@dsh-enhanced/lark-channel 0.1.48 → 0.1.49

package/lib/rsi-local-activation.js

@@ -0,0 +1,485 @@
+import { createHash, createPublicKey, verify } from 'node:crypto';
+import { lstat, readdir, realpath } from 'node:fs/promises';
+import { isAbsolute, join, resolve, sep } from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
+import { ControlPlaneDatabaseError, ControlPlaneStore, controlPlaneDigest, hostMaintenanceCanonical, hostMaintenanceDigest, signSourceMaintenanceRecord, sourceBaselineChain, sourceMaintenanceDigest, verifySourceMaintenanceRecords } from '@dsh-enhanced/plugin-control-plane';
+import { rsiBuildResources as io } from './rsi-build.js';
+import { isMap, isScalar, isSeq, parseDocument } from 'yaml';
+import { prepareRsiAuthorityResources } from './rsi-authority-resources.js';
+import { readRsiLocalCohort, verifyRsiLocalInstalledPackages } from './rsi-local-cohort.js';
+import { assertRsiLocalProfileRoots } from './rsi-local-profile-update.js';
+import { readRsiSourceMaintenance } from './rsi-source-maintenance.js';
+const HASH = /^[a-f0-9]{64}$/u;
+const PROFILE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
+function fail(message) { throw new Error(`rsi local activation: ${message}`); }
+function canonical(path) { return typeof path === 'string' && isAbsolute(path) && resolve(path) === path && !path.includes('\0'); }
+function inside(root, path) { return path === root || path.startsWith(`${root}${sep}`); }
+async function privateHostKey(path) {
+    const item = await lstat(path);
+    if (!item.isFile() || item.isSymbolicLink() || item.nlink !== 1 || item.size < 1 || item.size > 16_384
+        || (item.mode & 0o077) !== 0 || process.getuid && item.uid !== process.getuid())
+        fail(`unsafe Host key: ${path}`);
+    return (await io.readStable(path, 16_384, true)).toString('utf8');
+}
+const COORDINATOR_BUNDLES = ['assistant-policy', 'assistant-automations', 'plugin-control-plane'];
+function emptyConfiguration(source, path) {
+    const document = parseDocument(source, { uniqueKeys: true,
+        customTags: [{ tag: 'tag:yaml.org,2002:js', resolve: (value) => value }] });
+    if (document.errors.length || document.warnings.length || !isSeq(document.contents) || document.contents.items.length) {
+        fail(`prepared coordinator configuration is not inert: ${path}`);
+    }
+}
+async function assertPreparedCoordinator(input, home, coordinator, receiptPath, receipt, cohort) {
+    const profileRoot = join(home, 'profiles', coordinator);
+    await io.directory(profileRoot, false);
+    if (!isDeepStrictEqual((await readdir(profileRoot)).sort(), ['cordis.patch.yml', 'cordis.yml', 'node_modules', 'package.json', 'pnpm-lock.yaml', 'pnpm-workspace.yaml'].sort())) {
+        fail(`prepared coordinator profile layout differs: ${profileRoot}`);
+    }
+    if (!(await io.readStable(receiptPath, 65_536, true)).equals(receipt))
+        fail('prepared coordinator receipt changed');
+    for (const name of ['cordis.yml', 'cordis.patch.yml']) {
+        const path = join(profileRoot, name);
+        const bytes = await io.readStable(path, 2_097_152);
+        emptyConfiguration(bytes.toString('utf8'), path);
+        if (home !== input.logicalHome && !(await io.readStable(join(input.logicalHome, 'profiles', coordinator, name), 2_097_152)).equals(bytes)) {
+            fail(`prepared coordinator configuration changed in stage: ${path}`);
+        }
+    }
+    for (const name of ['package.json', 'pnpm-workspace.yaml', 'pnpm-lock.yaml']) {
+        const path = join(profileRoot, name), bytes = await io.readStable(path, 16_777_216);
+        if (home !== input.logicalHome && !(await io.readStable(join(input.logicalHome, 'profiles', coordinator, name), 16_777_216)).equals(bytes)) {
+            fail(`prepared coordinator installation changed in stage: ${path}`);
+        }
+        if (name === 'package.json')
+            assertRsiLocalProfileRoots({ source: bytes.toString('utf8'), cohort, bundles: COORDINATOR_BUNDLES });
+    }
+    await verifyRsiLocalInstalledPackages({ cohort, profilePath: profileRoot, bundles: COORDINATOR_BUNDLES });
+}
+async function assertAbsent(path) {
+    try {
+        await lstat(path);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return;
+        throw error;
+    }
+    fail(`pre-owner residue exists: ${path}`);
+}
+async function optionalBytes(path, maximum, privateMode = true) {
+    try {
+        await lstat(path);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return;
+        throw error;
+    }
+    const item = await lstat(path);
+    if (!item.isFile() || item.isSymbolicLink() || item.nlink !== 1 || item.size < 1
+        || item.size > maximum || (item.mode & 0o022) !== 0 || await realpath(path) !== path)
+        fail(`unsafe pre-owner file: ${path}`);
+    return io.readStable(path, maximum, privateMode);
+}
+const PRE_OWNER_FIELDS = new Set(['sourceJobs', 'sourceApprovals', 'sourceReleases', 'sourceReleaseExecution',
+    'sourceAdoptions', 'sourceBuild', 'runtimeObserver', 'foregroundDeployments', 'taskObservations', 'adoptionCoordinator',
+    'memoryReviews', 'automaticLearning']);
+function assertPreOwnerConfiguration(source, path, authorityConfig) {
+    const document = parseDocument(source, { uniqueKeys: true,
+        customTags: [{ tag: 'tag:yaml.org,2002:js', resolve: (value) => value }] });
+    if (document.errors.length || document.warnings.length || !isSeq(document.contents))
+        throw new Error(`rsi local activation: pre-owner configuration layer is invalid: ${path}`);
+    const inspect = (node) => {
+        if (isScalar(node)) {
+            const value = node.value;
+            if (typeof value === 'string' && value.includes(authorityConfig))
+                fail(`pre-owner layer references owner authority configuration: ${path}`);
+            if (node.tag === 'tag:yaml.org,2002:js' && typeof value === 'string'
+                && [...PRE_OWNER_FIELDS].some(field => new RegExp(`\\b${field}\\b`, 'u').test(value)))
+                fail(`pre-owner dynamic owner configuration is unsupported: ${path}`);
+        }
+        else if (isMap(node))
+            for (const pair of node.items) {
+                const key = isScalar(pair.key) ? pair.key.value : undefined;
+                const value = isScalar(pair.value) ? pair.value.value : pair.value;
+                if (typeof key === 'string' && PRE_OWNER_FIELDS.has(key) && value !== null && value !== false)
+                    fail(`pre-owner layer contains owner source configuration: ${path}`);
+                inspect(pair.key);
+                inspect(pair.value);
+            }
+        else if (isSeq(node))
+            node.items.forEach(inspect);
+    };
+    for (const row of document.contents.items) {
+        if (!isMap(row))
+            fail(`pre-owner dynamic or non-mapping row is unsupported: ${path}`);
+        const identity = ['name', 'module', 'id'].map(key => row.get(key, true))
+            .filter(isScalar).map(node => String(node.value)).join(' ');
+        if (/rsi-setup-/u.test(identity))
+            fail(`pre-owner layer contains an RSI owner row: ${path}`);
+        if (/cordis-plugin-(?:include|loader)/u.test(identity))
+            fail(`pre-owner include or Loader override is unsupported: ${path}`);
+        const config = row.get('config', true);
+        if (identity.includes('assistant-memory-learning') && (row.get('disabled') !== true || config !== undefined)) {
+            fail(`pre-owner memory learner is not inert: ${path}`);
+        }
+        if (identity.includes('plugin-control-plane') && isScalar(config) && config.tag === 'tag:yaml.org,2002:js')
+            fail(`pre-owner dynamic control-plane configuration is unsupported: ${path}`);
+        inspect(row);
+    }
+}
+/** Read-only absence proof for an installation whose authority bootstrap exists
+ * but owner grants and control ledger have never been installed. The explicit
+ * preparedCoordinator path accepts only the inert, receipt-bound original pair.
+ * It neither creates a ledger nor interprets arbitrary partial setup as fresh.
+ * Only Home/profile cordis.yml and cordis.patch.yml layers are supported.
+ * Alternate formats, dynamic owner rows/config, includes and explicit CLI
+ * overlays are rejected. The outer transaction must verify the effective
+ * graph and launch arguments, and owns package/Git materialization checks. */
+export async function assertRsiPreOwnerInstallation(input) {
+    if (!canonical(input.logicalHome) || !canonical(input.physicalHome) || !PROFILE.test(input.profile))
+        fail('invalid pre-owner Home or profile');
+    const signal = AbortSignal.any([input.signal ?? new AbortController().signal, AbortSignal.timeout(180_000)]);
+    signal.throwIfAborted();
+    if (input.extraPatchFiles?.length)
+        fail('pre-owner external --patch overrides are unsupported');
+    if (await realpath(input.logicalHome) !== input.logicalHome || await realpath(input.physicalHome) !== input.physicalHome)
+        fail('pre-owner Homes must be physical');
+    const live = await readRsiSourceMaintenance({ logicalHome: input.logicalHome, physicalHome: input.logicalHome, profile: input.profile, signal });
+    if (input.anchor && controlPlaneDigest(input.anchor) !== controlPlaneDigest(live.anchor))
+        fail('pre-owner installation anchor changed');
+    const resources = await prepareRsiAuthorityResources({ dshHome: input.logicalHome, profile: input.profile, existingOnly: true, signal });
+    if (resources.installationId !== live.anchor.installationId || resources.ledgerId !== live.anchor.ledger.id
+        || controlPlaneDigest(resources.identities.host.publicKeyPem) !== controlPlaneDigest(live.anchor.hostIdentity.publicKeyPem))
+        fail('pre-owner authority anchor changed');
+    const digest = (bytes) => createHash('sha256').update(bytes).digest('hex');
+    const authorityRelative = join('rsi-authorities', input.profile);
+    const sourceRelative = join('rsi-sources', input.profile);
+    const authorityBootstrap = await io.readStable(join(input.logicalHome, authorityRelative, 'bootstrap.json'), 65_536, true);
+    const sourceBootstrap = await io.readStable(join(input.logicalHome, sourceRelative, 'bootstrap.json'), 65_536, true);
+    const profileDigest = createHash('sha256').update(input.profile).digest('hex');
+    const coordinator = `rsi-${input.profile.slice(0, 43)}-${profileDigest.slice(0, 12)}`;
+    const markerName = `.rsi-coordinator-${profileDigest.slice(0, 16)}.json`;
+    const originalCohort = input.preparedCoordinator === true
+        ? await readRsiLocalCohort({ dshHome: input.logicalHome, profile: input.profile }) : undefined;
+    const marker = input.preparedCoordinator === true
+        ? await io.readStable(join(input.logicalHome, markerName), 65_536, true) : undefined;
+    if (originalCohort && marker) {
+        let parsed;
+        try {
+            parsed = JSON.parse(marker.toString('utf8'));
+        }
+        catch {
+            fail('prepared coordinator receipt is invalid');
+        }
+        if (!isDeepStrictEqual(parsed, { schemaVersion: 1, targetProfile: input.profile, coordinatorProfile: coordinator,
+            version: originalCohort.version, sourceRepository: originalCohort.sourceRepository })) {
+            fail('prepared coordinator receipt differs from the frozen cohort');
+        }
+    }
+    for (const home of new Set([input.logicalHome, input.physicalHome])) {
+        signal.throwIfAborted();
+        const authority = join(home, authorityRelative);
+        await io.directory(authority);
+        await io.directory(join(home, sourceRelative));
+        if ((await readdir(authority)).sort().join(',') !== 'bootstrap.json,catalog.json,config,identities,registry,state')
+            fail(`pre-owner authority layout differs: ${authority}`);
+        for (const name of ['config', 'state', 'registry']) {
+            const directory = join(authority, name);
+            await io.directory(directory);
+            const entries = (await readdir(directory)).sort();
+            if (name === 'state' && marker && isDeepStrictEqual(entries, ['creation-adoption-runner', 'creation-review-runner'])) {
+                for (const entry of entries) {
+                    const child = join(directory, entry);
+                    await io.directory(child);
+                    if ((await readdir(child)).length)
+                        fail(`pre-owner state is not empty: ${child}`);
+                }
+            }
+            else if (entries.length)
+                fail(`pre-owner ${name} is not empty: ${directory}`);
+        }
+        const catalog = JSON.parse((await io.readStable(join(authority, 'catalog.json'), 2_097_152, true)).toString('utf8'));
+        if (controlPlaneDigest(catalog) !== controlPlaneDigest({ schemaVersion: 1, entries: [] }))
+            fail(`pre-owner catalog is not empty: ${authority}`);
+        if (!(await io.readStable(join(authority, 'bootstrap.json'), 65_536, true)).equals(authorityBootstrap)
+            || !(await io.readStable(join(home, sourceRelative, 'bootstrap.json'), 65_536, true)).equals(sourceBootstrap))
+            fail('pre-owner live and staged bootstraps differ');
+        const keys = join(authority, 'identities');
+        await io.directory(keys);
+        if ((await readdir(keys)).sort().join(',') !== Object.keys(resources.identities).map(role => `${role}.pem`).sort().join(','))
+            fail('pre-owner signing identities differ');
+        for (const [role, identity] of Object.entries(resources.identities)) {
+            const actual = await privateHostKey(join(keys, `${role}.pem`));
+            const expected = await privateHostKey(identity.keyPath);
+            if (actual !== expected)
+                fail(`pre-owner signing identity differs: ${role}`);
+        }
+        for (const path of [join(home, 'rsi-coordinators', coordinator), join(home, 'rsi-authorities', coordinator),
+            join(home, '.rsi-setup-journal.json')])
+            await assertAbsent(path);
+        try {
+            const coordinators = join(home, 'rsi-coordinators');
+            await io.directory(coordinators);
+            if ((await readdir(coordinators)).length)
+                fail(`unknown coordinator state: ${coordinators}`);
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        for (const name of await readdir(home)) {
+            if (name.startsWith('.rsi-coordinator-') && (!marker || name !== markerName))
+                fail(`unknown coordinator marker: ${name}`);
+        }
+        if (marker && originalCohort) {
+            await assertPreparedCoordinator(input, home, coordinator, join(home, markerName), marker, originalCohort);
+            const targetRoot = join(home, 'profiles', input.profile);
+            const targetManifest = await io.readStable(join(targetRoot, 'package.json'), 2_097_152);
+            assertRsiLocalProfileRoots({ source: targetManifest.toString('utf8'), cohort: originalCohort,
+                bundles: originalCohort.bundles });
+            if (home !== input.logicalHome && !(await io.readStable(join(input.logicalHome, 'profiles', input.profile, 'package.json'), 2_097_152)).equals(targetManifest))
+                fail('prepared target profile manifest changed in stage');
+            await verifyRsiLocalInstalledPackages({ cohort: originalCohort, profilePath: targetRoot,
+                bundles: originalCohort.bundles });
+        }
+        else {
+            await assertAbsent(join(home, 'profiles', coordinator));
+            await assertAbsent(join(home, markerName));
+        }
+        const profileRoot = join(home, 'profiles', input.profile);
+        for (const root of [home, profileRoot]) {
+            for (const name of ['cordis.yaml', 'cordis.patch.yaml', 'cordis.json', 'cordis.patch.json']) {
+                const unsupported = await optionalBytes(join(root, name), 2_097_152, false);
+                if (unsupported)
+                    fail(`pre-owner configuration layer is unsupported: ${join(root, name)}`);
+            }
+            for (const name of ['cordis.patch.yml', 'cordis.yml']) {
+                const path = join(root, name), bytes = await optionalBytes(path, 2_097_152, false);
+                if (bytes)
+                    assertPreOwnerConfiguration(bytes.toString('utf8'), path, join(input.logicalHome, authorityRelative, 'config'));
+            }
+        }
+    }
+    const sidecar = await optionalBytes(join(input.physicalHome, sourceRelative, 'maintenance.json'), 4_194_304);
+    const parsed = sidecar ? JSON.parse(sidecar.toString('utf8')) : [];
+    if (!Array.isArray(parsed) || parsed.length > 256 || sidecar && !parsed.length)
+        fail('pre-owner source maintenance sidecar is invalid');
+    const records = verifySourceMaintenanceRecords(parsed, live.anchor);
+    const expected = input.records ?? live.records;
+    verifySourceMaintenanceRecords(expected, live.anchor);
+    if (expected.length < live.records.length || expected.length > live.records.length + 1
+        || live.records.some((record, index) => sourceMaintenanceDigest(record) !== sourceMaintenanceDigest(expected[index])))
+        fail('pre-owner live sidecar changed or staged chain does not extend it');
+    if (records.some(record => record.host !== null) || live.records.some(record => record.host !== null)
+        || expected.some(record => record.host !== null))
+        fail('pre-owner maintenance contains owner Host activation evidence');
+    if (controlPlaneDigest(records) !== controlPlaneDigest(expected))
+        fail('pre-owner sidecar differs from the expected maintenance chain');
+    const sourceChainTip = sourceBaselineChain(live.anchor.baseline, [], records).at(-1);
+    sourceBaselineChain(live.anchor.baseline, [], live.records);
+    signal.throwIfAborted();
+    return { mode: 'pre-owner', anchor: live.anchor, records, workspace: live.workspace, sourceChainTip,
+        originalBootstrapDigest: live.originalBootstrapDigest, authorityBootstrapDigest: digest(authorityBootstrap),
+        ...(marker && originalCohort ? { preparedCoordinator: { profile: coordinator, receiptDigest: digest(marker),
+                cohortDigest: originalCohort.receiptDigest } } : {}) };
+}
+function openReadOnlyLedger(path, label) {
+    try {
+        return new ControlPlaneStore({ path, readOnly: true });
+    }
+    catch (error) {
+        if (error instanceof ControlPlaneDatabaseError)
+            fail(`${label} control ledger is unavailable: ${error.message}`);
+        throw error;
+    }
+}
+function sameActivationState(left, right) {
+    return left.kind === right.kind && (left.kind !== 'watched' || left.planId === right.planId);
+}
+function watchedDeployment(store, input, state) {
+    const context = store.currentRuntimeEpochDeployment(join(input.logicalHome, 'profiles', input.profile));
+    const { plan, readiness } = context, receipt = readiness.receipt, anchor = input.live.anchor;
+    if (!receipt)
+        throw new Error('rsi local activation: runtime epoch readiness receipt is absent');
+    if (plan.id !== state.planId || plan.installationId !== anchor.installationId
+        || controlPlaneDigest(plan.ledger) !== controlPlaneDigest(anchor.ledger)
+        || plan.target.dshHome !== input.logicalHome || plan.profile !== input.profile
+        || receipt.authority !== anchor.hostIdentity.authority || receipt.keyId !== anchor.hostIdentity.keyId) {
+        fail('watched readiness was not issued by the installed Host identity or deployment');
+    }
+    const { signature, ...unsigned } = receipt;
+    if (!verify(null, Buffer.from(hostMaintenanceCanonical(unsigned)), createPublicKey(anchor.hostIdentity.publicKeyPem), Buffer.from(signature, 'base64')))
+        fail('watched original Host readiness signature changed');
+    return context;
+}
+/**
+ * Derive the next Host-signed source maintenance record for a frozen local
+ * update, without mutating anything. The caller applies it to the stopped stage
+ * and appends it to the staged ledger as one owned transaction.
+ *
+ * Explicit pre-owner mode uses a read-only absence proof and an empty release
+ * history; it signs host:null without creating either ledger. In owner mode,
+ * both the live ledger and the copied stage ledger are opened strictly
+ * read-only and must already exist at the current schema. Their release history,
+ * maintenance rows, and activation classification must agree byte-for-byte.
+ * When the stage anchors a watched runtime epoch, the record binds that plan and
+ * its original applied readiness receipt; with no watch the record carries
+ * `host: null`. Any other activation state, or any failure to read a watched
+ * deployment, aborts production — it is never silently downgraded, because the
+ * ledger append rejects a mismatched anchor anyway.
+ */
+export async function produceRsiLocalSourceMaintenance(input) {
+    const signal = AbortSignal.any([input.signal ?? new AbortController().signal, AbortSignal.timeout(180_000)]);
+    if (!canonical(input.logicalHome) || !canonical(input.stagePhysicalHome) || !PROFILE.test(input.profile))
+        fail('invalid activation Home or profile');
+    const livePhysicalHome = await realpath(input.logicalHome);
+    const stagePhysicalHome = await realpath(input.stagePhysicalHome);
+    if (stagePhysicalHome !== input.stagePhysicalHome || inside(livePhysicalHome, stagePhysicalHome)
+        || inside(stagePhysicalHome, livePhysicalHome)) {
+        fail('activation stage must be a distinct stopped copy outside the live Home');
+    }
+    signal.throwIfAborted();
+    const { preparation } = input;
+    if (preparation.dshHome !== input.logicalHome || preparation.profile !== input.profile)
+        fail('preparation is bound to another Home');
+    const anchor = input.live.anchor;
+    const source = preparation.source;
+    if (anchor.repository !== join(input.logicalHome, 'rsi-sources', input.profile, 'checkout')
+        || anchor.ledger.path !== join(input.logicalHome, 'rsi-authorities', input.profile, 'state', 'control-plane', 'control.sqlite')
+        || controlPlaneDigest(anchor.baseline) !== controlPlaneDigest(input.live.workspace.baseline))
+        fail('source installation anchor changed');
+    verifySourceMaintenanceRecords(input.live.records, anchor);
+    if (input.live.originalBootstrapDigest !== source.originalBootstrapDigest)
+        fail('source bootstrap identity changed');
+    if (input.nextCohort.sourceCommit !== source.sourceCommit || input.nextCohort.version !== source.version
+        || !HASH.test(input.nextCohort.receiptDigest))
+        fail('next cohort does not match the prepared source');
+    // The ledger is the authority for published release edges; the signed sidecar
+    // only covers maintenance edges. Live and copied-stage ledgers must agree with
+    // the sidecar before the chain is extended.
+    const mode = input.maintenanceMode ?? 'owner-ledger';
+    if (mode !== 'owner-ledger' && mode !== 'pre-owner')
+        fail('invalid maintenance mode');
+    if (input.preparedCoordinator && mode !== 'pre-owner')
+        fail('prepared coordinator requires pre-owner maintenance mode');
+    let currentTip;
+    let liveState = { kind: 'none' };
+    let liveSnapshotDigest = '';
+    let liveDeploymentDigest;
+    let liveHistory;
+    if (mode === 'pre-owner') {
+        const proof = await assertRsiPreOwnerInstallation({ logicalHome: input.logicalHome, physicalHome: stagePhysicalHome,
+            profile: input.profile, anchor, records: input.live.records,
+            ...(input.preparedCoordinator ? { preparedCoordinator: true } : {}), signal });
+        if (proof.originalBootstrapDigest !== input.live.originalBootstrapDigest
+            || controlPlaneDigest(proof.workspace) !== controlPlaneDigest(input.live.workspace))
+            fail('pre-owner source bootstrap or workspace snapshot changed');
+        currentTip = proof.sourceChainTip;
+        liveHistory = [];
+    }
+    else {
+        const liveLedger = openReadOnlyLedger(anchor.ledger.path, 'live');
+        try {
+            const state = liveLedger.readSourceMaintenanceState(anchor.repository);
+            const { history, records: ledgerRecords } = state;
+            liveHistory = history;
+            if (ledgerRecords.length !== input.live.records.length
+                || ledgerRecords.some((record, index) => sourceMaintenanceDigest(record) !== sourceMaintenanceDigest(input.live.records[index]))) {
+                fail('live ledger and sidecar source maintenance histories differ');
+            }
+            currentTip = sourceBaselineChain(anchor.baseline, history, ledgerRecords).at(-1);
+            liveSnapshotDigest = controlPlaneDigest({ history, records: ledgerRecords });
+            liveState = liveLedger.readSourceMaintenanceActivationState(input.logicalHome);
+            if (liveState.kind === 'unsettled')
+                fail('live Host activation is unsettled');
+            if (liveState.kind === 'watched')
+                liveDeploymentDigest = controlPlaneDigest(watchedDeployment(liveLedger, input, liveState));
+        }
+        finally {
+            liveLedger.close();
+        }
+    }
+    signal.throwIfAborted();
+    const prior = input.live.records.at(-1);
+    const sequence = input.live.records.length + 1;
+    const before = prior ? prior.after : { sourceCommit: input.live.workspace.sourceCommit,
+        version: input.live.workspace.version, cohortDigest: preparation.originalCohortDigest };
+    if (source.repairCommit !== currentTip)
+        fail('prepared repair ref is not the current source chain tip');
+    if (prior && prior.after.cohortDigest !== preparation.originalCohortDigest)
+        fail('prepared original cohort is not the signed current cohort');
+    if (!prior && !HASH.test(preparation.originalCohortDigest))
+        fail('original cohort digest is invalid');
+    // Probe the STOPPED stage ledger read-only: a missing/corrupt/stale stage is
+    // an abort, never an excuse to invent host: null.
+    const authorityRoot = join('rsi-authorities', input.profile, 'state', 'control-plane');
+    const stageLedgerPath = join(stagePhysicalHome, authorityRoot, 'control.sqlite');
+    let host = null;
+    if (mode === 'owner-ledger') {
+        const stageLedger = openReadOnlyLedger(stageLedgerPath, 'staged');
+        try {
+            const { history: stageHistory, records: stageRecords } = stageLedger.readSourceMaintenanceState(anchor.repository);
+            if (stageRecords.length !== input.live.records.length
+                || stageRecords.some((record, index) => sourceMaintenanceDigest(record) !== sourceMaintenanceDigest(input.live.records[index]))) {
+                fail('staged ledger and live sidecar source maintenance histories differ');
+            }
+            if (controlPlaneDigest({ history: stageHistory, records: stageRecords }) !== liveSnapshotDigest) {
+                fail('staged ledger and live ledger source histories differ');
+            }
+            const stageState = stageLedger.readSourceMaintenanceActivationState(input.logicalHome);
+            if (!sameActivationState(liveState, stageState))
+                fail('live and staged Host activation states differ');
+            if (stageState.kind === 'unsettled')
+                fail('staged Host activation is unsettled');
+            if (stageState.kind === 'watched') {
+                // A watched epoch must resolve completely. Invalid/conflicting rows abort
+                // production; they are never downgraded to an unanchored record.
+                const context = watchedDeployment(stageLedger, input, stageState);
+                if (controlPlaneDigest(context) !== liveDeploymentDigest)
+                    fail('live and staged watched Host deployments differ');
+                const receipt = context.readiness.receipt;
+                if (!receipt)
+                    throw new Error('rsi local activation: runtime epoch readiness receipt is absent');
+                if (receipt.authority !== anchor.hostIdentity.authority || receipt.keyId !== anchor.hostIdentity.keyId) {
+                    fail('watched readiness was not issued by the installed Host identity');
+                }
+                // An owner installation holds exactly one Host key; the watched readiness
+                // must have been issued by that same identity for the local key to sign a
+                // record the store will accept. The store re-verifies this independently.
+                host = { planId: context.plan.id, planDigest: context.plan.digest,
+                    readinessOperationId: context.readiness.operationId, readinessReceiptDigest: hostMaintenanceDigest(receipt) };
+            }
+        }
+        finally {
+            stageLedger.close();
+        }
+    }
+    signal.throwIfAborted();
+    const signingKey = await privateHostKey(join(stagePhysicalHome, 'rsi-authorities', input.profile, 'identities', 'host.pem'));
+    if (createPublicKey(signingKey).export({ format: 'pem', type: 'spki' }).toString() !== anchor.hostIdentity.publicKeyPem) {
+        fail('staged Host key does not match the signed installation anchor');
+    }
+    const now = input.now ?? Date.now;
+    const issuedAt = now();
+    if (!Number.isSafeInteger(issuedAt) || issuedAt <= 0)
+        fail('invalid signing time');
+    if (prior && issuedAt < prior.issuedAt)
+        fail('clock moved backwards before signing the maintenance record');
+    const record = signSourceMaintenanceRecord({ schemaVersion: 1, kind: 'dsh-source-maintenance',
+        transactionId: `local-update-${sequence}-${preparation.receiptDigest.slice(0, 16)}`,
+        installationId: anchor.installationId, ledger: anchor.ledger, repository: anchor.repository,
+        baseline: anchor.baseline, sequence, previousDigest: prior ? sourceMaintenanceDigest(prior) : null,
+        previousTip: currentTip, candidateTip: source.sourceCommit, upstreamCommit: source.upstreamCommit,
+        sourceTree: source.sourceTree, preparationReceiptDigest: source.receiptDigest,
+        originalBootstrapDigest: input.live.originalBootstrapDigest, before,
+        after: { sourceCommit: source.sourceCommit, version: source.version, cohortDigest: input.nextCohort.receiptDigest },
+        host, issuedAt, authority: anchor.hostIdentity.authority, keyId: anchor.hostIdentity.keyId }, signingKey);
+    verifySourceMaintenanceRecords([...input.live.records, record], anchor);
+    // Reject a duplicate candidate or fork before handing a signed record to the
+    // stage transaction; appendSourceMaintenance independently checks this again.
+    sourceBaselineChain(anchor.baseline, liveHistory, [...input.live.records, record]);
+    signal.throwIfAborted();
+    return record;
+}
+//# sourceMappingURL=rsi-local-activation.js.map

package/lib/rsi-local-activation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-local-activation.js","sourceRoot":"","sources":["../src/rsi-local-activation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACjE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3D,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,qBAAqB,EACxH,2BAA2B,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,8BAA8B,EAC7C,MAAM,oCAAoC,CAAA;AACxG,OAAO,EAAE,iBAAiB,IAAI,EAAE,EAAE,MAAM,gBAAgB,CAAA;AACxD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,MAAM,CAAA;AAC5D,OAAO,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAA;AAC3E,OAAO,EAAE,kBAAkB,EAAE,+BAA+B,EAAE,MAAM,uBAAuB,CAAA;AAC3F,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAA;AAG1E,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAA;AAEtE,MAAM,IAAI,GAAG,iBAAiB,CAAA;AAC9B,MAAM,OAAO,GAAG,oCAAoC,CAAA;AACpD,SAAS,IAAI,CAAC,OAAe,IAAW,MAAM,IAAI,KAAK,CAAC,yBAAyB,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC;AAC7F,SAAS,SAAS,CAAC,IAAY,IAAa,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA,CAAC,CAAC;AACnJ,SAAS,MAAM,CAAC,IAAY,EAAE,IAAY,IAAa,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC,CAAA,CAAC,CAAC;AACjH,KAAK,UAAU,cAAc,CAAC,IAAY;IACxC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;IAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,MAAM;WACjG,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE;QAAE,IAAI,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAA;IACnH,OAAO,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AACnE,CAAC;AAgDD,MAAM,mBAAmB,GAAG,CAAC,kBAAkB,EAAE,uBAAuB,EAAE,sBAAsB,CAAC,CAAA;AACjG,SAAS,kBAAkB,CAAC,MAAc,EAAE,IAAY;IACtD,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI;QACvD,UAAU,EAAE,CAAC,EAAE,GAAG,EAAE,sBAAsB,EAAE,OAAO,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;IACrF,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACtH,IAAI,CAAC,oDAAoD,IAAI,EAAE,CAAC,CAAA;IAClE,CAAC;AACH,CAAC;AACD,KAAK,UAAU,yBAAyB,CAAC,KAAyC,EAAE,IAAY,EAC9F,WAAmB,EAAE,WAAmB,EAAE,OAAe,EAAE,MAAsD;IACjH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,CAAA;IACvD,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;IACtC,IAAI,CAAC,iBAAiB,CAAC,CAAC,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,EACxD,CAAC,kBAAkB,EAAE,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB,EAAE,qBAAqB,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QACtH,IAAI,CAAC,gDAAgD,WAAW,EAAE,CAAC,CAAA;IACrE,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QAAE,IAAI,CAAC,sCAAsC,CAAC,CAAA;IACnH,KAAK,MAAM,IAAI,IAAI,CAAC,YAAY,EAAE,kBAAkB,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;QACpC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;QAClD,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAA;QAChD,IAAI,IAAI,KAAK,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1I,IAAI,CAAC,wDAAwD,IAAI,EAAE,CAAC,CAAA;QACtE,CAAC;IACH,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,CAAC,cAAc,EAAE,qBAAqB,EAAE,gBAAgB,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;QACnF,IAAI,IAAI,KAAK,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3I,IAAI,CAAC,uDAAuD,IAAI,EAAE,CAAC,CAAA;QACrE,CAAC;QACD,IAAI,IAAI,KAAK,cAAc;YAAE,0BAA0B,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAA;IACnI,CAAC;IACD,MAAM,+BAA+B,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAA;AAC3G,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,IAAI,CAAC;QAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;IAAC,CAAC;IACzB,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO;QAAC,MAAM,KAAK,CAAA;IAAC,CAAC;IAC7F,IAAI,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAA;AAC3C,CAAC;AACD,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,OAAe,EAAE,WAAW,GAAG,IAAI;IAC5E,IAAI,CAAC;QAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;IAAC,CAAC;IACzB,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO;QAAC,MAAM,KAAK,CAAA;IAAC,CAAC;IAC7F,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;IAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC;WAC3E,IAAI,CAAC,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI;QAAE,IAAI,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAA;IAC9H,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,CAAA;AAClD,CAAC;AAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,wBAAwB;IAC3G,iBAAiB,EAAE,aAAa,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,qBAAqB;IACvH,eAAe,EAAE,mBAAmB,CAAC,CAAC,CAAA;AACxC,SAAS,2BAA2B,CAAC,MAAc,EAAE,IAAY,EAAE,eAAuB;IACxF,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI;QACvD,UAAU,EAAE,CAAC,EAAE,GAAG,EAAE,sBAAsB,EAAE,OAAO,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;IACrF,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mEAAmE,IAAI,EAAE,CAAC,CAAA;IAC/K,MAAM,OAAO,GAAG,CAAC,IAAa,EAAQ,EAAE;QACtC,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACnB,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAA;YACjC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAAE,IAAI,CAAC,6DAA6D,IAAI,EAAE,CAAC,CAAA;YAC3I,IAAI,IAAI,CAAC,GAAG,KAAK,sBAAsB,IAAI,OAAO,KAAK,KAAK,QAAQ;mBAC/D,CAAC,GAAG,gBAAgB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAAE,IAAI,CAAC,yDAAyD,IAAI,EAAE,CAAC,CAAA;QAChK,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,CAAC;YAAE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACtD,MAAM,GAAG,GAAY,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;gBACpE,MAAM,KAAK,GAAY,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAA;gBAC3E,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,KAAK;oBAAE,IAAI,CAAC,wDAAwD,IAAI,EAAE,CAAC,CAAA;gBACnK,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACxC,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IACrD,CAAC,CAAA;IACD,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC1C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,wDAAwD,IAAI,EAAE,CAAC,CAAA;QACrF,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;aACrE,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC9D,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,IAAI,CAAC,8CAA8C,IAAI,EAAE,CAAC,CAAA;QAC5F,IAAI,mCAAmC,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,IAAI,CAAC,wDAAwD,IAAI,EAAE,CAAC,CAAA;QAC5H,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QACtC,IAAI,QAAQ,CAAC,QAAQ,CAAC,2BAA2B,CAAC,IAAI,CAAE,GAAG,CAAC,GAAG,CAAC,UAAU,CAAa,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;YAC1H,IAAI,CAAC,0CAA0C,IAAI,EAAE,CAAC,CAAA;QACxD,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,sBAAsB,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,GAAG,KAAK,sBAAsB;YAAE,IAAI,CAAC,iEAAiE,IAAI,EAAE,CAAC,CAAA;QACzL,OAAO,CAAC,GAAG,CAAC,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;;;;;8EAO8E;AAC9E,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAAyC;IAC3F,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,IAAI,CAAC,mCAAmC,CAAC,CAAA;IAC9I,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAC5G,MAAM,CAAC,cAAc,EAAE,CAAA;IACvB,IAAI,KAAK,CAAC,eAAe,EAAE,MAAM;QAAE,IAAI,CAAC,sDAAsD,CAAC,CAAA;IAC/F,IAAI,MAAM,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,KAAK,CAAC,WAAW,IAAI,MAAM,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,KAAK,CAAC,YAAY;QAAE,IAAI,CAAC,kCAAkC,CAAC,CAAA;IAClK,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;IAChJ,IAAI,KAAK,CAAC,MAAM,IAAI,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,uCAAuC,CAAC,CAAA;IACvI,MAAM,SAAS,GAAG,MAAM,4BAA4B,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IACxI,IAAI,SAAS,CAAC,cAAc,KAAK,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,SAAS,CAAC,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;WACtG,kBAAkB,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,YAAY,CAAC;QAAE,IAAI,CAAC,oCAAoC,CAAC,CAAA;IACzK,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAClF,MAAM,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IAChE,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IACzD,MAAM,kBAAkB,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;IAC1H,MAAM,eAAe,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,cAAc,EAAE,gBAAgB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;IACpH,MAAM,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC9E,MAAM,WAAW,GAAG,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAA;IACrF,MAAM,UAAU,GAAG,oBAAoB,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAA;IACxE,MAAM,cAAc,GAAG,KAAK,CAAC,mBAAmB,KAAK,IAAI;QACvD,CAAC,CAAC,MAAM,kBAAkB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAChG,MAAM,MAAM,GAAG,KAAK,CAAC,mBAAmB,KAAK,IAAI;QAC/C,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACtF,IAAI,cAAc,IAAI,MAAM,EAAE,CAAC;QAC7B,IAAI,MAAe,CAAA;QACnB,IAAI,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,IAAI,CAAC,yCAAyC,CAAC,CAAA;QAAC,CAAC;QAC9G,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,OAAO,EAAE,kBAAkB,EAAE,WAAW;YAC9G,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,gBAAgB,EAAE,cAAc,CAAC,gBAAgB,EAAE,CAAC,EAAE,CAAC;YACxF,IAAI,CAAC,6DAA6D,CAAC,CAAA;QACrE,CAAC;IACH,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;QACpE,MAAM,CAAC,cAAc,EAAE,CAAA;QACvB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAA;QAC/C,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QAC7B,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAA;QAC9C,IAAI,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,8DAA8D;YAAE,IAAI,CAAC,uCAAuC,SAAS,EAAE,CAAC,CAAA;QAC5K,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;YACnD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YAAC,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;YACtE,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YACjD,IAAI,IAAI,KAAK,OAAO,IAAI,MAAM,IAAI,iBAAiB,CAAC,OAAO,EACzD,CAAC,0BAA0B,EAAE,wBAAwB,CAAC,CAAC,EAAE,CAAC;gBAC1D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;oBAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;oBACpC,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;oBACzB,IAAI,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;wBAAE,IAAI,CAAC,iCAAiC,KAAK,EAAE,CAAC,CAAA;gBACnF,CAAC;YACH,CAAC;iBAAM,IAAI,OAAO,CAAC,MAAM;gBAAE,IAAI,CAAC,aAAa,IAAI,kBAAkB,SAAS,EAAE,CAAC,CAAA;QACjF,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAA;QAC/H,IAAI,kBAAkB,CAAC,OAAO,CAAC,KAAK,kBAAkB,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YAAE,IAAI,CAAC,mCAAmC,SAAS,EAAE,CAAC,CAAA;QAC/I,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC;eACjG,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,gBAAgB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC;YAAE,IAAI,CAAC,6CAA6C,CAAC,CAAA;QACpK,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAAC,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACpE,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,qCAAqC,CAAC,CAAA;QACzK,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;YACpE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC,CAAA;YAC9D,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;YACvD,IAAI,MAAM,KAAK,QAAQ;gBAAE,IAAI,CAAC,uCAAuC,IAAI,EAAE,CAAC,CAAA;QAC9E,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,iBAAiB,EAAE,WAAW,CAAC;YACzG,IAAI,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC;YAAE,MAAM,YAAY,CAAC,IAAI,CAAC,CAAA;QAClE,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAA;YACnD,MAAM,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;YAChC,IAAI,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM;gBAAE,IAAI,CAAC,8BAA8B,YAAY,EAAE,CAAC,CAAA;QAC9F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAA;QAAC,CAAC;QACvF,KAAK,MAAM,IAAI,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,IAAI,KAAK,UAAU,CAAC;gBAAE,IAAI,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAA;QAC3H,CAAC;QACD,IAAI,MAAM,IAAI,cAAc,EAAE,CAAC;YAC7B,MAAM,yBAAyB,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,CAAA;YACzG,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;YACxD,MAAM,cAAc,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,SAAS,CAAC,CAAA;YACvF,0BAA0B,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,cAAc;gBAC1F,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,CAAC,CAAA;YACpC,IAAI,IAAI,KAAK,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,UAAU,EAAE,KAAK,CAAC,OAAO,EACvG,cAAc,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC;gBAAE,IAAI,CAAC,mDAAmD,CAAC,CAAA;YAChH,MAAM,+BAA+B,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU;gBACrF,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,CAAC,CAAA;QACtC,CAAC;aAAM,CAAC;YACN,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAA;YACvD,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;QAC5C,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;QACzD,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;YACvC,KAAK,MAAM,IAAI,IAAI,CAAC,aAAa,EAAE,mBAAmB,EAAE,aAAa,EAAE,mBAAmB,CAAC,EAAE,CAAC;gBAC5F,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;gBAC3E,IAAI,WAAW;oBAAE,IAAI,CAAC,iDAAiD,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;YAC5F,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,CAAC,kBAAkB,EAAE,YAAY,CAAC,EAAE,CAAC;gBACtD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,KAAK,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;gBAClF,IAAI,KAAK;oBAAE,2BAA2B,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,iBAAiB,EAAE,QAAQ,CAAC,CAAC,CAAA;YAC5H,CAAC;QACH,CAAC;IAEH,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,cAAc,EAAE,kBAAkB,CAAC,EAAE,SAAS,CAAC,CAAA;IAC5G,MAAM,MAAM,GAAY,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC3E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,IAAI,CAAC,iDAAiD,CAAC,CAAA;IACvI,MAAM,OAAO,GAAG,8BAA8B,CAAC,MAAmC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IAChG,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAA;IAC9C,8BAA8B,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IACrD,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;WACjF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC,MAAM,CAAC,KAAK,uBAAuB,CAAC,QAAQ,CAAC,KAAK,CAAE,CAAC,CAAC;QAAE,IAAI,CAAC,mEAAmE,CAAC,CAAA;IACnM,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC;WAChG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,IAAI,CAAC,+DAA+D,CAAC,CAAA;IACzH,IAAI,kBAAkB,CAAC,OAAO,CAAC,KAAK,kBAAkB,CAAC,QAAQ,CAAC;QAAE,IAAI,CAAC,+DAA+D,CAAC,CAAA;IACvI,MAAM,cAAc,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAA;IACrF,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;IAC3D,MAAM,CAAC,cAAc,EAAE,CAAA;IACvB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,cAAc;QACjG,uBAAuB,EAAE,IAAI,CAAC,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,CAAC,kBAAkB,CAAC;QAC3G,GAAG,CAAC,MAAM,IAAI,cAAc,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC;gBACzG,YAAY,EAAE,cAAc,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;AAC5D,CAAC;AAID,SAAS,kBAAkB,CAAC,IAAY,EAAE,KAAa;IACrD,IAAI,CAAC;QACH,OAAO,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,yBAAyB;YAAE,IAAI,CAAC,GAAG,KAAK,mCAAmC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;QAChH,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAqB,EAAE,KAAsB;IACxE,OAAO,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAM,KAA4B,CAAC,MAAM,CAAC,CAAA;AACtH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAwB,EAAE,KAAsC,EACzF,KAAoD;IACpD,MAAM,OAAO,GAAG,KAAK,CAAC,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;IACvG,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,OAAO,GAAG,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAA;IAC5F,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;IAChG,IAAI,IAAI,CAAC,EAAE,KAAK,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc;WACxE,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC;WACrE,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;WAC3E,OAAO,CAAC,SAAS,KAAK,MAAM,CAAC,YAAY,CAAC,SAAS,IAAI,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACxG,IAAI,CAAC,+EAA+E,CAAC,CAAA;IACvF,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAA;IAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,EAAE,eAAe,CAAC,MAAM,CAAC,YAAY,CAAC,YAAY,CAAC,EAClH,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAAE,IAAI,CAAC,mDAAmD,CAAC,CAAA;IAC9F,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,KAAsC;IAC3F,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAC5G,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,IAAI,CAAC,oCAAoC,CAAC,CAAA;IACpJ,MAAM,gBAAgB,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IAC1D,MAAM,iBAAiB,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;IACjE,IAAI,iBAAiB,KAAK,KAAK,CAAC,iBAAiB,IAAI,MAAM,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;WAC3F,MAAM,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,wEAAwE,CAAC,CAAA;IAChF,CAAC;IACD,MAAM,CAAC,cAAc,EAAE,CAAA;IACvB,MAAM,EAAE,WAAW,EAAE,GAAG,KAAK,CAAA;IAC7B,IAAI,WAAW,CAAC,OAAO,KAAK,KAAK,CAAC,WAAW,IAAI,WAAW,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QAAE,IAAI,CAAC,sCAAsC,CAAC,CAAA;IACpI,MAAM,MAAM,GAA4B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAA;IACzD,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAA;IACjC,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC;WACtF,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,iBAAiB,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,gBAAgB,CAAC;WAC5H,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;QAAE,IAAI,CAAC,oCAAoC,CAAC,CAAA;IAC1I,8BAA8B,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAC1D,IAAI,KAAK,CAAC,IAAI,CAAC,uBAAuB,KAAK,MAAM,CAAC,uBAAuB;QAAE,IAAI,CAAC,mCAAmC,CAAC,CAAA;IACpH,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;WACnG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC;QAAE,IAAI,CAAC,gDAAgD,CAAC,CAAA;IAEvG,8EAA8E;IAC9E,+EAA+E;IAC/E,4CAA4C;IAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,eAAe,IAAI,cAAc,CAAA;IACpD,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,WAAW;QAAE,IAAI,CAAC,0BAA0B,CAAC,CAAA;IACrF,IAAI,KAAK,CAAC,mBAAmB,IAAI,IAAI,KAAK,WAAW;QAAE,IAAI,CAAC,0DAA0D,CAAC,CAAA;IACvH,IAAI,UAAkB,CAAA;IACtB,IAAI,SAAS,GAAoB,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IACjD,IAAI,kBAAkB,GAAG,EAAE,CAAA;IAC3B,IAAI,oBAAwC,CAAA;IAC5C,IAAI,WAAmF,CAAA;IACvF,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,6BAA6B,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,YAAY,EAAE,iBAAiB;YACjH,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO;YAC3D,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;QACzF,IAAI,KAAK,CAAC,uBAAuB,KAAK,KAAK,CAAC,IAAI,CAAC,uBAAuB;eACnE,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,0DAA0D,CAAC,CAAA;QACvJ,UAAU,GAAG,KAAK,CAAC,cAAc,CAAC;QAAC,WAAW,GAAG,EAAE,CAAA;IACrD,CAAC;SAAM,CAAC;QACN,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACjE,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,UAAU,CAAC,0BAA0B,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;YACtE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,KAAK,CAAA;YACjD,WAAW,GAAG,OAAO,CAAA;YACrB,IAAI,aAAa,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM;mBACjD,aAAa,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC,MAAM,CAAC,KAAK,uBAAuB,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAE,CAAC,CAAC,EAAE,CAAC;gBACpI,IAAI,CAAC,6DAA6D,CAAC,CAAA;YACrE,CAAC;YACD,UAAU,GAAG,mBAAmB,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAA;YACjF,kBAAkB,GAAG,kBAAkB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAA;YAC5E,SAAS,GAAG,UAAU,CAAC,oCAAoC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;YAC9E,IAAI,SAAS,CAAC,IAAI,KAAK,WAAW;gBAAE,IAAI,CAAC,mCAAmC,CAAC,CAAA;YAC7E,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS;gBAAE,oBAAoB,GAAG,kBAAkB,CAAC,iBAAiB,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAA;QAC9H,CAAC;gBAAS,CAAC;YAAC,UAAU,CAAC,KAAK,EAAE,CAAA;QAAC,CAAC;IAClC,CAAC;IACD,MAAM,CAAC,cAAc,EAAE,CAAA;IAEvB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAA;IAC9C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY;QACpF,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,YAAY,EAAE,WAAW,CAAC,oBAAoB,EAAE,CAAA;IACzF,IAAI,MAAM,CAAC,YAAY,KAAK,UAAU;QAAE,IAAI,CAAC,yDAAyD,CAAC,CAAA;IACvG,IAAI,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,YAAY,KAAK,WAAW,CAAC,oBAAoB;QAAE,IAAI,CAAC,2DAA2D,CAAC,CAAA;IAC7I,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAAC;QAAE,IAAI,CAAC,mCAAmC,CAAC,CAAA;IAErG,6EAA6E;IAC7E,kDAAkD;IAClD,MAAM,aAAa,GAAG,IAAI,CAAC,iBAAiB,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,eAAe,CAAC,CAAA;IACtF,MAAM,eAAe,GAAG,IAAI,CAAC,iBAAiB,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAAA;IAChF,IAAI,IAAI,GAAoC,IAAI,CAAA;IAChD,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,MAAM,WAAW,GAAG,kBAAkB,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAA;QACjE,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,WAAW,CAAC,0BAA0B,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;YAClH,IAAI,YAAY,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM;mBAChD,YAAY,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC,MAAM,CAAC,KAAK,uBAAuB,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAE,CAAC,CAAC,EAAE,CAAC;gBACnI,IAAI,CAAC,oEAAoE,CAAC,CAAA;YAC5E,CAAC;YACD,IAAI,kBAAkB,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,KAAK,kBAAkB,EAAE,CAAC;gBAChG,IAAI,CAAC,uDAAuD,CAAC,CAAA;YAC/D,CAAC;YACD,MAAM,UAAU,GAAG,WAAW,CAAC,oCAAoC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;YACtF,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,UAAU,CAAC;gBAAE,IAAI,CAAC,+CAA+C,CAAC,CAAA;YACtG,IAAI,UAAU,CAAC,IAAI,KAAK,WAAW;gBAAE,IAAI,CAAC,qCAAqC,CAAC,CAAA;YAChF,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAClC,0EAA0E;gBAC1E,iEAAiE;gBACjE,MAAM,OAAO,GAAG,iBAAiB,CAAC,WAAW,EAAE,KAAK,EAAE,UAAU,CAAC,CAAA;gBACjE,IAAI,kBAAkB,CAAC,OAAO,CAAC,KAAK,oBAAoB;oBAAE,IAAI,CAAC,iDAAiD,CAAC,CAAA;gBACjH,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAA;gBACzC,IAAI,CAAC,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;gBAChG,IAAI,OAAO,CAAC,SAAS,KAAK,MAAM,CAAC,YAAY,CAAC,SAAS,IAAI,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;oBACvG,IAAI,CAAC,iEAAiE,CAAC,CAAA;gBACzE,CAAC;gBACD,0EAA0E;gBAC1E,0EAA0E;gBAC1E,0EAA0E;gBAC1E,IAAI,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;oBAC/D,oBAAoB,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,sBAAsB,EAAE,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAA;YACjH,CAAC;QACH,CAAC;gBAAS,CAAC;YAAC,WAAW,CAAC,KAAK,EAAE,CAAA;QAAC,CAAC;IACnC,CAAC;IACD,MAAM,CAAC,cAAc,EAAE,CAAA;IAEvB,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,KAAK,CAAC,OAAO,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC,CAAA;IAC5H,IAAI,eAAe,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,MAAM,CAAC,YAAY,CAAC,YAAY,EAAE,CAAC;QACxH,IAAI,CAAC,+DAA+D,CAAC,CAAA;IACvE,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;IACjC,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAA;IACtB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC;QAAE,IAAI,CAAC,sBAAsB,CAAC,CAAA;IAClF,IAAI,KAAK,IAAI,QAAQ,GAAG,KAAK,CAAC,QAAQ;QAAE,IAAI,CAAC,6DAA6D,CAAC,CAAA;IAC3G,MAAM,MAAM,GAAG,2BAA2B,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,wBAAwB;QAC3F,aAAa,EAAE,gBAAgB,QAAQ,IAAI,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;QACnF,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU;QAC3F,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;QAClG,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc;QACjG,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,wBAAwB,EAAE,MAAM,CAAC,aAAa;QAC7E,uBAAuB,EAAE,KAAK,CAAC,IAAI,CAAC,uBAAuB,EAAE,MAAM;QACnE,KAAK,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,aAAa,EAAE;QACnH,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,UAAU,CAAC,CAAA;IAC3G,8BAA8B,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAA;IACvE,6EAA6E;IAC7E,8EAA8E;IAC9E,mBAAmB,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAA;IAClF,MAAM,CAAC,cAAc,EAAE,CAAA;IACvB,OAAO,MAAM,CAAA;AACf,CAAC"}

package/lib/rsi-local-cohort.d.ts

@@ -0,0 +1,70 @@
+import type { RsiSourceWorkspace } from './rsi-source.js';
+export interface RsiLocalCohortPackage {
+    name: string;
+    path: string;
+    bundle: boolean;
+    runtimeDependencies: string[];
+    tarball: string;
+    sha256: string;
+    files: {
+        path: string;
+        sha256: string;
+        mode: number;
+    }[];
+}
+export interface RsiLocalCohort {
+    schemaVersion: 1;
+    root: string;
+    sourceCommit: string;
+    version: string;
+    sourceRepository: string;
+    allowBuilds: Record<string, boolean>;
+    bundles: string[];
+    packages: RsiLocalCohortPackage[];
+    receiptDigest: string;
+}
+export interface RsiLocalCohortPorts {
+    /** The output contains one slug directory per package, each with one .tgz. */
+    build(workspace: string, output: string, packagePaths: readonly string[], signal: AbortSignal): Promise<void>;
+}
+export declare function readRsiLocalCohort(input: {
+    dshHome: string;
+    profile: string;
+    source?: RsiSourceWorkspace;
+}): Promise<RsiLocalCohort>;
+export declare const rsiLocalCohortPorts: RsiLocalCohortPorts;
+/** The caller holds the DSH_HOME lifecycle lock. A claimed receipt is immutable. */
+export declare function prepareRsiLocalCohort(input: {
+    dshHome: string;
+    profile: string;
+    source: RsiSourceWorkspace;
+    bundles: string[];
+    signal?: AbortSignal;
+}, ports?: RsiLocalCohortPorts): Promise<RsiLocalCohort>;
+/** A profile's roots and runtime closure define the only eligible peer providers.
+ * Peers never expand that closure, including optional peers. Receipt schema 1
+ * stays immutable; the peer edges are derived from its exact manifest bytes. */
+export declare function rsiLocalRuntimeClosure(cohort: RsiLocalCohort, bundles: readonly string[]): RsiLocalCohortPackage[];
+export declare function readRsiLocalArtifactManifest(item: Pick<RsiLocalCohortPackage, 'name' | 'tarball' | 'sha256' | 'files' | 'runtimeDependencies'> & {
+    version: string;
+}): Promise<{
+    peerDependencies: Record<string, string>;
+}>;
+export declare function rsiLocalPeerOverrides(input: {
+    cohort: RsiLocalCohort;
+    bundles: readonly string[];
+    /** During a pair upgrade the original archives have already been replaced.
+     * Its installed manifests must still match the original receipt's digest. */
+    profilePath?: string;
+}): Promise<Record<string, string>>;
+/** Validate the exact installed files for selected bundles and their own runtime closure. */
+export declare function verifyRsiLocalInstalledPackages(input: {
+    cohort: RsiLocalCohort;
+    profilePath: string;
+    bundles?: string[];
+}): Promise<void>;
+/** A native package add replaces pnpm links while the caller is running.
+ * Node caches their old physical targets in that process. Resolve the final
+ * installed closure in a new process using this pinned verifier's same checks. */
+export declare function verifyRsiLocalInstalledPackagesFresh(input: Parameters<typeof verifyRsiLocalInstalledPackages>[0], signal?: AbortSignal): Promise<void>;
+//# sourceMappingURL=rsi-local-cohort.d.ts.map

package/lib/rsi-local-cohort.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-local-cohort.d.ts","sourceRoot":"","sources":["../src/rsi-local-cohort.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAYzD,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,OAAO,CAAA;IACf,mBAAmB,EAAE,MAAM,EAAE,CAAA;IAC7B,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CACxD;AACD,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,CAAC,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,gBAAgB,EAAE,MAAM,CAAA;IACxB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACpC,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,QAAQ,EAAE,qBAAqB,EAAE,CAAA;IACjC,aAAa,EAAE,MAAM,CAAA;CACtB;AACD,MAAM,WAAW,mBAAmB;IAClC,8EAA8E;IAC9E,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9G;AAsPD,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,kBAAkB,CAAA;CAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAI1I;AAwBD,eAAO,MAAM,mBAAmB,EAAE,mBAA6C,CAAA;AAE/E,oFAAoF;AACpF,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAC;IAChH,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,EAAE,KAAK,GAAE,mBAAyC,GAAG,OAAO,CAAC,cAAc,CAAC,CAgFtH;AAED;;gFAEgF;AAChF,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,qBAAqB,EAAE,CAalH;AAED,wBAAsB,4BAA4B,CAAC,IAAI,EAAE,IAAI,CAAC,qBAAqB,EACjF,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,qBAAqB,CAAC,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC;IAC/F,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACzC,CAAC,CAsBH;AAED,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACtG;iFAC6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAiDzD;AAED,6FAA6F;AAC7F,wBAAsB,+BAA+B,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAmE/I;AAED;;kFAEkF;AAClF,wBAAsB,oCAAoC,CACxD,KAAK,EAAE,UAAU,CAAC,OAAO,+BAA+B,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,WAAW,GACjF,OAAO,CAAC,IAAI,CAAC,CAmEf"}