@zhin.js/agent 1.1.31 → 1.1.32

package/lib/data-governance/encrypted-file-payload-vault.d.ts

@@ -1,117 +0,0 @@
-import type { ConfidentialityClass, DataDescriptor } from './data-governance.js';
-import type { PayloadVaultDerivedWriteInput, PayloadVaultObjectHandle, PayloadVaultPort, PayloadVaultReadInput } from './disclosure-manifest.js';
-import { type PayloadLifecycleObjectAuthority, type PayloadLocationManifest } from './payload-lifecycle.js';
-export interface PayloadVaultWrappedKey {
-    readonly keyId: string;
-    /** Provider-opaque wrapped DEK. It must never be the raw key encoding. */
-    readonly wrappedKey: string;
-}
-export interface PayloadVaultCryptographyContext {
-    readonly version: 1;
-    readonly generation: number;
-    readonly tenantId: string;
-    readonly projectId: string;
-    readonly objectId: string;
-    readonly descriptorDigest: string;
-    readonly aadDigest: string;
-}
-/** Trusted Root-only crypto/KMS seam. KEK bytes never leave the provider. */
-export interface PayloadVaultCryptographyPort {
-    wrap(request: PayloadVaultCryptographyContext & Readonly<{
-        dataKey: Uint8Array;
-    }>, signal: AbortSignal): PayloadVaultWrappedKey | null | Promise<PayloadVaultWrappedKey | null>;
-    unwrap(request: PayloadVaultCryptographyContext & PayloadVaultWrappedKey, signal: AbortSignal): Uint8Array | null | Promise<Uint8Array | null>;
-}
-export interface PayloadVaultSourceWriteInput {
-    /** Complete canonical descriptor; loose classification fields are forbidden. */
-    readonly descriptor: DataDescriptor;
-    readonly descriptorDigest: string;
-    readonly payload: Uint8Array;
-    readonly sourceBindingDigest: string;
-}
-export declare class PayloadVaultCryptographyUnavailableError extends Error {
-    readonly tenantId: string;
-    readonly projectId: string;
-    readonly keyId?: string | undefined;
-    constructor(tenantId: string, projectId: string, keyId?: string | undefined);
-}
-export declare class PayloadVaultIntegrityError extends Error {
-    constructor(message: string, options?: ErrorOptions);
-}
-export interface VaultObjectEnvelope {
-    readonly version: 1;
-    readonly handle: PayloadVaultObjectHandle;
-    readonly aad: Readonly<{
-        version: 1;
-        issuedGeneration: number;
-        objectId: string;
-        payloadHash: string;
-        descriptorDigest: string;
-        tenantId: string;
-        projectId: string;
-        confidentiality: Exclude<ConfidentialityClass, 'unknown'>;
-        categories: readonly string[];
-        subjectDigests: readonly string[];
-        lineage: Readonly<{
-            sourceObjectIds: readonly string[];
-            transformRef?: string;
-            sourceBindingDigest?: string;
-        }>;
-        retention: DataDescriptor['retention'];
-        locationManifest: PayloadLocationManifest;
-    }>;
-    readonly encryption: Readonly<{
-        algorithm: 'aes-256-gcm';
-        keyId: string;
-        payloadIv: string;
-        payloadTag: string;
-        wrappedKey: string;
-    }>;
-    readonly ciphertext: string;
-    readonly digest: string;
-}
-export interface EncryptedFilePayloadVaultOptions {
-    /** Repository leaf; its parent must already exist. */
-    readonly directory: string;
-    readonly generation: number;
-    readonly cryptography: PayloadVaultCryptographyPort;
-}
-export interface EncryptedPayloadVaultStorageAuthority {
-    readonly locationIdPrefix: string;
-    readonly authorityDigest: string;
-}
-export interface SealedPayloadVaultObject {
-    readonly handle: PayloadVaultObjectHandle;
-    readonly envelope: VaultObjectEnvelope;
-    readonly audit: Readonly<Record<string, unknown>>;
-}
-/**
- * Immutable AES-256-GCM envelope Vault. Every object receives a random DEK;
- * only a KeyProvider-wrapped DEK is persisted. Handles reveal no path or key id.
- */
-export declare class EncryptedFilePayloadVault implements PayloadVaultPort {
-    #private;
-    constructor(options: EncryptedFilePayloadVaultOptions);
-    putSource(input: PayloadVaultSourceWriteInput, signal: AbortSignal): Promise<PayloadVaultObjectHandle>;
-    putDerived(input: PayloadVaultDerivedWriteInput, signal: AbortSignal): Promise<PayloadVaultObjectHandle>;
-    readExact(input: PayloadVaultReadInput, signal: AbortSignal): Promise<Uint8Array>;
-    /** Trusted Root lifecycle resolver; never publish the Vault itself as a Resource. */
-    resolveLifecycleObject(handle: PayloadVaultObjectHandle, signal: AbortSignal): Promise<PayloadLifecycleObjectAuthority | undefined>;
-}
-export declare function sealEncryptedPayloadVaultEnvelope(options: Readonly<{
-    generation: number;
-    cryptography: PayloadVaultCryptographyPort;
-    storage: EncryptedPayloadVaultStorageAuthority;
-    input: PayloadVaultSourceWriteInput | PayloadVaultDerivedWriteInput;
-    signal: AbortSignal;
-}>): Promise<SealedPayloadVaultObject>;
-export declare function openEncryptedPayloadVaultEnvelope(options: Readonly<{
-    generation: number;
-    cryptography: PayloadVaultCryptographyPort;
-    envelope: VaultObjectEnvelope;
-    input: PayloadVaultReadInput;
-    signal: AbortSignal;
-}>): Promise<Uint8Array>;
-export declare function resolveEncryptedPayloadVaultLifecycleObject(envelope: VaultObjectEnvelope, handle: PayloadVaultObjectHandle): PayloadLifecycleObjectAuthority;
-export declare function readEncryptedPayloadVaultAudit(generation: number, input: PayloadVaultReadInput): Readonly<Record<string, unknown>>;
-//# sourceMappingURL=encrypted-file-payload-vault.d.ts.map

package/lib/data-governance/encrypted-file-payload-vault.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"encrypted-file-payload-vault.d.ts","sourceRoot":"","sources":["../../src/data-governance/encrypted-file-payload-vault.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,oBAAoB,EACpB,cAAc,EAEf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EACV,6BAA6B,EAC7B,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,EACtB,MAAM,0BAA0B,CAAC;AAOlC,OAAO,EAIL,KAAK,+BAA+B,EACpC,KAAK,uBAAuB,EAC7B,MAAM,wBAAwB,CAAC;AAEhC,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,6EAA6E;AAC7E,MAAM,WAAW,4BAA4B;IAC3C,IAAI,CACF,OAAO,EAAE,+BAA+B,GAAG,QAAQ,CAAC;QAAE,OAAO,EAAE,UAAU,CAAA;KAAE,CAAC,EAC5E,MAAM,EAAE,WAAW,GAClB,sBAAsB,GAAG,IAAI,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IAC1E,MAAM,CACJ,OAAO,EAAE,+BAA+B,GAAG,sBAAsB,EACjE,MAAM,EAAE,WAAW,GAClB,UAAU,GAAG,IAAI,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,4BAA4B;IAC3C,gFAAgF;IAChF,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;CACtC;AAED,qBAAa,wCAAyC,SAAQ,KAAK;IACrD,QAAQ,CAAC,QAAQ,EAAE,MAAM;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM;gBAArE,QAAQ,EAAE,MAAM,EAAW,SAAS,EAAE,MAAM,EAAW,KAAK,CAAC,EAAE,MAAM,YAAA;CAI3F;AAED,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY;CAIpD;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;QACrB,OAAO,EAAE,CAAC,CAAC;QACX,gBAAgB,EAAE,MAAM,CAAC;QACzB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,gBAAgB,EAAE,MAAM,CAAC;QACzB,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,eAAe,EAAE,OAAO,CAAC,oBAAoB,EAAE,SAAS,CAAC,CAAC;QAC1D,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;QAC9B,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;QAClC,OAAO,EAAE,QAAQ,CAAC;YAChB,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;YACnC,YAAY,CAAC,EAAE,MAAM,CAAC;YACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;SAC9B,CAAC,CAAC;QACH,SAAS,EAAE,cAAc,CAAC,WAAW,CAAC,CAAC;QACvC,gBAAgB,EAAE,uBAAuB,CAAC;KAC3C,CAAC,CAAC;IACH,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC;QAC5B,SAAS,EAAE,aAAa,CAAC;QACzB,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC,CAAC;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,gCAAgC;IAC/C,sDAAsD;IACtD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,4BAA4B,CAAC;CACrD;AAED,MAAM,WAAW,qCAAqC;IACpD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACnD;AAED;;;GAGG;AACH,qBAAa,yBAA0B,YAAW,gBAAgB;;gBASpD,OAAO,EAAE,gCAAgC;IAa/C,SAAS,CACb,KAAK,EAAE,4BAA4B,EACnC,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,wBAAwB,CAAC;IAI9B,UAAU,CACd,KAAK,EAAE,6BAA6B,EACpC,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,wBAAwB,CAAC;IAI9B,SAAS,CAAC,KAAK,EAAE,qBAAqB,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IAmBvF,qFAAqF;IAC/E,sBAAsB,CAC1B,MAAM,EAAE,wBAAwB,EAChC,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,+BAA+B,GAAG,SAAS,CAAC;CA2FxD;AAED,wBAAsB,iCAAiC,CAAC,OAAO,EAAE,QAAQ,CAAC;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,4BAA4B,CAAC;IAC3C,OAAO,EAAE,qCAAqC,CAAC;IAC/C,KAAK,EAAE,4BAA4B,GAAG,6BAA6B,CAAC;IACpE,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAsFrC;AAED,wBAAsB,iCAAiC,CAAC,OAAO,EAAE,QAAQ,CAAC;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,4BAA4B,CAAC;IAC3C,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,KAAK,EAAE,qBAAqB,CAAC;IAC7B,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAkCvB;AAED,wBAAgB,2CAA2C,CACzD,QAAQ,EAAE,mBAAmB,EAC7B,MAAM,EAAE,wBAAwB,GAC/B,+BAA+B,CAajC;AAED,wBAAgB,8BAA8B,CAC5C,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,qBAAqB,GAC3B,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAEnC"}

package/lib/data-governance/encrypted-file-payload-vault.js

@@ -1,507 +0,0 @@
-import { createCipheriv, createDecipheriv, createHash, randomBytes, } from 'node:crypto';
-import { readFile } from 'node:fs/promises';
-import { join } from 'node:path';
-import { canonicalWorkroomJson, deepFreezeWorkroomValue as deepFreeze, digestCanonicalWorkroomValue as digest, } from '../workroom/canonical-value.js';
-import { DurableFileStore } from '../workroom/durable-file-store.js';
-import { createPayloadLifecycleObjectAuthority, createPayloadLocationManifest, digestPayloadSubjectRef, } from './payload-lifecycle.js';
-export class PayloadVaultCryptographyUnavailableError extends Error {
-    tenantId;
-    projectId;
-    keyId;
-    constructor(tenantId, projectId, keyId) {
-        super(`Payload Vault key authority is unavailable for ${tenantId}/${projectId}`);
-        this.tenantId = tenantId;
-        this.projectId = projectId;
-        this.keyId = keyId;
-        this.name = 'PayloadVaultCryptographyUnavailableError';
-    }
-}
-export class PayloadVaultIntegrityError extends Error {
-    constructor(message, options) {
-        super(message, options);
-        this.name = 'PayloadVaultIntegrityError';
-    }
-}
-/**
- * Immutable AES-256-GCM envelope Vault. Every object receives a random DEK;
- * only a KeyProvider-wrapped DEK is persisted. Handles reveal no path or key id.
- */
-export class EncryptedFilePayloadVault {
-    #root;
-    #objects;
-    #audit;
-    #generation;
-    #cryptography;
-    #locationAuthorityDigest;
-    #ready;
-    constructor(options) {
-        this.#generation = positiveInteger(options.generation, 'generation');
-        this.#cryptography = options.cryptography;
-        this.#locationAuthorityDigest = digest({
-            version: 1,
-            adapter: 'encrypted-file-payload-vault',
-            repositoryIdentityDigest: digest({ directory: options.directory }),
-        });
-        this.#root = new DurableFileStore(options.directory);
-        this.#objects = new DurableFileStore(join(options.directory, 'objects'));
-        this.#audit = new DurableFileStore(join(options.directory, 'audit'));
-    }
-    async putSource(input, signal) {
-        return await this.#put(input, signal);
-    }
-    async putDerived(input, signal) {
-        return await this.#put(input, signal);
-    }
-    async readExact(input, signal) {
-        signal.throwIfAborted();
-        await this.#ensureReady();
-        assertHandle(input.handle);
-        requireDigest(input.requestDigest, 'requestDigest');
-        requireText(input.principalId, 'principalId');
-        requireText(input.destinationId, 'destinationId');
-        const envelope = await this.#readEnvelope(this.#objectPath(input.handle.vaultObjectId));
-        const plaintext = await openEncryptedPayloadVaultEnvelope({
-            generation: this.#generation,
-            cryptography: this.#cryptography,
-            envelope,
-            input,
-            signal,
-        });
-        await this.#recordAudit(readAudit(this.#generation, input));
-        return plaintext;
-    }
-    /** Trusted Root lifecycle resolver; never publish the Vault itself as a Resource. */
-    async resolveLifecycleObject(handle, signal) {
-        signal.throwIfAborted();
-        await this.#ensureReady();
-        let envelope;
-        try {
-            envelope = await this.#readEnvelope(this.#objectPath(handle.vaultObjectId));
-        }
-        catch (error) {
-            if (error instanceof PayloadVaultIntegrityError)
-                return undefined;
-            throw error;
-        }
-        return resolveEncryptedPayloadVaultLifecycleObject(envelope, handle);
-    }
-    async #put(input, signal) {
-        signal.throwIfAborted();
-        await this.#ensureReady();
-        const sealed = await sealEncryptedPayloadVaultEnvelope({
-            generation: this.#generation,
-            cryptography: this.#cryptography,
-            storage: {
-                locationIdPrefix: 'vault-file',
-                authorityDigest: this.#locationAuthorityDigest,
-            },
-            input,
-            signal,
-        });
-        const target = this.#objectPath(sealed.handle.vaultObjectId);
-        const published = await this.#objects.publishCreateOnly({
-            target,
-            content: canonicalWorkroomJson(sealed.envelope),
-            createdValue: sealed.handle,
-            onConflict: async () => {
-                const winner = await this.#readEnvelope(target);
-                assertEnvelope(winner, sealed.handle);
-                return winner.handle;
-            },
-        });
-        await this.#recordAudit(sealed.audit);
-        return published.value;
-    }
-    #objectPath(vaultObjectId) {
-        const match = /^vault-object:([a-f\d]{64})$/u.exec(vaultObjectId);
-        if (!match)
-            throw new PayloadVaultIntegrityError('Payload Vault object id is invalid');
-        return join(this.#objects.directory, `${match[1]}.json`);
-    }
-    async #readEnvelope(path) {
-        await this.#objects.syncLeaf();
-        let value;
-        try {
-            value = JSON.parse(await readFile(path, 'utf8'));
-        }
-        catch (error) {
-            throw new PayloadVaultIntegrityError('Payload Vault object is absent or malformed', { cause: error });
-        }
-        if (!value || typeof value !== 'object') {
-            throw new PayloadVaultIntegrityError('Payload Vault object is malformed');
-        }
-        return value;
-    }
-    async #recordAudit(value) {
-        const content = deepFreeze({ ...structuredClone(value), digest: digest(value) });
-        const id = digest(content).slice('sha256:'.length);
-        const target = join(this.#audit.directory, `${id}.json`);
-        await this.#audit.publishCreateOnly({
-            target,
-            content: canonicalWorkroomJson(content),
-            createdValue: undefined,
-            onConflict: async () => {
-                await this.#audit.syncLeaf();
-                const winner = await readFile(target, 'utf8');
-                if (winner !== canonicalWorkroomJson(content)) {
-                    throw new PayloadVaultIntegrityError('Payload Vault audit replay drift');
-                }
-            },
-        });
-    }
-    #ensureReady() {
-        this.#ready ??= (async () => {
-            await this.#root.ensureDurableLeaf('Encrypted Payload Vault');
-            await this.#objects.ensureDurableLeaf('Encrypted Payload Vault objects');
-            await this.#audit.ensureDurableLeaf('Encrypted Payload Vault audit');
-            await this.#root.syncLeafAndParent();
-        })();
-        return this.#ready;
-    }
-}
-export async function sealEncryptedPayloadVaultEnvelope(options) {
-    options.signal.throwIfAborted();
-    const generation = positiveInteger(options.generation, 'generation');
-    requireText(options.storage.locationIdPrefix, 'locationIdPrefix');
-    requireDigest(options.storage.authorityDigest, 'storage authorityDigest');
-    const normalized = normalizeWrite(options.input);
-    const identity = deepFreeze({
-        version: 1,
-        objectId: normalized.objectId,
-        payloadHash: normalized.payloadHash,
-        descriptorDigest: normalized.descriptorDigest,
-        tenantId: normalized.tenantId,
-        projectId: normalized.projectId,
-    });
-    const vaultObjectId = `vault-object:${digest(identity).slice('sha256:'.length)}`;
-    const locationManifest = createPayloadLocationManifest({
-        version: 1,
-        tenantId: normalized.tenantId,
-        projectId: normalized.projectId,
-        objectId: normalized.objectId,
-        vaultObjectId,
-        descriptorDigest: normalized.descriptorDigest,
-        revision: 1,
-        locations: [{
-                id: `${options.storage.locationIdPrefix}:${vaultObjectId}`,
-                kind: 'vault_primary',
-                authorityDigest: options.storage.authorityDigest,
-                deletionMode: 'crypto_erase',
-            }],
-    });
-    const handle = deepFreeze({
-        version: 1,
-        vaultObjectId,
-        objectId: normalized.objectId,
-        payloadHash: normalized.payloadHash,
-        descriptorDigest: normalized.descriptorDigest,
-        tenantId: normalized.tenantId,
-        projectId: normalized.projectId,
-        locationManifestDigest: locationManifest.digest,
-    });
-    const aad = deepFreeze({
-        ...identity,
-        issuedGeneration: generation,
-        confidentiality: normalized.confidentiality,
-        categories: normalized.categories,
-        subjectDigests: normalized.subjectRefs.map(subjectRef => digestPayloadSubjectRef(normalized.tenantId, subjectRef)),
-        lineage: normalized.lineage,
-        retention: normalized.retention,
-        locationManifest,
-    });
-    const dataKey = randomBytes(32);
-    try {
-        const payloadCipher = encrypt(dataKey, Buffer.from(normalized.payload), Buffer.from(canonicalWorkroomJson(aad)));
-        const wrappedKey = await wrapEncryptedPayloadVaultKey(options.cryptography, {
-            version: 1,
-            generation,
-            tenantId: normalized.tenantId,
-            projectId: normalized.projectId,
-            objectId: normalized.objectId,
-            descriptorDigest: normalized.descriptorDigest,
-            aadDigest: digest(aad),
-            dataKey: new Uint8Array(dataKey),
-        }, options.signal);
-        const body = deepFreeze({
-            version: 1,
-            handle,
-            aad,
-            encryption: {
-                algorithm: 'aes-256-gcm',
-                keyId: wrappedKey.keyId,
-                payloadIv: payloadCipher.iv,
-                payloadTag: payloadCipher.tag,
-                wrappedKey: wrappedKey.wrappedKey,
-            },
-            ciphertext: payloadCipher.ciphertext,
-        });
-        return deepFreeze({
-            handle,
-            envelope: deepFreeze({ ...body, digest: digest(body) }),
-            audit: writeAudit(generation, handle, normalized.lineage),
-        });
-    }
-    finally {
-        dataKey.fill(0);
-        normalized.payload.fill(0);
-    }
-}
-export async function openEncryptedPayloadVaultEnvelope(options) {
-    options.signal.throwIfAborted();
-    const generation = positiveInteger(options.generation, 'generation');
-    assertHandle(options.input.handle);
-    requireDigest(options.input.requestDigest, 'requestDigest');
-    requireText(options.input.principalId, 'principalId');
-    requireText(options.input.destinationId, 'destinationId');
-    assertEnvelope(options.envelope, options.input.handle);
-    const dataKey = await unwrapEncryptedPayloadVaultKey(options.cryptography, {
-        version: 1,
-        generation,
-        tenantId: options.input.handle.tenantId,
-        projectId: options.input.handle.projectId,
-        objectId: options.input.handle.objectId,
-        descriptorDigest: options.input.handle.descriptorDigest,
-        aadDigest: digest(options.envelope.aad),
-        keyId: options.envelope.encryption.keyId,
-        wrappedKey: options.envelope.encryption.wrappedKey,
-    }, options.signal);
-    try {
-        const plaintext = decrypt(Buffer.from(dataKey), options.envelope.encryption.payloadIv, options.envelope.encryption.payloadTag, options.envelope.ciphertext, Buffer.from(canonicalWorkroomJson(options.envelope.aad)));
-        if (hashBytes(plaintext) !== options.input.handle.payloadHash) {
-            throw new PayloadVaultIntegrityError('Payload Vault decrypted body hash mismatch');
-        }
-        return new Uint8Array(plaintext);
-    }
-    finally {
-        dataKey.fill(0);
-    }
-}
-export function resolveEncryptedPayloadVaultLifecycleObject(envelope, handle) {
-    assertEnvelope(envelope, handle);
-    const manifest = createPayloadLocationManifest(envelope.aad.locationManifest);
-    if (canonicalWorkroomJson(manifest) !== canonicalWorkroomJson(envelope.aad.locationManifest)) {
-        throw new PayloadVaultIntegrityError('Payload Vault Location Manifest is non-canonical');
-    }
-    return createPayloadLifecycleObjectAuthority({
-        version: 1,
-        handle,
-        retention: envelope.aad.retention,
-        subjectDigests: envelope.aad.subjectDigests,
-        locations: manifest,
-    });
-}
-export function readEncryptedPayloadVaultAudit(generation, input) {
-    return readAudit(generation, input);
-}
-async function wrapEncryptedPayloadVaultKey(cryptography, request, signal) {
-    const ownedDataKey = new Uint8Array(request.dataKey);
-    try {
-        const authority = await abortable(Promise.resolve(cryptography.wrap(Object.freeze({ ...request, dataKey: ownedDataKey }), signal)), signal);
-        if (!authority)
-            throw new PayloadVaultCryptographyUnavailableError(request.tenantId, request.projectId);
-        requireText(authority.keyId, 'keyId');
-        requireText(authority.wrappedKey, 'wrappedKey');
-        if (authority.wrappedKey === Buffer.from(ownedDataKey).toString('base64')) {
-            throw new PayloadVaultIntegrityError('Payload Vault crypto provider returned an unwrapped data key');
-        }
-        return { keyId: authority.keyId, wrappedKey: authority.wrappedKey };
-    }
-    finally {
-        ownedDataKey.fill(0);
-    }
-}
-async function unwrapEncryptedPayloadVaultKey(cryptography, request, signal) {
-    const key = await abortable(Promise.resolve(cryptography.unwrap(deepFreeze(request), signal)), signal);
-    if (!key)
-        throw new PayloadVaultCryptographyUnavailableError(request.tenantId, request.projectId, request.keyId);
-    if (!(key instanceof Uint8Array) || key.byteLength !== 32) {
-        throw new PayloadVaultIntegrityError('Payload Vault crypto provider returned an invalid data key');
-    }
-    return new Uint8Array(key);
-}
-function writeAudit(generation, handle, lineage) {
-    return deepFreeze({
-        version: 1,
-        operation: 'write',
-        generation,
-        vaultObjectId: handle.vaultObjectId,
-        objectId: handle.objectId,
-        descriptorDigest: handle.descriptorDigest,
-        payloadHash: handle.payloadHash,
-        tenantId: handle.tenantId,
-        projectId: handle.projectId,
-        lineageDigest: digest(lineage),
-    });
-}
-function readAudit(generation, input) {
-    return deepFreeze({
-        version: 1,
-        operation: 'read',
-        generation,
-        vaultObjectId: input.handle.vaultObjectId,
-        objectId: input.handle.objectId,
-        descriptorDigest: input.handle.descriptorDigest,
-        payloadHash: input.handle.payloadHash,
-        tenantId: input.handle.tenantId,
-        projectId: input.handle.projectId,
-        requestDigest: input.requestDigest,
-        purpose: input.purpose,
-        principalId: input.principalId,
-        destinationId: input.destinationId,
-    });
-}
-function normalizeWrite(input) {
-    const descriptor = structuredClone(input.descriptor);
-    requireText(descriptor.objectId, 'objectId');
-    requireDigest(descriptor.payloadHash, 'payloadHash');
-    requireText(descriptor.tenantId, 'tenantId');
-    requireText(descriptor.projectId, 'projectId');
-    const descriptorDigest = digest(descriptor);
-    requireDigest(input.descriptorDigest, 'descriptorDigest');
-    if (input.descriptorDigest !== descriptorDigest) {
-        throw new PayloadVaultIntegrityError('Payload Vault Descriptor digest mismatch');
-    }
-    if (!(input.payload instanceof Uint8Array) || hashBytes(input.payload) !== descriptor.payloadHash) {
-        throw new PayloadVaultIntegrityError('Payload Vault write body does not match payloadHash');
-    }
-    if (!['public', 'project_internal', 'confidential', 'restricted'].includes(descriptor.confidentiality)) {
-        throw new PayloadVaultIntegrityError('Payload Vault confidentiality is invalid');
-    }
-    const categories = uniqueTexts(descriptor.categories, 'categories');
-    const subjectRefs = uniqueTexts(descriptor.subjectRefs, 'subjectRefs');
-    const sourceObjectIds = uniqueTexts(descriptor.lineage.sourceObjectIds, 'lineage.sourceObjectIds');
-    if (sourceObjectIds.length === 0) {
-        throw new PayloadVaultIntegrityError('Payload Vault source lineage is empty');
-    }
-    const lineage = 'sourceBindingDigest' in input
-        ? deepFreeze({
-            sourceObjectIds,
-            sourceBindingDigest: requireDigest(input.sourceBindingDigest, 'sourceBindingDigest'),
-        })
-        : deepFreeze({
-            sourceObjectIds,
-            ...(descriptor.lineage.transformRef === undefined
-                ? {}
-                : { transformRef: requireText(descriptor.lineage.transformRef, 'transformRef') }),
-        });
-    if (!descriptor.retention || !Number.isSafeInteger(descriptor.retention.minimumRetainUntil)
-        || !Number.isSafeInteger(descriptor.retention.deleteAfter)
-        || descriptor.retention.minimumRetainUntil < 0
-        || descriptor.retention.deleteAfter < descriptor.retention.minimumRetainUntil) {
-        throw new PayloadVaultIntegrityError('Payload Vault retention window is invalid');
-    }
-    if (canonicalWorkroomJson(descriptor.categories) !== canonicalWorkroomJson(categories)
-        || canonicalWorkroomJson(descriptor.subjectRefs) !== canonicalWorkroomJson(subjectRefs)
-        || canonicalWorkroomJson(descriptor.lineage.sourceObjectIds) !== canonicalWorkroomJson(sourceObjectIds)) {
-        throw new PayloadVaultIntegrityError('Payload Vault Descriptor is non-canonical');
-    }
-    // ECMAScript rejects freezing non-empty typed arrays. The Vault owns this
-    // byte copy and never exposes it; all authority-bearing metadata is frozen.
-    return Object.freeze({
-        objectId: descriptor.objectId,
-        payload: new Uint8Array(input.payload),
-        payloadHash: descriptor.payloadHash,
-        descriptorDigest,
-        tenantId: descriptor.tenantId,
-        projectId: descriptor.projectId,
-        confidentiality: descriptor.confidentiality,
-        categories,
-        subjectRefs,
-        lineage,
-        retention: { ...descriptor.retention },
-    });
-}
-function assertEnvelope(value, handle) {
-    let manifest;
-    try {
-        manifest = createPayloadLocationManifest(value.aad?.locationManifest);
-    }
-    catch (error) {
-        throw new PayloadVaultIntegrityError('Payload Vault Location Manifest is malformed', { cause: error });
-    }
-    if (value.version !== 1 || value.encryption?.algorithm !== 'aes-256-gcm'
-        || canonicalWorkroomJson(value.handle) !== canonicalWorkroomJson(handle)
-        || !Number.isSafeInteger(value.aad?.issuedGeneration)
-        || value.aad.issuedGeneration < 1
-        || value.aad.objectId !== handle.objectId
-        || value.aad.payloadHash !== handle.payloadHash
-        || value.aad.descriptorDigest !== handle.descriptorDigest
-        || value.aad.tenantId !== handle.tenantId
-        || value.aad.projectId !== handle.projectId
-        || canonicalWorkroomJson(manifest) !== canonicalWorkroomJson(value.aad.locationManifest)
-        || manifest.digest !== handle.locationManifestDigest) {
-        throw new PayloadVaultIntegrityError('Payload Vault envelope authority binding mismatch');
-    }
-    const { digest: actualDigest, ...body } = value;
-    if (actualDigest !== digest(body)) {
-        throw new PayloadVaultIntegrityError('Payload Vault envelope digest mismatch');
-    }
-}
-function assertHandle(value) {
-    if (value.version !== 1 || !/^vault-object:[a-f\d]{64}$/u.test(value.vaultObjectId)) {
-        throw new PayloadVaultIntegrityError('Payload Vault handle is invalid');
-    }
-    requireText(value.objectId, 'objectId');
-    requireDigest(value.payloadHash, 'payloadHash');
-    requireDigest(value.descriptorDigest, 'descriptorDigest');
-    requireText(value.tenantId, 'tenantId');
-    requireText(value.projectId, 'projectId');
-    requireDigest(value.locationManifestDigest, 'locationManifestDigest');
-}
-function encrypt(key, plaintext, aad) {
-    const iv = randomBytes(12);
-    const cipher = createCipheriv('aes-256-gcm', key, iv);
-    cipher.setAAD(aad);
-    const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
-    return {
-        iv: iv.toString('base64'),
-        tag: cipher.getAuthTag().toString('base64'),
-        ciphertext: ciphertext.toString('base64'),
-    };
-}
-function decrypt(key, iv, tag, ciphertext, aad) {
-    try {
-        const decipher = createDecipheriv('aes-256-gcm', key, Buffer.from(iv, 'base64'));
-        decipher.setAAD(aad);
-        decipher.setAuthTag(Buffer.from(tag, 'base64'));
-        return Buffer.concat([decipher.update(Buffer.from(ciphertext, 'base64')), decipher.final()]);
-    }
-    catch (error) {
-        throw new PayloadVaultIntegrityError('Payload Vault authenticated decryption failed', { cause: error });
-    }
-}
-function uniqueTexts(values, label) {
-    if (!Array.isArray(values))
-        throw new PayloadVaultIntegrityError(`Payload Vault ${label} is invalid`);
-    return Object.freeze([...new Set(values.map(value => requireText(value, label)))].sort());
-}
-function requireText(value, label) {
-    if (typeof value !== 'string' || value.trim() !== value || value.length === 0) {
-        throw new PayloadVaultIntegrityError(`Payload Vault ${label} is invalid`);
-    }
-    return value;
-}
-function requireDigest(value, label) {
-    if (!/^sha256:[a-f\d]{64}$/u.test(value)) {
-        throw new PayloadVaultIntegrityError(`Payload Vault ${label} is invalid`);
-    }
-    return value;
-}
-function positiveInteger(value, label) {
-    if (!Number.isSafeInteger(value) || value < 1) {
-        throw new PayloadVaultIntegrityError(`Payload Vault ${label} must be positive`);
-    }
-    return value;
-}
-function hashBytes(value) {
-    return `sha256:${createHash('sha256').update(value).digest('hex')}`;
-}
-async function abortable(promise, signal) {
-    signal.throwIfAborted();
-    return await new Promise((resolve, reject) => {
-        const onAbort = () => reject(signal.reason ?? new DOMException('Payload Vault cancelled', 'AbortError'));
-        signal.addEventListener('abort', onAbort, { once: true });
-        promise.then(resolve, reject).finally(() => signal.removeEventListener('abort', onAbort));
-    });
-}
-//# sourceMappingURL=encrypted-file-payload-vault.js.map

package/lib/data-governance/encrypted-file-payload-vault.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"encrypted-file-payload-vault.js","sourceRoot":"","sources":["../../src/data-governance/encrypted-file-payload-vault.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,WAAW,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAYjC,OAAO,EACL,qBAAqB,EACrB,uBAAuB,IAAI,UAAU,EACrC,4BAA4B,IAAI,MAAM,GACvC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EACL,qCAAqC,EACrC,6BAA6B,EAC7B,uBAAuB,GAGxB,MAAM,wBAAwB,CAAC;AAsChC,MAAM,OAAO,wCAAyC,SAAQ,KAAK;IAC5C;IAA2B;IAA4B;IAA5E,YAAqB,QAAgB,EAAW,SAAiB,EAAW,KAAc;QACxF,KAAK,CAAC,kDAAkD,QAAQ,IAAI,SAAS,EAAE,CAAC,CAAC;QAD9D,aAAQ,GAAR,QAAQ,CAAQ;QAAW,cAAS,GAAT,SAAS,CAAQ;QAAW,UAAK,GAAL,KAAK,CAAS;QAExF,IAAI,CAAC,IAAI,GAAG,0CAA0C,CAAC;IACzD,CAAC;CACF;AAED,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IACnD,YAAY,OAAe,EAAE,OAAsB;QACjD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAqDD;;;GAGG;AACH,MAAM,OAAO,yBAAyB;IAC3B,KAAK,CAAmB;IACxB,QAAQ,CAAmB;IAC3B,MAAM,CAAmB;IACzB,WAAW,CAAS;IACpB,aAAa,CAA+B;IAC5C,wBAAwB,CAAS;IAC1C,MAAM,CAAiB;IAEvB,YAAY,OAAyC;QACnD,IAAI,CAAC,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QACrE,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;QAC1C,IAAI,CAAC,wBAAwB,GAAG,MAAM,CAAC;YACrC,OAAO,EAAE,CAAC;YACV,OAAO,EAAE,8BAA8B;YACvC,wBAAwB,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;SACnE,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,GAAG,IAAI,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,SAAS,CACb,KAAmC,EACnC,MAAmB;QAEnB,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,UAAU,CACd,KAAoC,EACpC,MAAmB;QAEnB,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAA4B,EAAE,MAAmB;QAC/D,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3B,aAAa,CAAC,KAAK,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QACpD,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAC9C,WAAW,CAAC,KAAK,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;QACxF,MAAM,SAAS,GAAG,MAAM,iCAAiC,CAAC;YACxD,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,QAAQ;YACR,KAAK;YACL,MAAM;SACP,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;QAC5D,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,sBAAsB,CAC1B,MAAgC,EAChC,MAAmB;QAEnB,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,IAAI,QAA6B,CAAC;QAClC,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,0BAA0B;gBAAE,OAAO,SAAS,CAAC;YAClE,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,2CAA2C,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,IAAI,CACR,KAAmE,EACnE,MAAmB;QAEnB,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,iCAAiC,CAAC;YACrD,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,OAAO,EAAE;gBACP,gBAAgB,EAAE,YAAY;gBAC9B,eAAe,EAAE,IAAI,CAAC,wBAAwB;aAC/C;YACD,KAAK;YACL,MAAM;SACP,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YACtD,MAAM;YACN,OAAO,EAAE,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC/C,YAAY,EAAE,MAAM,CAAC,MAAM;YAC3B,UAAU,EAAE,KAAK,IAAI,EAAE;gBACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;gBAChD,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;gBACtC,OAAO,MAAM,CAAC,MAAM,CAAC;YACvB,CAAC;SACF,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtC,OAAO,SAAS,CAAC,KAAK,CAAC;IACzB,CAAC;IAED,WAAW,CAAC,aAAqB;QAC/B,MAAM,KAAK,GAAG,+BAA+B,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,0BAA0B,CAAC,oCAAoC,CAAC,CAAC;QACvF,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,IAAY;QAC9B,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC/B,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,0BAA0B,CAAC,6CAA6C,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACxG,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxC,MAAM,IAAI,0BAA0B,CAAC,mCAAmC,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,KAA4B,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAwC;QACzD,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,GAAG,eAAe,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACjF,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QACzD,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC;YAClC,MAAM;YACN,OAAO,EAAE,qBAAqB,CAAC,OAAO,CAAC;YACvC,YAAY,EAAE,SAAS;YACvB,UAAU,EAAE,KAAK,IAAI,EAAE;gBACrB,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAC9C,IAAI,MAAM,KAAK,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC9C,MAAM,IAAI,0BAA0B,CAAC,kCAAkC,CAAC,CAAC;gBAC3E,CAAC;YACH,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,YAAY;QACV,IAAI,CAAC,MAAM,KAAK,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,yBAAyB,CAAC,CAAC;YAC9D,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,iCAAiC,CAAC,CAAC;YACzE,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,+BAA+B,CAAC,CAAC;YACrE,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;QACvC,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,OAMtD;IACA,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;IAChC,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACrE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;IAClE,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;IAC1E,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,UAAU,CAAC;QAC1B,OAAO,EAAE,CAAU;QACnB,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;QAC7C,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,SAAS,EAAE,UAAU,CAAC,SAAS;KAChC,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,gBAAgB,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;IACjF,MAAM,gBAAgB,GAAG,6BAA6B,CAAC;QACrD,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,aAAa;QACb,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;QAC7C,QAAQ,EAAE,CAAC;QACX,SAAS,EAAE,CAAC;gBACV,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,IAAI,aAAa,EAAE;gBAC1D,IAAI,EAAE,eAAe;gBACrB,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,eAAe;gBAChD,YAAY,EAAE,cAAc;aAC7B,CAAC;KACH,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,UAAU,CAA2B;QAClD,OAAO,EAAE,CAAC;QACV,aAAa;QACb,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;QAC7C,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,sBAAsB,EAAE,gBAAgB,CAAC,MAAM;KAChD,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,UAAU,CAA6B;QACjD,GAAG,QAAQ;QACX,gBAAgB,EAAE,UAAU;QAC5B,eAAe,EAAE,UAAU,CAAC,eAAe;QAC3C,UAAU,EAAE,UAAU,CAAC,UAAU;QACjC,cAAc,EAAE,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CACtD,uBAAuB,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC3D,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,gBAAgB;KACjB,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACjH,MAAM,UAAU,GAAG,MAAM,4BAA4B,CAAC,OAAO,CAAC,YAAY,EAAE;YAC1E,OAAO,EAAE,CAAC;YACV,UAAU;YACV,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;YAC7C,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC;YACtB,OAAO,EAAE,IAAI,UAAU,CAAC,OAAO,CAAC;SACjC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACnB,MAAM,IAAI,GAAG,UAAU,CAAsC;YAC3D,OAAO,EAAE,CAAC;YACV,MAAM;YACN,GAAG;YACH,UAAU,EAAE;gBACV,SAAS,EAAE,aAAa;gBACxB,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,SAAS,EAAE,aAAa,CAAC,EAAE;gBAC3B,UAAU,EAAE,aAAa,CAAC,GAAG;gBAC7B,UAAU,EAAE,UAAU,CAAC,UAAU;aAClC;YACD,UAAU,EAAE,aAAa,CAAC,UAAU;SACrC,CAAC,CAAC;QACH,OAAO,UAAU,CAAC;YAChB,MAAM;YACN,QAAQ,EAAE,UAAU,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACvD,KAAK,EAAE,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC;SAC1D,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,OAMtD;IACA,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;IAChC,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACrE,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACnC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;IAC5D,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IACtD,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;IAC1D,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC,OAAO,CAAC,YAAY,EAAE;QACzE,OAAO,EAAE,CAAC;QACV,UAAU;QACV,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ;QACvC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS;QACzC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ;QACvC,gBAAgB,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB;QACvD,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QACvC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK;QACxC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU;KACnD,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,OAAO,CACvB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EACpB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,EACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,EACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,EAC3B,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CACzD,CAAC;QACF,IAAI,SAAS,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC9D,MAAM,IAAI,0BAA0B,CAAC,4CAA4C,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2CAA2C,CACzD,QAA6B,EAC7B,MAAgC;IAEhC,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,6BAA6B,CAAC,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC9E,IAAI,qBAAqB,CAAC,QAAQ,CAAC,KAAK,qBAAqB,CAAC,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,0BAA0B,CAAC,kDAAkD,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,qCAAqC,CAAC;QAC3C,OAAO,EAAE,CAAC;QACV,MAAM;QACN,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,SAAS;QACjC,cAAc,EAAE,QAAQ,CAAC,GAAG,CAAC,cAAc;QAC3C,SAAS,EAAE,QAAQ;KACpB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,UAAkB,EAClB,KAA4B;IAE5B,OAAO,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,YAA0C,EAC1C,OAA4E,EAC5E,MAAmB;IAEnB,MAAM,YAAY,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CACjE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,EACpD,MAAM,CACP,CAAC,EAAE,MAAM,CAAC,CAAC;QACZ,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,wCAAwC,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACxG,WAAW,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACtC,WAAW,CAAC,SAAS,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAChD,IAAI,SAAS,CAAC,UAAU,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,0BAA0B,CAAC,8DAA8D,CAAC,CAAC;QACvG,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,EAAE,CAAC;IACtE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,8BAA8B,CAC3C,YAA0C,EAC1C,OAAiE,EACjE,MAAmB;IAEnB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACvG,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,wCAAwC,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACjH,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC,IAAI,GAAG,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAC1D,MAAM,IAAI,0BAA0B,CAAC,4DAA4D,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,UAAU,CACjB,UAAkB,EAClB,MAAgC,EAChC,OAA0C;IAE1C,OAAO,UAAU,CAAC;QAChB,OAAO,EAAE,CAAC;QACV,SAAS,EAAE,OAAO;QAClB,UAAU;QACV,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAChB,UAAkB,EAClB,KAA4B;IAE5B,OAAO,UAAU,CAAC;QAChB,OAAO,EAAE,CAAC;QACV,SAAS,EAAE,MAAM;QACjB,UAAU;QACV,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,aAAa;QACzC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ;QAC/B,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,gBAAgB;QAC/C,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW;QACrC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ;QAC/B,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;QACjC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;KACnC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,KAAmE;IACzF,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACrD,WAAW,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC7C,aAAa,CAAC,UAAU,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IACrD,WAAW,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC7C,WAAW,CAAC,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC/C,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAC5C,aAAa,CAAC,KAAK,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;IAC1D,IAAI,KAAK,CAAC,gBAAgB,KAAK,gBAAgB,EAAE,CAAC;QAChD,MAAM,IAAI,0BAA0B,CAAC,0CAA0C,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,UAAU,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,UAAU,CAAC,WAAW,EAAE,CAAC;QAClG,MAAM,IAAI,0BAA0B,CAAC,qDAAqD,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,EAAE,kBAAkB,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACvG,MAAM,IAAI,0BAA0B,CAAC,0CAA0C,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACpE,MAAM,WAAW,GAAG,WAAW,CAAC,UAAU,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IACvE,MAAM,eAAe,GAAG,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;IACnG,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,0BAA0B,CAAC,uCAAuC,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,OAAO,GAAG,qBAAqB,IAAI,KAAK;QAC5C,CAAC,CAAC,UAAU,CAAC;YACX,eAAe;YACf,mBAAmB,EAAE,aAAa,CAAC,KAAK,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;SACrF,CAAC;QACF,CAAC,CAAC,UAAU,CAAC;YACX,eAAe;YACf,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS;gBAC/C,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,CAAC;SACpF,CAAC,CAAC;IACL,IAAI,CAAC,UAAU,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC,kBAAkB,CAAC;WACtF,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC,WAAW,CAAC;WACvD,UAAU,CAAC,SAAS,CAAC,kBAAkB,GAAG,CAAC;WAC3C,UAAU,CAAC,SAAS,CAAC,WAAW,GAAG,UAAU,CAAC,SAAS,CAAC,kBAAkB,EAAE,CAAC;QAChF,MAAM,IAAI,0BAA0B,CAAC,2CAA2C,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,qBAAqB,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,qBAAqB,CAAC,UAAU,CAAC;WACjF,qBAAqB,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,qBAAqB,CAAC,WAAW,CAAC;WACpF,qBAAqB,CAAC,UAAU,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,qBAAqB,CAAC,eAAe,CAAC,EAAE,CAAC;QAC1G,MAAM,IAAI,0BAA0B,CAAC,2CAA2C,CAAC,CAAC;IACpF,CAAC;IACD,0EAA0E;IAC1E,4EAA4E;IAC5E,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,OAAO,EAAE,IAAI,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC;QACtC,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,gBAAgB;QAChB,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,eAAe,EAAE,UAAU,CAAC,eAAe;QAC3C,UAAU;QACV,WAAW;QACX,OAAO;QACP,SAAS,EAAE,EAAE,GAAG,UAAU,CAAC,SAAS,EAAE;KACvC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CACrB,KAA0B,EAC1B,MAAgC;IAEhC,IAAI,QAAiC,CAAC;IACtC,IAAI,CAAC;QACH,QAAQ,GAAG,6BAA6B,CAAC,KAAK,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,0BAA0B,CAAC,8CAA8C,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,EAAE,SAAS,KAAK,aAAa;WACnE,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,qBAAqB,CAAC,MAAM,CAAC;WACrE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,gBAAgB,CAAC;WAClD,KAAK,CAAC,GAAG,CAAC,gBAAgB,GAAG,CAAC;WAC9B,KAAK,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;WACtC,KAAK,CAAC,GAAG,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;WAC5C,KAAK,CAAC,GAAG,CAAC,gBAAgB,KAAK,MAAM,CAAC,gBAAgB;WACtD,KAAK,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;WACtC,KAAK,CAAC,GAAG,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;WACxC,qBAAqB,CAAC,QAAQ,CAAC,KAAK,qBAAqB,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC;WACrF,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,sBAAsB,EAAE,CAAC;QACvD,MAAM,IAAI,0BAA0B,CAAC,mDAAmD,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;IAChD,IAAI,YAAY,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,0BAA0B,CAAC,wCAAwC,CAAC,CAAC;IACjF,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAA+B;IACnD,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;QACpF,MAAM,IAAI,0BAA0B,CAAC,iCAAiC,CAAC,CAAC;IAC1E,CAAC;IACD,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACxC,aAAa,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAChD,aAAa,CAAC,KAAK,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;IAC1D,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACxC,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC1C,aAAa,CAAC,KAAK,CAAC,sBAAsB,EAAE,wBAAwB,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,OAAO,CAAC,GAAW,EAAE,SAAiB,EAAE,GAAW;IAC1D,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnB,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7E,OAAO;QACL,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzB,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC3C,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,GAAW,EAAE,EAAU,EAAE,GAAW,EAAE,UAAkB,EAAE,GAAW;IACpF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;QACjF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;QAChD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC/F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,0BAA0B,CAAC,+CAA+C,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1G,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,MAAyB,EAAE,KAAa;IAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,0BAA0B,CAAC,iBAAiB,KAAK,aAAa,CAAC,CAAC;IACtG,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,WAAW,CAAC,KAAa,EAAE,KAAa;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,0BAA0B,CAAC,iBAAiB,KAAK,aAAa,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,KAAa;IACjD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,0BAA0B,CAAC,iBAAiB,KAAK,aAAa,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,KAAa;IACnD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,0BAA0B,CAAC,iBAAiB,KAAK,mBAAmB,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB;IAClC,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,SAAS,CAAI,OAAmB,EAAE,MAAmB;IAClE,MAAM,CAAC,cAAc,EAAE,CAAC;IACxB,OAAO,MAAM,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC9C,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,YAAY,CAAC,yBAAyB,EAAE,YAAY,CAAC,CAAC,CAAC;QAC/G,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;AACL,CAAC"}