@dsh-enhanced/lark-channel 0.1.47 → 0.1.49

package/lib/rsi-creation-build.js

@@ -0,0 +1,333 @@
+import { createHash } from 'node:crypto';
+import { chmod, lstat, mkdir, mkdtemp, readdir, rename, rm, stat } from 'node:fs/promises';
+import { dirname, isAbsolute, join, resolve } from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
+import { rsiBuildResources as io, readRsiBuildEnvironment } from './rsi-build.js';
+const COMMIT = /^[a-f0-9]{40}$/u;
+const IMAGE = /^sha256:[a-f0-9]{64}$/u;
+const PROFILE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
+const PACKAGE_MANAGER = 'pnpm@11.7.0';
+const FIXED = {
+    'scripts/isolation/build-plugin-verifier-image.mjs': 'ae615696e51f88be9ad1e5f1b2a8769b951d8f0632b13547fcfa8f23ab837802',
+    'scripts/isolation/plugin-verifier.Dockerfile': 'e3d4aad5d1a1fda8c1a01d080f32aceb9d6438954169b412ed96e8dde2fd22b2',
+    'scripts/isolation/plugin-observer-launcher.c': '90bb335432a74778d442e2fcab50a19fc4441191343eaa76beed09287515b0ce',
+    'plugins/assistant-verifier/src/plugin-behavior-runner.ts': '1a7f5d9a686cc8615e403a9f5536701d759fc40ef9fa5fe7c29cbddb2891c187',
+};
+const WORKER_SHA = '0394f3974410fe00538fbd99e643a86672a7dfad7a1471af7280dce36668eef4';
+const CANDIDATE_SHA = '051e76a0e45c50e434be757913f89a2be0ee5cac6941797924fb13b316695109';
+function fail(message) { throw new Error(`rsi creation build: ${message}`); }
+function digest(value) { return createHash('sha256').update(value).digest('hex'); }
+function validPath(value) { return isAbsolute(value) && resolve(value) === value && !value.includes('\0'); }
+async function base(input) {
+    if (!validPath(input.dshHome) || !PROFILE.test(input.profile)
+        || input.source.schemaVersion !== 1 || !COMMIT.test(input.source.sourceCommit)
+        || input.build.schemaVersion !== 1 || input.build.sourceCommit !== input.source.sourceCommit
+        || !IMAGE.test(input.build.sourceBuild?.image ?? ''))
+        fail('invalid source build binding');
+    input.signal?.throwIfAborted();
+    const recorded = await readRsiBuildEnvironment({ dshHome: input.dshHome, profile: input.profile,
+        source: input.source, ...(input.signal ? { signal: input.signal } : {}) });
+    if (!isDeepStrictEqual(recorded, input.build))
+        fail('source build differs from recorded approved environment');
+    return recorded;
+}
+async function inputs(source) {
+    await io.directory(source.repository);
+    const contextFiles = ['package.json', 'pnpm-lock.yaml', 'pnpm-workspace.yaml',
+        'scripts/isolation/plugin-verifier.Dockerfile', 'scripts/isolation/plugin-observer-launcher.c'];
+    for (const folder of ['plugins', 'packages']) {
+        await io.directory(join(source.repository, folder), false);
+        for (const entry of await readdir(join(source.repository, folder), { withFileTypes: true })) {
+            if (!entry.isDirectory() || entry.isSymbolicLink())
+                continue;
+            const packageDirectory = join(source.repository, folder, entry.name);
+            await io.directory(packageDirectory, false);
+            const name = `${folder}/${entry.name}/package.json`;
+            try {
+                await lstat(join(source.repository, name));
+                contextFiles.push(name);
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+            }
+        }
+    }
+    contextFiles.sort();
+    if (contextFiles.length > 256)
+        fail('manifest count exceeds bound');
+    const files = new Map();
+    for (const name of [...contextFiles, ...Object.keys(FIXED)]) {
+        await io.directory(dirname(join(source.repository, name)), false);
+        files.set(name, await io.readStable(join(source.repository, name), 4_194_304));
+    }
+    for (const [name, expected] of Object.entries(FIXED)) {
+        if (digest(files.get(name)) !== expected)
+            fail(`trusted asset changed: ${name}`);
+    }
+    const manifest = JSON.parse(files.get('package.json').toString('utf8'));
+    if (manifest.name !== 'dsh-enhanced' || manifest.version !== source.version
+        || manifest.packageManager !== PACKAGE_MANAGER)
+        fail('root manifest differs from source cohort');
+    const raw = files.get('plugins/assistant-verifier/src/plugin-behavior-runner.ts').toString('utf8');
+    const fixedAsset = (name) => {
+        const begin = `/* DSH_PLUGIN_VERIFIER_${name}_START\n`;
+        const end = `\nDSH_PLUGIN_VERIFIER_${name}_END */`;
+        const first = raw.indexOf(begin), last = raw.indexOf(end, first + begin.length);
+        if (first < 0 || last < 0 || raw.indexOf(begin, first + 1) >= 0 || raw.indexOf(end, last + 1) >= 0)
+            fail(`fixed ${name.toLowerCase()} markers invalid`);
+        const content = raw.slice(first + begin.length, last) + '\n';
+        if (Buffer.byteLength(content) > 32_768)
+            fail(`fixed ${name.toLowerCase()} exceeds bound`);
+        return content;
+    };
+    const worker = fixedAsset('WORKER'), candidate = fixedAsset('CANDIDATE');
+    if (digest(worker) !== WORKER_SHA || digest(candidate) !== CANDIDATE_SHA)
+        fail('fixed worker content changed');
+    // The approved builder extracts marker bodies from this file. Keep the
+    // snapshot limited to those bodies, without the surrounding app source.
+    const extraction = (name, body) => `/* DSH_PLUGIN_VERIFIER_${name}_START\n${body.trimEnd()}\nDSH_PLUGIN_VERIFIER_${name}_END */\n`;
+    files.set('plugins/assistant-verifier/src/plugin-behavior-runner.ts', Buffer.from(extraction('WORKER', worker) + extraction('CANDIDATE', candidate)));
+    const hashes = Object.fromEntries([...files].map(([name, bytes]) => [name, digest(bytes)]));
+    const lockSha256 = digest(files.get('pnpm-lock.yaml'));
+    const contextDigest = digest(JSON.stringify({ contextFiles, hashes, lockSha256, workerSha256: WORKER_SHA, candidateSha256: CANDIDATE_SHA }));
+    return { files, hashes, contextFiles, contextDigest, lockSha256 };
+}
+async function snapshot(root, files) {
+    for (const [name, bytes] of files) {
+        const path = join(root, name);
+        await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+        await io.writeExclusive(path, bytes);
+    }
+}
+function parseOutput(raw, expected, sourceImage) {
+    if (Buffer.byteLength(raw) > 16_384)
+        fail('builder output exceeds bound');
+    const value = JSON.parse(raw);
+    if (!value || typeof value !== 'object' || Array.isArray(value)
+        || !isDeepStrictEqual(Object.keys(value).sort(), ['image', 'tag', 'sourceImage', 'lockSha256',
+            'workerSha256', 'candidateSha256', 'launcherSourceSha256', 'dockerfileSha256', 'contextFiles'].sort())
+        || typeof value.image !== 'string' || !IMAGE.test(value.image)
+        || value.sourceImage !== sourceImage || value.lockSha256 !== expected.lockSha256
+        || value.workerSha256 !== WORKER_SHA || value.candidateSha256 !== CANDIDATE_SHA
+        || value.launcherSourceSha256 !== FIXED['scripts/isolation/plugin-observer-launcher.c']
+        || value.dockerfileSha256 !== FIXED['scripts/isolation/plugin-verifier.Dockerfile']
+        || !isDeepStrictEqual(value.contextFiles, [...expected.contextFiles, 'worker.mjs', 'candidate.mjs'].sort()))
+        fail('builder output differs from frozen source inputs');
+    return value.image;
+}
+async function imageExists(dockerPath, image, scratch, signal) {
+    const actual = await io.command(dockerPath, ['image', 'inspect', '--format', '{{.Id}}', image], io.isolatedEnvironment(scratch), signal, 30_000, 4096);
+    if (actual !== image)
+        fail('Docker image content ID differs from receipt');
+}
+async function replay(final, input, expected, dockerSha256, scratch, signal) {
+    await io.directory(final);
+    if (!isDeepStrictEqual(await readdir(final), ['bootstrap.json']))
+        fail('behavior workspace incomplete or unexpected');
+    const value = JSON.parse((await io.readStable(join(final, 'bootstrap.json'), 65_536, true)).toString('utf8'));
+    const { receiptDigest, ...content } = value;
+    if (!isDeepStrictEqual(Object.keys(content).sort(), ['schemaVersion', 'sourceCommit', 'sourceImage', 'image',
+        'dockerPath', 'dshHome', 'profile', 'dockerSha256', 'inputHashes', 'contextFiles', 'contextDigest', 'lockSha256'].sort())
+        || value.schemaVersion !== 1 || digest(JSON.stringify(content)) !== receiptDigest
+        || value.dshHome !== input.dshHome || value.profile !== input.profile
+        || value.sourceCommit !== input.source.sourceCommit || value.sourceImage !== input.build.sourceBuild.image
+        || !IMAGE.test(value.image) || value.dockerPath !== input.build.sourceBuild.dockerPath
+        || value.dockerSha256 !== dockerSha256 || !isDeepStrictEqual(value.inputHashes, expected.hashes)
+        || !isDeepStrictEqual(value.contextFiles, expected.contextFiles)
+        || value.contextDigest !== expected.contextDigest || value.lockSha256 !== expected.lockSha256)
+        fail('behavior receipt differs from approved source, assets, or Docker client');
+    if (scratch && signal) {
+        await imageExists(value.dockerPath, value.sourceImage, scratch, signal);
+        await imageExists(value.dockerPath, value.image, scratch, signal);
+    }
+    signal?.throwIfAborted();
+    return { schemaVersion: 1, sourceCommit: value.sourceCommit, sourceImage: value.sourceImage,
+        image: value.image, dockerPath: value.dockerPath };
+}
+/** Verify frozen local inputs only. This reader never invokes Docker. */
+export async function readRsiCreationBuildEnvironment(input) {
+    await base(input);
+    const expected = await inputs(input.source);
+    const dockerSha256 = digest(await io.readStable(input.build.sourceBuild.dockerPath, 100_000_000, false, true));
+    const parent = join(input.dshHome, 'rsi-creation-builds'), final = join(parent, input.profile);
+    await io.directory(parent);
+    return replay(final, input, expected, dockerSha256, undefined, input.signal);
+}
+export async function readRsiCreationBuildInStage(input) {
+    if (!validPath(input.logicalHome) || !validPath(input.stagePhysicalHome)
+        || input.logicalHome === input.stagePhysicalHome || !PROFILE.test(input.profile)
+        || input.stagedSource.repository !== join(input.logicalHome, 'rsi-sources', input.profile, 'checkout')
+        || input.stagedSource.sourceCommit !== input.stagedBuild.sourceCommit) {
+        fail('staged creation binding differs');
+    }
+    const expected = await inputs({ ...input.stagedSource,
+        repository: join(input.stagePhysicalHome, 'rsi-sources', input.profile, 'checkout') });
+    const dockerSha256 = digest(await io.readStable(input.stagedBuild.sourceBuild.dockerPath, 100_000_000, false, true));
+    return replay(join(input.stagePhysicalHome, 'rsi-creation-builds', input.profile), { dshHome: input.logicalHome, profile: input.profile, source: input.stagedSource,
+        build: input.stagedBuild, ...(input.signal ? { signal: input.signal } : {}) }, expected, dockerSha256, undefined, input.signal);
+}
+/** Bind a freshly built candidate image to a stopped, copied Home. The old
+ * logical Home and the candidate receipt are never written by this operation. */
+export async function materializeRsiCreationBuildInStage(input) {
+    const { candidateHome, stagePhysicalHome, logicalHome, profile, signal } = input;
+    if (!validPath(candidateHome) || !validPath(stagePhysicalHome) || !validPath(logicalHome)
+        || !PROFILE.test(profile) || candidateHome === stagePhysicalHome || candidateHome === logicalHome
+        || stagePhysicalHome === logicalHome || input.candidateSource.sourceCommit !== input.stagedSource.sourceCommit
+        || input.candidateBuild.sourceCommit !== input.stagedBuild.sourceCommit
+        || input.stagedSource.repository !== join(logicalHome, 'rsi-sources', profile, 'checkout')) {
+        fail('staged creation binding differs from new candidate');
+    }
+    const candidateSeccompPath = join(candidateHome, 'rsi-builds', profile, 'seccomp.json');
+    const stagedSeccompPath = join(logicalHome, 'rsi-builds', profile, 'seccomp.json');
+    if (input.candidateBuild.sourceBuild.repositorySandbox?.seccompPath !== candidateSeccompPath
+        || input.stagedBuild.sourceBuild.repositorySandbox?.seccompPath !== stagedSeccompPath
+        || !isDeepStrictEqual(input.stagedBuild.sourceBuild, { ...input.candidateBuild.sourceBuild,
+            repositorySandbox: { ...input.candidateBuild.sourceBuild.repositorySandbox, seccompPath: stagedSeccompPath } })) {
+        fail('staged creation build differs outside the approved seccomp relocation');
+    }
+    const candidateBuildPath = join(candidateHome, 'rsi-builds', profile, 'bootstrap.json');
+    const candidateBuildBytes = await io.readStable(candidateBuildPath, 65_536, true);
+    const candidateSeccompBytes = await io.readStable(candidateSeccompPath, 65_536, true);
+    const candidateInput = { dshHome: candidateHome, profile, source: input.candidateSource,
+        build: input.candidateBuild, ...(signal ? { signal } : {}) };
+    const creationBuild = await readRsiCreationBuildEnvironment(candidateInput);
+    const stageBuildPath = join(stagePhysicalHome, 'rsi-builds', profile, 'bootstrap.json');
+    if (!candidateBuildBytes.equals(await io.readStable(candidateBuildPath, 65_536, true))
+        || !candidateSeccompBytes.equals(await io.readStable(candidateSeccompPath, 65_536, true))) {
+        fail('verified candidate build changed during relocation');
+    }
+    const candidateBuildReceipt = JSON.parse(candidateBuildBytes.toString('utf8'));
+    const stagedBuildReceipt = JSON.parse((await io.readStable(stageBuildPath, 65_536, true)).toString('utf8'));
+    const { receiptDigest: _candidateDigest, ...candidateBuildBody } = candidateBuildReceipt;
+    const expectedBuildBody = { ...candidateBuildBody, dshHome: logicalHome,
+        repository: input.stagedSource.repository, sourceBuild: input.stagedBuild.sourceBuild };
+    if (!isDeepStrictEqual(stagedBuildReceipt, { ...expectedBuildBody,
+        receiptDigest: digest(JSON.stringify(expectedBuildBody)) })
+        || !candidateSeccompBytes.equals(await io.readStable(join(stagePhysicalHome, 'rsi-builds', profile, 'seccomp.json'), 65_536, true))) {
+        fail('staged build receipt or seccomp differs from verified candidate');
+    }
+    const candidatePath = join(candidateHome, 'rsi-creation-builds', profile, 'bootstrap.json');
+    const candidateBytes = await io.readStable(candidatePath, 65_536, true);
+    const candidateReceipt = JSON.parse(candidateBytes.toString('utf8'));
+    const expected = await inputs({ ...input.stagedSource,
+        repository: join(stagePhysicalHome, 'rsi-sources', profile, 'checkout') });
+    if (!isDeepStrictEqual(expected.hashes, candidateReceipt.inputHashes)
+        || expected.contextDigest !== candidateReceipt.contextDigest
+        || expected.lockSha256 !== candidateReceipt.lockSha256
+        || !isDeepStrictEqual(expected.contextFiles, candidateReceipt.contextFiles)) {
+        fail('staged source inputs differ from freshly built behavior image');
+    }
+    const dockerSha256 = digest(await io.readStable(creationBuild.dockerPath, 100_000_000, false, true));
+    if (dockerSha256 !== candidateReceipt.dockerSha256)
+        fail('candidate Docker client changed');
+    const scratch = await mkdtemp(join(stagePhysicalHome, '.rsi-creation-verify-'));
+    try {
+        await chmod(scratch, 0o700);
+        await mkdir(join(scratch, 'docker-config'), { mode: 0o700 });
+        const deadline = AbortSignal.any([signal ?? new AbortController().signal, AbortSignal.timeout(120_000)]);
+        await imageExists(creationBuild.dockerPath, creationBuild.sourceImage, scratch, deadline);
+        await imageExists(creationBuild.dockerPath, creationBuild.image, scratch, deadline);
+    }
+    finally {
+        await rm(scratch, { recursive: true, force: true });
+    }
+    const content = { ...creationBuild, dshHome: logicalHome, profile, dockerSha256,
+        inputHashes: expected.hashes, contextFiles: expected.contextFiles,
+        contextDigest: expected.contextDigest, lockSha256: expected.lockSha256 };
+    const bytes = JSON.stringify({ ...content, receiptDigest: digest(JSON.stringify(content)) });
+    const directory = join(stagePhysicalHome, 'rsi-creation-builds', profile);
+    await io.directory(directory);
+    const oldPath = join(directory, 'bootstrap.json');
+    await io.readStable(oldPath, 65_536, true);
+    const temporary = join(directory, `.bootstrap-${process.pid}-${Date.now()}.json`);
+    try {
+        await io.writeExclusive(temporary, bytes);
+        await rename(temporary, oldPath);
+        await io.syncDirectory(directory);
+    }
+    finally {
+        await rm(temporary, { force: true });
+    }
+    if (!isDeepStrictEqual(await readRsiCreationBuildInStage({ logicalHome, stagePhysicalHome, profile,
+        stagedSource: input.stagedSource, stagedBuild: input.stagedBuild, ...(signal ? { signal } : {}) }), creationBuild)) {
+        fail('materialized behavior image did not replay in the stopped stage');
+    }
+    return { creationBuild, candidateReceiptSha256: digest(candidateBytes), receiptSha256: digest(bytes) };
+}
+/** Caller holds the DSH_HOME lifecycle lock. Build or replay an immutable image. */
+export async function prepareRsiCreationBuildEnvironment(input) {
+    if (process.platform !== 'linux' || process.arch !== 'x64')
+        fail('Linux x64 is required');
+    await base(input);
+    const expected = await inputs(input.source);
+    const dockerPath = input.build.sourceBuild.dockerPath;
+    const dockerSha256 = digest(await io.readStable(dockerPath, 100_000_000, false, true));
+    const parent = join(input.dshHome, 'rsi-creation-builds');
+    try {
+        await mkdir(parent, { mode: 0o700 });
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST')
+            throw error;
+    }
+    await io.directory(parent);
+    const final = join(parent, input.profile);
+    const signal = AbortSignal.any([input.signal ?? new AbortController().signal, AbortSignal.timeout(1_860_000)]);
+    const stage = await mkdtemp(join(parent, `.${input.profile}-stage-`));
+    await chmod(stage, 0o700);
+    let claimed;
+    try {
+        await mkdir(join(stage, 'docker-config'), { mode: 0o700 });
+        const version = await io.command(dockerPath, ['version', '--format', '{{.Server.Version}}/{{.Server.Os}}/{{.Server.Arch}}'], io.isolatedEnvironment(stage), signal, 10_000, 4096);
+        if (version !== '29.4.1/linux/amd64')
+            fail('Docker runtime version differs from approved runtime');
+        const present = await lstat(final).then(() => true, error => {
+            if (error.code === 'ENOENT')
+                return false;
+            throw error;
+        });
+        if (present)
+            return await replay(final, input, expected, dockerSha256, stage, signal);
+        await imageExists(dockerPath, input.build.sourceBuild.image, stage, signal);
+        const context = join(stage, 'source');
+        await mkdir(context, { mode: 0o700 });
+        await snapshot(context, expected.files);
+        const builder = join(context, 'scripts/isolation/build-plugin-verifier-image.mjs');
+        const raw = await io.command(process.execPath, [builder, '--docker-path', dockerPath,
+            '--source-image', input.build.sourceBuild.image, '--timeout-ms', '1800000'], { ...io.isolatedEnvironment(stage), TMPDIR: stage }, signal, 1_810_000);
+        const image = parseOutput(raw, expected, input.build.sourceBuild.image);
+        await imageExists(dockerPath, image, stage, signal);
+        await base(input);
+        const fresh = await inputs(input.source);
+        if (!isDeepStrictEqual(fresh.hashes, expected.hashes) || fresh.contextDigest !== expected.contextDigest)
+            fail('source inputs changed during behavior image build');
+        signal.throwIfAborted();
+        await mkdir(final, { mode: 0o700 });
+        const identity = await stat(final);
+        claimed = { dev: identity.dev, ino: identity.ino };
+        const result = { schemaVersion: 1, sourceCommit: input.source.sourceCommit,
+            sourceImage: input.build.sourceBuild.image, image, dockerPath };
+        const content = { ...result, dshHome: input.dshHome, profile: input.profile, dockerSha256,
+            inputHashes: expected.hashes, contextFiles: expected.contextFiles,
+            contextDigest: expected.contextDigest, lockSha256: expected.lockSha256 };
+        await io.writeExclusive(join(final, 'bootstrap.json'), JSON.stringify({ ...content, receiptDigest: digest(JSON.stringify(content)) }));
+        await io.syncDirectory(final);
+        await io.syncDirectory(parent);
+        return result;
+    }
+    catch (error) {
+        if (claimed) {
+            const current = await lstat(final).catch(() => undefined);
+            if (current?.isDirectory() && current.dev === claimed.dev && current.ino === claimed.ino
+                && (await readdir(final)).every(name => name === 'bootstrap.json'))
+                await rm(final, { recursive: true, force: true });
+        }
+        throw error;
+    }
+    finally {
+        await rm(stage, { recursive: true, force: true });
+        await io.syncDirectory(parent);
+    }
+}
+//# sourceMappingURL=rsi-creation-build.js.map

package/lib/rsi-creation-build.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-creation-build.js","sourceRoot":"","sources":["../src/rsi-creation-build.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAC1F,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAE,iBAAiB,IAAI,EAAE,EAAE,uBAAuB,EAA4B,MAAM,gBAAgB,CAAA;AAG3G,MAAM,MAAM,GAAG,iBAAiB,CAAA;AAChC,MAAM,KAAK,GAAG,wBAAwB,CAAA;AACtC,MAAM,OAAO,GAAG,oCAAoC,CAAA;AACpD,MAAM,eAAe,GAAG,aAAa,CAAA;AACrC,MAAM,KAAK,GAAG;IACZ,mDAAmD,EAAE,kEAAkE;IACvH,8CAA8C,EAAE,kEAAkE;IAClH,8CAA8C,EAAE,kEAAkE;IAClH,0DAA0D,EAAE,kEAAkE;CACtH,CAAA;AACV,MAAM,UAAU,GAAG,kEAAkE,CAAA;AACrF,MAAM,aAAa,GAAG,kEAAkE,CAAA;AA8BxF,SAAS,IAAI,CAAC,OAAe,IAAW,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC;AAC3F,SAAS,MAAM,CAAC,KAAsB,IAAY,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA,CAAC,CAAC;AAC3G,SAAS,SAAS,CAAC,KAAa,IAAa,OAAO,UAAU,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA,CAAC,CAAC;AAE5H,KAAK,UAAU,IAAI,CAAC,KAAY;IAC9B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;WACxD,KAAK,CAAC,MAAM,CAAC,aAAa,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC;WAC3E,KAAK,CAAC,KAAK,CAAC,aAAa,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,MAAM,CAAC,YAAY;WACzF,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;QAAE,IAAI,CAAC,8BAA8B,CAAC,CAAA;IAC5F,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;IAC9B,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO;QAC7F,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;IAC5E,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,yDAAyD,CAAC,CAAA;IAC9G,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,MAA0B;IAC9C,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACrC,MAAM,YAAY,GAAG,CAAC,cAAc,EAAE,gBAAgB,EAAE,qBAAqB;QAC3E,8CAA8C,EAAE,8CAA8C,CAAC,CAAA;IACjG,KAAK,MAAM,MAAM,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,CAAC;QAC7C,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,CAAA;QAC1D,KAAK,MAAM,KAAK,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC5F,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,cAAc,EAAE;gBAAE,SAAQ;YAC5D,MAAM,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;YACpE,MAAM,EAAE,CAAC,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAA;YAC3C,MAAM,IAAI,GAAG,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,eAAe,CAAA;YACnD,IAAI,CAAC;gBAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;gBAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAAC,CAAC;YAC3E,OAAO,KAAK,EAAE,CAAC;gBAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAA;YAAC,CAAC;QACvF,CAAC;IACH,CAAC;IACD,YAAY,CAAC,IAAI,EAAE,CAAA;IACnB,IAAI,YAAY,CAAC,MAAM,GAAG,GAAG;QAAE,IAAI,CAAC,8BAA8B,CAAC,CAAA;IACnE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAA;IACvC,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,YAAY,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QACjE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC,CAAA;IAChF,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,KAAK,QAAQ;YAAE,IAAI,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAA;IACnF,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAA;IACnG,IAAI,QAAQ,CAAC,IAAI,KAAK,cAAc,IAAI,QAAQ,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;WACtE,QAAQ,CAAC,cAAc,KAAK,eAAe;QAAE,IAAI,CAAC,0CAA0C,CAAC,CAAA;IAClG,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,0DAA0D,CAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IACnG,MAAM,UAAU,GAAG,CAAC,IAA4B,EAAU,EAAE;QAC1D,MAAM,KAAK,GAAG,0BAA0B,IAAI,UAAU,CAAA;QACtD,MAAM,GAAG,GAAG,yBAAyB,IAAI,SAAS,CAAA;QAClD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAA;QAC/E,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;YAChG,IAAI,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAA;QACrD,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,IAAI,CAAA;QAC5D,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,MAAM;YAAE,IAAI,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAA;QAC1F,OAAO,OAAO,CAAA;IAChB,CAAC,CAAA;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,EAAE,SAAS,GAAG,UAAU,CAAC,WAAW,CAAC,CAAA;IACxE,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,UAAU,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,aAAa;QAAE,IAAI,CAAC,8BAA8B,CAAC,CAAA;IAC9G,uEAAuE;IACvE,wEAAwE;IACxE,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE,CAAC,0BAA0B,IAAI,WAAW,IAAI,CAAC,OAAO,EAAE,yBAAyB,IAAI,WAAW,CAAA;IAClJ,KAAK,CAAC,GAAG,CAAC,0DAA0D,EAClE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,UAAU,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,CAAA;IACjF,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC3F,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAE,CAAC,CAAA;IACvD,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,CAAC,CAAC,CAAA;IAC5I,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,CAAA;AACnE,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,KAA0B;IAC9D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QAC7B,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC5D,MAAM,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACtC,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,GAAW,EAAE,QAAgB,EAAE,WAAmB;IACrE,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,MAAM;QAAE,IAAI,CAAC,8BAA8B,CAAC,CAAA;IACzE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAA;IACxD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;WAC1D,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,YAAY;YAC3F,cAAc,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,cAAc,CAAC,CAAC,IAAI,EAAE,CAAC;WACrG,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;WAC3D,KAAK,CAAC,WAAW,KAAK,WAAW,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;WAC7E,KAAK,CAAC,YAAY,KAAK,UAAU,IAAI,KAAK,CAAC,eAAe,KAAK,aAAa;WAC5E,KAAK,CAAC,oBAAoB,KAAK,KAAK,CAAC,8CAA8C,CAAC;WACpF,KAAK,CAAC,gBAAgB,KAAK,KAAK,CAAC,8CAA8C,CAAC;WAChF,CAAC,iBAAiB,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,GAAG,QAAQ,CAAC,YAAY,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3G,IAAI,CAAC,kDAAkD,CAAC,CAAA;IAC1D,OAAO,KAAK,CAAC,KAAK,CAAA;AACpB,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,UAAkB,EAAE,KAAa,EAAE,OAAe,EAAE,MAAmB;IAChG,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,EAC5F,EAAE,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;IACxD,IAAI,MAAM,KAAK,KAAK;QAAE,IAAI,CAAC,8CAA8C,CAAC,CAAA;AAC5E,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,KAAa,EAAE,KAAY,EAAE,QAAgB,EAAE,YAAoB,EACvF,OAAgB,EAAE,MAAoB;IACtC,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IACzB,IAAI,CAAC,iBAAiB,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC;QAAE,IAAI,CAAC,6CAA6C,CAAC,CAAA;IACrH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAA;IACxH,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,CAAA;IAC3C,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,EAAE,cAAc,EAAE,aAAa,EAAE,OAAO;QAC1G,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC;WACtH,KAAK,CAAC,aAAa,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,KAAK,aAAa;WAC9E,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;WAClE,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,MAAM,CAAC,YAAY,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK;WACvG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,UAAU;WACnF,KAAK,CAAC,YAAY,KAAK,YAAY,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC;WAC7F,CAAC,iBAAiB,CAAC,KAAK,CAAC,YAAY,EAAE,QAAQ,CAAC,YAAY,CAAC;WAC7D,KAAK,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;QAC7F,IAAI,CAAC,yEAAyE,CAAC,CAAA;IACjF,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;QACtB,MAAM,WAAW,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;QACvE,MAAM,WAAW,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;IACnE,CAAC;IACD,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW;QACzF,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAA;AACtD,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAAY;IAChE,MAAM,IAAI,CAAC,KAAK,CAAC,CAAA;IACjB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAC3C,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAA;IAC9G,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,qBAAqB,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IAC9F,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IAC1B,OAAO,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;AAC9E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAGjD;IACC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC;WACnE,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,iBAAiB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;WAC7E,KAAK,CAAC,YAAY,CAAC,UAAU,KAAK,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC;WACnG,KAAK,CAAC,YAAY,CAAC,YAAY,KAAK,KAAK,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;QACxE,IAAI,CAAC,iCAAiC,CAAC,CAAA;IACzC,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,EAAE,GAAG,KAAK,CAAC,YAAY;QACnD,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,aAAa,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC,CAAA;IACxF,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAA;IACpH,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,qBAAqB,EAAE,KAAK,CAAC,OAAO,CAAC,EAC/E,EAAE,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,YAAY;QAC9E,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAC/E,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;AACpD,CAAC;AAED;iFACiF;AACjF,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAIxD;IACC,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,CAAA;IAChF,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;WACpF,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,aAAa,KAAK,iBAAiB,IAAI,aAAa,KAAK,WAAW;WAC9F,iBAAiB,KAAK,WAAW,IAAI,KAAK,CAAC,eAAe,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,CAAC,YAAY;WAC3G,KAAK,CAAC,cAAc,CAAC,YAAY,KAAK,KAAK,CAAC,WAAW,CAAC,YAAY;WACpE,KAAK,CAAC,YAAY,CAAC,UAAU,KAAK,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;QAC7F,IAAI,CAAC,oDAAoD,CAAC,CAAA;IAC5D,CAAC;IACD,MAAM,oBAAoB,GAAG,IAAI,CAAC,aAAa,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,CAAC,CAAA;IACvF,MAAM,iBAAiB,GAAG,IAAI,CAAC,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,CAAC,CAAA;IAClF,IAAI,KAAK,CAAC,cAAc,CAAC,WAAW,CAAC,iBAAiB,EAAE,WAAW,KAAK,oBAAoB;WACvF,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,iBAAiB,EAAE,WAAW,KAAK,iBAAiB;WAClF,CAAC,iBAAiB,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,GAAG,KAAK,CAAC,cAAc,CAAC,WAAW;YACxF,iBAAiB,EAAE,EAAE,GAAG,KAAK,CAAC,cAAc,CAAC,WAAW,CAAC,iBAAiB,EAAE,WAAW,EAAE,iBAAiB,EAAE,EAAE,CAAC,EAAE,CAAC;QACpH,IAAI,CAAC,uEAAuE,CAAC,CAAA;IAC/E,CAAC;IACD,MAAM,kBAAkB,GAAG,IAAI,CAAC,aAAa,EAAE,YAAY,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAA;IACvF,MAAM,mBAAmB,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,kBAAkB,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;IACjF,MAAM,qBAAqB,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,oBAAoB,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;IACrF,MAAM,cAAc,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,eAAe;QACrF,KAAK,EAAE,KAAK,CAAC,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;IAC9D,MAAM,aAAa,GAAG,MAAM,+BAA+B,CAAC,cAAc,CAAC,CAAA;IAC3E,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,EAAE,YAAY,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAA;IACvF,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,kBAAkB,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;WACjF,CAAC,qBAAqB,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,oBAAoB,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QAC5F,IAAI,CAAC,oDAAoD,CAAC,CAAA;IAC5D,CAAC;IACD,MAAM,qBAAqB,GAAG,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAA;IACzG,MAAM,kBAAkB,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAA;IACtI,MAAM,EAAE,aAAa,EAAE,gBAAgB,EAAE,GAAG,kBAAkB,EAAE,GAAG,qBAAqB,CAAA;IACxF,MAAM,iBAAiB,GAAG,EAAE,GAAG,kBAAkB,EAAE,OAAO,EAAE,WAAW;QACrE,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,CAAA;IACzF,IAAI,CAAC,iBAAiB,CAAC,kBAAkB,EAAE,EAAE,GAAG,iBAAiB;QAC/D,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAC;WACxD,CAAC,qBAAqB,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,iBAAiB,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QACtI,IAAI,CAAC,iEAAiE,CAAC,CAAA;IACzE,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,EAAE,qBAAqB,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAA;IAC3F,MAAM,cAAc,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;IACvE,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAA;IAC/E,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,EAAE,GAAG,KAAK,CAAC,YAAY;QACnD,UAAU,EAAE,IAAI,CAAC,iBAAiB,EAAE,aAAa,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC,CAAA;IAC5E,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC,WAAW,CAAC;WAChE,QAAQ,CAAC,aAAa,KAAK,gBAAgB,CAAC,aAAa;WACzD,QAAQ,CAAC,UAAU,KAAK,gBAAgB,CAAC,UAAU;WACnD,CAAC,iBAAiB,CAAC,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9E,IAAI,CAAC,+DAA+D,CAAC,CAAA;IACvE,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAA;IACpG,IAAI,YAAY,KAAK,gBAAgB,CAAC,YAAY;QAAE,IAAI,CAAC,iCAAiC,CAAC,CAAA;IAC3F,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,CAAC,CAAA;IAC/E,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QAC3B,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC5D,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;QACxG,MAAM,WAAW,CAAC,aAAa,CAAC,UAAU,EAAE,aAAa,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAA;QACzF,MAAM,WAAW,CAAC,aAAa,CAAC,UAAU,EAAE,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAA;IACrF,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAAC,CAAC;IACjE,MAAM,OAAO,GAAG,EAAE,GAAG,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY;QAC7E,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY;QACjE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAA;IAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAA;IAC5F,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,EAAE,qBAAqB,EAAE,OAAO,CAAC,CAAA;IACzE,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAA;IACjD,MAAM,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;IAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,cAAc,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IACjF,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;QACzC,MAAM,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;QAChC,MAAM,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,CAAA;IACnC,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAAC,CAAC;IAClD,IAAI,CAAC,iBAAiB,CAAC,MAAM,2BAA2B,CAAC,EAAE,WAAW,EAAE,iBAAiB,EAAE,OAAO;QAChG,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC;QACrH,IAAI,CAAC,iEAAiE,CAAC,CAAA;IACzE,CAAC;IACD,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,CAAC,cAAc,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;AACxG,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,KAAY;IACnE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK;QAAE,IAAI,CAAC,uBAAuB,CAAC,CAAA;IACzF,MAAM,IAAI,CAAC,KAAK,CAAC,CAAA;IACjB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAC3C,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,UAAU,CAAA;IACrD,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAA;IACtF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAA;IACzD,IAAI,CAAC;QAAC,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAAC,CAAC;IAC5C,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAA;IAAC,CAAC;IACrF,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IACzC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;IAC9G,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC,CAAA;IACrE,MAAM,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IACzB,IAAI,OAAiD,CAAA;IACrD,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,eAAe,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC1D,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,qDAAqD,CAAC,EACzH,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;QACtD,IAAI,OAAO,KAAK,oBAAoB;YAAE,IAAI,CAAC,sDAAsD,CAAC,CAAA;QAClG,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE;YAC1D,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAA;YACpE,MAAM,KAAK,CAAA;QACb,CAAC,CAAC,CAAA;QACF,IAAI,OAAO;YAAE,OAAO,MAAM,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;QACrF,MAAM,WAAW,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;QAC3E,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;QACrC,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACrC,MAAM,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAA;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,mDAAmD,CAAC,CAAA;QAClF,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,eAAe,EAAE,UAAU;YAClF,gBAAgB,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,cAAc,EAAE,SAAS,CAAC,EAC7E,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;QACvE,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;QACvE,MAAM,WAAW,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;QACnD,MAAM,IAAI,CAAC,KAAK,CAAC,CAAA;QACjB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACxC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa;YACrG,IAAI,CAAC,mDAAmD,CAAC,CAAA;QAC3D,MAAM,CAAC,cAAc,EAAE,CAAA;QACvB,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACnC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;QAAC,OAAO,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAA;QACtF,MAAM,MAAM,GAAgC,EAAE,aAAa,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YACrG,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAA;QACjE,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,YAAY;YACvF,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY;YACjE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAA;QAC1E,MAAM,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QACtI,MAAM,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,CAAA;QAC7D,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;YACzD,IAAI,OAAO,EAAE,WAAW,EAAE,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG;mBACnF,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,gBAAgB,CAAC;gBAAE,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACzH,CAAC;QACD,MAAM,KAAK,CAAA;IACb,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,CAAA;IAAC,CAAC;AACjG,CAAC"}

package/lib/rsi-host-authorities.d.ts

@@ -0,0 +1,18 @@
+import { type PluginControlTrustConfig, type SourceAdoptionAuthorityConfig, type SystemdHostAuthorityConfig } from '@dsh-enhanced/plugin-control-plane';
+/** Read-only preflight for the standing Host grant. The CP validator owns its schema. */
+export declare function validateRsiHostAuthorities(input: {
+    trust: PluginControlTrustConfig;
+    adoption: SourceAdoptionAuthorityConfig;
+    owner: SystemdHostAuthorityConfig['grant']['owner'];
+    ledgerPath: string;
+    trustPath: string;
+    targetProfile: string;
+    liveQualification: unknown;
+    hostDeploymentInputs: unknown;
+    handoff: {
+        coordinatorId: string;
+    } | undefined;
+    environment?: NodeJS.ProcessEnv;
+    readPrivate(path: string): Promise<string>;
+}): Promise<void>;
+//# sourceMappingURL=rsi-host-authorities.d.ts.map

package/lib/rsi-host-authorities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-host-authorities.d.ts","sourceRoot":"","sources":["../src/rsi-host-authorities.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,KAAK,wBAAwB,EAAE,KAAK,6BAA6B,EAAE,KAAK,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AA6BhJ,yFAAyF;AACzF,wBAAsB,0BAA0B,CAAC,KAAK,EAAE;IACtD,KAAK,EAAE,wBAAwB,CAAA;IAC/B,QAAQ,EAAE,6BAA6B,CAAA;IACvC,KAAK,EAAE,0BAA0B,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAA;IACnD,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,EAAE,MAAM,CAAA;IACrB,iBAAiB,EAAE,OAAO,CAAA;IAC1B,oBAAoB,EAAE,OAAO,CAAA;IAC7B,OAAO,EAAE;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAA;IAC9C,WAAW,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;IAC/B,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CAC3C,GAAG,OAAO,CAAC,IAAI,CAAC,CA4EhB"}

package/lib/rsi-host-authorities.js

@@ -0,0 +1,129 @@
+import { createHash, createPrivateKey, createPublicKey } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { readFile, realpath, lstat } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
+import { inspectTrustedExecutable, resolveTrustKey, validateSystemdHostAuthorityConfig } from '@dsh-enhanced/plugin-control-plane';
+function fail(detail) { throw new Error(`rsi setup: systemd Host authority ${detail}`); }
+function exactFields(value, fields) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)
+        || !isDeepStrictEqual(Object.keys(value).sort(), [...fields].sort()))
+        fail('wrapper fields differ from runtime contract');
+}
+function hash(bytes) { return createHash('sha256').update(bytes).digest('hex'); }
+async function pinned(spec) {
+    await inspectTrustedExecutable(spec.path, spec.sha256);
+    return readFile(spec.path);
+}
+async function regularPin(spec, maximum = 268_435_456) {
+    if (await realpath(spec.path) !== spec.path)
+        fail('pinned file is not canonical');
+    const stat = await lstat(spec.path);
+    if (!stat.isFile() || stat.nlink !== 1 || stat.size > maximum || (stat.mode & 0o022) !== 0
+        || (stat.uid !== 0 && stat.uid !== process.getuid?.()) || hash(await readFile(spec.path)) !== spec.sha256)
+        fail('pinned file changed');
+}
+async function privateDirectory(path) {
+    if (await realpath(path) !== path)
+        fail('directory is not canonical');
+    const stat = await lstat(path);
+    if (!stat.isDirectory() || stat.uid !== process.getuid?.() || (stat.mode & 0o077) !== 0)
+        fail('directory is not owner-private');
+}
+/** Read-only preflight for the standing Host grant. The CP validator owns its schema. */
+export async function validateRsiHostAuthorities(input) {
+    const attestor = input.trust.hostAttestor;
+    const configPath = (input.environment ?? process.env).DSH_SYSTEMD_HOST_ATTESTOR_CONFIG;
+    const allowed = attestor.environmentAllowlist.includes('DSH_SYSTEMD_HOST_ATTESTOR_CONFIG');
+    if (!allowed)
+        return; // Existing owner-provisioned explicit request configs remain valid.
+    if (!configPath)
+        fail('config path is missing');
+    const wrapperSource = await input.readPrivate(configPath);
+    if (Buffer.byteLength(wrapperSource) > 65_536)
+        fail('wrapper config exceeds runtime limit');
+    const wrapper = JSON.parse(wrapperSource);
+    if ([1, 2, 3].includes(wrapper.schemaVersion))
+        return; // Existing explicit request configurations.
+    if (wrapper.schemaVersion !== 4)
+        fail('unknown wrapper schema');
+    exactFields(wrapper, ['schemaVersion', 'template', 'resolver']);
+    exactFields(wrapper.template, ['authority', 'keyId', 'privateKeyPath', 'stateRoot', 'executable', 'interpreter', 'processHelper',
+        'systemctl', 'scope', 'unit', 'unitProperties', 'timeoutMs', 'stableWindowMs', 'pollIntervalMs', 'readiness', 'recoveryReadiness']);
+    exactFields(wrapper.resolver, ['executable', 'interpreter', 'configPath', 'configSha256', 'timeoutMs']);
+    exactFields(wrapper.resolver.executable, ['path', 'sha256']);
+    if (wrapper.resolver.interpreter !== null)
+        exactFields(wrapper.resolver.interpreter, ['path', 'sha256']);
+    if (attestor.version !== 'dsh-systemd-host-attestor-8' || attestor.interpreter === null)
+        fail('trust does not select the standing wrapper');
+    const resolver = wrapper.resolver;
+    if (!Number.isSafeInteger(resolver.timeoutMs) || resolver.timeoutMs < 1000 || resolver.timeoutMs > 60_000
+        || resolver.timeoutMs + wrapper.template.timeoutMs >= attestor.timeoutMs)
+        fail('timeouts cannot cover resolver and Host operation');
+    const template = wrapper.template;
+    if (!isDeepStrictEqual({ authority: template.authority, keyId: template.keyId, executable: template.executable, interpreter: template.interpreter }, { authority: attestor.authority, keyId: attestor.keyId, executable: { path: attestor.path, sha256: attestor.sha256 }, interpreter: attestor.interpreter }))
+        fail('wrapper differs from trusted attestor');
+    if (template.unit !== `dsh-profile-${input.targetProfile}.service`)
+        fail('wrapper unit differs from target');
+    const wrapperBytes = await pinned(template.executable);
+    const nodeBytes = await pinned(template.interpreter);
+    if (!wrapperBytes.subarray(0, 2).equals(Buffer.from('#!')) || !nodeBytes.subarray(0, 4).equals(Buffer.from([0x7f, 0x45, 0x4c, 0x46]))
+        || wrapperBytes.toString('utf8', 0, 512).split('\n', 1)[0] !== `#!${template.interpreter.path}`)
+        fail('attestor interpreter cannot run pinned wrapper');
+    const version = spawnSync(template.interpreter.path, [template.executable.path, '--version'], { encoding: 'utf8', env: { LANG: 'C', LC_ALL: 'C' }, timeout: 5000, maxBuffer: 1024 });
+    if (version.error || version.status !== 0 || version.stdout.trim() !== attestor.version)
+        fail('pinned wrapper version cannot run');
+    await regularPin(template.processHelper, 1_048_576);
+    await pinned({ path: template.systemctl.path, sha256: template.systemctl.sha256 });
+    if (template.systemctl.interpreter)
+        await pinned(template.systemctl.interpreter);
+    await regularPin(template.readiness.client);
+    await regularPin(template.recoveryReadiness.client);
+    await pinned(resolver.executable);
+    const interpreterBytes = resolver.interpreter ? await pinned(resolver.interpreter) : await readFile(resolver.executable.path);
+    if (!interpreterBytes.subarray(0, 4).equals(Buffer.from([0x7f, 0x45, 0x4c, 0x46])))
+        fail('resolver requires a native pinned interpreter');
+    // The shipped script has a relative compiled import. Inspect it when selected,
+    // while preserving the runtime's native/custom resolver contract.
+    if (resolver.executable.path.endsWith('/bin/dsh-systemd-host-authority.js')) {
+        if (!resolver.interpreter)
+            fail('shipped resolver requires a native interpreter');
+        const node = spawnSync(resolver.interpreter.path, ['--input-type=module', '--eval', 'process.stdout.write(process.versions.node)'], { encoding: 'utf8', env: { LANG: 'C', LC_ALL: 'C' }, timeout: 5000, maxBuffer: 1024 });
+        if (node.error || node.status !== 0 || !/^\d+\.\d+\.\d+$/u.test(node.stdout))
+            fail('pinned interpreter cannot run shipped resolver');
+        const syntax = spawnSync(resolver.interpreter.path, ['--check', resolver.executable.path], { encoding: 'utf8', env: { LANG: 'C', LC_ALL: 'C' }, timeout: 5000, maxBuffer: 1024 });
+        if (syntax.error || syntax.status !== 0)
+            fail('pinned interpreter cannot parse shipped resolver');
+        const resolverModule = join(dirname(resolver.executable.path), '../lib/systemd-host-authority.js');
+        if (await realpath(resolverModule) !== resolverModule || !(await lstat(resolverModule)).isFile())
+            fail('resolver module is unavailable');
+    }
+    await privateDirectory(dirname(configPath));
+    await privateDirectory(dirname(resolver.configPath));
+    const bytes = await input.readPrivate(resolver.configPath);
+    if (Buffer.byteLength(bytes) > 65_536)
+        fail('resolver config exceeds runtime limit');
+    if (hash(bytes) !== resolver.configSha256)
+        fail('resolver config pin changed');
+    const config = JSON.parse(bytes);
+    validateSystemdHostAuthorityConfig(config);
+    if (!isDeepStrictEqual(config.template, template) || config.trustPath !== input.trustPath
+        || config.controlDatabasePath !== input.ledgerPath || config.grant.profile.name !== input.targetProfile
+        || config.grant.profile.path !== input.adoption.grant.target.profilePath
+        || !isDeepStrictEqual(config.grant.owner, input.owner)
+        || !isDeepStrictEqual([...config.grant.packages].sort(), input.adoption.grant.policies.map(policy => policy.packageName).sort())
+        || config.grant.coordinatorId !== input.handoff?.coordinatorId
+        || !isDeepStrictEqual(config.grant.liveQualification, input.liveQualification)
+        || !isDeepStrictEqual(config.grant.hostDeploymentInputs, input.hostDeploymentInputs)
+        || !isDeepStrictEqual(config.grant.hostDeploymentInputs, input.adoption.grant.hostDeploymentInputs)
+        || config.grant.expiresAt <= Date.now()
+        || config.grant.notBefore > Date.now())
+        fail('grant deployment terms differ');
+    const trusted = resolveTrustKey(input.trust, 'host-attestation', template.authority, template.keyId);
+    const key = createPublicKey(createPrivateKey(await input.readPrivate(template.privateKeyPath))).export({ type: 'spki', format: 'der' });
+    if (!key.equals(createPublicKey(trusted.publicKeyPem).export({ type: 'spki', format: 'der' })))
+        fail('signing key differs from trust');
+    await privateDirectory(template.stateRoot);
+    await privateDirectory(dirname(config.statePath));
+}
+//# sourceMappingURL=rsi-host-authorities.js.map

package/lib/rsi-host-authorities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-host-authorities.js","sourceRoot":"","sources":["../src/rsi-host-authorities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAC3E,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AAC5D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,kCAAkC,EACgB,MAAM,oCAAoC,CAAA;AAOhJ,SAAS,IAAI,CAAC,MAAc,IAAW,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,EAAE,CAAC,CAAA,CAAC,CAAC;AACvG,SAAS,WAAW,CAAC,KAAc,EAAE,MAAyB;IAC5D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;WAC1D,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAAE,IAAI,CAAC,6CAA6C,CAAC,CAAA;AAC7H,CAAC;AACD,SAAS,IAAI,CAAC,KAAsB,IAAY,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA,CAAC,CAAC;AACzG,KAAK,UAAU,MAAM,CAAC,IAAS;IAC7B,MAAM,wBAAwB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IACtD,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC5B,CAAC;AACD,KAAK,UAAU,UAAU,CAAC,IAAS,EAAE,OAAO,GAAG,WAAW;IACxD,IAAI,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI;QAAE,IAAI,CAAC,8BAA8B,CAAC,CAAA;IACjF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACnC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;WACrF,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM;QAAE,IAAI,CAAC,qBAAqB,CAAC,CAAA;AAC1I,CAAC;AACD,KAAK,UAAU,gBAAgB,CAAC,IAAY;IAC1C,IAAI,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI;QAAE,IAAI,CAAC,4BAA4B,CAAC,CAAA;IACrE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;IAC9B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,gCAAgC,CAAC,CAAA;AACjI,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAYhD;IACC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,YAAa,CAAA;IAC1C,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,gCAAgC,CAAA;IACtF,MAAM,OAAO,GAAG,QAAQ,CAAC,oBAAoB,CAAC,QAAQ,CAAC,kCAAkC,CAAC,CAAA;IAC1F,IAAI,CAAC,OAAO;QAAE,OAAM,CAAC,oEAAoE;IACzF,IAAI,CAAC,UAAU;QAAE,IAAI,CAAC,wBAAwB,CAAC,CAAA;IAC/C,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;IACzD,IAAI,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,GAAG,MAAM;QAAE,IAAI,CAAC,sCAAsC,CAAC,CAAA;IAC3F,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAY,CAAA;IACpD,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC;QAAE,OAAM,CAAC,4CAA4C;IAClG,IAAI,OAAO,CAAC,aAAa,KAAK,CAAC;QAAE,IAAI,CAAC,wBAAwB,CAAC,CAAA;IAC/D,WAAW,CAAC,OAAO,EAAE,CAAC,eAAe,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAA;IAC/D,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe;QAC9H,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,WAAW,EAAE,mBAAmB,CAAC,CAAC,CAAA;IACrI,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC,CAAA;IACvG,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;IAC5D,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,KAAK,IAAI;QAAE,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;IACxG,IAAI,QAAQ,CAAC,OAAO,KAAK,6BAA6B,IAAI,QAAQ,CAAC,WAAW,KAAK,IAAI;QAAE,IAAI,CAAC,4CAA4C,CAAC,CAAA;IAC3I,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;IACjC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,SAAS,GAAG,IAAI,IAAI,QAAQ,CAAC,SAAS,GAAG,MAAM;WACpG,QAAQ,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS;QAAE,IAAI,CAAC,mDAAmD,CAAC,CAAA;IACrI,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;IACjC,IAAI,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,EACjJ,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC;QAAE,IAAI,CAAC,uCAAuC,CAAC,CAAA;IAC3M,IAAI,QAAQ,CAAC,IAAI,KAAK,eAAe,KAAK,CAAC,aAAa,UAAU;QAAE,IAAI,CAAC,kCAAkC,CAAC,CAAA;IAC5G,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;IACtD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IACpD,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;WAChI,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE;QAAE,IAAI,CAAC,gDAAgD,CAAC,CAAA;IACzJ,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,EAC1F,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACxF,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,QAAQ,CAAC,OAAO;QAAE,IAAI,CAAC,mCAAmC,CAAC,CAAA;IAClI,MAAM,UAAU,CAAC,QAAQ,CAAC,aAAa,EAAE,SAAS,CAAC,CAAA;IACnD,MAAM,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAA;IAClF,IAAI,QAAQ,CAAC,SAAS,CAAC,WAAW;QAAE,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;IAChF,MAAM,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IAC3C,MAAM,UAAU,CAAC,QAAQ,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;IACnD,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;IACjC,MAAM,gBAAgB,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;IAC7H,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,+CAA+C,CAAC,CAAA;IACzI,+EAA+E;IAC/E,kEAAkE;IAClE,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,oCAAoC,CAAC,EAAE,CAAC;QAC5E,IAAI,CAAC,QAAQ,CAAC,WAAW;YAAE,IAAI,CAAC,gDAAgD,CAAC,CAAA;QACjF,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,qBAAqB,EAAE,QAAQ,EAAE,6CAA6C,CAAC,EAChI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACxF,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,gDAAgD,CAAC,CAAA;QACpI,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EACvF,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACxF,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,IAAI,CAAC,kDAAkD,CAAC,CAAA;QACjG,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,kCAAkC,CAAC,CAAA;QAClG,IAAI,MAAM,QAAQ,CAAC,cAAc,CAAC,KAAK,cAAc,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE;YAAE,IAAI,CAAC,gCAAgC,CAAC,CAAA;IAC1I,CAAC;IACD,MAAM,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAA;IAC3C,MAAM,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAA;IACpD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;IAC1D,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,MAAM;QAAE,IAAI,CAAC,uCAAuC,CAAC,CAAA;IACpF,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,YAAY;QAAE,IAAI,CAAC,6BAA6B,CAAC,CAAA;IAC9E,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IACzC,kCAAkC,CAAC,MAAM,CAAC,CAAA;IAC1C,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;WACpF,MAAM,CAAC,mBAAmB,KAAK,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,aAAa;WACpG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW;WACrE,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC;WACnD,CAAC,iBAAiB,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;WAC7H,MAAM,CAAC,KAAK,CAAC,aAAa,KAAK,KAAK,CAAC,OAAO,EAAE,aAAa;WAC3D,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,CAAC;WAC3E,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,CAAC;WACjF,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,oBAAoB,CAAC;WAChG,MAAM,CAAC,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;WACpC,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,IAAI,CAAC,+BAA+B,CAAC,CAAA;IAC/E,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,EAAE,kBAAkB,EAAE,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAA;IACpG,MAAM,GAAG,GAAG,eAAe,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;IACvI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAAE,IAAI,CAAC,gCAAgC,CAAC,CAAA;IACtI,MAAM,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IAC1C,MAAM,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAA;AACnD,CAAC"}