approval-md 0.3.0 → 0.4.0

package/dist/src/cli/channel-relay.d.ts

@@ -0,0 +1,108 @@
+/**
+ * `approval channel relay` — gestures an operator's authenticated relay
+ * carries (SPEC.md §10.3, APRV-455).
+ *
+ * The third arrival of a human gesture, beside a Telegram tap and a terminal.
+ * An operator's control plane holds an EdgeOS session for the person, shows
+ * them a request or their policy, and posts what they did here: the gesture,
+ * the EdgeOS `/humans/me` id of the session that made it, the hash or the key
+ * it answers, and a nonce. `channels/relay-server.ts` authenticates the post
+ * and `channels/relay.ts` turns it into a log event through the one function a
+ * Telegram tap goes through. This file resolves configuration, refuses what it
+ * must refuse, binds a port and reports; it decides nothing.
+ *
+ * ## The refusals that are the point
+ *
+ * 1. **The secret comes from the launch environment, never from the tree.**
+ *    `APPROVAL_RELAY_SECRET`, refused when unset, when shorter than a value a
+ *    host would generate, and when it holds a character a header cannot carry
+ *    unambiguously (SPEC.md §11.1 invariant 7). It is a conventional name,
+ *    beside `APPROVAL_TG_WEBHOOK_SECRET`, for that variable's reason: the
+ *    policy decides WHETHER a channel exists, never the value that
+ *    authenticates it, and a second declaration would be a second place for
+ *    one fact to be wrong. Under the `APPROVAL_` prefix it is withheld from
+ *    every child `approval run` spawns (`core/child-env.ts`), and the hook
+ *    classifier holds this command line `policy.core`, so an agent session
+ *    cannot start a relay with a secret of its own.
+ * 2. **No human identity.** This verb takes no `--as` and reads no
+ *    `APPROVAL_HUMAN`. Every gesture is attributed to the account the attested
+ *    policy maps, or refused `sender-unmapped`.
+ * 3. **A post without the secret decides nothing and appends nothing.**
+ *
+ * ## Why there is no transport lease
+ *
+ * A Telegram bot admits one receiver, so its transports take a lease. A relay
+ * has no such constraint: two relays on one gate would each record through
+ * compare-and-append, the gate would answer a duplicate decision
+ * `already-decided`, and the nonce ledger is a directory of exclusively linked files that
+ * refuses a replay whichever relay it reaches. A second relay on the SAME port
+ * fails to bind and says so.
+ *
+ * ## Where TLS is
+ *
+ * Not here, exactly as for `approval serve` and the webhook. Loopback by
+ * default, behind whatever the operator puts in front of it; a routable bind
+ * takes two flags and prints a banner, because the secret travels in a header.
+ */
+import type { Streams } from "./main.js";
+/** The environment variable the shared secret is read from. */
+export declare const RELAY_SECRET_ENV = "APPROVAL_RELAY_SECRET";
+/** The shortest secret this verb starts with: `serve`'s floor, for its reason. */
+export declare const RELAY_MIN_SECRET_LENGTH = 24;
+/**
+ * Why the relay could not start. A closed union, distinct per repair (SPEC.md
+ * §11.1 invariant 6). Its per-request refusals are `RELAY_REFUSAL_CODES`.
+ */
+export declare const RELAY_START_REFUSAL_CODES: readonly [
+/** `APPROVAL_RELAY_SECRET` is unset or empty. */
+"relay-secret-missing", 
+/** It is shorter than {@link RELAY_MIN_SECRET_LENGTH}. */
+"relay-secret-weak", 
+/** It holds a character outside A-Z a-z 0-9 _ -, or is longer than 256. */
+"relay-secret-charset", 
+/** `--proposer` is not an `agent:` id. */
+"relay-proposer-invalid", 
+/** The bind flags do not name a usable loopback (or explicitly widened) address. */
+"relay-bind-invalid"];
+export type RelayStartRefusalCode = (typeof RELAY_START_REFUSAL_CODES)[number];
+export interface RelaySetup {
+    logPath: string;
+    policy: {
+        dir?: string;
+        file?: string;
+    };
+    secret: string;
+    host: string;
+    port: number;
+    proposer: string;
+    json: boolean;
+}
+export type RelayPreparation = {
+    ok: true;
+    setup: RelaySetup;
+} | {
+    ok: false;
+    code: RelayStartRefusalCode;
+    message: string;
+};
+export interface RelayRequest {
+    logPath: string;
+    policy: {
+        dir?: string;
+        file?: string;
+    };
+    listen: string | null;
+    port: string | null;
+    allowNonLoopback: boolean;
+    proposer: string | null;
+    json: boolean;
+    env?: NodeJS.ProcessEnv;
+}
+/** Everything that can fail without binding a port. Prints nothing. */
+export declare function prepareRelay(request: RelayRequest): RelayPreparation;
+/** The banner a routable bind prints, every time, on stderr. */
+export declare function relayNonLoopbackBanner(host: string, port: number): string;
+/** Run the relay until a signal stops it. */
+export declare function runRelay(setup: RelaySetup, streams: Streams): Promise<number>;
+/** `approval channel relay [flags]`. */
+export declare function commandChannelRelay(argv: string[], streams: Streams, cwd: string): Promise<number>;

package/dist/src/cli/channel-relay.js

@@ -0,0 +1,334 @@
+/**
+ * `approval channel relay` — gestures an operator's authenticated relay
+ * carries (SPEC.md §10.3, APRV-455).
+ *
+ * The third arrival of a human gesture, beside a Telegram tap and a terminal.
+ * An operator's control plane holds an EdgeOS session for the person, shows
+ * them a request or their policy, and posts what they did here: the gesture,
+ * the EdgeOS `/humans/me` id of the session that made it, the hash or the key
+ * it answers, and a nonce. `channels/relay-server.ts` authenticates the post
+ * and `channels/relay.ts` turns it into a log event through the one function a
+ * Telegram tap goes through. This file resolves configuration, refuses what it
+ * must refuse, binds a port and reports; it decides nothing.
+ *
+ * ## The refusals that are the point
+ *
+ * 1. **The secret comes from the launch environment, never from the tree.**
+ *    `APPROVAL_RELAY_SECRET`, refused when unset, when shorter than a value a
+ *    host would generate, and when it holds a character a header cannot carry
+ *    unambiguously (SPEC.md §11.1 invariant 7). It is a conventional name,
+ *    beside `APPROVAL_TG_WEBHOOK_SECRET`, for that variable's reason: the
+ *    policy decides WHETHER a channel exists, never the value that
+ *    authenticates it, and a second declaration would be a second place for
+ *    one fact to be wrong. Under the `APPROVAL_` prefix it is withheld from
+ *    every child `approval run` spawns (`core/child-env.ts`), and the hook
+ *    classifier holds this command line `policy.core`, so an agent session
+ *    cannot start a relay with a secret of its own.
+ * 2. **No human identity.** This verb takes no `--as` and reads no
+ *    `APPROVAL_HUMAN`. Every gesture is attributed to the account the attested
+ *    policy maps, or refused `sender-unmapped`.
+ * 3. **A post without the secret decides nothing and appends nothing.**
+ *
+ * ## Why there is no transport lease
+ *
+ * A Telegram bot admits one receiver, so its transports take a lease. A relay
+ * has no such constraint: two relays on one gate would each record through
+ * compare-and-append, the gate would answer a duplicate decision
+ * `already-decided`, and the nonce ledger is a directory of exclusively linked files that
+ * refuses a replay whichever relay it reaches. A second relay on the SAME port
+ * fails to bind and says so.
+ *
+ * ## Where TLS is
+ *
+ * Not here, exactly as for `approval serve` and the webhook. Loopback by
+ * default, behind whatever the operator puts in front of it; a routable bind
+ * takes two flags and prints a banner, because the secret travels in a header.
+ */
+import { isAbsolute, join, resolve as resolvePathSegments } from "node:path";
+import { RELAY_DEFAULT_HOST, RELAY_DEFAULT_PORT, RELAY_DEFAULT_PROPOSER, RELAY_PATH, RELAY_SECRET_HEADER, fileNonceLedger, } from "../channels/relay.js";
+import { serveRelay } from "../channels/relay-server.js";
+import { channelLeaseDirFor } from "../core/channel-lease.js";
+import { readGatePolicy } from "../core/gate.js";
+import { mapsSendersFor } from "../core/sender-identity.js";
+import { readVerifiedRecords } from "../core/state.js";
+import { boolFlag, parseFlags, stringFlag } from "./args.js";
+import { EXIT_INTEGRITY, EXIT_IO, EXIT_OK, EXIT_TORN_TAIL, EXIT_USAGE } from "./exit-codes.js";
+import { CHANNEL_RELAY_HELP } from "./help.js";
+import { isLoopbackHost, parseListen } from "./mcp.js";
+import { DEFAULT_LOG_PATH, resolvePath } from "./paths.js";
+import { usageErrorText } from "./usage.js";
+/** The environment variable the shared secret is read from. */
+export const RELAY_SECRET_ENV = "APPROVAL_RELAY_SECRET";
+/** The shortest secret this verb starts with: `serve`'s floor, for its reason. */
+export const RELAY_MIN_SECRET_LENGTH = 24;
+/** What a header carries unambiguously, and what `openssl rand -hex` produces. */
+const SECRET_CHARSET = /^[A-Za-z0-9_-]{1,256}$/u;
+/**
+ * A proposer is an `agent:` id. The relay is a machine carrying a proposal the
+ * control plane rendered, and recording it under a `human:` id would say a
+ * person proposed something nobody typed (APRV-455 refuter L1).
+ */
+const PROPOSER_PATTERN = /^agent:[^\s]+$/u;
+const RELAY_FLAGS = {
+    "--listen": "string",
+    "--port": "string",
+    "--allow-non-loopback": "boolean",
+    "--log": "string",
+    "--policy": "string",
+    "--dir": "string",
+    "--proposer": "string",
+    "--json": "boolean",
+    "--help": "boolean",
+    "-h": "boolean",
+};
+/**
+ * Why the relay could not start. A closed union, distinct per repair (SPEC.md
+ * §11.1 invariant 6). Its per-request refusals are `RELAY_REFUSAL_CODES`.
+ */
+export const RELAY_START_REFUSAL_CODES = [
+    /** `APPROVAL_RELAY_SECRET` is unset or empty. */
+    "relay-secret-missing",
+    /** It is shorter than {@link RELAY_MIN_SECRET_LENGTH}. */
+    "relay-secret-weak",
+    /** It holds a character outside A-Z a-z 0-9 _ -, or is longer than 256. */
+    "relay-secret-charset",
+    /** `--proposer` is not an `agent:` id. */
+    "relay-proposer-invalid",
+    /** The bind flags do not name a usable loopback (or explicitly widened) address. */
+    "relay-bind-invalid",
+];
+/** Everything that can fail without binding a port. Prints nothing. */
+export function prepareRelay(request) {
+    const environment = request.env ?? process.env;
+    const raw = environment[RELAY_SECRET_ENV];
+    const secret = raw === undefined ? "" : raw.trim();
+    if (secret.length === 0) {
+        return {
+            ok: false,
+            code: "relay-secret-missing",
+            message: `no ${RELAY_SECRET_ENV} in the environment. The relay's only authentication is this shared secret, carried in ${RELAY_SECRET_HEADER}; without one, any post that looked like a gesture would be one. Generate it (\`openssl rand -hex 32\`), give the same value to the control plane, and set it in the environment this process is launched from, never in a file in the tree`,
+        };
+    }
+    if (!SECRET_CHARSET.test(secret)) {
+        return {
+            ok: false,
+            code: "relay-secret-charset",
+            message: `${RELAY_SECRET_ENV} holds a value outside 1 to 256 characters of A-Z, a-z, 0-9, underscore and hyphen, which a header cannot be relied on to carry byte for byte. Its value is not shown here and is in no message this process writes`,
+        };
+    }
+    if (secret.length < RELAY_MIN_SECRET_LENGTH) {
+        return {
+            ok: false,
+            code: "relay-secret-weak",
+            message: `${RELAY_SECRET_ENV} is shorter than ${String(RELAY_MIN_SECRET_LENGTH)} characters. Generate it (\`openssl rand -hex 32\`) rather than choosing it: it is the whole of what separates the operator's relay from anyone who can reach this port`,
+        };
+    }
+    const proposer = request.proposer ?? RELAY_DEFAULT_PROPOSER;
+    if (!PROPOSER_PATTERN.test(proposer)) {
+        return {
+            ok: false,
+            code: "relay-proposer-invalid",
+            message: `--proposer ${JSON.stringify(proposer)} is not an agent:<id> actor. A proposal is recorded under it, and the relay is a machine carrying what the control plane rendered: a human: id would say a person proposed something nobody typed`,
+        };
+    }
+    if (request.listen !== null && request.port !== null) {
+        return {
+            ok: false,
+            code: "relay-bind-invalid",
+            message: "--listen and --port name the same thing; pass one. --listen <[host:]port> is the only way to bind a non-loopback interface",
+        };
+    }
+    let host = RELAY_DEFAULT_HOST;
+    let port = RELAY_DEFAULT_PORT;
+    if (request.listen !== null) {
+        const bind = parseListen(request.listen);
+        if (!bind.ok)
+            return { ok: false, code: "relay-bind-invalid", message: bind.message };
+        host = bind.host;
+        port = bind.port;
+    }
+    else if (request.port !== null) {
+        if (!/^\d+$/u.test(request.port.trim())) {
+            return {
+                ok: false,
+                code: "relay-bind-invalid",
+                message: `--port expects a whole number, got ${JSON.stringify(request.port)}`,
+            };
+        }
+        port = Number(request.port.trim());
+    }
+    if (port < 1 || port > 65535) {
+        return {
+            ok: false,
+            code: "relay-bind-invalid",
+            message: `the bind port ${String(port)} is outside 1..65535. Port 0 is refused too: the control plane posts to a fixed address, and an ephemeral port is one nobody would find`,
+        };
+    }
+    if (!isLoopbackHost(host) && !request.allowNonLoopback) {
+        return {
+            ok: false,
+            code: "relay-bind-invalid",
+            message: `--listen ${JSON.stringify(host)} is not the loopback interface, and this process speaks plain HTTP: the relay secret arrives in a header and a cleartext hop hands it to whoever is on it. Add --allow-non-loopback if you meant it and TLS is terminated in front of this process`,
+        };
+    }
+    return {
+        ok: true,
+        setup: {
+            logPath: request.logPath,
+            policy: request.policy,
+            secret,
+            host,
+            port,
+            proposer,
+            json: request.json,
+        },
+    };
+}
+function usageError(streams, json, code, message) {
+    if (json)
+        streams.err(`${JSON.stringify({ error: { code, message } })}\n`);
+    else
+        streams.err(usageErrorText(message, CHANNEL_RELAY_HELP));
+    return EXIT_USAGE;
+}
+function failure(streams, json, code, message, exit) {
+    if (json)
+        streams.err(`${JSON.stringify({ error: { code, message } })}\n`);
+    else
+        streams.err(`approval: ${message}\n`);
+    return exit;
+}
+/** The banner a routable bind prints, every time, on stderr. */
+export function relayNonLoopbackBanner(host, port) {
+    return [
+        "",
+        "  !! the approval relay IS BOUND TO A NON-LOOPBACK INTERFACE !!",
+        `  ${host}:${String(port)} is reachable by anyone who can route to it, and this`,
+        "  process speaks PLAIN HTTP. The relay secret travels in a header, and a",
+        "  cleartext hop hands it to whoever is on it. Terminate TLS in front of this",
+        "  process, or give it a loopback bind.",
+        "",
+        "",
+    ].join("\n");
+}
+/** Run the relay until a signal stops it. */
+export async function runRelay(setup, streams) {
+    const json = setup.json;
+    // The log must be readable before anything binds: an operator who pointed
+    // at the wrong store learns it here, not from the first refused gesture.
+    const read = readVerifiedRecords(setup.logPath);
+    if (!read.ok) {
+        const exit = read.code === "log-torn-tail" ? EXIT_TORN_TAIL : read.code === "log-unreadable" ? EXIT_IO : EXIT_INTEGRITY;
+        return failure(streams, json, read.code, read.message, exit);
+    }
+    // Not a refusal: a policy that maps no EdgeOS account is a legitimate state
+    // (the operator has not mapped the resident yet), and the relay refuses
+    // every gesture `sender-unmapped` until it does. Said once, at start.
+    const load = readGatePolicy({ policy: setup.policy });
+    if (!load.ok || !mapsSendersFor(load.policy.approvers, "edgeos")) {
+        streams.err(`approval: relay: the policy ${load.ok ? "maps no edgeos sender" : `does not load (${load.code})`}, so every attest, decline, grant and reject will be refused sender-unmapped until an attested policy maps the person's EdgeOS id under approvers.<id>.senders.edgeos\n`);
+    }
+    const report = (line, text) => {
+        if (json)
+            streams.out(`${JSON.stringify(line)}\n`);
+        else
+            streams.out(`${text}\n`);
+    };
+    let handle;
+    try {
+        handle = await serveRelay({
+            logPath: setup.logPath,
+            secret: setup.secret,
+            ledger: fileNonceLedger(join(channelLeaseDirFor(setup.logPath), "relay-nonces")),
+            host: setup.host,
+            port: setup.port,
+            gateOptions: { policy: setup.policy },
+            proposer: setup.proposer,
+            log: (message) => streams.err(`${message}\n`),
+            // What reached the gate, by code: never the body, the sender id or the
+            // secret. The record in the log is where the attribution lives.
+            afterGesture: (response) => {
+                const body = response.body;
+                const gesture = String(body["gesture"] ?? "?");
+                if (body["ok"] === true) {
+                    report({
+                        event: "relay_gesture",
+                        gesture,
+                        ok: true,
+                        ...(body["seq"] === undefined ? {} : { seq: body["seq"] }),
+                        ...(body["event"] === undefined ? {} : { record: body["event"] }),
+                        ...(body["actor"] === undefined ? {} : { actor: body["actor"] }),
+                    }, `relay ${gesture}: recorded seq ${String(body["seq"])}${body["actor"] === undefined ? "" : ` by ${String(body["actor"])}`}`);
+                }
+                else {
+                    const refusal = body["refusal"];
+                    const code = String(refusal?.code ?? "?");
+                    report({ event: "relay_gesture", gesture, ok: false, code }, `relay ${gesture}: refused (${code})`);
+                }
+            },
+        });
+    }
+    catch (cause) {
+        return failure(streams, json, "io", `the relay could not bind ${setup.host}:${String(setup.port)}: ${cause instanceof Error ? cause.message : String(cause)}`, EXIT_IO);
+    }
+    if (!isLoopbackHost(handle.host))
+        streams.err(relayNonLoopbackBanner(handle.host, handle.port));
+    if (json) {
+        streams.out(`${JSON.stringify({ event: "relay_started", host: handle.host, port: handle.port, path: RELAY_PATH, proposer: setup.proposer })}\n`);
+    }
+    streams.err(`approval: relay bound http://${handle.host}:${String(handle.port)}${RELAY_PATH}. Every post must carry ${RELAY_SECRET_HEADER}; gestures are attributed to the EdgeOS account the attested policy maps, never to this process. TLS is your proxy's. Press Ctrl-C to stop.\n`);
+    return await new Promise((settle) => {
+        let stopping = false;
+        const stop = () => {
+            if (stopping)
+                return;
+            stopping = true;
+            void (async () => {
+                await handle.close();
+                if (json)
+                    streams.out(`${JSON.stringify({ event: "stopped", relay: handle.stats() })}\n`);
+                process.off("SIGINT", stop);
+                process.off("SIGTERM", stop);
+                settle(EXIT_OK);
+            })();
+        };
+        process.on("SIGINT", stop);
+        process.on("SIGTERM", stop);
+    });
+}
+function absolute(value, cwd) {
+    return isAbsolute(value) ? value : resolvePathSegments(cwd, value);
+}
+/** `approval channel relay [flags]`. */
+export async function commandChannelRelay(argv, streams, cwd) {
+    const json = argv.includes("--json");
+    const parsed = parseFlags(argv, RELAY_FLAGS);
+    if (!parsed.ok)
+        return usageError(streams, json, "usage", parsed.message);
+    if (boolFlag(parsed.flags, "--help") || boolFlag(parsed.flags, "-h")) {
+        streams.out(`${CHANNEL_RELAY_HELP}\n`);
+        return EXIT_OK;
+    }
+    const extra = parsed.positionals[0];
+    if (extra !== undefined)
+        return usageError(streams, json, "usage", `unexpected argument ${JSON.stringify(extra)}`);
+    const flags = parsed.flags;
+    const policyFlag = stringFlag(flags, "--policy");
+    const dirFlag = stringFlag(flags, "--dir");
+    const policy = policyFlag !== null
+        ? { file: absolute(policyFlag, cwd) }
+        : { dir: dirFlag === null ? cwd : absolute(dirFlag, cwd) };
+    const prepared = prepareRelay({
+        logPath: resolvePath(stringFlag(flags, "--log"), DEFAULT_LOG_PATH, cwd),
+        policy,
+        listen: stringFlag(flags, "--listen"),
+        port: stringFlag(flags, "--port"),
+        allowNonLoopback: boolFlag(flags, "--allow-non-loopback"),
+        proposer: stringFlag(flags, "--proposer"),
+        json,
+    });
+    if (!prepared.ok)
+        return usageError(streams, json, prepared.code, prepared.message);
+    return await runRelay(prepared.setup, streams);
+}
+//# sourceMappingURL=channel-relay.js.map

package/dist/src/cli/channel-relay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-relay.js","sourceRoot":"","sources":["../../../src/cli/channel-relay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAE7E,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,EACtB,UAAU,EACV,mBAAmB,EACnB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,UAAU,EAAoB,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAiB,MAAM,WAAW,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC/F,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,+DAA+D;AAC/D,MAAM,CAAC,MAAM,gBAAgB,GAAG,uBAAuB,CAAC;AAExD,kFAAkF;AAClF,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAE1C,kFAAkF;AAClF,MAAM,cAAc,GAAG,yBAAyB,CAAC;AAEjD;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,iBAAiB,CAAC;AAE3C,MAAM,WAAW,GAA6B;IAC5C,UAAU,EAAE,QAAQ;IACpB,QAAQ,EAAE,QAAQ;IAClB,sBAAsB,EAAE,SAAS;IACjC,OAAO,EAAE,QAAQ;IACjB,UAAU,EAAE,QAAQ;IACpB,OAAO,EAAE,QAAQ;IACjB,YAAY,EAAE,QAAQ;IACtB,QAAQ,EAAE,SAAS;IACnB,QAAQ,EAAE,SAAS;IACnB,IAAI,EAAE,SAAS;CAChB,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,iDAAiD;IACjD,sBAAsB;IACtB,0DAA0D;IAC1D,mBAAmB;IACnB,2EAA2E;IAC3E,sBAAsB;IACtB,0CAA0C;IAC1C,wBAAwB;IACxB,oFAAoF;IACpF,oBAAoB;CACZ,CAAC;AA6BX,uEAAuE;AACvE,MAAM,UAAU,YAAY,CAAC,OAAqB;IAChD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAC/C,MAAM,GAAG,GAAG,WAAW,CAAC,gBAAgB,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IACnD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,MAAM,gBAAgB,0FAA0F,mBAAmB,6OAA6O;SAC1X,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,GAAG,gBAAgB,qNAAqN;SAClP,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QAC5C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,GAAG,gBAAgB,oBAAoB,MAAM,CAAC,uBAAuB,CAAC,yKAAyK;SACzP,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,sBAAsB,CAAC;IAC5D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE,cAAc,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,mMAAmM;SACnP,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACrD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,4HAA4H;SACtI,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,GAAG,kBAAkB,CAAC;IAC9B,IAAI,IAAI,GAAG,kBAAkB,CAAC;IAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;QACtF,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACjB,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;SAAM,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACxC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,sCAAsC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;aAC9E,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;QAC7B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,iBAAiB,MAAM,CAAC,IAAI,CAAC,yIAAyI;SAChL,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;QACvD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,YAAY,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,oPAAoP;SAC9R,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE;YACL,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,MAAM;YACN,IAAI;YACJ,IAAI;YACJ,QAAQ;YACR,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,OAAgB,EAAE,IAAa,EAAE,IAAY,EAAE,OAAe;IAChF,IAAI,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;;QACtE,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC9D,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,OAAO,CAAC,OAAgB,EAAE,IAAa,EAAE,IAAY,EAAE,OAAe,EAAE,IAAY;IAC3F,IAAI,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;;QACtE,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,IAAI,CAAC,CAAC;IAC3C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,sBAAsB,CAAC,IAAY,EAAE,IAAY;IAC/D,OAAO;QACL,EAAE;QACF,iEAAiE;QACjE,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,uDAAuD;QAChF,0EAA0E;QAC1E,8EAA8E;QAC9E,wCAAwC;QACxC,EAAE;QACF,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,6CAA6C;AAC7C,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,KAAiB,EAAE,OAAgB;IAChE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IAExB,0EAA0E;IAC1E,yEAAyE;IACzE,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;QACxH,OAAO,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/D,CAAC;IAED,4EAA4E;IAC5E,wEAAwE;IACxE,sEAAsE;IACtE,MAAM,IAAI,GAAG,cAAc,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;QACjE,OAAO,CAAC,GAAG,CACT,+BAA+B,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,kBAAkB,IAAI,CAAC,IAAI,GAAG,yKAAyK,CAC3Q,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,IAA6B,EAAE,IAAY,EAAQ,EAAE;QACnE,IAAI,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;YAC9C,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;IAChC,CAAC,CAAC;IAEF,IAAI,MAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,UAAU,CAAC;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,eAAe,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,CAAC;YAChF,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,WAAW,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;YACrC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,IAAI,CAAC;YAC7C,uEAAuE;YACvE,gEAAgE;YAChE,YAAY,EAAE,CAAC,QAAQ,EAAE,EAAE;gBACzB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;gBAC3B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,CAAC;gBAC/C,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;oBACxB,MAAM,CACJ;wBACE,KAAK,EAAE,eAAe;wBACtB,OAAO;wBACP,EAAE,EAAE,IAAI;wBACR,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC1D,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;wBACjE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;qBACjE,EACD,SAAS,OAAO,kBAAkB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAC5H,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAmC,CAAC;oBAClE,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,IAAI,IAAI,GAAG,CAAC,CAAC;oBAC1C,MAAM,CACJ,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EACpD,SAAS,OAAO,cAAc,IAAI,GAAG,CACtC,CAAC;gBACJ,CAAC;YACH,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,OAAO,CACZ,OAAO,EACP,IAAI,EACJ,IAAI,EACJ,4BAA4B,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EACzH,OAAO,CACR,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAChG,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CACT,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,IAAI,CACpI,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,CACT,gCAAgC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,2BAA2B,mBAAmB,+IAA+I,CAC7Q,CAAC;IAEF,OAAO,MAAM,IAAI,OAAO,CAAS,CAAC,MAAM,EAAE,EAAE;QAC1C,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,IAAI,GAAG,GAAS,EAAE;YACtB,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,KAAK,CAAC,KAAK,IAAI,EAAE;gBACf,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;gBACrB,IAAI,IAAI;oBAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;gBAC1F,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;gBAC5B,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;gBAC7B,MAAM,CAAC,OAAO,CAAC,CAAC;YAClB,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,GAAW;IAC1C,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACrE,CAAC;AAED,wCAAwC;AACxC,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAc,EAAE,OAAgB,EAAE,GAAW;IACrF,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1E,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,GAAG,kBAAkB,IAAI,CAAC,CAAC;QACvC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,uBAAuB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAEnH,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,MAAM,GACV,UAAU,KAAK,IAAI;QACjB,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE;QACrC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;IAE/D,MAAM,QAAQ,GAAG,YAAY,CAAC;QAC5B,OAAO,EAAE,WAAW,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC;QACvE,MAAM;QACN,MAAM,EAAE,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC;QACrC,IAAI,EAAE,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC;QACjC,gBAAgB,EAAE,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAC;QACzD,QAAQ,EAAE,UAAU,CAAC,KAAK,EAAE,YAAY,CAAC;QACzC,IAAI;KACL,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IACpF,OAAO,MAAM,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AACjD,CAAC"}