@synoikia/core 0.1.0

package/dist/http/admin/auth.js

@@ -0,0 +1,338 @@
+import { deleteCookie, getCookie, setCookie } from 'hono/cookie';
+import { z } from 'zod';
+import { writeAudit } from '../../audit.js';
+import { randomToken, safeEqual, signPayload, verifyPayload } from '../../auth/tokens.js';
+import { toPublicUser } from '../../auth/users.js';
+import { ConflictError } from '../../errors.js';
+import { getSettings } from '../../settings.js';
+import { clientIp, isSecure, readJson, requestOrigin } from '../common.js';
+const SESSION_COOKIE = 'syn_admin';
+const SECURE_SESSION_COOKIE = '__Host-syn_admin';
+export const CSRF_COOKIE = 'syn_csrf';
+export const CSRF_HEADER = 'x-csrf-token';
+const MFA_COOKIE = 'syn_mfa';
+const OIDC_COOKIE = 'syn_oidc';
+const MFA_TTL_MS = 5 * 60_000;
+export function sessionLimits(ctx) {
+    const s = getSettings(ctx.db, 'security');
+    return { idleMs: s.sessionIdleMinutes * 60_000, absoluteMs: s.sessionAbsoluteHours * 3600_000 };
+}
+const readSessionCookie = (c) => getCookie(c, SECURE_SESSION_COOKIE) ?? getCookie(c, SESSION_COOKIE);
+function setSessionCookie(c, ctx, raw) {
+    const secure = isSecure(c, ctx.config.TRUST_PROXY);
+    const limits = sessionLimits(ctx);
+    // `__Host-` requires Secure; plain-HTTP LAN setups fall back to the unprefixed name.
+    setCookie(c, secure ? SECURE_SESSION_COOKIE : SESSION_COOKIE, raw, {
+        httpOnly: true,
+        secure,
+        sameSite: 'Strict',
+        path: '/',
+        maxAge: Math.floor(limits.absoluteMs / 1000),
+    });
+    setCookie(c, CSRF_COOKIE, randomToken(24), { httpOnly: false, secure, sameSite: 'Strict', path: '/' });
+}
+function clearSessionCookies(c) {
+    deleteCookie(c, SESSION_COOKIE, { path: '/' });
+    deleteCookie(c, SECURE_SESSION_COOKIE, { path: '/', secure: true });
+}
+export function localLoginEnabled(ctx) {
+    return ctx.config.ADMIN_FORCE_LOCAL_LOGIN || !getSettings(ctx.db, 'security').disableLocalLogin;
+}
+/**
+ * While local login is off (setting, not the env override), single sign-on is the only way in: refuse
+ * any change that would leave it off or with no enabled user linked to it (design §6.1).
+ */
+export function assertSsoRemains(ctx, change) {
+    if (!getSettings(ctx.db, 'security').disableLocalLogin)
+        return;
+    if (change.oidcOff || !ctx.users.hasOidcLinkedUser(change.losingUser)) {
+        throw new ConflictError('local_login_disabled', 'Local login is disabled, so this would lock everyone out. Re-enable local login first.');
+    }
+}
+/** Local-password users must have TOTP when the admin requires it (OIDC-only users rely on the IdP). */
+export function mustEnrollTotp(ctx, user) {
+    return getSettings(ctx.db, 'security').requireTotp && !!user.passwordHash && !user.totpEnabled;
+}
+const UNSAFE = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
+/** CSRF: double-submit token + Origin check for every state-changing request under /api and /auth. */
+export function csrfGuard(ctx) {
+    return async (c, next) => {
+        if (!UNSAFE.has(c.req.method))
+            return next();
+        const origin = c.req.header('origin');
+        if (origin) {
+            const expected = ctx.config.PUBLIC_ADMIN_URL
+                ? new URL(ctx.config.PUBLIC_ADMIN_URL).origin
+                : requestOrigin(c, ctx.config.TRUST_PROXY);
+            if (origin !== expected)
+                return c.json({ error: 'bad_origin', message: 'Cross-origin request refused' }, 403);
+        }
+        const cookie = getCookie(c, CSRF_COOKIE);
+        const header = c.req.header(CSRF_HEADER);
+        if (!cookie || !header || !safeEqual(cookie, header)) {
+            return c.json({ error: 'csrf', message: 'Missing or invalid CSRF token' }, 403);
+        }
+        return next();
+    };
+}
+const TOTP_ENROLL_PATHS = ['/api/session', '/api/profile', '/api/profile/totp/begin', '/api/profile/totp/confirm'];
+export function requireUser(ctx) {
+    return async (c, next) => {
+        const raw = readSessionCookie(c);
+        const session = ctx.sessions.validate(raw, 'admin', sessionLimits(ctx));
+        if (!session || !raw)
+            return c.json({ error: 'unauthenticated', message: 'Sign in first' }, 401);
+        if (mustEnrollTotp(ctx, session.user) && !TOTP_ENROLL_PATHS.includes(c.req.path)) {
+            return c.json({ error: 'totp_enrollment_required', message: 'Set up two-factor authentication first' }, 403);
+        }
+        c.set('user', session.user);
+        c.set('sessionRaw', raw);
+        return next();
+    };
+}
+function startSession(c, ctx, user, method) {
+    const raw = ctx.sessions.create(user.id, 'admin', sessionLimits(ctx), {
+        ip: clientIp(c, ctx.config.TRUST_PROXY),
+        userAgent: c.req.header('user-agent'),
+    });
+    setSessionCookie(c, ctx, raw);
+    ctx.users.markLogin(user.id);
+    writeAudit(ctx.db, {
+        kind: 'auth',
+        decision: 'login',
+        actorKind: 'user',
+        actorId: user.id,
+        detail: { username: user.username, method, ip: clientIp(c, ctx.config.TRUST_PROXY) },
+    });
+}
+function adminCallbackUrl(c, ctx) {
+    const base = ctx.config.PUBLIC_ADMIN_URL ?? requestOrigin(c, ctx.config.TRUST_PROXY);
+    return new URL('/auth/oidc/callback', base).toString();
+}
+const safeReturnTo = (v) => (v && v.startsWith('/') && !v.startsWith('//') ? v : '/');
+export function registerAuthRoutes(app, ctx) {
+    const LoginBody = z.object({ username: z.string().min(1).max(64), password: z.string().min(1).max(1024) });
+    // Public session probe: also hands out the CSRF cookie the SPA echoes back.
+    app.get('/api/session', (c) => {
+        if (!getCookie(c, CSRF_COOKIE)) {
+            setCookie(c, CSRF_COOKIE, randomToken(24), {
+                httpOnly: false,
+                secure: isSecure(c, ctx.config.TRUST_PROXY),
+                sameSite: 'Strict',
+                path: '/',
+            });
+        }
+        const oidc = ctx.oidc.getSettings();
+        const base = {
+            setupRequired: ctx.users.count() === 0,
+            localLoginEnabled: localLoginEnabled(ctx),
+            oidc: { enabled: !!oidc?.enabled, label: oidc?.label ?? 'SSO' },
+        };
+        const session = ctx.sessions.validate(readSessionCookie(c), 'admin', sessionLimits(ctx));
+        if (!session)
+            return c.json({ authenticated: false, ...base });
+        return c.json({
+            authenticated: true,
+            ...base,
+            user: toPublicUser(session.user),
+            mustEnrollTotp: mustEnrollTotp(ctx, session.user),
+        });
+    });
+    app.post('/api/setup', async (c) => {
+        const body = await readJson(c, LoginBody);
+        const created = await ctx.users.setupFirstUser(body.username, body.password);
+        startSession(c, ctx, ctx.users.get(created.id), 'setup');
+        return c.json({ status: 'ok', user: created });
+    });
+    app.post('/auth/login', async (c) => {
+        const ip = clientIp(c, ctx.config.TRUST_PROXY);
+        if (!ctx.throttle.allowIp(ip))
+            return c.json({ error: 'rate_limited', message: 'Too many attempts; try again later' }, 429);
+        if (!localLoginEnabled(ctx))
+            return c.json({ error: 'local_login_disabled', message: 'Use single sign-on' }, 403);
+        const body = await readJson(c, LoginBody);
+        const lockedFor = ctx.throttle.lockedFor(body.username);
+        if (lockedFor > 0) {
+            return c.json({ error: 'locked', message: `Too many failed attempts; try again in ${Math.ceil(lockedFor / 60)} min` }, 429);
+        }
+        const user = await ctx.users.verifyPassword(body.username, body.password);
+        if (!user) {
+            const locked = ctx.throttle.fail(body.username);
+            writeAudit(ctx.db, {
+                kind: 'auth',
+                decision: locked ? 'login_locked' : 'login_failed',
+                actorKind: 'system',
+                detail: { username: body.username, ip },
+            });
+            if (locked)
+                ctx.events.emit('auth.lockout', { username: body.username, ip });
+            return c.json({ error: 'invalid_credentials', message: 'Invalid username or password' }, 401);
+        }
+        if (user.totpEnabled) {
+            setCookie(c, MFA_COOKIE, signPayload(ctx.keys.state, { mfaUser: user.id }, MFA_TTL_MS), {
+                httpOnly: true,
+                secure: isSecure(c, ctx.config.TRUST_PROXY),
+                sameSite: 'Strict',
+                path: '/auth',
+                maxAge: MFA_TTL_MS / 1000,
+            });
+            return c.json({ status: 'totp_required' });
+        }
+        ctx.throttle.succeed(body.username);
+        startSession(c, ctx, user, 'password');
+        return c.json({ status: 'ok', mustEnrollTotp: mustEnrollTotp(ctx, user) });
+    });
+    app.post('/auth/totp', async (c) => {
+        const { code } = await readJson(c, z.object({ code: z.string().min(1).max(32) }));
+        const pending = verifyPayload(ctx.keys.state, getCookie(c, MFA_COOKIE));
+        if (!pending)
+            return c.json({ error: 'mfa_expired', message: 'Sign in again' }, 401);
+        const user = ctx.users.get(pending.mfaUser);
+        if (ctx.throttle.lockedFor(user.username) > 0)
+            return c.json({ error: 'locked', message: 'Too many failed attempts' }, 429);
+        const factor = ctx.users.verifySecondFactor(user.id, code);
+        if (!factor) {
+            if (ctx.throttle.fail(user.username))
+                ctx.events.emit('auth.lockout', { username: user.username });
+            writeAudit(ctx.db, {
+                kind: 'auth',
+                decision: 'totp_failed',
+                actorKind: 'system',
+                detail: { username: user.username },
+            });
+            return c.json({ error: 'invalid_code', message: 'Invalid code' }, 401);
+        }
+        deleteCookie(c, MFA_COOKIE, { path: '/auth' });
+        ctx.throttle.succeed(user.username);
+        startSession(c, ctx, user, factor === 'recovery' ? 'password+recovery_code' : 'password+totp');
+        return c.json({ status: 'ok' });
+    });
+    app.post('/auth/logout', (c) => {
+        ctx.sessions.revoke(readSessionCookie(c));
+        clearSessionCookies(c);
+        return c.json({ status: 'ok' });
+    });
+    // OIDC: sign in, or link the signed-in user's account (Profile → Link).
+    app.get('/auth/oidc/start', async (c) => {
+        const { url, stateToken } = await ctx.oidc.begin({
+            purpose: 'admin_login',
+            redirectUri: adminCallbackUrl(c, ctx),
+            returnTo: safeReturnTo(c.req.query('returnTo')),
+        });
+        setCookie(c, OIDC_COOKIE, stateToken, {
+            httpOnly: true,
+            secure: isSecure(c, ctx.config.TRUST_PROXY),
+            sameSite: 'Lax',
+            path: '/auth',
+            maxAge: 600,
+        });
+        return c.redirect(url);
+    });
+    app.get('/auth/oidc/link', requireUser(ctx), async (c) => {
+        const { url, stateToken } = await ctx.oidc.begin({
+            purpose: 'admin_link',
+            redirectUri: adminCallbackUrl(c, ctx),
+            returnTo: '/settings/profile',
+            userId: c.get('user').id,
+        });
+        setCookie(c, OIDC_COOKIE, stateToken, {
+            httpOnly: true,
+            secure: isSecure(c, ctx.config.TRUST_PROXY),
+            sameSite: 'Lax',
+            path: '/auth',
+            maxAge: 600,
+        });
+        return c.redirect(url);
+    });
+    app.get('/auth/oidc/callback', async (c) => {
+        const fail = (code) => c.redirect(`/login?error=${encodeURIComponent(code)}`);
+        let result;
+        try {
+            result = await ctx.oidc.complete(new URL(c.req.url, adminCallbackUrl(c, ctx)), getCookie(c, OIDC_COOKIE));
+        }
+        catch (err) {
+            writeAudit(ctx.db, {
+                kind: 'auth',
+                decision: 'oidc_failed',
+                actorKind: 'system',
+                detail: { error: err instanceof Error ? err.message : String(err) },
+            });
+            return fail('oidc_failed');
+        }
+        finally {
+            deleteCookie(c, OIDC_COOKIE, { path: '/auth' });
+        }
+        const { identity, state } = result;
+        if (state.purpose === 'admin_link') {
+            // Linking requires the same signed-in user who started it.
+            const session = ctx.sessions.validate(readSessionCookie(c), 'admin', sessionLimits(ctx));
+            if (!session || session.user.id !== state.userId)
+                return fail('session_changed');
+            if (!ctx.oidc.isAllowed(identity))
+                return c.redirect('/settings/profile?error=oidc_not_allowed');
+            try {
+                ctx.users.linkOidc(session.user.id, identity.issuer, identity.subject);
+            }
+            catch (err) {
+                if (err instanceof ConflictError)
+                    return c.redirect('/settings/profile?error=oidc_taken');
+                throw err;
+            }
+            return c.redirect('/settings/profile?linked=1');
+        }
+        if (state.purpose !== 'admin_login')
+            return fail('wrong_flow');
+        const user = await ctx.oidc.resolveUser(ctx.users, identity);
+        if (!user) {
+            writeAudit(ctx.db, {
+                kind: 'auth',
+                decision: 'oidc_denied',
+                actorKind: 'system',
+                detail: { issuer: identity.issuer, subject: identity.subject, email: identity.email },
+            });
+            return fail('oidc_not_allowed');
+        }
+        startSession(c, ctx, user, 'oidc');
+        return c.redirect(safeReturnTo(state.returnTo));
+    });
+}
+export function registerProfileRoutes(app, ctx) {
+    app.get('/api/profile', (c) => c.json(toPublicUser(ctx.users.get(c.get('user').id))));
+    app.post('/api/profile/password', async (c) => {
+        const body = await readJson(c, z.object({ currentPassword: z.string().optional(), newPassword: z.string() }));
+        const user = c.get('user');
+        await ctx.users.setPassword(user.id, body.newPassword, {
+            currentPassword: body.currentPassword ?? '',
+            actorId: user.id,
+        });
+        ctx.sessions.revokeUser(user.id, c.get('sessionRaw'));
+        ctx.oauth.revokeUserGrants(user.id, 'password_changed', { userId: user.id });
+        return c.json({ status: 'ok' });
+    });
+    app.post('/api/profile/totp/begin', (c) => c.json(ctx.users.beginTotp(c.get('user').id)));
+    app.post('/api/profile/totp/confirm', async (c) => {
+        const { code } = await readJson(c, z.object({ code: z.string() }));
+        return c.json({ recoveryCodes: ctx.users.confirmTotp(c.get('user').id, code) });
+    });
+    // Turning TOTP off needs a current code, so a hijacked session alone can't remove the second factor.
+    app.post('/api/profile/totp/disable', async (c) => {
+        const { code } = await readJson(c, z.object({ code: z.string() }));
+        const user = c.get('user');
+        if (getSettings(ctx.db, 'security').requireTotp && user.passwordHash) {
+            throw new ConflictError('totp_required', 'Two-factor authentication is required on this server');
+        }
+        if (!ctx.users.verifySecondFactor(user.id, code))
+            return c.json({ error: 'invalid_code', message: 'Invalid code' }, 401);
+        ctx.users.resetTotp(user.id);
+        return c.json({ status: 'ok' });
+    });
+    app.post('/api/profile/oidc/unlink', (c) => {
+        const user = c.get('user');
+        if (!user.passwordHash)
+            throw new ConflictError('last_login_method', 'Set a password before unlinking single sign-on');
+        assertSsoRemains(ctx, { losingUser: user.id });
+        ctx.users.unlinkOidc(user.id);
+        return c.json({ status: 'ok' });
+    });
+}
+//# sourceMappingURL=auth.js.map

package/dist/http/admin/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/http/admin/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAS3E,MAAM,cAAc,GAAG,WAAW,CAAC;AACnC,MAAM,qBAAqB,GAAG,kBAAkB,CAAC;AACjD,MAAM,CAAC,MAAM,WAAW,GAAG,UAAU,CAAC;AACtC,MAAM,CAAC,MAAM,WAAW,GAAG,cAAc,CAAC;AAC1C,MAAM,UAAU,GAAG,SAAS,CAAC;AAC7B,MAAM,WAAW,GAAG,UAAU,CAAC;AAC/B,MAAM,UAAU,GAAG,CAAC,GAAG,MAAM,CAAC;AAE9B,MAAM,UAAU,aAAa,CAAC,GAAe;IAC3C,MAAM,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IAC1C,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,kBAAkB,GAAG,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,oBAAoB,GAAG,QAAQ,EAAE,CAAC;AAClG,CAAC;AAED,MAAM,iBAAiB,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,qBAAqB,CAAC,IAAI,SAAS,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;AAE9G,SAAS,gBAAgB,CAAC,CAAU,EAAE,GAAe,EAAE,GAAW;IAChE,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,qFAAqF;IACrF,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,cAAc,EAAE,GAAG,EAAE;QACjE,QAAQ,EAAE,IAAI;QACd,MAAM;QACN,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;KAC7C,CAAC,CAAC;IACH,SAAS,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;AACzG,CAAC;AAED,SAAS,mBAAmB,CAAC,CAAU;IACrC,YAAY,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/C,YAAY,CAAC,CAAC,EAAE,qBAAqB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAe;IAC/C,OAAO,GAAG,CAAC,MAAM,CAAC,uBAAuB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,iBAAiB,CAAC;AAClG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAe,EAAE,MAAkD;IAClG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,iBAAiB;QAAE,OAAO;IAC/D,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,aAAa,CACrB,sBAAsB,EACtB,wFAAwF,CACzF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,cAAc,CAAC,GAAe,EAAE,IAAa;IAC3D,OAAO,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;AACjG,CAAC;AAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE3D,sGAAsG;AACtG,MAAM,UAAU,SAAS,CAAC,GAAe;IACvC,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,gBAAgB;gBAC1C,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,MAAM;gBAC7C,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC7C,IAAI,MAAM,KAAK,QAAQ;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,8BAA8B,EAAE,EAAE,GAAG,CAAC,CAAC;QAChH,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;YACrD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,+BAA+B,EAAE,EAAE,GAAG,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,iBAAiB,GAAG,CAAC,cAAc,EAAE,cAAc,EAAE,yBAAyB,EAAE,2BAA2B,CAAC,CAAC;AAEnH,MAAM,UAAU,WAAW,CAAC,GAAe;IACzC,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,GAAG,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;QACxE,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAC;QACjG,IAAI,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACjF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,OAAO,EAAE,wCAAwC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/G,CAAC;QACD,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QACzB,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,CAAU,EAAE,GAAe,EAAE,IAAa,EAAE,MAAc;IAC9E,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE;QACpE,EAAE,EAAE,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC;QACvC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC;KACtC,CAAC,CAAC;IACH,gBAAgB,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9B,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7B,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE;QACjB,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,OAAO;QACjB,SAAS,EAAE,MAAM;QACjB,OAAO,EAAE,IAAI,CAAC,EAAE;QAChB,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE;KACrF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAU,EAAE,GAAe;IACnD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,gBAAgB,IAAI,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACrF,OAAO,IAAI,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;AACzD,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,CAAqB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAE1G,MAAM,UAAU,kBAAkB,CAAC,GAAmB,EAAE,GAAe;IACrE,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAE3G,4EAA4E;IAC5E,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE;QAC5B,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,WAAW,CAAC,EAAE,CAAC;YAC/B,SAAS,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC,EAAE;gBACzC,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC;gBAC3C,QAAQ,EAAE,QAAQ;gBAClB,IAAI,EAAE,GAAG;aACV,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG;YACX,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC;YACtC,iBAAiB,EAAE,iBAAiB,CAAC,GAAG,CAAC;YACzC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,KAAK,EAAE;SAChE,CAAC;QACF,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;QACzF,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QAC/D,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,aAAa,EAAE,IAAI;YACnB,GAAG,IAAI;YACP,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC;YAChC,cAAc,EAAE,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC;SAClD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7E,YAAY,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;QACzD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClC,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC/C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,oCAAoC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/F,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,OAAO,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;QAClH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YAClB,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,0CAA0C,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC,MAAM,EAAE,EACvG,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAChD,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE;gBACjB,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc;gBAClD,SAAS,EAAE,QAAQ;gBACnB,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE;aACxC,CAAC,CAAC;YACH,IAAI,MAAM;gBAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;YAC7E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,OAAO,EAAE,8BAA8B,EAAE,EAAE,GAAG,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,SAAS,CAAC,CAAC,EAAE,UAAU,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE;gBACtF,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC;gBAC3C,QAAQ,EAAE,QAAQ;gBAClB,IAAI,EAAE,OAAO;gBACb,MAAM,EAAE,UAAU,GAAG,IAAI;aAC1B,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpC,YAAY,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QACvC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAClF,MAAM,OAAO,GAAG,aAAa,CAAsB,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;QAC7F,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAC;QACrF,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC3C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,0BAA0B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YACnG,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE;gBACjB,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,aAAa;gBACvB,SAAS,EAAE,QAAQ;gBACnB,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;aACpC,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QACzE,CAAC;QACD,YAAY,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/C,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpC,YAAY,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;QAC/F,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE;QAC7B,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,mBAAmB,CAAC,CAAC,CAAC,CAAC;QACvB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtC,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;YAC/C,OAAO,EAAE,aAAa;YACtB,WAAW,EAAE,gBAAgB,CAAC,CAAC,EAAE,GAAG,CAAC;YACrC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;SAChD,CAAC,CAAC;QACH,SAAS,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE;YACpC,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC;YAC3C,QAAQ,EAAE,KAAK;YACf,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvD,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;YAC/C,OAAO,EAAE,YAAY;YACrB,WAAW,EAAE,gBAAgB,CAAC,CAAC,EAAE,GAAG,CAAC;YACrC,QAAQ,EAAE,mBAAmB;YAC7B,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE;SACzB,CAAC,CAAC;QACH,SAAS,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE;YACpC,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC;YAC3C,QAAQ,EAAE,KAAK;YACf,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtF,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;QAC5G,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE;gBACjB,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,aAAa;gBACvB,SAAS,EAAE,QAAQ;gBACnB,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;aACpE,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC;QAC7B,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;QACnC,IAAI,KAAK,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;YACnC,2DAA2D;YAC3D,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;YACzF,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACjF,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;gBAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,0CAA0C,CAAC,CAAC;YACjG,IAAI,CAAC;gBACH,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;YACzE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,aAAa;oBAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,oCAAoC,CAAC,CAAC;gBAC1F,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,OAAO,CAAC,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,KAAK,aAAa;YAAE,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE;gBACjB,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,aAAa;gBACvB,SAAS,EAAE,QAAQ;gBACnB,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE;aACtF,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAClC,CAAC;QACD,YAAY,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACnC,OAAO,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAAmB,EAAE,GAAe;IACxE,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAEtF,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;QAC9G,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,WAAW,EAAE;YACrD,eAAe,EAAE,IAAI,CAAC,eAAe,IAAI,EAAE;YAC3C,OAAO,EAAE,IAAI,CAAC,EAAE;SACjB,CAAC,CAAC;QACH,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;QACtD,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAE1F,GAAG,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;QACnE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,qGAAqG;IACrG,GAAG,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACrE,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,sDAAsD,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC;YAC9C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QACzE,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,CAAC,CAAC,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,YAAY;YACpB,MAAM,IAAI,aAAa,CAAC,mBAAmB,EAAE,gDAAgD,CAAC,CAAC;QACjG,gBAAgB,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/C,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/http/admin/instances.d.ts

@@ -0,0 +1,5 @@
+import type { Hono } from 'hono';
+import type { AppContext } from '../../app.js';
+import type { AdminEnv } from './auth.js';
+/** Instance-scoped Admin API routes (design §8.4). Every mutation is audited by the service layer. */
+export declare function registerInstanceRoutes(app: Hono<AdminEnv>, ctx: AppContext): void;

package/dist/http/admin/instances.js

@@ -0,0 +1,193 @@
+import { and, asc, eq } from 'drizzle-orm';
+import { z } from 'zod';
+import { applyBulkLevel, listGroups, mergeGroups, previewBulkLevel, renameGroup, setGroupLevel, updateOperation, accessInput, } from '../../catalog/groups.js';
+import { findRegistryEntries } from '../../catalog/registry.js';
+import { createRule, deleteRule, listRules, updateRule } from '../../catalog/rules.js';
+import { operationGroups, operations } from '../../db/schema.js';
+import { ValidationError } from '../../errors.js';
+import { ACCESS_LEVELS, effectiveAccess } from '../../gate/access.js';
+import { AUTH_MODES } from '../../instances/manager.js';
+import { clientIp, readJson, readOptionalJson } from '../common.js';
+import { createRedactor, GLOBAL_SENSITIVE_KEYS } from '../../gate/redact.js';
+/** Instance-scoped Admin API routes (design §8.4). Every mutation is audited by the service layer. */
+export function registerInstanceRoutes(app, ctx) {
+    const actor = (c) => ({ userId: c.get('user').id });
+    const exists = (id) => ctx.instances.get(id); // throws 404
+    const Connection = z.object({
+        config: z.record(z.string(), z.unknown()).default({}),
+        secrets: z.record(z.string(), z.string().nullable()).default({}),
+    });
+    app.get('/api/instances', (c) => c.json(ctx.instances.list()));
+    app.post('/api/instances', async (c) => {
+        const body = await readJson(c, z.object({
+            pluginId: z.string().min(1),
+            slug: z.string().min(1).max(63),
+            displayName: z.string().max(100).optional(),
+            connection: z.record(z.string(), z.unknown()).default({}),
+            authMode: z.enum(AUTH_MODES).nullable().optional(),
+            settings: z.record(z.string(), z.unknown()).optional(),
+            enabled: z.boolean().optional(),
+        }));
+        return c.json(await ctx.instances.create(body, actor(c)), 201);
+    });
+    app.get('/api/instances/:id', (c) => c.json(exists(c.req.param('id'))));
+    app.patch('/api/instances/:id', async (c) => {
+        const body = await readJson(c, z.object({
+            displayName: z.string().max(100).optional(),
+            slug: z.string().max(63).optional(),
+            enabled: z.boolean().optional(),
+            authMode: z.enum(AUTH_MODES).nullable().optional(),
+            settings: z.record(z.string(), z.unknown()).optional(),
+        }));
+        return c.json(await ctx.instances.update(c.req.param('id'), body, actor(c)));
+    });
+    app.delete('/api/instances/:id', async (c) => {
+        const { confirm } = await readJson(c, z.object({ confirm: z.string() }));
+        await ctx.instances.remove(c.req.param('id'), confirm, actor(c));
+        ctx.oauth.forgetInstance(c.req.param('id'));
+        return c.body(null, 204);
+    });
+    app.get('/api/instances/:id/connection', (c) => c.json(ctx.instances.getConnection(c.req.param('id'))));
+    app.put('/api/instances/:id/connection', async (c) => {
+        const body = await readJson(c, Connection);
+        return c.json(await ctx.instances.updateConnection(c.req.param('id'), body, actor(c)));
+    });
+    // Testing a connection makes the server talk to arbitrary hosts; throttled so it can't be an oracle (TN §4).
+    app.post('/api/instances/:id/connection/test', async (c) => {
+        if (!ctx.throttle.allowIp(clientIp(c, ctx.config.TRUST_PROXY))) {
+            return c.json({ error: 'rate_limited', message: 'Too many attempts; try again later' }, 429);
+        }
+        const candidate = await readOptionalJson(c, Connection);
+        return c.json(await ctx.instances.testConnection(c.req.param('id'), candidate));
+    });
+    app.post('/api/instances/:id/sync', async (c) => {
+        exists(c.req.param('id'));
+        return c.json(await ctx.instances.syncNow(c.req.param('id')));
+    });
+    // ── access groups & operations (design §5.2.1) ──
+    app.get('/api/instances/:id/groups', (c) => {
+        exists(c.req.param('id'));
+        return c.json(listGroups(ctx.db, c.req.param('id')));
+    });
+    app.patch('/api/instances/:id/groups/:key', async (c) => {
+        const id = c.req.param('id');
+        exists(id);
+        const body = await readJson(c, z.object({
+            level: z.string().optional(),
+            label: z.string().optional(),
+            acknowledge: z.array(z.string()).optional(),
+        }));
+        if (body.label !== undefined)
+            renameGroup(ctx.db, id, c.req.param('key'), body.label, { actor: actor(c) });
+        if (body.level !== undefined) {
+            setGroupLevel(ctx.db, id, c.req.param('key'), body.level, { acknowledge: body.acknowledge, actor: actor(c) });
+        }
+        return c.json(listGroups(ctx.db, id).find((g) => g.key === c.req.param('key')) ?? null);
+    });
+    app.post('/api/instances/:id/groups/merge', async (c) => {
+        const id = c.req.param('id');
+        exists(id);
+        const body = await readJson(c, z.object({ from: z.array(z.string()).min(1), into: z.string().min(1), label: z.string().optional() }));
+        return c.json(mergeGroups(ctx.db, id, body, { actor: actor(c) }));
+    });
+    app.get('/api/instances/:id/groups/bulk-level/preview', (c) => {
+        exists(c.req.param('id'));
+        return c.json(previewBulkLevel(ctx.db, c.req.param('id'), c.req.query('level') ?? ''));
+    });
+    app.post('/api/instances/:id/groups/bulk-level', async (c) => {
+        exists(c.req.param('id'));
+        const body = await readJson(c, z.object({ level: z.string(), confirm: z.string().optional(), acknowledge: z.array(z.string()).optional() }));
+        return c.json(applyBulkLevel(ctx.db, c.req.param('id'), body.level, { ...body, actor: actor(c) }));
+    });
+    app.get('/api/instances/:id/operations', (c) => {
+        const id = c.req.param('id');
+        exists(id);
+        const q = c.req.query();
+        const groups = new Map(ctx.db
+            .select()
+            .from(operationGroups)
+            .where(eq(operationGroups.instanceId, id))
+            .all()
+            .map((g) => [g.id, g]));
+        const conditions = [eq(operations.instanceId, id)];
+        if (q.stale !== '1')
+            conditions.push(eq(operations.stale, false));
+        const text = q.q?.toLowerCase();
+        const rows = ctx.db
+            .select()
+            .from(operations)
+            .where(and(...conditions))
+            .orderBy(asc(operations.key))
+            .all()
+            .map((op) => {
+            const group = groups.get(op.groupId);
+            const access = effectiveAccess(accessInput(op), group);
+            return {
+                ...op,
+                group: group?.key ?? null,
+                /** The level in force: the operation's own, else its group's. */
+                level: op.levelOverride ?? group?.level ?? 'none',
+                reachable: access.reachable,
+                mode: access.reachable ? access.mode : null,
+                pendingReview: access.reachable && access.pendingReview === true,
+                reason: access.reachable ? null : access.reason,
+            };
+        })
+            .filter((op) => (!q.group || op.group === q.group) && (!q.reason || op.reason === q.reason))
+            .filter((op) => (q.needsReview === '1' ? op.needsReview || op.pendingReview : true))
+            .filter((op) => !text || op.key.toLowerCase().includes(text) || (op.displayName ?? '').toLowerCase().includes(text));
+        return c.json(rows);
+    });
+    app.patch('/api/instances/:id/operations/:opId', async (c) => {
+        const body = await readJson(c, z.object({
+            level: z.enum(ACCESS_LEVELS).nullable().optional(),
+            acknowledged: z.boolean().optional(),
+            classification: z.enum(['read', 'write']).optional(),
+            attestationRequired: z.boolean().optional(),
+        }));
+        updateOperation(ctx.db, c.req.param('id'), c.req.param('opId'), body, { actor: actor(c) });
+        return c.json(ctx.db
+            .select()
+            .from(operations)
+            .where(eq(operations.id, c.req.param('opId')))
+            .get());
+    });
+    // ── pickers ──
+    app.get('/api/instances/:id/registry', (c) => {
+        exists(c.req.param('id'));
+        // Mirrored attributes can hold tokens (HA camera `access_token`); the portal gets them redacted too.
+        const entries = findRegistryEntries(ctx.db, c.req.param('id'), c.req.query());
+        let redact = createRedactor(GLOBAL_SENSITIVE_KEYS);
+        try {
+            redact = ctx.instances.runtime(c.req.param('id')).redact;
+        }
+        catch {
+            // Plugin not usable right now: the global keys still apply.
+        }
+        return c.json(redact(entries));
+    });
+    app.get('/api/instances/:id/options/:source', async (c) => {
+        const rt = ctx.instances.runtime(c.req.param('id'));
+        if (!/^[a-z0-9][a-z0-9._-]{0,63}$/.test(c.req.param('source')))
+            throw new ValidationError('invalid_source', 'Invalid options source');
+        return c.json(await rt.plugin().call('optionsFor', { source: c.req.param('source'), query: c.req.query('q') }));
+    });
+    // ── pre-approval rules ──
+    app.get('/api/instances/:id/rules', (c) => {
+        exists(c.req.param('id'));
+        return c.json(listRules(ctx.db, c.req.param('id')));
+    });
+    app.post('/api/instances/:id/rules', async (c) => {
+        const rt = ctx.instances.runtime(c.req.param('id'));
+        return c.json(createRule(ctx.db, rt.manifest, rt.instanceId, await readJson(c, z.unknown()), actor(c)), 201);
+    });
+    app.patch('/api/instances/:id/rules/:ruleId', async (c) => {
+        const rt = ctx.instances.runtime(c.req.param('id'));
+        return c.json(updateRule(ctx.db, rt.manifest, rt.instanceId, c.req.param('ruleId'), await readJson(c, z.unknown()), actor(c)));
+    });
+    app.delete('/api/instances/:id/rules/:ruleId', (c) => {
+        deleteRule(ctx.db, c.req.param('id'), c.req.param('ruleId'), actor(c));
+        return c.body(null, 204);
+    });
+}
+//# sourceMappingURL=instances.js.map

package/dist/http/admin/instances.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"instances.js","sourceRoot":"","sources":["../../../src/http/admin/instances.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,cAAc,EACd,UAAU,EACV,WAAW,EACX,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,eAAe,EACf,WAAW,GACZ,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEpE,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7E,sGAAsG;AACtG,MAAM,UAAU,sBAAsB,CAAC,GAAmB,EAAE,GAAe;IACzE,MAAM,KAAK,GAAG,CAAC,CAAyC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5F,MAAM,MAAM,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa;IAEnE,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;QAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KACjE,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAE/D,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,MAAM,QAAQ,CACzB,CAAC,EACD,CAAC,CAAC,MAAM,CAAC;YACP,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;YAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YACzD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;YAClD,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;YACtD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;SAChC,CAAC,CACH,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAExE,GAAG,CAAC,KAAK,CAAC,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,MAAM,QAAQ,CACzB,CAAC,EACD,CAAC,CAAC,MAAM,CAAC;YACP,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;YAC3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;YACnC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;YAC/B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;YAClD,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;SACvD,CAAC,CACH,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;QACzE,MAAM,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5C,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,+BAA+B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAExG,GAAG,CAAC,GAAG,CAAC,+BAA+B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QAC3C,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;IAEH,6GAA6G;IAC7G,GAAG,CAAC,IAAI,CAAC,oCAAoC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YAC/D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,oCAAoC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QACxD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9C,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1B,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,mDAAmD;IAEnD,GAAG,CAAC,GAAG,CAAC,2BAA2B,EAAE,CAAC,CAAC,EAAE,EAAE;QACzC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1B,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtD,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,CAAC,EAAE,CAAC,CAAC;QACX,MAAM,IAAI,GAAG,MAAM,QAAQ,CACzB,CAAC,EACD,CAAC,CAAC,MAAM,CAAC;YACP,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC5B,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;SAC5C,CAAC,CACH,CAAC;QACF,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3G,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAChH,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,iCAAiC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtD,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,CAAC,EAAE,CAAC,CAAC;QACX,MAAM,IAAI,GAAG,MAAM,QAAQ,CACzB,CAAC,EACD,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CACtG,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,8CAA8C,EAAE,CAAC,CAAC,EAAE,EAAE;QAC5D,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1B,OAAO,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,sCAAsC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3D,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,QAAQ,CACzB,CAAC,EACD,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAC7G,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrG,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,+BAA+B,EAAE,CAAC,CAAC,EAAE,EAAE;QAC7C,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,CAAC,EAAE,CAAC,CAAC;QACX,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,GAAG,CAAC,EAAE;aACH,MAAM,EAAE;aACR,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;aACzC,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CACzB,CAAC;QACF,MAAM,UAAU,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,CAAC,KAAK,KAAK,GAAG;YAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,GAAG,CAAC,EAAE;aAChB,MAAM,EAAE;aACR,IAAI,CAAC,UAAU,CAAC;aAChB,KAAK,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;aACzB,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;aAC5B,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;YACV,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;YACvD,OAAO;gBACL,GAAG,EAAE;gBACL,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,IAAI;gBACzB,iEAAiE;gBACjE,KAAK,EAAE,EAAE,CAAC,aAAa,IAAI,KAAK,EAAE,KAAK,IAAI,MAAM;gBACjD,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;gBAC3C,aAAa,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI;gBAChE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM;aAChD,CAAC;QACJ,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;aAC3F,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;aACnF,MAAM,CACL,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAC5G,CAAC;QACJ,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3D,MAAM,IAAI,GAAG,MAAM,QAAQ,CACzB,CAAC,EACD,CAAC,CAAC,MAAM,CAAC;YACP,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;YAClD,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;YACpC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;YACpD,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;SAC5C,CAAC,CACH,CAAC;QACF,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3F,OAAO,CAAC,CAAC,IAAI,CACX,GAAG,CAAC,EAAE;aACH,MAAM,EAAE;aACR,IAAI,CAAC,UAAU,CAAC;aAChB,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;aAC7C,GAAG,EAAE,CACT,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,gBAAgB;IAEhB,GAAG,CAAC,GAAG,CAAC,6BAA6B,EAAE,CAAC,CAAC,EAAE,EAAE;QAC3C,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1B,qGAAqG;QACrG,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QAC9E,IAAI,MAAM,GAAG,cAAc,CAAC,qBAAqB,CAAC,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;QAC9D,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,oCAAoC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxD,MAAM,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACpD,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC5D,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,wBAAwB,CAAC,CAAC;QACxE,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAClH,CAAC,CAAC,CAAC;IAEH,2BAA2B;IAE3B,GAAG,CAAC,GAAG,CAAC,0BAA0B,EAAE,CAAC,CAAC,EAAE,EAAE;QACxC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1B,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/C,MAAM,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACpD,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,UAAU,EAAE,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/G,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,KAAK,CAAC,kCAAkC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxD,MAAM,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACpD,OAAO,CAAC,CAAC,IAAI,CACX,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,MAAM,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAChH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,kCAAkC,EAAE,CAAC,CAAC,EAAE,EAAE;QACnD,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/http/admin/system.d.ts

@@ -0,0 +1,5 @@
+import type { Hono } from 'hono';
+import type { AppContext } from '../../app.js';
+import type { AdminEnv } from './auth.js';
+/** Global Admin API routes (design §8.4): overview, plugins, audit, tokens, users, settings, events. */
+export declare function registerSystemRoutes(app: Hono<AdminEnv>, ctx: AppContext): void;