@synoikia/core 0.1.0

package/dist/db/schema.js

@@ -0,0 +1,372 @@
+import { sql } from 'drizzle-orm';
+import { blob, index, integer, sqliteTable, text, uniqueIndex } from 'drizzle-orm/sqlite-core';
+/**
+ * Single SQLite schema for the whole server (design §7.1). JSON is stored as TEXT, timestamps as
+ * epoch milliseconds, encrypted values as AES-256-GCM blobs (design §7.2).
+ */
+const id = () => text('id').primaryKey();
+const ts = (name) => integer(name, { mode: 'timestamp_ms' });
+const createdAt = () => ts('created_at')
+    .notNull()
+    .default(sql `(unixepoch() * 1000)`);
+const flag = (name) => integer(name, { mode: 'boolean' });
+const json = (name) => text(name, { mode: 'json' });
+// ── identity & admin auth ────────────────────────────────────────────────────────────────────────
+export const users = sqliteTable('users', {
+    id: id(),
+    username: text('username').notNull().unique(),
+    passwordHash: text('password_hash'),
+    totpSecretEnc: blob('totp_secret_enc', { mode: 'buffer' }),
+    totpEnabled: flag('totp_enabled').notNull().default(false),
+    /** Last accepted TOTP time step, so a code can't be replayed within its window. */
+    totpLastStep: integer('totp_last_step'),
+    recoveryCodesHash: json('recovery_codes_hash').$type(),
+    oidcIssuer: text('oidc_issuer'),
+    oidcSubject: text('oidc_subject'),
+    createdAt: createdAt(),
+    lastLoginAt: ts('last_login_at'),
+    disabled: flag('disabled').notNull().default(false),
+});
+export const sessions = sqliteTable('sessions', {
+    idHash: text('id_hash').primaryKey(),
+    userId: text('user_id')
+        .notNull()
+        .references(() => users.id, { onDelete: 'cascade' }),
+    kind: text('kind', { enum: ['admin', 'oauth_ui', 'approval_ui'] }).notNull(),
+    createdAt: createdAt(),
+    lastSeenAt: ts('last_seen_at').notNull(),
+    expiresAt: ts('expires_at').notNull(),
+    ip: text('ip'),
+    userAgent: text('user_agent'),
+}, (t) => [index('sessions_user_idx').on(t.userId)]);
+export const settings = sqliteTable('settings', {
+    key: text('key').primaryKey(),
+    value: json('value').notNull(),
+});
+export const oidcConfig = sqliteTable('oidc_config', {
+    id: integer('id').primaryKey(),
+    issuer: text('issuer').notNull(),
+    clientId: text('client_id').notNull(),
+    clientSecretEnc: blob('client_secret_enc', { mode: 'buffer' }),
+    scopes: text('scopes').notNull().default('openid email profile'),
+    allowPolicy: json('allow_policy').$type(),
+    autoProvision: flag('auto_provision').notNull().default(false),
+    enabled: flag('enabled').notNull().default(false),
+});
+// ── plugins ──────────────────────────────────────────────────────────────────────────────────────
+export const pluginRepos = sqliteTable('plugin_repos', {
+    id: id(),
+    url: text('url').notNull().unique(),
+    name: text('name'),
+    signingMode: text('signing_mode', { enum: ['signed', 'unsigned'] }).notNull(),
+    publicKey: text('public_key'),
+    keyFingerprint: text('key_fingerprint'),
+    keyStatus: text('key_status', { enum: ['ok', 'key_changed'] })
+        .notNull()
+        .default('ok'),
+    indexCache: json('index_cache'),
+    lastFetchedAt: ts('last_fetched_at'),
+    lastFetchError: text('last_fetch_error'),
+});
+export const plugins = sqliteTable('plugins', {
+    id: id(),
+    pluginId: text('plugin_id').notNull().unique(),
+    version: text('version').notNull(),
+    source: text('source', { enum: ['core', 'repo'] }).notNull(),
+    repoId: text('repo_id').references(() => pluginRepos.id),
+    path: text('path').notNull(),
+    sha256: text('sha256'),
+    signatureVerified: flag('signature_verified').notNull().default(false),
+    manifest: json('manifest').notNull(),
+    status: text('status', { enum: ['ok', 'invalid', 'incompatible'] }).notNull(),
+    statusError: text('status_error'),
+    enabled: flag('enabled').notNull().default(false),
+    installedAt: createdAt(),
+});
+export const pluginInstances = sqliteTable('plugin_instances', {
+    id: id(),
+    pluginId: text('plugin_id')
+        .notNull()
+        .references(() => plugins.id),
+    slug: text('slug').notNull().unique(),
+    displayName: text('display_name').notNull(),
+    enabled: flag('enabled').notNull().default(true),
+    config: json('config').notNull().default({}),
+    secretsEnc: blob('secrets_enc', { mode: 'buffer' }),
+    /** NULL = inherit the global default (design §6.2). */
+    authMode: text('auth_mode', { enum: ['external', 'bearer', 'oauth', 'bearer+oauth'] }),
+    settings: json('settings').notNull().default({}),
+    status: text('status', { enum: ['stopped', 'starting', 'ready', 'error'] })
+        .notNull()
+        .default('stopped'),
+    statusError: text('status_error'),
+    upstreamVersion: text('upstream_version'),
+    sourceRef: text('source_ref'),
+    lastSyncedAt: ts('last_synced_at'),
+    lastSyncStatus: text('last_sync_status'),
+    createdAt: createdAt(),
+});
+// ── catalog ──────────────────────────────────────────────────────────────────────────────────────
+/** One none/read/ask/write level per group; operations follow it unless they carry their own level (design §5.2). */
+export const operationGroups = sqliteTable('operation_groups', {
+    id: id(),
+    instanceId: text('instance_id')
+        .notNull()
+        .references(() => pluginInstances.id, { onDelete: 'cascade' }),
+    key: text('key').notNull(),
+    label: text('label').notNull(),
+    /** New groups start read-only. */
+    level: text('level', { enum: ['none', 'read', 'ask', 'write'] })
+        .notNull()
+        .default('read'),
+    levelChangedAt: ts('level_changed_at'),
+    levelChangedBy: text('level_changed_by').references(() => users.id),
+    firstSeenAt: ts('first_seen_at').notNull(),
+    stale: flag('stale').notNull().default(false),
+}, (t) => [uniqueIndex('operation_groups_instance_key_idx').on(t.instanceId, t.key)]);
+/** Admin regrouping: maps a plugin-derived group onto a (possibly merged) group key; survives syncs. */
+export const operationGroupAliases = sqliteTable('operation_group_aliases', {
+    instanceId: text('instance_id')
+        .notNull()
+        .references(() => pluginInstances.id, { onDelete: 'cascade' }),
+    pluginGroup: text('plugin_group').notNull(),
+    groupKey: text('group_key').notNull(),
+}, (t) => [uniqueIndex('operation_group_aliases_idx').on(t.instanceId, t.pluginGroup)]);
+export const operations = sqliteTable('operations', {
+    id: id(),
+    instanceId: text('instance_id')
+        .notNull()
+        .references(() => pluginInstances.id, { onDelete: 'cascade' }),
+    key: text('key').notNull(),
+    displayName: text('display_name'),
+    kind: text('kind').notNull(),
+    /** Group as derived by the plugin, before admin aliases are applied. */
+    pluginGroup: text('plugin_group').notNull(),
+    groupId: text('group_id')
+        .notNull()
+        .references(() => operationGroups.id),
+    tag: text('tag'),
+    /** Effective classification; locked implies write. */
+    classification: text('classification', { enum: ['read', 'write'] }).notNull(),
+    classificationSource: text('classification_source', { enum: ['locked', 'override', 'inferred'] }).notNull(),
+    inferredClassification: text('inferred_classification', { enum: ['read', 'write'] }).notNull(),
+    inferredReason: text('inferred_reason').notNull(),
+    locked: flag('locked').notNull().default(false),
+    /** Admin-set level for this operation; null follows the group. Locked ops only become callable at `ask`. */
+    levelOverride: text('level_override', { enum: ['none', 'read', 'ask', 'write'] }),
+    /** Writes at level `write` still ask for approval until an admin acknowledges them. */
+    writeAcknowledged: flag('write_acknowledged').notNull().default(false),
+    acknowledgedAt: ts('acknowledged_at'),
+    acknowledgedBy: text('acknowledged_by').references(() => users.id),
+    typedConfirmation: flag('typed_confirmation').notNull().default(false),
+    attestationRequired: flag('attestation_required').notNull().default(false),
+    /** An admin turned the attestation requirement off; the plugin's request no longer re-adds it. */
+    attestationWaived: flag('attestation_waived').notNull().default(false),
+    needsReview: flag('needs_review').notNull().default(false),
+    matchProfile: text('match_profile'),
+    paramsSchema: json('params_schema'),
+    docs: json('docs'),
+    firstSeenAt: ts('first_seen_at').notNull(),
+    lastSeenAt: ts('last_seen_at').notNull(),
+    stale: flag('stale').notNull().default(false),
+}, (t) => [
+    uniqueIndex('operations_instance_key_idx').on(t.instanceId, t.key),
+    index('operations_group_idx').on(t.groupId),
+]);
+export const registryEntries = sqliteTable('registry_entries', {
+    id: id(),
+    instanceId: text('instance_id')
+        .notNull()
+        .references(() => pluginInstances.id, { onDelete: 'cascade' }),
+    kind: text('kind').notNull(),
+    extId: text('ext_id').notNull(),
+    name: text('name').notNull(),
+    parentExtId: text('parent_ext_id'),
+    domain: text('domain'),
+    attrs: json('attrs'),
+    stale: flag('stale').notNull().default(false),
+    lastSyncedAt: ts('last_synced_at').notNull(),
+}, (t) => [uniqueIndex('registry_instance_kind_ext_idx').on(t.instanceId, t.kind, t.extId)]);
+export const guides = sqliteTable('guides', {
+    id: id(),
+    instanceId: text('instance_id')
+        .notNull()
+        .references(() => pluginInstances.id, { onDelete: 'cascade' }),
+    operationId: text('operation_id')
+        .notNull()
+        .references(() => operations.id, { onDelete: 'cascade' }),
+    version: text('version').notNull(),
+    content: text('content').notNull(),
+    fetchedAt: ts('fetched_at').notNull(),
+});
+// ── permission gate ──────────────────────────────────────────────────────────────────────────────
+export const preApprovalRules = sqliteTable('pre_approval_rules', {
+    id: id(),
+    instanceId: text('instance_id')
+        .notNull()
+        .references(() => pluginInstances.id, { onDelete: 'cascade' }),
+    operationId: text('operation_id')
+        .notNull()
+        .references(() => operations.id),
+    match: json('match').notNull().default([]),
+    rateLimit: integer('rate_limit'),
+    windowSeconds: integer('window_seconds'),
+    expiresAt: ts('expires_at'),
+    reason: text('reason').notNull(),
+    enabled: flag('enabled').notNull().default(true),
+    createdBy: text('created_by').references(() => users.id),
+    createdAt: createdAt(),
+    updatedAt: ts('updated_at'),
+    lastTriggeredAt: ts('last_triggered_at'),
+    /** Last time the conditions held but the call had parameters the rule doesn't accept (strict match). */
+    strictMissAt: ts('strict_miss_at'),
+});
+export const preApprovalHits = sqliteTable('pre_approval_hits', {
+    id: integer('id').primaryKey({ autoIncrement: true }),
+    ruleId: text('rule_id')
+        .notNull()
+        .references(() => preApprovalRules.id, { onDelete: 'cascade' }),
+    occurredAt: ts('occurred_at').notNull(),
+}, (t) => [index('hits_rule_time_idx').on(t.ruleId, t.occurredAt)]);
+export const pendingApprovals = sqliteTable('pending_approvals', {
+    id: id(),
+    instanceId: text('instance_id')
+        .notNull()
+        .references(() => pluginInstances.id),
+    operationId: text('operation_id')
+        .notNull()
+        .references(() => operations.id),
+    /** Redacted copy for display; the real params live only in memory while pending (design §5.5). */
+    paramsDisplay: json('params_display'),
+    paramsHash: text('params_hash').notNull(),
+    resolvedTargets: json('resolved_targets'),
+    summary: text('summary').notNull(),
+    confirmLiteral: text('confirm_literal'),
+    diff: json('diff'),
+    expectedHash: text('expected_hash'),
+    clientKind: text('client_kind'),
+    clientId: text('client_id'),
+    mcpSessionId: text('mcp_session_id'),
+    requestedAt: ts('requested_at').notNull(),
+    expiresAt: ts('expires_at').notNull(),
+    status: text('status', { enum: ['pending', 'approved', 'denied', 'timed_out', 'cancelled'] })
+        .notNull()
+        .default('pending'),
+    decidedBy: text('decided_by'),
+    /** `url`: decided by a signed-in human on the approval page; `elicitation`: by the MCP client (opt-in). */
+    decidedVia: text('decided_via', { enum: ['elicitation', 'url'] }),
+    decidedAt: ts('decided_at'),
+});
+/** Append-only: no API updates or deletes rows (design §7.3). */
+export const auditLog = sqliteTable('audit_log', {
+    id: integer('id').primaryKey({ autoIncrement: true }),
+    at: ts('at').notNull(),
+    kind: text('kind', { enum: ['call', 'search', 'config', 'auth', 'plugin'] }).notNull(),
+    instanceId: text('instance_id'),
+    operationKey: text('operation_key'),
+    classification: text('classification'),
+    decision: text('decision'),
+    actorKind: text('actor_kind', { enum: ['mcp_client', 'user', 'system'] }).notNull(),
+    actorId: text('actor_id'),
+    decidedBy: text('decided_by'),
+    decidedVia: text('decided_via'),
+    params: json('params'),
+    resolvedTargets: json('resolved_targets'),
+    resultStatus: text('result_status'),
+    durationMs: integer('duration_ms'),
+    detail: json('detail'),
+}, (t) => [index('audit_at_idx').on(t.at), index('audit_instance_at_idx').on(t.instanceId, t.at)]);
+// ── MCP client auth ──────────────────────────────────────────────────────────────────────────────
+export const mcpTokens = sqliteTable('mcp_tokens', {
+    id: id(),
+    name: text('name').notNull(),
+    tokenHash: text('token_hash').notNull().unique(),
+    /** Instance ids, or ['*']. */
+    scope: json('scope').$type().notNull(),
+    /** Ceiling on what the token can reach: `read` hides and blocks every write. */
+    access: text('access', { enum: ['read', 'write'] })
+        .notNull()
+        .default('read'),
+    createdBy: text('created_by').references(() => users.id),
+    createdAt: createdAt(),
+    expiresAt: ts('expires_at'),
+    lastUsedAt: ts('last_used_at'),
+    revokedAt: ts('revoked_at'),
+});
+export const oauthClients = sqliteTable('oauth_clients', {
+    id: id(),
+    clientId: text('client_id').notNull().unique(),
+    clientSecretHash: text('client_secret_hash'),
+    name: text('name').notNull(),
+    redirectUris: json('redirect_uris').$type().notNull(),
+    registeredVia: text('registered_via', { enum: ['dcr', 'admin'] }).notNull(),
+    createdAt: createdAt(),
+    revokedAt: ts('revoked_at'),
+});
+export const oauthGrants = sqliteTable('oauth_grants', {
+    id: id(),
+    clientId: text('client_id')
+        .notNull()
+        .references(() => oauthClients.id, { onDelete: 'cascade' }),
+    userId: text('user_id')
+        .notNull()
+        .references(() => users.id, { onDelete: 'cascade' }),
+    resources: json('resources').$type().notNull(),
+    /**
+     * The instance each consented resource URL named at consent time (same order as `resources`).
+     * Tokens are checked against these ids, so renaming a slug or re-using it for another instance
+     * never carries a grant over (design §6.2). NULL only for grants from before this column.
+     */
+    instanceIds: json('instance_ids').$type(),
+    /** Chosen on the consent page (design §6.3); `read` hides and blocks every write. */
+    access: text('access', { enum: ['read', 'write'] })
+        .notNull()
+        .default('read'),
+    createdAt: createdAt(),
+    revokedAt: ts('revoked_at'),
+});
+export const oauthCodes = sqliteTable('oauth_codes', {
+    codeHash: text('code_hash').primaryKey(),
+    grantId: text('grant_id')
+        .notNull()
+        .references(() => oauthGrants.id, { onDelete: 'cascade' }),
+    codeChallenge: text('code_challenge').notNull(),
+    redirectUri: text('redirect_uri').notNull(),
+    resources: json('resources').$type().notNull(),
+    expiresAt: ts('expires_at').notNull(),
+    usedAt: ts('used_at'),
+});
+export const oauthTokens = sqliteTable('oauth_tokens', {
+    tokenHash: text('token_hash').primaryKey(),
+    grantId: text('grant_id')
+        .notNull()
+        .references(() => oauthGrants.id, { onDelete: 'cascade' }),
+    kind: text('kind', { enum: ['access', 'refresh'] }).notNull(),
+    familyId: text('family_id').notNull(),
+    resources: json('resources').$type().notNull(),
+    expiresAt: ts('expires_at').notNull(),
+    revokedAt: ts('revoked_at'),
+});
+// ── notifications ────────────────────────────────────────────────────────────────────────────────
+export const notifierChannels = sqliteTable('notifier_channels', {
+    id: id(),
+    kind: text('kind', { enum: ['ntfy', 'webhook'] }).notNull(),
+    name: text('name').notNull(),
+    config: json('config').notNull(),
+    secretsEnc: blob('secrets_enc', { mode: 'buffer' }),
+    events: json('events').$type().notNull(),
+    instanceFilter: json('instance_filter').$type(),
+    enabled: flag('enabled').notNull().default(true),
+    lastSentAt: ts('last_sent_at'),
+    lastError: text('last_error'),
+});
+export const approvalLinks = sqliteTable('approval_links', {
+    tokenHash: text('token_hash').primaryKey(),
+    approvalId: text('approval_id')
+        .notNull()
+        .references(() => pendingApprovals.id, { onDelete: 'cascade' }),
+    action: text('action', { enum: ['approve', 'deny', 'view'] }).notNull(),
+    expiresAt: ts('expires_at').notNull(),
+    usedAt: ts('used_at'),
+});
+//# sourceMappingURL=schema.js.map

package/dist/db/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/db/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE/F;;;GAGG;AAEH,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;AACzC,MAAM,EAAE,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;AACrE,MAAM,SAAS,GAAG,GAAG,EAAE,CACrB,EAAE,CAAC,YAAY,CAAC;KACb,OAAO,EAAE;KACT,OAAO,CAAC,GAAG,CAAA,sBAAsB,CAAC,CAAC;AACxC,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;AAClE,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AAE5D,oGAAoG;AAEpG,MAAM,CAAC,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,EAAE;IACxC,EAAE,EAAE,EAAE,EAAE;IACR,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IAC7C,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC;IACnC,aAAa,EAAE,IAAI,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC1D,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC1D,mFAAmF;IACnF,YAAY,EAAE,OAAO,CAAC,gBAAgB,CAAC;IACvC,iBAAiB,EAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC,KAAK,EAAY;IAChE,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;IAC/B,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC;IACjC,SAAS,EAAE,SAAS,EAAE;IACtB,WAAW,EAAE,EAAE,CAAC,eAAe,CAAC;IAChC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACpD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,QAAQ,GAAG,WAAW,CACjC,UAAU,EACV;IACE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,UAAU,EAAE;IACpC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;SACpB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACtD,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE;IAC5E,SAAS,EAAE,SAAS,EAAE;IACtB,UAAU,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IACxC,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACrC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC;IACd,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;CAC9B,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CACjD,CAAC;AAEF,MAAM,CAAC,MAAM,QAAQ,GAAG,WAAW,CAAC,UAAU,EAAE;IAC9C,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE;IAC7B,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;CAC/B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,WAAW,CAAC,aAAa,EAAE;IACnD,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC9B,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAChC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACrC,eAAe,EAAE,IAAI,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC9D,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,sBAAsB,CAAC;IAChE,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,KAAK,EAA8D;IACrG,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9D,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAClD,CAAC,CAAC;AAEH,oGAAoG;AAEpG,MAAM,CAAC,MAAM,WAAW,GAAG,WAAW,CAAC,cAAc,EAAE;IACrD,EAAE,EAAE,EAAE,EAAE;IACR,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IACnC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;IAClB,WAAW,EAAE,IAAI,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE;IAC7E,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;IAC7B,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC;IACvC,SAAS,EAAE,IAAI,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,CAAC;SAC3D,OAAO,EAAE;SACT,OAAO,CAAC,IAAI,CAAC;IAChB,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;IAC/B,aAAa,EAAE,EAAE,CAAC,iBAAiB,CAAC;IACpC,cAAc,EAAE,IAAI,CAAC,kBAAkB,CAAC;CACzC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,EAAE;IAC5C,EAAE,EAAE,EAAE,EAAE;IACR,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IAC9C,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IAClC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE;IAC5D,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;IACxD,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC;IACtB,iBAAiB,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACtE,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACpC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE;IAC7E,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC;IACjC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACjD,WAAW,EAAE,SAAS,EAAE;CACzB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAC,kBAAkB,EAAE;IAC7D,EAAE,EAAE,EAAE,EAAE;IACR,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;SACxB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IACrC,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAChD,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,UAAU,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACnD,uDAAuD;IACvD,QAAQ,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,CAAC,EAAE,CAAC;IACtF,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAChD,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;SACxE,OAAO,EAAE;SACT,OAAO,CAAC,SAAS,CAAC;IACrB,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC;IACjC,eAAe,EAAE,IAAI,CAAC,kBAAkB,CAAC;IACzC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;IAC7B,YAAY,EAAE,EAAE,CAAC,gBAAgB,CAAC;IAClC,cAAc,EAAE,IAAI,CAAC,kBAAkB,CAAC;IACxC,SAAS,EAAE,SAAS,EAAE;CACvB,CAAC,CAAC;AAEH,oGAAoG;AAEpG,qHAAqH;AACrH,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CACxC,kBAAkB,EAClB;IACE,EAAE,EAAE,EAAE,EAAE;IACR,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;SAC5B,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAChE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE;IAC1B,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IAC9B,kCAAkC;IAClC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;SAC7D,OAAO,EAAE;SACT,OAAO,CAAC,MAAM,CAAC;IAClB,cAAc,EAAE,EAAE,CAAC,kBAAkB,CAAC;IACtC,cAAc,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IACnE,WAAW,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE;IAC1C,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC9C,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,mCAAmC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAClF,CAAC;AAEF,wGAAwG;AACxG,MAAM,CAAC,MAAM,qBAAqB,GAAG,WAAW,CAC9C,yBAAyB,EACzB;IACE,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;SAC5B,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAChE,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;CACtC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,6BAA6B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CACpF,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,WAAW,CACnC,YAAY,EACZ;IACE,EAAE,EAAE,EAAE,EAAE;IACR,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;SAC5B,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAChE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE;IAC1B,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC;IACjC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,wEAAwE;IACxE,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC;SACtB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC;IACvC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC;IAChB,sDAAsD;IACtD,cAAc,EAAE,IAAI,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE;IAC7E,oBAAoB,EAAE,IAAI,CAAC,uBAAuB,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE;IAC3G,sBAAsB,EAAE,IAAI,CAAC,yBAAyB,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE;IAC9F,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/C,4GAA4G;IAC5G,aAAa,EAAE,IAAI,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;IACjF,uFAAuF;IACvF,iBAAiB,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACtE,cAAc,EAAE,EAAE,CAAC,iBAAiB,CAAC;IACrC,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IAClE,iBAAiB,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACtE,mBAAmB,EAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC1E,kGAAkG;IAClG,iBAAiB,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACtE,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC1D,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC;IACnC,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC;IACnC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;IAClB,WAAW,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE;IAC1C,UAAU,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IACxC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC9C,EACD,CAAC,CAAC,EAAE,EAAE,CAAC;IACL,WAAW,CAAC,6BAA6B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC;IAClE,KAAK,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;CAC5C,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CACxC,kBAAkB,EAClB;IACE,EAAE,EAAE,EAAE,EAAE;IACR,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;SAC5B,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAChE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAC/B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,WAAW,EAAE,IAAI,CAAC,eAAe,CAAC;IAClC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC;IACtB,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;IACpB,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC7C,YAAY,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;CAC7C,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,gCAAgC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CACzF,CAAC;AAEF,MAAM,CAAC,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,EAAE;IAC1C,EAAE,EAAE,EAAE,EAAE;IACR,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;SAC5B,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAChE,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC;SAC9B,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAC3D,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IAClC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IAClC,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CACtC,CAAC,CAAC;AAEH,oGAAoG;AAEpG,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAC,oBAAoB,EAAE;IAChE,EAAE,EAAE,EAAE,EAAE;IACR,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;SAC5B,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAChE,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC;SAC9B,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;IAClC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1C,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC;IAChC,aAAa,EAAE,OAAO,CAAC,gBAAgB,CAAC;IACxC,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC;IAC3B,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAChC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAChD,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IACxD,SAAS,EAAE,SAAS,EAAE;IACtB,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC;IAC3B,eAAe,EAAE,EAAE,CAAC,mBAAmB,CAAC;IACxC,wGAAwG;IACxG,YAAY,EAAE,EAAE,CAAC,gBAAgB,CAAC;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CACxC,mBAAmB,EACnB;IACE,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACrD,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;SACpB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACjE,UAAU,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;CACxC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAChE,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAC,mBAAmB,EAAE;IAC/D,EAAE,EAAE,EAAE,EAAE;IACR,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;SAC5B,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC;IACvC,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC;SAC9B,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;IAClC,kGAAkG;IAClG,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC;IACrC,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,eAAe,EAAE,IAAI,CAAC,kBAAkB,CAAC;IACzC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IAClC,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC;IACvC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;IAClB,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC;IACnC,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;IAC/B,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;IAC3B,YAAY,EAAE,IAAI,CAAC,gBAAgB,CAAC;IACpC,WAAW,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IACzC,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACrC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;SAC1F,OAAO,EAAE;SACT,OAAO,CAAC,SAAS,CAAC;IACrB,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;IAC7B,2GAA2G;IAC3G,UAAU,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC;IACjE,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC;CAC5B,CAAC,CAAC;AAEH,iEAAiE;AACjE,MAAM,CAAC,MAAM,QAAQ,GAAG,WAAW,CACjC,WAAW,EACX;IACE,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACrD,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE;IACtB,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE;IACtF,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;IAC/B,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC;IACnC,cAAc,EAAE,IAAI,CAAC,gBAAgB,CAAC;IACtC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC;IAC1B,SAAS,EAAE,IAAI,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE;IACnF,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC;IACzB,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;IAC7B,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;IAC/B,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC;IACtB,eAAe,EAAE,IAAI,CAAC,kBAAkB,CAAC;IACzC,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC;IACnC,UAAU,EAAE,OAAO,CAAC,aAAa,CAAC;IAClC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC;CACvB,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,uBAAuB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAC/F,CAAC;AAEF,oGAAoG;AAEpG,MAAM,CAAC,MAAM,SAAS,GAAG,WAAW,CAAC,YAAY,EAAE;IACjD,EAAE,EAAE,EAAE,EAAE;IACR,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IAChD,8BAA8B;IAC9B,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,EAAY,CAAC,OAAO,EAAE;IAChD,gFAAgF;IAChF,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;SAChD,OAAO,EAAE;SACT,OAAO,CAAC,MAAM,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IACxD,SAAS,EAAE,SAAS,EAAE;IACtB,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC;IAC3B,UAAU,EAAE,EAAE,CAAC,cAAc,CAAC;IAC9B,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,WAAW,CAAC,eAAe,EAAE;IACvD,EAAE,EAAE,EAAE,EAAE;IACR,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IAC9C,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC;IAC5C,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,KAAK,EAAY,CAAC,OAAO,EAAE;IAC/D,aAAa,EAAE,IAAI,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE;IAC3E,SAAS,EAAE,SAAS,EAAE;IACtB,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,WAAW,CAAC,cAAc,EAAE;IACrD,EAAE,EAAE,EAAE,EAAE;IACR,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;SACxB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAC7D,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;SACpB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACtD,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,KAAK,EAAY,CAAC,OAAO,EAAE;IACxD;;;;OAIG;IACH,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,KAAK,EAAY;IACnD,qFAAqF;IACrF,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;SAChD,OAAO,EAAE;SACT,OAAO,CAAC,MAAM,CAAC;IAClB,SAAS,EAAE,SAAS,EAAE;IACtB,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,WAAW,CAAC,aAAa,EAAE;IACnD,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,UAAU,EAAE;IACxC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC;SACtB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAC5D,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;IAC/C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,KAAK,EAAY,CAAC,OAAO,EAAE;IACxD,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACrC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,WAAW,CAAC,cAAc,EAAE;IACrD,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE;IAC1C,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC;SACtB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAC5D,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE;IAC7D,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACrC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,KAAK,EAAY,CAAC,OAAO,EAAE;IACxD,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACrC,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC;CAC5B,CAAC,CAAC;AAEH,oGAAoG;AAEpG,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAC,mBAAmB,EAAE;IAC/D,EAAE,EAAE,EAAE,EAAE;IACR,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE;IAC3D,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAChC,UAAU,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACnD,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAY,CAAC,OAAO,EAAE;IAClD,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,KAAK,EAAY;IACzD,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAChD,UAAU,EAAE,EAAE,CAAC,cAAc,CAAC;IAC9B,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;CAC9B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,WAAW,CAAC,gBAAgB,EAAE;IACzD,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE;IAC1C,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;SAC5B,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACjE,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE;IACvE,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACrC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC;CACtB,CAAC,CAAC"}

package/dist/endpoints/slug.d.ts

@@ -0,0 +1,3 @@
+/** Top-level paths on the MCP listener that can never be used as an instance slug (design §2.2). */
+export declare const RESERVED_SLUGS: readonly ["oauth", "a", "healthz", ".well-known", "api", "auth", "static"];
+export declare function isValidSlug(slug: string): boolean;

package/dist/endpoints/slug.js

@@ -0,0 +1,7 @@
+/** Top-level paths on the MCP listener that can never be used as an instance slug (design §2.2). */
+export const RESERVED_SLUGS = ['oauth', 'a', 'healthz', '.well-known', 'api', 'auth', 'static'];
+const SLUG_PATTERN = /^[a-z0-9][a-z0-9-]{0,62}$/;
+export function isValidSlug(slug) {
+    return SLUG_PATTERN.test(slug) && !RESERVED_SLUGS.includes(slug);
+}
+//# sourceMappingURL=slug.js.map

package/dist/endpoints/slug.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slug.js","sourceRoot":"","sources":["../../src/endpoints/slug.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAU,CAAC;AAEzG,MAAM,YAAY,GAAG,2BAA2B,CAAC;AAEjD,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAE,cAAoC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC1F,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,16 @@
+/** Service-layer errors that the Admin API maps onto HTTP status codes. */
+export declare class ServiceError extends Error {
+    readonly status: 400 | 404 | 409;
+    readonly code: string;
+    readonly details?: unknown | undefined;
+    constructor(status: 400 | 404 | 409, code: string, message: string, details?: unknown | undefined);
+}
+export declare class ValidationError extends ServiceError {
+    constructor(code: string, message: string, details?: unknown);
+}
+export declare class NotFoundError extends ServiceError {
+    constructor(code: string, message: string, details?: unknown);
+}
+export declare class ConflictError extends ServiceError {
+    constructor(code: string, message: string, details?: unknown);
+}

package/dist/errors.js

@@ -0,0 +1,29 @@
+/** Service-layer errors that the Admin API maps onto HTTP status codes. */
+export class ServiceError extends Error {
+    status;
+    code;
+    details;
+    constructor(status, code, message, details) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.details = details;
+        this.name = new.target.name;
+    }
+}
+export class ValidationError extends ServiceError {
+    constructor(code, message, details) {
+        super(400, code, message, details);
+    }
+}
+export class NotFoundError extends ServiceError {
+    constructor(code, message, details) {
+        super(404, code, message, details);
+    }
+}
+export class ConflictError extends ServiceError {
+    constructor(code, message, details) {
+        super(409, code, message, details);
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,MAAM,OAAO,YAAa,SAAQ,KAAK;IAE1B;IACA;IAEA;IAJX,YACW,MAAuB,EACvB,IAAY,EACrB,OAAe,EACN,OAAiB;QAE1B,KAAK,CAAC,OAAO,CAAC,CAAC;QALN,WAAM,GAAN,MAAM,CAAiB;QACvB,SAAI,GAAJ,IAAI,CAAQ;QAEZ,YAAO,GAAP,OAAO,CAAU;QAG1B,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;IAC9B,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,YAAY;IAC/C,YAAY,IAAY,EAAE,OAAe,EAAE,OAAiB;QAC1D,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;CACF;AAED,MAAM,OAAO,aAAc,SAAQ,YAAY;IAC7C,YAAY,IAAY,EAAE,OAAe,EAAE,OAAiB;QAC1D,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;CACF;AAED,MAAM,OAAO,aAAc,SAAQ,YAAY;IAC7C,YAAY,IAAY,EAAE,OAAe,EAAE,OAAiB;QAC1D,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;CACF"}

package/dist/events.d.ts

@@ -0,0 +1,43 @@
+import { EventEmitter } from 'node:events';
+/**
+ * In-process event bus (design §9.1). Notifiers and the admin SSE stream subscribe here; producers
+ * never need to know who is listening. Payloads never carry raw params or secrets.
+ */
+export interface CoreEventMap {
+    'instance.status': [{
+        instanceId: string;
+        slug: string;
+        status: string;
+        error?: string;
+    }];
+    'plugin.crashed': [{
+        instanceId: string;
+        slug: string;
+        error: string;
+    }];
+    'sync.completed': [
+        {
+            instanceId: string;
+            slug: string;
+            added: number;
+            pendingReview: string[];
+            newGroups: string[];
+            rulesDisabled?: number;
+        }
+    ];
+    'sync.failed': [{
+        instanceId: string;
+        slug: string;
+        error: string;
+    }];
+    'auth.lockout': [{
+        username: string;
+        ip?: string;
+        surface?: 'admin' | 'mcp';
+    }];
+}
+export type CoreEventName = keyof CoreEventMap;
+export declare const CORE_EVENT_NAMES: CoreEventName[];
+export declare class CoreEvents extends EventEmitter<CoreEventMap> {
+    constructor();
+}

package/dist/events.js

@@ -0,0 +1,16 @@
+import { EventEmitter } from 'node:events';
+export const CORE_EVENT_NAMES = [
+    'instance.status',
+    'plugin.crashed',
+    'sync.completed',
+    'sync.failed',
+    'auth.lockout',
+];
+export class CoreEvents extends EventEmitter {
+    constructor() {
+        super();
+        // Several subscribers (notifier channels, SSE clients) is normal; don't warn at 10.
+        this.setMaxListeners(0);
+    }
+}
+//# sourceMappingURL=events.js.map

package/dist/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAyB3C,MAAM,CAAC,MAAM,gBAAgB,GAAoB;IAC/C,iBAAiB;IACjB,gBAAgB;IAChB,gBAAgB;IAChB,aAAa;IACb,cAAc;CACf,CAAC;AAEF,MAAM,OAAO,UAAW,SAAQ,YAA0B;IACxD;QACE,KAAK,EAAE,CAAC;QACR,oFAAoF;QACpF,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;CACF"}

package/dist/gate/access.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Access levels (design §5.2 step 2). Every operation has an effective level: its own override if
+ * an admin set one, otherwise its group's level. The level decides whether a call is hidden, runs
+ * straight away, needs a human approval, or is auto-approved:
+ *
+ *   none  → nothing callable
+ *   read  → reads run; writes are hidden
+ *   ask   → reads run; writes need approval (pre-approval rules may cover them)
+ *   write → reads run; acknowledged writes run without asking
+ *
+ * Locked operations never follow their group into `ask`/`write`: each needs its own `ask` override,
+ * and `write` is not allowed for them. A principal whose access ceiling is `read` (consent page,
+ * bearer token) never reaches a write, whatever the levels say.
+ */
+export declare const ACCESS_LEVELS: readonly ["none", "read", "ask", "write"];
+export type AccessLevel = (typeof ACCESS_LEVELS)[number];
+export declare const ACCESS_CEILINGS: readonly ["read", "write"];
+export type AccessCeiling = (typeof ACCESS_CEILINGS)[number];
+export declare const isAccessLevel: (v: unknown) => v is AccessLevel;
+export declare const minLevel: (a: AccessLevel, b: AccessLevel) => AccessLevel;
+export type AccessReason = 'group_missing' | 'level_none' | 'read_only' | 'token_read_only' | 'locked_not_opted_in';
+/** `run`: read, no approval · `approve`: needs a human (or a pre-approval rule) · `auto`: write, auto-approved. */
+export type AccessMode = 'run' | 'approve' | 'auto';
+export interface AccessOperation {
+    classification: 'read' | 'write';
+    locked: boolean;
+    levelOverride: AccessLevel | null;
+    writeAcknowledged: boolean;
+}
+export interface AccessGroup {
+    level: AccessLevel;
+}
+export interface AccessPrincipal {
+    ceiling: AccessCeiling;
+}
+export type AccessDecision = {
+    reachable: true;
+    mode: AccessMode;
+    level: AccessLevel;
+    /** A write at level `write` that nobody acknowledged yet: it asks until an admin does. */
+    pendingReview?: true;
+} | {
+    reachable: false;
+    reason: AccessReason;
+};
+export declare const FULL_ACCESS: AccessPrincipal;
+export declare function effectiveAccess(op: AccessOperation, group: AccessGroup | undefined, principal?: AccessPrincipal): AccessDecision;

package/dist/gate/access.js

@@ -0,0 +1,48 @@
+/**
+ * Access levels (design §5.2 step 2). Every operation has an effective level: its own override if
+ * an admin set one, otherwise its group's level. The level decides whether a call is hidden, runs
+ * straight away, needs a human approval, or is auto-approved:
+ *
+ *   none  → nothing callable
+ *   read  → reads run; writes are hidden
+ *   ask   → reads run; writes need approval (pre-approval rules may cover them)
+ *   write → reads run; acknowledged writes run without asking
+ *
+ * Locked operations never follow their group into `ask`/`write`: each needs its own `ask` override,
+ * and `write` is not allowed for them. A principal whose access ceiling is `read` (consent page,
+ * bearer token) never reaches a write, whatever the levels say.
+ */
+export const ACCESS_LEVELS = ['none', 'read', 'ask', 'write'];
+export const ACCESS_CEILINGS = ['read', 'write'];
+const RANK = { none: 0, read: 1, ask: 2, write: 3 };
+export const isAccessLevel = (v) => ACCESS_LEVELS.includes(v);
+export const minLevel = (a, b) => (RANK[a] <= RANK[b] ? a : b);
+export const FULL_ACCESS = { ceiling: 'write' };
+export function effectiveAccess(op, group, principal = FULL_ACCESS) {
+    // Fail closed on a missing or unrecognized group row, and on an unrecognized override.
+    if (!group || !isAccessLevel(group.level))
+        return { reachable: false, reason: 'group_missing' };
+    const level = op.levelOverride === null ? group.level : isAccessLevel(op.levelOverride) ? op.levelOverride : 'none';
+    if (level === 'none')
+        return { reachable: false, reason: 'level_none' };
+    // Locked operations are always writes, whatever classification the row carries.
+    const isWrite = op.locked || op.classification === 'write';
+    if (!isWrite)
+        return { reachable: true, mode: 'run', level };
+    if (principal.ceiling !== 'write')
+        return { reachable: false, reason: 'token_read_only' };
+    if (op.locked) {
+        // Only an explicit per-operation `ask` opens a locked op, and it never auto-approves.
+        if (op.levelOverride === null || RANK[level] < RANK.ask)
+            return { reachable: false, reason: 'locked_not_opted_in' };
+        return { reachable: true, mode: 'approve', level: 'ask' };
+    }
+    if (level === 'read')
+        return { reachable: false, reason: 'read_only' };
+    if (level === 'ask')
+        return { reachable: true, mode: 'approve', level };
+    if (!op.writeAcknowledged)
+        return { reachable: true, mode: 'approve', level, pendingReview: true };
+    return { reachable: true, mode: 'auto', level };
+}
+//# sourceMappingURL=access.js.map

package/dist/gate/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../../src/gate/access.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAU,CAAC;AAGvE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,OAAO,CAAU,CAAC;AAG1D,MAAM,IAAI,GAAgC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAEjF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAU,EAAoB,EAAE,CAAE,aAAoC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAEjH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAc,EAAE,CAAc,EAAe,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAgCtG,MAAM,CAAC,MAAM,WAAW,GAAoB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAEjE,MAAM,UAAU,eAAe,CAC7B,EAAmB,EACnB,KAA8B,EAC9B,YAA6B,WAAW;IAExC,uFAAuF;IACvF,IAAI,CAAC,KAAK,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChG,MAAM,KAAK,GACT,EAAE,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC;IAExG,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACxE,gFAAgF;IAChF,MAAM,OAAO,GAAG,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,cAAc,KAAK,OAAO,CAAC;IAC3D,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAE7D,IAAI,SAAS,CAAC,OAAO,KAAK,OAAO;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC1F,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC;QACd,sFAAsF;QACtF,IAAI,EAAE,CAAC,aAAa,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QACpH,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC5D,CAAC;IACD,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACvE,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACxE,IAAI,CAAC,EAAE,CAAC,iBAAiB;QAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACnG,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAClD,CAAC"}