@dsh-enhanced/lark-channel 0.1.48 → 0.1.53

package/lib/rsi-authority-config.js

@@ -0,0 +1,233 @@
+import { createHash, createPublicKey } from 'node:crypto';
+import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
+import { defaultHostAttestationPolicy } from '@dsh-enhanced/plugin-control-plane';
+import { rsiAuthorityRoles } from './rsi-authority-resources.js';
+const phases = ['pr', 'review', 'merge', 'build', 'sign', 'publish', 'registry-verify', 'catalog-admission'];
+const digest = (source) => createHash('sha256').update(source).digest('hex');
+const json = (value) => `${JSON.stringify(value, null, 2)}\n`;
+function fail(message) { throw new Error(`rsi authority config: ${message}`); }
+function path(value, label) {
+    if (typeof value !== 'string' || !isAbsolute(value) || value === '/' || resolve(value) !== value
+        || value.includes('\0') || /[\r\n]/u.test(value))
+        fail(`${label} must be a canonical absolute path`);
+    return value;
+}
+function within(root, value, label) {
+    path(root, 'config root');
+    path(value, label);
+    const child = relative(root, value);
+    if (!child || child === '..' || child.startsWith(`..${sep}`) || isAbsolute(child))
+        fail(`${label} must be inside the authority config root`);
+    return value;
+}
+function finite(value, now, label) {
+    if (!Number.isSafeInteger(value) || value <= now)
+        fail(`${label} has expired`);
+    return value;
+}
+function positive(value, max, label) {
+    if (!Number.isSafeInteger(value) || value < 1 || value > max)
+        fail(`${label} is outside its finite limit`);
+    return value;
+}
+function checkedPin(value, label) {
+    path(value.path, label);
+    if (!/^[a-f0-9]{64}$/u.test(value.sha256))
+        fail(`${label} digest is invalid`);
+    return value;
+}
+/** Compile immutable configuration bytes. The caller creates private directories,
+ * writes files atomically, opens the Control Plane ledger, and runs the real
+ * filesystem and executable validators before any service is enabled. */
+export function compileRsiAuthorityConfigs(input) {
+    const { manifest, resources, runtime, source, releaseBuild, executor, now } = input;
+    const cp = manifest.controlPlane, reviews = manifest.sourceReviews, env = manifest.serviceEnvironment?.target;
+    const jobs = cp.sourceJobs, approvals = cp.sourceApprovals, releases = cp.sourceReleases;
+    const adoption = cp.sourceAdoptions, observations = cp.taskObservations, qualification = cp.liveQualification;
+    if (manifest.schemaVersion !== 1 || resources.schemaVersion !== 1 || runtime.schemaVersion !== 1 || source.schemaVersion !== 1
+        || !Number.isSafeInteger(now) || now < 1 || !jobs || !approvals || !releases || !adoption || !observations || !qualification
+        || !cp.runtimeObserver || !cp.foregroundDeployments || !cp.sourceReleaseExecution || !env
+        || !adoption.liveQualification || !adoption.handoff || !adoption.hostDeploymentInputs)
+        fail('complete bounded-live deployment input is required');
+    const home = path(dirname(dirname(resources.root)), 'DSH_HOME');
+    if (resources.root !== join(home, 'rsi-authorities', manifest.targetProfile)
+        || resources.configRoot !== join(resources.root, 'config') || resources.stateRoot !== join(resources.root, 'state')
+        || runtime.root !== join(home, 'rsi-authority-runtimes', manifest.targetProfile)
+        || cp.runtimeObserver.profilePath !== join(home, 'profiles', manifest.targetProfile)
+        || adoption.profile !== manifest.targetProfile || observations.profilePath !== cp.runtimeObserver.profilePath
+        || qualification.profilePath !== cp.runtimeObserver.profilePath
+        || cp.catalogPath !== resources.catalog.path || jobs.repository !== source.repository
+        || source.baseline.targetBranch !== 'repairs' || !isDeepStrictEqual(jobs.baseline, source.baseline)
+        || reviews.repository !== source.baseline.remote || cp.sourceReleaseExecution.reviewDecisionRoot !== reviews.decisionRoot
+        || cp.sourceReleaseExecution.independentReview !== true || cp.sourceBuild?.versioning !== 'patch'
+        || reviews.owner.authorityId !== jobs.ownerRouteId || reviews.owner.principalId !== jobs.principalId
+        || reviews.owner.workspace !== jobs.workspace || reviews.owner.agentPreset !== jobs.preset
+        || !isDeepStrictEqual(reviews.plugins, input.policies.map(policy => policy.candidateId))
+        || adoption.liveQualification.authority !== resources.identities.qualification.authority
+        || adoption.liveQualification.keyId !== resources.identities.qualification.keyId
+        || manifest.serviceEnvironment?.coordinator?.DSH_SYSTEMD_HOST_ATTESTOR_CONFIG !== env.DSH_SYSTEMD_HOST_ATTESTOR_CONFIG)
+        fail('source, profile, owner, or policy binding differs');
+    for (const [name, client] of [['approval', approvals], ['release', releases], ['adoption', adoption.authority],
+        ['observation', observations.authority], ['qualification', qualification.authority]]) {
+        if (!isDeepStrictEqual(client.executable, runtime.executables[name])
+            || !isDeepStrictEqual(client.interpreter, runtime.node))
+            fail(`${name} client differs from prepared authority runtime`);
+    }
+    const ledgerPath = join(path(cp.statePath, 'Control Plane state'), 'control.sqlite');
+    const worktreeRoot = join(cp.statePath, 'source-worktrees');
+    const root = path(resources.configRoot, 'authority config root');
+    const trustPath = within(root, cp.trustPath, 'trust path');
+    const resolverPath = join(root, 'host-authority.json');
+    const hostWrapperPath = within(root, env.DSH_SYSTEMD_HOST_ATTESTOR_CONFIG, 'Host wrapper path');
+    const approvalPath = within(root, approvals.configPath, 'approval config path');
+    const releasePath = within(root, releases.configPath, 'release config path');
+    const adoptionPath = within(root, adoption.authority.configPath, 'adoption config path');
+    const observationPath = within(root, observations.authority.configPath, 'observation config path');
+    const qualificationPath = within(root, qualification.authority.configPath, 'qualification config path');
+    const expiry = Math.min(finite(jobs.expiresAt, now, 'source jobs'), finite(reviews.expiresAt, now, 'source reviews'), finite(observations.policy.expiresAt, now, 'task observation policy'));
+    positive(jobs.maxSubmissions, 10_000, 'source submissions');
+    positive(reviews.maxReviews, 10_000, 'source reviews');
+    positive(observations.policy.maximumObservations, 1_000, 'task observations');
+    if (input.policies.length < 1 || input.policies.length > 32 || new Set(input.policies.map(policy => policy.candidateId)).size !== input.policies.length
+        || new Set(reviews.plugins).size !== reviews.plugins.length)
+        fail('source policies must be distinct and finite');
+    for (const policy of input.policies) {
+        if (policy.targetBranch !== source.baseline.targetBranch || policy.dshBaseline !== executor.version
+            || policy.packageName !== `@dsh-enhanced/${policy.candidateId}` || policy.packagePath !== `plugins/${policy.candidateId}`
+            || policy.registryId !== resources.registry.id || policy.registryLocator !== resources.registry.locator
+            || policy.catalogId !== resources.catalog.id || policy.catalogPath !== resources.catalog.path
+            || policy.minimumReproducibleBuilds < 2)
+            fail(`release policy differs from deployment: ${policy.candidateId}`);
+    }
+    const role = (name) => resources.identities[name];
+    const key = (name) => {
+        const identity = role(name);
+        if (identity.keyPath !== join(resources.root, 'identities', `${name}.pem`)
+            || identity.authority !== `${name}-${resources.installationId}` || identity.keyId !== `${identity.authority}-key`)
+            fail(`identity differs: ${name}`);
+        try {
+            if (createPublicKey(identity.publicKeyPem).asymmetricKeyType !== 'ed25519')
+                fail(`identity is not Ed25519: ${name}`);
+        }
+        catch {
+            fail(`identity is invalid: ${name}`);
+        }
+        return { authority: identity.authority, keyId: identity.keyId, publicKeyPem: identity.publicKeyPem };
+    };
+    if (new Set(rsiAuthorityRoles.map(name => role(name).publicKeyPem)).size !== rsiAuthorityRoles.length)
+        fail('authority keys must be independent');
+    const files = {};
+    const directories = new Set([root, join(root, 'public-keys'), resources.stateRoot, cp.statePath, worktreeRoot,
+        reviews.decisionRoot, join(resources.stateRoot, 'reviews'), join(resources.stateRoot, 'release'),
+        join(resources.stateRoot, 'host-attestor'), join(resources.stateRoot, 'registry-download')]);
+    const add = (filename, value) => {
+        if (Object.hasOwn(files, filename))
+            fail(`config paths collide: ${filename}`);
+        files[filename] = json(value);
+        directories.add(dirname(filename));
+    };
+    const publicPath = (name) => join(root, 'public-keys', `${name}.pem`);
+    for (const name of rsiAuthorityRoles) {
+        const filename = publicPath(name);
+        if (Object.hasOwn(files, filename))
+            fail(`public key paths collide: ${name}`);
+        files[filename] = role(name).publicKeyPem;
+    }
+    const identity = (name) => ({ authority: role(name).authority, keyId: role(name).keyId,
+        publicKeyPath: publicPath(name) });
+    const base = (name) => ({ schemaVersion: 1, authority: role(name).authority,
+        keyId: role(name).keyId, keyPath: role(name).keyPath, statePath: join(resources.stateRoot, `${name}.json`), controlDatabasePath: ledgerPath });
+    const common = { repository: source.repository, worktreeRoot, owner: reviews.owner, plugins: [...reviews.plugins],
+        maxChangedFiles: positive(reviews.maxChangedFiles, 256, 'changed files'),
+        maxChangedBytes: positive(reviews.maxInputBytes, 16 * 1024 * 1024, 'changed bytes'), receiptTtlMs: 60_000 };
+    const approvalConfig = { ...base('approval'), grant: { id: `approval-${resources.installationId}`,
+            expiresAt: expiry, maxApprovals: Math.min(jobs.maxSubmissions, reviews.maxReviews), ...common, versioning: 'patch' } };
+    const releaseConfig = { ...base('release'), grant: { id: `release-${resources.installationId}`,
+            expiresAt: expiry, maxReleases: Math.min(jobs.maxSubmissions, reviews.maxReviews), ...common, versioning: 'patch', policies: input.policies } };
+    const ledger = { id: resources.ledgerId, path: ledgerPath };
+    const profilePath = join(home, 'profiles', manifest.targetProfile);
+    const packages = reviews.plugins.map(name => `@dsh-enhanced/${name}`);
+    const adoptionPolicies = input.policies.map(({ candidateId, packageName, dshBaseline, capabilities, authorities, requires, registryId, registryLocator }) => ({ candidateId, packageName, dshBaseline, capabilities, authorities, requires, registryId, registryLocator }));
+    const adoptionConfig = { ...base('adoption'), grant: { id: `adoption-${resources.installationId}`,
+            expiresAt: expiry, maxAdoptions: Math.min(jobs.maxSubmissions, reviews.maxReviews), owner: reviews.owner,
+            installationId: resources.installationId, ledger, target: { dshHome: home, profile: manifest.targetProfile, profilePath },
+            executor: { id: executor.id, version: executor.version, path: executor.path, sha256: executor.sha256 },
+            catalogPath: resources.catalog.path, receiptTtlMs: 60_000, handoff: adoption.handoff,
+            liveQualification: adoption.liveQualification, hostDeploymentInputs: adoption.hostDeploymentInputs, policies: adoptionPolicies } };
+    const observationConfig = { ...base('observation'), grant: { policy: observations.policy,
+            owner: reviews.owner, installationId: resources.installationId, ledger, profilePath, packages, receiptTtlMs: 60_000 } };
+    const qualificationConfig = { ...base('qualification'), grant: { id: `qualification-${resources.installationId}`,
+            expiresAt: expiry, maxQualifications: Math.min(jobs.maxSubmissions, observations.policy.maximumObservations, 1_000),
+            owner: reviews.owner, installationId: resources.installationId, ledger, profilePath, packages,
+            terms: adoption.liveQualification, receiptTtlMs: 60_000 } };
+    add(approvalPath, approvalConfig);
+    add(releasePath, releaseConfig);
+    add(adoptionPath, adoptionConfig);
+    add(observationPath, observationConfig);
+    add(qualificationPath, qualificationConfig);
+    const releaseAdapters = {};
+    for (const phase of phases) {
+        const envName = `DSH_RELEASE_${phase.toUpperCase().replaceAll('-', '_')}_CONFIG`;
+        const configPath = within(root, env[envName], `${phase} adapter path`);
+        const executable = checkedPin(runtime.releaseAdapters[phase], `${phase} adapter`);
+        const stateRoot = join(resources.stateRoot, 'release', phase);
+        directories.add(stateRoot);
+        const adapter = { schemaVersion: 1, id: `release-${phase}-${resources.installationId}`, phase,
+            executablePath: executable.path, authority: role(phase).authority, keyId: role(phase).keyId,
+            privateKeyPath: role(phase).keyPath, authorizationAuthority: identity('release'), stateRoot,
+            git: { executable: checkedPin(reviews.git, 'review Git'), remote: source.baseline.remote,
+                targetBranch: source.baseline.targetBranch, authorName: 'DSH self iteration',
+                authorEmail: `agent-${resources.installationId}@dsh.invalid`, reviewStore: join(resources.stateRoot, 'reviews'),
+                reviewDecisionRoot: reviews.decisionRoot, reviewAuthority: identity('review') },
+            build: releaseBuild,
+            registry: { ...resources.registry, downloadRoot: join(resources.stateRoot, 'registry-download'), signer: identity('sign') },
+            catalog: { ...resources.catalog, helper: checkedPin(runtime.catalogValidator, 'catalog validator'),
+                interpreter: checkedPin(runtime.node, 'catalog Node') },
+            ...(phase === 'catalog-admission' ? { registryVerifier: identity('registry-verify') } : {}) };
+        add(configPath, adapter);
+        releaseAdapters[phase] = { id: adapter.id, version: 'dsh-local-release-adapter-1', ...executable,
+            interpreter: checkedPin(runtime.node, 'adapter Node'), authority: role(phase).authority, keyId: role(phase).keyId,
+            timeoutMs: 300_000, environmentAllowlist: [envName] };
+    }
+    const hostTemplate = {
+        authority: role('host').authority, keyId: role('host').keyId, privateKeyPath: role('host').keyPath,
+        stateRoot: join(resources.stateRoot, 'host-attestor'), executable: checkedPin(runtime.executables.hostAttestor, 'Host attestor'),
+        interpreter: checkedPin(runtime.node, 'Host Node'), processHelper: checkedPin(runtime.processHelper, 'process helper'),
+        systemctl: { ...checkedPin(input.systemctl, 'systemctl'), interpreter: input.systemctl.interpreter === null ? null
+                : checkedPin(input.systemctl.interpreter, 'systemctl interpreter') }, scope: 'user',
+        unit: `dsh-profile-${manifest.targetProfile}.service`, unitProperties: input.unitProperties,
+        timeoutMs: 20_000, stableWindowMs: 1_000, pollIntervalMs: 100,
+        readiness: { client: checkedPin(runtime.observerClient, 'observer client'), observer: cp.runtimeObserver },
+        recoveryReadiness: { client: checkedPin(runtime.observerClient, 'recovery observer client'), observer: cp.runtimeObserver },
+    };
+    const hostConfig = { schemaVersion: 1, statePath: join(resources.stateRoot, 'host-authority.json'),
+        controlDatabasePath: ledgerPath, trustPath, grant: { id: `host-${resources.installationId}`, notBefore: now,
+            expiresAt: expiry, maximumReloads: Math.min(jobs.maxSubmissions, 1_000), owner: reviews.owner,
+            profile: { name: manifest.targetProfile, path: profilePath }, packages,
+            coordinatorId: adoption.handoff.coordinatorId, hostDeploymentInputs: adoption.hostDeploymentInputs,
+            liveQualification: adoption.liveQualification }, template: hostTemplate };
+    const resolverSource = json(hostConfig);
+    add(resolverPath, hostConfig);
+    add(hostWrapperPath, { schemaVersion: 4, template: hostTemplate,
+        resolver: { executable: checkedPin(runtime.executables.hostAuthority, 'Host resolver'),
+            interpreter: checkedPin(runtime.node, 'resolver Node'), configPath: resolverPath,
+            configSha256: digest(resolverSource), timeoutMs: 10_000 } });
+    const trust = { schemaVersion: 4, installationId: resources.installationId, dshHome: home, ledger,
+        executor, hostPolicy: defaultHostAttestationPolicy,
+        hostAttestor: { id: `host-attestor-${resources.installationId}`, version: 'dsh-systemd-host-attestor-8',
+            ...checkedPin(runtime.executables.hostAttestor, 'Host attestor'), interpreter: checkedPin(runtime.node, 'Host Node'),
+            environmentAllowlist: ['DSH_SYSTEMD_HOST_ATTESTOR_CONFIG'], authority: role('host').authority, keyId: role('host').keyId,
+            timeoutMs: 60_000 }, catalog: resources.catalog,
+        releaseRegistry: { id: resources.registry.id, locator: resources.registry.locator, protocol: 'dsh', caPins: [], tokenEnvironment: null },
+        releaseReceiptTtlMs: 60_000, releaseAdapters,
+        approvalKeys: [key('approval'), key('adoption')], hostAttestationKeys: [key('host'), key('observation'), key('qualification')],
+        releaseKeys: phases.map(name => key(name)), releaseAuthorizationKeys: [key('release')] };
+    // Local file registries carry no CA or token fields on disk. The trust
+    // loader normalizes both to []/null after applying the schema-4 contract.
+    add(trustPath, { ...trust, releaseRegistry: { id: resources.registry.id, locator: resources.registry.locator, protocol: 'dsh' } });
+    if (new Set(Object.keys(files)).size !== rsiAuthorityRoles.length + 5 + phases.length + 2 + 1)
+        fail('generated config path collision');
+    return { files, directories: [...directories].sort(), trust };
+}
+//# sourceMappingURL=rsi-authority-config.js.map

package/lib/rsi-authority-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-authority-config.js","sourceRoot":"","sources":["../src/rsi-authority-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAE,4BAA4B,EAE4D,MAAM,oCAAoC,CAAA;AAE3I,OAAO,EAAE,iBAAiB,EAA8B,MAAM,8BAA8B,CAAA;AAM5F,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,mBAAmB,CAAkD,CAAA;AAC7J,MAAM,MAAM,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC5F,MAAM,IAAI,GAAG,CAAC,KAAc,EAAU,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAA;AAC9E,SAAS,IAAI,CAAC,OAAe,IAAW,MAAM,IAAI,KAAK,CAAC,yBAAyB,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC;AAC7F,SAAS,IAAI,CAAC,KAAa,EAAE,KAAa;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK;WAC3F,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,GAAG,KAAK,oCAAoC,CAAC,CAAA;IACtG,OAAO,KAAK,CAAA;AACd,CAAC;AACD,SAAS,MAAM,CAAC,IAAY,EAAE,KAAa,EAAE,KAAa;IACxD,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IAC7C,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACnC,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,GAAG,KAAK,2CAA2C,CAAC,CAAA;IAC5I,OAAO,KAAK,CAAA;AACd,CAAC;AACD,SAAS,MAAM,CAAC,KAAa,EAAE,GAAW,EAAE,KAAa;IACvD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,GAAG;QAAE,IAAI,CAAC,GAAG,KAAK,cAAc,CAAC,CAAA;IAC9E,OAAO,KAAK,CAAA;AACd,CAAC;AACD,SAAS,QAAQ,CAAC,KAAa,EAAE,GAAW,EAAE,KAAa;IACzD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,GAAG;QAAE,IAAI,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAA;IAC1G,OAAO,KAAK,CAAA;AACd,CAAC;AACD,SAAS,UAAU,CAAC,KAAU,EAAE,KAAa;IAC3C,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACvB,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAA;IAC7E,OAAO,KAAK,CAAA;AACd,CAAC;AAeD;;yEAEyE;AACzE,MAAM,UAAU,0BAA0B,CAAC,KAA8B;IAGvE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,KAAK,CAAA;IACnF,MAAM,EAAE,GAAG,QAAQ,CAAC,YAAY,EAAE,OAAO,GAAG,QAAQ,CAAC,aAAa,EAAE,GAAG,GAAG,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;IAC7G,MAAM,IAAI,GAAG,EAAE,CAAC,UAAU,EAAE,SAAS,GAAG,EAAE,CAAC,eAAe,EAAE,QAAQ,GAAG,EAAE,CAAC,cAAc,CAAA;IACxF,MAAM,QAAQ,GAAG,EAAE,CAAC,eAAe,EAAE,YAAY,GAAG,EAAE,CAAC,gBAAgB,EAAE,aAAa,GAAG,EAAE,CAAC,iBAAiB,CAAA;IAC7G,IAAI,QAAQ,CAAC,aAAa,KAAK,CAAC,IAAI,SAAS,CAAC,aAAa,KAAK,CAAC,IAAI,OAAO,CAAC,aAAa,KAAK,CAAC,IAAI,MAAM,CAAC,aAAa,KAAK,CAAC;WACzH,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,IAAI,CAAC,aAAa;WACzH,CAAC,EAAE,CAAC,eAAe,IAAI,CAAC,EAAE,CAAC,qBAAqB,IAAI,CAAC,EAAE,CAAC,sBAAsB,IAAI,CAAC,GAAG;WACtF,CAAC,QAAQ,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,oBAAoB;QAAE,IAAI,CAAC,oDAAoD,CAAC,CAAA;IACnJ,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;IAC/D,IAAI,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,iBAAiB,EAAE,QAAQ,CAAC,aAAa,CAAC;WACvE,SAAS,CAAC,UAAU,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,SAAS,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC;WAChH,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,wBAAwB,EAAE,QAAQ,CAAC,aAAa,CAAC;WAC7E,EAAE,CAAC,eAAe,CAAC,WAAW,KAAK,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,aAAa,CAAC;WACjF,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,aAAa,IAAI,YAAY,CAAC,WAAW,KAAK,EAAE,CAAC,eAAe,CAAC,WAAW;WAC1G,aAAa,CAAC,WAAW,KAAK,EAAE,CAAC,eAAe,CAAC,WAAW;WAC5D,EAAE,CAAC,WAAW,KAAK,SAAS,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU;WAClF,MAAM,CAAC,QAAQ,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;WAChG,OAAO,CAAC,UAAU,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,sBAAsB,CAAC,kBAAkB,KAAK,OAAO,CAAC,YAAY;WACtH,EAAE,CAAC,sBAAsB,CAAC,iBAAiB,KAAK,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,UAAU,KAAK,OAAO;WAC9F,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;WACjG,OAAO,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,MAAM;WACvF,CAAC,iBAAiB,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;WACrF,QAAQ,CAAC,iBAAiB,CAAC,SAAS,KAAK,SAAS,CAAC,UAAU,CAAC,aAAa,CAAC,SAAS;WACrF,QAAQ,CAAC,iBAAiB,CAAC,KAAK,KAAK,SAAS,CAAC,UAAU,CAAC,aAAa,CAAC,KAAK;WAC7E,QAAQ,CAAC,kBAAkB,EAAE,WAAW,EAAE,gCAAgC,KAAK,GAAG,CAAC,gCAAgC;QAAE,IAAI,CAAC,mDAAmD,CAAC,CAAA;IACnL,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC,SAAS,CAAC;QAC5G,CAAC,aAAa,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC,eAAe,EAAE,aAAa,CAAC,SAAS,CAAC,CAAU,EAAE,CAAC;QAChG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;eAC/D,CAAC,iBAAiB,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,GAAG,IAAI,iDAAiD,CAAC,CAAA;IAC3H,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,qBAAqB,CAAC,EAAE,gBAAgB,CAAC,CAAA;IACpF,MAAM,YAAY,GAAG,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAA;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAA;IAChE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,EAAE,YAAY,CAAC,CAAA;IAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAA;IACtD,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,gCAAiC,EAAE,mBAAmB,CAAC,CAAA;IAChG,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAA;IAC/E,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAA;IAC5E,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAA;IACxF,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,SAAS,CAAC,UAAU,EAAE,yBAAyB,CAAC,CAAA;IAClG,MAAM,iBAAiB,GAAG,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,UAAU,EAAE,2BAA2B,CAAC,CAAA;IACvG,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,gBAAgB,CAAC,EAClH,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,yBAAyB,CAAC,CAAC,CAAA;IACxE,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,oBAAoB,CAAC,CAAA;IAC3D,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAA;IACtD,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,mBAAmB,EAAE,KAAK,EAAE,mBAAmB,CAAC,CAAA;IAC7E,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,QAAQ,CAAC,MAAM;WAClJ,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM;QAAE,IAAI,CAAC,6CAA6C,CAAC,CAAA;IAClH,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpC,IAAI,MAAM,CAAC,YAAY,KAAK,MAAM,CAAC,QAAQ,CAAC,YAAY,IAAI,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,OAAO;eAC9F,MAAM,CAAC,WAAW,KAAK,iBAAiB,MAAM,CAAC,WAAW,EAAE,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW,MAAM,CAAC,WAAW,EAAE;eACtH,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,QAAQ,CAAC,EAAE,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,CAAC,QAAQ,CAAC,OAAO;eACpG,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,OAAO,CAAC,EAAE,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,OAAO,CAAC,IAAI;eAC1F,MAAM,CAAC,yBAAyB,GAAG,CAAC;YAAE,IAAI,CAAC,2CAA2C,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;IAClH,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,IAAsC,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;IACnF,MAAM,GAAG,GAAG,CAAC,IAAsC,EAAE,EAAE;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3B,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,IAAI,MAAM,CAAC;eACrE,QAAQ,CAAC,SAAS,KAAK,GAAG,IAAI,IAAI,SAAS,CAAC,cAAc,EAAE,IAAI,QAAQ,CAAC,KAAK,KAAK,GAAG,QAAQ,CAAC,SAAS,MAAM;YAAE,IAAI,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAA;QACtJ,IAAI,CAAC;YAAC,IAAI,eAAe,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,iBAAiB,KAAK,SAAS;gBAAE,IAAI,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAA;QAAC,CAAC;QAC5H,MAAM,CAAC;YAAC,IAAI,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAA;QAAC,CAAC;QAC9C,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAA;IACtG,CAAC,CAAA;IACD,IAAI,IAAI,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC,MAAM;QAAE,IAAI,CAAC,oCAAoC,CAAC,CAAA;IACjJ,MAAM,KAAK,GAA2B,EAAE,CAAA;IACxC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,YAAY;QACnH,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC;QAChG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAA;IAC9F,MAAM,GAAG,GAAG,CAAC,QAAgB,EAAE,KAAc,EAAE,EAAE;QAC/C,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC;YAAE,IAAI,CAAC,yBAAyB,QAAQ,EAAE,CAAC,CAAA;QAC7E,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;QAC7B,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAA;IACpC,CAAC,CAAA;IACD,MAAM,UAAU,GAAG,CAAC,IAAsC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,IAAI,MAAM,CAAC,CAAA;IACvG,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;QACjC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC;YAAE,IAAI,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAA;QAC7E,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,YAAY,CAAA;IAC3C,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,IAAsC,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK;QACtH,aAAa,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACpC,MAAM,IAAI,GAAG,CAAC,IAAsC,EAAE,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,CAAU,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS;QACpH,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,IAAI,OAAO,CAAC,EAAE,mBAAmB,EAAE,UAAU,EAAE,CAAC,CAAA;IAChJ,MAAM,MAAM,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/G,eAAe,EAAE,QAAQ,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,EAAE,eAAe,CAAC;QACxE,eAAe,EAAE,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,eAAe,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,CAAA;IAC7G,MAAM,cAAc,GAAkC,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,YAAY,SAAS,CAAC,cAAc,EAAE;YAC9H,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,CAAA;IACxH,MAAM,aAAa,GAAiC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,WAAW,SAAS,CAAC,cAAc,EAAE;YAC1H,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAA;IACjJ,MAAM,MAAM,GAAG,EAAE,EAAE,EAAE,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;IAC3D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAA;IAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAA;IACrE,MAAM,gBAAgB,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,eAAe,EAAE,EAAE,EAAE,CAC1J,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC,CAAC,CAAA;IAChH,MAAM,cAAc,GAAkC,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,YAAY,SAAS,CAAC,cAAc,EAAE;YAC9H,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK;YACxG,cAAc,EAAE,SAAS,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,aAAa,EAAE,WAAW,EAAE;YACzH,QAAQ,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE;YACtG,WAAW,EAAE,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO;YACpF,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,EAAE,QAAQ,EAAE,gBAAgB,EAAE,EAAE,CAAA;IACpI,MAAM,iBAAiB,GAAmC,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM;YACtH,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,cAAc,EAAE,SAAS,CAAC,cAAc,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,CAAA;IACzH,MAAM,mBAAmB,GAAqC,EAAE,GAAG,IAAI,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,iBAAiB,SAAS,CAAC,cAAc,EAAE;YAChJ,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,YAAY,CAAC,MAAM,CAAC,mBAAmB,EAAE,KAAK,CAAC;YACnH,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,cAAc,EAAE,SAAS,CAAC,cAAc,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ;YAC7F,KAAK,EAAE,QAAQ,CAAC,iBAAiB,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,CAAA;IAC7D,GAAG,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IAAC,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAAC,GAAG,CAAC,YAAY,EAAE,cAAc,CAAC,CAAA;IACrG,GAAG,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;IAAC,GAAG,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAA;IAEpF,MAAM,eAAe,GAAG,EAA8D,CAAA;IACtF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,eAAe,KAAK,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,SAAS,CAAA;QAChF,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAE,EAAE,GAAG,KAAK,eAAe,CAAC,CAAA;QACvE,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,GAAG,KAAK,UAAU,CAAC,CAAA;QACjF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;QAC7D,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QAC1B,MAAM,OAAO,GAAG,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,WAAW,KAAK,IAAI,SAAS,CAAC,cAAc,EAAE,EAAE,KAAK;YAC3F,cAAc,EAAE,UAAU,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK;YAC3F,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,sBAAsB,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS;YAC3F,GAAG,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;gBACtF,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,UAAU,EAAE,oBAAoB;gBAC5E,WAAW,EAAE,SAAS,SAAS,CAAC,cAAc,cAAc,EAAE,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC;gBAC/G,kBAAkB,EAAE,OAAO,CAAC,YAAY,EAAE,eAAe,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE;YACjF,KAAK,EAAE,YAAY;YACnB,QAAQ,EAAE,EAAE,GAAG,SAAS,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,mBAAmB,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE;YAC3H,OAAO,EAAE,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,gBAAgB,EAAE,mBAAmB,CAAC;gBAChG,WAAW,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE;YACzD,GAAG,CAAC,KAAK,KAAK,mBAAmB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;QAC/F,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;QACxB,eAAe,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,6BAA6B,EAAE,GAAG,UAAU;YAC9F,WAAW,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK;YACjH,SAAS,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,OAAO,CAAC,EAAE,CAAA;IACzD,CAAC;IAED,MAAM,YAAY,GAA2C;QAC3D,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO;QAClG,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,YAAY,EAAE,eAAe,CAAC;QAChI,WAAW,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,aAAa,EAAE,UAAU,CAAC,OAAO,CAAC,aAAa,EAAE,gBAAgB,CAAC;QACtH,SAAS,EAAE,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI;gBAChH,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,uBAAuB,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM;QACrF,IAAI,EAAE,eAAe,QAAQ,CAAC,aAAa,UAAU,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc;QAC3F,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG;QAC7D,SAAS,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,cAAc,EAAE,iBAAiB,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,eAAe,EAAE;QAC1G,iBAAiB,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,cAAc,EAAE,0BAA0B,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,eAAe,EAAE;KAC5H,CAAA;IACD,MAAM,UAAU,GAA+B,EAAE,aAAa,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,qBAAqB,CAAC;QAC5H,mBAAmB,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,SAAS,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,GAAG;YACzG,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK;YAC7F,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,aAAa,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,QAAQ;YACtE,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;YAClG,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAA;IAC7E,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,CAAA;IACvC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAA;IAC7B,GAAG,CAAC,eAAe,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,QAAQ,EAAE,YAAY;QAC7D,QAAQ,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,aAAa,EAAE,eAAe,CAAC;YACpF,WAAW,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,UAAU,EAAE,YAAY;YAChF,YAAY,EAAE,MAAM,CAAC,cAAc,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAA;IAEhE,MAAM,KAAK,GAA6B,EAAE,aAAa,EAAE,CAAC,EAAE,cAAc,EAAE,SAAS,CAAC,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM;QACzH,QAAQ,EAAE,UAAU,EAAE,4BAA4B;QAClD,YAAY,EAAE,EAAE,EAAE,EAAE,iBAAiB,SAAS,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,6BAA6B;YACrG,GAAG,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,YAAY,EAAE,eAAe,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC;YACpH,oBAAoB,EAAE,CAAC,kCAAkC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK;YACxH,SAAS,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO;QACjD,eAAe,EAAE,EAAE,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE;QACxI,mBAAmB,EAAE,MAAM,EAAE,eAAe;QAC5C,YAAY,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC;QAC9H,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,wBAAwB,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAA;IAC1F,uEAAuE;IACvE,0EAA0E;IAC1E,GAAG,CAAC,SAAS,EAAE,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAA;IAClI,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC;QAAE,IAAI,CAAC,iCAAiC,CAAC,CAAA;IACtI,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAA;AAC/D,CAAC"}

package/lib/rsi-authority-resources.d.ts

@@ -0,0 +1,36 @@
+export declare const rsiAuthorityRoles: readonly ["approval", "release", "adoption", "observation", "qualification", "host", "pr", "review", "merge", "build", "sign", "publish", "registry-verify", "catalog-admission"];
+type Role = typeof rsiAuthorityRoles[number];
+export interface RsiAuthorityIdentity {
+    authority: string;
+    keyId: string;
+    keyPath: string;
+    publicKeyPem: string;
+}
+export interface RsiAuthorityResources {
+    schemaVersion: 1;
+    root: string;
+    installationId: string;
+    ledgerId: string;
+    identities: Record<Role, RsiAuthorityIdentity>;
+    registry: {
+        id: string;
+        root: string;
+        locator: string;
+    };
+    catalog: {
+        id: string;
+        path: string;
+    };
+    stateRoot: string;
+    configRoot: string;
+}
+/** Caller holds the DSH_HOME lifecycle lock. This creates identities and local
+ * storage, not grants; owner-bound authorization is configured separately. */
+export declare function prepareRsiAuthorityResources(input: {
+    dshHome: string;
+    profile: string;
+    signal?: AbortSignal;
+    existingOnly?: boolean;
+}): Promise<RsiAuthorityResources>;
+export {};
+//# sourceMappingURL=rsi-authority-resources.d.ts.map

package/lib/rsi-authority-resources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-authority-resources.d.ts","sourceRoot":"","sources":["../src/rsi-authority-resources.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,iBAAiB,mLACyE,CAAA;AACvG,KAAK,IAAI,GAAG,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAA;AAC5C,MAAM,WAAW,oBAAoB;IAAG,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE;AACjH,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;IACxE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAA;IAC9C,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IACvD,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACrC,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CACtC;AAyDD;8EAC8E;AAC9E,wBAAsB,4BAA4B,CAAC,KAAK,EAAE;IACxD,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAAC,YAAY,CAAC,EAAE,OAAO,CAAA;CAC/E,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAiDjC"}

package/lib/rsi-authority-resources.js

@@ -0,0 +1,139 @@
+import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, randomUUID } from 'node:crypto';
+import { lstat, mkdir, readdir, realpath, rm } from 'node:fs/promises';
+import { isAbsolute, join, resolve } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { isDeepStrictEqual } from 'node:util';
+import { rsiBuildResources as io } from './rsi-build.js';
+export const rsiAuthorityRoles = ['approval', 'release', 'adoption', 'observation', 'qualification', 'host',
+    'pr', 'review', 'merge', 'build', 'sign', 'publish', 'registry-verify', 'catalog-admission'];
+const uuid = /^[a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/u;
+const hash = (value) => createHash('sha256').update(value).digest('hex');
+function fail(message) { throw new Error(`rsi authority resources: ${message}`); }
+async function readPrivate(path, maximum) {
+    const item = await lstat(path);
+    if (!item.isFile() || item.nlink !== 1 || await realpath(path) !== path)
+        fail(`unsafe file: ${path}`);
+    return io.readStable(path, maximum, true);
+}
+function locations(home, profile) {
+    const root = join(home, 'rsi-authorities', profile);
+    return { root, keys: join(root, 'identities'), stateRoot: join(root, 'state'), configRoot: join(root, 'config'),
+        registryRoot: join(root, 'registry'), catalogPath: join(root, 'catalog.json'), receiptPath: join(root, 'bootstrap.json') };
+}
+async function inspect(home, profile, signal) {
+    const paths = locations(home, profile);
+    await io.directory(paths.root);
+    if (!isDeepStrictEqual((await readdir(paths.root)).sort(), ['bootstrap.json', 'catalog.json', 'config', 'identities', 'registry', 'state']))
+        fail('existing resources are incomplete');
+    const receipt = JSON.parse((await readPrivate(paths.receiptPath, 65_536)).toString('utf8'));
+    const { receiptDigest, ...content } = receipt;
+    const resources = receipt.resources;
+    if (receipt.schemaVersion !== 1 || receipt.dshHome !== home || receipt.profile !== profile
+        || hash(JSON.stringify(content)) !== receiptDigest || resources?.schemaVersion !== 1
+        || resources.root !== paths.root || !uuid.test(resources.installationId) || !uuid.test(resources.ledgerId)
+        || resources.installationId === resources.ledgerId || resources.registry?.id !== `registry-${resources.installationId}`
+        || resources.registry.root !== paths.registryRoot || resources.registry.locator !== pathToFileURL(paths.registryRoot).href
+        || resources.catalog?.id !== `catalog-${resources.installationId}` || resources.catalog.path !== paths.catalogPath
+        || resources.stateRoot !== paths.stateRoot || resources.configRoot !== paths.configRoot
+        || !resources.identities || !receipt.keyDigests
+        || !isDeepStrictEqual(Object.keys(resources.identities).sort(), [...rsiAuthorityRoles].sort())
+        || !isDeepStrictEqual(Object.keys(receipt.keyDigests).sort(), [...rsiAuthorityRoles].sort()))
+        fail('resource receipt differs from the installation');
+    for (const directory of [paths.keys, paths.stateRoot, paths.configRoot, paths.registryRoot])
+        await io.directory(directory);
+    if (!isDeepStrictEqual((await readdir(paths.keys)).sort(), rsiAuthorityRoles.map(role => `${role}.pem`).sort()))
+        fail('signing identities changed');
+    const publicKeys = new Set();
+    for (const role of rsiAuthorityRoles) {
+        signal.throwIfAborted();
+        const identity = resources.identities[role], expectedAuthority = `${role}-${resources.installationId}`;
+        if (!isDeepStrictEqual(Object.keys(identity).sort(), ['authority', 'keyId', 'keyPath', 'publicKeyPem'])
+            || identity.authority !== expectedAuthority || identity.keyId !== `${expectedAuthority}-key`
+            || identity.keyPath !== join(paths.keys, `${role}.pem`))
+            fail('signing identity binding changed');
+        const bytes = await readPrivate(identity.keyPath, 16_384);
+        const key = createPrivateKey(bytes), publicKey = createPublicKey(key).export({ format: 'pem', type: 'spki' }).toString();
+        if (key.asymmetricKeyType !== 'ed25519' || hash(bytes) !== receipt.keyDigests[role]
+            || publicKey !== identity.publicKeyPem || publicKeys.has(publicKey))
+            fail('signing identity key changed');
+        publicKeys.add(publicKey);
+    }
+    // These are live release resources: validate them, never reset their contents
+    // or compare them with the initial empty catalog/registry/state snapshots.
+    const { parseCatalog } = await import('@dsh-enhanced/plugin-control-plane');
+    parseCatalog(JSON.parse((await readPrivate(paths.catalogPath, 2_097_152)).toString('utf8')));
+    signal.throwIfAborted();
+    return resources;
+}
+/** Caller holds the DSH_HOME lifecycle lock. This creates identities and local
+ * storage, not grants; owner-bound authorization is configured separately. */
+export async function prepareRsiAuthorityResources(input) {
+    const { dshHome: home, profile } = input;
+    if (!isAbsolute(home) || resolve(home) !== home || home.includes('\0') || /[\r\n]/u.test(home)
+        || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u.test(profile))
+        fail('invalid installation binding');
+    const signal = AbortSignal.any([input.signal ?? new AbortController().signal, AbortSignal.timeout(30_000)]);
+    signal.throwIfAborted();
+    await io.directory(home, false);
+    const parent = join(home, 'rsi-authorities'), paths = locations(home, profile);
+    if (input.existingOnly) {
+        await io.directory(parent);
+        return inspect(home, profile, signal);
+    }
+    try {
+        await mkdir(parent, { mode: 0o700 });
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST')
+            throw error;
+    }
+    await io.directory(parent);
+    let existing = false;
+    try {
+        await lstat(paths.root);
+        existing = true;
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
+    if (existing)
+        return inspect(home, profile, signal);
+    // An exclusive claim prevents overwriting another installation. Failed work
+    // removes only this exact directory; incomplete crash residue is never reset.
+    await mkdir(paths.root, { mode: 0o700 });
+    const claimed = await lstat(paths.root);
+    try {
+        for (const directory of [paths.keys, paths.stateRoot, paths.configRoot, paths.registryRoot])
+            await mkdir(directory, { mode: 0o700 });
+        const installationId = randomUUID(), ledgerId = randomUUID();
+        const identities = {}, keyDigests = {};
+        for (const role of rsiAuthorityRoles) {
+            signal.throwIfAborted();
+            const pair = generateKeyPairSync('ed25519'), keyPath = join(paths.keys, `${role}.pem`);
+            const privateKey = pair.privateKey.export({ type: 'pkcs8', format: 'pem' }).toString();
+            await io.writeExclusive(keyPath, privateKey);
+            const authority = `${role}-${installationId}`;
+            identities[role] = { authority, keyId: `${authority}-key`, keyPath,
+                publicKeyPem: pair.publicKey.export({ type: 'spki', format: 'pem' }).toString() };
+            keyDigests[role] = hash(privateKey);
+        }
+        const resources = { schemaVersion: 1, root: paths.root, installationId, ledgerId, identities,
+            registry: { id: `registry-${installationId}`, root: paths.registryRoot, locator: pathToFileURL(paths.registryRoot).href },
+            catalog: { id: `catalog-${installationId}`, path: paths.catalogPath }, stateRoot: paths.stateRoot, configRoot: paths.configRoot };
+        await io.writeExclusive(paths.catalogPath, '{"schemaVersion":1,"entries":[]}\n');
+        const content = { schemaVersion: 1, dshHome: home, profile, resources, keyDigests };
+        await io.writeExclusive(paths.receiptPath, JSON.stringify({ ...content, receiptDigest: hash(JSON.stringify(content)) }));
+        for (const directory of [paths.keys, paths.stateRoot, paths.configRoot, paths.registryRoot, paths.root, parent])
+            await io.syncDirectory(directory);
+        return await inspect(home, profile, signal);
+    }
+    catch (error) {
+        const current = await lstat(paths.root).catch(() => undefined);
+        if (current?.isDirectory() && current.dev === claimed.dev && current.ino === claimed.ino)
+            await rm(paths.root, { recursive: true, force: true });
+        await io.syncDirectory(parent);
+        throw error;
+    }
+}
+//# sourceMappingURL=rsi-authority-resources.js.map

package/lib/rsi-authority-resources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-authority-resources.js","sourceRoot":"","sources":["../src/rsi-authority-resources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAC5G,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAA;AACtE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAE,iBAAiB,IAAI,EAAE,EAAE,MAAM,gBAAgB,CAAA;AAExD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM;IACzG,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,mBAAmB,CAAU,CAAA;AAYvG,MAAM,IAAI,GAAG,wEAAwE,CAAA;AACrF,MAAM,IAAI,GAAG,CAAC,KAAsB,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACjG,SAAS,IAAI,CAAC,OAAe,IAAW,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,EAAE,CAAC,CAAA,CAAC,CAAC;AAEhG,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,OAAe;IACtD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;IAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI;QAAE,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAA;IACrG,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;AAC3C,CAAC;AACD,SAAS,SAAS,CAAC,IAAY,EAAE,OAAe;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAA;IACnD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QAC7G,YAAY,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,CAAA;AAC9H,CAAC;AACD,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,OAAe,EAAE,MAAmB;IACvE,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACtC,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC9B,IAAI,CAAC,iBAAiB,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QAAE,IAAI,CAAC,mCAAmC,CAAC,CAAA;IACtL,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAA;IACtG,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,CAAA;IAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;IACnC,IAAI,OAAO,CAAC,aAAa,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO;WACrF,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,KAAK,aAAa,IAAI,SAAS,EAAE,aAAa,KAAK,CAAC;WACjF,SAAS,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;WACvG,SAAS,CAAC,cAAc,KAAK,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,QAAQ,EAAE,EAAE,KAAK,YAAY,SAAS,CAAC,cAAc,EAAE;WACpH,SAAS,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC,YAAY,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,KAAK,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,IAAI;WACvH,SAAS,CAAC,OAAO,EAAE,EAAE,KAAK,WAAW,SAAS,CAAC,cAAc,EAAE,IAAI,SAAS,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,WAAW;WAC/G,SAAS,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,SAAS,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;WACpF,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,UAAU;WAC5C,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,iBAAiB,CAAC,CAAC,IAAI,EAAE,CAAC;WAC3F,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,iBAAiB,CAAC,CAAC,IAAI,EAAE,CAAC;QAAE,IAAI,CAAC,gDAAgD,CAAC,CAAA;IACtJ,KAAK,MAAM,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC;QAAE,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;IAC1H,IAAI,CAAC,iBAAiB,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAAE,IAAI,CAAC,4BAA4B,CAAC,CAAA;IACnJ,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAA;IACpC,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,MAAM,CAAC,cAAc,EAAE,CAAA;QACvB,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,iBAAiB,GAAG,GAAG,IAAI,IAAI,SAAS,CAAC,cAAc,EAAE,CAAA;QACtG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;eAClG,QAAQ,CAAC,SAAS,KAAK,iBAAiB,IAAI,QAAQ,CAAC,KAAK,KAAK,GAAG,iBAAiB,MAAM;eACzF,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,IAAI,MAAM,CAAC;YAAE,IAAI,CAAC,kCAAkC,CAAC,CAAA;QACnG,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACzD,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,EAAE,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAA;QACxH,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;eAC9E,SAAS,KAAK,QAAQ,CAAC,YAAY,IAAI,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,8BAA8B,CAAC,CAAA;QAC3G,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IAC3B,CAAC;IACD,8EAA8E;IAC9E,2EAA2E;IAC3E,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,oCAAoC,CAAC,CAAA;IAC3E,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IAC5F,MAAM,CAAC,cAAc,EAAE,CAAA;IACvB,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;8EAC8E;AAC9E,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAElD;IACC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,CAAA;IACxC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;WACzF,CAAC,oCAAoC,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,IAAI,CAAC,8BAA8B,CAAC,CAAA;IAC9F,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IAC3G,MAAM,CAAC,cAAc,EAAE,CAAA;IACvB,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,EAAE,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAC9E,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QAC1B,OAAO,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;IACvC,CAAC;IACD,IAAI,CAAC;QAAC,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAA;IAAC,CAAC;IAClI,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IAC1B,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,IAAI,CAAC;QAAC,MAAM,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAAC,QAAQ,GAAG,IAAI,CAAA;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAA;IAAC,CAAC;IACtI,IAAI,QAAQ;QAAE,OAAO,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;IACnD,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAM,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACxC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACvC,IAAI,CAAC;QACH,KAAK,MAAM,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC;YAAE,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACpI,MAAM,cAAc,GAAG,UAAU,EAAE,EAAE,QAAQ,GAAG,UAAU,EAAE,CAAA;QAC5D,MAAM,UAAU,GAAG,EAAwC,EAAE,UAAU,GAAG,EAA0B,CAAA;QACpG,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;YACrC,MAAM,CAAC,cAAc,EAAE,CAAA;YACvB,MAAM,IAAI,GAAG,mBAAmB,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,IAAI,MAAM,CAAC,CAAA;YACtF,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAA;YACtF,MAAM,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;YAC5C,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,cAAc,EAAE,CAAA;YAC7C,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,SAAS,MAAM,EAAE,OAAO;gBAChE,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAA;YACnF,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAA;QACrC,CAAC;QACD,MAAM,SAAS,GAA0B,EAAE,aAAa,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU;YACjH,QAAQ,EAAE,EAAE,EAAE,EAAE,YAAY,cAAc,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,YAAY,EAAE,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE;YACzH,OAAO,EAAE,EAAE,EAAE,EAAE,WAAW,cAAc,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAA;QACnI,MAAM,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,oCAAoC,CAAC,CAAA;QAChF,MAAM,OAAO,GAAG,EAAE,aAAa,EAAE,CAAU,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;QAC5F,MAAM,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QACxH,KAAK,MAAM,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC;YAAE,MAAM,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,CAAA;QAClJ,OAAO,MAAM,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QAC9D,IAAI,OAAO,EAAE,WAAW,EAAE,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG;YAAE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAChJ,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,CAAA;QAC9B,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC"}

package/lib/rsi-authority-runtime.d.ts

@@ -0,0 +1,50 @@
+export interface Pin {
+    path: string;
+    sha256: string;
+}
+declare const PHASES: readonly ["pr", "review", "merge", "build", "sign", "publish", "registry-verify", "catalog-admission"];
+type Phase = typeof PHASES[number];
+type Executable = 'approval' | 'release' | 'adoption' | 'observation' | 'qualification' | 'hostAuthority' | 'hostAttestor';
+export interface RsiAuthorityRuntime {
+    schemaVersion: 1;
+    packageVersion: string;
+    root: string;
+    node: Pin;
+    executables: Record<Executable, Pin>;
+    releaseAdapters: Record<Phase, Pin>;
+    processHelper: Pin;
+    observerClient: Pin;
+    catalogValidator: Pin;
+    catalogInterpreter: Pin;
+}
+interface Options {
+    packageRoot?: string;
+    nodePath?: string;
+}
+/** Read a copied runtime receipt through its physical stage path, retaining
+ * the logical paths embedded in the original installation. */
+export declare function readRsiAuthorityRuntimeReceipt(input: {
+    logicalHome: string;
+    physicalHome: string;
+    profile: string;
+    signal?: AbortSignal;
+}): Promise<{
+    runtime: RsiAuthorityRuntime;
+    receiptDigest: string;
+}>;
+/** Replace only the copied runtime under a stopped Home stage. The receipt and
+ * shebangs keep their logical Home paths, so the transaction can rename Home. */
+export declare function replaceRsiAuthorityRuntimeInStage(input: {
+    logicalHome: string;
+    physicalHome: string;
+    profile: string;
+    signal?: AbortSignal;
+}, options?: Options): Promise<RsiAuthorityRuntime>;
+/** Caller holds the home lifecycle lock. Only this function's stage/final claim is removed on failure. */
+export declare function prepareRsiAuthorityRuntime(input: {
+    dshHome: string;
+    profile: string;
+    signal?: AbortSignal;
+}, options?: Options): Promise<RsiAuthorityRuntime>;
+export {};
+//# sourceMappingURL=rsi-authority-runtime.d.ts.map

package/lib/rsi-authority-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsi-authority-runtime.d.ts","sourceRoot":"","sources":["../src/rsi-authority-runtime.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,GAAG;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AACrD,QAAA,MAAM,MAAM,wGAAyG,CAAA;AACrH,KAAK,KAAK,GAAG,OAAO,MAAM,CAAC,MAAM,CAAC,CAAA;AAClC,KAAK,UAAU,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,aAAa,GAAG,eAAe,GAAG,eAAe,GAAG,cAAc,CAAA;AAC1H,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,CAAC,CAAA;IAChB,cAAc,EAAE,MAAM,CAAA;IACtB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,GAAG,CAAA;IACT,WAAW,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;IACpC,eAAe,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IACnC,aAAa,EAAE,GAAG,CAAA;IAClB,cAAc,EAAE,GAAG,CAAA;IACnB,gBAAgB,EAAE,GAAG,CAAA;IACrB,kBAAkB,EAAE,GAAG,CAAA;CACxB;AAID,UAAU,OAAO;IAAG,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE;AA8J7D;8DAC8D;AAC9D,wBAAsB,8BAA8B,CAAC,KAAK,EAAE;IAC1D,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CACjF,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,mBAAmB,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,CAcnE;AAED;iFACiF;AACjF,wBAAsB,iCAAiC,CAAC,KAAK,EAAE;IAC7D,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CACjF,EAAE,OAAO,GAAE,OAAY,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA4DtD;AAED,0GAA0G;AAC1G,wBAAsB,0BAA0B,CAAC,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,EAChH,OAAO,GAAE,OAAY,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAiErD"}