@sanoma-ai/workflows 0.10.0 → 0.10.1

package/README.md

@@ -122,7 +122,7 @@ What an app's folder declares is named with the folder, from where its file is (
 
 The people are the company's: an app's data files declare none (`readPeople` refuses one, naming its file). A workflow may import the root's `resources/data.ts` and any app's. A relative import from one app's files into another's folder is a warning (`crossAppImports(root, apps)`, from `@sanoma-ai/workflows/describe`, which `sanoma check` prints), since a company may take one app without the other: reach the other through `ctx` or `api` instead. A collection or site at the root named as an app is a problem: `api.data.<app>` and `/sites/<app>/` are the app's.
 
-Taking an app is a git merge into a draft of the company's `Source` (the `sanoma` package's `localGitSource`). `draft.take({ url, ref?, folder?, author })` fetches the source repository, a public company repo holding one `apps/<folder>/` (`folder` names it when it holds more), by https alone, and merges it with its history as one merge commit. `draft.update({ folder, author })` merges the new commits of the default branch of the URL the app's `app.ts` names, and `source.behind(folder)` counts them, fetched now (both refuse a source that shares no history with the checkout). An update reads the source from `main`'s `app.ts`, never the draft's, since a draft's files are never loaded: an app only in a draft is refused until its take is published. Either merge takes `apps/<folder>/` (a take, the source's folder whole) and `package.json` (its connectors, both sides kept); every other file stays the company's, as does a file one side deleted, since the source's root is the starter's. Both return an `AppMerge` (`{ folder, revision, merged, conflicts }`): a line both sides changed is committed with git's markers (diff3: ours, the base, theirs) and its file named in `conflicts`, so the draft's checks fail until the agent resolves it. An update needs the take's merge commit in the history: a draft that takes an app is merged into `main` as a merge, not squashed.
+Taking an app is a git merge into a draft of the company's `Source` (the `sanoma` package's `localGitSource`). `draft.take({ url, ref?, folder?, author })` fetches the source repository, a public company repo holding one `apps/<folder>/` (`folder` names it when it holds more), by https alone, and merges it with its history as one merge commit. `draft.update({ folder, author })` merges the new commits of the default branch of the URL the app's `app.ts` names (`appSourceOf`: an `app.ts` that throws, or is not `defineApp({ source })`, is refused with its problem, and one that names no source as the company's own), and `source.behind(folder)` counts them, fetched now (both refuse a source that shares no history with the checkout). An update reads the source from `main`'s `app.ts`, never the draft's, since a draft's files are never loaded: an app only in a draft is refused until its take is published. Either merge takes `apps/<folder>/` (a take, the source's folder whole) and `package.json` (its connectors, both sides kept); every other file stays the company's, as does a file one side deleted, since the source's root is the starter's. Both return an `AppMerge` (`{ folder, revision, merged, conflicts }`): a line both sides changed is committed with git's markers (diff3: ours, the base, theirs) and its file named in `conflicts`, so the draft's checks fail until the agent resolves it. An update needs the take's merge commit in the history: a draft that takes an app is merged into `main` as a merge, not squashed.
 
 ### People
 
@@ -271,7 +271,7 @@ export default defineConfig({ connectors: [], secrets });
 
 Without `store`, the runtime uses its encrypted Postgres adapter. Without `namespace`, it uses `default`. An unbound name resolves to the same path in that namespace, managed by Sanoma. A `{ path, management: "external" }` binding is read-only to Sanoma even when its store can write. An `{ env }` binding reads that exact variable, is read-only, and does not fall back when absent. A `{ bootstrap }` binding explicitly exposes one deployment key to trusted host-secret resolution; it reads the corresponding environment or mounted-file input and never stores the key in Postgres. Bootstrap keys and recovery are described [below](#bootstrap-keys).
 
-An external adapter is a `SecretStore` instance supplied as `secrets.store`. It authenticates to one deployment's authorized storage before Sanoma can read values. Prefer a scoped workload identity where the adapter supports it; otherwise deliver its bootstrap credential through the host. Do not make that credential depend on reading the same store it unlocks. AWS Secrets Manager, Supabase Vault, HashiCorp Vault, Cloudflare Secrets Store, managed KMS storage and transfer tooling are not shipped by this foundation.
+An external adapter is a `SecretStore` instance supplied as `secrets.store`. It authenticates to one deployment's authorized storage before Sanoma can read values. Prefer a scoped workload identity where the adapter supports it; otherwise deliver its bootstrap credential through the host. Do not make that credential depend on reading the same store it unlocks. The [Supabase Vault adapter](../../connectors/supabase/README.md#supabase-vault-as-the-secret-store) provides this boundary for BYOC. See the [support and release-readiness matrix](https://github.com/Sanoma-AI/sanoma/blob/main/packages/workflows/SECRET-SUPPORT.md) for merged capabilities, connector coverage, publication status and remaining providers/lifecycle work.
 
 Keep deployment composition in config code, outside workflows. For example, given an adapter instance already authenticated as `liveStore`:
 
@@ -298,7 +298,7 @@ Pass exactly the selected configuration to `defineConfig`. A namespace is a rout
 
 The adapter contract uses `read({ namespace, path })`, `write(address, value, { expectedVersion, by })`, `delete(address, { expectedVersion, by })` and `validate(namespace)`. A read returns an opaque version beside the value; `expectedVersion: null` creates only when absent, and a version replaces or deletes only that version. `ensure` uses create-if-absent and reads the winner of a concurrent creation. Providers advertise writable access, a byte limit, conditional-write guarantees (`atomic`, `coordinated` or `none`), deletion behavior and change detection. `coordinated` covers cooperating Sanoma writers only; it cannot promise safety against external writers. Unsupported conditional writes are refused, not emulated with an unsafe read followed by a write.
 
-The built-in adapter stores one encrypted value or credential bundle per namespace/path, with a fresh version on each write. AES-256-GCM authenticates the complete namespace/path identity. It rejects plaintext rows and ciphertext moved to another address. `SecretStoreError` returns fixed codes without provider responses or secret values. Connector authentication declares its own versioned schema with `defineAuthentication`: `api-key`, `fields`, `oauth2` or `signed`, with storage requirements; `workload-identity` needs no persisted credential bundle. Connector authors use `checkAuthenticationStore`, `encodeCredentials` and `decodeCredentials` inside trusted code. These contracts do not implement OAuth consent, refresh or vendor account verification.
+The built-in adapter stores one encrypted value or credential bundle per namespace/path, with a fresh version on each write. AES-256-GCM authenticates the complete namespace/path identity. It rejects plaintext rows and ciphertext moved to another address. `SecretStoreError` returns fixed codes without provider responses or secret values. Connector authentication declares its own versioned schema with `defineAuthentication`: `api-key`, `fields`, `oauth2` or `signed`, with storage requirements; `workload-identity` needs no persisted credential bundle. Connector authors use `checkAuthenticationStore`, `encodeCredentials` and `decodeCredentials` inside trusted code. OAuth consent and refresh remain separate lifecycle work.
 
 Adapter authors can run `checkSecretStore(store, disposableNamespace)` from `@sanoma-ai/workflows`. It checks missing values, ownership, contention, stale versions, namespace separation, size limits and the advertised deletion behavior. It mutates test records; use a scoped test identity and clean up retained versions according to the provider. `memorySecretStore()` is the in-process reference implementation, not persistent deployment storage.
 
@@ -342,10 +342,14 @@ export default defineConfig({
 
 Connection creation rules accept principal IDs or `{ group: "visitors" }` for authenticated customer sign-ups. The runtime uses admitted groups and owns each dynamic connection by the initiating principal. Disconnect invalidates the account revision and blocks new selection; vendor revocation and credential retirement are separate lifecycle work. Visitors also need a Cedar permit for the relevant operation; a creation rule does not bypass policy.
 
-`sanoma.connection.bind` is a policy-controlled access operation. Its input contains a declared reference, the granted account and scopes, and `expectedRevision` (`null` for an initial binding). It persists metadata and a new revision, never credential values. `sanoma.connection.create` takes a declared rule ID, account and scopes; the actor must be in `createBy`. It creates an owner-scoped dynamic ID without a repository commit. Trusted code can make a typed reference with `connectionRef(rule, id)`, but the runtime still verifies the stored owner and declaration on use. These metadata operations are not proof of vendor consent; connector intake must verify the account before binding it.
+`sanoma.connection.bind` is a policy-controlled access operation. Its input contains a declared reference, the granted account and scopes, and `expectedRevision` (`null` for an initial binding). It persists metadata and a new revision, never credential values. `sanoma.connection.create` takes a declared rule ID, account and scopes; the actor must be in `createBy`. It creates an owner-scoped dynamic ID without a repository commit. Trusted code can make a typed reference with `connectionRef(rule, id)`, but the runtime still verifies the stored owner and declaration on use. These low-level metadata operations are not a credential-entry interface or proof of vendor consent. Use the secure intake APIs below for user-entered values; each named invocation also verifies the current bundle.
 
 A durable call pins its account revision before policy evaluation. A held direct call carries the same pin into its durable continuation. The runtime checks that the binding and definition still match before execution; rebinding or changing requirements requires a fresh call and authorization. Policy approvals cannot silently authorize a different account. The ledger records connection metadata, not its credential bundle. This changes the durable step layout; old runs are not replayed against the new layout.
 
+Named drivers explicitly opt into methods with `defineDriver(connector, implementation, { authentication: ["apiKey"] })`. Each method supplies `verify(credentials)`, which checks the provider and returns `{ account, scopes, expiresAt? }`; expiry is Unix milliseconds. Workload identity verifies the deployment identity without a stored bundle. A missing verifier or unsupported driver is refused. After policy allows the operation, the runtime reads only the selected bundle, validates its schema, verifies that its account and grants still match the authorized metadata, and rechecks the binding after verification. Changed grants or expired credentials require reconnection. Verifier exceptions expose no SDK messages or causes.
+
+The driver reads `authenticationCredentials("apiKey", definition, call)` inside its operation and creates a client for that invocation. `defineDriver` also accepts a factory `(call) => implementation`, invoked inside that boundary, for operations sharing one SDK client during a call. `call.authentication.credentialVersion` identifies the version read. The runtime keeps no credential or SDK cache: replacement affects the next invocation, while a call already executing retains its original bundle. Never put this material in an operation result. Named calls' `call.secrets` can resolve only auxiliary secret markers in their authorized input, and `ensure` additionally requires a marker with `generate: true`. An operation may declare generated destinations with `createsSecrets(input)`, such as a database connector storing a URL under the authorized resource export's name; these are exact logical names, not wildcard store access. Driver failures retain retryability and HTTP status, with a fixed message and no provider cause. Direct calls and durable calls use the same driver boundary.
+
 Resource declarations use the same identity as an option, loaded with the rest of the data file:
 
 ```ts
@@ -354,7 +358,29 @@ import { mail } from "@acme/mail/resources";
 export const inbox = mail.inbox({ name: "support" }, { connection: { vendor: "mail", $connection: "mail/support" } });
 ```
 
-The resource type must belong to that connector. Apply and drift pin the selected revision when they read declarations, then carry it through imports, plans and effects. The resource lockfile records the connection alongside the vendor object ID. Changing the account of a bound resource requires an explicit unbind/rebind; a default change or a same-name account replacement cannot redirect a later apply. Named sandbox account state and the connection-management UI remain follow-up work.
+The resource type must belong to that connector. Apply and drift pin the selected revision when they read declarations, then carry it through imports, plans and effects. The resource lockfile records the connection alongside the vendor object ID. Changing the account of a bound resource requires an explicit unbind/rebind; a default change or a same-name account replacement cannot redirect a later apply. The app exposes these declarations through its [connection management](../app/README.md#connection-management) forms.
+
+Sandbox runs use synthetic identities for declared static connections, with separate fake state, faults and remembered replies for each account and run. They never read production connection records, invoke authentication verifiers or read production credentials. A production revision or an undeclared dynamic account is refused. Scenario steps can select an account in their returned seed, such as `{ op: mail.message.create, input: { title }, connection: support }`; absent a selector, only an explicitly declared default is used. Fault seeds accept the same `connection` field. Standalone driver tests can use `connectionFakes(makeFake)` from `@sanoma-ai/workflows/fake`: its `driver` requires `call.connection`, `account(ref)` exposes just that account's fake for seeding and fault injection, and `calls` is the combined log with connection IDs. Rebinding a reference to a different vendor account starts fresh fake state.
+
+#### Connecting and managing accounts
+
+Use `SanomaClient.previewConnection(target, credentials, { actor, id })` and `connectConnection(review, credentials, { actor })` for secure account intake. These are trusted server APIs, not workflow operations: credential values must never be passed to `client.call`, workflow arguments or an approval. `target` is either `{ connection: ref }` for a declared account or `{ rule: "vendor/rule" }` for an authorized dynamic account. Keep the same request ID while completing one review; a new account or a changed review starts a new request.
+
+Preview runs the metadata-only `sanoma.connection.prepare` access gate before reading a store or verifying submitted credentials. The connector verifies the account and granted scopes against the code's requirements. The returned `ConnectionReview` contains metadata only: the verified account and scopes, destination, existing account/destination when present, expected revisions and the authorization fingerprint. It never returns credentials. An externally managed or read-only binding accepts no pasted replacement; preview reads its existing bundle. Workload identity verifies the deployment without a stored bundle.
+
+Save rechecks the review, policy and destination, verifies the credentials again, then calls `sanoma.connection.configure` to reserve a `pending` account revision. It writes a managed bundle directly through the selected store with the reviewed expected version, outside durable execution. An opaque stored-version receipt records a successful write so resuming the same approved setup does not blindly repeat it. `sanoma.connection.activate` is a separate access gate: it verifies the saved bundle before making that revision usable. These gates, Test and Disconnect use ordinary policy decisions and ledger records containing metadata only. When a gate asks for approval, return to the secure form and retry after the decision; an approval never stores the form's credential values for later replay.
+
+`pending` and `uncertain` accounts cannot run operations. An ambiguous store write or a failure after writing can leave `uncertain`; it must be inspected and reverified rather than treated as a successful connection or blindly written again. A policy, account, scope, destination or binding revision change invalidates the relevant review and requires fresh verification. Changing a destination does not copy or delete the previous value: the review identifies both locations, and a store migration remains an explicit separate action.
+
+The read APIs are scoped to the admitted actor:
+
+- `client.connections({ actor })` returns `ConnectionCard` metadata for company declarations and that actor's dynamic accounts, including requirements, account, scopes, ownership, current/bound storage location, change attribution and last-tested health. Listing cards does not read credentials or contact a vendor.
+- `client.connectionRules({ actor })` returns creation choices permitted by the current code's `createBy` person IDs or `{ group }` entries. Creating under a rule still passes policy and ownership checks.
+- `client.secretStoreStatus({ actor })` validates the selected store's bootstrap access and reports its ID, namespace, capabilities and a sanitized readiness problem. It neither enumerates nor reads credential values.
+
+Call `sanoma.connection.test` with `{ connection }` to verify the current bundle under policy. Its health result is a timestamped observation, not a live guarantee or background monitor: it can report expired, revoked, wrong-account, changed-scope, invalid, unavailable or store-denied states. An external bundle whose opaque version differs from the prior test is marked externally renewed. A later vendor or store change is detected on the next Test or authorized invocation.
+
+`sanoma.connection.disconnect` takes `{ connection, expectedRevision }` and makes the binding unusable under a new revision. It does not delete any stored value or revoke the token at the vendor; externally managed values remain with their owner. Deletion, vendor revocation, OAuth consent/refresh and provider-store migration require their own lifecycle support. The app's [connection forms](../app/README.md#connection-management) implement this secure intake and show these states; they do not add a second configuration source.
 
 #### Bootstrap keys
 
@@ -470,7 +496,7 @@ Another data file names `website` by importing it: `import { website } from "./g
 
 A data file is TypeScript like any other: it may compute a value, spread a shared object or import a helper of its own. Each exported value that a resource type's constructor made (`<vendor>.<type>({ … })`, the vendor's constructors imported from its connector's `<info.package>/resources` entry, the people's from `sanoma/resources`) is one declaration, `<file>#<export>`, in the file that made it (another file re-exporting it declares nothing), under its non-default name when the file also exports it as `default`; anything else the file exports, such as the list `export default [a, b]` that Sanoma writes, declares nothing. A field the type's `fields.references` allows a resource in is given the declared value itself, and names the declaration that exports that very object. A field the type's `fields.writeOnly` lists takes `secret("NAME")` or `secret("NAME", { generate: true })`, imported from `sanoma/resources` (or `@sanoma-ai/workflows/resources`; see [Secrets](#secrets)). `resources/data.ts` is the exception: it holds the [collections](#collections) and nothing else.
 
-The loader (`loadModules`) loads synchronously, since `describeConfig` and `readPeople` are: `require` of an ES module, Node's type stripping and `module.registerHooks`, so a data file may not use top-level `await`. It serves the modules a company file imports from the runtime itself, from its own objects: each connector's `<package>/resources` with the config's constructors, `sanoma/resources`, `sanoma/data` (`collection`), `sanoma/site` (`defineSite`) and, to an app's `app.ts`, `sanoma` (`defineApp`); so a data file never needs the package installed, and each value they make records where it was made. Each load is a generation: a file is loaded again, with what it imports, once it, a company file it imports or a directory they are in has changed (by size and modification time), so an edit is read without a restart; every other call answers from the generation, at the cost of a `stat` per file. A superseded generation's modules stay in Node's cache, a copy of the files per edit.
+The loader (`loadModules`) loads synchronously, since `describeConfig` and `readPeople` are: `require` of an ES module, Node's type stripping and `module.registerHooks`, so a data file may not use top-level `await`. It serves the modules a company file imports from the runtime itself, from its own objects: each connector's `<package>/resources` with the config's constructors, `sanoma/resources`, `sanoma/data` (`collection`), `sanoma/site` (`defineSite`) and, to an app's `app.ts`, `sanoma` (`defineApp`); so a data file never needs the package installed, and each value they make records where it was made. Each load is a generation: a file is loaded again, with what it imports, once it, a company file it imports or a directory they are in has changed (by size and modification time), so an edit is read without a restart; every other call answers from the generation, at the cost of a `stat` per file. `liveDescription(config)` (`@sanoma-ai/workflows/describe`) keeps a `describeConfig` and makes it again only once a file a load read (`stampsOf`), the lockfile, or a folder a new data file, app or site would appear in has changed: the app reads its description through it, so a saved field shows on the next page without a restart. A superseded generation's modules stay in Node's cache, a copy of the files per edit.
 
 The data files are found from the config's root: `defineConfig` records the file it is called from as the config's `file`, and `resolveConfig` gives its directory as `root`. A config bundled into one file sets `root` itself. A config with neither has no data files, and says so, rather than guess the working directory.
 
@@ -749,7 +775,7 @@ A sandbox run does not survive a worker restart: its fakes keep their state in t
 `@sanoma-ai/app` is one UI over a config; another (a Slack bot, an internal tool) can be built on the same pieces, which the package exports for that:
 
 - `describeConfig(config)` and its types (`ConfigDescription`, `WorkflowEntry`, `OpEntry`, `VendorEntry`, `ResourceTypeEntry`, `DeclaredResource`, `ResourceProblem`), and `loadDataFiles(root, connectors)` and `readResources(config)`, from `@sanoma-ai/workflows/describe`: what to render, as plain JSON, with each workflow's outline. Its shape is `ConfigDescriptionSchema`, from `@sanoma-ai/workflows/description` (zod and nothing of Node, so a browser may import it): each entry type is inferred from its schema, and the schema refuses a key it does not name. Beside what the sections above say, a resource type carries its `capabilities` (`host`, `database` and `wakeup` from its spec, `source` for a type a host type's `source` field names, such as `github.repository`), a vendor its `credentials` (each variable its driver's `env` declares: its name, description and whether it is optional, never a value or a status), and the policy its `files` (each `.cedar` file's path and text, the root's then each app's). It is a separate entry so the worker never loads the parser the outline uses, and the lint refuses it in workflow files. `resolveConfig(config)` returns the checked config as a `ResolvedConfig`, with the operations and drivers by id, the resource types by `<vendor>.<type>` (`types`), the workflows by name (the built-ins `drift`, `apply` and `call` among them), its `root` and each vendor's `credentials` (`CredentialStatus`); `isOp(x)` tells an operation from a built-in in a workflow's `uses`.
-- `readSites(root, description, connectors, policies?)`, from `@sanoma-ai/workflows/describe`, which `describeConfig` returns as `sites`: what each site calls, read from its source with oxc and never run (its pages are browser code: what they call is the site's outline), for a workflow's **Used by**; its `site.ts` is loaded. A site is a folder of `sites/` with a `routes/`, named as a URL segment; its `routes/**` and `components/**` (`.ts`, `.tsx`, less tests) are read for each `<RunForm workflow="…" />` and each use of `api`, both imported from `sanoma/site`, called or passed on (`queryFn: api.data.leads.list`): `api.<name>` and `api.<name>.<method>` are the workflow whose `apiNameOf` is `<name>`, `api.data.<collection>.<op>` a collection, `api.<vendor>.<resource>.<op>` the operation of that id. Each is a `SiteCall` (`kind`, `target`, `method`, what it calls of a workflow or collection as written (`start`, `latest`, `list`), `via`, `file`, `line`, `column`, and `page`, the page's path from its `createFileRoute` or `createLazyFileRoute` id, in a page's file); a `SiteEntry` holds a site's `name`, its `title` (`defineSite({ title })` in `site.ts`, the file's default export, which a zod schema checks: a key it does not name, a `login` naming no login half, or `locales` that are no language tags or not on a public site without a login, is a problem), its `pages` (each `SitePage` a `path` from a route file's id, one per path, a layout and its index being one; and on a path with one parameter, such as `/sites/www/blog/$slug`, `content`, the one kind its file reads an entry of by that parameter, `content.<kind>.get(params.slug)` (or `slug`, destructured) with `content` from `sanoma/site`, for the app's sitemap and its pages' languages, which `siteContentPages(root)` gives the app's build alone, path to kind), its `calls`, its `warnings` (on a public site, each page with one parameter whose file reads content but not by that parameter, so the sitemap lists none of its pages: a warning `sanoma check` prints and does not fail on) and its `problems`: each call to a workflow, collection or operation the config does not have (`calls workflow "<name>", which does not exist`), or to an operation a page may not call directly, and, given the policies (`describeConfig` passes them unless they have problems), on a public site each start (`api.<name>(…)`, `.start(…)`, a `RunForm`) and direct call that no company `permit` could let a visitor make, its `when` and `unless` aside (one naming `anonymous`; on a site with a `login`, `anonymous` or the group `visitors`), whose message ends with the permit to add, and, whatever the policies, its call of a built-in workflow or read of a workflow's runs but `.result` (`.latest`, `.runs`, `.approvals`, `.ledger`), which the app refuses a visitor; which `sanoma check` fails on. A name not written out (a variable, a template with holes, a computed member) is skipped, as is a call through a namespace import or a destructured `api`.
+- `readSites(root, description, connectors, policies?)`, from `@sanoma-ai/workflows/describe`, which `describeConfig` returns as `sites`: what each site calls, read from its source with oxc and never run (its pages are browser code: what they call is the site's outline), for a workflow's **Used by**; its `site.ts` is loaded. A site is a folder of `sites/` with a `routes/`, named as a URL segment; its `routes/**` and `components/**` (`.ts`, `.tsx`, less tests) are read for each `<RunForm workflow="…" />` and each use of `api`, both imported from `sanoma/site`, called or passed on (`queryFn: api.data.leads.list`): `api.<name>` and `api.<name>.<method>` are the workflow whose `apiNameOf` is `<name>`, `api.data.<collection>.<op>` a collection, `api.<vendor>.<resource>.<op>` the operation of that id. Each is a `SiteCall` (`kind`, `target`, `method`, what it calls of a workflow or collection as written (`start`, `latest`, `list`), `via`, `file`, `line`, `column`, and `page`, the page's path from its `createFileRoute` or `createLazyFileRoute` id, in a page's file); a `SiteEntry` holds a site's `name`, its `title` (`defineSite({ title })` in `site.ts`, the file's default export, which a zod schema checks: a key it does not name or a field of the wrong type (a number for `icon`) is a problem and that field is left out, the rest still read, so a bad `icon` keeps a site public, though a wrong `public`, `login` or `locales` leaves out all three; a `login` naming no login half, or `locales` that are no language tags or not on a public site without a login, is a problem too), its `pages` (each `SitePage` a `path` from a route file's id, one per path, a layout and its index being one; and on a path with one parameter, such as `/sites/www/blog/$slug`, `content`, the one kind its file reads an entry of by that parameter, `content.<kind>.get(params.slug)` (or `slug`, destructured) with `content` from `sanoma/site`, for the app's sitemap and its pages' languages, which `siteContentPages(root)` gives the app's build alone, path to kind), its `calls`, its `warnings` (on a public site, each page with one parameter whose file reads content but not by that parameter, so the sitemap lists none of its pages: a warning `sanoma check` prints and does not fail on) and its `problems`: each call to a workflow, collection or operation the config does not have (`calls workflow "<name>", which does not exist`), or to an operation a page may not call directly, and, given the policies (`describeConfig` passes them unless they have problems), on a public site each start (`api.<name>(…)`, `.start(…)`, a `RunForm`) and direct call that no company `permit` could let a visitor make, its `when` and `unless` aside (one naming `anonymous`; on a site with a `login`, `anonymous` or the group `visitors`), whose message ends with the permit to add, and, whatever the policies, its call of a built-in workflow or read of a workflow's runs but `.result` (`.latest`, `.runs`, `.approvals`, `.ledger`), which the app refuses a visitor; which `sanoma check` fails on. A name not written out (a variable, a template with holes, a computed member) is skipped, as is a call through a namespace import or a destructured `api`.
 - `generateApi(description)` and `writeApi(root, description)`, from `@sanoma-ai/workflows/describe`: a site's typed `api`, `.sanoma/api.ts` (`API_FILE`), from a `ConfigDescription`, types and JSDoc only and the same text for the same description. It holds a record type per collection and `CompanyApi`: `<apiNameOf(workflow)>: WorkflowFn<input>` per workflow, built-ins too; `<vendor>: { <resource>: { <op>: OpFn<input> } }` for the operations `direct` marks; `data: { <collection>: CollectionApi<record> }`; each member documented from its title or description. Then it augments `sanoma/site`'s `Register`. Inputs are typed from their JSON Schema for the kinds a start form draws, constants, and unions of them (`null` among them); anything else, and every output, is `unknown`. A workflow with `describeConfig`'s api-name problem is left out (`problems`). `writeApi` writes only when the text differs (`wrote`).
 - `SanomaClient`: call an operation directly (`call`, see [Direct calls](#direct-calls)), start runs, list them (`runs({ limit, status, workflow })`) or read a workflow's last result (`latest`), read a run's ledger and approvals, decide approvals, with the checks described above, and start a drift check or an apply and read its report (`drift`, `driftReport`, `apply`, `applyReport`, see [Drift](#drift) and [Apply](#apply)). `client.chats` keeps the operator agent's chats in the config's database: `open({ id, person, engine, title })` (the id the browser gave the new chat), `attach(id, draftId)`, `upsert(id, messages)` (the AI SDK's UI messages, each by its id, a new one after the last), `load(id)`, `get(id)` and `list(person)` (the newest first, `Chat`).
 - `APPROVALS_EVENT` and `decisionEventOf(approvalId)`: the DBOS events a run publishes its approvals and each decision on, for a UI that reads DBOS directly. `ApprovalMessage` is the zod schema of a decision as a run reads it. `RunArgs` is what a run receives: its input, `startedBy` and, for a sandbox run, its scenario as `sandbox`.

package/SECRET-SUPPORT.md

@@ -0,0 +1,33 @@
+# Secret storage and named-account support
+
+Release checkpoint: `sanoma`, `@sanoma-ai/workflows` and `@sanoma-ai/app` **0.10.1**, `@sanoma-ai/connector-supabase` **0.4.9**, `@sanoma-ai/bridge` **0.5** with its matching platform packages, and `@sanoma-ai/connector-neon` **0.2**. Publication and consumer verification remain pending in [#471](https://github.com/Sanoma-AI/sanoma/issues/471); check installed versions before relying on these capabilities. The client pins [provider-bridge v0.2.0](https://github.com/Sanoma-AI/provider-bridge/releases/tag/v0.2.0); the Go binary release alone does not update installed npm packages. GCP provisioning and D1 runtime identity are separate work, outside this 0.10.1 checkpoint.
+
+## Support matrix
+
+| Surface                 | Merged support                                                                                                                                                               | Boundary                                                                                                                                                                                         |
+| ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| Built-in secret store   | Encrypted Postgres values/bundles, logical names, explicit bindings, ownership and atomic version-checked writes/deletes.                                                    | Requires `SANOMA_SECRETS_KEY` outside the database. `SANOMA_SIGNING_KEY` is separate. This is not managed KMS storage.                                                                           |
+| Supabase Vault for BYOC | Server-only `@sanoma-ai/connector-supabase/vault` adapter, private SQL gateway, deployment-scoped database login, managed values and read-only mappings to existing secrets. | Requires gateway installation/grants and bootstrap database authentication. No `SANOMA_SECRETS_KEY` for Vault. Project-wide locks serialize Vault writes; project administrators remain trusted. |
+| Named accounts          | Static declarations, code-defined dynamic creation rules, explicit defaults, account/revision selection through policy and execution, and isolated sandbox accounts.         | The connector must declare and verify its authentication method, and its driver must explicitly support that method. Declaring an account alone does not add driver support.                     |
+| Connection management   | Secure Verify/Review/Save intake, metadata-only prepare/configure/activate gates, ownership-aware controls, Test/Disconnect, storage review and workflow dependency labels.  | Health is last-tested. Pending/uncertain connections cannot execute. Disconnect neither deletes stored credentials nor revokes a vendor token.                                                   |
+| Neon                    | Named `apiKey` connections, verified organization identity, and a new SDK client per authorized invocation.                                                                  | The verifier requires exactly one organization. It does not attest granular permissions or expiry; Neon enforces permissions on each request.                                                    |
+| Provider bridge         | UUID session and fresh provider process per operation, protocol-1 negotiation, process-bound plan tokens, shared release/schema caches and session cleanup.                  | At most 64 active/configuring sessions. No implicit mutation replay. Vendor-specific named authentication still needs an explicit adapter opt-in.                                                |
+
+Configuration and lifecycle contracts remain in [Credentials](README.md#credentials). Follow the [Supabase Vault setup and recovery instructions](../../connectors/supabase/README.md#supabase-vault-as-the-secret-store), [connection UI documentation](../app/README.md#connection-management) and [bridge session contract](../bridge/README.md).
+
+## Connector coverage
+
+**Neon is the only connector in this checkout declaring a named authentication method.** Its [authentication documentation](../../connectors/neon/README.md#authentication) describes the supported bundle and provider verification.
+
+GitHub, Stripe, Supabase and Docker resource drivers use the session-capable bridge, but do not yet opt into named authentication. Supabase Vault is a storage adapter; it does not migrate the Supabase Management API/resource driver. Other connectors retain their existing authentication paths. Login, model and remote halves are also distinct from named operation accounts. This release does not promise multiple named accounts for every connector, nor Gmail, LinkedIn, Reddit or Instagram OAuth connections.
+
+For a new named account, the connector's authentication definition, live verifier, supported driver methods and per-call credential use must all be present. Bridge session isolation supplies the provider-process boundary; it does not supply those vendor-specific pieces.
+
+## Remaining delivery and verification
+
+- Run the release's affected-package and repository checks against its final commit, verify packed installation and the pinned bridge binary, then publish the coordinated npm packages. Source merge and the Go release alone do not complete these steps.
+- Supabase Vault has an actual-extension proof using standard non-superuser administrator permissions in `supabase/postgres:17.6.1.136`. That is not proof of every hosted project's grants/version; validate the target deployment's gateway and scoped login. The [verification procedure](../../connectors/supabase/README.md#verification) uses a disposable database, not production.
+- Managed Cloud GCP KMS storage remains separate work in [#470](https://github.com/Sanoma-AI/sanoma/issues/470). This release does not establish a deployed Cloud identity route, tenant IAM isolation or the required live deployment evidence.
+- OAuth consent, token refresh, OAuth app ownership and reauthorization remain lifecycle work. Declaring an `oauth2` credential shape does not implement those flows.
+- Cross-store migration remains [#468](https://github.com/Sanoma-AI/sanoma/issues/468). Changing a binding or namespace does not transfer credentials or remove the old copy; automated encryption-key rotation is also absent.
+- AWS Secrets Manager [#462](https://github.com/Sanoma-AI/sanoma/issues/462) and HashiCorp Vault [#464](https://github.com/Sanoma-AI/sanoma/issues/464) are deferred. Cloudflare host bootstrap-secret delivery is distinct from its optional account-wide secret-store adapter; this matrix does not claim that adapter is implemented.

package/dist/apps.d.ts

@@ -17,6 +17,12 @@ export declare function appsAt(root: string | undefined): {
     apps: AppEntry[];
     problems: AppProblem[];
 };
+/**
+ * The source URL the app `folder` under `root` is taken from, as its `app.ts` names it; an error
+ * saying why there is none: no such app, its `app.ts` does not load or is not `defineApp({ source })`
+ * (what is wrong, where), or it names none (the company's own app).
+ */
+export declare function appSourceOf(root: string, folder: string): string;
 /**
  * Each import, from a file under one app's folder, of a file under another's, at its place: a
  * warning, since a company may take one app without the other. Static imports, re-exports and

package/dist/apps.js

@@ -5,7 +5,7 @@ import { childrenOf, readSource } from "./ast.js";
 import { exportsOf, loadModules } from "./load.js";
 import { stringValue } from "./outline.js";
 import { APPS_DIR, filesUnder, inside, isDirectory, RELATIVE, relPath } from "./paths.js";
-import { APP_NAME } from "./shared.js";
+import { APP_NAME, problemLine } from "./shared.js";
 /** The apps under `root` (`appsAt`), without what is wrong with them. */
 export const readApps = (root) => appsAt(root).apps;
 /**
@@ -52,6 +52,23 @@ export function appsAt(root) {
     problems.sort((a, b) => a.file.localeCompare(b.file));
     return { apps, problems };
 }
+/**
+ * The source URL the app `folder` under `root` is taken from, as its `app.ts` names it; an error
+ * saying why there is none: no such app, its `app.ts` does not load or is not `defineApp({ source })`
+ * (what is wrong, where), or it names none (the company's own app).
+ */
+export function appSourceOf(root, folder) {
+    if (!APP_NAME.test(folder) || !isDirectory(join(root, APPS_DIR, folder)))
+        throw new Error(`There is no app ${APPS_DIR}/${folder}/`);
+    const file = `${APPS_DIR}/${folder}/app.ts`;
+    const path = join(root, file);
+    const read = existsSync(path) ? appDefinitionOf(file, loadModules(root, [path], [])) : { problems: [] };
+    if (read.problems.length)
+        throw new Error(read.problems.map(problemLine).join("; "));
+    if (read.source === undefined)
+        throw new Error(`${file} names no source: the app is the company's own`);
+    return read.source;
+}
 /** What `app.ts`'s default export, `defineApp({ … })`, may say. */
 const AppDefinitionSchema = z.strictObject({ source: z.string().optional() });
 /** `app.ts`'s `source`, as loading it gave, and what is wrong there; nothing for no file. */

package/dist/apps.js.map

@@ -1 +1 @@
-{"version":3,"file":"apps.js","sourceRoot":"","sources":["../src/apps.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAa,UAAU,EAAE,MAAM,UAAU,CAAC;AAE7D,OAAO,EAAE,SAAS,EAAe,WAAW,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1F,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAYvC,yEAAyE;AACzE,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,IAAwB,EAAc,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;AAEpF;;;;;GAKG;AACH,MAAM,UAAU,MAAM,CAAC,IAAwB;IAC7C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACjC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACzD,MAAM,IAAI,GAAe,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;SACtD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;SAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SAClB,QAAQ,EAAE,CAAC;IACd,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAChE,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,EAAE,GAAG,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,EAAE;YACR,IAAI,EAAE,CAAC;YACP,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,GAAG,EAAE,+FAA+F;SAC9G,CAAC,CAAC;IACL,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAChG,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAkB,CAAC;IACvF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,GAAG,QAAQ,IAAI,IAAI,SAAS,CAAC;QAC1C,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3C,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC;YACR,IAAI;YACJ,GAAG,EAAE,GAAG,QAAQ,IAAI,IAAI,EAAE;YAC1B,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YACzD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC;SAC7D,CAAC,CAAC;IACL,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED,mEAAmE;AACnE,MAAM,mBAAmB,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAE9E,6FAA6F;AAC7F,SAAS,eAAe,CAAC,IAAY,EAAE,MAA2B;IAChE,iDAAiD;IACjD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACvC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAClD,IAAI,SAAS,IAAI,MAAM;QAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,uFAAuF,GAAG,EAAE,CAAC;QAC7G,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC9D,CAAC;IACD,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AACnG,CAAC;AAED,sEAAsE;AACtE,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAEnF;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAwB,EAAE,IAAyB;IACjF,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,SAAS;YACvC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAChC,MAAM,KAAK,GAAG,CAAC,IAAU,EAAE,EAAE;gBAC3B,IAAI,CAAC,IAAI;oBAAE,OAAO;gBAClB,MAAM,SAAS,GACb,IAAI,CAAC,IAAI,KAAK,mBAAmB;oBACjC,IAAI,CAAC,IAAI,KAAK,sBAAsB;oBACpC,IAAI,CAAC,IAAI,KAAK,wBAAwB;oBACpC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK;oBACpB,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,kBAAkB;wBAChC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;wBAC1B,CAAC,CAAC,SAAS,CAAC;gBAClB,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;oBACjD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;oBAC/E,IAAI,KAAK,EAAE,CAAC;wBACV,QAAQ,CAAC,IAAI,CAAC;4BACZ,IAAI,EAAE,GAAG;4BACT,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;4BACtB,OAAO,EAAE,YAAY,SAAS,kBAAkB,KAAK,CAAC,IAAI,wBAAwB,GAAG,CAAC,IAAI,qDAAqD;yBAChJ,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBACD,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,IAAI,CAAC;oBAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACrD,CAAC,CAAC;YACF,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"apps.js","sourceRoot":"","sources":["../src/apps.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAa,UAAU,EAAE,MAAM,UAAU,CAAC;AAE7D,OAAO,EAAE,SAAS,EAAe,WAAW,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1F,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAYpD,yEAAyE;AACzE,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,IAAwB,EAAc,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;AAEpF;;;;;GAKG;AACH,MAAM,UAAU,MAAM,CAAC,IAAwB;IAC7C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACjC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACzD,MAAM,IAAI,GAAe,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;SACtD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;SAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SAClB,QAAQ,EAAE,CAAC;IACd,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAChE,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,EAAE,GAAG,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,EAAE;YACR,IAAI,EAAE,CAAC;YACP,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,GAAG,EAAE,+FAA+F;SAC9G,CAAC,CAAC;IACL,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAChG,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAkB,CAAC;IACvF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,GAAG,QAAQ,IAAI,IAAI,SAAS,CAAC;QAC1C,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3C,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC;YACR,IAAI;YACJ,GAAG,EAAE,GAAG,QAAQ,IAAI,IAAI,EAAE;YAC1B,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YACzD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC;SAC7D,CAAC,CAAC;IACL,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,MAAc;IACtD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,mBAAmB,QAAQ,IAAI,MAAM,GAAG,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,GAAG,QAAQ,IAAI,MAAM,SAAS,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACxG,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACrF,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,gDAAgD,CAAC,CAAC;IACxG,OAAO,IAAI,CAAC,MAAM,CAAC;AACrB,CAAC;AAED,mEAAmE;AACnE,MAAM,mBAAmB,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAE9E,6FAA6F;AAC7F,SAAS,eAAe,CAAC,IAAY,EAAE,MAA2B;IAChE,iDAAiD;IACjD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACvC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAClD,IAAI,SAAS,IAAI,MAAM;QAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,uFAAuF,GAAG,EAAE,CAAC;QAC7G,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC9D,CAAC;IACD,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AACnG,CAAC;AAED,sEAAsE;AACtE,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAEnF;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAwB,EAAE,IAAyB;IACjF,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,SAAS;YACvC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAChC,MAAM,KAAK,GAAG,CAAC,IAAU,EAAE,EAAE;gBAC3B,IAAI,CAAC,IAAI;oBAAE,OAAO;gBAClB,MAAM,SAAS,GACb,IAAI,CAAC,IAAI,KAAK,mBAAmB;oBACjC,IAAI,CAAC,IAAI,KAAK,sBAAsB;oBACpC,IAAI,CAAC,IAAI,KAAK,wBAAwB;oBACpC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK;oBACpB,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,kBAAkB;wBAChC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;wBAC1B,CAAC,CAAC,SAAS,CAAC;gBAClB,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;oBACjD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;oBAC/E,IAAI,KAAK,EAAE,CAAC;wBACV,QAAQ,CAAC,IAAI,CAAC;4BACZ,IAAI,EAAE,GAAG;4BACT,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;4BACtB,OAAO,EAAE,YAAY,SAAS,kBAAkB,KAAK,CAAC,IAAI,wBAAwB,GAAG,CAAC,IAAI,qDAAqD;yBAChJ,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBACD,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,IAAI,CAAC;oBAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACrD,CAAC,CAAC;YACF,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/authentication.d.ts

@@ -1,5 +1,31 @@
 import type { z } from "zod";
+import type { CallContext } from "./op.ts";
 import { type SecretStoreCapabilities } from "./secret-store.ts";
+/** Facts verified with the provider, not account claims supplied by the caller. */
+export interface AuthenticationIdentity {
+    account: string;
+    scopes: readonly string[];
+    /** Unix time in milliseconds. Missing means the provider gives no expiry. */
+    expiresAt?: number;
+}
+export type AuthenticationProblem = "missing" | "expired" | "revoked" | "rejected" | "wrong_account" | "scope_changed" | "uncertain" | "unavailable" | "unsupported";
+/** Safe lifecycle information only: never a provider response, cause or credential. */
+export declare class AuthenticationError extends Error {
+    readonly code = "authentication_failed";
+    readonly retryable: boolean;
+    readonly problem: AuthenticationProblem;
+    constructor(problem: AuthenticationProblem);
+}
+export declare function authenticationProblem(error: unknown): AuthenticationProblem | undefined;
+/** Shared by credential intake and execution; unknown provider failures never imply revocation. */
+export declare function verifyAuthentication(method: Authentication, credentials?: unknown): Promise<AuthenticationIdentity>;
+/** Ephemeral material for one authorized driver invocation; never checkpoint this object. */
+export interface CallAuthentication {
+    method: string;
+    kind: Authentication["kind"];
+    credentialVersion?: string;
+    credentials?: unknown;
+}
 /** Credential schemas and lifecycle are owned by authentication, never by the store provider. */
 export type Authentication<S extends z.ZodType = z.ZodType> = {
     kind: "api-key" | "fields" | "oauth2" | "signed";
@@ -10,13 +36,17 @@ export type Authentication<S extends z.ZodType = z.ZodType> = {
         maxBytes: number;
         conditionalWrites: boolean;
     };
+    verify?(credentials: z.output<S>): Promise<AuthenticationIdentity>;
 } | {
     kind: "workload-identity";
     storage?: never;
     version?: never;
     schema?: never;
+    verify?(): Promise<AuthenticationIdentity>;
 };
 export declare function defineAuthentication<S extends z.ZodType>(definition: Authentication<S>): Authentication<S>;
+/** Typed access inside a driver. A missing or different method never falls back to the environment. */
+export declare function authenticationCredentials<S extends z.ZodType>(method: string, definition: Authentication<S>, call: CallContext): z.output<S>;
 /** Compatibility check before consent, including externally renewed (read-only) OAuth bundles. */
 export declare function checkAuthenticationStore(auth: Authentication, store: SecretStoreCapabilities, management: "sanoma" | "external"): void;
 /** Serialized only at the trusted store boundary, never returned by an operation to a workflow. */

package/dist/authentication.js

@@ -1,9 +1,66 @@
 import { SecretStoreError } from "./secret-store.js";
+/** Safe lifecycle information only: never a provider response, cause or credential. */
+export class AuthenticationError extends Error {
+    code = "authentication_failed";
+    retryable;
+    problem;
+    constructor(problem) {
+        super(`Authentication: ${problem}`);
+        this.problem = problem;
+        this.name = "AuthenticationError";
+        this.retryable = problem === "unavailable";
+    }
+}
+const authenticationProblems = new Set([
+    "missing",
+    "expired",
+    "revoked",
+    "rejected",
+    "wrong_account",
+    "scope_changed",
+    "uncertain",
+    "unavailable",
+    "unsupported",
+]);
+export function authenticationProblem(error) {
+    const failure = error;
+    return failure?.name === "AuthenticationError" && authenticationProblems.has(failure.problem)
+        ? failure.problem
+        : undefined;
+}
+/** Shared by credential intake and execution; unknown provider failures never imply revocation. */
+export async function verifyAuthentication(method, credentials) {
+    if (!method.verify)
+        throw new AuthenticationError("unsupported");
+    try {
+        const identity = await method.verify(credentials);
+        if (typeof identity?.account !== "string" ||
+            !identity.account.trim() ||
+            !Array.isArray(identity.scopes) ||
+            identity.scopes.some((scope) => typeof scope !== "string") ||
+            (identity.expiresAt !== undefined && !Number.isFinite(identity.expiresAt)))
+            throw new AuthenticationError("unavailable");
+        if (identity.expiresAt !== undefined && identity.expiresAt <= Date.now())
+            throw new AuthenticationError("expired");
+        return {
+            account: identity.account,
+            scopes: [...new Set(identity.scopes)].toSorted(),
+            ...(identity.expiresAt !== undefined && { expiresAt: identity.expiresAt }),
+        };
+    }
+    catch (error) {
+        // Structural recognition works across installed copies. Rebuild even recognized errors so
+        // an SDK message, stack or cause attached by a verifier cannot cross this boundary.
+        throw new AuthenticationError(authenticationProblem(error) ?? "unavailable");
+    }
+}
 export function defineAuthentication(definition) {
+    if (definition.verify !== undefined && typeof definition.verify !== "function")
+        throw new SecretStoreError("invalid_configuration");
     if (definition.kind === "workload-identity") {
         if (definition.storage !== undefined || definition.schema !== undefined || definition.version !== undefined)
             throw new SecretStoreError("invalid_configuration");
-        return Object.freeze({ kind: "workload-identity" });
+        return Object.freeze({ ...definition });
     }
     if (!["api-key", "fields", "oauth2", "signed"].includes(definition.kind) ||
         !Number.isSafeInteger(definition.version) ||
@@ -18,6 +75,19 @@ export function defineAuthentication(definition) {
     }
     return Object.freeze({ ...definition, storage: Object.freeze({ ...definition.storage }) });
 }
+/** Typed access inside a driver. A missing or different method never falls back to the environment. */
+export function authenticationCredentials(method, definition, call) {
+    if (definition.kind === "workload-identity" ||
+        call.authentication?.method !== method ||
+        call.authentication.kind !== definition.kind)
+        throw new SecretStoreError("unsupported");
+    try {
+        return definition.schema.parse(call.authentication.credentials);
+    }
+    catch {
+        throw new SecretStoreError("invalid_value");
+    }
+}
 /** Compatibility check before consent, including externally renewed (read-only) OAuth bundles. */
 export function checkAuthenticationStore(auth, store, management) {
     if (auth.kind === "workload-identity")

package/dist/authentication.js.map

@@ -1 +1 @@
-{"version":3,"file":"authentication.js","sourceRoot":"","sources":["../src/authentication.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAgC,MAAM,mBAAmB,CAAC;AAYnF,MAAM,UAAU,oBAAoB,CAAsB,UAA6B;IACrF,IAAI,UAAU,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QAC5C,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS;YACzG,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,CAAC,CAAC;QACtD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,IACE,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;QACpE,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC;QACzC,UAAU,CAAC,OAAO,GAAG,CAAC;QACtB,OAAO,UAAU,CAAC,MAAM,EAAE,SAAS,KAAK,UAAU;QAClD,CAAC,UAAU,CAAC,OAAO;QACnB,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC;QAClD,UAAU,CAAC,OAAO,CAAC,QAAQ,GAAG,CAAC;QAC/B,OAAO,UAAU,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS;QAChD,OAAO,UAAU,CAAC,OAAO,CAAC,iBAAiB,KAAK,SAAS,EACzD,CAAC;QACD,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;AAC7F,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,wBAAwB,CACtC,IAAoB,EACpB,KAA8B,EAC9B,UAAiC;IAEjC,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB;QAAE,OAAO;IAC9C,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACpF,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,UAAU,KAAK,UAAU,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACrH,IAAI,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,KAAK,CAAC,iBAAiB,KAAK,MAAM;QAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC;AACtH,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,iBAAiB,CAAsB,IAAuB,EAAE,KAAiB;IAC/F,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB;QAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACjF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,gBAAgB,CAAC,eAAe,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9E,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAChG,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,gBAAgB;YAAE,MAAM,IAAI,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9E,MAAM,IAAI,gBAAgB,CAAC,eAAe,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAsB,IAAuB,EAAE,OAAe;IAC7F,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB;QAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACjF,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAChG,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,gBAAgB,CAAC,eAAe,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,gBAAgB;YAAE,MAAM,IAAI,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9E,MAAM,IAAI,gBAAgB,CAAC,eAAe,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC"}
+{"version":3,"file":"authentication.js","sourceRoot":"","sources":["../src/authentication.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAgC,MAAM,mBAAmB,CAAC;AAqBnF,uFAAuF;AACvF,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,IAAI,GAAG,uBAAuB,CAAC;IAC/B,SAAS,CAAU;IACnB,OAAO,CAAwB;IACxC,YAAY,OAA8B;QACxC,KAAK,CAAC,mBAAmB,OAAO,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,OAAO,KAAK,aAAa,CAAC;IAC7C,CAAC;CACF;AAED,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAwB;IAC5D,SAAS;IACT,SAAS;IACT,SAAS;IACT,UAAU;IACV,eAAe;IACf,eAAe;IACf,WAAW;IACX,aAAa;IACb,aAAa;CACd,CAAC,CAAC;AAEH,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,MAAM,OAAO,GAAG,KAA4C,CAAC;IAC7D,OAAO,OAAO,EAAE,IAAI,KAAK,qBAAqB,IAAI,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,OAAQ,CAAC;QAC5F,CAAC,CAAC,OAAO,CAAC,OAAO;QACjB,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAsB,EACtB,WAAqB;IAErB,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,mBAAmB,CAAC,aAAa,CAAC,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAClD,IACE,OAAO,QAAQ,EAAE,OAAO,KAAK,QAAQ;YACrC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE;YACxB,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC/B,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;YAC1D,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAE1E,MAAM,IAAI,mBAAmB,CAAC,aAAa,CAAC,CAAC;QAC/C,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,IAAI,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACnH,OAAO;YACL,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;YAChD,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;SAC3E,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,0FAA0F;QAC1F,oFAAoF;QACpF,MAAM,IAAI,mBAAmB,CAAC,qBAAqB,CAAC,KAAK,CAAC,IAAI,aAAa,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC;AA2BD,MAAM,UAAU,oBAAoB,CAAsB,UAA6B;IACrF,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,UAAU,CAAC,MAAM,KAAK,UAAU;QAC5E,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,CAAC,CAAC;IACtD,IAAI,UAAU,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QAC5C,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS;YACzG,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,CAAC,CAAC;QACtD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,IACE,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;QACpE,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC;QACzC,UAAU,CAAC,OAAO,GAAG,CAAC;QACtB,OAAO,UAAU,CAAC,MAAM,EAAE,SAAS,KAAK,UAAU;QAClD,CAAC,UAAU,CAAC,OAAO;QACnB,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC;QAClD,UAAU,CAAC,OAAO,CAAC,QAAQ,GAAG,CAAC;QAC/B,OAAO,UAAU,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS;QAChD,OAAO,UAAU,CAAC,OAAO,CAAC,iBAAiB,KAAK,SAAS,EACzD,CAAC;QACD,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;AAC7F,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,yBAAyB,CACvC,MAAc,EACd,UAA6B,EAC7B,IAAiB;IAEjB,IACE,UAAU,CAAC,IAAI,KAAK,mBAAmB;QACvC,IAAI,CAAC,cAAc,EAAE,MAAM,KAAK,MAAM;QACtC,IAAI,CAAC,cAAc,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI;QAE5C,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,gBAAgB,CAAC,eAAe,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,wBAAwB,CACtC,IAAoB,EACpB,KAA8B,EAC9B,UAAiC;IAEjC,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB;QAAE,OAAO;IAC9C,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACpF,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,UAAU,KAAK,UAAU,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACrH,IAAI,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,KAAK,CAAC,iBAAiB,KAAK,MAAM;QAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC;AACtH,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,iBAAiB,CAAsB,IAAuB,EAAE,KAAiB;IAC/F,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB;QAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACjF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,gBAAgB,CAAC,eAAe,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9E,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAChG,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,gBAAgB;YAAE,MAAM,IAAI,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9E,MAAM,IAAI,gBAAgB,CAAC,eAAe,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAsB,IAAuB,EAAE,OAAe;IAC7F,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB;QAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACjF,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAChG,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,gBAAgB,CAAC,eAAe,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,gBAAgB;YAAE,MAAM,IAAI,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9E,MAAM,IAAI,gBAAgB,CAAC,eAAe,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC"}

package/dist/call.js

@@ -339,14 +339,15 @@ async function callOp(run, id, input, place, ref) {
     // before the step is recorded asks again.
     const connection = await DBOS.runStep(async () => {
         if (run.sandbox !== undefined) {
-            if (ref)
-                throw new SanomaError("invalid_input", "Named sandbox connections require explicit fake account state");
-            return undefined;
+            if (!run.fakeConnection)
+                throw new SanomaError("invalid_input", "Sandbox account state is unavailable");
+            return run.fakeConnection(op.vendor, ref);
         }
         return run.state.connections?.select(op.vendor, ref, run.actor.id);
     }, { name: `connection:${op.id}` });
     const decideStep = () => DBOS.runStep(async () => {
-        await run.state.connections?.assertCurrent(connection, run.actor.id);
+        if (run.sandbox === undefined)
+            await run.state.connections?.assertCurrent(connection, run.actor.id);
         return decide(run, op, parsed, connection);
     }, { name: `policy:${op.id}` });
     let decision = await decideStep();
@@ -401,7 +402,8 @@ async function callOp(run, id, input, place, ref) {
         result = await DBOS.runStep(async () => {
             const at = Date.now();
             attempt = DBOS.stepStatus?.currentAttempt ?? 1;
-            await run.state.connections?.assertCurrent(connection, run.actor.id);
+            if (run.sandbox === undefined)
+                await run.state.connections?.assertCurrent(connection, run.actor.id);
             const secrets = secretsOf(run);
             const context = {
                 idempotencyKey: `${run.id}:${seq}`,

package/dist/call.js.map

@@ -1 +1 @@
-{"version":3,"file":"call.js","sourceRoot":"","sources":["../src/call.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,yBAAyB,EAAE,KAAK,IAAI,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAwB,MAAM,gBAAgB,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,EACL,UAAU,EAIV,qBAAqB,EACrB,QAAQ,EAER,UAAU,EACV,UAAU,GAGX,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,MAAM,EACN,SAAS,EACT,SAAS,EACT,OAAO,EACP,QAAQ,EACR,YAAY,EACZ,iBAAiB,EACjB,WAAW,GACZ,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AACjC,OAAO,EAAoB,IAAI,EAAW,MAAM,SAAS,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAiB,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAA+C,UAAU,EAAyB,MAAM,aAAa,CAAC;AAEvH,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EACL,aAAa,EACb,aAAa,EACb,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,MAAM,EAEN,eAAe,GAChB,MAAM,aAAa,CAAC;AAErB,oGAAoG;AACpG,MAAM,WAAW,GAAG,CAAC,GAAY,EAAE,EAAE,CACnC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,UAAU,CAAC,0BAA0B,IAAI,CAAC,YAAY,yBAAyB,CAAC,CAAC;AAExH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAY,EAAE,KAAmC;IACrF,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,CAAC;AAC7E,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,QAAQ,CAAC,EAAM,EAAE,KAAc;IAC7C,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5G,MAAM,GAAG,GAA4B,EAAE,GAAG,KAAK,EAAE,CAAC;IAClD,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,MAAM;QAAE,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,GAAG,CAAC;IACnF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,uDAAuD;AACvD,MAAM,YAAY,GAAG,CAAC,CAAC;AAEvB,qFAAqF;AACrF,MAAM,aAAa,GAAG,CAAC,GAAY,EAAE,EAAE,CAAC,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC;AAExF;;;;;GAKG;AACH,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,aAAa,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,OAAO,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,MAAM,CAAI,GAAQ,EAAE,IAAsB;IACjD,4FAA4F;IAC5F,4FAA4F;IAC5F,6FAA6F;IAC7F,sFAAsF;IACtF,8CAA8C;IAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI;SAClB,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;SAC/C,IAAI,CAAC,GAAG,EAAE;QACT,aAAa,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;IACL,6FAA6F;IAC7F,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,IAAI,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;AAEtB,kGAAkG;AAClG,SAAS,aAAa,CAAC,GAAQ;IAC7B,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QACd,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,OAAO,GAAG,CAAC,EAAE,2DAA2D,EAAE;YAC3G,KAAK,EAAE,GAAG,CAAC,EAAE;SACd,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAYD,sIAAsI;AACtI,MAAM,KAAK,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAE3E;;;;;;;;GAQG;AACH,MAAM,UAAU,QAAQ,CAAC,EAAgC,EAAE,GAAQ;IACjE,MAAM,IAAI,GAAG,EAAE,CAAC,IAAsB,CAAC;IACvC,4HAA4H;IAC5H,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,IAA0D,EAAE,EAAE,CAC1F,KAAK,UAAU,MAAM,CAAC,GAAG,IAAe;QACtC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IACrD,CAAC,CAAC;IACJ,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,sGAAsG;QACtG,MAAM,KAAK,GAAG,EAAE,CAAC,EAAE;aAChB,KAAK,CAAC,GAAG,CAAC;aACV,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;aACZ,MAAM,CAAsB,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;QACvE,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,OAAwC,EAAE,EAAE,CACvF,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CACf,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,CAChG,CACF,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,KAAK,GAAG,GAAG,CAAC,EAAE,CAAC;IACvB,OAAO,CAAC,GAAG,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAClD,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,KAAa,EAAE,GAAoB,EAAE,EAAE,CAClF,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CACf,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC,CACtG,CACF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,KAAK,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC5C,iCAAiC;QACjC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAE,EAAE,CAAC,CAAC,CAC5E,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACjG,OAAO,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,uFAAuF;AACvF,SAAS,OAAO,CAAC,OAAgC,EAAE,IAAY,EAAE,QAAgB;IAC/E,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,GAAG,CAAC;YACN,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;gBACzC,CAAC,CAAC,OAAO,CAAC,KAAgC,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,EAAE,QAAQ,CAAC;gBACvE,CAAC,CAAC,KAAK,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;AACrC,CAAC;AASD;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,EAAY;IAC5B,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,eAAe,CAAC;IACpC,KAAK,CAAC,eAAe,GAAG,CAAC,CAAC;IAC1B,IAAI,CAAC;QACH,KAAK,CAAC,iBAAiB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtC,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,eAAe,GAAG,KAAK,CAAC;IAChC,CAAC;IACD,wGAAwG;IACxG,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACnD,MAAM,CAAC,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,qCAAqC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzF,MAAM,IAAI,GAAG,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/E,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,SAAS,CAAC,GAAQ,EAAE,EAAY,EAAE,IAAY;IACrD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC;IAClC,MAAM,IAAI,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC1B,IAAI,CAAC,IAAI;QAAE,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,gCAAgC,CAAC,CAAC;IACjF,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI;QAC5B,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,mBAAmB,QAAQ,WAAW,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5F,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9E,IAAI,CAAC,IAAI;QAAE,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,2BAA2B,QAAQ,YAAY,CAAC,CAAC;IAChG,iGAAiG;IACjG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;QAAE,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,6BAA6B,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,GAAQ,EAAE,IAAY,EAAE,IAA0B,EAAE,GAAW;IACnF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,iCAAiC,CAAC;IACpG,OAAO,IAAI,WAAW,CACpB,qBAAqB,EACrB,OAAO,IAAI,oBAAoB,KAAK,KAAK,GAAG,8DAA8D;QACxG,mEAAmE,EACrE,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAC7D,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,SAAS,MAAM,CAAmB,GAAM,EAAE,IAAY,EAAE,QAAgB;IACtE,OAAO,IAAI,KAAK,CAAC,GAAG,EAAE;QACpB,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ;YACvB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,IAAI,MAAM;gBAAE,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC1G,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,IAAI,GAAG,sDAAsD,QAAQ,GAAG,CAAC,CAAC;QACnG,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,mGAAmG;AACnG,SAAS,QAAQ,CAAC,EAAM,EAAE,KAAc;IACtC,IAAI,CAAC,EAAE,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAY,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,yBAAyB,OAAO,MAAM,gBAAgB,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,GAAQ,EACR,EAAM,EACN,KAAc,EACd,UAA+B;IAE/B,MAAM,IAAI,GAAG;QACX,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,SAAS,EAAE,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,CAC9C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,KAAK,UAAU,EAAE,QAAQ,CAC3E;KACF,CAAC;IACF,sEAAsE;IACtE,MAAM,IAAI,GACR,EAAE,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpH,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC;IAC7B,kFAAkF;IAClF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CACnF,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAClB,EAAE,GAAG,EAAE,EACP,EAAE,cAAc,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,GAAG,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CACjH,CACF,CAAC;IACF,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;IACrG,OAAO,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED,iHAAiH;AACjH,MAAM,QAAQ,GAAG,CAAC,GAAQ,EAAE,EAAU,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;AAEtH,sFAAsF;AACtF,MAAM,SAAS,GAAG,CAAC,GAAQ,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,WAAY,CAAC,CAAC;AAEnG,yGAAyG;AACzG,MAAM,MAAM,GAAG,CAAC,EAAM,EAAE,KAAc,EAAE,KAAgB,EAAE,GAAsB,EAAc,EAAE,CAAC,CAAC;IAChG,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC;IAClB,MAAM,EAAE,EAAE,CAAC,MAAM;IACjB,GAAG,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACtB,KAAK;IACL,KAAK;IACL,GAAG;IACH,GAAG,CAAC,EAAE,CAAC,EAAE,KAAK,YAAY,IAAI,EAAE,MAAM,EAAG,KAA4C,CAAC,KAAK,EAAE,CAAC;CAC/F,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,MAAc,EACd,EAAM,EACN,KAAc,EACd,WAA4C,EAC5C,IAAiE;IAEjE,MAAM,UAAU,GAAG,EAAE,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxF,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,MAAM,IAAI,EAAE,CAAC,IAAI,KAAK,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IAClG,MAAM,GAAG,GACP,EAAE,CAAC,IAAI,KAAK,MAAM;QAChB,CAAC,CAAE,KAA6C,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;QACvE,CAAC,CAAE,KAA0B,CAAC,GAAG,CAAC;IACtC,IAAI,KAA+B,CAAC;IACpC,IAAI,CAAC;QACH,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,WAAW,IAAI,EAAE,CAAC,QAAQ,MAAM,EAAE,GAAG,CAAC,CAA6B,CAAC;IAC7F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,WAAW,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;QAChC,MAAM,QAAQ,CAAC,IAAI,KAAK,CAAC,sBAAsB,EAAE,CAAC,EAAE,qBAAqB,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IACtH,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CACxB,MAAc,EACd,EAAM,EACN,KAAc,EACd,KAAgB,EAChB,GAAsB,EACtB,MAAM,GAA8C,EAAE;IAEtD,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC;IAC7D,OAAO,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CACzB,MAAc,EACd,QAAgB,EAChB,KAAc,EACd,KAAgB,EAChB,SAAS,GAA6B,EAAE;IAExC,OAAO,GAAG,CAAC,MAAM,EAAE,GAAG,eAAe,GAAG,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;AAC7G,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,WAAW,CACzB,QAAgB,EAChB,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAA0C;IAEpE,OAAO;QACL,QAAQ;QACR,KAAK,EAAE,KAAK,IAAI,GAAG,eAAe,GAAG,QAAQ,UAAU,aAAa,CAAC,QAAQ,CAAC,EAAE;QAChF,GAAG,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,CAAC;KAC5B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,GAAG,CACV,MAAc,EACd,EAAU,EACV,MAAsB,EACtB,KAAK,GAAiC,EAAE,OAAO,EAAE,KAAK,EAAE;IAExD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0FAA0F;QAC1F,mCAAmC;QACnC,IAAI,qBAAqB,CAAC,GAAG,EAAE,KAAK,CAAC;YAAE,MAAM,GAAG,CAAC;QACjD,MAAM,QAAQ,CAAC,IAAI,KAAK,CAAC,8BAA8B,EAAE,KAAK,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;AAClG,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,GAAQ,EAAE,EAAU,EAAE,KAAc,EAAE,KAAa,EAAE,GAAmB;IAC5F,yFAAyF;IACzF,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjC,qDAAqD;IACrD,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7B,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,GAAG,CAAC,OAAO,KAAK,SAAS;YACvB,CAAC,CAAC,8BAA8B,EAAE,iBAAiB;YACnD,CAAC,CAAC,4BAA4B,EAAE,8DAA8D,CACjG,CAAC;IACJ,CAAC;IACD,kGAAkG;IAClG,0DAA0D;IAC1D,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACnD,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI,gBAAgB,QAAQ,CAAC,QAAQ,OAAO,EAAE;YACxG,EAAE,EAAE,EAAE,CAAC,EAAE;YACT,QAAQ,EAAE,GAAG,CAAC,QAAQ;SACvB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,EAAE,4BAA4B,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/G,yFAAyF;IACzF,yFAAyF;IACzF,uFAAuF;IACvF,gFAAgF;IAChF,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC;IACtB,uFAAuF;IACvF,wFAAwF;IACxF,0CAA0C;IAC1C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CACnC,KAAK,IAAI,EAAE;QACT,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,GAAG;gBACL,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,+DAA+D,CAAC,CAAC;YAC1G,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACrE,CAAC,EACD,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,EAAE,EAAE,EAAE,CAChC,CAAC;IACF,MAAM,UAAU,GAAG,GAAG,EAAE,CACtB,IAAI,CAAC,OAAO,CACV,KAAK,IAAI,EAAE;QACT,MAAM,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,CAAC,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrE,OAAO,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IAC7C,CAAC,EACD,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAC5B,CAAC;IACJ,IAAI,QAAQ,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG;QACX,IAAI,EAAE,WAAW;QACjB,EAAE,EAAE,EAAE,CAAC,EAAE;QACT,GAAG,KAAK;QACR,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,KAAK,EAAE,MAAM;QACb,QAAQ;QACR,GAAG,CAAC,UAAU,IAAI,EAAE,UAAU,EAAE,CAAC;KACzB,CAAC;IAEX,yFAAyF;IACzF,SAAS,CAAC;QACR,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,IAAI,iBAAiB,CAAC,EAAE,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC1D,MAAM,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;YAC/G,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;YAAE,MAAM;QACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC,EAAE,UAAU,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrF,IAAI,CAAC;YACH,kCAAkC;YAClC,MAAM,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE;gBACvF,EAAE,EAAE,EAAE,CAAC,EAAE;gBACT,GAAG;gBACH,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,UAAU,EAAE,UAAU,EAAE,QAAQ;aACjC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,6FAA6F;YAC7F,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,IAAI,KAAK,mBAAmB,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;gBAClE,MAAM,QAAQ,GAAI,GAAmB,CAAC,IAAI,CAAC,UAAoB,CAAC;gBAChE,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;gBAChG,MAAM,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YACvC,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,QAAQ,GAAG,MAAM,UAAU,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,2FAA2F;IAC3F,mFAAmF;IACnF,IAAI,OAA2B,CAAC;IAChC,IAAI,MAA4E,CAAC;IACjF,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CACzB,KAAK,IAAI,EAAE;YACT,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACtB,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,cAAc,IAAI,CAAC,CAAC;YAC/C,MAAM,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,CAAC,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACrE,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAC/B,MAAM,OAAO,GAAgB;gBAC3B,cAAc,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,EAAE;gBAClC,KAAK,EAAE,GAAG,CAAC,EAAE;gBACb,IAAI,EAAE,EAAE,CAAC,EAAE;gBACX,OAAO;gBACP,OAAO;gBACP,SAAS,EAAE,GAAG,CAAC,KAAK;gBACpB,GAAG,CAAC,UAAU,IAAI,EAAE,UAAU,EAAE,CAAC;gBACjC,oGAAoG;gBACpG,EAAE,EAAE,GAAG,CAAC,QAAQ,KAAK,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,EAAE,EAAE;aACpE,CAAC;YACF,0FAA0F;YAC1F,kFAAkF;YAClF,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;YAC1D,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC;QAC9D,CAAC,EACD;YACE,IAAI,EAAE,EAAE,CAAC,EAAE;YACX,cAAc,EAAE,EAAE,CAAC,UAAU;YAC7B,WAAW,EAAE,YAAY;YACzB,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,YAAY;SACpE,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,wFAAwF;QACxF,qFAAqF;QACrF,MAAM,MAAM,GAAG,KAAK,CAClB,GAAG,EACH,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EACrG,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,CACrB,CAAC;QACF,IAAI,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,MAAM,EAAE,6BAA6B,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;;YACzG,MAAM,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QAC1C,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,KAAK,CACT,GAAG,EACH,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CACxG,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,yFAAyF;QACzF,mFAAmF;QACnF,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,mDAAmD,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAClH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,KAAa,EAAE,GAAoB;IACxD,MAAM,OAAO,GAAG,YAAY,CAAC,qBAAqB,EAAE,GAAG,EAAE,iBAAiB,KAAK,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAChG,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;AACtD,CAAC;AAED,oGAAoG;AACpG,SAAS,UAAU,CAAC,GAAY;IAC9B,MAAM,KAAK,GAAG,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,IAAI,GAAG,CAAC;IACxE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,aAAa,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACtF,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,GAAG,CAAC,GAAQ,EAAE,IAAa,EAAE,IAAY;IACtD,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;IACtC,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,gEAAgE,EAAE;YACvG,KAAK,EAAE,KAAK,CAAC,EAAE;SAChB,CAAC,CAAC;IACL,CAAC;IACD,gGAAgG;IAChG,IAAI,GAAG,CAAC,KAAK;QAAE,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,wDAAwD,CAAC,CAAC;IAChH,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IAC1D,MAAM,EAAE,GAAG,OAAO,GAAG,CAAC,GAAG,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAc,EAAE,CAAC;IAC9B,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC;IACjB,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YAChD,OAAO,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;YAAS,CAAC;QACT,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC;IACpB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,KAAK,CAAC,GAAQ,EAAE,GAAY,EAAE,EAAU;IACrD,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC;IACtB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;IACjC,MAAM,KAAK,GACT,OAAO,IAAI,GAAG;QACZ,CAAC,CAAC,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;YAC7B,CAAC,CAAC,GAAG,CAAC,KAAK;YACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC;QACzB,CAAC,CAAC,OAAO;YACP,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;YACb,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,KAAK;YAC1B,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,MAAM;YAC3B,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,SAAS;YAC5B,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,UAAU,CAAC;IACnC,MAAM,EAAE,GAAG,KAAK,GAAG,OAAO,CAAC;IAC3B,MAAM,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAC5F,2FAA2F;IAC3F,IAAI,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5F,CAAC;AACH,CAAC"}
+{"version":3,"file":"call.js","sourceRoot":"","sources":["../src/call.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,yBAAyB,EAAE,KAAK,IAAI,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAwB,MAAM,gBAAgB,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,EACL,UAAU,EAIV,qBAAqB,EACrB,QAAQ,EAER,UAAU,EACV,UAAU,GAGX,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,MAAM,EACN,SAAS,EACT,SAAS,EACT,OAAO,EACP,QAAQ,EACR,YAAY,EACZ,iBAAiB,EACjB,WAAW,GACZ,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AACjC,OAAO,EAAoB,IAAI,EAAW,MAAM,SAAS,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAiB,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAA+C,UAAU,EAAyB,MAAM,aAAa,CAAC;AAEvH,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EACL,aAAa,EACb,aAAa,EACb,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,MAAM,EAEN,eAAe,GAChB,MAAM,aAAa,CAAC;AAErB,oGAAoG;AACpG,MAAM,WAAW,GAAG,CAAC,GAAY,EAAE,EAAE,CACnC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,UAAU,CAAC,0BAA0B,IAAI,CAAC,YAAY,yBAAyB,CAAC,CAAC;AAExH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAY,EAAE,KAAmC;IACrF,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,CAAC;AAC7E,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,QAAQ,CAAC,EAAM,EAAE,KAAc;IAC7C,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5G,MAAM,GAAG,GAA4B,EAAE,GAAG,KAAK,EAAE,CAAC;IAClD,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,MAAM;QAAE,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,GAAG,CAAC;IACnF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,uDAAuD;AACvD,MAAM,YAAY,GAAG,CAAC,CAAC;AAEvB,qFAAqF;AACrF,MAAM,aAAa,GAAG,CAAC,GAAY,EAAE,EAAE,CAAC,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC;AAExF;;;;;GAKG;AACH,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,aAAa,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,OAAO,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,MAAM,CAAI,GAAQ,EAAE,IAAsB;IACjD,4FAA4F;IAC5F,4FAA4F;IAC5F,6FAA6F;IAC7F,sFAAsF;IACtF,8CAA8C;IAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI;SAClB,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;SAC/C,IAAI,CAAC,GAAG,EAAE;QACT,aAAa,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;IACL,6FAA6F;IAC7F,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,IAAI,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;AAEtB,kGAAkG;AAClG,SAAS,aAAa,CAAC,GAAQ;IAC7B,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QACd,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,OAAO,GAAG,CAAC,EAAE,2DAA2D,EAAE;YAC3G,KAAK,EAAE,GAAG,CAAC,EAAE;SACd,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAYD,sIAAsI;AACtI,MAAM,KAAK,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAE3E;;;;;;;;GAQG;AACH,MAAM,UAAU,QAAQ,CAAC,EAAgC,EAAE,GAAQ;IACjE,MAAM,IAAI,GAAG,EAAE,CAAC,IAAsB,CAAC;IACvC,4HAA4H;IAC5H,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,IAA0D,EAAE,EAAE,CAC1F,KAAK,UAAU,MAAM,CAAC,GAAG,IAAe;QACtC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IACrD,CAAC,CAAC;IACJ,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,sGAAsG;QACtG,MAAM,KAAK,GAAG,EAAE,CAAC,EAAE;aAChB,KAAK,CAAC,GAAG,CAAC;aACV,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;aACZ,MAAM,CAAsB,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;QACvE,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,OAAwC,EAAE,EAAE,CACvF,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CACf,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,CAChG,CACF,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,KAAK,GAAG,GAAG,CAAC,EAAE,CAAC;IACvB,OAAO,CAAC,GAAG,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAClD,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,KAAa,EAAE,GAAoB,EAAE,EAAE,CAClF,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CACf,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC,CACtG,CACF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,KAAK,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC5C,iCAAiC;QACjC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAE,EAAE,CAAC,CAAC,CAC5E,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACjG,OAAO,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,uFAAuF;AACvF,SAAS,OAAO,CAAC,OAAgC,EAAE,IAAY,EAAE,QAAgB;IAC/E,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,GAAG,CAAC;YACN,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;gBACzC,CAAC,CAAC,OAAO,CAAC,KAAgC,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,EAAE,QAAQ,CAAC;gBACvE,CAAC,CAAC,KAAK,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;AACrC,CAAC;AASD;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,EAAY;IAC5B,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,eAAe,CAAC;IACpC,KAAK,CAAC,eAAe,GAAG,CAAC,CAAC;IAC1B,IAAI,CAAC;QACH,KAAK,CAAC,iBAAiB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtC,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,eAAe,GAAG,KAAK,CAAC;IAChC,CAAC;IACD,wGAAwG;IACxG,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACnD,MAAM,CAAC,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,qCAAqC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzF,MAAM,IAAI,GAAG,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/E,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,SAAS,CAAC,GAAQ,EAAE,EAAY,EAAE,IAAY;IACrD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC;IAClC,MAAM,IAAI,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC1B,IAAI,CAAC,IAAI;QAAE,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,gCAAgC,CAAC,CAAC;IACjF,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI;QAC5B,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,mBAAmB,QAAQ,WAAW,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5F,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9E,IAAI,CAAC,IAAI;QAAE,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,2BAA2B,QAAQ,YAAY,CAAC,CAAC;IAChG,iGAAiG;IACjG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;QAAE,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,6BAA6B,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,GAAQ,EAAE,IAAY,EAAE,IAA0B,EAAE,GAAW;IACnF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,iCAAiC,CAAC;IACpG,OAAO,IAAI,WAAW,CACpB,qBAAqB,EACrB,OAAO,IAAI,oBAAoB,KAAK,KAAK,GAAG,8DAA8D;QACxG,mEAAmE,EACrE,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAC7D,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,SAAS,MAAM,CAAmB,GAAM,EAAE,IAAY,EAAE,QAAgB;IACtE,OAAO,IAAI,KAAK,CAAC,GAAG,EAAE;QACpB,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ;YACvB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,IAAI,MAAM;gBAAE,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC1G,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,IAAI,GAAG,sDAAsD,QAAQ,GAAG,CAAC,CAAC;QACnG,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,mGAAmG;AACnG,SAAS,QAAQ,CAAC,EAAM,EAAE,KAAc;IACtC,IAAI,CAAC,EAAE,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAY,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,yBAAyB,OAAO,MAAM,gBAAgB,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,GAAQ,EACR,EAAM,EACN,KAAc,EACd,UAA+B;IAE/B,MAAM,IAAI,GAAG;QACX,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,SAAS,EAAE,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,CAC9C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,KAAK,UAAU,EAAE,QAAQ,CAC3E;KACF,CAAC;IACF,sEAAsE;IACtE,MAAM,IAAI,GACR,EAAE,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpH,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC;IAC7B,kFAAkF;IAClF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CACnF,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAClB,EAAE,GAAG,EAAE,EACP,EAAE,cAAc,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,GAAG,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CACjH,CACF,CAAC;IACF,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;IACrG,OAAO,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED,iHAAiH;AACjH,MAAM,QAAQ,GAAG,CAAC,GAAQ,EAAE,EAAU,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;AAEtH,sFAAsF;AACtF,MAAM,SAAS,GAAG,CAAC,GAAQ,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,WAAY,CAAC,CAAC;AAEnG,yGAAyG;AACzG,MAAM,MAAM,GAAG,CAAC,EAAM,EAAE,KAAc,EAAE,KAAgB,EAAE,GAAsB,EAAc,EAAE,CAAC,CAAC;IAChG,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC;IAClB,MAAM,EAAE,EAAE,CAAC,MAAM;IACjB,GAAG,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACtB,KAAK;IACL,KAAK;IACL,GAAG;IACH,GAAG,CAAC,EAAE,CAAC,EAAE,KAAK,YAAY,IAAI,EAAE,MAAM,EAAG,KAA4C,CAAC,KAAK,EAAE,CAAC;CAC/F,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,MAAc,EACd,EAAM,EACN,KAAc,EACd,WAA4C,EAC5C,IAAiE;IAEjE,MAAM,UAAU,GAAG,EAAE,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxF,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,MAAM,IAAI,EAAE,CAAC,IAAI,KAAK,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IAClG,MAAM,GAAG,GACP,EAAE,CAAC,IAAI,KAAK,MAAM;QAChB,CAAC,CAAE,KAA6C,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;QACvE,CAAC,CAAE,KAA0B,CAAC,GAAG,CAAC;IACtC,IAAI,KAA+B,CAAC;IACpC,IAAI,CAAC;QACH,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,WAAW,IAAI,EAAE,CAAC,QAAQ,MAAM,EAAE,GAAG,CAAC,CAA6B,CAAC;IAC7F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,WAAW,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;QAChC,MAAM,QAAQ,CAAC,IAAI,KAAK,CAAC,sBAAsB,EAAE,CAAC,EAAE,qBAAqB,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IACtH,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CACxB,MAAc,EACd,EAAM,EACN,KAAc,EACd,KAAgB,EAChB,GAAsB,EACtB,MAAM,GAA8C,EAAE;IAEtD,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC;IAC7D,OAAO,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CACzB,MAAc,EACd,QAAgB,EAChB,KAAc,EACd,KAAgB,EAChB,SAAS,GAA6B,EAAE;IAExC,OAAO,GAAG,CAAC,MAAM,EAAE,GAAG,eAAe,GAAG,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;AAC7G,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,WAAW,CACzB,QAAgB,EAChB,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAA0C;IAEpE,OAAO;QACL,QAAQ;QACR,KAAK,EAAE,KAAK,IAAI,GAAG,eAAe,GAAG,QAAQ,UAAU,aAAa,CAAC,QAAQ,CAAC,EAAE;QAChF,GAAG,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,CAAC;KAC5B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,GAAG,CACV,MAAc,EACd,EAAU,EACV,MAAsB,EACtB,KAAK,GAAiC,EAAE,OAAO,EAAE,KAAK,EAAE;IAExD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0FAA0F;QAC1F,mCAAmC;QACnC,IAAI,qBAAqB,CAAC,GAAG,EAAE,KAAK,CAAC;YAAE,MAAM,GAAG,CAAC;QACjD,MAAM,QAAQ,CAAC,IAAI,KAAK,CAAC,8BAA8B,EAAE,KAAK,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;AAClG,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,GAAQ,EAAE,EAAU,EAAE,KAAc,EAAE,KAAa,EAAE,GAAmB;IAC5F,yFAAyF;IACzF,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjC,qDAAqD;IACrD,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7B,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,GAAG,CAAC,OAAO,KAAK,SAAS;YACvB,CAAC,CAAC,8BAA8B,EAAE,iBAAiB;YACnD,CAAC,CAAC,4BAA4B,EAAE,8DAA8D,CACjG,CAAC;IACJ,CAAC;IACD,kGAAkG;IAClG,0DAA0D;IAC1D,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACnD,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI,gBAAgB,QAAQ,CAAC,QAAQ,OAAO,EAAE;YACxG,EAAE,EAAE,EAAE,CAAC,EAAE;YACT,QAAQ,EAAE,GAAG,CAAC,QAAQ;SACvB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,EAAE,4BAA4B,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/G,yFAAyF;IACzF,yFAAyF;IACzF,uFAAuF;IACvF,gFAAgF;IAChF,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC;IACtB,uFAAuF;IACvF,wFAAwF;IACxF,0CAA0C;IAC1C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CACnC,KAAK,IAAI,EAAE;QACT,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,cAAc;gBAAE,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,sCAAsC,CAAC,CAAC;YACxG,OAAO,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACrE,CAAC,EACD,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,EAAE,EAAE,EAAE,CAChC,CAAC;IACF,MAAM,UAAU,GAAG,GAAG,EAAE,CACtB,IAAI,CAAC,OAAO,CACV,KAAK,IAAI,EAAE;QACT,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;YAAE,MAAM,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,CAAC,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpG,OAAO,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IAC7C,CAAC,EACD,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAC5B,CAAC;IACJ,IAAI,QAAQ,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG;QACX,IAAI,EAAE,WAAW;QACjB,EAAE,EAAE,EAAE,CAAC,EAAE;QACT,GAAG,KAAK;QACR,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,KAAK,EAAE,MAAM;QACb,QAAQ;QACR,GAAG,CAAC,UAAU,IAAI,EAAE,UAAU,EAAE,CAAC;KACzB,CAAC;IAEX,yFAAyF;IACzF,SAAS,CAAC;QACR,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,IAAI,iBAAiB,CAAC,EAAE,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC1D,MAAM,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;YAC/G,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;YAAE,MAAM;QACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC,EAAE,UAAU,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrF,IAAI,CAAC;YACH,kCAAkC;YAClC,MAAM,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE;gBACvF,EAAE,EAAE,EAAE,CAAC,EAAE;gBACT,GAAG;gBACH,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,UAAU,EAAE,UAAU,EAAE,QAAQ;aACjC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,6FAA6F;YAC7F,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,IAAI,KAAK,mBAAmB,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;gBAClE,MAAM,QAAQ,GAAI,GAAmB,CAAC,IAAI,CAAC,UAAoB,CAAC;gBAChE,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;gBAChG,MAAM,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YACvC,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,QAAQ,GAAG,MAAM,UAAU,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,2FAA2F;IAC3F,mFAAmF;IACnF,IAAI,OAA2B,CAAC;IAChC,IAAI,MAA4E,CAAC;IACjF,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CACzB,KAAK,IAAI,EAAE;YACT,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACtB,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,cAAc,IAAI,CAAC,CAAC;YAC/C,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;gBAAE,MAAM,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,CAAC,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACpG,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAC/B,MAAM,OAAO,GAAgB;gBAC3B,cAAc,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,EAAE;gBAClC,KAAK,EAAE,GAAG,CAAC,EAAE;gBACb,IAAI,EAAE,EAAE,CAAC,EAAE;gBACX,OAAO;gBACP,OAAO;gBACP,SAAS,EAAE,GAAG,CAAC,KAAK;gBACpB,GAAG,CAAC,UAAU,IAAI,EAAE,UAAU,EAAE,CAAC;gBACjC,oGAAoG;gBACpG,EAAE,EAAE,GAAG,CAAC,QAAQ,KAAK,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,EAAE,EAAE;aACpE,CAAC;YACF,0FAA0F;YAC1F,kFAAkF;YAClF,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;YAC1D,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC;QAC9D,CAAC,EACD;YACE,IAAI,EAAE,EAAE,CAAC,EAAE;YACX,cAAc,EAAE,EAAE,CAAC,UAAU;YAC7B,WAAW,EAAE,YAAY;YACzB,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,YAAY;SACpE,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,wFAAwF;QACxF,qFAAqF;QACrF,MAAM,MAAM,GAAG,KAAK,CAClB,GAAG,EACH,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EACrG,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,CACrB,CAAC;QACF,IAAI,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,MAAM,EAAE,6BAA6B,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;;YACzG,MAAM,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QAC1C,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,KAAK,CACT,GAAG,EACH,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CACxG,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,yFAAyF;QACzF,mFAAmF;QACnF,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,mDAAmD,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAClH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,KAAa,EAAE,GAAoB;IACxD,MAAM,OAAO,GAAG,YAAY,CAAC,qBAAqB,EAAE,GAAG,EAAE,iBAAiB,KAAK,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAChG,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;AACtD,CAAC;AAED,oGAAoG;AACpG,SAAS,UAAU,CAAC,GAAY;IAC9B,MAAM,KAAK,GAAG,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,IAAI,GAAG,CAAC;IACxE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,aAAa,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACtF,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,GAAG,CAAC,GAAQ,EAAE,IAAa,EAAE,IAAY;IACtD,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;IACtC,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,gEAAgE,EAAE;YACvG,KAAK,EAAE,KAAK,CAAC,EAAE;SAChB,CAAC,CAAC;IACL,CAAC;IACD,gGAAgG;IAChG,IAAI,GAAG,CAAC,KAAK;QAAE,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,wDAAwD,CAAC,CAAC;IAChH,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IAC1D,MAAM,EAAE,GAAG,OAAO,GAAG,CAAC,GAAG,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAc,EAAE,CAAC;IAC9B,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC;IACjB,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YAChD,OAAO,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;YAAS,CAAC;QACT,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC;IACpB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,KAAK,CAAC,GAAQ,EAAE,GAAY,EAAE,EAAU;IACrD,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC;IACtB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;IACjC,MAAM,KAAK,GACT,OAAO,IAAI,GAAG;QACZ,CAAC,CAAC,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;YAC7B,CAAC,CAAC,GAAG,CAAC,KAAK;YACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC;QACzB,CAAC,CAAC,OAAO;YACP,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;YACb,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,KAAK;YAC1B,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,MAAM;YAC3B,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,SAAS;YAC5B,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,UAAU,CAAC;IACnC,MAAM,EAAE,GAAG,KAAK,GAAG,OAAO,CAAC;IAC3B,MAAM,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAC5F,2FAA2F;IAC3F,IAAI,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5F,CAAC;AACH,CAAC"}