ftown 0.20.6 → 0.20.8

package/dist/security/bridge/policy.js

@@ -3,34 +3,53 @@ import { createHash, randomBytes, randomUUID, timingSafeEqual } from 'node:crypt
 import { join } from 'node:path';
 import { z } from 'zod';
 import { BridgeSecurityError } from './errors.js';
-import { approvedSchema, boundedId, displayLabel, endpointSchema, permissionSchema } from './metadata.js';
+import { approvedSchema, displayLabel, endpointSchema, permissionSchema } from './metadata.js';
 import { AtomicSnapshot } from './snapshot.js';
 import { verifyAccountHistory } from '../account-crypto.js';
 import { AccountConnectivity, storedAccountSchema } from './account-state.js';
 const FIVE_MINUTES = 300_000;
-const THIRTY_DAYS = 30 * 86_400_000;
 const MAX_ENDPOINTS = 1000;
 const digest = (secret) => createHash('sha256').update(secret).digest('hex');
 const invitationSchema = z.object({ id: z.string().guid(), secretHash: z.string().regex(/^[a-f0-9]{64}$/),
     label: z.string().max(100), permissions: z.array(permissionSchema).max(3), expiresAt: legacyDateTimeSchema,
     consumedBy: z.string().nullable(), provenance: z.enum(['legacy', 'local-recovery']).default('legacy') }).strict();
-const pendingSchema = z.object({ approved: approvedSchema, approvalId: z.string().guid(), requestId: boundedId,
-    expiresAt: legacyDateTimeSchema, activeExpiresAt: legacyDateTimeSchema, active: z.boolean() }).strict();
-const policySchema = z.object({ version: z.literal(1), ownerId: z.string(), bridgeId: z.string(), bridgeEndpointId: z.string(),
+/** Pre-removal policy files carry `mcp: []`, mcp devices and mcp provenance; the strict schema would reject them and brick the bridge. */
+export function migrateLegacyPolicy(raw) {
+    if (typeof raw !== 'object' || raw === null || Array.isArray(raw))
+        return raw;
+    const { mcp: _mcp, ...rest } = raw;
+    const isMcpDevice = (device) => typeof device === 'object' && device !== null
+        && device.endpoint?.kind === 'mcp';
+    const dropped = new Set();
+    if (Array.isArray(rest.devices)) {
+        for (const device of rest.devices) {
+            if (isMcpDevice(device))
+                dropped.add(String(device.endpoint.id));
+        }
+        rest.devices = rest.devices.filter(device => !isMcpDevice(device));
+    }
+    const provenance = rest.provenance;
+    if (typeof provenance === 'object' && provenance !== null && !Array.isArray(provenance)) {
+        rest.provenance = Object.fromEntries(Object.entries(provenance)
+            .filter(([id, value]) => !dropped.has(id) && value !== 'mcp'));
+    }
+    return rest;
+}
+const policySchema = z.preprocess(migrateLegacyPolicy, z.object({ version: z.literal(1), ownerId: z.string(), bridgeId: z.string(), bridgeEndpointId: z.string(),
     generation: z.number().int().nonnegative(), devices: z.array(approvedSchema).max(MAX_ENDPOINTS),
-    invitations: z.array(invitationSchema).max(256), mcp: z.array(pendingSchema).max(MAX_ENDPOINTS),
+    invitations: z.array(invitationSchema).max(256),
+    // Frozen: earlier releases require this key, so a downgrade must still parse what we write.
+    mcp: z.array(z.never()).max(0).default([]),
     account: storedAccountSchema.nullable().default(null),
-    provenance: z.record(z.string(), z.enum(['legacy', 'local-recovery', 'account', 'local-cli', 'mcp'])).default({}),
+    provenance: z.record(z.string(), z.enum(['legacy', 'local-recovery', 'account', 'local-cli'])).default({}),
 }).strict().superRefine((state, context) => {
     if (new Set(state.devices.map(device => device.endpoint.id)).size !== state.devices.length
-        || new Set(state.mcp.map(item => item.approved.grantId)).size !== state.mcp.length
         || state.devices.some(device => device.endpoint.ownerId !== state.ownerId
-            || (device.endpoint.kind === 'mcp') !== (device.grantId !== null)
-            || new Set(device.permissions).size !== device.permissions.length)
-        || state.mcp.some(item => !state.devices.some(device => JSON.stringify(device) === JSON.stringify(item.approved)))) {
+            || device.grantId !== null
+            || new Set(device.permissions).size !== device.permissions.length)) {
         context.addIssue({ code: z.ZodIssueCode.custom, message: 'Invalid policy relationship' });
     }
-});
+}));
 /** Identity comparison matters: request JSON cannot manufacture this recovery capability. */
 export const LOCAL_RECOVERY_AUTHORITY = Object.freeze({ source: 'os-local-recovery' });
 /** Bridge-owned authorization. Directory entries and caller-claimed permissions never enter this store. */
@@ -60,7 +79,7 @@ export class BridgePolicyStore {
             throw new BridgeSecurityError('wrong_context');
         }
     }
-    active(state, endpointId, pendingAllowed = false) {
+    active(state, endpointId) {
         this.check(state);
         const account = state.account;
         const member = account?.checkpoint.devices.find(item => item.endpoint.id === endpointId);
@@ -75,17 +94,12 @@ export class BridgePolicyStore {
         const record = state.devices.find(device => device.endpoint.id === endpointId);
         if (!record)
             throw new BridgeSecurityError('approval_required');
-        const pending = state.mcp.find(item => item.approved.endpoint.id === endpointId);
-        if (pending && !pending.active && (!pendingAllowed || Date.parse(pending.expiresAt) <= this.now())) {
-            throw new BridgeSecurityError(Date.parse(pending.expiresAt) <= this.now() ? 'expired' : 'approval_required');
-        }
         if (record.expiresAt && Date.parse(record.expiresAt) <= this.now())
             throw new BridgeSecurityError('expired');
         return record;
     }
     principalFrom(state, record) {
-        const pending = state.mcp.find(item => item.approved.endpoint.id === record.endpoint.id);
-        return { endpoint: record.endpoint, bridgeId: this.bridgeId, permissions: pending && !pending.active ? [] : record.permissions,
+        return { endpoint: record.endpoint, bridgeId: this.bridgeId, permissions: record.permissions,
             policyGeneration: state.generation, grantId: record.grantId };
     }
     authorize(state, actor, permission) {
@@ -99,8 +113,8 @@ export class BridgePolicyStore {
         }
         return record;
     }
-    async principal(endpointId, allowPendingHello = false) {
-        return this.snapshot.read(state => this.principalFrom(state, this.active(state, endpointId, allowPendingHello)));
+    async principal(endpointId) {
+        return this.snapshot.read(state => this.principalFrom(state, this.active(state, endpointId)));
     }
     async revalidate(actor, permission) {
         await this.snapshot.read(state => {
@@ -205,74 +219,6 @@ export class BridgePolicyStore {
             });
         });
     }
-    async approveMcp(actor, approval) {
-        let endpoint;
-        try {
-            endpoint = endpointSchema.parse(approval.endpoint);
-            boundedId.parse(approval.requestId);
-            boundedId.parse(approval.grantId);
-        }
-        catch {
-            throw new BridgeSecurityError('wrong_context');
-        }
-        const expires = Date.parse(approval.expiresAt);
-        const activeExpires = Date.parse(approval.activeExpiresAt);
-        if (endpoint.kind !== 'mcp' || endpoint.ownerId !== this.bridge.ownerId
-            || !Number.isFinite(expires) || expires <= this.now() || expires > this.now() + FIVE_MINUTES
-            || !Number.isFinite(activeExpires) || activeExpires <= expires || activeExpires > this.now() + THIRTY_DAYS
-            || !approval.permissions.includes('read') || approval.permissions.some(permission => permission !== 'read' && permission !== 'control')
-            || new Set(approval.permissions).size !== approval.permissions.length)
-            throw new BridgeSecurityError('wrong_context');
-        return this.snapshot.transact(state => {
-            this.authorize(state, actor, 'admin');
-            const expired = new Set(state.mcp.filter(item => Date.parse(item.active ? item.activeExpiresAt : item.expiresAt) <= this.now())
-                .map(item => item.approved.endpoint.id));
-            state.devices = state.devices.filter(device => !expired.has(device.endpoint.id));
-            state.mcp = state.mcp.filter(item => !expired.has(item.approved.endpoint.id));
-            const existing = state.mcp.find(item => item.approved.endpoint.id === endpoint.id || item.approved.grantId === approval.grantId);
-            let pending;
-            if (existing) {
-                if (existing.approved.endpoint.id !== endpoint.id || existing.approved.grantId !== approval.grantId
-                    || existing.requestId !== approval.requestId || existing.expiresAt !== approval.expiresAt
-                    || existing.activeExpiresAt !== approval.activeExpiresAt
-                    || JSON.stringify(existing.approved.permissions) !== JSON.stringify(approval.permissions))
-                    throw new BridgeSecurityError('wrong_context');
-                pending = existing;
-            }
-            else {
-                if (state.devices.some(device => device.endpoint.id === endpoint.id))
-                    throw new BridgeSecurityError('wrong_context');
-                if (state.devices.length >= MAX_ENDPOINTS)
-                    throw new BridgeSecurityError('capacity_exceeded');
-                const approved = { endpoint, label: 'MCP client', permissions: [...approval.permissions],
-                    approvedAt: new Date(this.now()).toISOString(), grantId: approval.grantId, expiresAt: approval.activeExpiresAt };
-                pending = { approved, approvalId: randomUUID(), requestId: approval.requestId, expiresAt: approval.expiresAt,
-                    activeExpiresAt: approval.activeExpiresAt, active: false };
-                state.devices.push(approved);
-                state.mcp.push(pending);
-                state.generation++;
-            }
-            return { type: 'mcp-approval', approvalId: pending.approvalId, requestId: pending.requestId, ownerId: this.bridge.ownerId,
-                grantId: approval.grantId, candidateEndpointId: endpoint.id, bridgeId: this.bridgeId, bridge: this.bridge,
-                permissions: [...approval.permissions], expiresAt: pending.expiresAt, activeExpiresAt: pending.activeExpiresAt };
-        });
-    }
-    async activateMcp(actor, grantId) {
-        return this.snapshot.transact(state => {
-            const record = this.active(state, actor.endpoint.id, true);
-            if (actor.policyGeneration !== state.generation)
-                throw new BridgeSecurityError('endpoint_revoked');
-            const pending = state.mcp.find(item => item.approved.endpoint.id === actor.endpoint.id);
-            if (actor.bridgeId !== this.bridgeId || actor.endpoint.publicKey !== record.endpoint.publicKey || actor.endpoint.kind !== 'mcp'
-                || !pending || record.grantId !== grantId || actor.grantId !== grantId)
-                throw new BridgeSecurityError('permission_denied');
-            if (!pending.active) {
-                pending.active = true;
-                state.generation++;
-            }
-            return { grantId, expiresAt: pending.activeExpiresAt };
-        });
-    }
     async revoke(actor, endpointId) {
         await this.snapshot.transact(state => {
             this.authorize(state, actor, 'admin');
@@ -280,7 +226,6 @@ export class BridgePolicyStore {
                 throw new BridgeSecurityError('account_approval_required');
             state.devices = state.devices.filter(device => device.endpoint.id !== endpointId);
             delete state.provenance[endpointId];
-            state.mcp = state.mcp.filter(item => item.approved.endpoint.id !== endpointId);
             state.generation++;
         });
     }

package/dist/security/bridge/policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../src/security/bridge/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC1G,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAG9E,MAAM,YAAY,GAAG,OAAO,CAAC;AAC7B,MAAM,WAAW,GAAG,EAAE,GAAG,UAAU,CAAC;AACpC,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACrF,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;IACvG,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,oBAAoB;IAC1G,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACpH,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS;IAC5G,SAAS,EAAE,oBAAoB,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAC1G,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5H,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC;IAC/F,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC;IAC/F,OAAO,EAAE,mBAAmB,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACrD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,gBAAgB,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAClH,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACzC,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,CAAC,MAAM;WACrF,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,GAAG,CAAC,MAAM;WAC/E,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;eACpE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC;eAC9D,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC;WACjE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACrH,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAC;IAC5F,CAAC;AACH,CAAC,CAAC,CAAC;AAIH,6FAA6F;AAC7F,MAAM,CAAC,MAAM,wBAAwB,GAA2B,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;AAI/G,2GAA2G;AAC3G,MAAM,OAAO,iBAAiB;IAIU;IAA2B;IAAyC;IAHzF,QAAQ,CAAyB;IACjC,GAAG,CAAe;IAClB,YAAY,CAAsB;IACnD,YAAY,OAAe,EAAW,QAAgB,EAAW,MAAsB,EAAmB,UAAyB,EAAE;QAA/F,aAAQ,GAAR,QAAQ,CAAQ;QAAW,WAAM,GAAN,MAAM,CAAgB;QAAmB,YAAO,GAAP,OAAO,CAAoB;QACnI,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAC7E,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,YAAY,GAAG,IAAI,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACzG,IAAI,CAAC,QAAQ,GAAG,IAAI,cAAc,CAAS,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,aAAa,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;YACxG,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC;YACzF,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE;SACrE,CAAC,CAAC,CAAC;IACN,CAAC;IACO,KAAK,CAAC,KAAa;QACzB,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,gBAAgB,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YAC3H,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACO,MAAM,CAAC,KAAa,EAAE,UAAkB,EAAE,cAAc,GAAG,KAAK;QACtE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAClB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC9B,MAAM,MAAM,GAAG,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;QACzF,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,OAAQ,CAAC,CAAC;YAClC,MAAM,GAAG,GAAG,OAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC;YACtF,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,IAAI,CAAC,MAAM,CAAC,SAAS;gBAAE,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,CAAC,CAAC;QAC9J,CAAC;aAAM,IAAI,OAAO,EAAE,UAAU,CAAC,gBAAgB,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,CAAC,CAAC;QAC9H,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;QAC/E,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;QACjF,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,cAAc,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YACnG,MAAM,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;QAC/G,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC7G,OAAO,MAAM,CAAC;IAChB,CAAC;IACO,aAAa,CAAC,KAAa,EAAE,MAAwB;QAC3D,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACzF,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW;YAC5H,gBAAgB,EAAE,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAClE,CAAC;IACO,SAAS,CAAC,KAAa,EAAE,KAAwB,EAAE,UAA8B;QACvF,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACvI,IAAI,KAAK,CAAC,gBAAgB,KAAK,KAAK,CAAC,UAAU;YAAE,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;QACnG,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,KAAK,KAAK,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACvG,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,UAAkB,EAAE,iBAAiB,GAAG,KAAK;QAC3D,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;IACnH,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,KAAwB,EAAE,UAA+B;QACxE,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YAC/B,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;YACvI,IAAI,KAAK,CAAC,gBAAgB,KAAK,KAAK,CAAC,UAAU;gBAAE,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;YACnG,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACrD,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,KAAK,KAAK,CAAC,QAAQ,CAAC,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;gBAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;YAC/I,IAAI,UAAU,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;QACjH,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,gBAAgB,CAAC,KAAiD,EAAE,OAA0B;QAClG,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,YAAY,GAAG,UAAU,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;QACpE,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YACnC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClB,IAAI,KAAK,KAAK,wBAAwB,EAAE,CAAC;gBACvC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAA0B,EAAE,OAAO,CAAC,CAAC;gBAC3D,IAAI,KAAK,CAAC,OAAO,IAAK,KAA2B,CAAC,QAAQ,CAAC,IAAI,KAAK,WAAW;oBAAE,MAAM,IAAI,mBAAmB,CAAC,2BAA2B,CAAC,CAAC;YAC9I,CAAC;YACD,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAC1G,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,IAAI,GAAG;gBAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;YACxF,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC;gBACvG,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QACvI,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM;YAC3G,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;IAChH,CAAC;IACD,KAAK,CAAC,iBAAiB,CAAC,OAA0B;QAChD,IAAI,SAAyB,CAAC;QAC9B,IAAI,CAAC;YAAC,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAAC,CAAC;QAC5D,MAAM,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;QAAC,CAAC;QAC9D,IAAI,SAAS,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS;eACxE,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;QAChH,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YACpC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClB,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;YACpF,IAAI,CAAC,UAAU,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvH,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;YACtD,CAAC;YACD,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;gBAAE,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;YACxG,IAAI,KAAK,CAAC,OAAO,IAAI,UAAU,CAAC,UAAU,KAAK,gBAAgB;gBAAE,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;YACrH,wFAAwF;YACxF,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,SAAS,CAAC,EAAE,CAAC;mBACjG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,2BAA2B,CAAC,CAAC;YACnI,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;gBAC1B,IAAI,UAAU,CAAC,UAAU,KAAK,SAAS,CAAC,EAAE;oBAAE,MAAM,IAAI,mBAAmB,CAAC,qBAAqB,CAAC,CAAC;gBACjG,yFAAyF;gBACzF,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;YAC1C,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,SAAS,CAAC,EAAE,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;YAC3H,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,aAAa;gBAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;YAC9F,MAAM,QAAQ,GAAqB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,KAAK;gBAC9G,WAAW,EAAE,CAAC,GAAG,UAAU,CAAC,WAAW,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAC7H,UAAU,CAAC,UAAU,GAAG,SAAS,CAAC,EAAE,CAAC;YACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7B,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,UAAU,CAAC;YACvD,KAAK,CAAC,UAAU,EAAE,CAAC;YACnB,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,KAAwB;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YAChC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YACtC,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;gBAChC,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBACxD,IAAI,UAAU,KAAK,SAAS;oBAAE,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,SAAkB,EAAE,CAAC;gBAC/E,IAAI,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,gBAAgB;oBAAE,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,OAAgB,EAAE,CAAC;gBAClH,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;YACvB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,UAAU;QACd,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YAChC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClB,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;gBACnC,IAAI,CAAC;oBAAC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,OAAO,KAAK,CAAC;gBAAC,CAAC;YAC7G,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,KAAwB,EAAE,QAAqB;QAC9D,IAAI,QAAwB,CAAC;QAC7B,IAAI,CAAC;YAAC,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QACnI,MAAM,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAAC,CAAC;QACzD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;QAC3D,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO;eAClE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY;eACzF,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,aAAa,IAAI,OAAO,IAAI,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW;eACvG,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,SAAS,CAAC;eACpI,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,WAAW,CAAC,MAAM;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACxH,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YACpC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YACtC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;iBAC5H,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YAC3C,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YACjF,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YAC9E,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,CAAC,CAAC;YACjI,IAAI,OAAgB,CAAC;YACrB,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO;uBAC9F,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;uBACtF,QAAQ,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;uBACrD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;oBAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;gBAC5I,OAAO,GAAG,QAAQ,CAAC;YACrB,CAAC;iBAAM,CAAC;gBACN,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,CAAC;oBAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;gBACrH,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,aAAa;oBAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;gBAC9F,MAAM,QAAQ,GAAqB,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC;oBACxG,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,eAAe,EAAE,CAAC;gBACnH,OAAO,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS;oBAC1G,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;gBAC7D,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YAC5E,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;gBACvH,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,mBAAmB,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM;gBACzG,WAAW,EAAE,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC;QACrH,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,WAAW,CAAC,KAAwB,EAAE,OAAe;QACzD,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YACpC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAC3D,IAAI,KAAK,CAAC,gBAAgB,KAAK,KAAK,CAAC,UAAU;gBAAE,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;YACnG,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACxF,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC,QAAQ,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK;mBAC1H,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO;gBAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;YAC7H,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;gBAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YAAC,CAAC;YACnE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC;QACzD,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,KAAwB,EAAE,UAAkB;QACvD,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YACnC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YACtC,IAAI,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,UAAU,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,2BAA2B,CAAC,CAAC;YAChJ,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;YAClF,OAAO,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YACpC,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;YAC/E,KAAK,CAAC,UAAU,EAAE,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,sBAAsB,CAAC,QAAwB;QACnD,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,SAAS,CAAC,IAAI,KAAK,WAAW,IAAI,SAAS,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAChI,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YACnC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClB,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,SAAS,CAAC,EAAE,CAAC;gBAAE,OAAO;YAC9E,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,aAAa;gBAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;YAC9F,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC;gBACrG,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YACxG,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,YAAY;QAChB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;IACD,KAAK,CAAC,kBAAkB;QACtB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3I,CAAC;IACD,YAAY,CAAC,IAAuB,IAAU,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9E,KAAK,CAAC,gBAAgB;QACpB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YAChC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClB,IAAI,CAAC,KAAK,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAChC,IAAI,CAAC;gBACH,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACvC,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC/H,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,KAAK,CAAC;YAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC;IACD,oFAAoF;IACpF,KAAK,CAAC,YAAY,CAAC,KAA2B;QAC5C,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAC,KAAK,EAAC,EAAE;YACzC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClB,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;gBAClB,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,KAAK,CAAC,UAAU,CAAC,MAAM;oBAAE,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,CAAC,CAAC;gBACzH,OAAO;YACT,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAC3F,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAClC,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/F,CAAC,CAAC,CAAC;IACL,CAAC;IACO,gBAAgB,CAAC,UAA4C;QACnE,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7E,IAAI,UAAU,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE;eACvF,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;IACxJ,CAAC;IACO,cAAc,CAAC,KAAa,EAAE,KAAyB;QAC7D,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;QAChF,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC;QACrC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,KAAK,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAC3E,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS;eACxE,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,gBAAgB;mBAChE,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;mBACjF,CAAC,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACvE,IAAI,KAAK;YAAE,KAAK,CAAC,WAAW,GAAG,EAAE,CAAC;QAClC,KAAK,MAAM,KAAK,IAAI,QAAQ;YAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAAE,OAAO,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAClJ,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnF,IAAI,GAAG,EAAE,QAAQ,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5F,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;gBACxH,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC;oBAC1H,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnE,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC;YACnD,CAAC;QACH,CAAC;QACD,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC;QACtB,IAAI,CAAC,SAAS;YAAE,KAAK,CAAC,UAAU,EAAE,CAAC;QACnC,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACnI,CAAC;IACD,yFAAyF;IACzF,KAAK,CAAC,gBAAgB,CAAC,OAAuB,EAAE,QAA0D;QACxG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAC,KAAK,EAAC,EAAE;YACxD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClB,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,mBAAmB,CAAC,2BAA2B,CAAC,CAAC;YAC5F,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS;oBAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;gBACnG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,IAAI,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACtG,IAAI,UAAU,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;YAC/F,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;gBAC3B,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI;oBAAE,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,CAAC,CAAC;gBACzK,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;gBAClC,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAChG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;oBAC9I,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,CAAC,CAAC;gBAC1D,CAAC;gBACD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC;YACjG,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAChD,MAAM,KAAK,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC;gBAC5F,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,EAAE,CAAC;YAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAClD,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACvH,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IACxD,CAAC;IACD,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YACnC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClB,IAAI,KAAK,CAAC,OAAO;gBAAE,KAAK,CAAC,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1H,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;CACF"}
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../src/security/bridge/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,cAAc,EAAa,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC1G,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAG9E,MAAM,YAAY,GAAG,OAAO,CAAC;AAC7B,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACrF,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;IACvG,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,oBAAoB;IAC1G,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACpH,0IAA0I;AAC1I,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAC9E,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,GAA8B,CAAC;IAC9D,MAAM,WAAW,GAAG,CAAC,MAAe,EAAE,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;WAChF,MAA4C,CAAC,QAAQ,EAAE,IAAI,KAAK,KAAK,CAAC;IAC5E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,WAAW,CAAC,MAAM,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAE,MAAyC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACnC,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACxF,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;aAC5D,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AACD,MAAM,YAAY,GAAG,CAAC,CAAC,UAAU,CAAC,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC9J,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC;IAC/F,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC/C,4FAA4F;IAC5F,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1C,OAAO,EAAE,mBAAmB,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACrD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,gBAAgB,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC3G,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACzC,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,CAAC,MAAM;WACrF,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;eACpE,MAAM,CAAC,OAAO,KAAK,IAAI;eACvB,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QACvE,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAC;IAC5F,CAAC;AACH,CAAC,CAAC,CAAC,CAAC;AAGJ,6FAA6F;AAC7F,MAAM,CAAC,MAAM,wBAAwB,GAA2B,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;AAI/G,2GAA2G;AAC3G,MAAM,OAAO,iBAAiB;IAIU;IAA2B;IAAyC;IAHzF,QAAQ,CAAyB;IACjC,GAAG,CAAe;IAClB,YAAY,CAAsB;IACnD,YAAY,OAAe,EAAW,QAAgB,EAAW,MAAsB,EAAmB,UAAyB,EAAE;QAA/F,aAAQ,GAAR,QAAQ,CAAQ;QAAW,WAAM,GAAN,MAAM,CAAgB;QAAmB,YAAO,GAAP,OAAO,CAAoB;QACnI,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAC7E,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,YAAY,GAAG,IAAI,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACzG,IAAI,CAAC,QAAQ,GAAG,IAAI,cAAc,CAAS,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,aAAa,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;YACxG,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC;YACzF,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE;SACrE,CAAC,CAAC,CAAC;IACN,CAAC;IACO,KAAK,CAAC,KAAa;QACzB,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,gBAAgB,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YAC3H,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACO,MAAM,CAAC,KAAa,EAAE,UAAkB;QAC9C,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAClB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC9B,MAAM,MAAM,GAAG,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;QACzF,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,OAAQ,CAAC,CAAC;YAClC,MAAM,GAAG,GAAG,OAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC;YACtF,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,IAAI,CAAC,MAAM,CAAC,SAAS;gBAAE,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,CAAC,CAAC;QAC9J,CAAC;aAAM,IAAI,OAAO,EAAE,UAAU,CAAC,gBAAgB,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,CAAC,CAAC;QAC9H,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;QAC/E,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;QAChE,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC7G,OAAO,MAAM,CAAC;IAChB,CAAC;IACO,aAAa,CAAC,KAAa,EAAE,MAAwB;QAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW;YAC1F,gBAAgB,EAAE,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAClE,CAAC;IACO,SAAS,CAAC,KAAa,EAAE,KAAwB,EAAE,UAA8B;QACvF,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACvI,IAAI,KAAK,CAAC,gBAAgB,KAAK,KAAK,CAAC,UAAU;YAAE,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;QACnG,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,KAAK,KAAK,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACvG,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,UAAkB;QAChC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IAChG,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,KAAwB,EAAE,UAA+B;QACxE,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YAC/B,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;YACvI,IAAI,KAAK,CAAC,gBAAgB,KAAK,KAAK,CAAC,UAAU;gBAAE,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;YACnG,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACrD,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,KAAK,KAAK,CAAC,QAAQ,CAAC,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;gBAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;YAC/I,IAAI,UAAU,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;QACjH,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,gBAAgB,CAAC,KAAiD,EAAE,OAA0B;QAClG,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,YAAY,GAAG,UAAU,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;QACpE,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YACnC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClB,IAAI,KAAK,KAAK,wBAAwB,EAAE,CAAC;gBACvC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAA0B,EAAE,OAAO,CAAC,CAAC;gBAC3D,IAAI,KAAK,CAAC,OAAO,IAAK,KAA2B,CAAC,QAAQ,CAAC,IAAI,KAAK,WAAW;oBAAE,MAAM,IAAI,mBAAmB,CAAC,2BAA2B,CAAC,CAAC;YAC9I,CAAC;YACD,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAC1G,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,IAAI,GAAG;gBAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;YACxF,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC;gBACvG,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QACvI,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM;YAC3G,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;IAChH,CAAC;IACD,KAAK,CAAC,iBAAiB,CAAC,OAA0B;QAChD,IAAI,SAAyB,CAAC;QAC9B,IAAI,CAAC;YAAC,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAAC,CAAC;QAC5D,MAAM,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;QAAC,CAAC;QAC9D,IAAI,SAAS,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS;eACxE,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;QAChH,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YACpC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClB,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;YACpF,IAAI,CAAC,UAAU,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvH,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;YACtD,CAAC;YACD,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;gBAAE,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;YACxG,IAAI,KAAK,CAAC,OAAO,IAAI,UAAU,CAAC,UAAU,KAAK,gBAAgB;gBAAE,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;YACrH,wFAAwF;YACxF,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,SAAS,CAAC,EAAE,CAAC;mBACjG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,2BAA2B,CAAC,CAAC;YACnI,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;gBAC1B,IAAI,UAAU,CAAC,UAAU,KAAK,SAAS,CAAC,EAAE;oBAAE,MAAM,IAAI,mBAAmB,CAAC,qBAAqB,CAAC,CAAC;gBACjG,yFAAyF;gBACzF,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;YAC1C,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,SAAS,CAAC,EAAE,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;YAC3H,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,aAAa;gBAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;YAC9F,MAAM,QAAQ,GAAqB,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,KAAK;gBAC9G,WAAW,EAAE,CAAC,GAAG,UAAU,CAAC,WAAW,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAC7H,UAAU,CAAC,UAAU,GAAG,SAAS,CAAC,EAAE,CAAC;YACrC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7B,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,UAAU,CAAC;YACvD,KAAK,CAAC,UAAU,EAAE,CAAC;YACnB,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,KAAwB;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YAChC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YACtC,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;gBAChC,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBACxD,IAAI,UAAU,KAAK,SAAS;oBAAE,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,SAAkB,EAAE,CAAC;gBAC/E,IAAI,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,gBAAgB;oBAAE,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,OAAgB,EAAE,CAAC;gBAClH,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;YACvB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,UAAU;QACd,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YAChC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClB,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;gBACnC,IAAI,CAAC;oBAAC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,OAAO,KAAK,CAAC;gBAAC,CAAC;YAC7G,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,KAAwB,EAAE,UAAkB;QACvD,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YACnC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YACtC,IAAI,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,UAAU,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,2BAA2B,CAAC,CAAC;YAChJ,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;YAClF,OAAO,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YACpC,KAAK,CAAC,UAAU,EAAE,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,sBAAsB,CAAC,QAAwB;QACnD,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,SAAS,CAAC,IAAI,KAAK,WAAW,IAAI,SAAS,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAChI,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YACnC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClB,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,SAAS,CAAC,EAAE,CAAC;gBAAE,OAAO;YAC9E,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,aAAa;gBAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;YAC9F,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC;gBACrG,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YACxG,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,YAAY;QAChB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;IACD,KAAK,CAAC,kBAAkB;QACtB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3I,CAAC;IACD,YAAY,CAAC,IAAuB,IAAU,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9E,KAAK,CAAC,gBAAgB;QACpB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YAChC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClB,IAAI,CAAC,KAAK,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAChC,IAAI,CAAC;gBACH,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACvC,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC/H,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,KAAK,CAAC;YAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC;IACD,oFAAoF;IACpF,KAAK,CAAC,YAAY,CAAC,KAA2B;QAC5C,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAC,KAAK,EAAC,EAAE;YACzC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClB,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;gBAClB,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,KAAK,CAAC,UAAU,CAAC,MAAM;oBAAE,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,CAAC,CAAC;gBACzH,OAAO;YACT,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAC3F,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAClC,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/F,CAAC,CAAC,CAAC;IACL,CAAC;IACO,gBAAgB,CAAC,UAA4C;QACnE,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7E,IAAI,UAAU,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE;eACvF,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;IACxJ,CAAC;IACO,cAAc,CAAC,KAAa,EAAE,KAAyB;QAC7D,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;QAChF,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC;QACrC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,KAAK,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAC3E,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS;eACxE,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,gBAAgB;mBAChE,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;mBACjF,CAAC,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACvE,IAAI,KAAK;YAAE,KAAK,CAAC,WAAW,GAAG,EAAE,CAAC;QAClC,KAAK,MAAM,KAAK,IAAI,QAAQ;YAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAAE,OAAO,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAClJ,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnF,IAAI,GAAG,EAAE,QAAQ,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5F,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;gBACxH,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC;oBAC1H,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnE,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC;YACnD,CAAC;QACH,CAAC;QACD,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC;QACtB,IAAI,CAAC,SAAS;YAAE,KAAK,CAAC,UAAU,EAAE,CAAC;QACnC,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACnI,CAAC;IACD,yFAAyF;IACzF,KAAK,CAAC,gBAAgB,CAAC,OAAuB,EAAE,QAA0D;QACxG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAC,KAAK,EAAC,EAAE;YACxD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClB,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,mBAAmB,CAAC,2BAA2B,CAAC,CAAC;YAC5F,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS;oBAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;gBACnG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,IAAI,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACtG,IAAI,UAAU,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;YAC/F,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;gBAC3B,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI;oBAAE,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,CAAC,CAAC;gBACzK,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;gBAClC,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAChG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;oBAC9I,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,CAAC,CAAC;gBAC1D,CAAC;gBACD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC;YACjG,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAChD,MAAM,KAAK,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC;gBAC5F,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,EAAE,CAAC;YAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAClD,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACvH,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IACxD,CAAC;IACD,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YACnC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClB,IAAI,KAAK,CAAC,OAAO;gBAAE,KAAK,CAAC,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1H,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;CACF"}

package/dist/security/bridge/security.d.ts

@@ -1,12 +1,13 @@
-import type { ApplicationJson, ApprovedEndpoint, BridgeInvitation, BridgeSecurity, EndpointIdentity, EnrollmentPacket, InboundTransportContext, InvitationOptions, LocalRecoveryAuthority, McpApproval, McpBridgeApproval, SecureApplication, SecureEnvelope, SecurePublication, VerifiedApplication, VerifiedPrincipal } from '../protocol.js';
+import type { ApplicationJson, ApprovedEndpoint, BridgeInvitation, BridgeSecurity, EndpointIdentity, EnrollmentPacket, InboundTransportContext, InvitationOptions, LocalRecoveryAuthority, SecureApplication, SecureEnvelope, SecurePublication, VerifiedApplication, VerifiedPrincipal } from '../protocol.js';
 import { BridgePolicyStore, type PolicyOptions } from './policy.js';
-import { BridgeAuditStore } from './audit.js';
 import type { AccountHead, AccountHistory, VerifiedAccountTrust } from '../account-protocol.js';
 export declare const applicationJson: (value: unknown) => ApplicationJson;
 export interface BridgeSecurityOptions extends PolicyOptions {
     relayUserId: string;
     browserOrigin?: string;
     readAccountHistory?: (signal?: AbortSignal) => Promise<AccountHistory | null>;
+    /** Jitter source for account-read retry backoff; defaults to Math.random. */
+    random?: () => number;
 }
 export declare class BridgeSecurityService implements BridgeSecurity {
     readonly identity: EndpointIdentity;
@@ -15,17 +16,15 @@ export declare class BridgeSecurityService implements BridgeSecurity {
     readonly endpoint: import("../protocol.js").EndpointPublic;
     readonly receiverEpoch: `${string}-${string}-${string}-${string}-${string}`;
     readonly policy: BridgePolicyStore;
-    readonly audit: BridgeAuditStore;
     private readonly now;
     private readonly replay;
     private readonly revoked;
-    private readonly admissions;
     private readonly verified;
     private closed;
     private accountTimer;
     private accountTimerDue;
     private accountPushHealthy;
-    private accountReadOk;
+    private accountReadFailures;
     private accountRefresh;
     private accountTrigger;
     private readonly accountAbort;
@@ -38,28 +37,24 @@ export declare class BridgeSecurityService implements BridgeSecurity {
     handleHandshake(packet: SecureEnvelope | EnrollmentPacket, route: InboundTransportContext): Promise<SecureEnvelope>;
     private parseApplication;
     private requirement;
-    private admission;
     acceptApplication(packet: SecureEnvelope, route: InboundTransportContext): Promise<VerifiedApplication>;
     revalidate(principal: VerifiedPrincipal): Promise<void>;
     /** One non-content receipt, prepared while authorized and released only after durable self-removal. */
     revokeSelfWithReceipt(message: VerifiedApplication, route: InboundTransportContext): Promise<SecureEnvelope | null>;
-    complete(message: VerifiedApplication, status: 'succeeded' | 'rejected' | 'failed' | 'unknown', errorCode?: string | null): Promise<void>;
     sealTo(recipientId: string, application: SecureApplication, route: InboundTransportContext): Promise<SecureEnvelope>;
     sealPublication(channel: string, application: SecureApplication): Promise<(SecureEnvelope | SecurePublication)[]>;
     createInvitation(actor: VerifiedPrincipal | LocalRecoveryAuthority, options: InvitationOptions): Promise<BridgeInvitation>;
     listDevices(actor: VerifiedPrincipal): Promise<ApprovedEndpoint[]>;
-    approveMcp(actor: VerifiedPrincipal, approval: McpApproval): Promise<McpBridgeApproval>;
-    activateMcp(actor: VerifiedPrincipal, grantId: string): Promise<{
-        grantId: string;
-        expiresAt: string;
-    }>;
     revokeEndpoint(actor: VerifiedPrincipal, endpointId: string): Promise<void>;
     /** Called once at startup; legacy/Solo stores never adopt an unsigned server directory. */
     startAccount(trust?: VerifiedAccountTrust): Promise<void>;
-    /** Safety read: 1 h only while push is healthy and the last read succeeded, else the 30 s cadence. */
+    private recordAccountRead;
+    /** After failures the server is the only writer of account state, so retrying fast buys nothing: back off with jitter. */
+    private nextAccountReadDelay;
+    /** Safety read: 1 h while push is healthy and the last read succeeded, else the 10 min cadence; failed reads back off from 60 s to 30 min. */
     private scheduleAccountRead;
     private trackedAccountRead;
-    /** Push (nudge subscription) health; losing it pulls the next safety read in to the 30 s cadence. */
+    /** Push (nudge subscription) health; losing it pulls the next safety read in to the 10 min cadence. */
     setAccountPushHealthy(healthy: boolean): void;
     /** Push-driven re-read (account nudge); bursts coalesce into at most one trailing read. */
     requestAccountRefresh(): void;

package/dist/security/bridge/security.js

@@ -2,7 +2,6 @@ import { randomUUID } from 'node:crypto';
 import { z } from 'zod';
 import { open, seal, parseSecureEnvelope } from '../crypto.js';
 import { BridgePolicyStore } from './policy.js';
-import { BridgeAuditStore } from './audit.js';
 import { BridgeSecurityError } from './errors.js';
 import { classifyCommand, classifyHttp, classifyTerminal } from './permissions.js';
 import { endpointSchema } from './metadata.js';
@@ -10,8 +9,6 @@ import { ACCOUNT_TRUST_LIMITS, AccountTrustError } from '../account-crypto.js';
 import { AccountReadUnavailable } from './account-client.js';
 import { ACCOUNT_SAFETY_REFRESH_MS, SECURITY_NUDGE_MIN_SPACING_MS, createCoalescedTrigger } from '../security-nudge.js';
 const token = z.string().regex(/^[A-Za-z0-9_-]{1,200}$/);
-const actionSchema = z.object({ actionId: token, parentActionId: token.nullable(), clientId: token, grantId: token,
-    tool: z.string().max(200), operation: z.string().max(200).nullable() }).strict();
 const routeSchema = z.discriminatedUnion('kind', [
     z.object({ kind: z.literal('command'), requestId: token, command: z.string().min(1).max(100), sessionId: token.nullable() }).strict(),
     z.object({ kind: z.literal('http'), requestId: token, method: z.enum(['GET', 'POST', 'PATCH', 'PUT', 'DELETE']), path: z.string().max(16384) }).strict(),
@@ -24,6 +21,8 @@ const object = (value) => {
     return value;
 };
 export const applicationJson = (value) => JSON.parse(JSON.stringify(value));
+const ACCOUNT_READ_RETRY_BASE_MS = 60_000;
+const ACCOUNT_READ_RETRY_MAX_MS = 1_800_000;
 export class BridgeSecurityService {
     identity;
     bridgeId;
@@ -31,17 +30,15 @@ export class BridgeSecurityService {
     endpoint;
     receiverEpoch = randomUUID();
     policy;
-    audit;
     now;
     replay = new Map();
     revoked = new Set();
-    admissions = new Map();
     verified = new WeakSet();
     closed = false;
     accountTimer = null;
     accountTimerDue = 0;
     accountPushHealthy = false;
-    accountReadOk = true;
+    accountReadFailures = 0;
     accountRefresh = null;
     accountTrigger = null;
     accountAbort = new AbortController();
@@ -52,7 +49,6 @@ export class BridgeSecurityService {
         this.endpoint = identity.endpoint;
         this.now = options.now ?? Date.now;
         this.policy = new BridgePolicyStore(dataDir, bridgeId, this.endpoint, options);
-        this.audit = new BridgeAuditStore(dataDir, this.endpoint.ownerId, bridgeId, options);
     }
     context(route) {
         if (this.closed || route.bridgeId !== this.bridgeId)
@@ -121,17 +117,16 @@ export class BridgeSecurityService {
         if (envelope.purpose !== 'hello')
             throw new BridgeSecurityError('wrong_context');
         this.freshness(envelope, false);
-        const principal = await this.policy.principal(envelope.senderId, true);
+        const principal = await this.policy.principal(envelope.senderId);
         const hello = z.object({ type: z.literal('hello'), challenge: token }).strict().parse(await this.decode(principal.endpoint, envelope, route));
         const welcome = await this.reply(principal.endpoint, 'welcome', { type: 'welcome', challenge: hello.challenge, receiverEpoch: this.receiverEpoch }, route, envelope.messageId);
-        // Pending MCP identities may hello but cannot acquire ordinary application permissions.
-        const current = await this.policy.principal(principal.endpoint.id, true);
+        const current = await this.policy.principal(principal.endpoint.id);
         if (current.endpoint.publicKey !== principal.endpoint.publicKey)
             throw new BridgeSecurityError('wrong_context');
         return welcome;
     }
     parseApplication(value) {
-        const parsed = z.object({ type: z.literal('application'), route: routeSchema, data: z.unknown().optional(), mcp: actionSchema.nullable() }).strict().parse(value);
+        const parsed = z.object({ type: z.literal('application'), route: routeSchema, data: z.unknown().optional(), mcp: z.null() }).strict().parse(value);
         return { ...parsed, data: applicationJson(parsed.data) };
     }
     requirement(application, transport) {
@@ -171,26 +166,11 @@ export class BridgeSecurityService {
         }
         throw new BridgeSecurityError('permission_denied');
     }
-    async admission(envelope, principal, app, operation) {
-        if (principal.endpoint.kind !== 'mcp') {
-            if (app.mcp !== null)
-                throw new BridgeSecurityError('permission_denied');
-            return;
-        }
-        const context = app.mcp;
-        if (!context || context.grantId !== principal.grantId)
-            throw new BridgeSecurityError('wrong_context');
-        const admitted = await this.audit.admit({ admissionId: envelope.messageId, ...context, endpointId: principal.endpoint.id,
-            operation: operation.operation, sessionId: operation.sessionId, mutating: operation.mutating });
-        if (!admitted.isNew)
-            throw new BridgeSecurityError('replayed');
-        this.admissions.set(`${envelope.senderId}:${envelope.messageId}`, admitted.event.id);
-    }
     async acceptApplication(packet, route) {
         const envelope = parseSecureEnvelope(packet);
         if (envelope.purpose !== 'application')
             throw new BridgeSecurityError('wrong_context');
-        const principal = await this.policy.principal(envelope.senderId, true);
+        const principal = await this.policy.principal(envelope.senderId);
         const app = this.parseApplication(await this.decode(principal.endpoint, envelope, route));
         if (app.route.kind === 'http') {
             const data = object(app.data);
@@ -200,36 +180,8 @@ export class BridgeSecurityService {
         }
         this.freshness(envelope, true);
         this.claim(envelope);
-        // Pending identities can do precisely this one bound operation; never generic application work.
-        if (app.route.kind === 'command' && app.route.command === 'security_activate_mcp') {
-            const data = object(app.data);
-            const payload = object(data.payload ?? null);
-            if (data.type !== app.route.command || data.requestId !== app.route.requestId || payload.bridgeId !== this.bridgeId
-                || payload.grantId !== principal.grantId || principal.endpoint.kind !== 'mcp')
-                throw new BridgeSecurityError('permission_denied');
-            const message = { principal, envelope, application: app };
-            this.verified.add(message);
-            return message;
-        }
-        let operation;
-        try {
-            operation = this.requirement(app, route);
-        }
-        catch (error) {
-            if (principal.endpoint.kind === 'mcp' && app.mcp) {
-                await this.admission(envelope, principal, app, { permission: 'control', mutating: true, operation: 'invalid_operation', sessionId: null });
-                await this.complete({ principal, envelope, application: app }, 'rejected', 'permission_denied');
-            }
-            throw error;
-        }
-        await this.admission(envelope, principal, app, operation);
-        try {
-            await this.policy.revalidate(principal, operation.permission);
-        }
-        catch (error) {
-            await this.complete({ principal, envelope, application: app }, 'rejected', 'permission_denied');
-            throw error;
-        }
+        const operation = this.requirement(app, route);
+        await this.policy.revalidate(principal, operation.permission);
         const message = { principal, envelope, application: app };
         this.verified.add(message);
         return message;
@@ -254,25 +206,11 @@ export class BridgeSecurityService {
             route: { kind: 'response', requestId: application.route.requestId }, mcp: null,
             data: { type: 'command_response', response: { requestId: application.route.requestId, success: true,
                     data: { endpointId: message.principal.endpoint.id, revoked: true } } } }, route, application.route.requestId);
-        // No sealed value leaves this method before both persistence steps have succeeded.
+        // No sealed value leaves this method before the durable self-removal has succeeded.
         await this.revokeEndpoint(message.principal, message.principal.endpoint.id);
-        await this.complete(message, 'succeeded');
         this.verified.delete(message);
         return receipt;
     }
-    async complete(message, status, errorCode = null) {
-        const key = `${message.envelope.senderId}:${message.envelope.messageId}`;
-        const admission = this.admissions.get(key);
-        if (!admission)
-            return;
-        try {
-            await this.audit.finish(admission, status, errorCode);
-            this.admissions.delete(key);
-        }
-        catch {
-            throw new BridgeSecurityError('outcome_unknown');
-        }
-    }
     async sealTo(recipientId, application, route) {
         const principal = await this.policy.principal(recipientId);
         const envelope = await this.reply(principal.endpoint, 'application', application, route, application.route.kind === 'response' ? application.route.requestId : randomUUID());
@@ -296,13 +234,6 @@ export class BridgeSecurityService {
     }
     createInvitation(actor, options) { return this.policy.createInvitation(actor, options); }
     listDevices(actor) { return this.policy.list(actor); }
-    async approveMcp(actor, approval) {
-        const receipt = await this.policy.approveMcp(actor, approval);
-        const envelope = await this.reply(approval.endpoint, 'mcp-approval', receipt, { transport: 'cloud', channel: `mcp-approval:${this.bridgeId}:${approval.requestId}`,
-            bridgeId: this.bridgeId, pairId: null });
-        return { bridgeId: this.bridgeId, bridge: this.endpoint, receipt: envelope };
-    }
-    activateMcp(actor, grantId) { return this.policy.activateMcp(actor, grantId); }
     async revokeEndpoint(actor, endpointId) {
         await this.policy.revoke(actor, endpointId);
         for (const listener of this.revoked)
@@ -312,12 +243,23 @@ export class BridgeSecurityService {
     async startAccount(trust) {
         if (trust)
             await this.policy.pinBootstrap(trust);
-        this.accountReadOk = await this.refreshAccount().then(() => true, () => false);
+        this.recordAccountRead(await this.refreshAccount().then(() => true, () => false));
         if (!this.closed && !this.accountTimer && this.options.readAccountHistory)
             this.scheduleAccountRead();
     }
-    /** Safety read: 1 h only while push is healthy and the last read succeeded, else the 30 s cadence. */
-    scheduleAccountRead(delay = this.accountPushHealthy && this.accountReadOk ? ACCOUNT_SAFETY_REFRESH_MS : ACCOUNT_TRUST_LIMITS.refreshIntervalMs) {
+    recordAccountRead(ok) {
+        this.accountReadFailures = ok ? 0 : this.accountReadFailures + 1;
+    }
+    /** After failures the server is the only writer of account state, so retrying fast buys nothing: back off with jitter. */
+    nextAccountReadDelay() {
+        if (this.accountReadFailures > 0) {
+            const base = Math.min(ACCOUNT_READ_RETRY_BASE_MS * 2 ** (this.accountReadFailures - 1), ACCOUNT_READ_RETRY_MAX_MS);
+            return base * (0.8 + 0.4 * (this.options.random ?? Math.random)());
+        }
+        return this.accountPushHealthy ? ACCOUNT_SAFETY_REFRESH_MS : ACCOUNT_TRUST_LIMITS.refreshIntervalMs;
+    }
+    /** Safety read: 1 h while push is healthy and the last read succeeded, else the 10 min cadence; failed reads back off from 60 s to 30 min. */
+    scheduleAccountRead(delay = this.nextAccountReadDelay()) {
         if (this.closed || !this.options.readAccountHistory)
             return;
         if (this.accountTimer)
@@ -329,14 +271,14 @@ export class BridgeSecurityService {
     async trackedAccountRead() {
         try {
             await this.refreshAccount();
-            this.accountReadOk = true;
+            this.recordAccountRead(true);
         }
         catch {
-            this.accountReadOk = false;
+            this.recordAccountRead(false);
         }
         this.scheduleAccountRead();
     }
-    /** Push (nudge subscription) health; losing it pulls the next safety read in to the 30 s cadence. */
+    /** Push (nudge subscription) health; losing it pulls the next safety read in to the 10 min cadence. */
     setAccountPushHealthy(healthy) {
         const lost = this.accountPushHealthy && !healthy;
         this.accountPushHealthy = healthy;
@@ -426,7 +368,6 @@ export class BridgeSecurityService {
         await this.accountRefresh?.catch(() => undefined);
         this.revoked.clear();
         this.replay.clear();
-        await this.audit.close();
         await this.policy.close();
     }
 }