@mcp-index/sdk 0.18.0 → 0.19.0

package/dist/src/lock/rawList.js

@@ -0,0 +1,561 @@
+/**
+ * Lock mode for the official MCP TypeScript client, at the transport.
+ *
+ * `Client.listTools()` returns tools after its zod schema has stripped unknown
+ * members, so a digest over that result is not a digest over what the server
+ * sent. LockedTransport sits between the Client and its real Transport and
+ * works on the parsed JSON-RPC message instead. The transports parse each
+ * message with JSON.parse and check only the envelope, so every member inside
+ * `result.tools`, `__proto__` included, is still there as sent.
+ *
+ * For a `tools/list` request from the client it:
+ *   - starts a listing (section 9.2.1) when it sends the request. Until the
+ *     listing is decided or fails, every `tools/call` is refused with
+ *     `no-listing`. A second cursorless `tools/list` abandons the first, whose
+ *     request is answered with an error;
+ *   - classifies every frame from the server as section 9.2.2 says
+ *     (classifyFrame): only the response to an unanswered `tools/list`,
+ *     matched by id with exact JSON type and value, can carry tools, and only
+ *     that or the `initialize` or `server/discover` response can carry
+ *     instructions. Anything else that carries them, or has both a method and
+ *     a result or error, is dropped and reported to onerror. A client request
+ *     whose id it matches is answered with an error under that id and is no
+ *     longer pending; when that request is the listing's, or one of its page
+ *     requests, the listing fails. A response whose id matches no request is
+ *     dropped too;
+ *   - follows `nextCursor` itself, sending its own page requests under private
+ *     ids, so one listing is every page (section 9.2). The client gets one
+ *     response with every shown tool and no cursor. A client request that
+ *     carries a cursor is answered with an error, since there is no partial
+ *     listing in lock mode;
+ *   - loads a lock snapshot, runs checkListing on the raw tools, installs the
+ *     decision in the CallGate, emits a listing event, and passes on only the
+ *     shown raw entries, without a top-level `_meta` that the decision removes
+ *     (section 9.2.3). The client then parses exactly those.
+ *
+ * Every outgoing `tools/call` goes through the CallGate first. A refused call
+ * is never sent; the client gets a -32011 error with data.reason. This covers
+ * callTool, request, requestStream and the task helpers alike, because they
+ * all end in Transport.send. A call on a snapshot older than maxStalenessMs
+ * (default 60 s) reloads it first; the reload can only shrink the allow-list,
+ * and if it fails the call gets `lock-stale` and the next call tries again.
+ *
+ * `notifications/tools/list_changed` is passed on and marks a listing as due.
+ * It does not change the allow-list, and this adapter does not start a
+ * listing on its own (the spec's SHOULD); the client asks for one. A listing
+ * that fails (an error response, a result with no tools array, a page that
+ * cannot be requested or gets no response, a page or tool limit exceeded)
+ * refuses every call with `unreachable` until a listing completes (section
+ * 9.5). Server instructions arrive in the initialize or server/discover
+ * result; they are checked there and stripped when the check says so.
+ *
+ * Unanswered requests are tracked in bounded maps. An entry leaves on its
+ * response, on the client's notifications/cancelled, after REQUEST_TTL_MS, or,
+ * when the map is full, oldest first. If that entry is the listing in
+ * progress, the listing fails.
+ *
+ * Lock mode has no auto-accept, first-use pin or re-pin, and this adapter
+ * takes no option that would add one.
+ */
+import { CallGate, DEFAULT_MAX_STALENESS_MS, checkInstructions, checkListing, isPosture, refusalError } from "./check.js";
+import { listingEvent, refusalEvent, emit } from "./events.js";
+import { LockError, validateIdentity } from "./lock.js";
+import { snapshotOfError } from "./store.js";
+/** Pages and tools one listing may span before the server is treated as unreachable. */
+export const MAX_LIST_PAGES = 100;
+export const MAX_LIST_TOOLS = 10_000;
+/** Unanswered requests tracked at once; past this the oldest is forgotten. */
+export const MAX_OUTSTANDING = 4_096;
+/** Age after which an unanswered request is forgotten (its late response is dropped). */
+export const REQUEST_TTL_MS = 600_000;
+export { DEFAULT_MAX_STALENESS_MS };
+const FORBIDDEN_OPTIONS = ["autoAccept", "autoApprove", "tofu", "newTools", "repin", "migrate"];
+function isObj(v) {
+    return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+function own(obj, key) {
+    return Object.getOwnPropertyDescriptor(obj, key)?.value;
+}
+function hasOwn(obj, key) {
+    return Object.prototype.hasOwnProperty.call(obj, key);
+}
+/** Map key for a request id: JSON type and value. Null, booleans and the rest have none. */
+function idKey(id) {
+    if (typeof id === "number" && Number.isFinite(id))
+        return `n:${id}`;
+    if (typeof id === "string")
+        return `s:${id}`;
+    return null;
+}
+/** Section 9.2.2: `id` equals one of `ids` in JSON type and value. Null matches nothing. */
+export function idMatches(id, ids) {
+    const key = idKey(id);
+    return key !== null && ids.some((i) => idKey(i) === key);
+}
+/** Requests whose response may carry instructions (section 9.2.2). */
+export const HANDSHAKE_METHODS = Object.freeze(["initialize", "server/discover"]);
+/**
+ * What the host does with one frame from the server (section 9.2.2):
+ * `listing` (a page of the listing whose request it answers), `handshake`
+ * (the initialize or server/discover response; its instructions are
+ * checked), `drop`, or `relay`. `isInflight` and `isHandshake` say whether an
+ * id matches an unanswered tools/list or handshake request; unanswered
+ * tools/list requests are matched first.
+ */
+export function classifyFrame(frame, isInflight, isHandshake) {
+    if (!isObj(frame))
+        return "drop";
+    const result = own(frame, "result");
+    const carriesTools = isObj(result) && hasOwn(result, "tools");
+    const carriesInstructions = isObj(result) && hasOwn(result, "instructions");
+    if (hasOwn(frame, "method"))
+        return hasOwn(frame, "result") || hasOwn(frame, "error") ? "drop" : "relay";
+    if (!hasOwn(frame, "id"))
+        return carriesTools || carriesInstructions ? "drop" : "relay";
+    const id = own(frame, "id");
+    if (isInflight(id))
+        return "listing";
+    if (carriesTools)
+        return "drop";
+    if (isHandshake(id))
+        return "handshake";
+    if (carriesInstructions)
+        return "drop";
+    return "relay";
+}
+/** Copy a result object member by member, leaving out `drop`. */
+function copyWithout(result, drop) {
+    const out = {};
+    for (const key of Object.keys(result)) {
+        if (drop.includes(key))
+            continue;
+        Object.defineProperty(out, key, { value: own(result, key), enumerable: true, writable: true, configurable: true });
+    }
+    return out;
+}
+export class LockedTransport {
+    onclose;
+    onerror;
+    onmessage;
+    gate;
+    #inner;
+    #store;
+    #identity;
+    #posture;
+    #sink;
+    #events;
+    #now;
+    /** Client request id key to method, for every request still unanswered. */
+    #outstanding = new Map();
+    /** Private page request id key to the listing it belongs to. */
+    #pages = new Map();
+    #current = null;
+    #queue = Promise.resolve();
+    #served = undefined;
+    #lastTools = null;
+    #listingDue = false;
+    #seq = 0;
+    #tag = Math.random().toString(36).slice(2, 10);
+    constructor(inner, options) {
+        for (const key of FORBIDDEN_OPTIONS) {
+            if (key in options)
+                throw new Error(`lock mode does not accept ${key}`);
+        }
+        if (!isPosture(options.posture))
+            throw new Error(`unknown posture ${String(options.posture)}`);
+        this.#inner = inner;
+        this.#store = options.store;
+        this.#identity = validateIdentity(options.identity);
+        this.#posture = options.posture;
+        this.#sink = options.sink;
+        this.#now = options.now ?? Date.now;
+        this.gate = new CallGate({ maxStalenessMs: options.maxStalenessMs ?? DEFAULT_MAX_STALENESS_MS, now: this.#now });
+        this.#events = { host: options.host ?? "mcpindex-sdk", identity: this.#identity };
+    }
+    get sessionId() {
+        return this.#inner.sessionId;
+    }
+    setProtocolVersion(version) {
+        this.#inner.setProtocolVersion?.(version);
+    }
+    /** True after a list_changed notification until the next listing completes. */
+    get listingDue() {
+        return this.#listingDue;
+    }
+    /** The decision for the latest complete listing on this connection, or null. */
+    get decision() {
+        return this.gate.decision;
+    }
+    async start() {
+        this.#inner.onmessage = (message, extra) => {
+            this.#queue = this.#queue
+                .then(() => this.#incoming(message, extra))
+                .catch((exc) => this.onerror?.(exc instanceof Error ? exc : new Error(String(exc))));
+        };
+        this.#inner.onerror = (error) => this.onerror?.(error);
+        this.#inner.onclose = () => this.onclose?.();
+        await this.#inner.start();
+    }
+    async close() {
+        await this.#inner.close();
+    }
+    async send(message, options) {
+        const msg = message;
+        if (Array.isArray(msg))
+            throw new Error("lock mode does not send JSON-RPC batches");
+        this.#expire();
+        if (isObj(msg) && own(msg, "method") === "notifications/cancelled") {
+            const params = own(msg, "params");
+            const key = isObj(params) ? idKey(own(params, "requestId")) : null;
+            if (key !== null)
+                this.#forget(key, "the client cancelled the listing request");
+        }
+        if (isObj(msg) && own(msg, "method") === "tools/call" && idKey(own(msg, "id")) === null) {
+            throw new Error("lock mode refuses a tools/call without a valid request id");
+        }
+        if (isObj(msg) && typeof own(msg, "method") === "string" && idKey(own(msg, "id")) !== null) {
+            const method = own(msg, "method");
+            const id = own(msg, "id");
+            const key = idKey(id);
+            const params = own(msg, "params");
+            if (method === "tools/call") {
+                const name = isObj(params) ? own(params, "name") : undefined;
+                const verdict = await this.#checkCall(typeof name === "string" ? name : null);
+                if (verdict !== "allow") {
+                    const tool = typeof name === "string" ? name : null;
+                    // As in the Python host: the event names "" and data.tool is left out.
+                    emit(this.#sink, refusalEvent(this.#events, tool ?? "", verdict));
+                    this.#deliverLater({ jsonrpc: "2.0", id, error: refusalError(tool, verdict) });
+                    return;
+                }
+            }
+            if (method === "tools/list" && isObj(params) && own(params, "cursor") !== undefined) {
+                this.#deliverLater({
+                    jsonrpc: "2.0",
+                    id,
+                    error: { code: -32602, message: "lock mode collects every page itself; send tools/list without a cursor" },
+                });
+                return;
+            }
+            this.#forget(key, "the listing request id was reused");
+            while (this.#outstanding.size >= MAX_OUTSTANDING) {
+                this.#forget(this.#outstanding.keys().next().value, "too many requests without a response");
+            }
+            this.#outstanding.set(key, { value: method, at: this.#now() });
+            if (method === "tools/list") {
+                // Section 9.2.1: the listing starts now; an earlier one is abandoned.
+                if (this.#current !== null)
+                    this.#abandon(this.#current);
+                this.#current = { clientId: id, clientKey: key, collecting: null };
+                this.gate.beginListing();
+                try {
+                    await this.#inner.send(message, options);
+                }
+                catch (exc) {
+                    this.#outstanding.delete(key);
+                    if (this.#current?.clientKey === key) {
+                        this.#current = null;
+                        this.gate.markUnreachable();
+                    }
+                    throw exc;
+                }
+                return;
+            }
+        }
+        await this.#inner.send(message, options);
+    }
+    /** Stop tracking a client request. If it is the listing in progress, that listing fails. */
+    #forget(key, why) {
+        if (!this.#outstanding.delete(key))
+            return;
+        const current = this.#current;
+        if (current !== null && current.clientKey === key)
+            this.#fail(current, why);
+    }
+    /** A newer cursorless tools/list replaced this listing. */
+    #abandon(listing) {
+        this.#dropPages(listing);
+        this.#outstanding.delete(listing.clientKey);
+        if (this.#current === listing)
+            this.#current = null;
+        this.#deliverLater({
+            jsonrpc: "2.0",
+            id: listing.clientId,
+            error: { code: -32603, message: "lock mode: a newer tools/list replaced this listing" },
+        });
+    }
+    #dropPages(listing) {
+        for (const [key, entry] of this.#pages)
+            if (entry.value === listing)
+                this.#pages.delete(key);
+    }
+    /**
+     * The listing failed. Fail closed: every call is refused with unreachable
+     * until a listing completes, and the client's request gets an error.
+     */
+    #fail(listing, why, error) {
+        if (this.#current !== listing)
+            return;
+        this.#current = null;
+        this.#dropPages(listing);
+        this.#outstanding.delete(listing.clientKey);
+        this.gate.markUnreachable();
+        this.#deliver({ jsonrpc: "2.0", id: listing.clientId, error: error ?? { code: -32603, message: `lock mode: ${why}` } });
+    }
+    async #checkCall(name) {
+        const decision = this.gate.decision;
+        if (this.gate.isStale() &&
+            !this.gate.listingInProgress &&
+            !this.gate.unreachable &&
+            decision !== null &&
+            decision.lockError === null) {
+            // Section 9.8: a decided whole-lock failure never reloads; it keeps its reason.
+            await this.#refresh();
+        }
+        const verdict = this.gate.check(name ?? "");
+        // A name that is not a string is never on an allow-list.
+        if (name === null && verdict === "allow")
+            return "not-listed";
+        return verdict;
+    }
+    /** Forget requests older than REQUEST_TTL_MS. A forgotten page request fails its listing. */
+    #expire() {
+        const cutoff = this.#now() - REQUEST_TTL_MS;
+        for (const [key, entry] of this.#outstanding) {
+            if (entry.at > cutoff)
+                break;
+            this.#forget(key, "the listing request got no response");
+        }
+        for (const [key, entry] of this.#pages) {
+            if (entry.at > cutoff)
+                break;
+            this.#pages.delete(key);
+            this.#fail(entry.value, "page request got no response");
+        }
+    }
+    /**
+     * Reload the snapshot and re-check the last listing (section 9.8). The
+     * allow-list keeps only names allowed both before and after; a name the
+     * reload drops takes its new reason. A reload whose lock does not load
+     * changes nothing, so the call gets lock-stale and the next one retries.
+     */
+    async #refresh() {
+        const previous = this.gate.decision;
+        const tools = this.#lastTools;
+        if (previous === null || tools === null)
+            return;
+        let snapshot;
+        try {
+            snapshot = await this.#store.loadSnapshot();
+        }
+        catch {
+            return;
+        }
+        if (snapshot.lock instanceof LockError)
+            return;
+        // A listing that started, completed or failed during the await is newer; never overwrite it.
+        if (this.gate.decision !== previous || this.gate.unreachable || this.gate.listingInProgress)
+            return;
+        const fresh = checkListing(snapshot.lock, this.#identity, { tools, instructions: this.#served }, this.#posture);
+        const callable = new Set([...previous.callable].filter((n) => fresh.callable.has(n)));
+        const withheld = new Map(previous.withheld);
+        for (const name of previous.callable) {
+            const reason = callable.has(name) ? undefined : fresh.withheld.get(name);
+            if (reason !== undefined)
+                withheld.set(name, reason); // otherwise checkCall says not-listed
+        }
+        this.gate.record(Object.freeze({ ...previous, callable, withheld }), snapshot);
+    }
+    #deliver(message, extra) {
+        this.onmessage?.(message, extra);
+    }
+    #deliverLater(message) {
+        queueMicrotask(() => this.#deliver(message));
+    }
+    async #snapshot() {
+        try {
+            return await this.#store.loadSnapshot();
+        }
+        catch (exc) {
+            return snapshotOfError(new LockError("lock-unreadable", exc.message ?? "store failed"), this.#now());
+        }
+    }
+    #isInflight(id) {
+        const key = idKey(id);
+        return key !== null && (this.#pages.has(key) || this.#outstanding.get(key)?.value === "tools/list");
+    }
+    #isHandshake(id) {
+        const key = idKey(id);
+        const method = key === null ? undefined : this.#outstanding.get(key)?.value;
+        return method !== undefined && HANDSHAKE_METHODS.includes(method);
+    }
+    async #incoming(message, extra) {
+        this.#expire();
+        const kind = classifyFrame(message, (id) => this.#isInflight(id), (id) => this.#isHandshake(id));
+        if (kind === "drop") {
+            this.#drop(message);
+            return;
+        }
+        const msg = message;
+        if (kind === "relay" && hasOwn(msg, "method")) {
+            if (own(msg, "method") === "notifications/tools/list_changed" && !hasOwn(msg, "id"))
+                this.#listingDue = true;
+            this.#deliver(msg, extra);
+            return;
+        }
+        const key = idKey(own(msg, "id"));
+        if (kind === "relay" && key === null) {
+            this.#deliver(msg, extra); // a response without a usable id and without tools; the client reports it
+            return;
+        }
+        const page = key === null ? undefined : this.#pages.get(key);
+        if (page !== undefined) {
+            this.#pages.delete(key);
+            await this.#onPage(page.value, msg);
+            return;
+        }
+        const entry = key === null ? undefined : this.#outstanding.get(key);
+        if (entry === undefined) {
+            this.onerror?.(new Error("dropped a response that matches no outstanding request"));
+            return;
+        }
+        this.#outstanding.delete(key);
+        if (kind === "handshake") {
+            await this.#onInitialize(msg, extra);
+            return;
+        }
+        if (kind === "listing") {
+            const listing = this.#current;
+            if (listing === null || listing.clientKey !== key)
+                return; // abandoned or failed already
+            const error = own(msg, "error");
+            if (error !== undefined) {
+                this.#fail(listing, "tools/list failed", error);
+                return;
+            }
+            const result = own(msg, "result");
+            if (!isObj(result)) {
+                this.#fail(listing, "tools/list result is not an object");
+                return;
+            }
+            listing.collecting = { first: result, tools: [], cursors: new Set(), pages: 0 };
+            await this.#onPage(listing, msg);
+            return;
+        }
+        this.#deliver(msg, extra);
+    }
+    /** Report a dropped frame, and answer the client request it matched so the client does not wait. */
+    #drop(message) {
+        this.onerror?.(new Error("dropped a frame from the server that section 9.2.2 does not allow to reach the client"));
+        if (!isObj(message))
+            return;
+        const key = idKey(own(message, "id"));
+        if (key === null)
+            return;
+        const page = this.#pages.get(key);
+        if (page !== undefined) {
+            this.#pages.delete(key);
+            this.#fail(page.value, "the server answered a page request with a frame that was dropped");
+            return;
+        }
+        const entry = this.#outstanding.get(key);
+        if (entry === undefined)
+            return;
+        const current = this.#current;
+        if (current !== null && current.clientKey === key) {
+            this.#fail(current, "the server answered tools/list with a frame that was dropped");
+            return;
+        }
+        this.#outstanding.delete(key);
+        this.#deliver({
+            jsonrpc: "2.0",
+            id: own(message, "id"),
+            error: { code: -32603, message: `lock mode: the response to ${entry.value} was dropped` },
+        });
+    }
+    async #onInitialize(message, extra) {
+        const result = own(message, "result");
+        if (!isObj(result)) {
+            this.#deliver(message, extra);
+            return;
+        }
+        this.#served = own(result, "instructions");
+        const snapshot = await this.#snapshot();
+        const verdict = checkInstructions(snapshot.lock, this.#identity, this.#served, this.#posture);
+        if (!verdict.strip) {
+            this.#deliver(message, extra);
+            return;
+        }
+        this.#deliver({ ...copyWithout(message, ["result"]), result: copyWithout(result, ["instructions"]) }, extra);
+    }
+    async #onPage(listing, message) {
+        const collecting = listing.collecting;
+        if (this.#current !== listing || collecting === null)
+            return;
+        const error = own(message, "error");
+        if (error !== undefined) {
+            // A failed page means the listing failed; no earlier allow-list is used.
+            this.#fail(listing, "a page request failed", error);
+            return;
+        }
+        const result = own(message, "result");
+        const tools = isObj(result) ? own(result, "tools") : undefined;
+        if (!Array.isArray(tools)) {
+            this.#fail(listing, "tools/list result has no tools array");
+            return;
+        }
+        collecting.pages += 1;
+        for (const t of tools)
+            collecting.tools.push(t);
+        if (collecting.pages > MAX_LIST_PAGES || collecting.tools.length > MAX_LIST_TOOLS) {
+            this.#fail(listing, "listing exceeds the page or tool limit");
+            return;
+        }
+        const cursor = isObj(result) ? own(result, "nextCursor") : undefined;
+        if (typeof cursor === "string" && cursor !== "") {
+            if (collecting.cursors.has(cursor)) {
+                this.#fail(listing, "server repeated a cursor");
+                return;
+            }
+            collecting.cursors.add(cursor);
+            this.#seq += 1;
+            const pid = `mcplock:${this.#tag}:${this.#seq}`;
+            const pkey = idKey(pid);
+            this.#pages.set(pkey, { value: listing, at: this.#now() });
+            try {
+                await this.#inner.send({ jsonrpc: "2.0", id: pid, method: "tools/list", params: { cursor } });
+            }
+            catch (exc) {
+                this.#pages.delete(pkey);
+                this.#fail(listing, `page request failed: ${exc.message}`);
+            }
+            return;
+        }
+        await this.#finish(listing, collecting);
+    }
+    async #finish(listing, collecting) {
+        const tools = collecting.tools;
+        const snapshot = await this.#snapshot();
+        if (this.#current !== listing)
+            return; // abandoned or failed while the snapshot loaded
+        const decision = checkListing(snapshot.lock, this.#identity, { tools, instructions: this.#served }, this.#posture);
+        this.#current = null;
+        this.gate.record(decision, snapshot);
+        this.#lastTools = tools;
+        this.#listingDue = false;
+        emit(this.#sink, listingEvent(this.#events, decision, snapshot.snapshotId));
+        const result = copyWithout(collecting.first, ["tools", "nextCursor"]);
+        result.tools = decision.shownIndexes.map((i) => {
+            const tool = tools[i];
+            return decision.stripMeta.has(i) && isObj(tool) ? copyWithout(tool, ["_meta"]) : tool;
+        });
+        this.#deliver({ jsonrpc: "2.0", id: listing.clientId, result });
+    }
+}
+/** Wrap `transport` in lock mode and connect `client` through it. */
+export async function lockClient(client, transport, options) {
+    const locked = new LockedTransport(transport, options);
+    await client.connect(locked);
+    return locked;
+}
+//# sourceMappingURL=rawList.js.map

package/dist/src/lock/rawList.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rawList.js","sourceRoot":"","sources":["../../../src/lock/rawList.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AAKH,OAAO,EAAE,QAAQ,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1H,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAE/D,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAExD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAG7C,wFAAwF;AACxF,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC;AAClC,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AACrC,8EAA8E;AAC9E,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAC;AACrC,yFAAyF;AACzF,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AACtC,OAAO,EAAE,wBAAwB,EAAE,CAAC;AAEpC,MAAM,iBAAiB,GAAG,CAAC,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AAqBhG,SAAS,KAAK,CAAC,CAAU;IACvB,OAAO,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,GAAG,CAAC,GAAQ,EAAE,GAAW;IAChC,OAAO,MAAM,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC;AAC1D,CAAC;AAED,SAAS,MAAM,CAAC,GAAQ,EAAE,GAAW;IACnC,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AACxD,CAAC;AAED,4FAA4F;AAC5F,SAAS,KAAK,CAAC,EAAW;IACxB,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,EAAE,EAAE,CAAC;IACpE,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,OAAO,KAAK,EAAE,EAAE,CAAC;IAC7C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,SAAS,CAAC,EAAW,EAAE,GAAuB;IAC5D,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;IACtB,OAAO,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAsB,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAIrG;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAc,EACd,UAAoC,EACpC,WAAqC;IAErC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACjC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACpC,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9D,MAAM,mBAAmB,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC5E,IAAI,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IACzG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC;QAAE,OAAO,YAAY,IAAI,mBAAmB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IACxF,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC5B,IAAI,UAAU,CAAC,EAAE,CAAC;QAAE,OAAO,SAAS,CAAC;IACrC,IAAI,YAAY;QAAE,OAAO,MAAM,CAAC;IAChC,IAAI,WAAW,CAAC,EAAE,CAAC;QAAE,OAAO,WAAW,CAAC;IACxC,IAAI,mBAAmB;QAAE,OAAO,MAAM,CAAC;IACvC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,iEAAiE;AACjE,SAAS,WAAW,CAAC,MAAW,EAAE,IAAuB;IACvD,MAAM,GAAG,GAAQ,EAAE,CAAC;IACpB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QACjC,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IACrH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAqBD,MAAM,OAAO,eAAe;IAC1B,OAAO,CAAc;IACrB,OAAO,CAA0B;IACjC,SAAS,CAA4E;IAE5E,IAAI,CAAW;IACf,MAAM,CAAY;IAClB,MAAM,CAAY;IAClB,SAAS,CAAW;IACpB,QAAQ,CAAU;IAClB,KAAK,CAA4B;IACjC,OAAO,CAAe;IACtB,IAAI,CAAe;IAC5B,2EAA2E;IAClE,YAAY,GAAG,IAAI,GAAG,EAA2B,CAAC;IAC3D,gEAAgE;IACvD,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAC;IACtD,QAAQ,GAAmB,IAAI,CAAC;IAChC,MAAM,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAC1C,OAAO,GAAY,SAAS,CAAC;IAC7B,UAAU,GAA8B,IAAI,CAAC;IAC7C,WAAW,GAAG,KAAK,CAAC;IACpB,IAAI,GAAG,CAAC,CAAC;IACA,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAExD,YAAY,KAAgB,EAAE,OAAoB;QAChD,KAAK,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;YACpC,IAAI,GAAG,IAAK,OAAkB;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/F,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,IAAI,CAAC,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,IAAI,QAAQ,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,wBAAwB,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACjH,IAAI,CAAC,OAAO,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,cAAc,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IACpF,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;IAC/B,CAAC;IAED,kBAAkB,CAAC,OAAe;QAChC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED,+EAA+E;IAC/E,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,gFAAgF;IAChF,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,CAAC,OAAuB,EAAE,KAAwB,EAAE,EAAE;YAC5E,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM;iBACtB,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,OAAkB,EAAE,KAAK,CAAC,CAAC;iBACrD,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAClG,CAAC,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC,KAAY,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7C,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAuB,EAAE,OAA8B;QAChE,MAAM,GAAG,GAAG,OAAkB,CAAC;QAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QACpF,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,yBAAyB,EAAE,CAAC;YACnE,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAClC,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACnE,IAAI,GAAG,KAAK,IAAI;gBAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,0CAA0C,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,YAAY,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACxF,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC3F,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAW,CAAC;YAC5C,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,EAAE,IAAI,CAAc,CAAC;YACvC,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE,CAAW,CAAC;YAChC,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAClC,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;gBAC5B,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC7D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC9E,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;oBACxB,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;oBACpD,uEAAuE;oBACvE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;oBAClE,IAAI,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;oBAC/E,OAAO;gBACT,CAAC;YACH,CAAC;YACD,IAAI,MAAM,KAAK,YAAY,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,SAAS,EAAE,CAAC;gBACpF,IAAI,CAAC,aAAa,CAAC;oBACjB,OAAO,EAAE,KAAK;oBACd,EAAE;oBACF,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,wEAAwE,EAAE;iBAC3G,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;YACvD,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI,eAAe,EAAE,CAAC;gBACjD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,EAAE,sCAAsC,CAAC,CAAC;YACxG,CAAC;YACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC/D,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;gBAC5B,sEAAsE;gBACtE,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI;oBAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACzD,IAAI,CAAC,QAAQ,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;gBACnE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC3C,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC9B,IAAI,IAAI,CAAC,QAAQ,EAAE,SAAS,KAAK,GAAG,EAAE,CAAC;wBACrC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;wBACrB,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;oBAC9B,CAAC;oBACD,MAAM,GAAG,CAAC;gBACZ,CAAC;gBACD,OAAO;YACT,CAAC;QACH,CAAC;QACD,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,4FAA4F;IAC5F,OAAO,CAAC,GAAW,EAAE,GAAW;QAC9B,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC;YAAE,OAAO;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,SAAS,KAAK,GAAG;YAAE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC9E,CAAC;IAED,2DAA2D;IAC3D,QAAQ,CAAC,OAAgB;QACvB,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACzB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO;YAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACpD,IAAI,CAAC,aAAa,CAAC;YACjB,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,OAAO,CAAC,QAAQ;YACpB,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,qDAAqD,EAAE;SACxF,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,OAAgB;QACzB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM;YAAE,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC/F,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAgB,EAAE,GAAW,EAAE,KAAe;QAClD,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO;QACtC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACzB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QAC5B,IAAI,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,cAAc,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1H,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAmB;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;QACpC,IACE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;YACnB,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB;YAC5B,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW;YACtB,QAAQ,KAAK,IAAI;YACjB,QAAQ,CAAC,SAAS,KAAK,IAAI,EAC3B,CAAC;YACD,gFAAgF;YAChF,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACxB,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC5C,yDAAyD;QACzD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,KAAK,OAAO;YAAE,OAAO,YAAY,CAAC;QAC9D,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,6FAA6F;IAC7F,OAAO;QACL,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,cAAc,CAAC;QAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC7C,IAAI,KAAK,CAAC,EAAE,GAAG,MAAM;gBAAE,MAAM;YAC7B,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,qCAAqC,CAAC,CAAC;QAC3D,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACvC,IAAI,KAAK,CAAC,EAAE,GAAG,MAAM;gBAAE,MAAM;YAC7B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,8BAA8B,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ;QACZ,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC;QAC9B,IAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO;QAChD,IAAI,QAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,YAAY,SAAS;YAAE,OAAO;QAC/C,6FAA6F;QAC7F,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI,CAAC,iBAAiB;YAAE,OAAO;QACpG,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAuC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAClF,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACzE,IAAI,MAAM,KAAK,SAAS;gBAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,sCAAsC;QAC9F,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;IACjF,CAAC;IAED,QAAQ,CAAC,OAAY,EAAE,KAAwB;QAC7C,IAAI,CAAC,SAAS,EAAE,CAAC,OAAoC,EAAE,KAAK,CAAC,CAAC;IAChE,CAAC;IAED,aAAa,CAAC,OAAY;QACxB,cAAc,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,SAAS;QACb,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,eAAe,CAAC,IAAI,SAAS,CAAC,iBAAiB,EAAG,GAAa,CAAC,OAAO,IAAI,cAAc,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAClH,CAAC;IACH,CAAC;IAED,WAAW,CAAC,EAAW;QACrB,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;QACtB,OAAO,GAAG,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,YAAY,CAAC,CAAC;IACtG,CAAC;IAED,YAAY,CAAC,EAAW;QACtB,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;QACtB,MAAM,MAAM,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;QAC5E,OAAO,MAAM,KAAK,SAAS,IAAI,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAgB,EAAE,KAAwB;QACxD,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,aAAa,CACxB,OAAO,EACP,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,EAC5B,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAC9B,CAAC;QACF,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,OAAc,CAAC;QAC3B,IAAI,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC9C,IAAI,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,kCAAkC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC;gBAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YAC7G,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC1B,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAClC,IAAI,IAAI,KAAK,OAAO,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACrC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,0EAA0E;YACrG,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAa,CAAC,CAAC;YAClC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACpC,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC,CAAC;YACpF,OAAO;QACT,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAa,CAAC,CAAC;QACxC,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YACzB,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC;YAC9B,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,SAAS,KAAK,GAAG;gBAAE,OAAO,CAAC,8BAA8B;YACzF,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAChC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,mBAAmB,EAAE,KAAK,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAClC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnB,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,oCAAoC,CAAC,CAAC;gBAC1D,OAAO;YACT,CAAC;YACD,OAAO,CAAC,UAAU,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED,oGAAoG;IACpG,KAAK,CAAC,OAAgB;QACpB,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,KAAK,CAAC,uFAAuF,CAAC,CAAC,CAAC;QACnH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;YAAE,OAAO;QAC5B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QACtC,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,kEAAkE,CAAC,CAAC;YAC3F,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,SAAS,KAAK,GAAG,EAAE,CAAC;YAClD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,8DAA8D,CAAC,CAAC;YACpF,OAAO;QACT,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC;YACZ,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,CAAc;YACnC,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,8BAA8B,KAAK,CAAC,KAAK,cAAc,EAAE;SAC1F,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAAY,EAAE,KAAwB;QACxD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACnB,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC9B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9F,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC9B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,cAAc,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC/G,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAgB,EAAE,OAAY;QAC1C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACtC,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO;QAC7D,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,yEAAyE;YACzE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,uBAAuB,EAAE,KAAK,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,sCAAsC,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,UAAU,CAAC,KAAK,IAAI,CAAC,CAAC;QACtB,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChD,IAAI,UAAU,CAAC,KAAK,GAAG,cAAc,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;YAClF,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,wCAAwC,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAChD,IAAI,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,0BAA0B,CAAC,CAAC;gBAChD,OAAO;YACT,CAAC;YACD,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC/B,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;YACf,MAAM,GAAG,GAAG,WAAW,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAChD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAW,CAAC;YAClC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC3D,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAoB,CAAC,CAAC;YAClH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACzB,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,wBAAyB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAgB,EAAE,UAAsB;QACpD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC/B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACxC,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,CAAC,gDAAgD;QACvF,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnH,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACrC,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC;QACxB,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;QACtE,MAAM,CAAC,KAAK,GAAG,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACtB,OAAO,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxF,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAClE,CAAC;CACF;AAOD,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAyB,EACzB,SAAoB,EACpB,OAAoB;IAEpB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/src/lock/signing.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Manifest signature verification (section 8.2).
+ *
+ * The signer identity and the trust root come from the host's own config
+ * object. Nothing here reads the lock repository or the environment for
+ * either. `sigstore` is an optional peer dependency, loaded on the verify
+ * path only; when it is missing, verify returns false and the reader fails
+ * with lock-signature-invalid, as it does for a missing or bad bundle.
+ *
+ * Verification is offline against a trusted_root.json the operator supplies.
+ * The issuer and SAN are matched exactly: sigstore treats the SAN policy as a
+ * regular expression, so it gets an escaped, anchored pattern, and the signer
+ * it returns is compared again by plain string equality.
+ */
+import type { ManifestVerifier } from "./lock.js";
+export type { ManifestVerifier, SignerIdentity } from "./lock.js";
+export interface SigstoreVerifierOptions {
+    /** Path to a Sigstore trusted_root.json, from host configuration. */
+    readonly trustedRootPath: string;
+    /** Transparency log entries required (sigstore default 1). */
+    readonly tlogThreshold?: number;
+    /** Certificate transparency entries required (sigstore default 1). */
+    readonly ctlogThreshold?: number;
+    /** Module loader, for tests. Defaults to resolving `sigstore` from this package. */
+    readonly load?: (name: string) => unknown;
+}
+/** Exact, anchored pattern for sigstore's regex-based SAN policy. */
+export declare function anchoredPattern(text: string): string;
+/**
+ * Sigstore verifier for MANIFEST.json. Returns false (never throws) on a
+ * missing module, unreadable trust root, malformed bundle, failed signature,
+ * or a signer that differs from the configured issuer and SAN.
+ */
+export declare function sigstoreVerifier(options: SigstoreVerifierOptions): ManifestVerifier;
+//# sourceMappingURL=signing.d.ts.map

package/dist/src/lock/signing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../../../src/lock/signing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,KAAK,EAAE,gBAAgB,EAAkB,MAAM,WAAW,CAAC;AAElE,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAElE,MAAM,WAAW,uBAAuB;IACtC,qEAAqE;IACrE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,8DAA8D;IAC9D,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,sEAAsE;IACtE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,oFAAoF;IACpF,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;CAC3C;AAMD,qEAAqE;AACrE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEpD;AA2CD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,gBAAgB,CA2BnF"}