instar 1.3.895 → 1.3.897

package/dist/core/SelfHealGate.js

@@ -0,0 +1,391 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import Database from 'better-sqlite3';
+import { FailureEpisodeLatch } from './FailureEpisodeLatch.js';
+import { registerSqliteHandle } from './SqliteRegistry.js';
+function cloneRecord(record) { return structuredClone(record); }
+function validateRecord(value) {
+    if (!value || typeof value !== 'object')
+        throw new Error('invalid self-heal episode');
+    const r = value;
+    if (r.schemaVersion !== 1 || typeof r.key !== 'string' || r.key.length < 1 || r.key.length > 240)
+        throw new Error('invalid self-heal episode');
+    for (const n of [r.revision, r.startedAt, r.attempts, r.nextEligibleAt, r.updatedAt])
+        if (!Number.isFinite(n) || n < 0)
+            throw new Error('invalid self-heal episode');
+    if (!Number.isInteger(r.revision) || !Number.isInteger(r.attempts) || !['active', 'recovered', 'exhausted'].includes(r.status))
+        throw new Error('invalid self-heal episode');
+    if (!Array.isArray(r.recoveries) || r.recoveries.length > 64 || r.recoveries.some((n) => !Number.isFinite(n) || n < 0))
+        throw new Error('invalid self-heal episode');
+    const latch = new FailureEpisodeLatch({ signalAfterMs: 1 });
+    latch.restore(r.latch);
+    return r;
+}
+export class InMemorySelfHealEpisodeStore {
+    rows = new Map();
+    audits = [];
+    load(key) { const row = this.rows.get(key); return row ? cloneRecord(row) : null; }
+    create(record) { if (this.rows.has(record.key))
+        return null; const row = validateRecord(cloneRecord(record)); this.rows.set(row.key, row); return cloneRecord(row); }
+    mutate(key, expectedRevision, update, guard) {
+        const current = this.rows.get(key);
+        if (!current || current.revision !== expectedRevision)
+            return null;
+        if (guard && !guard())
+            return null;
+        const next = validateRecord(update(cloneRecord(current)));
+        if (next.key !== key || next.revision !== expectedRevision + 1)
+            throw new Error('self-heal mutation must increment revision once');
+        if (current.status === 'exhausted' && next.status !== 'exhausted')
+            throw new Error('self-heal exhausted state is monotonic');
+        this.rows.set(key, cloneRecord(next));
+        return cloneRecord(next);
+    }
+    appendAudit(event) { this.audits.push(structuredClone(event)); }
+}
+export class SqliteSelfHealEpisodeStore {
+    db;
+    unregisterSqlite;
+    constructor(dbPath) {
+        const parent = path.dirname(dbPath);
+        fs.mkdirSync(parent, { recursive: true, mode: 0o700 });
+        const ps = fs.lstatSync(parent);
+        if (!ps.isDirectory() || ps.isSymbolicLink())
+            throw new Error('unsafe self-heal store parent');
+        if (fs.existsSync(dbPath)) {
+            const st = fs.lstatSync(dbPath);
+            if (!st.isFile() || st.isSymbolicLink())
+                throw new Error('unsafe self-heal store file');
+        }
+        this.db = new Database(dbPath, { timeout: 100 });
+        this.db.pragma('journal_mode = WAL');
+        this.db.pragma('busy_timeout = 100');
+        this.db.exec('CREATE TABLE IF NOT EXISTS self_heal_episodes (episode_key TEXT PRIMARY KEY, revision INTEGER NOT NULL, payload TEXT NOT NULL, updated_at INTEGER NOT NULL); CREATE TABLE IF NOT EXISTS self_heal_audit (id INTEGER PRIMARY KEY, at_ms INTEGER NOT NULL, controller_id TEXT NOT NULL, event TEXT NOT NULL, reason TEXT, attempt INTEGER, elapsed_ms INTEGER);');
+        try {
+            fs.chmodSync(dbPath, 0o600);
+        }
+        catch { /* non-posix */ }
+        this.unregisterSqlite = registerSqliteHandle(() => { try {
+            this.db.close();
+        }
+        catch { /* already closed */ } });
+    }
+    load(key) { const row = this.db.prepare('SELECT payload FROM self_heal_episodes WHERE episode_key=?').get(key); return row ? validateRecord(JSON.parse(row.payload)) : null; }
+    create(record) {
+        const row = validateRecord(cloneRecord(record));
+        const tx = this.db.transaction(() => {
+            const count = this.db.prepare('SELECT COUNT(*) AS n FROM self_heal_episodes').get().n;
+            if (count >= 256)
+                return false;
+            return this.db.prepare('INSERT OR IGNORE INTO self_heal_episodes(episode_key,revision,payload,updated_at) VALUES(?,?,?,?)').run(row.key, row.revision, JSON.stringify(row), row.updatedAt).changes === 1;
+        });
+        try {
+            return tx() ? cloneRecord(row) : null;
+        }
+        catch (error) {
+            if (/busy|locked/i.test(String(error)))
+                return null;
+            throw error;
+        }
+    }
+    mutate(key, expectedRevision, update, guard) {
+        const tx = this.db.transaction(() => {
+            const current = this.load(key);
+            if (!current || current.revision !== expectedRevision)
+                return null;
+            if (guard && !guard())
+                return null;
+            const next = validateRecord(update(cloneRecord(current)));
+            if (next.key !== key || next.revision !== expectedRevision + 1)
+                throw new Error('self-heal mutation must increment revision once');
+            if (current.status === 'exhausted' && next.status !== 'exhausted')
+                throw new Error('self-heal exhausted state is monotonic');
+            const changed = this.db.prepare('UPDATE self_heal_episodes SET revision=?,payload=?,updated_at=? WHERE episode_key=? AND revision=?').run(next.revision, JSON.stringify(next), next.updatedAt, key, expectedRevision).changes;
+            return changed === 1 ? next : null;
+        });
+        try {
+            const row = tx();
+            return row ? cloneRecord(row) : null;
+        }
+        catch (error) {
+            if (/busy|locked/i.test(String(error)))
+                return null;
+            throw error;
+        }
+    }
+    appendAudit(event) { this.db.prepare('INSERT OR REPLACE INTO self_heal_audit(id,at_ms,controller_id,event,reason,attempt,elapsed_ms) VALUES(?,?,?,?,?,?,?)').run(event.at % 1024, event.at, event.controllerId, event.event, event.reason ?? null, event.attempt ?? null, event.elapsedMs ?? null); }
+    close() { this.unregisterSqlite(); this.db.close(); }
+}
+export class SelfHealGate {
+    spec;
+    deps;
+    now;
+    store;
+    bootId;
+    stateFailureNotices = new Set();
+    constructor(spec, deps) {
+        this.spec = spec;
+        this.deps = deps;
+        if (spec.controllerResource !== 'hardware-bound')
+            throw new Error('v1 SelfHealGate refuses pool-shared controllers');
+        if (!Number.isInteger(spec.maxAttempts) || spec.maxAttempts < 1 || spec.maxAttempts > 32)
+            throw new Error('invalid maxAttempts');
+        for (const value of [spec.maxWallClockMs, spec.notificationLatencyCeilingMs, spec.flap.maxRecoveries, spec.flap.windowMs])
+            if (!Number.isFinite(value) || value <= 0)
+                throw new Error('invalid SelfHealGate bound');
+        this.now = deps.now ?? Date.now;
+        this.store = deps.episodeStore ?? new InMemorySelfHealEpisodeStore();
+        this.bootId = deps.bootId ?? crypto.randomUUID();
+    }
+    needsRestartVerification(ctx) { return this.store.load(this.key(ctx))?.restart !== null; }
+    async attempt(ctx) { const began = this.now(); try {
+        return await this.attemptInner(ctx);
+    }
+    catch {
+        return this.stateFailureWithNotice('store-operation-failed');
+    }
+    finally {
+        this.audit({ event: 'attempt-finished', elapsedMs: Math.max(0, this.now() - began) });
+    } }
+    recordHealthy(ctx) {
+        const current = this.store.load(this.key(ctx));
+        if (!current)
+            return { outcome: 'healed', reason: 'already-healthy' };
+        if (current.status === 'exhausted')
+            return { outcome: 'exhausted', reason: 'terminal' };
+        if (current.restart)
+            return { outcome: 'governed', reason: 'restart-verification-required' };
+        const next = this.cas(current, (row) => ({ ...row, status: 'recovered', recoveries: [...row.recoveries, this.now()].slice(-64), restart: null }));
+        return next ? { outcome: 'healed', reason: 'recorded-healthy' } : { outcome: 'busy', reason: 'revision-conflict' };
+    }
+    async attemptInner(ctx) {
+        const key = this.key(ctx);
+        let row = this.store.load(key);
+        if (!row) {
+            const fresh = this.newEpisode(key);
+            row = this.store.create(fresh) ?? this.store.load(key);
+        }
+        if (!row)
+            return this.stateFailureWithNotice('create-failed');
+        if (row.status === 'active') {
+            const now = this.now();
+            const recent = row.recoveries.filter((at) => now - at <= this.spec.flap.windowMs);
+            if (now - row.startedAt >= this.spec.maxWallClockMs)
+                return this.exhaust(row, 'wall-clock');
+            if (recent.length >= this.spec.flap.maxRecoveries)
+                return this.exhaust(row, 'flap');
+            if (row.attempts >= this.spec.maxAttempts && !row.restart)
+                return this.exhaust(row, 'max-attempts');
+        }
+        if (row.restart) {
+            if (row.restart.state === 'required')
+                return this.requestPendingRestart(row);
+            if (row.restart.requestingBootId === this.bootId)
+                return { outcome: 'attempted', reason: 'restart-awaiting-new-boot' };
+            let verified = false;
+            try {
+                verified = this.spec.restartVerified?.(ctx) === true;
+            }
+            catch {
+                verified = false;
+            }
+            if (!verified) {
+                let severity;
+                try {
+                    severity = this.spec.severity(ctx);
+                }
+                catch {
+                    severity = 'unknown';
+                }
+                if (severity === 'unknown')
+                    return this.noticeAndReturn(row, 'unknown-severity', 'invalid-severity');
+                return { outcome: 'attempted', reason: 'restart-verification-not-healthy' };
+            }
+            const closed = this.cas(row, (r) => ({ ...r, status: 'recovered', restart: null, recoveries: [...r.recoveries, this.now()].slice(-64) }));
+            return closed ? { outcome: 'healed', reason: 'restart-verified' } : { outcome: 'busy', reason: 'revision-conflict' };
+        }
+        let severity;
+        try {
+            severity = this.spec.severity(ctx);
+        }
+        catch {
+            severity = 'unknown';
+        }
+        if (!['recoverable', 'irreversible', 'data-loss', 'security'].includes(severity))
+            return this.noticeAndReturn(row, 'unknown-severity', 'invalid-severity');
+        if (severity !== 'recoverable') {
+            const notice = await this.ensureNotice(row, severity);
+            row = notice.row;
+        }
+        if (row.status === 'recovered') {
+            const now = this.now();
+            const reset = this.cas(row, (r) => ({ ...r, status: 'active', startedAt: now, attempts: 0, nextEligibleAt: 0, latch: emptyLatch(), notices: {}, restart: null }));
+            if (!reset)
+                return { outcome: 'busy', reason: 'revision-conflict' };
+            row = reset;
+        }
+        if (row.status === 'exhausted')
+            return { outcome: 'exhausted', reason: 'terminal' };
+        const latch = new FailureEpisodeLatch({ signalAfterMs: this.spec.notificationLatencyCeilingMs, now: this.now });
+        latch.restore(row.latch);
+        const failure = latch.recordFailure();
+        const detected = this.cas(row, (r) => ({ ...r, latch: latch.snapshot() }));
+        if (!detected)
+            return { outcome: 'busy', reason: 'revision-conflict' };
+        row = detected;
+        if (failure.shouldSignal) {
+            const notice = await this.ensureNotice(row, 'latency');
+            row = notice.row;
+        }
+        const now = this.now();
+        const recent = row.recoveries.filter((at) => now - at <= this.spec.flap.windowMs);
+        if (now - row.startedAt >= this.spec.maxWallClockMs)
+            return this.exhaust(row, 'wall-clock');
+        if (recent.length >= this.spec.flap.maxRecoveries)
+            return this.exhaust(row, 'flap');
+        if (row.attempts >= this.spec.maxAttempts)
+            return this.exhaust(row, 'max-attempts');
+        if (row.nextEligibleAt > now)
+            return { outcome: 'backoff', reason: 'not-eligible-yet' };
+        const eligibility = safeEligible(this.spec, ctx);
+        if (!eligibility.eligible || !eligibility.fence)
+            return { outcome: 'governed', reason: 'fence-stale' };
+        const target = { key: keyHash(key), classId: this.spec.classId, keyIsVolatile: false };
+        const admission = await this.deps.admit(target, { incarnation: eligibility.fence, eligible: () => safeEligible(this.spec, ctx).fence === eligibility.fence, onAdmitted: (token) => { void this.runAdmitted(ctx, target, token).catch(() => { void this.stateFailureWithNotice('queued-attempt-failed'); }); }, lane: 'job', nowMs: now });
+        if (admission.outcome !== 'allow')
+            return { outcome: 'governed', reason: admission.outcome };
+        return this.runAdmitted(ctx, target, admission.token);
+    }
+    async runAdmitted(ctx, target, token) {
+        let row = this.store.load(this.key(ctx));
+        if (!row || row.status !== 'active')
+            return { outcome: 'governed', reason: 'episode-not-active' };
+        const latch = new FailureEpisodeLatch({ signalAfterMs: this.spec.notificationLatencyCeilingMs, now: this.now });
+        latch.restore(row.latch);
+        const failure = latch.recordFailure();
+        const observed = this.cas(row, (r) => ({ ...r, latch: latch.snapshot() }));
+        if (!observed)
+            return { outcome: 'busy', reason: 'revision-conflict' };
+        row = observed;
+        if (failure.shouldSignal) {
+            const notice = await this.ensureNotice(row, 'latency');
+            row = notice.row;
+        }
+        const now = this.now();
+        const recent = row.recoveries.filter((at) => now - at <= this.spec.flap.windowMs);
+        if (now - row.startedAt >= this.spec.maxWallClockMs)
+            return this.exhaust(row, 'wall-clock');
+        if (recent.length >= this.spec.flap.maxRecoveries)
+            return this.exhaust(row, 'flap');
+        if (row.nextEligibleAt > now)
+            return { outcome: 'backoff', reason: 'not-eligible-yet' };
+        const eligibility = safeEligible(this.spec, ctx);
+        if (!eligibility.eligible || !eligibility.fence)
+            return { outcome: 'governed', reason: 'fence-stale' };
+        const consumed = this.deps.consumeToken(token, this.spec.id, { targetKey: target.key, nowMs: this.now() });
+        if (!consumed.proceed)
+            return { outcome: 'governed', reason: consumed.reason ?? 'token-refused', tokenValid: consumed.valid };
+        const again = safeEligible(this.spec, ctx);
+        if (!again.eligible || again.fence !== eligibility.fence)
+            return { outcome: 'governed', reason: 'fence-stale', tokenValid: consumed.valid };
+        if (row.attempts >= this.spec.maxAttempts)
+            return this.exhaust(row, 'max-attempts');
+        const claim = this.cas(row, (r) => ({ ...r, attempts: r.attempts + 1 }), () => {
+            const live = safeEligible(this.spec, ctx);
+            return live.eligible && live.fence === eligibility.fence;
+        });
+        if (!claim)
+            return { outcome: 'governed', reason: 'fence-stale-or-revision-conflict' };
+        row = claim;
+        let result;
+        try {
+            result = this.spec.remediation(ctx);
+            if (result && typeof result.then === 'function')
+                throw new Error('async remediation forbidden');
+        }
+        catch {
+            result = { outcome: 'not-healed', evidence: 'io-error' };
+        }
+        if (result.outcome === 'healed') {
+            const closed = this.cas(row, (r) => ({ ...r, status: 'recovered', recoveries: [...r.recoveries, this.now()].slice(-64) }));
+            return closed ? { outcome: 'healed', reason: result.evidence, tokenValid: consumed.valid } : { outcome: 'busy', reason: 'revision-conflict' };
+        }
+        if (result.outcome === 'pending-restart') {
+            const stableRequestId = `self-heal:${keyHash(row.key)}:${row.startedAt}`;
+            const pending = this.cas(row, (r) => ({ ...r, restart: { state: 'required', requestingBootId: this.bootId, stableRequestId } }));
+            return pending ? this.requestPendingRestart(pending) : { outcome: 'busy', reason: 'revision-conflict' };
+        }
+        const failed = this.cas(row, (r) => ({ ...r, nextEligibleAt: this.now() + Math.max(0, this.spec.backoffMs(row.attempts)) }));
+        return failed ? { outcome: 'attempted', reason: result.evidence, tokenValid: consumed.valid } : { outcome: 'busy', reason: 'revision-conflict' };
+    }
+    requestPendingRestart(row) {
+        if (!row.restart)
+            return { outcome: 'state-failure', reason: 'restart-state-missing' };
+        const ok = this.deps.requestRestart?.(row.restart.stableRequestId) ?? false;
+        if (!ok)
+            return { outcome: 'attempted', reason: 'restart-request-failed' };
+        if (row.restart.state === 'requested')
+            return { outcome: 'attempted', reason: 'restart-requested' };
+        const requested = this.cas(row, (r) => ({ ...r, restart: r.restart ? { ...r.restart, state: 'requested' } : null }));
+        return requested ? { outcome: 'attempted', reason: 'restart-requested' } : { outcome: 'busy', reason: 'revision-conflict' };
+    }
+    async ensureNotice(row, reason) {
+        const existing = row.notices[reason];
+        if (existing?.state === 'enqueued')
+            return { row, attempted: false };
+        const id = existing?.id ?? `self-heal:${keyHash(row.key)}:${reason}:${row.startedAt}`;
+        if (!existing) {
+            const pending = this.cas(row, (r) => ({ ...r, notices: { ...r.notices, [reason]: { state: 'pending', id } } }));
+            if (!pending)
+                return { row: this.store.load(row.key) ?? row, attempted: false };
+            row = pending;
+        }
+        try {
+            await this.deps.notify({ id, controllerId: this.spec.id, reason, priority: ['irreversible', 'data-loss', 'security'].includes(reason) ? 'URGENT' : 'HIGH' });
+        }
+        catch {
+            this.audit({ event: 'notice-enqueue-failed', reason });
+            return { row, attempted: true };
+        }
+        const enqueued = this.cas(row, (r) => ({ ...r, notices: { ...r.notices, [reason]: { state: 'enqueued', id } } }));
+        return { row: enqueued ?? row, attempted: true };
+    }
+    async noticeAndReturn(row, reason, outcome) { const notice = await this.ensureNotice(row, reason); return { outcome, reason, noticeAttempted: notice.attempted, noticeReason: reason }; }
+    async exhaust(row, reason) { const notice = await this.ensureNotice(row, reason); row = notice.row; const terminal = this.cas(row, (r) => ({ ...r, status: 'exhausted' })); return terminal ? { outcome: 'exhausted', reason, noticeAttempted: notice.attempted, noticeReason: reason } : { outcome: 'busy', reason: 'revision-conflict' }; }
+    stateFailure(reason) { this.audit({ event: 'state-failure', reason }); return { outcome: 'state-failure', reason }; }
+    async stateFailureWithNotice(reason) {
+        this.audit({ event: 'state-failure', reason });
+        const id = `self-heal:${this.spec.id}:state-failure:${this.bootId}`;
+        if (!this.stateFailureNotices.has(id)) {
+            try {
+                await this.deps.notify({ id, controllerId: this.spec.id, reason: 'state-failure', priority: 'HIGH' });
+                this.stateFailureNotices.add(id);
+            }
+            catch {
+                this.audit({ event: 'notice-enqueue-failed', reason: 'state-failure' });
+            }
+        }
+        return { outcome: 'state-failure', reason, noticeAttempted: true, noticeReason: 'state-failure' };
+    }
+    key(ctx) { const d = this.spec.dedupeKey(ctx); if (!/^[a-z0-9][a-z0-9._:-]{0,119}$/i.test(d))
+        throw new Error('invalid self-heal dedupe key'); return `${this.spec.id}:${d}`; }
+    newEpisode(key) { const now = this.now(); return { schemaVersion: 1, key, revision: 0, status: 'active', startedAt: now, attempts: 0, nextEligibleAt: 0, latch: emptyLatch(), notices: {}, recoveries: [], restart: null, updatedAt: now }; }
+    cas(row, update, guard) { return this.store.mutate(row.key, row.revision, (r) => ({ ...update(r), revision: r.revision + 1, updatedAt: this.now() }), guard); }
+    audit(input) { const event = { ...input, at: this.now(), controllerId: this.spec.id }; try {
+        this.store.appendAudit?.(event);
+    }
+    catch { /* secondary sink below */ } try {
+        this.deps.audit(event);
+    }
+    catch { /* metadata audit best effort */ } }
+}
+function safeEligible(spec, ctx) { try {
+    return spec.eligible(ctx);
+}
+catch {
+    return { eligible: false, fence: null };
+} }
+function emptyLatch() { return { schemaVersion: 1, failingSince: null, failures: 0, signaledFor: null }; }
+function keyHash(value) { return crypto.createHash('sha256').update(value).digest('hex').slice(0, 24); }
+//# sourceMappingURL=SelfHealGate.js.map

package/dist/core/SelfHealGate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SelfHealGate.js","sourceRoot":"","sources":["../../src/core/SelfHealGate.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAA+B,MAAM,0BAA0B,CAAC;AAC5F,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAkC3D,SAAS,WAAW,CAAC,MAA6B,IAA2B,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC9G,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACtF,MAAM,CAAC,GAAG,KAA8B,CAAC;IACzC,IAAI,CAAC,CAAC,aAAa,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/I,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,SAAS,CAAC;QAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACrK,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC7K,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACrK,MAAM,KAAK,GAAG,IAAI,mBAAmB,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC;IAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACpF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,OAAO,4BAA4B;IACtB,IAAI,GAAG,IAAI,GAAG,EAAiC,CAAC;IAAU,MAAM,GAAyB,EAAE,CAAC;IAC7G,IAAI,CAAC,GAAW,IAAkC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACzH,MAAM,CAAC,MAA6B,IAAkC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG,cAAc,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1N,MAAM,CAAC,GAAW,EAAE,gBAAwB,EAAE,MAAgE,EAAE,KAAqB;QACnI,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAAC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,gBAAgB;YAAE,OAAO,IAAI,CAAC;QACvG,IAAI,KAAK,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1D,IAAI,IAAI,CAAC,GAAG,KAAK,GAAG,IAAI,IAAI,CAAC,QAAQ,KAAK,gBAAgB,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACnI,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC7H,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;QAAC,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAClE,CAAC;IACD,WAAW,CAAC,KAAyB,IAAU,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;CAC3F;AAED,MAAM,OAAO,0BAA0B;IACpB,EAAE,CAAoB;IACtB,gBAAgB,CAAa;IAC9C,YAAY,MAAc;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAAC,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5F,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAAC,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAChI,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAAC,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,cAAc,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAAC,CAAC;QACxJ,IAAI,CAAC,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAC7H,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,+VAA+V,CAAC,CAAC;QAC9W,IAAI,CAAC;YAAC,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;QAC9D,IAAI,CAAC,gBAAgB,GAAG,oBAAoB,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAAC,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClH,CAAC;IACD,IAAI,CAAC,GAAW,IAAkC,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,4DAA4D,CAAC,CAAC,GAAG,CAAC,GAAG,CAAoC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACvP,MAAM,CAAC,MAA6B;QAClC,MAAM,GAAG,GAAG,cAAc,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;QAAC,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;YACnF,MAAM,KAAK,GAAI,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,GAAG,EAAoB,CAAC,CAAC,CAAC;YAAC,IAAI,KAAK,IAAI,GAAG;gBAAE,OAAO,KAAK,CAAC;YACzI,OAAO,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,mGAAmG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC;QAC3M,CAAC,CAAC,CAAC;QACH,IAAI,CAAC;YAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAAC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YAAC,MAAM,KAAK,CAAC;QAAC,CAAC;IACpI,CAAC;IACD,MAAM,CAAC,GAAW,EAAE,gBAAwB,EAAE,MAAgE,EAAE,KAAqB;QACnI,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;YAAG,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAAC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,gBAAgB;gBAAE,OAAO,IAAI,CAAC;YACxI,IAAI,KAAK,IAAI,CAAC,KAAK,EAAE;gBAAE,OAAO,IAAI,CAAC;YACnC,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAAC,IAAI,IAAI,CAAC,GAAG,KAAK,GAAG,IAAI,IAAI,CAAC,QAAQ,KAAK,gBAAgB,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YAC9L,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW;gBAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAC7H,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,oGAAoG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC,OAAO,CAAC;YAC9N,OAAO,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAAC,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC;YAAC,MAAM,GAAG,GAAG,EAAE,EAAE,CAAC;YAAC,OAAO,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAAC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YAAC,MAAM,KAAK,CAAC;QAAC,CAAC;IACrJ,CAAC;IACD,WAAW,CAAC,KAAyB,IAAU,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,sHAAsH,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/T,KAAK,KAAW,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;CAC5D;AAQD,MAAM,OAAO,YAAY;IAGM;IAA0C;IAFtD,GAAG,CAAe;IAAkB,KAAK,CAAuB;IAAkB,MAAM,CAAS;IACjG,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;IACzD,YAA6B,IAAuB,EAAmB,IAAsB;QAAhE,SAAI,GAAJ,IAAI,CAAmB;QAAmB,SAAI,GAAJ,IAAI,CAAkB;QAC3F,IAAI,IAAI,CAAC,kBAAkB,KAAK,gBAAgB;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrH,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,WAAW,GAAG,CAAC,IAAI,IAAI,CAAC,WAAW,GAAG,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACjI,KAAK,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,4BAA4B,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACpN,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,4BAA4B,EAAE,CAAC;QAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;IAC1J,CAAC;IACD,wBAAwB,CAAC,GAAQ,IAAa,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC;IACxG,KAAK,CAAC,OAAO,CAAC,GAAQ,IAA6B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC;QAAC,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,CAAC;IAAC,CAAC;YAAS,CAAC;QAAC,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC,CAAC,CAAC;IACtS,aAAa,CAAC,GAAQ;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAAC,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;QAAC,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW;YAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAC/M,IAAI,OAAO,CAAC,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;QAC7F,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,GAAG,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAClJ,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACrH,CAAC;IACO,KAAK,CAAC,YAAY,CAAC,GAAQ;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAAC,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YAAC,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC,sBAAsB,CAAC,eAAe,CAAC,CAAC;QACnO,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAAC,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,GAAG,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC1G,IAAI,GAAG,GAAG,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,cAAc;gBAAE,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAC5F,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa;gBAAE,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACpF,IAAI,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACtG,CAAC;QACD,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAChB,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,UAAU;gBAAE,OAAO,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAC7E,IAAI,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,IAAI,CAAC,MAAM;gBAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;YACvH,IAAI,QAAQ,GAAG,KAAK,CAAC;YAAC,IAAI,CAAC;gBAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,QAAQ,GAAG,KAAK,CAAC;YAAC,CAAC;YAC/G,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAAC,IAAI,QAA0B,CAAC;gBAAC,IAAI,CAAC;oBAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,QAAQ,GAAG,SAAS,CAAC;gBAAC,CAAC;gBAC1H,IAAI,QAAQ,KAAK,SAAS;oBAAE,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;gBACrG,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;YAAC,CAAC;YAChF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAC1I,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QACvH,CAAC;QACD,IAAI,QAA0B,CAAC;QAAC,IAAI,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,QAAQ,GAAG,SAAS,CAAC;QAAC,CAAC;QAC3G,IAAI,CAAC,CAAC,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;QAC3J,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;YAAC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,QAAwB,CAAC,CAAC;YAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QAAC,CAAC;QAC5H,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAAC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAAC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YAAC,IAAI,CAAC,KAAK;gBAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;YAAC,GAAG,GAAG,KAAK,CAAC;QAAC,CAAC;QAChT,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW;YAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QACpF,MAAM,KAAK,GAAG,IAAI,mBAAmB,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,4BAA4B,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC;QACjL,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;QAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QAAC,GAAG,GAAG,QAAQ,CAAC;QACnK,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YAAC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QAAC,CAAC;QACvG,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAAC,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,GAAG,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1G,IAAI,GAAG,GAAG,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAAC,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAAC,IAAI,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACtQ,IAAI,GAAG,CAAC,cAAc,GAAG,GAAG;YAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACxF,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,IAAI,CAAC,WAAW,CAAC,KAAK;YAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACzJ,MAAM,MAAM,GAAkB,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QACtG,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,KAAK,WAAW,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,KAAK,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1U,IAAI,SAAS,CAAC,OAAO,KAAK,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;QAAC,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;IACtJ,CAAC;IACO,KAAK,CAAC,WAAW,CAAC,GAAQ,EAAE,MAAqB,EAAE,KAAqB;QAC9E,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAAC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QAC5I,MAAM,KAAK,GAAG,IAAI,mBAAmB,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,4BAA4B,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAChH,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QAAC,GAAG,GAAG,QAAQ,CAAC;QACvF,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YAAC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QAAC,CAAC;QACvG,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,GAAG,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClF,IAAI,GAAG,GAAG,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAC5F,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACpF,IAAI,GAAG,CAAC,cAAc,GAAG,GAAG;YAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACxF,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,IAAI,CAAC,WAAW,CAAC,KAAK;YAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACzJ,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAAC,IAAI,CAAC,QAAQ,CAAC,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,eAAe,EAAE,UAAU,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC1O,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW,CAAC,KAAK;YAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;QACxL,IAAI,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACpF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE;YAC5E,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW,CAAC,KAAK,CAAC;QACtG,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;QAAC,GAAG,GAAG,KAAK,CAAC;QACpG,IAAI,MAAiC,CAAC;QAAC,IAAI,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YAAC,IAAI,MAAM,IAAI,OAAQ,MAAwC,CAAC,IAAI,KAAK,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;QAAC,CAAC;QAC3R,IAAI,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAAC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAAC,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QAAC,CAAC;QAC/S,IAAI,MAAM,CAAC,OAAO,KAAK,iBAAiB,EAAE,CAAC;YAAC,MAAM,eAAe,GAAG,aAAa,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;YAAC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,IAAI,CAAC,MAAM,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QAAC,CAAC;QAClW,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAAC,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACjR,CAAC;IACO,qBAAqB,CAAC,GAA0B;QACtD,IAAI,CAAC,GAAG,CAAC,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;QAAC,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC;QAAC,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;QAChP,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,WAAW;YAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QAAC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAAC,OAAO,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACzV,CAAC;IACO,KAAK,CAAC,YAAY,CAAC,GAA0B,EAAE,MAAoB;QACzE,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAAC,IAAI,QAAQ,EAAE,KAAK,KAAK,UAAU;YAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAAC,MAAM,EAAE,GAAG,QAAQ,EAAE,EAAE,IAAI,aAAa,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,MAAM,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;QAClM,IAAI,CAAC,QAAQ,EAAE,CAAC;YAAC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,IAAI,CAAC,OAAO;gBAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YAAC,GAAG,GAAG,OAAO,CAAC;QAAC,CAAC;QACnO,IAAI,CAAC;YAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,cAAc,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,CAAC,CAAC;YAAC,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAAC,CAAC;QACxQ,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,IAAI,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACtK,CAAC;IACO,KAAK,CAAC,eAAe,CAAC,GAA0B,EAAE,MAAoB,EAAE,OAAkC,IAA6B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,CAAC,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAClR,KAAK,CAAC,OAAO,CAAC,GAA0B,EAAE,MAA8C,IAA6B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,CAAC,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC;IACra,YAAY,CAAC,MAAc,IAAoB,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC7I,KAAK,CAAC,sBAAsB,CAAC,MAAc;QACjD,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/C,MAAM,EAAE,GAAG,aAAa,IAAI,CAAC,IAAI,CAAC,EAAE,kBAAkB,IAAI,CAAC,MAAM,EAAE,CAAC;QACpE,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACtC,IAAI,CAAC;gBAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;gBAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAAC,CAAC;YAChJ,MAAM,CAAC;gBAAC,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;YAAC,CAAC;QACpF,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY,EAAE,eAAe,EAAE,CAAC;IACpG,CAAC;IACO,GAAG,CAAC,GAAQ,IAAY,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5L,UAAU,CAAC,GAAW,IAA2B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IAC5Q,GAAG,CAAC,GAA0B,EAAE,MAA2D,EAAE,KAAqB,IAAkC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACzR,KAAK,CAAC,KAAsD,IAAU,MAAM,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC;QAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC;QAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,CAAC;CACjT;AACD,SAAS,YAAY,CAAM,IAAuB,EAAE,GAAQ,IAAiD,IAAI,CAAC;IAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAAC,CAAC;AAAC,MAAM,CAAC;IAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAAC,CAAC,CAAC,CAAC;AACpM,SAAS,UAAU,KAA6B,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAClI,SAAS,OAAO,CAAC,KAAa,IAAY,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC"}

package/dist/core/SshBootstrapAdvert.d.ts

@@ -0,0 +1,23 @@
+export interface SshBootstrapAdvert {
+    machineId: string;
+    agentId: string;
+    pairingEpoch: number;
+    observerBootId: string;
+    clientKeyGeneration: number;
+    hostKeyGeneration: number;
+    clientPublicKey: string;
+    sshHostPublicKeys: string[];
+    endpoints: Array<{
+        host: string;
+        port: number;
+        source: 'tailscale' | 'lan' | 'configured';
+    }>;
+    issuedAt: string;
+    expiresAt: string;
+    hostKeyTransitionSignature?: string;
+    machineSignature: string;
+}
+export declare function canonicalSshBootstrapAdvert(advert: Omit<SshBootstrapAdvert, 'machineSignature'>): string;
+/** Structural security floor; MachineAuth signature/principal validation precedes this call. */
+export declare function validateSshBootstrapAdvert(input: unknown, principalMachineId: string, principalAgentId: string, now?: number): SshBootstrapAdvert;
+//# sourceMappingURL=SshBootstrapAdvert.d.ts.map

package/dist/core/SshBootstrapAdvert.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SshBootstrapAdvert.d.ts","sourceRoot":"","sources":["../../src/core/SshBootstrapAdvert.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,SAAS,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,WAAW,GAAG,KAAK,GAAG,YAAY,CAAA;KAAE,CAAC,CAAC;IAC7F,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,IAAI,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,GAAG,MAAM,CASxG;AAED,gGAAgG;AAChG,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,kBAAkB,CAarJ"}

package/dist/core/SshBootstrapAdvert.js

@@ -0,0 +1,43 @@
+import net from 'node:net';
+export function canonicalSshBootstrapAdvert(advert) {
+    return JSON.stringify({
+        machineId: advert.machineId, agentId: advert.agentId, pairingEpoch: advert.pairingEpoch,
+        observerBootId: advert.observerBootId, clientKeyGeneration: advert.clientKeyGeneration,
+        hostKeyGeneration: advert.hostKeyGeneration, clientPublicKey: advert.clientPublicKey,
+        sshHostPublicKeys: advert.sshHostPublicKeys, endpoints: advert.endpoints,
+        issuedAt: advert.issuedAt, expiresAt: advert.expiresAt,
+        ...(advert.hostKeyTransitionSignature ? { hostKeyTransitionSignature: advert.hostKeyTransitionSignature } : {}),
+    });
+}
+/** Structural security floor; MachineAuth signature/principal validation precedes this call. */
+export function validateSshBootstrapAdvert(input, principalMachineId, principalAgentId, now = Date.now()) {
+    if (!input || typeof input !== 'object')
+        throw new Error('invalid-ssh-advert');
+    const row = input;
+    if (row.machineId !== principalMachineId || row.agentId !== principalAgentId)
+        throw new Error('ssh-advert-principal-mismatch');
+    if (!Number.isSafeInteger(row.pairingEpoch) || row.pairingEpoch < 1 || !Number.isSafeInteger(row.clientKeyGeneration) || !Number.isSafeInteger(row.hostKeyGeneration))
+        throw new Error('ssh-advert-generation-invalid');
+    const issuedAt = Date.parse(row.issuedAt);
+    const expiresAt = Date.parse(row.expiresAt);
+    if (!Number.isFinite(issuedAt) || !Number.isFinite(expiresAt) || issuedAt > now + 30_000 || expiresAt <= now || expiresAt - now > 300_000)
+        throw new Error('ssh-advert-expired');
+    if (!Array.isArray(row.sshHostPublicKeys) || !/^ssh-ed25519 [A-Za-z0-9+/=]+(?:\s|$)/.test(row.clientPublicKey) || row.sshHostPublicKeys.length < 1 || row.sshHostPublicKeys.length > 2 || row.sshHostPublicKeys.some(key => !/^ssh-ed25519 [A-Za-z0-9+/=]+(?:\s|$)/.test(key)))
+        throw new Error('ssh-advert-key-invalid');
+    if (!Array.isArray(row.endpoints) || row.endpoints.length > 8 || row.endpoints.some(endpoint => !validEndpoint(endpoint)))
+        throw new Error('ssh-advert-endpoint-invalid');
+    if (typeof row.observerBootId !== 'string' || row.observerBootId.length < 8 || row.observerBootId.length > 128 || typeof row.machineSignature !== 'string' || row.machineSignature.length < 32 || row.machineSignature.length > 512)
+        throw new Error('ssh-advert-signature-invalid');
+    if (row.hostKeyTransitionSignature !== undefined && (typeof row.hostKeyTransitionSignature !== 'string' || row.hostKeyTransitionSignature.length < 32 || row.hostKeyTransitionSignature.length > 512))
+        throw new Error('ssh-advert-transition-signature-invalid');
+    return row;
+}
+function validEndpoint(endpoint) {
+    if (!['tailscale', 'lan', 'configured'].includes(endpoint.source) || !Number.isInteger(endpoint.port) || endpoint.port < 1024 || endpoint.port > 65535)
+        return false;
+    if (net.isIP(endpoint.host) !== 4)
+        return false;
+    const [a, b] = endpoint.host.split('.').map(Number);
+    return a === 10 || (a === 100 && b >= 64 && b <= 127) || (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168);
+}
+//# sourceMappingURL=SshBootstrapAdvert.js.map

package/dist/core/SshBootstrapAdvert.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SshBootstrapAdvert.js","sourceRoot":"","sources":["../../src/core/SshBootstrapAdvert.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,UAAU,CAAC;AAkB3B,MAAM,UAAU,2BAA2B,CAAC,MAAoD;IAC9F,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY;QACvF,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;QACtF,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe;QACpF,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS;QACxE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS;QACtD,GAAG,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC,CAAC,EAAE,0BAA0B,EAAE,MAAM,CAAC,0BAA0B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChH,CAAC,CAAC;AACL,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,0BAA0B,CAAC,KAAc,EAAE,kBAA0B,EAAE,gBAAwB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC/H,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC/E,MAAM,GAAG,GAAG,KAA2B,CAAC;IACxC,IAAI,GAAG,CAAC,SAAS,KAAK,kBAAkB,IAAI,GAAG,CAAC,OAAO,KAAK,gBAAgB;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC/H,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,YAAY,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACxN,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,QAAQ,GAAG,GAAG,GAAG,MAAM,IAAI,SAAS,IAAI,GAAG,IAAI,SAAS,GAAG,GAAG,GAAG,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACjL,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,sCAAsC,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,sCAAsC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC1T,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC1K,IAAI,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ,IAAI,GAAG,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,cAAc,CAAC,MAAM,GAAG,GAAG,IAAI,OAAO,GAAG,CAAC,gBAAgB,KAAK,QAAQ,IAAI,GAAG,CAAC,gBAAgB,CAAC,MAAM,GAAG,EAAE,IAAI,GAAG,CAAC,gBAAgB,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACrR,IAAI,GAAG,CAAC,0BAA0B,KAAK,SAAS,IAAI,CAAC,OAAO,GAAG,CAAC,0BAA0B,KAAK,QAAQ,IAAI,GAAG,CAAC,0BAA0B,CAAC,MAAM,GAAG,EAAE,IAAI,GAAG,CAAC,0BAA0B,CAAC,MAAM,GAAG,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAClQ,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,QAAiD;IACtE,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,GAAG,IAAI,IAAI,QAAQ,CAAC,IAAI,GAAG,KAAK;QAAE,OAAO,KAAK,CAAC;IACrK,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpD,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;AACzH,CAAC"}

package/dist/core/SshHostKeyLifecycle.d.ts

@@ -0,0 +1,43 @@
+export type SshHostKeyState = 'current' | 'quarantined' | 'overlap' | 'retired' | 'rollback-rejected';
+export interface SignedHostKeyProposal {
+    agentId: string;
+    machineId: string;
+    pairingEpoch: number;
+    generation: number;
+    previousGeneration: number;
+    publicKey: string;
+    issuedAt: string;
+    machineSignature: string;
+    previousHostSignature?: string;
+}
+export interface HostKeyProposalVerifier {
+    verifyMachine(proposal: SignedHostKeyProposal): boolean;
+    verifyPreviousHost(proposal: SignedHostKeyProposal): boolean;
+}
+export interface HostKeyGeneration {
+    generation: number;
+    fingerprint: string;
+    publicKey: string;
+    state: SshHostKeyState;
+    quarantinedAt?: number;
+}
+export declare function canonicalHostKeyProposal(proposal: Omit<SignedHostKeyProposal, 'machineSignature' | 'previousHostSignature'>): string;
+/** Monotonic, fail-closed host-key rotation state machine. */
+export declare class SshHostKeyLifecycle {
+    private readonly overlapCeilingMs;
+    private current;
+    private candidate?;
+    constructor(initial: {
+        generation: number;
+        publicKey: string;
+    }, overlapCeilingMs?: number);
+    propose(proposal: SignedHostKeyProposal, verifier: HostKeyProposalVerifier, now?: number): HostKeyGeneration;
+    proveCandidate(generation: number): HostKeyGeneration;
+    promote(generation: number, allRequiredInboundProofs: boolean, now?: number): HostKeyGeneration;
+    expire(now?: number): void;
+    snapshot(): {
+        current: HostKeyGeneration;
+        candidate?: HostKeyGeneration;
+    };
+}
+//# sourceMappingURL=SshHostKeyLifecycle.d.ts.map

package/dist/core/SshHostKeyLifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SshHostKeyLifecycle.d.ts","sourceRoot":"","sources":["../../src/core/SshHostKeyLifecycle.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,aAAa,GAAG,SAAS,GAAG,SAAS,GAAG,mBAAmB,CAAC;AAEtG,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,uBAAuB;IACtC,aAAa,CAAC,QAAQ,EAAE,qBAAqB,GAAG,OAAO,CAAC;IACxD,kBAAkB,CAAC,QAAQ,EAAE,qBAAqB,GAAG,OAAO,CAAC;CAC9D;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,eAAe,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,IAAI,CAAC,qBAAqB,EAAE,kBAAkB,GAAG,uBAAuB,CAAC,GAAG,MAAM,CAMpI;AAED,8DAA8D;AAC9D,qBAAa,mBAAmB;IAIkC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAHjG,OAAO,CAAC,OAAO,CAAoB;IACnC,OAAO,CAAC,SAAS,CAAC,CAAoB;gBAE1B,OAAO,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAAmB,gBAAgB,SAAU;IAI3G,OAAO,CAAC,QAAQ,EAAE,qBAAqB,EAAE,QAAQ,EAAE,uBAAuB,EAAE,GAAG,SAAa,GAAG,iBAAiB;IAgBhH,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,iBAAiB;IAMrD,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,wBAAwB,EAAE,OAAO,EAAE,GAAG,SAAa,GAAG,iBAAiB;IASnG,MAAM,CAAC,GAAG,SAAa,GAAG,IAAI;IAI9B,QAAQ,IAAI;QAAE,OAAO,EAAE,iBAAiB,CAAC;QAAC,SAAS,CAAC,EAAE,iBAAiB,CAAA;KAAE;CAG1E"}

package/dist/core/SshHostKeyLifecycle.js

@@ -0,0 +1,68 @@
+import { createHash } from 'node:crypto';
+export function canonicalHostKeyProposal(proposal) {
+    return JSON.stringify({
+        agentId: proposal.agentId, machineId: proposal.machineId, pairingEpoch: proposal.pairingEpoch,
+        generation: proposal.generation, previousGeneration: proposal.previousGeneration,
+        publicKey: proposal.publicKey, issuedAt: proposal.issuedAt,
+    });
+}
+/** Monotonic, fail-closed host-key rotation state machine. */
+export class SshHostKeyLifecycle {
+    overlapCeilingMs;
+    current;
+    candidate;
+    constructor(initial, overlapCeilingMs = 600_000) {
+        this.overlapCeilingMs = overlapCeilingMs;
+        this.current = { ...initial, fingerprint: keyFingerprint(initial.publicKey), state: 'current' };
+    }
+    propose(proposal, verifier, now = Date.now()) {
+        const fp = keyFingerprint(proposal.publicKey);
+        if (!verifier.verifyMachine(proposal))
+            throw new Error('host-key-machine-signature-invalid');
+        if (proposal.generation <= this.current.generation || proposal.previousGeneration !== this.current.generation) {
+            throw new Error('host-key-rollback-rejected');
+        }
+        if (proposal.generation !== this.current.generation + 1)
+            throw new Error('host-key-generation-gap');
+        if (this.candidate) {
+            if (this.candidate.generation === proposal.generation && this.candidate.fingerprint === fp)
+                return this.candidate;
+            throw new Error('host-key-competing-proposal');
+        }
+        this.candidate = { generation: proposal.generation, publicKey: proposal.publicKey, fingerprint: fp, state: 'quarantined', quarantinedAt: now };
+        if (proposal.previousHostSignature && verifier.verifyPreviousHost(proposal))
+            this.candidate.state = 'overlap';
+        return this.candidate;
+    }
+    proveCandidate(generation) {
+        if (!this.candidate || this.candidate.generation !== generation)
+            throw new Error('host-key-not-quarantined');
+        this.candidate.state = 'overlap';
+        return this.candidate;
+    }
+    promote(generation, allRequiredInboundProofs, now = Date.now()) {
+        if (!this.candidate || this.candidate.generation !== generation || this.candidate.state !== 'overlap')
+            throw new Error('host-key-not-in-overlap');
+        if (now - (this.candidate.quarantinedAt ?? now) > this.overlapCeilingMs)
+            throw new Error('host-key-overlap-expired');
+        if (!allRequiredInboundProofs)
+            throw new Error('host-key-proofs-incomplete');
+        this.current = { ...this.candidate, state: 'current', quarantinedAt: undefined };
+        this.candidate = undefined;
+        return this.current;
+    }
+    expire(now = Date.now()) {
+        if (this.candidate && now - (this.candidate.quarantinedAt ?? now) > this.overlapCeilingMs)
+            this.candidate = undefined;
+    }
+    snapshot() {
+        return { current: { ...this.current }, candidate: this.candidate ? { ...this.candidate } : undefined };
+    }
+}
+function keyFingerprint(publicKey) {
+    const body = publicKey.trim().split(/\s+/)[1];
+    if (!body)
+        throw new Error('host-key-invalid');
+    return createHash('sha256').update(Buffer.from(body, 'base64')).digest('hex');
+}
+//# sourceMappingURL=SshHostKeyLifecycle.js.map