@dsh-enhanced/plugin-control-plane 0.1.48 → 0.1.49

package/lib/systemd-host-authority.d.ts

@@ -0,0 +1,68 @@
+import { type LiveQualificationTerms } from './live-qualification.js';
+import { type RuntimeEpochRequest } from './runtime-epoch.js';
+import type { SourceJobOwnerReceipt } from './source-job-types.js';
+import type { HostAttestationRequest } from './types.js';
+import type { RuntimeObserverConfig } from './runtime-observer-protocol.js';
+type Pin = {
+    path: string;
+    sha256: string;
+};
+type Template = {
+    authority: string;
+    keyId: string;
+    privateKeyPath: string;
+    stateRoot: string;
+    executable: Pin;
+    interpreter: Pin;
+    processHelper: Pin;
+    systemctl: Pin & {
+        interpreter: Pin | null;
+    };
+    scope: 'user' | 'system';
+    unit: string;
+    unitProperties: Record<'FragmentPath' | 'DropInPaths' | 'ExecStart' | 'Environment' | 'WorkingDirectory' | 'User' | 'Group' | 'Type' | 'KillMode', string>;
+    timeoutMs: number;
+    stableWindowMs: number;
+    pollIntervalMs: number;
+    readiness: {
+        client: Pin;
+        observer: RuntimeObserverConfig;
+    };
+    recoveryReadiness: {
+        client: Pin;
+        observer: RuntimeObserverConfig;
+    };
+};
+type Owner = Pick<SourceJobOwnerReceipt, 'authorityId' | 'authorityHash' | 'principalId' | 'principalRecordId' | 'principalVersion' | 'workspace' | 'agentPreset'>;
+export interface SystemdHostAuthorityConfig {
+    schemaVersion: 1;
+    statePath: string;
+    controlDatabasePath: string;
+    trustPath: string;
+    grant: {
+        id: string;
+        notBefore: number;
+        expiresAt: number;
+        maximumReloads: number;
+        owner: Owner;
+        profile: {
+            name: string;
+            path: string;
+        };
+        packages: readonly string[];
+        coordinatorId: string;
+        hostDeploymentInputs: readonly string[];
+        liveQualification: LiveQualificationTerms;
+    };
+    template: Template;
+}
+export declare class SystemdHostAuthorityError extends Error {
+    constructor();
+}
+export declare function validateSystemdHostAuthorityConfig(value: unknown): asserts value is SystemdHostAuthorityConfig;
+type ExactConfig = Record<string, unknown>;
+export declare function resolveSystemdHostAuthority(configInput: SystemdHostAuthorityConfig, requestInput: HostAttestationRequest | RuntimeEpochRequest): Promise<ExactConfig>;
+/** One bounded request in, one exact schema-1/2/3/5 configuration out. */
+export declare function runSystemdHostAuthority(argv?: string[]): Promise<void>;
+export {};
+//# sourceMappingURL=systemd-host-authority.d.ts.map

package/lib/systemd-host-authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"systemd-host-authority.d.ts","sourceRoot":"","sources":["../src/systemd-host-authority.ts"],"names":[],"mappings":"AAKA,OAAO,EAAkC,KAAK,sBAAsB,EAAE,MAAM,yBAAyB,CAAA;AAErG,OAAO,EAA4B,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAIvF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAClE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AAQ3E,KAAK,GAAG,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAC3C,KAAK,QAAQ,GAAG;IACd,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;IAC3E,UAAU,EAAE,GAAG,CAAC;IAAC,WAAW,EAAE,GAAG,CAAC;IAAC,aAAa,EAAE,GAAG,CAAA;IACrD,SAAS,EAAE,GAAG,GAAG;QAAE,WAAW,EAAE,GAAG,GAAG,IAAI,CAAA;KAAE,CAAA;IAC5C,KAAK,EAAE,MAAM,GAAG,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;IACtC,cAAc,EAAE,MAAM,CAAC,cAAc,GAAG,aAAa,GAAG,WAAW,GAAG,aAAa,GAAG,kBAAkB,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,UAAU,EAAE,MAAM,CAAC,CAAA;IAC1J,SAAS,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;IACjE,SAAS,EAAE;QAAE,MAAM,EAAE,GAAG,CAAC;QAAC,QAAQ,EAAE,qBAAqB,CAAA;KAAE,CAAA;IAC3D,iBAAiB,EAAE;QAAE,MAAM,EAAE,GAAG,CAAC;QAAC,QAAQ,EAAE,qBAAqB,CAAA;KAAE,CAAA;CACpE,CAAA;AACD,KAAK,KAAK,GAAG,IAAI,CAAC,qBAAqB,EAAE,aAAa,GAAG,eAAe,GAAG,aAAa,GAAG,mBAAmB,GAAG,kBAAkB,GAAG,WAAW,GAAG,aAAa,CAAC,CAAA;AAElK,MAAM,WAAW,0BAA0B;IACzC,aAAa,EAAE,CAAC,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE;QACL,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;QACxE,KAAK,EAAE,KAAK,CAAA;QACZ,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;QACvC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;QAC3B,aAAa,EAAE,MAAM,CAAA;QACrB,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAA;QACvC,iBAAiB,EAAE,sBAAsB,CAAA;KAC1C,CAAA;IACD,QAAQ,EAAE,QAAQ,CAAA;CACnB;AAED,qBAAa,yBAA0B,SAAQ,KAAK;;CAEnD;AAoCD,wBAAgB,kCAAkC,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,0BAA0B,CA8C9G;AAsBD,KAAK,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AA8J1C,wBAAsB,2BAA2B,CAAC,WAAW,EAAE,0BAA0B,EACvF,YAAY,EAAE,sBAAsB,GAAG,mBAAmB,GAAG,OAAO,CAAC,WAAW,CAAC,CA6ClF;AAED,0EAA0E;AAC1E,wBAAsB,uBAAuB,CAAC,IAAI,WAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAczF"}

package/lib/systemd-host-authority.js

@@ -0,0 +1,424 @@
+/** Finite owner authorization for the external systemd Host attestor. */
+import { closeSync, constants as fsConstants, fsyncSync, openSync } from 'node:fs';
+import { dirname, isAbsolute, resolve } from 'node:path';
+import { DatabaseSync } from 'node:sqlite';
+import { Ed25519ApprovalAuthority } from './approval.js';
+import { validateLiveQualificationTerms } from './live-qualification.js';
+import { sourceAuthorityCanonicalSafePath, sourceAuthorityReadSafeFile } from './source-approval-authority.js';
+import { parseRuntimeEpochRequest } from './runtime-epoch.js';
+import { controlPlaneDigest, readOwnerHostAttestationContext, readOwnerRuntimeEpochContext, validateHostDeploymentInputs } from './store.js';
+import { PROTECTED_PLUGIN_DENYLIST } from './source-workspace.js';
+import { loadTrustConfig, resolveTrustKey } from './trust.js';
+const ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,159}$/u;
+const DIGEST = /^[a-f0-9]{64}$/u;
+const PACKAGE = /^@dsh-enhanced\/([a-z][a-z0-9]*(?:-[a-z0-9]+)*)$/u;
+const MAX_REQUEST_BYTES = 65_536;
+const MAX_CONFIG_BYTES = 65_536;
+export class SystemdHostAuthorityError extends Error {
+    constructor() { super('systemd Host authority refused the request'); this.name = 'SystemdHostAuthorityError'; }
+}
+function fail() { throw new SystemdHostAuthorityError(); }
+function object(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        fail();
+    return value;
+}
+function exact(value, keys) {
+    if (Object.keys(value).sort().join('\0') !== [...keys].sort().join('\0'))
+        fail();
+}
+function same(a, b) { return controlPlaneDigest(a) === controlPlaneDigest(b); }
+function text(value, pattern = ID, max = 4096) {
+    if (typeof value !== 'string' || value.normalize('NFC').trim() !== value || !pattern.test(value)
+        || Buffer.byteLength(value) > max || /[\p{Cc}]/u.test(value))
+        fail();
+    return value;
+}
+function integer(value, min, max = Number.MAX_SAFE_INTEGER) {
+    if (!Number.isSafeInteger(value) || Number(value) < min || Number(value) > max)
+        fail();
+    return Number(value);
+}
+function path(value) {
+    const pathname = text(value, /^[\s\S]+$/u);
+    if (!isAbsolute(pathname) || pathname === '/' || resolve(pathname) !== pathname)
+        fail();
+    return pathname;
+}
+function pin(value) {
+    const item = object(value);
+    exact(item, ['path', 'sha256']);
+    return { path: path(item.path), sha256: text(item.sha256, DIGEST, 64) };
+}
+function owner(value) {
+    const item = object(value);
+    exact(item, ['authorityId', 'authorityHash', 'principalId', 'principalRecordId', 'principalVersion', 'workspace', 'agentPreset']);
+    return { authorityId: text(item.authorityId), authorityHash: text(item.authorityHash, DIGEST, 64),
+        principalId: text(item.principalId, /^[\s\S]+$/u, 512), principalRecordId: text(item.principalRecordId, /^[\s\S]+$/u, 512),
+        principalVersion: integer(item.principalVersion, 1), workspace: path(item.workspace), agentPreset: text(item.agentPreset) };
+}
+export function validateSystemdHostAuthorityConfig(value) {
+    const item = object(value);
+    exact(item, ['schemaVersion', 'statePath', 'controlDatabasePath', 'trustPath', 'grant', 'template']);
+    if (item.schemaVersion !== 1)
+        fail();
+    const statePath = path(item.statePath), controlPath = path(item.controlDatabasePath), trustPath = path(item.trustPath);
+    if (new Set([statePath, controlPath, trustPath]).size !== 3)
+        fail();
+    const grant = object(item.grant);
+    exact(grant, ['id', 'notBefore', 'expiresAt', 'maximumReloads', 'owner', 'profile', 'packages', 'coordinatorId', 'hostDeploymentInputs', 'liveQualification']);
+    text(grant.id);
+    const notBefore = integer(grant.notBefore, 0);
+    integer(grant.expiresAt, notBefore + 1);
+    integer(grant.maximumReloads, 1, 1000);
+    owner(grant.owner);
+    const profile = object(grant.profile);
+    exact(profile, ['name', 'path']);
+    const profileName = text(profile.name, /^[a-z0-9][a-z0-9-]{0,63}$/u, 64);
+    const profilePath = path(profile.path);
+    if (dirname(profilePath) === profilePath || resolve(profilePath) !== profilePath
+        || profilePath !== `${dirname(profilePath)}/${profileName}` || !dirname(profilePath).endsWith('/profiles'))
+        fail();
+    if ([statePath, controlPath, trustPath].some(value => value === profilePath || value.startsWith(`${profilePath}/`)))
+        fail();
+    text(grant.coordinatorId);
+    if (!Array.isArray(grant.packages) || grant.packages.length < 1 || grant.packages.length > 32)
+        fail();
+    const packages = grant.packages.map(item => text(item, PACKAGE, 128));
+    if (new Set(packages).size !== packages.length || packages.some(item => PROTECTED_PLUGIN_DENYLIST.has(item.slice('@dsh-enhanced/'.length))))
+        fail();
+    validateHostDeploymentInputs(grant.hostDeploymentInputs);
+    validateLiveQualificationTerms(grant.liveQualification);
+    const template = object(item.template);
+    exact(template, ['authority', 'keyId', 'privateKeyPath', 'stateRoot', 'executable', 'interpreter', 'processHelper', 'systemctl',
+        'scope', 'unit', 'unitProperties', 'timeoutMs', 'stableWindowMs', 'pollIntervalMs', 'readiness', 'recoveryReadiness']);
+    text(template.authority);
+    text(template.keyId);
+    path(template.privateKeyPath);
+    path(template.stateRoot);
+    pin(template.executable);
+    pin(template.interpreter);
+    pin(template.processHelper);
+    const systemctl = object(template.systemctl);
+    exact(systemctl, ['path', 'sha256', 'interpreter']);
+    path(systemctl.path);
+    text(systemctl.sha256, DIGEST, 64);
+    if (systemctl.interpreter !== null)
+        pin(systemctl.interpreter);
+    if (template.scope !== 'user' && template.scope !== 'system')
+        fail();
+    if (template.unit !== `dsh-profile-${profile.name}.service`)
+        fail();
+    const unitProperties = object(template.unitProperties);
+    exact(unitProperties, ['FragmentPath', 'DropInPaths', 'ExecStart', 'Environment', 'WorkingDirectory', 'User', 'Group', 'Type', 'KillMode']);
+    for (const value of Object.values(unitProperties))
+        text(value, /^[^\r\n]*$/u);
+    const timeout = integer(template.timeoutMs, 1000, 60000);
+    const stable = integer(template.stableWindowMs, 50, 10000), poll = integer(template.pollIntervalMs, 25, 1000);
+    if (stable + poll >= timeout)
+        fail();
+    for (const field of ['readiness', 'recoveryReadiness']) {
+        const readiness = object(template[field]);
+        exact(readiness, ['client', 'observer']);
+        pin(readiness.client);
+        const observer = object(readiness.observer);
+        exact(observer, ['socketPath', 'keyPath', 'profilePath', 'targets']);
+        path(observer.socketPath);
+        path(observer.keyPath);
+        if (observer.profilePath !== profile.path || !Array.isArray(observer.targets) || observer.targets.length < 1 || observer.targets.length > 32)
+            fail();
+    }
+}
+function contextFor(controlPath, operationId) {
+    const db = new DatabaseSync(sourceAuthorityCanonicalSafePath(controlPath, 'file'), { readOnly: true });
+    try {
+        db.exec('PRAGMA query_only=ON; BEGIN;');
+        const context = readOwnerHostAttestationContext(db, operationId);
+        db.exec('COMMIT');
+        return context;
+    }
+    catch (error) {
+        try {
+            db.exec('ROLLBACK');
+        }
+        catch { }
+        throw error;
+    }
+    finally {
+        db.close();
+    }
+}
+function runtimeEpochContextFor(controlPath, operationId) {
+    const db = new DatabaseSync(sourceAuthorityCanonicalSafePath(controlPath, 'file'), { readOnly: true });
+    try {
+        db.exec('PRAGMA query_only=ON; BEGIN;');
+        const context = readOwnerRuntimeEpochContext(db, operationId);
+        db.exec('COMMIT');
+        return context;
+    }
+    catch (error) {
+        try {
+            db.exec('ROLLBACK');
+        }
+        catch { }
+        throw error;
+    }
+    finally {
+        db.close();
+    }
+}
+function sameOwner(actual, expected) {
+    return actual.authorityId === expected.authorityId && actual.authorityHash === expected.authorityHash
+        && actual.principalId === expected.principalId && actual.principalRecordId === expected.principalRecordId
+        && actual.principalVersion === expected.principalVersion && actual.workspace === expected.workspace && actual.agentPreset === expected.agentPreset;
+}
+async function derive(config, request, now) {
+    const trust = await loadTrustConfig(config.trustPath);
+    const context = contextFor(config.controlDatabasePath, request.operationId);
+    const { plan, source, released, handoff, approvalReceipt, operation, dispatch, witness } = context;
+    if (request.schemaVersion !== 2 || !['reload', 'readiness', 'rollback'].includes(request.phase)
+        || !same(operation.request, request) || operation.requestDigest !== controlPlaneDigest(request)
+        || dispatch.status !== 'claimed' || !Number.isSafeInteger(dispatch.claimedAt)
+        || plan.id !== request.plan.id || plan.digest !== request.plan.digest
+        || plan.activation?.id !== request.activation.id || plan.activation.fence !== request.activation.fence
+        || plan.installationId !== request.installationId || !same(plan.ledger, request.ledger)
+        || plan.profile !== request.profile.name || plan.target.profilePath !== request.profile.path
+        || !sameOwner(source.owner, config.grant.owner) || !same(released, plan.candidate)
+        || !config.grant.packages.includes(released.package) || PROTECTED_PLUGIN_DENYLIST.has(released.id)
+        || plan.dossier.catalogProvenance !== 'owner-provided-integrity-pinned'
+        || !same(plan.dossier.hostDeploymentInputs, config.grant.hostDeploymentInputs)
+        || !same(plan.dossier.liveQualification, config.grant.liveQualification)
+        || !plan.dossier.handoff || plan.dossier.handoff.coordinatorId !== config.grant.coordinatorId
+        || handoff.coordinatorId !== config.grant.coordinatorId || handoff.planId !== plan.id || handoff.planDigest !== plan.digest
+        || trust.installationId !== request.installationId || !same(trust.ledger, request.ledger)
+        || trust.dshHome !== plan.target.dshHome || trust.ledger.path !== config.controlDatabasePath
+        || trust.hostAttestor === undefined || request.issuer.mode !== 'configured-executable'
+        || !same({ mode: 'configured-executable', id: trust.hostAttestor.id, version: trust.hostAttestor.version, path: trust.hostAttestor.path,
+            sha256: trust.hostAttestor.sha256, interpreter: trust.hostAttestor.interpreter, authority: trust.hostAttestor.authority,
+            keyId: trust.hostAttestor.keyId }, request.issuer)
+        || !same({ authority: config.template.authority, keyId: config.template.keyId,
+            executable: config.template.executable, interpreter: config.template.interpreter }, { authority: trust.hostAttestor.authority, keyId: trust.hostAttestor.keyId,
+            executable: { path: trust.hostAttestor.path, sha256: trust.hostAttestor.sha256 }, interpreter: trust.hostAttestor.interpreter }))
+        fail();
+    if (config.grant.profile.name !== plan.profile || config.grant.profile.path !== plan.target.profilePath)
+        fail();
+    const key = resolveTrustKey(trust, 'approval', approvalReceipt.authority, approvalReceipt.keyId);
+    const recovering = request.phase === 'rollback';
+    const verifiedAt = recovering ? witness?.createdAt : dispatch.claimedAt;
+    if (verifiedAt === undefined)
+        fail();
+    const verified = await new Ed25519ApprovalAuthority(key.publicKeyPem, key.authority, key.keyId, () => verifiedAt).verify(approvalReceipt, plan);
+    if (!same(verified, plan.approval))
+        fail();
+    if (!recovering) {
+        if (now < config.grant.notBefore || now >= config.grant.expiresAt || request.requestedAt < config.grant.notBefore
+            || request.requestedAt > now || dispatch.claimedAt < config.grant.notBefore || dispatch.claimedAt >= config.grant.expiresAt
+            || handoff.revokedAt !== undefined || handoff.expiresAt <= now || plan.expiresAt <= now
+            || approvalReceipt.expiresAt <= now || !witness || witness.activationId !== request.activation.id
+            || witness.fence !== request.activation.fence || witness.planDigest !== plan.digest
+            || !same(witness.inputs, config.grant.hostDeploymentInputs))
+            fail();
+    }
+    else if (request.requirements.kind !== 'rollback' || !witness || !plan.activation.hostRecoveryRequired
+        || !plan.activation.rollbackProfileRestored || !plan.activation.targetBaselineFiles
+        || !same(request.requirements.baselineFiles, plan.activation.targetBaselineFiles)
+        || request.requirements.action !== (plan.activation.targetOriginallyExisted ? 'restore' : 'stop')
+        || (request.requirements.action === 'restore' && !witness))
+        fail();
+    const forwardExpiry = Math.min(config.grant.expiresAt, plan.expiresAt, approvalReceipt.expiresAt, handoff.expiresAt);
+    // Physical recovery is a separate, exact, short-lived obligation after an
+    // already exposed plan. It does not renew forward installation authority.
+    const expiresAt = recovering ? dispatch.claimedAt + Math.max(config.template.timeoutMs + 1000, request.receiptTtlMs) : forwardExpiry;
+    if (expiresAt <= now)
+        fail();
+    const auth = { installationId: request.installationId, ledger: request.ledger, profile: request.profile,
+        plan: request.plan, activation: request.activation,
+        ...(request.phase === 'readiness' ? { hostGeneration: request.predecessor?.hostGeneration }
+            : { previousHostGeneration: request.requirements.kind === 'reload' || request.requirements.kind === 'rollback'
+                    ? request.requirements.previousHostGeneration : undefined }),
+        requestDigest: controlPlaneDigest(request), notBefore: recovering ? request.requestedAt : config.grant.notBefore,
+        expiresAt };
+    let profileFiles;
+    let readiness;
+    if (request.phase === 'rollback') {
+        profileFiles = plan.activation.targetBaselineFiles;
+        readiness = request.requirements.kind === 'rollback' && request.requirements.action === 'restore'
+            ? { ...config.template.recoveryReadiness, deploymentFiles: witness.baselineDeploymentFiles.map(item => ({ path: item.path, sha256: item.sha256 })) }
+            : null;
+    }
+    else {
+        profileFiles = witness.profileFiles;
+        if (request.phase === 'readiness')
+            readiness = { ...config.template.readiness,
+                deploymentFiles: witness.deploymentFiles.map(item => ({ path: item.path, sha256: item.sha256 })),
+                reloadOperationId: request.predecessor?.operationId };
+    }
+    const { readiness: _readiness, recoveryReadiness: _recoveryReadiness, ...base } = config.template;
+    const result = { schemaVersion: request.phase === 'reload' ? 1 : request.phase === 'readiness' ? 2 : 3,
+        ...base, profileFiles, authorization: auth, ...(readiness === undefined ? {} : { readiness }) };
+    return { result, witnessDigest: witness?.digest ?? controlPlaneDigest({ baseline: plan.activation.targetBaselineFiles }),
+        contextDigest: controlPlaneDigest(context), trustDigest: controlPlaneDigest(trust) };
+}
+/** Standing authority observes a fresh Host instance of an already successful deployment. */
+async function deriveRuntimeEpoch(config, request, now) {
+    const trust = await loadTrustConfig(config.trustPath);
+    const context = runtimeEpochContextFor(config.controlDatabasePath, request.operationId);
+    const { plan, source, released, handoff, approvalReceipt, witness, readiness } = context;
+    const receipt = readiness.receipt;
+    if (!same(context.request, request) || context.status !== 'claimed' || context.createdAt !== request.requestedAt
+        || plan.id !== request.plan.id || plan.digest !== request.plan.digest
+        || plan.activation?.id !== request.activation.id || plan.activation.fence !== request.activation.fence
+        || plan.installationId !== request.installationId || !same(plan.ledger, request.ledger)
+        || plan.profile !== request.profile.name || plan.target.profilePath !== request.profile.path
+        || config.grant.profile.name !== plan.profile || config.grant.profile.path !== plan.target.profilePath
+        || !sameOwner(source.owner, config.grant.owner) || !same(released, plan.candidate)
+        || !config.grant.packages.includes(released.package) || PROTECTED_PLUGIN_DENYLIST.has(released.id)
+        || plan.dossier.catalogProvenance !== 'owner-provided-integrity-pinned'
+        || !same(plan.dossier.hostDeploymentInputs, config.grant.hostDeploymentInputs)
+        || !same(plan.dossier.liveQualification, config.grant.liveQualification)
+        || !plan.dossier.handoff || plan.dossier.handoff.coordinatorId !== config.grant.coordinatorId
+        || handoff.coordinatorId !== config.grant.coordinatorId || handoff.planId !== plan.id || handoff.planDigest !== plan.digest
+        || handoff.revokedAt !== undefined
+        || !witness || witness.activationId !== request.activation.id || witness.fence !== request.activation.fence
+        || witness.planDigest !== plan.digest || !same(witness.inputs, config.grant.hostDeploymentInputs)
+        || readiness.status !== 'applied' || readiness.phase !== 'readiness' || !receipt || receipt.outcome !== 'passed'
+        || !Number.isSafeInteger(readiness.createdAt) || readiness.createdAt < plan.createdAt
+        || readiness.operationId !== request.predecessor.operationId
+        || controlPlaneDigest(receipt) !== request.predecessor.receiptDigest
+        || receipt.hostGeneration !== request.predecessor.hostGeneration
+        || receipt.planId !== plan.id || receipt.planDigest !== plan.digest
+        || receipt.activationId !== request.activation.id || receipt.fence !== request.activation.fence
+        || trust.installationId !== request.installationId || !same(trust.ledger, request.ledger)
+        || trust.dshHome !== plan.target.dshHome || trust.ledger.path !== config.controlDatabasePath
+        || trust.hostAttestor === undefined
+        || !same({ mode: 'configured-executable', id: trust.hostAttestor.id, version: trust.hostAttestor.version,
+            path: trust.hostAttestor.path, sha256: trust.hostAttestor.sha256, interpreter: trust.hostAttestor.interpreter,
+            authority: trust.hostAttestor.authority, keyId: trust.hostAttestor.keyId }, request.issuer)
+        || !same({ authority: config.template.authority, keyId: config.template.keyId,
+            executable: config.template.executable, interpreter: config.template.interpreter }, { authority: trust.hostAttestor.authority, keyId: trust.hostAttestor.keyId,
+            executable: { path: trust.hostAttestor.path, sha256: trust.hostAttestor.sha256 }, interpreter: trust.hostAttestor.interpreter }))
+        fail();
+    const key = resolveTrustKey(trust, 'approval', approvalReceipt.authority, approvalReceipt.keyId);
+    const verified = await new Ed25519ApprovalAuthority(key.publicKeyPem, key.authority, key.keyId, () => readiness.createdAt).verify(approvalReceipt, plan);
+    if (!same(verified, plan.approval))
+        fail();
+    const expiresAt = Math.min(config.grant.expiresAt, request.requestedAt + request.receiptTtlMs);
+    if (now < config.grant.notBefore || now >= expiresAt || request.requestedAt < config.grant.notBefore
+        || request.requestedAt > now || expiresAt <= request.requestedAt)
+        fail();
+    const { readiness: _readiness, recoveryReadiness: _recoveryReadiness, ...base } = config.template;
+    const result = { schemaVersion: context.maintenance.length ? 6 : 5, ...base, profileFiles: witness.profileFiles,
+        ...(context.maintenance.length ? { maintenance: context.maintenance } : {}),
+        authorization: { installationId: request.installationId, ledger: request.ledger, profile: request.profile,
+            plan: request.plan, activation: request.activation, hostGeneration: request.predecessor.hostGeneration,
+            requestDigest: controlPlaneDigest(request), notBefore: config.grant.notBefore, expiresAt },
+        readiness: { ...config.template.readiness,
+            deploymentFiles: witness.deploymentFiles.map(item => ({ path: item.path, sha256: item.sha256 })) } };
+    return { result, witnessDigest: witness.digest, contextDigest: controlPlaneDigest(context), trustDigest: controlPlaneDigest(trust) };
+}
+function journal(pathname) {
+    sourceAuthorityCanonicalSafePath(dirname(pathname), 'directory');
+    sourceAuthorityCanonicalSafePath(pathname, 'file', true);
+    const directory = openSync(dirname(pathname), fsConstants.O_RDONLY | fsConstants.O_DIRECTORY);
+    try {
+        fsyncSync(directory);
+    }
+    finally {
+        closeSync(directory);
+    }
+    const db = new DatabaseSync(pathname);
+    db.exec(`PRAGMA busy_timeout=5000; PRAGMA journal_mode=WAL; PRAGMA synchronous=FULL;
+    CREATE TABLE IF NOT EXISTS systemd_host_grants (grant_id TEXT PRIMARY KEY, grant_digest TEXT NOT NULL, config_digest TEXT NOT NULL, trust_digest TEXT NOT NULL) STRICT;
+    CREATE TABLE IF NOT EXISTS systemd_host_operations (operation_id TEXT PRIMARY KEY, grant_id TEXT NOT NULL, phase TEXT NOT NULL,
+      request_digest TEXT NOT NULL, config_digest TEXT NOT NULL, witness_digest TEXT NOT NULL, context_digest TEXT NOT NULL,
+      config_json TEXT NOT NULL, UNIQUE(grant_id, operation_id)) STRICT;`);
+    return db;
+}
+export async function resolveSystemdHostAuthority(configInput, requestInput) {
+    try {
+        validateSystemdHostAuthorityConfig(configInput);
+        const config = configInput;
+        if (!requestInput || typeof requestInput !== 'object')
+            fail();
+        const runtimeEpoch = requestInput.kind === 'dsh-runtime-epoch-request';
+        if (!runtimeEpoch && requestInput.kind !== 'dsh-host-attestation-request')
+            fail();
+        const request = runtimeEpoch ? parseRuntimeEpochRequest(requestInput) : requestInput;
+        const deriveRequest = () => runtimeEpoch
+            ? deriveRuntimeEpoch(config, request, Date.now())
+            : derive(config, request, Date.now());
+        const first = await deriveRequest();
+        const db = journal(config.statePath);
+        try {
+            db.exec('BEGIN IMMEDIATE');
+            try {
+                const second = await deriveRequest();
+                if (!same(first, second))
+                    fail();
+                const configDigest = controlPlaneDigest(config);
+                const grantDigest = controlPlaneDigest(config.grant);
+                const row = db.prepare('SELECT * FROM systemd_host_grants WHERE grant_id=?').get(config.grant.id);
+                if (row === undefined)
+                    db.prepare('INSERT INTO systemd_host_grants VALUES (?,?,?,?)').run(config.grant.id, grantDigest, configDigest, second.trustDigest);
+                else if (row.grant_digest !== grantDigest || row.config_digest !== configDigest || row.trust_digest !== second.trustDigest)
+                    fail();
+                const previous = db.prepare('SELECT * FROM systemd_host_operations WHERE operation_id=?').get(request.operationId);
+                const phase = runtimeEpoch ? 'runtime-epoch' : request.phase;
+                const requestDigest = controlPlaneDigest(request), outputDigest = controlPlaneDigest(second.result);
+                if (previous !== undefined) {
+                    if (previous.grant_id !== config.grant.id || previous.phase !== phase || previous.request_digest !== requestDigest
+                        || previous.config_digest !== outputDigest || previous.witness_digest !== second.witnessDigest
+                        || previous.context_digest !== second.contextDigest || controlPlaneDigest(JSON.parse(previous.config_json)) !== outputDigest)
+                        fail();
+                    db.exec('COMMIT');
+                    return JSON.parse(previous.config_json);
+                }
+                if ((phase === 'reload' || phase === 'runtime-epoch') && db.prepare('SELECT COUNT(*) AS n FROM systemd_host_operations WHERE grant_id=? AND phase=?')
+                    .get(config.grant.id, phase).n >= config.grant.maximumReloads)
+                    fail();
+                const json = JSON.stringify(second.result);
+                if (Buffer.byteLength(json) + 1 > 524_288)
+                    fail();
+                db.prepare('INSERT INTO systemd_host_operations VALUES (?,?,?,?,?,?,?,?)').run(request.operationId, config.grant.id, phase, requestDigest, outputDigest, second.witnessDigest, second.contextDigest, json);
+                db.exec('COMMIT');
+                return second.result;
+            }
+            catch (error) {
+                try {
+                    db.exec('ROLLBACK');
+                }
+                catch { }
+                throw error;
+            }
+        }
+        finally {
+            db.close();
+        }
+    }
+    catch {
+        throw new SystemdHostAuthorityError();
+    }
+}
+/** One bounded request in, one exact schema-1/2/3/5 configuration out. */
+export async function runSystemdHostAuthority(argv = process.argv.slice(2)) {
+    try {
+        if (argv.length !== 2 || argv[0] !== '--config')
+            fail();
+        const configPath = path(argv[1]);
+        const config = JSON.parse(sourceAuthorityReadSafeFile(configPath, MAX_CONFIG_BYTES).toString('utf8'));
+        const chunks = [];
+        let size = 0;
+        for await (const chunk of process.stdin) {
+            const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+            if ((size += bytes.length) > MAX_REQUEST_BYTES)
+                fail();
+            chunks.push(bytes);
+        }
+        const request = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+        process.stdout.write(`${JSON.stringify(await resolveSystemdHostAuthority(config, request))}\n`);
+    }
+    catch {
+        throw new SystemdHostAuthorityError();
+    }
+}
+//# sourceMappingURL=systemd-host-authority.js.map

package/lib/systemd-host-authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"systemd-host-authority.js","sourceRoot":"","sources":["../src/systemd-host-authority.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,OAAO,EAAE,SAAS,EAAE,SAAS,IAAI,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAClF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAA;AACxD,OAAO,EAAE,8BAA8B,EAA+B,MAAM,yBAAyB,CAAA;AACrG,OAAO,EAAE,gCAAgC,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAA;AAC9G,OAAO,EAAE,wBAAwB,EAA4B,MAAM,oBAAoB,CAAA;AACvF,OAAO,EAAE,kBAAkB,EAAE,+BAA+B,EAAE,4BAA4B,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAA;AAC5I,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AACjE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAK7D,MAAM,EAAE,GAAG,sCAAsC,CAAA;AACjD,MAAM,MAAM,GAAG,iBAAiB,CAAA;AAChC,MAAM,OAAO,GAAG,mDAAmD,CAAA;AACnE,MAAM,iBAAiB,GAAG,MAAM,CAAA;AAChC,MAAM,gBAAgB,GAAG,MAAM,CAAA;AAgC/B,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,gBAAgB,KAAK,CAAC,4CAA4C,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA,CAAC,CAAC;CAC/G;AACD,SAAS,IAAI,KAAY,MAAM,IAAI,yBAAyB,EAAE,CAAA,CAAC,CAAC;AAChE,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,CAAA;IACvE,OAAO,KAAgC,CAAA;AACzC,CAAC;AACD,SAAS,KAAK,CAAC,KAA8B,EAAE,IAAuB;IACpE,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,IAAI,EAAE,CAAA;AAClF,CAAC;AACD,SAAS,IAAI,CAAC,CAAU,EAAE,CAAU,IAAa,OAAO,kBAAkB,CAAC,CAAC,CAAC,KAAK,kBAAkB,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC;AACzG,SAAS,IAAI,CAAC,KAAc,EAAE,OAAO,GAAG,EAAE,EAAE,GAAG,GAAG,IAAI;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;WAC3F,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,CAAA;IACtE,OAAO,KAAK,CAAA;AACd,CAAC;AACD,SAAS,OAAO,CAAC,KAAc,EAAE,GAAW,EAAE,GAAG,GAAG,MAAM,CAAC,gBAAgB;IACzE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG;QAAE,IAAI,EAAE,CAAA;IACtF,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;AACtB,CAAC;AACD,SAAS,IAAI,CAAC,KAAc;IAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAA;IAC1C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,QAAQ,KAAK,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,QAAQ;QAAE,IAAI,EAAE,CAAA;IACvF,OAAO,QAAQ,CAAA;AACjB,CAAC;AACD,SAAS,GAAG,CAAC,KAAc;IACzB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;IAC3D,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,CAAA;AACzE,CAAC;AACD,SAAS,KAAK,CAAC,KAAc;IAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IAC1B,KAAK,CAAC,IAAI,EAAE,CAAC,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAA;IACjI,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC;QAC/F,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,EAAE,GAAG,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,YAAY,EAAE,GAAG,CAAC;QAC1H,gBAAgB,EAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAA;AAC/H,CAAC;AAED,MAAM,UAAU,kCAAkC,CAAC,KAAc;IAC/D,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAAC,KAAK,CAAC,IAAI,EAAE,CAAC,eAAe,EAAE,WAAW,EAAE,qBAAqB,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAA;IAChI,IAAI,IAAI,CAAC,aAAa,KAAK,CAAC;QAAE,IAAI,EAAE,CAAA;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACtH,IAAI,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;QAAE,IAAI,EAAE,CAAA;IACnE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAChC,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,eAAe,EAAE,sBAAsB,EAAE,mBAAmB,CAAC,CAAC,CAAA;IAC9J,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAAC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAA;IAC7D,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC;IAAC,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,EAAE,IAAI,CAAC,CAAA;IAC/E,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAClB,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAAC,KAAK,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACvE,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,4BAA4B,EAAE,EAAE,CAAC,CAAA;IACxE,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACtC,IAAI,OAAO,CAAC,WAAW,CAAC,KAAK,WAAW,IAAI,OAAO,CAAC,WAAW,CAAC,KAAK,WAAW;WAC3E,WAAW,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,IAAI,EAAE,CAAA;IACpH,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,WAAW,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,WAAW,GAAG,CAAC,CAAC;QAAE,IAAI,EAAE,CAAA;IAC3H,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;IACzB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE;QAAE,IAAI,EAAE,CAAA;IACrG,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAA;IACrE,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,yBAAyB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;QAAE,IAAI,EAAE,CAAA;IACnJ,4BAA4B,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAA;IACxD,8BAA8B,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;IACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACtC,KAAK,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,WAAW;QAC7H,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,WAAW,EAAE,mBAAmB,CAAC,CAAC,CAAA;IACxH,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IACvG,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAAC,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAA;IAChF,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAAC,KAAK,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAA;IACjG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,CAAA;IACxD,IAAI,SAAS,CAAC,WAAW,KAAK,IAAI;QAAE,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;IAC9D,IAAI,QAAQ,CAAC,KAAK,KAAK,MAAM,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ;QAAE,IAAI,EAAE,CAAA;IACpE,IAAI,QAAQ,CAAC,IAAI,KAAK,eAAe,OAAO,CAAC,IAAI,UAAU;QAAE,IAAI,EAAE,CAAA;IACnE,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;IACtD,KAAK,CAAC,cAAc,EAAE,CAAC,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAA;IAC3I,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;QAAE,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,CAAA;IAC7E,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;IACxD,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;IAC7G,IAAI,MAAM,GAAG,IAAI,IAAI,OAAO;QAAE,IAAI,EAAE,CAAA;IACpC,KAAK,MAAM,KAAK,IAAI,CAAC,WAAW,EAAE,mBAAmB,CAAU,EAAE,CAAC;QAChE,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAAC,KAAK,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAA;QACnF,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QACrB,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QAC3C,KAAK,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC,CAAA;QACpE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;QACjD,IAAI,QAAQ,CAAC,WAAW,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE;YAAE,IAAI,EAAE,CAAA;IACtJ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,WAAmB,EAAE,WAAmB;IAC1D,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,gCAAgC,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IACtG,IAAI,CAAC;QAAC,EAAE,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QAAC,MAAM,OAAO,GAAG,+BAA+B,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;QAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAAC,OAAO,OAAO,CAAA;IAAC,CAAC;IACpJ,OAAO,KAAK,EAAE,CAAC;QAAC,IAAI,CAAC;YAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QAAC,MAAM,KAAK,CAAA;IAAC,CAAC;YAC1D,CAAC;QAAC,EAAE,CAAC,KAAK,EAAE,CAAA;IAAC,CAAC;AACxB,CAAC;AAED,SAAS,sBAAsB,CAAC,WAAmB,EAAE,WAAmB;IACtE,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,gCAAgC,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IACtG,IAAI,CAAC;QAAC,EAAE,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QAAC,MAAM,OAAO,GAAG,4BAA4B,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;QAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAAC,OAAO,OAAO,CAAA;IAAC,CAAC;IACjJ,OAAO,KAAK,EAAE,CAAC;QAAC,IAAI,CAAC;YAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QAAC,MAAM,KAAK,CAAA;IAAC,CAAC;YAC1D,CAAC;QAAC,EAAE,CAAC,KAAK,EAAE,CAAA;IAAC,CAAC;AACxB,CAAC;AAED,SAAS,SAAS,CAAC,MAA6B,EAAE,QAAe;IAC/D,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,IAAI,MAAM,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa;WAChG,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,IAAI,MAAM,CAAC,iBAAiB,KAAK,QAAQ,CAAC,iBAAiB;WACtG,MAAM,CAAC,gBAAgB,KAAK,QAAQ,CAAC,gBAAgB,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,IAAI,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CAAA;AACtJ,CAAC;AAID,KAAK,UAAU,MAAM,CAAC,MAAkC,EAAE,OAA+B,EAAE,GAAW;IACpG,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IACrD,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,mBAAmB,EAAE,OAAO,CAAC,WAAW,CAAC,CAAA;IAC3E,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAClG,IAAI,OAAO,CAAC,aAAa,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC;WAC1F,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,SAAS,CAAC,aAAa,KAAK,kBAAkB,CAAC,OAAO,CAAC;WAC5F,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;WAC1E,IAAI,CAAC,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,MAAM;WAClE,IAAI,CAAC,UAAU,EAAE,EAAE,KAAK,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,KAAK,OAAO,CAAC,UAAU,CAAC,KAAK;WACnG,IAAI,CAAC,cAAc,KAAK,OAAO,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC;WACpF,IAAI,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC,IAAI;WACzF,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC;WAC/E,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,yBAAyB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;WAC/F,IAAI,CAAC,OAAO,CAAC,iBAAiB,KAAK,iCAAiC;WACpE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC;WAC3E,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC;WACrE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,KAAK,MAAM,CAAC,KAAK,CAAC,aAAa;WAC1F,OAAO,CAAC,aAAa,KAAK,MAAM,CAAC,KAAK,CAAC,aAAa,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,MAAM;WACxH,KAAK,CAAC,cAAc,KAAK,OAAO,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC;WACtF,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,mBAAmB;WACzF,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,uBAAuB;WACnF,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,EAAE,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,YAAY,CAAC,IAAI;YACrI,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,SAAS;YACvH,KAAK,EAAE,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC;WACjD,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK;YAC3E,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,EACpF,EAAE,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,YAAY,CAAC,KAAK;YACxE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;QAAE,IAAI,EAAE,CAAA;IAC5I,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,WAAW;QAAE,IAAI,EAAE,CAAA;IAC/G,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,EAAE,UAAU,EAAE,eAAe,CAAC,SAAS,EAAE,eAAe,CAAC,KAAK,CAAC,CAAA;IAChG,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,KAAK,UAAU,CAAA;IAC/C,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAA;IACvE,IAAI,UAAU,KAAK,SAAS;QAAE,IAAI,EAAE,CAAA;IACpC,MAAM,QAAQ,GAAG,MAAM,IAAI,wBAAwB,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,IAAI,CAAC,CAAA;IAC/I,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC;QAAE,IAAI,EAAE,CAAA;IAE1C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,IAAI,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,IAAI,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,IAAI,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS;eAC5G,OAAO,CAAC,WAAW,GAAG,GAAG,IAAI,QAAQ,CAAC,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS;eACxH,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,IAAI,GAAG,IAAI,IAAI,CAAC,SAAS,IAAI,GAAG;eACpF,eAAe,CAAC,SAAS,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,YAAY,KAAK,OAAO,CAAC,UAAU,CAAC,EAAE;eAC9F,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,UAAU,CAAC,KAAK,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,MAAM;eAChF,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC;YAAE,IAAI,EAAE,CAAA;IACvE,CAAC;SAAM,IAAI,OAAO,CAAC,YAAY,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,oBAAoB;WACnG,CAAC,IAAI,CAAC,UAAU,CAAC,uBAAuB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,mBAAmB;WAChF,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,aAAa,EAAE,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC;WAC9E,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;WAC9F,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC;QAAE,IAAI,EAAE,CAAA;IAEpE,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IACpH,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,GAAG,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,aAAa,CAAA;IACpI,IAAI,SAAS,IAAI,GAAG;QAAE,IAAI,EAAE,CAAA;IAC5B,MAAM,IAAI,GAAG,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO;QACrG,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU;QAClD,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,WAAW,EAAE,cAAc,EAAE;YACzF,CAAC,CAAC,EAAE,sBAAsB,EAAE,OAAO,CAAC,YAAY,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,YAAY,CAAC,IAAI,KAAK,UAAU;oBAC5G,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,sBAAsB,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QAChE,aAAa,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS;QAChH,SAAS,EAAE,CAAA;IACb,IAAI,YAAgE,CAAA;IACpE,IAAI,SAAqD,CAAA;IACzD,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QACjC,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,mBAAoB,CAAA;QACnD,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,KAAK,UAAU,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,SAAS;YAC/F,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE,eAAe,EAAE,OAAQ,CAAC,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE;YACrJ,CAAC,CAAC,IAAI,CAAA;IACV,CAAC;SAAM,CAAC;QACN,YAAY,GAAG,OAAQ,CAAC,YAAY,CAAA;QACpC,IAAI,OAAO,CAAC,KAAK,KAAK,WAAW;YAAE,SAAS,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS;gBAC3E,eAAe,EAAE,OAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBACjG,iBAAiB,EAAE,OAAO,CAAC,WAAW,EAAE,WAAW,EAAE,CAAA;IACzD,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAA;IACjG,MAAM,MAAM,GAAG,EAAE,aAAa,EAAE,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpG,GAAG,IAAI,EAAE,YAAY,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAA;IACjG,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,IAAI,kBAAkB,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,mBAAmB,EAAE,CAAC;QACtH,aAAa,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAA;AACxF,CAAC;AAED,6FAA6F;AAC7F,KAAK,UAAU,kBAAkB,CAAC,MAAkC,EAAE,OAA4B,EAAE,GAAW;IAG7G,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IACrD,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,mBAAmB,EAAE,OAAO,CAAC,WAAW,CAAC,CAAA;IACvF,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,OAAO,CAAA;IACxF,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAA;IACjC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,WAAW;WAC3G,IAAI,CAAC,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,MAAM;WAClE,IAAI,CAAC,UAAU,EAAE,EAAE,KAAK,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,KAAK,OAAO,CAAC,UAAU,CAAC,KAAK;WACnG,IAAI,CAAC,cAAc,KAAK,OAAO,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC;WACpF,IAAI,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC,IAAI;WACzF,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,WAAW;WACnG,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC;WAC/E,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,yBAAyB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;WAC/F,IAAI,CAAC,OAAO,CAAC,iBAAiB,KAAK,iCAAiC;WACpE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC;WAC3E,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC;WACrE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,KAAK,MAAM,CAAC,KAAK,CAAC,aAAa;WAC1F,OAAO,CAAC,aAAa,KAAK,MAAM,CAAC,KAAK,CAAC,aAAa,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,MAAM;WACxH,OAAO,CAAC,SAAS,KAAK,SAAS;WAC/B,CAAC,OAAO,IAAI,OAAO,CAAC,YAAY,KAAK,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,UAAU,CAAC,KAAK;WACxG,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC;WAC9F,SAAS,CAAC,MAAM,KAAK,SAAS,IAAI,SAAS,CAAC,KAAK,KAAK,WAAW,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,QAAQ;WAC7G,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS;WAClF,SAAS,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW,CAAC,WAAW;WACzD,kBAAkB,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,WAAW,CAAC,aAAa;WACjE,OAAO,CAAC,cAAc,KAAK,OAAO,CAAC,WAAW,CAAC,cAAc;WAC7D,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,MAAM;WAChE,OAAO,CAAC,YAAY,KAAK,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,UAAU,CAAC,KAAK;WAC5F,KAAK,CAAC,cAAc,KAAK,OAAO,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC;WACtF,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,mBAAmB;WACzF,KAAK,CAAC,YAAY,KAAK,SAAS;WAChC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,EAAE,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,OAAO;YACtG,IAAI,EAAE,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,WAAW;YAC7G,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC;WAC1F,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK;YAC3E,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,EACpF,EAAE,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,YAAY,CAAC,KAAK;YACxE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;QAAE,IAAI,EAAE,CAAA;IAE5I,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,EAAE,UAAU,EAAE,eAAe,CAAC,SAAS,EAAE,eAAe,CAAC,KAAK,CAAC,CAAA;IAChG,MAAM,QAAQ,GAAG,MAAM,IAAI,wBAAwB,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,EAC5F,GAAG,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,IAAI,CAAC,CAAA;IAC1D,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC;QAAE,IAAI,EAAE,CAAA;IAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IAC9F,IAAI,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,IAAI,GAAG,IAAI,SAAS,IAAI,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS;WAC/F,OAAO,CAAC,WAAW,GAAG,GAAG,IAAI,SAAS,IAAI,OAAO,CAAC,WAAW;QAAE,IAAI,EAAE,CAAA;IAE1E,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAA;IACjG,MAAM,MAAM,GAAG,EAAE,aAAa,EAAE,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;QAC7G,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,aAAa,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO;YACvG,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,cAAc,EAAE,OAAO,CAAC,WAAW,CAAC,cAAc;YACtG,aAAa,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE;QAC5F,SAAS,EAAE,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS;YACvC,eAAe,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAA;IACxG,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAA;AACtI,CAAC;AAED,SAAS,OAAO,CAAC,QAAgB;IAC/B,gCAAgC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,CAAA;IAChE,gCAAgC,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;IACxD,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,WAAW,CAAC,CAAA;IAC7F,IAAI,CAAC;QAAC,SAAS,CAAC,SAAS,CAAC,CAAA;IAAC,CAAC;YAAS,CAAC;QAAC,SAAS,CAAC,SAAS,CAAC,CAAA;IAAC,CAAC;IAC7D,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAA;IACrC,EAAE,CAAC,IAAI,CAAC;;;;yEAI+D,CAAC,CAAA;IACxE,OAAO,EAAE,CAAA;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,WAAuC,EACvF,YAA0D;IAC1D,IAAI,CAAC;QACH,kCAAkC,CAAC,WAAW,CAAC,CAAA;QAC/C,MAAM,MAAM,GAAG,WAAW,CAAA;QAC1B,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ;YAAE,IAAI,EAAE,CAAA;QAC7D,MAAM,YAAY,GAAG,YAAY,CAAC,IAAI,KAAK,2BAA2B,CAAA;QACtE,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,IAAI,KAAK,8BAA8B;YAAE,IAAI,EAAE,CAAA;QACjF,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAA;QACpF,MAAM,aAAa,GAAG,GAAG,EAAE,CAAC,YAAY;YACtC,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE,OAA8B,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;YACxE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,OAAiC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;QACjE,MAAM,KAAK,GAAG,MAAM,aAAa,EAAE,CAAA;QACnC,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QACpC,IAAI,CAAC;YACH,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;YAC1B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAA;gBACpC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;oBAAE,IAAI,EAAE,CAAA;gBAChC,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAA;gBAC/C,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;gBACpD,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,oDAAoD,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACb,CAAA;gBACnF,IAAI,GAAG,KAAK,SAAS;oBAAE,EAAE,CAAC,OAAO,CAAC,kDAAkD,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,WAAW,CAAC,CAAA;qBACpJ,IAAI,GAAG,CAAC,YAAY,KAAK,WAAW,IAAI,GAAG,CAAC,aAAa,KAAK,YAAY,IAAI,GAAG,CAAC,YAAY,KAAK,MAAM,CAAC,WAAW;oBAAE,IAAI,EAAE,CAAA;gBAClI,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CAAC,4DAA4D,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAEpD,CAAA;gBAC7D,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAE,OAAkC,CAAC,KAAK,CAAA;gBACxF,MAAM,aAAa,GAAG,kBAAkB,CAAC,OAAO,CAAC,EAAE,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;gBACnG,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;oBAC3B,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK,IAAI,QAAQ,CAAC,cAAc,KAAK,aAAa;2BAC7G,QAAQ,CAAC,aAAa,KAAK,YAAY,IAAI,QAAQ,CAAC,cAAc,KAAK,MAAM,CAAC,aAAa;2BAC3F,QAAQ,CAAC,cAAc,KAAK,MAAM,CAAC,aAAa,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,KAAK,YAAY;wBAAE,IAAI,EAAE,CAAA;oBACtI,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBAAC,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAgB,CAAA;gBAC3E,CAAC;gBACD,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,eAAe,CAAC,IAAK,EAAE,CAAC,OAAO,CAAC,gFAAgF,CAAC;qBACnJ,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAmB,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,cAAc;oBAAE,IAAI,EAAE,CAAA;gBACzF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;gBAC1C,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO;oBAAE,IAAI,EAAE,CAAA;gBACjD,EAAE,CAAC,OAAO,CAAC,8DAA8D,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,EACjH,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,CAAA;gBACvF,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAAC,OAAO,MAAM,CAAC,MAAM,CAAA;YACzC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,IAAI,CAAC;oBAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;gBAAC,MAAM,KAAK,CAAA;YAAC,CAAC;QACtE,CAAC;gBAAS,CAAC;YAAC,EAAE,CAAC,KAAK,EAAE,CAAA;QAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,yBAAyB,EAAE,CAAA;IAAC,CAAC;AACnD,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU;YAAE,IAAI,EAAE,CAAA;QACvD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,2BAA2B,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA+B,CAAA;QACnI,MAAM,MAAM,GAAa,EAAE,CAAC;QAAC,IAAI,IAAI,GAAG,CAAC,CAAA;QACzC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACjE,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,iBAAiB;gBAAE,IAAI,EAAE,CAAA;YACtD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACpB,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAiD,CAAA;QAClH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,2BAA2B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAA;IACjG,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,yBAAyB,EAAE,CAAA;IAAC,CAAC;AACnD,CAAC"}

package/lib/task-observation-evidence.d.ts

@@ -0,0 +1,32 @@
+import type { AssistantDeliveryService, OwnerForegroundLearningTask } from '@dsh-enhanced/assistant-delivery';
+import type { AssistantEvaluationService } from '@dsh-enhanced/assistant-evaluation';
+import type { ForegroundDeploymentRecord } from './foreground-deployment.js';
+import type { TaskObservationOwner, TaskObservationVote } from './task-observation-types.js';
+type Evaluation = Pick<AssistantEvaluationService, 'canonicalHostScope' | 'getTrustedForegroundLearningProjection' | 'withTrustedCanonicalTaskWriterFence'>;
+type Delivery = Pick<AssistantDeliveryService, 'inspectOwnerForegroundLearningTask'>;
+export declare function taskObservationOwner(owner: TaskObservationOwner): TaskObservationOwner;
+/** A current canonical result and exact Delivery owner source are both required. */
+export declare function trustedForegroundSource(input: {
+    owner: TaskObservationOwner;
+    inboxId: string;
+    evaluation: Evaluation;
+    delivery: Delivery;
+}): OwnerForegroundLearningTask | undefined;
+/** Shared vote predicates; a runtime may impose a tighter window after this check. */
+export declare function trustedForegroundVote(input: {
+    deployment: ForegroundDeploymentRecord;
+    source: OwnerForegroundLearningTask | undefined;
+    now: number;
+    lookbackMs: number;
+}): TaskObservationVote | undefined;
+/** Re-read source evidence under Evaluation's canonical writer fence. */
+export declare function withTrustedForegroundVoteFence<T>(input: {
+    evaluation: Evaluation;
+    owner: TaskObservationOwner;
+    votes: readonly TaskObservationVote[];
+    read(): readonly OwnerForegroundLearningTask[];
+    callback(): T;
+    additionalSource?(): OwnerForegroundLearningTask;
+}): T;
+export {};
+//# sourceMappingURL=task-observation-evidence.d.ts.map

package/lib/task-observation-evidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-observation-evidence.d.ts","sourceRoot":"","sources":["../src/task-observation-evidence.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAA;AAC7G,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AAEpF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAA;AAC5E,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AAE5F,KAAK,UAAU,GAAG,IAAI,CAAC,0BAA0B,EAAE,oBAAoB,GAAG,wCAAwC,GAC9G,qCAAqC,CAAC,CAAA;AAC1C,KAAK,QAAQ,GAAG,IAAI,CAAC,wBAAwB,EAAE,oCAAoC,CAAC,CAAA;AAIpF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,GAAG,oBAAoB,CAGtF;AAED,oFAAoF;AACpF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,KAAK,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAA;CACzF,GAAG,2BAA2B,GAAG,SAAS,CAW1C;AAED,sFAAsF;AACtF,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,UAAU,EAAE,0BAA0B,CAAC;IAAC,MAAM,EAAE,2BAA2B,GAAG,SAAS,CAAA;IACvF,GAAG,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAChC,GAAG,mBAAmB,GAAG,SAAS,CAkBlC;AAED,yEAAyE;AACzE,wBAAgB,8BAA8B,CAAC,CAAC,EAAE,KAAK,EAAE;IACvD,UAAU,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,oBAAoB,CAAC;IAAC,KAAK,EAAE,SAAS,mBAAmB,EAAE,CAAA;IAC1F,IAAI,IAAI,SAAS,2BAA2B,EAAE,CAAC;IAAC,QAAQ,IAAI,CAAC,CAAA;IAC7D,gBAAgB,CAAC,IAAI,2BAA2B,CAAA;CACjD,GAAG,CAAC,CAcJ"}