@hs-x/cli 0.2.7 → 0.3.6

package/dist/status-drilldown.js

@@ -0,0 +1,50 @@
+import { Effect } from 'effect';
+import { isInteractive, promptSelect } from './prompt.js';
+const ACTION_OPTIONS = [
+    { value: 'logs', label: 'View logs', description: 'Recent Workers and HubSpot activity' },
+    { value: 'routes', label: 'View routes', description: 'Active deployed revisions' },
+    { value: 'drift', label: 'View drift', description: 'Recorded and observed state' },
+    { value: 'refresh', label: 'Refresh status', description: 'Read this project again' },
+    { value: 'done', label: 'Done' },
+];
+/**
+ * Iterative (never recursive) status follow-up loop. Its prompt and actions are
+ * injected so dispatch behavior can be tested without a terminal or services.
+ */
+export function statusDrilldown(deps) {
+    if (!(deps.interactive ?? isInteractive()))
+        return Effect.void;
+    const select = deps.select ?? promptSelect;
+    const maxRefreshes = Math.max(0, deps.maxRefreshes ?? 10);
+    return Effect.gen(function* () {
+        let refreshes = 0;
+        while (true) {
+            const options = refreshes < maxRefreshes
+                ? ACTION_OPTIONS
+                : ACTION_OPTIONS.filter((option) => option.value !== 'refresh');
+            const action = yield* Effect.promise(() => select({
+                message: 'What would you like to inspect?',
+                options,
+                default: 'done',
+            }));
+            if (!action || action === 'done')
+                return;
+            switch (action) {
+                case 'logs':
+                    yield* deps.actions.logs();
+                    break;
+                case 'routes':
+                    yield* deps.actions.routes();
+                    break;
+                case 'drift':
+                    yield* deps.actions.drift();
+                    break;
+                case 'refresh':
+                    yield* deps.actions.refresh();
+                    refreshes += 1;
+                    break;
+            }
+        }
+    });
+}
+//# sourceMappingURL=status-drilldown.js.map

package/dist/status-drilldown.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-drilldown.js","sourceRoot":"","sources":["../src/status-drilldown.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAsB1D,MAAM,cAAc,GAAG;IACrB,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,qCAAqC,EAAE;IACzF,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,2BAA2B,EAAE;IACnF,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,6BAA6B,EAAE;IACnF,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,yBAAyB,EAAE;IACrF,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;CACxB,CAAC;AAEX;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAoC;IAEpC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,aAAa,EAAE,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IAE/D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC;IAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IAC1D,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACzB,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,OAAO,GACX,SAAS,GAAG,YAAY;gBACtB,CAAC,CAAC,cAAc;gBAChB,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;YACpE,MAAM,MAAM,GAAsC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAC3E,MAAM,CAAC;gBACL,OAAO,EAAE,iCAAiC;gBAC1C,OAAO;gBACP,OAAO,EAAE,MAAM;aAChB,CAAC,CACH,CAAC;YACF,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,MAAM;gBAAE,OAAO;YAEzC,QAAQ,MAAM,EAAE,CAAC;gBACf,KAAK,MAAM;oBACT,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;oBAC3B,MAAM;gBACR,KAAK,QAAQ;oBACX,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;oBAC7B,MAAM;gBACR,KAAK,OAAO;oBACV,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;oBAC5B,MAAM;gBACR,KAAK,SAAS;oBACZ,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;oBAC9B,SAAS,IAAI,CAAC,CAAC;oBACf,MAAM;YACV,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/tenant-state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-state.d.ts","sourceRoot":"","sources":["../src/tenant-state.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAGnD,OAAO,EAAE,KAAK,UAAU,EAAoB,MAAM,kBAAkB,CAAC;AAErE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACvE,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;CACjC;AAID;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,KAAK,EAAE;IAClD,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA2D9B;AAED;;;;;;;;GAQG;AACH,wBAAsB,+BAA+B,CAAC,KAAK,EAAE;IAC3D,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,IAAI,CAAC,CAUhB;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAAE;IAChD,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAwB1C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IACpD,QAAQ,CAAC,EAAE,EAAE,OAAO,oBAAoB,EAAE,kBAAkB,CAAC;IAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,SAAS;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE,CAAC,CAoB3E"}
+{"version":3,"file":"tenant-state.d.ts","sourceRoot":"","sources":["../src/tenant-state.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAGnD,OAAO,EAAE,KAAK,UAAU,EAAoB,MAAM,kBAAkB,CAAC;AAErE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACvE,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;CACjC;AAID;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,KAAK,EAAE;IAClD,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA2D9B;AAED;;;;;;;;GAQG;AACH,wBAAsB,+BAA+B,CAAC,KAAK,EAAE;IAC3D,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,IAAI,CAAC,CAWhB;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAAE;IAChD,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAwB1C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IACpD,QAAQ,CAAC,EAAE,EAAE,OAAO,oBAAoB,EAAE,kBAAkB,CAAC;IAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,SAAS;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE,CAAC,CAoB3E"}

package/dist/tenant-state.js

@@ -82,8 +82,9 @@ export async function preflightTenantStateCredentials(input) {
     const { apiToken, accountId } = resolveCloudflareCredentials(input.argv);
     const cloudflareAccountId = accountId ?? (await loadCloudflarePointer(input.root))?.cloudflareAccountId;
     if (!apiToken || !cloudflareAccountId) {
-        throw new Error('A Cloudflare deploy needs an API token and account id. Set CLOUDFLARE_API_TOKEN and ' +
-            'CLOUDFLARE_ACCOUNT_ID, or pass --cloudflare-api-token / --cloudflare-account-id, before deploying.');
+        throw new Error('A Cloudflare deploy needs a Cloudflare connection. Easiest: run `hs-x connect cloudflare` ' +
+            'to sign in via your browser (stored for every future deploy). Or set CLOUDFLARE_API_TOKEN ' +
+            'and CLOUDFLARE_ACCOUNT_ID (or pass --cloudflare-api-token / --cloudflare-account-id).');
     }
 }
 /**

package/dist/tenant-state.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenant-state.js","sourceRoot":"","sources":["../src/tenant-state.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAC5F,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAAmB,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAOrE,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAA8B,CAAC;AAEpE;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAG5C;IACC,MAAM,KAAK,GAAG,4BAA4B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC3B,0EAA0E;IAC1E,mEAAmE;IACnE,MAAM,mBAAmB,GACvB,KAAK,CAAC,SAAS,IAAI,CAAC,MAAM,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,mBAAmB,CAAC;IACpF,2EAA2E;IAC3E,6EAA6E;IAC7E,IAAI,WAA+B,CAAC;IACpC,IAAI,eAAmC,CAAC;IACxC,IAAI,CAAC,QAAQ,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACtE,WAAW,GAAG,KAAK,EAAE,QAAQ,CAAC;QAC9B,eAAe,GAAG,KAAK,EAAE,mBAAmB,CAAC;IAC/C,CAAC;IACD,MAAM,cAAc,GAAG,QAAQ,IAAI,WAAW,CAAC;IAC/C,MAAM,kBAAkB,GAAG,mBAAmB,IAAI,eAAe,CAAC;IAClE,IAAI,CAAC,cAAc,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CACb,qPAAqP,CACtP,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;IACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,mBAAmB,EAAE,kBAAkB;QACvC,QAAQ,EAAE,cAAc;QACxB,OAAO;KACR,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,WAAW,GAAG,wBAAwB,CAAC;QAC3C,SAAS,EAAE,kBAAkB;QAC7B,QAAQ,EAAE,cAAc;QACxB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChC,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC;QAC5C,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,mBAAmB,EAAE,kBAAkB;QACvC,kBAAkB,EAAE,SAAS,CAAC,EAAE;QAChC,oBAAoB,EAAE,SAAS,CAAC,KAAK;KACtC,CAAC,CAAC;IACH,MAAM,OAAO,GAAuB;QAClC,OAAO;QACP,UAAU,EAAE,gBAAgB,CAAC;YAC3B,OAAO;YACP,EAAE,EAAE,wBAAwB,CAAC;gBAC3B,SAAS,EAAE,OAAO,CAAC,mBAAmB;gBACtC,QAAQ,EAAE,cAAc;gBACxB,WAAW,EAAE,OAAO,CAAC,kBAAkB;gBACvC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChC,CAAC;SACH,CAAC;KACH,CAAC;IACF,qBAAqB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC7C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAGrD;IACC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,4BAA4B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzE,MAAM,mBAAmB,GACvB,SAAS,IAAI,CAAC,MAAM,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,mBAAmB,CAAC;IAC9E,IAAI,CAAC,QAAQ,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,sFAAsF;YACpF,oGAAoG,CACvG,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAG1C;IACC,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,EAAE,QAAQ,EAAE,GAAG,4BAA4B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,yBAAyB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9F,MAAM,cAAc,GAAG,QAAQ,IAAI,MAAM,EAAE,QAAQ,CAAC;IACpD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,mIAAmI,CACpI,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;IACxD,OAAO;QACL,OAAO;QACP,UAAU,EAAE,gBAAgB,CAAC;YAC3B,OAAO;YACP,EAAE,EAAE,wBAAwB,CAAC;gBAC3B,SAAS,EAAE,OAAO,CAAC,mBAAmB;gBACtC,QAAQ,EAAE,cAAc;gBACxB,WAAW,EAAE,OAAO,CAAC,kBAAkB;gBACvC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChC,CAAC;SACH,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAI9C;IACC,MAAM,UAAU,GAAG,UAAU,KAAK,CAAC,IAAI,GAAG,CAAC;IAC3C,MAAM,QAAQ,GAAG,UAAU,KAAK,CAAC,EAAE,GAAG,CAAC;IACvC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAErC,MAAM,SAAS,GAAyC,EAAE,CAAC;IAC3D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,MAAM,KAAK,GAAG,GAAG,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/D,MAAM,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5E,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,uEAAuE;IACvE,0DAA0D;IAC1D,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,SAAS,EAAE,CAAC;QACpC,MAAM,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa,EAAE,IAAY,EAAE,EAAU;IAClE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAC;QAC5C,IACE,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,KAAK,IAAI;YACf,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACrB,MAAgC,CAAC,OAAO,KAAK,IAAI,EAClD,CAAC;YACD,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;QAC1E,qEAAqE;IACvE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAGD;;;;GAIG;AACH,KAAK,UAAU,yBAAyB,CACtC,IAAuB,EACvB,IAAY;IAEZ,IAAI,CAAC;QACH,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACxE,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAC/B,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACtD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC;aACxE,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2B,CAAC;aACxD,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC1B,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,gBAAgB,CAAC;QACpF,IAAI,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC;QACjC,MAAM,EAAE,sBAAsB,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,IAAI,GAAG,CACL,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,mBAAmB,EAChE,sBAAsB,CAAC,IAAI,CAAC,CAC7B,EACD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,OAAO,CAAC,YAAY,EAAE;gBAC/C,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,iBAAiB,EAAE,CAAC,sBAAsB,CAAC,EAAE,CAAC;SACtE,CACF,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;QACnC,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGnC,CAAC;QACF,OAAO,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,mBAAmB;YAChD,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,EAAE;YAC9E,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}
+{"version":3,"file":"tenant-state.js","sourceRoot":"","sources":["../src/tenant-state.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAC5F,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAAmB,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAOrE,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAA8B,CAAC;AAEpE;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAG5C;IACC,MAAM,KAAK,GAAG,4BAA4B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC3B,0EAA0E;IAC1E,mEAAmE;IACnE,MAAM,mBAAmB,GACvB,KAAK,CAAC,SAAS,IAAI,CAAC,MAAM,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,mBAAmB,CAAC;IACpF,2EAA2E;IAC3E,6EAA6E;IAC7E,IAAI,WAA+B,CAAC;IACpC,IAAI,eAAmC,CAAC;IACxC,IAAI,CAAC,QAAQ,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACtE,WAAW,GAAG,KAAK,EAAE,QAAQ,CAAC;QAC9B,eAAe,GAAG,KAAK,EAAE,mBAAmB,CAAC;IAC/C,CAAC;IACD,MAAM,cAAc,GAAG,QAAQ,IAAI,WAAW,CAAC;IAC/C,MAAM,kBAAkB,GAAG,mBAAmB,IAAI,eAAe,CAAC;IAClE,IAAI,CAAC,cAAc,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CACb,qPAAqP,CACtP,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;IACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,mBAAmB,EAAE,kBAAkB;QACvC,QAAQ,EAAE,cAAc;QACxB,OAAO;KACR,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,WAAW,GAAG,wBAAwB,CAAC;QAC3C,SAAS,EAAE,kBAAkB;QAC7B,QAAQ,EAAE,cAAc;QACxB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChC,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC;QAC5C,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,mBAAmB,EAAE,kBAAkB;QACvC,kBAAkB,EAAE,SAAS,CAAC,EAAE;QAChC,oBAAoB,EAAE,SAAS,CAAC,KAAK;KACtC,CAAC,CAAC;IACH,MAAM,OAAO,GAAuB;QAClC,OAAO;QACP,UAAU,EAAE,gBAAgB,CAAC;YAC3B,OAAO;YACP,EAAE,EAAE,wBAAwB,CAAC;gBAC3B,SAAS,EAAE,OAAO,CAAC,mBAAmB;gBACtC,QAAQ,EAAE,cAAc;gBACxB,WAAW,EAAE,OAAO,CAAC,kBAAkB;gBACvC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChC,CAAC;SACH,CAAC;KACH,CAAC;IACF,qBAAqB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC7C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAGrD;IACC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,4BAA4B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzE,MAAM,mBAAmB,GACvB,SAAS,IAAI,CAAC,MAAM,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,mBAAmB,CAAC;IAC9E,IAAI,CAAC,QAAQ,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,4FAA4F;YAC1F,4FAA4F;YAC5F,uFAAuF,CAC1F,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAG1C;IACC,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,EAAE,QAAQ,EAAE,GAAG,4BAA4B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,yBAAyB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9F,MAAM,cAAc,GAAG,QAAQ,IAAI,MAAM,EAAE,QAAQ,CAAC;IACpD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,mIAAmI,CACpI,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;IACxD,OAAO;QACL,OAAO;QACP,UAAU,EAAE,gBAAgB,CAAC;YAC3B,OAAO;YACP,EAAE,EAAE,wBAAwB,CAAC;gBAC3B,SAAS,EAAE,OAAO,CAAC,mBAAmB;gBACtC,QAAQ,EAAE,cAAc;gBACxB,WAAW,EAAE,OAAO,CAAC,kBAAkB;gBACvC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChC,CAAC;SACH,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAI9C;IACC,MAAM,UAAU,GAAG,UAAU,KAAK,CAAC,IAAI,GAAG,CAAC;IAC3C,MAAM,QAAQ,GAAG,UAAU,KAAK,CAAC,EAAE,GAAG,CAAC;IACvC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAErC,MAAM,SAAS,GAAyC,EAAE,CAAC;IAC3D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,MAAM,KAAK,GAAG,GAAG,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/D,MAAM,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5E,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,uEAAuE;IACvE,0DAA0D;IAC1D,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,SAAS,EAAE,CAAC;QACpC,MAAM,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa,EAAE,IAAY,EAAE,EAAU;IAClE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAC;QAC5C,IACE,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,KAAK,IAAI;YACf,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACrB,MAAgC,CAAC,OAAO,KAAK,IAAI,EAClD,CAAC;YACD,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;QAC1E,qEAAqE;IACvE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,yBAAyB,CACtC,IAAuB,EACvB,IAAY;IAEZ,IAAI,CAAC;QACH,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACxE,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAC/B,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACtD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC;aACxE,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2B,CAAC;aACxD,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC1B,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,gBAAgB,CAAC;QACpF,IAAI,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC;QACjC,MAAM,EAAE,sBAAsB,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,IAAI,GAAG,CACL,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,mBAAmB,EAChE,sBAAsB,CAAC,IAAI,CAAC,CAC7B,EACD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,OAAO,CAAC,YAAY,EAAE;gBAC/C,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,iBAAiB,EAAE,CAAC,sBAAsB,CAAC,EAAE,CAAC;SACtE,CACF,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;QACnC,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGnC,CAAC;QACF,OAAO,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,mBAAmB;YAChD,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,EAAE;YAC9E,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/token-key-custody.d.ts

@@ -0,0 +1,91 @@
+import { Schema, schemas } from '@hs-x/types';
+import { CliError } from './cli-error.js';
+export type TokenKeyCustodyMechanism = Schema.Schema.Type<typeof schemas.TokenKeyCustodyMechanism>;
+export type TokenKeyCanary = Schema.Schema.Type<typeof schemas.TokenKeyCanary>;
+export type EscrowedTokenKeyCustody = Schema.Schema.Type<typeof schemas.EscrowedTokenKeyCustody>;
+declare const TOKEN_KEY_CUSTODY_CODES: readonly ["HSX_E_TOKEN_KEY_CUSTODY_MISSING", "HSX_E_TOKEN_KEY_CUSTODY_CORRUPT", "HSX_E_TOKEN_KEY_CUSTODY_UNAVAILABLE"];
+export type TokenKeyCustodyErrorCode = (typeof TOKEN_KEY_CUSTODY_CODES)[number];
+/** Typed, actionable custody failure. `code` is an errors-registry code. */
+export declare function tokenKeyCustodyError(code: TokenKeyCustodyErrorCode, detail: string): CliError;
+export declare function isTokenKeyCustodyError(error: unknown): error is CliError;
+/**
+ * Storage adapter for one custody mechanism.
+ *
+ * `retrieve` returns `undefined` for "no entry" and throws a typed
+ * `TokenKeyCustodyErrorCode` error for "entry exists but cannot be read".
+ */
+export interface TokenKeyCustodyAdapter {
+    readonly mechanism: TokenKeyCustodyMechanism;
+    escrow(custodyId: string, tokenKeySecretValue: string): Promise<void>;
+    retrieve(custodyId: string): Promise<string | undefined>;
+    /**
+     * Remove a custody entry. Idempotent — a missing entry is a no-op. Used by
+     * the ADR-022 journaled link migration (T03) to drop the OLD custody id
+     * after the token key has been re-escrowed under the new owner's id and the
+     * control-plane commit has succeeded — never leaving a zero-entry window.
+     */
+    remove(custodyId: string): Promise<void>;
+}
+/** Deterministic custody reference for a runtime binding — never key bytes. */
+export declare function tokenKeyCustodyIdFor(input: {
+    readonly ownerId: string;
+    readonly projectId: string;
+    readonly environment: string;
+    readonly hubSpotAppId: string | number;
+}): string;
+export declare function sealTokenKeyCanary(tokenKeySecretValue: string): Promise<TokenKeyCanary>;
+/**
+ * Preflight-usable proof: does `tokenKeySecretValue` decrypt this canary?
+ * Read-only, mutation-free — safe to run against live custody any time.
+ */
+export declare function verifyTokenKeyCanary(canary: TokenKeyCanary, tokenKeySecretValue: string): Promise<boolean>;
+export declare function defaultTokenKeyCustodyStorePath(env?: NodeJS.ProcessEnv): string;
+export declare function defaultTokenKeyCustodyKeyPath(env?: NodeJS.ProcessEnv): string;
+export declare function createEncryptedFileTokenKeyCustodyAdapter(options?: {
+    readonly storePath?: string;
+    readonly keyPath?: string;
+}): TokenKeyCustodyAdapter;
+export interface KeychainCommandResult {
+    readonly exitCode: number;
+    readonly stdout: string;
+    readonly stderr: string;
+}
+export type KeychainCommandRunner = (args: readonly string[], stdin?: string) => Promise<KeychainCommandResult>;
+export declare function createDarwinKeychainTokenKeyCustodyAdapter(options?: {
+    readonly run?: KeychainCommandRunner;
+    readonly service?: string;
+}): TokenKeyCustodyAdapter;
+/**
+ * The adapter used for NEW escrows. Encrypted file everywhere by default;
+ * `HSX_TOKEN_KEY_CUSTODY=keychain` opts into the macOS Keychain,
+ * `HSX_TOKEN_KEY_CUSTODY=file` pins the file store explicitly.
+ */
+export declare function defaultTokenKeyCustodyAdapter(env?: NodeJS.ProcessEnv): TokenKeyCustodyAdapter;
+/** Resolve the adapter a stored custody reference points at. */
+export declare function tokenKeyCustodyAdapterFor(mechanism: TokenKeyCustodyMechanism, env?: NodeJS.ProcessEnv): TokenKeyCustodyAdapter;
+/**
+ * Escrow a freshly generated token key and return the custody reference +
+ * sealed canary for the binding record. Reads the key back and verifies the
+ * canary before returning, so a binding never records custody that didn't
+ * stick — an escrow failure aborts BEFORE any Cloudflare mutation.
+ */
+export declare function escrowTokenKey(input: {
+    readonly adapter: TokenKeyCustodyAdapter;
+    readonly custodyId: string;
+    readonly tokenKeySecretValue: string;
+    readonly now?: () => Date;
+}): Promise<EscrowedTokenKeyCustody>;
+/**
+ * Retrieve an escrowed token key and PROVE it by opening the sealed canary.
+ * Read-only — this is the primitive the ADR-022 no-mutation link preflight
+ * (T02) composes. Throws a typed, actionable `TokenKeyCustodyErrorCode`
+ * error on missing/corrupt custody; callers must not have mutated anything
+ * before calling it.
+ */
+export declare function resolveEscrowedTokenKey(input: {
+    readonly custody: EscrowedTokenKeyCustody;
+    readonly adapter?: TokenKeyCustodyAdapter;
+    readonly env?: NodeJS.ProcessEnv;
+}): Promise<string>;
+export {};
+//# sourceMappingURL=token-key-custody.d.ts.map

package/dist/token-key-custody.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-key-custody.d.ts","sourceRoot":"","sources":["../src/token-key-custody.ts"],"names":[],"mappings":"AA+BA,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG1C,MAAM,MAAM,wBAAwB,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,OAAO,CAAC,wBAAwB,CAAC,CAAC;AACnG,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,OAAO,CAAC,cAAc,CAAC,CAAC;AAC/E,MAAM,MAAM,uBAAuB,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,OAAO,CAAC,uBAAuB,CAAC,CAAC;AAiBjG,QAAA,MAAM,uBAAuB,wHAInB,CAAC;AACX,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhF,4EAA4E;AAC5E,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,wBAAwB,EAAE,MAAM,EAAE,MAAM,GAAG,QAAQ,CAI7F;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,QAAQ,CAIxE;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,SAAS,EAAE,wBAAwB,CAAC;IAC7C,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACzD;;;;;OAKG;IACH,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AAED,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC;CACxC,GAAG,MAAM,CAET;AAaD,wBAAsB,kBAAkB,CAAC,mBAAmB,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAW7F;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,cAAc,EACtB,mBAAmB,EAAE,MAAM,GAC1B,OAAO,CAAC,OAAO,CAAC,CAiBlB;AAoBD,wBAAgB,+BAA+B,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAI5F;AAED,wBAAgB,6BAA6B,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAI1F;AA2BD,wBAAgB,yCAAyC,CACvD,OAAO,GAAE;IAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAO,GACvE,sBAAsB,CA0HxB;AAMD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,qBAAqB,GAAG,CAClC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,KAAK,CAAC,EAAE,MAAM,KACX,OAAO,CAAC,qBAAqB,CAAC,CAAC;AA6BpC,wBAAgB,0CAA0C,CACxD,OAAO,GAAE;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,qBAAqB,CAAC;IAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAO,GAChF,sBAAsB,CAgDxB;AAWD;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC3C,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,sBAAsB,CAQxB;AAED,gEAAgE;AAChE,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,wBAAwB,EACnC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,sBAAsB,CAOxB;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE;IAC1C,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAiBnC;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAAC,KAAK,EAAE;IACnD,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,sBAAsB,CAAC;IAC1C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CAClC,GAAG,OAAO,CAAC,MAAM,CAAC,CAiBlB"}

package/dist/token-key-custody.js

@@ -0,0 +1,375 @@
+// ADR-022 — recoverable custody for the locally generated `HSX_TOKEN_KEY`.
+//
+// An unlinked deploy encrypts customer-portal OAuth blobs under a token key
+// that historically existed in exactly one place: the deployed Worker's
+// secret binding. Cloudflare secrets are write-only, so losing the binding
+// (or the machine) meant the key was gone and every install's OAuth blob was
+// unreadable. This module escrows the key AT CREATION in an approved
+// encrypted local custody and seals a canary under it, so any later
+// operation (redeploy, the ADR-022 link preflight) can retrieve the key and
+// PROVE it decrypts real install data without touching an OAuth blob.
+//
+// Mechanisms:
+// - `encrypted-file` (default on every platform): AES-256-GCM entries in
+//   `$XDG_STATE_HOME/hs-x/token-key-custody.json`, sealed with a random
+//   machine-scoped custody key at `token-key-custody.key` (0600, mirroring
+//   the machine-id and Cloudflare OAuth credential stores). Chosen as the
+//   default because the hs-x CLI must work headlessly — `security(1)` reads
+//   from a non-codesigned interpreter can raise GUI consent prompts, which
+//   would hang CI and agent runs.
+// - `darwin-keychain` (opt-in, `HSX_TOKEN_KEY_CUSTODY=keychain`): macOS
+//   Keychain generic passwords via `security -i` (stdin, so key bytes never
+//   appear in an argv/process listing).
+//
+// Never write the key bytes to: the binding record, the control plane,
+// stdout/stderr, logs, or deploy snapshots. The binding carries only a
+// custody REFERENCE and the sealed canary.
+import { spawn } from 'node:child_process';
+import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';
+import { chmod, mkdir, readFile, writeFile } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { Schema, schemas } from '@hs-x/types';
+import { CliError } from './cli-error.js';
+import { statePath } from './paths.js';
+const KEYCHAIN_SERVICE = 'dev.hs-x.token-key';
+const CANARY_MARKER = 'hsx-token-key-canary';
+/**
+ * How to recover when custody is gone. The deployed Worker still holds the
+ * key as a write-only secret, so there is no re-escrow path — this text is
+ * the honest recovery story and is embedded in every custody failure.
+ */
+const CUSTODY_RECOVERY_HINT = 'The key cannot be read back from the deployed Worker (Cloudflare secrets are write-only). ' +
+    'Restore the hs-x state directory (or macOS Keychain item) from a machine backup if you have one. ' +
+    'Without the key, existing portal installs keep working on the already-deployed Worker but cannot ' +
+    'be migrated or re-keyed — the only path forward is asking customers to reinstall, which re-encrypts ' +
+    'their OAuth grants under a fresh key. See docs/token-key-custody.md.';
+const TOKEN_KEY_CUSTODY_CODES = [
+    'HSX_E_TOKEN_KEY_CUSTODY_MISSING',
+    'HSX_E_TOKEN_KEY_CUSTODY_CORRUPT',
+    'HSX_E_TOKEN_KEY_CUSTODY_UNAVAILABLE',
+];
+/** Typed, actionable custody failure. `code` is an errors-registry code. */
+export function tokenKeyCustodyError(code, detail) {
+    // The deploy quarantine seam renders only `message`, so the code rides in
+    // the message text to stay visible (and greppable) in every output mode.
+    return new CliError({ code, message: `${code}: ${detail} ${CUSTODY_RECOVERY_HINT}` });
+}
+export function isTokenKeyCustodyError(error) {
+    return (error instanceof CliError && TOKEN_KEY_CUSTODY_CODES.includes(error.code));
+}
+/** Deterministic custody reference for a runtime binding — never key bytes. */
+export function tokenKeyCustodyIdFor(input) {
+    return `hsx-token-key/${input.ownerId}/${input.projectId}/${input.environment}/${input.hubSpotAppId}`;
+}
+// ---------------------------------------------------------------------------
+// Canary — seal/verify with EXACTLY the runtime's key derivation
+// (AES-GCM under SHA-256 of the key string; ciphertext carries the GCM tag),
+// so "the canary opens" ⇒ "the Worker's OAuth blobs open".
+// ---------------------------------------------------------------------------
+async function importAesKey(secret) {
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(secret));
+    return crypto.subtle.importKey('raw', digest, 'AES-GCM', false, ['encrypt', 'decrypt']);
+}
+export async function sealTokenKeyCanary(tokenKeySecretValue) {
+    const key = await importAesKey(tokenKeySecretValue);
+    const iv = crypto.getRandomValues(new Uint8Array(12));
+    const plaintext = new TextEncoder().encode(JSON.stringify({ hsx: CANARY_MARKER, v: 1 }));
+    const ciphertext = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, key, plaintext);
+    return Schema.decodeUnknownSync(schemas.TokenKeyCanary)({
+        v: 1,
+        alg: 'AES-GCM',
+        iv: Buffer.from(iv).toString('base64'),
+        ciphertext: Buffer.from(new Uint8Array(ciphertext)).toString('base64'),
+    });
+}
+/**
+ * Preflight-usable proof: does `tokenKeySecretValue` decrypt this canary?
+ * Read-only, mutation-free — safe to run against live custody any time.
+ */
+export async function verifyTokenKeyCanary(canary, tokenKeySecretValue) {
+    try {
+        const key = await importAesKey(tokenKeySecretValue);
+        const plaintext = await crypto.subtle.decrypt({ name: 'AES-GCM', iv: Buffer.from(canary.iv, 'base64') }, key, Buffer.from(canary.ciphertext, 'base64'));
+        const parsed = JSON.parse(new TextDecoder().decode(plaintext));
+        return (typeof parsed === 'object' &&
+            parsed !== null &&
+            parsed.hsx === CANARY_MARKER);
+    }
+    catch {
+        return false;
+    }
+}
+export function defaultTokenKeyCustodyStorePath(env = process.env) {
+    const override = env.HSX_TOKEN_KEY_CUSTODY_PATH;
+    if (override && override.length > 0)
+        return override;
+    return statePath('token-key-custody.json');
+}
+export function defaultTokenKeyCustodyKeyPath(env = process.env) {
+    const override = env.HSX_TOKEN_KEY_CUSTODY_KEY_PATH;
+    if (override && override.length > 0)
+        return override;
+    return statePath('token-key-custody.key');
+}
+async function loadOrCreateCustodyMasterKey(keyPath) {
+    try {
+        const raw = (await readFile(keyPath, 'utf8')).trim();
+        const key = Buffer.from(raw, 'base64');
+        if (key.length !== 32) {
+            throw tokenKeyCustodyError('HSX_E_TOKEN_KEY_CUSTODY_CORRUPT', `The custody master key at ${keyPath} is not a 32-byte base64 key.`);
+        }
+        return key;
+    }
+    catch (error) {
+        if (isTokenKeyCustodyError(error))
+            throw error;
+        const key = randomBytes(32);
+        await mkdir(dirname(keyPath), { recursive: true, mode: 0o700 });
+        await writeFile(keyPath, `${key.toString('base64')}\n`, { encoding: 'utf8', mode: 0o600 });
+        try {
+            await chmod(keyPath, 0o600);
+        }
+        catch {
+            // Best effort on platforms without POSIX permissions.
+        }
+        return key;
+    }
+}
+export function createEncryptedFileTokenKeyCustodyAdapter(options = {}) {
+    const storePath = options.storePath ?? defaultTokenKeyCustodyStorePath();
+    const keyPath = options.keyPath ?? defaultTokenKeyCustodyKeyPath();
+    const loadStore = async () => {
+        let raw;
+        try {
+            raw = await readFile(storePath, 'utf8');
+        }
+        catch {
+            return undefined; // no store yet — every entry is "missing", not corrupt
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            throw tokenKeyCustodyError('HSX_E_TOKEN_KEY_CUSTODY_CORRUPT', `The token-key custody store at ${storePath} is not valid JSON.`);
+        }
+        if (typeof parsed !== 'object' ||
+            parsed === null ||
+            parsed.schemaVersion !== 1 ||
+            typeof parsed.entries !== 'object') {
+            throw tokenKeyCustodyError('HSX_E_TOKEN_KEY_CUSTODY_CORRUPT', `The token-key custody store at ${storePath} has an unexpected shape.`);
+        }
+        return parsed;
+    };
+    return {
+        mechanism: 'encrypted-file',
+        async escrow(custodyId, tokenKeySecretValue) {
+            const masterKey = await loadOrCreateCustodyMasterKey(keyPath);
+            const store = (await loadStore()) ?? { schemaVersion: 1, entries: {} };
+            const iv = randomBytes(12);
+            const cipher = createCipheriv('aes-256-gcm', masterKey, iv);
+            const ciphertext = Buffer.concat([
+                cipher.update(tokenKeySecretValue, 'utf8'),
+                cipher.final(),
+            ]);
+            const next = {
+                schemaVersion: 1,
+                entries: {
+                    ...store.entries,
+                    [custodyId]: {
+                        v: 1,
+                        alg: 'aes-256-gcm',
+                        iv: iv.toString('base64'),
+                        ciphertext: ciphertext.toString('base64'),
+                        tag: cipher.getAuthTag().toString('base64'),
+                        updatedAt: new Date().toISOString(),
+                    },
+                },
+            };
+            await mkdir(dirname(storePath), { recursive: true, mode: 0o700 });
+            await writeFile(storePath, `${JSON.stringify(next, null, 2)}\n`, {
+                encoding: 'utf8',
+                mode: 0o600,
+            });
+            try {
+                await chmod(storePath, 0o600);
+            }
+            catch {
+                // Best effort on platforms without POSIX permissions.
+            }
+        },
+        async retrieve(custodyId) {
+            const store = await loadStore();
+            const entry = store?.entries[custodyId];
+            if (!entry)
+                return undefined;
+            if (entry.v !== 1 ||
+                entry.alg !== 'aes-256-gcm' ||
+                typeof entry.iv !== 'string' ||
+                typeof entry.ciphertext !== 'string' ||
+                typeof entry.tag !== 'string') {
+                throw tokenKeyCustodyError('HSX_E_TOKEN_KEY_CUSTODY_CORRUPT', `The custody entry for ${custodyId} in ${storePath} has an unexpected shape.`);
+            }
+            const masterKey = await loadOrCreateCustodyMasterKey(keyPath);
+            try {
+                const decipher = createDecipheriv('aes-256-gcm', masterKey, Buffer.from(entry.iv, 'base64'));
+                decipher.setAuthTag(Buffer.from(entry.tag, 'base64'));
+                return Buffer.concat([
+                    decipher.update(Buffer.from(entry.ciphertext, 'base64')),
+                    decipher.final(),
+                ]).toString('utf8');
+            }
+            catch {
+                throw tokenKeyCustodyError('HSX_E_TOKEN_KEY_CUSTODY_CORRUPT', `The custody entry for ${custodyId} in ${storePath} does not decrypt with the custody master key at ${keyPath}.`);
+            }
+        },
+        async remove(custodyId) {
+            const store = await loadStore();
+            if (!store || !(custodyId in store.entries))
+                return; // idempotent
+            const { [custodyId]: _removed, ...entries } = store.entries;
+            const next = { schemaVersion: 1, entries };
+            await mkdir(dirname(storePath), { recursive: true, mode: 0o700 });
+            await writeFile(storePath, `${JSON.stringify(next, null, 2)}\n`, {
+                encoding: 'utf8',
+                mode: 0o600,
+            });
+            try {
+                await chmod(storePath, 0o600);
+            }
+            catch {
+                // Best effort on platforms without POSIX permissions.
+            }
+        },
+    };
+}
+function runSecurityCommand(args, stdin) {
+    return new Promise((resolve, reject) => {
+        const child = spawn('security', args, {
+            stdio: [stdin === undefined ? 'ignore' : 'pipe', 'pipe', 'pipe'],
+        });
+        let stdout = '';
+        let stderr = '';
+        child.stdout?.setEncoding('utf8');
+        child.stderr?.setEncoding('utf8');
+        child.stdout?.on('data', (chunk) => {
+            stdout += chunk;
+        });
+        child.stderr?.on('data', (chunk) => {
+            stderr += chunk;
+        });
+        if (stdin !== undefined)
+            child.stdin?.end(stdin);
+        child.on('error', reject);
+        child.on('exit', (code) => resolve({ exitCode: code ?? 1, stdout, stderr }));
+    });
+}
+/** errSecItemNotFound — `security find-generic-password` for a missing item. */
+const SECURITY_ITEM_NOT_FOUND_EXIT = 44;
+export function createDarwinKeychainTokenKeyCustodyAdapter(options = {}) {
+    const run = options.run ?? runSecurityCommand;
+    const service = options.service ?? KEYCHAIN_SERVICE;
+    return {
+        mechanism: 'darwin-keychain',
+        async escrow(custodyId, tokenKeySecretValue) {
+            // `security -i` reads commands from stdin, so the key never appears in
+            // an argv/process listing. -U updates an existing item in place.
+            const line = `add-generic-password -U -s ${quoteKeychainArg(service)} -a ${quoteKeychainArg(custodyId)} -w ${quoteKeychainArg(tokenKeySecretValue)}\n`;
+            const result = await run(['-i'], line);
+            if (result.exitCode !== 0) {
+                throw tokenKeyCustodyError('HSX_E_TOKEN_KEY_CUSTODY_UNAVAILABLE', `Escrowing the token key into the macOS Keychain failed (security exited ${result.exitCode}).`);
+            }
+        },
+        async retrieve(custodyId) {
+            const result = await run(['find-generic-password', '-s', service, '-a', custodyId, '-w']);
+            if (result.exitCode === SECURITY_ITEM_NOT_FOUND_EXIT)
+                return undefined;
+            if (result.exitCode !== 0) {
+                throw tokenKeyCustodyError('HSX_E_TOKEN_KEY_CUSTODY_UNAVAILABLE', `Reading the token key from the macOS Keychain failed (security exited ${result.exitCode}).`);
+            }
+            const value = result.stdout.replace(/\n$/, '');
+            if (value.length === 0) {
+                throw tokenKeyCustodyError('HSX_E_TOKEN_KEY_CUSTODY_CORRUPT', `The macOS Keychain item for ${custodyId} is empty.`);
+            }
+            return value;
+        },
+        async remove(custodyId) {
+            const result = await run(['delete-generic-password', '-s', service, '-a', custodyId]);
+            // errSecItemNotFound (44) means the item is already gone — idempotent.
+            if (result.exitCode !== 0 && result.exitCode !== SECURITY_ITEM_NOT_FOUND_EXIT) {
+                throw tokenKeyCustodyError('HSX_E_TOKEN_KEY_CUSTODY_UNAVAILABLE', `Removing the token key from the macOS Keychain failed (security exited ${result.exitCode}).`);
+            }
+        },
+    };
+}
+function quoteKeychainArg(value) {
+    return `"${value.replaceAll('\\', '\\\\').replaceAll('"', '\\"')}"`;
+}
+// ---------------------------------------------------------------------------
+// Selection + high-level escrow/resolve (what deploy and the ADR-022 link
+// preflight call)
+// ---------------------------------------------------------------------------
+/**
+ * The adapter used for NEW escrows. Encrypted file everywhere by default;
+ * `HSX_TOKEN_KEY_CUSTODY=keychain` opts into the macOS Keychain,
+ * `HSX_TOKEN_KEY_CUSTODY=file` pins the file store explicitly.
+ */
+export function defaultTokenKeyCustodyAdapter(env = process.env) {
+    if (env.HSX_TOKEN_KEY_CUSTODY === 'keychain') {
+        return createDarwinKeychainTokenKeyCustodyAdapter();
+    }
+    return createEncryptedFileTokenKeyCustodyAdapter({
+        storePath: defaultTokenKeyCustodyStorePath(env),
+        keyPath: defaultTokenKeyCustodyKeyPath(env),
+    });
+}
+/** Resolve the adapter a stored custody reference points at. */
+export function tokenKeyCustodyAdapterFor(mechanism, env = process.env) {
+    return mechanism === 'darwin-keychain'
+        ? createDarwinKeychainTokenKeyCustodyAdapter()
+        : createEncryptedFileTokenKeyCustodyAdapter({
+            storePath: defaultTokenKeyCustodyStorePath(env),
+            keyPath: defaultTokenKeyCustodyKeyPath(env),
+        });
+}
+/**
+ * Escrow a freshly generated token key and return the custody reference +
+ * sealed canary for the binding record. Reads the key back and verifies the
+ * canary before returning, so a binding never records custody that didn't
+ * stick — an escrow failure aborts BEFORE any Cloudflare mutation.
+ */
+export async function escrowTokenKey(input) {
+    await input.adapter.escrow(input.custodyId, input.tokenKeySecretValue);
+    const readBack = await input.adapter.retrieve(input.custodyId);
+    if (readBack !== input.tokenKeySecretValue) {
+        throw tokenKeyCustodyError('HSX_E_TOKEN_KEY_CUSTODY_UNAVAILABLE', `Escrow read-back for ${input.custodyId} did not return the escrowed key (${input.adapter.mechanism}).`);
+    }
+    const canary = await sealTokenKeyCanary(input.tokenKeySecretValue);
+    return Schema.decodeUnknownSync(schemas.EscrowedTokenKeyCustody)({
+        kind: 'escrowed',
+        mechanism: input.adapter.mechanism,
+        custodyId: input.custodyId,
+        escrowedAt: (input.now ? input.now() : new Date()).toISOString(),
+        canary,
+    });
+}
+/**
+ * Retrieve an escrowed token key and PROVE it by opening the sealed canary.
+ * Read-only — this is the primitive the ADR-022 no-mutation link preflight
+ * (T02) composes. Throws a typed, actionable `TokenKeyCustodyErrorCode`
+ * error on missing/corrupt custody; callers must not have mutated anything
+ * before calling it.
+ */
+export async function resolveEscrowedTokenKey(input) {
+    const adapter = input.adapter ?? tokenKeyCustodyAdapterFor(input.custody.mechanism, input.env);
+    const tokenKeySecretValue = await adapter.retrieve(input.custody.custodyId);
+    if (tokenKeySecretValue === undefined) {
+        throw tokenKeyCustodyError('HSX_E_TOKEN_KEY_CUSTODY_MISSING', `The escrowed HSX_TOKEN_KEY for ${input.custody.custodyId} is missing from local custody (${input.custody.mechanism}).`);
+    }
+    const proven = await verifyTokenKeyCanary(input.custody.canary, tokenKeySecretValue);
+    if (!proven) {
+        throw tokenKeyCustodyError('HSX_E_TOKEN_KEY_CUSTODY_CORRUPT', `The key in custody for ${input.custody.custodyId} does not open the binding's sealed canary — it is not the key the deployed Worker encrypts with.`);
+    }
+    return tokenKeySecretValue;
+}
+//# sourceMappingURL=token-key-custody.js.map

package/dist/token-key-custody.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-key-custody.js","sourceRoot":"","sources":["../src/token-key-custody.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,EAAE;AACF,4EAA4E;AAC5E,wEAAwE;AACxE,2EAA2E;AAC3E,6EAA6E;AAC7E,qEAAqE;AACrE,oEAAoE;AACpE,4EAA4E;AAC5E,sEAAsE;AACtE,EAAE;AACF,cAAc;AACd,yEAAyE;AACzE,wEAAwE;AACxE,2EAA2E;AAC3E,0EAA0E;AAC1E,4EAA4E;AAC5E,2EAA2E;AAC3E,kCAAkC;AAClC,wEAAwE;AACxE,4EAA4E;AAC5E,wCAAwC;AACxC,EAAE;AACF,uEAAuE;AACvE,uEAAuE;AACvE,2CAA2C;AAE3C,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAMvC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAC9C,MAAM,aAAa,GAAG,sBAAsB,CAAC;AAE7C;;;;GAIG;AACH,MAAM,qBAAqB,GACzB,4FAA4F;IAC5F,mGAAmG;IACnG,mGAAmG;IACnG,sGAAsG;IACtG,sEAAsE,CAAC;AAEzE,MAAM,uBAAuB,GAAG;IAC9B,iCAAiC;IACjC,iCAAiC;IACjC,qCAAqC;CAC7B,CAAC;AAGX,4EAA4E;AAC5E,MAAM,UAAU,oBAAoB,CAAC,IAA8B,EAAE,MAAc;IACjF,0EAA0E;IAC1E,yEAAyE;IACzE,OAAO,IAAI,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,KAAK,MAAM,IAAI,qBAAqB,EAAE,EAAE,CAAC,CAAC;AACxF,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,OAAO,CACL,KAAK,YAAY,QAAQ,IAAK,uBAA6C,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CACjG,CAAC;AACJ,CAAC;AAqBD,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,KAKpC;IACC,OAAO,iBAAiB,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;AACxG,CAAC;AAED,8EAA8E;AAC9E,iEAAiE;AACjE,6EAA6E;AAC7E,2DAA2D;AAC3D,8EAA8E;AAE9E,KAAK,UAAU,YAAY,CAAC,MAAc;IACxC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACvF,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,mBAA2B;IAClE,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,mBAAmB,CAAC,CAAC;IACpD,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACzF,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IACxF,OAAO,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACtD,CAAC,EAAE,CAAC;QACJ,GAAG,EAAE,SAAS;QACd,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACtC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;KACvE,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAsB,EACtB,mBAA2B;IAE3B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,mBAAmB,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC3C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,EACzD,GAAG,EACH,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,CACzC,CAAC;QACF,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QACxE,OAAO,CACL,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,KAAK,IAAI;YACd,MAA4B,CAAC,GAAG,KAAK,aAAa,CACpD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAoBD,MAAM,UAAU,+BAA+B,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClF,MAAM,QAAQ,GAAG,GAAG,CAAC,0BAA0B,CAAC;IAChD,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IACrD,OAAO,SAAS,CAAC,wBAAwB,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,MAAyB,OAAO,CAAC,GAAG;IAChF,MAAM,QAAQ,GAAG,GAAG,CAAC,8BAA8B,CAAC;IACpD,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IACrD,OAAO,SAAS,CAAC,uBAAuB,CAAC,CAAC;AAC5C,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,OAAe;IACzD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACvC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACtB,MAAM,oBAAoB,CACxB,iCAAiC,EACjC,6BAA6B,OAAO,+BAA+B,CACpE,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,sBAAsB,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QAC/C,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC5B,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAChE,MAAM,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,sDAAsD;QACxD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED,MAAM,UAAU,yCAAyC,CACvD,UAAsE,EAAE;IAExE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,+BAA+B,EAAE,CAAC;IACzE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,6BAA6B,EAAE,CAAC;IAEnE,MAAM,SAAS,GAAG,KAAK,IAA6C,EAAE;QACpE,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,CAAC,uDAAuD;QAC3E,CAAC;QACD,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,oBAAoB,CACxB,iCAAiC,EACjC,kCAAkC,SAAS,qBAAqB,CACjE,CAAC;QACJ,CAAC;QACD,IACE,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,KAAK,IAAI;YACd,MAAsC,CAAC,aAAa,KAAK,CAAC;YAC3D,OAAQ,MAAgC,CAAC,OAAO,KAAK,QAAQ,EAC7D,CAAC;YACD,MAAM,oBAAoB,CACxB,iCAAiC,EACjC,kCAAkC,SAAS,2BAA2B,CACvE,CAAC;QACJ,CAAC;QACD,OAAO,MAA4B,CAAC;IACtC,CAAC,CAAC;IAEF,OAAO;QACL,SAAS,EAAE,gBAAgB;QAC3B,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,mBAAmB;YACzC,MAAM,SAAS,GAAG,MAAM,4BAA4B,CAAC,OAAO,CAAC,CAAC;YAC9D,MAAM,KAAK,GAAG,CAAC,MAAM,SAAS,EAAE,CAAC,IAAI,EAAE,aAAa,EAAE,CAAU,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YAChF,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;YAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;YAC5D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC/B,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC;gBAC1C,MAAM,CAAC,KAAK,EAAE;aACf,CAAC,CAAC;YACH,MAAM,IAAI,GAAuB;gBAC/B,aAAa,EAAE,CAAC;gBAChB,OAAO,EAAE;oBACP,GAAG,KAAK,CAAC,OAAO;oBAChB,CAAC,SAAS,CAAC,EAAE;wBACX,CAAC,EAAE,CAAC;wBACJ,GAAG,EAAE,aAAa;wBAClB,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;wBACzB,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;wBACzC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;wBAC3C,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;qBACpC;iBACF;aACF,CAAC;YACF,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAClE,MAAM,SAAS,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;gBAC/D,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,KAAK;aACZ,CAAC,CAAC;YACH,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,sDAAsD;YACxD,CAAC;QACH,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,SAAS;YACtB,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;YACxC,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YAC7B,IACE,KAAK,CAAC,CAAC,KAAK,CAAC;gBACb,KAAK,CAAC,GAAG,KAAK,aAAa;gBAC3B,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;gBAC5B,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;gBACpC,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,EAC7B,CAAC;gBACD,MAAM,oBAAoB,CACxB,iCAAiC,EACjC,yBAAyB,SAAS,OAAO,SAAS,2BAA2B,CAC9E,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,4BAA4B,CAAC,OAAO,CAAC,CAAC;YAC9D,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,aAAa,EACb,SAAS,EACT,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,CAChC,CAAC;gBACF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;gBACtD,OAAO,MAAM,CAAC,MAAM,CAAC;oBACnB,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;oBACxD,QAAQ,CAAC,KAAK,EAAE;iBACjB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,oBAAoB,CACxB,iCAAiC,EACjC,yBAAyB,SAAS,OAAO,SAAS,oDAAoD,OAAO,GAAG,CACjH,CAAC;YACJ,CAAC;QACH,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,SAAS;YACpB,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC;gBAAE,OAAO,CAAC,aAAa;YAClE,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC;YAC5D,MAAM,IAAI,GAAuB,EAAE,aAAa,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;YAC/D,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAClE,MAAM,SAAS,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;gBAC/D,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,KAAK;aACZ,CAAC,CAAC;YACH,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,sDAAsD;YACxD,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAiBD,SAAS,kBAAkB,CACzB,IAAuB,EACvB,KAAc;IAEd,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE;YACpC,KAAK,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SACjE,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YACjC,MAAM,IAAI,KAAK,CAAC;QAClB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YACjC,MAAM,IAAI,KAAK,CAAC;QAClB,CAAC,CAAC,CAAC;QACH,IAAI,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QACjD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,MAAM,4BAA4B,GAAG,EAAE,CAAC;AAExC,MAAM,UAAU,0CAA0C,CACxD,UAA+E,EAAE;IAEjF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,kBAAkB,CAAC;IAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;IACpD,OAAO;QACL,SAAS,EAAE,iBAAiB;QAC5B,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,mBAAmB;YACzC,uEAAuE;YACvE,iEAAiE;YACjE,MAAM,IAAI,GAAG,8BAA8B,gBAAgB,CAAC,OAAO,CAAC,OAAO,gBAAgB,CACzF,SAAS,CACV,OAAO,gBAAgB,CAAC,mBAAmB,CAAC,IAAI,CAAC;YAClD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;YACvC,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,oBAAoB,CACxB,qCAAqC,EACrC,2EAA2E,MAAM,CAAC,QAAQ,IAAI,CAC/F,CAAC;YACJ,CAAC;QACH,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,SAAS;YACtB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;YAC1F,IAAI,MAAM,CAAC,QAAQ,KAAK,4BAA4B;gBAAE,OAAO,SAAS,CAAC;YACvE,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,oBAAoB,CACxB,qCAAqC,EACrC,yEAAyE,MAAM,CAAC,QAAQ,IAAI,CAC7F,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC/C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,oBAAoB,CACxB,iCAAiC,EACjC,+BAA+B,SAAS,YAAY,CACrD,CAAC;YACJ,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,SAAS;YACpB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,yBAAyB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;YACtF,uEAAuE;YACvE,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,KAAK,4BAA4B,EAAE,CAAC;gBAC9E,MAAM,oBAAoB,CACxB,qCAAqC,EACrC,0EAA0E,MAAM,CAAC,QAAQ,IAAI,CAC9F,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC;AACtE,CAAC;AAED,8EAA8E;AAC9E,0EAA0E;AAC1E,kBAAkB;AAClB,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAC3C,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,GAAG,CAAC,qBAAqB,KAAK,UAAU,EAAE,CAAC;QAC7C,OAAO,0CAA0C,EAAE,CAAC;IACtD,CAAC;IACD,OAAO,yCAAyC,CAAC;QAC/C,SAAS,EAAE,+BAA+B,CAAC,GAAG,CAAC;QAC/C,OAAO,EAAE,6BAA6B,CAAC,GAAG,CAAC;KAC5C,CAAC,CAAC;AACL,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,yBAAyB,CACvC,SAAmC,EACnC,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,SAAS,KAAK,iBAAiB;QACpC,CAAC,CAAC,0CAA0C,EAAE;QAC9C,CAAC,CAAC,yCAAyC,CAAC;YACxC,SAAS,EAAE,+BAA+B,CAAC,GAAG,CAAC;YAC/C,OAAO,EAAE,6BAA6B,CAAC,GAAG,CAAC;SAC5C,CAAC,CAAC;AACT,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAKpC;IACC,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/D,IAAI,QAAQ,KAAK,KAAK,CAAC,mBAAmB,EAAE,CAAC;QAC3C,MAAM,oBAAoB,CACxB,qCAAqC,EACrC,wBAAwB,KAAK,CAAC,SAAS,qCAAqC,KAAK,CAAC,OAAO,CAAC,SAAS,IAAI,CACxG,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;QAC/D,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAClC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;QAChE,MAAM;KACP,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAI7C;IACC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,yBAAyB,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/F,MAAM,mBAAmB,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5E,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,oBAAoB,CACxB,iCAAiC,EACjC,kCAAkC,KAAK,CAAC,OAAO,CAAC,SAAS,mCAAmC,KAAK,CAAC,OAAO,CAAC,SAAS,IAAI,CACxH,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACrF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,oBAAoB,CACxB,iCAAiC,EACjC,0BAA0B,KAAK,CAAC,OAAO,CAAC,SAAS,mGAAmG,CACrJ,CAAC;IACJ,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC"}