@emilia-protocol/gate 0.10.0 → 0.13.0

package/dist/breakglass.js

@@ -0,0 +1,627 @@
+// @ts-nocheck
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * EMILIA Gate — break-glass as EVIDENCE, never a bypass (EP-GATE-BREAKGLASS-v1).
+ *
+ * An emergency override is a FIRST-CLASS SIGNED ARTIFACT, not a config flag.
+ * There is no "disable the gate" switch anywhere in this module: to act outside
+ * the normal receipt path, operators mint a break-glass authorization — an
+ * M-of-N Ed25519 multi-signature over canonical JSON (sorted keys, same idiom
+ * as receipts/entitlements/evidence) of ONE shared grant:
+ *
+ *   { grant_id, scope: { action_types[] }, window: { not_before, expires_at },
+ *     reason, incident_ref, threshold }
+ *
+ * Every signer signs the SAME payload, so the artifact proves that `threshold`
+ * DISTINCT pinned principals authorized exactly this scope, for exactly this
+ * window, for exactly this incident. The grant is:
+ *   - SCOPED     — valid only for the listed action_types; anything else refuses;
+ *   - BOUNDED    — valid only inside [not_before, expires_at];
+ *   - ATTRIBUTED — reason + incident_ref are REQUIRED; an override with no
+ *                  stated cause is refused, not logged-and-allowed;
+ *   - SINGLE-USE — consumed through the same consumption-store contract as
+ *                  receipts (store.js); consumption is committed BEFORE use, so
+ *                  a crash mid-override burns the grant instead of leaving it
+ *                  replayable (fail direction: unusable, never reusable);
+ *   - LOGGED     — `buildBreakGlassEvidence` shapes a kind:'breakglass' entry
+ *                  for the tamper-evident evidence log.
+ *
+ * THE MODULE'S EXECUTION CONTRACT: use `runBreakGlass`. It is the one high-level
+ * path that enforces pinned-policy verification, permanent fleet-safe
+ * consumption, strict evidence acknowledgement, and only then effect invocation.
+ * The lower-level verify/consume/evidence helpers are composable primitives; no
+ * one of them alone authorizes or executes an override.
+ *
+ * Verification FAILS CLOSED with machine-readable reasons: threshold unmet,
+ * non-distinct signer kids, expired, not-yet-valid, out-of-scope action_type,
+ * tampered payload, unknown kid, malformed anything → { valid:false, reason }.
+ * A grant carrying ANY signature that does not verify is refused outright —
+ * we never "count the good ones" past a bad one.
+ *
+ * Pure functions: inputs in, verdict out. Time is injected (`now`), never read
+ * from the wall clock implicitly, so verification is deterministic.
+ */
+import crypto from 'node:crypto';
+import { strictJsonGate } from './strict-json.js';
+import { canonicalize as canonical } from './execution-binding.js';
+import { verifyEvidenceRecord } from './evidence.js';
+import { isSecureConsumptionStore } from './store.js';
+export const BREAKGLASS_VERSION = 'EP-GATE-BREAKGLASS-v1';
+export const BREAKGLASS_EVIDENCE_KIND = 'breakglass';
+function sha256hex(s) {
+    return crypto.createHash('sha256').update(s).digest('hex');
+}
+function toMs(t) {
+    if (t == null)
+        return null;
+    const ms = typeof t === 'number' ? t : Date.parse(t);
+    return Number.isFinite(ms) ? ms : null;
+}
+/** Every refusal shape is identical and machine-readable. Fail closed. */
+function refuse(reason, extra = {}) {
+    return { valid: false, reason, ...extra };
+}
+function isNonEmptyString(s) {
+    return typeof s === 'string' && s.length > 0;
+}
+function isActionTypeList(a) {
+    return Array.isArray(a) && a.length > 0 && a.every(isNonEmptyString);
+}
+/**
+ * Mint a break-glass authorization: every signer signs the canonical JSON of
+ * the SAME grant payload. Throws on invalid fields — a malformed grant must
+ * never be issued, only refused. Signer kids must already be distinct at mint
+ * time: one key can never pre-fill two threshold slots. Relying-party principal
+ * uniqueness is enforced at verification through the pinned policy roster.
+ *
+ * grant_id is CONTENT-DERIVED (sha-256 of the canonical grant fields), so the
+ * id is deterministic and re-minting the identical grant yields the identical
+ * single-use consumption key — the same emergency authorization cannot be
+ * "refreshed" into extra uses by minting it twice.
+ *
+ * @param {Array<{ privateKey: crypto.KeyObject, kid: string }>} signers
+ * @param {object} fields { scope: { action_types: string[] }, window: { not_before, expires_at }, reason, incident_ref, threshold }
+ * @returns {{ '@version': string, payload: object, signatures: Array<{ kid: string, algorithm: 'Ed25519', value: string }> }}
+ */
+export function mintBreakGlassAuthorization(signers, { scope, window: win, reason, incident_ref, threshold, } = {}) {
+    if (!Array.isArray(signers) || signers.length === 0) {
+        throw new Error('breakglass: signers must be a non-empty array of { privateKey, kid }');
+    }
+    for (const s of signers) {
+        if (!s || !s.privateKey || !isNonEmptyString(s.kid)) {
+            throw new Error('breakglass: each signer needs a privateKey and a kid');
+        }
+    }
+    const kids = signers.map((s) => s.kid);
+    if (new Set(kids).size !== kids.length) {
+        throw new Error('breakglass: signer kids must be distinct — one principal cannot fill two threshold slots');
+    }
+    let signerFingerprints;
+    try {
+        signerFingerprints = signers.map((s) => {
+            // @types/node's createPublicKey overloads omit KeyObject input even
+            // though Node derives a public key from a private KeyObject at runtime.
+            const publicKey = crypto.createPublicKey(/** @type {any} */ (s.privateKey));
+            if (publicKey.asymmetricKeyType !== 'ed25519')
+                throw new Error('not Ed25519');
+            const spki = publicKey.export({ type: 'spki', format: 'der' });
+            return sha256hex(spki);
+        });
+    }
+    catch {
+        throw new Error('breakglass: every signer privateKey must be an Ed25519 key');
+    }
+    if (new Set(signerFingerprints).size !== signerFingerprints.length) {
+        throw new Error('breakglass: signer SPKI keys must be distinct — one key cannot fill two threshold slots');
+    }
+    if (!scope || !isActionTypeList(scope.action_types)) {
+        throw new Error('breakglass: scope.action_types must be a non-empty array of action-type strings');
+    }
+    if (typeof threshold !== 'number' || !Number.isInteger(threshold) || threshold < 2) {
+        throw new Error('breakglass: threshold must be an integer >= 2');
+    }
+    if (threshold > signers.length) {
+        throw new Error(`breakglass: threshold ${threshold} exceeds signer count ${signers.length} — the grant could never verify`);
+    }
+    const nbf = toMs(win?.not_before);
+    const exp = toMs(win?.expires_at);
+    if (nbf == null || exp == null) {
+        throw new Error('breakglass: window.not_before and window.expires_at are required (ISO or ms)');
+    }
+    if (exp <= nbf)
+        throw new Error('breakglass: window.expires_at must be after window.not_before');
+    // An override with no stated cause must never exist — attribution is the deal.
+    if (!isNonEmptyString(reason))
+        throw new Error('breakglass: reason is required');
+    if (!isNonEmptyString(incident_ref))
+        throw new Error('breakglass: incident_ref is required');
+    const core = {
+        scope: { action_types: scope.action_types.slice() },
+        // win is guaranteed defined here: nbf/exp are non-null only when
+        // win?.not_before / win?.expires_at parsed successfully above.
+        window: { not_before: win.not_before, expires_at: win.expires_at },
+        reason,
+        incident_ref,
+        threshold,
+    };
+    const grant_id = `bg_${sha256hex(canonical(core))}`;
+    const payload = { grant_id, ...core };
+    const msg = Buffer.from(canonical(payload), 'utf8');
+    const signatures = signers.map(({ privateKey, kid }) => ({
+        kid,
+        algorithm: /** @type {'Ed25519'} */ ('Ed25519'),
+        value: crypto.sign(null, msg, privateKey).toString('base64url'),
+    }));
+    return { '@version': BREAKGLASS_VERSION, payload, signatures };
+}
+/** Resolve a base64url SPKI-DER key for `kid` from a map or an entry list. */
+function issuerKeyFor(issuerKeys, kid) {
+    if (!issuerKeys)
+        return null;
+    if (Array.isArray(issuerKeys)) {
+        const e = issuerKeys.find((x) => x && x.kid === kid && typeof x.key === 'string');
+        return e ? e.key : null;
+    }
+    const k = issuerKeys[kid];
+    return typeof k === 'string' ? k : null;
+}
+function isPlainObject(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+}
+function pinnedKey(key) {
+    if (typeof key !== 'string' || !/^[A-Za-z0-9_-]+$/.test(key)) {
+        throw new Error('invalid pinned key encoding');
+    }
+    const bytes = Buffer.from(key, 'base64url');
+    if (bytes.length === 0 || bytes.toString('base64url') !== key) {
+        throw new Error('non-canonical pinned key encoding');
+    }
+    const publicKey = crypto.createPublicKey({ key: bytes, format: 'der', type: 'spki' });
+    if (publicKey.asymmetricKeyType !== 'ed25519')
+        throw new Error('pinned key is not Ed25519');
+    const canonicalSpki = publicKey.export({ type: 'spki', format: 'der' });
+    return {
+        publicKey,
+        fingerprint: `sha256:${sha256hex(canonicalSpki)}`,
+    };
+}
+/**
+ * Normalize the relying-party trust policy; presenter material is never used.
+ * @returns {{ok:false, reason:string}|{ok:true, minimum_threshold:number, roster:Map<string,{kid:string, principal_id:string, publicKey:import('crypto').KeyObject, fingerprint:string}>}}
+ */
+function normalizePinnedPolicy(policy, issuerKeys) {
+    if (!isPlainObject(policy))
+        return { ok: false, reason: 'missing_policy' };
+    if (!Number.isSafeInteger(policy.minimum_threshold) || policy.minimum_threshold < 2
+        || !Array.isArray(policy.roster)) {
+        return { ok: false, reason: 'invalid_policy' };
+    }
+    try {
+        const roster = new Map();
+        for (const entry of policy.roster) {
+            if (!isPlainObject(entry) || !isNonEmptyString(entry.kid)
+                || !isNonEmptyString(entry.principal_id) || roster.has(entry.kid)) {
+                return { ok: false, reason: 'invalid_policy' };
+            }
+            const key = isNonEmptyString(entry.key) ? entry.key : issuerKeyFor(issuerKeys, entry.kid);
+            const keyInfo = pinnedKey(key);
+            roster.set(entry.kid, {
+                kid: entry.kid,
+                principal_id: entry.principal_id,
+                ...keyInfo,
+            });
+        }
+        const members = [...roster.values()];
+        if (new Set(members.map((entry) => entry.principal_id)).size < policy.minimum_threshold
+            || new Set(members.map((entry) => entry.fingerprint)).size < policy.minimum_threshold) {
+            return { ok: false, reason: 'invalid_policy' };
+        }
+        return {
+            ok: true,
+            minimum_threshold: policy.minimum_threshold,
+            roster,
+        };
+    }
+    catch {
+        return { ok: false, reason: 'invalid_policy' };
+    }
+}
+/**
+ * Verify a break-glass grant against a relying-party-pinned policy. NEVER throws for a
+ * bad artifact — every failure resolves to { valid:false, reason } so the
+ * refusal itself is loggable. FAILS CLOSED on every path:
+ *   no_grant | grant_unparseable | grant_malformed | unsupported_version |
+ *   unsupported_algorithm | invalid_threshold | invalid_scope |
+ *   missing_reason | missing_incident_ref | missing_policy | invalid_policy |
+ *   duplicate_signer | duplicate_signer_principal | duplicate_signer_key |
+ *   policy_threshold_unmet | threshold_unmet | signer_not_in_roster | bad_signature |
+ *   invalid_validity_window | not_yet_valid | expired |
+ *   action_type_required | out_of_scope
+ *
+ * A grant can never nominate its own threshold, roster, identities, or keys.
+ * EVERY listed signature must verify against its pinned roster entry — one
+ * tampered or unrostered signature refuses the whole grant. The validity window is checked
+ * only AFTER the signatures, so the timestamps themselves are authenticated.
+ *
+ * @param {object|string|null} grantJson the artifact (object or JSON string)
+ * @param {object} [o]
+ * @param {{minimum_threshold:number,roster:Array<{kid:string,principal_id:string,key?:string}>}} [o.policy] relying-party policy (a missing policy refuses, never throws)
+ * @param {object|Array<{kid:string,key:string}>} [o.issuerKeys] optional pinned keys when roster entries omit key
+ * @param {number|string|function} [o.now=Date.now] injected clock (ms, ISO, or () => ms)
+ * @param {string} [o.actionType] the action the caller wants to override (a missing actionType refuses, never throws)
+ * @returns {{ valid: boolean, reason: string, grant_id?: string, incident_ref?: string, scope?: object, window?: object, threshold?: number, required_threshold?: number, policy_minimum_threshold?: number, signer_kids?: string[], signer_principal_ids?: string[], signer_spki_fingerprints?: string[] }}
+ */
+function verifyBreakGlassInternal(grantJson, { policy, issuerKeys, now = Date.now, actionType, } = {}) {
+    if (grantJson == null || grantJson === '')
+        return refuse('no_grant');
+    let doc = grantJson;
+    if (typeof doc === 'string') {
+        try {
+            if (Buffer.byteLength(doc, 'utf8') > 1024 * 1024 || !strictJsonGate(doc).ok)
+                return refuse('grant_unparseable');
+            doc = JSON.parse(doc);
+        }
+        catch {
+            return refuse('grant_unparseable');
+        }
+    }
+    if (!doc || typeof doc !== 'object' || Array.isArray(doc))
+        return refuse('grant_malformed');
+    if (doc['@version'] !== BREAKGLASS_VERSION)
+        return refuse('unsupported_version');
+    const p = doc.payload;
+    const sigs = doc.signatures;
+    if (!p || typeof p !== 'object' || !Array.isArray(sigs) || sigs.length === 0) {
+        return refuse('grant_malformed');
+    }
+    if (!isNonEmptyString(p.grant_id))
+        return refuse('grant_malformed');
+    if (!Number.isInteger(p.threshold) || p.threshold < 1)
+        return refuse('invalid_threshold');
+    if (!p.scope || !isActionTypeList(p.scope.action_types))
+        return refuse('invalid_scope');
+    // Attribution is non-optional: an anonymous or causeless override is refused.
+    if (!isNonEmptyString(p.reason))
+        return refuse('missing_reason');
+    if (!isNonEmptyString(p.incident_ref))
+        return refuse('missing_incident_ref');
+    const pinned = normalizePinnedPolicy(policy, issuerKeys);
+    if (!pinned.ok)
+        return refuse(pinned.reason);
+    for (const s of sigs) {
+        if (!s || typeof s !== 'object' || !isNonEmptyString(s.kid) || typeof s.value !== 'string') {
+            return refuse('grant_malformed');
+        }
+        if (s.algorithm !== 'Ed25519')
+            return refuse('unsupported_algorithm', { kid: s.kid });
+    }
+    // Distinct roster slots, pinned human principals, and canonical SPKI keys are
+    // independent predicates. Aliases cannot satisfy separation of duties.
+    const kids = sigs.map((s) => s.kid);
+    if (new Set(kids).size !== kids.length) {
+        const dup = kids.find((k, i) => kids.indexOf(k) !== i);
+        return refuse('duplicate_signer', { kid: dup });
+    }
+    const signerEntries = [];
+    for (const kid of kids) {
+        const entry = pinned.roster.get(kid);
+        if (!entry)
+            return refuse('signer_not_in_roster', { kid });
+        signerEntries.push(entry);
+    }
+    const principalIds = signerEntries.map((entry) => entry.principal_id);
+    if (new Set(principalIds).size !== principalIds.length) {
+        const principalId = principalIds.find((id, i) => principalIds.indexOf(id) !== i);
+        return refuse('duplicate_signer_principal', { principal_id: principalId });
+    }
+    const fingerprints = signerEntries.map((entry) => entry.fingerprint);
+    if (new Set(fingerprints).size !== fingerprints.length) {
+        const fingerprint = fingerprints.find((value, i) => fingerprints.indexOf(value) !== i);
+        return refuse('duplicate_signer_key', { spki_fingerprint: fingerprint });
+    }
+    if (sigs.length < p.threshold) {
+        return refuse('threshold_unmet', { threshold: p.threshold, signatures: sigs.length });
+    }
+    if (sigs.length < pinned.minimum_threshold) {
+        return refuse('policy_threshold_unmet', {
+            required_threshold: pinned.minimum_threshold,
+            presented_threshold: p.threshold,
+            signatures: sigs.length,
+        });
+    }
+    // Every listed signature must verify against its pinned roster key. Never
+    // count past one failure.
+    let msg;
+    try {
+        msg = Buffer.from(canonical(p), 'utf8');
+    }
+    catch {
+        return refuse('grant_malformed');
+    }
+    for (let i = 0; i < sigs.length; i++) {
+        const s = sigs[i];
+        let ok;
+        try {
+            ok = crypto.verify(null, msg, signerEntries[i].publicKey, Buffer.from(s.value, 'base64url'));
+        }
+        catch {
+            return refuse('bad_signature', { kid: s.kid });
+        }
+        if (ok !== true)
+            return refuse('bad_signature', { kid: s.kid });
+    }
+    // Validity window — checked only AFTER the signatures, so the timestamps
+    // themselves are authenticated. Both bounds are required; unparseable fails closed.
+    let nowMs;
+    try {
+        nowMs = typeof now === 'function' ? toMs(now()) : toMs(now);
+    }
+    catch {
+        nowMs = null;
+    }
+    const nbf = toMs(p.window?.not_before);
+    const exp = toMs(p.window?.expires_at);
+    if (nbf == null || exp == null || nowMs == null)
+        return refuse('invalid_validity_window');
+    if (nowMs < nbf)
+        return refuse('not_yet_valid', { not_before: p.window.not_before });
+    if (nowMs > exp)
+        return refuse('expired', { expires_at: p.window.expires_at });
+    // Scope: without knowing the action there is nothing to authorize — refuse.
+    if (!isNonEmptyString(actionType))
+        return refuse('action_type_required');
+    if (!p.scope.action_types.includes(actionType)) {
+        return refuse('out_of_scope', { action_type: actionType, scope: p.scope.action_types.slice() });
+    }
+    return {
+        valid: true,
+        reason: 'breakglass_verified',
+        grant_id: p.grant_id,
+        incident_ref: p.incident_ref,
+        scope: { action_types: p.scope.action_types.slice() },
+        window: { not_before: p.window.not_before, expires_at: p.window.expires_at },
+        threshold: p.threshold,
+        required_threshold: Math.max(p.threshold, pinned.minimum_threshold),
+        policy_minimum_threshold: pinned.minimum_threshold,
+        signer_kids: kids.slice(),
+        signer_principal_ids: principalIds.slice(),
+        signer_spki_fingerprints: fingerprints.slice(),
+    };
+}
+export function verifyBreakGlass(grantJson, options = {}) {
+    try {
+        return verifyBreakGlassInternal(grantJson, options);
+    }
+    catch {
+        return refuse('grant_malformed');
+    }
+}
+/**
+ * SINGLE-USE consumption via the consumption-store contract (store.js):
+ * `consume(key)` returns true the FIRST time, false on every replay, and marks
+ * the key seen BEFORE the caller acts — consumption is committed before use.
+ * If the process crashes after consume() and before the override, the grant is
+ * burned, not replayable: the fail direction is unusable, never reusable.
+ *
+ * Accepts the grant document ({ payload: { grant_id } }) or a verified result
+ * ({ grant_id }). NEVER throws — a missing store, missing grant_id, or a store
+ * error all refuse with a machine-readable reason. This is a low-level primitive;
+ * only runBreakGlass also enforces store capabilities, evidence, and execution order.
+ *
+ * @param {object} grant break-glass grant document or verifyBreakGlass result
+ * @param {{ consume(key: string): Promise<boolean> }} store consumption store (store.js contract)
+ * @returns {Promise<{ consumed: boolean, reason: string, key?: string }>}
+ */
+export async function consumeBreakGlass(grant, store) {
+    const grantId = grant?.payload?.grant_id ?? grant?.grant_id;
+    if (!isNonEmptyString(grantId))
+        return { consumed: false, reason: 'missing_grant_id' };
+    if (!store || typeof store.consume !== 'function') {
+        return { consumed: false, reason: 'no_consumption_store' };
+    }
+    const key = `breakglass:${grantId}`;
+    let first = false;
+    try {
+        first = (await store.consume(key)) === true;
+    }
+    catch {
+        // The store could not commit the consumption — fail CLOSED: we cannot
+        // prove single-use, so the override must not run.
+        return { consumed: false, reason: 'store_error', key };
+    }
+    if (!first)
+        return { consumed: false, reason: 'already_consumed', key };
+    return { consumed: true, reason: 'consumed', key };
+}
+/**
+ * Shape an evidence-log entry (kind 'breakglass') committing to the EXACT
+ * grant artifact (grant_hash = sha-256 of canonical grant) and the decision
+ * taken under it. Append it via the hash-chained evidence log — with
+ * { strict: true } so a sink failure refuses the override.
+ *
+ * This builder does not execute or authorize anything. runBreakGlass is the
+ * enforcing path that requires a strict, independently validated record
+ * acknowledgement before invoking an effect. This function never throws, even
+ * for a malformed grant or missing decision; an uncanonicalizable artifact has
+ * a null grant_hash and cannot pass runBreakGlass verification.
+ *
+ * @param {object} grant the break-glass grant document as presented (even if invalid)
+ * @param {object} decision e.g. { allow, reason, action_type } from verify/consume
+ * @param {object} [o]
+ * @param {number|string|function} [o.now=Date.now] injected clock for the entry timestamp
+ * @returns {object} entry ready for createEvidenceLog().record()
+ */
+function buildBreakGlassEvidenceInternal(grant, decision, { now = Date.now } = {}) {
+    let nowMs;
+    try {
+        nowMs = typeof now === 'function' ? toMs(now()) : toMs(now);
+    }
+    catch {
+        nowMs = null;
+    }
+    const p = (grant && typeof grant === 'object' && grant.payload && typeof grant.payload === 'object')
+        ? grant.payload : null;
+    const sigs = (grant && Array.isArray(grant.signatures)) ? grant.signatures : [];
+    const d = (decision && typeof decision === 'object') ? decision : {};
+    let grantHash = null;
+    try {
+        grantHash = sha256hex(canonical(grant ?? null));
+    }
+    catch { /* uncanonicalizable artifacts stay unbound */ }
+    const principalIds = Array.isArray(d.signer_principal_ids)
+        && d.signer_principal_ids.every(isNonEmptyString) ? d.signer_principal_ids.slice() : null;
+    const fingerprints = Array.isArray(d.signer_spki_fingerprints)
+        && d.signer_spki_fingerprints.every(isNonEmptyString) ? d.signer_spki_fingerprints.slice() : null;
+    return {
+        kind: BREAKGLASS_EVIDENCE_KIND,
+        '@version': BREAKGLASS_VERSION,
+        at: new Date(nowMs ?? 0).toISOString(),
+        grant_id: p?.grant_id ?? null,
+        incident_ref: p?.incident_ref ?? null,
+        grant_reason: p?.reason ?? null,
+        scope: p?.scope?.action_types?.slice?.() ?? null,
+        threshold: p?.threshold ?? null,
+        policy_minimum_threshold: Number.isSafeInteger(d.policy_minimum_threshold)
+            ? d.policy_minimum_threshold : null,
+        required_threshold: Number.isSafeInteger(d.required_threshold) ? d.required_threshold : null,
+        signer_kids: sigs.map((s) => s?.kid ?? null),
+        signer_principal_ids: principalIds,
+        signer_spki_fingerprints: fingerprints,
+        // Commits the log entry to the exact artifact presented — a later dispute
+        // can prove which grant (tampered or not) the decision was taken under.
+        grant_hash: grantHash,
+        decision: {
+            allow: d.allow === true, // fail closed: anything else records a refusal
+            reason: isNonEmptyString(d.reason) ? d.reason : 'unspecified',
+            action_type: d.action_type ?? null,
+        },
+    };
+}
+export function buildBreakGlassEvidence(grant, decision, options = {}) {
+    try {
+        return buildBreakGlassEvidenceInternal(grant, decision, options);
+    }
+    catch {
+        return {
+            kind: BREAKGLASS_EVIDENCE_KIND,
+            '@version': BREAKGLASS_VERSION,
+            at: new Date(0).toISOString(),
+            grant_id: null,
+            incident_ref: null,
+            grant_reason: null,
+            scope: null,
+            threshold: null,
+            policy_minimum_threshold: null,
+            required_threshold: null,
+            signer_kids: [],
+            signer_principal_ids: null,
+            signer_spki_fingerprints: null,
+            grant_hash: null,
+            decision: { allow: false, reason: 'unspecified', action_type: null },
+        };
+    }
+}
+/**
+ * The sole high-level break-glass execution path. It snapshots the presented
+ * artifact, verifies it against relying-party policy, atomically consumes the
+ * grant in a capability-marked permanent store, validates a strict evidence
+ * acknowledgement, and only then invokes `effect`.
+ *
+ * @param {object} [args]
+ * @param {object|string} [args.grant] the presented break-glass artifact
+ * @param {{minimum_threshold:number,roster:Array<{kid:string,principal_id:string,key?:string}>}} [args.policy]
+ * @param {object|Array<{kid:string,key:string}>} [args.issuerKeys]
+ * @param {string} [args.actionType]
+ * @param {{ consume(key: string): Promise<boolean> }} [args.store]
+ * @param {{ strict?: boolean, atomicAppend?: boolean, record?: Function }} [args.evidence]
+ * @param {number|string|function} [args.now=Date.now]
+ * @param {Function} [effect] required at runtime; a missing effect throws
+ */
+export async function runBreakGlass({ grant, policy, issuerKeys, actionType, store, evidence, now = Date.now, } = {}, effect) {
+    if (typeof effect !== 'function')
+        throw new Error('runBreakGlass: effect function is required');
+    let snapshot;
+    try {
+        const parsed = typeof grant === 'string' ? JSON.parse(grant) : grant;
+        snapshot = JSON.parse(canonical(parsed));
+    }
+    catch {
+        const verification = verifyBreakGlass(grant, { policy, issuerKeys, actionType, now });
+        return { ok: false, reason: verification.reason, verification, consumption: null, evidence: null };
+    }
+    const verification = verifyBreakGlass(snapshot, { policy, issuerKeys, actionType, now });
+    if (!verification.valid) {
+        return { ok: false, reason: verification.reason, verification, consumption: null, evidence: null };
+    }
+    if (!isSecureConsumptionStore(store)) {
+        return {
+            ok: false,
+            reason: 'secure_consumption_store_required',
+            verification,
+            consumption: null,
+            evidence: null,
+        };
+    }
+    if (!evidence || evidence.strict !== true || typeof evidence.record !== 'function') {
+        return {
+            ok: false,
+            reason: 'strict_evidence_required',
+            verification,
+            consumption: null,
+            evidence: null,
+        };
+    }
+    // store is guaranteed defined here: isSecureConsumptionStore(store) returned
+    // true above, which only holds for a store with a callable consume().
+    const consume = store.consume.bind(store);
+    const record = evidence.record.bind(evidence);
+    const consumption = await consumeBreakGlass(verification, { consume });
+    if (!consumption.consumed) {
+        return { ok: false, reason: consumption.reason, verification, consumption, evidence: null };
+    }
+    const entry = buildBreakGlassEvidence(snapshot, {
+        ...verification,
+        allow: true,
+        action_type: actionType,
+    }, { now });
+    let evidenceRecord;
+    try {
+        evidenceRecord = await record(entry);
+        if (!verifyEvidenceRecord(evidenceRecord, /** @type {{atomicRequired?: boolean, expectedEntry?: object}} */ ({
+            atomicRequired: evidence.atomicAppend === true,
+            expectedEntry: entry,
+        })))
+            throw new Error('malformed evidence acknowledgement');
+    }
+    catch {
+        return {
+            ok: false,
+            reason: 'evidence_record_failed',
+            verification,
+            consumption,
+            evidence: null,
+        };
+    }
+    const result = await effect({ verification, consumption, evidence: evidenceRecord });
+    return {
+        ok: true,
+        reason: 'breakglass_executed',
+        result,
+        verification,
+        consumption,
+        evidence: evidenceRecord,
+    };
+}
+export default {
+    mintBreakGlassAuthorization,
+    verifyBreakGlass,
+    consumeBreakGlass,
+    buildBreakGlassEvidence,
+    runBreakGlass,
+    BREAKGLASS_VERSION,
+    BREAKGLASS_EVIDENCE_KIND,
+};
+//# sourceMappingURL=breakglass.js.map

package/dist/breakglass.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"breakglass.js","sourceRoot":"","sources":["../src/breakglass.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,YAAY,IAAI,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAEtD,MAAM,CAAC,MAAM,kBAAkB,GAAG,uBAAuB,CAAC;AAC1D,MAAM,CAAC,MAAM,wBAAwB,GAAG,YAAY,CAAC;AAwBrD,SAAS,SAAS,CAAC,CAAC;IAClB,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,IAAI,CAAC,CAAC;IACb,IAAI,CAAC,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAED,0EAA0E;AAC1E,SAAS,MAAM,CAAC,MAAM,EAAE,KAAK,GAAG,EAAE;IAChC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAC;IACzB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAC;IACzB,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,2BAA2B,CAAC,OAAO,EAAE,EACnD,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,MAOjD,EAAE;IACJ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,0FAA0F,CAAC,CAAC;IAC9G,CAAC;IACD,IAAI,kBAAkB,CAAC;IACvB,IAAI,CAAC;QACH,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACrC,oEAAoE;YACpE,wEAAwE;YACxE,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;YAC5E,IAAI,SAAS,CAAC,iBAAiB,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;YAC9E,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/D,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,MAAM,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,yFAAyF,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IACrG,CAAC;IACD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QACnF,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,yBAAyB,SAAS,yBAAyB,OAAO,CAAC,MAAM,iCAAiC,CAAC,CAAC;IAC9H,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAClC,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,GAAG,IAAI,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACjG,+EAA+E;IAC/E,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACjF,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAE7F,MAAM,IAAI,GAAG;QACX,KAAK,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE;QACnD,iEAAiE;QACjE,+DAA+D;QAC/D,MAAM,EAAE,EAAE,UAAU,EAAE,GAAI,CAAC,UAAU,EAAE,UAAU,EAAE,GAAI,CAAC,UAAU,EAAE;QACpE,MAAM;QACN,YAAY;QACZ,SAAS;KACV,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;IACpD,MAAM,OAAO,GAAG,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QACvD,GAAG;QACH,SAAS,EAAE,wBAAwB,CAAC,CAAC,SAAS,CAAC;QAC/C,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;KAChE,CAAC,CAAC,CAAC;IACJ,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACjE,CAAC;AAED,8EAA8E;AAC9E,SAAS,YAAY,CAAC,UAAU,EAAE,GAAG;IACnC,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC;QAClF,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1B,CAAC;IACD,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1C,CAAC;AAED,SAAS,aAAa,CAAC,KAAK;IAC1B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtF,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/C,OAAO,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC;AAC9D,CAAC;AAED,SAAS,SAAS,CAAC,GAAG;IACpB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,GAAG,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACtF,IAAI,SAAS,CAAC,iBAAiB,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC5F,MAAM,aAAa,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACxE,OAAO;QACL,SAAS;QACT,WAAW,EAAE,UAAU,SAAS,CAAC,aAAa,CAAC,EAAE;KAClD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB,CAAC,MAAM,EAAE,UAAU;IAG/C,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3E,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,MAAM,CAAC,iBAAiB,GAAG,CAAC;WAC5E,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACjD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;QACzB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC;mBAClD,CAAC,gBAAgB,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;YACjD,CAAC;YACD,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;YAC1F,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAC/B,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE;gBACpB,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,GAAG,OAAO;aACX,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACrC,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,GAAG,MAAM,CAAC,iBAAiB;eAChF,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,GAAG,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC1F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QACjD,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,MAAM;SACP,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACjD,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAS,wBAAwB,CAAC,SAAS,EAAE,EAC3C,MAAM,EAAE,UAAU,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,MAM5C,EAAE;IACJ,IAAI,SAAS,IAAI,IAAI,IAAI,SAAS,KAAK,EAAE;QAAE,OAAO,MAAM,CAAC,UAAU,CAAC,CAAC;IAErE,IAAI,GAAG,GAAG,SAAS,CAAC;IACpB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE;gBAAE,OAAO,MAAM,CAAC,mBAAmB,CAAC,CAAC;YAChH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAAC,CAAC;IACjD,CAAC;IACD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC5F,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,kBAAkB;QAAE,OAAO,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAEjF,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC;IACtB,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC;IAC5B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7E,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAC1F,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;QAAE,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC;IACxF,8EAA8E;IAC9E,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACjE,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,YAAY,CAAC;QAAE,OAAO,MAAM,CAAC,sBAAsB,CAAC,CAAC;IAE7E,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAE7C,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC3F,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,uBAAuB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IACxF,CAAC;IAED,8EAA8E;IAC9E,uEAAuE;IACvE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACvD,OAAO,MAAM,CAAC,kBAAkB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,aAAa,GAAwB,EAAE,CAAC;IAC9C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK;YAAE,OAAO,MAAM,CAAC,sBAAsB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3D,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IACD,MAAM,YAAY,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACtE,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,MAAM,EAAE,CAAC;QACvD,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACjF,OAAO,MAAM,CAAC,4BAA4B,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,YAAY,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACrE,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,MAAM,EAAE,CAAC;QACvD,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACvF,OAAO,MAAM,CAAC,sBAAsB,EAAE,EAAE,gBAAgB,EAAE,WAAW,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC,iBAAiB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC3C,OAAO,MAAM,CAAC,wBAAwB,EAAE;YACtC,kBAAkB,EAAE,MAAM,CAAC,iBAAiB;YAC5C,mBAAmB,EAAE,CAAC,CAAC,SAAS;YAChC,UAAU,EAAE,IAAI,CAAC,MAAM;SACxB,CAAC,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,0BAA0B;IAC1B,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QAAC,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAAC,CAAC;IAC5F,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,EAAE,CAAC;QACP,IAAI,CAAC;YACH,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;QAC/F,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,MAAM,CAAC,eAAe,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QAAC,CAAC;QAC3D,IAAI,EAAE,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC,eAAe,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,yEAAyE;IACzE,oFAAoF;IACpF,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QAAC,KAAK,GAAG,OAAO,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,KAAK,GAAG,IAAI,CAAC;IAAC,CAAC;IAC5F,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACvC,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,MAAM,CAAC,yBAAyB,CAAC,CAAC;IAC1F,IAAI,KAAK,GAAG,GAAG;QAAE,OAAO,MAAM,CAAC,eAAe,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IACrF,IAAI,KAAK,GAAG,GAAG;QAAE,OAAO,MAAM,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAE/E,4EAA4E;IAC5E,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC;QAAE,OAAO,MAAM,CAAC,sBAAsB,CAAC,CAAC;IACzE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/C,OAAO,MAAM,CAAC,cAAc,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClG,CAAC;IAED,OAAO;QACL,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,qBAAqB;QAC7B,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,KAAK,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE;QACrD,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE;QAC5E,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,kBAAkB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,iBAAiB,CAAC;QACnE,wBAAwB,EAAE,MAAM,CAAC,iBAAiB;QAClD,WAAW,EAAE,IAAI,CAAC,KAAK,EAAE;QACzB,oBAAoB,EAAE,YAAY,CAAC,KAAK,EAAE;QAC1C,wBAAwB,EAAE,YAAY,CAAC,KAAK,EAAE;KAC/C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,SAAS,EAAE,OAAO,GAAG,EAAE;IACtD,IAAI,CAAC;QAAC,OAAO,wBAAwB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAAC,CAAC;AAC1G,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAK,EAAE,KAAK;IAClD,MAAM,OAAO,GAAG,KAAK,EAAE,OAAO,EAAE,QAAQ,IAAI,KAAK,EAAE,QAAQ,CAAC;IAC5D,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACvF,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAClD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAC7D,CAAC;IACD,MAAM,GAAG,GAAG,cAAc,OAAO,EAAE,CAAC;IACpC,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,kDAAkD;QAClD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,EAAE,CAAC;IACxE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,+BAA+B,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;IAC/E,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QAAC,KAAK,GAAG,OAAO,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,KAAK,GAAG,IAAI,CAAC;IAAC,CAAC;IAC5F,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC;QAClG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,MAAM,CAAC,GAAG,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,CAAC;QAAC,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,8CAA8C,CAAC,CAAC;IACjH,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC;WACrD,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5F,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC;WACzD,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACpG,OAAO;QACL,IAAI,EAAE,wBAAwB;QAC9B,UAAU,EAAE,kBAAkB;QAC9B,EAAE,EAAE,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE;QACtC,QAAQ,EAAE,CAAC,EAAE,QAAQ,IAAI,IAAI;QAC7B,YAAY,EAAE,CAAC,EAAE,YAAY,IAAI,IAAI;QACrC,YAAY,EAAE,CAAC,EAAE,MAAM,IAAI,IAAI;QAC/B,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,IAAI,IAAI;QAChD,SAAS,EAAE,CAAC,EAAE,SAAS,IAAI,IAAI;QAC/B,wBAAwB,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,wBAAwB,CAAC;YACxE,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI;QACrC,kBAAkB,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI;QAC5F,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC;QAC5C,oBAAoB,EAAE,YAAY;QAClC,wBAAwB,EAAE,YAAY;QACtC,0EAA0E;QAC1E,wEAAwE;QACxE,UAAU,EAAE,SAAS;QACrB,QAAQ,EAAE;YACR,KAAK,EAAE,CAAC,CAAC,KAAK,KAAK,IAAI,EAAE,+CAA+C;YACxE,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa;YAC7D,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;SACnC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,GAAG,EAAE;IACnE,IAAI,CAAC;QAAC,OAAO,+BAA+B,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAC/E,OAAO;YACL,IAAI,EAAE,wBAAwB;YAC9B,UAAU,EAAE,kBAAkB;YAC9B,EAAE,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;YAC7B,QAAQ,EAAE,IAAI;YACd,YAAY,EAAE,IAAI;YAClB,YAAY,EAAE,IAAI;YAClB,KAAK,EAAE,IAAI;YACX,SAAS,EAAE,IAAI;YACf,wBAAwB,EAAE,IAAI;YAC9B,kBAAkB,EAAE,IAAI;YACxB,WAAW,EAAE,EAAE;YACf,oBAAoB,EAAE,IAAI;YAC1B,wBAAwB,EAAE,IAAI;YAC9B,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,IAAI,EAAE;SACrE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAClC,KAAK,EACL,MAAM,EACN,UAAU,EACV,UAAU,EACV,KAAK,EACL,QAAQ,EACR,GAAG,GAAG,IAAI,CAAC,GAAG,MASZ,EAAE,EAAE,MAAM;IACZ,IAAI,OAAO,MAAM,KAAK,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAEhG,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACrE,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,YAAY,GAAG,gBAAgB,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACtF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACrG,CAAC;IAED,MAAM,YAAY,GAAG,gBAAgB,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IACzF,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACrG,CAAC;IACD,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,mCAAmC;YAC3C,YAAY;YACZ,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,IAAI;SACf,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,QAAQ,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACnF,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,0BAA0B;YAClC,YAAY;YACZ,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,IAAI;SACf,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,sEAAsE;IACtE,MAAM,OAAO,GAAI,KAAoD,CAAC,OAAO,CAAC,IAAI,CAAC,KAAM,CAAC,CAAC;IAC3F,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACvE,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC9F,CAAC;IAED,MAAM,KAAK,GAAG,uBAAuB,CAAC,QAAQ,EAAE;QAC9C,GAAG,YAAY;QACf,KAAK,EAAE,IAAI;QACX,WAAW,EAAE,UAAU;KACxB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACZ,IAAI,cAAc,CAAC;IACnB,IAAI,CAAC;QACH,cAAc,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,oBAAoB,CAAC,cAAc,EAAE,iEAAiE,CAAC,CAAC;YAC3G,cAAc,EAAE,QAAQ,CAAC,YAAY,KAAK,IAAI;YAC9C,aAAa,EAAE,KAAK;SACrB,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,wBAAwB;YAChC,YAAY;YACZ,WAAW;YACX,QAAQ,EAAE,IAAI;SACf,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC;IACrF,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,qBAAqB;QAC7B,MAAM;QACN,YAAY;QACZ,WAAW;QACX,QAAQ,EAAE,cAAc;KACzB,CAAC;AACJ,CAAC;AAED,eAAe;IACb,2BAA2B;IAC3B,gBAAgB;IAChB,iBAAiB;IACjB,uBAAuB;IACvB,aAAa;IACb,kBAAkB;IAClB,wBAAwB;CACzB,CAAC"}