@serfab/cadre-core 1.15.0 → 1.17.0

package/dist/member-redemption.js

@@ -0,0 +1,485 @@
+/**
+ * The member-dialed redemption exchange shared by cadre invitations
+ * (`cadre-invite-protocol.ts`) and owner grants (`owner-grant-protocol.ts`): a holder dials ANY
+ * member machine its bundle names, proves possession in one signed frame, and the member writes
+ * rows on the issuer's behalf and answers in one frame. The issuer need not be online.
+ *
+ * What is the same for both credentials lives here, generic over the request and reply types:
+ *
+ * - the member side's hardening and sequencing ({@link MemberRedemptionHandler}): a concurrency
+ *   cap, a read timeout, the checks before any database work, the push of this member's control
+ *   store to the holder for a credential still live here, and the writes under that admission;
+ * - the holder side's dialing ({@link dialRedemption}, {@link dialRedemptionInPasses}): the
+ *   bundle's addresses one at a time under a per-address deadline, one signed request for every
+ *   address and every pass, and the pacing between passes;
+ * - the shape checks both directions apply off the wire, and the frame cap.
+ *
+ * What differs — the bundle, the request's fields and signatures, the refusal codes, the rows
+ * written and the reply's contents — stays in each protocol module, which passes it in. Same
+ * shape as the seed and wake protocols underneath: one length-prefixed JSON frame each way over
+ * the primitives in `control-stream.ts`.
+ */
+import debug from 'debug';
+import { multiaddr } from '@multiformats/multiaddr';
+import { withDeadline, exchangeFrame, readStreamToEnd, replyAndClose } from './control-stream.js';
+import { decodeLengthPrefixedFrame } from './seed-bootstrap.js';
+import { relayedRequestBudgetMs } from './link-budget.js';
+import { IssuedRowNotHereYetError, parseNullableStoredDatetimeMs } from './control-database.js';
+import { requireEd25519PublicKeyB64 } from './ed25519-key.js';
+import { dialAddr, nextMacrotask, trailingPeerId } from './peer-dial.js';
+import { chainMessages } from './control-retry.js';
+import { isRetriableControlWriteFailure } from './control-write-retry.js';
+const log = debug('sereus:cadre:member-redemption');
+/**
+ * Cap on either frame of either protocol. A request is one signed row, two signatures and a few
+ * addresses; a reply adds at most a peer list of a cadre's size. Both fit in a few KB; 64 KiB is
+ * the defensive bound a stranger can make the handler buffer.
+ */
+export const MAX_REDEMPTION_FRAME_BYTES = 64 * 1024;
+/**
+ * Default time the member waits for the request frame before aborting the read (ms). The read
+ * only: a stranger opens the stream, so the bound is on a caller that opens one and never sends.
+ * Same figure as the seed handler's.
+ */
+// eslint-disable-next-line no-restricted-syntax -- link-independent: a receiver cap on one frame on a stream the peer already opened; it bounds a peer that opens a stream and never sends, not the dial
+const DEFAULT_REDEEM_READ_TIMEOUT_MS = 10000;
+/** Default cap on concurrent inbound redemptions; over it the handler answers `busy`. */
+const DEFAULT_MAX_CONCURRENT_REDEMPTIONS = 100;
+/** Longest string field accepted off the wire; a stamp is 342 base64url chars, a signature 86. */
+export const MAX_WIRE_FIELD_LENGTH = 1024;
+const BASE64URL = /^[A-Za-z0-9_-]+$/;
+// ── Shape checks (both directions, both protocols) ───────────────────────────
+export function isBoundedString(value, max = MAX_WIRE_FIELD_LENGTH) {
+    return typeof value === 'string' && value.length > 0 && value.length <= max;
+}
+export function isEd25519KeyB64(value) {
+    if (!isBoundedString(value) || !BASE64URL.test(value))
+        return false;
+    try {
+        requireEd25519PublicKeyB64(value, 'key');
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Is `value` a null-or-bounded-string column, as the nullable text columns of a travelling row are? */
+export function isNullableBoundedString(value, max = MAX_WIRE_FIELD_LENGTH) {
+    return value === null || isBoundedString(value, max);
+}
+/** Is `value` a null-or-positive-integer use cap? */
+export function isNullableUseCap(value) {
+    return value === null || (Number.isInteger(value) && value >= 1);
+}
+export function rejection(code, reason) {
+    return { accepted: false, code, reason };
+}
+/** Which named constraint, if any, refused the write — read off the error's cause chain. */
+export function constraintRefusal(error, table) {
+    if (!(error instanceof Error))
+        return null;
+    const messages = chainMessages(error);
+    for (const [pattern, code, reason] of table) {
+        if (messages.some((message) => pattern.test(message)))
+            return rejection(code, reason);
+    }
+    return null;
+}
+/**
+ * A write failure that is not a refusal: this member cannot read the credential row the cadre
+ * holds yet, or the retry gave up (`conflict`), or something else (`internal`).
+ */
+export function writeFailureRefusal(error) {
+    if (error instanceof IssuedRowNotHereYetError) {
+        return rejection('conflict', 'This member has not synced the credential yet; nothing was recorded');
+    }
+    // NOTE: a seat torn on a member alone with an uncaught-up device was measured answering
+    // `internal`, not `conflict` (cadre-invite-redeemed-at-a-member-without-the-row). Both are
+    // retryable, so the holder is unaffected; if the two codes ever diverge in retryability,
+    // find which tear `isRetriableControlWriteFailure` does not recognise.
+    return isRetriableControlWriteFailure(error)
+        ? rejection('conflict', 'The redemption write failed transiently; nothing was recorded')
+        : rejection('internal', 'Internal redemption error');
+}
+/**
+ * Member side of one redemption protocol: registers the handler and drives each inbound stream
+ * through the checks in cost order — shape, then whatever the protocol checks without database
+ * work (party, signatures, and for an invitation the connecting identity and target device) —
+ * so no database work happens for a stranger that cannot prove anything; then admits the holder
+ * to this member's control replication (`admitDevice`) when the credential is live here, and
+ * runs the protocol's writes. Hardened as the seed handler is: a concurrency cap (over it,
+ * `busy`) and a read timeout.
+ *
+ * Registered only by a started `CadreNode`, after its control database is up, like the
+ * formation responder; nothing here is reachable on a node without one.
+ *
+ * A subclass supplies the five credential-specific pieces: the request's shape, the checks after
+ * it, the liveness read behind the push, the writes, and the two fixed refusals the base sends
+ * on its own (`busy`, and `internal` for a frame it could not read or a failure it did not
+ * expect).
+ */
+export class MemberRedemptionHandler {
+    /**
+     * @param label - Names the credential in log lines and stream labels ("Cadre invite", "Owner grant").
+     * @param protocolId - The protocol id {@link register} handles by default.
+     */
+    constructor(label, protocolId, options) {
+        this.label = label;
+        this.protocolId = protocolId;
+        this.registered = new Set();
+        this.active = 0;
+        this.partyId = options.partyId;
+        this.admitDevice = options.admitDevice;
+        this.readTimeoutMs = options.redeemReadTimeoutMs ?? DEFAULT_REDEEM_READ_TIMEOUT_MS;
+        this.maxConcurrent = options.maxConcurrentRedemptions ?? DEFAULT_MAX_CONCURRENT_REDEMPTIONS;
+    }
+    /** In-flight inbound redemptions. */
+    get activeCount() {
+        return this.active;
+    }
+    /**
+     * Register on `node`; rejects when libp2p refuses the registration. `runOnLimitedConnection`
+     * because a phone redeems through a relay, whose connection libp2p marks limited; the
+     * exchange is two small frames, well inside any relay's cap.
+     */
+    async register(node, protocolId = this.protocolId) {
+        if (this.registered.has(node))
+            return;
+        await node.handle(protocolId, async (rawStream, rawConnection) => {
+            await this.handleStream(rawStream, rawConnection.remotePeer.toString());
+        }, { runOnLimitedConnection: true });
+        this.registered.add(node);
+        log('%s handler registered (%s)', this.label, protocolId);
+    }
+    async unregister(node, protocolId = this.protocolId) {
+        if (!this.registered.has(node))
+            return;
+        await node.unhandle(protocolId);
+        this.registered.delete(node);
+        log('%s handler unregistered (%s)', this.label, protocolId);
+    }
+    /**
+     * One inbound redemption: read the frame, decide, reply, close. Public as the seam a protocol
+     * spec drives directly; `remotePeerId` is the connection's authenticated peer.
+     */
+    async handleStream(stream, remotePeerId) {
+        if (this.active >= this.maxConcurrent) {
+            log('%s: refusing redemption from %s: %d in flight at cap %d', this.label, remotePeerId, this.active, this.maxConcurrent);
+            await replyAndClose(stream, this.busyRefusal, this.label);
+            return;
+        }
+        this.active++;
+        try {
+            const reply = await this.decide(stream, remotePeerId);
+            log('%s: redemption from %s: %s', this.label, remotePeerId, reply.accepted ? 'accepted' : `refused (${reply.code})`);
+            await replyAndClose(stream, reply, this.label);
+        }
+        catch (error) {
+            log('%s: redemption from %s failed: %o', this.label, remotePeerId, error);
+            await replyAndClose(stream, this.internalRefusal, this.label);
+        }
+        finally {
+            this.active--;
+        }
+    }
+    /**
+     * Read the request frame to EOF, bounded and size-capped; JSON only, shape is the subclass's.
+     * Throws on a frame that cannot be read, which {@link handleStream} answers `internal`: a read
+     * timeout or a cut frame proves nothing about the credential, so the holder must stay free to
+     * try the next address.
+     */
+    async readRequest(stream) {
+        const data = await readStreamToEnd(stream, { maxBytes: MAX_REDEMPTION_FRAME_BYTES, timeoutMs: this.readTimeoutMs, label: this.label });
+        return JSON.parse(new TextDecoder().decode(decodeLengthPrefixedFrame(data, MAX_REDEMPTION_FRAME_BYTES)));
+    }
+    async decide(stream, remotePeerId) {
+        const request = await this.readRequest(stream);
+        if (!this.isWellFormedRequest(request))
+            return this.malformedRefusal;
+        const refused = this.checkRequest(request, remotePeerId);
+        if (refused)
+            return refused;
+        const release = await this.admitIfLive(request, remotePeerId);
+        try {
+            return await this.redeemAdmitted(request, remotePeerId);
+        }
+        finally {
+            release();
+        }
+    }
+    /**
+     * Admit the holder to this member's control replication before the first write of the
+     * exchange (the seat, when this member does not hold the row; otherwise the redemption), and
+     * resolve to the release that ends the admission. The holder is not a member, so only this
+     * puts it in this member's control write cohort, and it must be there to hold the rows the
+     * exchange writes. It is pushed the control store first, because a cohort node with no base
+     * revision of a block refuses a commit to it; a member alone with the holder would then have
+     * half its cohort refusing, and the write would tear instead of committing.
+     *
+     * Only for a credential still live here ({@link isLive}, judged on the row this member holds
+     * or, before the seat, on the bundle's copy once its issuer signature verifies): the holder
+     * of a withdrawn, expired or spent one, or of a forged copy naming a real owner, is refused
+     * without being sent anything. The retry of a redemption already written can read as spent
+     * too and is sent nothing; it needs nothing, since the rows it would hold are written and
+     * the ordinary catch-up reaches a member. Best-effort: a failed check or push is logged and
+     * the writes go ahead without the holder admitted, then commit or are answered retryably.
+     */
+    async admitIfLive(request, remotePeerId) {
+        const notAdmitted = () => undefined;
+        if (!this.admitDevice)
+            return notAdmitted;
+        try {
+            if (!await this.isLive(request)) {
+                log('%s: the credential is not live here; %s is not admitted before the write', this.label, remotePeerId);
+                return notAdmitted;
+            }
+            // NOTE: accepted tradeoff — when a write then fails (the seat refused, the last use
+            // taken by a race, the row expiring between this check and the write), the holder keeps
+            // a copy of a control store it was not admitted to. It holds a live owner-signed
+            // credential and proved possession and consent, and a seed hands an un-enrolled machine
+            // the same information. Revisit if a control table ever carries data a non-member must not see.
+            return await this.admitDevice(remotePeerId);
+        }
+        catch (error) {
+            log('%s: admitting %s before its write failed (writing anyway): %o', this.label, remotePeerId, error);
+            return notAdmitted;
+        }
+    }
+}
+/**
+ * Dial `addr`, open one stream to it, send the request, half-close, read the one reply frame.
+ * `signal` is the per-address deadline: it cancels the dial and resets a live stream.
+ *
+ * The address is dialed outside libp2p's dial queue (`dialAddr`), so another dial of the
+ * member in flight cannot capture this attempt; an open connection is still reused.
+ */
+async function exchangeRedemption(node, addr, options, signal, budgetMs) {
+    const connection = await dialAddr(node, addr, signal, `${options.label} redemption`);
+    // `runOnLimitedConnection`: a member may be reachable only through a relay (see `register`).
+    const rawStream = await connection.newStream(options.protocolId, { runOnLimitedConnection: true, signal });
+    return await exchangeFrame(rawStream, signal, options.request, async (stream) => {
+        const data = await readStreamToEnd(stream, { maxBytes: MAX_REDEMPTION_FRAME_BYTES, timeoutMs: budgetMs, label: `${options.label} reply` });
+        return decodeReply(JSON.parse(new TextDecoder().decode(decodeLengthPrefixedFrame(data, MAX_REDEMPTION_FRAME_BYTES))), options);
+    }, `${options.label} redemption aborted by its deadline`);
+}
+/**
+ * Read a reply frame into a typed reply. A refusal keeps only its code and reason, as sent;
+ * an acceptance is the protocol's to read. Throws on a frame that is neither.
+ */
+function decodeReply(value, options) {
+    if (typeof value !== 'object' || value === null) {
+        throw new Error(`${options.label} reply is not an object`);
+    }
+    const reply = value;
+    if (reply.accepted !== true) {
+        return { accepted: false, code: reply.code, reason: reply.reason };
+    }
+    return options.decodeAccepted(reply);
+}
+function isRefusal(reply) {
+    return reply.accepted === false;
+}
+function asError(error) {
+    if (error instanceof Error)
+        return error;
+    // A WebSocket transport rejects a refused dial with an `ErrorEvent`, whose text is its `message`.
+    const message = error?.message;
+    return new Error(typeof message === 'string' && message.length > 0 ? message : String(error), { cause: error });
+}
+/**
+ * Run `op` with a signal that aborts when either `deadline` or the caller's `signal` does.
+ * Relayed by hand rather than with `AbortSignal.any`, which the phone runtimes lack.
+ */
+async function underDeadlineAndCaller(deadline, caller, op) {
+    if (!caller)
+        return await op(deadline);
+    const either = new AbortController();
+    const abort = () => either.abort();
+    deadline.addEventListener('abort', abort, { once: true });
+    caller.addEventListener('abort', abort, { once: true });
+    // An abort between the caller's last check and the listener above fired no event.
+    if (caller.aborted)
+        abort();
+    try {
+        return await op(either.signal);
+    }
+    finally {
+        deadline.removeEventListener('abort', abort);
+        caller.removeEventListener('abort', abort);
+    }
+}
+/**
+ * One pass over the bundle's addresses, one at a time, each under its own deadline, stopping at
+ * the first acceptance or the first final refusal. A dial failure, a malformed reply or a
+ * retryable refusal moves to the next address. A final refusal and an acceptance that fails
+ * the holder's check are thrown from outside the per-address catch, so neither is ever
+ * mistaken for an address that could not be reached.
+ */
+async function dialOnce(node, options) {
+    const budgetMs = options.addressBudgetMs ?? relayedRequestBudgetMs(options.linkRoundTripMs);
+    const outcomes = [];
+    let memberAnswered = false;
+    for (const addr of options.members) {
+        options.signal?.throwIfAborted();
+        // Between attempts: a relayed address's relay leg goes through libp2p's dial queue, which
+        // needs a macrotask to drop an aborted job (see `tryAddrsInTurn`).
+        if (outcomes.length > 0)
+            await nextMacrotask();
+        let parsed;
+        try {
+            parsed = multiaddr(addr);
+        }
+        catch (error) {
+            outcomes.push({ addr, error: new Error('not a multiaddr', { cause: error }) });
+            continue;
+        }
+        let reply;
+        try {
+            reply = await withDeadline(budgetMs, `${options.label} redemption via ${addr}`, (deadline) => underDeadlineAndCaller(deadline, options.signal, (signal) => exchangeRedemption(node, parsed, options, signal, budgetMs)));
+        }
+        catch (error) {
+            // The caller's abort cut this attempt short; its reason, not the cut, is the answer.
+            options.signal?.throwIfAborted();
+            log('%s redemption via %s failed before an answer (%s); trying the next address', options.label, addr, asError(error).message);
+            outcomes.push({ addr, error: asError(error) });
+            continue;
+        }
+        if (isRefusal(reply)) {
+            const refusal = options.refusal(reply.code, reply.reason);
+            if (!refusal.retryable)
+                throw refusal;
+            log('%s redemption via %s refused retryably (%s); trying the next address', options.label, addr, refusal.message);
+            outcomes.push({ addr, error: refusal });
+            memberAnswered = true;
+            continue;
+        }
+        options.verifyAccepted(reply);
+        return { redeemed: { reply, memberPeerId: trailingPeerId(parsed), memberAddr: addr } };
+    }
+    return { outcomes, memberAnswered };
+}
+/**
+ * Holder side: try the bundle's addresses one at a time ({@link dialOnce}) and throw the
+ * protocol's unreachable error when none accepts.
+ *
+ * Every address gets the SAME request, with one usage nonce: the usage table is keyed by it,
+ * so a member the holder gave up on that was still committing cannot redeem it twice, and a
+ * retry at the next member after a dropped reply is answered as already done.
+ *
+ * @throws the protocol's rejected error on a final refusal, its reply-invalid error on an
+ *   acceptance that fails `verifyAccepted`, its unreachable error when every address was tried
+ *   and none accepted, and the reason of `options.signal` once it aborts.
+ */
+export async function dialRedemption(node, options) {
+    const outcome = await dialOnce(node, options);
+    if ('redeemed' in outcome)
+        return outcome.redeemed;
+    throw options.unreachable(outcome.outcomes);
+}
+/** Pause after the first pass in which no member accepted; doubled after each further one. */
+const REDEEM_PASS_FIRST_PAUSE_MS = 5000;
+/** Longest pause between passes. */
+const REDEEM_PASS_MAX_PAUSE_MS = 60000;
+/**
+ * Holder side, in passes: one {@link dialOnce} pass over the bundle's addresses, or, with
+ * `waitForMember`, as many as it takes, pausing between them (5 s after the first, doubling to
+ * 60 s, never past the credential's expiry). Every pass sends the same signed request, so a
+ * member that wrote the redemption on a pass whose reply was lost answers a later pass as
+ * already done, with no second usage row.
+ *
+ * A wait ends at the first acceptance, at a final refusal or an invalid reply (thrown as
+ * {@link dialRedemption} throws them), when the credential expires by this holder's clock
+ * (thrown as `expired()`), when `signal` aborts (its reason thrown), and when `node` stops. A
+ * bundle that names no address has nothing to wait for and throws at once.
+ */
+export async function dialRedemptionInPasses(node, options) {
+    for (let pass = 1;; pass++) {
+        if (options.waitForMember) {
+            // One pass leaves expiry to the member, whose clock decides; a wait has nothing else to end it.
+            refuseIfExpired(options);
+            refuseIfStopped(node, options.label);
+        }
+        reportProgress(options.onProgress, { state: 'redeeming', pass });
+        const outcome = await dialOnce(node, options);
+        if ('redeemed' in outcome)
+            return outcome.redeemed;
+        if (!options.waitForMember || outcome.outcomes.length === 0)
+            throw options.unreachable(outcome.outcomes);
+        const pauseMs = pauseAfterPass(pass, options.expiresAt);
+        reportProgress(options.onProgress, {
+            state: 'waiting',
+            pass,
+            retryAtMs: Date.now() + pauseMs,
+            // Any refusal means a member answered and is not ready yet; otherwise none answered at all.
+            reason: outcome.memberAnswered ? 'member-not-ready' : 'no-member-answered',
+            outcomes: outcome.outcomes
+        });
+        log('%s redemption pass %d found no member ready; the next pass in %d ms', options.label, pass, pauseMs);
+        await pause(pauseMs, options.signal, node);
+    }
+}
+// NOTE: judged by this holder's clock, so one running ahead ends a wait before the members
+// would refuse it. If waits are seen ending early on skewed phones, allow a grace margin here.
+function refuseIfExpired(options) {
+    const expiresAtMs = parseNullableStoredDatetimeMs(options.expiresAt);
+    if (expiresAtMs !== null && expiresAtMs <= Date.now()) {
+        throw options.expired();
+    }
+}
+/** A stopped node's every dial fails at once, which would otherwise read as "no member answered" until expiry. */
+function refuseIfStopped(node, label) {
+    if (node.status !== 'started') {
+        throw new Error(`${label} redemption stopped waiting: the node is ${node.status}`);
+    }
+}
+/** The pause after pass `pass`, cut short at the credential's expiry so the next check ends the wait then. */
+function pauseAfterPass(pass, expiresAt) {
+    const backoffMs = Math.min(REDEEM_PASS_FIRST_PAUSE_MS * 2 ** (pass - 1), REDEEM_PASS_MAX_PAUSE_MS);
+    const expiresAtMs = parseNullableStoredDatetimeMs(expiresAt);
+    return expiresAtMs === null ? backoffMs : Math.max(0, Math.min(backoffMs, expiresAtMs - Date.now()));
+}
+/** A UI callback must not break the join. */
+function reportProgress(onProgress, progress) {
+    if (!onProgress)
+        return;
+    try {
+        onProgress(progress);
+    }
+    catch (error) {
+        log('redemption progress callback threw (ignored): %o', error);
+    }
+}
+/**
+ * Wait `ms`, or reject with `signal`'s reason as soon as it aborts. Ends early, resolving, when
+ * `node` stops (or is already stopped), so the next pass's stop check ends the wait without a
+ * timer holding the process open. Listeners and timer are cleared however it ends.
+ */
+function pause(ms, signal, node) {
+    return new Promise((resolve, reject) => {
+        if (signal?.aborted) {
+            reject(signal.reason);
+            return;
+        }
+        if (node.status !== 'started') {
+            resolve();
+            return;
+        }
+        const settle = () => {
+            clearTimeout(timer);
+            signal?.removeEventListener('abort', onAbort);
+            node.removeEventListener('stop', onStop);
+        };
+        const onAbort = () => {
+            settle();
+            reject(signal.reason);
+        };
+        const onStop = () => {
+            settle();
+            resolve();
+        };
+        const timer = setTimeout(onStop, ms);
+        signal?.addEventListener('abort', onAbort, { once: true });
+        node.addEventListener('stop', onStop, { once: true });
+    });
+}
+//# sourceMappingURL=member-redemption.js.map

package/dist/member-redemption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"member-redemption.js","sourceRoot":"","sources":["../src/member-redemption.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,SAAS,EAAkB,MAAM,yBAAyB,CAAC;AAEpE,OAAO,EAAsB,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACtH,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAC;AAChG,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAG1E,MAAM,GAAG,GAAG,KAAK,CAAC,gCAAgC,CAAC,CAAC;AAEpD;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,IAAI,CAAC;AAEpD;;;;GAIG;AACH,yMAAyM;AACzM,MAAM,8BAA8B,GAAG,KAAM,CAAC;AAE9C,yFAAyF;AACzF,MAAM,kCAAkC,GAAG,GAAG,CAAC;AAE/C,kGAAkG;AAClG,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAE1C,MAAM,SAAS,GAAG,kBAAkB,CAAC;AAErC,gFAAgF;AAEhF,MAAM,UAAU,eAAe,CAAC,KAAc,EAAE,GAAG,GAAG,qBAAqB;IACzE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpE,IAAI,CAAC;QACH,0BAA0B,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,uBAAuB,CAAC,KAAc,EAAE,GAAG,GAAG,qBAAqB;IACjF,OAAO,KAAK,KAAK,IAAI,IAAI,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,OAAO,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAK,KAAgB,IAAI,CAAC,CAAC,CAAC;AAC/E,CAAC;AAsBD,MAAM,UAAU,SAAS,CAAsB,IAAU,EAAE,MAAc;IACvE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC3C,CAAC;AAKD,4FAA4F;AAC5F,MAAM,UAAU,iBAAiB,CAAsB,KAAc,EAAE,KAAgD;IACrH,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACtC,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QAC5C,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,IAAI,KAAK,YAAY,wBAAwB,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC,UAAU,EAAE,qEAAqE,CAAC,CAAC;IACtG,CAAC;IACD,wFAAwF;IACxF,2FAA2F;IAC3F,yFAAyF;IACzF,uEAAuE;IACvE,OAAO,8BAA8B,CAAC,KAAK,CAAC;QAC1C,CAAC,CAAC,SAAS,CAAC,UAAU,EAAE,+DAA+D,CAAC;QACxF,CAAC,CAAC,SAAS,CAAC,UAAU,EAAE,2BAA2B,CAAC,CAAC;AACzD,CAAC;AAsBD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAgB,uBAAuB;IAQ3C;;;OAGG;IACH,YAAyC,KAAa,EAAqB,UAAkB,EAAE,OAAuC;QAA7F,UAAK,GAAL,KAAK,CAAQ;QAAqB,eAAU,GAAV,UAAU,CAAQ;QAP5E,eAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QACxC,WAAM,GAAG,CAAC,CAAC;QAOjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,mBAAmB,IAAI,8BAA8B,CAAC;QACnF,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,wBAAwB,IAAI,kCAAkC,CAAC;IAC9F,CAAC;IAiBD,qCAAqC;IACrC,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,aAAqB,IAAI,CAAC,UAAU;QAC/D,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QACtC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,SAAkB,EAAE,aAAsB,EAAE,EAAE;YACjF,MAAM,IAAI,CAAC,YAAY,CAAC,SAA0B,EAAG,aAA4B,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC3G,CAAC,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1B,GAAG,CAAC,4BAA4B,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAY,EAAE,aAAqB,IAAI,CAAC,UAAU;QACjE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QACvC,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAChC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7B,GAAG,CAAC,8BAA8B,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC9D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAAC,MAAqB,EAAE,YAAoB;QAC5D,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACtC,GAAG,CAAC,yDAAyD,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YAC1H,MAAM,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YACtD,GAAG,CAAC,4BAA4B,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAa,KAA4B,CAAC,IAAI,GAAG,CAAC,CAAC;YAC7I,MAAM,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,mCAAmC,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;YAC1E,MAAM,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAChE,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,WAAW,CAAC,MAAqB;QAC7C,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,0BAA0B,EAAE,SAAS,EAAE,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACvI,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,IAAI,EAAE,0BAA0B,CAAC,CAAC,CAAC,CAAC;IAC3G,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,MAAqB,EAAE,YAAoB;QAC9D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC,gBAAgB,CAAC;QACrE,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACzD,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAC9D,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAC1D,CAAC;gBAAS,CAAC;YACT,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACK,KAAK,CAAC,WAAW,CAAC,OAAgB,EAAE,YAAoB;QAC9D,MAAM,WAAW,GAAG,GAAS,EAAE,CAAC,SAAS,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,WAAW,CAAC;QAC1C,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBAChC,GAAG,CAAC,0EAA0E,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;gBAC1G,OAAO,WAAW,CAAC;YACrB,CAAC;YACD,oFAAoF;YACpF,wFAAwF;YACxF,iFAAiF;YACjF,wFAAwF;YACxF,gGAAgG;YAChG,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,+DAA+D,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;YACtG,OAAO,WAAW,CAAC;QACrB,CAAC;IACH,CAAC;CACF;AAmDD;;;;;;GAMG;AACH,KAAK,UAAU,kBAAkB,CAC/B,IAAY,EACZ,IAAe,EACf,OAA0C,EAC1C,MAAmB,EACnB,QAAgB;IAEhB,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,aAAa,CAAC,CAAC;IACrF,6FAA6F;IAC7F,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3G,OAAO,MAAM,aAAa,CACxB,SAAqC,EACrC,MAAM,EACN,OAAO,CAAC,OAAO,EACf,KAAK,EAAE,MAAM,EAAE,EAAE;QACf,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,0BAA0B,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;QAC3I,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,IAAI,EAAE,0BAA0B,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACjI,CAAC,EACD,GAAG,OAAO,CAAC,KAAK,qCAAqC,CACtD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAW,KAAc,EAAE,OAA0C;IACvF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,yBAAyB,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC5B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,SAAS,CAAW,KAAwC;IACnE,OAAQ,KAAgC,CAAC,QAAQ,KAAK,KAAK,CAAC;AAC9D,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,IAAI,KAAK,YAAY,KAAK;QAAE,OAAO,KAAK,CAAC;IACzC,kGAAkG;IAClG,MAAM,OAAO,GAAI,KAAsC,EAAE,OAAO,CAAC;IACjE,OAAO,IAAI,KAAK,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AAClH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,sBAAsB,CACnC,QAAqB,EACrB,MAA+B,EAC/B,EAAuC;IAEvC,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,GAAS,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACzC,QAAQ,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,kFAAkF;IAClF,IAAI,MAAM,CAAC,OAAO;QAAE,KAAK,EAAE,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC7C,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAOD;;;;;;GAMG;AACH,KAAK,UAAU,QAAQ,CAAW,IAAY,EAAE,OAA0C;IACxF,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,IAAI,sBAAsB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5F,MAAM,QAAQ,GAA+B,EAAE,CAAC;IAChD,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACnC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;QACjC,0FAA0F;QAC1F,mEAAmE;QACnE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,aAAa,EAAE,CAAC;QAC/C,IAAI,MAAiB,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;YAC/E,SAAS;QACX,CAAC;QACD,IAAI,KAAwC,CAAC;QAC7C,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,KAAK,mBAAmB,IAAI,EAAE,EAC5E,CAAC,QAAQ,EAAE,EAAE,CAAC,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAC3D,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QAChF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qFAAqF;YACrF,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;YACjC,GAAG,CAAC,4EAA4E,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC;YAC/H,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC/C,SAAS;QACX,CAAC;QACD,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAC1D,IAAI,CAAC,OAAO,CAAC,SAAS;gBAAE,MAAM,OAAO,CAAC;YACtC,GAAG,CAAC,sEAAsE,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YAClH,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YACxC,cAAc,GAAG,IAAI,CAAC;YACtB,SAAS;QACX,CAAC;QACD,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC9B,OAAO,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC;IACzF,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAW,IAAY,EAAE,OAA0C;IACrG,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,UAAU,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,QAAQ,CAAC;IACnD,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AAC9C,CAAC;AAED,8FAA8F;AAC9F,MAAM,0BAA0B,GAAG,IAAK,CAAC;AAEzC,oCAAoC;AACpC,MAAM,wBAAwB,GAAG,KAAM,CAAC;AAaxC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAW,IAAY,EAAE,OAA8C;IACjH,KAAK,IAAI,IAAI,GAAG,CAAC,GAAI,IAAI,EAAE,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YAC1B,gGAAgG;YAChG,eAAe,CAAC,OAAO,CAAC,CAAC;YACzB,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;QACD,cAAc,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,UAAU,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC,QAAQ,CAAC;QACnD,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzG,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACxD,cAAc,CAAC,OAAO,CAAC,UAAU,EAAE;YACjC,KAAK,EAAE,SAAS;YAChB,IAAI;YACJ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;YAC/B,4FAA4F;YAC5F,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,oBAAoB;YAC1E,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC,CAAC;QACH,GAAG,CAAC,qEAAqE,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACzG,MAAM,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,2FAA2F;AAC3F,+FAA+F;AAC/F,SAAS,eAAe,CAAW,OAA8C;IAC/E,MAAM,WAAW,GAAG,6BAA6B,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrE,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACtD,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,kHAAkH;AAClH,SAAS,eAAe,CAAC,IAAY,EAAE,KAAa;IAClD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,4CAA4C,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACrF,CAAC;AACH,CAAC;AAED,8GAA8G;AAC9G,SAAS,cAAc,CAAC,IAAY,EAAE,SAAwB;IAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,0BAA0B,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC;IACnG,MAAM,WAAW,GAAG,6BAA6B,CAAC,SAAS,CAAC,CAAC;IAC7D,OAAO,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AACvG,CAAC;AAED,6CAA6C;AAC7C,SAAS,cAAc,CAAC,UAA+D,EAAE,QAA2B;IAClH,IAAI,CAAC,UAAU;QAAE,OAAO;IACxB,IAAI,CAAC;QACH,UAAU,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,kDAAkD,EAAE,KAAK,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,KAAK,CAAC,EAAU,EAAE,MAA+B,EAAE,IAAY;IACtE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,GAAS,EAAE;YACxB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9C,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC3C,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,MAAM,EAAE,CAAC;YACT,MAAM,CAAC,MAAO,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,GAAS,EAAE;YACxB,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACrC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/owner-anchor-sync.d.ts

@@ -1,5 +1,5 @@
 import type { TrustSource } from './trusted-owner-store.js';
-import type { InvitationChain, OwnerKeyRow, RevocationRow } from './types.js';
+import type { OwnerGrantChain, OwnerKeyRow, RevocationRow } from './types.js';
 export interface OwnerAnchorInputs {
     /** The party whose table is being read; every stored proof is judged for it, so a voucher or tombstone signed for another party neither seats nor removes a key. */
     partyId: string;
@@ -9,8 +9,8 @@ export interface OwnerAnchorInputs {
     rows: readonly OwnerKeyRow[];
     /** `Revocation` rows; only those with `tableName === 'OwnerKey'` are consulted. */
     tombstones: readonly RevocationRow[];
-    /** The usage and invitation rows, when some owner row is invitation-admitted; null skips those rows. */
-    chain: InvitationChain | null;
+    /** The usage and grant rows, when some owner row is grant-seated; null when none is, which skips every consent-seated row. */
+    grantChain: OwnerGrantChain | null;
 }
 export interface OwnerAnchorDerivation {
     /** The keys the anchor should hold after this pass. */
@@ -19,4 +19,4 @@ export interface OwnerAnchorDerivation {
     refusedRemovals: readonly string[];
 }
 /** The rule above, as one pure function. */
-export declare function deriveOwnerAnchor({ partyId, anchor, rows, tombstones, chain }: OwnerAnchorInputs): OwnerAnchorDerivation;
+export declare function deriveOwnerAnchor({ partyId, anchor, rows, tombstones, grantChain }: OwnerAnchorInputs): OwnerAnchorDerivation;

package/dist/owner-anchor-sync.js

@@ -1,7 +1,7 @@
 /**
  * How the node-local trusted-owner anchor follows the replicated `OwnerKey` table along
  * VERIFIABLE chains — the pure rule, with no I/O, so it can be tested without a database.
- * `CadreNode.syncOwnerAnchor` reads the table, the tombstones and the invitation chain,
+ * `CadreNode.syncOwnerAnchor` reads the table, the tombstones and the owner-grant chain,
  * calls {@link deriveOwnerAnchor}, and applies the difference to the store.
  *
  * Why not simply trust the table: an empty local copy can seat any key through the
@@ -19,9 +19,10 @@
  *   retired, although nothing could re-derive it from the remaining base.
  * - **derivable from S**: a live row whose stored proof verifies against S — owner-signed
  *   (`vouchSig` set): `vouchOwner` is in S and `verifyOwnerKeyVoucher` holds;
- *   invitation-admitted (`vouchSig` null, `vouchUsage` set): `verifyInvitationOwnerAdmission`
- *   holds with S as the anchor. The founding row (all three null) is never derivable:
- *   founders enter anchors only out of band.
+ *   grant-seated (`vouchSig` null, `vouchUsage` naming an `OwnerGrantUsage` row):
+ *   `verifyOwnerGrantAdmission` holds with S as the anchor. The founding row (all three null)
+ *   is never derivable: founders enter anchors only out of band. A machine invitation admits a
+ *   machine and never seats an owner row, so no `CadreInviteUsage` row is read here.
  * - **derived**: the least fixpoint from base ∪ kept — add every key whose live row is
  *   derivable from what is already in the set, until nothing changes. **chainDerived** is the
  *   keys whose live row was derivable in this pass, base keys included.
@@ -45,9 +46,9 @@
  * two cannot be told apart from replicated state; keeping is the only rule under which a
  * sole owner can rotate at all.
  */
-import { verifyInvitationOwnerAdmission, verifyOwnerKeyVoucher, verifyRevocationSigner } from './peer-authorization.js';
+import { verifyOwnerGrantAdmission, verifyOwnerKeyVoucher, verifyRevocationSigner } from './peer-authorization.js';
 /** The rule above, as one pure function. */
-export function deriveOwnerAnchor({ partyId, anchor, rows, tombstones, chain }) {
+export function deriveOwnerAnchor({ partyId, anchor, rows, tombstones, grantChain }) {
     const ownerTombstones = tombstones.filter(tombstone => tombstone.tableName === 'OwnerKey');
     // NOTE: a stamp is retired by any tombstone that names it, verified or not — the same
     // reading `queryCadrePeers` and `getOwnerKeys` give the table. A forged tombstone can
@@ -56,7 +57,7 @@ export function deriveOwnerAnchor({ partyId, anchor, rows, tombstones, chain })
     const retired = new Set(ownerTombstones.map(tombstone => tombstone.stampId));
     const liveRows = rows.filter(row => !retired.has(row.stampId));
     const derived = passStartSet(anchor, liveRows);
-    const chainDerived = deriveFixpoint(partyId, derived, liveRows, chain);
+    const chainDerived = deriveFixpoint(partyId, derived, liveRows, grantChain);
     const removed = removedKeys(partyId, derived, chainDerived, ownerTombstones);
     if (removed.size > 0 && removed.size === derived.size) {
         return { target: derived, refusedRemovals: Array.from(removed) };
@@ -81,7 +82,7 @@ function passStartSet(anchor, liveRows) {
  * trust only grows within a pass, and a proof that failed against a trusted voucher cannot
  * pass later, so no row is verified twice.
  */
-function deriveFixpoint(partyId, derived, liveRows, chain) {
+function deriveFixpoint(partyId, derived, liveRows, grantChain) {
     const chainDerived = new Set();
     const pending = new Set(liveRows);
     let progress = true;
@@ -92,7 +93,7 @@ function deriveFixpoint(partyId, derived, liveRows, chain) {
                 continue;
             }
             pending.delete(row);
-            if (proofVerifies(partyId, row, derived, chain)) {
+            if (proofVerifies(partyId, row, derived, grantChain)) {
                 chainDerived.add(row.key);
                 derived.add(row.key);
                 progress = true;
@@ -102,22 +103,22 @@ function deriveFixpoint(partyId, derived, liveRows, chain) {
     return chainDerived;
 }
 /** Does `row`'s stored proof verify against `trusted`, for `partyId`, by the kind of proof it carries (see the module doc)? */
-function proofVerifies(partyId, row, trusted, chain) {
+function proofVerifies(partyId, row, trusted, grantChain) {
     if (row.vouchOwner === null) {
         return false;
     }
     if (row.vouchSig !== null) {
-        return verifyOwnerKeyVoucher(partyId, row.key, row.stampId, row.vouchOwner, row.vouchSig);
+        return verifyOwnerKeyVoucher(partyId, row.key, row.label, row.stampId, row.vouchOwner, row.vouchSig);
     }
     if (row.vouchUsage === null) {
         return false;
     }
-    const usage = chain?.usages.get(row.vouchUsage);
-    const invite = usage === undefined ? undefined : chain?.invites.get(usage.inviteKey);
-    if (usage === undefined || invite === undefined) {
+    const grantUsage = grantChain?.usages.get(row.vouchUsage);
+    const grant = grantUsage === undefined ? undefined : grantChain?.grants.get(grantUsage.grantKey);
+    if (grantUsage === undefined || grant === undefined) {
         return false;
     }
-    return verifyInvitationOwnerAdmission(partyId, row, usage, invite, key => trusted.has(key));
+    return verifyOwnerGrantAdmission(partyId, row, grantUsage, grant, (key) => trusted.has(key));
 }
 /**
  * The keys of `derived` that a verifiable tombstone removes (see the module doc), every

package/dist/owner-anchor-sync.js.map

@@ -1 +1 @@
-{"version":3,"file":"owner-anchor-sync.js","sourceRoot":"","sources":["../src/owner-anchor-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,OAAO,EAAE,8BAA8B,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAwBxH,4CAA4C;AAC5C,MAAM,UAAU,iBAAiB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAqB;IAChG,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,UAAU,CAAC,CAAC;IAC3F,sFAAsF;IACtF,sFAAsF;IACtF,0FAA0F;IAC1F,2FAA2F;IAC3F,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAE/D,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAEvE,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC;IAC7E,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC;QACvD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;AACxC,CAAC;AAED,6FAA6F;AAC7F,SAAS,YAAY,CAAC,MAAwC,EAAE,QAAgC;IAC/F,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACpC,IAAI,MAAM,KAAK,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7C,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,OAAe,EAAE,OAAoB,EAAE,QAAgC,EAAE,KAA6B;IAC7H,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,OAAO,QAAQ,EAAE,CAAC;QACjB,QAAQ,GAAG,KAAK,CAAC;QACjB,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC3B,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7D,SAAS;YACV,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,IAAI,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;gBACjD,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC1B,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACrB,QAAQ,GAAG,IAAI,CAAC;YACjB,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,YAAY,CAAC;AACrB,CAAC;AAED,+HAA+H;AAC/H,SAAS,aAAa,CAAC,OAAe,EAAE,GAAgB,EAAE,OAA4B,EAAE,KAA6B;IACpH,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC3B,OAAO,qBAAqB,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACrF,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACjD,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,8BAA8B,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,OAAe,EAAE,OAA4B,EAAE,YAAiC,EAAE,eAAyC;IAC/I,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,SAAS,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACpE,SAAS;QACV,CAAC;QACD,IAAI,SAAS,CAAC,SAAS,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;YACtE,SAAS;QACV,CAAC;QACD,IAAI,sBAAsB,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;YAChD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC"}
+{"version":3,"file":"owner-anchor-sync.js","sourceRoot":"","sources":["../src/owner-anchor-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAwBnH,4CAA4C;AAC5C,MAAM,UAAU,iBAAiB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAqB;IACrG,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,UAAU,CAAC,CAAC;IAC3F,sFAAsF;IACtF,sFAAsF;IACtF,0FAA0F;IAC1F,2FAA2F;IAC3F,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAE/D,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IAE5E,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC;IAC7E,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC;QACvD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;AACxC,CAAC;AAED,6FAA6F;AAC7F,SAAS,YAAY,CAAC,MAAwC,EAAE,QAAgC;IAC/F,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACpC,IAAI,MAAM,KAAK,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7C,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,OAAe,EAAE,OAAoB,EAAE,QAAgC,EAAE,UAAkC;IAClI,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,OAAO,QAAQ,EAAE,CAAC;QACjB,QAAQ,GAAG,KAAK,CAAC;QACjB,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC3B,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7D,SAAS;YACV,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,IAAI,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;gBACtD,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC1B,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACrB,QAAQ,GAAG,IAAI,CAAC;YACjB,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,YAAY,CAAC;AACrB,CAAC;AAED,+HAA+H;AAC/H,SAAS,aAAa,CAAC,OAAe,EAAE,GAAgB,EAAE,OAA4B,EAAE,UAAkC;IACzH,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC3B,OAAO,qBAAqB,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAG,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACjG,IAAI,UAAU,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACrD,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,yBAAyB,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAC9F,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,OAAe,EAAE,OAA4B,EAAE,YAAiC,EAAE,eAAyC;IAC/I,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,SAAS,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACpE,SAAS;QACV,CAAC;QACD,IAAI,SAAS,CAAC,SAAS,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;YACtE,SAAS;QACV,CAAC;QACD,IAAI,sBAAsB,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;YAChD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC"}