@trillboards/edge-sdk 0.2.21 → 0.2.24

package/deploy/macos/scripts/setup-litertlm.sh

@@ -168,6 +168,36 @@ if [ "$HOST_OS" = "Darwin" ] && [ "$HOST_ARCH" != "arm64" ]; then
   exit 0
 fi
 
+# 0b. Enterprise TLS + proxy for uv.
+#
+# uv ships bundled Mozilla roots and does NOT consult the macOS keychain, so on
+# a network that inspects TLS this step is the first thing that fails -- and it
+# fails with a message about local AI, which is the wrong cause. UV_SYSTEM_CERTS
+# switches it to the platform's native verifier; UV_NATIVE_TLS is the older,
+# deprecated-but-still-read name for the same setting, exported too because
+# `uv tool install` here is UNPINNED and the version that lands is whatever is
+# current that day. An unknown env var is ignored, so both are safe; a CLI flag
+# would fail outright on a version that does not have it.
+export UV_SYSTEM_CERTS=1
+export UV_NATIVE_TLS=1
+
+# The proxy half: uv reads only the environment, never the macOS system proxy
+# settings. Fill them in from scutil when the operator has not set them already.
+if [ -z "${HTTPS_PROXY:-}" ] && [ -z "${https_proxy:-}" ] && [ -z "${ALL_PROXY:-}" ]; then
+  _proxy_conf="$(/usr/sbin/scutil --proxy 2>/dev/null || true)"
+  _proxy_enabled="$(printf '%s\n' "$_proxy_conf" | awk '/HTTPSEnable/ {print $3}')"
+  if [ "$_proxy_enabled" = "1" ]; then
+    _proxy_host="$(printf '%s\n' "$_proxy_conf" | awk '/HTTPSProxy/ {print $3}')"
+    _proxy_port="$(printf '%s\n' "$_proxy_conf" | awk '/HTTPSPort/ {print $3}')"
+    if [ -n "$_proxy_host" ]; then
+      HTTPS_PROXY="http://$_proxy_host${_proxy_port:+:$_proxy_port}"
+      export HTTPS_PROXY
+      export HTTP_PROXY="$HTTPS_PROXY"
+      log "using this machine's configured proxy for local AI downloads: $HTTPS_PROXY"
+    fi
+  fi
+fi
+
 # 1. uv (PATH first; else official standalone installer, home-domain).
 export PATH="$LOCAL_BIN:$USER_HOME/.cargo/bin:$PATH"
 if ! command -v uv >/dev/null 2>&1; then

package/deploy/windows/e2e/test-enterprise-trust-store.ps1

@@ -0,0 +1,341 @@
+<#
+  RUNTIME PROOF: the connector reads THIS MACHINE'S Windows certificate store,
+  and still refuses a certificate that store does not vouch for.
+
+  WHY THIS EXISTS
+  ---------------
+  Node ships its own Mozilla-derived root list and does not consult the Windows
+  store, so behind a TLS-inspecting corporate proxy the connector could not
+  reach the API at all -- on the repair install path, silently, in a background
+  process with no window. The Node-side fix reads the Root stores at runtime.
+  Everything about that fix is Windows-specific and the merge-gating CI lane is
+  Linux, so on Linux the store reader is exercised only through an injected
+  seam. This script is the half that is NOT a seam: it imports a throwaway
+  certificate into the REAL LocalMachine\Root store and measures what the REAL
+  shipped code does with it.
+
+  WHAT IT PROVES, AND THE CONTROL FOR EACH
+  ----------------------------------------
+    A. BEFORE the import, the connector REFUSES the inspecting proxy's
+       certificate.  <- the failing control. If this passes, the machine already
+                        trusted the root and every later assertion is vacuous.
+       It also asserts the store read returned SOMETHING and the request really
+       went through the proxy, so B cannot pass for the wrong reason.
+    B. AFTER the import, the SAME request succeeds. Only the store changed.
+    C. AFTER the import, a certificate from a DIFFERENT root is STILL refused.
+       This is the assertion `rejectUnauthorized:false` would fail, and it is
+       the whole reason B is not evidence of a security regression.
+    D. The store read is not blocked by execution policy: it keeps working under
+       a machine-scope AllSigned GPO, which is the estate this work targets.
+       (The reader uses `powershell -Command`, and execution policy governs
+       script FILES; a regression to `-File` would fail exactly here.)
+
+  It REQUIRES elevation, and it must import into LocalMachine\Root specifically.
+  CurrentUser\Root is writable by the signed-in user in the ACL sense, which is
+  exactly what makes it a trap: a write to a CurrentUser TRUST-ANCHOR store is
+  gated behind an interactive "you are about to install a certificate from a
+  certification authority" consent dialog. On a headless runner nobody can answer
+  it, so Import-Certificate BLOCKS rather than fails -- it hung 23 minutes and ate
+  the job's entire timeout on 2026-08-15, reporting neither pass nor fail.
+  LocalMachine\Root is gated by administrator rights instead of by a dialog, so it
+  is non-interactive. That costs nothing here: CASE D already sets a machine-scope
+  execution policy, so this script has always needed admin, and hosted
+  windows-latest is elevated. It is also the more faithful test -- an AD GPO
+  pushes an enterprise root to LocalMachine\Root, and the connector runs as a
+  service, which has no CurrentUser store of its own.
+  The reader consults both LocalMachine\Root and CurrentUser\Root.
+
+  Certificates live in Cert:\CurrentUser\My + a temp dir for the life of the run
+  and are removed in the finally block. Nothing is printed.
+#>
+[CmdletBinding()]
+param(
+  [string]$RepoRoot = (Resolve-Path (Join-Path $PSScriptRoot "..\..\..\..\..\..")).Path
+)
+
+$ErrorActionPreference = "Stop"
+$ProgressPreference = "SilentlyContinue"
+
+$work = Join-Path $env:RUNNER_TEMP ("tb-trust-proof-" + [Guid]::NewGuid().ToString("N").Substring(0, 8))
+$sdkDir = Join-Path $RepoRoot "trillboards-edge-sdk\packages\edge-sdk"
+$TARGET_DNS = "api.trillboards.test"
+$minted = @()
+$trustedThumbprint = $null
+$policyChanged = $false
+# Prior MachinePolicy registry state, captured in CASE D and restored in finally.
+$polKeyExisted = $false
+$priorEnable = $null
+$priorPolicy = $null
+
+function Fail([string]$Message) {
+  Write-Host "FAIL: $Message"
+  exit 1
+}
+
+# New-SelfSignedCertificate is the native path here: no openssl on PATH is
+# required (Git for Windows ships one but does not put it on PATH on the hosted
+# images), and a -Signer chain is exactly the CA -> leaf shape we need.
+function New-ProofCa([string]$CommonName) {
+  $ca = New-SelfSignedCertificate `
+    -Type Custom `
+    -Subject "CN=$CommonName" `
+    -KeyExportPolicy Exportable `
+    -KeyUsage CertSign, CRLSign `
+    -TextExtension @("2.5.29.19={text}CA=true&pathlength=0") `
+    -CertStoreLocation "Cert:\CurrentUser\My" `
+    -NotAfter (Get-Date).AddHours(2)
+  $script:minted += $ca.Thumbprint
+  return $ca
+}
+
+function New-ProofLeaf($Ca, [string]$Dns) {
+  $leaf = New-SelfSignedCertificate `
+    -Type Custom `
+    -Subject "CN=$Dns" `
+    -DnsName $Dns `
+    -KeyExportPolicy Exportable `
+    -Signer $Ca `
+    -CertStoreLocation "Cert:\CurrentUser\My" `
+    -NotAfter (Get-Date).AddHours(2)
+  $script:minted += $leaf.Thumbprint
+  return $leaf
+}
+
+try {
+  New-Item -ItemType Directory -Force -Path $work | Out-Null
+
+  Write-Host "== Minting a throwaway inspection CA and one for the negative control =="
+  $ca = New-ProofCa -CommonName "Trillboards Windows Trust Proof CA"
+  $otherCa = New-ProofCa -CommonName "Trillboards Windows Trust Proof OTHER CA"
+  $leaf = New-ProofLeaf -Ca $ca -Dns $TARGET_DNS
+  $otherLeaf = New-ProofLeaf -Ca $otherCa -Dns $TARGET_DNS
+
+  $pfxPassword = ConvertTo-SecureString -String ([Guid]::NewGuid().ToString("N")) -AsPlainText -Force
+  $pfxPlain = [Runtime.InteropServices.Marshal]::PtrToStringAuto(
+    [Runtime.InteropServices.Marshal]::SecureStringToBSTR($pfxPassword))
+  $leafPfx = Join-Path $work "leaf.pfx"
+  $otherPfx = Join-Path $work "otherleaf.pfx"
+  $caCer = Join-Path $work "ca.cer"
+  Export-PfxCertificate -Cert $leaf -FilePath $leafPfx -Password $pfxPassword | Out-Null
+  Export-PfxCertificate -Cert $otherLeaf -FilePath $otherPfx -Password $pfxPassword | Out-Null
+  Export-Certificate -Cert $ca -FilePath $caCer -Type CERT | Out-Null
+
+  # The probe: an inspecting proxy plus the SHIPPED agent, driven from Node so
+  # that what is measured is the real dist/ build and not a re-implementation.
+  $probe = Join-Path $work "probe.js"
+  $probeBody = @'
+// Stands up a CONNECT proxy that terminates TLS itself (an inspection
+// appliance), points the SHIPPED EnterpriseHttpsAgent at it, and reports what
+// happened as one line of JSON. Trust anchors come from the REAL Windows store
+// via the shipped reader -- nothing is injected.
+const fs = require('fs');
+const net = require('net');
+const https = require('https');
+const sdk = require(process.argv[2]);
+
+const pfx = fs.readFileSync(process.argv[3]);
+const passphrase = process.argv[4];
+const TARGET = 'api.trillboards.test';
+
+const inspector = https.createServer({ pfx, passphrase }, (_req, res) => {
+  res.writeHead(200, { 'content-type': 'application/json' });
+  res.end('{"ok":true}');
+});
+
+const proxy = net.createServer((socket) => {
+  socket.once('data', (chunk) => {
+    if (!chunk.toString('latin1').startsWith('CONNECT ')) { socket.end('HTTP/1.1 405\r\n\r\n'); return; }
+    socket.write('HTTP/1.1 200 Connection Established\r\n\r\n');
+    inspector.emit('connection', socket);
+  });
+  socket.on('error', () => {});
+});
+
+proxy.listen(0, '127.0.0.1', () => {
+  const port = proxy.address().port;
+  process.env.HTTPS_PROXY = 'http://127.0.0.1:' + port;
+  // The REAL reader, against the REAL CurrentUser\Root + LocalMachine\Root.
+  sdk.resetEnterpriseNetworkCaches();
+  const posture = sdk.describeNetworkPosture('https://' + TARGET);
+  const agent = sdk.getEnterpriseAgent();
+  const done = (result) => {
+    console.log(JSON.stringify(Object.assign({
+      anchorCount: posture.trust.certs.length,
+      anchorSources: posture.trust.sources.map((s) => s.name),
+      anchorWarnings: posture.trust.warnings,
+      proxyUrl: posture.proxy.proxyUrl,
+    }, result)));
+    proxy.close(); inspector.close(); agent.destroy(); process.exit(0);
+  };
+  const req = https.request('https://' + TARGET + '/health/live', { agent, timeout: 10000 }, (res) => {
+    res.resume();
+    res.on('end', () => done({ outcome: 'connected', statusCode: res.statusCode }));
+  });
+  req.on('timeout', () => req.destroy(new Error('probe timed out')));
+  req.on('error', (err) => done({
+    outcome: 'refused',
+    code: err.code || null,
+    failureClass: sdk.classifyTransportError(err, {}).failureClass,
+  }));
+  req.end();
+});
+'@
+  Set-Content -LiteralPath $probe -Value $probeBody -Encoding Ascii
+
+  # Build from the MONOREPO root, not the package: edge-sdk requires its sibling
+  # workspaces at runtime, so a package-scoped build silently depends on some
+  # earlier step in this job having built them. Building all of them here means
+  # this script is correct on its own and cannot be broken by a step reorder.
+  Write-Host "== Building the SDK so the probe measures the shipped build =="
+  Push-Location (Join-Path $RepoRoot "trillboards-edge-sdk")
+  & npm run build 2>&1 | Out-Null
+  $buildExit = $LASTEXITCODE
+  Pop-Location
+  if ($buildExit -ne 0) { Fail "edge-sdk build failed (exit $buildExit)" }
+  $sdkEntry = Join-Path $sdkDir "dist\index.js"
+  if (-not (Test-Path -LiteralPath $sdkEntry)) { Fail "edge-sdk dist/index.js is missing after the build" }
+
+  function Invoke-Probe([string]$Pfx) {
+    $raw = & node $probe $sdkEntry $Pfx $pfxPlain
+    if ($LASTEXITCODE -ne 0) { throw "probe exited $LASTEXITCODE" }
+    return (($raw | Select-Object -Last 1) | ConvertFrom-Json)
+  }
+
+  # ---------------------------------------------------------------- CONTROL A
+  Write-Host ""
+  Write-Host "== CONTROL A: before the import, the inspection cert must be REFUSED =="
+  $before = Invoke-Probe -Pfx $leafPfx
+  Write-Host ("  anchors read from the machine store: {0}" -f $before.anchorCount)
+  Write-Host ("  sources: {0}" -f ($before.anchorSources -join ", "))
+  Write-Host ("  warnings: {0}" -f ($before.anchorWarnings -join "; "))
+  Write-Host ("  proxy in use: {0}" -f $before.proxyUrl)
+  Write-Host ("  outcome: {0} {1} {2}" -f $before.outcome, $before.code, $before.failureClass)
+  if ($before.outcome -ne "refused") {
+    Fail "the untrusted inspection certificate was ACCEPTED before the import -- this probe cannot prove anything"
+  }
+  if ($before.failureClass -ne "tls_untrusted_root") {
+    Fail "expected failureClass tls_untrusted_root before the import, got '$($before.failureClass)'"
+  }
+  # The reader must have actually run. A store read that silently returned
+  # nothing would make case B below pass for the wrong reason.
+  if ([int]$before.anchorCount -lt 1) {
+    # The warnings are printed above. They are the whole point: the first version
+    # of the reader came back empty here with nothing to say about why, which
+    # cost a full windows-latest cycle to diagnose. Anything that reaches this
+    # line without an actionable warning above it is a reader bug of its own.
+    Fail "the Windows trust store read returned NO certificates -- see the warnings above; the reader did not run"
+  }
+  if (-not ("$($before.proxyUrl)" -like "http://127.0.0.1:*")) {
+    Fail "the probe did not go through the proxy -- HTTPS_PROXY was not honoured"
+  }
+
+  # ---------------------------------------------------------------- CASE B
+  Write-Host ""
+  Write-Host "== CASE B: import the root into LocalMachine\Root and retry =="
+  # LocalMachine, NOT CurrentUser. A write to a CurrentUser trust-anchor store
+  # raises an interactive consent dialog, which on a headless runner never gets
+  # answered and hangs this script forever (see the header). LocalMachine\Root is
+  # admin-gated instead, and is where a GPO-pushed enterprise root actually lands.
+  $imported = Import-Certificate -FilePath $caCer -CertStoreLocation "Cert:\LocalMachine\Root"
+  $trustedThumbprint = $imported.Thumbprint
+  Write-Host "  imported into Cert:\LocalMachine\Root (thumbprint recorded for cleanup)"
+
+  $after = Invoke-Probe -Pfx $leafPfx
+  Write-Host ("  anchors read from the machine store: {0}" -f $after.anchorCount)
+  Write-Host ("  outcome: {0} {1} {2}" -f $after.outcome, $after.statusCode, $after.failureClass)
+  if ($after.outcome -ne "connected" -or [int]$after.statusCode -ne 200) {
+    Fail "the connector still could not reach the API after the root was trusted (outcome=$($after.outcome) class=$($after.failureClass))"
+  }
+  if ([int]$after.anchorCount -le [int]$before.anchorCount) {
+    Fail "the anchor count did not grow after the import -- the reader is not seeing LocalMachine\Root"
+  }
+
+  # ---------------------------------------------------------------- CASE C
+  Write-Host ""
+  Write-Host "== CASE C: a cert from a DIFFERENT root is still REFUSED =="
+  $foreign = Invoke-Probe -Pfx $otherPfx
+  Write-Host ("  outcome: {0} {1} {2}" -f $foreign.outcome, $foreign.code, $foreign.failureClass)
+  if ($foreign.outcome -ne "refused") {
+    Fail "a certificate that chains to NO trusted root was accepted -- verification has been weakened, which is worse than the bug this fixes"
+  }
+  if ($foreign.failureClass -ne "tls_untrusted_root") {
+    Fail "expected failureClass tls_untrusted_root for the foreign root, got '$($foreign.failureClass)'"
+  }
+
+  # ---------------------------------------------------------------- CASE D
+  Write-Host ""
+  Write-Host "== CASE D: the store read survives a machine-scope AllSigned GPO =="
+  # Set-ExecutionPolicy -Scope MachinePolicy is REFUSED by Windows on purpose
+  # ("Execution policies at the MachinePolicy or UserPolicy scopes must be set
+  # through Group Policy"), so the cmdlet cannot stage this arm at all. A real
+  # GPO does not call the cmdlet either -- it writes these registry values, and
+  # the policy scope is just their projection. Writing them directly IS the GPO,
+  # not a workaround for one.
+  #
+  # Only the Windows PowerShell 5.1 key is written, never the PowerShellCore
+  # one. 5.1 is the interpreter the reader shells out to (`powershell -Command`),
+  # so it is the one this arm is about, and leaving pwsh 7's policy alone means a
+  # cleanup that fails to run cannot take the rest of the job's pwsh steps down
+  # with it -- the failure mode the step's own post-check exists to catch.
+  $polKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell"
+  $polKeyExisted = Test-Path $polKey
+  if ($polKeyExisted) {
+    $priorEnable = (Get-ItemProperty -Path $polKey -Name EnableScripts -ErrorAction SilentlyContinue).EnableScripts
+    $priorPolicy = (Get-ItemProperty -Path $polKey -Name ExecutionPolicy -ErrorAction SilentlyContinue).ExecutionPolicy
+  }
+  New-Item -Path $polKey -Force | Out-Null
+  New-ItemProperty -Path $polKey -Name "EnableScripts" -Value 1 -PropertyType DWord -Force | Out-Null
+  New-ItemProperty -Path $polKey -Name "ExecutionPolicy" -Value "AllSigned" -PropertyType String -Force | Out-Null
+  $policyChanged = $true
+  # Read it back through the interpreter it governs, not through pwsh 7, which
+  # reads a different key and would report Undefined no matter what we staged.
+  $effective = (& powershell.exe -NoProfile -Command "Get-ExecutionPolicy -Scope MachinePolicy" | Select-Object -Last 1).ToString().Trim()
+  Write-Host ("  MachinePolicy (Windows PowerShell 5.1) is now: {0}" -f $effective)
+  if ("$effective" -ne "AllSigned") {
+    Fail "could not stage MachinePolicy=AllSigned, so this arm would be vacuous"
+  }
+  $underPolicy = Invoke-Probe -Pfx $leafPfx
+  Write-Host ("  anchors read under AllSigned: {0}" -f $underPolicy.anchorCount)
+  Write-Host ("  outcome: {0}" -f $underPolicy.outcome)
+  if ([int]$underPolicy.anchorCount -lt [int]$after.anchorCount) {
+    Fail "the trust-store read returned fewer certificates under AllSigned ($($underPolicy.anchorCount) vs $($after.anchorCount)) -- execution policy is blocking it"
+  }
+  if ($underPolicy.outcome -ne "connected") {
+    Fail "the connector could not reach the API under AllSigned (outcome=$($underPolicy.outcome))"
+  }
+
+  Write-Host ""
+  Write-Host "PASS: refused before the import, connected after it, still refuses a foreign root, and reads the store under AllSigned."
+  exit 0
+} catch {
+  Write-Host "FAIL: $_"
+  exit 1
+} finally {
+  if ($policyChanged) {
+    # Restore exactly what was there, rather than deleting: on a developer's
+    # domain-joined machine this key may be REAL policy, and clearing it would
+    # silently relax that machine's execution policy.
+    $polKey = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell"
+    if ($polKeyExisted) {
+      if ($null -ne $priorEnable) {
+        New-ItemProperty -Path $polKey -Name "EnableScripts" -Value $priorEnable -PropertyType DWord -Force -ErrorAction SilentlyContinue | Out-Null
+      } else {
+        Remove-ItemProperty -Path $polKey -Name "EnableScripts" -Force -ErrorAction SilentlyContinue
+      }
+      if ($null -ne $priorPolicy) {
+        New-ItemProperty -Path $polKey -Name "ExecutionPolicy" -Value $priorPolicy -PropertyType String -Force -ErrorAction SilentlyContinue | Out-Null
+      } else {
+        Remove-ItemProperty -Path $polKey -Name "ExecutionPolicy" -Force -ErrorAction SilentlyContinue
+      }
+    } else {
+      Remove-Item -Path $polKey -Recurse -Force -ErrorAction SilentlyContinue
+    }
+  }
+  if ($trustedThumbprint) {
+    Remove-Item -LiteralPath "Cert:\LocalMachine\Root\$trustedThumbprint" -Force -ErrorAction SilentlyContinue
+  }
+  foreach ($thumb in $minted) {
+    Remove-Item -LiteralPath "Cert:\CurrentUser\My\$thumb" -Force -ErrorAction SilentlyContinue
+  }
+  if (Test-Path -LiteralPath $work) { Remove-Item -Recurse -Force $work -ErrorAction SilentlyContinue }
+}

package/deploy/windows/setup-litertlm.ps1

@@ -288,6 +288,45 @@ if ((Test-ServeHealthy) -and ($installedLitertLmVersion -ne $LitertLmVersion)) {
   Log "serve is healthy but litert-lm is $(if ($installedLitertLmVersion) { $installedLitertLmVersion } else { 'unknown' }) not pinned $LitertLmVersion; reinstalling and restarting the serve"
 }
 
+# --- Enterprise TLS + proxy for uv -------------------------------------------
+# uv does NOT use Schannel and does NOT auto-discover a Windows proxy. It ships
+# bundled Mozilla roots and reads proxy settings only from environment
+# variables. Behind a TLS-inspecting proxy that made this the step that failed:
+# PowerShell fetched the uv installer fine over Schannel, then `uv tool install`
+# died on the private root, and the installer aborted with "Private local AI
+# could not be installed" -- a message naming the wrong cause.
+#
+# Two env vars, both fail-safe:
+#   UV_SYSTEM_CERTS -- current name; use the platform's native certificate store
+#   UV_NATIVE_TLS   -- the deprecated-but-still-read older name for the same
+#                      thing, set because `uv tool install` is UNPINNED here and
+#                      the version that lands is whatever is current that day
+# An unknown environment variable is ignored, so setting both is safe across
+# every uv version; a CLI flag would fail outright on the version that lacks it.
+$env:UV_SYSTEM_CERTS = "1"
+$env:UV_NATIVE_TLS = "1"
+
+# The proxy half. WinINET/WinHTTP are invisible to uv, so hand it the resolved
+# proxy explicitly -- but only when the operator has not already set the
+# variables, so an explicit HTTPS_PROXY always wins.
+function Set-UvProxyEnvironment {
+  if ($env:HTTPS_PROXY -or $env:https_proxy -or $env:ALL_PROXY) { return }
+  try {
+    $probe = [Uri]"https://api.trillboards.com"
+    $systemProxy = [System.Net.WebRequest]::GetSystemWebProxy()
+    if ($null -eq $systemProxy) { return }
+    if ($systemProxy.IsBypassed($probe)) { return }
+    $resolved = $systemProxy.GetProxy($probe)
+    if ($null -eq $resolved -or $resolved.AbsoluteUri -eq $probe.AbsoluteUri) { return }
+    $env:HTTPS_PROXY = $resolved.AbsoluteUri.TrimEnd("/")
+    $env:HTTP_PROXY = $env:HTTPS_PROXY
+    Log ("using this machine's configured proxy for local AI downloads: {0}" -f $env:HTTPS_PROXY)
+  } catch {
+    Log "WARN: could not read this machine's proxy settings: $_"
+  }
+}
+Set-UvProxyEnvironment
+
 $env:Path = "$LocalBin;$env:Path"
 if (-not (Get-Command uv -ErrorAction SilentlyContinue)) {
   Log "uv not found; installing the local package runtime (no admin required)"
@@ -321,7 +360,16 @@ if ((Test-LitertLmCli) -and ($installedLitertLmVersion -eq $LitertLmVersion)) {
   $litertlmPath = if ($litertlmCmd) { $litertlmCmd.Source } else { Join-Path $LocalBin "litert-lm.exe" }
   if (-not (Test-LitertLmCli)) {
     Log "litert-lm remains unhealthy after repair"
-    Fail-LocalAi "The local AI engine could not be installed. Check the internet connection, then retry Local AI."
+    # Name the cause the log can actually distinguish. This step is the one that
+    # fails first on a TLS-inspecting network -- everything before it went over
+    # Schannel and worked -- so "check the internet connection" sent operators
+    # to look at a connection that was fine.
+    $tlsHint = ""
+    if ((Test-Path -LiteralPath $LogPath) -and
+        (Select-String -LiteralPath $LogPath -Pattern "certificate|CERTIFICATE_VERIFY|self.signed|SSL" -Quiet)) {
+      $tlsHint = " This machine appears to inspect TLS traffic: ask IT to install the inspection root into the Trusted Root Certification Authorities store, then retry."
+    }
+    Fail-LocalAi ("The local AI engine could not be installed. Check the internet connection, then retry Local AI." + $tlsHint)
     Stop-SetupLock
     exit 1
   }

package/dist/AudienceAnalyzeClient.d.ts

@@ -77,7 +77,24 @@ export interface AudienceAnalyzeResponse {
     rawBody: string;
 }
 export type CameraHealthState = 'never_started' | 'starting' | 'open' | 'failed' | 'closed';
-export type CameraHealthFailureClass = 'rtsp_auth' | 'rtsp_unreachable' | 'rtsp_timeout' | 'nvr_busy' | 'no_frames' | 'decode_error';
+export type CameraHealthFailureClass = 'rtsp_auth' | 'rtsp_unreachable' | 'rtsp_timeout' | 'nvr_busy' | 'no_frames' | 'decode_error'
+/**
+ * macOS is refusing this process access to the local network, so every LAN
+ * camera is unreachable at once.
+ *
+ * Deliberately NOT `rtsp_unreachable`. At the ffmpeg layer the two are the
+ * same string — "no route to host" — but they send the operator to opposite
+ * places: `rtsp_unreachable` means go look at the recorder, this means a
+ * human has to tick a box in System Settings › Privacy & Security › Local
+ * Network. It is only ever set when `probeLocalNetworkAccess()` has
+ * affirmatively proved the denial (see `localNetworkAccess.ts`); an
+ * ambiguous probe leaves the class as `rtsp_unreachable`, because inventing
+ * a permission problem misdirects just as badly as missing one.
+ *
+ * Like every other class it clears through the ordinary `state: 'open'`
+ * report, which carries no `lastFailureClass` and so nulls the column.
+ */
+ | 'local_network_denied';
 export type CameraSensingState = 'idle' | 'analyzing' | 'active' | 'waiting_for_capacity' | 'unavailable';
 export interface CameraHealthReport {
     state: CameraHealthState;
@@ -175,6 +192,20 @@ export declare class AudienceAnalyzeClient {
 /**
  * Default transport using Node's built-in http/https. No third-party deps so it
  * survives bundling into a single self-contained binary.
+ *
+ * This is the SHARED transport for every cloud call the connector makes —
+ * `AudienceAnalyzeClient`, `PairClient`, `SetupSessionClient`,
+ * `DiscoveryReportClient` and `SensingProfileClient` all default to it — so the
+ * enterprise trust store and the machine's proxy are wired in here once and
+ * pairing gets them for free. Under TLS inspection pairing failed exactly the
+ * same way sensing did.
+ *
+ * The two changes here, and nothing else:
+ *   - an agent carrying the platform trust anchors, and a CONNECT tunnel when
+ *     the machine is configured to use a proxy (`getEnterpriseAgent`);
+ *   - `req.on('error')` now rejects with a `TransportFailure` that NAMES the
+ *     cause instead of an OpenSSL constant. Timeouts, retries and the request
+ *     shape are untouched.
  */
 export declare const defaultHttpPoster: HttpPoster;
 //# sourceMappingURL=AudienceAnalyzeClient.d.ts.map

package/dist/AudienceAnalyzeClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AudienceAnalyzeClient.d.ts","sourceRoot":"","sources":["../src/AudienceAnalyzeClient.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,WAAW,4BAA4B;IAC3C,6EAA6E;IAC7E,UAAU,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,WAAW,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,eAAe;IAC9B,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,sBAAuB,SAAQ,eAAe;IAC7D,qCAAqC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,uBAAuB;IACtC,wBAAwB;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,EAAE,EAAE,OAAO,CAAC;IACZ,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACrC,yBAAyB;IACzB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,iBAAiB,GAAG,eAAe,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE5F,MAAM,MAAM,wBAAwB,GAChC,WAAW,GACX,kBAAkB,GAClB,cAAc,GACd,UAAU,GACV,WAAW,GACX,cAAc,CAAC;AAEnB,MAAM,MAAM,kBAAkB,GAC1B,MAAM,GACN,WAAW,GACX,QAAQ,GACR,sBAAsB,GACtB,aAAa,CAAC;AAElB,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,iBAAiB,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,wBAAwB,CAAC;IAC5C,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,wEAAwE;IACxE,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC;;;;;;;;;;;;;;OAcG;IACH,YAAY,CAAC,EAAE,eAAe,GAAG,aAAa,CAAC;CAChD;AAED,gFAAgF;AAChF,MAAM,WAAW,UAAU;IACzB,CACE,GAAG,EAAE,MAAM,EACX,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAC/E,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClD;AAED,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;gBAExB,OAAO,EAAE,4BAA4B,EAAE,MAAM,CAAC,EAAE,UAAU;IAkBtE,gEAAgE;IAChE,WAAW,IAAI,MAAM;IAIrB;;;;;OAKG;IACH,OAAO,CAAC,sBAAsB;IAO9B,OAAO,CAAC,WAAW;IAYnB;;OAEG;IACG,OAAO,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAmDhF;;;;;;;;;;;;;;;;OAgBG;IACG,kBAAkB,CACtB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,OAAO,GAAE,eAAe,GAAG;QACzB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,0FAA0F;QAC1F,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,6EAA6E;QAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;KACjB,GACL,OAAO,CAAC,uBAAuB,CAAC;IAyDnC;;;;OAIG;IACG,kBAAkB,CAAC,YAAY,EAAE,kBAAkB,GAAG,OAAO,CAAC,uBAAuB,CAAC;CAuB7F;AAkBD;;;GAGG;AACH,eAAO,MAAM,iBAAiB,EAAE,UA2C/B,CAAC"}
+{"version":3,"file":"AudienceAnalyzeClient.d.ts","sourceRoot":"","sources":["../src/AudienceAnalyzeClient.ts"],"names":[],"mappings":"AAOA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,WAAW,4BAA4B;IAC3C,6EAA6E;IAC7E,UAAU,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,WAAW,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,eAAe;IAC9B,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,sBAAuB,SAAQ,eAAe;IAC7D,qCAAqC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,uBAAuB;IACtC,wBAAwB;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,EAAE,EAAE,OAAO,CAAC;IACZ,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACrC,yBAAyB;IACzB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,iBAAiB,GAAG,eAAe,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE5F,MAAM,MAAM,wBAAwB,GAChC,WAAW,GACX,kBAAkB,GAClB,cAAc,GACd,UAAU,GACV,WAAW,GACX,cAAc;AAChB;;;;;;;;;;;;;;;GAeG;GACD,sBAAsB,CAAC;AAE3B,MAAM,MAAM,kBAAkB,GAC1B,MAAM,GACN,WAAW,GACX,QAAQ,GACR,sBAAsB,GACtB,aAAa,CAAC;AAElB,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,iBAAiB,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,wBAAwB,CAAC;IAC5C,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,wEAAwE;IACxE,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC;;;;;;;;;;;;;;OAcG;IACH,YAAY,CAAC,EAAE,eAAe,GAAG,aAAa,CAAC;CAChD;AAED,gFAAgF;AAChF,MAAM,WAAW,UAAU;IACzB,CACE,GAAG,EAAE,MAAM,EACX,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAC/E,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClD;AAED,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;gBAExB,OAAO,EAAE,4BAA4B,EAAE,MAAM,CAAC,EAAE,UAAU;IAkBtE,gEAAgE;IAChE,WAAW,IAAI,MAAM;IAIrB;;;;;OAKG;IACH,OAAO,CAAC,sBAAsB;IAO9B,OAAO,CAAC,WAAW;IAYnB;;OAEG;IACG,OAAO,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAmDhF;;;;;;;;;;;;;;;;OAgBG;IACG,kBAAkB,CACtB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,OAAO,GAAE,eAAe,GAAG;QACzB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,0FAA0F;QAC1F,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,6EAA6E;QAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;KACjB,GACL,OAAO,CAAC,uBAAuB,CAAC;IAyDnC;;;;OAIG;IACG,kBAAkB,CAAC,YAAY,EAAE,kBAAkB,GAAG,OAAO,CAAC,uBAAuB,CAAC;CAuB7F;AAkBD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,iBAAiB,EAAE,UAuD/B,CAAC"}

package/dist/AudienceAnalyzeClient.js

@@ -38,6 +38,7 @@ const http = __importStar(require("http"));
 const https = __importStar(require("https"));
 const url_1 = require("url");
 const crypto_1 = require("crypto");
+const enterpriseNetwork_1 = require("./enterpriseNetwork");
 class AudienceAnalyzeClient {
     constructor(options, poster) {
         if (!options.apiBaseUrl) {
@@ -235,6 +236,20 @@ function parseAnalyzeResponse(result) {
 /**
  * Default transport using Node's built-in http/https. No third-party deps so it
  * survives bundling into a single self-contained binary.
+ *
+ * This is the SHARED transport for every cloud call the connector makes —
+ * `AudienceAnalyzeClient`, `PairClient`, `SetupSessionClient`,
+ * `DiscoveryReportClient` and `SensingProfileClient` all default to it — so the
+ * enterprise trust store and the machine's proxy are wired in here once and
+ * pairing gets them for free. Under TLS inspection pairing failed exactly the
+ * same way sensing did.
+ *
+ * The two changes here, and nothing else:
+ *   - an agent carrying the platform trust anchors, and a CONNECT tunnel when
+ *     the machine is configured to use a proxy (`getEnterpriseAgent`);
+ *   - `req.on('error')` now rejects with a `TransportFailure` that NAMES the
+ *     cause instead of an OpenSSL constant. Timeouts, retries and the request
+ *     shape are untouched.
  */
 const defaultHttpPoster = (url, options, body) => {
     return new Promise((resolve, reject) => {
@@ -246,16 +261,24 @@ const defaultHttpPoster = (url, options, body) => {
             reject(new Error(`Invalid audience-analyze URL: ${err.message}`));
             return;
         }
-        const mod = parsed.protocol === 'https:' ? https : http;
+        const isHttps = parsed.protocol === 'https:';
+        const mod = isHttps ? https : http;
         const bodyBuffer = Buffer.from(body, 'utf-8');
-        const req = mod.request(url, {
+        const baseOptions = {
             method: options.method,
             headers: {
                 ...options.headers,
                 'Content-Length': String(bodyBuffer.length),
             },
             timeout: options.timeoutMs,
-        }, (res) => {
+            // https tunnels through the agent (CONNECT); plain http is rewritten to
+            // absolute-form below, which is how a forward proxy expects it.
+            ...(isHttps ? { agent: (0, enterpriseNetwork_1.getEnterpriseAgent)() } : {}),
+        };
+        const proxied = isHttps
+            ? { options: baseOptions, proxyUrl: null }
+            : (0, enterpriseNetwork_1.applyHttpProxy)(url, baseOptions);
+        const onResponse = (res) => {
             const chunks = [];
             res.on('data', (chunk) => chunks.push(chunk));
             res.on('end', () => {
@@ -264,8 +287,14 @@ const defaultHttpPoster = (url, options, body) => {
                     body: Buffer.concat(chunks).toString('utf-8'),
                 });
             });
-        });
-        req.on('error', (err) => reject(err));
+        };
+        // With a plain-http proxy in play the target moves into `path` as an
+        // absolute URL and `host` becomes the proxy, so the URL must NOT also be
+        // passed positionally — Node would overwrite both from it.
+        const req = proxied.proxyUrl
+            ? mod.request(proxied.options, onResponse)
+            : mod.request(url, baseOptions, onResponse);
+        req.on('error', (err) => reject((0, enterpriseNetwork_1.diagnoseTransportError)(err, url)));
         req.on('timeout', () => {
             req.destroy(new Error('audience-analyze request timed out'));
         });

package/dist/AudienceAnalyzeClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"AudienceAnalyzeClient.js","sourceRoot":"","sources":["../src/AudienceAnalyzeClient.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA6B;AAC7B,6CAA+B;AAC/B,6BAA0B;AAC1B,mCAAoC;AAyIpC,MAAa,qBAAqB;IAUhC,YAAY,OAAqC,EAAE,MAAmB;QACpE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ,GAAG,GAAG,IAAI,6BAA6B,CAAC;QACrD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAM,CAAC;QAC7C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,yBAAiB,CAAC;IAC5C,CAAC;IAED,gEAAgE;IAChE,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;;;;OAKG;IACK,sBAAsB,CAAC,IAAqB;QAClD,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU;YAC9C,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW;SAClD,CAAC;IACJ,CAAC;IAEO,WAAW;QACjB,OAAO;YACL,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,kBAAkB;YAC1B,4EAA4E;YAC5E,gBAAgB,EAAE,IAAI,CAAC,WAAW;YAClC,2BAA2B,EAAE,IAAI,CAAC,WAAW;YAC7C,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACxC,gBAAgB,EAAE,IAAA,mBAAU,GAAE;SAC/B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,OAA+B;QAC3C,IAAI,CAAC,OAAO,EAAE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACpD,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACpD,uEAAuE;QACvE,6EAA6E;QAC7E,qEAAqE;QACrE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAEzE,MAAM,OAAO,GAA4B;YACvC,WAAW;YACX,UAAU;YACV,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,wEAAwE;YACxE,yEAAyE;YACzE,yEAAyE;YACzE,uEAAuE;YACvE,uCAAuC;YACvC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;SACzB,CAAC;QAEF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAErC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAC9B,IAAI,CAAC,QAAQ,EACb,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAC1E,IAAI,CACL,CAAC;QAEF,IAAI,MAAM,GAAmC,IAAI,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAA6B,CAAC,CAAC,CAAC,IAAI,CAAC;QACrF,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;QAED,OAAO;YACL,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,EAAE,EAAE,MAAM,CAAC,UAAU,IAAI,GAAG,IAAI,MAAM,CAAC,UAAU,GAAG,GAAG;YACvD,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,MAAM,CAAC,IAAI;SACrB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,kBAAkB,CACtB,WAAoC,EACpC,UAQI,EAAE;QAEN,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACpD,wEAAwE;QACxE,wEAAwE;QACxE,2EAA2E;QAC3E,+CAA+C;QAC/C,IAAI,WAA+B,CAAC;QACpC,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChD,CAAC;aAAM,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrF,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACpC,CAAC;QACD,0EAA0E;QAC1E,4EAA4E;QAC5E,yEAAyE;QACzE,6EAA6E;QAC7E,sEAAsE;QACtE,iBAAiB;QACjB,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;QACzE,MAAM,OAAO,GAA4B;YACvC,WAAW;YACX,UAAU;YACV,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,wEAAwE;YACxE,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;SACzB,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAC9B,IAAI,CAAC,QAAQ,EACb,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAC1E,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CACxB,CAAC;QAEF,IAAI,MAAM,GAAmC,IAAI,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAA6B,CAAC,CAAC,CAAC,IAAI,CAAC;QACrF,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;QAED,OAAO;YACL,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,EAAE,EAAE,MAAM,CAAC,UAAU,IAAI,GAAG,IAAI,MAAM,CAAC,UAAU,GAAG,GAAG;YACvD,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,MAAM,CAAC,IAAI;SACrB,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,kBAAkB,CAAC,YAAgC;QACvD,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,OAAO,GAA4B;YACvC,YAAY;YACZ,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAC9B,IAAI,CAAC,QAAQ,EACb;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE;YAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,EACD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CACxB,CAAC;QAEF,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;CACF;AAjOD,sDAiOC;AAED,SAAS,oBAAoB,CAAC,MAA4C;IACxE,IAAI,MAAM,GAAmC,IAAI,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAA6B,CAAC,CAAC,CAAC,IAAI,CAAC;IACrF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IAED,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,EAAE,EAAE,MAAM,CAAC,UAAU,IAAI,GAAG,IAAI,MAAM,CAAC,UAAU,GAAG,GAAG;QACvD,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,MAAM,CAAC,IAAI;KACrB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACI,MAAM,iBAAiB,GAAe,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAClE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,SAAG,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,KAAK,CAAC,iCAAkC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC7E,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QACxD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAE9C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CACrB,GAAG,EACH;YACE,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE;gBACP,GAAG,OAAO,CAAC,OAAO;gBAClB,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;aAC5C;YACD,OAAO,EAAE,OAAO,CAAC,SAAS;SAC3B,EACD,CAAC,GAAG,EAAE,EAAE;YACN,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACtD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,OAAO,CAAC;oBACN,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC;oBAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;iBAC9C,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CACF,CAAC;QAEF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACtC,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACrB,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACtB,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AA3CW,QAAA,iBAAiB,qBA2C5B"}
+{"version":3,"file":"AudienceAnalyzeClient.js","sourceRoot":"","sources":["../src/AudienceAnalyzeClient.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA6B;AAC7B,6CAA+B;AAC/B,6BAA0B;AAC1B,mCAAoC;AAEpC,2DAAiG;AA0JjG,MAAa,qBAAqB;IAUhC,YAAY,OAAqC,EAAE,MAAmB;QACpE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ,GAAG,GAAG,IAAI,6BAA6B,CAAC;QACrD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAM,CAAC;QAC7C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,yBAAiB,CAAC;IAC5C,CAAC;IAED,gEAAgE;IAChE,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;;;;OAKG;IACK,sBAAsB,CAAC,IAAqB;QAClD,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU;YAC9C,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW;SAClD,CAAC;IACJ,CAAC;IAEO,WAAW;QACjB,OAAO;YACL,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,kBAAkB;YAC1B,4EAA4E;YAC5E,gBAAgB,EAAE,IAAI,CAAC,WAAW;YAClC,2BAA2B,EAAE,IAAI,CAAC,WAAW;YAC7C,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACxC,gBAAgB,EAAE,IAAA,mBAAU,GAAE;SAC/B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,OAA+B;QAC3C,IAAI,CAAC,OAAO,EAAE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACpD,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACpD,uEAAuE;QACvE,6EAA6E;QAC7E,qEAAqE;QACrE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAEzE,MAAM,OAAO,GAA4B;YACvC,WAAW;YACX,UAAU;YACV,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,wEAAwE;YACxE,yEAAyE;YACzE,yEAAyE;YACzE,uEAAuE;YACvE,uCAAuC;YACvC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;SACzB,CAAC;QAEF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAErC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAC9B,IAAI,CAAC,QAAQ,EACb,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAC1E,IAAI,CACL,CAAC;QAEF,IAAI,MAAM,GAAmC,IAAI,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAA6B,CAAC,CAAC,CAAC,IAAI,CAAC;QACrF,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;QAED,OAAO;YACL,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,EAAE,EAAE,MAAM,CAAC,UAAU,IAAI,GAAG,IAAI,MAAM,CAAC,UAAU,GAAG,GAAG;YACvD,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,MAAM,CAAC,IAAI;SACrB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,kBAAkB,CACtB,WAAoC,EACpC,UAQI,EAAE;QAEN,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACpD,wEAAwE;QACxE,wEAAwE;QACxE,2EAA2E;QAC3E,+CAA+C;QAC/C,IAAI,WAA+B,CAAC;QACpC,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChD,CAAC;aAAM,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrF,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACpC,CAAC;QACD,0EAA0E;QAC1E,4EAA4E;QAC5E,yEAAyE;QACzE,6EAA6E;QAC7E,sEAAsE;QACtE,iBAAiB;QACjB,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;QACzE,MAAM,OAAO,GAA4B;YACvC,WAAW;YACX,UAAU;YACV,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,wEAAwE;YACxE,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;SACzB,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAC9B,IAAI,CAAC,QAAQ,EACb,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAC1E,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CACxB,CAAC;QAEF,IAAI,MAAM,GAAmC,IAAI,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAA6B,CAAC,CAAC,CAAC,IAAI,CAAC;QACrF,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;QAED,OAAO;YACL,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,EAAE,EAAE,MAAM,CAAC,UAAU,IAAI,GAAG,IAAI,MAAM,CAAC,UAAU,GAAG,GAAG;YACvD,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,MAAM,CAAC,IAAI;SACrB,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,kBAAkB,CAAC,YAAgC;QACvD,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,OAAO,GAA4B;YACvC,YAAY;YACZ,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAC9B,IAAI,CAAC,QAAQ,EACb;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE;YAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,EACD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CACxB,CAAC;QAEF,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;CACF;AAjOD,sDAiOC;AAED,SAAS,oBAAoB,CAAC,MAA4C;IACxE,IAAI,MAAM,GAAmC,IAAI,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAA6B,CAAC,CAAC,CAAC,IAAI,CAAC;IACrF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IAED,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,EAAE,EAAE,MAAM,CAAC,UAAU,IAAI,GAAG,IAAI,MAAM,CAAC,UAAU,GAAG,GAAG;QACvD,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,MAAM,CAAC,IAAI;KACrB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACI,MAAM,iBAAiB,GAAe,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAClE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,SAAG,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,KAAK,CAAC,iCAAkC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC7E,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QACnC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAE9C,MAAM,WAAW,GAAwB;YACvC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE;gBACP,GAAG,OAAO,CAAC,OAAO;gBAClB,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;aAC5C;YACD,OAAO,EAAE,OAAO,CAAC,SAAS;YAC1B,wEAAwE;YACxE,gEAAgE;YAChE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAA,sCAAkB,GAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpD,CAAC;QACF,MAAM,OAAO,GAAG,OAAO;YACrB,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAqB,EAAE;YAC3D,CAAC,CAAC,IAAA,kCAAc,EAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAErC,MAAM,UAAU,GAAG,CAAC,GAAyB,EAAQ,EAAE;YACrD,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACtD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,OAAO,CAAC;oBACN,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC;oBAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;iBAC9C,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,qEAAqE;QACrE,yEAAyE;QACzE,2DAA2D;QAC3D,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ;YAC1B,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC;YAC1C,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;QAE9C,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAA,0CAAsB,EAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QACnE,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACrB,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACtB,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAvDW,QAAA,iBAAiB,qBAuD5B"}