@tiangong-lca/cli 0.0.25 → 0.0.26

package/dist/src/lib/dataset-maintenance-protected-run.js

@@ -1,12 +1,14 @@
-import { appendFileSync, chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync, } from 'node:fs';
+import { appendFileSync, chmodSync, existsSync } from 'node:fs';
 import path from 'node:path';
-import { buildAliasPlanRequest, loadMaintenanceDesiredPayload, } from './dataset-maintenance-alias-request.js';
-import { MAINTENANCE_SCAN_TABLES, isJsonObject, maintenanceRowKey, parseMaintenancePlan, readJsonFile, sha256Json, sha256Text, snapshotRemoteRow, stableJsonText, } from './dataset-maintenance-contract.js';
-import { PROTECTED_EXECUTION_CONTRACT, assertProtectedApprovalBindings, assertProtectedFreezeMatchesPlan, buildProtectedAdmitRequest, buildProtectedExecutionIdentity, buildProtectedPreflightRequest, parseProtectedAdmissionProof, parseProtectedApproval, parseProtectedDerivativeSnapshot, parseProtectedFreeze, parseProtectedGateProof, parseProtectedPreflightProof, parseProtectedStatusProof, } from './dataset-maintenance-protected-contract.js';
+import { buildAliasPlanRequest } from './dataset-maintenance-alias-request.js';
+import { ensurePrivateArtifactDirectory, readProtectedJsonArtifact, writePrivateImmutableJson, } from './dataset-maintenance-protected-artifacts.js';
+import { assertDerivativeBaselines as assertSharedDerivativeBaselines, assertStrictBeforeState as assertSharedStrictBeforeState, assertSupportSnapshots as assertSharedSupportSnapshots, projectedRows as sharedProjectedRows, } from './dataset-maintenance-protected-before.js';
+import { isJsonObject, parseMaintenancePlan, readJsonFile, sha256Json, sha256Text, stableJsonText, } from './dataset-maintenance-contract.js';
+import { PROTECTED_EXECUTION_CONTRACT, assertProtectedApprovalBindings, assertProtectedFreezeMatchesPlan, buildProtectedAdmitRequest, buildProtectedExecutionIdentity, buildProtectedPreflightRequest, parseProtectedAdmissionProof, parseProtectedApproval, parseProtectedFreeze, parseProtectedGateProof, parseProtectedPreflightProof, parseProtectedStatusProof, } from './dataset-maintenance-protected-contract.js';
+import { assertProtectedPreparationPlanSha256, assertProtectedProductionProjectRef, } from './dataset-maintenance-protected-preparation.js';
 import { verifyProtectedExecution, } from './dataset-maintenance-protected-verify.js';
 import { maintenanceProjectedReferenceFingerprint } from './dataset-maintenance-plan.js';
-import { isSnapshotCompletenessCompatible } from './dataset-maintenance-pagination.js';
-import { admitMaintenanceAliasExecution, captureMaintenanceAliasExecutionGate, fetchMaintenanceAccountRows, fetchMaintenanceDerivativeSnapshot, fetchMaintenanceExactRows, normalizeMaintenancePageSize, preflightMaintenanceAliasExecution, readMaintenanceAliasExecution, resolveMaintenanceRemoteContext, } from './dataset-maintenance-remote.js';
+import { admitMaintenanceAliasExecution, captureMaintenanceAliasExecutionGate, fetchMaintenanceAccountRows, normalizeMaintenancePageSize, preflightMaintenanceAliasExecution, readMaintenanceAliasExecution, resolveMaintenanceRemoteContext, } from './dataset-maintenance-remote.js';
 import { CliError } from './errors.js';
 import { withStateFileLock } from './state-lock.js';
 const DEFAULT_POLL_MS = 10_000;
@@ -44,34 +46,24 @@ function errorDetails(error) {
     };
 }
 function readArtifact(options) {
-    const resolved = path.resolve(options.filePath);
-    const text = readFileSync(resolved, 'utf8');
+    const artifact = readProtectedJsonArtifact(options);
     return {
-        resolved,
-        value: readJsonFile(resolved, options.label),
-        file_sha256: sha256Text(text),
+        resolved: artifact.resolved,
+        value: artifact.value,
+        text: artifact.text,
+        file_sha256: artifact.file_sha256,
     };
 }
-function ensurePrivateDirectory(directory) {
-    mkdirSync(directory, { recursive: true, mode: 0o700 });
-    chmodSync(directory, 0o700);
-}
-function writePrivateImmutableJson(filePath, value) {
-    const resolved = path.resolve(filePath);
-    const text = `${stableJsonText(value)}\n`;
-    ensurePrivateDirectory(path.dirname(resolved));
-    if (existsSync(resolved)) {
-        if (readFileSync(resolved, 'utf8') !== text) {
-            throw new CliError(`Refusing to overwrite protected evidence: ${resolved}`, {
-                code: 'DATASET_MAINTENANCE_PROTECTED_ARTIFACT_IMMUTABLE',
-                exitCode: 1,
-            });
-        }
-        chmodSync(resolved, 0o600);
-        return resolved;
+function assertCanonicalParsedArtifact(options) {
+    if (options.text !== `${stableJsonText(options.value)}\n`) {
+        throw new CliError(`${options.label} must be canonical JSON with exactly one final newline.`, {
+            code: 'DATASET_MAINTENANCE_PROTECTED_ARTIFACT_NONCANONICAL',
+            exitCode: 2,
+        });
     }
-    writeFileSync(resolved, text, { encoding: 'utf8', flag: 'wx', mode: 0o600 });
-    return resolved;
+}
+function ensurePrivateDirectory(directory) {
+    ensurePrivateArtifactDirectory(directory);
 }
 function appendPrivateJsonLine(filePath, value) {
     const resolved = path.resolve(filePath);
@@ -149,11 +141,24 @@ function prepareProtectedExecutionWithDependencies(options, dependencies) {
         label: 'Protected execution approval',
     });
     const plan = dependencies.parsePlan(planArtifact.value);
+    if (options.commit) {
+        assertProtectedPreparationPlanSha256(plan.plan_sha256, 'plan.plan_sha256');
+    }
     const planPath = planArtifact.resolved;
     const planDir = path.dirname(planPath);
     const aliasPlanRequest = dependencies.buildAliasPlan({ plan, planDir });
     const freeze = dependencies.parseFreeze(freezeArtifact.value);
     const approval = dependencies.parseApproval(approvalArtifact.value);
+    assertCanonicalParsedArtifact({
+        label: 'Protected execution freeze',
+        text: freezeArtifact.text,
+        value: freeze,
+    });
+    assertCanonicalParsedArtifact({
+        label: 'Protected execution approval',
+        text: approvalArtifact.text,
+        value: approval,
+    });
     dependencies.assertFreezeMatchesPlan({
         plan,
         planFileSha256: planArtifact.file_sha256,
@@ -175,6 +180,9 @@ function prepareProtectedExecutionWithDependencies(options, dependencies) {
         freezeFileSha256: freezeArtifact.file_sha256,
         approvalFileSha256: approvalArtifact.file_sha256,
     });
+    if (options.commit) {
+        assertProtectedProductionProjectRef(identity.project_ref);
+    }
     const outDir = path.resolve(options.outDir);
     const artifacts = {
         execution_seal: path.join(outDir, 'protected-execution-seal.json'),
@@ -235,143 +243,30 @@ function assertContextBindings(options) {
     }
 }
 function projectedRows(options) {
-    const projected = new Map(options.currentRows.map((row) => [maintenanceRowKey(row), { ...row }]));
-    for (const action of options.plan.actions) {
-        const row = projected.get(maintenanceRowKey(action));
-        if (row) {
-            projected.set(maintenanceRowKey(action), {
-                ...row,
-                json_ordered: loadMaintenanceDesiredPayload(options.planDir, action),
-            });
-        }
-    }
-    return [...projected.values()].sort((left, right) => maintenanceRowKey(left).localeCompare(maintenanceRowKey(right)));
+    return sharedProjectedRows(options);
 }
 function assertStrictBeforeState(options) {
-    const { plan } = options.prepared;
-    if (!plan.snapshot_completeness ||
-        !isSnapshotCompletenessCompatible(options.completeness, plan.snapshot_completeness, MAINTENANCE_SCAN_TABLES)) {
-        throw new CliError('Production RLS census does not match the frozen complete snapshot.', {
-            code: 'DATASET_MAINTENANCE_PROTECTED_SNAPSHOT_INCOMPLETE',
-            exitCode: 1,
-        });
-    }
-    const snapshots = options.currentRows
-        .map(snapshotRemoteRow)
-        .sort((left, right) => maintenanceRowKey(left).localeCompare(maintenanceRowKey(right)));
-    if (sha256Json(snapshots) !== plan.visible_snapshot_sha256) {
-        throw new CliError('Production RLS visible snapshot drifted after the freeze.', {
-            code: 'DATASET_MAINTENANCE_PROTECTED_VISIBLE_SNAPSHOT_DRIFT',
-            exitCode: 1,
-        });
-    }
-    const expectedKeys = new Set([
-        ...plan.actions.map(maintenanceRowKey),
-        ...plan.protected_rows.map(maintenanceRowKey),
-    ]);
-    if (expectedKeys.size !== options.currentRows.length ||
-        options.currentRows.some((row) => !expectedKeys.has(maintenanceRowKey(row)))) {
-        throw new CliError('Production owner account contains missing or unexpected rows.', {
-            code: 'DATASET_MAINTENANCE_PROTECTED_ACCOUNT_CENSUS_DRIFT',
-            exitCode: 1,
-        });
-    }
-    const current = new Map(options.currentRows.map((row) => [maintenanceRowKey(row), row]));
-    for (const row of plan.protected_rows) {
-        const observed = current.get(maintenanceRowKey(row));
-        if (!observed || snapshotRemoteRow(observed).row_sha256 !== row.row_sha256) {
-            throw new CliError(`Protected row drifted: ${row.id}`, {
-                code: 'DATASET_MAINTENANCE_PROTECTED_ROW_DRIFT',
-                exitCode: 1,
-                details: row,
-            });
-        }
-    }
-    for (const action of plan.actions) {
-        const observed = current.get(maintenanceRowKey(action));
-        if (!action.before ||
-            !observed ||
-            observed.user_id !== action.expected_user_id ||
-            observed.state_code !== 0 ||
-            snapshotRemoteRow(observed).row_sha256 !== action.before.row_sha256) {
-            throw new CliError(`Action row is no longer in the exact frozen before state: ${action.action_id}`, {
-                code: 'DATASET_MAINTENANCE_PROTECTED_ACTION_DRIFT',
-                exitCode: 1,
-            });
-        }
-    }
-    const finalRows = projectedRows({
-        plan,
+    assertSharedStrictBeforeState({
+        plan: options.prepared.plan,
         planDir: options.prepared.planDir,
+        actorUserId: options.prepared.identity.actor.user_id,
         currentRows: options.currentRows,
+        completeness: options.completeness,
     });
-    if (sha256Json(maintenanceProjectedReferenceFingerprint(finalRows)) !==
-        plan.projected_reference_sha256) {
-        throw new CliError('Projected reference closure drifted before protected execution.', {
-            code: 'DATASET_MAINTENANCE_PROTECTED_REFERENCE_DRIFT',
-            exitCode: 1,
-        });
-    }
 }
 async function assertSupportSnapshots(options) {
-    for (const batch of options.prepared.plan.alias_batches ?? []) {
-        for (const snapshot of [
-            batch.target_snapshots.unitgroup,
-            batch.target_snapshots.flowproperty,
-            batch.target_snapshots.source_unitgroup,
-        ]) {
-            if (!snapshot) {
-                throw new CliError(`Alias support snapshot is absent for ${batch.batch_id}.`, {
-                    code: 'DATASET_MAINTENANCE_PROTECTED_SUPPORT_DRIFT',
-                    exitCode: 1,
-                });
-            }
-            const exact = await fetchMaintenanceExactRows({
-                context: options.context,
-                table: snapshot.table,
-                id: snapshot.id,
-                version: snapshot.version,
-            });
-            const row = exact.rows.length === 1 ? exact.rows[0] : null;
-            if (!row ||
-                row.user_id !== options.prepared.identity.actor.user_id ||
-                row.state_code !== 0 ||
-                snapshotRemoteRow(row).row_sha256 !== snapshot.row_sha256) {
-                throw new CliError(`Alias support row drifted for ${batch.batch_id}.`, {
-                    code: 'DATASET_MAINTENANCE_PROTECTED_SUPPORT_DRIFT',
-                    exitCode: 1,
-                    details: { table: snapshot.table, id: snapshot.id, version: snapshot.version },
-                });
-            }
-        }
-    }
+    await assertSharedSupportSnapshots({
+        plan: options.prepared.plan,
+        actorUserId: options.prepared.identity.actor.user_id,
+        context: options.context,
+    });
 }
 async function assertDerivativeBaselines(options) {
-    const targets = options.prepared.identity.derivative_targets;
-    for (let offset = 0; offset < targets.length; offset += 5) {
-        const chunk = targets.slice(offset, offset + 5);
-        const snapshots = await Promise.all(chunk.map(async (target) => parseProtectedDerivativeSnapshot(await fetchMaintenanceDerivativeSnapshot({
-            context: options.context,
-            table: target.table,
-            id: target.id,
-            version: target.version,
-        }), {
-            table: target.table,
-            id: target.id,
-            version: target.version,
-            userId: target.user_id,
-        })));
-        for (const [index, snapshot] of snapshots.entries()) {
-            const target = chunk[index];
-            if (snapshot.snapshot_sha256 !== target.baseline_snapshot_sha256) {
-                throw new CliError('A protected derivative baseline drifted before preflight.', {
-                    code: 'DATASET_MAINTENANCE_PROTECTED_DERIVATIVE_BASELINE_DRIFT',
-                    exitCode: 1,
-                    details: { table: target.table, id: target.id, version: target.version },
-                });
-            }
-        }
-    }
+    await assertSharedDerivativeBaselines({
+        actorUserId: options.prepared.identity.actor.user_id,
+        context: options.context,
+        derivativeTargets: options.prepared.identity.derivative_targets,
+    });
 }
 async function captureProtectedGatesWithDependencies(options, dependencies) {
     const gateNames = ['primary_support_plan', 'execution_unused', 'derivative_quiescence'];
@@ -744,6 +639,7 @@ export async function runDatasetMaintenanceProtected(options) {
 export const __testInternals = {
     allocateAttemptArtifacts,
     appendPrivateJsonLine,
+    assertCanonicalParsedArtifact,
     assertContextBindings,
     assertDerivativeBaselines,
     assertStrictBeforeState,

package/dist/src/lib/dataset-maintenance-protected-run.js.map

@@ -1 +1 @@
-{"version":3,"file":"dataset-maintenance-protected-run.js","sourceRoot":"","sources":["../../../src/lib/dataset-maintenance-protected-run.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,SAAS,EACT,UAAU,EACV,SAAS,EACT,YAAY,EACZ,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,qBAAqB,EACrB,6BAA6B,GAC9B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,uBAAuB,EACvB,YAAY,EACZ,iBAAiB,EACjB,oBAAoB,EACpB,YAAY,EACZ,UAAU,EACV,UAAU,EACV,iBAAiB,EACjB,cAAc,GAIf,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,4BAA4B,EAC5B,+BAA+B,EAC/B,gCAAgC,EAChC,0BAA0B,EAC1B,+BAA+B,EAC/B,8BAA8B,EAC9B,4BAA4B,EAC5B,sBAAsB,EACtB,gCAAgC,EAChC,oBAAoB,EACpB,uBAAuB,EACvB,4BAA4B,EAC5B,yBAAyB,GAS1B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACL,wBAAwB,GAEzB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,wCAAwC,EAAE,MAAM,+BAA+B,CAAC;AACzF,OAAO,EAAE,gCAAgC,EAAE,MAAM,qCAAqC,CAAC;AACvF,OAAO,EACL,8BAA8B,EAC9B,oCAAoC,EACpC,2BAA2B,EAC3B,kCAAkC,EAClC,yBAAyB,EACzB,4BAA4B,EAC5B,kCAAkC,EAClC,6BAA6B,EAC7B,+BAA+B,GAEhC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAkEpD,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,MAAM,GAAG,iBAAiB,CAAC;AAEjC,SAAS,oBAAoB,CAAC,KAAc;IAC1C,MAAM,UAAU,GAAG,KAAK,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,IAAI,UAAU,GAAG,MAAM,EAAE,CAAC;QAC3E,MAAM,IAAI,QAAQ,CAAC,qDAAqD,EAAE;YACxE,IAAI,EAAE,4CAA4C;YAClD,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,UAAU,GAAG,KAAK,IAAI,eAAe,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,GAAG,IAAI,UAAU,GAAG,MAAM,EAAE,CAAC;QAC7E,MAAM,IAAI,QAAQ,CAAC,kDAAkD,EAAE;YACrE,IAAI,EAAE,4CAA4C;YAClD,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,KAAK,CAAC,OAA8C;IAC3D,OAAO,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO;QACL,IAAI,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO;QACnD,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAC/D,IAAI,EACF,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;YACrF,CAAC,CAAC,KAAK,CAAC,IAAI;YACZ,CAAC,CAAC,IAAI;KACX,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,OAA4C;IAKhE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5C,OAAO;QACL,QAAQ;QACR,KAAK,EAAE,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC;QAC5C,WAAW,EAAE,UAAU,CAAC,IAAI,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,SAAiB;IAC/C,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,yBAAyB,CAAC,QAAgB,EAAE,KAAc;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC;IAC1C,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/C,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,IAAI,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;YAC5C,MAAM,IAAI,QAAQ,CAAC,6CAA6C,QAAQ,EAAE,EAAE;gBAC1E,IAAI,EAAE,kDAAkD;gBACxD,QAAQ,EAAE,CAAC;aACZ,CAAC,CAAC;QACL,CAAC;QACD,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC3B,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAgB,EAAE,KAAc;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxC,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/C,cAAc,CAAC,QAAQ,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE;QACrD,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,GAAG;QACT,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IACH,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC3B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAc;IAC3C,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,OAAO,oBAAoB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACtF,OAAO,IAAI,CAAC,CAAC;IACf,CAAC;IACD,OAAO,oBAAoB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAE,CAAC;AACnD,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAc,EAAE,OAAe;IAC3D,MAAM,MAAM,GAAG,WAAW,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IAC7D,OAAO;QACL,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,wBAAwB,MAAM,OAAO,CAAC;QACxD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,4BAA4B,MAAM,OAAO,CAAC;QAC5D,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,8BAA8B,MAAM,OAAO,CAAC;QAC9D,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,gCAAgC,MAAM,OAAO,CAAC;QAChE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,iCAAiC,MAAM,OAAO,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,QAAoC;IAEpC,MAAM,aAAa,GAAG,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC;IAC1F,OAAO;QACL,GAAG,QAAQ;QACX,SAAS,EAAE;YACT,GAAG,QAAQ,CAAC,SAAS;YACrB,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,4BAA4B,MAAM,OAAO,CAAC;YACrF,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,8BAA8B,MAAM,OAAO,CAAC;YACzF,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,gCAAgC,MAAM,OAAO,CAAC;YAC7F,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAC5B,QAAQ,CAAC,MAAM,EACf,iCAAiC,MAAM,OAAO,CAC/C;YACD,cAAc,EAAE,aAAa;SAC9B;KACF,CAAC;AACJ,CAAC;AAaD,SAAS,yCAAyC,CAChD,OAA8C,EAC9C,YAA8C;IAE9C,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;QAC1C,MAAM,IAAI,QAAQ,CAAC,6CAA6C,EAAE;YAChE,IAAI,EAAE,4CAA4C;YAClD,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;IACD,IACE,OAAO,CAAC,MAAM;QACd,CAAC,CAAC,OAAO,CAAC,gBAAgB;YACxB,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;YACtC,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ;YACnC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAC1B,CAAC;QACD,MAAM,IAAI,QAAQ,CAAC,sEAAsE,EAAE;YACzF,IAAI,EAAE,iDAAiD;YACvD,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;IACD,oBAAoB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1C,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAChC,4BAA4B,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE/C,MAAM,YAAY,GAAG,YAAY,CAAC,YAAY,CAAC;QAC7C,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,kBAAkB;KAC1B,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,YAAY,CAAC,YAAY,CAAC;QAC/C,QAAQ,EAAE,OAAO,CAAC,UAAU;QAC5B,KAAK,EAAE,4BAA4B;KACpC,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,YAAY,CAAC,YAAY,CAAC;QACjD,QAAQ,EAAE,OAAO,CAAC,YAAY;QAC9B,KAAK,EAAE,8BAA8B;KACtC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,gBAAgB,GAAG,YAAY,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,YAAY,CAAC,aAAa,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACpE,YAAY,CAAC,uBAAuB,CAAC;QACnC,IAAI;QACJ,cAAc,EAAE,YAAY,CAAC,WAAW;QACxC,sBAAsB,EAAE,UAAU,CAAC,gBAAgB,CAAC;QACpD,MAAM;KACP,CAAC,CAAC;IACH,YAAY,CAAC,sBAAsB,CAAC;QAClC,QAAQ;QACR,MAAM;QACN,gBAAgB,EAAE,cAAc,CAAC,WAAW;QAC5C,kBAAkB,EAAE,gBAAgB,CAAC,WAAW;QAChD,gBAAgB,EAAE,OAAO,CAAC,UAAU;YAClC,CAAC,CAAC,QAAQ,CAAC,wBAAwB;YACnC,CAAC,CAAC,OAAO,CAAC,gBAAgB;KAC7B,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,YAAY,CAAC,aAAa,CAAC;QAC1C,MAAM;QACN,QAAQ;QACR,gBAAgB,EAAE,cAAc,CAAC,WAAW;QAC5C,kBAAkB,EAAE,gBAAgB,CAAC,WAAW;KACjD,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG;QAChB,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,+BAA+B,CAAC;QAClE,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,mCAAmC,CAAC;QAC1E,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,+BAA+B,CAAC;QACjE,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,mCAAmC,CAAC;QAC1E,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,mCAAmC,CAAC;QAC1E,yBAAyB,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,0CAA0C,CAAC;QACxF,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,iCAAiC,CAAC;QACrE,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,iCAAiC,CAAC;QACtE,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,mCAAmC,CAAC;QAC1E,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,+BAA+B,CAAC;QAClE,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,oCAAoC,CAAC;QAC5E,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,gCAAgC,CAAC;QACpE,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,uCAAuC,CAAC;KAC3E,CAAC;IACF,OAAO;QACL,QAAQ;QACR,OAAO;QACP,UAAU,EAAE,cAAc,CAAC,QAAQ;QACnC,YAAY,EAAE,gBAAgB,CAAC,QAAQ;QACvC,MAAM;QACN,IAAI;QACJ,MAAM;QACN,QAAQ;QACR,QAAQ;QACR,gBAAgB;QAChB,SAAS;KACV,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,OAA8C;IAE9C,OAAO,yCAAyC,CAAC,OAAO,EAAE;QACxD,YAAY;QACZ,SAAS,EAAE,oBAAoB;QAC/B,cAAc,EAAE,qBAAqB;QACrC,WAAW,EAAE,oBAAoB;QACjC,aAAa,EAAE,sBAAsB;QACrC,uBAAuB,EAAE,gCAAgC;QACzD,sBAAsB,EAAE,+BAA+B;QACvD,aAAa,EAAE,+BAA+B;KAC/C,CAAC,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB,CAAC,OAK9B;IACC,IACE,OAAO,CAAC,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW;QACrE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO;QAC3E,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK;QACvE,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EACrE,CAAC;QACD,MAAM,IAAI,QAAQ,CAChB,kGAAkG,EAClG;YACE,IAAI,EAAE,gDAAgD;YACtD,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE;gBACP,oBAAoB,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW;gBAC3D,oBAAoB,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW;gBACjD,gBAAgB,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO;gBACzD,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO;aAClD;SACF,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,OAItB;IACC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IAClG,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;QACrD,IAAI,GAAG,EAAE,CAAC;YACR,SAAS,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE;gBACvC,GAAG,GAAG;gBACN,YAAY,EAAE,6BAA6B,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC;aACrE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAClD,iBAAiB,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAChE,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,OAIhC;IACC,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,IACE,CAAC,IAAI,CAAC,qBAAqB;QAC3B,CAAC,gCAAgC,CAC/B,OAAO,CAAC,YAAY,EACpB,IAAI,CAAC,qBAAqB,EAC1B,uBAAuB,CACxB,EACD,CAAC;QACD,MAAM,IAAI,QAAQ,CAAC,oEAAoE,EAAE;YACvF,IAAI,EAAE,mDAAmD;YACzD,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW;SAClC,GAAG,CAAC,iBAAiB,CAAC;SACtB,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1F,IAAI,UAAU,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC3D,MAAM,IAAI,QAAQ,CAAC,2DAA2D,EAAE;YAC9E,IAAI,EAAE,sDAAsD;YAC5D,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;QAC3B,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QACtC,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,iBAAiB,CAAC;KAC9C,CAAC,CAAC;IACH,IACE,YAAY,CAAC,IAAI,KAAK,OAAO,CAAC,WAAW,CAAC,MAAM;QAChD,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAC5E,CAAC;QACD,MAAM,IAAI,QAAQ,CAAC,+DAA+D,EAAE;YAClF,IAAI,EAAE,oDAAoD;YAC1D,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACzF,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC,UAAU,EAAE,CAAC;YAC3E,MAAM,IAAI,QAAQ,CAAC,0BAA0B,GAAG,CAAC,EAAE,EAAE,EAAE;gBACrD,IAAI,EAAE,yCAAyC;gBAC/C,QAAQ,EAAE,CAAC;gBACX,OAAO,EAAE,GAAG;aACb,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;QACxD,IACE,CAAC,MAAM,CAAC,MAAM;YACd,CAAC,QAAQ;YACT,QAAQ,CAAC,OAAO,KAAK,MAAM,CAAC,gBAAgB;YAC5C,QAAQ,CAAC,UAAU,KAAK,CAAC;YACzB,iBAAiB,CAAC,QAAQ,CAAC,CAAC,UAAU,KAAK,MAAM,CAAC,MAAM,CAAC,UAAU,EACnE,CAAC;YACD,MAAM,IAAI,QAAQ,CAChB,6DAA6D,MAAM,CAAC,SAAS,EAAE,EAC/E;gBACE,IAAI,EAAE,4CAA4C;gBAClD,QAAQ,EAAE,CAAC;aACZ,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,aAAa,CAAC;QAC9B,IAAI;QACJ,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,OAAO;QACjC,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC,CAAC;IACH,IACE,UAAU,CAAC,wCAAwC,CAAC,SAAS,CAAC,CAAC;QAC/D,IAAI,CAAC,0BAA0B,EAC/B,CAAC;QACD,MAAM,IAAI,QAAQ,CAAC,iEAAiE,EAAE;YACpF,IAAI,EAAE,+CAA+C;YACrD,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,OAGrC;IACC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;QAC9D,KAAK,MAAM,QAAQ,IAAI;YACrB,KAAK,CAAC,gBAAgB,CAAC,SAAS;YAChC,KAAK,CAAC,gBAAgB,CAAC,YAAY;YACnC,KAAK,CAAC,gBAAgB,CAAC,gBAAgB;SACxC,EAAE,CAAC;YACF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,QAAQ,CAAC,wCAAwC,KAAK,CAAC,QAAQ,GAAG,EAAE;oBAC5E,IAAI,EAAE,6CAA6C;oBACnD,QAAQ,EAAE,CAAC;iBACZ,CAAC,CAAC;YACL,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC;gBAC5C,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,EAAE,EAAE,QAAQ,CAAC,EAAE;gBACf,OAAO,EAAE,QAAQ,CAAC,OAAO;aAC1B,CAAC,CAAC;YACH,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC3D,IACE,CAAC,GAAG;gBACJ,GAAG,CAAC,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO;gBACvD,GAAG,CAAC,UAAU,KAAK,CAAC;gBACpB,iBAAiB,CAAC,GAAG,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EACzD,CAAC;gBACD,MAAM,IAAI,QAAQ,CAAC,iCAAiC,KAAK,CAAC,QAAQ,GAAG,EAAE;oBACrE,IAAI,EAAE,6CAA6C;oBACnD,QAAQ,EAAE,CAAC;oBACX,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE;iBAC/E,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,OAGxC;IACC,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAC7D,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CACjC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CACzB,gCAAgC,CAC9B,MAAM,kCAAkC,CAAC;YACvC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,EACF;YACE,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE,MAAM,CAAC,OAAO;SACvB,CACF,CACF,CACF,CAAC;QACF,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;YACpD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAE,CAAC;YAC7B,IAAI,QAAQ,CAAC,eAAe,KAAK,MAAM,CAAC,wBAAwB,EAAE,CAAC;gBACjE,MAAM,IAAI,QAAQ,CAAC,2DAA2D,EAAE;oBAC9E,IAAI,EAAE,yDAAyD;oBAC/D,QAAQ,EAAE,CAAC;oBACX,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;iBACzE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AASD,KAAK,UAAU,qCAAqC,CAClD,OAKC,EACD,YAAuC;IASvC,MAAM,SAAS,GAAG,CAAC,sBAAsB,EAAE,kBAAkB,EAAE,uBAAuB,CAAU,CAAC;IACjG,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC;YACzC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU;YAC/C,cAAc,EAAE,OAAO,CAAC,SAAS,CAAC,eAAe;YACjD,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CAAC,SAAS,CAAC,GAAG,EAAE;YACxC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ;YACnC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,IAAI;SACL,CAAC,CAAC;QACH,YAAY,CAAC,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE;YAC9C,eAAe,EAAE,YAAY,CAAC,MAAM,EAAE;YACtC,KAAK;YACL,mBAAmB,EAAE,UAAU,CAAC,GAAG,CAAC;SACrC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,OAAO;QACL,MAAM;QACN,OAAO,EAAE;YACP,oBAAoB,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,MAAM;YACvC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,MAAM;YACnC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,MAAM;SACzC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,OAKpC;IAQC,OAAO,qCAAqC,CAAC,OAAO,EAAE;QACpD,WAAW,EAAE,oCAAoC;QACjD,SAAS,EAAE,uBAAuB;QAClC,aAAa,EAAE,qBAAqB;QACpC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACvC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAC7B,UAAkB,EAClB,QAAoC;IAEpC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,8BAA8B,CAAC,CAAC;IACxE,IACE,CAAC,YAAY,CAAC,MAAM,CAAC;QACrB,MAAM,CAAC,cAAc,KAAK,4BAA4B,CAAC,aAAa;QACpE,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;QACzC,MAAM,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;QACnD,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;QAC3C,MAAM,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY;QAC7C,MAAM,CAAC,eAAe,KAAK,CAAC;QAC5B,MAAM,CAAC,eAAe,KAAK,KAAK,EAChC,CAAC;QACD,MAAM,IAAI,QAAQ,CAAC,+DAA+D,EAAE;YAClF,IAAI,EAAE,8CAA8C;YACpD,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AASD,KAAK,UAAU,6BAA6B,CAC1C,OAIC,EACD,YAAuC;IAKvC,MAAM,WAAW,GAAG,oBAAoB,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,WAAW,GAAG,KAAK,CAAC;IAC5D,MAAM,KAAK,GACT,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/F,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,GAAe,CAAC;QACpB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC;gBACrC,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU;aAChD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE;gBAChE,eAAe,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACzC,MAAM,EAAE,YAAY;gBACpB,WAAW,EAAE,kBAAkB;gBAC/B,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;aAC3B,CAAC,CAAC;YACH,IAAI,YAAY,CAAC,KAAK,EAAE,GAAG,QAAQ,EAAE,CAAC;gBACpC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5E,SAAS;YACX,CAAC;YACD,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,YAAY,EAAE;oBACZ,MAAM,EAAE,eAAe;oBACvB,MAAM,EAAE;wBACN;4BACE,IAAI,EAAE,mCAAmC;4BACzC,OAAO,EACL,8EAA8E;4BAChF,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC;yBAC7B;qBACF;oBACD,gBAAgB,EAAE,IAAI;oBACtB,mBAAmB,EAAE,IAAI;iBAC1B;aACF,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,YAAY,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACvE,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE;YAChE,eAAe,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACzC,KAAK;YACL,mBAAmB,EAAE,UAAU,CAAC,GAAG,CAAC;SACrC,CAAC,CAAC;QACH,MAAM,0BAA0B,GAC9B,KAAK,CAAC,gBAAgB,KAAK,cAAc,IAAI,YAAY,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC;QAC/E,IACE,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,0BAA0B,CAAC;YAC3D,YAAY,CAAC,KAAK,EAAE,IAAI,QAAQ,EAChC,CAAC;YACD,IAAI,CAAC;gBACH,OAAO;oBACL,KAAK;oBACL,YAAY,EAAE,MAAM,YAAY,CAAC,eAAe,CAAC;wBAC/C,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI;wBAC3B,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,OAAO;wBACjC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ;wBACnC,KAAK;wBACL,OAAO,EAAE,OAAO,CAAC,OAAO;wBACxB,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ;qBACnC,CAAC;iBACH,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE;oBAChE,eAAe,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACzC,MAAM,EAAE,oBAAoB;oBAC5B,WAAW,EAAE,2BAA2B;oBACxC,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;iBAC3B,CAAC,CAAC;gBACH,IAAI,YAAY,CAAC,KAAK,EAAE,GAAG,QAAQ,EAAE,CAAC;oBACpC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC5E,SAAS;gBACX,CAAC;gBACD,OAAO;oBACL,KAAK;oBACL,YAAY,EAAE;wBACZ,MAAM,EAAE,eAAe;wBACvB,MAAM,EAAE;4BACN;gCACE,IAAI,EAAE,yCAAyC;gCAC/C,OAAO,EACL,2EAA2E;gCAC7E,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC;6BAC7B;yBACF;wBACD,gBAAgB,EAAE,IAAI;wBACtB,mBAAmB,EAAE,IAAI;qBAC1B;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,OAI5B;IAIC,OAAO,6BAA6B,CAAC,OAAO,EAAE;QAC5C,aAAa,EAAE,6BAA6B;QAC5C,WAAW,EAAE,yBAAyB;QACtC,eAAe,EAAE,wBAAwB;QACzC,KAAK,EAAE,IAAI,CAAC,GAAG;KAChB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,OAMpB;IACC,OAAO;QACL,cAAc,EAAE,4BAA4B,CAAC,aAAa;QAC1D,gBAAgB,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC1C,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ;QAC3D,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,MAAM;QACnC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU;QAChD,eAAe,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe;QAC1D,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW;QAC9C,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY;QAChD,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK;QACtC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW;QAClD,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,eAAe,EAAE,OAAO,CAAC,KAAK;QAC9B,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,MAAM;QACnC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS;KACtC,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,MAAyC;IACxE,OAAO;QACL,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,aAAa,EAAE,8BAA8B;QAC7C,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,OAKrC;IACC,IAAI,OAAO,CAAC,KAAK,EAAE,gBAAgB,EAAE,CAAC;QACpC,yBAAyB,CACvB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,cAAc,EACzC,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAC/B,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC;QAC1C,yBAAyB,CACvB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,gBAAgB,EAC3C,OAAO,CAAC,YAAY,CAAC,gBAAgB,CACtC,CAAC;QACF,yBAAyB,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,kBAAkB,EAAE;YACvE,0BAA0B,EAAE,UAAU,CACpC,wCAAwC,CAAC,OAAO,CAAC,YAAY,CAAC,gBAAgB,CAAC,IAAI,CAAC,CACrF;YACD,mCAAmC,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,0BAA0B;SACtF,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,CAAC,mBAAmB,EAAE,CAAC;QAC7C,yBAAyB,CACvB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,mBAAmB,EAC9C,OAAO,CAAC,YAAY,CAAC,mBAAmB,CACzC,CAAC;IACJ,CAAC;IACD,MAAM,yBAAyB,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAChE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,yCAAyC,CACpE,CAAC;IACF,yBAAyB,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACrF,IACE,OAAO,CAAC,KAAK;QACb,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS;QAClC,OAAO,CAAC,KAAK,CAAC,gBAAgB,KAAK,cAAc;QACjD,CAAC,yBAAyB;QAC1B,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC,EACvD,CAAC;QACD,yBAAyB,CACvB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,EAC1C,uBAAuB,CAAC,OAAO,CAAC,MAAM,CAAC,CACxC,CAAC;IACJ,CAAC;AACH,CAAC;AAkBD,KAAK,UAAU,6BAA6B,CAC1C,OAA8C,EAC9C,YAAwC,EACxC,YAA0C;IAE1C,sBAAsB,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAC5C,OAAO,YAAY,CAAC,aAAa,CAC/B,YAAY,CAAC,SAAS,CAAC,kBAAkB,EACzC,EAAE,MAAM,EAAE,iCAAiC,YAAY,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,EAC/E,KAAK,IAAI,EAAE;QACT,yBAAyB,CAAC,YAAY,CAAC,SAAS,CAAC,cAAc,EAAE;YAC/D,cAAc,EAAE,4BAA4B,CAAC,aAAa;YAC1D,UAAU,EAAE,YAAY,CAAC,QAAQ,CAAC,UAAU;YAC5C,eAAe,EAAE,YAAY,CAAC,QAAQ,CAAC,eAAe;YACtD,SAAS,EAAE,YAAY,CAAC,QAAQ;YAChC,WAAW,EAAE,YAAY,CAAC,UAAU;YACpC,aAAa,EAAE,YAAY,CAAC,YAAY;YACxC,WAAW,EAAE,YAAY,CAAC,IAAI,CAAC,WAAW;YAC1C,YAAY,EAAE,YAAY,CAAC,IAAI,CAAC,YAAY;YAC5C,WAAW,EAAE,YAAY,CAAC,QAAQ,CAAC,WAAW;YAC9C,KAAK,EAAE,YAAY,CAAC,QAAQ,CAAC,KAAK;YAClC,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC,QAAQ;SACzC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,wBAAwB,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,cAAc,GAAG,sBAAsB,CAC3C,QAAQ,CAAC,SAAS,CAAC,kBAAkB,EACrC,QAAQ,CAAC,QAAQ,CAClB,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,IAAI,cAAc,EAAE,CAAC;YACrC,MAAM,IAAI,QAAQ,CAChB,6FAA6F,EAC7F;gBACE,IAAI,EAAE,8CAA8C;gBACpD,QAAQ,EAAE,CAAC;aACZ,CACF,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,cAAc,CAAC;YAChD,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;QACH,qBAAqB,CAAC;YACpB,QAAQ;YACR,OAAO;YACP,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;QAEH,IAAI,SAAS,GAAmC,IAAI,CAAC;QACrD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,gBAAgB,CAAC;gBAClD,OAAO;gBACP,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO;gBACvC,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B,CAAC,CAAC;YACH,uBAAuB,CAAC;gBACtB,QAAQ;gBACR,WAAW,EAAE,OAAO,CAAC,IAAI;gBACzB,YAAY,EAAE,OAAO,CAAC,YAAY;aACnC,CAAC,CAAC;YACH,MAAM,YAAY,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YACxD,MAAM,YAAY,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YAE1D,MAAM,gBAAgB,GAAG,YAAY,CAAC,qBAAqB,CAAC;gBAC1D,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,IAAI,EAAE,QAAQ,CAAC,gBAAgB;gBAC/B,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;aAC5B,CAAC,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,kBAAkB,CAAC;gBACzD,OAAO;gBACP,OAAO,EAAE,gBAAgB;aAC1B,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,YAAY,CAAC,cAAc,CAC3C,YAAY,EACZ,QAAQ,CAAC,QAAQ,EACjB,KAAK,CAAC,OAAO,CAAC,CACf,CAAC;YACF,MAAM,EAAE,eAAe,EAAE,cAAc,EAAE,GAAG,iBAAiB,EAAE,GAAG,SAAS,CAAC;YAC5E,yBAAyB,CAAC,QAAQ,CAAC,SAAS,CAAC,kBAAkB,EAAE;gBAC/D,KAAK,EAAE,iBAAiB;gBACxB,sBAAsB,EAAE,UAAU,CAAC,cAAc,CAAC;gBAClD,mBAAmB,EAAE,UAAU,CAAC,YAAY,CAAC;aAC9C,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC;gBAC5C,QAAQ;gBACR,OAAO;gBACP,SAAS;gBACT,WAAW,EAAE,QAAQ,CAAC,SAAS,CAAC,aAAa;aAC9C,CAAC,CAAC;YACH,yBAAyB,CAAC,QAAQ,CAAC,SAAS,CAAC,kBAAkB,EAAE;gBAC/D,cAAc,EAAE,4BAA4B,CAAC,aAAa;gBAC1D,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE;gBAC7C,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,UAAU;gBACxC,eAAe,EAAE,QAAQ,CAAC,QAAQ,CAAC,eAAe;gBAClD,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,WAAW;gBAC1C,YAAY,EAAE,QAAQ,CAAC,QAAQ,CAAC,YAAY;gBAC5C,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK;gBAC9B,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,WAAW;gBAC1C,sBAAsB,EAAE,SAAS,CAAC,sBAAsB;gBACxD,sBAAsB,EAAE,UAAU,CAAC,SAAS,CAAC,eAAe,CAAC;gBAC7D,sBAAsB,EAAE,SAAS,CAAC,YAAY;gBAC9C,oBAAoB,EAAE,SAAS,CAAC,UAAU;gBAC1C,YAAY,EAAE,KAAK,CAAC,OAAO;gBAC3B,mBAAmB,EAAE,MAAM,CAAC,WAAW,CACrC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC,CAChE;gBACD,eAAe,EAAE,CAAC;gBAClB,eAAe,EAAE,KAAK;aACvB,CAAC,CAAC;YAEH,MAAM,YAAY,GAAG,YAAY,CAAC,iBAAiB,CAAC;gBAClD,SAAS;gBACT,WAAW,EAAE,KAAK,CAAC,OAAO;aAC3B,CAAC,CAAC;YACH,IAAI,CAAC;gBACH,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,cAAc,CAAC;oBACrD,OAAO;oBACP,OAAO,EAAE,YAAY;iBACtB,CAAC,CAAC;gBACH,SAAS,GAAG,YAAY,CAAC,cAAc,CAAC,YAAY,EAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;gBACpF,yBAAyB,CAAC,QAAQ,CAAC,SAAS,CAAC,kBAAkB,EAAE;oBAC/D,KAAK,EAAE,SAAS;oBAChB,mBAAmB,EAAE,UAAU,CAAC,YAAY,CAAC;iBAC9C,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,yBAAyB,CAAC,QAAQ,CAAC,SAAS,CAAC,yBAAyB,EAAE;oBACtE,cAAc,EAAE,CAAC;oBACjB,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,UAAU;oBACxC,eAAe,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACzC,cAAc,EAAE,4BAA4B;oBAC5C,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;iBAC3B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3F,MAAM,MAAM,GAAG,WAAW,CAAC;YACzB,OAAO,EAAE,OAAO;YAChB,QAAQ;YACR,SAAS;YACT,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,YAAY,EAAE,QAAQ,CAAC,YAAY;SACpC,CAAC,CAAC;QACH,4BAA4B,CAAC;YAC3B,QAAQ;YACR,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,MAAM;SACP,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,OAA8C;IAE9C,MAAM,QAAQ,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACpD,OAAO,6BAA6B,CAAC,OAAO,EAAE,QAAQ,EAAE;QACtD,aAAa,EAAE,iBAAiB;QAChC,cAAc,EAAE,+BAA+B;QAC/C,gBAAgB,EAAE,2BAA2B;QAC7C,aAAa,EAAE,sBAAsB;QACrC,eAAe,EAAE,yBAAyB;QAC1C,qBAAqB,EAAE,8BAA8B;QACrD,kBAAkB,EAAE,kCAAkC;QACtD,cAAc,EAAE,4BAA4B;QAC5C,YAAY,EAAE,qBAAqB;QACnC,iBAAiB,EAAE,0BAA0B;QAC7C,cAAc,EAAE,8BAA8B;QAC9C,cAAc,EAAE,4BAA4B;QAC5C,aAAa;KACd,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,wBAAwB;IACxB,qBAAqB;IACrB,qBAAqB;IACrB,yBAAyB;IACzB,uBAAuB;IACvB,sBAAsB;IACtB,WAAW;IACX,uBAAuB;IACvB,KAAK;IACL,YAAY;IACZ,qBAAqB;IACrB,eAAe;IACf,oBAAoB;IACpB,yBAAyB;IACzB,yCAAyC;IACzC,aAAa;IACb,YAAY;IACZ,aAAa;IACb,6BAA6B;IAC7B,6BAA6B;IAC7B,qBAAqB;IACrB,qCAAqC;IACrC,4BAA4B;IAC5B,sBAAsB;IACtB,yBAAyB;CAC1B,CAAC","sourcesContent":["import {\n  appendFileSync,\n  chmodSync,\n  existsSync,\n  mkdirSync,\n  readFileSync,\n  writeFileSync,\n} from 'node:fs';\nimport path from 'node:path';\nimport {\n  buildAliasPlanRequest,\n  loadMaintenanceDesiredPayload,\n} from './dataset-maintenance-alias-request.js';\nimport {\n  MAINTENANCE_SCAN_TABLES,\n  isJsonObject,\n  maintenanceRowKey,\n  parseMaintenancePlan,\n  readJsonFile,\n  sha256Json,\n  sha256Text,\n  snapshotRemoteRow,\n  stableJsonText,\n  type DatasetMaintenancePlan,\n  type DatasetMaintenanceRemoteRow,\n  type JsonObject,\n} from './dataset-maintenance-contract.js';\nimport {\n  PROTECTED_EXECUTION_CONTRACT,\n  assertProtectedApprovalBindings,\n  assertProtectedFreezeMatchesPlan,\n  buildProtectedAdmitRequest,\n  buildProtectedExecutionIdentity,\n  buildProtectedPreflightRequest,\n  parseProtectedAdmissionProof,\n  parseProtectedApproval,\n  parseProtectedDerivativeSnapshot,\n  parseProtectedFreeze,\n  parseProtectedGateProof,\n  parseProtectedPreflightProof,\n  parseProtectedStatusProof,\n  type DatasetMaintenanceProtectedApproval,\n  type DatasetMaintenanceProtectedFreeze,\n  type ProtectedAdmissionProof,\n  type ProtectedExecutionIdentity,\n  type ProtectedExecutionStatusProof,\n  type ProtectedGateProof,\n  type ProtectedPreflightProof,\n  type ProtectedReportStatus,\n} from './dataset-maintenance-protected-contract.js';\nimport {\n  verifyProtectedExecution,\n  type ProtectedVerificationResult,\n} from './dataset-maintenance-protected-verify.js';\nimport { maintenanceProjectedReferenceFingerprint } from './dataset-maintenance-plan.js';\nimport { isSnapshotCompletenessCompatible } from './dataset-maintenance-pagination.js';\nimport {\n  admitMaintenanceAliasExecution,\n  captureMaintenanceAliasExecutionGate,\n  fetchMaintenanceAccountRows,\n  fetchMaintenanceDerivativeSnapshot,\n  fetchMaintenanceExactRows,\n  normalizeMaintenancePageSize,\n  preflightMaintenanceAliasExecution,\n  readMaintenanceAliasExecution,\n  resolveMaintenanceRemoteContext,\n  type DatasetMaintenanceRemoteContext,\n} from './dataset-maintenance-remote.js';\nimport { CliError } from './errors.js';\nimport type { FetchLike } from './http.js';\nimport { withStateFileLock } from './state-lock.js';\n\nexport type RunDatasetMaintenanceProtectedOptions = {\n  planPath: string;\n  freezePath: string;\n  approvalPath: string;\n  outDir: string;\n  commit: boolean;\n  statusOnly: boolean;\n  approveExecution?: string;\n  confirm?: string;\n  waitSeconds?: number;\n  pollMs?: number;\n  pageSize?: number;\n  timeoutMs?: number;\n  env: NodeJS.ProcessEnv;\n  fetchImpl: FetchLike;\n  now?: Date;\n  sleep?: (ms: number) => Promise<void>;\n};\n\nexport type DatasetMaintenanceProtectedReport = {\n  schema_version: typeof PROTECTED_EXECUTION_CONTRACT.report_schema;\n  generated_at_utc: string;\n  mode: 'commit' | 'status_only';\n  status: ProtectedReportStatus;\n  request_id: string;\n  identity_sha256: string;\n  plan_sha256: string;\n  operation_id: string;\n  actor: { user_id: string; email: string };\n  project_ref: string;\n  admission: ProtectedAdmissionProof | null;\n  database_status: ProtectedExecutionStatusProof | null;\n  issues: Array<{ code: string; message: string; details?: unknown }>;\n  artifacts: {\n    execution_seal: string;\n    preflight_evidence: string;\n    gate_receipts: string;\n    submission_attempt: string;\n    admission_response: string;\n    admission_transport_error: string;\n    status_progress: string;\n    primary_readback: string;\n    reference_readback: string;\n    audit_readback: string;\n    derivative_readback: string;\n    terminal_report: string;\n    attempt_report: string;\n  };\n};\n\ntype PreparedProtectedExecution = {\n  planPath: string;\n  planDir: string;\n  freezePath: string;\n  approvalPath: string;\n  outDir: string;\n  plan: DatasetMaintenancePlan;\n  freeze: DatasetMaintenanceProtectedFreeze;\n  approval: DatasetMaintenanceProtectedApproval;\n  identity: ProtectedExecutionIdentity;\n  aliasPlanRequest: JsonObject;\n  artifacts: DatasetMaintenanceProtectedReport['artifacts'];\n};\n\nconst DEFAULT_POLL_MS = 10_000;\nconst SHA256 = /^[a-f0-9]{64}$/u;\n\nfunction normalizeWaitSeconds(value?: number): number {\n  const normalized = value ?? 0;\n  if (!Number.isInteger(normalized) || normalized < 0 || normalized > 86_400) {\n    throw new CliError('waitSeconds must be an integer between 0 and 86400.', {\n      code: 'DATASET_MAINTENANCE_PROTECTED_WAIT_INVALID',\n      exitCode: 2,\n    });\n  }\n  return normalized;\n}\n\nfunction normalizePollMs(value?: number): number {\n  const normalized = value ?? DEFAULT_POLL_MS;\n  if (!Number.isInteger(normalized) || normalized < 100 || normalized > 60_000) {\n    throw new CliError('pollMs must be an integer between 100 and 60000.', {\n      code: 'DATASET_MAINTENANCE_PROTECTED_POLL_INVALID',\n      exitCode: 2,\n    });\n  }\n  return normalized;\n}\n\nfunction clock(options: RunDatasetMaintenanceProtectedOptions): Date {\n  return options.now ?? new Date();\n}\n\nfunction errorDetails(error: unknown): { name: string; message: string; code: string | null } {\n  return {\n    name: error instanceof Error ? error.name : 'Error',\n    message: error instanceof Error ? error.message : String(error),\n    code:\n      error && typeof error === 'object' && 'code' in error && typeof error.code === 'string'\n        ? error.code\n        : null,\n  };\n}\n\nfunction readArtifact(options: { filePath: string; label: string }): {\n  resolved: string;\n  value: unknown;\n  file_sha256: string;\n} {\n  const resolved = path.resolve(options.filePath);\n  const text = readFileSync(resolved, 'utf8');\n  return {\n    resolved,\n    value: readJsonFile(resolved, options.label),\n    file_sha256: sha256Text(text),\n  };\n}\n\nfunction ensurePrivateDirectory(directory: string): void {\n  mkdirSync(directory, { recursive: true, mode: 0o700 });\n  chmodSync(directory, 0o700);\n}\n\nfunction writePrivateImmutableJson(filePath: string, value: unknown): string {\n  const resolved = path.resolve(filePath);\n  const text = `${stableJsonText(value)}\\n`;\n  ensurePrivateDirectory(path.dirname(resolved));\n  if (existsSync(resolved)) {\n    if (readFileSync(resolved, 'utf8') !== text) {\n      throw new CliError(`Refusing to overwrite protected evidence: ${resolved}`, {\n        code: 'DATASET_MAINTENANCE_PROTECTED_ARTIFACT_IMMUTABLE',\n        exitCode: 1,\n      });\n    }\n    chmodSync(resolved, 0o600);\n    return resolved;\n  }\n  writeFileSync(resolved, text, { encoding: 'utf8', flag: 'wx', mode: 0o600 });\n  return resolved;\n}\n\nfunction appendPrivateJsonLine(filePath: string, value: unknown): string {\n  const resolved = path.resolve(filePath);\n  ensurePrivateDirectory(path.dirname(resolved));\n  appendFileSync(resolved, `${stableJsonText(value)}\\n`, {\n    encoding: 'utf8',\n    flag: 'a',\n    mode: 0o600,\n  });\n  chmodSync(resolved, 0o600);\n  return resolved;\n}\n\nfunction nextAttemptReportPath(outDir: string): string {\n  let attempt = 1;\n  while (attemptArtifactPaths(outDir, attempt).some((filePath) => existsSync(filePath))) {\n    attempt += 1;\n  }\n  return attemptArtifactPaths(outDir, attempt)[0]!;\n}\n\nfunction attemptArtifactPaths(outDir: string, attempt: number): string[] {\n  const suffix = `attempt-${String(attempt).padStart(4, '0')}`;\n  return [\n    path.join(outDir, `protected-run-report.${suffix}.json`),\n    path.join(outDir, `protected-audit-readback.${suffix}.json`),\n    path.join(outDir, `protected-primary-readback.${suffix}.json`),\n    path.join(outDir, `protected-reference-readback.${suffix}.json`),\n    path.join(outDir, `protected-derivative-readback.${suffix}.json`),\n  ];\n}\n\nfunction allocateAttemptArtifacts(\n  prepared: PreparedProtectedExecution,\n): PreparedProtectedExecution {\n  const attemptReport = nextAttemptReportPath(prepared.outDir);\n  const suffix = path.basename(attemptReport, '.json').replace('protected-run-report.', '');\n  return {\n    ...prepared,\n    artifacts: {\n      ...prepared.artifacts,\n      audit_readback: path.join(prepared.outDir, `protected-audit-readback.${suffix}.json`),\n      primary_readback: path.join(prepared.outDir, `protected-primary-readback.${suffix}.json`),\n      reference_readback: path.join(prepared.outDir, `protected-reference-readback.${suffix}.json`),\n      derivative_readback: path.join(\n        prepared.outDir,\n        `protected-derivative-readback.${suffix}.json`,\n      ),\n      attempt_report: attemptReport,\n    },\n  };\n}\n\ntype ProtectedPreparationDependencies = {\n  readArtifact: typeof readArtifact;\n  parsePlan: typeof parseMaintenancePlan;\n  buildAliasPlan: typeof buildAliasPlanRequest;\n  parseFreeze: typeof parseProtectedFreeze;\n  parseApproval: typeof parseProtectedApproval;\n  assertFreezeMatchesPlan: typeof assertProtectedFreezeMatchesPlan;\n  assertApprovalBindings: typeof assertProtectedApprovalBindings;\n  buildIdentity: typeof buildProtectedExecutionIdentity;\n};\n\nfunction prepareProtectedExecutionWithDependencies(\n  options: RunDatasetMaintenanceProtectedOptions,\n  dependencies: ProtectedPreparationDependencies,\n): PreparedProtectedExecution {\n  if (options.commit === options.statusOnly) {\n    throw new CliError('Choose exactly one of commit or statusOnly.', {\n      code: 'DATASET_MAINTENANCE_PROTECTED_MODE_INVALID',\n      exitCode: 2,\n    });\n  }\n  if (\n    options.commit &&\n    (!options.approveExecution ||\n      !SHA256.test(options.approveExecution) ||\n      typeof options.confirm !== 'string' ||\n      !options.confirm.trim())\n  ) {\n    throw new CliError('Protected commit requires the exact approval hash and account email.', {\n      code: 'DATASET_MAINTENANCE_PROTECTED_APPROVAL_REQUIRED',\n      exitCode: 2,\n    });\n  }\n  normalizeWaitSeconds(options.waitSeconds);\n  normalizePollMs(options.pollMs);\n  normalizeMaintenancePageSize(options.pageSize);\n\n  const planArtifact = dependencies.readArtifact({\n    filePath: options.planPath,\n    label: 'Maintenance plan',\n  });\n  const freezeArtifact = dependencies.readArtifact({\n    filePath: options.freezePath,\n    label: 'Protected execution freeze',\n  });\n  const approvalArtifact = dependencies.readArtifact({\n    filePath: options.approvalPath,\n    label: 'Protected execution approval',\n  });\n  const plan = dependencies.parsePlan(planArtifact.value);\n  const planPath = planArtifact.resolved;\n  const planDir = path.dirname(planPath);\n  const aliasPlanRequest = dependencies.buildAliasPlan({ plan, planDir });\n  const freeze = dependencies.parseFreeze(freezeArtifact.value);\n  const approval = dependencies.parseApproval(approvalArtifact.value);\n  dependencies.assertFreezeMatchesPlan({\n    plan,\n    planFileSha256: planArtifact.file_sha256,\n    aliasPlanRequestSha256: sha256Json(aliasPlanRequest),\n    freeze,\n  });\n  dependencies.assertApprovalBindings({\n    approval,\n    freeze,\n    freezeFileSha256: freezeArtifact.file_sha256,\n    approvalFileSha256: approvalArtifact.file_sha256,\n    approveExecution: options.statusOnly\n      ? approval.approval_identity_sha256\n      : options.approveExecution,\n  });\n  const identity = dependencies.buildIdentity({\n    freeze,\n    approval,\n    freezeFileSha256: freezeArtifact.file_sha256,\n    approvalFileSha256: approvalArtifact.file_sha256,\n  });\n  const outDir = path.resolve(options.outDir);\n  const artifacts = {\n    execution_seal: path.join(outDir, 'protected-execution-seal.json'),\n    preflight_evidence: path.join(outDir, 'protected-preflight-evidence.json'),\n    gate_receipts: path.join(outDir, 'protected-gate-receipts.jsonl'),\n    submission_attempt: path.join(outDir, 'protected-submission-attempt.json'),\n    admission_response: path.join(outDir, 'protected-admission-response.json'),\n    admission_transport_error: path.join(outDir, 'protected-admission-transport-error.json'),\n    status_progress: path.join(outDir, 'protected-status-progress.jsonl'),\n    primary_readback: path.join(outDir, 'protected-primary-readback.json'),\n    reference_readback: path.join(outDir, 'protected-reference-readback.json'),\n    audit_readback: path.join(outDir, 'protected-audit-readback.json'),\n    derivative_readback: path.join(outDir, 'protected-derivative-readback.json'),\n    terminal_report: path.join(outDir, 'protected-terminal-report.json'),\n    attempt_report: path.join(outDir, 'protected-run-report.unallocated.json'),\n  };\n  return {\n    planPath,\n    planDir,\n    freezePath: freezeArtifact.resolved,\n    approvalPath: approvalArtifact.resolved,\n    outDir,\n    plan,\n    freeze,\n    approval,\n    identity,\n    aliasPlanRequest,\n    artifacts,\n  };\n}\n\nfunction prepareProtectedExecution(\n  options: RunDatasetMaintenanceProtectedOptions,\n): PreparedProtectedExecution {\n  return prepareProtectedExecutionWithDependencies(options, {\n    readArtifact,\n    parsePlan: parseMaintenancePlan,\n    buildAliasPlan: buildAliasPlanRequest,\n    parseFreeze: parseProtectedFreeze,\n    parseApproval: parseProtectedApproval,\n    assertFreezeMatchesPlan: assertProtectedFreezeMatchesPlan,\n    assertApprovalBindings: assertProtectedApprovalBindings,\n    buildIdentity: buildProtectedExecutionIdentity,\n  });\n}\n\nfunction assertContextBindings(options: {\n  prepared: PreparedProtectedExecution;\n  context: DatasetMaintenanceRemoteContext;\n  confirm?: string;\n  commit: boolean;\n}): void {\n  if (\n    options.context.project_ref !== options.prepared.identity.project_ref ||\n    options.context.account.user_id !== options.prepared.identity.actor.user_id ||\n    options.context.account.email !== options.prepared.identity.actor.email ||\n    (options.commit && options.confirm !== options.context.account.email)\n  ) {\n    throw new CliError(\n      'Authenticated RLS context does not match the sealed production project, actor, and confirmation.',\n      {\n        code: 'DATASET_MAINTENANCE_PROTECTED_CONTEXT_MISMATCH',\n        exitCode: 1,\n        details: {\n          expected_project_ref: options.prepared.identity.project_ref,\n          observed_project_ref: options.context.project_ref,\n          expected_user_id: options.prepared.identity.actor.user_id,\n          observed_user_id: options.context.account.user_id,\n        },\n      },\n    );\n  }\n}\n\nfunction projectedRows(options: {\n  plan: DatasetMaintenancePlan;\n  planDir: string;\n  currentRows: DatasetMaintenanceRemoteRow[];\n}): DatasetMaintenanceRemoteRow[] {\n  const projected = new Map(options.currentRows.map((row) => [maintenanceRowKey(row), { ...row }]));\n  for (const action of options.plan.actions) {\n    const row = projected.get(maintenanceRowKey(action));\n    if (row) {\n      projected.set(maintenanceRowKey(action), {\n        ...row,\n        json_ordered: loadMaintenanceDesiredPayload(options.planDir, action),\n      });\n    }\n  }\n  return [...projected.values()].sort((left, right) =>\n    maintenanceRowKey(left).localeCompare(maintenanceRowKey(right)),\n  );\n}\n\nfunction assertStrictBeforeState(options: {\n  prepared: PreparedProtectedExecution;\n  currentRows: DatasetMaintenanceRemoteRow[];\n  completeness: unknown;\n}): void {\n  const { plan } = options.prepared;\n  if (\n    !plan.snapshot_completeness ||\n    !isSnapshotCompletenessCompatible(\n      options.completeness,\n      plan.snapshot_completeness,\n      MAINTENANCE_SCAN_TABLES,\n    )\n  ) {\n    throw new CliError('Production RLS census does not match the frozen complete snapshot.', {\n      code: 'DATASET_MAINTENANCE_PROTECTED_SNAPSHOT_INCOMPLETE',\n      exitCode: 1,\n    });\n  }\n  const snapshots = options.currentRows\n    .map(snapshotRemoteRow)\n    .sort((left, right) => maintenanceRowKey(left).localeCompare(maintenanceRowKey(right)));\n  if (sha256Json(snapshots) !== plan.visible_snapshot_sha256) {\n    throw new CliError('Production RLS visible snapshot drifted after the freeze.', {\n      code: 'DATASET_MAINTENANCE_PROTECTED_VISIBLE_SNAPSHOT_DRIFT',\n      exitCode: 1,\n    });\n  }\n  const expectedKeys = new Set([\n    ...plan.actions.map(maintenanceRowKey),\n    ...plan.protected_rows.map(maintenanceRowKey),\n  ]);\n  if (\n    expectedKeys.size !== options.currentRows.length ||\n    options.currentRows.some((row) => !expectedKeys.has(maintenanceRowKey(row)))\n  ) {\n    throw new CliError('Production owner account contains missing or unexpected rows.', {\n      code: 'DATASET_MAINTENANCE_PROTECTED_ACCOUNT_CENSUS_DRIFT',\n      exitCode: 1,\n    });\n  }\n  const current = new Map(options.currentRows.map((row) => [maintenanceRowKey(row), row]));\n  for (const row of plan.protected_rows) {\n    const observed = current.get(maintenanceRowKey(row));\n    if (!observed || snapshotRemoteRow(observed).row_sha256 !== row.row_sha256) {\n      throw new CliError(`Protected row drifted: ${row.id}`, {\n        code: 'DATASET_MAINTENANCE_PROTECTED_ROW_DRIFT',\n        exitCode: 1,\n        details: row,\n      });\n    }\n  }\n  for (const action of plan.actions) {\n    const observed = current.get(maintenanceRowKey(action));\n    if (\n      !action.before ||\n      !observed ||\n      observed.user_id !== action.expected_user_id ||\n      observed.state_code !== 0 ||\n      snapshotRemoteRow(observed).row_sha256 !== action.before.row_sha256\n    ) {\n      throw new CliError(\n        `Action row is no longer in the exact frozen before state: ${action.action_id}`,\n        {\n          code: 'DATASET_MAINTENANCE_PROTECTED_ACTION_DRIFT',\n          exitCode: 1,\n        },\n      );\n    }\n  }\n  const finalRows = projectedRows({\n    plan,\n    planDir: options.prepared.planDir,\n    currentRows: options.currentRows,\n  });\n  if (\n    sha256Json(maintenanceProjectedReferenceFingerprint(finalRows)) !==\n    plan.projected_reference_sha256\n  ) {\n    throw new CliError('Projected reference closure drifted before protected execution.', {\n      code: 'DATASET_MAINTENANCE_PROTECTED_REFERENCE_DRIFT',\n      exitCode: 1,\n    });\n  }\n}\n\nasync function assertSupportSnapshots(options: {\n  prepared: PreparedProtectedExecution;\n  context: DatasetMaintenanceRemoteContext;\n}): Promise<void> {\n  for (const batch of options.prepared.plan.alias_batches ?? []) {\n    for (const snapshot of [\n      batch.target_snapshots.unitgroup,\n      batch.target_snapshots.flowproperty,\n      batch.target_snapshots.source_unitgroup,\n    ]) {\n      if (!snapshot) {\n        throw new CliError(`Alias support snapshot is absent for ${batch.batch_id}.`, {\n          code: 'DATASET_MAINTENANCE_PROTECTED_SUPPORT_DRIFT',\n          exitCode: 1,\n        });\n      }\n      const exact = await fetchMaintenanceExactRows({\n        context: options.context,\n        table: snapshot.table,\n        id: snapshot.id,\n        version: snapshot.version,\n      });\n      const row = exact.rows.length === 1 ? exact.rows[0] : null;\n      if (\n        !row ||\n        row.user_id !== options.prepared.identity.actor.user_id ||\n        row.state_code !== 0 ||\n        snapshotRemoteRow(row).row_sha256 !== snapshot.row_sha256\n      ) {\n        throw new CliError(`Alias support row drifted for ${batch.batch_id}.`, {\n          code: 'DATASET_MAINTENANCE_PROTECTED_SUPPORT_DRIFT',\n          exitCode: 1,\n          details: { table: snapshot.table, id: snapshot.id, version: snapshot.version },\n        });\n      }\n    }\n  }\n}\n\nasync function assertDerivativeBaselines(options: {\n  prepared: PreparedProtectedExecution;\n  context: DatasetMaintenanceRemoteContext;\n}): Promise<void> {\n  const targets = options.prepared.identity.derivative_targets;\n  for (let offset = 0; offset < targets.length; offset += 5) {\n    const chunk = targets.slice(offset, offset + 5);\n    const snapshots = await Promise.all(\n      chunk.map(async (target) =>\n        parseProtectedDerivativeSnapshot(\n          await fetchMaintenanceDerivativeSnapshot({\n            context: options.context,\n            table: target.table,\n            id: target.id,\n            version: target.version,\n          }),\n          {\n            table: target.table,\n            id: target.id,\n            version: target.version,\n            userId: target.user_id,\n          },\n        ),\n      ),\n    );\n    for (const [index, snapshot] of snapshots.entries()) {\n      const target = chunk[index]!;\n      if (snapshot.snapshot_sha256 !== target.baseline_snapshot_sha256) {\n        throw new CliError('A protected derivative baseline drifted before preflight.', {\n          code: 'DATASET_MAINTENANCE_PROTECTED_DERIVATIVE_BASELINE_DRIFT',\n          exitCode: 1,\n          details: { table: target.table, id: target.id, version: target.version },\n        });\n      }\n    }\n  }\n}\n\ntype ProtectedGateDependencies = {\n  captureGate: typeof captureMaintenanceAliasExecutionGate;\n  parseGate: typeof parseProtectedGateProof;\n  appendReceipt: typeof appendPrivateJsonLine;\n  nowIso: () => string;\n};\n\nasync function captureProtectedGatesWithDependencies(\n  options: {\n    prepared: PreparedProtectedExecution;\n    context: DatasetMaintenanceRemoteContext;\n    preflight: ProtectedPreflightProof;\n    receiptPath: string;\n  },\n  dependencies: ProtectedGateDependencies,\n): Promise<{\n  proofs: ProtectedGateProof[];\n  results: {\n    primary_support_plan: ProtectedGateProof['result'];\n    execution_unused: ProtectedGateProof['result'];\n    derivative_quiescence: ProtectedGateProof['result'];\n  };\n}> {\n  const gateNames = ['primary_support_plan', 'execution_unused', 'derivative_quiescence'] as const;\n  const proofs: ProtectedGateProof[] = [];\n  for (const gate of gateNames) {\n    const raw = await dependencies.captureGate({\n      context: options.context,\n      requestId: options.prepared.identity.request_id,\n      preflightToken: options.preflight.preflight_token,\n      gateName: gate,\n    });\n    const proof = dependencies.parseGate(raw, {\n      identity: options.prepared.identity,\n      preflight: options.preflight,\n      gate,\n    });\n    dependencies.appendReceipt(options.receiptPath, {\n      observed_at_utc: dependencies.nowIso(),\n      proof,\n      raw_response_sha256: sha256Json(raw),\n    });\n    proofs.push(proof);\n  }\n  return {\n    proofs,\n    results: {\n      primary_support_plan: proofs[0]!.result,\n      execution_unused: proofs[1]!.result,\n      derivative_quiescence: proofs[2]!.result,\n    },\n  };\n}\n\nasync function captureProtectedGates(options: {\n  prepared: PreparedProtectedExecution;\n  context: DatasetMaintenanceRemoteContext;\n  preflight: ProtectedPreflightProof;\n  receiptPath: string;\n}): Promise<{\n  proofs: ProtectedGateProof[];\n  results: {\n    primary_support_plan: ProtectedGateProof['result'];\n    execution_unused: ProtectedGateProof['result'];\n    derivative_quiescence: ProtectedGateProof['result'];\n  };\n}> {\n  return captureProtectedGatesWithDependencies(options, {\n    captureGate: captureMaintenanceAliasExecutionGate,\n    parseGate: parseProtectedGateProof,\n    appendReceipt: appendPrivateJsonLine,\n    nowIso: () => new Date().toISOString(),\n  });\n}\n\nfunction validateExistingMarker(\n  markerPath: string,\n  identity: ProtectedExecutionIdentity,\n): JsonObject | null {\n  if (!existsSync(markerPath)) return null;\n  const marker = readJsonFile(markerPath, 'Protected submission attempt');\n  if (\n    !isJsonObject(marker) ||\n    marker.schema_version !== PROTECTED_EXECUTION_CONTRACT.marker_schema ||\n    marker.request_id !== identity.request_id ||\n    marker.identity_sha256 !== identity.identity_sha256 ||\n    marker.plan_sha256 !== identity.plan_sha256 ||\n    marker.operation_id !== identity.operation_id ||\n    marker.max_admit_posts !== 1 ||\n    marker.automatic_retry !== false\n  ) {\n    throw new CliError('Existing protected submission marker is foreign or malformed.', {\n      code: 'DATASET_MAINTENANCE_PROTECTED_MARKER_INVALID',\n      exitCode: 1,\n    });\n  }\n  return marker;\n}\n\ntype ProtectedReadDependencies = {\n  readExecution: typeof readMaintenanceAliasExecution;\n  parseStatus: typeof parseProtectedStatusProof;\n  verifyExecution: typeof verifyProtectedExecution;\n  nowMs: () => number;\n};\n\nasync function readAndVerifyWithDependencies(\n  options: {\n    command: RunDatasetMaintenanceProtectedOptions;\n    prepared: PreparedProtectedExecution;\n    context: DatasetMaintenanceRemoteContext;\n  },\n  dependencies: ProtectedReadDependencies,\n): Promise<{\n  proof: ProtectedExecutionStatusProof | null;\n  verification: ProtectedVerificationResult;\n}> {\n  const waitSeconds = normalizeWaitSeconds(options.command.waitSeconds);\n  const pollMs = normalizePollMs(options.command.pollMs);\n  const deadline = dependencies.nowMs() + waitSeconds * 1_000;\n  const sleep =\n    options.command.sleep ?? ((ms: number) => new Promise((resolve) => setTimeout(resolve, ms)));\n  while (true) {\n    let raw: JsonObject;\n    try {\n      raw = await dependencies.readExecution({\n        context: options.context,\n        requestId: options.prepared.identity.request_id,\n      });\n    } catch (error) {\n      appendPrivateJsonLine(options.prepared.artifacts.status_progress, {\n        observed_at_utc: new Date().toISOString(),\n        result: 'read_error',\n        retry_scope: 'status_read_only',\n        error: errorDetails(error),\n      });\n      if (dependencies.nowMs() < deadline) {\n        await sleep(Math.min(pollMs, Math.max(deadline - dependencies.nowMs(), 0)));\n        continue;\n      }\n      return {\n        proof: null,\n        verification: {\n          status: 'indeterminate',\n          issues: [\n            {\n              code: 'PROTECTED_STATUS_READ_UNAVAILABLE',\n              message:\n                'Protected execution status could not be read; admission must not be retried.',\n              details: errorDetails(error),\n            },\n          ],\n          account_readback: null,\n          derivative_readback: null,\n        },\n      };\n    }\n    const proof = dependencies.parseStatus(raw, options.prepared.identity);\n    appendPrivateJsonLine(options.prepared.artifacts.status_progress, {\n      observed_at_utc: new Date().toISOString(),\n      proof,\n      raw_response_sha256: sha256Json(raw),\n    });\n    const waitForAdmissionVisibility =\n      proof.execution_status === 'not_admitted' && dependencies.nowMs() < deadline;\n    if (\n      (proof.status !== 'pending' && !waitForAdmissionVisibility) ||\n      dependencies.nowMs() >= deadline\n    ) {\n      try {\n        return {\n          proof,\n          verification: await dependencies.verifyExecution({\n            plan: options.prepared.plan,\n            planDir: options.prepared.planDir,\n            identity: options.prepared.identity,\n            proof,\n            context: options.context,\n            pageSize: options.command.pageSize,\n          }),\n        };\n      } catch (error) {\n        appendPrivateJsonLine(options.prepared.artifacts.status_progress, {\n          observed_at_utc: new Date().toISOString(),\n          result: 'verification_error',\n          retry_scope: 'independent_readback_only',\n          request_id: proof.request_id,\n          error: errorDetails(error),\n        });\n        if (dependencies.nowMs() < deadline) {\n          await sleep(Math.min(pollMs, Math.max(deadline - dependencies.nowMs(), 0)));\n          continue;\n        }\n        return {\n          proof,\n          verification: {\n            status: 'indeterminate',\n            issues: [\n              {\n                code: 'PROTECTED_TERMINAL_READBACK_UNAVAILABLE',\n                message:\n                  'Terminal proof was returned but independent RLS readback was unavailable.',\n                details: errorDetails(error),\n              },\n            ],\n            account_readback: null,\n            derivative_readback: null,\n          },\n        };\n      }\n    }\n    await sleep(Math.min(pollMs, Math.max(deadline - dependencies.nowMs(), 0)));\n  }\n}\n\nasync function readAndVerify(options: {\n  command: RunDatasetMaintenanceProtectedOptions;\n  prepared: PreparedProtectedExecution;\n  context: DatasetMaintenanceRemoteContext;\n}): Promise<{\n  proof: ProtectedExecutionStatusProof | null;\n  verification: ProtectedVerificationResult;\n}> {\n  return readAndVerifyWithDependencies(options, {\n    readExecution: readMaintenanceAliasExecution,\n    parseStatus: parseProtectedStatusProof,\n    verifyExecution: verifyProtectedExecution,\n    nowMs: Date.now,\n  });\n}\n\nfunction buildReport(options: {\n  command: RunDatasetMaintenanceProtectedOptions;\n  prepared: PreparedProtectedExecution;\n  admission: ProtectedAdmissionProof | null;\n  proof: ProtectedExecutionStatusProof | null;\n  verification: ProtectedVerificationResult;\n}): DatasetMaintenanceProtectedReport {\n  return {\n    schema_version: PROTECTED_EXECUTION_CONTRACT.report_schema,\n    generated_at_utc: new Date().toISOString(),\n    mode: options.command.statusOnly ? 'status_only' : 'commit',\n    status: options.verification.status,\n    request_id: options.prepared.identity.request_id,\n    identity_sha256: options.prepared.identity.identity_sha256,\n    plan_sha256: options.prepared.plan.plan_sha256,\n    operation_id: options.prepared.plan.operation_id,\n    actor: options.prepared.identity.actor,\n    project_ref: options.prepared.identity.project_ref,\n    admission: options.admission,\n    database_status: options.proof,\n    issues: options.verification.issues,\n    artifacts: options.prepared.artifacts,\n  };\n}\n\nfunction canonicalTerminalReport(report: DatasetMaintenanceProtectedReport): JsonObject {\n  return {\n    schema_version: report.schema_version,\n    artifact_kind: 'protected_terminal_canonical',\n    status: report.status,\n    request_id: report.request_id,\n    identity_sha256: report.identity_sha256,\n    plan_sha256: report.plan_sha256,\n    operation_id: report.operation_id,\n    actor: report.actor,\n    project_ref: report.project_ref,\n    database_status: report.database_status,\n    issues: report.issues,\n  };\n}\n\nfunction persistVerificationArtifacts(options: {\n  prepared: PreparedProtectedExecution;\n  proof: ProtectedExecutionStatusProof | null;\n  verification: ProtectedVerificationResult;\n  report: DatasetMaintenanceProtectedReport;\n}): void {\n  if (options.proof?.primary_readback) {\n    writePrivateImmutableJson(\n      options.prepared.artifacts.audit_readback,\n      options.proof.primary_readback,\n    );\n  }\n  if (options.verification.account_readback) {\n    writePrivateImmutableJson(\n      options.prepared.artifacts.primary_readback,\n      options.verification.account_readback,\n    );\n    writePrivateImmutableJson(options.prepared.artifacts.reference_readback, {\n      projected_reference_sha256: sha256Json(\n        maintenanceProjectedReferenceFingerprint(options.verification.account_readback.rows),\n      ),\n      expected_projected_reference_sha256: options.prepared.plan.projected_reference_sha256,\n    });\n  }\n  if (options.verification.derivative_readback) {\n    writePrivateImmutableJson(\n      options.prepared.artifacts.derivative_readback,\n      options.verification.derivative_readback,\n    );\n  }\n  const terminalReadbackRetryable = options.verification.issues.some(\n    (entry) => entry.code === 'PROTECTED_TERMINAL_READBACK_UNAVAILABLE',\n  );\n  writePrivateImmutableJson(options.prepared.artifacts.attempt_report, options.report);\n  if (\n    options.proof &&\n    options.proof.status !== 'pending' &&\n    options.proof.execution_status !== 'not_admitted' &&\n    !terminalReadbackRetryable &&\n    !existsSync(options.prepared.artifacts.terminal_report)\n  ) {\n    writePrivateImmutableJson(\n      options.prepared.artifacts.terminal_report,\n      canonicalTerminalReport(options.report),\n    );\n  }\n}\n\ntype ProtectedRuntimeDependencies = {\n  withStateLock: typeof withStateFileLock;\n  resolveContext: typeof resolveMaintenanceRemoteContext;\n  fetchAccountRows: typeof fetchMaintenanceAccountRows;\n  assertSupport: typeof assertSupportSnapshots;\n  assertBaselines: typeof assertDerivativeBaselines;\n  buildPreflightRequest: typeof buildProtectedPreflightRequest;\n  preflightExecution: typeof preflightMaintenanceAliasExecution;\n  parsePreflight: typeof parseProtectedPreflightProof;\n  captureGates: typeof captureProtectedGates;\n  buildAdmitRequest: typeof buildProtectedAdmitRequest;\n  admitExecution: typeof admitMaintenanceAliasExecution;\n  parseAdmission: typeof parseProtectedAdmissionProof;\n  readAndVerify: typeof readAndVerify;\n};\n\nasync function runPreparedProtectedExecution(\n  options: RunDatasetMaintenanceProtectedOptions,\n  basePrepared: PreparedProtectedExecution,\n  dependencies: ProtectedRuntimeDependencies,\n): Promise<DatasetMaintenanceProtectedReport> {\n  ensurePrivateDirectory(basePrepared.outDir);\n  return dependencies.withStateLock(\n    basePrepared.artifacts.submission_attempt,\n    { reason: `dataset_maintenance_protected_${basePrepared.identity.request_id}` },\n    async () => {\n      writePrivateImmutableJson(basePrepared.artifacts.execution_seal, {\n        schema_version: PROTECTED_EXECUTION_CONTRACT.freeze_schema,\n        request_id: basePrepared.identity.request_id,\n        identity_sha256: basePrepared.identity.identity_sha256,\n        plan_path: basePrepared.planPath,\n        freeze_path: basePrepared.freezePath,\n        approval_path: basePrepared.approvalPath,\n        plan_sha256: basePrepared.plan.plan_sha256,\n        operation_id: basePrepared.plan.operation_id,\n        project_ref: basePrepared.identity.project_ref,\n        actor: basePrepared.identity.actor,\n        bindings: basePrepared.identity.bindings,\n      });\n      const prepared = allocateAttemptArtifacts(basePrepared);\n      const existingMarker = validateExistingMarker(\n        prepared.artifacts.submission_attempt,\n        prepared.identity,\n      );\n      if (options.commit && existingMarker) {\n        throw new CliError(\n          'A protected submission marker already exists. Use status-only; admission cannot be retried.',\n          {\n            code: 'DATASET_MAINTENANCE_PROTECTED_ATTEMPT_EXISTS',\n            exitCode: 1,\n          },\n        );\n      }\n      const context = await dependencies.resolveContext({\n        env: options.env,\n        fetchImpl: options.fetchImpl,\n        timeoutMs: options.timeoutMs,\n        now: options.now,\n      });\n      assertContextBindings({\n        prepared,\n        context,\n        confirm: options.confirm,\n        commit: options.commit,\n      });\n\n      let admission: ProtectedAdmissionProof | null = null;\n      if (options.commit) {\n        const current = await dependencies.fetchAccountRows({\n          context,\n          userId: prepared.identity.actor.user_id,\n          pageSize: options.pageSize,\n        });\n        assertStrictBeforeState({\n          prepared,\n          currentRows: current.rows,\n          completeness: current.completeness,\n        });\n        await dependencies.assertSupport({ prepared, context });\n        await dependencies.assertBaselines({ prepared, context });\n\n        const preflightRequest = dependencies.buildPreflightRequest({\n          identity: prepared.identity,\n          plan: prepared.aliasPlanRequest,\n          freeze: prepared.freeze,\n          approval: prepared.approval,\n        });\n        const preflightRaw = await dependencies.preflightExecution({\n          context,\n          request: preflightRequest,\n        });\n        const preflight = dependencies.parsePreflight(\n          preflightRaw,\n          prepared.identity,\n          clock(options),\n        );\n        const { preflight_token: preflightToken, ...preflightEvidence } = preflight;\n        writePrivateImmutableJson(prepared.artifacts.preflight_evidence, {\n          proof: preflightEvidence,\n          preflight_token_sha256: sha256Text(preflightToken),\n          raw_response_sha256: sha256Json(preflightRaw),\n        });\n        const gates = await dependencies.captureGates({\n          prepared,\n          context,\n          preflight,\n          receiptPath: prepared.artifacts.gate_receipts,\n        });\n        writePrivateImmutableJson(prepared.artifacts.submission_attempt, {\n          schema_version: PROTECTED_EXECUTION_CONTRACT.marker_schema,\n          prepared_at_utc: clock(options).toISOString(),\n          request_id: prepared.identity.request_id,\n          identity_sha256: prepared.identity.identity_sha256,\n          plan_sha256: prepared.identity.plan_sha256,\n          operation_id: prepared.identity.operation_id,\n          actor: prepared.identity.actor,\n          project_ref: prepared.identity.project_ref,\n          preflight_proof_sha256: preflight.preflight_proof_sha256,\n          preflight_token_sha256: sha256Text(preflight.preflight_token),\n          preflight_completed_at: preflight.completed_at,\n          preflight_expires_at: preflight.expires_at,\n          gate_results: gates.results,\n          gate_receipt_sha256: Object.fromEntries(\n            gates.proofs.map((proof) => [proof.gate, proof.receipt_sha256]),\n          ),\n          max_admit_posts: 1,\n          automatic_retry: false,\n        });\n\n        const admitRequest = dependencies.buildAdmitRequest({\n          preflight,\n          gateResults: gates.results,\n        });\n        try {\n          const admissionRaw = await dependencies.admitExecution({\n            context,\n            request: admitRequest,\n          });\n          admission = dependencies.parseAdmission(admissionRaw, prepared.identity, preflight);\n          writePrivateImmutableJson(prepared.artifacts.admission_response, {\n            proof: admission,\n            raw_response_sha256: sha256Json(admissionRaw),\n          });\n        } catch (error) {\n          writePrivateImmutableJson(prepared.artifacts.admission_transport_error, {\n            schema_version: 1,\n            request_id: prepared.identity.request_id,\n            observed_at_utc: new Date().toISOString(),\n            classification: 'ambiguous_consumed_attempt',\n            error: errorDetails(error),\n          });\n        }\n      }\n\n      const readback = await dependencies.readAndVerify({ command: options, prepared, context });\n      const report = buildReport({\n        command: options,\n        prepared,\n        admission,\n        proof: readback.proof,\n        verification: readback.verification,\n      });\n      persistVerificationArtifacts({\n        prepared,\n        proof: readback.proof,\n        verification: readback.verification,\n        report,\n      });\n      return report;\n    },\n  );\n}\n\nexport async function runDatasetMaintenanceProtected(\n  options: RunDatasetMaintenanceProtectedOptions,\n): Promise<DatasetMaintenanceProtectedReport> {\n  const prepared = prepareProtectedExecution(options);\n  return runPreparedProtectedExecution(options, prepared, {\n    withStateLock: withStateFileLock,\n    resolveContext: resolveMaintenanceRemoteContext,\n    fetchAccountRows: fetchMaintenanceAccountRows,\n    assertSupport: assertSupportSnapshots,\n    assertBaselines: assertDerivativeBaselines,\n    buildPreflightRequest: buildProtectedPreflightRequest,\n    preflightExecution: preflightMaintenanceAliasExecution,\n    parsePreflight: parseProtectedPreflightProof,\n    captureGates: captureProtectedGates,\n    buildAdmitRequest: buildProtectedAdmitRequest,\n    admitExecution: admitMaintenanceAliasExecution,\n    parseAdmission: parseProtectedAdmissionProof,\n    readAndVerify,\n  });\n}\n\nexport const __testInternals = {\n  allocateAttemptArtifacts,\n  appendPrivateJsonLine,\n  assertContextBindings,\n  assertDerivativeBaselines,\n  assertStrictBeforeState,\n  assertSupportSnapshots,\n  buildReport,\n  canonicalTerminalReport,\n  clock,\n  errorDetails,\n  nextAttemptReportPath,\n  normalizePollMs,\n  normalizeWaitSeconds,\n  prepareProtectedExecution,\n  prepareProtectedExecutionWithDependencies,\n  projectedRows,\n  readArtifact,\n  readAndVerify,\n  readAndVerifyWithDependencies,\n  runPreparedProtectedExecution,\n  captureProtectedGates,\n  captureProtectedGatesWithDependencies,\n  persistVerificationArtifacts,\n  validateExistingMarker,\n  writePrivateImmutableJson,\n};\n"]}
+{"version":3,"file":"dataset-maintenance-protected-run.js","sourceRoot":"","sources":["../../../src/lib/dataset-maintenance-protected-run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,yBAAyB,IAAI,+BAA+B,EAC5D,uBAAuB,IAAI,6BAA6B,EACxD,sBAAsB,IAAI,4BAA4B,EACtD,aAAa,IAAI,mBAAmB,GACrC,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,YAAY,EACZ,UAAU,EACV,UAAU,EACV,cAAc,GAIf,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,4BAA4B,EAC5B,+BAA+B,EAC/B,gCAAgC,EAChC,0BAA0B,EAC1B,+BAA+B,EAC/B,8BAA8B,EAC9B,4BAA4B,EAC5B,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,4BAA4B,EAC5B,yBAAyB,GAS1B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACL,oCAAoC,EACpC,mCAAmC,GACpC,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACL,wBAAwB,GAEzB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,wCAAwC,EAAE,MAAM,+BAA+B,CAAC;AACzF,OAAO,EACL,8BAA8B,EAC9B,oCAAoC,EACpC,2BAA2B,EAC3B,4BAA4B,EAC5B,kCAAkC,EAClC,6BAA6B,EAC7B,+BAA+B,GAEhC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAkEpD,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,MAAM,GAAG,iBAAiB,CAAC;AAEjC,SAAS,oBAAoB,CAAC,KAAc;IAC1C,MAAM,UAAU,GAAG,KAAK,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,IAAI,UAAU,GAAG,MAAM,EAAE,CAAC;QAC3E,MAAM,IAAI,QAAQ,CAAC,qDAAqD,EAAE;YACxE,IAAI,EAAE,4CAA4C;YAClD,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,UAAU,GAAG,KAAK,IAAI,eAAe,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,GAAG,IAAI,UAAU,GAAG,MAAM,EAAE,CAAC;QAC7E,MAAM,IAAI,QAAQ,CAAC,kDAAkD,EAAE;YACrE,IAAI,EAAE,4CAA4C;YAClD,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,KAAK,CAAC,OAA8C;IAC3D,OAAO,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO;QACL,IAAI,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO;QACnD,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAC/D,IAAI,EACF,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;YACrF,CAAC,CAAC,KAAK,CAAC,IAAI;YACZ,CAAC,CAAC,IAAI;KACX,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,OAA4C;IAMhE,MAAM,QAAQ,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACpD,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,WAAW,EAAE,QAAQ,CAAC,WAAW;KAClC,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CAAC,OAItC;IACC,IAAI,OAAO,CAAC,IAAI,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC1D,MAAM,IAAI,QAAQ,CAAC,GAAG,OAAO,CAAC,KAAK,yDAAyD,EAAE;YAC5F,IAAI,EAAE,qDAAqD;YAC3D,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,SAAiB;IAC/C,8BAA8B,CAAC,SAAS,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAgB,EAAE,KAAc;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxC,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/C,cAAc,CAAC,QAAQ,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE;QACrD,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,GAAG;QACT,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IACH,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC3B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAc;IAC3C,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,OAAO,oBAAoB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACtF,OAAO,IAAI,CAAC,CAAC;IACf,CAAC;IACD,OAAO,oBAAoB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAE,CAAC;AACnD,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAc,EAAE,OAAe;IAC3D,MAAM,MAAM,GAAG,WAAW,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IAC7D,OAAO;QACL,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,wBAAwB,MAAM,OAAO,CAAC;QACxD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,4BAA4B,MAAM,OAAO,CAAC;QAC5D,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,8BAA8B,MAAM,OAAO,CAAC;QAC9D,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,gCAAgC,MAAM,OAAO,CAAC;QAChE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,iCAAiC,MAAM,OAAO,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,QAAoC;IAEpC,MAAM,aAAa,GAAG,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC;IAC1F,OAAO;QACL,GAAG,QAAQ;QACX,SAAS,EAAE;YACT,GAAG,QAAQ,CAAC,SAAS;YACrB,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,4BAA4B,MAAM,OAAO,CAAC;YACrF,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,8BAA8B,MAAM,OAAO,CAAC;YACzF,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,gCAAgC,MAAM,OAAO,CAAC;YAC7F,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAC5B,QAAQ,CAAC,MAAM,EACf,iCAAiC,MAAM,OAAO,CAC/C;YACD,cAAc,EAAE,aAAa;SAC9B;KACF,CAAC;AACJ,CAAC;AAaD,SAAS,yCAAyC,CAChD,OAA8C,EAC9C,YAA8C;IAE9C,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;QAC1C,MAAM,IAAI,QAAQ,CAAC,6CAA6C,EAAE;YAChE,IAAI,EAAE,4CAA4C;YAClD,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;IACD,IACE,OAAO,CAAC,MAAM;QACd,CAAC,CAAC,OAAO,CAAC,gBAAgB;YACxB,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;YACtC,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ;YACnC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAC1B,CAAC;QACD,MAAM,IAAI,QAAQ,CAAC,sEAAsE,EAAE;YACzF,IAAI,EAAE,iDAAiD;YACvD,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;IACD,oBAAoB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1C,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAChC,4BAA4B,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE/C,MAAM,YAAY,GAAG,YAAY,CAAC,YAAY,CAAC;QAC7C,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,kBAAkB;KAC1B,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,YAAY,CAAC,YAAY,CAAC;QAC/C,QAAQ,EAAE,OAAO,CAAC,UAAU;QAC5B,KAAK,EAAE,4BAA4B;KACpC,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,YAAY,CAAC,YAAY,CAAC;QACjD,QAAQ,EAAE,OAAO,CAAC,YAAY;QAC9B,KAAK,EAAE,8BAA8B;KACtC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,oCAAoC,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,gBAAgB,GAAG,YAAY,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,YAAY,CAAC,aAAa,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACpE,6BAA6B,CAAC;QAC5B,KAAK,EAAE,4BAA4B;QACnC,IAAI,EAAE,cAAc,CAAC,IAAI;QACzB,KAAK,EAAE,MAAM;KACd,CAAC,CAAC;IACH,6BAA6B,CAAC;QAC5B,KAAK,EAAE,8BAA8B;QACrC,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,KAAK,EAAE,QAAQ;KAChB,CAAC,CAAC;IACH,YAAY,CAAC,uBAAuB,CAAC;QACnC,IAAI;QACJ,cAAc,EAAE,YAAY,CAAC,WAAW;QACxC,sBAAsB,EAAE,UAAU,CAAC,gBAAgB,CAAC;QACpD,MAAM;KACP,CAAC,CAAC;IACH,YAAY,CAAC,sBAAsB,CAAC;QAClC,QAAQ;QACR,MAAM;QACN,gBAAgB,EAAE,cAAc,CAAC,WAAW;QAC5C,kBAAkB,EAAE,gBAAgB,CAAC,WAAW;QAChD,gBAAgB,EAAE,OAAO,CAAC,UAAU;YAClC,CAAC,CAAC,QAAQ,CAAC,wBAAwB;YACnC,CAAC,CAAC,OAAO,CAAC,gBAAgB;KAC7B,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,YAAY,CAAC,aAAa,CAAC;QAC1C,MAAM;QACN,QAAQ;QACR,gBAAgB,EAAE,cAAc,CAAC,WAAW;QAC5C,kBAAkB,EAAE,gBAAgB,CAAC,WAAW;KACjD,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,mCAAmC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG;QAChB,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,+BAA+B,CAAC;QAClE,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,mCAAmC,CAAC;QAC1E,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,+BAA+B,CAAC;QACjE,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,mCAAmC,CAAC;QAC1E,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,mCAAmC,CAAC;QAC1E,yBAAyB,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,0CAA0C,CAAC;QACxF,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,iCAAiC,CAAC;QACrE,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,iCAAiC,CAAC;QACtE,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,mCAAmC,CAAC;QAC1E,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,+BAA+B,CAAC;QAClE,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,oCAAoC,CAAC;QAC5E,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,gCAAgC,CAAC;QACpE,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,uCAAuC,CAAC;KAC3E,CAAC;IACF,OAAO;QACL,QAAQ;QACR,OAAO;QACP,UAAU,EAAE,cAAc,CAAC,QAAQ;QACnC,YAAY,EAAE,gBAAgB,CAAC,QAAQ;QACvC,MAAM;QACN,IAAI;QACJ,MAAM;QACN,QAAQ;QACR,QAAQ;QACR,gBAAgB;QAChB,SAAS;KACV,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,OAA8C;IAE9C,OAAO,yCAAyC,CAAC,OAAO,EAAE;QACxD,YAAY;QACZ,SAAS,EAAE,oBAAoB;QAC/B,cAAc,EAAE,qBAAqB;QACrC,WAAW,EAAE,oBAAoB;QACjC,aAAa,EAAE,sBAAsB;QACrC,uBAAuB,EAAE,gCAAgC;QACzD,sBAAsB,EAAE,+BAA+B;QACvD,aAAa,EAAE,+BAA+B;KAC/C,CAAC,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB,CAAC,OAK9B;IACC,IACE,OAAO,CAAC,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW;QACrE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO;QAC3E,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK;QACvE,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EACrE,CAAC;QACD,MAAM,IAAI,QAAQ,CAChB,kGAAkG,EAClG;YACE,IAAI,EAAE,gDAAgD;YACtD,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE;gBACP,oBAAoB,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW;gBAC3D,oBAAoB,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW;gBACjD,gBAAgB,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO;gBACzD,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO;aAClD;SACF,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,OAItB;IACC,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,uBAAuB,CAAC,OAIhC;IACC,6BAA6B,CAAC;QAC5B,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI;QAC3B,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,OAAO;QACjC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO;QACpD,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,OAGrC;IACC,MAAM,4BAA4B,CAAC;QACjC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI;QAC3B,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO;QACpD,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,OAGxC;IACC,MAAM,+BAA+B,CAAC;QACpC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO;QACpD,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,iBAAiB,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB;KAChE,CAAC,CAAC;AACL,CAAC;AASD,KAAK,UAAU,qCAAqC,CAClD,OAKC,EACD,YAAuC;IASvC,MAAM,SAAS,GAAG,CAAC,sBAAsB,EAAE,kBAAkB,EAAE,uBAAuB,CAAU,CAAC;IACjG,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC;YACzC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU;YAC/C,cAAc,EAAE,OAAO,CAAC,SAAS,CAAC,eAAe;YACjD,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CAAC,SAAS,CAAC,GAAG,EAAE;YACxC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ;YACnC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,IAAI;SACL,CAAC,CAAC;QACH,YAAY,CAAC,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE;YAC9C,eAAe,EAAE,YAAY,CAAC,MAAM,EAAE;YACtC,KAAK;YACL,mBAAmB,EAAE,UAAU,CAAC,GAAG,CAAC;SACrC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,OAAO;QACL,MAAM;QACN,OAAO,EAAE;YACP,oBAAoB,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,MAAM;YACvC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,MAAM;YACnC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,MAAM;SACzC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,OAKpC;IAQC,OAAO,qCAAqC,CAAC,OAAO,EAAE;QACpD,WAAW,EAAE,oCAAoC;QACjD,SAAS,EAAE,uBAAuB;QAClC,aAAa,EAAE,qBAAqB;QACpC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACvC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAC7B,UAAkB,EAClB,QAAoC;IAEpC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,8BAA8B,CAAC,CAAC;IACxE,IACE,CAAC,YAAY,CAAC,MAAM,CAAC;QACrB,MAAM,CAAC,cAAc,KAAK,4BAA4B,CAAC,aAAa;QACpE,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;QACzC,MAAM,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;QACnD,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;QAC3C,MAAM,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY;QAC7C,MAAM,CAAC,eAAe,KAAK,CAAC;QAC5B,MAAM,CAAC,eAAe,KAAK,KAAK,EAChC,CAAC;QACD,MAAM,IAAI,QAAQ,CAAC,+DAA+D,EAAE;YAClF,IAAI,EAAE,8CAA8C;YACpD,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AASD,KAAK,UAAU,6BAA6B,CAC1C,OAIC,EACD,YAAuC;IAKvC,MAAM,WAAW,GAAG,oBAAoB,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,WAAW,GAAG,KAAK,CAAC;IAC5D,MAAM,KAAK,GACT,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/F,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,GAAe,CAAC;QACpB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC;gBACrC,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU;aAChD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE;gBAChE,eAAe,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACzC,MAAM,EAAE,YAAY;gBACpB,WAAW,EAAE,kBAAkB;gBAC/B,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;aAC3B,CAAC,CAAC;YACH,IAAI,YAAY,CAAC,KAAK,EAAE,GAAG,QAAQ,EAAE,CAAC;gBACpC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5E,SAAS;YACX,CAAC;YACD,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,YAAY,EAAE;oBACZ,MAAM,EAAE,eAAe;oBACvB,MAAM,EAAE;wBACN;4BACE,IAAI,EAAE,mCAAmC;4BACzC,OAAO,EACL,8EAA8E;4BAChF,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC;yBAC7B;qBACF;oBACD,gBAAgB,EAAE,IAAI;oBACtB,mBAAmB,EAAE,IAAI;iBAC1B;aACF,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,YAAY,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACvE,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE;YAChE,eAAe,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACzC,KAAK;YACL,mBAAmB,EAAE,UAAU,CAAC,GAAG,CAAC;SACrC,CAAC,CAAC;QACH,MAAM,0BAA0B,GAC9B,KAAK,CAAC,gBAAgB,KAAK,cAAc,IAAI,YAAY,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC;QAC/E,IACE,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,0BAA0B,CAAC;YAC3D,YAAY,CAAC,KAAK,EAAE,IAAI,QAAQ,EAChC,CAAC;YACD,IAAI,CAAC;gBACH,OAAO;oBACL,KAAK;oBACL,YAAY,EAAE,MAAM,YAAY,CAAC,eAAe,CAAC;wBAC/C,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI;wBAC3B,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,OAAO;wBACjC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ;wBACnC,KAAK;wBACL,OAAO,EAAE,OAAO,CAAC,OAAO;wBACxB,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ;qBACnC,CAAC;iBACH,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE;oBAChE,eAAe,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACzC,MAAM,EAAE,oBAAoB;oBAC5B,WAAW,EAAE,2BAA2B;oBACxC,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;iBAC3B,CAAC,CAAC;gBACH,IAAI,YAAY,CAAC,KAAK,EAAE,GAAG,QAAQ,EAAE,CAAC;oBACpC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC5E,SAAS;gBACX,CAAC;gBACD,OAAO;oBACL,KAAK;oBACL,YAAY,EAAE;wBACZ,MAAM,EAAE,eAAe;wBACvB,MAAM,EAAE;4BACN;gCACE,IAAI,EAAE,yCAAyC;gCAC/C,OAAO,EACL,2EAA2E;gCAC7E,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC;6BAC7B;yBACF;wBACD,gBAAgB,EAAE,IAAI;wBACtB,mBAAmB,EAAE,IAAI;qBAC1B;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,OAI5B;IAIC,OAAO,6BAA6B,CAAC,OAAO,EAAE;QAC5C,aAAa,EAAE,6BAA6B;QAC5C,WAAW,EAAE,yBAAyB;QACtC,eAAe,EAAE,wBAAwB;QACzC,KAAK,EAAE,IAAI,CAAC,GAAG;KAChB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,OAMpB;IACC,OAAO;QACL,cAAc,EAAE,4BAA4B,CAAC,aAAa;QAC1D,gBAAgB,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC1C,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ;QAC3D,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,MAAM;QACnC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU;QAChD,eAAe,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe;QAC1D,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW;QAC9C,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY;QAChD,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK;QACtC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW;QAClD,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,eAAe,EAAE,OAAO,CAAC,KAAK;QAC9B,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,MAAM;QACnC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS;KACtC,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,MAAyC;IACxE,OAAO;QACL,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,aAAa,EAAE,8BAA8B;QAC7C,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,OAKrC;IACC,IAAI,OAAO,CAAC,KAAK,EAAE,gBAAgB,EAAE,CAAC;QACpC,yBAAyB,CACvB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,cAAc,EACzC,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAC/B,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC;QAC1C,yBAAyB,CACvB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,gBAAgB,EAC3C,OAAO,CAAC,YAAY,CAAC,gBAAgB,CACtC,CAAC;QACF,yBAAyB,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,kBAAkB,EAAE;YACvE,0BAA0B,EAAE,UAAU,CACpC,wCAAwC,CAAC,OAAO,CAAC,YAAY,CAAC,gBAAgB,CAAC,IAAI,CAAC,CACrF;YACD,mCAAmC,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,0BAA0B;SACtF,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,CAAC,mBAAmB,EAAE,CAAC;QAC7C,yBAAyB,CACvB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,mBAAmB,EAC9C,OAAO,CAAC,YAAY,CAAC,mBAAmB,CACzC,CAAC;IACJ,CAAC;IACD,MAAM,yBAAyB,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAChE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,yCAAyC,CACpE,CAAC;IACF,yBAAyB,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACrF,IACE,OAAO,CAAC,KAAK;QACb,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS;QAClC,OAAO,CAAC,KAAK,CAAC,gBAAgB,KAAK,cAAc;QACjD,CAAC,yBAAyB;QAC1B,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC,EACvD,CAAC;QACD,yBAAyB,CACvB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,EAC1C,uBAAuB,CAAC,OAAO,CAAC,MAAM,CAAC,CACxC,CAAC;IACJ,CAAC;AACH,CAAC;AAkBD,KAAK,UAAU,6BAA6B,CAC1C,OAA8C,EAC9C,YAAwC,EACxC,YAA0C;IAE1C,sBAAsB,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAC5C,OAAO,YAAY,CAAC,aAAa,CAC/B,YAAY,CAAC,SAAS,CAAC,kBAAkB,EACzC,EAAE,MAAM,EAAE,iCAAiC,YAAY,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,EAC/E,KAAK,IAAI,EAAE;QACT,yBAAyB,CAAC,YAAY,CAAC,SAAS,CAAC,cAAc,EAAE;YAC/D,cAAc,EAAE,4BAA4B,CAAC,aAAa;YAC1D,UAAU,EAAE,YAAY,CAAC,QAAQ,CAAC,UAAU;YAC5C,eAAe,EAAE,YAAY,CAAC,QAAQ,CAAC,eAAe;YACtD,SAAS,EAAE,YAAY,CAAC,QAAQ;YAChC,WAAW,EAAE,YAAY,CAAC,UAAU;YACpC,aAAa,EAAE,YAAY,CAAC,YAAY;YACxC,WAAW,EAAE,YAAY,CAAC,IAAI,CAAC,WAAW;YAC1C,YAAY,EAAE,YAAY,CAAC,IAAI,CAAC,YAAY;YAC5C,WAAW,EAAE,YAAY,CAAC,QAAQ,CAAC,WAAW;YAC9C,KAAK,EAAE,YAAY,CAAC,QAAQ,CAAC,KAAK;YAClC,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC,QAAQ;SACzC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,wBAAwB,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,cAAc,GAAG,sBAAsB,CAC3C,QAAQ,CAAC,SAAS,CAAC,kBAAkB,EACrC,QAAQ,CAAC,QAAQ,CAClB,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,IAAI,cAAc,EAAE,CAAC;YACrC,MAAM,IAAI,QAAQ,CAChB,6FAA6F,EAC7F;gBACE,IAAI,EAAE,8CAA8C;gBACpD,QAAQ,EAAE,CAAC;aACZ,CACF,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,cAAc,CAAC;YAChD,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;QACH,qBAAqB,CAAC;YACpB,QAAQ;YACR,OAAO;YACP,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;QAEH,IAAI,SAAS,GAAmC,IAAI,CAAC;QACrD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,gBAAgB,CAAC;gBAClD,OAAO;gBACP,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO;gBACvC,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B,CAAC,CAAC;YACH,uBAAuB,CAAC;gBACtB,QAAQ;gBACR,WAAW,EAAE,OAAO,CAAC,IAAI;gBACzB,YAAY,EAAE,OAAO,CAAC,YAAY;aACnC,CAAC,CAAC;YACH,MAAM,YAAY,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YACxD,MAAM,YAAY,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YAE1D,MAAM,gBAAgB,GAAG,YAAY,CAAC,qBAAqB,CAAC;gBAC1D,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,IAAI,EAAE,QAAQ,CAAC,gBAAgB;gBAC/B,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;aAC5B,CAAC,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,kBAAkB,CAAC;gBACzD,OAAO;gBACP,OAAO,EAAE,gBAAgB;aAC1B,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,YAAY,CAAC,cAAc,CAC3C,YAAY,EACZ,QAAQ,CAAC,QAAQ,EACjB,KAAK,CAAC,OAAO,CAAC,CACf,CAAC;YACF,MAAM,EAAE,eAAe,EAAE,cAAc,EAAE,GAAG,iBAAiB,EAAE,GAAG,SAAS,CAAC;YAC5E,yBAAyB,CAAC,QAAQ,CAAC,SAAS,CAAC,kBAAkB,EAAE;gBAC/D,KAAK,EAAE,iBAAiB;gBACxB,sBAAsB,EAAE,UAAU,CAAC,cAAc,CAAC;gBAClD,mBAAmB,EAAE,UAAU,CAAC,YAAY,CAAC;aAC9C,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC;gBAC5C,QAAQ;gBACR,OAAO;gBACP,SAAS;gBACT,WAAW,EAAE,QAAQ,CAAC,SAAS,CAAC,aAAa;aAC9C,CAAC,CAAC;YACH,yBAAyB,CAAC,QAAQ,CAAC,SAAS,CAAC,kBAAkB,EAAE;gBAC/D,cAAc,EAAE,4BAA4B,CAAC,aAAa;gBAC1D,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE;gBAC7C,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,UAAU;gBACxC,eAAe,EAAE,QAAQ,CAAC,QAAQ,CAAC,eAAe;gBAClD,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,WAAW;gBAC1C,YAAY,EAAE,QAAQ,CAAC,QAAQ,CAAC,YAAY;gBAC5C,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK;gBAC9B,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,WAAW;gBAC1C,sBAAsB,EAAE,SAAS,CAAC,sBAAsB;gBACxD,sBAAsB,EAAE,UAAU,CAAC,SAAS,CAAC,eAAe,CAAC;gBAC7D,sBAAsB,EAAE,SAAS,CAAC,YAAY;gBAC9C,oBAAoB,EAAE,SAAS,CAAC,UAAU;gBAC1C,YAAY,EAAE,KAAK,CAAC,OAAO;gBAC3B,mBAAmB,EAAE,MAAM,CAAC,WAAW,CACrC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC,CAChE;gBACD,eAAe,EAAE,CAAC;gBAClB,eAAe,EAAE,KAAK;aACvB,CAAC,CAAC;YAEH,MAAM,YAAY,GAAG,YAAY,CAAC,iBAAiB,CAAC;gBAClD,SAAS;gBACT,WAAW,EAAE,KAAK,CAAC,OAAO;aAC3B,CAAC,CAAC;YACH,IAAI,CAAC;gBACH,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,cAAc,CAAC;oBACrD,OAAO;oBACP,OAAO,EAAE,YAAY;iBACtB,CAAC,CAAC;gBACH,SAAS,GAAG,YAAY,CAAC,cAAc,CAAC,YAAY,EAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;gBACpF,yBAAyB,CAAC,QAAQ,CAAC,SAAS,CAAC,kBAAkB,EAAE;oBAC/D,KAAK,EAAE,SAAS;oBAChB,mBAAmB,EAAE,UAAU,CAAC,YAAY,CAAC;iBAC9C,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,yBAAyB,CAAC,QAAQ,CAAC,SAAS,CAAC,yBAAyB,EAAE;oBACtE,cAAc,EAAE,CAAC;oBACjB,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,UAAU;oBACxC,eAAe,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACzC,cAAc,EAAE,4BAA4B;oBAC5C,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;iBAC3B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3F,MAAM,MAAM,GAAG,WAAW,CAAC;YACzB,OAAO,EAAE,OAAO;YAChB,QAAQ;YACR,SAAS;YACT,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,YAAY,EAAE,QAAQ,CAAC,YAAY;SACpC,CAAC,CAAC;QACH,4BAA4B,CAAC;YAC3B,QAAQ;YACR,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,MAAM;SACP,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,OAA8C;IAE9C,MAAM,QAAQ,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACpD,OAAO,6BAA6B,CAAC,OAAO,EAAE,QAAQ,EAAE;QACtD,aAAa,EAAE,iBAAiB;QAChC,cAAc,EAAE,+BAA+B;QAC/C,gBAAgB,EAAE,2BAA2B;QAC7C,aAAa,EAAE,sBAAsB;QACrC,eAAe,EAAE,yBAAyB;QAC1C,qBAAqB,EAAE,8BAA8B;QACrD,kBAAkB,EAAE,kCAAkC;QACtD,cAAc,EAAE,4BAA4B;QAC5C,YAAY,EAAE,qBAAqB;QACnC,iBAAiB,EAAE,0BAA0B;QAC7C,cAAc,EAAE,8BAA8B;QAC9C,cAAc,EAAE,4BAA4B;QAC5C,aAAa;KACd,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,wBAAwB;IACxB,qBAAqB;IACrB,6BAA6B;IAC7B,qBAAqB;IACrB,yBAAyB;IACzB,uBAAuB;IACvB,sBAAsB;IACtB,WAAW;IACX,uBAAuB;IACvB,KAAK;IACL,YAAY;IACZ,qBAAqB;IACrB,eAAe;IACf,oBAAoB;IACpB,yBAAyB;IACzB,yCAAyC;IACzC,aAAa;IACb,YAAY;IACZ,aAAa;IACb,6BAA6B;IAC7B,6BAA6B;IAC7B,qBAAqB;IACrB,qCAAqC;IACrC,4BAA4B;IAC5B,sBAAsB;IACtB,yBAAyB;CAC1B,CAAC","sourcesContent":["import { appendFileSync, chmodSync, existsSync } from 'node:fs';\nimport path from 'node:path';\nimport { buildAliasPlanRequest } from './dataset-maintenance-alias-request.js';\nimport {\n  ensurePrivateArtifactDirectory,\n  readProtectedJsonArtifact,\n  writePrivateImmutableJson,\n} from './dataset-maintenance-protected-artifacts.js';\nimport {\n  assertDerivativeBaselines as assertSharedDerivativeBaselines,\n  assertStrictBeforeState as assertSharedStrictBeforeState,\n  assertSupportSnapshots as assertSharedSupportSnapshots,\n  projectedRows as sharedProjectedRows,\n} from './dataset-maintenance-protected-before.js';\nimport {\n  isJsonObject,\n  parseMaintenancePlan,\n  readJsonFile,\n  sha256Json,\n  sha256Text,\n  stableJsonText,\n  type DatasetMaintenancePlan,\n  type DatasetMaintenanceRemoteRow,\n  type JsonObject,\n} from './dataset-maintenance-contract.js';\nimport {\n  PROTECTED_EXECUTION_CONTRACT,\n  assertProtectedApprovalBindings,\n  assertProtectedFreezeMatchesPlan,\n  buildProtectedAdmitRequest,\n  buildProtectedExecutionIdentity,\n  buildProtectedPreflightRequest,\n  parseProtectedAdmissionProof,\n  parseProtectedApproval,\n  parseProtectedFreeze,\n  parseProtectedGateProof,\n  parseProtectedPreflightProof,\n  parseProtectedStatusProof,\n  type DatasetMaintenanceProtectedApproval,\n  type DatasetMaintenanceProtectedFreeze,\n  type ProtectedAdmissionProof,\n  type ProtectedExecutionIdentity,\n  type ProtectedExecutionStatusProof,\n  type ProtectedGateProof,\n  type ProtectedPreflightProof,\n  type ProtectedReportStatus,\n} from './dataset-maintenance-protected-contract.js';\nimport {\n  assertProtectedPreparationPlanSha256,\n  assertProtectedProductionProjectRef,\n} from './dataset-maintenance-protected-preparation.js';\nimport {\n  verifyProtectedExecution,\n  type ProtectedVerificationResult,\n} from './dataset-maintenance-protected-verify.js';\nimport { maintenanceProjectedReferenceFingerprint } from './dataset-maintenance-plan.js';\nimport {\n  admitMaintenanceAliasExecution,\n  captureMaintenanceAliasExecutionGate,\n  fetchMaintenanceAccountRows,\n  normalizeMaintenancePageSize,\n  preflightMaintenanceAliasExecution,\n  readMaintenanceAliasExecution,\n  resolveMaintenanceRemoteContext,\n  type DatasetMaintenanceRemoteContext,\n} from './dataset-maintenance-remote.js';\nimport { CliError } from './errors.js';\nimport type { FetchLike } from './http.js';\nimport { withStateFileLock } from './state-lock.js';\n\nexport type RunDatasetMaintenanceProtectedOptions = {\n  planPath: string;\n  freezePath: string;\n  approvalPath: string;\n  outDir: string;\n  commit: boolean;\n  statusOnly: boolean;\n  approveExecution?: string;\n  confirm?: string;\n  waitSeconds?: number;\n  pollMs?: number;\n  pageSize?: number;\n  timeoutMs?: number;\n  env: NodeJS.ProcessEnv;\n  fetchImpl: FetchLike;\n  now?: Date;\n  sleep?: (ms: number) => Promise<void>;\n};\n\nexport type DatasetMaintenanceProtectedReport = {\n  schema_version: typeof PROTECTED_EXECUTION_CONTRACT.report_schema;\n  generated_at_utc: string;\n  mode: 'commit' | 'status_only';\n  status: ProtectedReportStatus;\n  request_id: string;\n  identity_sha256: string;\n  plan_sha256: string;\n  operation_id: string;\n  actor: { user_id: string; email: string };\n  project_ref: string;\n  admission: ProtectedAdmissionProof | null;\n  database_status: ProtectedExecutionStatusProof | null;\n  issues: Array<{ code: string; message: string; details?: unknown }>;\n  artifacts: {\n    execution_seal: string;\n    preflight_evidence: string;\n    gate_receipts: string;\n    submission_attempt: string;\n    admission_response: string;\n    admission_transport_error: string;\n    status_progress: string;\n    primary_readback: string;\n    reference_readback: string;\n    audit_readback: string;\n    derivative_readback: string;\n    terminal_report: string;\n    attempt_report: string;\n  };\n};\n\ntype PreparedProtectedExecution = {\n  planPath: string;\n  planDir: string;\n  freezePath: string;\n  approvalPath: string;\n  outDir: string;\n  plan: DatasetMaintenancePlan;\n  freeze: DatasetMaintenanceProtectedFreeze;\n  approval: DatasetMaintenanceProtectedApproval;\n  identity: ProtectedExecutionIdentity;\n  aliasPlanRequest: JsonObject;\n  artifacts: DatasetMaintenanceProtectedReport['artifacts'];\n};\n\nconst DEFAULT_POLL_MS = 10_000;\nconst SHA256 = /^[a-f0-9]{64}$/u;\n\nfunction normalizeWaitSeconds(value?: number): number {\n  const normalized = value ?? 0;\n  if (!Number.isInteger(normalized) || normalized < 0 || normalized > 86_400) {\n    throw new CliError('waitSeconds must be an integer between 0 and 86400.', {\n      code: 'DATASET_MAINTENANCE_PROTECTED_WAIT_INVALID',\n      exitCode: 2,\n    });\n  }\n  return normalized;\n}\n\nfunction normalizePollMs(value?: number): number {\n  const normalized = value ?? DEFAULT_POLL_MS;\n  if (!Number.isInteger(normalized) || normalized < 100 || normalized > 60_000) {\n    throw new CliError('pollMs must be an integer between 100 and 60000.', {\n      code: 'DATASET_MAINTENANCE_PROTECTED_POLL_INVALID',\n      exitCode: 2,\n    });\n  }\n  return normalized;\n}\n\nfunction clock(options: RunDatasetMaintenanceProtectedOptions): Date {\n  return options.now ?? new Date();\n}\n\nfunction errorDetails(error: unknown): { name: string; message: string; code: string | null } {\n  return {\n    name: error instanceof Error ? error.name : 'Error',\n    message: error instanceof Error ? error.message : String(error),\n    code:\n      error && typeof error === 'object' && 'code' in error && typeof error.code === 'string'\n        ? error.code\n        : null,\n  };\n}\n\nfunction readArtifact(options: { filePath: string; label: string }): {\n  resolved: string;\n  value: unknown;\n  text: string;\n  file_sha256: string;\n} {\n  const artifact = readProtectedJsonArtifact(options);\n  return {\n    resolved: artifact.resolved,\n    value: artifact.value,\n    text: artifact.text,\n    file_sha256: artifact.file_sha256,\n  };\n}\n\nfunction assertCanonicalParsedArtifact(options: {\n  label: string;\n  text: string;\n  value: unknown;\n}): void {\n  if (options.text !== `${stableJsonText(options.value)}\\n`) {\n    throw new CliError(`${options.label} must be canonical JSON with exactly one final newline.`, {\n      code: 'DATASET_MAINTENANCE_PROTECTED_ARTIFACT_NONCANONICAL',\n      exitCode: 2,\n    });\n  }\n}\n\nfunction ensurePrivateDirectory(directory: string): void {\n  ensurePrivateArtifactDirectory(directory);\n}\n\nfunction appendPrivateJsonLine(filePath: string, value: unknown): string {\n  const resolved = path.resolve(filePath);\n  ensurePrivateDirectory(path.dirname(resolved));\n  appendFileSync(resolved, `${stableJsonText(value)}\\n`, {\n    encoding: 'utf8',\n    flag: 'a',\n    mode: 0o600,\n  });\n  chmodSync(resolved, 0o600);\n  return resolved;\n}\n\nfunction nextAttemptReportPath(outDir: string): string {\n  let attempt = 1;\n  while (attemptArtifactPaths(outDir, attempt).some((filePath) => existsSync(filePath))) {\n    attempt += 1;\n  }\n  return attemptArtifactPaths(outDir, attempt)[0]!;\n}\n\nfunction attemptArtifactPaths(outDir: string, attempt: number): string[] {\n  const suffix = `attempt-${String(attempt).padStart(4, '0')}`;\n  return [\n    path.join(outDir, `protected-run-report.${suffix}.json`),\n    path.join(outDir, `protected-audit-readback.${suffix}.json`),\n    path.join(outDir, `protected-primary-readback.${suffix}.json`),\n    path.join(outDir, `protected-reference-readback.${suffix}.json`),\n    path.join(outDir, `protected-derivative-readback.${suffix}.json`),\n  ];\n}\n\nfunction allocateAttemptArtifacts(\n  prepared: PreparedProtectedExecution,\n): PreparedProtectedExecution {\n  const attemptReport = nextAttemptReportPath(prepared.outDir);\n  const suffix = path.basename(attemptReport, '.json').replace('protected-run-report.', '');\n  return {\n    ...prepared,\n    artifacts: {\n      ...prepared.artifacts,\n      audit_readback: path.join(prepared.outDir, `protected-audit-readback.${suffix}.json`),\n      primary_readback: path.join(prepared.outDir, `protected-primary-readback.${suffix}.json`),\n      reference_readback: path.join(prepared.outDir, `protected-reference-readback.${suffix}.json`),\n      derivative_readback: path.join(\n        prepared.outDir,\n        `protected-derivative-readback.${suffix}.json`,\n      ),\n      attempt_report: attemptReport,\n    },\n  };\n}\n\ntype ProtectedPreparationDependencies = {\n  readArtifact: typeof readArtifact;\n  parsePlan: typeof parseMaintenancePlan;\n  buildAliasPlan: typeof buildAliasPlanRequest;\n  parseFreeze: typeof parseProtectedFreeze;\n  parseApproval: typeof parseProtectedApproval;\n  assertFreezeMatchesPlan: typeof assertProtectedFreezeMatchesPlan;\n  assertApprovalBindings: typeof assertProtectedApprovalBindings;\n  buildIdentity: typeof buildProtectedExecutionIdentity;\n};\n\nfunction prepareProtectedExecutionWithDependencies(\n  options: RunDatasetMaintenanceProtectedOptions,\n  dependencies: ProtectedPreparationDependencies,\n): PreparedProtectedExecution {\n  if (options.commit === options.statusOnly) {\n    throw new CliError('Choose exactly one of commit or statusOnly.', {\n      code: 'DATASET_MAINTENANCE_PROTECTED_MODE_INVALID',\n      exitCode: 2,\n    });\n  }\n  if (\n    options.commit &&\n    (!options.approveExecution ||\n      !SHA256.test(options.approveExecution) ||\n      typeof options.confirm !== 'string' ||\n      !options.confirm.trim())\n  ) {\n    throw new CliError('Protected commit requires the exact approval hash and account email.', {\n      code: 'DATASET_MAINTENANCE_PROTECTED_APPROVAL_REQUIRED',\n      exitCode: 2,\n    });\n  }\n  normalizeWaitSeconds(options.waitSeconds);\n  normalizePollMs(options.pollMs);\n  normalizeMaintenancePageSize(options.pageSize);\n\n  const planArtifact = dependencies.readArtifact({\n    filePath: options.planPath,\n    label: 'Maintenance plan',\n  });\n  const freezeArtifact = dependencies.readArtifact({\n    filePath: options.freezePath,\n    label: 'Protected execution freeze',\n  });\n  const approvalArtifact = dependencies.readArtifact({\n    filePath: options.approvalPath,\n    label: 'Protected execution approval',\n  });\n  const plan = dependencies.parsePlan(planArtifact.value);\n  if (options.commit) {\n    assertProtectedPreparationPlanSha256(plan.plan_sha256, 'plan.plan_sha256');\n  }\n  const planPath = planArtifact.resolved;\n  const planDir = path.dirname(planPath);\n  const aliasPlanRequest = dependencies.buildAliasPlan({ plan, planDir });\n  const freeze = dependencies.parseFreeze(freezeArtifact.value);\n  const approval = dependencies.parseApproval(approvalArtifact.value);\n  assertCanonicalParsedArtifact({\n    label: 'Protected execution freeze',\n    text: freezeArtifact.text,\n    value: freeze,\n  });\n  assertCanonicalParsedArtifact({\n    label: 'Protected execution approval',\n    text: approvalArtifact.text,\n    value: approval,\n  });\n  dependencies.assertFreezeMatchesPlan({\n    plan,\n    planFileSha256: planArtifact.file_sha256,\n    aliasPlanRequestSha256: sha256Json(aliasPlanRequest),\n    freeze,\n  });\n  dependencies.assertApprovalBindings({\n    approval,\n    freeze,\n    freezeFileSha256: freezeArtifact.file_sha256,\n    approvalFileSha256: approvalArtifact.file_sha256,\n    approveExecution: options.statusOnly\n      ? approval.approval_identity_sha256\n      : options.approveExecution,\n  });\n  const identity = dependencies.buildIdentity({\n    freeze,\n    approval,\n    freezeFileSha256: freezeArtifact.file_sha256,\n    approvalFileSha256: approvalArtifact.file_sha256,\n  });\n  if (options.commit) {\n    assertProtectedProductionProjectRef(identity.project_ref);\n  }\n  const outDir = path.resolve(options.outDir);\n  const artifacts = {\n    execution_seal: path.join(outDir, 'protected-execution-seal.json'),\n    preflight_evidence: path.join(outDir, 'protected-preflight-evidence.json'),\n    gate_receipts: path.join(outDir, 'protected-gate-receipts.jsonl'),\n    submission_attempt: path.join(outDir, 'protected-submission-attempt.json'),\n    admission_response: path.join(outDir, 'protected-admission-response.json'),\n    admission_transport_error: path.join(outDir, 'protected-admission-transport-error.json'),\n    status_progress: path.join(outDir, 'protected-status-progress.jsonl'),\n    primary_readback: path.join(outDir, 'protected-primary-readback.json'),\n    reference_readback: path.join(outDir, 'protected-reference-readback.json'),\n    audit_readback: path.join(outDir, 'protected-audit-readback.json'),\n    derivative_readback: path.join(outDir, 'protected-derivative-readback.json'),\n    terminal_report: path.join(outDir, 'protected-terminal-report.json'),\n    attempt_report: path.join(outDir, 'protected-run-report.unallocated.json'),\n  };\n  return {\n    planPath,\n    planDir,\n    freezePath: freezeArtifact.resolved,\n    approvalPath: approvalArtifact.resolved,\n    outDir,\n    plan,\n    freeze,\n    approval,\n    identity,\n    aliasPlanRequest,\n    artifacts,\n  };\n}\n\nfunction prepareProtectedExecution(\n  options: RunDatasetMaintenanceProtectedOptions,\n): PreparedProtectedExecution {\n  return prepareProtectedExecutionWithDependencies(options, {\n    readArtifact,\n    parsePlan: parseMaintenancePlan,\n    buildAliasPlan: buildAliasPlanRequest,\n    parseFreeze: parseProtectedFreeze,\n    parseApproval: parseProtectedApproval,\n    assertFreezeMatchesPlan: assertProtectedFreezeMatchesPlan,\n    assertApprovalBindings: assertProtectedApprovalBindings,\n    buildIdentity: buildProtectedExecutionIdentity,\n  });\n}\n\nfunction assertContextBindings(options: {\n  prepared: PreparedProtectedExecution;\n  context: DatasetMaintenanceRemoteContext;\n  confirm?: string;\n  commit: boolean;\n}): void {\n  if (\n    options.context.project_ref !== options.prepared.identity.project_ref ||\n    options.context.account.user_id !== options.prepared.identity.actor.user_id ||\n    options.context.account.email !== options.prepared.identity.actor.email ||\n    (options.commit && options.confirm !== options.context.account.email)\n  ) {\n    throw new CliError(\n      'Authenticated RLS context does not match the sealed production project, actor, and confirmation.',\n      {\n        code: 'DATASET_MAINTENANCE_PROTECTED_CONTEXT_MISMATCH',\n        exitCode: 1,\n        details: {\n          expected_project_ref: options.prepared.identity.project_ref,\n          observed_project_ref: options.context.project_ref,\n          expected_user_id: options.prepared.identity.actor.user_id,\n          observed_user_id: options.context.account.user_id,\n        },\n      },\n    );\n  }\n}\n\nfunction projectedRows(options: {\n  plan: DatasetMaintenancePlan;\n  planDir: string;\n  currentRows: DatasetMaintenanceRemoteRow[];\n}): DatasetMaintenanceRemoteRow[] {\n  return sharedProjectedRows(options);\n}\n\nfunction assertStrictBeforeState(options: {\n  prepared: PreparedProtectedExecution;\n  currentRows: DatasetMaintenanceRemoteRow[];\n  completeness: unknown;\n}): void {\n  assertSharedStrictBeforeState({\n    plan: options.prepared.plan,\n    planDir: options.prepared.planDir,\n    actorUserId: options.prepared.identity.actor.user_id,\n    currentRows: options.currentRows,\n    completeness: options.completeness,\n  });\n}\n\nasync function assertSupportSnapshots(options: {\n  prepared: PreparedProtectedExecution;\n  context: DatasetMaintenanceRemoteContext;\n}): Promise<void> {\n  await assertSharedSupportSnapshots({\n    plan: options.prepared.plan,\n    actorUserId: options.prepared.identity.actor.user_id,\n    context: options.context,\n  });\n}\n\nasync function assertDerivativeBaselines(options: {\n  prepared: PreparedProtectedExecution;\n  context: DatasetMaintenanceRemoteContext;\n}): Promise<void> {\n  await assertSharedDerivativeBaselines({\n    actorUserId: options.prepared.identity.actor.user_id,\n    context: options.context,\n    derivativeTargets: options.prepared.identity.derivative_targets,\n  });\n}\n\ntype ProtectedGateDependencies = {\n  captureGate: typeof captureMaintenanceAliasExecutionGate;\n  parseGate: typeof parseProtectedGateProof;\n  appendReceipt: typeof appendPrivateJsonLine;\n  nowIso: () => string;\n};\n\nasync function captureProtectedGatesWithDependencies(\n  options: {\n    prepared: PreparedProtectedExecution;\n    context: DatasetMaintenanceRemoteContext;\n    preflight: ProtectedPreflightProof;\n    receiptPath: string;\n  },\n  dependencies: ProtectedGateDependencies,\n): Promise<{\n  proofs: ProtectedGateProof[];\n  results: {\n    primary_support_plan: ProtectedGateProof['result'];\n    execution_unused: ProtectedGateProof['result'];\n    derivative_quiescence: ProtectedGateProof['result'];\n  };\n}> {\n  const gateNames = ['primary_support_plan', 'execution_unused', 'derivative_quiescence'] as const;\n  const proofs: ProtectedGateProof[] = [];\n  for (const gate of gateNames) {\n    const raw = await dependencies.captureGate({\n      context: options.context,\n      requestId: options.prepared.identity.request_id,\n      preflightToken: options.preflight.preflight_token,\n      gateName: gate,\n    });\n    const proof = dependencies.parseGate(raw, {\n      identity: options.prepared.identity,\n      preflight: options.preflight,\n      gate,\n    });\n    dependencies.appendReceipt(options.receiptPath, {\n      observed_at_utc: dependencies.nowIso(),\n      proof,\n      raw_response_sha256: sha256Json(raw),\n    });\n    proofs.push(proof);\n  }\n  return {\n    proofs,\n    results: {\n      primary_support_plan: proofs[0]!.result,\n      execution_unused: proofs[1]!.result,\n      derivative_quiescence: proofs[2]!.result,\n    },\n  };\n}\n\nasync function captureProtectedGates(options: {\n  prepared: PreparedProtectedExecution;\n  context: DatasetMaintenanceRemoteContext;\n  preflight: ProtectedPreflightProof;\n  receiptPath: string;\n}): Promise<{\n  proofs: ProtectedGateProof[];\n  results: {\n    primary_support_plan: ProtectedGateProof['result'];\n    execution_unused: ProtectedGateProof['result'];\n    derivative_quiescence: ProtectedGateProof['result'];\n  };\n}> {\n  return captureProtectedGatesWithDependencies(options, {\n    captureGate: captureMaintenanceAliasExecutionGate,\n    parseGate: parseProtectedGateProof,\n    appendReceipt: appendPrivateJsonLine,\n    nowIso: () => new Date().toISOString(),\n  });\n}\n\nfunction validateExistingMarker(\n  markerPath: string,\n  identity: ProtectedExecutionIdentity,\n): JsonObject | null {\n  if (!existsSync(markerPath)) return null;\n  const marker = readJsonFile(markerPath, 'Protected submission attempt');\n  if (\n    !isJsonObject(marker) ||\n    marker.schema_version !== PROTECTED_EXECUTION_CONTRACT.marker_schema ||\n    marker.request_id !== identity.request_id ||\n    marker.identity_sha256 !== identity.identity_sha256 ||\n    marker.plan_sha256 !== identity.plan_sha256 ||\n    marker.operation_id !== identity.operation_id ||\n    marker.max_admit_posts !== 1 ||\n    marker.automatic_retry !== false\n  ) {\n    throw new CliError('Existing protected submission marker is foreign or malformed.', {\n      code: 'DATASET_MAINTENANCE_PROTECTED_MARKER_INVALID',\n      exitCode: 1,\n    });\n  }\n  return marker;\n}\n\ntype ProtectedReadDependencies = {\n  readExecution: typeof readMaintenanceAliasExecution;\n  parseStatus: typeof parseProtectedStatusProof;\n  verifyExecution: typeof verifyProtectedExecution;\n  nowMs: () => number;\n};\n\nasync function readAndVerifyWithDependencies(\n  options: {\n    command: RunDatasetMaintenanceProtectedOptions;\n    prepared: PreparedProtectedExecution;\n    context: DatasetMaintenanceRemoteContext;\n  },\n  dependencies: ProtectedReadDependencies,\n): Promise<{\n  proof: ProtectedExecutionStatusProof | null;\n  verification: ProtectedVerificationResult;\n}> {\n  const waitSeconds = normalizeWaitSeconds(options.command.waitSeconds);\n  const pollMs = normalizePollMs(options.command.pollMs);\n  const deadline = dependencies.nowMs() + waitSeconds * 1_000;\n  const sleep =\n    options.command.sleep ?? ((ms: number) => new Promise((resolve) => setTimeout(resolve, ms)));\n  while (true) {\n    let raw: JsonObject;\n    try {\n      raw = await dependencies.readExecution({\n        context: options.context,\n        requestId: options.prepared.identity.request_id,\n      });\n    } catch (error) {\n      appendPrivateJsonLine(options.prepared.artifacts.status_progress, {\n        observed_at_utc: new Date().toISOString(),\n        result: 'read_error',\n        retry_scope: 'status_read_only',\n        error: errorDetails(error),\n      });\n      if (dependencies.nowMs() < deadline) {\n        await sleep(Math.min(pollMs, Math.max(deadline - dependencies.nowMs(), 0)));\n        continue;\n      }\n      return {\n        proof: null,\n        verification: {\n          status: 'indeterminate',\n          issues: [\n            {\n              code: 'PROTECTED_STATUS_READ_UNAVAILABLE',\n              message:\n                'Protected execution status could not be read; admission must not be retried.',\n              details: errorDetails(error),\n            },\n          ],\n          account_readback: null,\n          derivative_readback: null,\n        },\n      };\n    }\n    const proof = dependencies.parseStatus(raw, options.prepared.identity);\n    appendPrivateJsonLine(options.prepared.artifacts.status_progress, {\n      observed_at_utc: new Date().toISOString(),\n      proof,\n      raw_response_sha256: sha256Json(raw),\n    });\n    const waitForAdmissionVisibility =\n      proof.execution_status === 'not_admitted' && dependencies.nowMs() < deadline;\n    if (\n      (proof.status !== 'pending' && !waitForAdmissionVisibility) ||\n      dependencies.nowMs() >= deadline\n    ) {\n      try {\n        return {\n          proof,\n          verification: await dependencies.verifyExecution({\n            plan: options.prepared.plan,\n            planDir: options.prepared.planDir,\n            identity: options.prepared.identity,\n            proof,\n            context: options.context,\n            pageSize: options.command.pageSize,\n          }),\n        };\n      } catch (error) {\n        appendPrivateJsonLine(options.prepared.artifacts.status_progress, {\n          observed_at_utc: new Date().toISOString(),\n          result: 'verification_error',\n          retry_scope: 'independent_readback_only',\n          request_id: proof.request_id,\n          error: errorDetails(error),\n        });\n        if (dependencies.nowMs() < deadline) {\n          await sleep(Math.min(pollMs, Math.max(deadline - dependencies.nowMs(), 0)));\n          continue;\n        }\n        return {\n          proof,\n          verification: {\n            status: 'indeterminate',\n            issues: [\n              {\n                code: 'PROTECTED_TERMINAL_READBACK_UNAVAILABLE',\n                message:\n                  'Terminal proof was returned but independent RLS readback was unavailable.',\n                details: errorDetails(error),\n              },\n            ],\n            account_readback: null,\n            derivative_readback: null,\n          },\n        };\n      }\n    }\n    await sleep(Math.min(pollMs, Math.max(deadline - dependencies.nowMs(), 0)));\n  }\n}\n\nasync function readAndVerify(options: {\n  command: RunDatasetMaintenanceProtectedOptions;\n  prepared: PreparedProtectedExecution;\n  context: DatasetMaintenanceRemoteContext;\n}): Promise<{\n  proof: ProtectedExecutionStatusProof | null;\n  verification: ProtectedVerificationResult;\n}> {\n  return readAndVerifyWithDependencies(options, {\n    readExecution: readMaintenanceAliasExecution,\n    parseStatus: parseProtectedStatusProof,\n    verifyExecution: verifyProtectedExecution,\n    nowMs: Date.now,\n  });\n}\n\nfunction buildReport(options: {\n  command: RunDatasetMaintenanceProtectedOptions;\n  prepared: PreparedProtectedExecution;\n  admission: ProtectedAdmissionProof | null;\n  proof: ProtectedExecutionStatusProof | null;\n  verification: ProtectedVerificationResult;\n}): DatasetMaintenanceProtectedReport {\n  return {\n    schema_version: PROTECTED_EXECUTION_CONTRACT.report_schema,\n    generated_at_utc: new Date().toISOString(),\n    mode: options.command.statusOnly ? 'status_only' : 'commit',\n    status: options.verification.status,\n    request_id: options.prepared.identity.request_id,\n    identity_sha256: options.prepared.identity.identity_sha256,\n    plan_sha256: options.prepared.plan.plan_sha256,\n    operation_id: options.prepared.plan.operation_id,\n    actor: options.prepared.identity.actor,\n    project_ref: options.prepared.identity.project_ref,\n    admission: options.admission,\n    database_status: options.proof,\n    issues: options.verification.issues,\n    artifacts: options.prepared.artifacts,\n  };\n}\n\nfunction canonicalTerminalReport(report: DatasetMaintenanceProtectedReport): JsonObject {\n  return {\n    schema_version: report.schema_version,\n    artifact_kind: 'protected_terminal_canonical',\n    status: report.status,\n    request_id: report.request_id,\n    identity_sha256: report.identity_sha256,\n    plan_sha256: report.plan_sha256,\n    operation_id: report.operation_id,\n    actor: report.actor,\n    project_ref: report.project_ref,\n    database_status: report.database_status,\n    issues: report.issues,\n  };\n}\n\nfunction persistVerificationArtifacts(options: {\n  prepared: PreparedProtectedExecution;\n  proof: ProtectedExecutionStatusProof | null;\n  verification: ProtectedVerificationResult;\n  report: DatasetMaintenanceProtectedReport;\n}): void {\n  if (options.proof?.primary_readback) {\n    writePrivateImmutableJson(\n      options.prepared.artifacts.audit_readback,\n      options.proof.primary_readback,\n    );\n  }\n  if (options.verification.account_readback) {\n    writePrivateImmutableJson(\n      options.prepared.artifacts.primary_readback,\n      options.verification.account_readback,\n    );\n    writePrivateImmutableJson(options.prepared.artifacts.reference_readback, {\n      projected_reference_sha256: sha256Json(\n        maintenanceProjectedReferenceFingerprint(options.verification.account_readback.rows),\n      ),\n      expected_projected_reference_sha256: options.prepared.plan.projected_reference_sha256,\n    });\n  }\n  if (options.verification.derivative_readback) {\n    writePrivateImmutableJson(\n      options.prepared.artifacts.derivative_readback,\n      options.verification.derivative_readback,\n    );\n  }\n  const terminalReadbackRetryable = options.verification.issues.some(\n    (entry) => entry.code === 'PROTECTED_TERMINAL_READBACK_UNAVAILABLE',\n  );\n  writePrivateImmutableJson(options.prepared.artifacts.attempt_report, options.report);\n  if (\n    options.proof &&\n    options.proof.status !== 'pending' &&\n    options.proof.execution_status !== 'not_admitted' &&\n    !terminalReadbackRetryable &&\n    !existsSync(options.prepared.artifacts.terminal_report)\n  ) {\n    writePrivateImmutableJson(\n      options.prepared.artifacts.terminal_report,\n      canonicalTerminalReport(options.report),\n    );\n  }\n}\n\ntype ProtectedRuntimeDependencies = {\n  withStateLock: typeof withStateFileLock;\n  resolveContext: typeof resolveMaintenanceRemoteContext;\n  fetchAccountRows: typeof fetchMaintenanceAccountRows;\n  assertSupport: typeof assertSupportSnapshots;\n  assertBaselines: typeof assertDerivativeBaselines;\n  buildPreflightRequest: typeof buildProtectedPreflightRequest;\n  preflightExecution: typeof preflightMaintenanceAliasExecution;\n  parsePreflight: typeof parseProtectedPreflightProof;\n  captureGates: typeof captureProtectedGates;\n  buildAdmitRequest: typeof buildProtectedAdmitRequest;\n  admitExecution: typeof admitMaintenanceAliasExecution;\n  parseAdmission: typeof parseProtectedAdmissionProof;\n  readAndVerify: typeof readAndVerify;\n};\n\nasync function runPreparedProtectedExecution(\n  options: RunDatasetMaintenanceProtectedOptions,\n  basePrepared: PreparedProtectedExecution,\n  dependencies: ProtectedRuntimeDependencies,\n): Promise<DatasetMaintenanceProtectedReport> {\n  ensurePrivateDirectory(basePrepared.outDir);\n  return dependencies.withStateLock(\n    basePrepared.artifacts.submission_attempt,\n    { reason: `dataset_maintenance_protected_${basePrepared.identity.request_id}` },\n    async () => {\n      writePrivateImmutableJson(basePrepared.artifacts.execution_seal, {\n        schema_version: PROTECTED_EXECUTION_CONTRACT.freeze_schema,\n        request_id: basePrepared.identity.request_id,\n        identity_sha256: basePrepared.identity.identity_sha256,\n        plan_path: basePrepared.planPath,\n        freeze_path: basePrepared.freezePath,\n        approval_path: basePrepared.approvalPath,\n        plan_sha256: basePrepared.plan.plan_sha256,\n        operation_id: basePrepared.plan.operation_id,\n        project_ref: basePrepared.identity.project_ref,\n        actor: basePrepared.identity.actor,\n        bindings: basePrepared.identity.bindings,\n      });\n      const prepared = allocateAttemptArtifacts(basePrepared);\n      const existingMarker = validateExistingMarker(\n        prepared.artifacts.submission_attempt,\n        prepared.identity,\n      );\n      if (options.commit && existingMarker) {\n        throw new CliError(\n          'A protected submission marker already exists. Use status-only; admission cannot be retried.',\n          {\n            code: 'DATASET_MAINTENANCE_PROTECTED_ATTEMPT_EXISTS',\n            exitCode: 1,\n          },\n        );\n      }\n      const context = await dependencies.resolveContext({\n        env: options.env,\n        fetchImpl: options.fetchImpl,\n        timeoutMs: options.timeoutMs,\n        now: options.now,\n      });\n      assertContextBindings({\n        prepared,\n        context,\n        confirm: options.confirm,\n        commit: options.commit,\n      });\n\n      let admission: ProtectedAdmissionProof | null = null;\n      if (options.commit) {\n        const current = await dependencies.fetchAccountRows({\n          context,\n          userId: prepared.identity.actor.user_id,\n          pageSize: options.pageSize,\n        });\n        assertStrictBeforeState({\n          prepared,\n          currentRows: current.rows,\n          completeness: current.completeness,\n        });\n        await dependencies.assertSupport({ prepared, context });\n        await dependencies.assertBaselines({ prepared, context });\n\n        const preflightRequest = dependencies.buildPreflightRequest({\n          identity: prepared.identity,\n          plan: prepared.aliasPlanRequest,\n          freeze: prepared.freeze,\n          approval: prepared.approval,\n        });\n        const preflightRaw = await dependencies.preflightExecution({\n          context,\n          request: preflightRequest,\n        });\n        const preflight = dependencies.parsePreflight(\n          preflightRaw,\n          prepared.identity,\n          clock(options),\n        );\n        const { preflight_token: preflightToken, ...preflightEvidence } = preflight;\n        writePrivateImmutableJson(prepared.artifacts.preflight_evidence, {\n          proof: preflightEvidence,\n          preflight_token_sha256: sha256Text(preflightToken),\n          raw_response_sha256: sha256Json(preflightRaw),\n        });\n        const gates = await dependencies.captureGates({\n          prepared,\n          context,\n          preflight,\n          receiptPath: prepared.artifacts.gate_receipts,\n        });\n        writePrivateImmutableJson(prepared.artifacts.submission_attempt, {\n          schema_version: PROTECTED_EXECUTION_CONTRACT.marker_schema,\n          prepared_at_utc: clock(options).toISOString(),\n          request_id: prepared.identity.request_id,\n          identity_sha256: prepared.identity.identity_sha256,\n          plan_sha256: prepared.identity.plan_sha256,\n          operation_id: prepared.identity.operation_id,\n          actor: prepared.identity.actor,\n          project_ref: prepared.identity.project_ref,\n          preflight_proof_sha256: preflight.preflight_proof_sha256,\n          preflight_token_sha256: sha256Text(preflight.preflight_token),\n          preflight_completed_at: preflight.completed_at,\n          preflight_expires_at: preflight.expires_at,\n          gate_results: gates.results,\n          gate_receipt_sha256: Object.fromEntries(\n            gates.proofs.map((proof) => [proof.gate, proof.receipt_sha256]),\n          ),\n          max_admit_posts: 1,\n          automatic_retry: false,\n        });\n\n        const admitRequest = dependencies.buildAdmitRequest({\n          preflight,\n          gateResults: gates.results,\n        });\n        try {\n          const admissionRaw = await dependencies.admitExecution({\n            context,\n            request: admitRequest,\n          });\n          admission = dependencies.parseAdmission(admissionRaw, prepared.identity, preflight);\n          writePrivateImmutableJson(prepared.artifacts.admission_response, {\n            proof: admission,\n            raw_response_sha256: sha256Json(admissionRaw),\n          });\n        } catch (error) {\n          writePrivateImmutableJson(prepared.artifacts.admission_transport_error, {\n            schema_version: 1,\n            request_id: prepared.identity.request_id,\n            observed_at_utc: new Date().toISOString(),\n            classification: 'ambiguous_consumed_attempt',\n            error: errorDetails(error),\n          });\n        }\n      }\n\n      const readback = await dependencies.readAndVerify({ command: options, prepared, context });\n      const report = buildReport({\n        command: options,\n        prepared,\n        admission,\n        proof: readback.proof,\n        verification: readback.verification,\n      });\n      persistVerificationArtifacts({\n        prepared,\n        proof: readback.proof,\n        verification: readback.verification,\n        report,\n      });\n      return report;\n    },\n  );\n}\n\nexport async function runDatasetMaintenanceProtected(\n  options: RunDatasetMaintenanceProtectedOptions,\n): Promise<DatasetMaintenanceProtectedReport> {\n  const prepared = prepareProtectedExecution(options);\n  return runPreparedProtectedExecution(options, prepared, {\n    withStateLock: withStateFileLock,\n    resolveContext: resolveMaintenanceRemoteContext,\n    fetchAccountRows: fetchMaintenanceAccountRows,\n    assertSupport: assertSupportSnapshots,\n    assertBaselines: assertDerivativeBaselines,\n    buildPreflightRequest: buildProtectedPreflightRequest,\n    preflightExecution: preflightMaintenanceAliasExecution,\n    parsePreflight: parseProtectedPreflightProof,\n    captureGates: captureProtectedGates,\n    buildAdmitRequest: buildProtectedAdmitRequest,\n    admitExecution: admitMaintenanceAliasExecution,\n    parseAdmission: parseProtectedAdmissionProof,\n    readAndVerify,\n  });\n}\n\nexport const __testInternals = {\n  allocateAttemptArtifacts,\n  appendPrivateJsonLine,\n  assertCanonicalParsedArtifact,\n  assertContextBindings,\n  assertDerivativeBaselines,\n  assertStrictBeforeState,\n  assertSupportSnapshots,\n  buildReport,\n  canonicalTerminalReport,\n  clock,\n  errorDetails,\n  nextAttemptReportPath,\n  normalizePollMs,\n  normalizeWaitSeconds,\n  prepareProtectedExecution,\n  prepareProtectedExecutionWithDependencies,\n  projectedRows,\n  readArtifact,\n  readAndVerify,\n  readAndVerifyWithDependencies,\n  runPreparedProtectedExecution,\n  captureProtectedGates,\n  captureProtectedGatesWithDependencies,\n  persistVerificationArtifacts,\n  validateExistingMarker,\n  writePrivateImmutableJson,\n};\n"]}