instar 1.3.534 → 1.3.536

package/dist/core/CredentialSwapExecutor.js

@@ -0,0 +1,596 @@
+/**
+ * CredentialSwapExecutor — Step 5 of live credential re-pointing (spec §2.3).
+ *
+ * The staged exchange that MOVES a credential between two config-home slots WITHOUT restarting
+ * the sessions reading those slots (E3: the `claude` client re-reads its store on the next API
+ * call). `swap(slotA, slotB)` EXCHANGES the two slots' credentials — never copies — so the §0.d
+ * invariant ("one lineage per readable config home") holds by construction for the swap itself.
+ *
+ * Ships DARK + dry-run for EVERYONE (incl. dev). `subscriptionPool.credentialRepointing` is a
+ * `DARK_GATE_EXCLUSIONS` `destructive` entry (`enabled:false` + `dryRun:true`); with the feature
+ * off the executor performs ZERO real keychain/config writes (a strict no-op verdict), and with
+ * `dryRun` on it runs the full decision loop and AUDITS what it WOULD do without writing. Going
+ * live needs a deliberate `enabled:true` AND `dryRun:false` flip (the two-flag gate).
+ *
+ * ── The staged-exchange mechanism (spec §2.3 steps, each audited) ──
+ *  1.  Preconditions: BOTH slots resolve by EXACT membership in the ledger's enumerated slot set
+ *      BEFORE any path expansion (a value not `===` a known slot is rejected — `../`/`~`/absolute
+ *      traversal can never reach a keychain service, since the value is validated against the
+ *      ledger, not the filesystem); neither tenant quarantined; no swap in flight (single-mover);
+ *      both blobs re-read fresh, parse, and carry refresh tokens.
+ *  1a. Source-slot CAS: immediately before staging/overwriting each slot, RE-READ its on-disk
+ *      blob and compare to the step-1 read. If it changed and the new blob parses + identity-
+ *      matches the SAME tenant → ADOPT the newer blob (the client's rotated copy); never carry a
+ *      blob older than what is on disk. A different-tenant blob is a clobber-race → ABORT.
+ *  2.  Staging escrow: COPY (never move) blob A (the 1a re-read, freshest) into a DISJOINT
+ *      `instar-credential-swap-staging-<swapId>` keychain entry; journal `begin` BEFORE the first
+ *      destructive write. The staging namespace is guaranteed disjoint from every
+ *      `claudeCredentialService(home)` output, so no `claude` client / poller ever reads a staged
+ *      copy. Staging is RETAINED until step 6's delayed re-verify passes.
+ *  3.  The exchange: write blob B → slot A, write blob A (from staging) → slot B — KEYCHAIN FIRST,
+ *      then config (`oauthAccount` blocks; default slot config = `~/.claude.json`, home-root).
+ *  4.  Verify on ACCOUNT IDENTITY via the oracle (NOT token bytes, NOT auth-status). match→commit;
+ *      identity-MISMATCH→repair-from-staging then re-verify, still-wrong→quarantine;
+ *      oracle-UNAVAILABLE→QUARANTINE-NEVER-REPAIR (an outage must never trigger a destructive
+ *      repair). The system NEVER writes a credential into a slot it cannot identity-verify.
+ *  5.  Commit: journal `committed`, ledger assignments updated — staging RETAINED (a client
+ *      write-back between commit and step-6 could clobber slot B's only copy; staging is the heal
+ *      source for that window).
+ *  6.  Delayed re-verify ~90s after commit (oracle identity of both slots); only on pass →
+ *      DELETE staging + journal `done`. (90s covers the sub-2-min in-flight refresh; the at-expiry
+ *      write-back is the always-on §2.4 audit's job.)
+ *
+ * ── Crash-safety ── A crash at ANY boundary is decidable from the journal + the two slots' on-disk
+ * reads: before step 3's first write nothing destructive happened (staging is a COPY, slot A
+ * untouched) → unwind is a no-op; after `begin` and before `done`, staging is the escrow and
+ * recovery applies the adopt-on-newer rule (never a blind staging overwrite). `recover()` acquires
+ * the single-mover mutex (recovery WRITES race the boot balancer otherwise) and resolves every
+ * in-flight journal row; the balancer's first pass is gated on `recoveryBarrier` WITH a bounded
+ * hang-timeout (a wedged recovery write must not freeze the balancer forever — on timeout the
+ * unresolved slots are quarantined BEFORE the barrier lifts, so the balancer structurally cannot
+ * select them).
+ *
+ * ── Concurrency ── Every swap runs inside `funnel.withSingleMover(() => funnel.withSlotLocks([A,B],
+ * …))` so two swaps never overlap and a swap can never interleave with a refresh on the same slot
+ * (the Step-4b funnel guards both). All `security` keychain calls go through the async
+ * execFile-based `KeychainCredentialExec` with a 10s timeout — NEVER `execFileSync` (a locked
+ * keychain ACL prompt would wedge the event loop). The credential WRITE path routes through the
+ * funnel; the executor never calls `defaultCredentialStore.write` / `provider.writeCredentials`,
+ * so the §2.2 unfunneled-write lint stays clean.
+ *
+ * ── No token material on any surface ── audit records, journal details, attention items, and the
+ * swap-result reference accounts by id / slot only; every free-text error string is scrubbed
+ * through `redactToken` before it reaches any persisted/served/notified surface.
+ */
+import { execFile } from 'node:child_process';
+import { credentialSlotKey, claudeCredentialService, expandHome } from './OAuthRefresher.js';
+import { redactToken } from '../monitoring/CredentialProvider.js';
+const SECURITY_CALL_TIMEOUT_MS = 10_000;
+/** Disjoint from every `claudeCredentialService(home)` output (`Claude Code-credentials[-<8hex>]`). */
+const STAGING_SERVICE_PREFIX = 'instar-credential-swap-staging-';
+const DEFAULT_REVERIFY_DELAY_MS = 90_000;
+/** Hang-timeout barrier: a wedged recovery write must not freeze the balancer forever. */
+const DEFAULT_RECOVERY_BARRIER_TIMEOUT_MS = 60_000;
+/** Default macOS keychain exec — async `execFile`, 10s timeout. Non-darwin: a per-service file. */
+export const defaultKeychainExec = {
+    readService(service) {
+        return new Promise((resolve) => {
+            try {
+                execFile('security', ['find-generic-password', '-s', service, '-w'], { timeout: SECURITY_CALL_TIMEOUT_MS, maxBuffer: 1024 * 1024 }, (err, stdout) => {
+                    if (err) {
+                        resolve(null); // @silent-fallback-ok: no keychain entry (or timeout) → treated as absent; the caller's CAS/precondition decides, never a guess
+                        return;
+                    }
+                    const raw = (stdout ?? '').toString().trim();
+                    resolve(raw || null);
+                });
+            }
+            catch {
+                resolve(null); // @silent-fallback-ok: spawn failed → absent; never throws into the swap loop
+            }
+        });
+    },
+    writeService(service, rawJson) {
+        return new Promise((resolve, reject) => {
+            try {
+                execFile('security', ['add-generic-password', '-U', '-a', process.env.USER ?? 'instar', '-s', service, '-w', rawJson], { timeout: SECURITY_CALL_TIMEOUT_MS }, (err) => (err ? reject(err) : resolve()));
+            }
+            catch (err) {
+                reject(err);
+            }
+        });
+    },
+    deleteService(service) {
+        return new Promise((resolve) => {
+            try {
+                execFile('security', ['delete-generic-password', '-s', service], { timeout: SECURITY_CALL_TIMEOUT_MS }, () => resolve());
+            }
+            catch {
+                resolve(); // @silent-fallback-ok: spawn failed on a best-effort delete → leave the (harmless, disjoint) staging entry for the boot-recovery orphan sweep
+            }
+        });
+    },
+};
+/** No-op config exchange (the metadata follow is wired in Step 6's census re-routing). */
+export const noopConfigBlockExchange = {
+    async exchange() {
+        /* metadata-follow wired in Step 6 (census #1/#8); the keychain exchange is the record of truth */
+    },
+};
+export class CredentialSwapExecutor {
+    funnel;
+    ledger;
+    keychain;
+    configExchange;
+    resolveIdentity;
+    config;
+    emitAudit;
+    emitAttention;
+    now;
+    nowIso;
+    reverifyDelayMs;
+    recoveryBarrierTimeoutMs;
+    swapIdFactory;
+    /** Resolves once boot-recovery has resolved every in-flight journal row (or the barrier timed out). */
+    recoveryResolve = null;
+    recoveryBarrier;
+    recoveryDone = false;
+    seq = 0;
+    constructor(deps) {
+        this.funnel = deps.funnel;
+        this.ledger = deps.ledger;
+        this.keychain = deps.keychain ?? defaultKeychainExec;
+        this.configExchange = deps.configExchange ?? noopConfigBlockExchange;
+        this.resolveIdentity = deps.resolveIdentity;
+        this.config = { enabled: deps.config?.enabled ?? false, dryRun: deps.config?.dryRun ?? true };
+        this.emitAudit = deps.emitAudit;
+        this.emitAttention = deps.emitAttention;
+        this.now = deps.now ?? (() => Date.now());
+        this.nowIso = deps.nowIso ?? (() => new Date(this.now()).toISOString());
+        this.reverifyDelayMs = deps.reverifyDelayMs ?? DEFAULT_REVERIFY_DELAY_MS;
+        this.recoveryBarrierTimeoutMs = deps.recoveryBarrierTimeoutMs ?? DEFAULT_RECOVERY_BARRIER_TIMEOUT_MS;
+        this.swapIdFactory = deps.swapIdFactory ?? (() => `${Date.now().toString(36)}-${(this.seq++).toString(36)}`);
+        this.recoveryBarrier = new Promise((resolve) => {
+            this.recoveryResolve = resolve;
+        });
+    }
+    /**
+     * The balancer's first pass awaits THIS before selecting any pair — so a recovery WRITE can't
+     * race a fresh swap on a different slot pair (round-2 unmutexed write-write find). Bounded by a
+     * hang-timeout: a wedged recovery write must not freeze the balancer forever.
+     */
+    awaitRecoveryComplete() {
+        return this.recoveryBarrier;
+    }
+    isRecoveryComplete() {
+        return this.recoveryDone;
+    }
+    // ── Audit / scrub chokepoint ────────────────────────────────────────────────────────────────
+    /** SINGLE emit chokepoint — every record is scrubbed of token material here (§2.9). */
+    audit(swapId, step, slotA, slotB, detail) {
+        if (!this.emitAudit)
+            return;
+        this.emitAudit({ swapId, step, slotA, slotB, detail: detail ? scrub(detail) : undefined, at: this.nowIso() });
+    }
+    stagingService(swapId) {
+        return `${STAGING_SERVICE_PREFIX}${swapId}`;
+    }
+    // ── The swap (spec §2.3) ──────────────────────────────────────────────────────────────────────
+    /**
+     * EXCHANGE the credentials of two slots. Returns a verdict; never throws into the caller for an
+     * expected condition (precondition fail / clobber-race / quarantine / busy lock are all results).
+     */
+    async swap(slotA, slotB) {
+        // DARK: feature off → strict no-op (zero writes). This is the dark-ship inertness guarantee.
+        if (!this.config.enabled) {
+            return { outcome: 'disabled', reason: 'credential re-pointing is disabled (dark) — no swap performed' };
+        }
+        // Step 1 (precondition, pre-lock): EXACT ledger membership BEFORE any path expansion. A value
+        // not === a known slot is rejected — `../`/`~`/absolute traversal can never reach a keychain
+        // service because we validate against the ledger's enumerated set, not the filesystem.
+        const memberSlots = new Set(this.ledger.getAssignments().map((a) => a.slot));
+        if (slotA === slotB) {
+            return { outcome: 'precondition-failed', reason: 'slotA and slotB are the same slot' };
+        }
+        if (!memberSlots.has(slotA) || !memberSlots.has(slotB)) {
+            return {
+                outcome: 'precondition-failed',
+                reason: `a slot is not a known ledger member (got '${slotA}', '${slotB}') — refusing an arbitrary keychain/path write`,
+            };
+        }
+        const aAssign = this.ledger.getAssignment(slotA);
+        const bAssign = this.ledger.getAssignment(slotB);
+        if (aAssign?.quarantined || bAssign?.quarantined) {
+            return { outcome: 'precondition-failed', reason: 'a slot tenant is quarantined — excluded from balancing' };
+        }
+        // Take the single-mover mutex (no swap in flight) THEN both slot locks (canonical order). The
+        // funnel returns a SKIP rather than blocking → a busy lock is a transient retry, never a wedge.
+        const moverResult = await this.funnel.withSingleMover(async () => {
+            return this.funnel.withSlotLocks([credentialSlotKey(slotA), credentialSlotKey(slotB)], () => this.swapLocked(slotA, slotB, aAssign?.accountId ?? '', bAssign?.accountId ?? ''));
+        });
+        if (!moverResult.ran) {
+            return { outcome: 'skipped', reason: scrub(moverResult.skippedReason ?? 'funnel busy') };
+        }
+        const inner = moverResult.value;
+        if (!inner.ran) {
+            return { outcome: 'skipped', reason: scrub(inner.skippedReason ?? 'slot lock busy') };
+        }
+        return inner.value;
+    }
+    /** Runs under the single-mover mutex + both slot locks. */
+    async swapLocked(slotA, slotB, expectA, expectB) {
+        const swapId = this.swapIdFactory();
+        // Step 1 (continued): re-read both blobs fresh; they must parse + carry refresh tokens.
+        const read1A = await this.readBlob(slotA);
+        const read1B = await this.readBlob(slotB);
+        if (!read1A || !read1B) {
+            return { outcome: 'precondition-failed', reason: `a slot blob is missing/unparseable or lacks a refresh token`, swapId };
+        }
+        // Step 1a: source-slot CAS — re-read each slot immediately before it is staged/overwritten. If
+        // a slot changed AND the new blob is the SAME tenant → ADOPT it (the client's rotated copy). A
+        // DIFFERENT-tenant blob is a clobber-race → ABORT, overwrite nothing.
+        const casA = await this.casReread(slotA, read1A, expectA, swapId);
+        if (casA.aborted)
+            return { outcome: 'clobber-race', reason: casA.reason, swapId };
+        const casB = await this.casReread(slotB, read1B, expectB, swapId);
+        if (casB.aborted)
+            return { outcome: 'clobber-race', reason: casB.reason, swapId };
+        const blobA = casA.blob; // freshest A (adopted if the client rotated it)
+        const blobB = casB.blob; // freshest B
+        // dryRun: full decision loop ran, ZERO writes. Audit the WOULD-swap and stop before step 2.
+        if (this.config.dryRun) {
+            this.audit(swapId, 'dry-run', slotA, slotB, `would exchange ${expectA}<->${expectB}`);
+            return { outcome: 'dry-run', reason: 'dry-run — decision computed, zero credential writes', swapId };
+        }
+        // Step 2: staging escrow — COPY blob A into a disjoint staging entry, THEN journal `begin`
+        // BEFORE the first destructive write. (COPY not move: slot A is untouched until step 3, so a
+        // crash before step 3 unwinds to a true no-op.)
+        const staging = this.stagingService(swapId);
+        await this.keychain.writeService(staging, blobA.raw);
+        this.ledger.appendJournal({ op: 'swap', phase: 'begin', slots: [slotA, slotB], detail: `swapId=${swapId} staging` });
+        this.audit(swapId, 'begin', slotA, slotB, `staged A; exchanging ${expectA}<->${expectB}`);
+        // Step 3: the exchange — KEYCHAIN FIRST (write B→slotA, then A→slotB from staging), config
+        // second. The between-the-two-writes crash point is recovery-decidable (journal begin + the
+        // two slots' on-disk reads + the retained staging copy of A).
+        await this.keychain.writeService(claudeCredentialService(slotA), blobB.raw);
+        await this.keychain.writeService(claudeCredentialService(slotB), blobA.raw);
+        this.ledger.appendJournal({ op: 'swap', phase: 'exchanged', slots: [slotA, slotB], detail: `swapId=${swapId} keychain` });
+        try {
+            await this.configExchange.exchange(slotA, slotB);
+        }
+        catch (err) {
+            // Config-write failure AFTER a successful keychain exchange is a REPAIRABLE metadata
+            // condition — never a quarantine. Audited; the metadata-follow retry is the §2.3 step-3 path.
+            this.audit(swapId, 'config-exchange-deferred', slotA, slotB, `metadata follow failed (repairable): ${err?.message ?? 'unknown'}`);
+        }
+        // Step 4: verify on ACCOUNT IDENTITY. The credential now in slotA must be expectB's; the one
+        // in slotB must be expectA's.
+        const verify = await this.verifyAndHeal(slotA, slotB, expectB, expectA, staging, blobB, blobA, swapId);
+        if (verify.quarantined) {
+            return { outcome: 'quarantined', reason: verify.reason, swapId, quarantinedSlots: verify.quarantinedSlots };
+        }
+        // Step 5: commit — ledger assignments updated; staging RETAINED (heal source through step 6).
+        this.ledger.appendJournal({ op: 'swap', phase: 'verified', slots: [slotA, slotB], detail: `swapId=${swapId}` });
+        this.ledger.recordAssignment(slotA, expectB, { verifiedAt: this.nowIso(), op: 'swap' });
+        this.ledger.recordAssignment(slotB, expectA, { verifiedAt: this.nowIso(), op: 'swap' });
+        this.audit(swapId, 'committed', slotA, slotB, `tenants exchanged (staging retained)`);
+        // Step 6: delayed re-verify, then staging delete. Scheduled (does NOT block the swap return);
+        // a client whose refresh exchange was in flight DURING the swap lands its write after step 4.
+        this.scheduleReverify(slotA, slotB, expectB, expectA, staging, swapId);
+        return { outcome: 'swapped', reason: 'credentials exchanged; staging retained pending delayed re-verify', swapId };
+    }
+    // ── Step 1a: source-slot CAS ──────────────────────────────────────────────────────────────────
+    async casReread(slot, read1, expectTenant, swapId) {
+        const fresh = await this.readBlob(slot);
+        if (!fresh) {
+            // The slot became unreadable between step 1 and the destructive write → abort (do not write a
+            // stale copy over an absent/garbage on-disk state).
+            return { aborted: true, reason: `slot '${slot}' became unreadable before write (CAS)` };
+        }
+        if (fresh.raw === read1.raw) {
+            return { aborted: false, blob: read1 }; // unchanged
+        }
+        // It changed. Is the new blob the SAME tenant? Adopt; else it's a clobber-race → abort.
+        const identity = await this.resolveIdentity(slot);
+        if ('unavailable' in identity) {
+            // Cannot confirm the tenant of the changed blob → do NOT guess. Abort the swap (the safe
+            // direction: never overwrite a blob we cannot identity-verify is the same lineage).
+            return { aborted: true, reason: `CAS: slot '${slot}' changed and identity is unavailable — aborting (${identity.reason})` };
+        }
+        if (identity.accountId !== expectTenant) {
+            this.audit(swapId, 'clobber-race', slot, slot, `CAS saw a different-tenant blob (expected ${expectTenant})`);
+            return { aborted: true, reason: `CAS: slot '${slot}' now holds a different tenant — clobber-race, aborting` };
+        }
+        // Same tenant, newer blob → ADOPT (the client's rotated copy).
+        this.audit(swapId, 'cas-adopt', slot, slot, `adopted the client's rotated same-tenant blob`);
+        return { aborted: false, blob: fresh };
+    }
+    // ── Step 4: verify-and-heal (identity match → adopt / mismatch → repair / unavailable → quarantine) ──
+    async verifyAndHeal(slotA, slotB, wantA, wantB, staging, blobForA, blobForB, swapId) {
+        const quarantined = [];
+        for (const [slot, want, blob] of [
+            [slotA, wantA, blobForA],
+            [slotB, wantB, blobForB],
+        ]) {
+            const id = await this.resolveIdentity(slot);
+            if ('unavailable' in id) {
+                // Oracle UNAVAILABLE during verify → quarantine-never-repair (an outage must never trigger
+                // a destructive repair). Leave the slot quarantined; the scheduled §2.4 re-probe clears it.
+                this.ledger.quarantineSlot(slot, scrub(`oracle unavailable at verify: ${id.reason}`));
+                await this.raiseQuarantineAttention(slot, swapId, 'oracle unavailable at verify');
+                this.audit(swapId, 'quarantine-oracle-unavailable', slotA, slotB, `slot=${slot}`);
+                quarantined.push(slot);
+                continue;
+            }
+            if (id.accountId === want) {
+                continue; // identity match → good
+            }
+            // Identity MISMATCH with a reachable oracle → ONE repair from staging/fresh blob, re-verify.
+            this.audit(swapId, 'repair-attempt', slotA, slotB, `slot=${slot} expected=${want} got=${id.accountId}`);
+            await this.keychain.writeService(claudeCredentialService(slot), blob.raw);
+            const reId = await this.resolveIdentity(slot);
+            if (!('unavailable' in reId) && reId.accountId === want) {
+                this.audit(swapId, 'repair-ok', slotA, slotB, `slot=${slot}`);
+                continue;
+            }
+            // Still wrong (or the oracle went unavailable on re-verify) → quarantine, leave the other
+            // slot consistent. The bounded blast radius is one account re-auth (§6).
+            this.ledger.quarantineSlot(slot, scrub(`identity unrepairable after one attempt (wanted ${want})`));
+            await this.raiseQuarantineAttention(slot, swapId, 'identity mismatch unrepairable');
+            this.audit(swapId, 'quarantine-mismatch', slotA, slotB, `slot=${slot}`);
+            quarantined.push(slot);
+        }
+        if (quarantined.length > 0) {
+            return { quarantined: true, reason: 'one or more slots could not be identity-confirmed — quarantined (never repaired blindly)', quarantinedSlots: quarantined };
+        }
+        return { quarantined: false, reason: 'both slots identity-confirmed' };
+    }
+    // ── Step 6: delayed re-verify + staging delete ────────────────────────────────────────────────
+    scheduleReverify(slotA, slotB, wantA, wantB, staging, swapId) {
+        const run = async () => {
+            try {
+                await this.reverifyNow(slotA, slotB, wantA, wantB, staging, swapId);
+            }
+            catch (err) {
+                // @silent-fallback-ok — the delayed re-verify is best-effort cleanup; a failure here leaves
+                // the journal at `committed` and staging RETAINED, which boot-recovery resolves (the
+                // crash-safe state). It must never throw out of a timer and crash the process.
+                this.audit(swapId, 'reverify-error', slotA, slotB, scrub(err?.message ?? 'unknown'));
+            }
+        };
+        const t = setTimeout(() => void run(), this.reverifyDelayMs);
+        if (typeof t.unref === 'function')
+            t.unref();
+    }
+    /** Run the step-6 re-verify immediately (exposed for deterministic tests). */
+    async reverifyNow(slotA, slotB, wantA, wantB, staging, swapId) {
+        let allGood = true;
+        for (const [slot, want] of [
+            [slotA, wantA],
+            [slotB, wantB],
+        ]) {
+            const id = await this.resolveIdentity(slot);
+            if ('unavailable' in id || id.accountId !== want) {
+                // A write-back clobbered the slot (or the oracle is down). Do NOT blind-overwrite with
+                // staging (adopt-on-newer): re-read the slot; if it already identity-matches, the client
+                // healed it. Otherwise the honest outcome is needs-reauth/quarantine — surfaced, not papered.
+                allGood = false;
+                this.audit(swapId, 'reverify-divergence', slotA, slotB, `slot=${slot} want=${want}`);
+                if ('unavailable' in id) {
+                    this.ledger.quarantineSlot(slot, scrub(`step-6 re-verify: oracle unavailable (${id.reason})`));
+                }
+                else {
+                    this.ledger.quarantineSlot(slot, scrub(`step-6 re-verify: slot diverged from ${want} (a client write-back)`));
+                }
+                await this.raiseQuarantineAttention(slot, swapId, 'delayed re-verify divergence');
+            }
+        }
+        if (allGood) {
+            // Both slots still correct → delete staging, journal `done`. Staging is the heal source ONLY
+            // through this point (retaining it past `done` would orphan it; the sweep predicate protects
+            // any non-`done` row).
+            await this.keychain.deleteService(staging);
+            this.ledger.appendJournal({ op: 'swap', phase: 'done', slots: [slotA, slotB], detail: `swapId=${swapId} reverified` });
+            this.audit(swapId, 'done', slotA, slotB, 'delayed re-verify passed; staging deleted');
+        }
+    }
+    // ── Boot recovery (single-mover mutex; resolves in-flight journal rows; barrier with hang-timeout) ──
+    /**
+     * Resolve every in-flight swap journal row left by a crash. Acquires the single-mover mutex (a
+     * recovery WRITE must not race a boot balancer pass on the ledger). When it finishes (or the
+     * hang-timeout fires) the recovery barrier lifts so the balancer's first pass can run. A wedged
+     * recovery write quarantines its slots BEFORE the barrier lifts, so the post-lift balancer
+     * structurally cannot select a wedged slot.
+     */
+    async recover() {
+        if (this.recoveryDone)
+            return;
+        let lifted = false;
+        const lift = () => {
+            if (lifted)
+                return;
+            lifted = true;
+            this.recoveryDone = true;
+            this.recoveryResolve?.();
+        };
+        // Hang-timeout: a wedged recovery write (a keychain ACL prompt on the default slot) must not
+        // freeze the barrier forever. On timeout, quarantine the unresolved in-flight slots FIRST,
+        // THEN lift — the per-write 10s execFile timeout is what actually releases a held lock.
+        const inFlight = this.inFlightSwaps();
+        const barrierTimer = setTimeout(() => {
+            for (const e of inFlight) {
+                for (const slot of e.slots) {
+                    try {
+                        this.ledger.quarantineSlot(slot, 'boot-recovery barrier timed out — slot unresolved, fail-closed');
+                    }
+                    catch {
+                        /* @silent-fallback-ok — ledger may be UNKNOWN-mode; the barrier still lifts so the balancer can run on the healthy remainder */
+                    }
+                }
+            }
+            lift();
+        }, this.recoveryBarrierTimeoutMs);
+        if (typeof barrierTimer.unref === 'function')
+            barrierTimer.unref();
+        try {
+            await this.funnel.withSingleMover(async () => {
+                for (const entry of inFlight) {
+                    await this.recoverEntry(entry);
+                }
+            });
+        }
+        finally {
+            clearTimeout(barrierTimer);
+            lift();
+        }
+    }
+    /** In-flight swap journal rows = a `begin`/`exchanged`/`verified` row whose swapId has no later `done`/`aborted`. */
+    inFlightSwaps() {
+        const bySwap = new Map();
+        for (const e of this.ledger.getJournal()) {
+            if (e.op !== 'swap')
+                continue;
+            const id = parseSwapId(e.detail);
+            if (!id)
+                continue;
+            const rec = bySwap.get(id) ?? { slots: e.slots, phases: new Set() };
+            rec.phases.add(e.phase);
+            if (e.slots.length)
+                rec.slots = e.slots;
+            bySwap.set(id, rec);
+        }
+        const out = [];
+        for (const [swapId, rec] of bySwap) {
+            const terminal = rec.phases.has('done') || rec.phases.has('aborted');
+            if (terminal)
+                continue;
+            const lastPhase = rec.phases.has('verified') ? 'verified' : rec.phases.has('exchanged') ? 'exchanged' : 'begin';
+            out.push({ swapId, slots: rec.slots, lastPhase });
+        }
+        return out;
+    }
+    /**
+     * Resolve one in-flight entry. Per §2.3 recovery decidability: re-read each slot, apply
+     * adopt-on-newer (never a blind staging overwrite), and verify identity; an unverifiable slot is
+     * quarantined (never repaired blindly). Staging is deleted + the row closed `done` ONLY when
+     * both slots verify; otherwise the row stays in-flight and its staging is retained (the sweep
+     * predicate protects any non-`done` row).
+     */
+    async recoverEntry(entry) {
+        const [slotA, slotB] = entry.slots;
+        if (!slotA || !slotB) {
+            // Cannot resolve a malformed entry; close it aborted (nothing to heal that we can identify).
+            this.ledger.appendJournal({ op: 'swap', phase: 'aborted', slots: entry.slots, detail: `swapId=${entry.swapId} unrecoverable-entry` });
+            return;
+        }
+        // The ledger's intended tenants after this swap are the CURRENT assignments (recordAssignment
+        // ran iff the swap committed); for an in-flight entry we resolve by reading the live identity
+        // of each slot and quarantining anything we cannot confirm. We never guess a tenant.
+        const staging = this.stagingService(entry.swapId);
+        let allConfirmed = true;
+        for (const slot of [slotA, slotB]) {
+            const id = await this.resolveIdentity(slot);
+            if ('unavailable' in id) {
+                allConfirmed = false;
+                this.ledger.quarantineSlot(slot, scrub(`boot-recovery: oracle unavailable (${id.reason})`));
+                await this.raiseQuarantineAttention(slot, entry.swapId, 'boot-recovery oracle unavailable');
+            }
+        }
+        if (allConfirmed) {
+            // Both slots carry a confirmable tenant → the exchange is coherent; clean up staging + close.
+            await this.keychain.deleteService(staging);
+            this.ledger.appendJournal({ op: 'swap', phase: 'done', slots: entry.slots, detail: `swapId=${entry.swapId} recovered` });
+            this.audit(entry.swapId, 'recovered', slotA, slotB, 'boot-recovery confirmed both slots');
+        }
+        else {
+            // Leave the row in-flight (staging retained — the heal source). The slot(s) are quarantined
+            // and excluded from balancing until a clean re-probe; staging is NOT deleted.
+            this.audit(entry.swapId, 'recover-deferred', slotA, slotB, 'a slot unconfirmed — staging retained, slots quarantined');
+        }
+    }
+    // ── Orphan-staging sweep (boot) ───────────────────────────────────────────────────────────────
+    /**
+     * A staging entry is an ORPHAN iff its swapId has NO journal row, OR its row is `done`. Any
+     * non-`done` row (begin/exchanged/verified) PROTECTS its staging (the heal source through step
+     * 6 — a literal "in-flight = begin only" reading would delete a committed row's heal source).
+     * Caller supplies the live staging-service list (the executor never enumerates the keychain).
+     */
+    async sweepOrphanStaging(stagingServices) {
+        // A swapId is PROTECTED iff it is currently in-flight — i.e. it has at least one swap journal
+        // row and NONE of them is terminal (`done`/`aborted`). `inFlightSwaps()` computes exactly that
+        // (a swapId with ANY `done` row drops out). A `done`/`aborted` swapId and a swapId with no row
+        // at all are both UNPROTECTED → their staging is an orphan and is deleted. (The earlier
+        // per-row "protect on any non-done row" reading would wrongly retain a finished swap's staging
+        // whose history still carries its `begin` row — the lost-source bug this predicate avoids in
+        // the other direction.)
+        const inFlightIds = new Set(this.inFlightSwaps().map((e) => e.swapId));
+        const deleted = [];
+        for (const service of stagingServices) {
+            if (!service.startsWith(STAGING_SERVICE_PREFIX))
+                continue;
+            const id = service.slice(STAGING_SERVICE_PREFIX.length);
+            if (inFlightIds.has(id))
+                continue;
+            await this.keychain.deleteService(service);
+            deleted.push(service);
+        }
+        return deleted;
+    }
+    // ── Blob read + validation ────────────────────────────────────────────────────────────────────
+    /** Read a slot's blob via the async keychain exec; require it parse + carry a refresh token. */
+    async readBlob(slot) {
+        const raw = await this.keychain.readService(claudeCredentialService(slot));
+        if (!raw)
+            return null;
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            return null; // @silent-fallback-ok: unparseable blob → precondition fail (never overwritten); the caller refuses the swap
+        }
+        const oauth = (parsed?.claudeAiOauth ?? null);
+        if (!oauth || typeof oauth !== 'object')
+            return null;
+        if (typeof oauth.refreshToken !== 'string' || !oauth.refreshToken)
+            return null;
+        return { raw, oauth };
+    }
+    async raiseQuarantineAttention(slot, swapId, why) {
+        if (!this.emitAttention)
+            return;
+        try {
+            await this.emitAttention({
+                id: `credential-swap-quarantine:${credentialSlotKey(slot)}`,
+                title: 'A credential slot was quarantined during a swap',
+                summary: scrub(`Slot ${expandHome(slot)} was quarantined (${why}); it is excluded from balancing until a clean re-probe. Blast radius: one account may need re-auth.`),
+                category: 'credential-repointing',
+                priority: 'HIGH',
+                sourceContext: 'credential-swap-executor',
+            });
+        }
+        catch {
+            // @silent-fallback-ok — best-effort notice; the quarantine (the safety action) is already
+            // durably recorded in the ledger whether or not this notice is delivered.
+        }
+    }
+}
+// ─── Module helpers ──────────────────────────────────────────────────────────────────────────────
+/** Extract `swapId=<id>` from a journal detail string. */
+function parseSwapId(detail) {
+    if (!detail)
+        return null;
+    const m = /swapId=([^\s]+)/.exec(detail);
+    return m ? m[1] : null;
+}
+/**
+ * Scrub any token material from a free-text string before it reaches a persisted/served/notified
+ * surface (§2.9 single-emit chokepoint). Catches the `sk-ant-…` family via `redactToken` on any
+ * token-shaped run, so a `security` stderr or a `${raw}`-bearing interpolation can't leak a byte.
+ */
+function scrub(s) {
+    if (!s)
+        return s;
+    return s.replace(/sk-ant-[A-Za-z0-9_-]+/g, (m) => redactToken(m));
+}
+//# sourceMappingURL=CredentialSwapExecutor.js.map

package/dist/core/CredentialSwapExecutor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialSwapExecutor.js","sourceRoot":"","sources":["../../src/core/CredentialSwapExecutor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,UAAU,EAAoB,MAAM,qBAAqB,CAAC;AAG/G,OAAO,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAC;AAElE,MAAM,wBAAwB,GAAG,MAAM,CAAC;AACxC,uGAAuG;AACvG,MAAM,sBAAsB,GAAG,iCAAiC,CAAC;AACjE,MAAM,yBAAyB,GAAG,MAAM,CAAC;AACzC,0FAA0F;AAC1F,MAAM,mCAAmC,GAAG,MAAM,CAAC;AAqBnD,mGAAmG;AACnG,MAAM,CAAC,MAAM,mBAAmB,GAA2B;IACzD,WAAW,CAAC,OAAe;QACzB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,CAAC;gBACH,QAAQ,CACN,UAAU,EACV,CAAC,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAC9C,EAAE,OAAO,EAAE,wBAAwB,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,EAAE,EAC7D,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;oBACd,IAAI,GAAG,EAAE,CAAC;wBACR,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,gIAAgI;wBAC/I,OAAO;oBACT,CAAC;oBACD,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;oBAC7C,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;gBACvB,CAAC,CACF,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,8EAA8E;YAC/F,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IACD,YAAY,CAAC,OAAe,EAAE,OAAe;QAC3C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC;gBACH,QAAQ,CACN,UAAU,EACV,CAAC,sBAAsB,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,EAChG,EAAE,OAAO,EAAE,wBAAwB,EAAE,EACrC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CACzC,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,GAAY,CAAC,CAAC;YACvB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IACD,aAAa,CAAC,OAAe;QAC3B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,CAAC;gBACH,QAAQ,CACN,UAAU,EACV,CAAC,yBAAyB,EAAE,IAAI,EAAE,OAAO,CAAC,EAC1C,EAAE,OAAO,EAAE,wBAAwB,EAAE,EACrC,GAAG,EAAE,CAAC,OAAO,EAAE,CAChB,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,CAAC,CAAC,8IAA8I;YAC3J,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAC;AAeF,0FAA0F;AAC1F,MAAM,CAAC,MAAM,uBAAuB,GAAwB;IAC1D,KAAK,CAAC,QAAQ;QACZ,kGAAkG;IACpG,CAAC;CACF,CAAC;AA8EF,MAAM,OAAO,sBAAsB;IAChB,MAAM,CAAwB;IAC9B,MAAM,CAA2B;IACjC,QAAQ,CAAyB;IACjC,cAAc,CAAsB;IACpC,eAAe,CAAsB;IACrC,MAAM,CAAwC;IAC9C,SAAS,CAAqC;IAC9C,aAAa,CAA+C;IAC5D,GAAG,CAAe;IAClB,MAAM,CAAe;IACrB,eAAe,CAAS;IACxB,wBAAwB,CAAS;IACjC,aAAa,CAAe;IAE7C,uGAAuG;IAC/F,eAAe,GAAwB,IAAI,CAAC;IACnC,eAAe,CAAgB;IACxC,YAAY,GAAG,KAAK,CAAC;IACrB,GAAG,GAAG,CAAC,CAAC;IAEhB,YAAY,IAAgC;QAC1C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,mBAAmB,CAAC;QACrD,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,uBAAuB,CAAC;QACrE,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;QAC5C,IAAI,CAAC,MAAM,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC;QAC9F,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,yBAAyB,CAAC;QACzE,IAAI,CAAC,wBAAwB,GAAG,IAAI,CAAC,wBAAwB,IAAI,mCAAmC,CAAC;QACrG,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC7G,IAAI,CAAC,eAAe,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACnD,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,qBAAqB;QACnB,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED,kBAAkB;QAChB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,+FAA+F;IAE/F,uFAAuF;IAC/E,KAAK,CAAC,MAAc,EAAE,IAAY,EAAE,KAAa,EAAE,KAAa,EAAE,MAAe;QACvF,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO;QAC5B,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChH,CAAC;IAEO,cAAc,CAAC,MAAc;QACnC,OAAO,GAAG,sBAAsB,GAAG,MAAM,EAAE,CAAC;IAC9C,CAAC;IAED,iGAAiG;IAEjG;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,KAAa,EAAE,KAAa;QACrC,6FAA6F;QAC7F,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,+DAA+D,EAAE,CAAC;QAC1G,CAAC;QAED,8FAA8F;QAC9F,6FAA6F;QAC7F,uFAAuF;QACvF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7E,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;YACpB,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC;QACzF,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACvD,OAAO;gBACL,OAAO,EAAE,qBAAqB;gBAC9B,MAAM,EAAE,6CAA6C,KAAK,OAAO,KAAK,gDAAgD;aACvH,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,OAAO,EAAE,WAAW,IAAI,OAAO,EAAE,WAAW,EAAE,CAAC;YACjD,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,wDAAwD,EAAE,CAAC;QAC9G,CAAC;QAED,8FAA8F;QAC9F,gGAAgG;QAChG,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,IAAI,EAAE;YAC/D,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,CAC1F,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,IAAI,EAAE,EAAE,OAAO,EAAE,SAAS,IAAI,EAAE,CAAC,CAClF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC;YACrB,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,aAAa,IAAI,aAAa,CAAC,EAAE,CAAC;QAC3F,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAqE,CAAC;QAChG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YACf,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa,IAAI,gBAAgB,CAAC,EAAE,CAAC;QACxF,CAAC;QACD,OAAO,KAAK,CAAC,KAAmB,CAAC;IACnC,CAAC;IAED,2DAA2D;IACnD,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,KAAa,EAAE,OAAe,EAAE,OAAe;QACrF,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAEpC,wFAAwF;QACxF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YACvB,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,6DAA6D,EAAE,MAAM,EAAE,CAAC;QAC3H,CAAC;QAED,+FAA+F;QAC/F,+FAA+F;QAC/F,sEAAsE;QACtE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAClE,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAClF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAClE,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAClF,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,gDAAgD;QACzE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa;QAEtC,4FAA4F;QAC5F,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,OAAO,MAAM,OAAO,EAAE,CAAC,CAAC;YACtF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,qDAAqD,EAAE,MAAM,EAAE,CAAC;QACvG,CAAC;QAED,2FAA2F;QAC3F,6FAA6F;QAC7F,gDAAgD;QAChD,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,UAAU,MAAM,UAAU,EAAE,CAAC,CAAC;QACrH,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,OAAO,MAAM,OAAO,EAAE,CAAC,CAAC;QAE1F,2FAA2F;QAC3F,4FAA4F;QAC5F,8DAA8D;QAC9D,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,uBAAuB,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5E,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,uBAAuB,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5E,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,UAAU,MAAM,WAAW,EAAE,CAAC,CAAC;QAC1H,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qFAAqF;YACrF,8FAA8F;YAC9F,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,0BAA0B,EAAE,KAAK,EAAE,KAAK,EAAE,wCAAyC,GAAa,EAAE,OAAO,IAAI,SAAS,EAAE,CAAC,CAAC;QAC/I,CAAC;QAED,6FAA6F;QAC7F,8BAA8B;QAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACvG,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC9G,CAAC;QAED,8FAA8F;QAC9F,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,UAAU,MAAM,EAAE,EAAE,CAAC,CAAC;QAChH,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACxF,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACxF,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,sCAAsC,CAAC,CAAC;QAEtF,8FAA8F;QAC9F,8FAA8F;QAC9F,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAEvE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,mEAAmE,EAAE,MAAM,EAAE,CAAC;IACrH,CAAC;IAED,iGAAiG;IAEzF,KAAK,CAAC,SAAS,CACrB,IAAY,EACZ,KAAe,EACf,YAAoB,EACpB,MAAc;QAEd,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,8FAA8F;YAC9F,oDAAoD;YACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,IAAI,wCAAwC,EAAE,CAAC;QAC1F,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,EAAE,CAAC;YAC5B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,YAAY;QACtD,CAAC;QACD,wFAAwF;QACxF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,aAAa,IAAI,QAAQ,EAAE,CAAC;YAC9B,yFAAyF;YACzF,oFAAoF;YACpF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,IAAI,qDAAqD,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAC;QAC9H,CAAC;QACD,IAAI,QAAQ,CAAC,SAAS,KAAK,YAAY,EAAE,CAAC;YACxC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,6CAA6C,YAAY,GAAG,CAAC,CAAC;YAC7G,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,IAAI,yDAAyD,EAAE,CAAC;QAChH,CAAC;QACD,+DAA+D;QAC/D,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,+CAA+C,CAAC,CAAC;QAC7F,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACzC,CAAC;IAED,wGAAwG;IAEhG,KAAK,CAAC,aAAa,CACzB,KAAa,EACb,KAAa,EACb,KAAa,EACb,KAAa,EACb,OAAe,EACf,QAAkB,EAClB,QAAkB,EAClB,MAAc;QAEd,MAAM,WAAW,GAAa,EAAE,CAAC;QAEjC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI;YAC/B,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC;YACxB,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC;SAChB,EAAE,CAAC;YACX,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,aAAa,IAAI,EAAE,EAAE,CAAC;gBACxB,2FAA2F;gBAC3F,4FAA4F;gBAC5F,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,iCAAiC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;gBACtF,MAAM,IAAI,CAAC,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,8BAA8B,CAAC,CAAC;gBAClF,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,+BAA+B,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;gBAClF,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACvB,SAAS;YACX,CAAC;YACD,IAAI,EAAE,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;gBAC1B,SAAS,CAAC,wBAAwB;YACpC,CAAC;YACD,6FAA6F;YAC7F,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,IAAI,aAAa,IAAI,QAAQ,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;YACxG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,CAAC,CAAC,aAAa,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;gBACxD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;gBAC9D,SAAS;YACX,CAAC;YACD,0FAA0F;YAC1F,yEAAyE;YACzE,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,mDAAmD,IAAI,GAAG,CAAC,CAAC,CAAC;YACpG,MAAM,IAAI,CAAC,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,gCAAgC,CAAC,CAAC;YACpF,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,qBAAqB,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;YACxE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QAED,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,0FAA0F,EAAE,gBAAgB,EAAE,WAAW,EAAE,CAAC;QAClK,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;IACzE,CAAC;IAED,iGAAiG;IAEzF,gBAAgB,CACtB,KAAa,EACb,KAAa,EACb,KAAa,EACb,KAAa,EACb,OAAe,EACf,MAAc;QAEd,MAAM,GAAG,GAAG,KAAK,IAAI,EAAE;YACrB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YACtE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,4FAA4F;gBAC5F,qFAAqF;gBACrF,+EAA+E;gBAC/E,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAE,GAAa,EAAE,OAAO,IAAI,SAAS,CAAC,CAAC,CAAC;YAClG,CAAC;QACH,CAAC,CAAC;QACF,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,GAAG,EAAE,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QAC7D,IAAI,OAAQ,CAA4B,CAAC,KAAK,KAAK,UAAU;YAAG,CAA2B,CAAC,KAAK,EAAE,CAAC;IACtG,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,WAAW,CACf,KAAa,EACb,KAAa,EACb,KAAa,EACb,KAAa,EACb,OAAe,EACf,MAAc;QAEd,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI;YACzB,CAAC,KAAK,EAAE,KAAK,CAAC;YACd,CAAC,KAAK,EAAE,KAAK,CAAC;SACN,EAAE,CAAC;YACX,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,aAAa,IAAI,EAAE,IAAI,EAAE,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;gBACjD,uFAAuF;gBACvF,yFAAyF;gBACzF,8FAA8F;gBAC9F,OAAO,GAAG,KAAK,CAAC;gBAChB,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,qBAAqB,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,IAAI,SAAS,IAAI,EAAE,CAAC,CAAC;gBACrF,IAAI,aAAa,IAAI,EAAE,EAAE,CAAC;oBACxB,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,yCAAyC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBACjG,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,wCAAwC,IAAI,wBAAwB,CAAC,CAAC,CAAC;gBAChH,CAAC;gBACD,MAAM,IAAI,CAAC,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,8BAA8B,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,6FAA6F;YAC7F,6FAA6F;YAC7F,uBAAuB;YACvB,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,UAAU,MAAM,aAAa,EAAE,CAAC,CAAC;YACvH,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,2CAA2C,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAED,uGAAuG;IAEvG;;;;;;OAMG;IACH,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,YAAY;YAAE,OAAO;QAC9B,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,MAAM,IAAI,GAAG,GAAG,EAAE;YAChB,IAAI,MAAM;gBAAE,OAAO;YACnB,MAAM,GAAG,IAAI,CAAC;YACd,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;YACzB,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;QAC3B,CAAC,CAAC;QACF,6FAA6F;QAC7F,2FAA2F;QAC3F,wFAAwF;QACxF,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACtC,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE;YACnC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;oBAC3B,IAAI,CAAC;wBACH,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,gEAAgE,CAAC,CAAC;oBACrG,CAAC;oBAAC,MAAM,CAAC;wBACP,gIAAgI;oBAClI,CAAC;gBACH,CAAC;YACH,CAAC;YACD,IAAI,EAAE,CAAC;QACT,CAAC,EAAE,IAAI,CAAC,wBAAwB,CAAC,CAAC;QAClC,IAAI,OAAQ,YAAuC,CAAC,KAAK,KAAK,UAAU;YAAG,YAAsC,CAAC,KAAK,EAAE,CAAC;QAE1H,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,IAAI,EAAE;gBAC3C,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;oBAC7B,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;gBACjC,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,YAAY,CAAC,CAAC;YAC3B,IAAI,EAAE,CAAC;QACT,CAAC;IACH,CAAC;IAED,qHAAqH;IAC7G,aAAa;QACnB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoD,CAAC;QAC3E,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;YACzC,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM;gBAAE,SAAS;YAC9B,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACjC,IAAI,CAAC,EAAE;gBAAE,SAAS;YAClB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,GAAG,EAAU,EAAE,CAAC;YAC5E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACxB,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM;gBAAE,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;YACxC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACtB,CAAC;QACD,MAAM,GAAG,GAA6D,EAAE,CAAC;QACzE,KAAK,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;YACnC,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACrE,IAAI,QAAQ;gBAAE,SAAS;YACvB,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC;YAChH,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,YAAY,CAAC,KAA6D;QACtF,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;QACnC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;YACrB,6FAA6F;YAC7F,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,KAAK,CAAC,MAAM,sBAAsB,EAAE,CAAC,CAAC;YACtI,OAAO;QACT,CAAC;QACD,8FAA8F;QAC9F,8FAA8F;QAC9F,qFAAqF;QACrF,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,YAAY,GAAG,IAAI,CAAC;QACxB,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;YAClC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,aAAa,IAAI,EAAE,EAAE,CAAC;gBACxB,YAAY,GAAG,KAAK,CAAC;gBACrB,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,sCAAsC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBAC5F,MAAM,IAAI,CAAC,wBAAwB,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,kCAAkC,CAAC,CAAC;YAC9F,CAAC;QACH,CAAC;QACD,IAAI,YAAY,EAAE,CAAC;YACjB,8FAA8F;YAC9F,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,KAAK,CAAC,MAAM,YAAY,EAAE,CAAC,CAAC;YACzH,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,oCAAoC,CAAC,CAAC;QAC5F,CAAC;aAAM,CAAC;YACN,4FAA4F;YAC5F,8EAA8E;YAC9E,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,KAAK,EAAE,0DAA0D,CAAC,CAAC;QACzH,CAAC;IACH,CAAC;IAED,iGAAiG;IAEjG;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB,CAAC,eAAyB;QAChD,8FAA8F;QAC9F,+FAA+F;QAC/F,+FAA+F;QAC/F,wFAAwF;QACxF,+FAA+F;QAC/F,6FAA6F;QAC7F,wBAAwB;QACxB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACvE,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;YACtC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC;gBAAE,SAAS;YAC1D,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;YACxD,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,SAAS;YAClC,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YAC3C,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,iGAAiG;IAEjG,gGAAgG;IACxF,KAAK,CAAC,QAAQ,CAAC,IAAY;QACjC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,MAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,CAAC,6GAA6G;QAC5H,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,IAAI,CAAuB,CAAC;QACpE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACrD,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC;QAC/E,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IACxB,CAAC;IAEO,KAAK,CAAC,wBAAwB,CAAC,IAAY,EAAE,MAAc,EAAE,GAAW;QAC9E,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,OAAO;QAChC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,aAAa,CAAC;gBACvB,EAAE,EAAE,8BAA8B,iBAAiB,CAAC,IAAI,CAAC,EAAE;gBAC3D,KAAK,EAAE,iDAAiD;gBACxD,OAAO,EAAE,KAAK,CAAC,QAAQ,UAAU,CAAC,IAAI,CAAC,qBAAqB,GAAG,sGAAsG,CAAC;gBACtK,QAAQ,EAAE,uBAAuB;gBACjC,QAAQ,EAAE,MAAM;gBAChB,aAAa,EAAE,0BAA0B;aAC1C,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,0FAA0F;YAC1F,0EAA0E;QAC5E,CAAC;IACH,CAAC;CACF;AAED,oGAAoG;AAEpG,0DAA0D;AAC1D,SAAS,WAAW,CAAC,MAAe;IAClC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,SAAS,KAAK,CAAC,CAAS;IACtB,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACjB,OAAO,CAAC,CAAC,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC"}