fest-gateway 0.1.0

package/dist/server/auth/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../../server/auth/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAExC,MAAM,WAAW,GAAG,EAAE,CAAC;AAEvB,MAAM,CAAC,MAAM,OAAO,GAAG,EAAE,GAAG,SAAS,CAAC;AACtC,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,GAAG,UAAU,CAAC;AAE3C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,cAAc,CAAC;AAC1C,MAAM,CAAC,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AAcxD,MAAM,IAAI,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAE7F,MAAM,UAAU,UAAU,CAAC,MAAe;IACxC,OAAO,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,WAAW,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAA0B;IACrD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAS;QACxB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,EAAE;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,GAAW,EACX,IAAgD;IAEhD,MAAM,KAAK,GAAG;QACZ,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,EAAE;QACnC,QAAQ;QACR,UAAU;QACV,uEAAuE;QACvE,4EAA4E;QAC5E,uCAAuC;QACvC,iBAAiB;QACjB,WAAW,IAAI,CAAC,aAAa,EAAE;KAChC,CAAC;IACF,IAAI,IAAI,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAe;IAC3C,MAAM,KAAK,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,iBAAiB,EAAE,WAAW,CAAC,CAAC;IAC/F,IAAI,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AASD,MAAM,UAAU,aAAa,CAC3B,KAAY,EACZ,IAAsF;IAEtF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,SAAS,GAAG,GAAG,GAAG,WAAW,CAAC;IAEpC,KAAK,CAAC,EAAE;SACL,OAAO,CACN;;0CAEoC,CACrC;SACA,GAAG,CACF,SAAS,EACT,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,GAAG,CAAC,EACT,GAAG,EACH,SAAS,EACT,GAAG,EACH,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EACpC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAC7B,CAAC;IAEJ,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAAC,KAAY,EAAE,GAA8B,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC3F,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IAE5B,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE;SACjB,OAAO,CACN;;;;+BAIyB,CAC1B;SACA,GAAG,CAAC,SAAS,CAaH,CAAC;IAEd,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAEnC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACxC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEjE,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,GAAG,GAAG,GAAG,CAAC,YAAY,GAAG,OAAO;QAAE,OAAO,IAAI,CAAC;IAElD,sEAAsE;IACtE,6EAA6E;IAC7E,gDAAgD;IAChD,IAAI,GAAG,GAAG,GAAG,CAAC,YAAY,GAAG,MAAM,EAAE,CAAC;QACpC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,mDAAmD,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,EAAE;QACjB,KAAK,EAAE,GAAG,CAAC,MAAM;QACjB,MAAM,EAAE,GAAG,CAAC,OAAO;QACnB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAY,EAAE,SAAiB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC7E,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE;SACjB,OAAO,CAAC,wEAAwE,CAAC;SACjF,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACvB,OAAO,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,kBAAkB,CAAC,KAAY,EAAE,MAAc,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC/E,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE;SACjB,OAAO,CAAC,6EAA6E,CAAC;SACtF,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACpB,OAAO,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,KAAY,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC1D,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE;SACjB,OAAO,CAAC,0FAA0F,CAAC;SACnG,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,CAAC;IAC3B,OAAO,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC7B,CAAC"}

package/dist/server/bin/fest.js

@@ -0,0 +1,589 @@
+#!/usr/bin/env node
+/**
+ * Fest CLI.
+ *
+ * Server operator commands (need FEST_* server env, run on the host):
+ *   fest serve                        run the gateway
+ *   fest migrate                      apply schema migrations
+ *   fest token create <email> [name]  mint an identity token (shown once)
+ *   fest token list
+ *   fest token revoke <token-id>
+ *   fest admin create <email> [--role owner|admin|member] [--password-stdin]
+ *                                     grant dashboard sign-in (password shown once)
+ *   fest admin list
+ *   fest admin passwd <email> [--password-stdin]
+ *   fest admin disable <email> | fest admin enable <email>
+ *   fest seed [--requests N] [--hours N] [--force]
+ *                                     synthetic traffic, for looking at the
+ *                                     dashboard without a live session
+ *   fest seed --reset                 discard the database, then seed it fresh
+ *   fest seed --clear                 discard the database and stop
+ *
+ * Developer commands (run on your own machine, no server env needed):
+ *   fest login [--provider google|github] [--server <url>]
+ *                                     sign in via OAuth, store a token in ~/.fest
+ *   fest whoami                       show the locally stored login
+ *   fest claude [gw] [-- claude args...]
+ *                                     run `claude` pointed at your Fest gateway.
+ *                                     Posture is auto-detected: your own Anthropic
+ *                                     login pays if you have one, org credentials
+ *                                     if you do not. `gw` forces org credentials
+ *                                     and the gateway model menu.
+ *   fest logout                       forget the local login
+ */
+import { mkdir, rm } from "node:fs/promises";
+import { dirname } from "node:path";
+import { loadConfig, describeConfig } from "../config.js";
+import { createUsageSink } from "../ingest/sink.js";
+import { createLiveBus } from "../ingest/live-bus.js";
+import { createServer } from "../http/server.js";
+import { log, setLogLevel } from "../log.js";
+import { openStore, migrate } from "../store/db.js";
+import { ensureOrg, ensureUser, findUserByEmail } from "../store/bootstrap.js";
+import { createToken, listTokens, revokeToken, resolveToken, createLastUsedTracker } from "../store/tokens.js";
+import { grantDashboardAccess, hasAnyOwner, normaliseEmail } from "../auth/accounts.js";
+import { revokeUserSessions } from "../auth/session.js";
+import { isLoopbackHost } from "../auth/guard.js";
+import { generatePassword } from "../auth/password.js";
+import { recordAudit } from "../store/audit.js";
+import { createRequestWriter } from "../store/write.js";
+import { startRetention, DEFAULT_RETENTION } from "../store/retention.js";
+import { loadPrices, startPriceRefresh, pricingOptionsFromEnv } from "../usage/prices/refresh.js";
+import { seed, existingRequestCount, isDefaultDatabase } from "../store/seed.js";
+import { parseRouteTable, EMPTY_ROUTE_TABLE } from "../routes/table.js";
+import { watchRoutes } from "../routes/watch.js";
+import { readFile } from "node:fs/promises";
+import { runLogin } from "../../cli/login.js";
+import { runWhoami } from "../../cli/whoami.js";
+import { runClaude } from "../../cli/claude.js";
+import { runLogout } from "../../cli/logout.js";
+import { readCliConfig } from "../../cli/config.js";
+const out = (s) => void process.stdout.write(s + "\n");
+async function withStore(cfg) {
+    await mkdir(dirname(cfg.dbPath), { recursive: true });
+    const store = openStore(cfg.dbPath);
+    // Migrations run before anything else touches the schema, so a fresh volume
+    // and an upgraded one behave identically.
+    const { applied, version } = migrate(store);
+    if (applied > 0)
+        log.info("migrations applied", { applied, version });
+    return store;
+}
+/**
+ * Load and validate the routing table at BOOT, not on first use.
+ *
+ * A config error must stop the process here, where an operator is watching,
+ * rather than surfacing as a failed request to a developer hours later. And a
+ * table that fails to parse must never degrade to "no routing": that would
+ * silently send substituted traffic back onto developers' subscriptions, which
+ * is the exact silent-billing-substitution failure this phase is designed
+ * against.
+ */
+async function loadRoutes(cfg) {
+    if (cfg.routesPath === null)
+        return EMPTY_ROUTE_TABLE;
+    const text = await readFile(cfg.routesPath, "utf8");
+    const table = parseRouteTable(text);
+    log.info("routing table loaded", {
+        path: cfg.routesPath,
+        version: table.version,
+        routes: table.routes.length,
+        upstreams: [...table.upstreams.keys()],
+    });
+    return table;
+}
+async function cmdServe(cfg) {
+    const routes = await loadRoutes(cfg);
+    // Edits to routes.json take effect without a restart. `node --watch` only
+    // tracks imported .ts files, so without this an edit appeared to do nothing —
+    // which reads as "my config is wrong" rather than "it has not been loaded".
+    const routeWatcher = cfg.routesPath === null ? null : watchRoutes(cfg.routesPath, routes);
+    const store = await withStore(cfg);
+    const org = ensureOrg(store);
+    /**
+     * Refuse to serve an unauthenticated dashboard off loopback.
+     *
+     * The API exposes every developer's usage. On 127.0.0.1 that is a
+     * single-developer trial and asking for a password first would be friction
+     * for no one's benefit; on any other interface it is a data leak waiting for
+     * someone to find the port. Failing at boot — where an operator is watching —
+     * beats failing as a quiet exposure nobody notices.
+     */
+    if (!isLoopbackHost(cfg.host) && !hasAnyOwner(store, org.id)) {
+        store.close();
+        throw new Error(`refusing to listen on ${cfg.host} with no owner account.\n` +
+            "The dashboard would serve every developer's usage to anyone who finds the port.\n" +
+            "Create one first:\n" +
+            "  node server/bin/fest.ts admin create you@corp.test\n" +
+            "  (in Docker: docker compose run --rm fest admin create you@corp.test)\n" +
+            "or bind to loopback (FEST_HOST=127.0.0.1) for a single-developer trial.");
+    }
+    // Prices load synchronously from the vendored snapshot before the first
+    // request can arrive, so a call is never metered against an empty table. The
+    // refresh that follows is best-effort and off the hot path — see
+    // usage/prices/refresh.ts for why boot must never wait on it.
+    const pricing = pricingOptionsFromEnv(cfg.dbPath);
+    loadPrices(pricing);
+    const priceRefresh = startPriceRefresh(pricing);
+    const writer = createRequestWriter(store);
+    const lastUsed = createLastUsedTracker(store);
+    // Hourly sweep, on a timer rather than at boot: a restart loop must not turn
+    // into a delete loop.
+    const retention = startRetention(store, DEFAULT_RETENTION);
+    await mkdir(dirname(cfg.usageLogPath), { recursive: true });
+    const bus = createLiveBus();
+    const sink = createUsageSink({
+        path: cfg.usageLogPath,
+        // The store is the system of record; JSONL stays as a cheap, greppable
+        // trail. Pricing and persistence both happen here in the flush, never on
+        // the request path.
+        //
+        // The live feed is published AFTER the write, so a dashboard never shows a
+        // row that then fails to persist. A throwing write requeues the batch and
+        // publishes on the retry instead, which is the right way round: the feed
+        // may lag the truth, but it must not contradict it.
+        onBatch: (records) => {
+            writer.writeBatch(org.id, records);
+            bus.publish(records);
+        },
+    });
+    const server = createServer({
+        config: cfg,
+        sink,
+        bus,
+        routes: routeWatcher === null ? routes : () => routeWatcher.current(),
+        orgId: org.id,
+        store,
+        resolveIdentity: (raw) => resolveToken(store, raw),
+        touchToken: (id) => lastUsed.touch(id),
+    });
+    /**
+     * How long an in-flight request may keep the process alive on shutdown.
+     *
+     * Long enough not to guillotine a developer mid-turn; short enough that
+     * `node --watch` feels like a restart rather than a hang.
+     */
+    const DRAIN_GRACE_MS = 5_000;
+    let shuttingDown = false;
+    const shutdown = (signal) => {
+        if (shuttingDown)
+            return;
+        shuttingDown = true;
+        log.info("shutting down", { signal });
+        const finish = () => {
+            void sink.close().then(() => {
+                retention.stop();
+                priceRefresh.stop();
+                routeWatcher?.stop();
+                lastUsed.stop();
+                store.close();
+                log.info("drained", { sink: sink.stats() });
+                process.exit(0);
+            });
+        };
+        server.close(finish);
+        // `server.close()` stops accepting but WAITS for every open connection.
+        // An SSE stream never ends by itself, so a single open dashboard would
+        // block shutdown indefinitely — which under `node --watch` looks like a
+        // restart stuck on "Waiting for graceful termination". Hang up on the
+        // dashboards explicitly; they reconnect on their own.
+        bus.closeAll();
+        server.closeIdleConnections();
+        // Whatever is left is a request genuinely in flight. Give it a bounded
+        // grace period, then stop waiting: a developer's next keystroke restarting
+        // the server matters more than the tail of one turn, and the sink has
+        // already been told to drain.
+        const forced = setTimeout(() => {
+            log.warn("shutdown grace expired; closing remaining connections", {
+                afterMs: DRAIN_GRACE_MS,
+            });
+            server.closeAllConnections();
+            finish();
+        }, DRAIN_GRACE_MS);
+        forced.unref();
+    };
+    process.on("SIGINT", () => shutdown("SIGINT"));
+    process.on("SIGTERM", () => shutdown("SIGTERM"));
+    server.listen(cfg.port, cfg.host, () => {
+        log.info("fest listening", describeConfig(cfg));
+        out(`fest: http://${cfg.host}:${cfg.port}  ->  ${cfg.upstreamBaseUrl}\n` +
+            `  db: ${cfg.dbPath}   identity required: ${cfg.requireIdentity}\n` +
+            `  retention: requests ${DEFAULT_RETENTION.requestDays}d, rollups ${DEFAULT_RETENTION.rollupDays}d\n` +
+            `  routing: ${routes.routes.length === 0
+                ? "none — every request passes through on the caller's own credential"
+                : `${routes.routes.length} route(s) via ${cfg.routesPath} (v${routes.version})`}\n` +
+            `point Claude Code at it with:\n` +
+            `  ANTHROPIC_BASE_URL=http://${cfg.host}:${cfg.port}/t/<your-token>\n` +
+            `and do NOT set ANTHROPIC_API_KEY / ANTHROPIC_AUTH_TOKEN (either disables your subscription)`);
+    });
+}
+async function cmdToken(cfg, argv) {
+    const store = await withStore(cfg);
+    const org = ensureOrg(store);
+    const sub = argv[0] ?? "list";
+    if (sub === "create") {
+        const email = argv[1];
+        if (email === undefined)
+            throw new Error("usage: fest token create <email> [name]");
+        const user = ensureUser(store, { orgId: org.id, email, role: "member" });
+        const created = createToken(store, { orgId: org.id, userId: user.id, name: argv[2] ?? "" });
+        recordAudit(store, {
+            orgId: org.id,
+            actorLabel: "cli",
+            action: "token.create",
+            target: created.id,
+            outcome: "ok",
+            detail: { user: user.email, name: argv[2] ?? "" },
+        });
+        out(`token id : ${created.id}`);
+        out(`user     : ${user.email}`);
+        out("");
+        // Shown exactly once: only the hash is stored.
+        out(`  ${created.raw}`);
+        out("");
+        out("This is the only time the token is shown. Use it as:");
+        out(`  ANTHROPIC_BASE_URL=http://${cfg.host}:${cfg.port}/t/${created.raw}`);
+    }
+    else if (sub === "list") {
+        const rows = listTokens(store, org.id);
+        if (rows.length === 0)
+            out("(no tokens)");
+        for (const r of rows) {
+            const state = r.revokedAt !== null ? "revoked" : "active";
+            out(`${r.id}  ${r.displayPrefix}…  ${state.padEnd(7)}  user=${r.userId}  ` +
+                `last-used=${r.lastUsedAt === null ? "never" : new Date(r.lastUsedAt).toISOString()}  ${r.name}`);
+        }
+    }
+    else if (sub === "revoke") {
+        const id = argv[1];
+        if (id === undefined)
+            throw new Error("usage: fest token revoke <token-id>");
+        const revoked = revokeToken(store, org.id, id);
+        recordAudit(store, {
+            orgId: org.id,
+            actorLabel: "cli",
+            action: "token.revoke",
+            target: id,
+            outcome: revoked ? "ok" : "denied",
+        });
+        out(revoked ? `revoked ${id}` : `not found or already revoked: ${id}`);
+    }
+    else {
+        throw new Error(`unknown token subcommand: ${sub}`);
+    }
+    store.close();
+}
+/**
+ * Read a password from stdin when asked to, otherwise generate one.
+ *
+ * Never from a command-line argument: `fest admin create x --password hunter2`
+ * puts the password in the shell history, in `ps` output for every user on the
+ * box, and often in a CI log. `--password-stdin` is the automation path; the
+ * default is a generated password shown once, which is the one most operators
+ * should take.
+ */
+async function readPassword(argv) {
+    if (!argv.includes("--password-stdin"))
+        return { password: generatePassword(), generated: true };
+    const chunks = [];
+    for await (const chunk of process.stdin)
+        chunks.push(chunk);
+    const password = Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
+    if (password === "")
+        throw new Error("--password-stdin was given but stdin was empty");
+    return { password, generated: false };
+}
+function flagValue(argv, name) {
+    const i = argv.indexOf(`--${name}`);
+    return i === -1 ? undefined : argv[i + 1];
+}
+/**
+ * Did this user already have console access — a password of their own —
+ * before this call? `ensureUser` also runs for metering-only rows (an
+ * identity token, or an OAuth self-service login that never went through
+ * `admin create`), so "a row exists" is not the same question.
+ */
+function hadConsoleAccess(store, userId) {
+    const row = store.db.prepare(`SELECT password_hash FROM users WHERE id = ?`).get(userId);
+    return row !== undefined && row.password_hash !== null;
+}
+async function cmdAdmin(cfg, argv) {
+    const store = await withStore(cfg);
+    const org = ensureOrg(store);
+    const sub = argv[0] ?? "list";
+    try {
+        if (sub === "create" || sub === "passwd") {
+            const email = argv[1];
+            if (email === undefined)
+                throw new Error(`usage: fest admin ${sub} <email> [--role R] [--password-stdin]`);
+            const roleFlag = flagValue(argv, "role");
+            if (roleFlag !== undefined && !["owner", "admin", "member"].includes(roleFlag)) {
+                throw new Error("--role must be owner, admin or member");
+            }
+            /**
+             * An existing user keeps their role unless `--role` says otherwise.
+             *
+             * Found by running it: `admin passwd` on the only owner silently demoted
+             * them to `admin`, which left the deployment with no owner — and an
+             * ownerless deployment on loopback serves the API unauthenticated. A
+             * routine password rotation therefore turned the dashboard's auth off.
+             * Changing a password must change exactly the password.
+             *
+             * Only when the user is new to the CONSOLE does the default apply, and
+             * then the FIRST such account is the owner whatever it asked for: a
+             * deployment with only an `admin` has nobody able to grant the owner
+             * role afterwards. A metering-only row (minted by `fest token create`,
+             * or by an OAuth `fest login` that never touched the console) does not
+             * count as "existing" for this purpose — granting it console access for
+             * the first time is exactly the bootstrap case, not a rotation to
+             * protect.
+             */
+            const existing = findUserByEmail(store, org.id, normaliseEmail(email));
+            const existingConsoleRole = existing !== null && hadConsoleAccess(store, existing.id) ? existing.role : undefined;
+            const role = (roleFlag ?? existingConsoleRole ?? (hasAnyOwner(store, org.id) ? "admin" : "owner"));
+            const { password, generated } = await readPassword(argv);
+            const user = await grantDashboardAccess(store, {
+                orgId: org.id,
+                email,
+                password,
+                role,
+            });
+            recordAudit(store, {
+                orgId: org.id,
+                actorLabel: "cli",
+                action: sub === "create" ? "admin.create" : "admin.passwd",
+                target: user.email,
+                outcome: "ok",
+                detail: { role },
+            });
+            out(`user : ${user.email}`);
+            out(`role : ${user.role}`);
+            if (generated) {
+                out("");
+                // Shown exactly once: only the scrypt hash is stored.
+                out(`  ${password}`);
+                out("");
+                out("This is the only time the password is shown. Store it in a password manager.");
+            }
+            else {
+                out("password set from stdin");
+            }
+            out("Existing sessions for this user have been signed out.");
+            return;
+        }
+        if (sub === "list") {
+            const rows = store.db
+                .prepare(`SELECT email, role, password_hash IS NOT NULL AS can_sign_in, disabled_at, password_set_at
+             FROM users WHERE org_id = ? ORDER BY role, email`)
+                .all(org.id);
+            if (rows.length === 0)
+                out("(no users)");
+            for (const r of rows) {
+                const state = r["disabled_at"] !== null ? "disabled" : Number(r["can_sign_in"]) === 1 ? "sign-in" : "metered-only";
+                out(`${String(r["email"]).padEnd(32)} ${String(r["role"]).padEnd(7)} ${state}`);
+            }
+            return;
+        }
+        if (sub === "disable" || sub === "enable") {
+            const email = argv[1];
+            if (email === undefined)
+                throw new Error(`usage: fest admin ${sub} <email>`);
+            const disabling = sub === "disable";
+            const res = store.db
+                .prepare(`UPDATE users SET disabled_at = ? WHERE org_id = ? AND email = ?`)
+                .run(disabling ? Date.now() : null, org.id, normaliseEmail(email));
+            if (Number(res.changes) === 0)
+                throw new Error(`no such user: ${email}`);
+            // Disabling has to take effect now, not at the next sign-in. A live
+            // cookie outliving the account is the whole reason this command exists.
+            if (disabling) {
+                const user = store.db
+                    .prepare(`SELECT id FROM users WHERE org_id = ? AND email = ?`)
+                    .get(org.id, normaliseEmail(email));
+                if (user !== undefined)
+                    revokeUserSessions(store, user.id);
+            }
+            recordAudit(store, {
+                orgId: org.id,
+                actorLabel: "cli",
+                action: disabling ? "admin.disable" : "admin.enable",
+                target: normaliseEmail(email),
+                outcome: "ok",
+            });
+            out(`${disabling ? "disabled" : "enabled"} ${normaliseEmail(email)}`);
+            return;
+        }
+        throw new Error(`unknown admin subcommand: ${sub}`);
+    }
+    finally {
+        store.close();
+    }
+}
+function intFlag(argv, name) {
+    const i = argv.indexOf(`--${name}`);
+    if (i === -1)
+        return undefined;
+    const n = Number(argv[i + 1]);
+    if (!Number.isInteger(n) || n <= 0)
+        throw new Error(`--${name} needs a positive integer`);
+    return n;
+}
+/**
+ * Discard a database entirely, rather than deleting rows from it.
+ *
+ * Unlink and not `DELETE FROM`: once synthetic and observed rows share a table
+ * there is no honest predicate that separates them, so a partial wipe would
+ * have to guess. Removing the file is total and unambiguous — you know exactly
+ * what you have afterwards, which is nothing.
+ *
+ * Refuses the default database without `--force`, because the one thing this
+ * command must never do is silently destroy a real record of a team's usage on
+ * the way to showing someone a demo.
+ */
+async function discardDatabase(cfg, force) {
+    if (isDefaultDatabase(cfg.dbPath) && !force) {
+        throw new Error(`refusing to delete the default database (${cfg.dbPath}).\n` +
+            "That is where real traffic is recorded. Point at a scratch database:\n" +
+            "  npm run demo:clean          (uses ./data/demo.db)\n" +
+            "  FEST_DB=./data/scratch.db node server/bin/fest.ts seed --clear\n" +
+            "or pass --force if you genuinely mean this one.");
+    }
+    // The -wal and -shm siblings hold committed pages. Leaving them behind next
+    // to a deleted main file is how a "cleared" database comes back populated.
+    await Promise.all([cfg.dbPath, `${cfg.dbPath}-wal`, `${cfg.dbPath}-shm`].map((f) => rm(f, { force: true })));
+}
+async function cmdSeed(cfg, argv) {
+    const force = argv.includes("--force");
+    const clear = argv.includes("--clear");
+    const reset = argv.includes("--reset");
+    if (clear || reset) {
+        await discardDatabase(cfg, force);
+        out(`discarded ${cfg.dbPath}`);
+        if (clear)
+            return;
+    }
+    const store = await withStore(cfg);
+    const existing = existingRequestCount(store);
+    // Invented numbers must never be blended into observed ones. A dashboard is
+    // only worth anything if you can trust that what it shows was measured.
+    if (existing > 0 && !force) {
+        store.close();
+        throw new Error(`${cfg.dbPath} already holds ${existing} request(s).\n` +
+            "Seeding would mix synthetic rows into real traffic. Either start clean:\n" +
+            "  npm run demo                (scratch database, reset each time)\n" +
+            "  node server/bin/fest.ts seed --reset\n" +
+            "or pass --force if you are certain this database is disposable.");
+    }
+    const requests = intFlag(argv, "requests");
+    const hours = intFlag(argv, "hours");
+    const result = seed(store, {
+        ...(requests === undefined ? {} : { requests }),
+        ...(hours === undefined ? {} : { hours }),
+    });
+    store.close();
+    out(`seeded ${result.written} synthetic requests into ${cfg.dbPath}`);
+    out(`developers: ${result.users.join(", ")}`);
+    out("");
+    out("These rows are INVENTED. Discard them with --clear before trusting any");
+    out("number in this database.");
+}
+function printHelp() {
+    out("server operator:\n" +
+        "  fest serve | migrate |\n" +
+        "       seed [--requests N] [--hours N] [--reset | --clear] [--force] |\n" +
+        "       token create <email> [name] | token list | token revoke <id> |\n" +
+        "       admin create <email> [--role R] [--password-stdin] | admin list |\n" +
+        "       admin passwd <email> | admin disable <email> | admin enable <email>\n" +
+        "\n" +
+        "developer (run on your own machine, no server env needed):\n" +
+        "  fest login [--provider google|github] [--server <url>]\n" +
+        "  fest whoami\n" +
+        "  fest claude [gw] [-- claude args...]   (gw: force org credentials + gateway models)\n" +
+        "  fest logout");
+}
+async function cmdLogin(argv) {
+    const providerFlag = flagValue(argv, "provider") ?? "google";
+    if (providerFlag !== "google" && providerFlag !== "github") {
+        throw new Error("--provider must be google or github");
+    }
+    const serverFlag = flagValue(argv, "server");
+    const serverUrl = serverFlag ?? (await readCliConfig())?.serverUrl;
+    if (serverUrl === undefined) {
+        throw new Error("usage: fest login --server <url> [--provider google|github]\n(--server is required the first time)");
+    }
+    await runLogin({ provider: providerFlag, serverUrl });
+}
+/**
+ * Commands a developer runs on their own machine. Dispatched before
+ * `loadConfig()` is ever called: a laptop has no reason to have any FEST_*
+ * server env var set, and these commands must not imply otherwise.
+ */
+const CLIENT_COMMANDS = new Set(["login", "whoami", "claude", "logout"]);
+async function main() {
+    const argv = process.argv.slice(2);
+    const cmd = argv[0] ?? "help";
+    if (CLIENT_COMMANDS.has(cmd)) {
+        switch (cmd) {
+            case "login":
+                await cmdLogin(argv.slice(1));
+                return;
+            case "whoami":
+                await runWhoami();
+                return;
+            case "claude": {
+                let claudeArgs = argv.slice(1);
+                // `gw` is the one word this subcommand owns, and only before `--`:
+                // `fest claude -- gw` still forwards `gw` to the child.
+                const posture = claudeArgs[0] === "gw" ? "key" : "auto";
+                if (posture === "key")
+                    claudeArgs = claudeArgs.slice(1);
+                // `fest claude -- --resume` and `fest claude --resume` are both fine:
+                // apart from `gw` this subcommand defines no flags of its own, so a
+                // leading `--` is only ever there by convention and is stripped rather
+                // than forwarded.
+                if (claudeArgs[0] === "--")
+                    claudeArgs = claudeArgs.slice(1);
+                await runClaude(claudeArgs, posture);
+                return;
+            }
+            case "logout":
+                await runLogout();
+                return;
+        }
+    }
+    if (cmd === "help" || cmd === "--help" || cmd === "-h") {
+        printHelp();
+        return;
+    }
+    const cfg = loadConfig();
+    setLogLevel(cfg.logLevel);
+    switch (cmd) {
+        case "serve":
+            await cmdServe(cfg);
+            return;
+        case "migrate": {
+            const store = await withStore(cfg);
+            ensureOrg(store);
+            const version = store.db.prepare("PRAGMA user_version").get();
+            out(`migrated: ${cfg.dbPath} (user_version=${Object.values(version)[0]})`);
+            store.close();
+            return;
+        }
+        case "token":
+            await cmdToken(cfg, argv.slice(1));
+            return;
+        case "admin":
+            await cmdAdmin(cfg, argv.slice(1));
+            return;
+        case "seed":
+            await cmdSeed(cfg, argv.slice(1));
+            return;
+        default:
+            throw new Error(`unknown command: ${cmd}`);
+    }
+}
+main().catch((err) => {
+    process.stderr.write(`fest: ${err instanceof Error ? err.message : String(err)}\n`);
+    process.exit(1);
+});
+//# sourceMappingURL=fest.js.map

package/dist/server/bin/fest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fest.js","sourceRoot":"","sources":["../../../server/bin/fest.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE1D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEpD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC/G,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAClG,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,MAAM,GAAG,GAAG,CAAC,CAAS,EAAQ,EAAE,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AAErE,KAAK,UAAU,SAAS,CAAC,GAAe;IACtC,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpC,4EAA4E;IAC5E,0CAA0C;IAC1C,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,OAAO,GAAG,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACtE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,UAAU,CAAC,GAAe;IACvC,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI;QAAE,OAAO,iBAAiB,CAAC;IACtD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACpC,GAAG,CAAC,IAAI,CAAC,sBAAsB,EAAE;QAC/B,IAAI,EAAE,GAAG,CAAC,UAAU;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM;QAC3B,SAAS,EAAE,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;KACvC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAe;IACrC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IACrC,0EAA0E;IAC1E,8EAA8E;IAC9E,4EAA4E;IAC5E,MAAM,YAAY,GAChB,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAE7B;;;;;;;;OAQG;IACH,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;QAC7D,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,yBAAyB,GAAG,CAAC,IAAI,2BAA2B;YAC1D,mFAAmF;YACnF,qBAAqB;YACrB,wDAAwD;YACxD,0EAA0E;YAC1E,yEAAyE,CAC5E,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,6EAA6E;IAC7E,iEAAiE;IACjE,8DAA8D;IAC9D,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClD,UAAU,CAAC,OAAO,CAAC,CAAC;IACpB,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAEhD,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC9C,6EAA6E;IAC7E,sBAAsB;IACtB,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IAE3D,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,eAAe,CAAC;QAC3B,IAAI,EAAE,GAAG,CAAC,YAAY;QACtB,uEAAuE;QACvE,yEAAyE;QACzE,oBAAoB;QACpB,EAAE;QACF,2EAA2E;QAC3E,0EAA0E;QAC1E,yEAAyE;QACzE,oDAAoD;QACpD,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE;YACnB,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YACnC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,YAAY,CAAC;QAC1B,MAAM,EAAE,GAAG;QACX,IAAI;QACJ,GAAG;QACH,MAAM,EAAE,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE;QACrE,KAAK,EAAE,GAAG,CAAC,EAAE;QACb,KAAK;QACL,eAAe,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC;QAClD,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;KACvC,CAAC,CAAC;IAEH;;;;;OAKG;IACH,MAAM,cAAc,GAAG,KAAK,CAAC;IAE7B,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAQ,EAAE;QACxC,IAAI,YAAY;YAAE,OAAO;QACzB,YAAY,GAAG,IAAI,CAAC;QACpB,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAEtC,MAAM,MAAM,GAAG,GAAS,EAAE;YACxB,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC1B,SAAS,CAAC,IAAI,EAAE,CAAC;gBACjB,YAAY,CAAC,IAAI,EAAE,CAAC;gBACpB,YAAY,EAAE,IAAI,EAAE,CAAC;gBACrB,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAChB,KAAK,CAAC,KAAK,EAAE,CAAC;gBACd,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAErB,wEAAwE;QACxE,uEAAuE;QACvE,wEAAwE;QACxE,sEAAsE;QACtE,sDAAsD;QACtD,GAAG,CAAC,QAAQ,EAAE,CAAC;QACf,MAAM,CAAC,oBAAoB,EAAE,CAAC;QAE9B,uEAAuE;QACvE,2EAA2E;QAC3E,sEAAsE;QACtE,8BAA8B;QAC9B,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE;YAC7B,GAAG,CAAC,IAAI,CAAC,uDAAuD,EAAE;gBAChE,OAAO,EAAE,cAAc;aACxB,CAAC,CAAC;YACH,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAC7B,MAAM,EAAE,CAAC;QACX,CAAC,EAAE,cAAc,CAAC,CAAC;QACnB,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/C,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IAEjD,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE;QACrC,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;QAChD,GAAG,CACD,gBAAgB,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,SAAS,GAAG,CAAC,eAAe,IAAI;YAClE,SAAS,GAAG,CAAC,MAAM,yBAAyB,GAAG,CAAC,eAAe,IAAI;YACnE,yBAAyB,iBAAiB,CAAC,WAAW,cAAc,iBAAiB,CAAC,UAAU,KAAK;YACrG,cACE,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;gBACxB,CAAC,CAAC,oEAAoE;gBACtE,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,UAAU,MAAM,MAAM,CAAC,OAAO,GAChF,IAAI;YACJ,iCAAiC;YACjC,+BAA+B,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,mBAAmB;YACtE,6FAA6F,CAChG,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAe,EAAE,IAAuB;IAC9D,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;IAE9B,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACpF,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzE,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC5F,WAAW,CAAC,KAAK,EAAE;YACjB,KAAK,EAAE,GAAG,CAAC,EAAE;YACb,UAAU,EAAE,KAAK;YACjB,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,OAAO,CAAC,EAAE;YAClB,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE;SAClD,CAAC,CAAC;QACH,GAAG,CAAC,cAAc,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAChC,GAAG,CAAC,cAAc,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAChC,GAAG,CAAC,EAAE,CAAC,CAAC;QACR,+CAA+C;QAC/C,GAAG,CAAC,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACxB,GAAG,CAAC,EAAE,CAAC,CAAC;QACR,GAAG,CAAC,sDAAsD,CAAC,CAAC;QAC5D,GAAG,CAAC,+BAA+B,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9E,CAAC;SAAM,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,GAAG,CAAC,aAAa,CAAC,CAAC;QAC1C,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC1D,GAAG,CACD,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,aAAa,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,IAAI;gBACpE,aAAa,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CACnG,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,EAAE,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAC7E,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/C,WAAW,CAAC,KAAK,EAAE;YACjB,KAAK,EAAE,GAAG,CAAC,EAAE;YACb,UAAU,EAAE,KAAK;YACjB,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,EAAE;YACV,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ;SACnC,CAAC,CAAC;QACH,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,iCAAiC,EAAE,EAAE,CAAC,CAAC;IACzE,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,YAAY,CAAC,IAAuB;IACjD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACjG,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC9E,IAAI,QAAQ,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACvF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,SAAS,CAAC,IAAuB,EAAE,IAAY;IACtD,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACpC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,KAAY,EAAE,MAAc;IACpD,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,GAAG,CAAC,MAAM,CAE1E,CAAC;IACd,OAAO,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,aAAa,KAAK,IAAI,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAe,EAAE,IAAuB;IAC9D,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;IAE9B,IAAI,CAAC;QACH,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACtB,IAAI,KAAK,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,wCAAwC,CAAC,CAAC;YAE3G,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACzC,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/E,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAC3D,CAAC;YAED;;;;;;;;;;;;;;;;;eAiBG;YACH,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;YACvE,MAAM,mBAAmB,GACvB,QAAQ,KAAK,IAAI,IAAI,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YACxF,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,mBAAmB,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAGrF,CAAC;YAEb,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;YACzD,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE;gBAC7C,KAAK,EAAE,GAAG,CAAC,EAAE;gBACb,KAAK;gBACL,QAAQ;gBACR,IAAI;aACL,CAAC,CAAC;YAEH,WAAW,CAAC,KAAK,EAAE;gBACjB,KAAK,EAAE,GAAG,CAAC,EAAE;gBACb,UAAU,EAAE,KAAK;gBACjB,MAAM,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc;gBAC1D,MAAM,EAAE,IAAI,CAAC,KAAK;gBAClB,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,EAAE,IAAI,EAAE;aACjB,CAAC,CAAC;YAEH,GAAG,CAAC,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YAC5B,GAAG,CAAC,UAAU,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAC3B,IAAI,SAAS,EAAE,CAAC;gBACd,GAAG,CAAC,EAAE,CAAC,CAAC;gBACR,sDAAsD;gBACtD,GAAG,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;gBACrB,GAAG,CAAC,EAAE,CAAC,CAAC;gBACR,GAAG,CAAC,8EAA8E,CAAC,CAAC;YACtF,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,yBAAyB,CAAC,CAAC;YACjC,CAAC;YACD,GAAG,CAAC,uDAAuD,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACnB,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE;iBAClB,OAAO,CACN;8DACoD,CACrD;iBACA,GAAG,CAAC,GAAG,CAAC,EAAE,CAAmC,CAAC;YACjD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,GAAG,CAAC,YAAY,CAAC,CAAC;YACzC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,KAAK,GAAG,CAAC,CAAC,aAAa,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC;gBACnH,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;YAClF,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACtB,IAAI,KAAK,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,UAAU,CAAC,CAAC;YAC7E,MAAM,SAAS,GAAG,GAAG,KAAK,SAAS,CAAC;YACpC,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE;iBACjB,OAAO,CAAC,iEAAiE,CAAC;iBAC1E,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;YACrE,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,KAAK,EAAE,CAAC,CAAC;YAEzE,oEAAoE;YACpE,wEAAwE;YACxE,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE;qBAClB,OAAO,CAAC,qDAAqD,CAAC;qBAC9D,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,cAAc,CAAC,KAAK,CAAC,CAA+B,CAAC;gBACpE,IAAI,IAAI,KAAK,SAAS;oBAAE,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,WAAW,CAAC,KAAK,EAAE;gBACjB,KAAK,EAAE,GAAG,CAAC,EAAE;gBACb,UAAU,EAAE,KAAK;gBACjB,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc;gBACpD,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC;gBAC7B,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YACH,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACtE,OAAO;QACT,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC;IACtD,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,IAAuB,EAAE,IAAY;IACpD,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,KAAK,IAAI,2BAA2B,CAAC,CAAC;IAC1F,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,eAAe,CAAC,GAAe,EAAE,KAAc;IAC5D,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,4CAA4C,GAAG,CAAC,MAAM,MAAM;YAC1D,wEAAwE;YACxE,uDAAuD;YACvD,oEAAoE;YACpE,iDAAiD,CACpD,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,2EAA2E;IAC3E,MAAM,OAAO,CAAC,GAAG,CACf,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/D,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CACvB,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,GAAe,EAAE,IAAuB;IAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAEvC,IAAI,KAAK,IAAI,KAAK,EAAE,CAAC;QACnB,MAAM,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAClC,GAAG,CAAC,aAAa,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/B,IAAI,KAAK;YAAE,OAAO;IACpB,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAE7C,4EAA4E;IAC5E,wEAAwE;IACxE,IAAI,QAAQ,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3B,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,GAAG,GAAG,CAAC,MAAM,kBAAkB,QAAQ,gBAAgB;YACrD,2EAA2E;YAC3E,qEAAqE;YACrE,0CAA0C;YAC1C,iEAAiE,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE;QACzB,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;KAC1C,CAAC,CAAC;IACH,KAAK,CAAC,KAAK,EAAE,CAAC;IAEd,GAAG,CAAC,UAAU,MAAM,CAAC,OAAO,4BAA4B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACtE,GAAG,CAAC,eAAe,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9C,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,wEAAwE,CAAC,CAAC;IAC9E,GAAG,CAAC,0BAA0B,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,SAAS;IAChB,GAAG,CACD,oBAAoB;QAClB,4BAA4B;QAC5B,0EAA0E;QAC1E,yEAAyE;QACzE,4EAA4E;QAC5E,8EAA8E;QAC9E,IAAI;QACJ,8DAA8D;QAC9D,4DAA4D;QAC5D,iBAAiB;QACjB,yFAAyF;QACzF,eAAe,CAClB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAuB;IAC7C,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,QAAQ,CAAC;IAC7D,IAAI,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,QAAQ,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,UAAU,IAAI,CAAC,MAAM,aAAa,EAAE,CAAC,EAAE,SAAS,CAAC;IACnE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,oGAAoG,CACrG,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEzE,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;IAE9B,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,OAAO;gBACV,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC9B,OAAO;YACT,KAAK,QAAQ;gBACX,MAAM,SAAS,EAAE,CAAC;gBAClB,OAAO;YACT,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,IAAI,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC/B,mEAAmE;gBACnE,wDAAwD;gBACxD,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;gBACxD,IAAI,OAAO,KAAK,KAAK;oBAAE,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACxD,sEAAsE;gBACtE,oEAAoE;gBACpE,uEAAuE;gBACvE,kBAAkB;gBAClB,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI;oBAAE,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC7D,MAAM,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;gBACrC,OAAO;YACT,CAAC;YACD,KAAK,QAAQ;gBACX,MAAM,SAAS,EAAE,CAAC;gBAClB,OAAO;QACX,CAAC;IACH,CAAC;IAED,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACvD,SAAS,EAAE,CAAC;QACZ,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAE1B,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,OAAO;YACV,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACT,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;YACnC,SAAS,CAAC,KAAK,CAAC,CAAC;YACjB,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,GAAG,EAA6B,CAAC;YACzF,GAAG,CAAC,aAAa,GAAG,CAAC,MAAM,kBAAkB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC3E,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,OAAO;QACT,CAAC;QACD,KAAK,OAAO;YACV,MAAM,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACnC,OAAO;QACT,KAAK,OAAO;YACV,MAAM,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACnC,OAAO;QACT,KAAK,MAAM;YACT,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAClC,OAAO;QACT;YACE,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,EAAE,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}