(options(stateRoot), { store })).deviceId, deviceId);
     if (process.platform !== 'win32')
         assert.equal((await stat(connected.configPath)).mode & 0o777, 0o600);
 });
@@ -119,6 +192,219 @@ test('Demo enrollment rejects missing and foreign signing anchors before saving
         await assert.rejects(readFile(scopePath(options(stateRoot), hqUrl)), { code: 'ENOENT' });
     }
 });
+test('fresh enrollment during preload protects the successor before status and resumes activation after restart', async () => {
+    const stateRoot = await mkdtemp(resolve(tmpdir(), 'dharma-demo-preload-enrollment-'));
+    const scope = options(stateRoot);
+    const store = memoryStore();
+    const approved = approvedEnrollment();
+    const initial = approved.serverSigningKeyset;
+    const successor = generateKeyPairSync('ed25519');
+    const nextExpiry = new Date(Date.now() + 48 * 60 * 60_000).toISOString();
+    const { signature: _signature, ...initialUnsigned } = initial;
+    const preloadUnsigned = { ...initialUnsigned, generation: 2, keys: [...initial.keys, {
+                keyVersion: 'successor', publicKeyEd25519: successor.publicKey.export({ format: 'jwk' }).x,
+                status: 'overlap', notBefore: initial.issuedAt, notAfter: nextExpiry
+            }] };
+    const preload = { ...preloadUnsigned, signature: signCanonicalObject(preloadUnsigned, signer.privateKey) };
+    const activeUnsigned = { ...preloadUnsigned, generation: 3, signedByKeyVersion: 'successor',
+        expiresAt: nextExpiry, keys: preload.keys.map(key => ({ ...key,
+            status: key.keyVersion === 'successor' ? 'active' : 'overlap' })) };
+    const active = { ...activeUnsigned, signature: signCanonicalObject(activeUnsigned, successor.privateKey) };
+    const envelope = (keysets) => ({ schema: 'dharma.demo-signing-update/v1',
+        organizationId: orgId, repositoryId, deviceId, issuedAt: new Date().toISOString(),
+        expiresAt: new Date(Date.now() + 60_000).toISOString(), keysets });
+    let activate = false;
+    const fetcher = async (resource) => {
+        const url = new URL(String(resource));
+        if (url.pathname.endsWith('/enrollments'))
+            return new Response(JSON.stringify({ ok: true,
+                status: 'pending', organizationId: orgId, repositoryId, deviceCode,
+                expiresAt: new Date(Date.now() + 60_000).toISOString(),
+                verificationUri: `${hqUrl}/demo/fabric/approve?orgId=${orgId}&repositoryId=${repositoryId}&code=${browserCode}` }));
+        if (url.pathname.endsWith('/poll'))
+            return new Response(JSON.stringify({ ...approved,
+                signingTrustUpdate: envelope([initial, preload]) }));
+        assert.equal(url.searchParams.get('signingGeneration'), '2');
+        return new Response(JSON.stringify({ ok: true, organizationId: orgId, repositoryId,
+            deviceId, normalizedRepository, ...(activate ? { signingTrustUpdate: envelope([preload, active]) } : {}) }));
+    };
+    const connected = await connectDemoDevice(scope, { store, fetcher });
+    assert.equal((await loadDemoSigningTrust(scope, { store })).keyset.generation, 2);
+    // The same approved enrollment may be returned on retry; it must not downgrade protected trust.
+    await connectDemoDevice(scope, { store, fetcher });
+    activate = true;
+    await verifyDemoDevice(scope, { store, fetcher });
+    const trust = await loadDemoSigningTrust(scope, { store,
+        now: new Date(Date.parse(initial.expiresAt) + 1_000) });
+    assert.equal(trust.keyset.generation, 3);
+    const saved = await readFile(connected.configPath, 'utf8');
+    assert.doesNotMatch(saved, /grant|signingTrustUpdate|privateKey|privateJwk/i);
+    assert.equal(JSON.parse(saved).serverPublicKeyEd25519, serverPublicKeyEd25519);
+});
+test('fresh enrollment rejects a foreign or corrupt preload before writing a device or requesting signed status', async () => {
+    for (const fault of ['foreign', 'corrupt', 'expired', 'unexpected']) {
+        const stateRoot = await mkdtemp(resolve(tmpdir(), 'dharma-demo-preload-reject-'));
+        const scope = options(stateRoot);
+        const approved = approvedEnrollment();
+        const update = { schema: 'dharma.demo-signing-update/v1', organizationId: orgId,
+            repositoryId, deviceId, issuedAt: new Date().toISOString(),
+            expiresAt: new Date(Date.now() + 60_000).toISOString(), keysets: [approved.serverSigningKeyset],
+            ...(fault === 'unexpected' ? { grant: 'must-not-persist' } : {}) };
+        if (fault === 'foreign')
+            update.deviceId = '30000000-0000-4000-8000-000000000099';
+        if (fault === 'expired')
+            update.expiresAt = new Date(Date.now() - 1_000).toISOString();
+        if (fault === 'corrupt')
+            update.keysets = [{ ...approved.serverSigningKeyset, generation: 2, signature: 'invalid' }];
+        const fetcher = async (resource) => {
+            const pathname = new URL(String(resource)).pathname;
+            if (pathname.endsWith('/enrollments'))
+                return new Response(JSON.stringify({ ok: true,
+                    status: 'pending', organizationId: orgId, repositoryId, deviceCode,
+                    expiresAt: new Date(Date.now() + 60_000).toISOString(),
+                    verificationUri: `${hqUrl}/demo/fabric/approve?orgId=${orgId}&repositoryId=${repositoryId}&code=${browserCode}` }));
+            assert.ok(pathname.endsWith('/poll'), 'a rejected preload must never dispatch signed status');
+            return new Response(JSON.stringify({ ...approved, signingTrustUpdate: update }));
+        };
+        await assert.rejects(connectDemoDevice(scope, { store: memoryStore(), fetcher }), /Demo signing/);
+        await assert.rejects(readFile(scopePath(scope, hqUrl)), { code: 'ENOENT' });
+    }
+});
+test('interrupted preload enrollment recovers its protected binding without a second approval or credential file', async () => {
+    const stateRoot = await mkdtemp(resolve(tmpdir(), 'dharma-demo-preload-interrupt-'));
+    const scope = options(stateRoot);
+    const store = memoryStore();
+    const approved = approvedEnrollment();
+    const initial = approved.serverSigningKeyset;
+    const successor = generateKeyPairSync('ed25519');
+    const { signature: _signature, ...body } = initial;
+    const unsigned = { ...body, generation: 2, keys: [...initial.keys, { keyVersion: 'successor',
+                publicKeyEd25519: successor.publicKey.export({ format: 'jwk' }).x, status: 'overlap',
+                notBefore: initial.issuedAt, notAfter: new Date(Date.now() + 48 * 60 * 60_000).toISOString() }] };
+    const preload = { ...unsigned, signature: signCanonicalObject(unsigned, signer.privateKey) };
+    const fetcher = async (resource) => {
+        const url = new URL(String(resource));
+        if (url.pathname.endsWith('/enrollments'))
+            return new Response(JSON.stringify({ ok: true,
+                status: 'approved', organizationId: orgId, repositoryId, deviceCode,
+                expiresAt: new Date(Date.now() + 60_000).toISOString(),
+                verificationUri: `${hqUrl}/demo/fabric/approve?orgId=${orgId}&repositoryId=${repositoryId}&code=${browserCode}` }));
+        if (url.pathname.endsWith('/poll'))
+            return new Response(JSON.stringify({ ...approved, signingTrustUpdate: {
+                    schema: 'dharma.demo-signing-update/v1', organizationId: orgId, repositoryId, deviceId,
+                    issuedAt: new Date().toISOString(), expiresAt: new Date(Date.now() + 60_000).toISOString(), keysets: [initial, preload]
+                } }));
+        assert.equal(url.searchParams.get('signingGeneration'), '2');
+        return new Response(JSON.stringify({ ok: true, organizationId: orgId, repositoryId, deviceId, normalizedRepository }));
+    };
+    const interruptedStore = { ...store, async put(account, value) {
+            await store.put(account, value);
+            if (account.startsWith('demo-signing-') && JSON.parse(value).serverSigningKeyset.generation === 2) {
+                throw new Error('simulated termination after protected write');
+            }
+        } };
+    await assert.rejects(connectDemoDevice(scope, { store: interruptedStore, fetcher }), /simulated termination/);
+    const path = scopePath(scope, hqUrl);
+    await assert.rejects(readFile(path), { code: 'ENOENT' });
+    const pending = JSON.parse(await readFile(`${path}.pending-enrollment.json`, 'utf8'));
+    assert.equal(pending.signedReady, false);
+    assert.doesNotMatch(JSON.stringify(pending), /grant|privateKey|privateJwk|signingTrustUpdate/i);
+    for (const change of [{ organizationId: 'org_foreign' }, { publicKeyEd25519: 'E'.repeat(43) },
+        { deviceId: '30000000-0000-4000-8000-000000000099' }, { signedReady: true }, { nextSequence: 2 },
+        { grant: 'must-not-persist' }]) {
+        const foreign = JSON.stringify({ ...pending, ...change });
+        await writeFile(`${path}.pending-enrollment.json`, foreign);
+        await assert.rejects(connectDemoDevice(scope, { store, fetcher }), /Pending Demo enrollment/);
+        assert.equal(await readFile(`${path}.pending-enrollment.json`, 'utf8'), foreign);
+    }
+    await writeFile(`${path}.pending-enrollment.json`, JSON.stringify(pending));
+    await new Promise(accept => setTimeout(accept, 10));
+    const result = await connectDemoDevice(scope, { store, fetcher,
+        onApprovalRequired: async () => { assert.fail('an approved interrupted enrollment must not ask for another approval'); } });
+    assert.equal(result.stage, 'device_signed_ready');
+    assert.equal(JSON.parse(await readFile(path, 'utf8')).enrolledAt, pending.enrolledAt);
+    assert.equal((await loadDemoSigningTrust(scope, { store })).keyset.generation, 2);
+    await assert.rejects(readFile(`${path}.pending-enrollment.json`), { code: 'ENOENT' });
+});
+test('signed status autonomously accepts a successor and reloads it from protected trust after bootstrap expiry', async () => {
+    const stateRoot = await mkdtemp(resolve(tmpdir(), 'dharma-demo-rotation-'));
+    const scope = options(stateRoot);
+    const store = memoryStore();
+    const approved = approvedEnrollment();
+    const initial = approved.serverSigningKeyset;
+    const successor = generateKeyPairSync('ed25519');
+    const nextExpiry = new Date(Date.now() + 48 * 60 * 60_000).toISOString();
+    const preloadBody = { ...initial, generation: 2, keys: [...initial.keys, {
+                keyVersion: 'successor', publicKeyEd25519: successor.publicKey.export({ format: 'jwk' }).x,
+                status: 'overlap', notBefore: initial.issuedAt, notAfter: nextExpiry
+            }] };
+    const { signature: _oldSignature, ...preloadUnsigned } = preloadBody;
+    const preload = { ...preloadUnsigned, signature: signCanonicalObject(preloadUnsigned, signer.privateKey) };
+    const activeUnsigned = { ...preloadUnsigned, generation: 3, signedByKeyVersion: 'successor',
+        expiresAt: nextExpiry, keys: preload.keys.map(key => ({ ...key,
+            status: key.keyVersion === 'successor' ? 'active' : 'overlap' })) };
+    const active = { ...activeUnsigned, signature: signCanonicalObject(activeUnsigned, successor.privateKey) };
+    let update;
+    const fetcher = async (resource) => {
+        const url = new URL(String(resource));
+        if (url.pathname.endsWith('/enrollments'))
+            return new Response(JSON.stringify({ ok: true,
+                status: 'pending', organizationId: orgId, repositoryId, deviceCode,
+                expiresAt: new Date(Date.now() + 60_000).toISOString(),
+                verificationUri: `${hqUrl}/demo/fabric/approve?orgId=${orgId}&repositoryId=${repositoryId}&code=${browserCode}` }));
+        if (url.pathname.endsWith('/poll'))
+            return new Response(JSON.stringify(approved));
+        assert.equal(url.searchParams.get('signingGeneration'), '1');
+        return new Response(JSON.stringify({ ok: true, organizationId: orgId, repositoryId,
+            deviceId, normalizedRepository, ...(update ? { signingTrustUpdate: update } : {}) }));
+    };
+    const connected = await connectDemoDevice(scope, { store, fetcher });
+    update = { schema: 'dharma.demo-signing-update/v1', organizationId: orgId, repositoryId, deviceId,
+        issuedAt: new Date().toISOString(), expiresAt: new Date(Date.now() + 60_000).toISOString(),
+        keysets: [preload, active] };
+    await verifyDemoDevice(scope, { store, fetcher });
+    const trusted = await loadDemoSigningTrust(scope, { store,
+        now: new Date(Date.parse(initial.expiresAt) + 1_000) });
+    assert.equal(trusted.keyset.generation, 3);
+    const config = JSON.parse(await readFile(connected.configPath, 'utf8'));
+    assert.equal(config.serverPublicKeyEd25519, approved.serverPublicKeyEd25519);
+    assert.equal(config.serverSigningKeyset.keys[0].notAfter, initial.keys[0].notAfter);
+    assert.equal(config.nextSequence, 3);
+    assert.doesNotMatch(JSON.stringify(config), /grant|privateJwk|privateKey/i);
+});
+test('a rejected status trust update preserves the sequence and last verified keyset', async () => {
+    const stateRoot = await mkdtemp(resolve(tmpdir(), 'dharma-demo-rotation-reject-'));
+    const scope = options(stateRoot);
+    const store = memoryStore();
+    const approved = approvedEnrollment();
+    let tamper = false;
+    const fetcher = async (resource) => {
+        const pathname = new URL(String(resource)).pathname;
+        if (pathname.endsWith('/enrollments'))
+            return new Response(JSON.stringify({ ok: true,
+                status: 'pending', organizationId: orgId, repositoryId, deviceCode,
+                expiresAt: new Date(Date.now() + 60_000).toISOString(),
+                verificationUri: `${hqUrl}/demo/fabric/approve?orgId=${orgId}&repositoryId=${repositoryId}&code=${browserCode}` }));
+        if (pathname.endsWith('/poll'))
+            return new Response(JSON.stringify(approved));
+        return new Response(JSON.stringify({ ok: true, organizationId: orgId, repositoryId,
+            deviceId, normalizedRepository, ...(tamper ? { signingTrustUpdate: {
+                    schema: 'dharma.demo-signing-update/v1', organizationId: orgId, repositoryId, deviceId,
+                    issuedAt: new Date().toISOString(), expiresAt: new Date(Date.now() + 60_000).toISOString(),
+                    keysets: [{ ...approved.serverSigningKeyset, generation: 2, signature: 'invalid' }]
+                } } : {}) }));
+    };
+    const connected = await connectDemoDevice(scope, { store, fetcher });
+    tamper = true;
+    await assert.rejects(verifyDemoDevice(scope, { store, fetcher }), /Demo signing/);
+    const config = JSON.parse(await readFile(connected.configPath, 'utf8'));
+    assert.equal(config.nextSequence, 3);
+    assert.equal(config.serverSigningKeyset.generation, 1);
+    assert.deepEqual((await loadDemoSigningTrust(scope, { store })).keyset, approved.serverSigningKeyset);
+    tamper = false;
+    await verifyDemoDevice(scope, { store, fetcher });
+    assert.equal(JSON.parse(await readFile(connected.configPath, 'utf8')).nextSequence, 4);
+});
 test('Demo enrollment recovers from one transient poll failure without restarting enrollment', async () => {
     const stateRoot = await mkdtemp(resolve(tmpdir(), 'dharma-demo-poll-retry-'));
     const calls = [];