@tokensrc/codex 1.13.4 → 1.14.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +79 -3
- package/dist/client.d.ts +29 -1
- package/dist/client.js +221 -2
- package/dist/client.js.map +1 -1
- package/dist/command-directory.d.ts +1 -0
- package/dist/command-directory.js +3 -2
- package/dist/command-directory.js.map +1 -1
- package/dist/commands.d.ts +8 -2
- package/dist/commands.js +567 -40
- package/dist/commands.js.map +1 -1
- package/dist/console-status.js +1 -1
- package/dist/console-status.js.map +1 -1
- package/dist/credential-supervisor.d.ts +17 -0
- package/dist/credential-supervisor.js +84 -0
- package/dist/credential-supervisor.js.map +1 -0
- package/dist/credentials.d.ts +75 -3
- package/dist/credentials.js +357 -12
- package/dist/credentials.js.map +1 -1
- package/dist/enrollment-envelope.d.ts +18 -0
- package/dist/enrollment-envelope.js +112 -0
- package/dist/enrollment-envelope.js.map +1 -0
- package/dist/enrollment-flow.d.ts +27 -0
- package/dist/enrollment-flow.js +224 -0
- package/dist/enrollment-flow.js.map +1 -0
- package/dist/enrollment-login.d.ts +26 -0
- package/dist/enrollment-login.js +104 -0
- package/dist/enrollment-login.js.map +1 -0
- package/dist/index.d.ts +13 -0
- package/dist/index.js +17 -3
- package/dist/index.js.map +1 -1
- package/dist/managed-credential-v3-envelope.d.ts +60 -0
- package/dist/managed-credential-v3-envelope.js +234 -0
- package/dist/managed-credential-v3-envelope.js.map +1 -0
- package/dist/managed-credential-v3-flow.d.ts +45 -0
- package/dist/managed-credential-v3-flow.js +499 -0
- package/dist/managed-credential-v3-flow.js.map +1 -0
- package/dist/managed-credential-v3-journal.d.ts +192 -0
- package/dist/managed-credential-v3-journal.js +153 -0
- package/dist/managed-credential-v3-journal.js.map +1 -0
- package/dist/managed-credential-v3.d.ts +117 -0
- package/dist/managed-credential-v3.js +423 -0
- package/dist/managed-credential-v3.js.map +1 -0
- package/dist/migration-login-batch.d.ts +66 -0
- package/dist/migration-login-batch.js +202 -0
- package/dist/migration-login-batch.js.map +1 -0
- package/dist/private-file.d.ts +10 -0
- package/dist/private-file.js +77 -2
- package/dist/private-file.js.map +1 -1
- package/dist/profile.d.ts +10 -0
- package/dist/profile.js +55 -2
- package/dist/profile.js.map +1 -1
- package/dist/protocol.d.ts +1070 -0
- package/dist/protocol.js +560 -0
- package/dist/protocol.js.map +1 -1
- package/dist/retirement-flow.d.ts +38 -0
- package/dist/retirement-flow.js +78 -0
- package/dist/retirement-flow.js.map +1 -0
- package/dist/runtime.d.ts +4 -1
- package/dist/runtime.js +29 -4
- package/dist/runtime.js.map +1 -1
- package/dist/selection.d.ts +10 -1
- package/dist/selection.js +38 -2
- package/dist/selection.js.map +1 -1
- package/dist/short-lived-delivery-flow.d.ts +41 -0
- package/dist/short-lived-delivery-flow.js +141 -0
- package/dist/short-lived-delivery-flow.js.map +1 -0
- package/dist/short-lived-delivery-journal.d.ts +34 -0
- package/dist/short-lived-delivery-journal.js +137 -0
- package/dist/short-lived-delivery-journal.js.map +1 -0
- package/dist/short-lived-delivery.d.ts +26 -0
- package/dist/short-lived-delivery.js +139 -0
- package/dist/short-lived-delivery.js.map +1 -0
- package/dist/tui.js +23 -0
- package/dist/tui.js.map +1 -1
- package/dist/types.d.ts +6 -2
- package/package.json +2 -2
|
@@ -0,0 +1,499 @@
|
|
|
1
|
+
import { randomUUID } from "node:crypto";
|
|
2
|
+
import { withOneShotCodexLogin } from "./enrollment-login.js";
|
|
3
|
+
import { CodexServiceError } from "./errors.js";
|
|
4
|
+
import { codexV3CredentialDigests, commitManagedCodexV3GenerationReport, installManagedCodexV3Credentials, markManagedCodexV3DeliveryAcknowledged, readManagedCodexV3State, withCurrentCodexFullCredentials, withManagedCodexV3CredentialObservation } from "./managed-credential-v3.js";
|
|
5
|
+
import { createCodexV3DeliveryKeyPair, openCodexV3FullCredentialDelivery, sealCodexV3Enrollment, sealCodexV3GenerationReport } from "./managed-credential-v3-envelope.js";
|
|
6
|
+
import { clearManagedCodexV3OperationJournal, openManagedCodexV3DeliveryJournalKey, readManagedCodexV3OperationJournal, replaceManagedCodexV3OperationWithDelivery, writeManagedCodexV3OperationJournal } from "./managed-credential-v3-journal.js";
|
|
7
|
+
export async function executeManagedCodexV3Login(input) {
|
|
8
|
+
const resumed = await resumePendingManagedCodexV3EnrollmentOperation(input);
|
|
9
|
+
if (resumed)
|
|
10
|
+
return resumed;
|
|
11
|
+
const configuration = await input.client.getV3EnrollmentConfiguration();
|
|
12
|
+
const subject = await input.client.getCurrentActorSubject();
|
|
13
|
+
return withOneShotCodexLogin({
|
|
14
|
+
mode: input.deviceAuth ? "device" : "browser",
|
|
15
|
+
env: input.env
|
|
16
|
+
}, async (credentials) => {
|
|
17
|
+
if (!credentials.providerAccountId) {
|
|
18
|
+
throw new CodexServiceError("Official Codex login did not expose a provider account id.", "invalid_managed_codex_v3_credentials");
|
|
19
|
+
}
|
|
20
|
+
const accessPayload = credentials.accessToken.split(".")[1];
|
|
21
|
+
const exp = accessPayload ? tokenExpiry(credentials.accessToken) : undefined;
|
|
22
|
+
if (!exp)
|
|
23
|
+
throw new CodexServiceError("Official Codex login did not expose a usable access-token expiry.", "invalid_managed_codex_v3_credentials");
|
|
24
|
+
return executeManagedCodexV3Enrollment({
|
|
25
|
+
...input,
|
|
26
|
+
configuration: configuration.ingress,
|
|
27
|
+
subject,
|
|
28
|
+
credentials: {
|
|
29
|
+
refreshToken: credentials.refreshToken,
|
|
30
|
+
accessToken: credentials.accessToken,
|
|
31
|
+
idToken: credentials.idToken,
|
|
32
|
+
providerAccountId: credentials.providerAccountId,
|
|
33
|
+
expiresAt: new Date(exp).toISOString()
|
|
34
|
+
}
|
|
35
|
+
});
|
|
36
|
+
});
|
|
37
|
+
}
|
|
38
|
+
export async function executeManagedCodexV3Upload(input) {
|
|
39
|
+
const resumed = await resumePendingManagedCodexV3EnrollmentOperation(input);
|
|
40
|
+
if (resumed)
|
|
41
|
+
return resumed;
|
|
42
|
+
const configuration = await input.client.getV3EnrollmentConfiguration();
|
|
43
|
+
const subject = await input.client.getCurrentActorSubject();
|
|
44
|
+
return withCurrentCodexFullCredentials(input.env ?? process.env, async (credentials) => executeManagedCodexV3Enrollment({
|
|
45
|
+
...input,
|
|
46
|
+
configuration: configuration.ingress,
|
|
47
|
+
subject,
|
|
48
|
+
credentials
|
|
49
|
+
}));
|
|
50
|
+
}
|
|
51
|
+
async function executeManagedCodexV3Enrollment(input) {
|
|
52
|
+
const newId = input.newId ?? randomUUID;
|
|
53
|
+
const now = input.now ?? Date.now;
|
|
54
|
+
const clientRequestId = newId();
|
|
55
|
+
const enrollmentKey = newId();
|
|
56
|
+
const envelope = sealCodexV3Enrollment({
|
|
57
|
+
tenantId: input.tenantId,
|
|
58
|
+
subject: input.subject,
|
|
59
|
+
clientRequestId,
|
|
60
|
+
idempotencyKey: enrollmentKey,
|
|
61
|
+
ingress: input.configuration,
|
|
62
|
+
credentials: input.credentials
|
|
63
|
+
});
|
|
64
|
+
const timestamp = new Date(now()).toISOString();
|
|
65
|
+
const journal = await writeManagedCodexV3OperationJournal({
|
|
66
|
+
schemaVersion: 3,
|
|
67
|
+
kind: "ENROLLMENT",
|
|
68
|
+
tenantId: input.tenantId,
|
|
69
|
+
subject: input.subject,
|
|
70
|
+
clientRequestId,
|
|
71
|
+
idempotencyKey: enrollmentKey,
|
|
72
|
+
providerAccountId: input.credentials.providerAccountId,
|
|
73
|
+
envelope,
|
|
74
|
+
createdAt: timestamp,
|
|
75
|
+
updatedAt: timestamp
|
|
76
|
+
}, input.env);
|
|
77
|
+
if (journal.kind !== "ENROLLMENT")
|
|
78
|
+
throw new Error("Unexpected v3 operation journal.");
|
|
79
|
+
return completeEnrollmentJournal({ ...input, journal });
|
|
80
|
+
}
|
|
81
|
+
async function completeEnrollmentJournal(input) {
|
|
82
|
+
const newId = input.newId ?? randomUUID;
|
|
83
|
+
const now = input.now ?? Date.now;
|
|
84
|
+
const wait = input.wait ?? ((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)));
|
|
85
|
+
let enrollment = await postResolveReplay({
|
|
86
|
+
post: () => input.client.createV3Enrollment({
|
|
87
|
+
clientRequestId: input.journal.clientRequestId,
|
|
88
|
+
envelope: input.journal.envelope
|
|
89
|
+
}, input.journal.idempotencyKey),
|
|
90
|
+
resolve: () => input.client.resolveV3Enrollment(input.journal.clientRequestId)
|
|
91
|
+
});
|
|
92
|
+
for (let attempt = 0; enrollment.enrollment.status === "VALIDATING" && attempt < 120; attempt += 1) {
|
|
93
|
+
await wait(1_000);
|
|
94
|
+
enrollment = await input.client.resolveV3Enrollment(input.journal.clientRequestId);
|
|
95
|
+
}
|
|
96
|
+
const ready = requireReadyEnrollment(enrollment);
|
|
97
|
+
if (ready.providerAccountId !== input.journal.providerAccountId) {
|
|
98
|
+
throw new CodexServiceError("V3 enrollment provider identity does not match the official Codex login.", "invalid_codex_service_response");
|
|
99
|
+
}
|
|
100
|
+
const keyPair = createCodexV3DeliveryKeyPair();
|
|
101
|
+
const deliveryClientRequestId = newId();
|
|
102
|
+
const deliveryKey = newId();
|
|
103
|
+
const ackKey = newId();
|
|
104
|
+
const deliveryJournal = await replaceManagedCodexV3OperationWithDelivery({
|
|
105
|
+
previous: input.journal,
|
|
106
|
+
delivery: {
|
|
107
|
+
tenantId: input.journal.tenantId,
|
|
108
|
+
subject: input.journal.subject,
|
|
109
|
+
clientRequestId: deliveryClientRequestId,
|
|
110
|
+
idempotencyKey: deliveryKey,
|
|
111
|
+
enrollmentId: ready.id,
|
|
112
|
+
assignmentId: ready.assignmentId,
|
|
113
|
+
managedAccountId: ready.managedAccountId,
|
|
114
|
+
providerAccountId: ready.providerAccountId,
|
|
115
|
+
lineageId: ready.lineageId,
|
|
116
|
+
generationVersion: ready.generationVersion,
|
|
117
|
+
clientKey: keyPair.clientKey,
|
|
118
|
+
ackIdempotencyKey: ackKey
|
|
119
|
+
},
|
|
120
|
+
privateKey: keyPair.privateKey,
|
|
121
|
+
now: now(),
|
|
122
|
+
env: input.env
|
|
123
|
+
});
|
|
124
|
+
return completeDeliveryJournal({
|
|
125
|
+
client: input.client,
|
|
126
|
+
journal: deliveryJournal,
|
|
127
|
+
now,
|
|
128
|
+
env: input.env,
|
|
129
|
+
enrollmentReplayed: enrollment.replayed
|
|
130
|
+
});
|
|
131
|
+
}
|
|
132
|
+
async function completeDeliveryJournal(input) {
|
|
133
|
+
const now = input.now ?? Date.now;
|
|
134
|
+
const delivery = await postResolveReplay({
|
|
135
|
+
post: () => input.client.createV3FullCredentialDelivery(input.journal.assignmentId, {
|
|
136
|
+
schemaVersion: 3,
|
|
137
|
+
clientRequestId: input.journal.clientRequestId,
|
|
138
|
+
clientKey: input.journal.clientKey
|
|
139
|
+
}, input.journal.idempotencyKey),
|
|
140
|
+
resolve: () => input.client.resolveV3FullCredentialDelivery(input.journal.assignmentId, input.journal.clientRequestId)
|
|
141
|
+
});
|
|
142
|
+
const bundle = openCodexV3FullCredentialDelivery({
|
|
143
|
+
tenantId: input.journal.tenantId,
|
|
144
|
+
response: delivery,
|
|
145
|
+
privateKey: openManagedCodexV3DeliveryJournalKey(input.journal),
|
|
146
|
+
now: now()
|
|
147
|
+
});
|
|
148
|
+
if (bundle.providerAccountId !== input.journal.providerAccountId
|
|
149
|
+
|| bundle.lineageId !== input.journal.lineageId
|
|
150
|
+
|| bundle.managedAccountId !== input.journal.managedAccountId
|
|
151
|
+
|| bundle.generationVersion !== input.journal.generationVersion
|
|
152
|
+
|| delivery.delivery.assignmentId !== input.journal.assignmentId) {
|
|
153
|
+
throw new CodexServiceError("V3 enrollment and delivery evidence do not match.", "invalid_codex_service_response");
|
|
154
|
+
}
|
|
155
|
+
await installManagedCodexV3Credentials({
|
|
156
|
+
tenantId: input.journal.tenantId,
|
|
157
|
+
enrollmentId: input.journal.enrollmentId,
|
|
158
|
+
assignmentId: input.journal.assignmentId,
|
|
159
|
+
managedAccountId: bundle.managedAccountId,
|
|
160
|
+
providerAccountId: bundle.providerAccountId,
|
|
161
|
+
lineageId: bundle.lineageId,
|
|
162
|
+
generationVersion: bundle.generationVersion,
|
|
163
|
+
deliveryId: bundle.deliveryId,
|
|
164
|
+
ackIdempotencyKey: input.journal.ackIdempotencyKey,
|
|
165
|
+
refreshToken: bundle.refreshToken,
|
|
166
|
+
accessToken: bundle.accessToken,
|
|
167
|
+
idToken: bundle.idToken,
|
|
168
|
+
credentialExpiresAt: bundle.expiresAt,
|
|
169
|
+
ackExpiresAt: delivery.delivery.ackExpiresAt,
|
|
170
|
+
lastRefresh: delivery.delivery.issuedAt
|
|
171
|
+
}, now(), input.env);
|
|
172
|
+
const ack = await acknowledgeWithRecovery(input.client, {
|
|
173
|
+
assignmentId: input.journal.assignmentId,
|
|
174
|
+
managedAccountId: bundle.managedAccountId,
|
|
175
|
+
providerAccountId: bundle.providerAccountId,
|
|
176
|
+
lineageId: bundle.lineageId,
|
|
177
|
+
deliveryId: bundle.deliveryId,
|
|
178
|
+
generationVersion: bundle.generationVersion,
|
|
179
|
+
idempotencyKey: input.journal.ackIdempotencyKey
|
|
180
|
+
});
|
|
181
|
+
if (ack.delivery.assignmentId !== input.journal.assignmentId
|
|
182
|
+
|| ack.delivery.managedAccountId !== bundle.managedAccountId
|
|
183
|
+
|| ack.delivery.providerAccountId !== bundle.providerAccountId
|
|
184
|
+
|| ack.delivery.lineageId !== bundle.lineageId) {
|
|
185
|
+
throw new CodexServiceError("V3 ACK evidence does not match installed credentials.", "invalid_codex_service_response");
|
|
186
|
+
}
|
|
187
|
+
await markManagedCodexV3DeliveryAcknowledged({
|
|
188
|
+
deliveryId: bundle.deliveryId,
|
|
189
|
+
generationVersion: bundle.generationVersion,
|
|
190
|
+
authorityEpoch: ack.delivery.authorityEpoch,
|
|
191
|
+
ackedAt: ack.delivery.ackedAt
|
|
192
|
+
}, input.env);
|
|
193
|
+
await clearManagedCodexV3OperationJournal(input.journal, input.env);
|
|
194
|
+
return {
|
|
195
|
+
enrollmentId: input.journal.enrollmentId,
|
|
196
|
+
assignmentId: input.journal.assignmentId,
|
|
197
|
+
managedAccountId: input.journal.managedAccountId,
|
|
198
|
+
providerAccountId: input.journal.providerAccountId,
|
|
199
|
+
lineageId: input.journal.lineageId,
|
|
200
|
+
generationVersion: input.journal.generationVersion,
|
|
201
|
+
authorityMode: "CLIENT_MANAGED",
|
|
202
|
+
authorityEpoch: ack.delivery.authorityEpoch,
|
|
203
|
+
credentialExpiresAt: bundle.expiresAt,
|
|
204
|
+
enrollmentReplayed: input.enrollmentReplayed,
|
|
205
|
+
deliveryReplayed: delivery.replayed,
|
|
206
|
+
ackReplayed: ack.replayed
|
|
207
|
+
};
|
|
208
|
+
}
|
|
209
|
+
async function resumePendingManagedCodexV3EnrollmentOperation(input) {
|
|
210
|
+
const ack = await resumePendingManagedCodexV3Ack(input);
|
|
211
|
+
if (ack)
|
|
212
|
+
return ack;
|
|
213
|
+
const journal = await readManagedCodexV3OperationJournal(input.env);
|
|
214
|
+
if (!journal)
|
|
215
|
+
return undefined;
|
|
216
|
+
if (journal.tenantId !== input.tenantId) {
|
|
217
|
+
throw new CodexServiceError("Another tenant has a pending v3 credential operation.", "managed_codex_v3_state_conflict");
|
|
218
|
+
}
|
|
219
|
+
if (journal.kind === "REPORT") {
|
|
220
|
+
throw new CodexServiceError("A v3 credential generation report must be reconciled before enrollment.", "managed_codex_v3_state_conflict");
|
|
221
|
+
}
|
|
222
|
+
return journal.kind === "ENROLLMENT"
|
|
223
|
+
? completeEnrollmentJournal({ ...input, journal })
|
|
224
|
+
: completeDeliveryJournal({ ...input, journal, enrollmentReplayed: true });
|
|
225
|
+
}
|
|
226
|
+
async function resumePendingManagedCodexV3Ack(input) {
|
|
227
|
+
const state = await readManagedCodexV3State(input.env);
|
|
228
|
+
if (!state || state.tenantId !== input.tenantId) {
|
|
229
|
+
return undefined;
|
|
230
|
+
}
|
|
231
|
+
const journal = await readManagedCodexV3OperationJournal(input.env);
|
|
232
|
+
if (state.phase === "INSTALLED") {
|
|
233
|
+
if (state.authorityEpoch == null) {
|
|
234
|
+
throw new CodexServiceError("The acknowledged v3 authority evidence is incomplete.", "managed_codex_v3_state_conflict");
|
|
235
|
+
}
|
|
236
|
+
if (journal?.kind !== "DELIVERY")
|
|
237
|
+
return undefined;
|
|
238
|
+
if (journal.assignmentId !== state.assignmentId
|
|
239
|
+
|| journal.managedAccountId !== state.managedAccountId
|
|
240
|
+
|| journal.providerAccountId !== state.providerAccountId
|
|
241
|
+
|| journal.lineageId !== state.lineageId
|
|
242
|
+
|| journal.generationVersion !== state.generationVersion
|
|
243
|
+
|| journal.ackIdempotencyKey !== state.ackIdempotencyKey) {
|
|
244
|
+
throw new CodexServiceError("The acknowledged v3 credentials conflict with the pending delivery journal.", "managed_codex_v3_state_conflict");
|
|
245
|
+
}
|
|
246
|
+
await clearManagedCodexV3OperationJournal(journal, input.env);
|
|
247
|
+
return {
|
|
248
|
+
enrollmentId: state.enrollmentId,
|
|
249
|
+
assignmentId: state.assignmentId,
|
|
250
|
+
managedAccountId: state.managedAccountId,
|
|
251
|
+
providerAccountId: state.providerAccountId,
|
|
252
|
+
lineageId: state.lineageId,
|
|
253
|
+
generationVersion: state.generationVersion,
|
|
254
|
+
authorityMode: "CLIENT_MANAGED",
|
|
255
|
+
authorityEpoch: state.authorityEpoch,
|
|
256
|
+
credentialExpiresAt: state.credentialExpiresAt,
|
|
257
|
+
enrollmentReplayed: true,
|
|
258
|
+
deliveryReplayed: true,
|
|
259
|
+
ackReplayed: true
|
|
260
|
+
};
|
|
261
|
+
}
|
|
262
|
+
if (state.phase !== "INSTALLED_PENDING_ACK")
|
|
263
|
+
return undefined;
|
|
264
|
+
if (Date.parse(state.ackExpiresAt) <= (input.now ?? Date.now)()) {
|
|
265
|
+
throw new CodexServiceError("The pending v3 delivery ACK has expired.", "full_credential_delivery_expired");
|
|
266
|
+
}
|
|
267
|
+
const ack = await acknowledgeWithRecovery(input.client, {
|
|
268
|
+
assignmentId: state.assignmentId,
|
|
269
|
+
managedAccountId: state.managedAccountId,
|
|
270
|
+
providerAccountId: state.providerAccountId,
|
|
271
|
+
lineageId: state.lineageId,
|
|
272
|
+
deliveryId: state.deliveryId,
|
|
273
|
+
generationVersion: state.generationVersion,
|
|
274
|
+
idempotencyKey: state.ackIdempotencyKey
|
|
275
|
+
});
|
|
276
|
+
await markManagedCodexV3DeliveryAcknowledged({
|
|
277
|
+
deliveryId: state.deliveryId,
|
|
278
|
+
generationVersion: state.generationVersion,
|
|
279
|
+
authorityEpoch: ack.delivery.authorityEpoch,
|
|
280
|
+
ackedAt: ack.delivery.ackedAt
|
|
281
|
+
}, input.env);
|
|
282
|
+
if (journal?.kind === "DELIVERY" && journal.assignmentId === state.assignmentId
|
|
283
|
+
&& journal.ackIdempotencyKey === state.ackIdempotencyKey) {
|
|
284
|
+
await clearManagedCodexV3OperationJournal(journal, input.env);
|
|
285
|
+
}
|
|
286
|
+
return {
|
|
287
|
+
enrollmentId: state.enrollmentId,
|
|
288
|
+
assignmentId: state.assignmentId,
|
|
289
|
+
managedAccountId: state.managedAccountId,
|
|
290
|
+
providerAccountId: state.providerAccountId,
|
|
291
|
+
lineageId: state.lineageId,
|
|
292
|
+
generationVersion: state.generationVersion,
|
|
293
|
+
authorityMode: "CLIENT_MANAGED",
|
|
294
|
+
authorityEpoch: ack.delivery.authorityEpoch,
|
|
295
|
+
credentialExpiresAt: state.credentialExpiresAt,
|
|
296
|
+
enrollmentReplayed: true,
|
|
297
|
+
deliveryReplayed: true,
|
|
298
|
+
ackReplayed: ack.replayed
|
|
299
|
+
};
|
|
300
|
+
}
|
|
301
|
+
async function acknowledgeWithRecovery(client, expected) {
|
|
302
|
+
const call = () => client.acknowledgeV3FullCredentialDelivery(expected.deliveryId, {
|
|
303
|
+
generationVersion: expected.generationVersion,
|
|
304
|
+
installed: true
|
|
305
|
+
}, expected.idempotencyKey);
|
|
306
|
+
try {
|
|
307
|
+
return await call();
|
|
308
|
+
}
|
|
309
|
+
catch (error) {
|
|
310
|
+
if (!resultMayBeUnknown(error))
|
|
311
|
+
throw error;
|
|
312
|
+
let assignment;
|
|
313
|
+
try {
|
|
314
|
+
assignment = (await client.listV3CredentialAssignments()).items[0];
|
|
315
|
+
}
|
|
316
|
+
catch (inspectError) {
|
|
317
|
+
throw new CodexServiceError("Codex v3 ACK outcome is unknown and assignment evidence is unavailable.", "managed_codex_v3_result_unknown", undefined, { cause: inspectError });
|
|
318
|
+
}
|
|
319
|
+
if (assignment && (assignment.assignmentId !== expected.assignmentId
|
|
320
|
+
|| assignment.managedAccountId !== expected.managedAccountId
|
|
321
|
+
|| assignment.providerAccountId !== expected.providerAccountId
|
|
322
|
+
|| assignment.lineageId !== expected.lineageId
|
|
323
|
+
|| assignment.currentGenerationVersion !== expected.generationVersion)) {
|
|
324
|
+
throw new CodexServiceError("Codex v3 ACK assignment evidence conflicts with local credentials.", "lineage_version_conflict");
|
|
325
|
+
}
|
|
326
|
+
try {
|
|
327
|
+
return await call();
|
|
328
|
+
}
|
|
329
|
+
catch (replayError) {
|
|
330
|
+
throw new CodexServiceError("Codex v3 ACK outcome remains unknown after assignment inspection and exact replay.", "managed_codex_v3_result_unknown", undefined, { cause: replayError });
|
|
331
|
+
}
|
|
332
|
+
}
|
|
333
|
+
}
|
|
334
|
+
export async function reportManagedCodexV3Credentials(input) {
|
|
335
|
+
const newId = input.newId ?? randomUUID;
|
|
336
|
+
const now = input.now ?? Date.now;
|
|
337
|
+
try {
|
|
338
|
+
const pending = await readManagedCodexV3OperationJournal(input.env);
|
|
339
|
+
if (pending) {
|
|
340
|
+
if (pending.kind !== "REPORT" || pending.tenantId !== input.tenantId) {
|
|
341
|
+
throw new CodexServiceError("A v3 enrollment/delivery operation is pending.", "managed_codex_v3_state_conflict");
|
|
342
|
+
}
|
|
343
|
+
const generationVersion = await completeReportJournal(input.client, pending, input.env);
|
|
344
|
+
return { reported: true, generationVersion };
|
|
345
|
+
}
|
|
346
|
+
const configuration = await input.client.getV3EnrollmentConfiguration();
|
|
347
|
+
const subject = await input.client.getCurrentActorSubject();
|
|
348
|
+
const result = await withManagedCodexV3CredentialObservation(input.env ?? process.env, now(), async (observation) => {
|
|
349
|
+
const clientRequestId = newId();
|
|
350
|
+
const key = newId();
|
|
351
|
+
const envelope = sealCodexV3GenerationReport({
|
|
352
|
+
tenantId: input.tenantId,
|
|
353
|
+
subject,
|
|
354
|
+
lineageId: observation.state.lineageId,
|
|
355
|
+
clientRequestId,
|
|
356
|
+
idempotencyKey: key,
|
|
357
|
+
expectedGenerationVersion: observation.state.generationVersion,
|
|
358
|
+
rotationMode: observation.rotationMode,
|
|
359
|
+
ingress: configuration.ingress,
|
|
360
|
+
credentials: {
|
|
361
|
+
...observation.credentials,
|
|
362
|
+
expiresAt: observation.credentialExpiresAt
|
|
363
|
+
}
|
|
364
|
+
});
|
|
365
|
+
const digests = codexV3CredentialDigests(observation.credentials);
|
|
366
|
+
const timestamp = new Date(now()).toISOString();
|
|
367
|
+
const journal = await writeManagedCodexV3OperationJournal({
|
|
368
|
+
schemaVersion: 3,
|
|
369
|
+
kind: "REPORT",
|
|
370
|
+
tenantId: input.tenantId,
|
|
371
|
+
subject,
|
|
372
|
+
clientRequestId,
|
|
373
|
+
idempotencyKey: key,
|
|
374
|
+
lineageId: observation.state.lineageId,
|
|
375
|
+
expectedGenerationVersion: observation.state.generationVersion,
|
|
376
|
+
rotationMode: observation.rotationMode,
|
|
377
|
+
envelope,
|
|
378
|
+
accessTokenHealth: observation.accessTokenHealth,
|
|
379
|
+
refreshTokenHealth: observation.refreshTokenHealth,
|
|
380
|
+
observedAt: observation.observedAt,
|
|
381
|
+
credentialExpiresAt: observation.credentialExpiresAt,
|
|
382
|
+
...digests,
|
|
383
|
+
createdAt: timestamp,
|
|
384
|
+
updatedAt: timestamp
|
|
385
|
+
}, input.env);
|
|
386
|
+
if (journal.kind !== "REPORT")
|
|
387
|
+
throw new Error("Unexpected v3 report journal.");
|
|
388
|
+
return completeReportJournal(input.client, journal, input.env);
|
|
389
|
+
});
|
|
390
|
+
return result === undefined ? { reported: false } : { reported: true, generationVersion: result };
|
|
391
|
+
}
|
|
392
|
+
catch (error) {
|
|
393
|
+
// Transport silence is not credential invalidity. Leave the local generation
|
|
394
|
+
// untouched so the next explicit observation can reconcile with the same server lineage.
|
|
395
|
+
return { reported: false, warningCode: errorCode(error) };
|
|
396
|
+
}
|
|
397
|
+
}
|
|
398
|
+
async function completeReportJournal(client, journal, env) {
|
|
399
|
+
const state = await readManagedCodexV3State(env);
|
|
400
|
+
if (state?.phase === "INSTALLED"
|
|
401
|
+
&& state.lineageId === journal.lineageId
|
|
402
|
+
&& state.generationVersion === journal.expectedGenerationVersion + 1
|
|
403
|
+
&& state.lastReportedAt === journal.observedAt
|
|
404
|
+
&& state.credentialExpiresAt === journal.credentialExpiresAt
|
|
405
|
+
&& state.accessTokenDigest === journal.accessTokenDigest
|
|
406
|
+
&& state.refreshTokenDigest === journal.refreshTokenDigest
|
|
407
|
+
&& state.idTokenDigest === journal.idTokenDigest) {
|
|
408
|
+
await clearManagedCodexV3OperationJournal(journal, env);
|
|
409
|
+
return state.generationVersion;
|
|
410
|
+
}
|
|
411
|
+
const reportInput = {
|
|
412
|
+
clientRequestId: journal.clientRequestId,
|
|
413
|
+
expectedGenerationVersion: journal.expectedGenerationVersion,
|
|
414
|
+
rotationMode: journal.rotationMode,
|
|
415
|
+
envelope: journal.envelope,
|
|
416
|
+
accessTokenHealth: journal.accessTokenHealth,
|
|
417
|
+
refreshTokenHealth: journal.refreshTokenHealth,
|
|
418
|
+
observedAt: journal.observedAt
|
|
419
|
+
};
|
|
420
|
+
const response = await postResolveReplay({
|
|
421
|
+
post: () => client.reportV3Generation(journal.lineageId, reportInput, journal.idempotencyKey),
|
|
422
|
+
resolve: () => client.resolveV3GenerationReport(journal.lineageId, reportInput)
|
|
423
|
+
});
|
|
424
|
+
if (response.report.credentialExpiresAt !== journal.credentialExpiresAt) {
|
|
425
|
+
throw new CodexServiceError("V3 report expiry evidence does not match observed credentials.", "invalid_codex_service_response");
|
|
426
|
+
}
|
|
427
|
+
await commitManagedCodexV3GenerationReport({
|
|
428
|
+
lineageId: response.report.lineageId,
|
|
429
|
+
previousGenerationVersion: response.report.previousGenerationVersion,
|
|
430
|
+
generationVersion: response.report.generationVersion,
|
|
431
|
+
authorityEpoch: response.report.authorityEpoch,
|
|
432
|
+
credentialExpiresAt: response.report.credentialExpiresAt,
|
|
433
|
+
observedAt: response.report.observedAt,
|
|
434
|
+
tokenDigests: {
|
|
435
|
+
accessTokenDigest: journal.accessTokenDigest,
|
|
436
|
+
refreshTokenDigest: journal.refreshTokenDigest,
|
|
437
|
+
idTokenDigest: journal.idTokenDigest
|
|
438
|
+
}
|
|
439
|
+
}, env);
|
|
440
|
+
await clearManagedCodexV3OperationJournal(journal, env);
|
|
441
|
+
return response.report.generationVersion;
|
|
442
|
+
}
|
|
443
|
+
function requireReadyEnrollment(response) {
|
|
444
|
+
const value = response.enrollment;
|
|
445
|
+
if (value.status !== "READY" || value.assignmentId == null || value.managedAccountId == null
|
|
446
|
+
|| value.providerAccountId == null || value.lineageId == null || value.generationVersion == null) {
|
|
447
|
+
throw new CodexServiceError(`Codex v3 enrollment did not become READY (${value.status}).`, value.safeErrorCode ?? "managed_codex_v3_enrollment_not_ready", 409);
|
|
448
|
+
}
|
|
449
|
+
return { ...value, assignmentId: value.assignmentId, managedAccountId: value.managedAccountId,
|
|
450
|
+
providerAccountId: value.providerAccountId, lineageId: value.lineageId,
|
|
451
|
+
generationVersion: value.generationVersion };
|
|
452
|
+
}
|
|
453
|
+
async function postResolveReplay(input) {
|
|
454
|
+
try {
|
|
455
|
+
return await input.post();
|
|
456
|
+
}
|
|
457
|
+
catch (postError) {
|
|
458
|
+
if (!resultMayBeUnknown(postError))
|
|
459
|
+
throw postError;
|
|
460
|
+
try {
|
|
461
|
+
return await input.resolve();
|
|
462
|
+
}
|
|
463
|
+
catch (resolveError) {
|
|
464
|
+
if (resolveError instanceof CodexServiceError && resolveError.status === 404) {
|
|
465
|
+
try {
|
|
466
|
+
return await input.post();
|
|
467
|
+
}
|
|
468
|
+
catch (replayError) {
|
|
469
|
+
throw new CodexServiceError("Codex v3 mutation outcome remains unknown after exact replay.", "managed_codex_v3_result_unknown", undefined, { cause: replayError });
|
|
470
|
+
}
|
|
471
|
+
}
|
|
472
|
+
throw new CodexServiceError("Codex v3 mutation outcome is unknown; retry with the same local operation state.", "managed_codex_v3_result_unknown", undefined, { cause: postError });
|
|
473
|
+
}
|
|
474
|
+
}
|
|
475
|
+
}
|
|
476
|
+
function resultMayBeUnknown(error) {
|
|
477
|
+
if (!(error instanceof CodexServiceError))
|
|
478
|
+
return true;
|
|
479
|
+
return error.status === undefined || error.status >= 500
|
|
480
|
+
|| error.code === "invalid_codex_service_response";
|
|
481
|
+
}
|
|
482
|
+
function tokenExpiry(token) {
|
|
483
|
+
try {
|
|
484
|
+
const payload = token.split(".")[1];
|
|
485
|
+
if (!payload)
|
|
486
|
+
return undefined;
|
|
487
|
+
const value = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
|
|
488
|
+
return typeof value.exp === "number" && Number.isFinite(value.exp) ? value.exp * 1_000 : undefined;
|
|
489
|
+
}
|
|
490
|
+
catch {
|
|
491
|
+
return undefined;
|
|
492
|
+
}
|
|
493
|
+
}
|
|
494
|
+
function errorCode(error) {
|
|
495
|
+
return typeof error?.code === "string"
|
|
496
|
+
? error.code
|
|
497
|
+
: "managed_codex_v3_report_deferred";
|
|
498
|
+
}
|
|
499
|
+
//# sourceMappingURL=managed-credential-v3-flow.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"managed-credential-v3-flow.js","sourceRoot":"","sources":["../src/managed-credential-v3-flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EACL,wBAAwB,EACxB,oCAAoC,EACpC,gCAAgC,EAChC,sCAAsC,EACtC,uBAAuB,EACvB,+BAA+B,EAC/B,uCAAuC,EACxC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,4BAA4B,EAC5B,iCAAiC,EACjC,qBAAqB,EACrB,2BAA2B,EAE5B,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EACL,mCAAmC,EACnC,oCAAoC,EACpC,kCAAkC,EAClC,0CAA0C,EAC1C,mCAAmC,EAIpC,MAAM,oCAAoC,CAAC;AAuB5C,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAQhD;IACC,MAAM,OAAO,GAAG,MAAM,8CAA8C,CAAC,KAAK,CAAC,CAAC;IAC5E,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,4BAA4B,EAAE,CAAC;IACxE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC;IAC5D,OAAO,qBAAqB,CAAC;QAC3B,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;QAC7C,GAAG,EAAE,KAAK,CAAC,GAAG;KACf,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE;QACvB,IAAI,CAAC,WAAW,CAAC,iBAAiB,EAAE,CAAC;YACnC,MAAM,IAAI,iBAAiB,CACzB,4DAA4D,EAC5D,sCAAsC,CACvC,CAAC;QACJ,CAAC;QACD,MAAM,aAAa,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5D,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7E,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,iBAAiB,CACnC,mEAAmE,EACnE,sCAAsC,CACvC,CAAC;QACF,OAAO,+BAA+B,CAAC;YACrC,GAAG,KAAK;YACR,aAAa,EAAE,aAAa,CAAC,OAAO;YACpC,OAAO;YACP,WAAW,EAAE;gBACX,YAAY,EAAE,WAAW,CAAC,YAAY;gBACtC,WAAW,EAAE,WAAW,CAAC,WAAW;gBACpC,OAAO,EAAE,WAAW,CAAC,OAAO;gBAC5B,iBAAiB,EAAE,WAAW,CAAC,iBAAiB;gBAChD,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;aACvC;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAOjD;IACC,MAAM,OAAO,GAAG,MAAM,8CAA8C,CAAC,KAAK,CAAC,CAAC;IAC5E,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,4BAA4B,EAAE,CAAC;IACxE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC;IAC5D,OAAO,+BAA+B,CAAC,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CACrF,+BAA+B,CAAC;QAC9B,GAAG,KAAK;QACR,aAAa,EAAE,aAAa,CAAC,OAAO;QACpC,OAAO;QACP,WAAW;KACZ,CAAC,CAAC,CAAC;AACR,CAAC;AAED,KAAK,UAAU,+BAA+B,CAAC,KAU9C;IACC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,UAAU,CAAC;IACxC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAClC,MAAM,eAAe,GAAG,KAAK,EAAE,CAAC;IAChC,MAAM,aAAa,GAAG,KAAK,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAG,qBAAqB,CAAC;QACrC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,eAAe;QACf,cAAc,EAAE,aAAa;QAC7B,OAAO,EAAE,KAAK,CAAC,aAAa;QAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAChD,MAAM,OAAO,GAAG,MAAM,mCAAmC,CAAC;QACxD,aAAa,EAAE,CAAC;QAChB,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,eAAe;QACf,cAAc,EAAE,aAAa;QAC7B,iBAAiB,EAAE,KAAK,CAAC,WAAW,CAAC,iBAAiB;QACtD,QAAQ;QACR,SAAS,EAAE,SAAS;QACpB,SAAS,EAAE,SAAS;KACrB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACd,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACvF,OAAO,yBAAyB,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,KAOxC;IACC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,UAAU,CAAC;IACxC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAClC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,YAAoB,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IACnH,IAAI,UAAU,GAAG,MAAM,iBAAiB,CAAC;QACvC,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC;YAC1C,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,eAAe;YAC9C,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;SACjC,EAAE,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;QAChC,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC;KAC/E,CAAC,CAAC;IACH,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC,MAAM,KAAK,YAAY,IAAI,OAAO,GAAG,GAAG,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QACnG,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;QAClB,UAAU,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,KAAK,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,KAAK,CAAC,iBAAiB,KAAK,KAAK,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAChE,MAAM,IAAI,iBAAiB,CACzB,0EAA0E,EAC1E,gCAAgC,CACjC,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,4BAA4B,EAAE,CAAC;IAC/C,MAAM,uBAAuB,GAAG,KAAK,EAAE,CAAC;IACxC,MAAM,WAAW,GAAG,KAAK,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,KAAK,EAAE,CAAC;IACvB,MAAM,eAAe,GAAG,MAAM,0CAA0C,CAAC;QACvE,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,QAAQ,EAAE;YACR,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;YAChC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO;YAC9B,eAAe,EAAE,uBAAuB;YACxC,cAAc,EAAE,WAAW;YAC3B,YAAY,EAAE,KAAK,CAAC,EAAE;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,iBAAiB,EAAE,MAAM;SAC1B;QACD,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,GAAG,EAAE,GAAG,EAAE;QACV,GAAG,EAAE,KAAK,CAAC,GAAG;KACf,CAAC,CAAC;IACH,OAAO,uBAAuB,CAAC;QAC7B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,eAAe;QACxB,GAAG;QACH,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,kBAAkB,EAAE,UAAU,CAAC,QAAQ;KACxC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,KAMtC;IACC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAClC,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC;QACvC,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,8BAA8B,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE;YAClF,aAAa,EAAE,CAAC;YAChB,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,eAAe;YAC9C,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;SACnC,EAAE,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;QAChC,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,+BAA+B,CACzD,KAAK,CAAC,OAAO,CAAC,YAAY,EAC1B,KAAK,CAAC,OAAO,CAAC,eAAe,CAC9B;KACF,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,iCAAiC,CAAC;QAC/C,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;QAChC,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,oCAAoC,CAAC,KAAK,CAAC,OAAO,CAAC;QAC/D,GAAG,EAAE,GAAG,EAAE;KACX,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,iBAAiB,KAAK,KAAK,CAAC,OAAO,CAAC,iBAAiB;WAC3D,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,OAAO,CAAC,SAAS;WAC5C,MAAM,CAAC,gBAAgB,KAAK,KAAK,CAAC,OAAO,CAAC,gBAAgB;WAC1D,MAAM,CAAC,iBAAiB,KAAK,KAAK,CAAC,OAAO,CAAC,iBAAiB;WAC5D,QAAQ,CAAC,QAAQ,CAAC,YAAY,KAAK,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QACnE,MAAM,IAAI,iBAAiB,CAAC,mDAAmD,EAAE,gCAAgC,CAAC,CAAC;IACrH,CAAC;IACD,MAAM,gCAAgC,CAAC;QACrC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;QAChC,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;QACxC,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;QACxC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,iBAAiB;QAClD,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,mBAAmB,EAAE,MAAM,CAAC,SAAS;QACrC,YAAY,EAAE,QAAQ,CAAC,QAAQ,CAAC,YAAY;QAC5C,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ;KACxC,EAAE,GAAG,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACrB,MAAM,GAAG,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,MAAM,EAAE;QACtD,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;QACxC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,iBAAiB;KAChD,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,KAAK,KAAK,CAAC,OAAO,CAAC,YAAY;WACvD,GAAG,CAAC,QAAQ,CAAC,gBAAgB,KAAK,MAAM,CAAC,gBAAgB;WACzD,GAAG,CAAC,QAAQ,CAAC,iBAAiB,KAAK,MAAM,CAAC,iBAAiB;WAC3D,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;QACjD,MAAM,IAAI,iBAAiB,CAAC,uDAAuD,EAAE,gCAAgC,CAAC,CAAC;IACzH,CAAC;IACD,MAAM,sCAAsC,CAAC;QAC3C,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,cAAc,EAAE,GAAG,CAAC,QAAQ,CAAC,cAAc;QAC3C,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO;KAC9B,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACd,MAAM,mCAAmC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACpE,OAAO;QACL,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;QACxC,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;QACxC,gBAAgB,EAAE,KAAK,CAAC,OAAO,CAAC,gBAAgB;QAChD,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,iBAAiB;QAClD,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;QAClC,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,iBAAiB;QAClD,aAAa,EAAE,gBAAgB;QAC/B,cAAc,EAAE,GAAG,CAAC,QAAQ,CAAC,cAAc;QAC3C,mBAAmB,EAAE,MAAM,CAAC,SAAS;QACrC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,gBAAgB,EAAE,QAAQ,CAAC,QAAQ;QACnC,WAAW,EAAE,GAAG,CAAC,QAAQ;KAC1B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,8CAA8C,CAAC,KAO7D;IACC,MAAM,GAAG,GAAG,MAAM,8BAA8B,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IACpB,MAAM,OAAO,GAAG,MAAM,kCAAkC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpE,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,iBAAiB,CAAC,uDAAuD,EAAE,iCAAiC,CAAC,CAAC;IAC1H,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,iBAAiB,CAAC,yEAAyE,EAAE,iCAAiC,CAAC,CAAC;IAC5I,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,KAAK,YAAY;QAClC,CAAC,CAAC,yBAAyB,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,CAAC;QAClD,CAAC,CAAC,uBAAuB,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,KAAK,UAAU,8BAA8B,CAAC,KAK7C;IACC,MAAM,KAAK,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,kCAAkC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;QAChC,IAAI,KAAK,CAAC,cAAc,IAAI,IAAI,EAAE,CAAC;YACjC,MAAM,IAAI,iBAAiB,CAAC,uDAAuD,EAAE,iCAAiC,CAAC,CAAC;QAC1H,CAAC;QACD,IAAI,OAAO,EAAE,IAAI,KAAK,UAAU;YAAE,OAAO,SAAS,CAAC;QACnD,IAAI,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;eAC1C,OAAO,CAAC,gBAAgB,KAAK,KAAK,CAAC,gBAAgB;eACnD,OAAO,CAAC,iBAAiB,KAAK,KAAK,CAAC,iBAAiB;eACrD,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;eACrC,OAAO,CAAC,iBAAiB,KAAK,KAAK,CAAC,iBAAiB;eACrD,OAAO,CAAC,iBAAiB,KAAK,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAC3D,MAAM,IAAI,iBAAiB,CACzB,6EAA6E,EAC7E,iCAAiC,CAClC,CAAC;QACJ,CAAC;QACD,MAAM,mCAAmC,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9D,OAAO;YACL,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,aAAa,EAAE,gBAAgB;YAC/B,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;YACtB,WAAW,EAAE,IAAI;SAClB,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,KAAK,uBAAuB;QAAE,OAAO,SAAS,CAAC;IAC9D,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QAChE,MAAM,IAAI,iBAAiB,CAAC,0CAA0C,EAAE,kCAAkC,CAAC,CAAC;IAC9G,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,MAAM,EAAE;QACtD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,cAAc,EAAE,KAAK,CAAC,iBAAiB;KACxC,CAAC,CAAC;IACH,MAAM,sCAAsC,CAAC;QAC3C,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,cAAc,EAAE,GAAG,CAAC,QAAQ,CAAC,cAAc;QAC3C,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO;KAC9B,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACd,IAAI,OAAO,EAAE,IAAI,KAAK,UAAU,IAAI,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;WAC1E,OAAO,CAAC,iBAAiB,KAAK,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAC3D,MAAM,mCAAmC,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAChE,CAAC;IACD,OAAO;QACL,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,aAAa,EAAE,gBAAgB;QAC/B,cAAc,EAAE,GAAG,CAAC,QAAQ,CAAC,cAAc;QAC3C,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,kBAAkB,EAAE,IAAI;QACxB,gBAAgB,EAAE,IAAI;QACtB,WAAW,EAAE,GAAG,CAAC,QAAQ;KAC1B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,MAAgB,EAAE,QAQxD;IACC,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,mCAAmC,CAAC,QAAQ,CAAC,UAAU,EAAE;QACjF,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;QAC7C,SAAS,EAAE,IAAI;KAChB,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QAC5C,IAAI,UAAU,CAAC;QACf,IAAI,CAAC;YACH,UAAU,GAAG,CAAC,MAAM,MAAM,CAAC,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,YAAY,EAAE,CAAC;YACtB,MAAM,IAAI,iBAAiB,CACzB,yEAAyE,EACzE,iCAAiC,EACjC,SAAS,EACT,EAAE,KAAK,EAAE,YAAY,EAAE,CACxB,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,IAAI,CAAC,UAAU,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY;eAC/D,UAAU,CAAC,gBAAgB,KAAK,QAAQ,CAAC,gBAAgB;eACzD,UAAU,CAAC,iBAAiB,KAAK,QAAQ,CAAC,iBAAiB;eAC3D,UAAU,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;eAC3C,UAAU,CAAC,wBAAwB,KAAK,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,iBAAiB,CAAC,oEAAoE,EAAE,0BAA0B,CAAC,CAAC;QAChI,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,WAAW,EAAE,CAAC;YACrB,MAAM,IAAI,iBAAiB,CACzB,oFAAoF,EACpF,iCAAiC,EACjC,SAAS,EACT,EAAE,KAAK,EAAE,WAAW,EAAE,CACvB,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAMrD;IACC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,UAAU,CAAC;IACxC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,kCAAkC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpE,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACrE,MAAM,IAAI,iBAAiB,CAAC,gDAAgD,EAAE,iCAAiC,CAAC,CAAC;YACnH,CAAC;YACD,MAAM,iBAAiB,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;YACxF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;QAC/C,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,4BAA4B,EAAE,CAAC;QACxE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,uCAAuC,CAAC,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE;YAClH,MAAM,eAAe,GAAG,KAAK,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;YACpB,MAAM,QAAQ,GAAG,2BAA2B,CAAC;gBAC3C,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,OAAO;gBACP,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC,SAAS;gBACtC,eAAe;gBACf,cAAc,EAAE,GAAG;gBACnB,yBAAyB,EAAE,WAAW,CAAC,KAAK,CAAC,iBAAiB;gBAC9D,YAAY,EAAE,WAAW,CAAC,YAAY;gBACtC,OAAO,EAAE,aAAa,CAAC,OAAO;gBAC9B,WAAW,EAAE;oBACX,GAAG,WAAW,CAAC,WAAW;oBAC1B,SAAS,EAAE,WAAW,CAAC,mBAAmB;iBAC3C;aACF,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,wBAAwB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;YAClE,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAChD,MAAM,OAAO,GAAG,MAAM,mCAAmC,CAAC;gBACxD,aAAa,EAAE,CAAC;gBAChB,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,OAAO;gBACP,eAAe;gBACf,cAAc,EAAE,GAAG;gBACnB,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC,SAAS;gBACtC,yBAAyB,EAAE,WAAW,CAAC,KAAK,CAAC,iBAAiB;gBAC9D,YAAY,EAAE,WAAW,CAAC,YAAY;gBACtC,QAAQ;gBACR,iBAAiB,EAAE,WAAW,CAAC,iBAAiB;gBAChD,kBAAkB,EAAE,WAAW,CAAC,kBAAkB;gBAClD,UAAU,EAAE,WAAW,CAAC,UAAU;gBAClC,mBAAmB,EAAE,WAAW,CAAC,mBAAmB;gBACpD,GAAG,OAAO;gBACV,SAAS,EAAE,SAAS;gBACpB,SAAS,EAAE,SAAS;aACrB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;YACd,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YAChF,OAAO,qBAAqB,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC;IACpG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,6EAA6E;QAC7E,yFAAyF;QACzF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,MAAgB,EAChB,OAAoC,EACpC,GAAuB;IAEvB,MAAM,KAAK,GAAG,MAAM,uBAAuB,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,KAAK,EAAE,KAAK,KAAK,WAAW;WAC3B,KAAK,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;WACrC,KAAK,CAAC,iBAAiB,KAAK,OAAO,CAAC,yBAAyB,GAAG,CAAC;WACjE,KAAK,CAAC,cAAc,KAAK,OAAO,CAAC,UAAU;WAC3C,KAAK,CAAC,mBAAmB,KAAK,OAAO,CAAC,mBAAmB;WACzD,KAAK,CAAC,iBAAiB,KAAK,OAAO,CAAC,iBAAiB;WACrD,KAAK,CAAC,kBAAkB,KAAK,OAAO,CAAC,kBAAkB;WACvD,KAAK,CAAC,aAAa,KAAK,OAAO,CAAC,aAAa,EAAE,CAAC;QACnD,MAAM,mCAAmC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACxD,OAAO,KAAK,CAAC,iBAAiB,CAAC;IACjC,CAAC;IACD,MAAM,WAAW,GAAG;QAClB,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,yBAAyB,EAAE,OAAO,CAAC,yBAAyB;QAC5D,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,UAAU,EAAE,OAAO,CAAC,UAAU;KACtB,CAAC;IACX,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC;QACvC,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,cAAc,CAAC;QAC7F,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC;KAChF,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,CAAC,mBAAmB,KAAK,OAAO,CAAC,mBAAmB,EAAE,CAAC;QACxE,MAAM,IAAI,iBAAiB,CAAC,gEAAgE,EAAE,gCAAgC,CAAC,CAAC;IAClI,CAAC;IACD,MAAM,oCAAoC,CAAC;QACzC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS;QACpC,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,yBAAyB;QACpE,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,iBAAiB;QACpD,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc;QAC9C,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,mBAAmB;QACxD,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU;QACtC,YAAY,EAAE;YACZ,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;YAC9C,aAAa,EAAE,OAAO,CAAC,aAAa;SACrC;KACF,EAAE,GAAG,CAAC,CAAC;IACR,MAAM,mCAAmC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACxD,OAAO,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC;AAC3C,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAmC;IACjE,MAAM,KAAK,GAAG,QAAQ,CAAC,UAAU,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,IAAI,KAAK,CAAC,YAAY,IAAI,IAAI,IAAI,KAAK,CAAC,gBAAgB,IAAI,IAAI;WACvF,KAAK,CAAC,iBAAiB,IAAI,IAAI,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,KAAK,CAAC,iBAAiB,IAAI,IAAI,EAAE,CAAC;QACnG,MAAM,IAAI,iBAAiB,CACzB,6CAA6C,KAAK,CAAC,MAAM,IAAI,EAC7D,KAAK,CAAC,aAAa,IAAI,uCAAuC,EAC9D,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QAC3F,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS;QACtE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAI,KAA4D;IAC9F,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,SAAS,EAAE,CAAC;QACnB,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC;YAAE,MAAM,SAAS,CAAC;QACpD,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,YAAY,EAAE,CAAC;YACtB,IAAI,YAAY,YAAY,iBAAiB,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC7E,IAAI,CAAC;oBACH,OAAO,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;gBAC5B,CAAC;gBAAC,OAAO,WAAW,EAAE,CAAC;oBACrB,MAAM,IAAI,iBAAiB,CACzB,+DAA+D,EAC/D,iCAAiC,EACjC,SAAS,EACT,EAAE,KAAK,EAAE,WAAW,EAAE,CACvB,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM,IAAI,iBAAiB,CACzB,kFAAkF,EAClF,iCAAiC,EACjC,SAAS,EACT,EAAE,KAAK,EAAE,SAAS,EAAE,CACrB,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,CAAC,CAAC,KAAK,YAAY,iBAAiB,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG;WACnD,KAAK,CAAC,IAAI,KAAK,gCAAgC,CAAC;AACvD,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAsB,CAAC;QAClG,OAAO,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACrG,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;AAC/B,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,OAAQ,KAAwC,EAAE,IAAI,KAAK,QAAQ;QACxE,CAAC,CAAE,KAA0B,CAAC,IAAI;QAClC,CAAC,CAAC,kCAAkC,CAAC;AACzC,CAAC"}
|