@dharma-ai-labs/agent-fabric 0.2.109 → 0.2.111

package/dist/demoSigningTrust.test.js

@@ -0,0 +1,445 @@
+import assert from 'node:assert/strict';
+import { generateKeyPairSync } from 'node:crypto';
+import test from 'node:test';
+import { signCanonicalObject } from '@dharma-ai-labs/agent-fabric-contracts';
+import { acceptDemoSigningKeysets, acceptDemoSigningUpdate, recoverDemoSigningEnrollment, resolveDemoSigningTrust } from './demoSigningTrust.js';
+const now = new Date('2026-09-27T03:00:00.000Z');
+const old = generateKeyPairSync('ed25519');
+const next = generateKeyPairSync('ed25519');
+const oldPublic = old.publicKey.export({ format: 'jwk' }).x;
+const nextPublic = next.publicKey.export({ format: 'jwk' }).x;
+const oldExpiry = '2026-09-27T23:00:00.000Z';
+const newExpiry = '2026-10-20T23:00:00.000Z';
+function signed(generation, keys, successor = false) {
+    const body = { schema: 'dharma.server-signing-keyset/v1', organizationId: 'org_fixture',
+        generation, keys, signedByKeyVersion: successor ? 'successor' : 'original',
+        issuedAt: '2026-09-27T02:00:00.000Z', expiresAt: successor ? newExpiry : oldExpiry };
+    return { ...body, signature: signCanonicalObject(body, successor ? next.privateKey : old.privateKey) };
+}
+function fixture() {
+    const initial = signed(1, [{ keyVersion: 'original', publicKeyEd25519: oldPublic,
+            status: 'active', notBefore: '2026-09-01T00:00:00.000Z', notAfter: oldExpiry }]);
+    const preload = signed(2, [...initial.keys, { keyVersion: 'successor', publicKeyEd25519: nextPublic,
+            status: 'overlap', notBefore: '2026-09-27T02:00:00.000Z', notAfter: newExpiry }]);
+    const active = signed(3, preload.keys.map(key => ({ ...key,
+        status: key.keyVersion === 'successor' ? 'active' : 'overlap' })), true);
+    const config = { schema: 'dharma.demo-device/v1', hqUrl: 'https://dharma.example',
+        organizationId: 'org_fixture', repositoryId: '10000000-0000-4000-8000-000000000001',
+        normalizedRepository: 'github.com/example/private',
+        installationId: '40000000-0000-4000-8000-000000000001',
+        deviceId: '30000000-0000-4000-8000-000000000001', publicKeyEd25519: 'D'.repeat(43),
+        enrolledAt: '2026-09-27T02:30:00.000Z', signedReady: true, nextSequence: 1,
+        serverPublicKeyEd25519: oldPublic, serverSigningKeyset: initial };
+    const values = new Map();
+    const store = { backend: 'linux-secret-service',
+        async get(account) { return values.get(account) ?? null; },
+        async put(account, value) { values.set(account, value); },
+        async delete(account) { values.delete(account); } };
+    return { initial, preload, active, config, store, values };
+}
+const expiredNow = new Date('2026-09-28T03:00:00.000Z');
+function approval(f) {
+    return { schema: 'dharma.demo-enrollment-approval/v1', organizationId: f.config.organizationId,
+        repositoryId: f.config.repositoryId, participantId: '20000000-0000-4000-8000-000000000001',
+        deviceId: f.config.deviceId, enrollmentId: '50000000-0000-4000-8000-000000000001',
+        publicKeyEd25519: f.config.publicKeyEd25519, approvedAt: expiredNow.toISOString(),
+        expiresAt: new Date(expiredNow.getTime() + 60_000).toISOString() };
+}
+test('browser re-enrollment archives expired trust and repairs an older disk binding on restart', async () => {
+    const f = fixture();
+    await resolveDemoSigningTrust(f.config, { store: f.store, now });
+    const original = [...f.values.values()][0];
+    const renewed = await recoverDemoSigningEnrollment(f.config, { serverPublicKeyEd25519: nextPublic, serverSigningKeyset: f.active }, approval(f), { store: f.store, now: expiredNow });
+    assert.equal(renewed.enrolledAt, f.config.enrolledAt);
+    assert.equal(renewed.nextSequence, f.config.nextSequence);
+    assert.equal(renewed.serverPublicKeyEd25519, nextPublic);
+    assert.ok([...f.values.values()].includes(original));
+    assert.deepEqual(await resolveDemoSigningTrust(f.config, { store: f.store, now: expiredNow }), renewed);
+    assert.doesNotMatch([...f.values.values()].join(''), /grant|privateJwk|privateKey|authorization/i);
+});
+test('re-enrollment of an expired legacy file labels its snapshot without treating it as prior protected authority', async () => {
+    const f = fixture();
+    const renewed = await recoverDemoSigningEnrollment(f.config, { serverPublicKeyEd25519: nextPublic, serverSigningKeyset: f.active }, approval(f), { store: f.store, now: expiredNow });
+    assert.ok([...f.values.values()].some(value => value.includes('"previousWasProtected":false')));
+    assert.deepEqual(await resolveDemoSigningTrust(f.config, { store: f.store, now: expiredNow }), renewed);
+});
+test('re-enrollment requires a fresh scoped approval and rejects credentials, old receipts and malformed candidates', async () => {
+    for (const change of [null, { schema: 'legacy' }, { grant: 'never-persist' },
+        { organizationId: 'org_foreign' }, { repositoryId: '10000000-0000-4000-8000-000000000099' },
+        { deviceId: '30000000-0000-4000-8000-000000000099' }, { publicKeyEd25519: 'E'.repeat(43) },
+        { approvedAt: now.toISOString() }, { approvedAt: new Date(expiredNow.getTime() + 60_000).toISOString() },
+        { expiresAt: expiredNow.toISOString() }, { expiresAt: new Date(expiredNow.getTime() + 16 * 60_000).toISOString() }]) {
+        const f = fixture();
+        await resolveDemoSigningTrust(f.config, { store: f.store, now });
+        const before = [...f.values.entries()];
+        await assert.rejects(recoverDemoSigningEnrollment(f.config, { serverPublicKeyEd25519: nextPublic, serverSigningKeyset: f.active }, change === null ? null : { ...approval(f), ...change }, { store: f.store, now: expiredNow }), /Demo signing/);
+        assert.deepEqual([...f.values.entries()], before);
+    }
+    for (const trust of [{ serverPublicKeyEd25519: oldPublic, serverSigningKeyset: fixture().active },
+        { serverPublicKeyEd25519: nextPublic, serverSigningKeyset: { ...fixture().active, signature: 'invalid' } },
+        { serverPublicKeyEd25519: nextPublic, serverSigningKeyset: { ...fixture().active, generation: 1 } }]) {
+        const f = fixture();
+        await assert.rejects(recoverDemoSigningEnrollment(f.config, trust, approval(f), { store: f.store, now: expiredNow }), /Demo signing/);
+        assert.equal(f.values.size, 0);
+    }
+});
+test('valid protected trust and modified disk bindings cannot be replaced through re-enrollment', async () => {
+    const f = fixture();
+    await resolveDemoSigningTrust(f.config, { store: f.store, now });
+    const before = [...f.values.entries()];
+    await assert.rejects(recoverDemoSigningEnrollment(f.config, { serverPublicKeyEd25519: nextPublic, serverSigningKeyset: f.active }, { ...approval(f), approvedAt: now.toISOString(), expiresAt: new Date(now.getTime() + 60_000).toISOString() }, { store: f.store, now }), /approval_must_follow_trust_expiry/);
+    const altered = { ...f.config, enrolledAt: '2026-09-27T02:31:00Z' };
+    await assert.rejects(recoverDemoSigningEnrollment(altered, { serverPublicKeyEd25519: nextPublic, serverSigningKeyset: f.active }, approval(f), { store: f.store, now: expiredNow }), /binding_mismatch/);
+    assert.deepEqual([...f.values.entries()], before);
+});
+test('recipient approval cannot extend or rewrite a retained expired signing key', async () => {
+    const f = fixture();
+    const { signature: _signature, ...body } = f.active;
+    const altered = { ...body, keys: body.keys.map(key => key.keyVersion === 'original'
+            ? { ...key, notAfter: newExpiry } : key) };
+    await assert.rejects(recoverDemoSigningEnrollment(f.config, { serverPublicKeyEd25519: nextPublic,
+        serverSigningKeyset: { ...altered, signature: signCanonicalObject(altered, next.privateKey) } }, approval(f), { store: f.store, now: expiredNow }), /retained_window_changed/);
+    assert.equal(f.values.size, 0);
+});
+test('interrupted protected replacement resumes from confirmed history without extending old validity', async () => {
+    for (const interruptedAt of ['before', 'after', 'removed']) {
+        const f = fixture();
+        await resolveDemoSigningTrust(f.config, { store: f.store, now });
+        const original = [...f.values.values()][0];
+        const store = { ...f.store, async put(account, value) {
+                if (!account.includes('-history-') && !account.endsWith('-recovery') && !account.includes('-approval-')) {
+                    if (interruptedAt === 'after')
+                        await f.store.put(account, value);
+                    if (interruptedAt === 'removed')
+                        await f.store.delete(account);
+                    throw new Error('interrupted anchor replacement');
+                }
+                await f.store.put(account, value);
+            } };
+        await assert.rejects(recoverDemoSigningEnrollment(f.config, { serverPublicKeyEd25519: nextPublic, serverSigningKeyset: f.active }, approval(f), { store, now: expiredNow }), /interrupted/);
+        assert.ok([...f.values.values()].includes(original));
+        if (interruptedAt === 'after') {
+            const restored = await resolveDemoSigningTrust(f.config, { store: f.store, now: expiredNow });
+            assert.equal(restored.serverPublicKeyEd25519, nextPublic);
+            assert.equal(restored.serverSigningKeyset?.keys[0]?.notAfter, oldExpiry);
+        }
+        else {
+            const restored = await recoverDemoSigningEnrollment(f.config, { serverPublicKeyEd25519: nextPublic, serverSigningKeyset: f.active }, approval(f), { store: f.store, now: expiredNow });
+            assert.equal(restored.serverPublicKeyEd25519, nextPublic);
+        }
+    }
+});
+test('a missing active anchor cannot recover from changed approval, missing history or malformed journal', async () => {
+    for (const fault of ['recipient', 'enrollment', 'expired', 'binding', 'history', 'approval_record', 'null_journal', 'invalid_journal']) {
+        const f = fixture();
+        await resolveDemoSigningTrust(f.config, { store: f.store, now });
+        const [account] = [...f.values.keys()];
+        const store = { ...f.store, async put(key, value) {
+                if (key === account) {
+                    await f.store.delete(key);
+                    throw new Error('interrupted anchor replacement');
+                }
+                await f.store.put(key, value);
+            } };
+        const trust = { serverPublicKeyEd25519: nextPublic, serverSigningKeyset: f.active };
+        await assert.rejects(recoverDemoSigningEnrollment(f.config, trust, approval(f), { store, now: expiredNow }), /interrupted/);
+        if (fault === 'history')
+            f.values.delete([...f.values.keys()].find(key => key.includes('-history-')));
+        if (fault === 'approval_record')
+            f.values.delete([...f.values.keys()].find(key => key.includes('-approval-')));
+        if (fault === 'null_journal')
+            f.values.set(`${account}-recovery`, 'null');
+        if (fault === 'invalid_journal')
+            f.values.set(`${account}-recovery`, '{');
+        const receipt = { ...approval(f), ...(fault === 'recipient'
+                ? { participantId: '20000000-0000-4000-8000-000000000099' }
+                : fault === 'enrollment' ? { enrollmentId: '50000000-0000-4000-8000-000000000099' } : {}) };
+        const before = [...f.values.entries()];
+        await assert.rejects(recoverDemoSigningEnrollment({ ...f.config, ...(fault === 'binding' ? { enrolledAt: '2026-09-27T02:31:00Z' } : {}) }, trust, receipt, { store: f.store, now: fault === 'expired' ? new Date(expiredNow.getTime() + 60_000) : expiredNow }), /Demo signing trust rejected/);
+        assert.deepEqual([...f.values.entries()], before);
+    }
+});
+test('a fresh recipient approval resumes an abandoned missing-anchor write after its earlier approval expires', async () => {
+    const f = fixture();
+    await resolveDemoSigningTrust(f.config, { store: f.store, now });
+    const [account, original] = [...f.values.entries()][0];
+    const trust = { serverPublicKeyEd25519: nextPublic, serverSigningKeyset: f.active };
+    const interrupted = { ...f.store, async put(key, value) {
+            if (key === account) {
+                await f.store.delete(key);
+                throw new Error('interrupted anchor replacement');
+            }
+            await f.store.put(key, value);
+        } };
+    const oldReceipt = approval(f);
+    await assert.rejects(recoverDemoSigningEnrollment(f.config, trust, oldReceipt, { store: interrupted, now: expiredNow }), /interrupted/);
+    const oldJournal = f.values.get(`${account}-recovery`);
+    const afterApprovalExpiry = new Date(Date.parse(oldReceipt.expiresAt) + 1_000);
+    const freshReceipt = { ...oldReceipt, enrollmentId: '50000000-0000-4000-8000-000000000002',
+        approvedAt: afterApprovalExpiry.toISOString(),
+        expiresAt: new Date(afterApprovalExpiry.getTime() + 60_000).toISOString() };
+    const before = [...f.values.entries()];
+    await assert.rejects(recoverDemoSigningEnrollment(f.config, trust, oldReceipt, { store: f.store, now: afterApprovalExpiry }), /approval_scope_or_expiry_invalid/);
+    assert.deepEqual([...f.values.entries()], before);
+    const renewed = await recoverDemoSigningEnrollment(f.config, trust, freshReceipt, { store: f.store, now: afterApprovalExpiry });
+    assert.equal(renewed.deviceId, f.config.deviceId);
+    assert.equal(renewed.enrolledAt, f.config.enrolledAt);
+    assert.equal(renewed.nextSequence, f.config.nextSequence);
+    assert.ok([...f.values.values()].includes(original));
+    assert.equal(f.values.get(`${account}-approval-${oldReceipt.enrollmentId}`), oldJournal);
+    assert.equal(f.values.size, 5, 'fresh receipt adds one immutable record, not another device or duplicate history');
+    assert.deepEqual(await resolveDemoSigningTrust(f.config, { store: f.store, now: afterApprovalExpiry }), renewed);
+});
+test('renewing an interrupted approval preserves recipient scope, expiry, history and generation fencing', async () => {
+    for (const fault of ['still_valid', 'early_approval', 'same_enrollment', 'organization', 'repository',
+        'participant', 'device', 'key', 'missing_approval', 'corrupt_approval', 'missing_history',
+        'corrupt_history', 'lower_generation', 'conflicting_generation']) {
+        const f = fixture();
+        await resolveDemoSigningTrust(f.config, { store: f.store, now });
+        const [account] = [...f.values.keys()];
+        const trust = { serverPublicKeyEd25519: nextPublic, serverSigningKeyset: f.active };
+        const interrupted = { ...f.store, async put(key, value) {
+                if (key === account) {
+                    await f.store.delete(key);
+                    throw new Error('interrupted anchor replacement');
+                }
+                await f.store.put(key, value);
+            } };
+        const oldReceipt = approval(f);
+        await assert.rejects(recoverDemoSigningEnrollment(f.config, trust, oldReceipt, { store: interrupted, now: expiredNow }), /interrupted/);
+        const retryAt = fault === 'still_valid' ? new Date(expiredNow.getTime() + 1_000)
+            : new Date(Date.parse(oldReceipt.expiresAt) + 1_000);
+        const receipt = { ...oldReceipt, enrollmentId: '50000000-0000-4000-8000-000000000002',
+            approvedAt: retryAt.toISOString(), expiresAt: new Date(retryAt.getTime() + 60_000).toISOString() };
+        if (fault === 'early_approval')
+            receipt.approvedAt = oldReceipt.expiresAt;
+        if (fault === 'same_enrollment')
+            receipt.enrollmentId = oldReceipt.enrollmentId;
+        if (fault === 'organization')
+            receipt.organizationId = 'org_foreign';
+        if (fault === 'repository')
+            receipt.repositoryId = '10000000-0000-4000-8000-000000000099';
+        if (fault === 'participant')
+            receipt.participantId = '20000000-0000-4000-8000-000000000099';
+        if (fault === 'device')
+            receipt.deviceId = '30000000-0000-4000-8000-000000000099';
+        if (fault === 'key')
+            receipt.publicKeyEd25519 = 'E'.repeat(43);
+        const oldApprovalAccount = `${account}-approval-${oldReceipt.enrollmentId}`;
+        const historyAccount = [...f.values.keys()].find(key => key.includes('-history-'));
+        if (fault === 'missing_approval')
+            f.values.delete(oldApprovalAccount);
+        if (fault === 'corrupt_approval')
+            f.values.set(oldApprovalAccount, '{}');
+        if (fault === 'missing_history')
+            f.values.delete(historyAccount);
+        if (fault === 'corrupt_history')
+            f.values.set(historyAccount, '{}');
+        const candidate = fault === 'lower_generation' ? signed(2, f.active.keys, true)
+            : fault === 'conflicting_generation' ? signed(3, [...f.active.keys].reverse(), true) : f.active;
+        const before = [...f.values.entries()];
+        await assert.rejects(recoverDemoSigningEnrollment(f.config, { ...trust, serverSigningKeyset: candidate }, receipt, { store: f.store, now: retryAt }), /Demo signing trust rejected/, fault);
+        assert.deepEqual([...f.values.entries()], before, `${fault}: rejection cannot write protected state`);
+    }
+});
+test('fresh approval may recover to a newer generation without reusing the abandoned pending generation', async () => {
+    const f = fixture();
+    await resolveDemoSigningTrust(f.config, { store: f.store, now });
+    const [account] = [...f.values.keys()];
+    const interrupted = { ...f.store, async put(key, value) {
+            if (key === account) {
+                await f.store.delete(key);
+                throw new Error('interrupted anchor replacement');
+            }
+            await f.store.put(key, value);
+        } };
+    const oldReceipt = approval(f);
+    await assert.rejects(recoverDemoSigningEnrollment(f.config, { serverPublicKeyEd25519: nextPublic, serverSigningKeyset: f.active }, oldReceipt, { store: interrupted, now: expiredNow }), /interrupted/);
+    const retryAt = new Date(Date.parse(oldReceipt.expiresAt) + 1_000);
+    const renewed = await recoverDemoSigningEnrollment(f.config, { serverPublicKeyEd25519: nextPublic, serverSigningKeyset: signed(4, f.active.keys, true) }, { ...oldReceipt, enrollmentId: '50000000-0000-4000-8000-000000000002',
+        approvedAt: retryAt.toISOString(), expiresAt: new Date(retryAt.getTime() + 60_000).toISOString() }, { store: f.store, now: retryAt });
+    assert.equal(renewed.serverSigningKeyset?.generation, 4);
+    assert.equal(renewed.nextSequence, f.config.nextSequence);
+    assert.deepEqual(await resolveDemoSigningTrust(f.config, { store: f.store, now: retryAt }), renewed);
+});
+test('every protected recovery write must be confirmed before returning replacement trust', async () => {
+    for (const phase of ['history', 'approval', 'journal', 'anchor']) {
+        const f = fixture();
+        await resolveDemoSigningTrust(f.config, { store: f.store, now });
+        const [account, original] = [...f.values.entries()][0];
+        const store = { ...f.store, async put(key, value) {
+                if ((phase === 'history' && key.includes('-history-'))
+                    || (phase === 'approval' && key.includes('-approval-'))
+                    || (phase === 'journal' && key.endsWith('-recovery'))
+                    || (phase === 'anchor' && key === account))
+                    return;
+                await f.store.put(key, value);
+            } };
+        await assert.rejects(recoverDemoSigningEnrollment(f.config, { serverPublicKeyEd25519: nextPublic, serverSigningKeyset: f.active }, approval(f), { store, now: expiredNow }), /write_not_confirmed/);
+        assert.equal(f.values.get(account), original);
+        await assert.rejects(resolveDemoSigningTrust(f.config, { store: f.store, now: expiredNow }), /expired/);
+    }
+});
+test('a cached secure-store echo cannot substitute for confirmed OS storage', async () => {
+    const f = fixture();
+    const cache = new Map();
+    const store = { ...f.store,
+        async get(account) { return cache.get(account) ?? null; },
+        async getFresh() { return null; },
+        async put(account, value) { cache.set(account, value); } };
+    await assert.rejects(resolveDemoSigningTrust(f.config, { store, now }), /write_not_confirmed/);
+    await assert.rejects(recoverDemoSigningEnrollment(f.config, { serverPublicKeyEd25519: nextPublic, serverSigningKeyset: f.active }, approval(f), { store, now: expiredNow }), /write_not_confirmed/);
+    assert.equal(f.values.size, 0);
+});
+test('accepted approval identities cannot be replayed with edited timestamps or a different recipient', async () => {
+    const f = fixture();
+    await resolveDemoSigningTrust(f.config, { store: f.store, now });
+    const renewed = await recoverDemoSigningEnrollment(f.config, { serverPublicKeyEd25519: nextPublic, serverSigningKeyset: f.active }, approval(f), { store: f.store, now: expiredNow });
+    const afterExpiry = new Date(Date.parse(newExpiry) + 60_000);
+    const fourth = generateKeyPairSync('ed25519');
+    const fourthPin = fourth.publicKey.export({ format: 'jwk' }).x;
+    const body = { schema: 'dharma.server-signing-keyset/v1', organizationId: f.config.organizationId,
+        generation: 4, signedByKeyVersion: 'fourth', issuedAt: afterExpiry.toISOString(),
+        expiresAt: new Date(afterExpiry.getTime() + 86_400_000).toISOString(), keys: [{ keyVersion: 'fourth',
+                publicKeyEd25519: fourthPin, status: 'active', notBefore: afterExpiry.toISOString(),
+                notAfter: new Date(afterExpiry.getTime() + 86_400_000).toISOString() }] };
+    const trust = { serverPublicKeyEd25519: fourthPin,
+        serverSigningKeyset: { ...body, signature: signCanonicalObject(body, fourth.privateKey) } };
+    const before = [...f.values.entries()];
+    for (const change of [{}, { participantId: '20000000-0000-4000-8000-000000000099',
+            enrollmentId: '50000000-0000-4000-8000-000000000099' }]) {
+        await assert.rejects(recoverDemoSigningEnrollment(renewed, trust, { ...approval(f), approvedAt: afterExpiry.toISOString(),
+            expiresAt: new Date(afterExpiry.getTime() + 60_000).toISOString(), ...change }, { store: f.store, now: afterExpiry }), /approval_replayed_or_conflicting/);
+        assert.deepEqual([...f.values.entries()], before);
+    }
+});
+test('Demo trust survives restart and original-key expiry only after a protected successor transition', async () => {
+    const f = fixture();
+    const updated = await acceptDemoSigningKeysets(f.config, [f.preload, f.active], { store: f.store, now });
+    assert.equal(updated.serverSigningKeyset?.generation, 3);
+    assert.equal(updated.serverPublicKeyEd25519, oldPublic);
+    assert.equal(updated.serverSigningKeyset?.keys[0]?.notAfter, oldExpiry);
+    const afterOriginalExpiry = new Date('2026-09-28T03:00:00.000Z');
+    const restarted = await resolveDemoSigningTrust(updated, { store: f.store, now: afterOriginalExpiry });
+    assert.deepEqual(restarted, updated);
+    // Protected write-ahead storage recovers an interrupted disk replacement.
+    const recovered = await resolveDemoSigningTrust(f.config, { store: f.store, now: afterOriginalExpiry });
+    assert.equal(recovered.serverSigningKeyset?.generation, 3);
+});
+test('Demo trust rejects unknown signers, generation skips, changed old windows and revoked keys', async () => {
+    for (const attack of ['unknown', 'skip', 'extend', 'shorten', 'remove', 'activate_without_preload']) {
+        const f = fixture();
+        let candidate = f.preload;
+        if (attack === 'unknown')
+            candidate = signed(2, f.active.keys, true);
+        if (attack === 'skip')
+            candidate = signed(4, f.preload.keys);
+        if (attack === 'extend')
+            candidate = signed(2, f.preload.keys.map(k => ({ ...k, notAfter: newExpiry })));
+        if (attack === 'shorten')
+            candidate = signed(2, f.preload.keys.map(k => ({ ...k,
+                notAfter: k.keyVersion === 'original' ? '2026-09-27T22:00:00.000Z' : k.notAfter })));
+        if (attack === 'remove')
+            candidate = signed(2, f.preload.keys.slice(1), true);
+        if (attack === 'activate_without_preload')
+            candidate = signed(2, f.active.keys);
+        await assert.rejects(acceptDemoSigningKeysets(f.config, [candidate], { store: f.store, now }), /Demo signing/);
+        assert.equal((await resolveDemoSigningTrust(f.config, { store: f.store, now })).serverSigningKeyset?.generation, 1);
+    }
+});
+test('Demo trust distinguishes identical delivery from replayed or conflicting generations', async () => {
+    const f = fixture();
+    const updated = await acceptDemoSigningKeysets(f.config, [f.preload], { store: f.store, now });
+    assert.deepEqual(await acceptDemoSigningKeysets(updated, [f.preload], { store: f.store, now }), updated);
+    await assert.rejects(acceptDemoSigningKeysets(updated, [f.initial], { store: f.store, now }), /Demo signing/);
+    const conflict = signed(2, [...f.preload.keys].reverse());
+    await assert.rejects(acceptDemoSigningKeysets(updated, [conflict], { store: f.store, now }), /Demo signing/);
+    await assert.rejects(resolveDemoSigningTrust({ ...updated, serverSigningKeyset: conflict }, { store: f.store, now }), /Demo signing/);
+});
+test('Demo trust rejects expired anchors instead of manufacturing a renewal or fresh pin', async () => {
+    const f = fixture();
+    await resolveDemoSigningTrust(f.config, { store: f.store, now });
+    const expired = new Date('2026-09-28T03:00:00.000Z');
+    await assert.rejects(acceptDemoSigningKeysets(f.config, [f.preload, f.active], { store: f.store, now: expired }), /Demo signing.*browser/i);
+    const empty = fixture();
+    await assert.rejects(resolveDemoSigningTrust(empty.config, { store: empty.store, now: expired }), /Demo signing/);
+    assert.equal(empty.values.size, 0);
+});
+test('Demo trust binds protected state to the approved identity, repository and original pin', async () => {
+    const f = fixture();
+    await resolveDemoSigningTrust(f.config, { store: f.store, now });
+    await assert.rejects(resolveDemoSigningTrust({ ...f.config, serverPublicKeyEd25519: nextPublic }, { store: f.store, now }), /Demo signing/);
+    await assert.rejects(resolveDemoSigningTrust({ ...f.config, publicKeyEd25519: 'E'.repeat(43) }, { store: f.store, now }), /Demo signing/);
+    await assert.rejects(acceptDemoSigningKeysets(f.config, [{ ...f.preload, organizationId: 'org_foreign' }], { store: f.store, now }), /Demo signing/);
+    await assert.rejects(acceptDemoSigningKeysets(f.config, new Array(21).fill(f.preload), { store: f.store, now }), /Demo signing/);
+    const serialized = [...f.values.values()].join('');
+    assert.doesNotMatch(serialized, /grant|privateJwk|privateKey|authorization/i);
+});
+test('Demo trust does not acknowledge a secure-store write that was not durably confirmed', async () => {
+    const f = fixture();
+    const store = { ...f.store, async put() { } };
+    await assert.rejects(resolveDemoSigningTrust(f.config, { store, now }), /confirm/i);
+});
+test('Demo signing update enforces its runtime schema, recipient scope and bounded response lifetime', async () => {
+    const f = fixture();
+    const value = { schema: 'dharma.demo-signing-update/v1', organizationId: f.config.organizationId,
+        repositoryId: f.config.repositoryId, deviceId: f.config.deviceId, issuedAt: now.toISOString(),
+        expiresAt: new Date(now.getTime() + 60_000).toISOString(), keysets: [f.preload, f.active] };
+    for (const override of [{ schema: 'legacy' }, { grant: 'must-not-persist' },
+        { organizationId: 'org_foreign' }, { repositoryId: '10000000-0000-4000-8000-000000000099' },
+        { deviceId: '30000000-0000-4000-8000-000000000099' }, { expiresAt: now.toISOString() },
+        { issuedAt: new Date(now.getTime() + 60_000).toISOString() },
+        { expiresAt: new Date(now.getTime() + 6 * 60_000).toISOString() },
+        { keysets: [] }, { keysets: [null] }, { keysets: new Array(21).fill(f.preload) }]) {
+        await assert.rejects(acceptDemoSigningUpdate(f.config, { ...value, ...override }, { store: f.store, now }), /Demo signing/);
+    }
+    assert.equal(f.values.size, 0);
+    const updated = await acceptDemoSigningUpdate(f.config, value, { store: f.store, now });
+    assert.equal(updated.serverSigningKeyset?.generation, 3);
+});
+test('invalid late chain element cannot partially install an otherwise valid preload', async () => {
+    const f = fixture();
+    await assert.rejects(acceptDemoSigningKeysets(f.config, [f.preload, { ...f.active, signature: 'corrupt' }], { store: f.store, now }), /Demo signing/);
+    const anchor = await resolveDemoSigningTrust(f.config, { store: f.store, now });
+    assert.equal(anchor.serverSigningKeyset?.generation, 1);
+});
+test('Demo preload rejects a successor that is not yet valid or has no transition safety window', async () => {
+    for (const change of [{ notBefore: '2026-09-27T04:00:00.000Z' },
+        { notAfter: '2026-09-27T03:05:00.000Z' }]) {
+        const f = fixture();
+        const candidate = signed(2, f.preload.keys.map(k => k.keyVersion === 'successor' ? { ...k, ...change } : k));
+        await assert.rejects(acceptDemoSigningKeysets(f.config, [candidate], { store: f.store, now }), /Demo signing/);
+    }
+});
+test('an active generation cannot reactivate a retained old key without a new preload', async () => {
+    const f = fixture();
+    const active = await acceptDemoSigningKeysets(f.config, [f.preload, f.active], { store: f.store, now });
+    const rollback = signed(4, f.preload.keys.map(k => ({ ...k,
+        status: k.keyVersion === 'original' ? 'active' : 'overlap' })));
+    await assert.rejects(acceptDemoSigningKeysets(active, [rollback], { store: f.store, now }), /Demo signing/);
+});
+test('a pending preload cannot be replaced by another preload', async () => {
+    const f = fixture();
+    const current = await acceptDemoSigningKeysets(f.config, [f.preload], { store: f.store, now });
+    const third = generateKeyPairSync('ed25519');
+    const repeated = signed(3, [...f.preload.keys, { ...f.preload.keys[1], keyVersion: 'third',
+            publicKeyEd25519: third.publicKey.export({ format: 'jwk' }).x }]);
+    await assert.rejects(acceptDemoSigningKeysets(current, [repeated], { store: f.store, now }), /Demo signing/);
+});
+test('a restarted client activates only the successor recorded in protected preload state', async () => {
+    const f = fixture();
+    await acceptDemoSigningKeysets(f.config, [f.preload], { store: f.store, now });
+    const restarted = await resolveDemoSigningTrust(f.config, { store: f.store, now });
+    const activated = await acceptDemoSigningKeysets(restarted, [f.active], { store: f.store, now });
+    assert.equal(activated.serverSigningKeyset?.generation, 3);
+    const third = generateKeyPairSync('ed25519');
+    const body = { ...f.active, generation: 4, keys: [...f.active.keys, { ...f.preload.keys[1],
+                keyVersion: 'third', publicKeyEd25519: third.publicKey.export({ format: 'jwk' }).x }] };
+    const { signature: _signature, ...unsigned } = body;
+    const preload = { ...unsigned, signature: signCanonicalObject(unsigned, next.privateKey) };
+    const pending = await acceptDemoSigningKeysets(activated, [preload], { store: f.store, now });
+    const wrong = signed(5, preload.keys.map(k => ({ ...k,
+        status: k.keyVersion === 'original' ? 'active' : 'overlap' })));
+    await assert.rejects(acceptDemoSigningKeysets(pending, [wrong], { store: f.store, now }), /Demo signing/);
+});
+//# sourceMappingURL=demoSigningTrust.test.js.map

package/dist/demoSigningTrust.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"demoSigningTrust.test.js","sourceRoot":"","sources":["../src/demoSigningTrust.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAmC,MAAM,wCAAwC,CAAC;AAE9G,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,4BAA4B,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAEjJ,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,0BAA0B,CAAC,CAAC;AACjD,MAAM,GAAG,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;AAC3C,MAAM,IAAI,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;AAC5C,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAE,CAAC;AAC7D,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAE,CAAC;AAC/D,MAAM,SAAS,GAAG,0BAA0B,CAAC;AAC7C,MAAM,SAAS,GAAG,0BAA0B,CAAC;AAC7C,SAAS,MAAM,CAAC,UAAkB,EAAE,IAAwC,EAAE,SAAS,GAAG,KAAK;IAC7F,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,iCAA0C,EAAE,cAAc,EAAE,aAAa;QAC9F,UAAU,EAAE,IAAI,EAAE,kBAAkB,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU;QAC1E,QAAQ,EAAE,0BAA0B,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IACvF,OAAO,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,mBAAmB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AACzG,CAAC;AACD,SAAS,OAAO;IACd,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,SAAS;YAC9E,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,0BAA0B,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACnF,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,UAAU;YACjG,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,0BAA0B,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACpF,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG;QACxD,MAAM,EAAE,GAAG,CAAC,UAAU,KAAK,WAAW,CAAC,CAAC,CAAC,QAAiB,CAAC,CAAC,CAAC,SAAkB,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC7F,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,uBAAgC,EAAE,KAAK,EAAE,wBAAwB;QACxF,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,sCAAsC;QACnF,oBAAoB,EAAE,4BAA4B;QAClD,cAAc,EAAE,sCAAsC;QACtD,QAAQ,EAAE,sCAAsC,EAAE,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAClF,UAAU,EAAE,0BAA0B,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QAC1E,sBAAsB,EAAE,SAAS,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC;IACpE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,KAAK,GAAsB,EAAE,OAAO,EAAE,sBAAsB;QAChE,KAAK,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;QAC1D,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QACzD,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,0BAA0B,CAAC,CAAC;AACxD,SAAS,QAAQ,CAAC,CAA6B;IAC7C,OAAO,EAAE,MAAM,EAAE,oCAAoC,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc;QAC5F,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,aAAa,EAAE,sCAAsC;QAC1F,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,sCAAsC;QACjF,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,gBAAgB,EAAE,UAAU,EAAE,UAAU,CAAC,WAAW,EAAE;QACjF,SAAS,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;AACvE,CAAC;AAED,IAAI,CAAC,2FAA2F,EAAE,KAAK,IAAI,EAAE;IAC3G,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;IACpB,MAAM,uBAAuB,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,CAAC,CAAC,MAAM,EACzD,EAAE,sBAAsB,EAAE,UAAU,EAAE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;IAC3H,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,sBAAsB,EAAE,UAAU,CAAC,CAAC;IACzD,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrD,MAAM,CAAC,SAAS,CAAC,MAAM,uBAAuB,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IACxG,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,4CAA4C,CAAC,CAAC;AACrG,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,8GAA8G,EAAE,KAAK,IAAI,EAAE;IAC9H,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;IACpB,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,CAAC,CAAC,MAAM,EACzD,EAAE,sBAAsB,EAAE,UAAU,EAAE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;IAC3H,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,8BAA8B,CAAC,CAAC,CAAC,CAAC;IAChG,MAAM,CAAC,SAAS,CAAC,MAAM,uBAAuB,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;AAC1G,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,+GAA+G,EAAE,KAAK,IAAI,EAAE;IAC/H,KAAK,MAAM,MAAM,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE;QAC1E,EAAE,cAAc,EAAE,aAAa,EAAE,EAAE,EAAE,YAAY,EAAE,sCAAsC,EAAE;QAC3F,EAAE,QAAQ,EAAE,sCAAsC,EAAE,EAAE,EAAE,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;QAC1F,EAAE,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE;QACxG,EAAE,SAAS,EAAE,UAAU,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC;QACtH,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;QACpB,MAAM,uBAAuB,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QACvC,MAAM,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,CAAC,MAAM,EACxD,EAAE,sBAAsB,EAAE,UAAU,EAAE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,EACrE,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC;QAChH,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,CAAC,EAAE,sBAAsB,EAAE,SAAS,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE;QAC/F,EAAE,sBAAsB,EAAE,UAAU,EAAE,mBAAmB,EAAE,EAAE,GAAG,OAAO,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE;QAC1G,EAAE,sBAAsB,EAAE,UAAU,EAAE,mBAAmB,EAAE,EAAE,GAAG,OAAO,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QACvG,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC;QACtI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACjC,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2FAA2F,EAAE,KAAK,IAAI,EAAE;IAC3G,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;IACpB,MAAM,uBAAuB,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACvC,MAAM,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,CAAC,MAAM,EACxD,EAAE,sBAAsB,EAAE,UAAU,EAAE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,EACrE,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,EAC5G,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,mCAAmC,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,sBAAsB,EAAE,CAAC;IACpE,MAAM,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAAC,OAAO,EACvD,EAAE,sBAAsB,EAAE,UAAU,EAAE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAChJ,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;AACpD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;IAC5F,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;IACpB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,MAAM,OAAO,GAAG,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,KAAK,UAAU;YACjF,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,CAAC,MAAM,EACxD,EAAE,sBAAsB,EAAE,UAAU;QAClC,mBAAmB,EAAE,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,EACjG,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,yBAAyB,CAAC,CAAC;IAChF,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AACjC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iGAAiG,EAAE,KAAK,IAAI,EAAE;IACjH,KAAK,MAAM,aAAa,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;QAC3D,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;QACpB,MAAM,uBAAuB,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC;QAC5C,MAAM,KAAK,GAAsB,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK;gBACrE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;oBACxG,IAAI,aAAa,KAAK,OAAO;wBAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;oBACjE,IAAI,aAAa,KAAK,SAAS;wBAAE,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;oBAC/D,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;gBACpD,CAAC;gBACD,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC,EAAE,CAAC;QACJ,MAAM,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,CAAC,MAAM,EACxD,EAAE,sBAAsB,EAAE,UAAU,EAAE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC;QAClI,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrD,IAAI,aAAa,KAAK,OAAO,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;YAC9F,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,sBAAsB,EAAE,UAAU,CAAC,CAAC;YAC1D,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC3E,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,CAAC,CAAC,MAAM,EAC1D,EAAE,sBAAsB,EAAE,UAAU,EAAE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3H,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,sBAAsB,EAAE,UAAU,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,oGAAoG,EAAE,KAAK,IAAI,EAAE;IACpH,KAAK,MAAM,KAAK,IAAI,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,iBAAiB,EAAE,cAAc,EAAE,iBAAiB,CAAC,EAAE,CAAC;QACvI,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;QACpB,MAAM,uBAAuB,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACjE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACvC,MAAM,KAAK,GAAsB,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK;gBACjE,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;oBACpB,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC1B,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;gBACpD,CAAC;gBACD,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAChC,CAAC,EAAE,CAAC;QACJ,MAAM,KAAK,GAAG,EAAE,sBAAsB,EAAE,UAAU,EAAE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QACpF,MAAM,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC;QAC5H,IAAI,KAAK,KAAK,SAAS;YAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAE,CAAC,CAAC;QACvG,IAAI,KAAK,KAAK,iBAAiB;YAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAE,CAAC,CAAC;QAChH,IAAI,KAAK,KAAK,cAAc;YAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,WAAW,EAAE,MAAM,CAAC,CAAC;QAC1E,IAAI,KAAK,KAAK,iBAAiB;YAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,WAAW,EAAE,GAAG,CAAC,CAAC;QAC1E,MAAM,OAAO,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,KAAK,WAAW;gBACzD,CAAC,CAAC,EAAE,aAAa,EAAE,sCAAsC,EAAE;gBAC3D,CAAC,CAAC,KAAK,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,sCAAsC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC9F,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QACvC,MAAM,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAC/C,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EACvG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,EAAE,6BAA6B,CAAC,CAAC;QACvI,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yGAAyG,EAAE,KAAK,IAAI,EAAE;IACzH,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;IACpB,MAAM,uBAAuB,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACjE,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC;IACxD,MAAM,KAAK,GAAG,EAAE,sBAAsB,EAAE,UAAU,EAAE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACpF,MAAM,WAAW,GAAsB,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK;YACvE,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;gBACpB,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YACD,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAChC,CAAC,EAAE,CAAC;IACJ,MAAM,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,EAC3E,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,WAAW,CAAE,CAAC;IACxD,MAAM,mBAAmB,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,CAAC;IAC/E,MAAM,YAAY,GAAG,EAAE,GAAG,UAAU,EAAE,YAAY,EAAE,sCAAsC;QACxF,UAAU,EAAE,mBAAmB,CAAC,WAAW,EAAE;QAC7C,SAAS,EAAE,IAAI,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;IAC9E,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACvC,MAAM,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,EAC3E,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,mBAAmB,EAAE,CAAC,EAAE,kCAAkC,CAAC,CAAC;IACrF,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,EAC9E,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAChD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,aAAa,UAAU,CAAC,YAAY,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;IACzF,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,kFAAkF,CAAC,CAAC;IACnH,MAAM,CAAC,SAAS,CAAC,MAAM,uBAAuB,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,mBAAmB,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;AACnH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,oGAAoG,EAAE,KAAK,IAAI,EAAE;IACpH,KAAK,MAAM,KAAK,IAAI,CAAC,aAAa,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,cAAc,EAAE,YAAY;QACnG,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,iBAAiB;QACzF,iBAAiB,EAAE,kBAAkB,EAAE,wBAAwB,CAAC,EAAE,CAAC;QACnE,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;QACpB,MAAM,uBAAuB,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACjE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,EAAE,sBAAsB,EAAE,UAAU,EAAE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QACpF,MAAM,WAAW,GAAsB,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK;gBACvE,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;oBACpB,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC1B,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;gBACpD,CAAC;gBACD,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAChC,CAAC,EAAE,CAAC;QACJ,MAAM,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,EAC3E,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC;YAC9E,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,EAAE,GAAG,UAAU,EAAE,YAAY,EAAE,sCAAsC;YACnF,UAAU,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACrG,IAAI,KAAK,KAAK,gBAAgB;YAAE,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC;QAC1E,IAAI,KAAK,KAAK,iBAAiB;YAAE,OAAO,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAChF,IAAI,KAAK,KAAK,cAAc;YAAE,OAAO,CAAC,cAAc,GAAG,aAAa,CAAC;QACrE,IAAI,KAAK,KAAK,YAAY;YAAE,OAAO,CAAC,YAAY,GAAG,sCAAsC,CAAC;QAC1F,IAAI,KAAK,KAAK,aAAa;YAAE,OAAO,CAAC,aAAa,GAAG,sCAAsC,CAAC;QAC5F,IAAI,KAAK,KAAK,QAAQ;YAAE,OAAO,CAAC,QAAQ,GAAG,sCAAsC,CAAC;QAClF,IAAI,KAAK,KAAK,KAAK;YAAE,OAAO,CAAC,gBAAgB,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/D,MAAM,kBAAkB,GAAG,GAAG,OAAO,aAAa,UAAU,CAAC,YAAY,EAAE,CAAC;QAC5E,MAAM,cAAc,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAE,CAAC;QACpF,IAAI,KAAK,KAAK,kBAAkB;YAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACtE,IAAI,KAAK,KAAK,kBAAkB;YAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC;QACzE,IAAI,KAAK,KAAK,iBAAiB;YAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACjE,IAAI,KAAK,KAAK,iBAAiB;YAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;QACpE,MAAM,SAAS,GAAG,KAAK,KAAK,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC;YAC7E,CAAC,CAAC,KAAK,KAAK,wBAAwB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAClG,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QACvC,MAAM,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,CAAC,MAAM,EACxD,EAAE,GAAG,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAC1F,6BAA6B,EAAE,KAAK,CAAC,CAAC;QACtC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,KAAK,0CAA0C,CAAC,CAAC;IACxG,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,mGAAmG,EAAE,KAAK,IAAI,EAAE;IACnH,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;IACpB,MAAM,uBAAuB,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACjE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACvC,MAAM,WAAW,GAAsB,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK;YACvE,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;gBACpB,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YACD,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAChC,CAAC,EAAE,CAAC;IACJ,MAAM,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,CAAC,MAAM,EACxD,EAAE,sBAAsB,EAAE,UAAU,EAAE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,EACjF,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,CAAC,CAAC,MAAM,EACzD,EAAE,sBAAsB,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAC3F,EAAE,GAAG,UAAU,EAAE,YAAY,EAAE,sCAAsC;QACnE,UAAU,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,EACpG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IACpC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IACzD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,CAAC,SAAS,CAAC,MAAM,uBAAuB,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;AACvG,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;IACrG,KAAK,MAAM,KAAK,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;QACjE,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;QACpB,MAAM,uBAAuB,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACjE,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC;QACxD,MAAM,KAAK,GAAsB,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK;gBACjE,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;uBACjD,CAAC,KAAK,KAAK,UAAU,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;uBACpD,CAAC,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;uBAClD,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,KAAK,OAAO,CAAC;oBAAE,OAAO;gBACrD,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAChC,CAAC,EAAE,CAAC;QACJ,MAAM,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,CAAC,MAAM,EACxD,EAAE,sBAAsB,EAAE,UAAU,EAAE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,qBAAqB,CAAC,CAAC;QAC1I,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC9C,MAAM,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;IAC1G,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;IACvF,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;IACpB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,MAAM,KAAK,GAAsB,EAAE,GAAG,CAAC,CAAC,KAAK;QAC3C,KAAK,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;QACzD,KAAK,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC;QACjC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,MAAM,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAC/F,MAAM,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,CAAC,MAAM,EACxD,EAAE,sBAAsB,EAAE,UAAU,EAAE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAC1I,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AACjC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iGAAiG,EAAE,KAAK,IAAI,EAAE;IACjH,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;IACpB,MAAM,uBAAuB,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAAC,CAAC,CAAC,MAAM,EACzD,EAAE,sBAAsB,EAAE,UAAU,EAAE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;IAC3H,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAE,CAAC;IAChE,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,iCAA0C,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc;QACxG,UAAU,EAAE,CAAC,EAAE,kBAAkB,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,CAAC,WAAW,EAAE;QAChF,SAAS,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,QAAQ;gBAClG,gBAAgB,EAAE,SAAS,EAAE,MAAM,EAAE,QAAiB,EAAE,SAAS,EAAE,WAAW,CAAC,WAAW,EAAE;gBAC5F,QAAQ,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC;IAC9E,MAAM,KAAK,GAAG,EAAE,sBAAsB,EAAE,SAAS;QAC/C,mBAAmB,EAAE,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;IAC9F,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACvC,KAAK,MAAM,MAAM,IAAI,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,sCAAsC;YAC/E,YAAY,EAAE,sCAAsC,EAAE,CAAC,EAAE,CAAC;QAC1D,MAAM,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAAC,OAAO,EAAE,KAAK,EAC9D,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,WAAW,CAAC,WAAW,EAAE;YACrD,SAAS,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,GAAG,MAAM,EAAE,EAChF,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,EAAE,kCAAkC,CAAC,CAAC;QAC7E,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iGAAiG,EAAE,KAAK,IAAI,EAAE;IACjH,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;IACpB,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACzG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IACzD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,sBAAsB,EAAE,SAAS,CAAC,CAAC;IACxD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IACxE,MAAM,mBAAmB,GAAG,IAAI,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACvG,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACrC,0EAA0E;IAC1E,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACxG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,mBAAmB,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;AAC7D,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,4FAA4F,EAAE,KAAK,IAAI,EAAE;IAC5G,KAAK,MAAM,MAAM,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,0BAA0B,CAAC,EAAE,CAAC;QACpG,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;QACpB,IAAI,SAAS,GAAG,CAAC,CAAC,OAAO,CAAC;QAC1B,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACrE,IAAI,MAAM,KAAK,MAAM;YAAE,SAAS,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7D,IAAI,MAAM,KAAK,QAAQ;YAAE,SAAS,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;QACzG,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC;gBAC7E,QAAQ,EAAE,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;QACvF,IAAI,MAAM,KAAK,QAAQ;YAAE,SAAS,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC9E,IAAI,MAAM,KAAK,0BAA0B;YAAE,SAAS,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAChF,MAAM,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC;QAC/G,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,uBAAuB,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,mBAAmB,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IACtH,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;IACtG,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;IACpB,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/F,MAAM,CAAC,SAAS,CAAC,MAAM,wBAAwB,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IACzG,MAAM,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC;IAC9G,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1D,MAAM,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC;IAC7G,MAAM,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,EAAE,GAAG,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,EACxF,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC;AAC9C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,oFAAoF,EAAE,KAAK,IAAI,EAAE;IACpG,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;IACpB,MAAM,uBAAuB,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACrD,MAAM,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAC3E,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,wBAAwB,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC;IACxB,MAAM,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC;IAClH,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AACrC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wFAAwF,EAAE,KAAK,IAAI,EAAE;IACxG,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;IACpB,MAAM,uBAAuB,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACjE,MAAM,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,sBAAsB,EAAE,UAAU,EAAE,EAC9F,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC;IAC5C,MAAM,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAC5F,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC;IAC5C,MAAM,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC,CAAC,MAAM,EACpD,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC;IAC/F,MAAM,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EACnF,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnD,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,4CAA4C,CAAC,CAAC;AAChF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;IACrG,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;IACpB,MAAM,KAAK,GAAsB,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,KAAI,CAAC,EAAE,CAAC;IAChE,MAAM,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;AACtF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gGAAgG,EAAE,KAAK,IAAI,EAAE;IAChH,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;IACpB,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,+BAA+B,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc;QAC9F,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,WAAW,EAAE;QAC7F,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;IAC9F,KAAK,MAAM,QAAQ,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE;QACzE,EAAE,cAAc,EAAE,aAAa,EAAE,EAAE,EAAE,YAAY,EAAE,sCAAsC,EAAE;QAC3F,EAAE,QAAQ,EAAE,sCAAsC,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE;QACtF,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE;QAC5D,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE;QACjE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;QACpF,MAAM,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,KAAK,EAAE,GAAG,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC;IAC9H,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACxF,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;IAChG,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;IACpB,MAAM,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,EACxG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAChF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,mBAAmB,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;AAC1D,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2FAA2F,EAAE,KAAK,IAAI,EAAE;IAC3G,KAAK,MAAM,MAAM,IAAI,CAAC,EAAE,SAAS,EAAE,0BAA0B,EAAE;QAC7D,EAAE,QAAQ,EAAE,0BAA0B,EAAE,CAAC,EAAE,CAAC;QAC5C,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;QACpB,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7G,MAAM,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC;IACjH,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;IACjG,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACxG,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC;QACxD,MAAM,EAAE,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,QAAiB,CAAC,CAAC,CAAC,SAAkB,EAAE,CAAC,CAAC,CAAC,CAAC;IACpF,MAAM,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC;AAC9G,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;IACzE,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;IACpB,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/F,MAAM,KAAK,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAE,EAAE,UAAU,EAAE,OAAO;YACzF,gBAAgB,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC;IACrE,MAAM,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC;AAC/G,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;IACrG,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;IACpB,MAAM,wBAAwB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/E,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACnF,MAAM,SAAS,GAAG,MAAM,wBAAwB,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACjG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,mBAAmB,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAE;gBACzF,UAAU,EAAE,OAAO,EAAE,gBAAgB,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAE,EAAE,CAAC,EAAE,CAAC;IAC3F,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,QAAQ,EAAE,GAAG,IAAI,CAAC;IACpD,MAAM,OAAO,GAAG,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;IAC3F,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9F,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC;QACnD,MAAM,EAAE,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,QAAiB,CAAC,CAAC,CAAC,SAAkB,EAAE,CAAC,CAAC,CAAC,CAAC;IACpF,MAAM,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC;AAC5G,CAAC,CAAC,CAAC"}

package/dist/demoSigningUpgradeProof.d.ts

@@ -0,0 +1,52 @@
+import { type SecureSecretStore } from '@dharma-ai-labs/agent-fabric-relay-client';
+import { type DemoDeviceScope } from './demoEnrollment.js';
+type Consumer = {
+    name: string;
+    version: string;
+};
+interface UpgradeContext {
+    schema: 'dharma.signing-upgrade-context/v1';
+    organizationId: string;
+    repositoryId: string;
+    globalEpoch: string;
+    predecessorHash: string;
+    candidateHash: string;
+    installedKeysetHash: string;
+    baselineConsumers: Consumer[];
+    requiredConsumers: Consumer[];
+    requiredClientIds: string[];
+    expiresAt: string;
+}
+type Common = Pick<UpgradeContext, 'organizationId' | 'globalEpoch' | 'predecessorHash' | 'candidateHash' | 'expiresAt'> & {
+    principalId: string;
+    observedAt: string;
+    signature: string;
+    sourceHash: string;
+};
+type Source = Common & ({
+    schema: 'dharma.signing-client-upgrade-proof/v1';
+    cliVersion: string;
+    contractVersion: string;
+    installedKeysetHash: string;
+} | {
+    schema: 'dharma.signing-consumer-approval/v1';
+    baselineConsumers: Consumer[];
+    requiredConsumers: Consumer[];
+    requiredClientIds: string[];
+});
+export declare function readDemoSigningUpgradeContext(path: string): Promise<unknown>;
+export declare function prepareDemoSigningUpgradeProof(input: DemoDeviceScope, value: unknown, kind: 'client' | 'owner', deps?: {
+    store?: SecureSecretStore;
+    now?: Date;
+}): Promise<{
+    ok: boolean;
+    stage: "proof_prepared";
+    organizationId: string;
+    repositoryId: string;
+    deviceId: string;
+    submitted: false;
+    browserApprovalRequired: boolean;
+    proof: Source;
+}>;
+export {};
+//# sourceMappingURL=demoSigningUpgradeProof.d.ts.map

package/dist/demoSigningUpgradeProof.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"demoSigningUpgradeProof.d.ts","sourceRoot":"","sources":["../src/demoSigningUpgradeProof.ts"],"names":[],"mappings":"AAMA,OAAO,EAA8C,KAAK,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAE/H,OAAO,EAAmC,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE5F,KAAK,QAAQ,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAClD,UAAU,cAAc;IACtB,MAAM,EAAE,mCAAmC,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAC1F,WAAW,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAC;IACjG,iBAAiB,EAAE,QAAQ,EAAE,CAAC;IAAC,iBAAiB,EAAE,QAAQ,EAAE,CAAC;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;CAC9G;AACD,KAAK,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,gBAAgB,GAAG,aAAa,GAAG,iBAAiB,GAAG,eAAe,GAAG,WAAW,CAAC,GAAG;IACzH,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;CAChF,CAAC;AACF,KAAK,MAAM,GAAG,MAAM,GAAG,CACrB;IAAE,MAAM,EAAE,wCAAwC,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAA;CAAE,GAC5H;IAAE,MAAM,EAAE,qCAAqC,CAAC;IAAC,iBAAiB,EAAE,QAAQ,EAAE,CAAC;IAAC,iBAAiB,EAAE,QAAQ,EAAE,CAAC;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC;AAmClJ,wBAAsB,6BAA6B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAclF;AAID,wBAAsB,8BAA8B,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,EACzF,IAAI,EAAE,QAAQ,GAAG,OAAO,EAAE,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CAAO;;;;;;;;;GA0D/E"}