@zhin.js/agent 1.1.13 → 1.1.14

package/lib/data-governance/encrypted-file-payload-vault.d.ts

@@ -0,0 +1,117 @@
+import type { ConfidentialityClass, DataDescriptor } from './data-governance.js';
+import type { PayloadVaultDerivedWriteInput, PayloadVaultObjectHandle, PayloadVaultPort, PayloadVaultReadInput } from './disclosure-manifest.js';
+import { type PayloadLifecycleObjectAuthority, type PayloadLocationManifest } from './payload-lifecycle.js';
+export interface PayloadVaultWrappedKey {
+    readonly keyId: string;
+    /** Provider-opaque wrapped DEK. It must never be the raw key encoding. */
+    readonly wrappedKey: string;
+}
+export interface PayloadVaultCryptographyContext {
+    readonly version: 1;
+    readonly generation: number;
+    readonly tenantId: string;
+    readonly projectId: string;
+    readonly objectId: string;
+    readonly descriptorDigest: string;
+    readonly aadDigest: string;
+}
+/** Trusted Root-only crypto/KMS seam. KEK bytes never leave the provider. */
+export interface PayloadVaultCryptographyPort {
+    wrap(request: PayloadVaultCryptographyContext & Readonly<{
+        dataKey: Uint8Array;
+    }>, signal: AbortSignal): PayloadVaultWrappedKey | null | Promise<PayloadVaultWrappedKey | null>;
+    unwrap(request: PayloadVaultCryptographyContext & PayloadVaultWrappedKey, signal: AbortSignal): Uint8Array | null | Promise<Uint8Array | null>;
+}
+export interface PayloadVaultSourceWriteInput {
+    /** Complete canonical descriptor; loose classification fields are forbidden. */
+    readonly descriptor: DataDescriptor;
+    readonly descriptorDigest: string;
+    readonly payload: Uint8Array;
+    readonly sourceBindingDigest: string;
+}
+export declare class PayloadVaultCryptographyUnavailableError extends Error {
+    readonly tenantId: string;
+    readonly projectId: string;
+    readonly keyId?: string | undefined;
+    constructor(tenantId: string, projectId: string, keyId?: string | undefined);
+}
+export declare class PayloadVaultIntegrityError extends Error {
+    constructor(message: string, options?: ErrorOptions);
+}
+export interface VaultObjectEnvelope {
+    readonly version: 1;
+    readonly handle: PayloadVaultObjectHandle;
+    readonly aad: Readonly<{
+        version: 1;
+        issuedGeneration: number;
+        objectId: string;
+        payloadHash: string;
+        descriptorDigest: string;
+        tenantId: string;
+        projectId: string;
+        confidentiality: Exclude<ConfidentialityClass, 'unknown'>;
+        categories: readonly string[];
+        subjectDigests: readonly string[];
+        lineage: Readonly<{
+            sourceObjectIds: readonly string[];
+            transformRef?: string;
+            sourceBindingDigest?: string;
+        }>;
+        retention: DataDescriptor['retention'];
+        locationManifest: PayloadLocationManifest;
+    }>;
+    readonly encryption: Readonly<{
+        algorithm: 'aes-256-gcm';
+        keyId: string;
+        payloadIv: string;
+        payloadTag: string;
+        wrappedKey: string;
+    }>;
+    readonly ciphertext: string;
+    readonly digest: string;
+}
+export interface EncryptedFilePayloadVaultOptions {
+    /** Repository leaf; its parent must already exist. */
+    readonly directory: string;
+    readonly generation: number;
+    readonly cryptography: PayloadVaultCryptographyPort;
+}
+export interface EncryptedPayloadVaultStorageAuthority {
+    readonly locationIdPrefix: string;
+    readonly authorityDigest: string;
+}
+export interface SealedPayloadVaultObject {
+    readonly handle: PayloadVaultObjectHandle;
+    readonly envelope: VaultObjectEnvelope;
+    readonly audit: Readonly<Record<string, unknown>>;
+}
+/**
+ * Immutable AES-256-GCM envelope Vault. Every object receives a random DEK;
+ * only a KeyProvider-wrapped DEK is persisted. Handles reveal no path or key id.
+ */
+export declare class EncryptedFilePayloadVault implements PayloadVaultPort {
+    #private;
+    constructor(options: EncryptedFilePayloadVaultOptions);
+    putSource(input: PayloadVaultSourceWriteInput, signal: AbortSignal): Promise<PayloadVaultObjectHandle>;
+    putDerived(input: PayloadVaultDerivedWriteInput, signal: AbortSignal): Promise<PayloadVaultObjectHandle>;
+    readExact(input: PayloadVaultReadInput, signal: AbortSignal): Promise<Uint8Array>;
+    /** Trusted Root lifecycle resolver; never publish the Vault itself as a Resource. */
+    resolveLifecycleObject(handle: PayloadVaultObjectHandle, signal: AbortSignal): Promise<PayloadLifecycleObjectAuthority | undefined>;
+}
+export declare function sealEncryptedPayloadVaultEnvelope(options: Readonly<{
+    generation: number;
+    cryptography: PayloadVaultCryptographyPort;
+    storage: EncryptedPayloadVaultStorageAuthority;
+    input: PayloadVaultSourceWriteInput | PayloadVaultDerivedWriteInput;
+    signal: AbortSignal;
+}>): Promise<SealedPayloadVaultObject>;
+export declare function openEncryptedPayloadVaultEnvelope(options: Readonly<{
+    generation: number;
+    cryptography: PayloadVaultCryptographyPort;
+    envelope: VaultObjectEnvelope;
+    input: PayloadVaultReadInput;
+    signal: AbortSignal;
+}>): Promise<Uint8Array>;
+export declare function resolveEncryptedPayloadVaultLifecycleObject(envelope: VaultObjectEnvelope, handle: PayloadVaultObjectHandle): PayloadLifecycleObjectAuthority;
+export declare function readEncryptedPayloadVaultAudit(generation: number, input: PayloadVaultReadInput): Readonly<Record<string, unknown>>;
+//# sourceMappingURL=encrypted-file-payload-vault.d.ts.map

package/lib/data-governance/encrypted-file-payload-vault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypted-file-payload-vault.d.ts","sourceRoot":"","sources":["../../src/data-governance/encrypted-file-payload-vault.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,oBAAoB,EACpB,cAAc,EAEf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EACV,6BAA6B,EAC7B,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,EACtB,MAAM,0BAA0B,CAAC;AAOlC,OAAO,EAIL,KAAK,+BAA+B,EACpC,KAAK,uBAAuB,EAC7B,MAAM,wBAAwB,CAAC;AAEhC,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,6EAA6E;AAC7E,MAAM,WAAW,4BAA4B;IAC3C,IAAI,CACF,OAAO,EAAE,+BAA+B,GAAG,QAAQ,CAAC;QAAE,OAAO,EAAE,UAAU,CAAA;KAAE,CAAC,EAC5E,MAAM,EAAE,WAAW,GAClB,sBAAsB,GAAG,IAAI,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IAC1E,MAAM,CACJ,OAAO,EAAE,+BAA+B,GAAG,sBAAsB,EACjE,MAAM,EAAE,WAAW,GAClB,UAAU,GAAG,IAAI,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,4BAA4B;IAC3C,gFAAgF;IAChF,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;CACtC;AAED,qBAAa,wCAAyC,SAAQ,KAAK;IACrD,QAAQ,CAAC,QAAQ,EAAE,MAAM;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM;gBAArE,QAAQ,EAAE,MAAM,EAAW,SAAS,EAAE,MAAM,EAAW,KAAK,CAAC,EAAE,MAAM,YAAA;CAI3F;AAED,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY;CAIpD;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;QACrB,OAAO,EAAE,CAAC,CAAC;QACX,gBAAgB,EAAE,MAAM,CAAC;QACzB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,gBAAgB,EAAE,MAAM,CAAC;QACzB,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,eAAe,EAAE,OAAO,CAAC,oBAAoB,EAAE,SAAS,CAAC,CAAC;QAC1D,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;QAC9B,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;QAClC,OAAO,EAAE,QAAQ,CAAC;YAChB,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;YACnC,YAAY,CAAC,EAAE,MAAM,CAAC;YACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;SAC9B,CAAC,CAAC;QACH,SAAS,EAAE,cAAc,CAAC,WAAW,CAAC,CAAC;QACvC,gBAAgB,EAAE,uBAAuB,CAAC;KAC3C,CAAC,CAAC;IACH,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC;QAC5B,SAAS,EAAE,aAAa,CAAC;QACzB,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC,CAAC;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,gCAAgC;IAC/C,sDAAsD;IACtD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,4BAA4B,CAAC;CACrD;AAED,MAAM,WAAW,qCAAqC;IACpD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACnD;AAED;;;GAGG;AACH,qBAAa,yBAA0B,YAAW,gBAAgB;;gBASpD,OAAO,EAAE,gCAAgC;IAa/C,SAAS,CACb,KAAK,EAAE,4BAA4B,EACnC,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,wBAAwB,CAAC;IAI9B,UAAU,CACd,KAAK,EAAE,6BAA6B,EACpC,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,wBAAwB,CAAC;IAI9B,SAAS,CAAC,KAAK,EAAE,qBAAqB,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IAmBvF,qFAAqF;IAC/E,sBAAsB,CAC1B,MAAM,EAAE,wBAAwB,EAChC,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,+BAA+B,GAAG,SAAS,CAAC;CA2FxD;AAED,wBAAsB,iCAAiC,CAAC,OAAO,EAAE,QAAQ,CAAC;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,4BAA4B,CAAC;IAC3C,OAAO,EAAE,qCAAqC,CAAC;IAC/C,KAAK,EAAE,4BAA4B,GAAG,6BAA6B,CAAC;IACpE,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAsFrC;AAED,wBAAsB,iCAAiC,CAAC,OAAO,EAAE,QAAQ,CAAC;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,4BAA4B,CAAC;IAC3C,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,KAAK,EAAE,qBAAqB,CAAC;IAC7B,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAkCvB;AAED,wBAAgB,2CAA2C,CACzD,QAAQ,EAAE,mBAAmB,EAC7B,MAAM,EAAE,wBAAwB,GAC/B,+BAA+B,CAajC;AAED,wBAAgB,8BAA8B,CAC5C,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,qBAAqB,GAC3B,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAEnC"}

package/lib/data-governance/encrypted-file-payload-vault.js

@@ -0,0 +1,507 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes, } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { canonicalWorkroomJson, deepFreezeWorkroomValue as deepFreeze, digestCanonicalWorkroomValue as digest, } from '../workroom/canonical-value.js';
+import { DurableFileStore } from '../workroom/durable-file-store.js';
+import { createPayloadLifecycleObjectAuthority, createPayloadLocationManifest, digestPayloadSubjectRef, } from './payload-lifecycle.js';
+export class PayloadVaultCryptographyUnavailableError extends Error {
+    tenantId;
+    projectId;
+    keyId;
+    constructor(tenantId, projectId, keyId) {
+        super(`Payload Vault key authority is unavailable for ${tenantId}/${projectId}`);
+        this.tenantId = tenantId;
+        this.projectId = projectId;
+        this.keyId = keyId;
+        this.name = 'PayloadVaultCryptographyUnavailableError';
+    }
+}
+export class PayloadVaultIntegrityError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = 'PayloadVaultIntegrityError';
+    }
+}
+/**
+ * Immutable AES-256-GCM envelope Vault. Every object receives a random DEK;
+ * only a KeyProvider-wrapped DEK is persisted. Handles reveal no path or key id.
+ */
+export class EncryptedFilePayloadVault {
+    #root;
+    #objects;
+    #audit;
+    #generation;
+    #cryptography;
+    #locationAuthorityDigest;
+    #ready;
+    constructor(options) {
+        this.#generation = positiveInteger(options.generation, 'generation');
+        this.#cryptography = options.cryptography;
+        this.#locationAuthorityDigest = digest({
+            version: 1,
+            adapter: 'encrypted-file-payload-vault',
+            repositoryIdentityDigest: digest({ directory: options.directory }),
+        });
+        this.#root = new DurableFileStore(options.directory);
+        this.#objects = new DurableFileStore(join(options.directory, 'objects'));
+        this.#audit = new DurableFileStore(join(options.directory, 'audit'));
+    }
+    async putSource(input, signal) {
+        return await this.#put(input, signal);
+    }
+    async putDerived(input, signal) {
+        return await this.#put(input, signal);
+    }
+    async readExact(input, signal) {
+        signal.throwIfAborted();
+        await this.#ensureReady();
+        assertHandle(input.handle);
+        requireDigest(input.requestDigest, 'requestDigest');
+        requireText(input.principalId, 'principalId');
+        requireText(input.destinationId, 'destinationId');
+        const envelope = await this.#readEnvelope(this.#objectPath(input.handle.vaultObjectId));
+        const plaintext = await openEncryptedPayloadVaultEnvelope({
+            generation: this.#generation,
+            cryptography: this.#cryptography,
+            envelope,
+            input,
+            signal,
+        });
+        await this.#recordAudit(readAudit(this.#generation, input));
+        return plaintext;
+    }
+    /** Trusted Root lifecycle resolver; never publish the Vault itself as a Resource. */
+    async resolveLifecycleObject(handle, signal) {
+        signal.throwIfAborted();
+        await this.#ensureReady();
+        let envelope;
+        try {
+            envelope = await this.#readEnvelope(this.#objectPath(handle.vaultObjectId));
+        }
+        catch (error) {
+            if (error instanceof PayloadVaultIntegrityError)
+                return undefined;
+            throw error;
+        }
+        return resolveEncryptedPayloadVaultLifecycleObject(envelope, handle);
+    }
+    async #put(input, signal) {
+        signal.throwIfAborted();
+        await this.#ensureReady();
+        const sealed = await sealEncryptedPayloadVaultEnvelope({
+            generation: this.#generation,
+            cryptography: this.#cryptography,
+            storage: {
+                locationIdPrefix: 'vault-file',
+                authorityDigest: this.#locationAuthorityDigest,
+            },
+            input,
+            signal,
+        });
+        const target = this.#objectPath(sealed.handle.vaultObjectId);
+        const published = await this.#objects.publishCreateOnly({
+            target,
+            content: canonicalWorkroomJson(sealed.envelope),
+            createdValue: sealed.handle,
+            onConflict: async () => {
+                const winner = await this.#readEnvelope(target);
+                assertEnvelope(winner, sealed.handle);
+                return winner.handle;
+            },
+        });
+        await this.#recordAudit(sealed.audit);
+        return published.value;
+    }
+    #objectPath(vaultObjectId) {
+        const match = /^vault-object:([a-f\d]{64})$/u.exec(vaultObjectId);
+        if (!match)
+            throw new PayloadVaultIntegrityError('Payload Vault object id is invalid');
+        return join(this.#objects.directory, `${match[1]}.json`);
+    }
+    async #readEnvelope(path) {
+        await this.#objects.syncLeaf();
+        let value;
+        try {
+            value = JSON.parse(await readFile(path, 'utf8'));
+        }
+        catch (error) {
+            throw new PayloadVaultIntegrityError('Payload Vault object is absent or malformed', { cause: error });
+        }
+        if (!value || typeof value !== 'object') {
+            throw new PayloadVaultIntegrityError('Payload Vault object is malformed');
+        }
+        return value;
+    }
+    async #recordAudit(value) {
+        const content = deepFreeze({ ...structuredClone(value), digest: digest(value) });
+        const id = digest(content).slice('sha256:'.length);
+        const target = join(this.#audit.directory, `${id}.json`);
+        await this.#audit.publishCreateOnly({
+            target,
+            content: canonicalWorkroomJson(content),
+            createdValue: undefined,
+            onConflict: async () => {
+                await this.#audit.syncLeaf();
+                const winner = await readFile(target, 'utf8');
+                if (winner !== canonicalWorkroomJson(content)) {
+                    throw new PayloadVaultIntegrityError('Payload Vault audit replay drift');
+                }
+            },
+        });
+    }
+    #ensureReady() {
+        this.#ready ??= (async () => {
+            await this.#root.ensureDurableLeaf('Encrypted Payload Vault');
+            await this.#objects.ensureDurableLeaf('Encrypted Payload Vault objects');
+            await this.#audit.ensureDurableLeaf('Encrypted Payload Vault audit');
+            await this.#root.syncLeafAndParent();
+        })();
+        return this.#ready;
+    }
+}
+export async function sealEncryptedPayloadVaultEnvelope(options) {
+    options.signal.throwIfAborted();
+    const generation = positiveInteger(options.generation, 'generation');
+    requireText(options.storage.locationIdPrefix, 'locationIdPrefix');
+    requireDigest(options.storage.authorityDigest, 'storage authorityDigest');
+    const normalized = normalizeWrite(options.input);
+    const identity = deepFreeze({
+        version: 1,
+        objectId: normalized.objectId,
+        payloadHash: normalized.payloadHash,
+        descriptorDigest: normalized.descriptorDigest,
+        tenantId: normalized.tenantId,
+        projectId: normalized.projectId,
+    });
+    const vaultObjectId = `vault-object:${digest(identity).slice('sha256:'.length)}`;
+    const locationManifest = createPayloadLocationManifest({
+        version: 1,
+        tenantId: normalized.tenantId,
+        projectId: normalized.projectId,
+        objectId: normalized.objectId,
+        vaultObjectId,
+        descriptorDigest: normalized.descriptorDigest,
+        revision: 1,
+        locations: [{
+                id: `${options.storage.locationIdPrefix}:${vaultObjectId}`,
+                kind: 'vault_primary',
+                authorityDigest: options.storage.authorityDigest,
+                deletionMode: 'crypto_erase',
+            }],
+    });
+    const handle = deepFreeze({
+        version: 1,
+        vaultObjectId,
+        objectId: normalized.objectId,
+        payloadHash: normalized.payloadHash,
+        descriptorDigest: normalized.descriptorDigest,
+        tenantId: normalized.tenantId,
+        projectId: normalized.projectId,
+        locationManifestDigest: locationManifest.digest,
+    });
+    const aad = deepFreeze({
+        ...identity,
+        issuedGeneration: generation,
+        confidentiality: normalized.confidentiality,
+        categories: normalized.categories,
+        subjectDigests: normalized.subjectRefs.map(subjectRef => digestPayloadSubjectRef(normalized.tenantId, subjectRef)),
+        lineage: normalized.lineage,
+        retention: normalized.retention,
+        locationManifest,
+    });
+    const dataKey = randomBytes(32);
+    try {
+        const payloadCipher = encrypt(dataKey, Buffer.from(normalized.payload), Buffer.from(canonicalWorkroomJson(aad)));
+        const wrappedKey = await wrapEncryptedPayloadVaultKey(options.cryptography, {
+            version: 1,
+            generation,
+            tenantId: normalized.tenantId,
+            projectId: normalized.projectId,
+            objectId: normalized.objectId,
+            descriptorDigest: normalized.descriptorDigest,
+            aadDigest: digest(aad),
+            dataKey: new Uint8Array(dataKey),
+        }, options.signal);
+        const body = deepFreeze({
+            version: 1,
+            handle,
+            aad,
+            encryption: {
+                algorithm: 'aes-256-gcm',
+                keyId: wrappedKey.keyId,
+                payloadIv: payloadCipher.iv,
+                payloadTag: payloadCipher.tag,
+                wrappedKey: wrappedKey.wrappedKey,
+            },
+            ciphertext: payloadCipher.ciphertext,
+        });
+        return deepFreeze({
+            handle,
+            envelope: deepFreeze({ ...body, digest: digest(body) }),
+            audit: writeAudit(generation, handle, normalized.lineage),
+        });
+    }
+    finally {
+        dataKey.fill(0);
+        normalized.payload.fill(0);
+    }
+}
+export async function openEncryptedPayloadVaultEnvelope(options) {
+    options.signal.throwIfAborted();
+    const generation = positiveInteger(options.generation, 'generation');
+    assertHandle(options.input.handle);
+    requireDigest(options.input.requestDigest, 'requestDigest');
+    requireText(options.input.principalId, 'principalId');
+    requireText(options.input.destinationId, 'destinationId');
+    assertEnvelope(options.envelope, options.input.handle);
+    const dataKey = await unwrapEncryptedPayloadVaultKey(options.cryptography, {
+        version: 1,
+        generation,
+        tenantId: options.input.handle.tenantId,
+        projectId: options.input.handle.projectId,
+        objectId: options.input.handle.objectId,
+        descriptorDigest: options.input.handle.descriptorDigest,
+        aadDigest: digest(options.envelope.aad),
+        keyId: options.envelope.encryption.keyId,
+        wrappedKey: options.envelope.encryption.wrappedKey,
+    }, options.signal);
+    try {
+        const plaintext = decrypt(Buffer.from(dataKey), options.envelope.encryption.payloadIv, options.envelope.encryption.payloadTag, options.envelope.ciphertext, Buffer.from(canonicalWorkroomJson(options.envelope.aad)));
+        if (hashBytes(plaintext) !== options.input.handle.payloadHash) {
+            throw new PayloadVaultIntegrityError('Payload Vault decrypted body hash mismatch');
+        }
+        return new Uint8Array(plaintext);
+    }
+    finally {
+        dataKey.fill(0);
+    }
+}
+export function resolveEncryptedPayloadVaultLifecycleObject(envelope, handle) {
+    assertEnvelope(envelope, handle);
+    const manifest = createPayloadLocationManifest(envelope.aad.locationManifest);
+    if (canonicalWorkroomJson(manifest) !== canonicalWorkroomJson(envelope.aad.locationManifest)) {
+        throw new PayloadVaultIntegrityError('Payload Vault Location Manifest is non-canonical');
+    }
+    return createPayloadLifecycleObjectAuthority({
+        version: 1,
+        handle,
+        retention: envelope.aad.retention,
+        subjectDigests: envelope.aad.subjectDigests,
+        locations: manifest,
+    });
+}
+export function readEncryptedPayloadVaultAudit(generation, input) {
+    return readAudit(generation, input);
+}
+async function wrapEncryptedPayloadVaultKey(cryptography, request, signal) {
+    const ownedDataKey = new Uint8Array(request.dataKey);
+    try {
+        const authority = await abortable(Promise.resolve(cryptography.wrap(Object.freeze({ ...request, dataKey: ownedDataKey }), signal)), signal);
+        if (!authority)
+            throw new PayloadVaultCryptographyUnavailableError(request.tenantId, request.projectId);
+        requireText(authority.keyId, 'keyId');
+        requireText(authority.wrappedKey, 'wrappedKey');
+        if (authority.wrappedKey === Buffer.from(ownedDataKey).toString('base64')) {
+            throw new PayloadVaultIntegrityError('Payload Vault crypto provider returned an unwrapped data key');
+        }
+        return { keyId: authority.keyId, wrappedKey: authority.wrappedKey };
+    }
+    finally {
+        ownedDataKey.fill(0);
+    }
+}
+async function unwrapEncryptedPayloadVaultKey(cryptography, request, signal) {
+    const key = await abortable(Promise.resolve(cryptography.unwrap(deepFreeze(request), signal)), signal);
+    if (!key)
+        throw new PayloadVaultCryptographyUnavailableError(request.tenantId, request.projectId, request.keyId);
+    if (!(key instanceof Uint8Array) || key.byteLength !== 32) {
+        throw new PayloadVaultIntegrityError('Payload Vault crypto provider returned an invalid data key');
+    }
+    return new Uint8Array(key);
+}
+function writeAudit(generation, handle, lineage) {
+    return deepFreeze({
+        version: 1,
+        operation: 'write',
+        generation,
+        vaultObjectId: handle.vaultObjectId,
+        objectId: handle.objectId,
+        descriptorDigest: handle.descriptorDigest,
+        payloadHash: handle.payloadHash,
+        tenantId: handle.tenantId,
+        projectId: handle.projectId,
+        lineageDigest: digest(lineage),
+    });
+}
+function readAudit(generation, input) {
+    return deepFreeze({
+        version: 1,
+        operation: 'read',
+        generation,
+        vaultObjectId: input.handle.vaultObjectId,
+        objectId: input.handle.objectId,
+        descriptorDigest: input.handle.descriptorDigest,
+        payloadHash: input.handle.payloadHash,
+        tenantId: input.handle.tenantId,
+        projectId: input.handle.projectId,
+        requestDigest: input.requestDigest,
+        purpose: input.purpose,
+        principalId: input.principalId,
+        destinationId: input.destinationId,
+    });
+}
+function normalizeWrite(input) {
+    const descriptor = structuredClone(input.descriptor);
+    requireText(descriptor.objectId, 'objectId');
+    requireDigest(descriptor.payloadHash, 'payloadHash');
+    requireText(descriptor.tenantId, 'tenantId');
+    requireText(descriptor.projectId, 'projectId');
+    const descriptorDigest = digest(descriptor);
+    requireDigest(input.descriptorDigest, 'descriptorDigest');
+    if (input.descriptorDigest !== descriptorDigest) {
+        throw new PayloadVaultIntegrityError('Payload Vault Descriptor digest mismatch');
+    }
+    if (!(input.payload instanceof Uint8Array) || hashBytes(input.payload) !== descriptor.payloadHash) {
+        throw new PayloadVaultIntegrityError('Payload Vault write body does not match payloadHash');
+    }
+    if (!['public', 'project_internal', 'confidential', 'restricted'].includes(descriptor.confidentiality)) {
+        throw new PayloadVaultIntegrityError('Payload Vault confidentiality is invalid');
+    }
+    const categories = uniqueTexts(descriptor.categories, 'categories');
+    const subjectRefs = uniqueTexts(descriptor.subjectRefs, 'subjectRefs');
+    const sourceObjectIds = uniqueTexts(descriptor.lineage.sourceObjectIds, 'lineage.sourceObjectIds');
+    if (sourceObjectIds.length === 0) {
+        throw new PayloadVaultIntegrityError('Payload Vault source lineage is empty');
+    }
+    const lineage = 'sourceBindingDigest' in input
+        ? deepFreeze({
+            sourceObjectIds,
+            sourceBindingDigest: requireDigest(input.sourceBindingDigest, 'sourceBindingDigest'),
+        })
+        : deepFreeze({
+            sourceObjectIds,
+            ...(descriptor.lineage.transformRef === undefined
+                ? {}
+                : { transformRef: requireText(descriptor.lineage.transformRef, 'transformRef') }),
+        });
+    if (!descriptor.retention || !Number.isSafeInteger(descriptor.retention.minimumRetainUntil)
+        || !Number.isSafeInteger(descriptor.retention.deleteAfter)
+        || descriptor.retention.minimumRetainUntil < 0
+        || descriptor.retention.deleteAfter < descriptor.retention.minimumRetainUntil) {
+        throw new PayloadVaultIntegrityError('Payload Vault retention window is invalid');
+    }
+    if (canonicalWorkroomJson(descriptor.categories) !== canonicalWorkroomJson(categories)
+        || canonicalWorkroomJson(descriptor.subjectRefs) !== canonicalWorkroomJson(subjectRefs)
+        || canonicalWorkroomJson(descriptor.lineage.sourceObjectIds) !== canonicalWorkroomJson(sourceObjectIds)) {
+        throw new PayloadVaultIntegrityError('Payload Vault Descriptor is non-canonical');
+    }
+    // ECMAScript rejects freezing non-empty typed arrays. The Vault owns this
+    // byte copy and never exposes it; all authority-bearing metadata is frozen.
+    return Object.freeze({
+        objectId: descriptor.objectId,
+        payload: new Uint8Array(input.payload),
+        payloadHash: descriptor.payloadHash,
+        descriptorDigest,
+        tenantId: descriptor.tenantId,
+        projectId: descriptor.projectId,
+        confidentiality: descriptor.confidentiality,
+        categories,
+        subjectRefs,
+        lineage,
+        retention: { ...descriptor.retention },
+    });
+}
+function assertEnvelope(value, handle) {
+    let manifest;
+    try {
+        manifest = createPayloadLocationManifest(value.aad?.locationManifest);
+    }
+    catch (error) {
+        throw new PayloadVaultIntegrityError('Payload Vault Location Manifest is malformed', { cause: error });
+    }
+    if (value.version !== 1 || value.encryption?.algorithm !== 'aes-256-gcm'
+        || canonicalWorkroomJson(value.handle) !== canonicalWorkroomJson(handle)
+        || !Number.isSafeInteger(value.aad?.issuedGeneration)
+        || value.aad.issuedGeneration < 1
+        || value.aad.objectId !== handle.objectId
+        || value.aad.payloadHash !== handle.payloadHash
+        || value.aad.descriptorDigest !== handle.descriptorDigest
+        || value.aad.tenantId !== handle.tenantId
+        || value.aad.projectId !== handle.projectId
+        || canonicalWorkroomJson(manifest) !== canonicalWorkroomJson(value.aad.locationManifest)
+        || manifest.digest !== handle.locationManifestDigest) {
+        throw new PayloadVaultIntegrityError('Payload Vault envelope authority binding mismatch');
+    }
+    const { digest: actualDigest, ...body } = value;
+    if (actualDigest !== digest(body)) {
+        throw new PayloadVaultIntegrityError('Payload Vault envelope digest mismatch');
+    }
+}
+function assertHandle(value) {
+    if (value.version !== 1 || !/^vault-object:[a-f\d]{64}$/u.test(value.vaultObjectId)) {
+        throw new PayloadVaultIntegrityError('Payload Vault handle is invalid');
+    }
+    requireText(value.objectId, 'objectId');
+    requireDigest(value.payloadHash, 'payloadHash');
+    requireDigest(value.descriptorDigest, 'descriptorDigest');
+    requireText(value.tenantId, 'tenantId');
+    requireText(value.projectId, 'projectId');
+    requireDigest(value.locationManifestDigest, 'locationManifestDigest');
+}
+function encrypt(key, plaintext, aad) {
+    const iv = randomBytes(12);
+    const cipher = createCipheriv('aes-256-gcm', key, iv);
+    cipher.setAAD(aad);
+    const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+    return {
+        iv: iv.toString('base64'),
+        tag: cipher.getAuthTag().toString('base64'),
+        ciphertext: ciphertext.toString('base64'),
+    };
+}
+function decrypt(key, iv, tag, ciphertext, aad) {
+    try {
+        const decipher = createDecipheriv('aes-256-gcm', key, Buffer.from(iv, 'base64'));
+        decipher.setAAD(aad);
+        decipher.setAuthTag(Buffer.from(tag, 'base64'));
+        return Buffer.concat([decipher.update(Buffer.from(ciphertext, 'base64')), decipher.final()]);
+    }
+    catch (error) {
+        throw new PayloadVaultIntegrityError('Payload Vault authenticated decryption failed', { cause: error });
+    }
+}
+function uniqueTexts(values, label) {
+    if (!Array.isArray(values))
+        throw new PayloadVaultIntegrityError(`Payload Vault ${label} is invalid`);
+    return Object.freeze([...new Set(values.map(value => requireText(value, label)))].sort());
+}
+function requireText(value, label) {
+    if (typeof value !== 'string' || value.trim() !== value || value.length === 0) {
+        throw new PayloadVaultIntegrityError(`Payload Vault ${label} is invalid`);
+    }
+    return value;
+}
+function requireDigest(value, label) {
+    if (!/^sha256:[a-f\d]{64}$/u.test(value)) {
+        throw new PayloadVaultIntegrityError(`Payload Vault ${label} is invalid`);
+    }
+    return value;
+}
+function positiveInteger(value, label) {
+    if (!Number.isSafeInteger(value) || value < 1) {
+        throw new PayloadVaultIntegrityError(`Payload Vault ${label} must be positive`);
+    }
+    return value;
+}
+function hashBytes(value) {
+    return `sha256:${createHash('sha256').update(value).digest('hex')}`;
+}
+async function abortable(promise, signal) {
+    signal.throwIfAborted();
+    return await new Promise((resolve, reject) => {
+        const onAbort = () => reject(signal.reason ?? new DOMException('Payload Vault cancelled', 'AbortError'));
+        signal.addEventListener('abort', onAbort, { once: true });
+        promise.then(resolve, reject).finally(() => signal.removeEventListener('abort', onAbort));
+    });
+}
+//# sourceMappingURL=encrypted-file-payload-vault.js.map

package/lib/data-governance/encrypted-file-payload-vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypted-file-payload-vault.js","sourceRoot":"","sources":["../../src/data-governance/encrypted-file-payload-vault.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,WAAW,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAYjC,OAAO,EACL,qBAAqB,EACrB,uBAAuB,IAAI,UAAU,EACrC,4BAA4B,IAAI,MAAM,GACvC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EACL,qCAAqC,EACrC,6BAA6B,EAC7B,uBAAuB,GAGxB,MAAM,wBAAwB,CAAC;AAsChC,MAAM,OAAO,wCAAyC,SAAQ,KAAK;IAC5C;IAA2B;IAA4B;IAA5E,YAAqB,QAAgB,EAAW,SAAiB,EAAW,KAAc;QACxF,KAAK,CAAC,kDAAkD,QAAQ,IAAI,SAAS,EAAE,CAAC,CAAC;QAD9D,aAAQ,GAAR,QAAQ,CAAQ;QAAW,cAAS,GAAT,SAAS,CAAQ;QAAW,UAAK,GAAL,KAAK,CAAS;QAExF,IAAI,CAAC,IAAI,GAAG,0CAA0C,CAAC;IACzD,CAAC;CACF;AAED,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IACnD,YAAY,OAAe,EAAE,OAAsB;QACjD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAqDD;;;GAGG;AACH,MAAM,OAAO,yBAAyB;IAC3B,KAAK,CAAmB;IACxB,QAAQ,CAAmB;IAC3B,MAAM,CAAmB;IACzB,WAAW,CAAS;IACpB,aAAa,CAA+B;IAC5C,wBAAwB,CAAS;IAC1C,MAAM,CAAiB;IAEvB,YAAY,OAAyC;QACnD,IAAI,CAAC,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QACrE,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;QAC1C,IAAI,CAAC,wBAAwB,GAAG,MAAM,CAAC;YACrC,OAAO,EAAE,CAAC;YACV,OAAO,EAAE,8BAA8B;YACvC,wBAAwB,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;SACnE,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,GAAG,IAAI,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,SAAS,CACb,KAAmC,EACnC,MAAmB;QAEnB,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,UAAU,CACd,KAAoC,EACpC,MAAmB;QAEnB,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAA4B,EAAE,MAAmB;QAC/D,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3B,aAAa,CAAC,KAAK,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QACpD,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAC9C,WAAW,CAAC,KAAK,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;QACxF,MAAM,SAAS,GAAG,MAAM,iCAAiC,CAAC;YACxD,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,QAAQ;YACR,KAAK;YACL,MAAM;SACP,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;QAC5D,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,sBAAsB,CAC1B,MAAgC,EAChC,MAAmB;QAEnB,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,IAAI,QAA6B,CAAC;QAClC,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,0BAA0B;gBAAE,OAAO,SAAS,CAAC;YAClE,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,2CAA2C,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,IAAI,CACR,KAAmE,EACnE,MAAmB;QAEnB,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,iCAAiC,CAAC;YACrD,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,OAAO,EAAE;gBACP,gBAAgB,EAAE,YAAY;gBAC9B,eAAe,EAAE,IAAI,CAAC,wBAAwB;aAC/C;YACD,KAAK;YACL,MAAM;SACP,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YACtD,MAAM;YACN,OAAO,EAAE,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC/C,YAAY,EAAE,MAAM,CAAC,MAAM;YAC3B,UAAU,EAAE,KAAK,IAAI,EAAE;gBACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;gBAChD,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;gBACtC,OAAO,MAAM,CAAC,MAAM,CAAC;YACvB,CAAC;SACF,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtC,OAAO,SAAS,CAAC,KAAK,CAAC;IACzB,CAAC;IAED,WAAW,CAAC,aAAqB;QAC/B,MAAM,KAAK,GAAG,+BAA+B,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,0BAA0B,CAAC,oCAAoC,CAAC,CAAC;QACvF,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,IAAY;QAC9B,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC/B,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,0BAA0B,CAAC,6CAA6C,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACxG,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxC,MAAM,IAAI,0BAA0B,CAAC,mCAAmC,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,KAA4B,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAwC;QACzD,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,GAAG,eAAe,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACjF,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QACzD,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC;YAClC,MAAM;YACN,OAAO,EAAE,qBAAqB,CAAC,OAAO,CAAC;YACvC,YAAY,EAAE,SAAS;YACvB,UAAU,EAAE,KAAK,IAAI,EAAE;gBACrB,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAC9C,IAAI,MAAM,KAAK,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC9C,MAAM,IAAI,0BAA0B,CAAC,kCAAkC,CAAC,CAAC;gBAC3E,CAAC;YACH,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,YAAY;QACV,IAAI,CAAC,MAAM,KAAK,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,yBAAyB,CAAC,CAAC;YAC9D,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,iCAAiC,CAAC,CAAC;YACzE,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,+BAA+B,CAAC,CAAC;YACrE,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;QACvC,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,OAMtD;IACA,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;IAChC,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACrE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;IAClE,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;IAC1E,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,UAAU,CAAC;QAC1B,OAAO,EAAE,CAAU;QACnB,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;QAC7C,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,SAAS,EAAE,UAAU,CAAC,SAAS;KAChC,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,gBAAgB,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;IACjF,MAAM,gBAAgB,GAAG,6BAA6B,CAAC;QACrD,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,aAAa;QACb,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;QAC7C,QAAQ,EAAE,CAAC;QACX,SAAS,EAAE,CAAC;gBACV,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,IAAI,aAAa,EAAE;gBAC1D,IAAI,EAAE,eAAe;gBACrB,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,eAAe;gBAChD,YAAY,EAAE,cAAc;aAC7B,CAAC;KACH,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,UAAU,CAA2B;QAClD,OAAO,EAAE,CAAC;QACV,aAAa;QACb,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;QAC7C,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,sBAAsB,EAAE,gBAAgB,CAAC,MAAM;KAChD,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,UAAU,CAA6B;QACjD,GAAG,QAAQ;QACX,gBAAgB,EAAE,UAAU;QAC5B,eAAe,EAAE,UAAU,CAAC,eAAe;QAC3C,UAAU,EAAE,UAAU,CAAC,UAAU;QACjC,cAAc,EAAE,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CACtD,uBAAuB,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC3D,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,gBAAgB;KACjB,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACjH,MAAM,UAAU,GAAG,MAAM,4BAA4B,CAAC,OAAO,CAAC,YAAY,EAAE;YAC1E,OAAO,EAAE,CAAC;YACV,UAAU;YACV,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;YAC7C,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC;YACtB,OAAO,EAAE,IAAI,UAAU,CAAC,OAAO,CAAC;SACjC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACnB,MAAM,IAAI,GAAG,UAAU,CAAsC;YAC3D,OAAO,EAAE,CAAC;YACV,MAAM;YACN,GAAG;YACH,UAAU,EAAE;gBACV,SAAS,EAAE,aAAa;gBACxB,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,SAAS,EAAE,aAAa,CAAC,EAAE;gBAC3B,UAAU,EAAE,aAAa,CAAC,GAAG;gBAC7B,UAAU,EAAE,UAAU,CAAC,UAAU;aAClC;YACD,UAAU,EAAE,aAAa,CAAC,UAAU;SACrC,CAAC,CAAC;QACH,OAAO,UAAU,CAAC;YAChB,MAAM;YACN,QAAQ,EAAE,UAAU,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACvD,KAAK,EAAE,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC;SAC1D,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,OAMtD;IACA,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;IAChC,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACrE,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACnC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;IAC5D,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IACtD,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;IAC1D,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC,OAAO,CAAC,YAAY,EAAE;QACzE,OAAO,EAAE,CAAC;QACV,UAAU;QACV,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ;QACvC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS;QACzC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ;QACvC,gBAAgB,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB;QACvD,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QACvC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK;QACxC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU;KACnD,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,OAAO,CACvB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EACpB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,EACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,EACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,EAC3B,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CACzD,CAAC;QACF,IAAI,SAAS,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC9D,MAAM,IAAI,0BAA0B,CAAC,4CAA4C,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2CAA2C,CACzD,QAA6B,EAC7B,MAAgC;IAEhC,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,6BAA6B,CAAC,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC9E,IAAI,qBAAqB,CAAC,QAAQ,CAAC,KAAK,qBAAqB,CAAC,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,0BAA0B,CAAC,kDAAkD,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,qCAAqC,CAAC;QAC3C,OAAO,EAAE,CAAC;QACV,MAAM;QACN,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,SAAS;QACjC,cAAc,EAAE,QAAQ,CAAC,GAAG,CAAC,cAAc;QAC3C,SAAS,EAAE,QAAQ;KACpB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,UAAkB,EAClB,KAA4B;IAE5B,OAAO,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,YAA0C,EAC1C,OAA4E,EAC5E,MAAmB;IAEnB,MAAM,YAAY,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CACjE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,EACpD,MAAM,CACP,CAAC,EAAE,MAAM,CAAC,CAAC;QACZ,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,wCAAwC,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACxG,WAAW,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACtC,WAAW,CAAC,SAAS,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAChD,IAAI,SAAS,CAAC,UAAU,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,0BAA0B,CAAC,8DAA8D,CAAC,CAAC;QACvG,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,EAAE,CAAC;IACtE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,8BAA8B,CAC3C,YAA0C,EAC1C,OAAiE,EACjE,MAAmB;IAEnB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACvG,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,wCAAwC,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACjH,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC,IAAI,GAAG,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAC1D,MAAM,IAAI,0BAA0B,CAAC,4DAA4D,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,UAAU,CACjB,UAAkB,EAClB,MAAgC,EAChC,OAA0C;IAE1C,OAAO,UAAU,CAAC;QAChB,OAAO,EAAE,CAAC;QACV,SAAS,EAAE,OAAO;QAClB,UAAU;QACV,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAChB,UAAkB,EAClB,KAA4B;IAE5B,OAAO,UAAU,CAAC;QAChB,OAAO,EAAE,CAAC;QACV,SAAS,EAAE,MAAM;QACjB,UAAU;QACV,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa;QACzC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ;QAC/B,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,gBAAgB;QAC/C,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW;QACrC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ;QAC/B,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;QACjC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;KACnC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,KAAmE;IACzF,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACrD,WAAW,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC7C,aAAa,CAAC,UAAU,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IACrD,WAAW,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC7C,WAAW,CAAC,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC/C,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAC5C,aAAa,CAAC,KAAK,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;IAC1D,IAAI,KAAK,CAAC,gBAAgB,KAAK,gBAAgB,EAAE,CAAC;QAChD,MAAM,IAAI,0BAA0B,CAAC,0CAA0C,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,UAAU,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,UAAU,CAAC,WAAW,EAAE,CAAC;QAClG,MAAM,IAAI,0BAA0B,CAAC,qDAAqD,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,EAAE,kBAAkB,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACvG,MAAM,IAAI,0BAA0B,CAAC,0CAA0C,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACpE,MAAM,WAAW,GAAG,WAAW,CAAC,UAAU,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IACvE,MAAM,eAAe,GAAG,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;IACnG,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,0BAA0B,CAAC,uCAAuC,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,OAAO,GAAG,qBAAqB,IAAI,KAAK;QAC5C,CAAC,CAAC,UAAU,CAAC;YACX,eAAe;YACf,mBAAmB,EAAE,aAAa,CAAC,KAAK,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;SACrF,CAAC;QACF,CAAC,CAAC,UAAU,CAAC;YACX,eAAe;YACf,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS;gBAC/C,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,CAAC;SACpF,CAAC,CAAC;IACL,IAAI,CAAC,UAAU,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC,kBAAkB,CAAC;WACtF,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC,WAAW,CAAC;WACvD,UAAU,CAAC,SAAS,CAAC,kBAAkB,GAAG,CAAC;WAC3C,UAAU,CAAC,SAAS,CAAC,WAAW,GAAG,UAAU,CAAC,SAAS,CAAC,kBAAkB,EAAE,CAAC;QAChF,MAAM,IAAI,0BAA0B,CAAC,2CAA2C,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,qBAAqB,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,qBAAqB,CAAC,UAAU,CAAC;WACjF,qBAAqB,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,qBAAqB,CAAC,WAAW,CAAC;WACpF,qBAAqB,CAAC,UAAU,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,qBAAqB,CAAC,eAAe,CAAC,EAAE,CAAC;QAC1G,MAAM,IAAI,0BAA0B,CAAC,2CAA2C,CAAC,CAAC;IACpF,CAAC;IACD,0EAA0E;IAC1E,4EAA4E;IAC5E,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,OAAO,EAAE,IAAI,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC;QACtC,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,gBAAgB;QAChB,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,eAAe,EAAE,UAAU,CAAC,eAAe;QAC3C,UAAU;QACV,WAAW;QACX,OAAO;QACP,SAAS,EAAE,EAAE,GAAG,UAAU,CAAC,SAAS,EAAE;KACvC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CACrB,KAA0B,EAC1B,MAAgC;IAEhC,IAAI,QAAiC,CAAC;IACtC,IAAI,CAAC;QACH,QAAQ,GAAG,6BAA6B,CAAC,KAAK,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,0BAA0B,CAAC,8CAA8C,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,EAAE,SAAS,KAAK,aAAa;WACnE,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,qBAAqB,CAAC,MAAM,CAAC;WACrE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,gBAAgB,CAAC;WAClD,KAAK,CAAC,GAAG,CAAC,gBAAgB,GAAG,CAAC;WAC9B,KAAK,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;WACtC,KAAK,CAAC,GAAG,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;WAC5C,KAAK,CAAC,GAAG,CAAC,gBAAgB,KAAK,MAAM,CAAC,gBAAgB;WACtD,KAAK,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;WACtC,KAAK,CAAC,GAAG,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;WACxC,qBAAqB,CAAC,QAAQ,CAAC,KAAK,qBAAqB,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC;WACrF,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,sBAAsB,EAAE,CAAC;QACvD,MAAM,IAAI,0BAA0B,CAAC,mDAAmD,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;IAChD,IAAI,YAAY,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,0BAA0B,CAAC,wCAAwC,CAAC,CAAC;IACjF,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAA+B;IACnD,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;QACpF,MAAM,IAAI,0BAA0B,CAAC,iCAAiC,CAAC,CAAC;IAC1E,CAAC;IACD,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACxC,aAAa,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAChD,aAAa,CAAC,KAAK,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;IAC1D,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACxC,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC1C,aAAa,CAAC,KAAK,CAAC,sBAAsB,EAAE,wBAAwB,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,OAAO,CAAC,GAAW,EAAE,SAAiB,EAAE,GAAW;IAC1D,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnB,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7E,OAAO;QACL,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzB,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC3C,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,GAAW,EAAE,EAAU,EAAE,GAAW,EAAE,UAAkB,EAAE,GAAW;IACpF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;QACjF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;QAChD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC/F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,0BAA0B,CAAC,+CAA+C,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1G,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,MAAyB,EAAE,KAAa;IAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,0BAA0B,CAAC,iBAAiB,KAAK,aAAa,CAAC,CAAC;IACtG,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,WAAW,CAAC,KAAa,EAAE,KAAa;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,0BAA0B,CAAC,iBAAiB,KAAK,aAAa,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,KAAa;IACjD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,0BAA0B,CAAC,iBAAiB,KAAK,aAAa,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,KAAa;IACnD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,0BAA0B,CAAC,iBAAiB,KAAK,mBAAmB,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB;IAClC,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,SAAS,CAAI,OAAmB,EAAE,MAAmB;IAClE,MAAM,CAAC,cAAc,EAAE,CAAC;IACxB,OAAO,MAAM,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC9C,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,YAAY,CAAC,yBAAyB,EAAE,YAAY,CAAC,CAAC,CAAC;QAC/G,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;AACL,CAAC"}