hikoutei 0.5.15 → 0.5.16

package/README.md

@@ -125,11 +125,64 @@ an operation for each write. The sync runtime uses one Google Sheets API
 provider (the internal `googleSheetsApi` bootstrap option) with a service
 account — no Apps Script deployment.
 
-**Fastest path:** install the gcloud CLI, run `gcloud auth login`, then
-`npx hikoutei setup` — it creates the project, service account, key, and a
-spreadsheet owned by that service account, and writes
-`GOOGLE_APPLICATION_CREDENTIALS` plus `HIKOUTEI_SYNC_SPREADSHEET_URL` into
-your `.env`. The manual steps below remain available for advanced setups.
+**Fastest path:** install the gcloud CLI and log in once with Drive access
+(`gcloud auth login --enable-gdrive-access`), then `npx hikoutei setup` — it
+creates the project, service account, and key, creates a spreadsheet owned
+by your account, shares it with the service account as an Editor, verifies
+service-account access, and writes `GOOGLE_APPLICATION_CREDENTIALS` plus
+`HIKOUTEI_SYNC_SPREADSHEET_URL` into your `.env`. The human access token is
+used in memory only and never stored. Automatic setup runs on macOS and
+Linux; on Windows a non-dry-run is refused before any mutation and manual
+setup is available. Interrupted runs resume from a local checkpoint
+(`.hikoutei-setup-state.json`); a spreadsheet create whose outcome is
+unknown is reconciled by its creation marker on the next run and setup
+never creates a second spreadsheet (inspect Drive and rerun if setup
+reports `sheet_create_uncertain`, and a create rejected up front with
+HTTP 400/403 plus a confirmed-zero marker lookup rolls back to `key_ready`
+so a corrected rerun starts a fresh marker). Sharing is write-ahead too:
+`spreadsheet_share_started` is persisted before the idempotent SA writer
+permission ensure and `spreadsheet_shared` after it, so a crash between
+the remote permission mutation and the checkpoint write resumes the
+ensure on the next run and never creates a second spreadsheet. The
+service-account key is
+created under a write-ahead contract too: the user-managed key list is
+recorded as a baseline before the single gcloud key create, and
+`key_create_started`/`key_ready` checkpoints let a crashed run recover a
+staged or installed key instead of creating a second one. Only the
+invocation that just persisted `key_create_started` may issue the one key
+create; resumed runs are reconcile-only and, when no credential and no
+post-baseline key are visible, poll the key list plus staged/final
+evidence for up to two minutes (2, 4, 8, 16, 30, 30, 30 s) before failing
+with `key_create_uncertain` — the create is never retried automatically.
+An unmatched user-managed key with no local credential is never deleted
+automatically — setup fails with `key_create_uncertain` and you inspect
+the key list in the Google Cloud console before rerunning (a
+verified-absent state requires removing the setup state file to reset the
+key checkpoint); reused keys are enforced to owner-only mode 600. An exclusive lock directory
+(`.hikoutei-setup-state.json.lock`) prevents concurrent runs and is never
+removed automatically: a crash leaves an empty lock directory behind, and
+removing it manually is required only when you are certain no setup is
+running. Starting fresh requires removing or moving both the checkpoint and
+the key file, or passing `--project` to recover an existing key —
+checkpointed or identity-matched cloud resources are reused, and setup
+never deletes cloud resources. The manual steps below remain available for
+advanced setups.
+
+**Keep setup artifacts out of Git.** `hikoutei setup` writes its defaults
+into the current directory: the service-account key
+(`hikoutei-service-account.json`, owner-only mode 600 — a secret), the
+resume checkpoint (`.hikoutei-setup-state.json` and its `.tmp`/unique-temp
+and `.lock` siblings), private key staging/cleanup directories
+(`.hikoutei-key-stage-*`, `.hikoutei-key-cleanup-*`), and
+`.hikoutei-env-*` temporary env writes. The repository's `.gitignore`
+already ignores these defaults, so a plain `git add .` does not pick them
+up. A `.gitignore` is **not a security boundary**, though: it only keeps
+untracked files out of `git add`, and it does not protect files that are
+already tracked (remove a mistakenly tracked key from history and rotate
+it — delete the user-managed key in the Cloud console and rerun setup).
+When you use a custom `--output` or keep the key or checkpoint at custom
+paths, add those exact paths to your application's ignore rules and never
+commit them.
 
 ### Env-driven sync auto-start
 
@@ -161,7 +214,11 @@ shared on the spreadsheet (the error tells you which email to share).
    access is not enough.
 2. **Keep the key server-side.** Put the service-account key path in
    `GOOGLE_APPLICATION_CREDENTIALS` on the server and the spreadsheet ID in an
-   untracked secret store. Never put the key in browser code or Git.
+   untracked secret store. Never put the key in browser code or Git: add the
+   key path (and any custom `.env`/checkpoint paths) to the application's
+   `.gitignore` — the defaults created by `hikoutei setup` are already
+   ignored, but a `.gitignore` is not a security boundary and does not
+   protect already-tracked files.
 3. **Start the internal sync bootstrap** with `googleSheetsApi` configured. It
    creates and verifies headers on the registered tabs, then starts outbox
    delivery and User_Input polling.

package/dist/cli/args.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"args.d.ts","sourceRoot":"","sources":["../../src/cli/args.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAmC,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAEjF,kEAAkE;AAClE,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAE7C,iFAAiF;AACjF,eAAO,MAAM,wBAAwB,SAAS,CAAC;AAE/C,mEAAmE;AACnE,MAAM,WAAW,YAAY;IAC3B,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iFAAiF;IACjF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qCAAqC;IACrC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,qEAAqE;IACrE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,gDAAgD;AAChD,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;CAAE,CAAC;AAanE,eAAO,MAAM,eAAe,QAyBhB,CAAC;AAUb;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,oBAAoB,CA6E5E"}
+{"version":3,"file":"args.d.ts","sourceRoot":"","sources":["../../src/cli/args.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAmC,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAEjF,kEAAkE;AAClE,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAE7C,iFAAiF;AACjF,eAAO,MAAM,wBAAwB,SAAS,CAAC;AAE/C,mEAAmE;AACnE,MAAM,WAAW,YAAY;IAC3B,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iFAAiF;IACjF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qCAAqC;IACrC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,qEAAqE;IACrE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,gDAAgD;AAChD,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;CAAE,CAAC;AAanE,eAAO,MAAM,eAAe,QAkEhB,CAAC;AAUb;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,oBAAoB,CAyG5E"}

package/dist/cli/args.js

@@ -5,6 +5,7 @@
  * the filesystem, or the network. The result is an explicit union so the CLI
  * entry can branch on help / valid / invalid without inspecting message text.
  */
+import { isValidGcpProjectId, isValidServiceAccountName } from "./checkpoint.js";
 import { SETUP_ERROR_CODES, setupFailure } from "./errors.js";
 /** Default service-account name when `--sa-name` is not given. */
 export const DEFAULT_SA_NAME = "hikoutei-sa";
@@ -22,10 +23,12 @@ const SETUP_FLAGS = {
 };
 export const SETUP_HELP_TEXT = [
     "hikoutei setup - bootstrap a Google Cloud project, service account, key, and",
-    "spreadsheet for Hikoutei sync, then write a ready-to-use .env file.",
+    "a human-owned spreadsheet for Hikoutei sync, then write a ready-to-use .env file.",
     "",
-    "Prerequisites: the gcloud CLI is installed and `gcloud auth login` has been",
-    "run once (an active account is required).",
+    "Prerequisites: the gcloud CLI is installed and `gcloud auth login",
+    "--enable-gdrive-access` has been run once. Setup creates the spreadsheet as",
+    "the logged-in user and shares it with the service account as a writer, so the",
+    "active account must grant Drive access.",
     "",
     "Usage:",
     "  hikoutei setup [options]",
@@ -41,10 +44,49 @@ export const SETUP_HELP_TEXT = [
     "                             the current directory).",
     "  --yes                      Skip interactive confirmation (non-interactive",
     "                             mode).",
-    "  --dry-run                  Print the exact gcloud command sequence and",
-    "                             simulated outcomes without executing anything.",
+    "  --dry-run                  Print the exact command sequence and",
+    "                             simulated outcomes without executing anything",
+    "                             (read-only local path-safety checks only;",
+    "                             no subprocess, network, cloud, or file",
+    "                             mutations; the gcloud key create shows the",
+    "                             private staging placeholder",
+    "                             <private-key-staging-dir>/key.json — never the",
+    "                             final key path).",
     "  -h, --help                 Show this help and exit.",
     "",
+    "Automatic setup runs on macOS and Linux. On Windows, non-dry-run setup",
+    "is refused before any subprocess, network, cloud, lock, checkpoint, key,",
+    "or file mutation (Windows cannot guarantee no-follow or owner-only ACL",
+    "semantics); manual setup remains available.",
+    "",
+    "Interrupted runs resume from .hikoutei-setup-state.json in the current",
+    "directory. A spreadsheet create whose outcome is unknown is reconciled by",
+    "its creation marker on the next run; setup never creates a second",
+    "spreadsheet. A create rejected up front (HTTP 400/403) with no matching",
+    "file rolls the checkpoint back to key_ready so a corrected rerun starts a",
+    "fresh marker. The service-account key is created under a write-ahead",
+    "contract: the user-managed key list is recorded as a baseline before the",
+    "single gcloud key create, and key_create_started/key_ready checkpoints",
+    "let a crashed run recover a staged or installed key instead of creating a",
+    "second one. Only the invocation that just persisted key_create_started",
+    "may issue the one key create; resumed runs are reconcile-only and poll",
+    "the key list plus staged/final evidence for up to two minutes (2, 4, 8,",
+    "16, 30, 30, 30 s) before failing with key_create_uncertain — the create",
+    "is never retried automatically. An unmatched user-managed key with no",
+    "local credential is never deleted automatically: setup fails with",
+    "key_create_uncertain and you inspect the key list in the Google Cloud",
+    "console before rerunning (verified-absent states require removing the",
+    "setup state file to reset the key checkpoint).",
+    "Reused keys are enforced to owner-only mode 600.",
+    "An exclusive lock directory (.hikoutei-setup-state.json.lock)",
+    "prevents concurrent runs and is never removed automatically: a leftover",
+    "lock directory (for example after a crash) requires manual removal only",
+    "when you are certain no setup is running.",
+    "Starting fresh requires removing or moving BOTH the checkpoint and the",
+    "service-account key file (or passing --project <id> to recover an",
+    "existing key); checkpointed or identity-matched cloud resources are",
+    "reused, and setup never deletes cloud resources.",
+    "",
 ].join("\n");
 /** True when the flag is a value flag; used to accept `--flag value` and `--flag=value`. */
 const VALUE_FLAGS = [
@@ -96,9 +138,31 @@ export function parseSetupArgs(argv) {
             }
             switch (flagName) {
                 case SETUP_FLAGS.PROJECT:
+                    // Strict GCP project id format (the canonical shared guard): an
+                    // option-like or malformed value (for example `--project=--flag`)
+                    // is rejected BEFORE it can reach gcloud, an API, or a file.
+                    if (!isValidGcpProjectId(value)) {
+                        return {
+                            status: "invalid",
+                            failure: setupFailure(SETUP_ERROR_CODES.INVALID_ARGS, `invalid value for ${flagName}: GCP project ids must start with a lowercase ` +
+                                `letter and contain only lowercase letters, digits, and hyphens (6-30 characters)`),
+                        };
+                    }
                     projectId = value;
                     break;
                 case SETUP_FLAGS.SA_NAME:
+                    // Strict service-account name format (the canonical shared guard):
+                    // an option-like or malformed value (for example
+                    // `--sa-name=--flag`) is rejected before it can reach gcloud, an
+                    // API, or a file.
+                    if (!isValidServiceAccountName(value)) {
+                        return {
+                            status: "invalid",
+                            failure: setupFailure(SETUP_ERROR_CODES.INVALID_ARGS, `invalid value for ${flagName}: service-account names must start with a ` +
+                                `lowercase letter and contain only lowercase letters, digits, and hyphens ` +
+                                `(6-30 characters)`),
+                        };
+                    }
                     saName = value;
                     break;
                 case SETUP_FLAGS.SPREADSHEET_TITLE:

package/dist/cli/args.js.map

@@ -1 +1 @@
-{"version":3,"file":"args.js","sourceRoot":"","sources":["../../src/cli/args.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAqB,MAAM,aAAa,CAAC;AAEjF,kEAAkE;AAClE,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAC;AAE7C,iFAAiF;AACjF,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAwB/C,MAAM,WAAW,GAAG;IAClB,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,IAAI;IAChB,OAAO,EAAE,WAAW;IACpB,OAAO,EAAE,WAAW;IACpB,iBAAiB,EAAE,qBAAqB;IACxC,MAAM,EAAE,UAAU;IAClB,GAAG,EAAE,OAAO;IACZ,OAAO,EAAE,WAAW;CACZ,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,8EAA8E;IAC9E,qEAAqE;IACrE,EAAE;IACF,6EAA6E;IAC7E,2CAA2C;IAC3C,EAAE;IACF,QAAQ;IACR,4BAA4B;IAC5B,EAAE;IACF,UAAU;IACV,8EAA8E;IAC9E,2EAA2E;IAC3E,0CAA0C;IAC1C,2EAA2E;IAC3E,4EAA4E;IAC5E,wDAAwD;IACxD,6EAA6E;IAC7E,sDAAsD;IACtD,6EAA6E;IAC7E,qCAAqC;IACrC,0EAA0E;IAC1E,6EAA6E;IAC7E,uDAAuD;IACvD,EAAE;CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,4FAA4F;AAC5F,MAAM,WAAW,GAAG;IAClB,WAAW,CAAC,OAAO;IACnB,WAAW,CAAC,OAAO;IACnB,WAAW,CAAC,iBAAiB;IAC7B,WAAW,CAAC,MAAM;CACV,CAAC;AAEX;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,IAAuB;IACpD,0EAA0E;IAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,IAAI,SAA6B,CAAC;IAClC,IAAI,MAAM,GAAG,eAAe,CAAC;IAC7B,IAAI,gBAAoC,CAAC;IACzC,IAAI,MAAM,GAAG,wBAAwB,CAAC;IACtC,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAW,CAAC;QAElC,IAAI,GAAG,KAAK,WAAW,CAAC,IAAI,IAAI,GAAG,KAAK,WAAW,CAAC,UAAU,EAAE,CAAC;YAC/D,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;QACvD,CAAC;QACD,IAAI,GAAG,KAAK,WAAW,CAAC,GAAG,EAAE,CAAC;YAC5B,GAAG,GAAG,IAAI,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,WAAW,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,GAAG,IAAI,CAAC;YACd,SAAS;QACX,CAAC;QAED,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QACtE,IAAK,WAAiC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1D,MAAM,KAAK,GAAG,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC;YAChF,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,IAAI,CAAC,WAAW,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACzF,OAAO;oBACL,MAAM,EAAE,SAAS;oBACjB,OAAO,EAAE,YAAY,CAAC,iBAAiB,CAAC,YAAY,EAAE,GAAG,QAAQ,mBAAmB,CAAC;iBACtF,CAAC;YACJ,CAAC;YACD,QAAQ,QAAQ,EAAE,CAAC;gBACjB,KAAK,WAAW,CAAC,OAAO;oBACtB,SAAS,GAAG,KAAK,CAAC;oBAClB,MAAM;gBACR,KAAK,WAAW,CAAC,OAAO;oBACtB,MAAM,GAAG,KAAK,CAAC;oBACf,MAAM;gBACR,KAAK,WAAW,CAAC,iBAAiB;oBAChC,gBAAgB,GAAG,KAAK,CAAC;oBACzB,MAAM;gBACR,KAAK,WAAW,CAAC,MAAM;oBACrB,MAAM,GAAG,KAAK,CAAC;oBACf,MAAM;YACV,CAAC;YACD,IAAI,WAAW,KAAK,CAAC,CAAC,EAAE,CAAC;gBACvB,KAAK,IAAI,CAAC,CAAC;YACb,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,YAAY,CAAC,iBAAiB,CAAC,YAAY,EAAE,iBAAiB,GAAG,EAAE,CAAC;aAC9E,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,YAAY,CAAC,iBAAiB,CAAC,YAAY,EAAE,wBAAwB,GAAG,EAAE,CAAC;SACrF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,OAAO;QACf,OAAO,EAAE;YACP,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,MAAM;YACN,MAAM;YACN,GAAG;YACH,MAAM;SACP;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"args.js","sourceRoot":"","sources":["../../src/cli/args.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAqB,MAAM,aAAa,CAAC;AAEjF,kEAAkE;AAClE,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAC;AAE7C,iFAAiF;AACjF,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAwB/C,MAAM,WAAW,GAAG;IAClB,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,IAAI;IAChB,OAAO,EAAE,WAAW;IACpB,OAAO,EAAE,WAAW;IACpB,iBAAiB,EAAE,qBAAqB;IACxC,MAAM,EAAE,UAAU;IAClB,GAAG,EAAE,OAAO;IACZ,OAAO,EAAE,WAAW;CACZ,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,8EAA8E;IAC9E,mFAAmF;IACnF,EAAE;IACF,mEAAmE;IACnE,6EAA6E;IAC7E,+EAA+E;IAC/E,yCAAyC;IACzC,EAAE;IACF,QAAQ;IACR,4BAA4B;IAC5B,EAAE;IACF,UAAU;IACV,8EAA8E;IAC9E,2EAA2E;IAC3E,0CAA0C;IAC1C,2EAA2E;IAC3E,4EAA4E;IAC5E,wDAAwD;IACxD,6EAA6E;IAC7E,sDAAsD;IACtD,6EAA6E;IAC7E,qCAAqC;IACrC,mEAAmE;IACnE,4EAA4E;IAC5E,wEAAwE;IACxE,qEAAqE;IACrE,yEAAyE;IACzE,0DAA0D;IAC1D,6EAA6E;IAC7E,+CAA+C;IAC/C,uDAAuD;IACvD,EAAE;IACF,wEAAwE;IACxE,0EAA0E;IAC1E,wEAAwE;IACxE,6CAA6C;IAC7C,EAAE;IACF,wEAAwE;IACxE,2EAA2E;IAC3E,mEAAmE;IACnE,yEAAyE;IACzE,2EAA2E;IAC3E,sEAAsE;IACtE,0EAA0E;IAC1E,wEAAwE;IACxE,2EAA2E;IAC3E,wEAAwE;IACxE,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,uEAAuE;IACvE,mEAAmE;IACnE,uEAAuE;IACvE,uEAAuE;IACvE,gDAAgD;IAChD,kDAAkD;IAClD,+DAA+D;IAC/D,yEAAyE;IACzE,yEAAyE;IACzE,2CAA2C;IAC3C,wEAAwE;IACxE,mEAAmE;IACnE,qEAAqE;IACrE,kDAAkD;IAClD,EAAE;CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,4FAA4F;AAC5F,MAAM,WAAW,GAAG;IAClB,WAAW,CAAC,OAAO;IACnB,WAAW,CAAC,OAAO;IACnB,WAAW,CAAC,iBAAiB;IAC7B,WAAW,CAAC,MAAM;CACV,CAAC;AAEX;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,IAAuB;IACpD,0EAA0E;IAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,IAAI,SAA6B,CAAC;IAClC,IAAI,MAAM,GAAG,eAAe,CAAC;IAC7B,IAAI,gBAAoC,CAAC;IACzC,IAAI,MAAM,GAAG,wBAAwB,CAAC;IACtC,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAW,CAAC;QAElC,IAAI,GAAG,KAAK,WAAW,CAAC,IAAI,IAAI,GAAG,KAAK,WAAW,CAAC,UAAU,EAAE,CAAC;YAC/D,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;QACvD,CAAC;QACD,IAAI,GAAG,KAAK,WAAW,CAAC,GAAG,EAAE,CAAC;YAC5B,GAAG,GAAG,IAAI,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,WAAW,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,GAAG,IAAI,CAAC;YACd,SAAS;QACX,CAAC;QAED,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QACtE,IAAK,WAAiC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1D,MAAM,KAAK,GAAG,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC;YAChF,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,IAAI,CAAC,WAAW,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACzF,OAAO;oBACL,MAAM,EAAE,SAAS;oBACjB,OAAO,EAAE,YAAY,CAAC,iBAAiB,CAAC,YAAY,EAAE,GAAG,QAAQ,mBAAmB,CAAC;iBACtF,CAAC;YACJ,CAAC;YACD,QAAQ,QAAQ,EAAE,CAAC;gBACjB,KAAK,WAAW,CAAC,OAAO;oBACtB,gEAAgE;oBAChE,kEAAkE;oBAClE,6DAA6D;oBAC7D,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;wBAChC,OAAO;4BACL,MAAM,EAAE,SAAS;4BACjB,OAAO,EAAE,YAAY,CACnB,iBAAiB,CAAC,YAAY,EAC9B,qBAAqB,QAAQ,gDAAgD;gCAC3E,kFAAkF,CACrF;yBACF,CAAC;oBACJ,CAAC;oBACD,SAAS,GAAG,KAAK,CAAC;oBAClB,MAAM;gBACR,KAAK,WAAW,CAAC,OAAO;oBACtB,mEAAmE;oBACnE,iDAAiD;oBACjD,iEAAiE;oBACjE,kBAAkB;oBAClB,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;wBACtC,OAAO;4BACL,MAAM,EAAE,SAAS;4BACjB,OAAO,EAAE,YAAY,CACnB,iBAAiB,CAAC,YAAY,EAC9B,qBAAqB,QAAQ,4CAA4C;gCACvE,2EAA2E;gCAC3E,mBAAmB,CACtB;yBACF,CAAC;oBACJ,CAAC;oBACD,MAAM,GAAG,KAAK,CAAC;oBACf,MAAM;gBACR,KAAK,WAAW,CAAC,iBAAiB;oBAChC,gBAAgB,GAAG,KAAK,CAAC;oBACzB,MAAM;gBACR,KAAK,WAAW,CAAC,MAAM;oBACrB,MAAM,GAAG,KAAK,CAAC;oBACf,MAAM;YACV,CAAC;YACD,IAAI,WAAW,KAAK,CAAC,CAAC,EAAE,CAAC;gBACvB,KAAK,IAAI,CAAC,CAAC;YACb,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,YAAY,CAAC,iBAAiB,CAAC,YAAY,EAAE,iBAAiB,GAAG,EAAE,CAAC;aAC9E,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,YAAY,CAAC,iBAAiB,CAAC,YAAY,EAAE,wBAAwB,GAAG,EAAE,CAAC;SACrF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,OAAO;QACf,OAAO,EAAE;YACP,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,MAAM;YACN,MAAM;YACN,GAAG;YACH,MAAM;SACP;KACF,CAAC;AACJ,CAAC"}