@intutic/cli 1.10.0 → 2.0.0

package/dist/commands/integrity.js

@@ -0,0 +1,620 @@
+/**
+ * `intutic integrity` — check that sealed trace roots still re-derive.
+ *
+ * Subcommands:
+ *   - `intutic integrity roots [--loop-run <id>] [--json]`
+ *   - `intutic integrity verify <root_id> [--json]`
+ *   - `intutic integrity chain [--json]`
+ *   - `intutic integrity config-chain [--json]`
+ *
+ * The exit status is the point. This is what a customer puts in CI, so the
+ * findings that mean "the record no longer matches what was sealed" — a
+ * re-derivation mismatch, a covered trace that is gone, a signature a published
+ * key rejects, a break in the root chain, a break or an edited body in the
+ * config snapshot chain — leave with 1. Everything else leaves with 0,
+ * including the states that look alarming and are not: a root sealed under a
+ * key that is no longer published, and a root or snapshot that names no
+ * predecessor. See `failsIntegrity`.
+ *
+ * Server side: services/control-plane/src/routes/integrity.ts.
+ *
+ * @module
+ */
+import { createPublicKey, verify as nodeVerify } from 'node:crypto';
+import { log } from '../lib/logger.js';
+import { NOT_AUTHENTICATED } from '../lib/authMessages.js';
+import { loadCredentials } from '../config/store.js';
+import { resolveControlPlaneUrl } from '../config/paths.js';
+import { createApiClient } from '../lib/api.js';
+import pc from 'picocolors';
+/** The version to rebuild a root's preimage under. See the field's note above. */
+function preimageVersionOf(root) {
+    return root.signing_preimage_version ?? 1;
+}
+/**
+ * Domain tag per preimage version, mirroring `SIGN_DOMAIN` in
+ * services/control-plane/src/lib/rootSigner.ts. This map is also the list of
+ * versions this build can rebuild — kept as one thing rather than two, because
+ * two lists of the same fact drift and the drift is silent.
+ */
+const SIGN_DOMAIN = {
+    1: 'intutic.merkle-root.v1',
+    2: 'intutic.merkle-root.v2',
+};
+/**
+ * Whether a finding should fail the command, and therefore the customer's CI.
+ *
+ * `unverifiable` deliberately does not. A root whose `signing_key_id` is not in
+ * the published JWKS says the operator dropped a rotated-out key from
+ * `TRACE_SIGNING_RETIRED_KEYS`; a root whose `signing_preimage_version` this
+ * build does not know says the CLI is older than the control plane. Neither
+ * says anything is wrong with the root. Failing on either accuses them of
+ * rewriting history over a key-management gap or a version skew, which is the
+ * distinction rootSigner.ts exists to preserve.
+ *
+ * `keys_unavailable` does not either — a control plane we could not reach for
+ * the JWKS is a fact about the network, not about the root.
+ *
+ * A chain finding reads `breaks` and never `unchainedRootIds`: an unchained
+ * root claimed no predecessor, so it contradicts nothing. It is also what a
+ * pre-migration-108 writer produces during a rolling deploy, so failing on it
+ * would make every deploy red.
+ *
+ * `configChain` fails on either of its two findings, and they are carried as
+ * two counts rather than one total because they have different causes: a break
+ * means a snapshot beside this one went missing, a content mismatch means this
+ * snapshot's own body was rewritten under its stored hash. Both contradict a
+ * claim the writer made, so both are failures — but a caller that had only a
+ * sum could not tell an operator which happened.
+ */
+export function failsIntegrity(finding) {
+    switch (finding.kind) {
+        case 'recompute':
+            return finding.verdict !== 'match';
+        case 'signature':
+            return finding.state === 'invalid';
+        case 'chain':
+            return finding.breaks > 0;
+        case 'configChain':
+            return finding.breaks > 0 || finding.contentMismatches > 0;
+    }
+}
+// ─── Signature verification ─────────────────────────────────────────
+/**
+ * The exact bytes the control plane signs, per preimage version.
+ *
+ * Must stay byte-identical to `signingPreimage` in
+ * services/control-plane/src/lib/rootSigner.ts — this is an independent
+ * verifier, so it rebuilds the preimage rather than being handed it. The scope
+ * fields are in the preimage because a signature over the bare 32-byte root
+ * would be portable to another workspace's row.
+ *
+ * v1 is the encoding of migration 107 and is retained verbatim: roots sealed
+ * under it are still in the ledger, and rebuilding them any other way reports a
+ * forgery on rows nobody touched. v2 adds `previous_root` behind a presence
+ * tag, because without it the chain link that makes root deletion detectable
+ * sat outside the signature and could be rewritten freely.
+ *
+ * The version comes off the root itself and is never a parameter. A caller that
+ * could pass one is a caller that can pass the wrong one, and the wrong one
+ * produces `invalid` — the verdict that accuses an operator of forgery.
+ */
+export function signingPreimage(root) {
+    const US = '\x1f';
+    const version = preimageVersionOf(root);
+    const domain = SIGN_DOMAIN[version];
+    if (domain === undefined) {
+        // Unreachable from `verifyRootSignature`, which reports an unknown version
+        // as unverifiable before it gets here. It throws rather than falling back
+        // to the newest encoding because a fallback would confidently produce bytes
+        // that were never signed, and the key would then say "forged".
+        throw new RangeError(`integrity: unknown signing preimage version ${version}`);
+    }
+    const fields = [
+        domain,
+        root.workspace_id,
+        root.loop_run_id ?? '',
+        String(root.leaf_schema_version),
+        root.merkle_root,
+    ];
+    if (version >= 2) {
+        // Presence tag then value, matching rootSigner.ts. "No predecessor" is a
+        // claim about the chain, not a missing field, so it must not encode the
+        // same as some value could.
+        //
+        // Normalised through `?? null` rather than compared against `null` directly:
+        // this row is parsed from JSON, and a server that omits the key rather than
+        // serialising a null would otherwise be tagged present-with-empty-value here
+        // while the control plane and the dashboard both tag it absent. Two of our
+        // own verifiers disagreeing on one root is how an auditor gets handed a
+        // forgery verdict we manufactured.
+        const previous = root.previous_root ?? null;
+        fields.push(previous === null ? '0' : '1', previous ?? '');
+    }
+    return fields.join(US);
+}
+/**
+ * Check a root's signature against the key the root itself names.
+ *
+ * Selection is by `signing_key_id`, never "any key that works": a root sealed
+ * under a rotated-out key must verify against that key years later, and a root
+ * that verifies under some *other* published key is not the same claim.
+ */
+export function verifyRootSignature(root, jwks) {
+    if (!root.signature || !root.signing_key_id)
+        return 'unsigned';
+    if (!jwks)
+        return 'keys_unavailable';
+    const jwk = jwks.keys.find((k) => k['kid'] === root.signing_key_id);
+    if (!jwk)
+        return 'unverifiable';
+    // An algorithm this build cannot compute is another "no verdict", not a
+    // rejection. Only EdDSA is ever written today (rootSigner.ts signs nothing
+    // else), so this is the forward-compatible branch.
+    if (root.signature_alg !== 'EdDSA')
+        return 'unverifiable';
+    // And exactly the same for a preimage this build cannot rebuild. A newer
+    // control plane sealing under v3 while a customer's CI still runs last
+    // quarter's CLI is the ordinary case. Whatever bytes we produced for it would
+    // not be the bytes that were signed, so we would either print INVALID and
+    // exit 1 over a version skew, or — worse — reconstruct something that happens
+    // to match and report `valid` for a check we did not actually perform.
+    // Nothing here settles it either way, which is what `unverifiable` means.
+    if (SIGN_DOMAIN[preimageVersionOf(root)] === undefined)
+        return 'unverifiable';
+    try {
+        const key = createPublicKey({ key: jwk, format: 'jwk' });
+        const ok = nodeVerify(null, Buffer.from(signingPreimage(root), 'utf8'), key, Buffer.from(root.signature, 'base64'));
+        return ok ? 'valid' : 'invalid';
+    }
+    catch {
+        // A published key we cannot load is a key we do not effectively hold. That
+        // is the unverifiable case, not a rejection by a key we do hold.
+        return 'unverifiable';
+    }
+}
+/** Where the verification keys are published. Unauthenticated by design. */
+const JWKS_PATH = '/.well-known/intutic-trace-signing.json';
+/**
+ * Fetch the published verification keys, or null when they cannot be had.
+ *
+ * No credentials: an auditor who must hold your API key to obtain the verifying
+ * key is not an external auditor, and this command must exercise the same path
+ * one of them would.
+ */
+async function fetchSigningKeys(controlPlaneUrl) {
+    try {
+        const res = await fetch(`${controlPlaneUrl}${JWKS_PATH}`);
+        if (!res.ok)
+            return null;
+        const body = (await res.json());
+        return Array.isArray(body?.keys) ? body : null;
+    }
+    catch {
+        return null;
+    }
+}
+// ─── Formatting helpers ─────────────────────────────────────────────
+/** Truncate an id for table display. */
+function truncateId(id) {
+    if (id.length <= 20)
+        return id;
+    return id.slice(0, 17) + '...';
+}
+/** Format ISO timestamp for compact table display. */
+function formatTimestamp(iso) {
+    if (!iso)
+        return '—';
+    const d = new Date(iso);
+    const pad2 = (n) => String(n).padStart(2, '0');
+    return `${d.getFullYear()}-${pad2(d.getMonth() + 1)}-${pad2(d.getDate())} ${pad2(d.getHours())}:${pad2(d.getMinutes())}`;
+}
+/** Pad a string to a fixed width (right-pad with spaces). */
+/**
+ * ANSI escapes are zero-width. Measuring and slicing raw string length counts
+ * them, so a coloured cell is both mis-padded and cut mid-escape.
+ *
+ * `pc.yellow('unverifiable')` is 22 characters of which 12 are visible. Against
+ * a 13-wide column the old `slice(0, width)` cut after `ESC[33munver`, leaving a
+ * truncated word and an unterminated escape sequence that bleeds colour into
+ * everything after it. It looked fine locally only because picocolors disables
+ * colour when stdout is not a TTY — so the bug was invisible in a pipe and
+ * present in every real terminal.
+ */
+// eslint-disable-next-line no-control-regex -- ESC (\u001b) opens every SGR colour sequence; matching it is this pattern's whole purpose.
+const ANSI = /\u001b\[[0-9;]*m/g;
+function visibleLength(str) {
+    return str.replace(ANSI, '').length;
+}
+/** Cut to `width` VISIBLE characters, keeping escapes and closing any left open. */
+function truncateVisible(str, width) {
+    let out = '';
+    let seen = 0;
+    let i = 0;
+    let coloured = false;
+    while (i < str.length && seen < width) {
+        ANSI.lastIndex = i;
+        const m = ANSI.exec(str);
+        if (m && m.index === i) {
+            out += m[0];
+            coloured = m[0] !== '\u001b[39m' && m[0] !== '\u001b[0m';
+            i += m[0].length;
+            continue;
+        }
+        out += str[i];
+        seen += 1;
+        i += 1;
+    }
+    // Never leave a colour open — it would tint the border and every later row.
+    return coloured ? out + '\u001b[0m' : out;
+}
+export function padCell(str, width) {
+    const visible = visibleLength(str);
+    if (visible >= width)
+        return truncateVisible(str, width);
+    return str + ' '.repeat(width - visible);
+}
+/** Render a simple table with borders. */
+function renderTable(headers, widths, rows) {
+    const top = '┌' + widths.map((w) => '─'.repeat(w + 2)).join('┬') + '┐';
+    const mid = '├' + widths.map((w) => '─'.repeat(w + 2)).join('┼') + '┤';
+    const bot = '└' + widths.map((w) => '─'.repeat(w + 2)).join('┴') + '┘';
+    const fmtRow = (cells) => '│ ' + cells.map((c, i) => padCell(c, widths[i])).join(' │ ') + ' │';
+    console.log(top);
+    console.log(fmtRow(headers));
+    console.log(mid);
+    for (const row of rows) {
+        console.log(fmtRow(row));
+    }
+    console.log(bot);
+}
+export function keyPublication(row, jwks) {
+    if (!row.signing_key_id)
+        return 'unsigned';
+    if (!jwks)
+        return 'keys_unavailable';
+    return jwks.keys.some((k) => k['kid'] === row.signing_key_id) ? 'published' : 'not_published';
+}
+/** Colour a key-publication state for the listing. */
+function colorPublication(state) {
+    switch (state) {
+        case 'published':
+            return pc.cyan('key published');
+        case 'not_published':
+            return pc.yellow('unverifiable');
+        case 'keys_unavailable':
+            return pc.yellow('keys unread');
+        case 'unsigned':
+            return pc.dim('unsigned');
+    }
+}
+/** Colour a signature state. Amber for "no verdict", red only for a rejection. */
+function colorSignature(state) {
+    switch (state) {
+        case 'valid':
+            return pc.green('valid');
+        case 'invalid':
+            return pc.red('INVALID');
+        case 'unverifiable':
+            return pc.yellow('unverifiable');
+        case 'keys_unavailable':
+            return pc.yellow('not checked');
+        case 'unsigned':
+            return pc.dim('unsigned');
+    }
+}
+/** What each signature state means, and what the operator does about it. */
+function signatureNote(state, controlPlaneUrl) {
+    switch (state) {
+        case 'valid':
+            return 'Signed by a key this deployment publishes. That proves the root came from this deployment — not that its history is true, since the same party holds the key.';
+        case 'invalid':
+            return 'The key this root names REJECTED its signature. The root does not say what it was sealed saying.';
+        case 'unverifiable':
+            return `Nothing here settles this either way: either the key id it was sealed under is not published at ${controlPlaneUrl}${JWKS_PATH} — put the rotated-out PEM back into TRACE_SIGNING_RETIRED_KEYS — or the root records a signing preimage version this CLI cannot rebuild, in which case upgrade the CLI.`;
+        case 'keys_unavailable':
+            return `Could not read ${controlPlaneUrl}${JWKS_PATH}, so the signature was not checked.`;
+        case 'unsigned':
+            return 'Sealed with no signing key configured. Supported — the root still re-derives; it just cannot be attributed to this deployment by a third party.';
+    }
+}
+/** Cap a long id list so a mismatch over 4,000 traces stays readable. */
+function sampleIds(ids, limit = 10) {
+    if (ids.length <= limit)
+        return ids.join(', ');
+    return `${ids.slice(0, limit).join(', ')} … and ${ids.length - limit} more`;
+}
+// ─── Commands ───────────────────────────────────────────────────────
+/**
+ * `intutic integrity roots` — the sealed roots for the workspace, newest first.
+ */
+export async function runIntegrityRoots(opts) {
+    const creds = await loadCredentials();
+    if (!creds) {
+        log.error(NOT_AUTHENTICATED);
+        process.exit(1);
+    }
+    const controlPlaneUrl = resolveControlPlaneUrl(opts.dev);
+    const client = createApiClient(controlPlaneUrl, creds.apiKey);
+    try {
+        const query = opts.loopRun ? `?loopRunId=${encodeURIComponent(opts.loopRun)}` : '';
+        const data = await client.get(`/api/v1/integrity/roots${query}`);
+        const roots = data.data ?? [];
+        if (opts.json) {
+            console.log(JSON.stringify(data, null, 2));
+            return;
+        }
+        log.header('Intutic — Sealed Trace Roots');
+        if (roots.length === 0) {
+            log.dim('  No roots sealed yet.');
+            log.dim('  An hourly sweep seals a loop run once it is terminal and has been quiet for');
+            log.dim('  fifteen minutes. Until then its traces are recorded but under no root.');
+            return;
+        }
+        // Fetched once for the whole listing. Without it the signature column could
+        // only report presence, and "signed" would be indistinguishable from
+        // "signed by a key nobody can obtain".
+        const jwks = await fetchSigningKeys(controlPlaneUrl);
+        const headers = ['Root ID', 'Sealed', 'Loop Run', 'Traces', 'Leaf v', 'Signature'];
+        const widths = [20, 16, 20, 6, 6, 13];
+        const rows = roots.map((r) => [
+            truncateId(r.root_id),
+            formatTimestamp(r.sealed_at),
+            r.loop_run_id ? truncateId(r.loop_run_id) : '—',
+            String(r.leaf_count),
+            `v${r.leaf_schema_version}`,
+            // The list endpoint does not carry the signature itself, so this column
+            // reports key publication and nothing more. `verify` checks the bytes.
+            colorPublication(keyPublication(r, jwks)),
+        ]);
+        renderTable(headers, widths, rows);
+        console.log(pc.dim(`Showing ${roots.length} root${roots.length === 1 ? '' : 's'}. The Signature column reports whether the sealing key is published,\n` +
+            'not whether the signature verifies — `intutic integrity verify <root_id>` checks the bytes.'));
+    }
+    catch (err) {
+        log.error(`Failed to list roots: ${err instanceof Error ? err.message : String(err)}`);
+        process.exit(1);
+    }
+}
+/**
+ * `intutic integrity verify <root_id>` — re-derive one root from the live rows
+ * and check its signature.
+ *
+ * Exits 1 on a mismatch, on missing traces, or on a signature a published key
+ * rejects.
+ */
+export async function runIntegrityVerify(rootId, opts) {
+    const creds = await loadCredentials();
+    if (!creds) {
+        log.error(NOT_AUTHENTICATED);
+        process.exit(1);
+    }
+    const controlPlaneUrl = resolveControlPlaneUrl(opts.dev);
+    const client = createApiClient(controlPlaneUrl, creds.apiKey);
+    const encoded = encodeURIComponent(rootId);
+    let detail;
+    let recompute;
+    try {
+        detail = await client.get(`/api/v1/integrity/roots/${encoded}`);
+        // Always 200, whatever the verdict: a mismatch is a successful check that
+        // found something, and an HTTP error here would be retried and then ignored.
+        recompute = await client.post(`/api/v1/integrity/roots/${encoded}/recompute`, {});
+    }
+    catch (err) {
+        log.error(`Failed to verify root: ${err instanceof Error ? err.message : String(err)}`);
+        process.exit(1);
+    }
+    const signature = verifyRootSignature(detail.root, await fetchSigningKeys(controlPlaneUrl));
+    const findings = [
+        { kind: 'recompute', verdict: recompute.verdict },
+        { kind: 'signature', state: signature },
+    ];
+    const failed = findings.some(failsIntegrity);
+    if (opts.json) {
+        console.log(JSON.stringify({
+            rootId,
+            verdict: recompute.verdict,
+            storedRoot: recompute.storedRoot,
+            recomputedRoot: recompute.recomputedRoot,
+            changedTraceIds: recompute.changedTraceIds,
+            missingTraceIds: recompute.missingTraceIds,
+            signature,
+            leafSchemaVersion: detail.root.leaf_schema_version,
+            leafCount: detail.root.leaf_count,
+            failed,
+        }, null, 2));
+    }
+    else {
+        log.header('Intutic — Root Verification');
+        log.field('Root ID', detail.root.root_id);
+        log.field('Loop run', detail.root.loop_run_id ?? '— (not scoped to a run)');
+        log.field('Sealed', formatTimestamp(detail.root.sealed_at));
+        log.field('Traces covered', `${detail.leaves.length} of ${detail.root.leaf_count} enumerated`);
+        log.field('Leaf schema', `v${detail.root.leaf_schema_version}`);
+        console.log('');
+        switch (recompute.verdict) {
+            case 'match':
+                log.success('Re-derivation: match — every covered trace still hashes to what was sealed.');
+                break;
+            case 'mismatch':
+                log.error(`Re-derivation: MISMATCH — ${recompute.changedTraceIds.length} trace(s) changed after sealing.`);
+                log.field('Changed', sampleIds(recompute.changedTraceIds));
+                log.field('Sealed root', recompute.storedRoot);
+                log.field('Re-derived', recompute.recomputedRoot ?? '—');
+                break;
+            case 'missing_traces':
+                log.error(`Re-derivation: MISSING TRACES — ${recompute.missingTraceIds.length} covered trace(s) are gone.`);
+                log.field('Missing', sampleIds(recompute.missingTraceIds));
+                break;
+        }
+        console.log('');
+        console.log(`  ${pc.dim('Signature:')} ${colorSignature(signature)}`);
+        log.dim(`  ${signatureNote(signature, controlPlaneUrl)}`);
+    }
+    if (failed)
+        process.exit(1);
+}
+/**
+ * `intutic integrity chain` — walk the `previous_root` chain.
+ *
+ * Exits 1 on a break. Re-derivation cannot see a root that was deleted outright
+ * — the survivors all verify perfectly — so this walk is the only check that
+ * notices one is missing.
+ */
+export async function runIntegrityChain(opts) {
+    const creds = await loadCredentials();
+    if (!creds) {
+        log.error(NOT_AUTHENTICATED);
+        process.exit(1);
+    }
+    const controlPlaneUrl = resolveControlPlaneUrl(opts.dev);
+    const client = createApiClient(controlPlaneUrl, creds.apiKey);
+    let status;
+    let body;
+    try {
+        // The break case answers 409 with the walk in the body, so the status
+        // cannot be allowed to throw past the reporting.
+        const res = await client.getWithStatus('/api/v1/integrity/chain');
+        status = res.status;
+        body = res.body;
+    }
+    catch (err) {
+        log.error(`Failed to walk the chain: ${err instanceof Error ? err.message : String(err)}`);
+        process.exit(1);
+    }
+    if (status !== 200 && status !== 409) {
+        log.error(`Chain walk failed (${status}): ${JSON.stringify(body)}`);
+        process.exit(1);
+    }
+    const breaks = body.breaks ?? [];
+    const unchained = body.unchainedRootIds ?? [];
+    if (opts.json) {
+        console.log(JSON.stringify({ ...body, failed: failsIntegrity({ kind: 'chain', breaks: breaks.length }) }, null, 2));
+    }
+    else {
+        log.header('Intutic — Root Chain Walk');
+        log.field('Roots walked', String(body.rootsWalked));
+        if (body.rootsNotWalked > 0) {
+            // An unwalked tail is not an intact one, and the endpoint says so rather
+            // than letting the caller read "no breaks" as "no breaks anywhere".
+            log.field('Older, not walked', `${body.rootsNotWalked} (outside the 500-root window)`);
+        }
+        if (breaks.length === 0) {
+            log.success('No breaks: every walked root names the root that actually precedes it.');
+        }
+        else {
+            log.error(`${breaks.length} break(s) — a root names a predecessor that is not the root before it.`);
+            for (const b of breaks) {
+                log.field(b.rootId, `names ${b.namedPrevious}, but ${b.precedingRootId} (${b.precedingMerkleRoot}) precedes it`);
+            }
+        }
+        if (unchained.length > 0) {
+            log.warn(`${unchained.length} root(s) name no predecessor. Not a break — nothing was claimed, so ` +
+                'nothing contradicts. It means a deletion at that point would go unseen.');
+            log.field('Unchained', sampleIds(unchained));
+        }
+    }
+    if (failsIntegrity({ kind: 'chain', breaks: breaks.length }))
+        process.exit(1);
+}
+/**
+ * `intutic integrity config-chain` — walk the harness config snapshot chain.
+ *
+ * The TD-232 verifier, reached from the product rather than from a hand-written
+ * curl. `content_hash` and `previous_hash` are written on every config snapshot
+ * and were read only to find a diff predecessor, so for months a snapshot could
+ * be deleted, or its body rewritten under its stored hash, and every reader
+ * returned exactly what it returned before.
+ *
+ * Exits 1 on either finding. They are reported apart because they have
+ * different causes and different remedies: a break says a snapshot next to this
+ * one is gone, a content mismatch says this snapshot's own stored body no
+ * longer hashes to the hash recorded with it. Collapsing them into one count is
+ * the mistake the `audit_log_integrity` probe made by averaging independent
+ * controls into a single score.
+ */
+export async function runIntegrityConfigChain(opts) {
+    const creds = await loadCredentials();
+    if (!creds) {
+        log.error(NOT_AUTHENTICATED);
+        process.exit(1);
+    }
+    const controlPlaneUrl = resolveControlPlaneUrl(opts.dev);
+    const client = createApiClient(controlPlaneUrl, creds.apiKey);
+    let status;
+    let body;
+    try {
+        // Same reason as `chain` above: the contradicted case answers 409 with the
+        // walk in the body, so the status must not throw past the reporting.
+        const res = await client.getWithStatus('/api/v1/integrity/config-chain');
+        status = res.status;
+        body = res.body;
+    }
+    catch (err) {
+        log.error(`Failed to walk the config chain: ${err instanceof Error ? err.message : String(err)}`);
+        process.exit(1);
+    }
+    if (status !== 200 && status !== 409) {
+        log.error(`Config chain walk failed (${status}): ${JSON.stringify(body)}`);
+        process.exit(1);
+    }
+    const breaks = body.breaks ?? [];
+    const mismatches = body.contentMismatches ?? [];
+    const unchained = body.unchainedSnapshotIds ?? [];
+    const walked = body.snapshotsWalked ?? 0;
+    const failed = failsIntegrity({
+        kind: 'configChain',
+        breaks: breaks.length,
+        contentMismatches: mismatches.length,
+    });
+    if (opts.json) {
+        console.log(JSON.stringify({ ...body, failed }, null, 2));
+    }
+    else {
+        log.header('Intutic — Config Snapshot Chain Walk');
+        log.field('Snapshots walked', String(walked));
+        if (body.snapshotsNotWalked > 0) {
+            // Never printed as a count: the server stops counting at one. An
+            // unwalked tail is still not an intact one, so it is stated.
+            log.field('Older, not walked', 'yes — snapshots past the 500-snapshot window were not examined');
+        }
+        if (walked === 0) {
+            // Not a pass, and it must not read as one. Nothing was checked, so
+            // "no breaks" here would be the same sentence an intact chain prints
+            // while standing for nothing at all.
+            log.warn('No config snapshots for this workspace, so nothing was verified. This is not a clean ' +
+                'chain — it is an absent one. A workspace whose harness configs are being captured ' +
+                'has snapshots; if this one should, the sync daemon is not reaching the control plane.');
+        }
+        else if (breaks.length === 0 && mismatches.length === 0) {
+            log.success(`No breaks and no content mismatches across ${walked} snapshot(s): every walked snapshot ` +
+                'names the snapshot that actually precedes it, and every stored body still hashes to its ' +
+                'recorded content_hash.');
+        }
+        if (breaks.length > 0) {
+            log.error(`${breaks.length} break(s) — a snapshot names a predecessor that is not the snapshot ` +
+                'before it. That is what deleting a snapshot leaves behind.');
+            for (const b of breaks) {
+                log.field(`${b.snapshotId} (${b.harnessType} ${b.filePath})`, `names ${b.namedPrevious}, but ${b.precedingSnapshotId} (${b.precedingContentHash}) precedes it`);
+            }
+        }
+        if (mismatches.length > 0) {
+            // Deliberately not called a break, and deliberately printed as its own
+            // finding: the links here are all intact. The body under one of them was
+            // edited, which link-checking alone cannot see.
+            log.error(`${mismatches.length} content mismatch(es) — a stored snapshot body no longer hashes to ` +
+                'the content_hash recorded with it. The body was rewritten in place.');
+            for (const m of mismatches) {
+                log.field(`${m.snapshotId} (${m.harnessType} ${m.filePath})`, `recorded ${m.storedHash}, body now hashes to ${m.recomputedHash}`);
+            }
+        }
+        if (unchained.length > 0) {
+            log.warn(`${unchained.length} snapshot(s) name no predecessor mid-chain. Nothing was claimed, so ` +
+                'nothing contradicts — but a deletion at that point would go unseen.');
+            log.field('Unchained', sampleIds(unchained));
+        }
+    }
+    if (failed)
+        process.exit(1);
+}
+//# sourceMappingURL=integrity.js.map

package/dist/commands/integrity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrity.js","sourceRoot":"","sources":["../../src/commands/integrity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,IAAI,UAAU,EAAmB,MAAM,aAAa,CAAA;AACpF,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,MAAM,YAAY,CAAA;AAuC3B,kFAAkF;AAClF,SAAS,iBAAiB,CAAC,IAAmB;IAC5C,OAAO,IAAI,CAAC,wBAAwB,IAAI,CAAC,CAAA;AAC3C,CAAC;AAED;;;;;GAKG;AACH,MAAM,WAAW,GAAqC;IACpD,CAAC,EAAE,wBAAwB;IAC3B,CAAC,EAAE,wBAAwB;CAC5B,CAAA;AAmHD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,cAAc,CAAC,OAAyB;IACtD,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,WAAW;YACd,OAAO,OAAO,CAAC,OAAO,KAAK,OAAO,CAAA;QACpC,KAAK,WAAW;YACd,OAAO,OAAO,CAAC,KAAK,KAAK,SAAS,CAAA;QACpC,KAAK,OAAO;YACV,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAA;QAC3B,KAAK,aAAa;YAChB,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,iBAAiB,GAAG,CAAC,CAAA;IAC9D,CAAC;AACH,CAAC;AAED,uEAAuE;AAEvE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,eAAe,CAAC,IAAmB;IACjD,MAAM,EAAE,GAAG,MAAM,CAAA;IACjB,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;IACvC,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAA;IACnC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,2EAA2E;QAC3E,0EAA0E;QAC1E,4EAA4E;QAC5E,+DAA+D;QAC/D,MAAM,IAAI,UAAU,CAAC,+CAA+C,OAAO,EAAE,CAAC,CAAA;IAChF,CAAC;IACD,MAAM,MAAM,GAAG;QACb,MAAM;QACN,IAAI,CAAC,YAAY;QACjB,IAAI,CAAC,WAAW,IAAI,EAAE;QACtB,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC;QAChC,IAAI,CAAC,WAAW;KACjB,CAAA;IACD,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QACjB,yEAAyE;QACzE,wEAAwE;QACxE,4BAA4B;QAC5B,EAAE;QACF,6EAA6E;QAC7E,4EAA4E;QAC5E,6EAA6E;QAC7E,2EAA2E;QAC3E,wEAAwE;QACxE,mCAAmC;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAA;QAC3C,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAA;IAC5D,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AACxB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAmB,EAAE,IAAwB;IAC/E,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,cAAc;QAAE,OAAO,UAAU,CAAA;IAC9D,IAAI,CAAC,IAAI;QAAE,OAAO,kBAAkB,CAAA;IAEpC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,cAAc,CAAC,CAAA;IACnE,IAAI,CAAC,GAAG;QAAE,OAAO,cAAc,CAAA;IAC/B,wEAAwE;IACxE,2EAA2E;IAC3E,mDAAmD;IACnD,IAAI,IAAI,CAAC,aAAa,KAAK,OAAO;QAAE,OAAO,cAAc,CAAA;IACzD,yEAAyE;IACzE,uEAAuE;IACvE,8EAA8E;IAC9E,0EAA0E;IAC1E,8EAA8E;IAC9E,uEAAuE;IACvE,0EAA0E;IAC1E,IAAI,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,cAAc,CAAA;IAE7E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,GAAiB,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;QACtE,MAAM,EAAE,GAAG,UAAU,CACnB,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,EAC1C,GAAG,EACH,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CACtC,CAAA;QACD,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,iEAAiE;QACjE,OAAO,cAAc,CAAA;IACvB,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,SAAS,GAAG,yCAAyC,CAAA;AAE3D;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAAC,eAAuB;IACrD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,eAAe,GAAG,SAAS,EAAE,CAAC,CAAA;QACzD,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAgB,CAAA;QAC9C,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,uEAAuE;AAEvE,wCAAwC;AACxC,SAAS,UAAU,CAAC,EAAU;IAC5B,IAAI,EAAE,CAAC,MAAM,IAAI,EAAE;QAAE,OAAO,EAAE,CAAA;IAC9B,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAA;AAChC,CAAC;AAED,sDAAsD;AACtD,SAAS,eAAe,CAAC,GAAkB;IACzC,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAA;IACpB,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAA;IACvB,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACtD,OAAO,GAAG,CAAC,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,EAAE,CAAA;AAC1H,CAAC;AAED,6DAA6D;AAC7D;;;;;;;;;;GAUG;AACH,0IAA0I;AAC1I,MAAM,IAAI,GAAG,mBAAmB,CAAA;AAEhC,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAA;AACrC,CAAC;AAED,oFAAoF;AACpF,SAAS,eAAe,CAAC,GAAW,EAAE,KAAa;IACjD,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;QACtC,IAAI,CAAC,SAAS,GAAG,CAAC,CAAA;QAClB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACxB,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;YACvB,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;YACX,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,WAAW,CAAA;YACxD,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;YAChB,SAAQ;QACV,CAAC;QACD,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAA;QACb,IAAI,IAAI,CAAC,CAAA;QACT,CAAC,IAAI,CAAC,CAAA;IACR,CAAC;IACD,4EAA4E;IAC5E,OAAO,QAAQ,CAAC,CAAC,CAAC,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,CAAA;AAC3C,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,GAAW,EAAE,KAAa;IAChD,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;IAClC,IAAI,OAAO,IAAI,KAAK;QAAE,OAAO,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IACxD,OAAO,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,OAAO,CAAC,CAAA;AAC1C,CAAC;AAED,0CAA0C;AAC1C,SAAS,WAAW,CAAC,OAAiB,EAAE,MAAgB,EAAE,IAAgB;IACxE,MAAM,GAAG,GAAG,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAA;IACtE,MAAM,GAAG,GAAG,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAA;IACtE,MAAM,GAAG,GAAG,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAA;IAEtE,MAAM,MAAM,GAAG,CAAC,KAAe,EAAE,EAAE,CACjC,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAA;IAEtE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAChB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;IAC5B,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAChB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;IAC1B,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;AAClB,CAAC;AAYD,MAAM,UAAU,cAAc,CAC5B,GAA0C,EAC1C,IAAwB;IAExB,IAAI,CAAC,GAAG,CAAC,cAAc;QAAE,OAAO,UAAU,CAAA;IAC1C,IAAI,CAAC,IAAI;QAAE,OAAO,kBAAkB,CAAA;IACpC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,CAAA;AAC/F,CAAC;AAED,sDAAsD;AACtD,SAAS,gBAAgB,CAAC,KAAqB;IAC7C,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,WAAW;YACd,OAAO,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;QACjC,KAAK,eAAe;YAClB,OAAO,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;QAClC,KAAK,kBAAkB;YACrB,OAAO,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;QACjC,KAAK,UAAU;YACb,OAAO,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IAC7B,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,SAAS,cAAc,CAAC,KAAqB;IAC3C,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,OAAO;YACV,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC1B,KAAK,SAAS;YACZ,OAAO,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QAC1B,KAAK,cAAc;YACjB,OAAO,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;QAClC,KAAK,kBAAkB;YACrB,OAAO,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;QACjC,KAAK,UAAU;YACb,OAAO,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IAC7B,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,SAAS,aAAa,CAAC,KAAqB,EAAE,eAAuB;IACnE,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,OAAO;YACV,OAAO,+JAA+J,CAAA;QACxK,KAAK,SAAS;YACZ,OAAO,kGAAkG,CAAA;QAC3G,KAAK,cAAc;YACjB,OAAO,mGAAmG,eAAe,GAAG,SAAS,0KAA0K,CAAA;QACjT,KAAK,kBAAkB;YACrB,OAAO,kBAAkB,eAAe,GAAG,SAAS,qCAAqC,CAAA;QAC3F,KAAK,UAAU;YACb,OAAO,iJAAiJ,CAAA;IAC5J,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,SAAS,SAAS,CAAC,GAAa,EAAE,KAAK,GAAG,EAAE;IAC1C,IAAI,GAAG,CAAC,MAAM,IAAI,KAAK;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC9C,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,MAAM,GAAG,KAAK,OAAO,CAAA;AAC7E,CAAC;AAOD,uEAAuE;AAEvE;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAA6C;IAE7C,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;QAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,MAAM,eAAe,GAAG,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACxD,MAAM,MAAM,GAAG,eAAe,CAAC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IAE7D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QAClF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAmB,0BAA0B,KAAK,EAAE,CAAC,CAAA;QAClF,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAA;QAE7B,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;YAC1C,OAAM;QACR,CAAC;QAED,GAAG,CAAC,MAAM,CAAC,8BAA8B,CAAC,CAAA;QAE1C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAA;YACjC,GAAG,CAAC,GAAG,CACL,+EAA+E,CAChF,CAAA;YACD,GAAG,CAAC,GAAG,CACL,0EAA0E,CAC3E,CAAA;YACD,OAAM;QACR,CAAC;QAED,4EAA4E;QAC5E,qEAAqE;QACrE,uCAAuC;QACvC,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,eAAe,CAAC,CAAA;QAEpD,MAAM,OAAO,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAA;QAClF,MAAM,MAAM,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAA;QACrC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAC5B,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;YACrB,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5B,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG;YAC/C,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;YACpB,IAAI,CAAC,CAAC,mBAAmB,EAAE;YAC3B,wEAAwE;YACxE,uEAAuE;YACvE,gBAAgB,CAAC,cAAc,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;SAC1C,CAAC,CAAA;QAEF,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;QAClC,OAAO,CAAC,GAAG,CACT,EAAE,CAAC,GAAG,CACJ,WAAW,KAAK,CAAC,MAAM,QAAQ,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,wEAAwE;YAClI,6FAA6F,CAChG,CACF,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,yBAAyB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACtF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,IAAsB;IAEtB,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;QAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,MAAM,eAAe,GAAG,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACxD,MAAM,MAAM,GAAG,eAAe,CAAC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IAC7D,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAA;IAE1C,IAAI,MAA0B,CAAA;IAC9B,IAAI,SAA4B,CAAA;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAqB,2BAA2B,OAAO,EAAE,CAAC,CAAA;QACnF,0EAA0E;QAC1E,6EAA6E;QAC7E,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CAC3B,2BAA2B,OAAO,YAAY,EAC9C,EAAE,CACH,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,0BAA0B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACvF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,gBAAgB,CAAC,eAAe,CAAC,CAAC,CAAA;IAC3F,MAAM,QAAQ,GAAuB;QACnC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE;QACjD,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE;KACxC,CAAA;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;IAE5C,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;YACE,MAAM;YACN,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,cAAc,EAAE,SAAS,CAAC,cAAc;YACxC,eAAe,EAAE,SAAS,CAAC,eAAe;YAC1C,eAAe,EAAE,SAAS,CAAC,eAAe;YAC1C,SAAS;YACT,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB;YAClD,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU;YACjC,MAAM;SACP,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAA;IACH,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAA;QACzC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACzC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,yBAAyB,CAAC,CAAA;QAC3E,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAA;QAC3D,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,aAAa,CAAC,CAAA;QAC9F,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAA;QAC/D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAEf,QAAQ,SAAS,CAAC,OAAO,EAAE,CAAC;YAC1B,KAAK,OAAO;gBACV,GAAG,CAAC,OAAO,CAAC,6EAA6E,CAAC,CAAA;gBAC1F,MAAK;YACP,KAAK,UAAU;gBACb,GAAG,CAAC,KAAK,CAAC,6BAA6B,SAAS,CAAC,eAAe,CAAC,MAAM,kCAAkC,CAAC,CAAA;gBAC1G,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,CAAA;gBAC1D,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE,SAAS,CAAC,UAAU,CAAC,CAAA;gBAC9C,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,SAAS,CAAC,cAAc,IAAI,GAAG,CAAC,CAAA;gBACxD,MAAK;YACP,KAAK,gBAAgB;gBACnB,GAAG,CAAC,KAAK,CAAC,mCAAmC,SAAS,CAAC,eAAe,CAAC,MAAM,6BAA6B,CAAC,CAAA;gBAC3G,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,CAAA;gBAC1D,MAAK;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACf,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;QACrE,GAAG,CAAC,GAAG,CAAC,KAAK,aAAa,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,CAAC,CAAA;IAC3D,CAAC;IAED,IAAI,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAsB;IAC5D,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;QAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,MAAM,eAAe,GAAG,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACxD,MAAM,MAAM,GAAG,eAAe,CAAC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IAE7D,IAAI,MAAc,CAAA;IAClB,IAAI,IAAmB,CAAA;IACvB,IAAI,CAAC;QACH,sEAAsE;QACtE,iDAAiD;QACjD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,aAAa,CAAgB,yBAAyB,CAAC,CAAA;QAChF,MAAM,GAAG,GAAG,CAAC,MAAM,CAAA;QACnB,IAAI,GAAG,GAAG,CAAC,IAAI,CAAA;IACjB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,6BAA6B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC1F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACrC,GAAG,CAAC,KAAK,CAAC,sBAAsB,MAAM,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAA;IAChC,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAA;IAE7C,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IACrH,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAA;QACvC,GAAG,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAA;QACnD,IAAI,IAAI,CAAC,cAAc,GAAG,CAAC,EAAE,CAAC;YAC5B,yEAAyE;YACzE,oEAAoE;YACpE,GAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE,GAAG,IAAI,CAAC,cAAc,gCAAgC,CAAC,CAAA;QACxF,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,GAAG,CAAC,OAAO,CAAC,wEAAwE,CAAC,CAAA;QACvF,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,MAAM,wEAAwE,CAAC,CAAA;YACnG,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;gBACvB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,aAAa,SAAS,CAAC,CAAC,eAAe,KAAK,CAAC,CAAC,mBAAmB,eAAe,CAAC,CAAA;YAClH,CAAC;QACH,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,IAAI,CACN,GAAG,SAAS,CAAC,MAAM,sEAAsE;gBACvF,yEAAyE,CAC5E,CAAA;YACD,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;IAED,IAAI,cAAc,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AAC/E,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAAsB;IAClE,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;QAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,MAAM,eAAe,GAAG,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACxD,MAAM,MAAM,GAAG,eAAe,CAAC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IAE7D,IAAI,MAAc,CAAA;IAClB,IAAI,IAAyB,CAAA;IAC7B,IAAI,CAAC;QACH,2EAA2E;QAC3E,qEAAqE;QACrE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,aAAa,CAAsB,gCAAgC,CAAC,CAAA;QAC7F,MAAM,GAAG,GAAG,CAAC,MAAM,CAAA;QACnB,IAAI,GAAG,GAAG,CAAC,IAAI,CAAA;IACjB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,oCAAoC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACjG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACrC,GAAG,CAAC,KAAK,CAAC,6BAA6B,MAAM,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAA;IAChC,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAA;IAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,oBAAoB,IAAI,EAAE,CAAA;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,IAAI,CAAC,CAAA;IACxC,MAAM,MAAM,GAAG,cAAc,CAAC;QAC5B,IAAI,EAAE,aAAa;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,iBAAiB,EAAE,UAAU,CAAC,MAAM;KACrC,CAAC,CAAA;IAEF,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IAC3D,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,MAAM,CAAC,sCAAsC,CAAC,CAAA;QAClD,GAAG,CAAC,KAAK,CAAC,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;QAC7C,IAAI,IAAI,CAAC,kBAAkB,GAAG,CAAC,EAAE,CAAC;YAChC,iEAAiE;YACjE,6DAA6D;YAC7D,GAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE,gEAAgE,CAAC,CAAA;QAClG,CAAC;QAED,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;YACjB,mEAAmE;YACnE,qEAAqE;YACrE,qCAAqC;YACrC,GAAG,CAAC,IAAI,CACN,uFAAuF;gBACrF,oFAAoF;gBACpF,uFAAuF,CAC1F,CAAA;QACH,CAAC;aAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,OAAO,CACT,8CAA8C,MAAM,sCAAsC;gBACxF,0FAA0F;gBAC1F,wBAAwB,CAC3B,CAAA;QACH,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,GAAG,CAAC,KAAK,CACP,GAAG,MAAM,CAAC,MAAM,sEAAsE;gBACpF,4DAA4D,CAC/D,CAAA;YACD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;gBACvB,GAAG,CAAC,KAAK,CACP,GAAG,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,QAAQ,GAAG,EAClD,SAAS,CAAC,CAAC,aAAa,SAAS,CAAC,CAAC,mBAAmB,KAAK,CAAC,CAAC,oBAAoB,eAAe,CACjG,CAAA;YACH,CAAC;QACH,CAAC;QAED,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,uEAAuE;YACvE,yEAAyE;YACzE,gDAAgD;YAChD,GAAG,CAAC,KAAK,CACP,GAAG,UAAU,CAAC,MAAM,qEAAqE;gBACvF,qEAAqE,CACxE,CAAA;YACD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;gBAC3B,GAAG,CAAC,KAAK,CACP,GAAG,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,QAAQ,GAAG,EAClD,YAAY,CAAC,CAAC,UAAU,wBAAwB,CAAC,CAAC,cAAc,EAAE,CACnE,CAAA;YACH,CAAC;QACH,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,IAAI,CACN,GAAG,SAAS,CAAC,MAAM,sEAAsE;gBACvF,qEAAqE,CACxE,CAAA;YACD,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;IAED,IAAI,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AAC7B,CAAC"}