@tiangong-lca/cli 0.0.28 → 0.0.29

package/dist/src/lib/dataset-maintenance-flow-identity-run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dataset-maintenance-flow-identity-run.js","sourceRoot":"","sources":["../../../src/lib/dataset-maintenance-flow-identity-run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,gCAAgC,EAChC,+BAA+B,EAC/B,mCAAmC,EACnC,4CAA4C,EAC5C,kCAAkC,EAClC,8BAA8B,EAC9B,6BAA6B,EAC7B,oCAAoC,EACpC,iCAAiC,EACjC,4BAA4B,EAC5B,4BAA4B,EAC5B,+BAA+B,GAMhC,MAAM,2DAA2D,CAAC;AACnE,OAAO,EACL,2BAA2B,EAC3B,8BAA8B,EAC9B,oCAAoC,GAErC,MAAM,iDAAiD,CAAC;AACzD,OAAO,EACL,YAAY,EACZ,UAAU,EACV,cAAc,GAEf,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,4BAA4B,EAAE,MAAM,6CAA6C,CAAC;AAK3F,OAAO,EACL,oCAAoC,EACpC,6BAA6B,EAC7B,kCAAkC,EAClC,qCAAqC,EACrC,mCAAmC,EACnC,gCAAgC,EAChC,+BAA+B,EAC/B,qCAAqC,GAGtC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EACL,yBAAyB,EACzB,6BAA6B,GAE9B,MAAM,uDAAuD,CAAC;AA8E/D,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,0BAA0B,GAC9B,6EAA6E,CAAC;AAChF,MAAM,wBAAwB,GAAG,0BAA0B,CAAC;AAE5D,SAAS,IAAI,CAAC,OAAe,EAAE,IAAY,EAAE,OAAiB;IAC5D,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE;QAC1B,IAAI;QACJ,QAAQ,EAAE,CAAC;QACX,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;KAC9C,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO;QACL,IAAI,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO;QACnD,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAC/D,IAAI,EACF,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;YACrF,CAAC,CAAC,KAAK,CAAC,IAAI;YACZ,CAAC,CAAC,IAAI;KACX,CAAC;AACJ,CAAC;AAED,SAAS,8BAA8B,CAAC,KAAkC,EAAE,KAAa;IACvF,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,kBAAkB,CAAC,EAAE,CAAC;QAC7C,IAAI,CACF,GAAG,KAAK,2DAA2D,EACnE,uDAAuD,CACxD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB,EAAE,KAAa;IACxD,MAAM,QAAQ,GAAG,yBAAyB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IAChE,IAAI,QAAQ,CAAC,IAAI,KAAK,GAAG,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC5D,IAAI,CACF,GAAG,KAAK,4DAA4D,EACpE,6CAA6C,CAC9C,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,EAAU,EAAE,OAAe;IAC/D,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,OAAO,EAAE,CAAC;AAChE,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAgB,EAAE,IAAsB;IACpE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CACxB,OAAO,EACP,IAAI,CAAC,SAAS,CAAC,mBAAmB,EAClC,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CACpE,CAAC;QACF,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE,kCAAkC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/F,IACE,CAAC,YAAY,CAAC,KAAK,CAAC;YACpB,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC;YAC5B,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;YAC9B,CAAC,YAAY,CAAC,KAAK,CAAC,gBAAgB,CAAC;YACrC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,UAAU,CAAC,OAAO,CAAC;YACjD,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,kBAAkB;YACzD,UAAU,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,OAAO,CAAC,uBAAuB;YACtE,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,aAAa,EAC/C,CAAC;YACD,IAAI,CACF,oBAAoB,OAAO,CAAC,OAAO,qCAAqC,EACxE,gDAAgD,CACjD,CAAC;QACJ,CAAC;QACD,OAAO,KAAmC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAAC,OAK/B;IACC,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,4BAA4B,CAAC;QACrE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,yBAAyB,CAAC;QAClE,IAAI,CAAC,IAAI,CACP,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,EACtD,yCAAyC,CAC1C;KACF,CAAC;IACF,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,CACF,2EAA2E,EAC3E,4CAA4C,CAC7C,CAAC;IACJ,CAAC;IACD,OAAO,iBAAiB,CAAC,KAAK,EAAE,oCAAoC,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,UAAU,CAAC,OAA+B;IACjD,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;QAC1C,IAAI,CAAC,6CAA6C,EAAE,wCAAwC,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,4BAA4B,CAAC;QAC5C,IAAI,EAAE,iBAAiB,CAAC,QAAQ,EAAE,oBAAoB,CAAC;QACvD,MAAM,EAAE,iBAAiB,CAAC,OAAO,CAAC,UAAU,EAAE,sBAAsB,CAAC;QACrE,QAAQ,EAAE,iBAAiB,CAAC,OAAO,CAAC,YAAY,EAAE,wBAAwB,CAAC;KAC5E,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG;QACxB,OAAO,CAAC,kBAAkB;QAC1B,OAAO,CAAC,oBAAoB;QAC5B,OAAO,CAAC,cAAc;KACvB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IACzB,IAAI,iBAAiB,KAAK,CAAC,IAAI,iBAAiB,KAAK,CAAC,EAAE,CAAC;QACvD,IAAI,CACF,8FAA8F,EAC9F,kDAAkD,CACnD,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GACZ,iBAAiB,KAAK,CAAC;QACrB,CAAC,CAAC,oCAAoC,CAAC;YACnC,IAAI,EAAE,iBAAiB,CAAC,QAAQ,EAAE,6BAA6B,CAAC;YAChE,cAAc,EAAE,iBAAiB,CAC/B,OAAO,CAAC,UAAU,EAClB,wCAAwC,CACzC;YACD,gBAAgB,EAAE,iBAAiB,CACjC,OAAO,CAAC,YAAY,EACpB,0CAA0C,CAC3C;YACD,KAAK,EAAE,sBAAsB,CAAC;gBAC5B,MAAM,EAAE,OAAO,CAAC,cAAe;gBAC/B,kBAAkB,EAAE,OAAO,CAAC,kBAAmB;gBAC/C,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;aAC5B,CAAC;YACF,cAAc,EAAE,iBAAiB,CAC/B,OAAO,CAAC,kBAAmB,EAC3B,+BAA+B,CAChC;YACD,gBAAgB,EAAE,iBAAiB,CACjC,OAAO,CAAC,oBAAqB,EAC7B,iCAAiC,CAClC;SACF,CAAC;QACJ,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,wBAAwB,GAC5B,QAAQ,EAAE,gBAAgB,CAAC,iCAAiC;YAC5D,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC;QACpC,IACE,OAAO,CAAC,gBAAgB,KAAK,wBAAwB;YACrD,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAC/C,CAAC;YACD,IAAI,CACF,6EAA6E,EAC7E,mDAAmD,CACpD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,aAAa,GAAqC,IAAI,CAAC;IAC3D,IAAI,OAAO,CAAC,UAAU,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,6BAA6B,CAAC;YAC1C,sBAAsB,EAAE,QAAQ,CAAC,QAAQ,CAAC,kCAAkC;YAC5E,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;QACH,IAAI,KAAK,EAAE,CAAC;YACV,aAAa,GAAG,KAAK,CAAC;YACtB,IACE,KAAK,CAAC,aAAa,KAAK,SAAS;gBACjC,KAAK,CAAC,yBAAyB,KAAK,QAAQ,CAAC,QAAQ,CAAC,eAAe;gBACrE,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,QAAQ,CAAC,UAAU;gBACjD,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,IAAI,CAAC,WAAW;gBAC/C,KAAK,CAAC,aAAa,KAAK,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO;gBACrD,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK;gBACjD,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,IAAI,CAAC,WAAW;gBAC/C,KAAK,CAAC,aAAa,KAAK,QAAQ,CAAC,MAAM,CAAC,aAAa,EACrD,CAAC;gBACD,IAAI,CACF,8DAA8D,EAC9D,8CAA8C,CAC/C,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YAC/C,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACxB,IAAI,CACF,mEAAmE,EACnE,8CAA8C,CAC/C,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,GAAG,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAChD,OAAO;QACL,GAAG,QAAQ;QACX,QAAQ;QACR,MAAM;QACN,SAAS,EAAE,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC;QACxD,QAAQ;QACR,aAAa;KACd,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,QAAqB,EAAE,OAAwC;IACpF,IACE,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,IAAI,CAAC,WAAW;QACjD,OAAO,CAAC,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO;QACzD,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAC1E,CAAC;QACD,IAAI,CACF,sEAAsE,EACtE,wCAAwC,EACxC;YACE,oBAAoB,EAAE,QAAQ,CAAC,IAAI,CAAC,WAAW;YAC/C,oBAAoB,EAAE,OAAO,CAAC,WAAW;YACzC,gBAAgB,EAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO;YAC/C,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO;SAC1C,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAiB,EAAE,MAAc;IACzD,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC9F,OAAO,IAAI,CAAC,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAqB,EAAE,KAAc;IAChE,yBAAyB,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAqB;IACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC;IAC1E,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,OAAO,oCAAoC,CACzC,iBAAiB,CAAC,QAAQ,EAAE,qCAAqC,CAAC,EAClE,QAAQ,CAAC,IAAI,CACd,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;IACzE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,iCAAiC,CACtC,iBAAiB,CAAC,UAAU,EAAE,kCAAkC,CAAC,EACjE,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,QAAQ,CAClB,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,OAKlC;IACC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACjE,IACE,CAAC,YAAY,CAAC,KAAK,CAAC;QACpB,KAAK,CAAC,MAAM,KAAK,UAAU;QAC3B,KAAK,CAAC,eAAe,KAAK,KAAK;QAC/B,KAAK,CAAC,iBAAiB,KAAK,KAAK;QACjC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,OAAO,CAAC,qBAAqB;QACjE,CAAC,6BAA6B,CAAC,KAAK,CAAC,QAAQ,CAAC,EAC9C,CAAC;QACD,IAAI,CACF,GAAG,OAAO,CAAC,KAAK,uDAAuD,EACvE,gDAAgD,CACjD,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,QAAQ,CAAC;AACxB,CAAC;AAED,SAAS,oBAAoB,CAC3B,QAAqB,EACrB,IAAkE,EAClE,aAAqB;IAErB,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,IAAI,IAAI,aAAa,OAAO,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,yBAAyB,CAAC,OAIlC;IACC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1F,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE,gCAAgC,CAAC,CAAC;IAC5E,IACE,CAAC,YAAY,CAAC,KAAK,CAAC;QACpB,KAAK,CAAC,cAAc,KAAK,2CAA2C;QACpE,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,KAAK,CAAC,QAAQ;QACzC,KAAK,CAAC,cAAc,KAAK,OAAO,CAAC,aAAa;QAC9C,KAAK,CAAC,SAAS,KAAK,CAAC;QACrB,KAAK,CAAC,eAAe,KAAK,KAAK;QAC/B,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC;QAC5B,4BAA4B,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,aAAa,EACrE,CAAC;QACD,IAAI,CACF,iEAAiE,EACjE,gDAAgD,CACjD,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC;AACvB,CAAC;AAED,SAAS,2BAA2B,CAAC,QAAqB;IACxD,OAAO,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC;SAChC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;SACjF,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC;SAClD,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,uBAAuB,CAAC,OAKhC;IACC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IACxF,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,8BAA8B,CAAC;QACpC,KAAK,EAAE,iBAAiB,CAAC,QAAQ,EAAE,8BAA8B,CAAC;QAClE,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI;QAC3B,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ;QAC/B,gBAAgB,EAAE,OAAO,CAAC,KAAK,CAAC,kBAAkB;QAClD,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAK1B;IACC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YAC/B,IAAI,CACF,iFAAiF,EACjF,gDAAgD,CACjD,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC3C,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC;YAClD,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ;SACjC,CAAC,CAAC;QACH,IAAI,6BAA6B,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/C,8BAA8B,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAC;YACtE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;QACvD,CAAC;QACD,MAAM,QAAQ,GAAG,4BAA4B,CAC3C,WAAW,EACX,OAAO,CAAC,QAAQ,CAAC,IAAI,EACrB,QAAQ,CAAC,KAAK,CAAC,QAAQ,EACvB,QAAQ,CAAC,KAAK,CAAC,kBAAkB,CAClC,CAAC;QACF,2BAA2B,CAAC,QAAQ,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;QAC/D,mBAAmB,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAChD,MAAM,aAAa,GAAG,4BAA4B,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;QAC7E,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,CACF,yCAAyC,EACzC,gDAAgD,CACjD,CAAC;QACJ,CAAC;QACD,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,6BAA6B,CAAC,EAAE;YAC3F,cAAc,EAAE,2CAA2C;YAC3D,gBAAgB,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;YAC1D,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ;YACjC,cAAc,EAAE,aAAa;YAC7B,iCAAiC,EAC/B,QAAQ,CAAC,gBAAgB,CAAC,iCAAiC;YAC7D,2BAA2B,EAAE,CAAC;YAC9B,wBAAwB,EAAE,CAAC;YAC3B,iBAAiB,EAAE,KAAK;YACxB,eAAe,EAAE,KAAK;SACvB,CAAC,CAAC;QACH,IAAI,GAAe,CAAC;QACpB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC;gBACvC,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ;gBAChC,OAAO,EAAE,QAAQ,CAAC,eAAe;aAClC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;YACpC,yBAAyB,CACvB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,qCAAqC,CAAC,EACzE;gBACE,cAAc,EAAE,mDAAmD;gBACnE,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;gBACzD,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ;gBACjC,cAAc,EAAE,aAAa;gBAC7B,iBAAiB,EAAE,KAAK;gBACxB,eAAe,EAAE,KAAK;gBACtB,QAAQ,EAAE,iBAAiB;gBAC3B,KAAK,EAAE,OAAO;aACf,CACF,CAAC;YACF,IAAI,QAAQ,GAAmC,IAAI,CAAC;YACpD,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC;oBAClD,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ;iBACjC,CAAC,CAAC;gBACH,IAAI,CAAC,6BAA6B,CAAC,WAAW,CAAC,EAAE,CAAC;oBAChD,QAAQ,GAAG,4BAA4B,CACrC,WAAW,EACX,OAAO,CAAC,QAAQ,CAAC,IAAI,EACrB,QAAQ,CAAC,KAAK,CAAC,QAAQ,EACvB,QAAQ,CAAC,KAAK,CAAC,kBAAkB,CAClC,CAAC;oBACF,mBAAmB,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBAClD,CAAC;qBAAM,CAAC;oBACN,8BAA8B,CAAC,WAAW,EAAE,gCAAgC,CAAC,CAAC;gBAChF,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,+EAA+E;YACjF,CAAC;YACD,OAAO;gBACL,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,eAAe,EAAE,IAAI;gBACrB,iBAAiB,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE;aAChD,CAAC;QACJ,CAAC;QACD,IAAI,6BAA6B,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,8BAA8B,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;YACtD,yBAAyB,CACvB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,sCAAsC,CAAC,EAC1E;gBACE,cAAc,EAAE,oDAAoD;gBACpE,MAAM,EAAE,UAAU;gBAClB,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ;gBACjC,cAAc,EAAE,aAAa;gBAC7B,iBAAiB,EAAE,KAAK;gBACxB,eAAe,EAAE,KAAK;gBACtB,QAAQ,EAAE,GAAG;aACd,CACF,CAAC;YACF,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;QAC/C,CAAC;QACD,MAAM,QAAQ,GAAG,+BAA+B,CAAC;YAC/C,KAAK,EAAE,GAAG;YACV,kBAAkB,EAAE,CAAC;YACrB,cAAc,EAAE,GAAG,CAAC,MAAM,KAAK,IAAI;YACnC,eAAe,EAAE,GAAG,CAAC,MAAM,KAAK,IAAI;YACpC,KAAK,EAAE,8BAA8B;SACtC,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,8BAA8B,CAAC;YACnD,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,MAAM,EAAE,QAAQ,CAAC,cAAc;YAC/B,QAAQ,EAAE,QAAQ,CAAC,gBAAgB;YACnC,OAAO,EAAE,QAAQ,CAAC,eAAe;YACjC,oBAAoB,EAAE,QAAQ,CAAC,eAAe,EAAE,aAAa;SAC9D,CAAC,CAAC;QACH,yBAAyB,CACvB,IAAI,CAAC,IAAI,CACP,OAAO,CAAC,QAAQ,CAAC,MAAM,EACvB,QAAQ,CAAC,KAAK,CAAC,cAAc,KAAK,8CAA8C;YAC9E,CAAC,CAAC,yBAAyB;YAC3B,CAAC,CAAC,4BAA4B,CACjC,EACD,QAAQ,CAAC,KAAK,CACf,CAAC;QACF,yBAAyB,CACvB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAC,EAC/D,aAAa,CACd,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE,CAAC;IAC9E,CAAC;IACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtD,IAAI,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IAC5D,MAAM,eAAe,GAAG,yBAAyB,CAAC;QAChD,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,uCAAuC,CAAC;QACrF,KAAK,EAAE,gDAAgD;QACvD,gBAAgB,EAAE,gBAAgB;QAClC,qBAAqB,EAAE,4BAA4B,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;KACvF,CAAC,CAAC;IACH,IAAI,eAAe;QAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IAC9E,IAAI,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;YACpE,IAAI,CACF,uIAAuI,EACvI,4CAA4C,CAC7C,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC;YAClD,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EAAE,mCAAmC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;SACtF,CAAC,CAAC;QACH,IAAI,6BAA6B,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,8BAA8B,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;YAC1D,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;QACrD,CAAC;QACD,MAAM,WAAW,GAAG,iCAAiC,CACnD,SAAS,EACT,OAAO,CAAC,QAAQ,CAAC,IAAI,EACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAC1B,CAAC;QACF,yBAAyB,CACvB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAC,EAC7D,WAAW,CACZ,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IACvD,CAAC;IACD,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,8BAA8B,CAAC,EAAE;QAC5F,cAAc,EAAE,4CAA4C;QAC5D,gBAAgB,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;QAC1D,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU;QAChD,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW;QAC9C,cAAc,EAAE,4BAA4B,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAC/E,oBAAoB,EAAE,KAAK;QAC3B,eAAe,EAAE,KAAK;KACvB,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC;QAC/C,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,gBAAgB;KAC3C,CAAC,CAAC;IACH,IAAI,6BAA6B,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,8BAA8B,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QACvD,yBAAyB,CACvB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,uCAAuC,CAAC,EAC3E;YACE,cAAc,EAAE,qDAAqD;YACrE,MAAM,EAAE,UAAU;YAClB,cAAc,EAAE,4BAA4B,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAC/E,eAAe,EAAE,KAAK;YACtB,iBAAiB,EAAE,KAAK;YACxB,QAAQ,EAAE,gDAAgD;YAC1D,QAAQ,EAAE,GAAG;SACd,CACF,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IAC/C,CAAC;IACD,MAAM,QAAQ,GAAG,+BAA+B,CAAC;QAC/C,KAAK,EAAE,GAAG;QACV,kBAAkB,EAAE,CAAC;QACrB,cAAc,EAAE,GAAG,CAAC,MAAM,KAAK,IAAI;QACnC,eAAe,EAAE,GAAG,CAAC,MAAM,KAAK,IAAI;QACpC,KAAK,EAAE,+BAA+B;KACvC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,oCAAoC,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC1F,yBAAyB,CACvB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,4BAA4B,CAAC,EAChE,KAAK,CACN,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,OAKxB;IACC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC;QAC1C,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ;KAChC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,4BAA4B,CACzC,GAAG,EACH,OAAO,CAAC,QAAQ,CAAC,IAAI,EACrB,OAAO,CAAC,KAAK,CAAC,QAAQ,EACtB,OAAO,CAAC,KAAK,CAAC,kBAAkB,CACjC,CAAC;IACF,mBAAmB,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC9C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,yBAAyB,CAAC,QAAqB,EAAE,MAA+B;IACvF,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,EAAE,CAAC;QACtF,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CACF,yDAAyD,EACzD,wCAAwC,CACzC,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,+BAA+B,CAAC;YAC9C,gBAAgB,EAAE,MAAM,CAAC,kBAAkB;YAC3C,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,wBAAwB,EAAE,MAAM,CAAC,2BAA2B;SAC7D,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,sBAAsB,KAAK,OAAO,CAAC,sBAAsB,EAAE,CAAC;YACrE,IAAI,CACF,qBAAqB,MAAM,CAAC,OAAO,+BAA+B,EAClE,wCAAwC,CACzC,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAC5B,QAAqB,EACrB,MAA+B,EAC/B,OAAe;IAEf,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACxD,IAAI,CACF,gEAAgE,EAChE,4CAA4C,CAC7C,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,MAAM,CAAC,OAQf;IACC,MAAM,KAAK,GAA0B;QACnC,cAAc,EAAE,qCAAqC;QACrD,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE;QAC3C,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY;QAChD,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW;QAC9C,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU;QAChD,eAAe,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe;QAC1D,QAAQ,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,IAAI,IAAI;QACzC,eAAe,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,IAAI,IAAI;QACjD,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM;QACrD,uBAAuB,EAAE,OAAO,CAAC,QAAQ,EAAE,uBAAuB,IAAI,CAAC;QACvE,YAAY,EAAE,OAAO,CAAC,QAAQ,EAAE,YAAY,IAAI,IAAI;QACpD,eAAe,EAAE,KAAK;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;KAC7B,CAAC;IACF,yBAAyB,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;IAC1F,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,OAU3C;IACC,IAAI,SAAS,GAAmC,IAAI,CAAC;IACrD,IAAI,SAAS,GAAY,IAAI,CAAC;IAC9B,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,SAAS,CAAC;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC,CAAC;QACH,yBAAyB,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,SAAS,GAAG,KAAK,CAAC;IACpB,CAAC;IACD,MAAM,QAAQ,GACZ,SAAS,IAAI,SAAS,CAAC,uBAAuB,GAAG,CAAC;QAChD,CAAC,CAAC,0BAA0B;QAC5B,CAAC,CAAC,wBAAwB,CAAC;IAC/B,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QACvC,yBAAyB,CAAC,OAAO,CAAC,aAAa,EAAE;YAC/C,cAAc,EAAE,mDAAmD;YACnE,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,sBAAsB,EAAE,OAAO,CAAC,aAAa;YAC7C,eAAe,EAAE,KAAK;YACtB,iBAAiB,EAAE,KAAK;YACxB,QAAQ;YACR,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC,CAAC;IACL,CAAC;IACD,yBAAyB,CACvB,gBAAgB,CACd,OAAO,CAAC,QAAQ,CAAC,MAAM,EACvB,qCAAqC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAChF,EACD;QACE,cAAc,EAAE,4DAA4D;QAC5E,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;QACzD,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ;QAChC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,sBAAsB,EAAE,OAAO,CAAC,aAAa;QAC7C,qBAAqB,EAAE,SAAS,KAAK,IAAI;QACzC,uBAAuB,EAAE,SAAS,EAAE,uBAAuB,IAAI,IAAI;QACnE,YAAY,EAAE,SAAS,EAAE,YAAY,IAAI,IAAI;QAC7C,4BAA4B,EAAE,SAAS,EAAE,4BAA4B,IAAI,IAAI;QAC7E,QAAQ;QACR,eAAe,EAAE,KAAK;QACtB,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;KAClE,CACF,CAAC;IACF,MAAM,aAAa,GACjB,QAAQ,KAAK,0BAA0B;QACrC,CAAC,CAAC;YACE,IAAI,EAAE,mGAAmG;YACzG,OAAO,EACL,2IAA2I;YAC7I,OAAO,EAAE,EAAE,QAAQ,EAAE;SACtB;QACH,CAAC,CAAC;YACE,IAAI,EAAE,gDAAgD;YACtD,OAAO,EACL,sHAAsH;YACxH,OAAO,EAAE,EAAE,QAAQ,EAAE;SACtB,CAAC;IACR,OAAO,MAAM,CAAC;QACZ,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe;QACxD,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAC3B,OAAO,EACL,OAAO,OAAO,CAAC,QAAQ,CAAC,OAAO,KAAK,QAAQ;oBAC1C,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO;oBAC1B,CAAC,CAAC,mDAAmD,OAAO,CAAC,OAAO,GAAG;gBAC3E,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE;aAClD;YACD,GAAG,CAAC,SAAS,KAAK,IAAI;gBACpB,CAAC,CAAC,CAAC,aAAa,CAAC;gBACjB,CAAC,CAAC;oBACE;wBACE,IAAI,EAAE,mEAAmE;wBACzE,OAAO,EACL,mGAAmG;wBACrG,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE;qBACtD;iBACF,CAAC;SACP;QACD,GAAG,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,EAAE;KAChC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,+BAA+B,CAAC,MAA+B;IACtE,OAAO,CACL,MAAM,CAAC,MAAM,KAAK,WAAW;QAC7B,MAAM,CAAC,MAAM,KAAK,YAAY;QAC9B,MAAM,CAAC,MAAM,KAAK,QAAQ;QAC1B,MAAM,CAAC,qBAAqB,KAAK,IAAI;QACrC,kCAAkC,CAAC,MAAM,CAAC,CAC3C,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,MAA+B;IACzD,OAAO,4CAA4C,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AACrF,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,OAOtC;IACC,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,eAAe,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,WAAW,GAAG,CAAC,IAAI,WAAW,GAAG,MAAM,EAAE,CAAC;QAC9E,IAAI,CAAC,iDAAiD,EAAE,oCAAoC,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,GAAG,MAAM,EAAE,CAAC;QACjE,IAAI,CAAC,8CAA8C,EAAE,oCAAoC,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,GAAG,KAAK,CAAC;IAClD,IAAI,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAC9B,OAAO,CAAC,+BAA+B,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC1E,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACvF,OAAO,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;QACnC,yBAAyB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,OAA+B,EAC/B,YAA6B,EAC7B,aAA2B;IAE3B,MAAM,QAAQ,GAAG,aAAa,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC;IACvD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,cAAc,CAAC;QAChD,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IACH,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACjC,IAAI,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC,aAAa,EAAE,CAAC;QACjD,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;QACnC,YAAY,CAAC,aAAa,CAAC;YACzB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,KAAK,EAAE;gBACL,cAAc,EAAE,+CAA+C;gBAC/D,cAAc,EAAE,YAAY,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;gBAChD,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;gBAChD,wBAAwB,EAAE,QAAQ;oBAChC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,iCAAiC;oBAC7D,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,kCAAkC;gBACxD,yBAAyB,EAAE,QAAQ,CAAC,QAAQ,CAAC,eAAe;gBAC5D,UAAU,EAAE,QAAQ;oBAClB,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,UAAU,CAAC;oBAC7C,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU;gBAChC,WAAW,EAAE,YAAY;gBACzB,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,WAAW;gBACtC,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO;gBAC5C,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK;gBACxC,iBAAiB,EAAE,aAAa;gBAChC,gBAAgB,EAAE,gDAAgD;gBAClE,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,WAAW;gBACtC,aAAa,EAAE,QAAQ;oBACrB,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,sBAAsB;oBAChD,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa;gBACjC,iBAAiB,EAAE,QAAQ,CAAC,MAAM;gBAClC,wBAAwB,EAAE,CAAC;gBAC3B,iBAAiB,EAAE,KAAK;aACzB;SACF,CAAC,CAAC;IACL,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;IACjF,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC7B,MAAM,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;IACjD,IAAI,6BAA6B,CAAC,KAAK,CAAC,EAAE,CAAC;QACzC,OAAO,MAAM,CAAC;YACZ,QAAQ;YACR,IAAI;YACJ,MAAM,EAAE,SAAS;YACjB,KAAK,EAAE,IAAI;YACX,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE;gBACN;oBACE,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,OAAO,EACL,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;wBAC/B,CAAC,CAAC,KAAK,CAAC,OAAO;wBACf,CAAC,CAAC,0DAA0D;oBAChE,OAAO,EAAE,KAAK;iBACf;aACF;YACD,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE;SACxB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC;YACZ,QAAQ;YACR,IAAI;YACJ,MAAM,EAAE,eAAe;YACvB,KAAK;YACL,QAAQ,EAAE,QAAQ,CAAC,iBAAiB,CAAC,QAAQ;YAC7C,MAAM,EAAE;gBACN;oBACE,IAAI,EAAE,mDAAmD;oBACzD,OAAO,EACL,uJAAuJ;oBACzJ,OAAO,EAAE,QAAQ,CAAC,iBAAiB,CAAC,KAAK;iBAC1C;aACF;YACD,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE;SACxB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,GAAG,MAAM,SAAS,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;IACzE,yBAAyB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;QACjE,OAAO,MAAM,CAAC;YACZ,QAAQ;YACR,IAAI;YACJ,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;YAC7D,KAAK;YACL,QAAQ,EAAE,MAAM;YAChB,MAAM,EACJ,MAAM,CAAC,MAAM,KAAK,YAAY;gBAC5B,CAAC,CAAC;oBACE;wBACE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,sCAAsC;wBAC3D,OAAO,EACL,6GAA6G;qBAChH;iBACF;gBACH,CAAC,CAAC,EAAE;YACR,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE;SACxB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,kBAAkB,IAAI,CAAC,MAAM,CAAC,yBAAyB,EAAE,CAAC;QACpE,OAAO,MAAM,CAAC;YACZ,QAAQ;YACR,IAAI;YACJ,MAAM,EAAE,SAAS;YACjB,KAAK;YACL,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE;gBACN;oBACE,IAAI,EAAE,+CAA+C;oBACrD,OAAO,EACL,8FAA8F;iBACjG;aACF;YACD,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE;SACxB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC;YACZ,QAAQ;YACR,IAAI;YACJ,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC;YAClC,KAAK;YACL,QAAQ,EAAE,MAAM;YAChB,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE;SACxB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,GAAG,MAAM,uBAAuB,CAAC;YACrC,OAAO;YACP,QAAQ;YACR,OAAO;YACP,KAAK;YACL,OAAO,EAAE,MAAM;YACf,YAAY;SACb,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;YACZ,QAAQ;YACR,IAAI;YACJ,MAAM,EACJ,MAAM,CAAC,MAAM,KAAK,WAAW;gBAC3B,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC;gBAC5B,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,YAAY;oBAC9B,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ;wBAC1B,CAAC,CAAC,QAAQ;wBACV,CAAC,CAAC,SAAS;YACnB,KAAK;YACL,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,MAAM,CAAC,qBAAqB;gBAClC,CAAC,CAAC;oBACE;wBACE,IAAI,EAAE,gDAAgD;wBACtD,OAAO,EACL,8HAA8H;wBAChI,OAAO,EAAE,EAAE,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,EAAE;qBAC/D;iBACF;gBACH,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW,IAAI,kCAAkC,CAAC,MAAM,CAAC;oBAC3E,CAAC,CAAC;wBACE;4BACE,IAAI,EAAE,8BAA8B;4BACpC,OAAO,EACL,sIAAsI;yBACzI;qBACF;oBACH,CAAC,CAAC,EAAE;YACR,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE;SACxB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC;YACZ,QAAQ;YACR,IAAI;YACJ,MAAM,EAAE,SAAS;YACjB,KAAK;YACL,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE;gBACN;oBACE,IAAI,EAAE,wDAAwD;oBAC9D,OAAO,EACL,8KAA8K;oBAChL,OAAO,EAAE;wBACP,iBAAiB,EAAE,KAAK;wBACxB,2BAA2B,EAAE,CAAC;wBAC9B,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;wBACvD,YAAY,EAAE,MAAM,CAAC,YAAY;wBACjC,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;qBAC1D;iBACF;aACF;YACD,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE;SACxB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,UAAU,GAAgC,eAAe,CAAC;IAE9D,IAAI,WAAW,GAAkB,MAAM,CAAC,YAAY,CAAC;IACrD,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAC3B,OACE,CAAC,MAAM,CAAC,gBAAgB;QACxB,WAAW,KAAK,IAAI;QACpB,WAAW,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAC7C,CAAC;QACD,IACE,CAAC,MAAM,CAAC,eAAe;YACvB,CAAC,MAAM,CAAC,kBAAkB;YAC1B,CAAC,MAAM,CAAC,yBAAyB,EACjC,CAAC;YACD,OAAO,MAAM,CAAC;gBACZ,QAAQ;gBACR,IAAI;gBACJ,MAAM,EAAE,SAAS;gBACjB,KAAK;gBACL,QAAQ,EAAE,MAAM;gBAChB,MAAM,EAAE;oBACN;wBACE,IAAI,EAAE,+CAA+C;wBACrD,OAAO,EACL,+FAA+F;qBAClG;iBACF;gBACD,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE;aACxB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GAAG,WAAW,CAAC;QAC5B,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9E,MAAM,OAAO,GAAG,+BAA+B,CAAC;YAC9C,gBAAgB,EAAE,KAAK,CAAC,kBAAkB;YAC1C,OAAO;YACP,wBAAwB,EAAE,MAAM,CAAC,2BAA2B;SAC7D,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAC1B,QAAQ,CAAC,MAAM,EACf,mBAAmB,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAC3D,CAAC;QACF,MAAM,mBAAmB,GAAG,IAAI,CAAC,IAAI,CACnC,QAAQ,CAAC,MAAM,EACf,4BAA4B,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CACpE,CAAC;QACF,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3B,MAAM,eAAe,GAAG,yBAAyB,CAAC;gBAChD,QAAQ,EAAE,mBAAmB;gBAC7B,KAAK,EAAE,yBAAyB,OAAO,mBAAmB;gBAC1D,gBAAgB,EAAE,wBAAwB;gBAC1C,qBAAqB,EAAE,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC;aAC9D,CAAC,CAAC;YACH,IAAI,eAAe,EAAE,CAAC;gBACpB,OAAO,4BAA4B,CAAC;oBAClC,QAAQ;oBACR,IAAI;oBACJ,OAAO;oBACP,KAAK;oBACL,YAAY;oBACZ,OAAO;oBACP,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC;oBACrD,QAAQ,EAAE,eAAe;oBACzB,aAAa,EAAE,mBAAmB;iBACnC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,MAAM,CAAC;gBACZ,QAAQ;gBACR,IAAI;gBACJ,MAAM,EAAE,SAAS;gBACjB,KAAK;gBACL,QAAQ,EAAE,MAAM;gBAChB,MAAM,EAAE;oBACN;wBACE,IAAI,EAAE,iDAAiD;wBACvD,OAAO,EAAE,WAAW,OAAO,4FAA4F;qBACxH;iBACF;gBACD,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE;aACxB,CAAC,CAAC;QACL,CAAC;QACD,yBAAyB,CAAC,UAAU,EAAE;YACpC,cAAc,EAAE,0CAA0C;YAC1D,gBAAgB,EAAE,YAAY,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;YAClD,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,OAAO;YACP,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;YACtD,SAAS,EAAE,CAAC;YACZ,eAAe,EAAE,KAAK;SACvB,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC;gBACrC,OAAO;gBACP,OAAO,EAAE,KAAK,CAAC,QAAQ;gBACvB,OAAO;gBACP,aAAa,EAAE,UAAU;aAC1B,CAAC,CAAC;YACH,IAAI,6BAA6B,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvC,8BAA8B,CAAC,GAAG,EAAE,WAAW,OAAO,EAAE,CAAC,CAAC;gBAC1D,OAAO,4BAA4B,CAAC;oBAClC,QAAQ;oBACR,IAAI;oBACJ,OAAO;oBACP,KAAK;oBACL,YAAY;oBACZ,OAAO;oBACP,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC;oBACrD,QAAQ,EAAE,GAAG;oBACb,aAAa,EAAE,mBAAmB;iBACnC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,QAAQ,GAAG,+BAA+B,CAAC;gBAC/C,KAAK,EAAE,GAAG;gBACV,kBAAkB,EAAE,UAAU,CAAC,UAAU,GAAG,CAAC;gBAC7C,oBAAoB,EAAE,UAAU,CAAC,aAAa;gBAC9C,cAAc,EAAE,IAAI;gBACpB,KAAK,EAAE,yBAAyB,OAAO,EAAE;aAC1C,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,6BAA6B,CAAC;gBAC1C,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,OAAO,EAAE,KAAK,CAAC,QAAQ;gBACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC;gBACrD,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU;gBACnC,kBAAkB,EAAE,QAAQ,CAAC,IAAI,CAAC,oBAAoB;gBACtD,qBAAqB,EAAE,QAAQ,CAAC,IAAI,CAAC,wBAAwB;gBAC7D,sBAAsB,EAAE,QAAQ,CAAC,IAAI,CAAC,yBAAyB;gBAC/D,wBAAwB,EAAE,MAAM,CAAC,2BAA2B;gBAC5D,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM;gBAC5C,oBAAoB,EAAE,UAAU,CAAC,aAAa;gBAC9C,8BAA8B,EAAE,UAAU,CAAC,UAAU;aACtD,CAAC,CAAC;YACH,yBAAyB,CACvB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,EACpF,KAAK,CACN,CAAC;YACF,0EAA0E;YAC1E,UAAU,GAAG,QAAQ,CAAC,eAAgB,CAAC;YACvC,kBAAkB,IAAI,CAAC,CAAC;YACxB,WAAW,GAAG,KAAK,CAAC,YAAY,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yBAAyB,CACvB,IAAI,CAAC,IAAI,CACP,QAAQ,CAAC,MAAM,EACf,2BAA2B,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CACnE,EACD;gBACE,cAAc,EAAE,kDAAkD;gBAClE,eAAe,EAAE,YAAY,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;gBACjD,OAAO;gBACP,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;gBACtD,eAAe,EAAE,KAAK;gBACtB,QAAQ,EAAE,iBAAiB;gBAC3B,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;aAC3B,CACF,CAAC;YACF,IAAI,SAAS,GAAmC,IAAI,CAAC;YACrD,IAAI,CAAC;gBACH,SAAS,GAAG,MAAM,SAAS,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;gBACxE,yBAAyB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YACjD,CAAC;YAAC,OAAO,SAAS,EAAE,CAAC;gBACnB,yBAAyB,CACvB,IAAI,CAAC,IAAI,CACP,QAAQ,CAAC,MAAM,EACf,+BAA+B,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CACvE,EACD,EAAE,eAAe,EAAE,YAAY,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,CACtF,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC;gBACZ,QAAQ;gBACR,IAAI;gBACJ,MAAM,EAAE,eAAe;gBACvB,KAAK;gBACL,QAAQ,EAAE,SAAS;gBACnB,MAAM,EAAE;oBACN;wBACE,IAAI,EAAE,kDAAkD;wBACxD,OAAO,EACL,oGAAoG;wBACtG,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC;qBAC7B;iBACF;gBACD,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE;aACxB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,kBAAkB,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,GAAG,MAAM,SAAS,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QACrE,yBAAyB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,CAAC,MAAM,CAAC,kBAAkB,IAAI,CAAC,MAAM,CAAC,yBAAyB,EAAE,CAAC;QAC/F,OAAO,MAAM,CAAC;YACZ,QAAQ;YACR,IAAI;YACJ,MAAM,EAAE,SAAS;YACjB,KAAK;YACL,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE;gBACN;oBACE,IAAI,EAAE,+CAA+C;oBACrD,OAAO,EACL,0GAA0G;iBAC7G;aACF;YACD,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE;SACxB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,GAAG,MAAM,uBAAuB,CAAC;QACrC,OAAO;QACP,QAAQ;QACR,OAAO;QACP,KAAK;QACL,OAAO,EAAE,MAAM;QACf,YAAY;KACb,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC;YACZ,QAAQ;YACR,IAAI;YACJ,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC;YAClC,KAAK;YACL,QAAQ,EAAE,MAAM;YAChB,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE;SACxB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACjE,OAAO,MAAM,CAAC;YACZ,QAAQ;YACR,IAAI;YACJ,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;YAC7D,KAAK;YACL,QAAQ,EAAE,MAAM;YAChB,MAAM,EACJ,MAAM,CAAC,MAAM,KAAK,YAAY;gBAC5B,CAAC,CAAC;oBACE;wBACE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,sCAAsC;wBAC3D,OAAO,EACL,uHAAuH;qBAC1H;iBACF;gBACH,CAAC,CAAC,EAAE;YACR,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE;SACxB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,CAAC,MAAM,CAAC,kBAAkB,IAAI,CAAC,MAAM,CAAC,yBAAyB,EAAE,CAAC;QAC/F,OAAO,MAAM,CAAC;YACZ,QAAQ;YACR,IAAI;YACJ,MAAM,EAAE,SAAS;YACjB,KAAK;YACL,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE;gBACN;oBACE,IAAI,EAAE,+CAA+C;oBACrD,OAAO,EACL,iGAAiG;iBACpG;aACF;YACD,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE;SACxB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,qBAAqB,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC;YACZ,QAAQ;YACR,IAAI;YACJ,MAAM,EAAE,SAAS;YACjB,KAAK;YACL,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE;gBACN;oBACE,IAAI,EAAE,gDAAgD;oBACtD,OAAO,EACL,6JAA6J;oBAC/J,OAAO,EAAE,EAAE,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,EAAE;iBAC/D;aACF;YACD,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE;SACxB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,kCAAkC,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC;YACZ,QAAQ;YACR,IAAI;YACJ,MAAM,EAAE,SAAS;YACjB,KAAK;YACL,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE;gBACN;oBACE,IAAI,EAAE,mCAAmC;oBACzC,OAAO,EACL,6NAA6N;iBAChO;aACF;YACD,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE;SACxB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,eAAe,GAAG,gCAAgC,CAAC;QACvD,gBAAgB,EAAE,KAAK,CAAC,kBAAkB;QAC1C,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,MAAM;KACP,CAAC,CAAC;IACH,MAAM,qBAAqB,GAAG,4BAA4B,CAAC,eAAe,CAAC,CAAC;IAC5E,MAAM,mBAAmB,GAAG,oBAAoB,CAAC,QAAQ,EAAE,SAAS,EAAE,qBAAqB,CAAC,CAAC;IAC7F,MAAM,qBAAqB,GAAG,oBAAoB,CAChD,QAAQ,EACR,kBAAkB,EAClB,qBAAqB,CACtB,CAAC;IACF,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC;IACzF,MAAM,qBAAqB,GAAG,oBAAoB,CAChD,QAAQ,EACR,iBAAiB,EACjB,qBAAqB,CACtB,CAAC;IACF,MAAM,kBAAkB,GAAG,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IACjE,MAAM,kBAAkB,GAAG,yBAAyB,CAAC;QACnD,QAAQ;QACR,KAAK;QACL,aAAa,EAAE,qBAAqB;KACrC,CAAC,CAAC;IACH,IAAI,kBAAkB,EAAE,CAAC;QACvB,MAAM,eAAe,GAAG,yBAAyB,CAAC;YAChD,QAAQ,EAAE,qBAAqB;YAC/B,KAAK,EAAE,yCAAyC;YAChD,gBAAgB,EAAE,gBAAgB;YAClC,qBAAqB,EAAE,qBAAqB;SAC7C,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,uBAAuB,CAAC;YAC1C,QAAQ;YACR,KAAK;YACL,OAAO,EAAE,kBAAkB;YAC3B,aAAa,EAAE,qBAAqB;SACrC,CAAC,CAAC;QACH,IAAI,eAAe,IAAI,WAAW,EAAE,CAAC;YACnC,IAAI,CACF,mEAAmE,EACnE,kDAAkD,CACnD,CAAC;QACJ,CAAC;QACD,IAAI,eAAe,EAAE,CAAC;YACpB,OAAO,MAAM,CAAC;gBACZ,QAAQ;gBACR,IAAI;gBACJ,MAAM,EAAE,SAAS;gBACjB,KAAK;gBACL,QAAQ,EAAE,MAAM;gBAChB,MAAM,EAAE;oBACN;wBACE,IAAI,EAAE,eAAe,CAAC,IAAI;wBAC1B,OAAO,EACL,OAAO,eAAe,CAAC,OAAO,KAAK,QAAQ;4BACzC,CAAC,CAAC,eAAe,CAAC,OAAO;4BACzB,CAAC,CAAC,mDAAmD;wBACzD,OAAO,EAAE;4BACP,QAAQ,EAAE,eAAe;4BACzB,cAAc,EAAE,qBAAqB;4BACrC,QAAQ,EAAE,wBAAwB;yBACnC;qBACF;iBACF;gBACD,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE;aACxB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,MAAM,CAAC;gBACZ,QAAQ;gBACR,IAAI;gBACJ,MAAM,EACJ,WAAW,CAAC,MAAM,KAAK,QAAQ;oBAC7B,CAAC,CAAC,QAAQ;oBACV,CAAC,CAAC,WAAW,CAAC,MAAM,KAAK,YAAY;wBACnC,CAAC,CAAC,SAAS;wBACX,CAAC,CAAC,SAAS;gBACjB,KAAK;gBACL,QAAQ,EAAE,MAAM;gBAChB,MAAM,EAAE;oBACN;wBACE,IAAI,EAAE,uDAAuD;wBAC7D,OAAO,EACL,8MAA8M;wBAChN,OAAO,EAAE;4BACP,cAAc,EAAE,qBAAqB;4BACrC,YAAY,EAAE,WAAW,CAAC,MAAM;yBACjC;qBACF;iBACF;gBACD,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE;aACxB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;YACZ,QAAQ;YACR,IAAI;YACJ,MAAM,EAAE,eAAe;YACvB,KAAK;YACL,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE;gBACN;oBACE,IAAI,EAAE,kDAAkD;oBACxD,OAAO,EACL,sJAAsJ;oBACxJ,OAAO,EAAE,EAAE,cAAc,EAAE,qBAAqB,EAAE;iBACnD;aACF;YACD,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE;SACxB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,UAAU,CAAC,qBAAqB,CAAC,IAAI,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACvE,IAAI,CACF,8DAA8D,EAC9D,iDAAiD,CAClD,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,kBAAkB,IAAI,kBAAkB,EAAE,CAAC;QACpD,MAAM,YAAY,GAAG,yBAAyB,CAAC;YAC7C,QAAQ;YACR,KAAK;YACL,aAAa,EAAE,kBAAkB;SAClC,CAAC,CAAC;QACH,IAAI,CAAC,YAAY;YAAE,SAAS;QAC5B,MAAM,cAAc,GAAG,yBAAyB,CAAC;YAC/C,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,kBAAkB,CAAC;YAChF,KAAK,EAAE,+CAA+C;YACtD,gBAAgB,EAAE,gBAAgB;YAClC,qBAAqB,EAAE,kBAAkB;SAC1C,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,uBAAuB,CAAC;YACzC,QAAQ;YACR,KAAK;YACL,OAAO,EAAE,YAAY;YACrB,aAAa,EAAE,kBAAkB;SAClC,CAAC,CAAC;QACH,IAAI,cAAc,IAAI,CAAC,UAAU,EAAE,CAAC;YAClC,OAAO,MAAM,CAAC;gBACZ,QAAQ;gBACR,IAAI;gBACJ,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe;gBACpD,KAAK;gBACL,QAAQ,EAAE,MAAM;gBAChB,MAAM,EAAE;oBACN;wBACE,IAAI,EAAE,cAAc,EAAE,IAAI,IAAI,kDAAkD;wBAChF,OAAO,EACL,2IAA2I;wBAC7I,OAAO,EAAE;4BACP,oBAAoB,EAAE,kBAAkB;4BACxC,sBAAsB,EAAE,qBAAqB;yBAC9C;qBACF;iBACF;gBACD,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE;aACxB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,qBAAqB,EAAE,CAAC;YAChD,OAAO,MAAM,CAAC;gBACZ,QAAQ;gBACR,IAAI;gBACJ,MAAM,EAAE,UAAU,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;gBAC7D,KAAK;gBACL,QAAQ,EAAE,MAAM;gBAChB,MAAM,EAAE;oBACN;wBACE,IAAI,EAAE,2DAA2D;wBACjE,OAAO,EACL,wHAAwH;wBAC1H,OAAO,EAAE;4BACP,oBAAoB,EAAE,kBAAkB;4BACxC,YAAY,EAAE,UAAU,CAAC,MAAM;4BAC/B,sBAAsB,EAAE,qBAAqB;yBAC9C;qBACF;iBACF;gBACD,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE;aACxB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,yBAAyB,CAAC,mBAAmB,EAAE;QAC7C,cAAc,EAAE,2CAA2C;QAC3D,gBAAgB,EAAE,YAAY,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;QAClD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,qBAAqB;QACrC,OAAO,EAAE,eAAe;QACxB,SAAS,EAAE,CAAC;QACZ,eAAe,EAAE,KAAK;KACvB,CAAC,CAAC;IACH,IAAI,aAAwC,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC;YACtC,OAAO;YACP,OAAO,EAAE,KAAK,CAAC,QAAQ;YACvB,OAAO,EAAE,eAAe;YACxB,aAAa,EAAE,UAAU;SAC1B,CAAC,CAAC;QACH,IACE,YAAY,CAAC,GAAG,CAAC;YACjB,GAAG,CAAC,cAAc,KAAK,gDAAgD,EACvE,CAAC;YACD,MAAM,UAAU,GAAG,UAAU,CAAC;YAC9B,MAAM,QAAQ,GACZ,GAAG,CAAC,EAAE,KAAK,IAAI;gBACb,CAAC,CAAC,+BAA+B,CAAC;oBAC9B,KAAK,EAAE,GAAG;oBACV,kBAAkB,EAAE,UAAU,CAAC,UAAU,GAAG,CAAC;oBAC7C,oBAAoB,EAAE,UAAU,CAAC,aAAa;oBAC9C,cAAc,EAAE,GAAG,CAAC,MAAM,KAAK,qBAAqB;oBACpD,eAAe,EAAE,GAAG,CAAC,MAAM,KAAK,qBAAqB;oBACrD,KAAK,EAAE,wBAAwB;iBAChC,CAAC;gBACJ,CAAC,CAAC,CAAC,GAAG,EAAE;oBACJ,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,kBAAkB,CAAC,EAAE,CAAC;wBAC3C,IAAI,CACF,qEAAqE,EACrE,uDAAuD,CACxD,CAAC;oBACJ,CAAC;oBACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;gBAC/C,CAAC,CAAC,EAAE,CAAC;YACX,aAAa,GAAG,8BAA8B,CAAC;gBAC7C,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,OAAO,EAAE,KAAK,CAAC,QAAQ;gBACvB,gBAAgB,EAAE,KAAK,CAAC,kBAAkB;gBAC1C,OAAO,EAAE,eAAe;gBACxB,oBAAoB,EAAE,UAAU,CAAC,aAAa;gBAC9C,8BAA8B,EAAE,UAAU,CAAC,UAAU;aACtD,CAAC,CAAC;YACH,IAAI,QAAQ,CAAC,eAAe,KAAK,IAAI;gBAAE,UAAU,GAAG,QAAQ,CAAC,eAAe,CAAC;YAC7E,yBAAyB,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;QAC9D,CAAC;aAAM,IAAI,6BAA6B,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9C,8BAA8B,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YAChD,yBAAyB,CAAC,qBAAqB,EAAE;gBAC/C,cAAc,EAAE,oDAAoD;gBACpE,MAAM,EAAE,UAAU;gBAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,cAAc,EAAE,qBAAqB;gBACrC,eAAe,EAAE,KAAK;gBACtB,iBAAiB,EAAE,KAAK;gBACxB,QAAQ,EAAE,wBAAwB;gBAClC,QAAQ,EAAE,GAAG;aACd,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;gBACZ,QAAQ;gBACR,IAAI;gBACJ,MAAM,EAAE,SAAS;gBACjB,KAAK;gBACL,QAAQ,EAAE,MAAM;gBAChB,MAAM,EAAE;oBACN;wBACE,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,OAAO,EACL,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;4BAC7B,CAAC,CAAC,GAAG,CAAC,OAAO;4BACb,CAAC,CAAC,mDAAmD;wBACzD,OAAO,EAAE;4BACP,QAAQ,EAAE,GAAG;4BACb,cAAc,EAAE,qBAAqB;4BACrC,QAAQ,EAAE,wBAAwB;yBACnC;qBACF;iBACF;gBACD,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE;aACxB,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,IAAI,CACF,iFAAiF,EACjF,iDAAiD,CAClD,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,yBAAyB,CAAC,qBAAqB,EAAE;YAC/C,cAAc,EAAE,mDAAmD;YACnE,eAAe,EAAE,YAAY,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;YACjD,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,cAAc,EAAE,qBAAqB;YACrC,eAAe,EAAE,KAAK;YACtB,QAAQ,EAAE,iBAAiB;YAC3B,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;SAC3B,CAAC,CAAC;QACH,IAAI,SAAS,GAAmC,IAAI,CAAC;QACrD,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,SAAS,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;YACxE,yBAAyB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,6FAA6F;QAC/F,CAAC;QACD,OAAO,MAAM,CAAC;YACZ,QAAQ;YACR,IAAI;YACJ,MAAM,EAAE,eAAe;YACvB,KAAK;YACL,QAAQ,EAAE,SAAS;YACnB,MAAM,EAAE;gBACN;oBACE,IAAI,EAAE,mDAAmD;oBACzD,OAAO,EACL,uGAAuG;oBACzG,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC;iBAC7B;aACF;YACD,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE;SACxB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,GAAG,MAAM,SAAS,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;IACrE,yBAAyB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5C,OAAO,MAAM,CAAC;QACZ,QAAQ;QACR,IAAI;QACJ,MAAM,EACJ,aAAa,CAAC,MAAM,KAAK,WAAW;YACpC,MAAM,CAAC,MAAM,KAAK,WAAW;YAC7B,4CAA4C,CAAC,MAAM,CAAC;YAClD,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,YAAY,IAAI,aAAa,CAAC,MAAM,KAAK,YAAY;gBACvE,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,aAAa,CAAC,MAAM,KAAK,QAAQ;oBAC/D,CAAC,CAAC,QAAQ;oBACV,CAAC,CAAC,SAAS;QACnB,KAAK;QACL,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,aAAa,CAAC,qBAAqB;YACzC,CAAC,CAAC;gBACE;oBACE,IAAI,EAAE,gDAAgD;oBACtD,OAAO,EACL,8HAA8H;oBAChI,OAAO,EAAE,EAAE,oBAAoB,EAAE,aAAa,CAAC,oBAAoB,EAAE;iBACtE;aACF;YACH,CAAC,CAAC,EAAE;QACN,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE;KACxB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAA+B;IAE/B,uEAAuE;IACvE,4EAA4E;IAC5E,sCAAsC;IACtC,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC/B,OAAO,iBAAiB,CACtB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,yBAAyB,CAAC,EAC5C,EAAE,MAAM,EAAE,qCAAqC,EAAE,SAAS,EAAE,CAAC,EAAE,EAC/D,GAAG,EAAE,CACH,UAAU,CACR,OAAO,EACP;QACE,cAAc,EAAE,+BAA+B;QAC/C,SAAS,EAAE,qCAAqC;QAChD,MAAM,EAAE,kCAAkC;QAC1C,OAAO,EAAE,mCAAmC;QAC5C,OAAO,EAAE,qCAAqC;QAC9C,IAAI,EAAE,gCAAgC;QACtC,QAAQ,EAAE,oCAAoC;QAC9C,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;QACnF,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE;QACpC,aAAa,EAAE,yBAAyB;KACzC,EACD,QAAQ,CACT,CACJ,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,aAAa;IACb,kBAAkB;IAClB,YAAY;IACZ,UAAU;IACV,oBAAoB;IACpB,gBAAgB;IAChB,UAAU;IACV,WAAW;IACX,iBAAiB;IACjB,qBAAqB;IACrB,MAAM;IACN,yBAAyB;IACzB,uBAAuB;CACxB,CAAC","sourcesContent":["import { existsSync, readdirSync } from 'node:fs';\nimport path from 'node:path';\nimport {\n  ensurePrivateArtifactDirectory,\n  readProtectedJsonArtifact,\n  writePrivateImmutableJson,\n} from './dataset-maintenance-protected-artifacts.js';\nimport {\n  buildFlowIdentityFinalizeRequest,\n  buildFlowIdentityProcessRequest,\n  buildFlowIdentityScopeLookupRequest,\n  flowIdentityScopeHasCurrentDerivativeClosure,\n  flowIdentityScopeIsReadyToFinalize,\n  parseFlowIdentityFinalizeProof,\n  parseFlowIdentityProcessProof,\n  parseFlowIdentityScopePreflightProof,\n  parseFlowIdentityScopeLookupProof,\n  parseFlowIdentityScopeStatus,\n  prepareFlowIdentityExecution,\n  splitFlowIdentityPermitResponse,\n  type FlowIdentityExecutionPermit,\n  type FlowIdentityExecutionIdentity,\n  type FlowIdentityFinalizeProof,\n  type FlowIdentityScopeProof,\n  type FlowIdentityScopeStatus,\n} from './dataset-maintenance-flow-identity-execution-contract.js';\nimport {\n  assertFreshRecoveryBaseline,\n  parseFlowIdentityRecoveryProof,\n  prepareFlowIdentityRecoveryExecution,\n  type PreparedFlowIdentityRecoveryExecution,\n} from './dataset-maintenance-flow-identity-recovery.js';\nimport {\n  isJsonObject,\n  sha256Json,\n  stableJsonText,\n  type JsonObject,\n} from './dataset-maintenance-contract.js';\nimport { flowIdentityRestrictedSha256 } from './dataset-maintenance-flow-identity-wire.js';\nimport type {\n  FlowIdentityPlan,\n  FlowIdentityProcessTemplate,\n} from './dataset-maintenance-flow-identity-contract.js';\nimport {\n  finalizeMaintenanceFlowIdentityScope,\n  isMaintenanceRpcDomainFailure,\n  lookupMaintenanceFlowIdentityScope,\n  preflightMaintenanceFlowIdentityScope,\n  recoverMaintenanceFlowIdentityScope,\n  readMaintenanceFlowIdentityScope,\n  resolveMaintenanceRemoteContext,\n  rewriteMaintenanceFlowIdentityProcess,\n  type MaintenanceRpcDomainFailure,\n  type DatasetMaintenanceRemoteContext,\n} from './dataset-maintenance-remote.js';\nimport { CliError } from './errors.js';\nimport type { FetchLike } from './http.js';\nimport { withStateFileLock } from './state-lock.js';\nimport {\n  claimFlowIdentityApproval,\n  readFlowIdentityApprovalClaim,\n  type FlowIdentityApprovalClaim,\n} from './dataset-maintenance-flow-identity-approval-claim.js';\n\nexport type FlowIdentityRunStatus = 'passed' | 'pending' | 'blocked' | 'failed' | 'indeterminate';\n\nexport type RunFlowIdentityOptions = {\n  planPath: string;\n  freezePath: string;\n  approvalPath: string;\n  recoveryFreezePath?: string;\n  recoveryApprovalPath?: string;\n  recoveryRunDir?: string;\n  outDir: string;\n  commit: boolean;\n  statusOnly: boolean;\n  approveExecution?: string;\n  confirm?: string;\n  waitSeconds?: number;\n  pollMs?: number;\n  timeoutMs?: number;\n  env: NodeJS.ProcessEnv;\n  fetchImpl: FetchLike;\n  now?: Date;\n  sleep?: (ms: number) => Promise<void>;\n};\n\nexport type FlowIdentityRunReport = {\n  schema_version: 'dataset-flow-identity-run-report.v2';\n  generated_at_utc: string;\n  mode: 'commit' | 'status_only';\n  status: FlowIdentityRunStatus;\n  operation_id: string;\n  plan_sha256: string;\n  request_id: string;\n  identity_sha256: string;\n  scope_id: string | null;\n  database_status: FlowIdentityScopeStatus['status'] | null;\n  process_count: number;\n  completed_process_count: number;\n  next_ordinal: number | null;\n  automatic_retry: false;\n  issues: Array<{ code: string; message: string; details?: unknown }>;\n};\n\ntype ProcessTemplate = Pick<\n  FlowIdentityProcessTemplate,\n  'process' | 'rewrites' | 'collision_ledger'\n>;\n\ntype PreparedRun = ReturnType<typeof prepareFlowIdentityExecution> & {\n  planPath: string;\n  outDir: string;\n  templates: ProcessTemplate[];\n  recovery: PreparedFlowIdentityRecoveryExecution | null;\n  approvalClaim: FlowIdentityApprovalClaim | null;\n};\n\ntype RunDependencies = {\n  resolveContext: typeof resolveMaintenanceRemoteContext;\n  preflight: typeof preflightMaintenanceFlowIdentityScope;\n  lookup?: typeof lookupMaintenanceFlowIdentityScope;\n  recover?: typeof recoverMaintenanceFlowIdentityScope;\n  rewrite: typeof rewriteMaintenanceFlowIdentityProcess;\n  read: typeof readMaintenanceFlowIdentityScope;\n  finalize: typeof finalizeMaintenanceFlowIdentityScope;\n  sleep: (ms: number) => Promise<void>;\n  now: () => Date;\n  claimApproval?: (options: { claim: FlowIdentityApprovalClaim; env: NodeJS.ProcessEnv }) => string;\n};\n\ntype ObtainedScope = {\n  scope: FlowIdentityScopeProof | MaintenanceRpcDomainFailure;\n  executionPermit: FlowIdentityExecutionPermit | null;\n  recoveryAmbiguity?: {\n    observed: FlowIdentityScopeStatus | null;\n    error: { name: string; message: string; code: string | null };\n  };\n};\n\nconst DEFAULT_POLL_MS = 10_000;\nconst PARTIAL_EXECUTION_RECOVERY =\n  'partial_execution_requires_status_read_and_operator_approved_scope_recovery';\nconst OPERATOR_REVIEW_REQUIRED = 'operator_review_required';\n\nfunction fail(message: string, code: string, details?: unknown): never {\n  throw new CliError(message, {\n    code,\n    exitCode: 1,\n    ...(details === undefined ? {} : { details }),\n  });\n}\n\nfunction errorDetails(error: unknown): { name: string; message: string; code: string | null } {\n  return {\n    name: error instanceof Error ? error.name : 'Error',\n    message: error instanceof Error ? error.message : String(error),\n    code:\n      error && typeof error === 'object' && 'code' in error && typeof error.code === 'string'\n        ? error.code\n        : null,\n  };\n}\n\nfunction assertDomainFailureHasNoPermit(value: MaintenanceRpcDomainFailure, label: string): void {\n  if (Object.hasOwn(value, 'execution_permit')) {\n    fail(\n      `${label} domain rejection unexpectedly contained a bearer permit.`,\n      'DATASET_FLOW_IDENTITY_DOMAIN_REJECTION_PERMIT_INVALID',\n    );\n  }\n}\n\nfunction readCanonicalJson(filePath: string, label: string): unknown {\n  const artifact = readProtectedJsonArtifact({ filePath, label });\n  if (artifact.text !== `${stableJsonText(artifact.value)}\\n`) {\n    fail(\n      `${label} must be canonical JSON with exactly one trailing newline.`,\n      'DATASET_FLOW_IDENTITY_ARTIFACT_NONCANONICAL',\n    );\n  }\n  return artifact.value;\n}\n\nfunction processStem(ordinal: number, id: string, version: string): string {\n  return `${String(ordinal).padStart(6, '0')}-${id}-${version}`;\n}\n\nfunction loadProcessTemplates(planPath: string, plan: FlowIdentityPlan): ProcessTemplate[] {\n  const planDir = path.dirname(planPath);\n  return plan.processes.map((process) => {\n    const filePath = path.join(\n      planDir,\n      plan.artifacts.process_request_dir,\n      `${processStem(process.ordinal, process.id, process.version)}.json`,\n    );\n    const value = readCanonicalJson(filePath, `Flow identity process template ${process.ordinal}`);\n    if (\n      !isJsonObject(value) ||\n      !isJsonObject(value.process) ||\n      !Array.isArray(value.rewrites) ||\n      !isJsonObject(value.collision_ledger) ||\n      sha256Json(value.process) !== sha256Json(process) ||\n      sha256Json(value.rewrites) !== process.rewrite_set_sha256 ||\n      sha256Json(value.collision_ledger) !== process.collision_ledger_sha256 ||\n      value.rewrites.length !== process.rewrite_count\n    ) {\n      fail(\n        `Process template ${process.ordinal} does not bind the sealed manifest.`,\n        'DATASET_FLOW_IDENTITY_PROCESS_TEMPLATE_INVALID',\n      );\n    }\n    return value as unknown as ProcessTemplate;\n  });\n}\n\nfunction readRecoveryInputScope(options: {\n  runDir: string;\n  recoveryFreezePath: string;\n  plan: FlowIdentityPlan;\n  identity: FlowIdentityExecutionIdentity;\n}): unknown {\n  const candidates = [\n    path.join(path.resolve(options.runDir), 'scope-preflight-proof.json'),\n    path.join(path.resolve(options.runDir), 'scope-lookup-proof.json'),\n    path.join(\n      path.dirname(path.resolve(options.recoveryFreezePath)),\n      'flow-identity-recovery-scope-proof.json',\n    ),\n  ];\n  const found = candidates.find((candidate) => existsSync(candidate));\n  if (!found) {\n    fail(\n      'Recovery run requires an exact preflight or read-only lookup scope proof.',\n      'DATASET_FLOW_IDENTITY_SCOPE_PROOF_REQUIRED',\n    );\n  }\n  return readCanonicalJson(found, 'Flow identity recovery scope proof');\n}\n\nfunction prepareRun(options: RunFlowIdentityOptions): PreparedRun {\n  if (options.commit === options.statusOnly) {\n    fail('Choose exactly one of commit or statusOnly.', 'DATASET_FLOW_IDENTITY_RUN_MODE_INVALID');\n  }\n  const planPath = path.resolve(options.planPath);\n  const prepared = prepareFlowIdentityExecution({\n    plan: readCanonicalJson(planPath, 'Flow identity plan'),\n    freeze: readCanonicalJson(options.freezePath, 'Flow identity freeze'),\n    approval: readCanonicalJson(options.approvalPath, 'Flow identity approval'),\n  });\n  const recoveryPathCount = [\n    options.recoveryFreezePath,\n    options.recoveryApprovalPath,\n    options.recoveryRunDir,\n  ].filter(Boolean).length;\n  if (recoveryPathCount !== 0 && recoveryPathCount !== 3) {\n    fail(\n      'Recovery run requires recoveryFreezePath, recoveryApprovalPath, and recoveryRunDir together.',\n      'DATASET_FLOW_IDENTITY_RECOVERY_ARGUMENTS_INVALID',\n    );\n  }\n  const recovery =\n    recoveryPathCount === 3\n      ? prepareFlowIdentityRecoveryExecution({\n          plan: readCanonicalJson(planPath, 'Flow identity recovery plan'),\n          originalFreeze: readCanonicalJson(\n            options.freezePath,\n            'Flow identity recovery original freeze',\n          ),\n          originalApproval: readCanonicalJson(\n            options.approvalPath,\n            'Flow identity recovery original approval',\n          ),\n          scope: readRecoveryInputScope({\n            runDir: options.recoveryRunDir!,\n            recoveryFreezePath: options.recoveryFreezePath!,\n            plan: prepared.plan,\n            identity: prepared.identity,\n          }),\n          recoveryFreeze: readCanonicalJson(\n            options.recoveryFreezePath!,\n            'Flow identity recovery freeze',\n          ),\n          recoveryApproval: readCanonicalJson(\n            options.recoveryApprovalPath!,\n            'Flow identity recovery approval',\n          ),\n        })\n      : null;\n  if (options.commit) {\n    const expectedApprovalIdentity =\n      recovery?.recoveryApproval.recovery_approval_identity_sha256 ??\n      prepared.identity.identity_sha256;\n    if (\n      options.approveExecution !== expectedApprovalIdentity ||\n      options.confirm !== prepared.plan.account.email\n    ) {\n      fail(\n        'Commit requires the exact execution identity hash and frozen account email.',\n        'DATASET_FLOW_IDENTITY_EXECUTION_APPROVAL_REQUIRED',\n      );\n    }\n  }\n  let outDir = path.resolve(options.outDir);\n  let approvalClaim: FlowIdentityApprovalClaim | null = null;\n  if (options.statusOnly && recovery === null) {\n    const claim = readFlowIdentityApprovalClaim({\n      approvalIdentitySha256: prepared.approval.execution_approval_identity_sha256,\n      env: options.env,\n    });\n    if (claim) {\n      approvalClaim = claim;\n      if (\n        claim.approval_kind !== 'initial' ||\n        claim.execution_identity_sha256 !== prepared.identity.identity_sha256 ||\n        claim.request_id !== prepared.identity.request_id ||\n        claim.project_ref !== prepared.plan.project_ref ||\n        claim.actor_user_id !== prepared.plan.account.user_id ||\n        claim.actor_email !== prepared.plan.account.email ||\n        claim.plan_sha256 !== prepared.plan.plan_sha256 ||\n        claim.freeze_sha256 !== prepared.freeze.freeze_sha256\n      ) {\n        fail(\n          'Local approval claim does not bind this immutable execution.',\n          'DATASET_FLOW_IDENTITY_APPROVAL_CLAIM_INVALID',\n        );\n      }\n      outDir = path.resolve(claim.canonical_out_dir);\n      if (!existsSync(outDir)) {\n        fail(\n          'Local approval claim points to a missing canonical run directory.',\n          'DATASET_FLOW_IDENTITY_APPROVAL_CLAIM_INVALID',\n        );\n      }\n    }\n  }\n  outDir = ensurePrivateArtifactDirectory(outDir);\n  return {\n    ...prepared,\n    planPath,\n    outDir,\n    templates: loadProcessTemplates(planPath, prepared.plan),\n    recovery,\n    approvalClaim,\n  };\n}\n\nfunction assertContext(prepared: PreparedRun, context: DatasetMaintenanceRemoteContext): void {\n  if (\n    context.project_ref !== prepared.plan.project_ref ||\n    context.account.user_id !== prepared.plan.account.user_id ||\n    context.account.email.trim().toLowerCase() !== prepared.plan.account.email\n  ) {\n    fail(\n      'Authenticated production RLS context does not match the sealed plan.',\n      'DATASET_FLOW_IDENTITY_CONTEXT_MISMATCH',\n      {\n        expected_project_ref: prepared.plan.project_ref,\n        observed_project_ref: context.project_ref,\n        expected_user_id: prepared.plan.account.user_id,\n        observed_user_id: context.account.user_id,\n      },\n    );\n  }\n}\n\nfunction numberedArtifact(directory: string, prefix: string): string {\n  let ordinal = 1;\n  while (existsSync(path.join(directory, `${prefix}.${String(ordinal).padStart(6, '0')}.json`))) {\n    ordinal += 1;\n  }\n  return path.join(directory, `${prefix}.${String(ordinal).padStart(6, '0')}.json`);\n}\n\nfunction writeStatusSnapshot(prepared: PreparedRun, value: unknown): void {\n  writePrivateImmutableJson(numberedArtifact(prepared.outDir, 'scope-status'), value);\n}\n\nfunction readStoredScopeProof(prepared: PreparedRun): FlowIdentityScopeProof | null {\n  const filePath = path.join(prepared.outDir, 'scope-preflight-proof.json');\n  if (existsSync(filePath)) {\n    return parseFlowIdentityScopePreflightProof(\n      readCanonicalJson(filePath, 'Flow identity scope preflight proof'),\n      prepared.plan,\n    );\n  }\n  const lookupPath = path.join(prepared.outDir, 'scope-lookup-proof.json');\n  if (!existsSync(lookupPath)) return null;\n  return parseFlowIdentityScopeLookupProof(\n    readCanonicalJson(lookupPath, 'Flow identity scope lookup proof'),\n    prepared.plan,\n    prepared.identity,\n  );\n}\n\nfunction readStoredDomainRejection(options: {\n  filePath: string;\n  label: string;\n  requestHashField: 'request_sha256' | 'process_request_sha256';\n  expectedRequestSha256: string;\n}): MaintenanceRpcDomainFailure | null {\n  if (!existsSync(options.filePath)) return null;\n  const value = readCanonicalJson(options.filePath, options.label);\n  if (\n    !isJsonObject(value) ||\n    value.status !== 'rejected' ||\n    value.automatic_retry !== false ||\n    value.approval_reusable !== false ||\n    value[options.requestHashField] !== options.expectedRequestSha256 ||\n    !isMaintenanceRpcDomainFailure(value.response)\n  ) {\n    fail(\n      `${options.label} does not contain an exact database domain rejection.`,\n      'DATASET_FLOW_IDENTITY_DOMAIN_REJECTION_INVALID',\n    );\n  }\n  return value.response;\n}\n\nfunction finalizeArtifactPath(\n  prepared: PreparedRun,\n  kind: 'attempt' | 'domain-rejection' | 'proof' | 'transport-error',\n  requestSha256: string,\n): string {\n  return path.join(prepared.outDir, `finalize-${kind}-${requestSha256}.json`);\n}\n\nfunction readStoredFinalizeAttempt(options: {\n  prepared: PreparedRun;\n  scope: FlowIdentityScopeProof;\n  requestSha256: string;\n}): JsonObject | null {\n  const filePath = finalizeArtifactPath(options.prepared, 'attempt', options.requestSha256);\n  if (!existsSync(filePath)) return null;\n  const value = readCanonicalJson(filePath, 'Flow identity finalize attempt');\n  if (\n    !isJsonObject(value) ||\n    value.schema_version !== 'dataset-flow-identity-finalize-attempt.v3' ||\n    value.scope_id !== options.scope.scope_id ||\n    value.request_sha256 !== options.requestSha256 ||\n    value.max_posts !== 1 ||\n    value.automatic_retry !== false ||\n    !isJsonObject(value.request) ||\n    flowIdentityRestrictedSha256(value.request) !== options.requestSha256\n  ) {\n    fail(\n      'Flow identity finalize attempt does not bind the exact request.',\n      'DATASET_FLOW_IDENTITY_FINALIZE_ATTEMPT_INVALID',\n    );\n  }\n  return value.request;\n}\n\nfunction storedFinalizeAttemptHashes(prepared: PreparedRun): string[] {\n  return readdirSync(prepared.outDir)\n    .map((name) => /^finalize-attempt-([a-f0-9]{64})\\.json$/u.exec(name)?.[1] ?? null)\n    .filter((value): value is string => value !== null)\n    .sort();\n}\n\nfunction readStoredFinalizeProof(options: {\n  prepared: PreparedRun;\n  scope: FlowIdentityScopeProof;\n  request: JsonObject;\n  requestSha256: string;\n}): FlowIdentityFinalizeProof | null {\n  const filePath = finalizeArtifactPath(options.prepared, 'proof', options.requestSha256);\n  if (!existsSync(filePath)) return null;\n  return parseFlowIdentityFinalizeProof({\n    value: readCanonicalJson(filePath, 'Flow identity finalize proof'),\n    plan: options.prepared.plan,\n    scopeId: options.scope.scope_id,\n    scopeProofSha256: options.scope.scope_proof_sha256,\n    request: options.request,\n  });\n}\n\nasync function obtainScope(options: {\n  command: RunFlowIdentityOptions;\n  prepared: PreparedRun;\n  context: DatasetMaintenanceRemoteContext;\n  dependencies: RunDependencies;\n}): Promise<ObtainedScope> {\n  if (options.prepared.recovery) {\n    if (options.command.statusOnly) {\n      fail(\n        'Recovery admission is write-capable and requires an explicit commit invocation.',\n        'DATASET_FLOW_IDENTITY_RECOVERY_COMMIT_REQUIRED',\n      );\n    }\n    const recovery = options.prepared.recovery;\n    const baselineRaw = await options.dependencies.read({\n      context: options.context,\n      scopeId: recovery.scope.scope_id,\n    });\n    if (isMaintenanceRpcDomainFailure(baselineRaw)) {\n      assertDomainFailureHasNoPermit(baselineRaw, 'Recovery baseline read');\n      return { scope: baselineRaw, executionPermit: null };\n    }\n    const baseline = parseFlowIdentityScopeStatus(\n      baselineRaw,\n      options.prepared.plan,\n      recovery.scope.scope_id,\n      recovery.scope.scope_proof_sha256,\n    );\n    assertFreshRecoveryBaseline(baseline, recovery.recoveryFreeze);\n    writeStatusSnapshot(options.prepared, baseline);\n    const requestSha256 = flowIdentityRestrictedSha256(recovery.recoveryRequest);\n    if (!options.dependencies.recover) {\n      fail(\n        'Recovery RPC dependency is unavailable.',\n        'DATASET_FLOW_IDENTITY_RECOVERY_RPC_UNAVAILABLE',\n      );\n    }\n    writePrivateImmutableJson(path.join(options.prepared.outDir, 'scope-recovery-attempt.json'), {\n      schema_version: 'dataset-flow-identity-recovery-attempt.v1',\n      generated_at_utc: options.dependencies.now().toISOString(),\n      scope_id: recovery.scope.scope_id,\n      request_sha256: requestSha256,\n      recovery_approval_identity_sha256:\n        recovery.recoveryApproval.recovery_approval_identity_sha256,\n      maximum_wrapper_invocations: 1,\n      maximum_cli_apply_spawns: 1,\n      approval_reusable: false,\n      automatic_retry: false,\n    });\n    let raw: JsonObject;\n    try {\n      raw = await options.dependencies.recover({\n        context: options.context,\n        scopeId: recovery.scope.scope_id,\n        request: recovery.recoveryRequest,\n      });\n    } catch (error) {\n      const details = errorDetails(error);\n      writePrivateImmutableJson(\n        path.join(options.prepared.outDir, 'scope-recovery-transport-error.json'),\n        {\n          schema_version: 'dataset-flow-identity-recovery-transport-error.v1',\n          observed_at_utc: options.dependencies.now().toISOString(),\n          scope_id: recovery.scope.scope_id,\n          request_sha256: requestSha256,\n          approval_reusable: false,\n          automatic_retry: false,\n          recovery: 'read_scope_only',\n          error: details,\n        },\n      );\n      let observed: FlowIdentityScopeStatus | null = null;\n      try {\n        const observedRaw = await options.dependencies.read({\n          context: options.context,\n          scopeId: recovery.scope.scope_id,\n        });\n        if (!isMaintenanceRpcDomainFailure(observedRaw)) {\n          observed = parseFlowIdentityScopeStatus(\n            observedRaw,\n            options.prepared.plan,\n            recovery.scope.scope_id,\n            recovery.scope.scope_proof_sha256,\n          );\n          writeStatusSnapshot(options.prepared, observed);\n        } else {\n          assertDomainFailureHasNoPermit(observedRaw, 'Recovery ambiguity status read');\n        }\n      } catch {\n        // The immutable transport error is sufficient; never retry recovery admission.\n      }\n      return {\n        scope: recovery.scope,\n        executionPermit: null,\n        recoveryAmbiguity: { observed, error: details },\n      };\n    }\n    if (isMaintenanceRpcDomainFailure(raw)) {\n      assertDomainFailureHasNoPermit(raw, 'Scope recovery');\n      writePrivateImmutableJson(\n        path.join(options.prepared.outDir, 'scope-recovery-domain-rejection.json'),\n        {\n          schema_version: 'dataset-flow-identity-recovery-domain-rejection.v1',\n          status: 'rejected',\n          scope_id: recovery.scope.scope_id,\n          request_sha256: requestSha256,\n          approval_reusable: false,\n          automatic_retry: false,\n          response: raw,\n        },\n      );\n      return { scope: raw, executionPermit: null };\n    }\n    const envelope = splitFlowIdentityPermitResponse({\n      value: raw,\n      expectedGeneration: 0,\n      permitRequired: raw.replay !== true,\n      permitForbidden: raw.replay === true,\n      label: 'Flow identity scope recovery',\n    });\n    const recoveryProof = parseFlowIdentityRecoveryProof({\n      value: envelope.proof,\n      freeze: recovery.recoveryFreeze,\n      approval: recovery.recoveryApproval,\n      request: recovery.recoveryRequest,\n      expectedInvocationId: envelope.executionPermit?.invocation_id,\n    });\n    writePrivateImmutableJson(\n      path.join(\n        options.prepared.outDir,\n        recovery.scope.schema_version === 'dataset-flow-identity-scope-lookup-result.v1'\n          ? 'scope-lookup-proof.json'\n          : 'scope-preflight-proof.json',\n      ),\n      recovery.scope,\n    );\n    writePrivateImmutableJson(\n      path.join(options.prepared.outDir, 'scope-recovery-proof.json'),\n      recoveryProof,\n    );\n    return { scope: recovery.scope, executionPermit: envelope.executionPermit };\n  }\n  const stored = readStoredScopeProof(options.prepared);\n  if (stored) return { scope: stored, executionPermit: null };\n  const storedRejection = readStoredDomainRejection({\n    filePath: path.join(options.prepared.outDir, 'scope-preflight-domain-rejection.json'),\n    label: 'Flow identity scope preflight domain rejection',\n    requestHashField: 'request_sha256',\n    expectedRequestSha256: flowIdentityRestrictedSha256(options.prepared.preflightRequest),\n  });\n  if (storedRejection) return { scope: storedRejection, executionPermit: null };\n  if (options.command.statusOnly) {\n    if (!options.prepared.approvalClaim || !options.dependencies.lookup) {\n      fail(\n        'Status-only recovery requires an immutable local scope proof or a consumed local approval claim with the read-only lookup capability.',\n        'DATASET_FLOW_IDENTITY_SCOPE_PROOF_REQUIRED',\n      );\n    }\n    const rawLookup = await options.dependencies.lookup({\n      context: options.context,\n      request: buildFlowIdentityScopeLookupRequest({ identity: options.prepared.identity }),\n    });\n    if (isMaintenanceRpcDomainFailure(rawLookup)) {\n      assertDomainFailureHasNoPermit(rawLookup, 'Scope lookup');\n      return { scope: rawLookup, executionPermit: null };\n    }\n    const lookupProof = parseFlowIdentityScopeLookupProof(\n      rawLookup,\n      options.prepared.plan,\n      options.prepared.identity,\n    );\n    writePrivateImmutableJson(\n      path.join(options.prepared.outDir, 'scope-lookup-proof.json'),\n      lookupProof,\n    );\n    return { scope: lookupProof, executionPermit: null };\n  }\n  writePrivateImmutableJson(path.join(options.prepared.outDir, 'scope-preflight-attempt.json'), {\n    schema_version: 'dataset-flow-identity-preflight-attempt.v2',\n    generated_at_utc: options.dependencies.now().toISOString(),\n    request_id: options.prepared.identity.request_id,\n    plan_sha256: options.prepared.plan.plan_sha256,\n    request_sha256: flowIdentityRestrictedSha256(options.prepared.preflightRequest),\n    exact_replay_allowed: false,\n    automatic_retry: false,\n  });\n  const raw = await options.dependencies.preflight({\n    context: options.context,\n    request: options.prepared.preflightRequest,\n  });\n  if (isMaintenanceRpcDomainFailure(raw)) {\n    assertDomainFailureHasNoPermit(raw, 'Scope preflight');\n    writePrivateImmutableJson(\n      path.join(options.prepared.outDir, 'scope-preflight-domain-rejection.json'),\n      {\n        schema_version: 'dataset-flow-identity-preflight-domain-rejection.v1',\n        status: 'rejected',\n        request_sha256: flowIdentityRestrictedSha256(options.prepared.preflightRequest),\n        automatic_retry: false,\n        approval_reusable: false,\n        recovery: 'new_capture_freeze_and_exact_approval_required',\n        response: raw,\n      },\n    );\n    return { scope: raw, executionPermit: null };\n  }\n  const envelope = splitFlowIdentityPermitResponse({\n    value: raw,\n    expectedGeneration: 0,\n    permitRequired: raw.replay !== true,\n    permitForbidden: raw.replay === true,\n    label: 'Flow identity scope preflight',\n  });\n  const proof = parseFlowIdentityScopePreflightProof(envelope.proof, options.prepared.plan);\n  writePrivateImmutableJson(\n    path.join(options.prepared.outDir, 'scope-preflight-proof.json'),\n    proof,\n  );\n  return { scope: proof, executionPermit: envelope.executionPermit };\n}\n\nasync function readScope(options: {\n  prepared: PreparedRun;\n  context: DatasetMaintenanceRemoteContext;\n  scope: FlowIdentityScopeProof;\n  dependencies: RunDependencies;\n}): Promise<FlowIdentityScopeStatus> {\n  const raw = await options.dependencies.read({\n    context: options.context,\n    scopeId: options.scope.scope_id,\n  });\n  const status = parseFlowIdentityScopeStatus(\n    raw,\n    options.prepared.plan,\n    options.scope.scope_id,\n    options.scope.scope_proof_sha256,\n  );\n  writeStatusSnapshot(options.prepared, status);\n  return status;\n}\n\nfunction validateCompletedRequests(prepared: PreparedRun, status: FlowIdentityScopeStatus): void {\n  for (const ledger of status.processes.filter((entry) => entry.status === 'completed')) {\n    const template = prepared.templates[ledger.ordinal - 1];\n    if (!template) {\n      fail(\n        'Database progress contains a foreign completed ordinal.',\n        'DATASET_FLOW_IDENTITY_PROGRESS_INVALID',\n      );\n    }\n    const request = buildFlowIdentityProcessRequest({\n      scopeProofSha256: status.scope_proof_sha256,\n      ordinal: ledger.ordinal,\n      processIntentProofSha256: ledger.process_intent_proof_sha256,\n    });\n    if (ledger.process_request_sha256 !== request.process_request_sha256) {\n      fail(\n        `Completed process ${ledger.ordinal} used a foreign request hash.`,\n        'DATASET_FLOW_IDENTITY_PROGRESS_INVALID',\n      );\n    }\n  }\n}\n\nfunction requirePendingProcess(\n  prepared: PreparedRun,\n  status: FlowIdentityScopeStatus,\n  ordinal: number,\n): { ledger: FlowIdentityScopeStatus['processes'][number]; template: ProcessTemplate } {\n  const ledger = status.processes[ordinal - 1];\n  const template = prepared.templates[ordinal - 1];\n  if (!ledger || !template || ledger.status !== 'pending') {\n    fail(\n      'Durable scope did not expose exactly one pending next ordinal.',\n      'DATASET_FLOW_IDENTITY_NEXT_ORDINAL_INVALID',\n    );\n  }\n  return { ledger, template };\n}\n\nfunction report(options: {\n  prepared: PreparedRun;\n  mode: 'commit' | 'status_only';\n  status: FlowIdentityRunStatus;\n  scope: FlowIdentityScopeProof | null;\n  database: FlowIdentityScopeStatus | null;\n  issues?: FlowIdentityRunReport['issues'];\n  now: Date;\n}): FlowIdentityRunReport {\n  const value: FlowIdentityRunReport = {\n    schema_version: 'dataset-flow-identity-run-report.v2',\n    generated_at_utc: options.now.toISOString(),\n    mode: options.mode,\n    status: options.status,\n    operation_id: options.prepared.plan.operation_id,\n    plan_sha256: options.prepared.plan.plan_sha256,\n    request_id: options.prepared.identity.request_id,\n    identity_sha256: options.prepared.identity.identity_sha256,\n    scope_id: options.scope?.scope_id ?? null,\n    database_status: options.database?.status ?? null,\n    process_count: options.prepared.plan.processes.length,\n    completed_process_count: options.database?.completed_process_count ?? 0,\n    next_ordinal: options.database?.next_ordinal ?? null,\n    automatic_retry: false,\n    issues: options.issues ?? [],\n  };\n  writePrivateImmutableJson(numberedArtifact(options.prepared.outDir, 'run-report'), value);\n  return value;\n}\n\nasync function reportProcessDomainRejection(options: {\n  prepared: PreparedRun;\n  mode: 'commit' | 'status_only';\n  context: DatasetMaintenanceRemoteContext;\n  scope: FlowIdentityScopeProof;\n  dependencies: RunDependencies;\n  ordinal: number;\n  requestSha256: string;\n  response: MaintenanceRpcDomainFailure;\n  rejectionPath: string;\n}): Promise<FlowIdentityRunReport> {\n  let recovered: FlowIdentityScopeStatus | null = null;\n  let readError: unknown = null;\n  try {\n    recovered = await readScope({\n      prepared: options.prepared,\n      context: options.context,\n      scope: options.scope,\n      dependencies: options.dependencies,\n    });\n    validateCompletedRequests(options.prepared, recovered);\n  } catch (error) {\n    readError = error;\n  }\n  const recovery =\n    recovered && recovered.completed_process_count > 0\n      ? PARTIAL_EXECUTION_RECOVERY\n      : OPERATOR_REVIEW_REQUIRED;\n  if (!existsSync(options.rejectionPath)) {\n    writePrivateImmutableJson(options.rejectionPath, {\n      schema_version: 'dataset-flow-identity-process-domain-rejection.v2',\n      status: 'rejected',\n      ordinal: options.ordinal,\n      process_request_sha256: options.requestSha256,\n      automatic_retry: false,\n      approval_reusable: false,\n      recovery,\n      response: options.response,\n    });\n  }\n  writePrivateImmutableJson(\n    numberedArtifact(\n      options.prepared.outDir,\n      `process-domain-rejection-recovery-${String(options.ordinal).padStart(6, '0')}`,\n    ),\n    {\n      schema_version: 'dataset-flow-identity-process-domain-rejection-recovery.v1',\n      observed_at_utc: options.dependencies.now().toISOString(),\n      scope_id: options.scope.scope_id,\n      ordinal: options.ordinal,\n      process_request_sha256: options.requestSha256,\n      status_read_succeeded: recovered !== null,\n      completed_process_count: recovered?.completed_process_count ?? null,\n      next_ordinal: recovered?.next_ordinal ?? null,\n      strict_continuation_required: recovered?.strict_continuation_required ?? null,\n      recovery,\n      automatic_retry: false,\n      ...(readError === null ? {} : { error: errorDetails(readError) }),\n    },\n  );\n  const recoveryIssue =\n    recovery === PARTIAL_EXECUTION_RECOVERY\n      ? {\n          code: 'DATASET_FLOW_IDENTITY_PARTIAL_EXECUTION_REQUIRES_STATUS_READ_AND_OPERATOR_APPROVED_SCOPE_RECOVERY',\n          message:\n            'Primary writes already exist. Recovery requires fresh status reads and an operator-approved scope recovery; do not start a fresh capture.',\n          details: { recovery },\n        }\n      : {\n          code: 'DATASET_FLOW_IDENTITY_OPERATOR_REVIEW_REQUIRED',\n          message:\n            'No completed primary write is proven by the bounded status read; operator review is required before any next action.',\n          details: { recovery },\n        };\n  return report({\n    prepared: options.prepared,\n    mode: options.mode,\n    status: readError === null ? 'blocked' : 'indeterminate',\n    scope: options.scope,\n    database: recovered,\n    issues: [\n      {\n        code: options.response.code,\n        message:\n          typeof options.response.message === 'string'\n            ? options.response.message\n            : `The database deterministically rejected process ${options.ordinal}.`,\n        details: { response: options.response, recovery },\n      },\n      ...(readError === null\n        ? [recoveryIssue]\n        : [\n            {\n              code: 'DATASET_FLOW_IDENTITY_PROCESS_DOMAIN_REJECTION_STATUS_READ_FAILED',\n              message:\n                'The bounded recovery status read failed; execution is indeterminate and requires operator review.',\n              details: { recovery, error: errorDetails(readError) },\n            },\n          ]),\n    ],\n    now: options.dependencies.now(),\n  });\n}\n\nfunction hasFlowIdentityFinalizeDecision(status: FlowIdentityScopeStatus): boolean {\n  return (\n    status.status === 'completed' ||\n    status.status === 'live_drift' ||\n    status.status === 'failed' ||\n    status.compensation_required === true ||\n    flowIdentityScopeIsReadyToFinalize(status)\n  );\n}\n\nfunction completedRunStatus(status: FlowIdentityScopeStatus): 'passed' | 'blocked' {\n  return flowIdentityScopeHasCurrentDerivativeClosure(status) ? 'passed' : 'blocked';\n}\n\nasync function waitForFinalizeDecision(options: {\n  command: RunFlowIdentityOptions;\n  prepared: PreparedRun;\n  context: DatasetMaintenanceRemoteContext;\n  scope: FlowIdentityScopeProof;\n  initial: FlowIdentityScopeStatus;\n  dependencies: RunDependencies;\n}): Promise<FlowIdentityScopeStatus> {\n  const waitSeconds = options.command.waitSeconds ?? 0;\n  const pollMs = options.command.pollMs ?? DEFAULT_POLL_MS;\n  if (!Number.isInteger(waitSeconds) || waitSeconds < 0 || waitSeconds > 86_400) {\n    fail('waitSeconds must be an integer from 0 to 86400.', 'DATASET_FLOW_IDENTITY_WAIT_INVALID');\n  }\n  if (!Number.isInteger(pollMs) || pollMs < 100 || pollMs > 60_000) {\n    fail('pollMs must be an integer from 100 to 60000.', 'DATASET_FLOW_IDENTITY_POLL_INVALID');\n  }\n  const deadline = Date.now() + waitSeconds * 1_000;\n  let current = options.initial;\n  while (!hasFlowIdentityFinalizeDecision(current) && Date.now() < deadline) {\n    await options.dependencies.sleep(Math.min(pollMs, Math.max(deadline - Date.now(), 0)));\n    current = await readScope(options);\n    validateCompletedRequests(options.prepared, current);\n  }\n  return current;\n}\n\nasync function executeRun(\n  command: RunFlowIdentityOptions,\n  dependencies: RunDependencies,\n  preparedInput?: PreparedRun,\n): Promise<FlowIdentityRunReport> {\n  const prepared = preparedInput ?? prepareRun(command);\n  const mode = command.commit ? 'commit' : 'status_only';\n  const context = await dependencies.resolveContext({\n    env: command.env,\n    fetchImpl: command.fetchImpl,\n    timeoutMs: command.timeoutMs,\n    now: command.now,\n  });\n  assertContext(prepared, context);\n  if (command.commit && dependencies.claimApproval) {\n    const recovery = prepared.recovery;\n    dependencies.claimApproval({\n      env: command.env,\n      claim: {\n        schema_version: 'dataset-flow-identity-local-approval-claim.v1',\n        claimed_at_utc: dependencies.now().toISOString(),\n        approval_kind: recovery ? 'recovery' : 'initial',\n        approval_identity_sha256: recovery\n          ? recovery.recoveryApproval.recovery_approval_identity_sha256\n          : prepared.approval.execution_approval_identity_sha256,\n        execution_identity_sha256: prepared.identity.identity_sha256,\n        request_id: recovery\n          ? String(recovery.recoveryRequest.request_id)\n          : prepared.identity.request_id,\n        environment: 'production',\n        project_ref: prepared.plan.project_ref,\n        actor_user_id: prepared.plan.account.user_id,\n        actor_email: prepared.plan.account.email,\n        target_visibility: 'owner_draft',\n        user_state_claim: 'authenticated_actor_state_100_plus_own_state_0',\n        plan_sha256: prepared.plan.plan_sha256,\n        freeze_sha256: recovery\n          ? recovery.recoveryFreeze.recovery_freeze_sha256\n          : prepared.freeze.freeze_sha256,\n        canonical_out_dir: prepared.outDir,\n        maximum_cli_apply_spawns: 1,\n        approval_reusable: false,\n      },\n    });\n  }\n  const obtained = await obtainScope({ command, prepared, context, dependencies });\n  const scope = obtained.scope;\n  const executionPermit = obtained.executionPermit;\n  if (isMaintenanceRpcDomainFailure(scope)) {\n    return report({\n      prepared,\n      mode,\n      status: 'blocked',\n      scope: null,\n      database: null,\n      issues: [\n        {\n          code: scope.code,\n          message:\n            typeof scope.message === 'string'\n              ? scope.message\n              : 'The database deterministically rejected scope preflight.',\n          details: scope,\n        },\n      ],\n      now: dependencies.now(),\n    });\n  }\n  if (obtained.recoveryAmbiguity) {\n    return report({\n      prepared,\n      mode,\n      status: 'indeterminate',\n      scope,\n      database: obtained.recoveryAmbiguity.observed,\n      issues: [\n        {\n          code: 'DATASET_FLOW_IDENTITY_RECOVERY_RESPONSE_AMBIGUOUS',\n          message:\n            'Recovery admission response was ambiguous; scope was read once and recovery was not retried. A fresh exact recovery freeze and approval are required.',\n          details: obtained.recoveryAmbiguity.error,\n        },\n      ],\n      now: dependencies.now(),\n    });\n  }\n  let status = await readScope({ prepared, context, scope, dependencies });\n  validateCompletedRequests(prepared, status);\n  if (status.status === 'failed' || status.status === 'live_drift') {\n    return report({\n      prepared,\n      mode,\n      status: status.status === 'live_drift' ? 'blocked' : 'failed',\n      scope,\n      database: status,\n      issues:\n        status.status === 'live_drift'\n          ? [\n              {\n                code: status.code ?? 'FLOW_IDENTITY_PRIMARY_OR_GUARD_DRIFT',\n                message:\n                  'The database dynamically reproved primary or guard drift; no process submission or compensation is allowed.',\n              },\n            ]\n          : [],\n      now: dependencies.now(),\n    });\n  }\n  if (!status.live_guard_current || !status.protected_closure_current) {\n    return report({\n      prepared,\n      mode,\n      status: 'blocked',\n      scope,\n      database: status,\n      issues: [\n        {\n          code: 'DATASET_FLOW_IDENTITY_PROTECTED_CLOSURE_DRIFT',\n          message:\n            'The exactly sealed pending/blocker/orphan closure changed; no process submission is allowed.',\n        },\n      ],\n      now: dependencies.now(),\n    });\n  }\n  if (status.status === 'completed') {\n    return report({\n      prepared,\n      mode,\n      status: completedRunStatus(status),\n      scope,\n      database: status,\n      now: dependencies.now(),\n    });\n  }\n  if (command.statusOnly) {\n    status = await waitForFinalizeDecision({\n      command,\n      prepared,\n      context,\n      scope,\n      initial: status,\n      dependencies,\n    });\n    return report({\n      prepared,\n      mode,\n      status:\n        status.status === 'completed'\n          ? completedRunStatus(status)\n          : status.status === 'live_drift'\n            ? 'blocked'\n            : status.status === 'failed'\n              ? 'failed'\n              : 'pending',\n      scope,\n      database: status,\n      issues: status.compensation_required\n        ? [\n            {\n              code: 'FLOW_IDENTITY_DERIVATIVE_COMPENSATION_REQUIRED',\n              message:\n                'A derivative-only compensation needs a separate plan, freeze, and exact approval; the process mutation will not be replayed.',\n              details: { compensation_targets: status.compensation_targets },\n            },\n          ]\n        : status.status !== 'completed' && flowIdentityScopeIsReadyToFinalize(status)\n          ? [\n              {\n                code: 'FLOW_IDENTITY_FINALIZE_READY',\n                message:\n                  'The derivative closure is ready. Status-only mode remains read-only; an explicit approved commit invocation is required to finalize.',\n              },\n            ]\n          : [],\n      now: dependencies.now(),\n    });\n  }\n\n  if (executionPermit === null) {\n    return report({\n      prepared,\n      mode,\n      status: 'blocked',\n      scope,\n      database: status,\n      issues: [\n        {\n          code: 'DATASET_FLOW_IDENTITY_FRESH_RECOVERY_APPROVAL_REQUIRED',\n          message:\n            'This wrapper has no live database permit. Scope read remains available, but any further process or finalize write requires a fresh exact recovery freeze and human approval.',\n          details: {\n            approval_reusable: false,\n            maximum_wrapper_invocations: 1,\n            completed_process_count: status.completed_process_count,\n            next_ordinal: status.next_ordinal,\n            whole_scope_proof_sha256: status.whole_scope_proof_sha256,\n          },\n        },\n      ],\n      now: dependencies.now(),\n    });\n  }\n  let livePermit: FlowIdentityExecutionPermit = executionPermit;\n\n  let nextOrdinal: number | null = status.next_ordinal;\n  let submittedProcesses = 0;\n  while (\n    !status.primary_complete &&\n    nextOrdinal !== null &&\n    nextOrdinal <= prepared.plan.processes.length\n  ) {\n    if (\n      !status.primary_current ||\n      !status.live_guard_current ||\n      !status.protected_closure_current\n    ) {\n      return report({\n        prepared,\n        mode,\n        status: 'blocked',\n        scope,\n        database: status,\n        issues: [\n          {\n            code: 'DATASET_FLOW_IDENTITY_PROTECTED_CLOSURE_DRIFT',\n            message:\n              'The exactly sealed pending/blocker/orphan closure changed; no next process will be submitted.',\n          },\n        ],\n        now: dependencies.now(),\n      });\n    }\n    const ordinal = nextOrdinal;\n    const { ledger, template } = requirePendingProcess(prepared, status, ordinal);\n    const request = buildFlowIdentityProcessRequest({\n      scopeProofSha256: scope.scope_proof_sha256,\n      ordinal,\n      processIntentProofSha256: ledger.process_intent_proof_sha256,\n    });\n    const markerPath = path.join(\n      prepared.outDir,\n      `process-attempt-${String(ordinal).padStart(6, '0')}.json`,\n    );\n    const domainRejectionPath = path.join(\n      prepared.outDir,\n      `process-domain-rejection-${String(ordinal).padStart(6, '0')}.json`,\n    );\n    if (existsSync(markerPath)) {\n      const storedRejection = readStoredDomainRejection({\n        filePath: domainRejectionPath,\n        label: `Flow identity process ${ordinal} domain rejection`,\n        requestHashField: 'process_request_sha256',\n        expectedRequestSha256: String(request.process_request_sha256),\n      });\n      if (storedRejection) {\n        return reportProcessDomainRejection({\n          prepared,\n          mode,\n          context,\n          scope,\n          dependencies,\n          ordinal,\n          requestSha256: String(request.process_request_sha256),\n          response: storedRejection,\n          rejectionPath: domainRejectionPath,\n        });\n      }\n      return report({\n        prepared,\n        mode,\n        status: 'blocked',\n        scope,\n        database: status,\n        issues: [\n          {\n            code: 'DATASET_FLOW_IDENTITY_PROCESS_ATTEMPT_AMBIGUOUS',\n            message: `Process ${ordinal} has a local attempt marker but no durable completed proof; no automatic retry is allowed.`,\n          },\n        ],\n        now: dependencies.now(),\n      });\n    }\n    writePrivateImmutableJson(markerPath, {\n      schema_version: 'dataset-flow-identity-process-attempt.v2',\n      generated_at_utc: dependencies.now().toISOString(),\n      scope_id: scope.scope_id,\n      scope_proof_sha256: scope.scope_proof_sha256,\n      ordinal,\n      process_request_sha256: request.process_request_sha256,\n      max_posts: 1,\n      automatic_retry: false,\n    });\n    try {\n      const raw = await dependencies.rewrite({\n        context,\n        scopeId: scope.scope_id,\n        request,\n        authorization: livePermit,\n      });\n      if (isMaintenanceRpcDomainFailure(raw)) {\n        assertDomainFailureHasNoPermit(raw, `Process ${ordinal}`);\n        return reportProcessDomainRejection({\n          prepared,\n          mode,\n          context,\n          scope,\n          dependencies,\n          ordinal,\n          requestSha256: String(request.process_request_sha256),\n          response: raw,\n          rejectionPath: domainRejectionPath,\n        });\n      }\n      const envelope = splitFlowIdentityPermitResponse({\n        value: raw,\n        expectedGeneration: livePermit.generation + 1,\n        expectedInvocationId: livePermit.invocation_id,\n        permitRequired: true,\n        label: `Flow identity process ${ordinal}`,\n      });\n      const proof = parseFlowIdentityProcessProof({\n        value: envelope.proof,\n        scopeId: scope.scope_id,\n        process: template.process,\n        requestSha256: String(request.process_request_sha256),\n        receiptId: prepared.plan.receipt_id,\n        receiptProofSha256: prepared.plan.receipt_proof_sha256,\n        mappingGuardSetSha256: prepared.plan.mapping_guard_set_sha256,\n        processIntentSetSha256: prepared.plan.process_intent_set_sha256,\n        processIntentProofSha256: ledger.process_intent_proof_sha256,\n        processCount: prepared.plan.processes.length,\n        expectedInvocationId: livePermit.invocation_id,\n        expectedPermitGenerationBefore: livePermit.generation,\n      });\n      writePrivateImmutableJson(\n        path.join(prepared.outDir, `process-proof-${String(ordinal).padStart(6, '0')}.json`),\n        proof,\n      );\n      // permitRequired=true above already rejects null before the proof parser.\n      livePermit = envelope.executionPermit!;\n      submittedProcesses += 1;\n      nextOrdinal = proof.next_ordinal;\n    } catch (error) {\n      writePrivateImmutableJson(\n        path.join(\n          prepared.outDir,\n          `process-transport-error-${String(ordinal).padStart(6, '0')}.json`,\n        ),\n        {\n          schema_version: 'dataset-flow-identity-process-transport-error.v1',\n          observed_at_utc: dependencies.now().toISOString(),\n          ordinal,\n          process_request_sha256: request.process_request_sha256,\n          automatic_retry: false,\n          recovery: 'read_scope_only',\n          error: errorDetails(error),\n        },\n      );\n      let recovered: FlowIdentityScopeStatus | null = null;\n      try {\n        recovered = await readScope({ prepared, context, scope, dependencies });\n        validateCompletedRequests(prepared, recovered);\n      } catch (readError) {\n        writePrivateImmutableJson(\n          path.join(\n            prepared.outDir,\n            `process-recovery-read-error-${String(ordinal).padStart(6, '0')}.json`,\n          ),\n          { observed_at_utc: dependencies.now().toISOString(), error: errorDetails(readError) },\n        );\n      }\n      return report({\n        prepared,\n        mode,\n        status: 'indeterminate',\n        scope,\n        database: recovered,\n        issues: [\n          {\n            code: 'DATASET_FLOW_IDENTITY_PROCESS_RESPONSE_AMBIGUOUS',\n            message:\n              'Process response was ambiguous; durable scope was read once and no process submission was retried.',\n            details: errorDetails(error),\n          },\n        ],\n        now: dependencies.now(),\n      });\n    }\n  }\n\n  if (submittedProcesses > 0) {\n    status = await readScope({ prepared, context, scope, dependencies });\n    validateCompletedRequests(prepared, status);\n  }\n\n  if (!status.primary_current || !status.live_guard_current || !status.protected_closure_current) {\n    return report({\n      prepared,\n      mode,\n      status: 'blocked',\n      scope,\n      database: status,\n      issues: [\n        {\n          code: 'DATASET_FLOW_IDENTITY_PROTECTED_CLOSURE_DRIFT',\n          message:\n            'The exactly sealed pending/blocker/orphan closure changed after the last process; finalize is forbidden.',\n        },\n      ],\n      now: dependencies.now(),\n    });\n  }\n\n  status = await waitForFinalizeDecision({\n    command,\n    prepared,\n    context,\n    scope,\n    initial: status,\n    dependencies,\n  });\n  if (status.status === 'completed') {\n    return report({\n      prepared,\n      mode,\n      status: completedRunStatus(status),\n      scope,\n      database: status,\n      now: dependencies.now(),\n    });\n  }\n  if (status.status === 'live_drift' || status.status === 'failed') {\n    return report({\n      prepared,\n      mode,\n      status: status.status === 'live_drift' ? 'blocked' : 'failed',\n      scope,\n      database: status,\n      issues:\n        status.status === 'live_drift'\n          ? [\n              {\n                code: status.code ?? 'FLOW_IDENTITY_PRIMARY_OR_GUARD_DRIFT',\n                message:\n                  'The database dynamically reproved primary or guard drift while derivatives were settling; finalize was not submitted.',\n              },\n            ]\n          : [],\n      now: dependencies.now(),\n    });\n  }\n  if (!status.primary_current || !status.live_guard_current || !status.protected_closure_current) {\n    return report({\n      prepared,\n      mode,\n      status: 'blocked',\n      scope,\n      database: status,\n      issues: [\n        {\n          code: 'DATASET_FLOW_IDENTITY_PROTECTED_CLOSURE_DRIFT',\n          message:\n            'The exactly sealed closure changed while derivatives were settling; finalize was not submitted.',\n        },\n      ],\n      now: dependencies.now(),\n    });\n  }\n  if (status.compensation_required) {\n    return report({\n      prepared,\n      mode,\n      status: 'pending',\n      scope,\n      database: status,\n      issues: [\n        {\n          code: 'FLOW_IDENTITY_DERIVATIVE_COMPENSATION_REQUIRED',\n          message:\n            'A derivative-only compensation needs a separate plan, freeze, and exact approval; finalize was not submitted and the process mutation will not be replayed.',\n          details: { compensation_targets: status.compensation_targets },\n        },\n      ],\n      now: dependencies.now(),\n    });\n  }\n  if (!flowIdentityScopeIsReadyToFinalize(status)) {\n    return report({\n      prepared,\n      mode,\n      status: 'pending',\n      scope,\n      database: status,\n      issues: [\n        {\n          code: 'FLOW_IDENTITY_DERIVATIVES_PENDING',\n          message:\n            'Derivative closure is still pending at the wait deadline; finalize was not submitted. This in-memory permit is discarded when the wrapper exits, so continuation requires a fresh exact recovery freeze and human approval.',\n        },\n      ],\n      now: dependencies.now(),\n    });\n  }\n\n  const finalizeRequest = buildFlowIdentityFinalizeRequest({\n    scopeProofSha256: scope.scope_proof_sha256,\n    plan: prepared.plan,\n    status,\n  });\n  const finalizeRequestSha256 = flowIdentityRestrictedSha256(finalizeRequest);\n  const finalizeAttemptPath = finalizeArtifactPath(prepared, 'attempt', finalizeRequestSha256);\n  const finalizeRejectionPath = finalizeArtifactPath(\n    prepared,\n    'domain-rejection',\n    finalizeRequestSha256,\n  );\n  const finalizeProofPath = finalizeArtifactPath(prepared, 'proof', finalizeRequestSha256);\n  const finalizeTransportPath = finalizeArtifactPath(\n    prepared,\n    'transport-error',\n    finalizeRequestSha256,\n  );\n  const priorAttemptHashes = storedFinalizeAttemptHashes(prepared);\n  const exactStoredRequest = readStoredFinalizeAttempt({\n    prepared,\n    scope,\n    requestSha256: finalizeRequestSha256,\n  });\n  if (exactStoredRequest) {\n    const storedRejection = readStoredDomainRejection({\n      filePath: finalizeRejectionPath,\n      label: 'Flow identity finalize domain rejection',\n      requestHashField: 'request_sha256',\n      expectedRequestSha256: finalizeRequestSha256,\n    });\n    const storedProof = readStoredFinalizeProof({\n      prepared,\n      scope,\n      request: exactStoredRequest,\n      requestSha256: finalizeRequestSha256,\n    });\n    if (storedRejection && storedProof) {\n      fail(\n        'Finalize request has contradictory rejection and proof artifacts.',\n        'DATASET_FLOW_IDENTITY_FINALIZE_ARTIFACT_CONFLICT',\n      );\n    }\n    if (storedRejection) {\n      return report({\n        prepared,\n        mode,\n        status: 'blocked',\n        scope,\n        database: status,\n        issues: [\n          {\n            code: storedRejection.code,\n            message:\n              typeof storedRejection.message === 'string'\n                ? storedRejection.message\n                : 'The database deterministically rejected finalize.',\n            details: {\n              response: storedRejection,\n              request_sha256: finalizeRequestSha256,\n              recovery: OPERATOR_REVIEW_REQUIRED,\n            },\n          },\n        ],\n        now: dependencies.now(),\n      });\n    }\n    if (storedProof) {\n      return report({\n        prepared,\n        mode,\n        status:\n          storedProof.status === 'failed'\n            ? 'failed'\n            : storedProof.status === 'live_drift'\n              ? 'blocked'\n              : 'pending',\n        scope,\n        database: status,\n        issues: [\n          {\n            code: 'DATASET_FLOW_IDENTITY_FINALIZE_REQUEST_ALREADY_PROVEN',\n            message:\n              'This exact finalize request already has a durable proof and will not be posted again. A new explicit finalize requires a prior derivatives_pending proof and a later status that creates a new request hash.',\n            details: {\n              request_sha256: finalizeRequestSha256,\n              proof_status: storedProof.status,\n            },\n          },\n        ],\n        now: dependencies.now(),\n      });\n    }\n    return report({\n      prepared,\n      mode,\n      status: 'indeterminate',\n      scope,\n      database: status,\n      issues: [\n        {\n          code: 'DATASET_FLOW_IDENTITY_FINALIZE_ATTEMPT_AMBIGUOUS',\n          message:\n            'This exact finalize request has an attempt but no durable proof or domain rejection; the scope was read first and finalize will not be posted again.',\n          details: { request_sha256: finalizeRequestSha256 },\n        },\n      ],\n      now: dependencies.now(),\n    });\n  }\n  if (existsSync(finalizeRejectionPath) || existsSync(finalizeProofPath)) {\n    fail(\n      'Finalize terminal artifact exists without its exact attempt.',\n      'DATASET_FLOW_IDENTITY_FINALIZE_ARTIFACT_INVALID',\n    );\n  }\n  for (const priorRequestSha256 of priorAttemptHashes) {\n    const priorRequest = readStoredFinalizeAttempt({\n      prepared,\n      scope,\n      requestSha256: priorRequestSha256,\n    });\n    if (!priorRequest) continue;\n    const priorRejection = readStoredDomainRejection({\n      filePath: finalizeArtifactPath(prepared, 'domain-rejection', priorRequestSha256),\n      label: 'Prior flow identity finalize domain rejection',\n      requestHashField: 'request_sha256',\n      expectedRequestSha256: priorRequestSha256,\n    });\n    const priorProof = readStoredFinalizeProof({\n      prepared,\n      scope,\n      request: priorRequest,\n      requestSha256: priorRequestSha256,\n    });\n    if (priorRejection || !priorProof) {\n      return report({\n        prepared,\n        mode,\n        status: priorRejection ? 'blocked' : 'indeterminate',\n        scope,\n        database: status,\n        issues: [\n          {\n            code: priorRejection?.code ?? 'DATASET_FLOW_IDENTITY_FINALIZE_ATTEMPT_AMBIGUOUS',\n            message:\n              'A prior finalize attempt is not backed by a valid derivatives_pending proof; no new finalize request is allowed in this output directory.',\n            details: {\n              prior_request_sha256: priorRequestSha256,\n              current_request_sha256: finalizeRequestSha256,\n            },\n          },\n        ],\n        now: dependencies.now(),\n      });\n    }\n    if (priorProof.status !== 'derivatives_pending') {\n      return report({\n        prepared,\n        mode,\n        status: priorProof.status === 'failed' ? 'failed' : 'blocked',\n        scope,\n        database: status,\n        issues: [\n          {\n            code: 'DATASET_FLOW_IDENTITY_FINALIZE_NEW_REQUEST_NOT_AUTHORIZED',\n            message:\n              'Only a valid derivatives_pending proof can authorize a later explicit finalize with a new status-derived request hash.',\n            details: {\n              prior_request_sha256: priorRequestSha256,\n              prior_status: priorProof.status,\n              current_request_sha256: finalizeRequestSha256,\n            },\n          },\n        ],\n        now: dependencies.now(),\n      });\n    }\n  }\n  writePrivateImmutableJson(finalizeAttemptPath, {\n    schema_version: 'dataset-flow-identity-finalize-attempt.v3',\n    generated_at_utc: dependencies.now().toISOString(),\n    scope_id: scope.scope_id,\n    request_sha256: finalizeRequestSha256,\n    request: finalizeRequest,\n    max_posts: 1,\n    automatic_retry: false,\n  });\n  let finalizeProof: FlowIdentityFinalizeProof;\n  try {\n    const raw = await dependencies.finalize({\n      context,\n      scopeId: scope.scope_id,\n      request: finalizeRequest,\n      authorization: livePermit,\n    });\n    if (\n      isJsonObject(raw) &&\n      raw.schema_version === 'dataset-flow-identity-scope-finalize-result.v2'\n    ) {\n      const permitUsed = livePermit;\n      const envelope =\n        raw.ok === true\n          ? splitFlowIdentityPermitResponse({\n              value: raw,\n              expectedGeneration: permitUsed.generation + 1,\n              expectedInvocationId: permitUsed.invocation_id,\n              permitRequired: raw.status === 'derivatives_pending',\n              permitForbidden: raw.status !== 'derivatives_pending',\n              label: 'Flow identity finalize',\n            })\n          : (() => {\n              if (Object.hasOwn(raw, 'execution_permit')) {\n                fail(\n                  'Rejected flow identity finalize response contained a bearer permit.',\n                  'DATASET_FLOW_IDENTITY_DOMAIN_REJECTION_PERMIT_INVALID',\n                );\n              }\n              return { proof: raw, executionPermit: null };\n            })();\n      finalizeProof = parseFlowIdentityFinalizeProof({\n        value: envelope.proof,\n        plan: prepared.plan,\n        scopeId: scope.scope_id,\n        scopeProofSha256: scope.scope_proof_sha256,\n        request: finalizeRequest,\n        expectedInvocationId: permitUsed.invocation_id,\n        expectedPermitGenerationBefore: permitUsed.generation,\n      });\n      if (envelope.executionPermit !== null) livePermit = envelope.executionPermit;\n      writePrivateImmutableJson(finalizeProofPath, finalizeProof);\n    } else if (isMaintenanceRpcDomainFailure(raw)) {\n      assertDomainFailureHasNoPermit(raw, 'Finalize');\n      writePrivateImmutableJson(finalizeRejectionPath, {\n        schema_version: 'dataset-flow-identity-finalize-domain-rejection.v1',\n        status: 'rejected',\n        scope_id: scope.scope_id,\n        request_sha256: finalizeRequestSha256,\n        automatic_retry: false,\n        approval_reusable: false,\n        recovery: OPERATOR_REVIEW_REQUIRED,\n        response: raw,\n      });\n      return report({\n        prepared,\n        mode,\n        status: 'blocked',\n        scope,\n        database: status,\n        issues: [\n          {\n            code: raw.code,\n            message:\n              typeof raw.message === 'string'\n                ? raw.message\n                : 'The database deterministically rejected finalize.',\n            details: {\n              response: raw,\n              request_sha256: finalizeRequestSha256,\n              recovery: OPERATOR_REVIEW_REQUIRED,\n            },\n          },\n        ],\n        now: dependencies.now(),\n      });\n    } else {\n      fail(\n        'Finalize returned neither a guarded proof nor a deterministic domain rejection.',\n        'DATASET_FLOW_IDENTITY_FINALIZE_RESPONSE_INVALID',\n      );\n    }\n  } catch (error) {\n    writePrivateImmutableJson(finalizeTransportPath, {\n      schema_version: 'dataset-flow-identity-finalize-transport-error.v1',\n      observed_at_utc: dependencies.now().toISOString(),\n      scope_id: scope.scope_id,\n      request_sha256: finalizeRequestSha256,\n      automatic_retry: false,\n      recovery: 'read_scope_only',\n      error: errorDetails(error),\n    });\n    let recovered: FlowIdentityScopeStatus | null = null;\n    try {\n      recovered = await readScope({ prepared, context, scope, dependencies });\n      validateCompletedRequests(prepared, recovered);\n    } catch {\n      // The immutable transport error is sufficient; never replace it with a blind finalize retry.\n    }\n    return report({\n      prepared,\n      mode,\n      status: 'indeterminate',\n      scope,\n      database: recovered,\n      issues: [\n        {\n          code: 'DATASET_FLOW_IDENTITY_FINALIZE_RESPONSE_AMBIGUOUS',\n          message:\n            'Finalize response was ambiguous; scope was read once and finalize was not retried in this invocation.',\n          details: errorDetails(error),\n        },\n      ],\n      now: dependencies.now(),\n    });\n  }\n  status = await readScope({ prepared, context, scope, dependencies });\n  validateCompletedRequests(prepared, status);\n  return report({\n    prepared,\n    mode,\n    status:\n      finalizeProof.status === 'completed' &&\n      status.status === 'completed' &&\n      flowIdentityScopeHasCurrentDerivativeClosure(status)\n        ? 'passed'\n        : status.status === 'live_drift' || finalizeProof.status === 'live_drift'\n          ? 'blocked'\n          : status.status === 'failed' || finalizeProof.status === 'failed'\n            ? 'failed'\n            : 'pending',\n    scope,\n    database: status,\n    issues: finalizeProof.compensation_required\n      ? [\n          {\n            code: 'FLOW_IDENTITY_DERIVATIVE_COMPENSATION_REQUIRED',\n            message:\n              'A derivative-only compensation needs a separate plan, freeze, and exact approval; the process mutation will not be replayed.',\n            details: { compensation_targets: finalizeProof.compensation_targets },\n          },\n        ]\n      : [],\n    now: dependencies.now(),\n  });\n}\n\nexport async function runFlowIdentity(\n  options: RunFlowIdentityOptions,\n): Promise<FlowIdentityRunReport> {\n  // Status-only may be invoked with a different caller path. Resolve the\n  // immutable approval claim before locking so every reader/writer serializes\n  // on the one canonical run directory.\n  const prepared = prepareRun(options);\n  const outDir = prepared.outDir;\n  return withStateFileLock(\n    path.join(outDir, 'flow-identity-run-state'),\n    { reason: 'dataset flow identity serial runner', timeoutMs: 0 },\n    () =>\n      executeRun(\n        options,\n        {\n          resolveContext: resolveMaintenanceRemoteContext,\n          preflight: preflightMaintenanceFlowIdentityScope,\n          lookup: lookupMaintenanceFlowIdentityScope,\n          recover: recoverMaintenanceFlowIdentityScope,\n          rewrite: rewriteMaintenanceFlowIdentityProcess,\n          read: readMaintenanceFlowIdentityScope,\n          finalize: finalizeMaintenanceFlowIdentityScope,\n          sleep: options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms))),\n          now: () => options.now ?? new Date(),\n          claimApproval: claimFlowIdentityApproval,\n        },\n        prepared,\n      ),\n  );\n}\n\nexport const __testInternals = {\n  assertContext,\n  completedRunStatus,\n  errorDetails,\n  executeRun,\n  loadProcessTemplates,\n  numberedArtifact,\n  prepareRun,\n  processStem,\n  readCanonicalJson,\n  requirePendingProcess,\n  report,\n  validateCompletedRequests,\n  waitForFinalizeDecision,\n};\n"]}

package/dist/src/lib/dataset-maintenance-flow-identity-seal.js

@@ -0,0 +1,144 @@
+import path from 'node:path';
+import { materializePrivateArtifactDirectoryAtomically, readProtectedJsonArtifact, readProtectedTextArtifact, writePrivateImmutableJson, writePrivateImmutableText, } from './dataset-maintenance-protected-artifacts.js';
+import { computeFlowIdentityApprovalIdentitySha256, parseFlowIdentityFreeze, } from './dataset-maintenance-flow-identity-execution-contract.js';
+import { parseFlowIdentityPlan } from './dataset-maintenance-flow-identity-contract.js';
+import { sha256Text, stableJsonText } from './dataset-maintenance-contract.js';
+import { parseFlowIdentityApprovalRequest, renderFlowIdentityExecutionApprovalText, } from './dataset-maintenance-flow-identity-freeze.js';
+import { CliError } from './errors.js';
+export const FLOW_IDENTITY_APPROVAL_ARTIFACTS = {
+    human_approval: 'flow-identity-execution-human-approval.txt',
+    approval: 'flow-identity-execution-approval.json',
+    report: 'flow-identity-execution-approval-seal-report.json',
+};
+const HASH = /^[a-f0-9]{64}$/u;
+function fail(message, code = 'DATASET_FLOW_IDENTITY_APPROVAL_SEAL_INVALID') {
+    throw new CliError(message, { code, exitCode: 1 });
+}
+function requireHash(value, label) {
+    if (!HASH.test(value))
+        fail(`${label} must be a lowercase SHA-256.`);
+}
+function requireDistinctApprovalHashDomains(hashes) {
+    if (new Set(hashes).size !== hashes.length) {
+        fail('Policy and execution approval hash domains must remain distinct.');
+    }
+}
+function requireCanonicalJson(filePath, label) {
+    const artifact = readProtectedJsonArtifact({ filePath, label });
+    if (artifact.text !== `${stableJsonText(artifact.value)}\n`) {
+        fail(`${label} must be canonical JSON with one trailing newline.`);
+    }
+    return artifact;
+}
+export function sealFlowIdentityApproval(options) {
+    requireHash(options.approveFreezeFile, 'approveFreezeFile');
+    requireHash(options.approveRequest, 'approveRequest');
+    requireHash(options.approveText, 'approveText');
+    if (!Number.isFinite(Date.parse(options.approvedAtUtc))) {
+        fail('approvedAtUtc must be an RFC3339 timestamp.');
+    }
+    const planArtifact = requireCanonicalJson(options.planPath, 'Flow identity plan');
+    const plan = parseFlowIdentityPlan(planArtifact.value);
+    const freezeArtifact = requireCanonicalJson(options.freezePath, 'Flow identity freeze');
+    const freeze = parseFlowIdentityFreeze(freezeArtifact.value, plan);
+    const requestArtifact = requireCanonicalJson(options.approvalRequestPath, 'Flow identity execution approval request');
+    const request = parseFlowIdentityApprovalRequest(requestArtifact.value);
+    const core = { ...request };
+    delete core.request_sha256;
+    const expectedText = renderFlowIdentityExecutionApprovalText(core, request.request_sha256);
+    const humanApproval = readProtectedTextArtifact(options.humanApprovalPath);
+    const humanApprovalSha256 = sha256Text(humanApproval.text);
+    if (plan.environment !== 'production' ||
+        options.confirm !== plan.account.email ||
+        options.approveFreezeFile !== freezeArtifact.file_sha256 ||
+        options.approveRequest !== request.request_sha256 ||
+        options.approveText !== humanApprovalSha256 ||
+        humanApproval.text !== expectedText ||
+        options.approvedAtUtc !== request.approved_at_utc ||
+        request.project_ref !== plan.project_ref ||
+        request.actor.user_id !== plan.account.user_id ||
+        request.actor.email !== plan.account.email ||
+        request.plan_sha256 !== plan.plan_sha256 ||
+        request.plan_file_sha256 !== planArtifact.file_sha256 ||
+        request.operation_id !== plan.operation_id ||
+        request.freeze_file_sha256 !== freezeArtifact.file_sha256 ||
+        request.freeze_sha256 !== freeze.freeze_sha256 ||
+        request.receipt_id !== plan.receipt_id ||
+        request.receipt_proof_sha256 !== plan.receipt_proof_sha256 ||
+        request.capture_request_sha256 !== plan.capture_request_sha256 ||
+        request.source_guard_set_sha256 !== plan.source_guard_set_sha256 ||
+        request.support_guard_set_sha256 !== plan.support_guard_set_sha256 ||
+        request.target_guard_set_sha256 !== plan.target_guard_set_sha256 ||
+        request.mapping_guard_set_sha256 !== plan.mapping_guard_set_sha256 ||
+        request.process_intent_set_sha256 !== plan.process_intent_set_sha256 ||
+        request.receipt_protected_closure_sha256 !== plan.receipt_protected_closure_sha256 ||
+        request.capture_whole_scope_proof_sha256 !== plan.capture_whole_scope_proof_sha256 ||
+        request.capture_artifact_sha256 !== plan.capture_artifact_sha256 ||
+        request.toolchain_evidence_sha256 !== freeze.toolchain_evidence_sha256 ||
+        request.policy_approval_text_sha256 !== plan.compatibility_policy.approval_text_sha256 ||
+        request.semantic_source_count !== plan.summary.semantic_sources ||
+        request.mapping_count !== plan.mappings.length ||
+        request.pending_count !== plan.protected_closure.pending.length ||
+        request.blocker_count !== plan.protected_closure.blockers.length ||
+        request.orphan_count !== plan.protected_closure.orphans.length ||
+        request.process_count !== plan.processes.length ||
+        request.rewrite_count !== plan.summary.rewrites ||
+        new Set([request.policy_approval_text_sha256, request.request_sha256, humanApprovalSha256])
+            .size !== 3) {
+        fail('Human approval does not exactly bind this production execution request.');
+    }
+    const approval = {
+        schema_version: 'dataset-flow-identity-execution-approval.v2',
+        approved_at_utc: request.approved_at_utc,
+        actor: plan.account,
+        plan_sha256: plan.plan_sha256,
+        freeze_sha256: freeze.freeze_sha256,
+        toolchain_evidence_sha256: freeze.toolchain_evidence_sha256,
+        policy_approval_text_sha256: request.policy_approval_text_sha256,
+        execution_approval_request_sha256: request.request_sha256,
+        execution_approval_text_sha256: humanApprovalSha256,
+        execution_approval_identity_sha256: '',
+    };
+    approval.execution_approval_identity_sha256 = computeFlowIdentityApprovalIdentitySha256(approval);
+    requireDistinctApprovalHashDomains([
+        approval.policy_approval_text_sha256,
+        approval.execution_approval_request_sha256,
+        approval.execution_approval_text_sha256,
+        approval.execution_approval_identity_sha256,
+    ]);
+    const outDir = path.resolve(options.outDir);
+    const artifacts = Object.fromEntries(Object.entries(FLOW_IDENTITY_APPROVAL_ARTIFACTS).map(([key, name]) => [
+        key,
+        path.join(outDir, name),
+    ]));
+    const report = {
+        schema_version: 'dataset-flow-identity-execution-approval-seal-report.v2',
+        generated_at_utc: (options.now ?? new Date()).toISOString(),
+        approval_authority_at_utc: request.approved_at_utc,
+        status: 'sealed',
+        execution_submitted: false,
+        network_calls: 0,
+        database_calls: 0,
+        plan_sha256: plan.plan_sha256,
+        operation_id: plan.operation_id,
+        freeze_file_sha256: freezeArtifact.file_sha256,
+        freeze_sha256: freeze.freeze_sha256,
+        policy_approval_text_sha256: approval.policy_approval_text_sha256,
+        execution_approval_request_sha256: approval.execution_approval_request_sha256,
+        execution_approval_text_sha256: approval.execution_approval_text_sha256,
+        execution_approval_identity_sha256: approval.execution_approval_identity_sha256,
+        artifacts,
+    };
+    materializePrivateArtifactDirectoryAtomically(outDir, (staging) => {
+        writePrivateImmutableText(path.join(staging, FLOW_IDENTITY_APPROVAL_ARTIFACTS.human_approval), humanApproval.text);
+        writePrivateImmutableJson(path.join(staging, FLOW_IDENTITY_APPROVAL_ARTIFACTS.approval), approval);
+        writePrivateImmutableJson(path.join(staging, FLOW_IDENTITY_APPROVAL_ARTIFACTS.report), report);
+    });
+    return report;
+}
+export const __testInternals = {
+    requireCanonicalJson,
+    requireDistinctApprovalHashDomains,
+    requireHash,
+};
+//# sourceMappingURL=dataset-maintenance-flow-identity-seal.js.map

package/dist/src/lib/dataset-maintenance-flow-identity-seal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dataset-maintenance-flow-identity-seal.js","sourceRoot":"","sources":["../../../src/lib/dataset-maintenance-flow-identity-seal.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,6CAA6C,EAC7C,yBAAyB,EACzB,yBAAyB,EACzB,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,yCAAyC,EACzC,uBAAuB,GAExB,MAAM,2DAA2D,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,iDAAiD,CAAC;AACxF,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAC/E,OAAO,EACL,gCAAgC,EAChC,uCAAuC,GAExC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAmCvC,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,cAAc,EAAE,4CAA4C;IAC5D,QAAQ,EAAE,uCAAuC;IACjD,MAAM,EAAE,mDAAmD;CACnD,CAAC;AAEX,MAAM,IAAI,GAAG,iBAAiB,CAAC;AAE/B,SAAS,IAAI,CAAC,OAAe,EAAE,IAAI,GAAG,6CAA6C;IACjF,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,WAAW,CAAC,KAAa,EAAE,KAAa;IAC/C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,GAAG,KAAK,+BAA+B,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,kCAAkC,CAAC,MAAyB;IACnE,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QAC3C,IAAI,CAAC,kEAAkE,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAgB,EAAE,KAAa;IAC3D,MAAM,QAAQ,GAAG,yBAAyB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IAChE,IAAI,QAAQ,CAAC,IAAI,KAAK,GAAG,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC5D,IAAI,CAAC,GAAG,KAAK,oDAAoD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,OAAwC;IAExC,WAAW,CAAC,OAAO,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;IAC5D,WAAW,CAAC,OAAO,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IACtD,WAAW,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,6CAA6C,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,YAAY,GAAG,oBAAoB,CAAC,OAAO,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;IAClF,MAAM,IAAI,GAAG,qBAAqB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IACvD,MAAM,cAAc,GAAG,oBAAoB,CAAC,OAAO,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC;IACxF,MAAM,MAAM,GAAG,uBAAuB,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACnE,MAAM,eAAe,GAAG,oBAAoB,CAC1C,OAAO,CAAC,mBAAmB,EAC3B,0CAA0C,CAC3C,CAAC;IACF,MAAM,OAAO,GAAG,gCAAgC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,EAAE,GAAG,OAAO,EAA6B,CAAC;IACvD,OAAO,IAAI,CAAC,cAAc,CAAC;IAC3B,MAAM,YAAY,GAAG,uCAAuC,CAC1D,IAAgD,EAChD,OAAO,CAAC,cAAc,CACvB,CAAC;IACF,MAAM,aAAa,GAAG,yBAAyB,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC3E,MAAM,mBAAmB,GAAG,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAC3D,IACE,IAAI,CAAC,WAAW,KAAK,YAAY;QACjC,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK;QACtC,OAAO,CAAC,iBAAiB,KAAK,cAAc,CAAC,WAAW;QACxD,OAAO,CAAC,cAAc,KAAK,OAAO,CAAC,cAAc;QACjD,OAAO,CAAC,WAAW,KAAK,mBAAmB;QAC3C,aAAa,CAAC,IAAI,KAAK,YAAY;QACnC,OAAO,CAAC,aAAa,KAAK,OAAO,CAAC,eAAe;QACjD,OAAO,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;QACxC,OAAO,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO;QAC9C,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK;QAC1C,OAAO,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;QACxC,OAAO,CAAC,gBAAgB,KAAK,YAAY,CAAC,WAAW;QACrD,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY;QAC1C,OAAO,CAAC,kBAAkB,KAAK,cAAc,CAAC,WAAW;QACzD,OAAO,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa;QAC9C,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU;QACtC,OAAO,CAAC,oBAAoB,KAAK,IAAI,CAAC,oBAAoB;QAC1D,OAAO,CAAC,sBAAsB,KAAK,IAAI,CAAC,sBAAsB;QAC9D,OAAO,CAAC,uBAAuB,KAAK,IAAI,CAAC,uBAAuB;QAChE,OAAO,CAAC,wBAAwB,KAAK,IAAI,CAAC,wBAAwB;QAClE,OAAO,CAAC,uBAAuB,KAAK,IAAI,CAAC,uBAAuB;QAChE,OAAO,CAAC,wBAAwB,KAAK,IAAI,CAAC,wBAAwB;QAClE,OAAO,CAAC,yBAAyB,KAAK,IAAI,CAAC,yBAAyB;QACpE,OAAO,CAAC,gCAAgC,KAAK,IAAI,CAAC,gCAAgC;QAClF,OAAO,CAAC,gCAAgC,KAAK,IAAI,CAAC,gCAAgC;QAClF,OAAO,CAAC,uBAAuB,KAAK,IAAI,CAAC,uBAAuB;QAChE,OAAO,CAAC,yBAAyB,KAAK,MAAM,CAAC,yBAAyB;QACtE,OAAO,CAAC,2BAA2B,KAAK,IAAI,CAAC,oBAAoB,CAAC,oBAAoB;QACtF,OAAO,CAAC,qBAAqB,KAAK,IAAI,CAAC,OAAO,CAAC,gBAAgB;QAC/D,OAAO,CAAC,aAAa,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM;QAC9C,OAAO,CAAC,aAAa,KAAK,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,MAAM;QAC/D,OAAO,CAAC,aAAa,KAAK,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM;QAChE,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,MAAM;QAC9D,OAAO,CAAC,aAAa,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM;QAC/C,OAAO,CAAC,aAAa,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ;QAC/C,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,2BAA2B,EAAE,OAAO,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC;aACxF,IAAI,KAAK,CAAC,EACb,CAAC;QACD,IAAI,CAAC,yEAAyE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,QAAQ,GAAyB;QACrC,cAAc,EAAE,6CAA6C;QAC7D,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,KAAK,EAAE,IAAI,CAAC,OAAO;QACnB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,yBAAyB,EAAE,MAAM,CAAC,yBAAyB;QAC3D,2BAA2B,EAAE,OAAO,CAAC,2BAA2B;QAChE,iCAAiC,EAAE,OAAO,CAAC,cAAc;QACzD,8BAA8B,EAAE,mBAAmB;QACnD,kCAAkC,EAAE,EAAE;KACvC,CAAC;IACF,QAAQ,CAAC,kCAAkC,GAAG,yCAAyC,CAAC,QAAQ,CAAC,CAAC;IAClG,kCAAkC,CAAC;QACjC,QAAQ,CAAC,2BAA2B;QACpC,QAAQ,CAAC,iCAAiC;QAC1C,QAAQ,CAAC,8BAA8B;QACvC,QAAQ,CAAC,kCAAkC;KAC5C,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAClC,MAAM,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;QACpE,GAAG;QACH,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC;KACxB,CAAC,CAC4C,CAAC;IACjD,MAAM,MAAM,GAAmC;QAC7C,cAAc,EAAE,yDAAyD;QACzE,gBAAgB,EAAE,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;QAC3D,yBAAyB,EAAE,OAAO,CAAC,eAAe;QAClD,MAAM,EAAE,QAAQ;QAChB,mBAAmB,EAAE,KAAK;QAC1B,aAAa,EAAE,CAAC;QAChB,cAAc,EAAE,CAAC;QACjB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,kBAAkB,EAAE,cAAc,CAAC,WAAW;QAC9C,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,2BAA2B,EAAE,QAAQ,CAAC,2BAA2B;QACjE,iCAAiC,EAAE,QAAQ,CAAC,iCAAiC;QAC7E,8BAA8B,EAAE,QAAQ,CAAC,8BAA8B;QACvE,kCAAkC,EAAE,QAAQ,CAAC,kCAAkC;QAC/E,SAAS;KACV,CAAC;IACF,6CAA6C,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE;QAChE,yBAAyB,CACvB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,gCAAgC,CAAC,cAAc,CAAC,EACnE,aAAa,CAAC,IAAI,CACnB,CAAC;QACF,yBAAyB,CACvB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,gCAAgC,CAAC,QAAQ,CAAC,EAC7D,QAAQ,CACT,CAAC;QACF,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,gCAAgC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IACjG,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,oBAAoB;IACpB,kCAAkC;IAClC,WAAW;CACZ,CAAC","sourcesContent":["import path from 'node:path';\nimport {\n  materializePrivateArtifactDirectoryAtomically,\n  readProtectedJsonArtifact,\n  readProtectedTextArtifact,\n  writePrivateImmutableJson,\n  writePrivateImmutableText,\n} from './dataset-maintenance-protected-artifacts.js';\nimport {\n  computeFlowIdentityApprovalIdentitySha256,\n  parseFlowIdentityFreeze,\n  type FlowIdentityApproval,\n} from './dataset-maintenance-flow-identity-execution-contract.js';\nimport { parseFlowIdentityPlan } from './dataset-maintenance-flow-identity-contract.js';\nimport { sha256Text, stableJsonText } from './dataset-maintenance-contract.js';\nimport {\n  parseFlowIdentityApprovalRequest,\n  renderFlowIdentityExecutionApprovalText,\n  type FlowIdentityExecutionApprovalRequestCore,\n} from './dataset-maintenance-flow-identity-freeze.js';\nimport { CliError } from './errors.js';\n\nexport type SealFlowIdentityApprovalOptions = {\n  planPath: string;\n  freezePath: string;\n  approvalRequestPath: string;\n  humanApprovalPath: string;\n  approveFreezeFile: string;\n  approveRequest: string;\n  approveText: string;\n  confirm: string;\n  approvedAtUtc: string;\n  outDir: string;\n  now?: Date;\n};\n\nexport type FlowIdentityApprovalSealReport = {\n  schema_version: 'dataset-flow-identity-execution-approval-seal-report.v2';\n  generated_at_utc: string;\n  approval_authority_at_utc: string;\n  status: 'sealed';\n  execution_submitted: false;\n  network_calls: 0;\n  database_calls: 0;\n  plan_sha256: string;\n  operation_id: string;\n  freeze_file_sha256: string;\n  freeze_sha256: string;\n  policy_approval_text_sha256: string;\n  execution_approval_request_sha256: string;\n  execution_approval_text_sha256: string;\n  execution_approval_identity_sha256: string;\n  artifacts: { human_approval: string; approval: string; report: string };\n};\n\nexport const FLOW_IDENTITY_APPROVAL_ARTIFACTS = {\n  human_approval: 'flow-identity-execution-human-approval.txt',\n  approval: 'flow-identity-execution-approval.json',\n  report: 'flow-identity-execution-approval-seal-report.json',\n} as const;\n\nconst HASH = /^[a-f0-9]{64}$/u;\n\nfunction fail(message: string, code = 'DATASET_FLOW_IDENTITY_APPROVAL_SEAL_INVALID'): never {\n  throw new CliError(message, { code, exitCode: 1 });\n}\n\nfunction requireHash(value: string, label: string): void {\n  if (!HASH.test(value)) fail(`${label} must be a lowercase SHA-256.`);\n}\n\nfunction requireDistinctApprovalHashDomains(hashes: readonly string[]): void {\n  if (new Set(hashes).size !== hashes.length) {\n    fail('Policy and execution approval hash domains must remain distinct.');\n  }\n}\n\nfunction requireCanonicalJson(filePath: string, label: string) {\n  const artifact = readProtectedJsonArtifact({ filePath, label });\n  if (artifact.text !== `${stableJsonText(artifact.value)}\\n`) {\n    fail(`${label} must be canonical JSON with one trailing newline.`);\n  }\n  return artifact;\n}\n\nexport function sealFlowIdentityApproval(\n  options: SealFlowIdentityApprovalOptions,\n): FlowIdentityApprovalSealReport {\n  requireHash(options.approveFreezeFile, 'approveFreezeFile');\n  requireHash(options.approveRequest, 'approveRequest');\n  requireHash(options.approveText, 'approveText');\n  if (!Number.isFinite(Date.parse(options.approvedAtUtc))) {\n    fail('approvedAtUtc must be an RFC3339 timestamp.');\n  }\n  const planArtifact = requireCanonicalJson(options.planPath, 'Flow identity plan');\n  const plan = parseFlowIdentityPlan(planArtifact.value);\n  const freezeArtifact = requireCanonicalJson(options.freezePath, 'Flow identity freeze');\n  const freeze = parseFlowIdentityFreeze(freezeArtifact.value, plan);\n  const requestArtifact = requireCanonicalJson(\n    options.approvalRequestPath,\n    'Flow identity execution approval request',\n  );\n  const request = parseFlowIdentityApprovalRequest(requestArtifact.value);\n  const core = { ...request } as Record<string, unknown>;\n  delete core.request_sha256;\n  const expectedText = renderFlowIdentityExecutionApprovalText(\n    core as FlowIdentityExecutionApprovalRequestCore,\n    request.request_sha256,\n  );\n  const humanApproval = readProtectedTextArtifact(options.humanApprovalPath);\n  const humanApprovalSha256 = sha256Text(humanApproval.text);\n  if (\n    plan.environment !== 'production' ||\n    options.confirm !== plan.account.email ||\n    options.approveFreezeFile !== freezeArtifact.file_sha256 ||\n    options.approveRequest !== request.request_sha256 ||\n    options.approveText !== humanApprovalSha256 ||\n    humanApproval.text !== expectedText ||\n    options.approvedAtUtc !== request.approved_at_utc ||\n    request.project_ref !== plan.project_ref ||\n    request.actor.user_id !== plan.account.user_id ||\n    request.actor.email !== plan.account.email ||\n    request.plan_sha256 !== plan.plan_sha256 ||\n    request.plan_file_sha256 !== planArtifact.file_sha256 ||\n    request.operation_id !== plan.operation_id ||\n    request.freeze_file_sha256 !== freezeArtifact.file_sha256 ||\n    request.freeze_sha256 !== freeze.freeze_sha256 ||\n    request.receipt_id !== plan.receipt_id ||\n    request.receipt_proof_sha256 !== plan.receipt_proof_sha256 ||\n    request.capture_request_sha256 !== plan.capture_request_sha256 ||\n    request.source_guard_set_sha256 !== plan.source_guard_set_sha256 ||\n    request.support_guard_set_sha256 !== plan.support_guard_set_sha256 ||\n    request.target_guard_set_sha256 !== plan.target_guard_set_sha256 ||\n    request.mapping_guard_set_sha256 !== plan.mapping_guard_set_sha256 ||\n    request.process_intent_set_sha256 !== plan.process_intent_set_sha256 ||\n    request.receipt_protected_closure_sha256 !== plan.receipt_protected_closure_sha256 ||\n    request.capture_whole_scope_proof_sha256 !== plan.capture_whole_scope_proof_sha256 ||\n    request.capture_artifact_sha256 !== plan.capture_artifact_sha256 ||\n    request.toolchain_evidence_sha256 !== freeze.toolchain_evidence_sha256 ||\n    request.policy_approval_text_sha256 !== plan.compatibility_policy.approval_text_sha256 ||\n    request.semantic_source_count !== plan.summary.semantic_sources ||\n    request.mapping_count !== plan.mappings.length ||\n    request.pending_count !== plan.protected_closure.pending.length ||\n    request.blocker_count !== plan.protected_closure.blockers.length ||\n    request.orphan_count !== plan.protected_closure.orphans.length ||\n    request.process_count !== plan.processes.length ||\n    request.rewrite_count !== plan.summary.rewrites ||\n    new Set([request.policy_approval_text_sha256, request.request_sha256, humanApprovalSha256])\n      .size !== 3\n  ) {\n    fail('Human approval does not exactly bind this production execution request.');\n  }\n  const approval: FlowIdentityApproval = {\n    schema_version: 'dataset-flow-identity-execution-approval.v2',\n    approved_at_utc: request.approved_at_utc,\n    actor: plan.account,\n    plan_sha256: plan.plan_sha256,\n    freeze_sha256: freeze.freeze_sha256,\n    toolchain_evidence_sha256: freeze.toolchain_evidence_sha256,\n    policy_approval_text_sha256: request.policy_approval_text_sha256,\n    execution_approval_request_sha256: request.request_sha256,\n    execution_approval_text_sha256: humanApprovalSha256,\n    execution_approval_identity_sha256: '',\n  };\n  approval.execution_approval_identity_sha256 = computeFlowIdentityApprovalIdentitySha256(approval);\n  requireDistinctApprovalHashDomains([\n    approval.policy_approval_text_sha256,\n    approval.execution_approval_request_sha256,\n    approval.execution_approval_text_sha256,\n    approval.execution_approval_identity_sha256,\n  ]);\n  const outDir = path.resolve(options.outDir);\n  const artifacts = Object.fromEntries(\n    Object.entries(FLOW_IDENTITY_APPROVAL_ARTIFACTS).map(([key, name]) => [\n      key,\n      path.join(outDir, name),\n    ]),\n  ) as FlowIdentityApprovalSealReport['artifacts'];\n  const report: FlowIdentityApprovalSealReport = {\n    schema_version: 'dataset-flow-identity-execution-approval-seal-report.v2',\n    generated_at_utc: (options.now ?? new Date()).toISOString(),\n    approval_authority_at_utc: request.approved_at_utc,\n    status: 'sealed',\n    execution_submitted: false,\n    network_calls: 0,\n    database_calls: 0,\n    plan_sha256: plan.plan_sha256,\n    operation_id: plan.operation_id,\n    freeze_file_sha256: freezeArtifact.file_sha256,\n    freeze_sha256: freeze.freeze_sha256,\n    policy_approval_text_sha256: approval.policy_approval_text_sha256,\n    execution_approval_request_sha256: approval.execution_approval_request_sha256,\n    execution_approval_text_sha256: approval.execution_approval_text_sha256,\n    execution_approval_identity_sha256: approval.execution_approval_identity_sha256,\n    artifacts,\n  };\n  materializePrivateArtifactDirectoryAtomically(outDir, (staging) => {\n    writePrivateImmutableText(\n      path.join(staging, FLOW_IDENTITY_APPROVAL_ARTIFACTS.human_approval),\n      humanApproval.text,\n    );\n    writePrivateImmutableJson(\n      path.join(staging, FLOW_IDENTITY_APPROVAL_ARTIFACTS.approval),\n      approval,\n    );\n    writePrivateImmutableJson(path.join(staging, FLOW_IDENTITY_APPROVAL_ARTIFACTS.report), report);\n  });\n  return report;\n}\n\nexport const __testInternals = {\n  requireCanonicalJson,\n  requireDistinctApprovalHashDomains,\n  requireHash,\n};\n"]}