@dsh-enhanced/plugin-control-plane 0.1.6 → 0.1.12

package/lib/trust.js

@@ -0,0 +1,477 @@
+import { constants as fsConstants } from 'node:fs';
+import { lstat, open, readFile, realpath } from 'node:fs/promises';
+import { dirname, isAbsolute, join, resolve } from 'node:path';
+import { createHash, createPublicKey } from 'node:crypto';
+const UUID = /^[a-f0-9]{8}-[a-f0-9]{4}-[1-8][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/u;
+const ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
+const VERSION = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,63}$/u;
+const ENVIRONMENT = /^[A-Z][A-Z0-9_]{0,63}$/u;
+const FORBIDDEN_ENVIRONMENT = /(AUTH|COOKIE|CREDENTIAL|KEY|PASS|SECRET|TOKEN)/u;
+const EXECUTION_CONTROL_ENVIRONMENT = /^(?:BASH_ENV|ENV|IFS|LD_.*|DYLD_.*|NODE_OPTIONS|NODE_PATH|PERL5LIB|PERL5OPT|PYTHONHOME|PYTHONPATH|RUBYLIB|RUBYOPT|SHELLOPTS|ZDOTDIR)$/u;
+export class TrustConfigError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'TrustConfigError';
+    }
+}
+export const defaultHostAttestationPolicy = Object.freeze({
+    readinessMinimumChecks: 1,
+    effectBlockedMinimumDeliveryAttempts: 1,
+    effectBlockedMinimumToolExecutionAttempts: 1,
+    shadowMinimumSamples: 1,
+    shadowMaximumMismatches: 0,
+    canaryMinimumSamples: 1,
+    canaryMaximumFailures: 0,
+    soakMinimumWindowMs: 60_000,
+    soakMinimumSamples: 10,
+    soakMaximumFailureRate: 0,
+    healthMinimumChecks: 1,
+    healthMaximumFailures: 0,
+    receiptTtlMs: 30_000,
+});
+function record(value, label) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        throw new TrustConfigError('invalid-config', `${label} must be an object`);
+    return value;
+}
+function exactKeys(value, expected, label) {
+    if (Object.keys(value).sort().join(',') !== [...expected].sort().join(','))
+        throw new TrustConfigError('invalid-config', `${label} has unknown or missing fields`);
+}
+function text(value, label, maximum = 500) {
+    if (typeof value !== 'string')
+        throw new TrustConfigError('invalid-config', `${label} must be text`);
+    const normalized = value.normalize('NFC').trim();
+    if (normalized === '' || Buffer.byteLength(normalized) > maximum || [...normalized].some(character => {
+        const point = character.codePointAt(0);
+        return point <= 0x1f || point === 0x7f;
+    }))
+        throw new TrustConfigError('invalid-config', `${label} must be bounded printable text`);
+    return normalized;
+}
+function keys(value, label) {
+    if (!Array.isArray(value) || value.length === 0 || value.length > 32)
+        throw new TrustConfigError('invalid-config', `${label} must contain 1..32 keys`);
+    const seen = new Set();
+    return Object.freeze(value.map((raw, index) => {
+        const item = record(raw, `${label}[${index}]`);
+        exactKeys(item, ['authority', 'keyId', 'publicKeyPem'], `${label}[${index}]`);
+        const authority = text(item.authority, `${label}.authority`, 128);
+        const keyId = text(item.keyId, `${label}.keyId`, 128);
+        if (typeof item.publicKeyPem !== 'string')
+            throw new TrustConfigError('invalid-config', `${label}.publicKeyPem must be text`);
+        const publicKeyPem = item.publicKeyPem.trim();
+        if (Buffer.byteLength(publicKeyPem) > 8_192 || publicKeyPem.includes('\0'))
+            throw new TrustConfigError('invalid-config', `${label}.publicKeyPem is invalid`);
+        if (!ID.test(authority) || !ID.test(keyId) || seen.has(`${authority}\0${keyId}`))
+            throw new TrustConfigError('invalid-config', `${label} contains an invalid or duplicate authority/key id`);
+        seen.add(`${authority}\0${keyId}`);
+        try {
+            const key = createPublicKey(publicKeyPem);
+            if (key.asymmetricKeyType !== 'ed25519')
+                throw new Error('not Ed25519');
+        }
+        catch {
+            throw new TrustConfigError('invalid-config', `${label} must contain Ed25519 public keys`);
+        }
+        return Object.freeze({ authority, keyId, publicKeyPem });
+    }));
+}
+function keyFingerprint(key) {
+    const der = createPublicKey(key.publicKeyPem).export({ format: 'der', type: 'spki' });
+    return createHash('sha256').update(der).digest('hex');
+}
+function assertIndependentKeySets(left, right, label) {
+    for (const first of left)
+        for (const second of right) {
+            if ((first.authority === second.authority && first.keyId === second.keyId) || keyFingerprint(first) === keyFingerprint(second)) {
+                throw new TrustConfigError('invalid-config', `${label} must not reuse an authority/key identity or public key`);
+            }
+        }
+}
+async function assertOwnerPrivateFile(path) {
+    const metadata = await lstat(path);
+    const uid = process.getuid?.();
+    if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.nlink !== 1 || (metadata.mode & 0o077) !== 0
+        || (uid !== undefined && metadata.uid !== uid) || await realpath(path) !== resolve(path)) {
+        throw new TrustConfigError('unsafe-file', 'trust config must be one owner-owned 0600 regular file without symlink traversal');
+    }
+    const parent = await lstat(dirname(path));
+    if (!parent.isDirectory() || parent.isSymbolicLink() || (parent.mode & 0o077) !== 0
+        || (uid !== undefined && parent.uid !== uid) || await realpath(dirname(path)) !== resolve(dirname(path))) {
+        throw new TrustConfigError('unsafe-file', 'trust config directory must be owner-owned and private');
+    }
+}
+async function readAt(handle, size) {
+    const bytes = Buffer.alloc(Number(size));
+    let offset = 0;
+    while (offset < bytes.length) {
+        const result = await handle.read(bytes, offset, bytes.length - offset, offset);
+        if (result.bytesRead === 0)
+            break;
+        offset += result.bytesRead;
+    }
+    if (offset !== bytes.length)
+        throw new TrustConfigError('unsafe-file', 'trusted executable changed or was truncated while reading');
+    return bytes;
+}
+async function snapshotOpenTrustedExecutable(path, handle, expectedSha256) {
+    const before = await handle.stat({ bigint: true });
+    const pathBefore = await lstat(path, { bigint: true });
+    const uid = process.getuid?.();
+    const expectedUid = uid === undefined ? undefined : BigInt(uid);
+    if (!before.isFile() || before.nlink !== 1n || before.size > 268435456n || (before.mode & 73n) === 0n
+        || (before.mode & 18n) !== 0n || (expectedUid !== undefined && before.uid !== 0n && before.uid !== expectedUid)
+        || !pathBefore.isFile() || pathBefore.isSymbolicLink() || pathBefore.dev !== before.dev || pathBefore.ino !== before.ino) {
+        throw new TrustConfigError('unsafe-file', 'trusted executable must be one bounded non-writable root- or owner-owned executable regular file');
+    }
+    const bytes = await readAt(handle, before.size);
+    const sha256 = createHash('sha256').update(bytes).digest('hex');
+    const after = await handle.stat({ bigint: true });
+    const pathAfter = await lstat(path, { bigint: true });
+    if (after.dev !== before.dev || after.ino !== before.ino || after.size !== before.size || after.mtimeNs !== before.mtimeNs
+        || after.ctimeNs !== before.ctimeNs || pathAfter.dev !== before.dev || pathAfter.ino !== before.ino || sha256 !== expectedSha256) {
+        throw new TrustConfigError('unsafe-file', 'trusted executable identity or digest changed during verification');
+    }
+    return Object.freeze({ device: before.dev, inode: before.ino, sha256 });
+}
+export async function openTrustedExecutable(path, expectedSha256) {
+    if (!isAbsolute(path) || await realpath(path) !== resolve(path))
+        throw new TrustConfigError('unsafe-file', 'trusted executable path must be canonical');
+    const directory = await lstat(dirname(path));
+    const uid = process.getuid?.();
+    if (!directory.isDirectory() || directory.isSymbolicLink() || (directory.mode & 0o022) !== 0
+        || (uid !== undefined && directory.uid !== 0 && directory.uid !== uid)) {
+        throw new TrustConfigError('unsafe-file', 'trusted executable directory must not be writable by another principal');
+    }
+    const handle = await open(path, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW);
+    try {
+        const snapshot = await snapshotOpenTrustedExecutable(path, handle, expectedSha256);
+        return Object.freeze({ path, handle, snapshot });
+    }
+    catch (error) {
+        await handle.close();
+        throw error;
+    }
+}
+export async function verifyOpenTrustedExecutable(value) {
+    const current = await snapshotOpenTrustedExecutable(value.path, value.handle, value.snapshot.sha256);
+    if (current.device !== value.snapshot.device || current.inode !== value.snapshot.inode) {
+        throw new TrustConfigError('unsafe-file', 'trusted executable descriptor identity changed during execution');
+    }
+    return current;
+}
+export async function inspectTrustedExecutable(path, expectedSha256) {
+    const executable = await openTrustedExecutable(path, expectedSha256);
+    try {
+        return executable.snapshot;
+    }
+    finally {
+        await executable.handle.close();
+    }
+}
+function environmentAllowlist(value, label) {
+    if (!Array.isArray(value) || value.length > 32)
+        throw new TrustConfigError('invalid-config', `${label} must be an array`);
+    const result = [...new Set(value.map(raw => text(raw, label, 64)))];
+    if (result.some(name => !ENVIRONMENT.test(name) || FORBIDDEN_ENVIRONMENT.test(name) || EXECUTION_CONTROL_ENVIRONMENT.test(name))) {
+        throw new TrustConfigError('invalid-config', `${label} contains an invalid or secret-bearing variable`);
+    }
+    return Object.freeze(result);
+}
+function policy(value) {
+    const item = record(value, 'hostPolicy');
+    const fields = ['readinessMinimumChecks', 'effectBlockedMinimumDeliveryAttempts', 'effectBlockedMinimumToolExecutionAttempts',
+        'shadowMinimumSamples', 'shadowMaximumMismatches', 'canaryMinimumSamples', 'canaryMaximumFailures', 'soakMinimumWindowMs',
+        'soakMinimumSamples', 'soakMaximumFailureRate', 'healthMinimumChecks', 'healthMaximumFailures', 'receiptTtlMs'];
+    exactKeys(item, fields, 'hostPolicy');
+    const positive = (name, minimum, maximum) => {
+        const raw = item[name];
+        if (typeof raw !== 'number' || !Number.isSafeInteger(raw) || raw < minimum || raw > maximum) {
+            throw new TrustConfigError('invalid-config', `hostPolicy.${name} is outside its accepted range`);
+        }
+        return raw;
+    };
+    const rate = item.soakMaximumFailureRate;
+    if (typeof rate !== 'number' || !Number.isFinite(rate) || rate < 0 || rate > 1) {
+        throw new TrustConfigError('invalid-config', 'hostPolicy.soakMaximumFailureRate must be between zero and one');
+    }
+    return Object.freeze({
+        readinessMinimumChecks: positive('readinessMinimumChecks', 1, 1_000_000),
+        effectBlockedMinimumDeliveryAttempts: positive('effectBlockedMinimumDeliveryAttempts', 1, 1_000_000),
+        effectBlockedMinimumToolExecutionAttempts: positive('effectBlockedMinimumToolExecutionAttempts', 1, 1_000_000),
+        shadowMinimumSamples: positive('shadowMinimumSamples', 1, 1_000_000),
+        shadowMaximumMismatches: positive('shadowMaximumMismatches', 0, 1_000_000),
+        canaryMinimumSamples: positive('canaryMinimumSamples', 1, 1_000_000),
+        canaryMaximumFailures: positive('canaryMaximumFailures', 0, 1_000_000),
+        soakMinimumWindowMs: positive('soakMinimumWindowMs', 1, 86_400_000),
+        soakMinimumSamples: positive('soakMinimumSamples', 1, 10_000_000),
+        soakMaximumFailureRate: rate,
+        healthMinimumChecks: positive('healthMinimumChecks', 1, 1_000_000),
+        healthMaximumFailures: positive('healthMaximumFailures', 0, 1_000_000),
+        receiptTtlMs: positive('receiptTtlMs', 1_000, 300_000),
+    });
+}
+async function externalAdapter(value, label, trustedKeys) {
+    const item = record(value, label);
+    exactKeys(item, ['id', 'version', 'path', 'sha256', 'interpreter', 'environmentAllowlist', 'authority', 'keyId', 'timeoutMs'], label);
+    const id = text(item.id, `${label}.id`, 128);
+    const version = text(item.version, `${label}.version`, 64);
+    const pathInput = text(item.path, `${label}.path`, 2_000);
+    const sha256 = text(item.sha256, `${label}.sha256`, 64).toLowerCase();
+    const authority = text(item.authority, `${label}.authority`, 128);
+    const keyId = text(item.keyId, `${label}.keyId`, 128);
+    if (!ID.test(id) || !VERSION.test(version) || !isAbsolute(pathInput) || !/^[a-f0-9]{64}$/u.test(sha256)
+        || !ID.test(authority) || !ID.test(keyId) || !Number.isSafeInteger(item.timeoutMs) || Number(item.timeoutMs) < 1_000 || Number(item.timeoutMs) > 300_000) {
+        throw new TrustConfigError('invalid-config', `${label} identity, digest, authority or timeout is invalid`);
+    }
+    const path = await realpath(pathInput);
+    if (path !== resolve(pathInput))
+        throw new TrustConfigError('invalid-config', `${label} path must be canonical`);
+    await inspectTrustedExecutable(path, sha256);
+    const firstLine = (await readFile(path)).subarray(0, 512).toString('utf8').split('\n', 1)[0] ?? '';
+    let interpreter = null;
+    if (firstLine.startsWith('#!')) {
+        const raw = record(item.interpreter, `${label}.interpreter`);
+        exactKeys(raw, ['path', 'sha256'], `${label}.interpreter`);
+        const interpreterPathInput = text(raw.path, `${label}.interpreter.path`, 2_000);
+        const interpreterSha256 = text(raw.sha256, `${label}.interpreter.sha256`, 64).toLowerCase();
+        if (!isAbsolute(interpreterPathInput) || !/^[a-f0-9]{64}$/u.test(interpreterSha256))
+            throw new TrustConfigError('invalid-config', `${label} interpreter binding is invalid`);
+        const interpreterPath = await realpath(interpreterPathInput);
+        if (interpreterPath !== resolve(interpreterPathInput) || firstLine !== `#!${interpreterPath}`) {
+            throw new TrustConfigError('invalid-config', `${label} script must use its exact canonical pinned interpreter without arguments`);
+        }
+        await inspectTrustedExecutable(interpreterPath, interpreterSha256);
+        interpreter = Object.freeze({ path: interpreterPath, sha256: interpreterSha256 });
+    }
+    else if (item.interpreter !== null)
+        throw new TrustConfigError('invalid-config', `${label} native executable must set interpreter to null`);
+    if (!trustedKeys.some(key => key.authority === authority && key.keyId === keyId))
+        throw new TrustConfigError('invalid-config', `${label} authority/key is not pre-registered`);
+    return Object.freeze({ id, version, path, sha256, interpreter,
+        environmentAllowlist: environmentAllowlist(item.environmentAllowlist, `${label}.environmentAllowlist`),
+        authority, keyId, timeoutMs: Number(item.timeoutMs) });
+}
+async function independent(left, right, label, trustedKeys) {
+    if (left === undefined || right === undefined)
+        return;
+    const leftFile = await lstat(left.path, { bigint: true });
+    const rightFile = await lstat(right.path, { bigint: true });
+    const leftKey = trustedKeys.find(key => key.authority === left.authority && key.keyId === left.keyId);
+    const rightKey = trustedKeys.find(key => key.authority === right.authority && key.keyId === right.keyId);
+    const leftInterpreter = left.interpreter === null ? undefined : await lstat(left.interpreter.path, { bigint: true });
+    const rightInterpreter = right.interpreter === null ? undefined : await lstat(right.interpreter.path, { bigint: true });
+    const sameIdentity = (first, second) => first !== undefined && second !== undefined && first.dev === second.dev && first.ino === second.ino;
+    if (left.id === right.id || left.authority === right.authority || left.path === right.path
+        || sameIdentity(leftFile, rightFile)
+        || sameIdentity(leftFile, rightInterpreter) || sameIdentity(leftInterpreter, rightFile)
+        || keyFingerprint(leftKey) === keyFingerprint(rightKey)) {
+        throw new TrustConfigError('invalid-config', `${label} must use independent executable and signing authority/key`);
+    }
+}
+export async function loadTrustConfig(pathInput) {
+    const path = resolve(pathInput);
+    await assertOwnerPrivateFile(path);
+    const source = await readFile(path, 'utf8');
+    if (Buffer.byteLength(source) > 65_536)
+        throw new TrustConfigError('invalid-config', 'trust config exceeds 64 KiB');
+    let parsed;
+    try {
+        parsed = JSON.parse(source);
+    }
+    catch {
+        throw new TrustConfigError('invalid-config', 'trust config is not valid JSON');
+    }
+    const root = record(parsed, 'trust config');
+    if (root.schemaVersion === 1)
+        exactKeys(root, ['schemaVersion', 'installationId', 'dshHome', 'ledger', 'executor', 'approvalKeys', 'hostAttestationKeys'], 'trust config');
+    else if (root.schemaVersion === 2)
+        exactKeys(root, ['schemaVersion', 'installationId', 'dshHome', 'ledger', 'executor', 'hostPolicy', 'hostAttestor', 'approvalKeys', 'hostAttestationKeys'], 'trust config');
+    else if (root.schemaVersion === 3)
+        exactKeys(root, ['schemaVersion', 'installationId', 'dshHome', 'ledger', 'executor', 'hostPolicy', 'hostAttestor',
+            'catalog', 'releaseRegistry', 'releaseReceiptTtlMs', 'releaseAdapters', 'approvalKeys', 'hostAttestationKeys', 'releaseKeys'], 'trust config');
+    else if (root.schemaVersion === 4)
+        exactKeys(root, ['schemaVersion', 'installationId', 'dshHome', 'ledger', 'executor', 'hostPolicy', 'hostAttestor',
+            'catalog', 'releaseRegistry', 'releaseReceiptTtlMs', 'releaseAdapters', 'approvalKeys', 'hostAttestationKeys', 'releaseKeys',
+            'releaseAuthorizationKeys'], 'trust config');
+    else
+        throw new TrustConfigError('invalid-config', 'unsupported trust config schema');
+    const installationId = text(root.installationId, 'installationId', 36).toLowerCase();
+    if (!UUID.test(installationId))
+        throw new TrustConfigError('invalid-config', 'installationId must be a UUID');
+    const dshHomeInput = text(root.dshHome, 'dshHome', 2_000);
+    if (!isAbsolute(dshHomeInput) || await realpath(dshHomeInput) !== resolve(dshHomeInput))
+        throw new TrustConfigError('invalid-config', 'dshHome must be an existing canonical directory');
+    const ledgerInput = record(root.ledger, 'ledger');
+    exactKeys(ledgerInput, ['id', 'path'], 'ledger');
+    const ledgerId = text(ledgerInput.id, 'ledger.id', 36).toLowerCase();
+    const ledgerPathInput = text(ledgerInput.path, 'ledger.path', 2_000);
+    if (!UUID.test(ledgerId) || !isAbsolute(ledgerPathInput) || await realpath(dirname(ledgerPathInput)) !== resolve(dirname(ledgerPathInput))) {
+        throw new TrustConfigError('invalid-config', 'ledger id/path must identify one canonical control-plane directory');
+    }
+    const ledgerPath = resolve(ledgerPathInput);
+    const executorInput = record(root.executor, 'executor');
+    exactKeys(executorInput, ['id', 'version', 'path', 'sha256', 'environmentAllowlist'], 'executor');
+    const executorId = text(executorInput.id, 'executor.id', 128);
+    const executorVersion = text(executorInput.version, 'executor.version', 64);
+    const executorPathInput = text(executorInput.path, 'executor.path', 2_000);
+    const executorSha256 = text(executorInput.sha256, 'executor.sha256', 64).toLowerCase();
+    if (!ID.test(executorId) || !VERSION.test(executorVersion) || !isAbsolute(executorPathInput)
+        || !/^[a-f0-9]{64}$/u.test(executorSha256))
+        throw new TrustConfigError('invalid-config', 'executor identity/version/path/digest is invalid');
+    const executorPath = await realpath(executorPathInput);
+    if (executorPath !== resolve(executorPathInput))
+        throw new TrustConfigError('invalid-config', 'executor path must be canonical');
+    await inspectTrustedExecutable(executorPath, executorSha256);
+    const executorEnvironmentAllowlist = environmentAllowlist(executorInput.environmentAllowlist, 'executor.environmentAllowlist');
+    const approvalKeys = keys(root.approvalKeys, 'approvalKeys');
+    const hostAttestationKeys = keys(root.hostAttestationKeys, 'hostAttestationKeys');
+    const releaseKeys = root.schemaVersion === 3 || root.schemaVersion === 4 ? keys(root.releaseKeys, 'releaseKeys') : Object.freeze([]);
+    const releaseAuthorizationKeys = root.schemaVersion === 4 ? keys(root.releaseAuthorizationKeys, 'releaseAuthorizationKeys') : Object.freeze([]);
+    if (root.schemaVersion === 4) {
+        assertIndependentKeySets(releaseAuthorizationKeys, approvalKeys, 'release authorization and source approval keys');
+        assertIndependentKeySets(releaseAuthorizationKeys, releaseKeys, 'release authorization and adapter receipt keys');
+        assertIndependentKeySets(approvalKeys, releaseKeys, 'source approval and adapter receipt keys');
+    }
+    const hostPolicy = root.schemaVersion === 2 || root.schemaVersion === 3 || root.schemaVersion === 4 ? policy(root.hostPolicy) : defaultHostAttestationPolicy;
+    let hostAttestor;
+    if ((root.schemaVersion === 2 || root.schemaVersion === 3 || root.schemaVersion === 4) && root.hostAttestor !== null) {
+        const item = record(root.hostAttestor, 'hostAttestor');
+        exactKeys(item, ['id', 'version', 'path', 'sha256', 'interpreter', 'environmentAllowlist', 'authority', 'keyId', 'timeoutMs'], 'hostAttestor');
+        const id = text(item.id, 'hostAttestor.id', 128);
+        const version = text(item.version, 'hostAttestor.version', 64);
+        const pathInput = text(item.path, 'hostAttestor.path', 2_000);
+        const sha256 = text(item.sha256, 'hostAttestor.sha256', 64).toLowerCase();
+        const authority = text(item.authority, 'hostAttestor.authority', 128);
+        const keyId = text(item.keyId, 'hostAttestor.keyId', 128);
+        if (!ID.test(id) || !VERSION.test(version) || !isAbsolute(pathInput) || !/^[a-f0-9]{64}$/u.test(sha256)
+            || !ID.test(authority) || !ID.test(keyId) || !Number.isSafeInteger(item.timeoutMs) || Number(item.timeoutMs) < 1_000 || Number(item.timeoutMs) > 300_000) {
+            throw new TrustConfigError('invalid-config', 'hostAttestor identity, digest, authority or timeout is invalid');
+        }
+        const attestorPath = await realpath(pathInput);
+        if (attestorPath !== resolve(pathInput))
+            throw new TrustConfigError('invalid-config', 'hostAttestor path must be canonical');
+        await inspectTrustedExecutable(attestorPath, sha256);
+        const firstLine = (await readFile(attestorPath)).subarray(0, 512).toString('utf8').split('\n', 1)[0] ?? '';
+        let interpreter = null;
+        if (firstLine.startsWith('#!')) {
+            const interpreterInput = record(item.interpreter, 'hostAttestor.interpreter');
+            exactKeys(interpreterInput, ['path', 'sha256'], 'hostAttestor.interpreter');
+            const interpreterPathInput = text(interpreterInput.path, 'hostAttestor.interpreter.path', 2_000);
+            const interpreterSha256 = text(interpreterInput.sha256, 'hostAttestor.interpreter.sha256', 64).toLowerCase();
+            if (!isAbsolute(interpreterPathInput) || !/^[a-f0-9]{64}$/u.test(interpreterSha256)) {
+                throw new TrustConfigError('invalid-config', 'hostAttestor interpreter binding is invalid');
+            }
+            const interpreterPath = await realpath(interpreterPathInput);
+            if (interpreterPath !== resolve(interpreterPathInput) || firstLine !== `#!${interpreterPath}`) {
+                throw new TrustConfigError('invalid-config', 'script attestor must use its exact canonical pinned interpreter without arguments');
+            }
+            await inspectTrustedExecutable(interpreterPath, interpreterSha256);
+            interpreter = Object.freeze({ path: interpreterPath, sha256: interpreterSha256 });
+        }
+        else if (item.interpreter !== null)
+            throw new TrustConfigError('invalid-config', 'native hostAttestor must set interpreter to null');
+        if (!hostAttestationKeys.some(key => key.authority === authority && key.keyId === keyId)) {
+            throw new TrustConfigError('invalid-config', 'hostAttestor signing authority/key is not pre-registered');
+        }
+        hostAttestor = Object.freeze({ id, version, path: attestorPath, sha256, interpreter,
+            environmentAllowlist: environmentAllowlist(item.environmentAllowlist, 'hostAttestor.environmentAllowlist'),
+            authority, keyId, timeoutMs: Number(item.timeoutMs) });
+    }
+    let catalog = Object.freeze({ id: 'legacy-default-catalog', path: join(resolve(dshHomeInput), 'plugin-control', 'catalog.json') });
+    let releaseRegistry;
+    let releaseReceiptTtlMs = 30_000;
+    let releaseAdapters;
+    if (root.schemaVersion === 3 || root.schemaVersion === 4) {
+        const catalogInput = record(root.catalog, 'catalog');
+        exactKeys(catalogInput, ['id', 'path'], 'catalog');
+        const catalogId = text(catalogInput.id, 'catalog.id', 128);
+        const catalogPathInput = text(catalogInput.path, 'catalog.path', 2_000);
+        if (!ID.test(catalogId) || !isAbsolute(catalogPathInput) || await realpath(catalogPathInput) !== resolve(catalogPathInput)) {
+            throw new TrustConfigError('invalid-config', 'catalog id/path must identify one canonical owner catalog');
+        }
+        catalog = Object.freeze({ id: catalogId, path: resolve(catalogPathInput) });
+        const registryInput = record(root.releaseRegistry, 'releaseRegistry');
+        exactKeys(registryInput, ['id', 'locator'], 'releaseRegistry');
+        const registryId = text(registryInput.id, 'releaseRegistry.id', 128);
+        const registryLocator = text(registryInput.locator, 'releaseRegistry.locator', 2_000);
+        if (!ID.test(registryId))
+            throw new TrustConfigError('invalid-config', 'releaseRegistry id is invalid');
+        releaseRegistry = Object.freeze({ id: registryId, locator: registryLocator });
+        if (!Number.isSafeInteger(root.releaseReceiptTtlMs) || Number(root.releaseReceiptTtlMs) < 1_000 || Number(root.releaseReceiptTtlMs) > 300_000) {
+            throw new TrustConfigError('invalid-config', 'releaseReceiptTtlMs is outside its accepted range');
+        }
+        releaseReceiptTtlMs = Number(root.releaseReceiptTtlMs);
+        const adapterInput = record(root.releaseAdapters, 'releaseAdapters');
+        const phases = ['pr', 'review', 'merge', 'build', 'sign', 'publish', 'registry-verify', 'catalog-admission'];
+        exactKeys(adapterInput, phases, 'releaseAdapters');
+        const parsedAdapters = {};
+        for (const phase of phases)
+            if (adapterInput[phase] !== null)
+                parsedAdapters[phase] = await externalAdapter(adapterInput[phase], `releaseAdapters.${phase}`, releaseKeys);
+        for (let left = 0; left < phases.length; left += 1) {
+            for (let right = left + 1; right < phases.length; right += 1) {
+                await independent(parsedAdapters[phases[left]], parsedAdapters[phases[right]], `${phases[left]} and ${phases[right]} release adapters`, releaseKeys);
+            }
+        }
+        releaseAdapters = Object.freeze(parsedAdapters);
+    }
+    return Object.freeze({
+        schemaVersion: root.schemaVersion,
+        installationId,
+        dshHome: resolve(dshHomeInput),
+        ledger: Object.freeze({ id: ledgerId, path: ledgerPath }),
+        executor: Object.freeze({ id: executorId, version: executorVersion, path: executorPath,
+            sha256: executorSha256, environmentAllowlist: executorEnvironmentAllowlist }),
+        hostPolicy,
+        ...(hostAttestor === undefined ? {} : { hostAttestor }),
+        catalog,
+        ...(releaseRegistry === undefined ? {} : { releaseRegistry }),
+        releaseReceiptTtlMs,
+        ...(releaseAdapters === undefined ? {} : { releaseAdapters }),
+        approvalKeys,
+        hostAttestationKeys,
+        releaseKeys,
+        releaseAuthorizationKeys,
+    });
+}
+export function resolveTrustKey(config, purpose, authority, keyId) {
+    const source = purpose === 'approval' ? config.approvalKeys : purpose === 'host-attestation'
+        ? config.hostAttestationKeys : purpose === 'release' ? config.releaseKeys : config.releaseAuthorizationKeys;
+    const result = source.find(item => item.authority === authority && item.keyId === keyId);
+    if (result === undefined)
+        throw new TrustConfigError('invalid-config', `${purpose} authority/key is not pre-registered`);
+    return result;
+}
+export function inheritedEnvironment(config) {
+    const environment = {};
+    for (const key of config.executor.environmentAllowlist) {
+        const value = process.env[key];
+        if (value !== undefined)
+            environment[key] = value;
+    }
+    environment.DSH_HOME = config.dshHome;
+    return environment;
+}
+export function inheritedHostAttestorEnvironment(config) {
+    const environment = {};
+    for (const key of config.hostAttestor?.environmentAllowlist ?? []) {
+        const value = process.env[key];
+        if (value !== undefined)
+            environment[key] = value;
+    }
+    return environment;
+}
+export function inheritedReleaseAdapterEnvironment(config, phase) {
+    const environment = {};
+    for (const key of config.releaseAdapters?.[phase]?.environmentAllowlist ?? []) {
+        const value = process.env[key];
+        if (value !== undefined)
+            environment[key] = value;
+    }
+    return environment;
+}
+//# sourceMappingURL=trust.js.map

package/lib/trust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust.js","sourceRoot":"","sources":["../src/trust.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAmB,MAAM,kBAAkB,CAAA;AACnF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAC9D,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAGzD,MAAM,IAAI,GAAG,4EAA4E,CAAA;AACzF,MAAM,EAAE,GAAG,sCAAsC,CAAA;AACjD,MAAM,OAAO,GAAG,qCAAqC,CAAA;AACrD,MAAM,WAAW,GAAG,yBAAyB,CAAA;AAC7C,MAAM,qBAAqB,GAAG,iDAAiD,CAAA;AAC/E,MAAM,6BAA6B,GAAG,wIAAwI,CAAA;AAgD9K,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACpB;IAArB,YAAqB,IAAsC,EAAE,OAAe;QAC1E,KAAK,CAAC,OAAO,CAAC,CAAA;QADK,SAAI,GAAJ,IAAI,CAAkC;QAEzD,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAA;IAChC,CAAC;CACF;AAED,MAAM,CAAC,MAAM,4BAA4B,GAA0B,MAAM,CAAC,MAAM,CAAC;IAC/E,sBAAsB,EAAE,CAAC;IACzB,oCAAoC,EAAE,CAAC;IACvC,yCAAyC,EAAE,CAAC;IAC5C,oBAAoB,EAAE,CAAC;IACvB,uBAAuB,EAAE,CAAC;IAC1B,oBAAoB,EAAE,CAAC;IACvB,qBAAqB,EAAE,CAAC;IACxB,mBAAmB,EAAE,MAAM;IAC3B,kBAAkB,EAAE,EAAE;IACtB,sBAAsB,EAAE,CAAC;IACzB,mBAAmB,EAAE,CAAC;IACtB,qBAAqB,EAAE,CAAC;IACxB,YAAY,EAAE,MAAM;CACrB,CAAC,CAAA;AAEF,SAAS,MAAM,CAAC,KAAc,EAAE,KAAa;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,GAAG,KAAK,oBAAoB,CAAC,CAAA;IACnJ,OAAO,KAAgC,CAAA;AACzC,CAAC;AAED,SAAS,SAAS,CAAC,KAA8B,EAAE,QAA2B,EAAE,KAAa;IAC3F,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,GAAG,KAAK,gCAAgC,CAAC,CAAA;AACpK,CAAC;AAED,SAAS,IAAI,CAAC,KAAc,EAAE,KAAa,EAAE,OAAO,GAAG,GAAG;IACxD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,GAAG,KAAK,eAAe,CAAC,CAAA;IACpG,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAA;IAChD,IAAI,UAAU,KAAK,EAAE,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,OAAO,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE;QACnG,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC,CAAE,CAAA;QACvC,OAAO,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,IAAI,CAAA;IACxC,CAAC,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,GAAG,KAAK,iCAAiC,CAAC,CAAA;IAC3F,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,SAAS,IAAI,CAAC,KAAc,EAAE,KAAa;IACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,GAAG,KAAK,0BAA0B,CAAC,CAAA;IACtJ,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,KAAK,GAAG,CAAC,CAAA;QAC9C,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,cAAc,CAAC,EAAE,GAAG,KAAK,IAAI,KAAK,GAAG,CAAC,CAAA;QAC7E,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,KAAK,YAAY,EAAE,GAAG,CAAC,CAAA;QACjE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,KAAK,QAAQ,EAAE,GAAG,CAAC,CAAA;QACrD,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ;YAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,GAAG,KAAK,4BAA4B,CAAC,CAAA;QAC7H,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAA;QAC7C,IAAI,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,GAAG,KAAK,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,GAAG,KAAK,0BAA0B,CAAC,CAAA;QAC5J,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,SAAS,KAAK,KAAK,EAAE,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,GAAG,KAAK,oDAAoD,CAAC,CAAA;QAC5L,IAAI,CAAC,GAAG,CAAC,GAAG,SAAS,KAAK,KAAK,EAAE,CAAC,CAAA;QAClC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,eAAe,CAAC,YAAY,CAAC,CAAA;YACzC,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAA;QACzE,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,GAAG,KAAK,mCAAmC,CAAC,CAAA;QAAC,CAAC;QACrG,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAA;IAC1D,CAAC,CAAC,CAAC,CAAA;AACL,CAAC;AAED,SAAS,cAAc,CAAC,GAAa;IACnC,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IACrF,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACvD,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAyB,EAAE,KAA0B,EAAE,KAAa;IACpG,KAAK,MAAM,KAAK,IAAI,IAAI;QAAE,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;YACrD,IAAI,CAAC,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC,KAAK,CAAC,KAAK,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/H,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,GAAG,KAAK,yDAAyD,CAAC,CAAA;YACjH,CAAC;QACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,IAAY;IAChD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAA;IAC9B,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,QAAQ,CAAC,cAAc,EAAE,IAAI,QAAQ,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;WACvG,CAAC,GAAG,KAAK,SAAS,IAAI,QAAQ,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3F,MAAM,IAAI,gBAAgB,CAAC,aAAa,EAAE,kFAAkF,CAAC,CAAA;IAC/H,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IACzC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;WAC9E,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC3G,MAAM,IAAI,gBAAgB,CAAC,aAAa,EAAE,wDAAwD,CAAC,CAAA;IACrG,CAAC;AACH,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,MAAkB,EAAE,IAAY;IACpD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAAC,IAAI,MAAM,GAAG,CAAC,CAAA;IACxD,OAAO,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC,CAAA;QAC9E,IAAI,MAAM,CAAC,SAAS,KAAK,CAAC;YAAE,MAAK;QACjC,MAAM,IAAI,MAAM,CAAC,SAAS,CAAA;IAC5B,CAAC;IACD,IAAI,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,EAAE,2DAA2D,CAAC,CAAA;IACnI,OAAO,KAAK,CAAA;AACd,CAAC;AAED,KAAK,UAAU,6BAA6B,CAAC,IAAY,EAAE,MAAkB,EAAE,cAAsB;IACnG,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAA;IAC1I,MAAM,WAAW,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAC/D,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,KAAK,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,GAAG,UAAY,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,GAAM,CAAC,KAAK,EAAE;WACrG,CAAC,MAAM,CAAC,IAAI,GAAG,GAAM,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,EAAE,IAAI,MAAM,CAAC,GAAG,KAAK,WAAW,CAAC;WAC/G,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,UAAU,CAAC,cAAc,EAAE,IAAI,UAAU,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC;QAC3H,MAAM,IAAI,gBAAgB,CAAC,aAAa,EAAE,kGAAkG,CAAC,CAAA;IAC/I,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAAC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAChH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACxG,IAAI,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;WACrH,KAAK,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,IAAI,SAAS,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,SAAS,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;QACnI,MAAM,IAAI,gBAAgB,CAAC,aAAa,EAAE,mEAAmE,CAAC,CAAA;IAChH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAA;AACzE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAY,EAAE,cAAsB;IAC9E,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,EAAE,2CAA2C,CAAC,CAAA;IACvJ,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAAC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAA;IAC5E,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;WACvF,CAAC,GAAG,KAAK,SAAS,IAAI,SAAS,CAAC,GAAG,KAAK,CAAC,IAAI,SAAS,CAAC,GAAG,KAAK,GAAG,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,gBAAgB,CAAC,aAAa,EAAE,wEAAwE,CAAC,CAAA;IACrH,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,UAAU,CAAC,CAAA;IAC9E,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,CAAA;QAClF,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QAAC,MAAM,KAAK,CAAA;IAAC,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAA4B;IAC5E,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IACpG,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,QAAQ,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACvF,MAAM,IAAI,gBAAgB,CAAC,aAAa,EAAE,iEAAiE,CAAC,CAAA;IAC9G,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,IAAY,EAAE,cAAsB;IACjF,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAA;IACpE,IAAI,CAAC;QAAC,OAAO,UAAU,CAAC,QAAQ,CAAA;IAAC,CAAC;YAAS,CAAC;QAAC,MAAM,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;IAAC,CAAC;AAChF,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc,EAAE,KAAa;IACzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,GAAG,KAAK,mBAAmB,CAAC,CAAA;IACzH,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IACnE,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACjI,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,GAAG,KAAK,iDAAiD,CAAC,CAAA;IACzG,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;AAC9B,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,CAAA;IACxC,MAAM,MAAM,GAAG,CAAC,wBAAwB,EAAE,sCAAsC,EAAE,2CAA2C;QAC3H,sBAAsB,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,qBAAqB;QACzH,oBAAoB,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,cAAc,CAAU,CAAA;IAC1H,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,CAAA;IACrC,MAAM,QAAQ,GAAG,CAAC,IAA2B,EAAE,OAAe,EAAE,OAAe,EAAU,EAAE;QACzF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAA;QACtB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,OAAO,IAAI,GAAG,GAAG,OAAO,EAAE,CAAC;YAC5F,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,cAAc,IAAI,gCAAgC,CAAC,CAAA;QAClG,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC,CAAA;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,sBAAsB,CAAA;IACxC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,gEAAgE,CAAC,CAAA;IAChH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,sBAAsB,EAAE,QAAQ,CAAC,wBAAwB,EAAE,CAAC,EAAE,SAAS,CAAC;QACxE,oCAAoC,EAAE,QAAQ,CAAC,sCAAsC,EAAE,CAAC,EAAE,SAAS,CAAC;QACpG,yCAAyC,EAAE,QAAQ,CAAC,2CAA2C,EAAE,CAAC,EAAE,SAAS,CAAC;QAC9G,oBAAoB,EAAE,QAAQ,CAAC,sBAAsB,EAAE,CAAC,EAAE,SAAS,CAAC;QACpE,uBAAuB,EAAE,QAAQ,CAAC,yBAAyB,EAAE,CAAC,EAAE,SAAS,CAAC;QAC1E,oBAAoB,EAAE,QAAQ,CAAC,sBAAsB,EAAE,CAAC,EAAE,SAAS,CAAC;QACpE,qBAAqB,EAAE,QAAQ,CAAC,uBAAuB,EAAE,CAAC,EAAE,SAAS,CAAC;QACtE,mBAAmB,EAAE,QAAQ,CAAC,qBAAqB,EAAE,CAAC,EAAE,UAAU,CAAC;QACnE,kBAAkB,EAAE,QAAQ,CAAC,oBAAoB,EAAE,CAAC,EAAE,UAAU,CAAC;QACjE,sBAAsB,EAAE,IAAI;QAC5B,mBAAmB,EAAE,QAAQ,CAAC,qBAAqB,EAAE,CAAC,EAAE,SAAS,CAAC;QAClE,qBAAqB,EAAE,QAAQ,CAAC,uBAAuB,EAAE,CAAC,EAAE,SAAS,CAAC;QACtE,YAAY,EAAE,QAAQ,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,CAAC;KACvD,CAAC,CAAA;AACJ,CAAC;AAID,KAAK,UAAU,eAAe,CAAC,KAAc,EAAE,KAAa,EAAE,WAAgC;IAC5F,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IACjC,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,sBAAsB,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,KAAK,CAAC,CAAA;IACrI,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,KAAK,KAAK,EAAE,GAAG,CAAC,CAAC;IAAC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,KAAK,UAAU,EAAE,EAAE,CAAC,CAAA;IACxG,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,OAAO,EAAE,KAAK,CAAC,CAAC;IAAC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,SAAS,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;IAChI,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,KAAK,YAAY,EAAE,GAAG,CAAC,CAAC;IAAC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,KAAK,QAAQ,EAAE,GAAG,CAAC,CAAA;IACxH,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC;WAClG,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,OAAO,EAAE,CAAC;QAC3J,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,GAAG,KAAK,oDAAoD,CAAC,CAAA;IAC5G,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAA;IACtC,IAAI,IAAI,KAAK,OAAO,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,GAAG,KAAK,yBAAyB,CAAC,CAAA;IAChH,MAAM,wBAAwB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC5C,MAAM,SAAS,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAClG,IAAI,WAAW,GAAgD,IAAI,CAAA;IACnE,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,KAAK,cAAc,CAAC,CAAC;QAAC,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,GAAG,KAAK,cAAc,CAAC,CAAA;QACxH,MAAM,oBAAoB,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,KAAK,mBAAmB,EAAE,KAAK,CAAC,CAAA;QAC/E,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,KAAK,qBAAqB,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;QAC3F,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,iBAAiB,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,GAAG,KAAK,iCAAiC,CAAC,CAAA;QAC5K,MAAM,eAAe,GAAG,MAAM,QAAQ,CAAC,oBAAoB,CAAC,CAAA;QAC5D,IAAI,eAAe,KAAK,OAAO,CAAC,oBAAoB,CAAC,IAAI,SAAS,KAAK,KAAK,eAAe,EAAE,EAAE,CAAC;YAC9F,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,GAAG,KAAK,2EAA2E,CAAC,CAAA;QACnI,CAAC;QACD,MAAM,wBAAwB,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAA;QAClE,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAA;IACnF,CAAC;SAAM,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI;QAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,GAAG,KAAK,iDAAiD,CAAC,CAAA;IAC7I,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,GAAG,KAAK,sCAAsC,CAAC,CAAA;IAC9K,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW;QAC3D,oBAAoB,EAAE,oBAAoB,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,KAAK,uBAAuB,CAAC;QACtG,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;AAC1D,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAuC,EAAE,KAAwC,EAAE,KAAa,EACzH,WAAgC;IAChC,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;QAAE,OAAM;IACrD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACtH,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAE,CAAA;IACtG,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAE,CAAA;IACzG,MAAM,eAAe,GAAG,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACpH,MAAM,gBAAgB,GAAG,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACvH,MAAM,YAAY,GAAG,CAAC,KAA+C,EAAE,MAAgD,EAAW,EAAE,CAClI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAA;IACrG,IAAI,IAAI,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,IAAI,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;WACrF,YAAY,CAAC,QAAQ,EAAE,SAAS,CAAC;WACjC,YAAY,CAAC,QAAQ,EAAE,gBAAgB,CAAC,IAAI,YAAY,CAAC,eAAe,EAAE,SAAS,CAAC;WACpF,cAAc,CAAC,OAAO,CAAC,KAAK,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,GAAG,KAAK,4DAA4D,CAAC,CAAA;IACpH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,SAAiB;IACrD,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IAC/B,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAA;IAClC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC3C,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,MAAM;QAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,6BAA6B,CAAC,CAAA;IACnH,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAY,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,gCAAgC,CAAC,CAAA;IAAC,CAAC;IACvI,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;IAC3C,IAAI,IAAI,CAAC,aAAa,KAAK,CAAC;QAAE,SAAS,CAAC,IAAI,EAAE,CAAC,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,qBAAqB,CAAC,EAAE,cAAc,CAAC,CAAA;SACrK,IAAI,IAAI,CAAC,aAAa,KAAK,CAAC;QAAE,SAAS,CAAC,IAAI,EAAE,CAAC,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,qBAAqB,CAAC,EAAE,cAAc,CAAC,CAAA;SACxM,IAAI,IAAI,CAAC,aAAa,KAAK,CAAC;QAAE,SAAS,CAAC,IAAI,EAAE,CAAC,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc;YAClJ,SAAS,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,cAAc,EAAE,qBAAqB,EAAE,aAAa,CAAC,EAAE,cAAc,CAAC,CAAA;SAC3I,IAAI,IAAI,CAAC,aAAa,KAAK,CAAC;QAAE,SAAS,CAAC,IAAI,EAAE,CAAC,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc;YAClJ,SAAS,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,cAAc,EAAE,qBAAqB,EAAE,aAAa;YAC5H,0BAA0B,CAAC,EAAE,cAAc,CAAC,CAAA;;QACzC,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,iCAAiC,CAAC,CAAA;IACpF,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;IACpF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAA;IAC7G,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;IACzD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,MAAM,QAAQ,CAAC,YAAY,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,iDAAiD,CAAC,CAAA;IACxL,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAAC,SAAS,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAA;IACnG,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAAC,MAAM,eAAe,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC,CAAA;IAC1I,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,MAAM,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;QAC3I,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,oEAAoE,CAAC,CAAA;IACpH,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,eAAe,CAAC,CAAA;IAC3C,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;IACvD,SAAS,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,sBAAsB,CAAC,EAAE,UAAU,CAAC,CAAA;IACjG,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,aAAa,EAAE,GAAG,CAAC,CAAA;IAC7D,MAAM,eAAe,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAA;IAC3E,MAAM,iBAAiB,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,eAAe,EAAE,KAAK,CAAC,CAAA;IAC1E,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;IACtF,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC;WACvF,CAAC,iBAAiB,CAAC,IAAI,CAAC,cAAc,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,kDAAkD,CAAC,CAAA;IAC9I,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,CAAA;IACtD,IAAI,YAAY,KAAK,OAAO,CAAC,iBAAiB,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,iCAAiC,CAAC,CAAA;IAChI,MAAM,wBAAwB,CAAC,YAAY,EAAE,cAAc,CAAC,CAAA;IAC5D,MAAM,4BAA4B,GAAG,oBAAoB,CAAC,aAAa,CAAC,oBAAoB,EAAE,+BAA+B,CAAC,CAAA;IAC9H,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,CAAA;IAC/I,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,KAAK,CAAC,IAAI,IAAI,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACpI,MAAM,wBAAwB,GAAG,IAAI,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,0BAA0B,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IAC/I,IAAI,IAAI,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;QAC7B,wBAAwB,CAAC,wBAAwB,EAAE,YAAY,EAAE,gDAAgD,CAAC,CAAA;QAClH,wBAAwB,CAAC,wBAAwB,EAAE,WAAW,EAAE,gDAAgD,CAAC,CAAA;QACjH,wBAAwB,CAAC,YAAY,EAAE,WAAW,EAAE,0CAA0C,CAAC,CAAA;IACjG,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,KAAK,CAAC,IAAI,IAAI,CAAC,aAAa,KAAK,CAAC,IAAI,IAAI,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,4BAA4B,CAAA;IAC5J,IAAI,YAAsD,CAAA;IAC1D,IAAI,CAAC,IAAI,CAAC,aAAa,KAAK,CAAC,IAAI,IAAI,CAAC,aAAa,KAAK,CAAC,IAAI,IAAI,CAAC,aAAa,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QACrH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,CAAA;QACtD,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,sBAAsB,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,cAAc,CAAC,CAAA;QAC9I,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,iBAAiB,EAAE,GAAG,CAAC,CAAC;QAAC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAA;QAChH,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,EAAE,KAAK,CAAC,CAAC;QAAC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,qBAAqB,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;QACxI,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,wBAAwB,EAAE,GAAG,CAAC,CAAC;QAAC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAA;QAChI,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC;eAClG,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,OAAO,EAAE,CAAC;YAC3J,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,gEAAgE,CAAC,CAAA;QAChH,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAA;QAC9C,IAAI,YAAY,KAAK,OAAO,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,qCAAqC,CAAC,CAAA;QAC5H,MAAM,wBAAwB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAA;QACpD,MAAM,SAAS,GAAG,CAAC,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAC1G,IAAI,WAAW,GAAyE,IAAI,CAAA;QAC5F,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,0BAA0B,CAAC,CAAA;YAC7E,SAAS,CAAC,gBAAgB,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,0BAA0B,CAAC,CAAA;YAC3E,MAAM,oBAAoB,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,+BAA+B,EAAE,KAAK,CAAC,CAAA;YAChG,MAAM,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,iCAAiC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;YAC5G,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACpF,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,6CAA6C,CAAC,CAAA;YAC7F,CAAC;YACD,MAAM,eAAe,GAAG,MAAM,QAAQ,CAAC,oBAAoB,CAAC,CAAA;YAC5D,IAAI,eAAe,KAAK,OAAO,CAAC,oBAAoB,CAAC,IAAI,SAAS,KAAK,KAAK,eAAe,EAAE,EAAE,CAAC;gBAC9F,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,mFAAmF,CAAC,CAAA;YACnI,CAAC;YACD,MAAM,wBAAwB,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAA;YAClE,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAA;QACnF,CAAC;aAAM,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI;YAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,kDAAkD,CAAC,CAAA;QACtI,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC,EAAE,CAAC;YACzF,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,0DAA0D,CAAC,CAAA;QAC1G,CAAC;QACD,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW;YACjF,oBAAoB,EAAE,oBAAoB,CAAC,IAAI,CAAC,oBAAoB,EAAE,mCAAmC,CAAC;YAC1G,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;IAC1D,CAAC;IACD,IAAI,OAAO,GAAwC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,wBAAwB,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,gBAAgB,EAAE,cAAc,CAAC,EAAE,CAAC,CAAA;IACvK,IAAI,eAA4D,CAAA;IAChE,IAAI,mBAAmB,GAAG,MAAM,CAAA;IAChC,IAAI,eAA4D,CAAA;IAChE,IAAI,IAAI,CAAC,aAAa,KAAK,CAAC,IAAI,IAAI,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAAC,SAAS,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC,CAAA;QACxG,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC;QAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC,CAAA;QACnI,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,IAAI,MAAM,QAAQ,CAAC,gBAAgB,CAAC,KAAK,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC3H,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,2DAA2D,CAAC,CAAA;QAC3G,CAAC;QACD,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAA;QAC3E,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QAAC,SAAS,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,iBAAiB,CAAC,CAAA;QACrI,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;QAAC,MAAM,eAAe,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,yBAAyB,EAAE,KAAK,CAAC,CAAA;QAC3J,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAA;QACvG,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAA;QAC7E,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,OAAO,EAAE,CAAC;YAC9I,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,mDAAmD,CAAC,CAAA;QACnG,CAAC;QACD,mBAAmB,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;QACtD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAA;QACpE,MAAM,MAAM,GAAkC,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,mBAAmB,CAAC,CAAA;QAC3I,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,iBAAiB,CAAC,CAAA;QAClD,MAAM,cAAc,GAA4E,EAAE,CAAA;QAClG,KAAK,MAAM,KAAK,IAAI,MAAM;YAAE,IAAI,YAAY,CAAC,KAAK,CAAC,KAAK,IAAI;gBAAE,cAAc,CAAC,KAAK,CAAC,GAAG,MAAM,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,mBAAmB,KAAK,EAAE,EAAE,WAAW,CAAC,CAAA;QACzK,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;YACnD,KAAK,IAAI,KAAK,GAAG,IAAI,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;gBAC7D,MAAM,WAAW,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAE,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,KAAK,CAAE,CAAC,EAC7E,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAA;YACzE,CAAC;QACH,CAAC;QACD,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;IACjD,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,cAAc;QACd,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC;QAC9B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QACzD,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY;YACpF,MAAM,EAAE,cAAc,EAAE,oBAAoB,EAAE,4BAA4B,EAAE,CAAC;QAC/E,UAAU;QACV,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;QACvD,OAAO;QACP,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC;QAC7D,mBAAmB;QACnB,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC;QAC7D,YAAY;QACZ,mBAAmB;QACnB,WAAW;QACX,wBAAwB;KACzB,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAgC,EAAE,OAA8E,EAAE,SAAiB,EAAE,KAAa;IAChL,MAAM,MAAM,GAAG,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,KAAK,kBAAkB;QAC1F,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,wBAAwB,CAAA;IAC7G,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAA;IACxF,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,GAAG,OAAO,sCAAsC,CAAC,CAAA;IACxH,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAgC;IACnE,MAAM,WAAW,GAAsB,EAAE,CAAA;IACzC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,oBAAoB,EAAE,CAAC;QACvD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,KAAK,KAAK,SAAS;YAAE,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IACnD,CAAC;IACD,WAAW,CAAC,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAA;IACrC,OAAO,WAAW,CAAA;AACpB,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,MAAgC;IAC/E,MAAM,WAAW,GAAsB,EAAE,CAAA;IACzC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,YAAY,EAAE,oBAAoB,IAAI,EAAE,EAAE,CAAC;QAClE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,KAAK,KAAK,SAAS;YAAE,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IACnD,CAAC;IACD,OAAO,WAAW,CAAA;AACpB,CAAC;AAED,MAAM,UAAU,kCAAkC,CAAC,MAAgC,EAAE,KAAyB;IAC5G,MAAM,WAAW,GAAsB,EAAE,CAAA;IACzC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC,KAAK,CAAC,EAAE,oBAAoB,IAAI,EAAE,EAAE,CAAC;QAC9E,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,KAAK,KAAK,SAAS;YAAE,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IACnD,CAAC;IACD,OAAO,WAAW,CAAA;AACpB,CAAC"}