approval-md 0.0.1 → 0.2.0

package/dist/src/cli/setup-common.js

@@ -0,0 +1,376 @@
+/**
+ * What every `approval setup` subcommand shares (SPEC.md §5.2, §10.1; APRV-79).
+ *
+ * `setup` began as one file with four subcommands in it. APRV-78 added
+ * `setup adapter <name>` in a file of its own, and it had to reach back into
+ * `cli/setup.ts` for the front matter — which made a cycle: `setup.ts` imports
+ * the adapter verb to dispatch it, and the adapter verb imports `front`,
+ * `requireHuman` and `SetupDeps` back. ESM tolerates that until the day an
+ * initialisation order changes and a `const` at module scope is `undefined` in
+ * one direction only. APRV-79 adds a THIRD such file (`setup-channel.ts`), so
+ * the cycle is broken by extraction rather than tolerated a second time.
+ *
+ * The rule this file exists to enforce, asserted in `tests/layering.test.ts`:
+ *
+ * ```
+ * setup.ts ──┬─> setup-adapter.ts ──┐
+ *            └─> setup-channel.ts ──┴─> setup-common.ts   (and no arrow back)
+ * ```
+ *
+ * What lives here is what more than one of those three needs: the dependency
+ * bag, the keystore seam, the flag table, the front matter (`--help`, the paths,
+ * the policy, the terminal check), the human-only gate, the `.approval/env`
+ * refusal mapping, the service names, and the plaintext-literal offer. What does
+ * NOT live here is anything one subcommand alone uses: the chat picker is
+ * `setup-channel.ts`'s, the manifest hint generator is `setup-adapter.ts`'s, and
+ * the generated-secret path (`storeGeneratedSecret`) stays with `vault` and
+ * `sampling` in `setup.ts`.
+ *
+ * The reasoning for each decision this file encodes — why the token is never
+ * handled by this process, why a generated value may reach an argv and an
+ * operator's own may not, why every subcommand refuses a non-terminal stdin —
+ * is in `cli/setup.ts`'s module doc, which is the family's front page. It is not
+ * repeated here; this file is the mechanism.
+ */
+import { randomBytes } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { userInfo } from "node:os";
+import { isAbsolute, resolve as resolvePathSegments } from "node:path";
+import { HUMAN_ACTOR_ENV, resolveHumanActor } from "../core/attest.js";
+import { defaultSourceRunner, envFilePathFor, } from "../core/env-file.js";
+import { LEGACY_SERVICE_SAMPLING_SECRET, LEGACY_SERVICE_TELEGRAM_TOKEN, LEGACY_SERVICE_VAULT_PASSPHRASE, scopedService, } from "../core/instance.js";
+import { loadPolicy } from "../core/policy-load.js";
+import { telegramChatEnvFor, telegramTokenEnvFor } from "../core/telegram-config.js";
+import { passphraseEnvFor } from "../core/vault.js";
+import { TELEGRAM_DEFAULT_API_BASE } from "../channels/telegram.js";
+import { boolFlag, parseFlags, stringFlag } from "./args.js";
+import { EXIT_INTEGRITY, EXIT_IO, EXIT_OK, EXIT_USAGE } from "./exit-codes.js";
+import { DEFAULT_LOG_PATH, resolvePath } from "./paths.js";
+import { createPrompter } from "./prompt.js";
+import { refusal as renderRefusal, style } from "./style.js";
+import { usageErrorText } from "./usage.js";
+/** The three item names the instance owning `logPath` reads and writes. */
+export function servicesFor(logPath) {
+    return {
+        telegramToken: scopedService(LEGACY_SERVICE_TELEGRAM_TOKEN, logPath),
+        vaultPassphrase: scopedService(LEGACY_SERVICE_VAULT_PASSPHRASE, logPath),
+        samplingSecret: scopedService(LEGACY_SERVICE_SAMPLING_SECRET, logPath),
+    };
+}
+/**
+ * The variable a sampling secret goes into when the policy names none. The
+ * value is stored either way; what the operator is then told to do is add the
+ * `audit.sampling_secret_env` line, because until the POLICY names a variable
+ * the sampler stays off (SPEC.md §5.2) and no amount of environment fixes that.
+ */
+export const DEFAULT_SAMPLING_ENV = "APPROVAL_SAMPLING_SECRET";
+/** The long-poll `getUpdates` asks for, in seconds. */
+export const POLL_TIMEOUT_SECONDS = 10;
+/** doctor's probe timeout, for the calls that answer immediately. */
+export const PROBE_TIMEOUT_MS = 10_000;
+/** The flags every subcommand accepts. One table, so none of them drifts. */
+export const FLAGS = {
+    "--policy": "string",
+    "--dir": "string",
+    "--log": "string",
+    "--api-base": "string",
+    "--as": "string",
+    "--json": "boolean",
+    "--help": "boolean",
+    "-h": "boolean",
+};
+/** Is `binary` on PATH? An ENOENT from a spawn is the honest way to ask. */
+function onPath(binary, probeArgs) {
+    const result = spawnSync(binary, probeArgs, { encoding: "utf8", stdio: "ignore" });
+    return result.error?.code !== "ENOENT";
+}
+/** A thrown thing, as a sentence. */
+export function detail(cause) {
+    return cause instanceof Error ? cause.message : String(cause);
+}
+/** The real one. Nothing in the test suite constructs it. */
+export const defaultKeystoreRunner = {
+    kind() {
+        if (process.platform === "darwin" && onPath("security", ["help"]))
+            return "keychain";
+        // `secret-tool` with no arguments prints its usage and exits non-zero,
+        // which is all this probe needs: it touches no keyring and unlocks nothing.
+        if (onPath("secret-tool", []))
+            return "secret-service";
+        return "none";
+    },
+    storeGenerated(service, value) {
+        const backend = defaultKeystoreRunner.kind();
+        if (backend === "secret-service") {
+            // `secret-tool store` reads the secret from stdin. One canonical form,
+            // no fallback needed, and the value is never in an argv.
+            const stored = spawnSync("secret-tool", ["store", "--label", service, "approval", service], { encoding: "utf8", input: value });
+            if (stored.error !== undefined) {
+                return { ok: false, message: `secret-tool could not be run: ${detail(stored.error)}` };
+            }
+            return stored.status === 0
+                ? { ok: true, viaArgv: false }
+                : { ok: false, message: `secret-tool store exited ${String(stored.status)}` };
+        }
+        if (backend !== "keychain") {
+            return { ok: false, message: "no OS keystore is available on this machine" };
+        }
+        const account = process.env["USER"] ?? userInfo().username;
+        const base = ["add-generic-password", "-a", account, "-s", service, "-U"];
+        // Attempt one: the value on `security`'s STDIN. Its `-w` with no argument
+        // prompts twice (the value and its confirmation), so it is written twice.
+        //
+        // `detached: true` is load-bearing (APRV-94). `security -w` reads the
+        // secret from the CONTROLLING TTY whenever the process has one and ignores
+        // stdin entirely, so from a real terminal the pipe below was never read:
+        // Apple's "password data for new item:" prompt appeared to the human,
+        // whatever they typed was stored, and only the read-back mismatch and the
+        // argv fallback rescued the run (Ctrl-C at that prompt stored nothing at
+        // all). A detached child starts its own session with no controlling
+        // terminal, so `security` has nothing to prompt on and reads the pipe.
+        // spawnSync still waits for it; detaching changes the session, not the
+        // synchrony. The option is absent from the sync typings (undocumented for
+        // spawnSync, honoured by Node's SyncProcessRunner, verified against Node
+        // 24 with a scratch item), hence the widened type. A Node that ignored it
+        // would land on exactly the pre-APRV-94 path, and the read-back below is
+        // what catches that.
+        //
+        // Exit status is NOT trusted as proof of a correct store. A probe against a
+        // scratch keychain (APRV-74 review) showed `security … -w` with piped stdin
+        // exiting 0 while leaving no findable item under the service name (that
+        // was this same tty behaviour, seen from the other side). So every attempt
+        // is followed by a read-back, and success is "the keystore returns exactly
+        // the bytes we generated", nothing less.
+        const pipedOptions = {
+            encoding: "utf8",
+            input: `${value}\n${value}\n`,
+            detached: true,
+        };
+        const piped = spawnSync("security", [...base, "-w"], pipedOptions);
+        if (piped.error === undefined && piped.status === 0) {
+            const back = defaultKeystoreRunner.read(service);
+            if (back.ok && back.value === value)
+                return { ok: true, viaArgv: false };
+        }
+        // Attempt two, for GENERATED VALUES ONLY: the argv form. See `cli/setup.ts`
+        // for exactly what is being accepted here and why it is not extended to a
+        // value the operator brought with them.
+        const argv = spawnSync("security", [...base, "-w", value], { encoding: "utf8" });
+        if (argv.error !== undefined) {
+            return { ok: false, message: `security could not be run: ${detail(argv.error)}` };
+        }
+        if (argv.status === 0) {
+            const back = defaultKeystoreRunner.read(service);
+            if (back.ok && back.value === value)
+                return { ok: true, viaArgv: true };
+            return {
+                ok: false,
+                message: `security add-generic-password reported success for service ${JSON.stringify(service)} but the read-back did not return the stored value; nothing this run wrote can be trusted, inspect the keychain by hand`,
+            };
+        }
+        return {
+            ok: false,
+            message: `security add-generic-password exited ${String(argv.status)} for service ${JSON.stringify(service)}`,
+        };
+    },
+    storePrompted(service) {
+        const backend = defaultKeystoreRunner.kind();
+        if (backend === "keychain") {
+            const account = process.env["USER"] ?? userInfo().username;
+            // `stdio: "inherit"`: Apple's own prompt owns the terminal for the length
+            // of this call, and the value it reads is never seen by this process.
+            const result = spawnSync("security", ["add-generic-password", "-a", account, "-s", service, "-U", "-w"], { stdio: "inherit" });
+            if (result.error !== undefined) {
+                return { ok: false, message: `security could not be run: ${detail(result.error)}` };
+            }
+            return result.status === 0
+                ? { ok: true, viaArgv: false }
+                : { ok: false, message: `security add-generic-password exited ${String(result.status)}` };
+        }
+        if (backend === "secret-service") {
+            const result = spawnSync("secret-tool", ["store", "--label", service, "approval", service], { stdio: "inherit" });
+            if (result.error !== undefined) {
+                return { ok: false, message: `secret-tool could not be run: ${detail(result.error)}` };
+            }
+            return result.status === 0
+                ? { ok: true, viaArgv: false }
+                : { ok: false, message: `secret-tool store exited ${String(result.status)}` };
+        }
+        return { ok: false, message: "no OS keystore is available on this machine" };
+    },
+    read(service) {
+        const backend = defaultKeystoreRunner.kind();
+        const outcome = backend === "keychain"
+            ? defaultSourceRunner.keychain(service)
+            : defaultSourceRunner.secretService(service);
+        return outcome.ok ? { ok: true, value: outcome.value } : { ok: false, message: outcome.message };
+    },
+};
+/** The `.approval/env` scheme a backend writes. */
+export function schemeFor(kind, service) {
+    if (kind === "keychain")
+        return `keychain:${service}`;
+    if (kind === "secret-service")
+        return `secret-service:${service}`;
+    return null;
+}
+/** The command an operator runs by hand to see that the item is really there. */
+export function retrievalCommand(kind, service) {
+    return kind === "keychain"
+        ? `security find-generic-password -a "$USER" -s ${service} -w`
+        : `secret-tool lookup approval ${service}`;
+}
+/** The command an operator runs by hand to STORE the item, with no value in it. */
+export function storageCommand(kind, service) {
+    return kind === "secret-service"
+        ? `secret-tool store --label ${service} approval ${service}`
+        : `security add-generic-password -a "$USER" -s ${service} -U -w`;
+}
+export function usageError(streams, json, message, helpText) {
+    if (json)
+        streams.err(`${JSON.stringify({ error: { code: "usage", message } })}\n`);
+    else
+        streams.err(usageErrorText(message, helpText));
+    return EXIT_USAGE;
+}
+/**
+ * A refused PROMPT, as one line and no help page (APRV-90).
+ *
+ * The distinction this function exists to draw: {@link usageError} answers a
+ * mangled command line, so it names the shape that line should have had, which
+ * is the thing the operator got wrong. A prompt that was aborted or answered
+ * wrongly five times is not a command line at all — the operator was in a
+ * conversation, the question was on screen, and a usage block under it teaches
+ * nothing. Same exit code (the frozen table is unchanged), one line of output,
+ * and not even the `--help` pointer a usage error carries.
+ */
+export function promptRefusal(streams, message) {
+    streams.err(`approval: ${message}\n`);
+    return EXIT_USAGE;
+}
+export function absolute(value, cwd) {
+    return isAbsolute(value) ? value : resolvePathSegments(cwd, value);
+}
+export function refusalExitCode(refusal) {
+    return refusal.code === "env-file-io" || refusal.code === "env-file-mode"
+        ? EXIT_IO
+        : EXIT_INTEGRITY;
+}
+export function emitRefusal(streams, refusal) {
+    streams.err(`${renderRefusal(style(), refusal.code, refusal.message)}\n`);
+    return refusalExitCode(refusal);
+}
+/** The policy's `audit.sampling_secret_env`, or `null`. */
+export function samplingEnvName(load) {
+    if (!load.ok)
+        return null;
+    const declared = load.policy.audit?.sampling_secret_env;
+    return typeof declared === "string" && declared.length > 0 ? declared : null;
+}
+export function hintContextFor(load, envPath, kind, services) {
+    return {
+        envPath,
+        kind,
+        services,
+        passphraseEnv: passphraseEnvFor(load),
+        samplingEnv: samplingEnvName(load) ?? DEFAULT_SAMPLING_ENV,
+        tokenEnv: telegramTokenEnvFor(load),
+        chatEnv: telegramChatEnvFor(load),
+    };
+}
+/**
+ * `--help`, the paths, the policy, the terminal check.
+ *
+ * The terminal check has no `process.stdin.isTTY` in it, deliberately: the real
+ * prompter refuses to construct without one ({@link createPrompter}), so "there
+ * is no prompter" IS "there is no terminal", and a test that injects one has
+ * not bypassed a check that a CI job could also bypass — it has supplied the
+ * human's side of the conversation, which is the only thing a test can honestly
+ * do here.
+ */
+export function front(subcommand, argv, streams, cwd, deps, helpText, nonInteractiveHint, 
+/**
+ * Flags this subcommand accepts on top of the shared table (APRV-110).
+ *
+ * `setup service` is the first subcommand whose subject is not a credential,
+ * so it needs words the other four have no use for (a platform, a unit label,
+ * a log directory). They are passed in rather than added to {@link FLAGS},
+ * because a flag every subcommand silently accepts is a flag an operator will
+ * eventually pass to the one that ignores it.
+ */
+extraFlags = {}) {
+    const json = argv.includes("--json");
+    const parsed = parseFlags(argv, { ...FLAGS, ...extraFlags });
+    if (!parsed.ok)
+        return { kind: "handled", code: usageError(streams, json, parsed.message, helpText) };
+    if (boolFlag(parsed.flags, "--help") || boolFlag(parsed.flags, "-h")) {
+        streams.out(`${helpText}\n`);
+        return { kind: "handled", code: EXIT_OK };
+    }
+    const logPath = resolvePath(stringFlag(parsed.flags, "--log"), DEFAULT_LOG_PATH, cwd);
+    const envPath = envFilePathFor(logPath);
+    const policyFlag = stringFlag(parsed.flags, "--policy");
+    const dirFlag = stringFlag(parsed.flags, "--dir");
+    const load = loadPolicy(policyFlag !== null
+        ? { file: absolute(policyFlag, cwd) }
+        : { dir: dirFlag === null ? cwd : absolute(dirFlag, cwd) });
+    const keystore = deps.keystore ?? defaultKeystoreRunner;
+    const kind = keystore.kind();
+    const services = servicesFor(logPath);
+    const prompter = deps.prompter ?? createPrompter(streams);
+    if (json || prompter === null) {
+        streams.err(`approval: \`approval setup ${subcommand}\` is interactive and ${json
+            ? "--json was given"
+            : "stdin is not a terminal"}. Nothing was written.\n\nIdentity is declared, not proved, so establishing it — and the credentials beside it — is an act of the human at the machine, not something a pipe or a CI job can do. The non-interactive path is explicit, and here it is:\n\n${nonInteractiveHint(hintContextFor(load, envPath, kind, services))}\n\nThen check it with \`approval env --check\`, which prints no values.\n`);
+        return { kind: "handled", code: EXIT_USAGE };
+    }
+    return {
+        kind: "run",
+        flags: parsed.flags,
+        positionals: parsed.positionals,
+        prompter,
+        keystore,
+        backend: kind,
+        load,
+        logPath,
+        envPath,
+        services,
+        apiBase: deps.apiBase ?? stringFlag(parsed.flags, "--api-base") ?? TELEGRAM_DEFAULT_API_BASE,
+        generate: deps.generate ?? (() => randomBytes(32).toString("base64")),
+        pollTimeoutSeconds: deps.pollTimeoutSeconds ?? POLL_TIMEOUT_SECONDS,
+    };
+}
+/** The human-only rule, spelled exactly as `vault set` spells it. */
+export function requireHuman(flags, streams, helpText, verb) {
+    const asFlag = stringFlag(flags, "--as");
+    const actor = resolveHumanActor(asFlag === null ? {} : { actor: asFlag });
+    if (actor !== null)
+        return { ok: true, actor };
+    return {
+        ok: false,
+        code: usageError(streams, false, asFlag === null
+            ? `no human identity: set ${HUMAN_ACTOR_ENV}=human:<id> or pass --as human:<id>. \`approval setup identity\` is the verb that establishes it, and it is the one subcommand exempt from this check`
+            : `--as expects a human identity matching human:<id>, got ${JSON.stringify(asFlag)}; \`approval setup ${verb}\` stores a credential and is human-only`, helpText),
+    };
+}
+// ---------------------------------------------------------------------------
+// The plaintext-literal offer
+// ---------------------------------------------------------------------------
+/**
+ * The plaintext-literal offer, for a machine with no keystore.
+ *
+ * An explicit typed `yes` — not `y`, not Enter — because the whole content of
+ * this question is that the operator understood it. The warning is worded to
+ * match what `approval env --check` will print at them on every run afterwards,
+ * so the two never read as different claims about the same file.
+ */
+export function offerLiteral(streams, prompter, envPath, what) {
+    streams.out(`\nThis machine has no OS keystore this runtime can drive: \`security\` (macOS) and\n\`secret-tool\` (Linux, libsecret) are both absent, so there is nowhere to put the\n${what} except ${envPath} itself, in plaintext.\n\nThat is PERMITTED and it is always reported: \`approval env --check\` will list the\nvariable under PLAINTEXT for as long as the line exists. The file is mode 0600 and\n\`approval init\` gitignores it. A rule people route around is not a control — the\nalternative to writing it here is writing it into a shell profile, where nothing in\nthis runtime can see it to tell you.\n\n`);
+    const answer = prompter.readLine(`type \`yes\` in full to write it in plaintext: `);
+    const typed = (answer ?? "").trim();
+    if (typed === "yes")
+        return true;
+    streams.out("not confirmed: nothing was stored and nothing was written\n");
+    return false;
+}
+//# sourceMappingURL=setup-common.js.map

package/dist/src/cli/setup-common.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-common.js","sourceRoot":"","sources":["../../../src/cli/setup-common.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAA2C,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAEvE,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EACL,mBAAmB,EACnB,cAAc,GAEf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,8BAA8B,EAC9B,6BAA6B,EAC7B,+BAA+B,EAC/B,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAyB,MAAM,wBAAwB,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACrF,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAGpD,OAAO,EAAE,yBAAyB,EAAsB,MAAM,yBAAyB,CAAC;AACxF,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAiB,MAAM,WAAW,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE/E,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAiB,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AA2B5C,2EAA2E;AAC3E,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,OAAO;QACL,aAAa,EAAE,aAAa,CAAC,6BAA6B,EAAE,OAAO,CAAC;QACpE,eAAe,EAAE,aAAa,CAAC,+BAA+B,EAAE,OAAO,CAAC;QACxE,cAAc,EAAE,aAAa,CAAC,8BAA8B,EAAE,OAAO,CAAC;KACvE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,0BAA0B,CAAC;AAE/D,uDAAuD;AACvD,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEvC,qEAAqE;AACrE,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEvC,6EAA6E;AAC7E,MAAM,CAAC,MAAM,KAAK,GAA6B;IAC7C,UAAU,EAAE,QAAQ;IACpB,OAAO,EAAE,QAAQ;IACjB,OAAO,EAAE,QAAQ;IACjB,YAAY,EAAE,QAAQ;IACtB,MAAM,EAAE,QAAQ;IAChB,QAAQ,EAAE,SAAS;IACnB,QAAQ,EAAE,SAAS;IACnB,IAAI,EAAE,SAAS;CAChB,CAAC;AA8CF,4EAA4E;AAC5E,SAAS,MAAM,CAAC,MAAc,EAAE,SAAmB;IACjD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnF,OAAQ,MAAM,CAAC,KAA2C,EAAE,IAAI,KAAK,QAAQ,CAAC;AAChF,CAAC;AAED,qCAAqC;AACrC,MAAM,UAAU,MAAM,CAAC,KAAc;IACnC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,6DAA6D;AAC7D,MAAM,CAAC,MAAM,qBAAqB,GAAmB;IACnD,IAAI;QACF,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC;YAAE,OAAO,UAAU,CAAC;QACrF,uEAAuE;QACvE,4EAA4E;QAC5E,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE,CAAC;YAAE,OAAO,gBAAgB,CAAC;QACvD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,cAAc,CAAC,OAAe,EAAE,KAAa;QAC3C,MAAM,OAAO,GAAG,qBAAqB,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;YACjC,uEAAuE;YACvE,yDAAyD;YACzD,MAAM,MAAM,GAAG,SAAS,CACtB,aAAa,EACb,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,EAClD,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CACnC,CAAC;YACF,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,iCAAiC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACzF,CAAC;YACD,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC;gBACxB,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE;gBAC9B,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,4BAA4B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QAClF,CAAC;QACD,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;YAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,6CAA6C,EAAE,CAAC;QAC/E,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC,QAAQ,CAAC;QAC3D,MAAM,IAAI,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAE1E,0EAA0E;QAC1E,0EAA0E;QAC1E,EAAE;QACF,sEAAsE;QACtE,2EAA2E;QAC3E,yEAAyE;QACzE,sEAAsE;QACtE,0EAA0E;QAC1E,yEAAyE;QACzE,oEAAoE;QACpE,uEAAuE;QACvE,uEAAuE;QACvE,0EAA0E;QAC1E,yEAAyE;QACzE,0EAA0E;QAC1E,yEAAyE;QACzE,qBAAqB;QACrB,EAAE;QACF,4EAA4E;QAC5E,4EAA4E;QAC5E,wEAAwE;QACxE,2EAA2E;QAC3E,2EAA2E;QAC3E,yCAAyC;QACzC,MAAM,YAAY,GAA+D;YAC/E,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,GAAG,KAAK,KAAK,KAAK,IAAI;YAC7B,QAAQ,EAAE,IAAI;SACf,CAAC;QACF,MAAM,KAAK,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3E,CAAC;QAED,4EAA4E;QAC5E,0EAA0E;QAC1E,wCAAwC;QACxC,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC,GAAG,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACjF,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,8BAA8B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACpF,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACxE,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,8DAA8D,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,yHAAyH;aACxN,CAAC;QACJ,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,wCAAwC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE;SAC9G,CAAC;IACJ,CAAC;IAED,aAAa,CAAC,OAAe;QAC3B,MAAM,OAAO,GAAG,qBAAqB,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC,QAAQ,CAAC;YAC3D,0EAA0E;YAC1E,sEAAsE;YACtE,MAAM,MAAM,GAAG,SAAS,CACtB,UAAU,EACV,CAAC,sBAAsB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAClE,EAAE,KAAK,EAAE,SAAS,EAAE,CACrB,CAAC;YACF,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,8BAA8B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACtF,CAAC;YACD,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC;gBACxB,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE;gBAC9B,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,wCAAwC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QAC9F,CAAC;QACD,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,SAAS,CACtB,aAAa,EACb,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,EAClD,EAAE,KAAK,EAAE,SAAS,EAAE,CACrB,CAAC;YACF,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,iCAAiC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACzF,CAAC;YACD,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC;gBACxB,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE;gBAC9B,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,4BAA4B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QAClF,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,6CAA6C,EAAE,CAAC;IAC/E,CAAC;IAED,IAAI,CAAC,OAAe;QAClB,MAAM,OAAO,GAAG,qBAAqB,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,OAAO,GACX,OAAO,KAAK,UAAU;YACpB,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC,OAAO,CAAC;YACvC,CAAC,CAAC,mBAAmB,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QACjD,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;IACnG,CAAC;CACF,CAAC;AAEF,mDAAmD;AACnD,MAAM,UAAU,SAAS,CAAC,IAAkB,EAAE,OAAe;IAC3D,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,YAAY,OAAO,EAAE,CAAC;IACtD,IAAI,IAAI,KAAK,gBAAgB;QAAE,OAAO,kBAAkB,OAAO,EAAE,CAAC;IAClE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,gBAAgB,CAAC,IAAkB,EAAE,OAAe;IAClE,OAAO,IAAI,KAAK,UAAU;QACxB,CAAC,CAAC,gDAAgD,OAAO,KAAK;QAC9D,CAAC,CAAC,+BAA+B,OAAO,EAAE,CAAC;AAC/C,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,cAAc,CAAC,IAAkB,EAAE,OAAe;IAChE,OAAO,IAAI,KAAK,gBAAgB;QAC9B,CAAC,CAAC,6BAA6B,OAAO,aAAa,OAAO,EAAE;QAC5D,CAAC,CAAC,+CAA+C,OAAO,QAAQ,CAAC;AACrE,CAAC;AAiDD,MAAM,UAAU,UAAU,CACxB,OAAgB,EAChB,IAAa,EACb,OAAe,EACf,QAAgB;IAEhB,IAAI,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;;QAC/E,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IACpD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,OAAgB,EAAE,OAAe;IAC7D,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,IAAI,CAAC,CAAC;IACtC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAa,EAAE,GAAW;IACjD,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAuB;IACrD,OAAO,OAAO,CAAC,IAAI,KAAK,aAAa,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe;QACvE,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,cAAc,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAAgB,EAAE,OAAuB;IACnE,OAAO,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1E,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;AAClC,CAAC;AA6CD,2DAA2D;AAC3D,MAAM,UAAU,eAAe,CAAC,IAAsB;IACpD,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,mBAAmB,CAAC;IACxD,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,IAAsB,EACtB,OAAe,EACf,IAAkB,EAClB,QAAsB;IAEtB,OAAO;QACL,OAAO;QACP,IAAI;QACJ,QAAQ;QACR,aAAa,EAAE,gBAAgB,CAAC,IAAI,CAAC;QACrC,WAAW,EAAE,eAAe,CAAC,IAAI,CAAC,IAAI,oBAAoB;QAC1D,QAAQ,EAAE,mBAAmB,CAAC,IAAI,CAAC;QACnC,OAAO,EAAE,kBAAkB,CAAC,IAAI,CAAC;KAClC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,KAAK,CACnB,UAAkB,EAClB,IAAc,EACd,OAAgB,EAChB,GAAW,EACX,IAAe,EACf,QAAgB,EAChB,kBAAoD;AACpD;;;;;;;;GAQG;AACH,UAAU,GAA6B,EAAE;IAEzC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,GAAG,KAAK,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;IACtG,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,GAAG,QAAQ,IAAI,CAAC,CAAC;QAC7B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC5C,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;IACtF,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,UAAU,CACrB,UAAU,KAAK,IAAI;QACjB,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE;QACrC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAC7D,CAAC;IAEF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,qBAAqB,CAAC;IACxD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC;IAE1D,IAAI,IAAI,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CACT,8BAA8B,UAAU,yBACtC,IAAI;YACF,CAAC,CAAC,kBAAkB;YACpB,CAAC,CAAC,yBACN,6PAA6P,kBAAkB,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,4EAA4E,CAC3Y,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC/C,CAAC;IAED,OAAO;QACL,IAAI,EAAE,KAAK;QACX,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,QAAQ;QACR,QAAQ;QACR,OAAO,EAAE,IAAI;QACb,IAAI;QACJ,OAAO;QACP,OAAO;QACP,QAAQ;QACR,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,yBAAyB;QAC5F,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACrE,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,IAAI,oBAAoB;KACpE,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,YAAY,CAC1B,KAAuC,EACvC,OAAgB,EAChB,QAAgB,EAChB,IAAY;IAEZ,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1E,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC/C,OAAO;QACL,EAAE,EAAE,KAAK;QACT,IAAI,EAAE,UAAU,CACd,OAAO,EACP,KAAK,EACL,MAAM,KAAK,IAAI;YACb,CAAC,CAAC,0BAA0B,eAAe,uJAAuJ;YAClM,CAAC,CAAC,0DAA0D,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,sBAAsB,IAAI,0CAA0C,EACxJ,QAAQ,CACT;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,8BAA8B;AAC9B,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAgB,EAChB,QAAkB,EAClB,OAAe,EACf,IAAY;IAEZ,OAAO,CAAC,GAAG,CACT,2KAA2K,IAAI,WAAW,OAAO,sZAAsZ,CACxlB,CAAC;IACF,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,iDAAiD,CAAC,CAAC;IACpF,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;IAC3E,OAAO,KAAK,CAAC;AACf,CAAC"}