@dharma-ai-labs/agent-fabric 0.2.177 → 0.2.179

package/dist/resumeLoginCaller.test.js

@@ -0,0 +1,461 @@
+import assert from 'node:assert/strict';
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { runInNewContext } from 'node:vm';
+import test from 'node:test';
+import ts from 'typescript';
+import { canonicalize } from '@dharma-ai-labs/agent-fabric-contracts';
+import { generateKeyPairSync, sign, randomUUID } from 'node:crypto';
+import { verifyServerAuthorizedPolicy } from '@dharma-ai-labs/agent-fabric-policy';
+import { AgentFabricClient, parseDeviceConfig, readDeviceConnectionPreference, saveDeviceConnectionPreference, loadOrCreateDeviceIdentity, saveDeviceEnrollmentAnchor, installTrustedServerSigningKeyset } from '@dharma-ai-labs/agent-fabric-relay-client';
+import { isIsolatedDeviceSession, runInIsolatedDeviceSession } from './connectionSessionScope.js';
+import { assertConnectionScope, assertInstallationContinuity, assertUnenrolledHome, assertReauthenticationSigningTrust, connectionPreference, resumeDeviceConnection } from './deviceConnection.js';
+import { automaticBootstrapResume } from './deviceConnection.js';
+import { bootstrapGrantMode } from './privateGrantInput.js';
+import { selectDeviceWorkspace, workspaceIdForDevice } from './onboardingWorkspace.js';
+// Execute the actual CLI caller. Only browser, network and OS-keychain effects
+// are replaced; configuration reads/writes use real isolated filesystem state.
+async function caller(name, deps, file = 'index.ts') {
+    const source = await readFile(new URL(`../src/${file}`, import.meta.url), 'utf8');
+    const ast = ts.createSourceFile('index.ts', source, ts.ScriptTarget.Latest, true);
+    const declaration = ast.statements.find(n => ts.isFunctionDeclaration(n) && n.name?.text === name);
+    assert.ok(declaration);
+    const compiled = ts.transpileModule(declaration.getText(ast).replace(/^export\s+/, ''), {
+        compilerOptions: { target: ts.ScriptTarget.ES2023, module: ts.ModuleKind.None }, reportDiagnostics: true,
+    });
+    assert.equal(compiled.diagnostics?.filter(d => d.category === ts.DiagnosticCategory.Error).length, 0);
+    return runInNewContext(`${compiled.outputText}\n${name}`, deps, { timeout: 1000 });
+}
+async function fixture(t) {
+    const home = await mkdtemp(join(tmpdir(), 'dharma-resume-login-'));
+    t.after(() => rm(home, { recursive: true, force: true }));
+    const configPath = join(home, 'device.json');
+    const config = { schema: 'dharma.device-config/v1', hqUrl: 'https://hq.example',
+        organizationId: 'org_fixture', deviceId: '22222222-2222-4222-8222-222222222222', installationId: '11111111-1111-4111-8111-111111111111',
+        deviceName: 'synthetic device', platform: 'linux', publicKeyEd25519: 'A'.repeat(43),
+        serverPublicKeyEd25519: 'B'.repeat(43), relayUrl: 'wss://relay.example',
+        enrolledAt: '2026-10-01T00:00:00.000Z', connectionMode: 'resume' };
+    await writeFile(configPath, JSON.stringify(config), { mode: 0o600 });
+    const installationPath = join(home, 'installation.json');
+    await writeFile(installationPath, JSON.stringify({ schema: 'dharma.installation-identity/v1', installationId: config.installationId }));
+    const effects = [];
+    const deps = {
+        readFile, writeFile, resolve, mkdir: async () => { }, rm: async () => { }, randomUUID, AbortSignal, fetch, setTimeout, URL,
+        isIsolatedDeviceSession, runInIsolatedDeviceSession, saveDeviceConnectionPreference,
+        configPath: () => configPath, pendingEnrollmentPath: () => join(home, 'pending.json'),
+        workspaceRegistryPath: () => join(home, 'workspaces.json'), dharmaHome: () => home,
+        currentBootstrapHostScope: () => undefined,
+        installationIdentityPath: () => installationPath, protocolStatePath: () => join(home, 'state.json'),
+        connectionPreference, assertConnectionScope, assertInstallationContinuity, assertUnenrolledHome, assertReauthenticationSigningTrust, canonicalize,
+        VERSION: '0.1.synthetic',
+        resumeDeviceConnection: (input) => resumeDeviceConnection({ ...input,
+            openClient: async () => {
+                const saved = parseDeviceConfig(await readFile(configPath, 'utf8'));
+                return { config: saved, openSession: async () => ({ ok: true, organizationId: saved.organizationId,
+                        relayUrl: saved.relayUrl, serverPublicKeyEd25519: saved.serverPublicKeyEd25519,
+                        deviceAuthority: { schema: 'dharma.device-admission/v1', deviceId: saved.deviceId,
+                            ownerMembershipId: '44444444-4444-4444-8444-444444444444', deviceStatus: 'active', memberStatus: 'active' } }) };
+            } }),
+        acquirePidLock: async () => async () => { },
+        assertDeviceEnrollmentAnchorAbsent: async () => { },
+        normalizeHqUrl: (url) => url.replace(/\/$/, ''),
+        portalUrl: () => config.hqUrl,
+        required: (flags, key) => {
+            const value = flags.get(key);
+            if (!value)
+                throw Error(`missing ${key}`);
+            return value;
+        },
+        platform: async () => 'linux', loadOrCreateInstallationId: async () => config.installationId,
+        loadOrCreateDeviceIdentity: async () => { effects.push('key-create-path'); return { publicKeyEd25519: config.publicKeyEd25519 }; },
+        beginEnrollment: async () => { effects.push('enrollment'); return { deviceCode: 'synthetic', verificationUri: 'https://hq.example/approve', browserCode: 'synthetic', expiresInSeconds: 60 }; },
+        openVerificationUri: async () => { effects.push('browser'); return true; },
+        pollEnrollment: async () => ({ status: 'approved', deviceId: '33333333-3333-4333-8333-333333333333', relayUrl: config.relayUrl, serverPublicKeyEd25519: config.serverPublicKeyEd25519 }),
+        saveDeviceConfig: async (_path, value) => writeFile(configPath, JSON.stringify(value)),
+        saveDeviceEnrollmentAnchor: async () => { effects.push('anchor-write'); },
+        process: { env: {}, stderr: { write: () => { } } },
+    };
+    // Execute the real read helper with only filesystem read failures injectable.
+    deps.readExistingDeviceConfig = async (path) => (await caller('readExistingDeviceConfig', { readFile: deps.readFile, parseDeviceConfig, readDeviceConnectionPreference }, 'deviceConnection.ts'))(path);
+    deps.readDeviceConfig = async () => (await caller('readDeviceConfig', deps))();
+    deps.reauthenticateExistingDevice = await caller('reauthenticateExistingDevice', deps);
+    return { home, configPath, config, effects, deps };
+}
+test('ordinary opted-in login resumes the original identity without enrollment, keys or browser', async (t) => {
+    const f = await fixture(t);
+    const login = await caller('login', f.deps);
+    const result = await login(new Map([['organization-id', f.config.organizationId]]));
+    assert.equal(result?.status, 'resumed');
+    assert.equal(result?.deviceId, f.config.deviceId);
+    assert.equal(f.effects.includes('enrollment'), false);
+    assert.equal(f.effects.includes('key-create-path'), false);
+    assert.equal(f.effects.includes('browser'), false);
+    assert.equal(JSON.parse(await readFile(f.configPath, 'utf8')).deviceId, f.config.deviceId);
+});
+test('corrupt existing config is a recovery failure instead of an absent installation', async (t) => {
+    const f = await fixture(t);
+    await writeFile(f.configPath, '{broken');
+    const read = await caller('readDeviceConfig', f.deps);
+    await assert.rejects(read(), /connection_config_corrupt/);
+    assert.equal(await readFile(f.configPath, 'utf8'), '{broken');
+});
+test('an unreadable existing config cannot become first enrollment', async (t) => {
+    const f = await fixture(t);
+    f.deps.readFile = async () => { throw Object.assign(Error('synthetic denied'), { code: 'EACCES' }); };
+    const read = await caller('readDeviceConfig', f.deps);
+    await assert.rejects(read(), /connection_config_unreadable/);
+});
+test('a foreign organization cannot silently re-enroll an opted-in installation', async (t) => {
+    const f = await fixture(t);
+    const login = await caller('login', f.deps);
+    await assert.rejects(login(new Map([['organization-id', 'org_other']])), /connection_scope_mismatch/);
+    assert.deepEqual(f.effects, []);
+});
+test('manual mode requires explicit resume or opt-in and never replaces the device', async (t) => {
+    const f = await fixture(t);
+    await writeFile(f.configPath, JSON.stringify({ ...f.config, connectionMode: 'manual' }));
+    const login = await caller('login', f.deps);
+    await assert.rejects(login(new Map()), /connection_resume_opt_in_required/);
+    assert.deepEqual(f.effects, []);
+});
+test('returning dry-run has no enrollment, browser, key or configuration effects', async (t) => {
+    const f = await fixture(t);
+    const before = await readFile(f.configPath, 'utf8');
+    const login = await caller('login', f.deps);
+    const result = await login(new Map([['dry-run', true], ['organization-id', f.config.organizationId]]));
+    assert.equal(result?.status, 'plan');
+    assert.deepEqual(f.effects, []);
+    assert.equal(await readFile(f.configPath, 'utf8'), before);
+});
+test('ordinary opted-in bootstrap selects resume before demanding a new grant', async (t) => {
+    const f = await fixture(t);
+    f.deps.automaticBootstrapResume = automaticBootstrapResume;
+    f.deps.bootstrapGrantMode = bootstrapGrantMode;
+    f.deps.realpath = async () => { throw Error('reached_existing_scope_preflight'); };
+    const bootstrap = await caller('bootstrap', f.deps);
+    const result = await bootstrap(new Map([['organization-id', f.config.organizationId], ['complete', true]]));
+    assert.equal(result?.stage, 'repository_selection');
+    assert.equal(result?.message, 'Selected repository could not be verified; the grant was not redeemed.');
+    assert.deepEqual(f.effects, []);
+});
+test('explicit opt-in and opt-out preserve the enrolled authority fields', async (t) => {
+    const f = await fixture(t);
+    await writeFile(f.configPath, JSON.stringify({ ...f.config, connectionMode: 'manual' }));
+    const login = await caller('login', f.deps);
+    const enabled = await login(new Map([['unattended', true]]));
+    assert.equal(enabled?.status, 'resumed');
+    assert.equal(enabled?.connectionMode, 'resume');
+    const disabled = await login(new Map([['no-unattended', true]]));
+    assert.equal(disabled?.connectionMode, 'manual');
+    assert.equal(disabled?.connected, false);
+    assert.deepEqual(JSON.parse(await readFile(f.configPath, 'utf8')), { ...f.config, connectionMode: 'manual' });
+    assert.deepEqual(f.effects, []);
+});
+test('two first-login callers serialize enrollment and the second reuses its approved result', async (t) => {
+    const f = await fixture(t);
+    await rm(f.configPath);
+    await rm(join(f.home, 'installation.json'));
+    f.deps.rm = rm;
+    f.deps.loadOrCreateInstallationId = async () => {
+        await writeFile(join(f.home, 'installation.json'), JSON.stringify({ schema: 'dharma.installation-identity/v1', installationId: f.config.installationId }));
+        return f.config.installationId;
+    };
+    const locks = new Map();
+    f.deps.acquirePidLock = async (path) => {
+        let release;
+        const next = new Promise(resolve => { release = resolve; });
+        const previous = locks.get(path) ?? Promise.resolve();
+        locks.set(path, previous.then(() => next));
+        await previous;
+        return async () => release();
+    };
+    const login = await caller('login', f.deps);
+    const flags = new Map([['organization-id', f.config.organizationId], ['unattended', true], ['no-browser', true]]);
+    const results = await Promise.all([login(flags), login(flags)]);
+    assert.equal(f.effects.filter(effect => effect === 'enrollment').length, 1);
+    assert.equal(f.effects.filter(effect => effect === 'key-create-path').length, 1);
+    assert.deepEqual(results.map(result => result?.status).sort(), ['approved', 'resumed']);
+});
+async function bootstrapFixture(t) {
+    const f = await fixture(t);
+    const server = generateKeyPairSync('ed25519');
+    const config = { ...f.config, serverPublicKeyEd25519: server.publicKey.export({ format: 'jwk' }).x };
+    await writeFile(f.configPath, JSON.stringify(config));
+    const fingerprint = `sha256:${'a'.repeat(64)}`;
+    const workspaceId = workspaceIdForDevice({ organizationId: config.organizationId, deviceId: config.deviceId, path: f.home });
+    const row = { workspaceId, organizationId: config.organizationId, path: f.home, repositoryRemoteHash: fingerprint,
+        repositoryBindingId: 'binding-existing', endpointId: 'endpoint-existing' };
+    const evidence = { automaticDisclosure: { mode: 'metadata_only' }, maximumCapsuleBytes: 1024,
+        maximumDailyUploadBytes: 4096, maximumExpansionBytes: 1024, excludePaths: ['.git/**'], pseudonymizeIdentity: true };
+    const authorization = { schema: 'dharma.workspace-policy-authorization/v1', organizationId: config.organizationId, workspaceId,
+        policy: { revision: 'approved-1', evidence }, issuedAt: new Date(Date.now() - 1000).toISOString(),
+        expiresAt: new Date(Date.now() + 60_000).toISOString(), keyVersion: 'origin' };
+    const policy = { organizationId: config.organizationId, revision: 'approved-1', evidence,
+        serverAuthorization: { ...authorization, signature: sign(null, Buffer.from(canonicalize(authorization)), server.privateKey).toString('base64url') } };
+    Object.assign(f.deps, { automaticBootstrapResume, bootstrapGrantMode, selectDeviceWorkspace, verifyServerAuthorizedPolicy,
+        realpath: async () => f.home, preflightBootstrapWorkspaceIdentity: async () => ({ fingerprint }),
+        assertBootstrapHostSource: async () => { }, detectBootstrapProvider: async () => 'codex', isLocalProviderId: () => true,
+        registry: async () => [row], loadVerifiedWorkspacePolicy: async () => policy,
+        assertWorkspaceAuthorizationCurrent: async () => { }, loadOrganizationApiToken: async () => null });
+    f.deps.assertBootstrapResumeAuthority = await caller('assertBootstrapResumeAuthority', f.deps);
+    const flags = new Map([['organization-id', config.organizationId], ['complete', true],
+        ['workspace', f.home], ['policy-revision', policy.revision]]);
+    return { ...f, flags, row, policy };
+}
+test('ordinary bootstrap keeps accepted identity and reaches existing credential recovery without enrollment', async (t) => {
+    const f = await bootstrapFixture(t);
+    const bootstrap = await caller('bootstrap', f.deps);
+    const result = await bootstrap(f.flags);
+    assert.equal(result?.stage, 'organization_api_credentials');
+    assert.equal((result?.enrollment).deviceId, f.config.deviceId);
+    assert.deepEqual(f.effects, []);
+});
+test('automatic bootstrap rejects new repository, missing endpoint and new policy revision before setup effects', async (t) => {
+    for (const state of ['repository', 'endpoint', 'revision']) {
+        const f = await bootstrapFixture(t);
+        if (state === 'repository')
+            f.row.repositoryRemoteHash = `sha256:${'b'.repeat(64)}`;
+        if (state === 'endpoint')
+            f.row.endpointId = '';
+        if (state === 'revision')
+            f.flags.set('policy-revision', 'new-permissions');
+        const bootstrap = await caller('bootstrap', f.deps);
+        await assert.rejects(bootstrap(f.flags), /connection_new_scope_requires_approval/);
+        assert.deepEqual(f.effects, []);
+    }
+});
+test('automatic bootstrap dry-run verifies approved scope without connecting or changing credentials', async (t) => {
+    const f = await bootstrapFixture(t);
+    f.flags.set('dry-run', true);
+    f.deps.resumeDeviceConnection = async () => { throw Error('unexpected_device_connection'); };
+    f.deps.loadOrganizationApiToken = async () => { throw Error('unexpected_credential_access'); };
+    const bootstrap = await caller('bootstrap', f.deps);
+    const result = await bootstrap(f.flags);
+    assert.equal(result?.stage, 'plan');
+    assert.equal(result?.effects, false);
+    assert.deepEqual(f.effects, []);
+});
+test('explicit browser-approved legacy reauthentication preserves the original identity', async (t) => {
+    const f = await fixture(t);
+    await writeFile(f.configPath, JSON.stringify({ ...f.config, connectionMode: 'manual' }));
+    f.deps.enrolledDeviceIdentity = async () => ({ publicKeyEd25519: f.config.publicKeyEd25519 });
+    f.deps.pollEnrollment = async () => ({ status: 'approved', organizationId: f.config.organizationId, deviceId: f.config.deviceId,
+        relayUrl: f.config.relayUrl, serverPublicKeyEd25519: f.config.serverPublicKeyEd25519 });
+    const login = await caller('login', f.deps);
+    const result = await login(new Map([['reauthenticate', true]]));
+    assert.equal(result?.status, 'reauthenticated');
+    assert.equal(result?.deviceId, f.config.deviceId);
+    assert.deepEqual(f.effects, ['enrollment', 'browser', 'anchor-write']);
+    assert.deepEqual(JSON.parse(await readFile(f.configPath, 'utf8')), { ...f.config, connectionMode: 'manual' });
+});
+test('explicit reauthentication fails closed on missing private key or changed approval identity', async (t) => {
+    for (const state of ['missing_key', 'replacement', 'denied']) {
+        const f = await fixture(t), bytes = await readFile(f.configPath, 'utf8');
+        f.deps.enrolledDeviceIdentity = async () => {
+            if (state === 'missing_key')
+                throw Error('private-store-detail');
+            return { publicKeyEd25519: f.config.publicKeyEd25519 };
+        };
+        if (state === 'denied')
+            f.deps.pollEnrollment = async () => ({ status: 'denied' });
+        const login = await caller('login', f.deps);
+        await assert.rejects(login(new Map([['reauthenticate', true]])), state === 'missing_key' ? /connection_identity_requires_recovery/
+            : state === 'denied' ? /connection_reauthentication_rejected/ : /connection_reauthentication_identity_mismatch/);
+        assert.equal(await readFile(f.configPath, 'utf8'), bytes);
+        assert.equal(f.effects.includes('anchor-write'), false);
+        assert.equal(f.effects.includes('key-create-path'), false);
+        if (state === 'missing_key')
+            assert.deepEqual(f.effects, []);
+    }
+});
+test('a delayed protected keyset installation cannot undo actual CLI opt-out', async (t) => {
+    const f = await fixture(t), rootKey = generateKeyPairSync('ed25519');
+    const config = { ...f.config, serverPublicKeyEd25519: rootKey.publicKey.export({ format: 'jwk' }).x };
+    await writeFile(f.configPath, JSON.stringify(config));
+    const values = new Map();
+    let notify, unblock;
+    const delayed = new Promise(resolve => { notify = resolve; }), released = new Promise(resolve => { unblock = resolve; });
+    const store = { backend: 'windows-credential-manager',
+        compareAndPutEnrollmentAnchor: async (input) => {
+            if ((values.get(input.account) ?? null) !== input.expectedCurrent
+                || (values.get(input.legacyAccount) ?? null) !== input.expectedLegacy)
+                return false;
+            await store.put(input.account, input.secret);
+            return true;
+        }, get: async (account) => values.get(account) ?? null,
+        delete: async (account) => { values.delete(account); },
+        put: async (account, value) => {
+            if (JSON.parse(value).serverSigningKeyset) {
+                notify();
+                await released;
+            }
+            values.set(account, value);
+        } };
+    await saveDeviceEnrollmentAnchor({ config, store });
+    const now = new Date(), unsigned = { schema: 'dharma.server-signing-keyset/v1',
+        organizationId: config.organizationId, generation: 1,
+        keys: [{ keyVersion: 'origin', publicKeyEd25519: config.serverPublicKeyEd25519, status: 'active',
+                notBefore: new Date(now.getTime() - 1000).toISOString(), notAfter: new Date(now.getTime() + 60_000).toISOString() }],
+        signedByKeyVersion: 'origin', issuedAt: now.toISOString(), expiresAt: new Date(now.getTime() + 60_000).toISOString() };
+    const candidate = { ...unsigned, signature: sign(null, Buffer.from(canonicalize(unsigned)), rootKey.privateKey).toString('base64url') };
+    const rotation = installTrustedServerSigningKeyset({ configPath: f.configPath, candidate, store, now });
+    await delayed;
+    try {
+        const login = await caller('login', f.deps);
+        assert.equal((await login(new Map([['no-unattended', true]])))?.connectionMode, 'manual');
+    }
+    finally {
+        unblock();
+    }
+    await rotation;
+    const current = await f.deps.readDeviceConfig();
+    assert.equal(current.connectionMode, 'manual');
+    assert.deepEqual(current.serverSigningKeyset, candidate);
+    assert.equal(current.deviceId, config.deviceId);
+});
+test('concurrent actual bootstrap-to-onboard clients preserve a sibling durable outbox', async (t) => {
+    const f = await bootstrapFixture(t), values = new Map();
+    const store = { backend: 'windows-credential-manager',
+        compareAndPutEnrollmentAnchor: async (input) => {
+            if ((values.get(input.account) ?? null) !== input.expectedCurrent
+                || (values.get(input.legacyAccount) ?? null) !== input.expectedLegacy)
+                return false;
+            await store.put(input.account, input.secret);
+            return true;
+        }, get: async (account) => values.get(account) ?? null,
+        put: async (account, value) => { values.set(account, value); }, delete: async (account) => { values.delete(account); } };
+    const identity = await loadOrCreateDeviceIdentity({ hqUrl: f.config.hqUrl, organizationId: f.config.organizationId,
+        installationId: f.config.installationId, store });
+    const config = { ...parseDeviceConfig(await readFile(f.configPath, 'utf8')), publicKeyEd25519: identity.publicKeyEd25519 };
+    await writeFile(f.configPath, JSON.stringify(config));
+    await saveDeviceEnrollmentAnchor({ config, store });
+    const statePath = join(f.home, 'state.json'), pending = JSON.stringify({ schema: 'dharma.protocol-state/v1',
+        sessionId: 'sibling-original', nextSequence: 7, pending: { method: 'POST',
+            pathname: `/api/v1/orgs/${config.organizationId}/agent-fabric/tasks/poll`, body: '{"leaseSeconds":120}', headers: {} } });
+    await writeFile(statePath, pending);
+    const protectedBefore = new Map(values);
+    const requests = [];
+    Object.assign(f.deps, {
+        AgentFabricClient: { open: (input) => AgentFabricClient.open({ ...input, store,
+                fetcher: async (url, init) => {
+                    requests.push({ path: new URL(String(url)).pathname, sessionId: new Headers(init?.headers).get('x-dharma-session-id') });
+                    return new Response(JSON.stringify({ ok: true }), { status: 201 });
+                } }) },
+        loadOrganizationApiToken: async () => 'synthetic-existing-token',
+        parseSelectedProviderIds: () => ['codex'], inspectRegistryRecoveryFile: async () => ({ kind: 'valid' }),
+        registerWorkspaceBeforeRepositoryBind: async (fabric) => {
+            await fabric.registerWorkspace({ workspaceId: f.row.workspaceId });
+            return { registered: { ...f.row, repositoryAgentId: 'agent-existing' }, synchronized: { localPolicy: f.policy } };
+        },
+        fetchRepositorySourceAuthorization: async () => { throw Error('bounded_scope_read_stop'); },
+        retryBootstrapOnboarding: (operation) => operation(),
+    });
+    f.deps.client = await caller('client', f.deps);
+    f.deps.onboard = await caller('onboard', f.deps);
+    const bootstrap = await caller('bootstrap', f.deps);
+    const results = await Promise.all(Array.from({ length: 4 }, () => bootstrap(f.flags)));
+    assert.equal(results.every(result => result?.stage === 'repository_source_authorization_required'), true);
+    assert.equal(requests.some(request => request.path.endsWith('/tasks/poll')), false, 'No replay of the sibling request');
+    const admissions = requests.filter(request => request.path.endsWith('/agent-fabric/sessions'));
+    assert.equal(admissions.length, 4);
+    assert.equal(new Set(admissions.map(request => request.sessionId)).size, 4);
+    assert.equal(await readFile(statePath, 'utf8'), pending);
+    assert.deepEqual(values, protectedBefore);
+    assert.deepEqual(f.effects, []);
+});
+test('a surviving preference sidecar prevents first enrollment after a legacy config disappears', async (t) => {
+    const f = await fixture(t);
+    await saveDeviceConnectionPreference({ configPath: f.configPath, config: f.config, connectionMode: 'resume' });
+    const preference = await readFile(f.configPath + '.connection.json', 'utf8');
+    await rm(f.configPath);
+    await rm(join(f.home, 'installation.json'));
+    const login = await caller('login', f.deps);
+    await assert.rejects(login(new Map([['organization-id', f.config.organizationId]])), /connection_prior_state_requires_recovery/);
+    assert.deepEqual(f.effects, []);
+    assert.equal(await readFile(f.configPath + '.connection.json', 'utf8'), preference);
+    await assert.rejects(readFile(f.configPath), { code: 'ENOENT' });
+});
+test('explicit reauthentication preserves every pre-existing or unavailable protected anchor', async (t) => {
+    for (const state of ['existing', 'mismatched', 'corrupt', 'unavailable']) {
+        const f = await fixture(t), before = await readFile(f.configPath, 'utf8');
+        f.deps.enrolledDeviceIdentity = async () => ({ publicKeyEd25519: f.config.publicKeyEd25519 });
+        f.deps.pollEnrollment = async () => ({ status: 'approved', organizationId: f.config.organizationId,
+            deviceId: f.config.deviceId, relayUrl: f.config.relayUrl, serverPublicKeyEd25519: f.config.serverPublicKeyEd25519 });
+        f.deps.assertDeviceEnrollmentAnchorAbsent = async () => { throw Error('connection_existing_anchor_requires_recovery'); };
+        const login = await caller('login', f.deps);
+        await assert.rejects(login(new Map([['reauthenticate', true]])), /connection_existing_anchor_requires_recovery/);
+        assert.equal(await readFile(f.configPath, 'utf8'), before);
+        assert.deepEqual(f.effects, [], state);
+    }
+});
+test('a protected anchor appearing during browser approval is preserved', async (t) => {
+    const f = await fixture(t), before = await readFile(f.configPath, 'utf8');
+    let present = false;
+    f.deps.enrolledDeviceIdentity = async () => ({ publicKeyEd25519: f.config.publicKeyEd25519 });
+    f.deps.assertDeviceEnrollmentAnchorAbsent = async () => {
+        if (present)
+            throw Error('connection_existing_anchor_requires_recovery');
+    };
+    f.deps.pollEnrollment = async () => {
+        present = true;
+        return { status: 'approved', organizationId: f.config.organizationId, deviceId: f.config.deviceId,
+            relayUrl: f.config.relayUrl, serverPublicKeyEd25519: f.config.serverPublicKeyEd25519 };
+    };
+    const login = await caller('login', f.deps);
+    await assert.rejects(login(new Map([['reauthenticate', true]])), /connection_existing_anchor_requires_recovery/);
+    assert.equal(await readFile(f.configPath, 'utf8'), before);
+    assert.equal(f.effects.includes('anchor-write'), false);
+});
+test('legacy no-keyset recovery accepts a current root-signed approval without replacing legacy trust', async (t) => {
+    const f = await fixture(t), root = generateKeyPairSync('ed25519'), now = Date.now();
+    const config = { ...f.config, serverPublicKeyEd25519: root.publicKey.export({ format: 'jwk' }).x };
+    await writeFile(f.configPath, JSON.stringify(config));
+    const before = await readFile(f.configPath, 'utf8');
+    const unsigned = { schema: 'dharma.server-signing-keyset/v1', organizationId: config.organizationId, generation: 1,
+        keys: [{ keyVersion: 'origin', publicKeyEd25519: config.serverPublicKeyEd25519, status: 'active',
+                notBefore: new Date(now - 1000).toISOString(), notAfter: new Date(now + 60_000).toISOString() }],
+        signedByKeyVersion: 'origin', issuedAt: new Date(now).toISOString(), expiresAt: new Date(now + 60_000).toISOString() };
+    const keyset = { ...unsigned, signature: sign(null, Buffer.from(canonicalize(unsigned)), root.privateKey).toString('base64url') };
+    f.deps.enrolledDeviceIdentity = async () => ({ publicKeyEd25519: config.publicKeyEd25519 });
+    f.deps.pollEnrollment = async () => ({ status: 'approved', organizationId: config.organizationId,
+        deviceId: config.deviceId, relayUrl: config.relayUrl, serverPublicKeyEd25519: config.serverPublicKeyEd25519,
+        serverSigningKeyset: keyset });
+    const login = await caller('login', f.deps);
+    assert.equal((await login(new Map([['reauthenticate', true]])))?.status, 'reauthenticated');
+    assert.equal(await readFile(f.configPath, 'utf8'), before);
+    assert.equal(f.effects.includes('anchor-write'), true);
+});
+test('legacy recovery rejects untrusted approval keysets before writing an anchor', async (t) => {
+    for (const state of ['signature', 'organization', 'expired', 'root', 'malformed']) {
+        const f = await fixture(t), root = generateKeyPairSync('ed25519'), now = Date.now();
+        const config = { ...f.config, serverPublicKeyEd25519: root.publicKey.export({ format: 'jwk' }).x };
+        await writeFile(f.configPath, JSON.stringify(config));
+        const before = await readFile(f.configPath, 'utf8');
+        const unsigned = { schema: 'dharma.server-signing-keyset/v1', organizationId: config.organizationId, generation: 1,
+            keys: [{ keyVersion: 'origin', publicKeyEd25519: config.serverPublicKeyEd25519, status: 'active',
+                    notBefore: new Date(now - 1000).toISOString(), notAfter: new Date(now + 60_000).toISOString() }],
+            signedByKeyVersion: 'origin', issuedAt: new Date(now).toISOString(), expiresAt: new Date(now + 60_000).toISOString() };
+        if (state === 'organization')
+            unsigned.organizationId = 'org_other';
+        if (state === 'expired') {
+            unsigned.issuedAt = new Date(now - 60_000).toISOString();
+            unsigned.expiresAt = new Date(now - 1000).toISOString();
+        }
+        if (state === 'root')
+            unsigned.keys[0].publicKeyEd25519 = generateKeyPairSync('ed25519').publicKey.export({ format: 'jwk' }).x;
+        let keyset = { ...unsigned, signature: sign(null, Buffer.from(canonicalize(unsigned)), root.privateKey).toString('base64url') };
+        if (state === 'signature')
+            keyset = { ...keyset, signature: 'A'.repeat(86) };
+        if (state === 'malformed')
+            keyset = {};
+        f.deps.enrolledDeviceIdentity = async () => ({ publicKeyEd25519: config.publicKeyEd25519 });
+        f.deps.pollEnrollment = async () => ({ status: 'approved', organizationId: config.organizationId, deviceId: config.deviceId,
+            relayUrl: config.relayUrl, serverPublicKeyEd25519: config.serverPublicKeyEd25519, serverSigningKeyset: keyset });
+        const login = await caller('login', f.deps);
+        await assert.rejects(login(new Map([['reauthenticate', true]])), /connection_reauthentication_trust_rejected/);
+        assert.equal(await readFile(f.configPath, 'utf8'), before);
+        assert.equal(f.effects.includes('anchor-write'), false);
+    }
+});
+//# sourceMappingURL=resumeLoginCaller.test.js.map

package/dist/resumeLoginCaller.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resumeLoginCaller.test.js","sourceRoot":"","sources":["../src/resumeLoginCaller.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAC,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAC,MAAM,EAAC,MAAM,SAAS,CAAC;AAC/B,OAAO,EAAC,IAAI,EAAE,OAAO,EAAC,MAAM,WAAW,CAAC;AACxC,OAAO,EAAC,eAAe,EAAC,MAAM,SAAS,CAAC;AACxC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAC,YAAY,EAAC,MAAM,wCAAwC,CAAC;AACpE,OAAO,EAAC,mBAAmB,EAAE,IAAI,EAAE,UAAU,EAAC,MAAM,aAAa,CAAC;AAClE,OAAO,EAAC,4BAA4B,EAAC,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAC,iBAAiB,EAAE,iBAAiB,EAAE,8BAA8B,EAAE,8BAA8B,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,iCAAiC,EAA4C,MAAM,2CAA2C,CAAC;AACrS,OAAO,EAAC,uBAAuB,EAAE,0BAA0B,EAAC,MAAM,6BAA6B,CAAC;AAChG,OAAO,EAAC,qBAAqB,EAAE,4BAA4B,EAAE,oBAAoB,EAAE,kCAAkC,EAAE,oBAAoB,EAAE,sBAAsB,EAAC,MAAM,uBAAuB,CAAC;AAClM,OAAO,EAAC,wBAAwB,EAAC,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAC,kBAAkB,EAAC,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAC,qBAAqB,EAAE,oBAAoB,EAAC,MAAM,0BAA0B,CAAC;AAErF,+EAA+E;AAC/E,+EAA+E;AAC/E,KAAK,UAAU,MAAM,CAAC,IAAY,EAAE,IAA6B,EAAE,IAAI,GAAG,UAAU;IAClF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;IAClF,MAAM,GAAG,GAAG,EAAE,CAAC,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAClF,MAAM,WAAW,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC;IACnG,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC;IACvB,MAAM,QAAQ,GAAG,EAAE,CAAC,eAAe,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE;QACtF,eAAe,EAAE,EAAC,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAC,EAAE,iBAAiB,EAAE,IAAI;KACvG,CAAC,CAAC;IACH,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACtG,OAAO,eAAe,CAAC,GAAG,QAAQ,CAAC,UAAU,KAAK,IAAI,EAAE,EAAE,IAAI,EAAE,EAAC,OAAO,EAAE,IAAI,EAAC,CACd,CAAC;AACpE,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,CAAyC;IAC9D,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACnE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAC,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAC,CAAC,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,EAAC,MAAM,EAAE,yBAAyB,EAAE,KAAK,EAAE,oBAAoB;QAC5E,cAAc,EAAE,aAAa,EAAE,QAAQ,EAAE,sCAAsC,EAAE,cAAc,EAAE,sCAAsC;QACvI,UAAU,EAAE,kBAAkB,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACnF,sBAAsB,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,qBAAqB;QACvE,UAAU,EAAE,0BAA0B,EAAE,cAAc,EAAE,QAAQ,EAAC,CAAC;IACpE,MAAM,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAC,IAAI,EAAE,KAAK,EAAC,CAAC,CAAC;IACnE,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IACzD,MAAM,SAAS,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,EAAC,MAAM,EAAE,iCAAiC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAC,CAAC,CAAC,CAAC;IACtI,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAA4B;QACpC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,EAAE,EAAE,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG;QACxH,uBAAuB,EAAE,0BAA0B,EAAE,8BAA8B;QACnF,UAAU,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,qBAAqB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC;QACrF,qBAAqB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI;QAClF,yBAAyB,EAAE,GAAG,EAAE,CAAC,SAAS;QAC1C,wBAAwB,EAAE,GAAG,EAAE,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;QACnG,oBAAoB,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,oBAAoB,EAAE,kCAAkC,EAAE,YAAY;QACjJ,OAAO,EAAE,eAAe;QACxB,sBAAsB,EAAE,CAAC,KAAmD,EAAE,EAAE,CAAC,sBAAsB,CAAC,EAAC,GAAG,KAAK;YAC/G,UAAU,EAAE,KAAK,IAAI,EAAE;gBACrB,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;gBACpE,OAAO,EAAC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAC,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc;wBAC9F,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;wBAC9E,eAAe,EAAE,EAAC,MAAM,EAAE,4BAA4B,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ;4BAC9E,iBAAiB,EAAE,sCAAsC,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAC,EAAC,CAAC,EAAC,CAAC;YACpH,CAAC,EAAC,CAAC;QACL,cAAc,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK,IAAI,EAAE,GAAE,CAAC;QAC1C,kCAAkC,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;QAClD,cAAc,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QACvD,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK;QAC7B,QAAQ,EAAE,CAAC,KAA2B,EAAE,GAAW,EAAE,EAAE;YACrD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAAC,IAAI,CAAC,KAAK;gBAAE,MAAM,KAAK,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC;YAAC,OAAO,KAAK,CAAC;QACxF,CAAC;QACD,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,OAAO,EAAE,0BAA0B,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,cAAc;QAC5F,0BAA0B,EAAE,KAAK,IAAI,EAAE,GAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,EAAC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAC,CAAC,CAAA,CAAC;QAC9H,eAAe,EAAE,KAAK,IAAI,EAAE,GAAE,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,EAAC,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,4BAA4B,EAAE,WAAW,EAAE,WAAW,EAAE,gBAAgB,EAAE,EAAE,EAAC,CAAC,CAAA,CAAC;QAC3L,mBAAmB,EAAE,KAAK,IAAI,EAAE,GAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAA,CAAC;QACxE,cAAc,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,sCAAsC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,sBAAsB,EAAE,MAAM,CAAC,sBAAsB,EAAC,CAAC;QACtL,gBAAgB,EAAE,KAAK,EAAE,KAAa,EAAE,KAAc,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACvG,0BAA0B,EAAE,KAAK,IAAI,EAAE,GAAE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAA,CAAC;QACvE,OAAO,EAAE,EAAC,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,EAAC,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC,EAAC,EAAC;KAC9C,CAAC;IACF,8EAA8E;IAC9E,IAAI,CAAC,wBAAwB,GAAG,KAAK,EAAE,IAAY,EAAE,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,0BAA0B,EAC9F,EAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,iBAAiB,EAAE,8BAA8B,EAAC,EAAE,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC9G,IAAI,CAAC,gBAAgB,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;IAC/E,IAAI,CAAC,4BAA4B,GAAG,MAAM,MAAM,CAAC,8BAA8B,EAAE,IAAI,CAAC,CAAC;IACvF,OAAO,EAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAC,CAAC;AACnD,CAAC;AAED,IAAI,CAAC,2FAA2F,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IAC1G,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IACxC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,CAAC;IAC3D,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAwB,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACrH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iFAAiF,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IAChG,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACtD,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,2BAA2B,CAAC,CAAC;IAC1D,MAAM,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC;AAChE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,8DAA8D,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IAC7E,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC,CAAC,IAAI,CAAC,QAAQ,GAAG,KAAK,IAAI,EAAE,GAAE,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,EAAC,IAAI,EAAE,QAAQ,EAAC,CAAC,CAAC,CAAA,CAAC,CAAC;IAClG,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACtD,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,8BAA8B,CAAC,CAAC;AAC/D,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2EAA2E,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IAC1F,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAC;IACtG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,8EAA8E,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IAC7F,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAC,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAC,CAAC,CAAC,CAAC;IACvF,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,EAAE,CAAC,EAAE,mCAAmC,CAAC,CAAC;IAC5E,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,4EAA4E,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IAC3F,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAA2B,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;IACjI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAChC,MAAM,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;AAC7D,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yEAAyE,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IACxF,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC,CAAC,IAAI,CAAC,wBAAwB,GAAG,wBAAwB,CAAC;IAC3D,CAAC,CAAC,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;IAC/C,CAAC,CAAC,IAAI,CAAC,QAAQ,GAAG,KAAK,IAAI,EAAE,GAAE,MAAM,KAAK,CAAC,kCAAkC,CAAC,CAAC,CAAA,CAAC,CAAC;IACjF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,GAAG,CAA2B,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACtI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,sBAAsB,CAAC,CAAC;IACpD,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,wEAAwE,CAAC,CAAC;IACxG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,oEAAoE,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IACnF,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAC,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAC,CAAC,CAAC,CAAC;IACvF,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IACzC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;IACjD,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACzC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,EAAE,EAAC,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAC,CAAC,CAAC;IAC5G,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wFAAwF,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IACvG,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACvB,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;IACf,CAAC,CAAC,IAAI,CAAC,0BAA0B,GAAG,KAAK,IAAI,EAAE;QAC7C,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,mBAAmB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAC,MAAM,EAAE,iCAAiC,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc,EAAC,CAAC,CAAC,CAAC;QACzJ,OAAO,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC;IACjC,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC/C,CAAC,CAAC,IAAI,CAAC,cAAc,GAAG,KAAK,EAAE,IAAY,EAAE,EAAE;QAC7C,IAAI,OAAoB,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,GAAE,OAAO,GAAG,OAAO,CAAC,CAAA,CAAC,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACtD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3C,MAAM,QAAQ,CAAC;QACf,OAAO,KAAK,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IAC/B,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,IAAI,GAAG,CAA2B,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5I,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC5E,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,KAAK,iBAAiB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACjF,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;AAC1F,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,gBAAgB,CAAC,CAAyC;IACvE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,EAAC,GAAG,CAAC,CAAC,MAAM,EAAE,sBAAsB,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,EAAC,MAAM,EAAE,KAAK,EAAC,CAAC,CAAC,CAAE,EAAC,CAAC;IAClG,MAAM,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,UAAU,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;IAC/C,MAAM,WAAW,GAAG,oBAAoB,CAAC,EAAC,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAC,CAAC,CAAC;IAC3H,MAAM,GAAG,GAAG,EAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,oBAAoB,EAAE,WAAW;QAC9G,mBAAmB,EAAE,kBAAkB,EAAE,UAAU,EAAE,mBAAmB,EAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,EAAC,mBAAmB,EAAE,EAAC,IAAI,EAAE,eAAe,EAAC,EAAE,mBAAmB,EAAE,IAAI;QACvF,uBAAuB,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,SAAS,CAAC,EAAE,oBAAoB,EAAE,IAAI,EAAC,CAAC;IACrH,MAAM,aAAa,GAAG,EAAC,MAAM,EAAE,0CAA0C,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,WAAW;QAC3H,MAAM,EAAE,EAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAC,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QAC/F,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAC,CAAC;IAChF,MAAM,MAAM,GAAG,EAAC,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ;QACrF,mBAAmB,EAAE,EAAC,GAAG,aAAa,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAC,EAAC,CAAC;IACrJ,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,EAAC,wBAAwB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,4BAA4B;QACtH,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,mCAAmC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAC,WAAW,EAAC,CAAC;QAC9F,yBAAyB,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,EAAE,uBAAuB,EAAE,KAAK,IAAI,EAAE,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,EAAE,CAAC,IAAI;QACtH,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,2BAA2B,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM;QAC5E,mCAAmC,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,EAAE,wBAAwB,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAC,CAAC,CAAC;IACpG,CAAC,CAAC,IAAI,CAAC,8BAA8B,GAAG,MAAM,MAAM,CAAC,gCAAgC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/F,MAAM,KAAK,GAAG,IAAI,GAAG,CAA2B,CAAC,CAAC,iBAAiB,EAAE,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC;QAC7G,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,iBAAiB,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,EAAC,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAC,CAAC;AACpC,CAAC;AAED,IAAI,CAAC,wGAAwG,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IACvH,MAAM,CAAC,GAAG,MAAM,gBAAgB,CAAC,CAAC,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,8BAA8B,CAAC,CAAC;IAC5D,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,UAAiC,CAAA,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrF,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2GAA2G,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IAC1H,KAAK,MAAM,KAAK,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC;QAC3D,MAAM,CAAC,GAAG,MAAM,gBAAgB,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,YAAY;YAAE,CAAC,CAAC,GAAG,CAAC,oBAAoB,GAAG,UAAU,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;QACpF,IAAI,KAAK,KAAK,UAAU;YAAE,CAAC,CAAC,GAAG,CAAC,UAAU,GAAG,EAAE,CAAC;QAChD,IAAI,KAAK,KAAK,UAAU;YAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;QAC5E,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,wCAAwC,CAAC,CAAC;QACnF,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAClC,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gGAAgG,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IAC/G,MAAM,CAAC,GAAG,MAAM,gBAAgB,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC,IAAI,CAAC,sBAAsB,GAAG,KAAK,IAAI,EAAE,GAAE,MAAM,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAA,CAAC,CAAC;IAC3F,CAAC,CAAC,IAAI,CAAC,wBAAwB,GAAG,KAAK,IAAI,EAAE,GAAE,MAAM,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAA,CAAC,CAAC;IAC7F,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,mFAAmF,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IAClG,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAC,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAC,CAAC,CAAC,CAAC;IACvF,CAAC,CAAC,IAAI,CAAC,sBAAsB,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,EAAC,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,gBAAgB,EAAC,CAAC,CAAC;IAC5F,CAAC,CAAC,IAAI,CAAC,cAAc,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,EAAC,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ;QAC5H,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,sBAAsB,EAAE,CAAC,CAAC,MAAM,CAAC,sBAAsB,EAAC,CAAC,CAAC;IACzF,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAChD,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,YAAY,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;IACvE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,EAAE,EAAC,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAC,CAAC,CAAC;AAC9G,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,4FAA4F,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IAC3G,KAAK,MAAM,KAAK,IAAI,CAAC,aAAa,EAAE,aAAa,EAAE,QAAQ,CAAU,EAAE,CAAC;QACtE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,MAAM,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACzE,CAAC,CAAC,IAAI,CAAC,sBAAsB,GAAG,KAAK,IAAI,EAAE;YACzC,IAAI,KAAK,KAAK,aAAa;gBAAE,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;YACjE,OAAO,EAAC,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,gBAAgB,EAAC,CAAC;QACvD,CAAC,CAAC;QACF,IAAI,KAAK,KAAK,QAAQ;YAAE,CAAC,CAAC,IAAI,CAAC,cAAc,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,EAAC,MAAM,EAAE,QAAQ,EAAC,CAAC,CAAC;QACjF,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAC7D,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,uCAAuC;YAC/D,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC,+CAA+C,CAAC,CAAC;QACrH,MAAM,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;QAC1D,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC;QACxD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,CAAC;QAC3D,IAAI,KAAK,KAAK,aAAa;YAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wEAAwE,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IACvF,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,EAAC,GAAG,CAAC,CAAC,MAAM,EAAE,sBAAsB,EAAE,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,EAAC,MAAM,EAAE,KAAK,EAAC,CAAC,CAAC,CAAE,EAAiB,CAAC;IACnH,MAAM,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,IAAI,MAAmB,EAAE,OAAoB,CAAC;IAC9C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,GAAE,MAAM,GAAG,OAAO,CAAC,CAAA,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,GAAE,OAAO,GAAG,OAAO,CAAC,CAAA,CAAC,CAAC,CAAC;IACjI,MAAM,KAAK,GAAsB,EAAC,OAAO,EAAE,4BAA4B;QACrE,6BAA6B,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YAC3C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,eAAe;mBAC5D,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,cAAc;gBAAE,OAAO,KAAK,CAAC;YACtF,MAAM,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAC5D,CAAC,EAAE,GAAG,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI;QACpD,MAAM,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE,GAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA,CAAC;QAClD,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAC5B,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,mBAAmB,EAAE,CAAC;gBAAA,MAAM,EAAE,CAAC;gBAAC,MAAM,QAAQ,CAAC;YAAA,CAAC;YACtE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC7B,CAAC,EAAC,CAAC;IACL,MAAM,0BAA0B,CAAC,EAAC,MAAM,EAAE,KAAK,EAAC,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,EAAE,QAAQ,GAAG,EAAC,MAAM,EAAE,iCAA0C;QACpF,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,UAAU,EAAE,CAAC;QACpD,IAAI,EAAE,CAAC,EAAC,UAAU,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,CAAC,sBAAsB,EAAE,MAAM,EAAE,QAAiB;gBACtG,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAC,CAAC;QACrH,kBAAkB,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAC,CAAC;IACxH,MAAM,SAAS,GAAG,EAAC,GAAG,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAC,CAAC;IACtI,MAAM,QAAQ,GAAG,iCAAiC,CAAC,EAAC,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAC,CAAC,CAAC;IACtG,MAAM,OAAO,CAAC;IACd,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;IAC5F,CAAC;YAAS,CAAC;QAAA,OAAO,EAAE,CAAC;IAAA,CAAC;IACtB,MAAM,QAAQ,CAAC;IACf,MAAM,OAAO,GAAG,MAAO,CAAC,CAAC,IAAI,CAAC,gBAAgD,EAAE,CAAC;IACjF,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;IAC/C,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;IACzD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;AAClD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kFAAkF,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IACjG,MAAM,CAAC,GAAG,MAAM,gBAAgB,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxE,MAAM,KAAK,GAAsB,EAAC,OAAO,EAAE,4BAA4B;QACrE,6BAA6B,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE;YAC3C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,eAAe;mBAC5D,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,cAAc;gBAAE,OAAO,KAAK,CAAC;YACtF,MAAM,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAC5D,CAAC,EAAE,GAAG,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI;QACpD,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,GAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAA,CAAC,EAAE,MAAM,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE,GAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA,CAAC,EAAC,CAAC;IACpH,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,EAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc;QAC/G,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,EAAC,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,EAAC,GAAG,iBAAiB,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,EAAE,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,EAAC,CAAC;IACzH,MAAM,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD,MAAM,0BAA0B,CAAC,EAAC,MAAM,EAAE,KAAK,EAAC,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAC,MAAM,EAAE,0BAA0B;QACxG,SAAS,EAAE,kBAAkB,EAAE,YAAY,EAAE,CAAC,EAAE,OAAO,EAAE,EAAC,MAAM,EAAE,MAAM;YACtE,QAAQ,EAAE,gBAAgB,MAAM,CAAC,cAAc,0BAA0B,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,EAAE,EAAC,EAAC,CAAC,CAAC;IAC5H,MAAM,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACpC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAoD,EAAE,CAAC;IACrE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE;QACpB,iBAAiB,EAAE,EAAC,IAAI,EAAE,CAAC,KAAmD,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAC,GAAG,KAAK,EAAE,KAAK;gBACxH,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;oBAC3B,QAAQ,CAAC,IAAI,CAAC,EAAC,IAAI,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAC,CAAC,CAAC;oBACvH,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAC,EAAE,EAAE,IAAI,EAAC,CAAC,EAAE,EAAC,MAAM,EAAE,GAAG,EAAC,CAAC,CAAC;gBACjE,CAAC,EAAC,CAAC,EAAC;QACN,wBAAwB,EAAE,KAAK,IAAI,EAAE,CAAC,0BAA0B;QAChE,wBAAwB,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,2BAA2B,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAC,IAAI,EAAE,OAAO,EAAC,CAAC;QACrG,qCAAqC,EAAE,KAAK,EAAE,MAAyB,EAAE,EAAE;YACzE,MAAM,MAAM,CAAC,iBAAiB,CAAC,EAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,EAAC,CAAC,CAAC;YACjE,OAAO,EAAC,UAAU,EAAE,EAAC,GAAG,CAAC,CAAC,GAAG,EAAE,iBAAiB,EAAE,gBAAgB,EAAC,EAAE,YAAY,EAAE,EAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAC,EAAC,CAAC;QAC9G,CAAC;QACD,kCAAkC,EAAE,KAAK,IAAI,EAAE,GAAE,MAAM,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAA,CAAC;QACzF,wBAAwB,EAAE,CAAC,SAAwB,EAAE,EAAE,CAAC,SAAS,EAAE;KACpE,CAAC,CAAC;IACH,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC,CAAC,IAAI,CAAC,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAC,MAAM,EAAE,CAAC,EAAC,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACrF,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,KAAK,0CAA0C,CAAC,EAAE,IAAI,CAAC,CAAC;IAC1G,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,EAAE,KAAK,EAAE,kCAAkC,CAAC,CAAC;IACxH,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC,CAAC;IAC/F,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACnC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC5E,MAAM,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;IACzD,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC1C,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2FAA2F,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IAC1G,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,8BAA8B,CAAC,EAAC,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,MAAsB,EAAE,cAAc,EAAE,QAAQ,EAAC,CAAC,CAAC;IAC7H,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,CAAC,CAAC,UAAU,GAAG,kBAAkB,EAAE,MAAM,CAAC,CAAC;IAC7E,MAAM,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACvB,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,0CAA0C,CAAC,CAAC;IACjI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAChC,MAAM,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,UAAU,GAAG,kBAAkB,EAAE,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC;IACpF,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,EAAC,IAAI,EAAE,QAAQ,EAAC,CAAC,CAAC;AACjE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wFAAwF,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IACvG,KAAK,MAAM,KAAK,IAAI,CAAC,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC,EAAE,CAAC;QACzE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC1E,CAAC,CAAC,IAAI,CAAC,sBAAsB,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,EAAC,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,gBAAgB,EAAC,CAAC,CAAC;QAC5F,CAAC,CAAC,IAAI,CAAC,cAAc,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,EAAC,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc;YAC/F,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,sBAAsB,EAAE,CAAC,CAAC,MAAM,CAAC,sBAAsB,EAAC,CAAC,CAAC;QACtH,CAAC,CAAC,IAAI,CAAC,kCAAkC,GAAG,KAAK,IAAI,EAAE,GAAE,MAAM,KAAK,CAAC,8CAA8C,CAAC,CAAC,CAAA,CAAC,CAAC;QACvH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,8CAA8C,CAAC,CAAC;QACjH,MAAM,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3D,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,mEAAmE,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IAClF,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC1E,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,CAAC,CAAC,IAAI,CAAC,sBAAsB,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,EAAC,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,gBAAgB,EAAC,CAAC,CAAC;IAC5F,CAAC,CAAC,IAAI,CAAC,kCAAkC,GAAG,KAAK,IAAI,EAAE;QACrD,IAAI,OAAO;YAAE,MAAM,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAC3E,CAAC,CAAC;IACF,CAAC,CAAC,IAAI,CAAC,cAAc,GAAG,KAAK,IAAI,EAAE;QACjC,OAAO,GAAG,IAAI,CAAC;QACf,OAAO,EAAC,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ;YAC9F,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,sBAAsB,EAAE,CAAC,CAAC,MAAM,CAAC,sBAAsB,EAAC,CAAC;IAC1F,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,8CAA8C,CAAC,CAAC;IACjH,MAAM,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IAC3D,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC;AAC1D,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iGAAiG,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IAChH,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,GAAG,mBAAmB,CAAC,SAAS,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACpF,MAAM,MAAM,GAAG,EAAC,GAAG,CAAC,CAAC,MAAM,EAAE,sBAAsB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAC,MAAM,EAAE,KAAK,EAAC,CAAC,CAAC,CAAE,EAAC,CAAC;IAChG,MAAM,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,EAAC,MAAM,EAAE,iCAAiC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,UAAU,EAAE,CAAC;QAC/G,IAAI,EAAE,CAAC,EAAC,UAAU,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,CAAC,sBAAsB,EAAE,MAAM,EAAE,QAAQ;gBAC7F,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAC,CAAC;QACjG,kBAAkB,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAC,CAAC;IACxH,MAAM,MAAM,GAAG,EAAC,GAAG,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAC,CAAC;IAChI,CAAC,CAAC,IAAI,CAAC,sBAAsB,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,EAAC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAC,CAAC,CAAC;IAC1F,CAAC,CAAC,IAAI,CAAC,cAAc,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,EAAC,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc;QAC7F,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;QAC3G,mBAAmB,EAAE,MAAM,EAAC,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC5F,MAAM,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IAC3D,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,CAAC;AACzD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,6EAA6E,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IAC5F,KAAK,MAAM,KAAK,IAAI,CAAC,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;QAClF,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,GAAG,mBAAmB,CAAC,SAAS,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACpF,MAAM,MAAM,GAAG,EAAC,GAAG,CAAC,CAAC,MAAM,EAAE,sBAAsB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAC,MAAM,EAAE,KAAK,EAAC,CAAC,CAAC,CAAE,EAAC,CAAC;QAChG,MAAM,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,EAAC,MAAM,EAAE,iCAAiC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,UAAU,EAAE,CAAC;YAC/G,IAAI,EAAE,CAAC,EAAC,UAAU,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,CAAC,sBAAsB,EAAE,MAAM,EAAE,QAAQ;oBAC7F,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAC,CAAC;YACjG,kBAAkB,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,EAAC,CAAC;QACxH,IAAI,KAAK,KAAK,cAAc;YAAE,QAAQ,CAAC,cAAc,GAAG,WAAW,CAAC;QACpE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAAA,QAAQ,CAAC,QAAQ,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;YAAC,QAAQ,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAAA,CAAC;QAC7I,IAAI,KAAK,KAAK,MAAM;YAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,gBAAgB,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,EAAC,MAAM,EAAE,KAAK,EAAC,CAAC,CAAC,CAAE,CAAC;QAC/H,IAAI,MAAM,GAAY,EAAC,GAAG,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAC,CAAC;QACvI,IAAI,KAAK,KAAK,WAAW;YAAE,MAAM,GAAG,EAAC,GAAG,MAAgB,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAC,CAAC;QACrF,IAAI,KAAK,KAAK,WAAW;YAAE,MAAM,GAAG,EAAE,CAAC;QACvC,CAAC,CAAC,IAAI,CAAC,sBAAsB,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,EAAC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAC,CAAC,CAAC;QAC1F,CAAC,CAAC,IAAI,CAAC,cAAc,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,EAAC,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACxH,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,sBAAsB,EAAE,MAAM,CAAC,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,EAAC,CAAC,CAAC;QAClH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,4CAA4C,CAAC,CAAC;QAC/G,MAAM,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3D,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/schemas/device-admission.schema.json

@@ -0,0 +1,61 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schemas.dharma-ai.io/device-admission/v1",
+  "title": "Current protected HQ device and member admission",
+  "type": "object",
+  "additionalProperties": true,
+  "required": [
+    "ok",
+    "organizationId",
+    "relayUrl",
+    "serverPublicKeyEd25519",
+    "deviceAuthority"
+  ],
+  "properties": {
+    "ok": {
+      "const": true
+    },
+    "organizationId": {
+      "type": "string",
+      "minLength": 1
+    },
+    "relayUrl": {
+      "type": "string",
+      "format": "uri"
+    },
+    "serverPublicKeyEd25519": {
+      "type": "string",
+      "pattern": "^[A-Za-z0-9_-]{43}$"
+    },
+    "deviceAuthority": {
+      "type": "object",
+      "additionalProperties": true,
+      "required": [
+        "schema",
+        "deviceId",
+        "ownerMembershipId",
+        "deviceStatus",
+        "memberStatus"
+      ],
+      "properties": {
+        "schema": {
+          "const": "dharma.device-admission/v1"
+        },
+        "deviceId": {
+          "type": "string",
+          "format": "uuid"
+        },
+        "ownerMembershipId": {
+          "type": "string",
+          "format": "uuid"
+        },
+        "deviceStatus": {
+          "const": "active"
+        },
+        "memberStatus": {
+          "const": "active"
+        }
+      }
+    }
+  }
+}

package/dist/schemas/device-config.schema.json

@@ -0,0 +1,26 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schemas.dharma-ai.io/device-config/v1",
+  "title": "Enrolled device configuration",
+  "type": "object",
+  "additionalProperties": true,
+  "required": ["schema", "hqUrl", "organizationId", "deviceId", "deviceName", "platform", "publicKeyEd25519", "serverPublicKeyEd25519", "relayUrl", "enrolledAt"],
+  "properties": {
+    "schema": {"const": "dharma.device-config/v1"},
+    "hqUrl": {"type": "string", "format": "uri"},
+    "organizationId": {"type": "string", "minLength": 1},
+    "installationId": {"type": "string", "format": "uuid"},
+    "deviceId": {"type": "string", "minLength": 1},
+    "deviceName": {"type": "string", "minLength": 1},
+    "platform": {"enum": ["windows", "wsl", "macos", "linux"]},
+    "publicKeyEd25519": {"type": "string", "pattern": "^[A-Za-z0-9_-]{43}$"},
+    "serverPublicKeyEd25519": {"type": "string", "pattern": "^[A-Za-z0-9_-]{43}$"},
+    "serverSigningKeyset": {"type": "object"},
+    "relayUrl": {"type": "string", "format": "uri"},
+    "enrolledAt": {"type": "string", "format": "date-time"},
+    "connectionMode": {"enum": ["manual", "resume"], "description": "Local opt-in preference; conveys no server or provider authority."},
+    "evidenceQuotaLedgerInitializedAt": {"type": "string", "format": "date-time"},
+    "setupClaimReference": {"type": "string", "minLength": 1},
+    "setupClaimRepositoryFingerprint": {"type": "string", "pattern": "^sha256:[a-f0-9]{64}$"}
+  }
+}