instar 1.3.1597 → 1.3.1599

package/dist/core/DesktopLockedController.d.ts

@@ -0,0 +1,138 @@
+import { isLockedClass, type DesktopLockPolicy, type DesktopLockSample, type DesktopLockState } from './DesktopLockState.js';
+import { type DesktopProvenVersion } from './DesktopProvenVersions.js';
+export declare const RELOCK_WATCH_MS = 120000;
+export declare const MAX_GUARD_REPLACEMENTS = 3;
+export declare const DISABLE_MARKER_TIMEOUT_MS = 5000;
+export declare const RESPAWNS_PER_CHANGE = 3;
+export declare const RESPAWNS_PER_REQUEST = 8;
+export interface DesktopLockedSettings {
+    enabled: boolean;
+    browserBox: boolean;
+    chime: boolean;
+}
+export interface DesktopRelockMarker {
+    state: string;
+    agentId?: string;
+    requestId?: string;
+    deadlineMs?: number;
+    resumeWindowMs?: number;
+    relockNow?: boolean;
+    typistPid?: number;
+    typistStart?: string;
+    guardPid?: number;
+    guardStart?: string;
+    guardReplacements?: number;
+    enterPendingAt?: number;
+    watchStart?: number;
+    bootSession?: string;
+    loginSession?: string;
+    producerGone?: boolean;
+    reported?: boolean;
+}
+/** The helper's state-op verb, in one call. */
+export interface DesktopLockedHostPort {
+    lockedOp(op: Record<string, unknown>): Promise<Record<string, unknown>>;
+    startRelockGuard(key: string): Promise<void>;
+    setLockedMode(mode: {
+        root: string;
+        refuse: string[];
+        chime?: boolean;
+    } | null): void;
+}
+export interface DesktopLockedDeps {
+    host: DesktopLockedHostPort;
+    agentId: string;
+    settings: () => DesktopLockedSettings;
+    saveSettings: (next: DesktopLockedSettings) => void;
+    readPolicy: () => Promise<DesktopLockPolicy>;
+    tunnelFirstTierActive: () => boolean;
+    /** True only once the item is durably with the owner's attention surface. */
+    raiseSecurity: (item: {
+        key: string;
+        title: string;
+        body: string;
+    }) => boolean | Promise<boolean>;
+    audit?: (event: Record<string, unknown>) => void;
+    now?: () => number;
+    root?: string;
+    /** Only tests pass this. Production always uses the shipped table. */
+    provenVersions?: readonly DesktopProvenVersion[];
+}
+/** A dead guard is replaced at most this often for one duty, then the duty fails loudly. */
+export declare function decideGuardReplacement(replacements: number): 'replace' | 'give-up';
+/** 3 per state change and 8 per request; spends one or refuses. */
+export declare function decideLockedRespawn(thisChange: number, total: number): boolean;
+export declare class DesktopLockedController {
+    private readonly deps;
+    readonly root: string;
+    private readonly now;
+    private readonly proven;
+    private policy;
+    private lastRawFlag;
+    private lastOsMajor;
+    private lastState;
+    private readonly live;
+    private sweepTimer;
+    private sweeping;
+    private lastAdmissionRefusal;
+    constructor(deps: DesktopLockedDeps);
+    private storeExists;
+    /** The feature needs the owner's setting AND a proven macOS. */
+    active(osMajor?: number | undefined): boolean;
+    /** Why the enable route refuses. No route can reach past this. */
+    enableRefusal(osMajor: number | undefined): string | null;
+    /** Tells the host whether to spawn helpers with the feature on. */
+    applyMode(osMajor: number | undefined): void;
+    private policyFor;
+    readState(sample: DesktopLockSample): Promise<DesktopLockState>;
+    wanted(): boolean;
+    private read;
+    private heartbeatAgeMs;
+    private renewLease;
+    /** The unlock happened, so nothing is left in a password field. */
+    noteUnlocked(): Promise<void>;
+    private stale;
+    /** Both must be confirmed gone before anything reopens. */
+    private stopRecorded;
+    /** Null admits. Runs even with the feature off, but only if a marker exists,
+     * so a clean Mac stays byte for byte today's path. */
+    admissionRefusal(sameRequestId?: string): Promise<string | null>;
+    noteGrant(requestId: string): void;
+    /** Marker first, then guard, then its acknowledgement. Nothing is typed
+     * before all three. */
+    prepareSecret(requestId: string, deadlineMs: number): Promise<{
+        key: string;
+    } | {
+        refused: string;
+    }>;
+    /** Stop or the ceiling: relock now. Transport loss renews until the window. */
+    endRequest(requestId: string, reason: 'stop' | 'transport-lost'): Promise<void>;
+    /** Acknowledged only if this tap beat the guard. */
+    leaveUnlocked(requestId: string): Promise<boolean>;
+    refundAttempt(requestId: string): Promise<void>;
+    enterPostedAt(requestId: string): Promise<number | null>;
+    /** The setting and the live grants go off first, so a helper that throws or
+     * hangs cannot leave a session running; the Mac-wide marker is attempted last. */
+    disable(endGrants?: () => void): Promise<void>;
+    isDisabled(): Promise<boolean>;
+    applySettings(patch: Partial<DesktopLockedSettings>): Promise<DesktopLockedSettings>;
+    /** A hint for honest pages. The target still refuses, and a hostile front
+     * can draw a box anyway; that limit is stated in the spec. */
+    browserBoxShown(): boolean;
+    /** Null when the password path is ready, else a named reason. */
+    passwordRefusal(probe: DesktopLockSample & {
+        inputGrant?: string;
+        helperSource?: string;
+    }, client: 'app' | 'browser', state: DesktopLockState): string | null;
+    private startSweep;
+    stop(): void;
+    /** Covers a watch whose request has already ended, so "tells you" holds. */
+    sweep(boot?: boolean): Promise<void>;
+    /** A guard that lost its store leaves a file, and has already tried to lock. */
+    private reportGuardFailures;
+    private retryFailed;
+    private replaceGuard;
+    status(osMajor: number | undefined): Promise<Record<string, unknown>>;
+}
+export { isLockedClass };
+//# sourceMappingURL=DesktopLockedController.d.ts.map

package/dist/core/DesktopLockedController.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DesktopLockedController.d.ts","sourceRoot":"","sources":["../../src/core/DesktopLockedController.ts"],"names":[],"mappings":"AAeA,OAAO,EAAuB,aAAa,EAAE,KAAK,iBAAiB,EAAE,KAAK,iBAAiB,EAAE,KAAK,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAClJ,OAAO,EAAwC,KAAK,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAE7G,eAAO,MAAM,eAAe,SAAU,CAAC;AAMvC,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC,eAAO,MAAM,yBAAyB,OAAQ,CAAC;AAC/C,eAAO,MAAM,mBAAmB,IAAI,CAAC;AACrC,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAItC,MAAM,WAAW,qBAAqB;IAAG,OAAO,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE;AAEhG,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,+CAA+C;AAC/C,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACxE,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,aAAa,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,GAAG,IAAI,CAAC;CACvF;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,qBAAqB,CAAC;IACtC,YAAY,EAAE,CAAC,IAAI,EAAE,qBAAqB,KAAK,IAAI,CAAC;IACpD,UAAU,EAAE,MAAM,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC7C,qBAAqB,EAAE,MAAM,OAAO,CAAC;IACrC,6EAA6E;IAC7E,aAAa,EAAE,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClG,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACjD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,cAAc,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;CAClD;AAED,4FAA4F;AAC5F,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAElF;AAED,mEAAmE;AACnE,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAE9E;AAED,qBAAa,uBAAuB;IAatB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAZjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkC;IACzD,OAAO,CAAC,MAAM,CAAyD;IACvE,OAAO,CAAC,WAAW,CAAsB;IACzC,OAAO,CAAC,WAAW,CAAqB;IACxC,OAAO,CAAC,SAAS,CAA+B;IAChD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA0D;IAC/E,OAAO,CAAC,UAAU,CAA+C;IACjE,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,oBAAoB,CAAuB;IAEnD,YAA6B,IAAI,EAAE,iBAAiB,EAInD;IAED,OAAO,CAAC,WAAW;IAEnB,gEAAgE;IAChE,MAAM,CAAC,OAAO,GAAE,MAAM,GAAG,SAA4B,GAAG,OAAO,CAE9D;IAED,kEAAkE;IAClE,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAExD;IAED,mEAAmE;IACnE,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAK3C;YAEa,SAAS;IAgBjB,SAAS,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAKpE;IAED,MAAM,IAAI,OAAO,CAAyC;YAE5C,IAAI;IASlB,OAAO,CAAC,cAAc;IAKtB,OAAO,CAAC,UAAU;IAQlB,mEAAmE;IAC7D,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAElC;IAED,OAAO,CAAC,KAAK;IAQb,2DAA2D;YAC7C,YAAY;IAS1B;0DACsD;IAChD,gBAAgB,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA8BrE;IAED,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAGjC;IAED;2BACuB;IACjB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CA8BzG;IAED,+EAA+E;IACzE,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAOpF;IAED,oDAAoD;IAC9C,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAMvD;IAEK,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEpD;IAEK,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAI7D;IAED;sFACkF;IAC5E,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBnD;IAEK,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,CAAyC;IAEvE,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,qBAAqB,CAAC,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAMzF;IAED;kEAC8D;IAC9D,eAAe,IAAI,OAAO,CAEzB;IAED,iEAAiE;IACjE,eAAe,CAAC,KAAK,EAAE,iBAAiB,GAAG;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,EACvF,MAAM,EAAE,KAAK,GAAG,SAAS,EAAE,KAAK,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI,CASnE;IAED,OAAO,CAAC,UAAU;IAclB,IAAI,IAAI,IAAI,CAGX;IAED,4EAA4E;IACtE,KAAK,CAAC,IAAI,UAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAyCvC;IAED,gFAAgF;YAClE,mBAAmB;YAWnB,WAAW;YAUX,YAAY;IAepB,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAS1E;CACF;AAED,OAAO,EAAE,aAAa,EAAE,CAAC"}

package/dist/core/DesktopLockedController.js

@@ -0,0 +1,442 @@
+/**
+ * Target-side authority for remote desktop through the ordinary Mac lock.
+ * Off is today's behaviour: with no setting, no marker and an empty proven
+ * table this answers "off" and touches nothing.
+ *
+ * State that must outlive Node lives on the Mac, changed only by the helper
+ * under a kernel lock. This class never takes that lock, so a suspended Node
+ * cannot hold a relock up. It holds no password and has no route that makes one.
+ * Spec: docs/specs/desktop-locked-screen.md.
+ */
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { SafeFsExecutor } from './SafeFsExecutor.js';
+import { DegradationReporter } from '../monitoring/DegradationReporter.js';
+import { classifyDesktopLock, isLockedClass } from './DesktopLockState.js';
+import { PROVEN_MACOS_VERSIONS, provenVersion } from './DesktopProvenVersions.js';
+export const RELOCK_WATCH_MS = 120_000;
+const WATCH_SLACK_MS = 30_000;
+const POLICY_TTL_MS = 60_000;
+const SWEEP_MS = 10_000;
+const GUARD_ACK_MS = 3_000;
+const HEARTBEAT_STALE_MS = 5_000;
+export const MAX_GUARD_REPLACEMENTS = 3;
+const RESUME_WINDOW_MS = 30_000;
+export const DISABLE_MARKER_TIMEOUT_MS = 5_000;
+export const RESPAWNS_PER_CHANGE = 3;
+export const RESPAWNS_PER_REQUEST = 8;
+const TERMINAL = new Set(['relocked', 'relock-failed', 'left-unlocked', 'closed-not-applicable']);
+const BLOCKING = new Set(['owed', 'executing', 'watching']);
+/** A dead guard is replaced at most this often for one duty, then the duty fails loudly. */
+export function decideGuardReplacement(replacements) {
+    return replacements >= MAX_GUARD_REPLACEMENTS ? 'give-up' : 'replace';
+}
+/** 3 per state change and 8 per request; spends one or refuses. */
+export function decideLockedRespawn(thisChange, total) {
+    return thisChange < RESPAWNS_PER_CHANGE && total < RESPAWNS_PER_REQUEST;
+}
+export class DesktopLockedController {
+    deps;
+    root;
+    now;
+    proven;
+    policy = null;
+    lastRawFlag;
+    lastOsMajor;
+    lastState = 'unknown';
+    live = new Map();
+    sweepTimer = null;
+    sweeping = false;
+    lastAdmissionRefusal = null;
+    constructor(deps) {
+        this.deps = deps;
+        this.root = deps.root ?? path.join(os.homedir(), '.instar', 'desktop-helper', 'locked');
+        this.now = deps.now ?? Date.now;
+        this.proven = deps.provenVersions ?? PROVEN_MACOS_VERSIONS;
+    }
+    storeExists() { return fs.existsSync(path.join(this.root, 'locked-state.json')); }
+    /** The feature needs the owner's setting AND a proven macOS. */
+    active(osMajor = this.lastOsMajor) {
+        return this.deps.settings().enabled && !!provenVersion(this.proven, osMajor);
+    }
+    /** Why the enable route refuses. No route can reach past this. */
+    enableRefusal(osMajor) {
+        return provenVersion(this.proven, osMajor) ? null : 'unsupported-macos';
+    }
+    /** Tells the host whether to spawn helpers with the feature on. */
+    applyMode(osMajor) {
+        this.lastOsMajor = osMajor;
+        const row = provenVersion(this.proven, osMajor);
+        this.deps.host.setLockedMode(this.deps.settings().enabled && row
+            ? { root: this.root, refuse: row.refuse, chime: this.deps.settings().chime } : null);
+    }
+    async policyFor(flag) {
+        const fresh = this.policy && this.now() - this.policy.at < POLICY_TTL_MS;
+        // Only a change in a raw input refreshes, or a refresh would feed itself.
+        const changed = flag !== this.lastRawFlag;
+        this.lastRawFlag = flag;
+        if (fresh && !changed)
+            return this.policy.value;
+        const refreshing = this.deps.readPolicy().then(value => {
+            this.policy = { value, at: this.now() };
+            return value;
+        }, () => {
+            this.policy = { value: 'unreadable', at: this.now() };
+            return 'unreadable';
+        });
+        return changed ? (void refreshing, 'pending') : refreshing;
+    }
+    async readState(sample) {
+        this.applyMode(sample.osMajor ?? sample.lockInputs?.osMajor);
+        const state = classifyDesktopLock(sample, await this.policyFor(sample.screenLocked), this.now());
+        this.lastState = state;
+        return state;
+    }
+    wanted() { return this.deps.settings().enabled; }
+    async read() {
+        if (!this.storeExists())
+            return { markers: {}, disabled: false, dirty: false, attempts: { count: 0 } };
+        const reply = await this.deps.host.lockedOp({ op: 'read' });
+        const state = (reply.state ?? {});
+        return { markers: state.markers ?? {}, disabled: state.disabled === true, dirty: !!state.dirty,
+            attempts: (reply.attempts ?? { count: 0 }),
+            bootSession: reply.bootSession, loginSession: reply.loginSession };
+    }
+    heartbeatAgeMs(key) {
+        try {
+            return this.now() - fs.statSync(path.join(this.root, `hb-${key}`)).mtimeMs;
+        }
+        catch {
+            return null;
+        } // @silent-fallback-ok — no heartbeat file reads as stale, which replaces the guard.
+    }
+    renewLease(key) {
+        const file = path.join(this.root, `lease-${key}`);
+        fs.writeFileSync(file, '', { mode: 0o600 });
+        // Truncating an empty file need not move its time; the guard reads the time.
+        const stamp = new Date(this.now());
+        fs.utimesSync(file, stamp, stamp);
+    }
+    /** The unlock happened, so nothing is left in a password field. */
+    async noteUnlocked() {
+        await this.deps.host.lockedOp({ op: 'clear-dirty' });
+    }
+    stale(marker, key) {
+        const deadline = marker.state === 'watching'
+            ? (marker.watchStart ?? 0) + RELOCK_WATCH_MS + WATCH_SLACK_MS
+            : (marker.deadlineMs ?? 0);
+        const age = this.heartbeatAgeMs(key);
+        return this.now() >= deadline && (age === null || age > HEARTBEAT_STALE_MS);
+    }
+    /** Both must be confirmed gone before anything reopens. */
+    async stopRecorded(marker) {
+        const stop = async (pid, start) => {
+            if (!pid || !start)
+                return true;
+            return (await this.deps.host.lockedOp({ op: 'kill-recorded', pid, start })).gone === true;
+        };
+        const [guard, typist] = [await stop(marker.guardPid, marker.guardStart), await stop(marker.typistPid, marker.typistStart)];
+        return guard && typist;
+    }
+    /** Null admits. Runs even with the feature off, but only if a marker exists,
+     * so a clean Mac stays byte for byte today's path. */
+    async admissionRefusal(sameRequestId) {
+        if (!this.storeExists())
+            return null;
+        const { markers, disabled, bootSession, loginSession } = await this.read();
+        if (disabled && this.deps.settings().enabled)
+            this.lastAdmissionRefusal = 'disabled';
+        for (const [key, marker] of Object.entries(markers)) {
+            if (marker.requestId === sameRequestId)
+                continue;
+            // That reboot or logout already ended the session, so no duty remains.
+            if (BLOCKING.has(marker.state) && bootSession && (marker.bootSession !== bootSession
+                || (loginSession && marker.loginSession !== loginSession))) {
+                await this.deps.host.lockedOp({ op: 'close', key, to: 'closed-not-applicable' });
+                continue;
+            }
+            if (marker.state === 'left-unlocked' && marker.producerGone !== true) {
+                if (!await this.stopRecorded({ ...marker, guardPid: undefined }))
+                    return 'relock-failed-producer-alive';
+                await this.deps.host.lockedOp({ op: 'set-producer-gone', key });
+                continue;
+            }
+            if (marker.state === 'relock-failed') {
+                if (marker.producerGone === false) {
+                    if (await this.stopRecorded(marker))
+                        await this.deps.host.lockedOp({ op: 'set-producer-gone', key });
+                    else
+                        return 'relock-failed-producer-alive';
+                }
+                continue;
+            }
+            if (!BLOCKING.has(marker.state))
+                continue;
+            if (!this.stale(marker, key))
+                return 'relock-pending';
+            if (!await this.stopRecorded(marker))
+                return 'relock-pending-unconfirmed';
+            await this.deps.host.lockedOp({ op: 'close', key, to: 'relock-failed', producerGone: true });
+        }
+        return null;
+    }
+    noteGrant(requestId) {
+        if (!this.live.has(requestId))
+            this.live.set(requestId, { key: `${requestId}.0`, generation: 0 });
+        this.startSweep();
+    }
+    /** Marker first, then guard, then its acknowledgement. Nothing is typed
+     * before all three. */
+    async prepareSecret(requestId, deadlineMs) {
+        // Stop may have landed already. A marker now would outlive its request.
+        const entry = this.live.get(requestId);
+        if (!entry)
+            return { refused: 'grant-ended' };
+        let key = entry.key;
+        let reply = await this.deps.host.lockedOp({ op: 'marker-create', key, marker: {
+                agentId: this.deps.agentId, requestId, deadlineMs, resumeWindowMs: RESUME_WINDOW_MS
+            } });
+        if (reply.error)
+            return { refused: String(reply.error) };
+        const existing = reply.marker;
+        if (existing?.state === 'relock-failed')
+            return { refused: 'relock-failed' };
+        if (existing && TERMINAL.has(existing.state)) {
+            entry.generation++;
+            key = `${requestId}.${entry.generation}`;
+            entry.key = key;
+            reply = await this.deps.host.lockedOp({ op: 'marker-create', key, marker: {
+                    agentId: this.deps.agentId, requestId, deadlineMs, resumeWindowMs: RESUME_WINDOW_MS
+                } });
+        }
+        this.renewLease(key);
+        const age = this.heartbeatAgeMs(key);
+        if (age === null || age > HEARTBEAT_STALE_MS) {
+            await this.deps.host.startRelockGuard(key);
+            const until = this.now() + GUARD_ACK_MS;
+            while (this.now() < until) {
+                const seen = this.heartbeatAgeMs(key);
+                if (seen !== null && seen <= HEARTBEAT_STALE_MS)
+                    return { key };
+                await new Promise(resolve => setTimeout(resolve, 100));
+            }
+            return { refused: 'guard-not-alive' };
+        }
+        return { key };
+    }
+    /** Stop or the ceiling: relock now. Transport loss renews until the window. */
+    async endRequest(requestId, reason) {
+        const entry = this.live.get(requestId);
+        if (!entry)
+            return;
+        if (reason === 'stop') {
+            this.live.delete(requestId);
+            await this.deps.host.lockedOp({ op: 'relock-now', key: entry.key });
+        }
+    }
+    /** Acknowledged only if this tap beat the guard. */
+    async leaveUnlocked(requestId) {
+        const entry = this.live.get(requestId);
+        if (!entry)
+            return false;
+        const reply = await this.deps.host.lockedOp({ op: 'leave-unlocked', key: entry.key });
+        this.deps.audit?.({ kind: 'leave-unlocked', ok: reply.ok === true });
+        return reply.ok === true;
+    }
+    async refundAttempt(requestId) {
+        await this.deps.host.lockedOp({ op: 'refund', requestId });
+    }
+    async enterPostedAt(requestId) {
+        const entry = this.live.get(requestId);
+        if (!entry)
+            return null;
+        return (await this.read()).markers[entry.key]?.enterPendingAt ?? null;
+    }
+    /** The setting and the live grants go off first, so a helper that throws or
+     * hangs cannot leave a session running; the Mac-wide marker is attempted last. */
+    async disable(endGrants) {
+        const next = { ...this.deps.settings(), enabled: false };
+        this.deps.saveSettings(next);
+        let markerError = null;
+        try {
+            endGrants?.();
+        }
+        finally {
+            try {
+                let timer;
+                await Promise.race([
+                    this.deps.host.lockedOp({ op: 'set-disabled', disabled: true }),
+                    new Promise((_, reject) => { timer = setTimeout(() => reject(new Error('locked-disable-marker-timeout')), DISABLE_MARKER_TIMEOUT_MS); }),
+                ]).finally(() => clearTimeout(timer));
+            }
+            catch (err) {
+                // Surfaced, not swallowed: audited, named in the security item, and re-thrown below.
+                markerError = err;
+            }
+            this.deps.audit?.({ kind: 'locked-disable', markerWritten: markerError === null });
+            this.deps.raiseSecurity({ key: 'desktop-locked-disabled', title: 'Remote desktop through the lock was turned off',
+                body: markerError === null
+                    ? 'Any open locked-screen session was ended. The dashboard PIN turns it back on.'
+                    : 'Any open locked-screen session was ended and the setting is off, but the Mac-wide off marker could not be written. Turn it off again from the dashboard to retry.' });
+        }
+        if (markerError !== null)
+            throw markerError instanceof Error ? markerError : new Error(String(markerError));
+    }
+    async isDisabled() { return (await this.read()).disabled; }
+    async applySettings(patch) {
+        const next = { ...this.deps.settings(), ...patch };
+        if (patch.enabled === true)
+            await this.deps.host.lockedOp({ op: 'set-disabled', disabled: false });
+        this.deps.saveSettings(next);
+        this.applyMode(this.lastOsMajor);
+        return next;
+    }
+    /** A hint for honest pages. The target still refuses, and a hostile front
+     * can draw a box anyway; that limit is stated in the spec. */
+    browserBoxShown() {
+        return this.deps.settings().browserBox && this.deps.tunnelFirstTierActive();
+    }
+    /** Null when the password path is ready, else a named reason. */
+    passwordRefusal(probe, client, state) {
+        if (!this.active(probe.osMajor))
+            return 'unsupported-macos';
+        if (probe.helperSource !== 'retained')
+            return 'retained-helper-required';
+        if (probe.inputGrant !== 'own')
+            return 'own-input-grant-required';
+        if (client === 'browser') {
+            if (!this.deps.settings().browserBox)
+                return 'browser-box-off';
+            if (!this.deps.tunnelFirstTierActive())
+                return 'tunnel-not-first-tier';
+        }
+        return state === 'locked-in-session' ? null : 'not-locked';
+    }
+    startSweep() {
+        if (this.sweepTimer)
+            return;
+        this.sweepTimer = setInterval(() => {
+            void this.sweep().catch((error) => {
+                console.warn('[instar] locked-screen sweep failed');
+                DegradationReporter.getInstance().report({ feature: 'DesktopLocked.sweep',
+                    primary: 'Locked-screen relock sweep', fallback: 'The next sweep tick retries',
+                    reason: `sweep failed: ${error instanceof Error ? error.message : String(error)}`,
+                    impact: 'A relock or a guard replacement may be late by one sweep interval or more.' });
+            });
+        }, SWEEP_MS);
+        this.sweepTimer.unref?.();
+    }
+    stop() {
+        if (this.sweepTimer)
+            clearInterval(this.sweepTimer);
+        this.sweepTimer = null;
+    }
+    /** Covers a watch whose request has already ended, so "tells you" holds. */
+    async sweep(boot = false) {
+        if (this.sweeping || !this.storeExists())
+            return;
+        this.sweeping = true;
+        // Started before the read, so a slow or failed read cannot end the watching.
+        this.startSweep();
+        try {
+            const untold = await this.reportGuardFailures();
+            const { markers } = await this.read();
+            const { bootSession, loginSession } = await this.read();
+            let open = untold;
+            for (const [key, marker] of Object.entries(markers)) {
+                if (marker.agentId !== this.deps.agentId)
+                    continue;
+                const sameSession = !bootSession || (marker.bootSession === bootSession
+                    && (!loginSession || marker.loginSession === loginSession));
+                if (BLOCKING.has(marker.state) && !sameSession) {
+                    await this.deps.host.lockedOp({ op: 'close', key, to: 'closed-not-applicable' });
+                    continue;
+                }
+                if (BLOCKING.has(marker.state)) {
+                    open = true;
+                    const requestId = marker.requestId ?? '';
+                    if (this.live.has(requestId))
+                        this.renewLease(key);
+                    else if (boot && marker.state === 'owed')
+                        await this.deps.host.lockedOp({ op: 'relock-now', key });
+                    const age = this.heartbeatAgeMs(key);
+                    if (age === null || age > HEARTBEAT_STALE_MS)
+                        await this.replaceGuard(key, marker);
+                }
+                else if (marker.state === 'relock-failed' && !marker.reported) {
+                    open = true;
+                    if (boot && sameSession)
+                        await this.retryFailed(key, marker);
+                    const told = await this.deps.raiseSecurity({ key: `desktop-relock-failed:${key}`, title: 'A Mac may still be unlocked',
+                        body: 'Instar could not confirm the relock after a remote desktop session. Lock it, or open it to check.' });
+                    // Unconfirmed stays unreported, so the next sweep tries again.
+                    if (told)
+                        await this.deps.host.lockedOp({ op: 'mark-reported', key });
+                }
+            }
+            if (open)
+                this.startSweep();
+            else if (this.live.size === 0)
+                this.stop();
+        }
+        catch {
+            // The guard locks by itself. What fails here is telling the owner, so say so.
+            await this.deps.raiseSecurity({ key: 'desktop-locked-store-unreadable', title: 'A Mac may need checking',
+                body: 'Instar could not read its relock record for this Mac. Lock it, or open it to check.' });
+        }
+        finally {
+            this.sweeping = false;
+        }
+    }
+    /** A guard that lost its store leaves a file, and has already tried to lock. */
+    async reportGuardFailures() {
+        let untold = false;
+        for (const name of fs.readdirSync(this.root).filter(file => file.startsWith('failed-'))) {
+            const told = await this.deps.raiseSecurity({ key: `desktop-relock-${name}`, title: 'A Mac may still be unlocked',
+                body: 'Instar lost its relock record after a remote desktop session and tried to lock the Mac. Check it.' });
+            if (told)
+                SafeFsExecutor.safeRmSync(path.join(this.root, name), { force: true, operation: 'src/core/DesktopLockedController.ts:reportGuardFailures' });
+            else
+                untold = true;
+        }
+        return untold;
+    }
+    async retryFailed(key, marker) {
+        const requestId = marker.requestId ?? key.split('.')[0];
+        const generation = Number(key.split('.')[1] ?? 0) + 1;
+        const next = `${requestId}.${generation}`;
+        await this.deps.host.lockedOp({ op: 'marker-create', key: next, marker: {
+                agentId: this.deps.agentId, requestId, deadlineMs: this.now(), resumeWindowMs: RESUME_WINDOW_MS
+            } });
+        await this.deps.host.lockedOp({ op: 'relock-now', key: next });
+        await this.deps.host.startRelockGuard(next);
+    }
+    async replaceGuard(key, marker) {
+        const count = marker.guardReplacements ?? 0;
+        const guardGone = !marker.guardPid || !marker.guardStart
+            || (await this.deps.host.lockedOp({ op: 'kill-recorded', pid: marker.guardPid, start: marker.guardStart })).gone === true;
+        if (decideGuardReplacement(count) === 'give-up') {
+            const typistGone = !marker.typistPid || !marker.typistStart
+                || (await this.deps.host.lockedOp({ op: 'kill-recorded', pid: marker.typistPid, start: marker.typistStart })).gone === true;
+            await this.deps.host.lockedOp({ op: 'close', key, to: 'relock-failed', producerGone: guardGone && typistGone });
+            return;
+        }
+        if (!guardGone)
+            return;
+        await this.deps.host.lockedOp({ op: 'set-guard', key, pid: 0, start: '', replacements: count + 1 });
+        await this.deps.host.startRelockGuard(key);
+    }
+    async status(osMajor) {
+        const { markers, disabled, attempts } = await this.read();
+        const settings = this.deps.settings();
+        return { enabled: settings.enabled, active: this.active(osMajor), disabled,
+            browserBox: settings.browserBox, chime: settings.chime,
+            refusal: this.enableRefusal(osMajor), lockState: this.lastState,
+            attemptsToday: attempts.count ?? 0, lastAdmissionRefusal: this.lastAdmissionRefusal,
+            openDuties: Object.values(markers).filter(item => BLOCKING.has(item.state)).length,
+            failedRelocks: Object.values(markers).filter(item => item.state === 'relock-failed').length };
+    }
+}
+export { isLockedClass };
+//# sourceMappingURL=DesktopLockedController.js.map

package/dist/core/DesktopLockedController.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DesktopLockedController.js","sourceRoot":"","sources":["../../src/core/DesktopLockedController.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAyE,MAAM,uBAAuB,CAAC;AAClJ,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAA6B,MAAM,4BAA4B,CAAC;AAE7G,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AACvC,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,MAAM,aAAa,GAAG,MAAM,CAAC;AAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC;AACxB,MAAM,YAAY,GAAG,KAAK,CAAC;AAC3B,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AACxC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC;AAC/C,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AACrC,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AACtC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,eAAe,EAAE,eAAe,EAAE,uBAAuB,CAAC,CAAC,CAAC;AAClG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;AA+C5D,4FAA4F;AAC5F,MAAM,UAAU,sBAAsB,CAAC,YAAoB;IACzD,OAAO,YAAY,IAAI,sBAAsB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AACxE,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,mBAAmB,CAAC,UAAkB,EAAE,KAAa;IACnE,OAAO,UAAU,GAAG,mBAAmB,IAAI,KAAK,GAAG,oBAAoB,CAAC;AAC1E,CAAC;AAED,MAAM,OAAO,uBAAuB;IAaL,IAAI;IAZxB,IAAI,CAAS;IACL,GAAG,CAAe;IAClB,MAAM,CAAkC;IACjD,MAAM,GAAoD,IAAI,CAAC;IAC/D,WAAW,CAAsB;IACjC,WAAW,CAAqB;IAChC,SAAS,GAAqB,SAAS,CAAC;IAC/B,IAAI,GAAG,IAAI,GAAG,EAA+C,CAAC;IACvE,UAAU,GAA0C,IAAI,CAAC;IACzD,QAAQ,GAAG,KAAK,CAAC;IACjB,oBAAoB,GAAkB,IAAI,CAAC;IAEnD,YAA6B,IAAuB;oBAAvB,IAAI;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QACxF,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,cAAc,IAAI,qBAAqB,CAAC;IAC7D,CAAC;IAEO,WAAW,KAAc,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC;IAEnG,gEAAgE;IAChE,MAAM,CAAC,OAAO,GAAuB,IAAI,CAAC,WAAW;QACnD,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,OAAO,IAAI,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/E,CAAC;IAED,kEAAkE;IAClE,aAAa,CAAC,OAA2B;QACvC,OAAO,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC;IAC1E,CAAC;IAED,mEAAmE;IACnE,SAAS,CAAC,OAA2B;QACnC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC;QAC3B,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,OAAO,IAAI,GAAG;YAC9D,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACzF,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,IAAyB;QAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,aAAa,CAAC;QACzE,0EAA0E;QAC1E,MAAM,OAAO,GAAG,IAAI,KAAK,IAAI,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,IAAI,KAAK,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,MAAO,CAAC,KAAK,CAAC;QACjD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YACrD,IAAI,CAAC,MAAM,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACxC,OAAO,KAAK,CAAC;QACf,CAAC,EAAE,GAAsB,EAAE;YACzB,IAAI,CAAC,MAAM,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACtD,OAAO,YAAY,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,MAAyB;QACvC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC7D,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACjG,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACvB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,KAAc,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAElD,KAAK,CAAC,IAAI;QAChB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QACvG,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAA2F,CAAC;QAC5H,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK;YAC5F,QAAQ,EAAE,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAsB;YAC/D,WAAW,EAAE,KAAK,CAAC,WAAiC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAkC,EAAE,CAAC;IACnH,CAAC;IAEO,cAAc,CAAC,GAAW;QAChC,IAAI,CAAC;YAAC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QAAC,CAAC;QACnF,MAAM,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC,CAAC,oFAAoF;IAC7G,CAAC;IAEO,UAAU,CAAC,GAAW;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,GAAG,EAAE,CAAC,CAAC;QAClD,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5C,6EAA6E;QAC7E,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACnC,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,mEAAmE;IACnE,KAAK,CAAC,YAAY;QAChB,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;IACvD,CAAC;IAEO,KAAK,CAAC,MAA2B,EAAE,GAAW;QACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,KAAK,UAAU;YAC1C,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,eAAe,GAAG,cAAc;YAC7D,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,GAAG,kBAAkB,CAAC,CAAC;IAC9E,CAAC;IAED,2DAA2D;IACnD,KAAK,CAAC,YAAY,CAAC,MAA2B;QACpD,MAAM,IAAI,GAAG,KAAK,EAAE,GAAY,EAAE,KAAc,EAAoB,EAAE;YACpE,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YAChC,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;QAC5F,CAAC,CAAC;QACF,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;QAC3H,OAAO,KAAK,IAAI,MAAM,CAAC;IACzB,CAAC;IAED;0DACsD;IACtD,KAAK,CAAC,gBAAgB,CAAC,aAAsB;QAC3C,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,OAAO,IAAI,CAAC;QACrC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC3E,IAAI,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,OAAO;YAAE,IAAI,CAAC,oBAAoB,GAAG,UAAU,CAAC;QACrF,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACpD,IAAI,MAAM,CAAC,SAAS,KAAK,aAAa;gBAAE,SAAS;YACjD,uEAAuE;YACvE,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,WAAW,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,WAAW;mBAC/E,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC,EAAE,CAAC;gBAC7D,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,uBAAuB,EAAE,CAAC,CAAC;gBACjF,SAAS;YACX,CAAC;YACD,IAAI,MAAM,CAAC,KAAK,KAAK,eAAe,IAAI,MAAM,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;gBACrE,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;oBAAE,OAAO,8BAA8B,CAAC;gBACxG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,mBAAmB,EAAE,GAAG,EAAE,CAAC,CAAC;gBAChE,SAAS;YACX,CAAC;YACD,IAAI,MAAM,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;gBACrC,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;oBAClC,IAAI,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;wBAAE,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,mBAAmB,EAAE,GAAG,EAAE,CAAC,CAAC;;wBAChG,OAAO,8BAA8B,CAAC;gBAC7C,CAAC;gBACD,SAAS;YACX,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAE,SAAS;YAC1C,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC;gBAAE,OAAO,gBAAgB,CAAC;YACtD,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;gBAAE,OAAO,4BAA4B,CAAC;YAC1E,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,eAAe,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,SAAS,CAAC,SAAiB;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,SAAS,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QAClG,IAAI,CAAC,UAAU,EAAE,CAAC;IACpB,CAAC;IAED;2BACuB;IACvB,KAAK,CAAC,aAAa,CAAC,SAAiB,EAAE,UAAkB;QACvD,wEAAwE;QACxE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;QAC9C,IAAI,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;QACpB,IAAI,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,EAAE;gBAC5E,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,cAAc,EAAE,gBAAgB;aAAE,EAAE,CAAC,CAAC;QAC3F,IAAI,KAAK,CAAC,KAAK;YAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAyC,CAAC;QACjE,IAAI,QAAQ,EAAE,KAAK,KAAK,eAAe;YAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;QAC7E,IAAI,QAAQ,IAAI,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7C,KAAK,CAAC,UAAU,EAAE,CAAC;YACnB,GAAG,GAAG,GAAG,SAAS,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACzC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC;YAChB,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,EAAE;oBACxE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,cAAc,EAAE,gBAAgB;iBAAE,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,GAAG,kBAAkB,EAAE,CAAC;YAC7C,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;YAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC;YACxC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;gBAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;gBACtC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,IAAI,kBAAkB;oBAAE,OAAO,EAAE,GAAG,EAAE,CAAC;gBAChE,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;YACzD,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;QACxC,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,CAAC;IACjB,CAAC;IAED,+EAA+E;IAC/E,KAAK,CAAC,UAAU,CAAC,SAAiB,EAAE,MAAiC;QACnE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC5B,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,oDAAoD;IACpD,KAAK,CAAC,aAAa,CAAC,SAAiB;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QACtF,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QACrE,OAAO,KAAK,CAAC,EAAE,KAAK,IAAI,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,SAAiB;QACnC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,SAAiB;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,cAAc,IAAI,IAAI,CAAC;IACxE,CAAC;IAED;sFACkF;IAClF,KAAK,CAAC,OAAO,CAAC,SAAsB;QAClC,MAAM,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACzD,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,WAAW,GAAY,IAAI,CAAC;QAChC,IAAI,CAAC;YACH,SAAS,EAAE,EAAE,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBACH,IAAI,KAAiC,CAAC;gBACtC,MAAM,OAAO,CAAC,IAAI,CAAC;oBACjB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;oBAC/D,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC;iBACzI,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;YACxC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,qFAAqF;gBACrF,WAAW,GAAG,GAAG,CAAC;YACpB,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,aAAa,EAAE,WAAW,KAAK,IAAI,EAAE,CAAC,CAAC;YACnF,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,gDAAgD;gBAC/G,IAAI,EAAE,WAAW,KAAK,IAAI;oBACxB,CAAC,CAAC,+EAA+E;oBACjF,CAAC,CAAC,mKAAmK,EAAE,CAAC,CAAC;QAC/K,CAAC;QACD,IAAI,WAAW,KAAK,IAAI;YAAE,MAAM,WAAW,YAAY,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IAC9G,CAAC;IAED,KAAK,CAAC,UAAU,KAAuB,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE7E,KAAK,CAAC,aAAa,CAAC,KAAqC;QACvD,MAAM,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC;QACnD,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI;YAAE,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACnG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;kEAC8D;IAC9D,eAAe;QACb,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;IAC9E,CAAC;IAED,iEAAiE;IACjE,eAAe,CAAC,KAAyE,EACvF,MAAyB,EAAE,KAAuB;QAClD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;YAAE,OAAO,mBAAmB,CAAC;QAC5D,IAAI,KAAK,CAAC,YAAY,KAAK,UAAU;YAAE,OAAO,0BAA0B,CAAC;QACzE,IAAI,KAAK,CAAC,UAAU,KAAK,KAAK;YAAE,OAAO,0BAA0B,CAAC;QAClE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,UAAU;gBAAE,OAAO,iBAAiB,CAAC;YAC/D,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE;gBAAE,OAAO,uBAAuB,CAAC;QACzE,CAAC;QACD,OAAO,KAAK,KAAK,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC;IAC7D,CAAC;IAEO,UAAU;QAChB,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO;QAC5B,IAAI,CAAC,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE;YACjC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACzC,OAAO,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;gBACpD,mBAAmB,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,qBAAqB;oBACvE,OAAO,EAAE,4BAA4B,EAAE,QAAQ,EAAE,6BAA6B;oBAC9E,MAAM,EAAE,iBAAiB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;oBACjF,MAAM,EAAE,4EAA4E,EAAE,CAAC,CAAC;YAC5F,CAAC,CAAC,CAAC;QACL,CAAC,EAAE,QAAQ,CAAC,CAAC;QACb,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC;IAC5B,CAAC;IAED,IAAI;QACF,IAAI,IAAI,CAAC,UAAU;YAAE,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;IACzB,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK;QACtB,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,OAAO;QACjD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,6EAA6E;QAC7E,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAChD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YACtC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YACxD,IAAI,IAAI,GAAG,MAAM,CAAC;YAClB,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpD,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO;oBAAE,SAAS;gBACnD,MAAM,WAAW,GAAG,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,WAAW;uBAClE,CAAC,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC,CAAC;gBAC9D,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;oBAC/C,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,uBAAuB,EAAE,CAAC,CAAC;oBACjF,SAAS;gBACX,CAAC;gBACD,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC/B,IAAI,GAAG,IAAI,CAAC;oBACZ,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;oBACzC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;wBAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;yBAC9C,IAAI,IAAI,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM;wBAAE,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;oBACnG,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;oBACrC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,GAAG,kBAAkB;wBAAE,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBACrF,CAAC;qBAAM,IAAI,MAAM,CAAC,KAAK,KAAK,eAAe,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;oBAChE,IAAI,GAAG,IAAI,CAAC;oBACZ,IAAI,IAAI,IAAI,WAAW;wBAAE,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;oBAC7D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,yBAAyB,GAAG,EAAE,EAAE,KAAK,EAAE,6BAA6B;wBACpH,IAAI,EAAE,mGAAmG,EAAE,CAAC,CAAC;oBAC/G,+DAA+D;oBAC/D,IAAI,IAAI;wBAAE,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC;gBACxE,CAAC;YACH,CAAC;YACD,IAAI,IAAI;gBAAE,IAAI,CAAC,UAAU,EAAE,CAAC;iBACvB,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC;gBAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,8EAA8E;YAC9E,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,iCAAiC,EAAE,KAAK,EAAE,yBAAyB;gBACtG,IAAI,EAAE,qFAAqF,EAAE,CAAC,CAAC;QACnG,CAAC;gBAAS,CAAC;YAAC,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QAAC,CAAC;IACtC,CAAC;IAED,gFAAgF;IACxE,KAAK,CAAC,mBAAmB;QAC/B,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACxF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,kBAAkB,IAAI,EAAE,EAAE,KAAK,EAAE,6BAA6B;gBAC9G,IAAI,EAAE,mGAAmG,EAAE,CAAC,CAAC;YAC/G,IAAI,IAAI;gBAAE,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,yDAAyD,EAAE,CAAC,CAAC;;gBAClJ,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,GAAW,EAAE,MAA2B;QAChE,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;QAC1C,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE;gBACtE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,gBAAgB;aAAE,EAAE,CAAC,CAAC;QACvG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,GAAW,EAAE,MAA2B;QACjE,MAAM,KAAK,GAAG,MAAM,CAAC,iBAAiB,IAAI,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,UAAU;eACnD,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;QAC5H,IAAI,sBAAsB,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;YAChD,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,WAAW;mBACtD,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;YAC9H,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,eAAe,EAAE,YAAY,EAAE,SAAS,IAAI,UAAU,EAAE,CAAC,CAAC;YAChH,OAAO;QACT,CAAC;QACD,IAAI,CAAC,SAAS;YAAE,OAAO;QACvB,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;QACpG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAA2B;QACtC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,QAAQ;YACxE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK;YACtD,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS;YAC/D,aAAa,EAAE,QAAQ,CAAC,KAAK,IAAI,CAAC,EAAE,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YACnF,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;YAClF,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,eAAe,CAAC,CAAC,MAAM,EAAE,CAAC;IAClG,CAAC;CACF;AAED,OAAO,EAAE,aAAa,EAAE,CAAC"}