@dsh-enhanced/plugin-control-plane 0.1.47 → 0.1.49

package/bin/dsh-systemd-host-attestor.js

@@ -6,7 +6,7 @@ import { basename, dirname, isAbsolute, join, resolve } from 'node:path'
 import { DatabaseSync } from 'node:sqlite'
 import { fileURLToPath } from 'node:url'
 
-export const SYSTEMD_HOST_ATTESTOR_VERSION = 'dsh-systemd-host-attestor-5'
+export const SYSTEMD_HOST_ATTESTOR_VERSION = 'dsh-systemd-host-attestor-8'
 const DIGEST = /^[a-f0-9]{64}$/u
 const ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,159}$/u
 const UNIT_PROPERTIES = ['FragmentPath', 'DropInPaths', 'ExecStart', 'Environment', 'WorkingDirectory', 'User', 'Group', 'Type', 'KillMode']
@@ -104,8 +104,7 @@ function validateReadiness(ready, profilePath, withReload) {
   if (new Set(ready.deploymentFiles.map(spec => spec.path)).size !== ready.deploymentFiles.length) fail('duplicate deployment pin')
   if (ready.observer?.profilePath !== profilePath) fail('observer profile differs')
 }
-function loadConfig(environment, request) {
-  const config = parseJson(readSafe(environment.DSH_SYSTEMD_HOST_ATTESTOR_CONFIG, 65536, true), 'config')
+function loadConfig(environment, request, config) {
   object(config, ['schemaVersion', 'authority', 'keyId', 'privateKeyPath', 'stateRoot', 'executable', 'interpreter', 'processHelper',
     'systemctl', 'scope', 'unit', 'unitProperties', 'profileFiles', 'authorization', 'timeoutMs', 'stableWindowMs', 'pollIntervalMs',
     ...([2, 3].includes(config.schemaVersion) ? ['readiness'] : [])], 'config')
@@ -207,6 +206,135 @@ function loadConfig(environment, request) {
   assertCurrent(config, request)
   return { config, privateKey }
 }
+
+const TEMPLATE_FIELDS = ['authority', 'keyId', 'privateKeyPath', 'stateRoot', 'executable', 'interpreter', 'processHelper',
+  'systemctl', 'scope', 'unit', 'unitProperties', 'timeoutMs', 'stableWindowMs', 'pollIntervalMs', 'readiness', 'recoveryReadiness']
+
+async function processRunner(spec) {
+  const bytes = readSafe(spec.path, 1048576)
+  if (hash(bytes) !== spec.sha256) fail('process helper changed')
+  const { executeControlledProcess } = await import(`data:text/javascript;base64,${bytes.toString('base64')}`)
+  if (typeof executeControlledProcess !== 'function') fail('process helper contract is unavailable')
+  return executeControlledProcess
+}
+
+/** A pinned independent resolver authorizes each durable operation from its standing grant. */
+async function resolveStandingConfig(wrapper, request) {
+  object(wrapper, ['schemaVersion', 'template', 'resolver'], 'standing config')
+  const template = object(wrapper.template, TEMPLATE_FIELDS, 'standing template')
+  pin(template.executable, 'attestor executable', true); pin(template.interpreter, 'attestor interpreter', true)
+  pin(template.processHelper, 'process helper')
+  if (runningHash(process.argv[1]) !== template.executable.sha256 || runningHash(process.execPath) !== template.interpreter.sha256) fail('running attestor identity differs')
+  const resolver = object(wrapper.resolver, ['executable', 'interpreter', 'configPath', 'configSha256', 'timeoutMs'], 'authorization resolver')
+  pin(resolver.executable, 'resolver executable', true)
+  if (resolver.interpreter !== null) pin(resolver.interpreter, 'resolver interpreter', true)
+  integer(resolver.timeoutMs, 'resolver timeout', 1000, 60000)
+  text(resolver.configSha256, 'resolver config digest', DIGEST)
+  const configBytes = readSafe(resolver.configPath, 65536, true)
+  if (hash(configBytes) !== resolver.configSha256) fail('resolver config changed')
+  const authorityConfig = parseJson(configBytes, 'resolver config')
+  if (canonical(authorityConfig.template) !== canonical(template)) fail('resolver template differs from standing config')
+  const execute = await processRunner(template.processHelper)
+  const specs = [resolver.executable, ...(resolver.interpreter ? [resolver.interpreter] : [])], descriptors = []
+  try {
+    for (const spec of specs) {
+      const fd = openSync(spec.path, F.O_RDONLY | F.O_NOFOLLOW); descriptors.push(fd)
+      const bytes = descriptorBytes(fd, 268435456)
+      if (hash(bytes) !== spec.sha256) fail('resolver inode changed')
+      if ((resolver.interpreter === null || spec === resolver.interpreter)
+        && !bytes.subarray(0, 4).equals(Buffer.from([0x7f, 0x45, 0x4c, 0x46]))) fail('script resolver requires a pinned interpreter with native ELF identity')
+    }
+    const result = await execute({ command: descriptors.length === 2 ? '/proc/self/fd/4' : '/proc/self/fd/3',
+      args: [...(descriptors.length === 2 ? ['/proc/self/fd/3'] : []), '--config', resolver.configPath],
+      env: { LANG: 'C', LC_ALL: 'C' }, stdio: ['pipe', 'pipe', 'ignore', ...descriptors],
+      stdin: `${JSON.stringify(request)}\n`, maximumOutput: 524288, timeoutMs: resolver.timeoutMs })
+    for (let index = 0; index < descriptors.length; index++) if (hash(descriptorBytes(descriptors[index], 268435456)) !== specs[index].sha256) fail('resolver mutated')
+    if (hash(readSafe(resolver.configPath, 65536, true)) !== resolver.configSha256) fail('resolver config changed during authorization')
+    const derived = parseJson(Buffer.from(result), 'resolved config')
+    for (const field of TEMPLATE_FIELDS.filter(field => field !== 'readiness' && field !== 'recoveryReadiness')) {
+      if (canonical(derived[field]) !== canonical(template[field])) fail('resolved static authority differs')
+    }
+    const expectedSchema = request.kind === 'dsh-runtime-epoch-request' ? (derived.maintenance === undefined ? 5 : 6)
+      : request.phase === 'reload' ? 1 : request.phase === 'readiness' ? 2 : 3
+    if (derived.schemaVersion !== expectedSchema || derived.authorization?.requestDigest !== digest(request)) fail('resolver did not authorize the exact phase and request')
+    if (expectedSchema !== 1) {
+      if (request.phase === 'rollback' && request.requirements?.action === 'stop') {
+        if (derived.readiness !== null) fail('resolved stop readiness differs')
+      } else {
+        const expected = request.phase === 'rollback' ? template.recoveryReadiness : template.readiness
+        if (canonical(derived.readiness?.client) !== canonical(expected?.client)
+          || canonical(derived.readiness?.observer) !== canonical(expected?.observer)) fail('resolved observer authority differs')
+      }
+    }
+    return derived
+  } finally { for (const fd of descriptors.reverse()) closeSync(fd) }
+}
+function loadEpochConfig(environment, request, config) {
+  object(config, ['schemaVersion', 'authority', 'keyId', 'privateKeyPath', 'stateRoot', 'executable', 'interpreter', 'processHelper',
+    'systemctl', 'scope', 'unit', 'unitProperties', 'profileFiles', 'authorization', 'timeoutMs', 'stableWindowMs', 'pollIntervalMs',
+    'readiness', ...(config.schemaVersion === 6 ? ['maintenance'] : [])], 'epoch config')
+  if (![5, 6].includes(config.schemaVersion)) fail('runtime epoch requires config schema 5 or 6')
+  if (config.schemaVersion === 6 && (!Array.isArray(config.maintenance) || !config.maintenance.length
+    || config.maintenance.length > 256 || Buffer.byteLength(JSON.stringify(config.maintenance)) > 450000)) fail('maintenance chain exceeds bounds')
+  text(config.authority, 'authority', ID); text(config.keyId, 'keyId', ID)
+  integer(config.timeoutMs, 'timeout', 1000, 60000); integer(config.stableWindowMs, 'stable window', 50, 10000)
+  integer(config.pollIntervalMs, 'poll interval', 25, 1000)
+  if (config.stableWindowMs + config.pollIntervalMs >= config.timeoutMs || !['user', 'system'].includes(config.scope)) fail('epoch observation bounds are invalid')
+  const auth = object(config.authorization, ['installationId', 'ledger', 'profile', 'plan', 'activation', 'hostGeneration', 'requestDigest', 'notBefore', 'expiresAt'], 'epoch authorization')
+  text(auth.requestDigest, 'request digest', DIGEST)
+  if (digest(request) !== auth.requestDigest) fail('exact epoch request is not authorized')
+  object(auth.ledger, ['id', 'path'], 'ledger'); object(auth.profile, ['name', 'path'], 'profile')
+  object(auth.plan, ['id', 'digest'], 'plan'); object(auth.activation, ['id', 'fence'], 'activation')
+  text(auth.installationId, 'installation', /^[a-f0-9]{8}-[a-f0-9]{4}-[1-8][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/u)
+  for (const value of [auth.ledger.id, auth.plan.id, auth.activation.id]) text(value, 'identity', ID)
+  text(auth.plan.digest, 'plan digest', DIGEST); text(auth.profile.name, 'profile name', /^[a-z0-9][a-z0-9-]{0,63}$/u)
+  canonicalPath(auth.profile.path, 'profile'); canonicalPath(auth.ledger.path, 'ledger')
+  if (basename(auth.profile.path) !== auth.profile.name || basename(dirname(auth.profile.path)) !== 'profiles') fail('profile path and name differ')
+  integer(auth.activation.fence, 'fence', 1); integer(auth.hostGeneration, 'host generation', 1)
+  integer(auth.notBefore, 'authorization start'); integer(auth.expiresAt, 'authorization expiry', auth.notBefore + 1)
+  if (config.unit !== `dsh-profile-${auth.profile.name}.service`) fail('unit does not bind the profile')
+  object(config.unitProperties, UNIT_PROPERTIES, 'unit properties')
+  for (const property of UNIT_PROPERTIES) text(config.unitProperties[property], property)
+  if (!['simple', 'exec', 'notify'].includes(config.unitProperties.Type) || config.unitProperties.KillMode !== 'control-group') fail('unsupported unit lifecycle')
+  if (!Array.isArray(config.profileFiles) || config.profileFiles.length < 3 || config.profileFiles.length > 32) fail('profile pins are invalid')
+  const paths = config.profileFiles.map(spec => {
+    pin(spec, 'profile file')
+    if (!within(auth.profile.path, spec.path)) fail('profile pin is outside profile')
+    return spec.path
+  })
+  if (new Set(paths).size !== paths.length || !['package.json', 'pnpm-lock.yaml', 'cordis.patch.yml'].every(name => paths.includes(join(auth.profile.path, name)))) fail('profile manifest, lockfile and patch pins are required')
+  privateDirectory(config.stateRoot)
+  for (const path of [environment.DSH_SYSTEMD_HOST_ATTESTOR_CONFIG, config.privateKeyPath, config.stateRoot]) {
+    if (within(auth.profile.path, path)) fail('attestor authority must be outside the candidate profile')
+  }
+  const privateKey = createPrivateKey(readSafe(config.privateKeyPath, 16384, true))
+  if (privateKey.asymmetricKeyType !== 'ed25519') fail('signing key must be Ed25519')
+  pin(config.executable, 'attestor executable', true); pin(config.interpreter, 'attestor interpreter', true); pin(config.processHelper, 'process helper')
+  if (runningHash(process.argv[1]) !== config.executable.sha256 || runningHash(process.execPath) !== config.interpreter.sha256) fail('running attestor identity differs')
+  object(config.systemctl, ['path', 'sha256', 'interpreter'], 'systemctl')
+  pin({ path: config.systemctl.path, sha256: config.systemctl.sha256 }, 'systemctl', true)
+  if (config.systemctl.interpreter !== null) pin(config.systemctl.interpreter, 'systemctl interpreter', true)
+  object(request, ['schemaVersion', 'kind', 'operationId', 'requestedAt', 'receiptTtlMs', 'installationId', 'ledger', 'plan',
+    'activation', 'profile', 'issuer', 'predecessor', 'sequence', 'runtimeIdentityDigest'], 'epoch request')
+  if (request.schemaVersion !== 1 || request.kind !== 'dsh-runtime-epoch-request') fail('epoch request version or kind is invalid')
+  text(request.operationId, 'operation', ID); if (request.operationId.length > 152) fail('operation is too long for receipt identity')
+  integer(request.requestedAt, 'requestedAt'); integer(request.receiptTtlMs, 'receipt TTL', 1, 3600000)
+  integer(request.sequence, 'epoch sequence', 1); text(request.runtimeIdentityDigest, 'runtime identity digest', DIGEST)
+  const prior = object(request.predecessor, ['operationId', 'receiptDigest', 'hostGeneration'], 'epoch predecessor')
+  text(prior.operationId, 'predecessor operation', ID); text(prior.receiptDigest, 'predecessor digest', DIGEST)
+  integer(prior.hostGeneration, 'predecessor generation', 1)
+  if (prior.operationId === request.operationId || prior.hostGeneration !== auth.hostGeneration) fail('epoch predecessor is invalid')
+  for (const field of ['installationId', 'ledger', 'profile', 'plan', 'activation']) if (canonical(request[field]) !== canonical(auth[field])) fail(`${field} is not authorized`)
+  object(request.issuer, ['mode', 'id', 'version', 'path', 'sha256', 'interpreter', 'authority', 'keyId'], 'issuer')
+  text(request.issuer.id, 'issuer ID', ID)
+  if (request.issuer.mode !== 'configured-executable' || request.issuer.version !== SYSTEMD_HOST_ATTESTOR_VERSION
+    || request.issuer.path !== config.executable.path || request.issuer.sha256 !== config.executable.sha256
+    || canonical(request.issuer.interpreter) !== canonical(config.interpreter)
+    || request.issuer.authority !== config.authority || request.issuer.keyId !== config.keyId) fail('issuer differs from owner configuration')
+  validateReadiness(config.readiness, auth.profile.path, false)
+  assertCurrent(config, request)
+  return { config, privateKey }
+}
 function assertCurrent(config, request) {
   const now = Date.now(); const auth = config.authorization
   if (request.requestedAt < auth.notBefore || request.requestedAt > now || now > auth.expiresAt) fail('authorization expired or not yet valid')
@@ -618,11 +746,226 @@ async function attestRollback(request, config, privateKey, db, execute, deadline
     return cachedReceipt(db.prepare('SELECT * FROM reloads WHERE operation_id = ?').get(request.operationId), request, config, privateKey)
   })
 }
+function retainedSignedReceipt(row, privateKey, label) {
+  if (!row?.receipt || !row.observation) fail(`${label} is unresolved`)
+  const receipt = parseJson(Buffer.from(row.receipt), `${label} receipt`)
+  const observation = parseJson(Buffer.from(row.observation), `${label} observation`)
+  const { signature, ...unsigned } = receipt
+  if (receipt.operationId !== row.operation_id || receipt.requestDigest !== row.request_digest
+    || receipt.evidenceDigest !== digest(receipt.evidence) || receipt.evidence.probeDigest !== digest(observation)
+    || typeof signature !== 'string' || !verify(null, Buffer.from(canonical(unsigned)), createPublicKey(privateKey), Buffer.from(signature, 'base64'))) {
+    fail(`${label} signed evidence is invalid`)
+  }
+  // A prior passed readiness is durable history even after its short live TTL.
+  return { receipt, observation }
+}
+function boundEpochPredecessor(db, request, config, privateKey) {
+  const scopeId = digest({ installation: request.installationId })
+  const reload = db.prepare('SELECT * FROM reloads WHERE scope_id = ? ORDER BY generation DESC LIMIT 1').get(scopeId)
+  if (!reload || reload.generation !== config.authorization.hostGeneration || !reload.request || !reload.config) fail('latest Host generation is unresolved or superseded')
+  const priorRequest = parseJson(Buffer.from(reload.request), 'historical reload request')
+  const priorConfig = parseJson(Buffer.from(reload.config), 'historical reload config')
+  if (reload.request_digest !== digest(priorRequest) || reload.config_digest !== digest(priorConfig)) fail('historical reload context changed')
+  for (const field of ['installationId', 'ledger', 'profile', 'plan', 'activation']) {
+    if (canonical(priorRequest[field]) !== canonical(request[field])) fail('historical reload context differs')
+  }
+  for (const field of ['authority', 'keyId', 'privateKeyPath', 'stateRoot', 'scope', 'unit', 'unitProperties', 'profileFiles', 'systemctl']) {
+    if (config.schemaVersion === 6 && ['unitProperties', 'profileFiles'].includes(field)) continue
+    if (canonical(priorConfig[field]) !== canonical(config[field])) fail('historical deployment differs')
+  }
+  const signedReload = retainedSignedReceipt(reload, privateKey, 'historical reload')
+  if (priorRequest.phase !== 'reload' || signedReload.receipt.phase !== 'reload' || signedReload.receipt.outcome !== 'passed'
+    || signedReload.receipt.hostGeneration !== reload.generation || signedReload.receipt.authority !== config.authority
+    || signedReload.receipt.keyId !== config.keyId || signedReload.receipt.evidence.reloaded !== true
+    || signedReload.receipt.evidence.currentHostGeneration !== reload.generation
+    || signedReload.observation.requestDigest !== reload.request_digest || signedReload.observation.configDigest !== reload.config_digest) fail('historical reload is invalid')
+  const readiness = db.prepare('SELECT * FROM readiness WHERE reload_id = ?').get(reload.operation_id)
+  const signedReady = retainedSignedReceipt(readiness, privateKey, 'historical readiness')
+  const ready = signedReady.receipt
+  if (readiness.reload_id !== reload.operation_id || ready.phase !== 'readiness' || ready.outcome !== 'passed'
+    || ready.hostGeneration !== reload.generation || ready.installationId !== request.installationId
+    || ready.planId !== request.plan.id || ready.planDigest !== request.plan.digest
+    || ready.activationId !== request.activation.id || ready.fence !== request.activation.fence
+    || ready.authority !== config.authority || ready.keyId !== config.keyId || ready.evidence.kind !== 'readiness'
+    || ready.evidence.checks < 2 || ready.evidence.failures !== 0
+    || signedReady.observation.reload?.operationId !== reload.operation_id
+    || signedReady.observation.reload?.receiptDigest !== digest(signedReload.receipt)
+    || signedReady.observation.reload?.generation !== reload.generation
+    || request.predecessor.operationId !== ready.operationId || request.predecessor.receiptDigest !== digest(ready)
+    || request.predecessor.hostGeneration !== ready.hostGeneration) fail('runtime epoch predecessor is not the applied signed readiness')
+  if (config.schemaVersion === 6) verifyEpochMaintenance(config, request, priorConfig, ready, privateKey)
+  return { reloadOperationId: reload.operation_id, readinessOperationId: ready.operationId,
+    readinessReceiptDigest: digest(ready), hostGeneration: reload.generation }
+}
+function verifyEpochMaintenance(config, request, original, ready, privateKey) {
+  const key = createPublicKey(privateKey), publicKeyPem = key.export({ type: 'spki', format: 'pem' }).toString()
+  let prior
+  for (const record of config.maintenance) {
+    object(record, ['schemaVersion', 'kind', 'transactionId', 'installationId', 'ledger', 'profile', 'plan', 'activation',
+      'predecessor', 'sequence', 'previousDigest', 'before', 'after', 'issuedAt', 'authority', 'keyId', 'publicKeyPem', 'signature'], 'maintenance record')
+    const { signature, ...unsigned } = record
+    if (record.schemaVersion !== 1 || record.kind !== 'dsh-host-maintenance'
+      || record.publicKeyPem !== publicKeyPem || record.authority !== config.authority || record.keyId !== config.keyId
+      || typeof signature !== 'string' || !verify(null, Buffer.from(canonical(unsigned)), key, Buffer.from(signature, 'base64'))
+      || record.sequence !== (prior?.sequence ?? 0) + 1 || record.previousDigest !== (prior ? digest(prior) : null)
+      || !Number.isSafeInteger(record.issuedAt) || record.issuedAt < (prior?.issuedAt ?? ready.observedAt)
+      || record.issuedAt > Date.now() || canonical(record.predecessor) !== canonical(request.predecessor)) fail('maintenance signature or chain differs')
+    for (const field of ['installationId', 'ledger', 'profile', 'plan', 'activation']) {
+      if (canonical(record[field]) !== canonical(request[field])) fail('maintenance deployment identity differs')
+    }
+    for (const snapshot of [record.before, record.after]) object(snapshot,
+      ['executor', 'profileFiles', 'baselineFiles', 'deploymentFiles', 'baselineDeploymentFiles', 'unitProperties'], 'maintenance snapshot')
+    if (prior ? canonical(record.before) !== canonical(prior.after)
+      : canonical(record.before.profileFiles) !== canonical(original.profileFiles)
+        || canonical(record.before.unitProperties) !== canonical(original.unitProperties)) fail('maintenance predecessor deployment differs')
+    prior = record
+  }
+  if (!prior || canonical(prior.after.profileFiles) !== canonical(config.profileFiles)
+    || canonical(prior.after.unitProperties) !== canonical(config.unitProperties)
+    || canonical(prior.after.deploymentFiles.map(({ path, sha256 }) => ({ path, sha256 }))) !== canonical(config.readiness.deploymentFiles)) fail('maintenance current deployment differs')
+}
+function epochJournal(config) {
+  const path = join(config.stateRoot, 'runtime-epochs.sqlite')
+  for (const suffix of ['', '-wal', '-shm', '-journal']) if (existsSync(path + suffix)) readSafe(path + suffix, 67108864, true)
+  const oldMask = process.umask(0o077); let db
+  try { db = new DatabaseSync(path) } finally { process.umask(oldMask) }
+  try {
+    db.exec(`PRAGMA busy_timeout=1000; PRAGMA journal_mode=WAL; PRAGMA synchronous=FULL;
+      CREATE TABLE IF NOT EXISTS runtime_epochs (
+        operation_id TEXT PRIMARY KEY, request_digest TEXT NOT NULL, config_digest TEXT NOT NULL,
+        scope_id TEXT NOT NULL, host_generation INTEGER NOT NULL, sequence INTEGER NOT NULL,
+        runtime_identity_digest TEXT NOT NULL, predecessor_digest TEXT NOT NULL,
+        observation TEXT, receipt TEXT,
+        UNIQUE(scope_id, host_generation, sequence));`)
+    syncDirectory(config.stateRoot)
+    return db
+  } catch { db.close(); fail('private runtime epoch journal could not be opened') }
+}
+function epochCachedReceipt(row, request, config, privateKey) {
+  if (row.request_digest !== digest(request) || row.config_digest !== digest(config)
+    || row.runtime_identity_digest !== request.runtimeIdentityDigest
+    || row.predecessor_digest !== request.predecessor.receiptDigest) fail('runtime epoch operation identity changed')
+  if (row.receipt === null) return undefined
+  if (row.observation === null) fail('runtime epoch receipt lacks observation')
+  const receipt = parseJson(Buffer.from(row.receipt), 'runtime epoch receipt')
+  const observation = parseJson(Buffer.from(row.observation), 'runtime epoch observation')
+  const { signature, ...unsigned } = receipt
+  if (receipt.requestDigest !== row.request_digest || receipt.runtimeIdentityDigest !== request.runtimeIdentityDigest
+    || receipt.sequence !== request.sequence || receipt.hostGeneration !== request.predecessor.hostGeneration
+    || receipt.evidence?.probeDigest !== digest(observation)
+    || typeof signature !== 'string' || !verify(null, Buffer.from(canonical(unsigned)), createPublicKey(privateKey), Buffer.from(signature, 'base64'))) fail('cached runtime epoch receipt is invalid')
+  if (Date.now() > receipt.expiresAt) fail('cached runtime epoch receipt expired; owner reconciliation required')
+  return { receipt, observation }
+}
+async function attestEpoch(request, config, privateKey) {
+  const execute = await processRunner(config.processHelper)
+  const deadline = performance.now() + config.timeoutMs
+  const oldPath = join(config.stateRoot, 'reload.sqlite')
+  readSafe(oldPath, 67108864, true)
+  const historical = new DatabaseSync(oldPath, { readOnly: true })
+  const epochs = epochJournal(config)
+  try {
+    const binding = boundEpochPredecessor(historical, request, config, privateKey)
+    const scopeId = digest({ installation: request.installationId })
+    const row = transaction(epochs, () => {
+      const existing = epochs.prepare('SELECT * FROM runtime_epochs WHERE operation_id = ?').get(request.operationId)
+      const latest = epochs.prepare('SELECT * FROM runtime_epochs WHERE scope_id = ? AND host_generation = ? ORDER BY sequence DESC LIMIT 1').get(scopeId, binding.hostGeneration)
+      if (existing) {
+        if (latest?.sequence !== existing.sequence) fail('runtime epoch operation was superseded')
+        epochCachedReceipt(existing, request, config, privateKey)
+        return existing
+      }
+      if (request.sequence <= (latest?.sequence ?? 0)) fail('runtime epoch sequence is stale')
+      epochs.prepare(`INSERT INTO runtime_epochs(operation_id, request_digest, config_digest, scope_id, host_generation,
+        sequence, runtime_identity_digest, predecessor_digest) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`)
+        .run(request.operationId, digest(request), digest(config), scopeId, binding.hostGeneration,
+          request.sequence, request.runtimeIdentityDigest, request.predecessor.receiptDigest)
+      return epochs.prepare('SELECT * FROM runtime_epochs WHERE operation_id = ?').get(request.operationId)
+    })
+    const cached = epochCachedReceipt(row, request, config, privateKey)
+    const retained = cached?.observation
+    const ready = config.readiness
+    const bytes = readSafe(ready.client.path, 1048576)
+    if (hash(bytes) !== ready.client.sha256) fail('observer client changed')
+    const client = await import(`data:text/javascript;base64,${bytes.toString('base64')}`)
+    client.validateRuntimeObserverConfig(ready.observer)
+    const observerDigest = client.runtimeConfigDigest(ready.observer)
+    const channelDigest = hash(readSafe(ready.observer.keyPath, 32, true))
+    let stable; let supervisor; let started; let failures = 0
+    const samples = [], challenges = new Set()
+    for (;;) {
+      assertCurrent(config, request); remaining(deadline)
+      if (canonical(boundEpochPredecessor(historical, request, config, privateKey)) !== canonical(binding)) fail('Host generation changed during runtime epoch')
+      const before = await observe(config, execute, deadline)
+      if (!active(before)) fail('target service is not active for runtime epoch')
+      if (supervisor === undefined) supervisor = before
+      else if (canonical(supervisor) !== canonical(before)) fail('supervisor changed during runtime epoch')
+      if (hash(readSafe(ready.observer.keyPath, 32, true)) !== channelDigest) fail('observer key changed')
+      const queriedAt = Date.now()
+      const sample = await client.queryRuntimeObserver({ ...ready.observer, signal: AbortSignal.timeout(remaining(deadline)) })
+      if (sample.profilePath !== request.profile.path || sample.observerConfigDigest !== observerDigest
+        || sample.processId !== before.MainPID || sample.invocationId !== before.InvocationID
+        || sample.observedAt < queriedAt || sample.observedAt > Date.now() || challenges.has(sample.challenge)
+        || sample.entries.length !== ready.observer.targets.length) fail('observer identity or freshness differs')
+      challenges.add(sample.challenge)
+      let sampleFailed = false
+      for (const target of ready.observer.targets) {
+        const entry = sample.entries.find(item => item.entryId === target.entryId)
+        if (!entry || entry.module !== target.module || entry.configDigest !== target.configDigest
+          || canonical(entry.services.map(service => service.name).sort()) !== canonical([...target.services].sort())) fail('candidate identity differs')
+        if (entry.active === true) {
+          if (!entry.instance || [...entry.dependencies, ...entry.services].some(service => !service.instance)) fail('active candidate is not ready')
+        } else if (entry.active === false) sampleFailed = true
+        else fail('candidate active state is invalid')
+      }
+      const { challenge: _challenge, observedAt: _observedAt, ...identity } = sample
+      if (digest(identity) !== request.runtimeIdentityDigest) fail('runtime identity differs from requested epoch')
+      if (stable === undefined) { stable = identity; started = performance.now() }
+      else if (canonical(stable) !== canonical(identity)) fail('runtime instance changed during epoch')
+      if (retained && (canonical(identity) !== canonical(retained.runtime)
+        || canonical(before) !== canonical(retained.supervisor) || channelDigest !== retained.channelDigest)) fail('cached runtime epoch identity changed')
+      if (sampleFailed) failures++
+      samples.push({ challenge: sample.challenge, observedAt: sample.observedAt, digest: digest(sample) })
+      const after = await observe(config, execute, deadline)
+      if (canonical(after) !== canonical(before)) fail('supervisor changed during runtime query')
+      if (samples.length >= 2 && performance.now() - started >= config.stableWindowMs) break
+      if (samples.length >= 256) fail('runtime epoch sample limit exceeded')
+      await new Promise(resolveDelay => setTimeout(resolveDelay, Math.min(config.pollIntervalMs, remaining(deadline))))
+    }
+    assertCurrent(config, request); assertProfile(config); remaining(deadline)
+    if (hash(readSafe(ready.observer.keyPath, 32, true)) !== channelDigest) fail('observer key changed')
+    const observation = { schemaVersion: 1, requestDigest: digest(request), configDigest: digest(config), binding,
+      channelDigest, supervisor, runtime: stable, samples, stableWindowMs: config.stableWindowMs, observedAt: Date.now() }
+    const evidence = { checks: samples.length, failures, probeDigest: digest(observation) }
+    const unsigned = { schemaVersion: 1, kind: 'dsh-runtime-epoch-receipt', receiptId: `receipt:${request.operationId}`,
+      operationId: request.operationId, requestDigest: digest(request), installationId: request.installationId,
+      planId: request.plan.id, planDigest: request.plan.digest, activationId: request.activation.id, fence: request.activation.fence,
+      hostGeneration: binding.hostGeneration, sequence: request.sequence, runtimeIdentityDigest: request.runtimeIdentityDigest,
+      authority: config.authority, keyId: config.keyId, outcome: failures === 0 ? 'passed' : 'failed',
+      observedAt: observation.observedAt, expiresAt: Math.min(observation.observedAt + request.receiptTtlMs, config.authorization.expiresAt), evidence }
+    if (unsigned.expiresAt <= unsigned.observedAt) fail('authorization expired before signing')
+    return transaction(epochs, () => {
+      assertCurrent(config, request); remaining(deadline)
+      if (canonical(boundEpochPredecessor(historical, request, config, privateKey)) !== canonical(binding)) fail('Host generation changed before epoch signing')
+      const current = epochs.prepare('SELECT * FROM runtime_epochs WHERE operation_id = ?').get(request.operationId)
+      const latest = epochs.prepare('SELECT operation_id FROM runtime_epochs WHERE scope_id = ? AND host_generation = ? ORDER BY sequence DESC LIMIT 1')
+        .get(scopeId, binding.hostGeneration)
+      if (latest?.operation_id !== request.operationId) fail('runtime epoch operation was superseded before signing')
+      const replay = epochCachedReceipt(current, request, config, privateKey)
+      if (replay) {
+        if (canonical(replay.observation.runtime) !== canonical(stable)
+          || canonical(replay.observation.supervisor) !== canonical(supervisor)) fail('concurrent epoch identity differs')
+        return replay.receipt
+      }
+      const receipt = { ...unsigned, signature: sign(null, Buffer.from(canonical(unsigned)), privateKey).toString('base64') }
+      epochs.prepare('UPDATE runtime_epochs SET observation = ?, receipt = ? WHERE operation_id = ? AND receipt IS NULL')
+        .run(canonical(observation), canonical(receipt), request.operationId)
+      return epochCachedReceipt(epochs.prepare('SELECT * FROM runtime_epochs WHERE operation_id = ?').get(request.operationId), request, config, privateKey).receipt
+    })
+  } finally { epochs.close(); historical.close() }
+}
 async function attest(request, config, privateKey) {
-  const helperBytes = readSafe(config.processHelper.path, 1048576)
-  if (hash(helperBytes) !== config.processHelper.sha256) fail('process helper changed')
-  const { executeControlledProcess: execute } = await import(`data:text/javascript;base64,${helperBytes.toString('base64')}`)
-  if (typeof execute !== 'function') fail('process helper contract is unavailable')
+  const execute = await processRunner(config.processHelper)
   const deadline = performance.now() + config.timeoutMs
   const db = journal(config)
   try {
@@ -693,8 +1036,15 @@ export async function runSystemdHostAttestor(argv = process.argv.slice(2), envir
   let bytes = 0; const chunks = []
   for await (const chunk of process.stdin) { bytes += chunk.length; if (bytes > 65536) fail('request exceeds byte limit'); chunks.push(chunk) }
   const request = parseJson(Buffer.concat(chunks), 'request')
-  if (!['reload', 'readiness', 'rollback'].includes(request?.phase)) fail('only reload, readiness and rollback requests are supported')
-  const { config, privateKey } = loadConfig(environment, request)
+  const epoch = request?.kind === 'dsh-runtime-epoch-request'
+  if (!epoch && !['reload', 'readiness', 'rollback'].includes(request?.phase)) fail('only reload, readiness, rollback and runtime epoch requests are supported')
+  let input = parseJson(readSafe(environment.DSH_SYSTEMD_HOST_ATTESTOR_CONFIG, 65536, true), 'config')
+  if (input.schemaVersion === 4) input = await resolveStandingConfig(input, request)
+  if (epoch) {
+    const { config, privateKey } = loadEpochConfig(environment, request, input)
+    return attestEpoch(request, config, privateKey)
+  }
+  const { config, privateKey } = loadConfig(environment, request, input)
   return attest(request, config, privateKey)
 }
 if (process.argv[1] && (/^\/proc\/self\/fd\/\d+$/u.test(process.argv[1]) || realpathSync(process.argv[1]) === fileURLToPath(import.meta.url))) {

package/bin/dsh-systemd-host-authority.js

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+import { realpathSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { pathToFileURL } from 'node:url'
+try {
+  const wrapper = realpathSync(process.argv[1])
+  const { runSystemdHostAuthority } = await import(pathToFileURL(join(dirname(wrapper), '../lib/systemd-host-authority.js')).href)
+  await runSystemdHostAuthority()
+} catch {
+  process.stderr.write('systemd Host authority refused the request\n')
+  process.exitCode = 1
+}

package/lib/adoption-coordinator.d.ts

@@ -48,7 +48,9 @@ export declare class AdoptionCoordinatorRuntime {
         assertCurrent: () => void;
     });
     start(): void;
-    close(): Promise<void>;
+    close(options?: {
+        skipPause?: boolean;
+    }): Promise<void>;
     health: () => {
         connected: boolean;
         lastError: string | null;

package/lib/adoption-coordinator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adoption-coordinator.d.ts","sourceRoot":"","sources":["../src/adoption-coordinator.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,2BAA2B,EAAuF,MAAM,qCAAqC,CAAA;AAE3K,OAAO,EAAsB,KAAK,iBAAiB,EAAE,MAAM,YAAY,CAAA;AACvE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAUtD,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,MAAM,CAAA;IACrB,KAAK,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAA;IACvF,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,yBAAyB,CAkB5G;AAKD;;;GAGG;AACH,wBAAsB,yBAAyB,CAAC,OAAO,EAAE;IACvD,KAAK,EAAE,iBAAiB,CAAA;IACxB,KAAK,EAAE,wBAAwB,CAAA;IAC/B,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,aAAa,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3C,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAmEhC;AAED,KAAK,WAAW,GAAG,IAAI,CAAC,2BAA2B,EAAE,sBAAsB,GAAG,iBAAiB,GAAG,8BAA8B,CAAC,CAAA;AAGjI,yFAAyF;AACzF,qBAAa,0BAA0B;IAWzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAVpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwB;IAC9C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8B;IACtD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAe;IAC1C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAQ;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;IACrC,OAAO,CAAC,MAAM,CAAQ;IACtB,OAAO,CAAC,MAAM,CAAI;IAClB,OAAO,CAAC,UAAU,CAAC,CAAY;IAC/B,OAAO,CAAC,OAAO,CAAC,CAAe;IAC/B,OAAO,CAAC,SAAS,CAAsB;gBACV,OAAO,EAAE;QAAE,MAAM,EAAE,yBAAyB,CAAC;QAAC,KAAK,EAAE,iBAAiB,CAAC;QAAC,KAAK,EAAE,wBAAwB,CAAC;QAAC,WAAW,EAAE,WAAW,CAAC;QAAC,aAAa,EAAE,MAAM,IAAI,CAAA;KAAE;IAO3L,KAAK,IAAI,IAAI;IAmBb,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAiBtB,MAAM;;;MAAgE;IAEtE,OAAO,CAAC,KAAK;IAKb,OAAO,CAAC,OAAO;IAKf,OAAO,CAAC,UAAU;IAQlB,OAAO,CAAC,QAAQ;YAGF,OAAO;CA8BtB"}
+{"version":3,"file":"adoption-coordinator.d.ts","sourceRoot":"","sources":["../src/adoption-coordinator.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,2BAA2B,EAAuF,MAAM,qCAAqC,CAAA;AAE3K,OAAO,EAAsB,KAAK,iBAAiB,EAAE,MAAM,YAAY,CAAA;AACvE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAWtD,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,MAAM,CAAA;IACrB,KAAK,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAA;IACvF,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,yBAAyB,CAkB5G;AAKD;;;GAGG;AACH,wBAAsB,yBAAyB,CAAC,OAAO,EAAE;IACvD,KAAK,EAAE,iBAAiB,CAAA;IACxB,KAAK,EAAE,wBAAwB,CAAA;IAC/B,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,aAAa,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3C,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAqEhC;AAED,KAAK,WAAW,GAAG,IAAI,CAAC,2BAA2B,EAAE,sBAAsB,GAAG,iBAAiB,GAAG,8BAA8B,CAAC,CAAA;AAGjI,yFAAyF;AACzF,qBAAa,0BAA0B;IAWzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAVpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwB;IAC9C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8B;IACtD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAe;IAC1C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAQ;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;IACrC,OAAO,CAAC,MAAM,CAAQ;IACtB,OAAO,CAAC,MAAM,CAAI;IAClB,OAAO,CAAC,UAAU,CAAC,CAAY;IAC/B,OAAO,CAAC,OAAO,CAAC,CAAe;IAC/B,OAAO,CAAC,SAAS,CAAsB;gBACV,OAAO,EAAE;QAAE,MAAM,EAAE,yBAAyB,CAAC;QAAC,KAAK,EAAE,iBAAiB,CAAC;QAAC,KAAK,EAAE,wBAAwB,CAAC;QAAC,WAAW,EAAE,WAAW,CAAC;QAAC,aAAa,EAAE,MAAM,IAAI,CAAA;KAAE;IAO3L,KAAK,IAAI,IAAI;IAmBb,KAAK,CAAC,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAmB3D,MAAM;;;MAAgE;IAEtE,OAAO,CAAC,KAAK;IAKb,OAAO,CAAC,OAAO;IAKf,OAAO,CAAC,UAAU;IAQlB,OAAO,CAAC,QAAQ;YAGF,OAAO;CAsCtB"}

package/lib/adoption-coordinator.js

@@ -2,6 +2,7 @@ import { randomUUID } from 'node:crypto';
 import { isAbsolute, resolve } from 'node:path';
 import { activatePluginPlan, probePluginPlan } from './cli.js';
 import { controlPlaneDigest } from './store.js';
+import { invokeConfiguredRuntimeEpochAttestor } from './host-attestor.js';
 const OWNER = 'plugin-control-plane-adoption-coordinator';
 const EXECUTOR = 'plugin-control-plane-adoption-coordinator-v1';
 const CATALOG = controlPlaneDigest({ executor: EXECUTOR, version: 1, operation: 'advance-adoption-handoff' });
@@ -30,7 +31,7 @@ export function validateAdoptionCoordinatorConfig(value) {
     }
 }
 function terminal(plan) { return plan.status === 'activated' || plan.status === 'rolled-back'; }
-function exposed(plan) { return plan.status === 'staging' || plan.status === 'commit-pending' || AWAITING.has(plan.status); }
+function exposed(plan) { return plan.status === 'staging' || plan.status === 'commit-pending' || plan.status === 'awaiting-live-tasks' || AWAITING.has(plan.status); }
 /**
  * Advance an already signed source handoff only through Host attestation.
  * This Host deliberately leaves `commit-pending` for the target Host.
@@ -63,14 +64,14 @@ export async function coordinateAdoptionHandoff(options) {
         }
         return restored;
     };
-    const recoverExpired = async (plan) => {
+    const recoverExpired = async (plan, failureCode = 'adoption-handoff-expired') => {
         if (plan.status === 'rollback-pending')
             return finishRollback(plan);
         if (!exposed(plan) || plan.activation === undefined)
             return plan;
         await current();
         const rollback = options.store.requestActivationRollback({ planId: plan.id, expectedRevision: plan.revision,
-            fence: plan.activation.fence, failureCode: 'adoption-handoff-expired' });
+            fence: plan.activation.fence, failureCode });
         return finishRollback(rollback);
     };
     for (let phase = 0; phase < 16; phase++) {
@@ -93,6 +94,9 @@ export async function coordinateAdoptionHandoff(options) {
             throw error;
         }
         await current();
+        const liveDeadline = options.store.getLiveQualificationDeadline(plan.id);
+        if (liveDeadline !== undefined && liveDeadline <= Date.now())
+            return recoverExpired(plan, 'live-qualification-expired');
         const before = { status: plan.status, revision: plan.revision, fence: plan.activation?.fence };
         if (plan.status === 'approved' || plan.status === 'staging') {
             options.store.assertAdoptionHandoff(plan.id);
@@ -161,14 +165,16 @@ export class AdoptionCoordinatorRuntime {
             throw error;
         }
     }
-    close() {
+    close(options = {}) {
         return this.closing ??= (async () => {
             this.active = false;
             try {
-                const registration = this.options.automations.inspectSystemOwnedActivation({ owner: OWNER, automationId: this.automationId });
-                if (registration?.activationNonce === this.activationNonce)
-                    this.options.automations.reconcileSystem({ owner: OWNER,
-                        automationId: this.automationId, idempotencyKey: `${this.automationId}:${this.generation}:pause`, desiredStatus: 'paused', definition: this.definition() });
+                if (!options.skipPause) {
+                    const registration = this.options.automations.inspectSystemOwnedActivation({ owner: OWNER, automationId: this.automationId });
+                    if (registration?.activationNonce === this.activationNonce)
+                        this.options.automations.reconcileSystem({ owner: OWNER,
+                            automationId: this.automationId, idempotencyKey: `${this.automationId}:${this.generation}:pause`, desiredStatus: 'paused', definition: this.definition() });
+                }
             }
             finally {
                 this.abort.abort();
@@ -221,8 +227,17 @@ export class AdoptionCoordinatorRuntime {
             }
             const signal = AbortSignal.any([this.abort.signal, input.signal, AbortSignal.timeout(this.options.config.timeoutMs)]);
             this.current(signal);
+            const epochs = this.options.store.pendingRuntimeEpochs(this.options.config.coordinatorId);
             const handoffs = this.handoffs();
-            if (handoffs.length) {
+            // Runtime continuity uses the same native Automation budget and lifetime as adoption.
+            if (epochs.length && (this.cursor++ % 2 === 0 || !handoffs.length)) {
+                const epoch = this.options.store.claimRuntimeEpoch(epochs[0].request.operationId, this.options.config.coordinatorId);
+                began = true;
+                const receipt = await invokeConfiguredRuntimeEpochAttestor(this.options.trust, epoch.request, signal);
+                this.current(signal);
+                this.options.store.applyRuntimeEpoch(receipt, this.options.trust);
+            }
+            else if (handoffs.length) {
                 const handoff = handoffs[this.cursor++ % handoffs.length];
                 began = true;
                 await coordinateAdoptionHandoff({ store: this.options.store, trust: this.options.trust, planId: handoff.planId, signal,

package/lib/adoption-coordinator.js.map

@@ -1 +1 @@
-{"version":3,"file":"adoption-coordinator.js","sourceRoot":"","sources":["../src/adoption-coordinator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAE/C,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAC9D,OAAO,EAAE,kBAAkB,EAA0B,MAAM,YAAY,CAAA;AAIvE,MAAM,KAAK,GAAG,2CAA2C,CAAA;AACzD,MAAM,QAAQ,GAAG,8CAA8C,CAAA;AAC/D,MAAM,OAAO,GAAG,kBAAkB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,0BAA0B,EAAE,CAAC,CAAA;AAC7G,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAiC;IACvD,iBAAiB,EAAE,oBAAoB,EAAE,gCAAgC,EAAE,iBAAiB;IAC5F,iBAAiB,EAAE,eAAe,EAAE,iBAAiB;CACtD,CAAC,CAAA;AAUF,MAAM,UAAU,iCAAiC,CAAC,KAAc;IAC9D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAA;IACpJ,MAAM,MAAM,GAAG,KAAgC,CAAA;IAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAgC,CAAA;IACrD,MAAM,KAAK,GAAG,CAAC,MAAe,EAAE,IAAuB,EAAE,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;WAC9H,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACxE,MAAM,IAAI,GAAG,CAAC,IAAa,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI;WAC7F,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACrE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,eAAe,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC;WAC3J,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,sCAAsC,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;WAC7I,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC;WACxG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,KAAK,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;WAC/H,MAAM,CAAC,SAAS,GAAG,KAAK,IAAI,MAAM,CAAC,SAAS,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;WAChF,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,GAAG;WACnE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ;WACrF,MAAM,CAAC,YAAY,GAAG,CAAC,IAAI,MAAM,CAAC,YAAY,GAAG,UAAU,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAA;IACrF,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAA0B,IAAa,OAAO,IAAI,CAAC,MAAM,KAAK,WAAW,IAAI,IAAI,CAAC,MAAM,KAAK,aAAa,CAAA,CAAC,CAAC;AAC9H,SAAS,OAAO,CAAC,IAA0B,IAAa,OAAO,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,gBAAgB,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA,CAAC,CAAC;AAE3J;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,OAM/C;IACC,MAAM,OAAO,GAAG,KAAK,IAAmB,EAAE;QACxC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;QAChC,MAAM,OAAO,CAAC,aAAa,EAAE,EAAE,CAAA;QAC/B,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;IAClC,CAAC,CAAA;IACD,MAAM,cAAc,GAAG,KAAK,EAAE,IAA0B,EAAiC,EAAE;QACzF,IAAI,IAAI,CAAC,MAAM,KAAK,kBAAkB,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;YAAE,OAAO,IAAI,CAAA;QACpF,MAAM,QAAQ,GAAG,IAAI,CAAA;QACrB,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAA;QACtC,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAA;QAC7C,IAAI,UAAU,CAAC,uBAAuB,EAAE,CAAC;YACvC,MAAM,OAAO,EAAE,CAAA;YACf,OAAO,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE;gBACtF,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,EAAE,aAAa,EAAE,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;QACnK,CAAC;QACD,MAAM,OAAO,EAAE,CAAA;QACf,IAAI,QAAQ,GAAG,MAAM,kBAAkB,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE;YACvG,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;QAC7G,IAAI,QAAQ,CAAC,MAAM,KAAK,kBAAkB,IAAI,QAAQ,CAAC,UAAU,EAAE,uBAAuB,EAAE,CAAC;YAC3F,MAAM,OAAO,EAAE,CAAA;YACf,QAAQ,GAAG,MAAM,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE;gBAChG,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,EAAE,aAAa,EAAE,QAAQ,CAAC,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;QAC5K,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC,CAAA;IACD,MAAM,cAAc,GAAG,KAAK,EAAE,IAA0B,EAAiC,EAAE;QACzF,IAAI,IAAI,CAAC,MAAM,KAAK,kBAAkB;YAAE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAA;QACnE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;YAAE,OAAO,IAAI,CAAA;QAChE,MAAM,OAAO,EAAE,CAAA;QACf,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,QAAQ;YACzG,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC,CAAA;QAC1E,OAAO,cAAc,CAAC,QAAQ,CAAC,CAAA;IACjC,CAAC,CAAA;IAED,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;QACxC,MAAM,OAAO,EAAE,CAAA;QACf,IAAI,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAChD,IAAI,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QAC/B,IAAI,IAAI,CAAC,MAAM,KAAK,kBAAkB;YAAE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAA;QACnE,IAAI,CAAC;YAAC,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAAC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAClE,0EAA0E;YAC1E,qEAAqE;YACrE,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAA;YACvF,IAAI,OAAO,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa;mBAClI,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;gBAAE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAA;YACtG,MAAM,KAAK,CAAA;QACb,CAAC;QACD,MAAM,OAAO,EAAE,CAAA;QACf,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,CAAA;QAC9F,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC5D,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAC5C,IAAI,GAAG,MAAM,kBAAkB,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;gBAC3F,gBAAgB,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;QAC3G,CAAC;aAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAA;YAChI,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAC5C,IAAI,GAAG,MAAM,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;gBACxF,gBAAgB,EAAE,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;QACpK,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAA;QACb,CAAC;;YAAM,OAAO,IAAI,CAAA;QAClB,MAAM,OAAO,EAAE,CAAA;QACf,IAAI,IAAI,CAAC,MAAM,KAAK,gBAAgB,IAAI,QAAQ,CAAC,IAAI,CAAC;eACjD,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,EAAE,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;IACnI,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;AAC9C,CAAC;AAKD,yFAAyF;AACzF,MAAM,OAAO,0BAA0B;IAWR;IAVZ,KAAK,GAAG,IAAI,eAAe,EAAE,CAAA;IAC7B,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAA;IACrC,UAAU,GAAG,UAAU,EAAE,CAAA;IACzB,eAAe,CAAQ;IACvB,YAAY,CAAQ;IAC7B,MAAM,GAAG,KAAK,CAAA;IACd,MAAM,GAAG,CAAC,CAAA;IACV,UAAU,CAAa;IACvB,OAAO,CAAgB;IACvB,SAAS,GAAkB,IAAI,CAAA;IACvC,YAA6B,OAA8J;QAA9J,YAAO,GAAP,OAAO,CAAuJ;QACzL,iCAAiC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QACjD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAA;QACjH,IAAI,CAAC,YAAY,GAAG,wBAAwB,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAA;QACnE,IAAI,CAAC,eAAe,GAAG,kBAAkB,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;IACtF,CAAC;IAED,KAAK;QACH,IAAI,IAAI,CAAC,MAAM;YAAE,OAAM;QACvB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC;YAC9D,UAAU,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE;YAChF,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,uBAAuB,KAAK,CAAC,IAAI,IAAI,CAAC,aAAa,KAAK,OAAO;mBAChH,IAAI,CAAC,SAAS,KAAK,YAAY,IAAI,IAAI,CAAC,cAAc,KAAK,CAAC;YACjE,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;SAClD,CAAC,CAAA;QACF,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;YAClB,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY;gBACtF,cAAc,EAAE,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,UAAU,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;QAC/H,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;YACnB,IAAI,CAAC;gBAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,mCAAmC,CAAC,CAAC;YACzE,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,OAAO,KAAK,CAAC,KAAK,IAAI,EAAE;YAClC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;YACnB,IAAI,CAAC;gBACH,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,4BAA4B,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAA;gBAC7H,IAAI,YAAY,EAAE,eAAe,KAAK,IAAI,CAAC,eAAe;oBAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,KAAK;wBACjH,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,UAAU,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;YAC/J,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;gBAClB,IAAI,CAAC;oBAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAA;gBAAC,CAAC;wBAAS,CAAC;oBACnC,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;oBACtC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;gBAC5B,CAAC;YACH,CAAC;QACH,CAAC,CAAC,EAAE,CAAA;IACN,CAAC;IAED,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;IAE9D,KAAK,CAAI,MAAkB;QACjC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACxB,KAAK,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QACtE,OAAO,MAAM,CAAA;IACf,CAAC;IACO,OAAO,CAAC,MAAoB;QAClC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAAC,MAAM,EAAE,cAAc,EAAE,CAAA;QAC5D,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;QACrE,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAA;IAC9B,CAAC;IACO,UAAU;QAChB,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAA;QACxE,OAAO,EAAE,IAAI,EAAE,qCAAqC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE;YACxH,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;YACnJ,SAAS,EAAE,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,uBAAuB,EAAE,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC;gBAC3K,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC3J,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,EAAE,CAAA;IACjF,CAAC;IACO,QAAQ;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAuB,CAAA;IAC9G,CAAC;IACO,KAAK,CAAC,OAAO,CAAC,KAAkC;QACtD,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAgC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe;YACjK,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,+BAA+B,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAA;QACzL,IAAI,KAAK,GAAG,KAAK,CAAA;QACjB,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;YAC1B,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAA;YACrC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,4BAA4B,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAA;YAC7H,IAAI,KAAK,CAAC,aAAa,KAAK,YAAY,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,eAAe,KAAK,IAAI,CAAC,eAAe;mBACjI,KAAK,CAAC,aAAa,KAAK,OAAO,IAAI,KAAK,CAAC,cAAc,KAAK,YAAY,EAAE,cAAc,IAAI,YAAY,CAAC,eAAe,KAAK,IAAI,CAAC,eAAe;mBACjJ,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;gBACxL,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;YAC1D,CAAC;YACD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;YACrH,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;YACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAA;YAChC,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACpB,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAE,CAAA;gBAC1D,KAAK,GAAG,IAAI,CAAA;gBACZ,MAAM,yBAAyB,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM;oBACpH,aAAa,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;gBAC9C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;YACtB,CAAC;YACD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAA;YACrB,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAA;QACvJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,SAAS,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,6BAA6B,CAAA;YACrG,OAAO,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC5E,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"adoption-coordinator.js","sourceRoot":"","sources":["../src/adoption-coordinator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAE/C,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAC9D,OAAO,EAAE,kBAAkB,EAA0B,MAAM,YAAY,CAAA;AAGvE,OAAO,EAAE,oCAAoC,EAAE,MAAM,oBAAoB,CAAA;AAEzE,MAAM,KAAK,GAAG,2CAA2C,CAAA;AACzD,MAAM,QAAQ,GAAG,8CAA8C,CAAA;AAC/D,MAAM,OAAO,GAAG,kBAAkB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,0BAA0B,EAAE,CAAC,CAAA;AAC7G,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAiC;IACvD,iBAAiB,EAAE,oBAAoB,EAAE,gCAAgC,EAAE,iBAAiB;IAC5F,iBAAiB,EAAE,eAAe,EAAE,iBAAiB;CACtD,CAAC,CAAA;AAUF,MAAM,UAAU,iCAAiC,CAAC,KAAc;IAC9D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAA;IACpJ,MAAM,MAAM,GAAG,KAAgC,CAAA;IAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAgC,CAAA;IACrD,MAAM,KAAK,GAAG,CAAC,MAAe,EAAE,IAAuB,EAAE,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;WAC9H,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACxE,MAAM,IAAI,GAAG,CAAC,IAAa,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI;WAC7F,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACrE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,eAAe,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC;WAC3J,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,sCAAsC,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;WAC7I,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC;WACxG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,KAAK,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;WAC/H,MAAM,CAAC,SAAS,GAAG,KAAK,IAAI,MAAM,CAAC,SAAS,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;WAChF,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,GAAG;WACnE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ;WACrF,MAAM,CAAC,YAAY,GAAG,CAAC,IAAI,MAAM,CAAC,YAAY,GAAG,UAAU,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAA;IACrF,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAA0B,IAAa,OAAO,IAAI,CAAC,MAAM,KAAK,WAAW,IAAI,IAAI,CAAC,MAAM,KAAK,aAAa,CAAA,CAAC,CAAC;AAC9H,SAAS,OAAO,CAAC,IAA0B,IAAa,OAAO,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,gBAAgB,IAAI,IAAI,CAAC,MAAM,KAAK,qBAAqB,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA,CAAC,CAAC;AAEpM;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,OAM/C;IACC,MAAM,OAAO,GAAG,KAAK,IAAmB,EAAE;QACxC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;QAChC,MAAM,OAAO,CAAC,aAAa,EAAE,EAAE,CAAA;QAC/B,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;IAClC,CAAC,CAAA;IACD,MAAM,cAAc,GAAG,KAAK,EAAE,IAA0B,EAAiC,EAAE;QACzF,IAAI,IAAI,CAAC,MAAM,KAAK,kBAAkB,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;YAAE,OAAO,IAAI,CAAA;QACpF,MAAM,QAAQ,GAAG,IAAI,CAAA;QACrB,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAA;QACtC,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAA;QAC7C,IAAI,UAAU,CAAC,uBAAuB,EAAE,CAAC;YACvC,MAAM,OAAO,EAAE,CAAA;YACf,OAAO,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE;gBACtF,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,EAAE,aAAa,EAAE,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;QACnK,CAAC;QACD,MAAM,OAAO,EAAE,CAAA;QACf,IAAI,QAAQ,GAAG,MAAM,kBAAkB,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE;YACvG,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;QAC7G,IAAI,QAAQ,CAAC,MAAM,KAAK,kBAAkB,IAAI,QAAQ,CAAC,UAAU,EAAE,uBAAuB,EAAE,CAAC;YAC3F,MAAM,OAAO,EAAE,CAAA;YACf,QAAQ,GAAG,MAAM,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE;gBAChG,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,EAAE,aAAa,EAAE,QAAQ,CAAC,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;QAC5K,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC,CAAA;IACD,MAAM,cAAc,GAAG,KAAK,EAAE,IAA0B,EAAE,WAAW,GAAG,0BAA0B,EAAiC,EAAE;QACnI,IAAI,IAAI,CAAC,MAAM,KAAK,kBAAkB;YAAE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAA;QACnE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;YAAE,OAAO,IAAI,CAAA;QAChE,MAAM,OAAO,EAAE,CAAA;QACf,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,QAAQ;YACzG,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAA;QAC9C,OAAO,cAAc,CAAC,QAAQ,CAAC,CAAA;IACjC,CAAC,CAAA;IAED,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;QACxC,MAAM,OAAO,EAAE,CAAA;QACf,IAAI,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAChD,IAAI,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QAC/B,IAAI,IAAI,CAAC,MAAM,KAAK,kBAAkB;YAAE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAA;QACnE,IAAI,CAAC;YAAC,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAAC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAClE,0EAA0E;YAC1E,qEAAqE;YACrE,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAA;YACvF,IAAI,OAAO,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa;mBAClI,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;gBAAE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAA;YACtG,MAAM,KAAK,CAAA;QACb,CAAC;QACD,MAAM,OAAO,EAAE,CAAA;QACf,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,4BAA4B,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACxE,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,cAAc,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAA;QACvH,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,CAAA;QAC9F,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC5D,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAC5C,IAAI,GAAG,MAAM,kBAAkB,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;gBAC3F,gBAAgB,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;QAC3G,CAAC;aAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAA;YAChI,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAC5C,IAAI,GAAG,MAAM,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;gBACxF,gBAAgB,EAAE,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;QACpK,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAA;QACb,CAAC;;YAAM,OAAO,IAAI,CAAA;QAClB,MAAM,OAAO,EAAE,CAAA;QACf,IAAI,IAAI,CAAC,MAAM,KAAK,gBAAgB,IAAI,QAAQ,CAAC,IAAI,CAAC;eACjD,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,EAAE,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;IACnI,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;AAC9C,CAAC;AAKD,yFAAyF;AACzF,MAAM,OAAO,0BAA0B;IAWR;IAVZ,KAAK,GAAG,IAAI,eAAe,EAAE,CAAA;IAC7B,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAA;IACrC,UAAU,GAAG,UAAU,EAAE,CAAA;IACzB,eAAe,CAAQ;IACvB,YAAY,CAAQ;IAC7B,MAAM,GAAG,KAAK,CAAA;IACd,MAAM,GAAG,CAAC,CAAA;IACV,UAAU,CAAa;IACvB,OAAO,CAAgB;IACvB,SAAS,GAAkB,IAAI,CAAA;IACvC,YAA6B,OAA8J;QAA9J,YAAO,GAAP,OAAO,CAAuJ;QACzL,iCAAiC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QACjD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAA;QACjH,IAAI,CAAC,YAAY,GAAG,wBAAwB,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAA;QACnE,IAAI,CAAC,eAAe,GAAG,kBAAkB,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;IACtF,CAAC;IAED,KAAK;QACH,IAAI,IAAI,CAAC,MAAM;YAAE,OAAM;QACvB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC;YAC9D,UAAU,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE;YAChF,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,uBAAuB,KAAK,CAAC,IAAI,IAAI,CAAC,aAAa,KAAK,OAAO;mBAChH,IAAI,CAAC,SAAS,KAAK,YAAY,IAAI,IAAI,CAAC,cAAc,KAAK,CAAC;YACjE,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;SAClD,CAAC,CAAA;QACF,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;YAClB,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY;gBACtF,cAAc,EAAE,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,UAAU,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;QAC/H,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;YACnB,IAAI,CAAC;gBAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,mCAAmC,CAAC,CAAC;YACzE,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAmC,EAAE;QACzC,OAAO,IAAI,CAAC,OAAO,KAAK,CAAC,KAAK,IAAI,EAAE;YAClC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;YACnB,IAAI,CAAC;gBACH,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;oBACvB,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,4BAA4B,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAA;oBAC7H,IAAI,YAAY,EAAE,eAAe,KAAK,IAAI,CAAC,eAAe;wBAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,KAAK;4BACjH,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,UAAU,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;gBAC/J,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;gBAClB,IAAI,CAAC;oBAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAA;gBAAC,CAAC;wBAAS,CAAC;oBACnC,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;oBACtC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;gBAC5B,CAAC;YACH,CAAC;QACH,CAAC,CAAC,EAAE,CAAA;IACN,CAAC;IAED,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;IAE9D,KAAK,CAAI,MAAkB;QACjC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACxB,KAAK,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QACtE,OAAO,MAAM,CAAA;IACf,CAAC;IACO,OAAO,CAAC,MAAoB;QAClC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAAC,MAAM,EAAE,cAAc,EAAE,CAAA;QAC5D,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;QACrE,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAA;IAC9B,CAAC;IACO,UAAU;QAChB,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAA;QACxE,OAAO,EAAE,IAAI,EAAE,qCAAqC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE;YACxH,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;YACnJ,SAAS,EAAE,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,uBAAuB,EAAE,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC;gBAC3K,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC3J,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,EAAE,CAAA;IACjF,CAAC;IACO,QAAQ;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAuB,CAAA;IAC9G,CAAC;IACO,KAAK,CAAC,OAAO,CAAC,KAAkC;QACtD,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAgC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe;YACjK,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,+BAA+B,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAA;QACzL,IAAI,KAAK,GAAG,KAAK,CAAA;QACjB,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;YAC1B,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAA;YACrC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,4BAA4B,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAA;YAC7H,IAAI,KAAK,CAAC,aAAa,KAAK,YAAY,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,eAAe,KAAK,IAAI,CAAC,eAAe;mBACjI,KAAK,CAAC,aAAa,KAAK,OAAO,IAAI,KAAK,CAAC,cAAc,KAAK,YAAY,EAAE,cAAc,IAAI,YAAY,CAAC,eAAe,KAAK,IAAI,CAAC,eAAe;mBACjJ,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;gBACxL,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;YAC1D,CAAC;YACD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;YACrH,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;YACpB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;YACzF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAA;YAChC,sFAAsF;YACtF,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnE,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;gBACrH,KAAK,GAAG,IAAI,CAAA;gBACZ,MAAM,OAAO,GAAG,MAAM,oCAAoC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBACrG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;gBACpB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;YACnE,CAAC;iBAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC3B,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAE,CAAA;gBAC1D,KAAK,GAAG,IAAI,CAAA;gBACZ,MAAM,yBAAyB,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM;oBACpH,aAAa,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;gBAC9C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;YACtB,CAAC;YACD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAA;YACrB,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAA;QACvJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,SAAS,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,6BAA6B,CAAA;YACrG,OAAO,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC5E,CAAC;IACH,CAAC;CACF"}

package/lib/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,iBAAiB,EAA6C,MAAM,YAAY,CAAA;AAGzF,OAAO,EAAsB,qBAAqB,EAA+F,MAAM,uBAAuB,CAAA;AAC9K,OAAO,EACuB,KAAK,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAC/E,OAAO,KAAK,EACE,oBAAoB,EAC2F,MAAM,YAAY,CAAA;AAwB/I,OAAO,EAAE,qBAAqB,EAAE,CAAA;AA8uBhC;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAAE,KAAK,EAAE,iBAAiB,CAAC;IAAC,KAAK,EAAE,wBAAwB,CAAC;IAC3G,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA2BvE;AAuCD,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAAE,KAAK,EAAE,iBAAiB,CAAC;IAAC,KAAK,EAAE,wBAAwB,CAAC;IAC1G,MAAM,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAkFjG;AA0FD,wBAAsB,eAAe,CAAC,KAAK,EAAE;IAAE,KAAK,EAAE,iBAAiB,CAAC;IAAC,KAAK,EAAE,wBAAwB,CAAC;IACvG,MAAM,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAE/I;AAqWD,wBAAsB,gBAAgB,CAAC,IAAI,WAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmClF"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,iBAAiB,EAA6C,MAAM,YAAY,CAAA;AAGzF,OAAO,EAAsB,qBAAqB,EAA+F,MAAM,uBAAuB,CAAA;AAC9K,OAAO,EACuB,KAAK,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAC/E,OAAO,KAAK,EACE,oBAAoB,EAC2F,MAAM,YAAY,CAAA;AAwB/I,OAAO,EAAE,qBAAqB,EAAE,CAAA;AA+uBhC;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAAE,KAAK,EAAE,iBAAiB,CAAC;IAAC,KAAK,EAAE,wBAAwB,CAAC;IAC3G,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA2BvE;AAuCD,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAAE,KAAK,EAAE,iBAAiB,CAAC;IAAC,KAAK,EAAE,wBAAwB,CAAC;IAC1G,MAAM,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAkGjG;AA0FD,wBAAsB,eAAe,CAAC,KAAK,EAAE;IAAE,KAAK,EAAE,iBAAiB,CAAC;IAAC,KAAK,EAAE,wBAAwB,CAAC;IACvG,MAAM,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAE/I;AAqWD,wBAAsB,gBAAgB,CAAC,IAAI,WAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmClF"}