pi-daddy 0.17.1 → 0.18.0

package/dist/check-runner.d.ts

@@ -0,0 +1,61 @@
+import { type CorrelationMetadata } from "./correlation.ts";
+import { type ValidatedWorkspace, type WorkspaceAccess } from "./workspace.ts";
+export interface CheckDefinition {
+    /** Absolute operator-owned executable. PATH lookup is deliberately not part of the contract. */
+    executable: string;
+    /** Exact argv elements. Never a shell command string. */
+    argv: string[];
+    /** Fixed non-sensitive environment values. */
+    env?: Record<string, string>;
+    /** Explicit inherited names. Sensitive names are still removed. */
+    inherit_env?: string[];
+    timeout_ms?: number;
+    max_output_bytes?: number;
+    /** Checks are assumed capable of writing unless the operator declares read. */
+    workspace_access?: WorkspaceAccess;
+}
+export interface CheckRegistry {
+    version: 1;
+    checks: Record<string, CheckDefinition>;
+}
+export interface CheckReceipt {
+    schema_version: "1.0";
+    receipt_id: string;
+    check_id: string;
+    executable: string;
+    executable_sha256: string;
+    argv: string[];
+    argv_sha256: string;
+    cwd: string;
+    cwd_sha256: string;
+    started_at: string;
+    ended_at: string;
+    exit_code: number | null;
+    signal: NodeJS.Signals | null;
+    timed_out: boolean;
+    aborted: boolean;
+    truncated: boolean;
+    output_sha256: string;
+    workspace_id: string;
+    workspace_access: WorkspaceAccess;
+    head_sha: string;
+    tree_sha: string;
+    correlation?: CorrelationMetadata;
+}
+export declare function buildCheckEnvironment(definition: CheckDefinition, inherited?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+export declare function runNamedCheck(input: {
+    checkId: string;
+    registry: CheckRegistry;
+    workspace: ValidatedWorkspace;
+    correlation?: CorrelationMetadata;
+    inheritedEnv?: NodeJS.ProcessEnv;
+    signal?: AbortSignal;
+    leaseDir?: string;
+    ledgerPath?: string;
+}): Promise<{
+    output: string;
+    exitCode: number | null;
+    signal: NodeJS.Signals | null;
+    receipt: CheckReceipt;
+}>;
+//# sourceMappingURL=check-runner.d.ts.map

package/dist/check-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-runner.d.ts","sourceRoot":"","sources":["../src/check-runner.ts"],"names":[],"mappings":"AAIA,OAAO,EAAwB,KAAK,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAUlF,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,eAAe,EAGrB,MAAM,gBAAgB,CAAC;AAExB,MAAM,WAAW,eAAe;IAC9B,gGAAgG;IAChG,UAAU,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,8CAA8C;IAC9C,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,mEAAmE;IACnE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,eAAe,CAAC;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,CAAC,CAAC;IACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,KAAK,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,eAAe,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,mBAAmB,CAAC;CACnC;AAKD,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,eAAe,EAC3B,SAAS,GAAE,MAAM,CAAC,UAAwB,GACzC,MAAM,CAAC,UAAU,CAWnB;AA4BD,wBAAsB,aAAa,CAAC,KAAK,EAAE;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,aAAa,CAAC;IACxB,SAAS,EAAE,kBAAkB,CAAC;IAC9B,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACjC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC;IACV,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE,YAAY,CAAC;CACvB,CAAC,CAqND"}

package/dist/check-runner.js

@@ -0,0 +1,237 @@
+import { createHash, randomUUID } from "node:crypto";
+import { chmod, mkdtemp, readFile, realpath, rm, stat, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { basename, isAbsolute, join } from "node:path";
+import { normaliseCorrelation } from "./correlation.js";
+import { appendLedgerEvent, buildWorkspaceLeaseEvent, LEDGER_VERSION, } from "./ledger.js";
+import { computeGitCandidateIdentity } from "./git-identity.js";
+import { runChild } from "./run-child.js";
+import { GovernanceRefusal, refusal } from "./refusals.js";
+import { acquireWorkspaceLease, defaultWorkspaceLeaseDir, leaseAcquisitionOutcome, leaseReleaseLedgerOutcome, } from "./workspace.js";
+const SAFE_ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const SENSITIVE_ENV_NAME = /(?:^|_)(?:TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|AUTH|COOKIE|PRIVATE_KEY|API_KEY)(?:_|$)|^PI_GRANTS_|^(?:AWS|GITHUB|GITLAB|AZURE|GOOGLE)_/i;
+export function buildCheckEnvironment(definition, inherited = process.env) {
+    const env = {};
+    for (const name of definition.inherit_env ?? []) {
+        if (!SAFE_ENV_NAME.test(name) || SENSITIVE_ENV_NAME.test(name))
+            continue;
+        if (inherited[name] !== undefined)
+            env[name] = inherited[name];
+    }
+    for (const [name, value] of Object.entries(definition.env ?? {})) {
+        if (!SAFE_ENV_NAME.test(name) || SENSITIVE_ENV_NAME.test(name))
+            continue;
+        env[name] = value;
+    }
+    return env;
+}
+function validateDefinition(checkId, value) {
+    if (!value) {
+        throw new GovernanceRefusal(refusal("CHECK_NOT_CONFIGURED", `check ${JSON.stringify(checkId)} is not present in operator-owned configuration`, { check_id: checkId }));
+    }
+    if (!isAbsolute(value.executable) || !Array.isArray(value.argv) || value.argv.some((item) => typeof item !== "string")) {
+        throw new GovernanceRefusal(refusal("CHECK_CONFIGURATION_INVALID", `check ${JSON.stringify(checkId)} requires an absolute executable and argv string array`, { check_id: checkId }));
+    }
+    for (const bound of [value.timeout_ms, value.max_output_bytes]) {
+        if (bound !== undefined && (!Number.isInteger(bound) || bound <= 0)) {
+            throw new GovernanceRefusal(refusal("CHECK_CONFIGURATION_INVALID", `check ${JSON.stringify(checkId)} has a non-positive runtime bound`, { check_id: checkId }));
+        }
+    }
+    return value;
+}
+function receiptId(receipt) {
+    return createHash("sha256").update(JSON.stringify(receipt), "utf8").digest("hex");
+}
+export async function runNamedCheck(input) {
+    if (input.registry?.version !== 1 || !input.registry.checks || typeof input.registry.checks !== "object") {
+        throw new GovernanceRefusal(refusal("CHECK_CONFIGURATION_INVALID", "check registry must contain {version:1, checks:{...}}"));
+    }
+    const definition = validateDefinition(input.checkId, input.registry.checks[input.checkId]);
+    let executable;
+    try {
+        executable = await realpath(definition.executable);
+        if (!(await stat(executable)).isFile())
+            throw new Error("not a file");
+    }
+    catch (error) {
+        throw new GovernanceRefusal(refusal("CHECK_CONFIGURATION_INVALID", `check ${JSON.stringify(input.checkId)} executable is not a real file (${String(error)})`, { check_id: input.checkId }));
+    }
+    const argvSha256 = createHash("sha256").update(JSON.stringify(definition.argv), "utf8").digest("hex");
+    const cwdSha256 = createHash("sha256").update(input.workspace.root, "utf8").digest("hex");
+    const access = definition.workspace_access ?? "write";
+    // Evidence checks coordinate exclusively so their pre/post candidate identities cannot overlap another
+    // governed writer. `access` still records what the configured executable is intended to do.
+    const leaseAccess = "write";
+    const ownerId = `check:${input.checkId}:${randomUUID()}`;
+    const correlation = normaliseCorrelation(input.correlation);
+    let lease;
+    let stagedDir;
+    /** Failures of best-effort RECORDS, reported alongside whatever actually happened — never instead of it. */
+    const notes = [];
+    let releaseReason = "failed";
+    try {
+        try {
+            lease = await acquireWorkspaceLease({
+                workspace: input.workspace, access: leaseAccess, leaseDir: input.leaseDir ?? defaultWorkspaceLeaseDir(),
+                ownerId, signal: input.signal,
+            });
+        }
+        catch (error) {
+            if (input.ledgerPath)
+                await appendLedgerEvent({ path: input.ledgerPath, strict: true }, buildWorkspaceLeaseEvent({
+                    childId: ownerId, workspaceId: input.workspace.workspaceId, root: input.workspace.root, access: leaseAccess,
+                    outcome: "refused",
+                    correlation, now: new Date(),
+                    ...(error instanceof GovernanceRefusal
+                        ? { refusal: { code: error.code, message: error.message, ...(error.details ? { details: error.details } : {}) } }
+                        : {}),
+                }));
+            throw error;
+        }
+        if (input.ledgerPath) {
+            try {
+                await appendLedgerEvent({ path: input.ledgerPath, strict: true }, buildWorkspaceLeaseEvent({
+                    childId: ownerId, workspaceId: input.workspace.workspaceId, root: input.workspace.root, access: leaseAccess,
+                    outcome: leaseAcquisitionOutcome(leaseAccess, lease.recovered), recovered: lease.recovered,
+                    correlation, now: new Date(),
+                }));
+            }
+            catch (error) {
+                await lease.release("ledger-failed");
+                lease = undefined;
+                throw error;
+            }
+        }
+        const before = await computeGitCandidateIdentity(input.workspace);
+        for (const [name, supplied, actual] of [
+            ["head_sha", correlation?.head_sha, before.headSha], ["tree_sha", correlation?.tree_sha, before.treeSha],
+        ]) {
+            if (supplied && supplied !== actual)
+                throw new GovernanceRefusal(refusal("CHECK_IDENTITY_MISMATCH", `check ${JSON.stringify(input.checkId)} ${name} does not match the validated workspace`, { check_id: input.checkId, supplied, actual }));
+        }
+        const executableBytes = await readFile(executable);
+        const executableSha256 = createHash("sha256").update(executableBytes).digest("hex");
+        stagedDir = await mkdtemp(join(tmpdir(), "pi-daddy-check-exec-"));
+        const stagedExecutable = join(stagedDir, basename(executable));
+        await writeFile(stagedExecutable, executableBytes, { mode: 0o700 });
+        await chmod(stagedExecutable, 0o700);
+        const leaseAbort = new AbortController();
+        let leaseLost = false;
+        lease.lost.then(() => { leaseLost = true; leaseAbort.abort(); });
+        const checkSignal = input.signal ? AbortSignal.any([input.signal, leaseAbort.signal]) : leaseAbort.signal;
+        const started = new Date();
+        const result = await runChild({
+            command: "setpriv", args: ["--pdeathsig", "KILL", "--", stagedExecutable, ...definition.argv],
+            env: buildCheckEnvironment(definition, input.inheritedEnv), cwd: input.workspace.root,
+            signal: checkSignal, timeoutMs: definition.timeout_ms, maxOutputBytes: definition.max_output_bytes,
+            onSpawn: (pid) => lease.attachProcess(pid),
+        });
+        const ended = new Date();
+        releaseReason = input.signal?.aborted ? "cancelled" : result.timedOut ? "timeout" : result.aborted ? "failed" : "completed";
+        // Every throw below re-stamps this. Without that, a check refused for CHECK_IDENTITY_MISMATCH still
+        // wrote `released / completed` from the `finally` — the LAST lease event for that owner — so the trail
+        // still read like a clean run and `verifyLedger` still counted a clean release. The R-114 fix added a
+        // refusal line beside the misleading one instead of correcting it.
+        if (result.spawnError)
+            throw new GovernanceRefusal(refusal("EXECUTOR_UNAVAILABLE", `check ${JSON.stringify(input.checkId)} could not start its constrained executor`, { check_id: input.checkId }));
+        if (leaseLost)
+            throw new GovernanceRefusal(refusal("WORKSPACE_LEASE_STALE", `check ${JSON.stringify(input.checkId)} lost its workspace lease while running`, { check_id: input.checkId }));
+        const after = await computeGitCandidateIdentity(input.workspace);
+        if (leaseLost)
+            throw new GovernanceRefusal(refusal("WORKSPACE_LEASE_STALE", `check ${JSON.stringify(input.checkId)} lost its workspace lease before receipt`, { check_id: input.checkId }));
+        if (before.headSha !== after.headSha || before.treeSha !== after.treeSha) {
+            throw new GovernanceRefusal(refusal("CHECK_IDENTITY_MISMATCH", `check ${JSON.stringify(input.checkId)} workspace changed while it ran`, { check_id: input.checkId }));
+        }
+        // The candidate is now measured and the process is dead. End the lease before writing the receipt so
+        // lease loss cannot race a blocked ledger append and leave behind evidence from an unprotected run.
+        // Record what release actually DID. This asserted `released` unconditionally and threw the outcome
+        // away, so the evidence path reproduced the very defect the outcome union was added to expose: a lost
+        // or unrecorded handover ledgered as a clean one, with `lease = undefined` stopping the `finally` from
+        // ever noticing (R-100/R-103, found while reviewing the fix for R-99).
+        const releaseOutcome = await lease.release(releaseReason);
+        lease = undefined;
+        if (leaseLost)
+            throw new GovernanceRefusal(refusal("WORKSPACE_LEASE_STALE", `check ${JSON.stringify(input.checkId)} lost its workspace lease before receipt`, { check_id: input.checkId }));
+        if (input.ledgerPath)
+            await appendLedgerEvent({ path: input.ledgerPath, strict: true }, buildWorkspaceLeaseEvent({
+                childId: ownerId, workspaceId: input.workspace.workspaceId, root: input.workspace.root, access: leaseAccess,
+                outcome: leaseReleaseLedgerOutcome(releaseOutcome, releaseReason), releaseReason, correlation, now: new Date(),
+            }));
+        const body = {
+            schema_version: "1.0", check_id: input.checkId, executable, executable_sha256: executableSha256,
+            argv: [...definition.argv], argv_sha256: argvSha256, cwd: input.workspace.root, cwd_sha256: cwdSha256,
+            started_at: started.toISOString(), ended_at: ended.toISOString(), exit_code: result.code,
+            signal: result.signal ?? null, timed_out: result.timedOut, aborted: result.aborted, truncated: result.truncated,
+            output_sha256: createHash("sha256").update(result.text, "utf8").digest("hex"),
+            workspace_id: input.workspace.workspaceId, workspace_access: access,
+            head_sha: before.headSha, tree_sha: before.treeSha, ...(correlation ? { correlation } : {}),
+        };
+        const receipt = { receipt_id: receiptId(body), ...body };
+        if (input.ledgerPath) {
+            const event = {
+                ledgerVersion: LEDGER_VERSION, event: "check_receipt", ts: ended.toISOString(), childId: ownerId,
+                receiptId: receipt.receipt_id, workspaceId: input.workspace.workspaceId, checkId: input.checkId,
+                treeSha: receipt.tree_sha, ...(correlation ? { correlation } : {}),
+            };
+            await appendLedgerEvent({ path: input.ledgerPath, strict: true }, event);
+        }
+        return { output: result.text, exitCode: result.code, signal: result.signal ?? null, receipt };
+    }
+    catch (error) {
+        // The run did not complete, so the release must not be recorded as if it had. Without this the
+        // `finally` wrote `released / completed` as the LAST lease event for a refused check, so the trail
+        // still read like a clean run and `verifyLedger` still counted a clean release — the R-114 fix put a
+        // refusal line beside the misleading one instead of correcting it.
+        if (releaseReason === "completed")
+            releaseReason = "refused";
+        // The single most important negative result this feature can produce — CHECK_IDENTITY_MISMATCH, "the
+        // workspace changed while the check ran" — used to leave NO ledger evidence at all, while the
+        // `finally` recorded `released, reason: completed`, so the trail read like a clean run (R-114).
+        if (input.ledgerPath) {
+            await appendLedgerEvent({
+                path: input.ledgerPath,
+                // Best effort, and loud: this records a failure, so it must not replace the failure. A strict
+                // append that threw here would substitute "ledger write failed" for the evidence-integrity
+                // refusal that actually happened (R-115).
+                strict: false,
+                // NOT empty. `onFailure` exists because a non-strict append is a choice not to fail closed and
+                // never a choice to be silent — the comment above says "loud", and an empty callback is the
+                // definition of swallowing. This guards the evidence record itself, so losing it silently is
+                // how a mutated workspace came to leave a trail that read like a clean run.
+                onFailure: (cause) => { notes.push(`check refusal record failed: ${String(cause)}`); },
+            }, buildWorkspaceLeaseEvent({
+                childId: ownerId, workspaceId: input.workspace.workspaceId, root: input.workspace.root, access: leaseAccess,
+                outcome: "refused",
+                refusal: error instanceof GovernanceRefusal
+                    ? { code: error.code, message: error.message, ...(error.details ? { details: error.details } : {}) }
+                    : refusal("CHECK_IDENTITY_UNAVAILABLE", `check ${JSON.stringify(input.checkId)} failed (${String(error)})`),
+                correlation, now: new Date(),
+            }));
+        }
+        throw error;
+    }
+    finally {
+        if (stagedDir)
+            await rm(stagedDir, { recursive: true, force: true });
+        if (lease) {
+            // `release()` cannot throw (R-99), and the record of it is best-effort for the same reason as
+            // above: a `finally` that throws destroys whatever the caller was already returning or raising.
+            const outcome = await lease.release(releaseReason);
+            if (input.ledgerPath)
+                await appendLedgerEvent({
+                    path: input.ledgerPath,
+                    strict: false,
+                    onFailure: (cause) => { notes.push(`check lease release record failed: ${String(cause)}`); },
+                }, buildWorkspaceLeaseEvent({
+                    childId: ownerId, workspaceId: input.workspace.workspaceId, root: input.workspace.root, access: leaseAccess,
+                    outcome: outcome === "lost"
+                        ? "lost"
+                        : outcome === "released-unrecorded"
+                            ? "released-unrecorded"
+                            : releaseReason === "timeout" ? "timeout" : "released",
+                    releaseReason, correlation, now: new Date(),
+                }));
+        }
+    }
+}
+//# sourceMappingURL=check-runner.js.map

package/dist/check-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-runner.js","sourceRoot":"","sources":["../src/check-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC3F,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAA4B,MAAM,kBAAkB,CAAC;AAClF,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EAExB,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EAGxB,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,gBAAgB,CAAC;AA+CxB,MAAM,aAAa,GAAG,0BAA0B,CAAC;AACjD,MAAM,kBAAkB,GAAG,6IAA6I,CAAC;AAEzK,MAAM,UAAU,qBAAqB,CACnC,UAA2B,EAC3B,YAA+B,OAAO,CAAC,GAAG;IAE1C,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;QAChD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACzE,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACzE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACpB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe,EAAE,KAAkC;IAC7E,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,iBAAiB,CAAC,OAAO,CACjC,sBAAsB,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,iDAAiD,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CACjI,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;QACvH,MAAM,IAAI,iBAAiB,CAAC,OAAO,CACjC,6BAA6B,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,wDAAwD,EACvH,EAAE,QAAQ,EAAE,OAAO,EAAE,CACtB,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC/D,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,iBAAiB,CAAC,OAAO,CACjC,6BAA6B,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,mCAAmC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAC1H,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,OAAyC;IAC1D,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KASnC;IAMC,IAAI,KAAK,CAAC,QAAQ,EAAE,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,IAAI,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACzG,MAAM,IAAI,iBAAiB,CAAC,OAAO,CAAC,6BAA6B,EAAE,uDAAuD,CAAC,CAAC,CAAC;IAC/H,CAAC;IACD,MAAM,UAAU,GAAG,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3F,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,iBAAiB,CAAC,OAAO,CACjC,6BAA6B,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,mCAAmC,MAAM,CAAC,KAAK,CAAC,GAAG,EACxH,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,CAC5B,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtG,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,UAAU,CAAC,gBAAgB,IAAI,OAAO,CAAC;IACtD,uGAAuG;IACvG,4FAA4F;IAC5F,MAAM,WAAW,GAAoB,OAAO,CAAC;IAC7C,MAAM,OAAO,GAAG,SAAS,KAAK,CAAC,OAAO,IAAI,UAAU,EAAE,EAAE,CAAC;IACzD,MAAM,WAAW,GAAG,oBAAoB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC5D,IAAI,KAAoE,CAAC;IACzE,IAAI,SAA6B,CAAC;IAClC,4GAA4G;IAC5G,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,aAAa,GAAG,QAAQ,CAAC;IAC7B,IAAI,CAAC;QACH,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,qBAAqB,CAAC;gBAClC,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,wBAAwB,EAAE;gBACvG,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM;aAC9B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,CAAC,UAAU;gBAAE,MAAM,iBAAiB,CAC3C,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,EACxC,wBAAwB,CAAC;oBACvB,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW;oBAC3G,OAAO,EAAE,SAAS;oBAClB,WAAW,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE;oBAC5B,GAAG,CAAC,KAAK,YAAY,iBAAiB;wBACpC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;wBACjH,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC,CACH,CAAC;YACF,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,iBAAiB,CACrB,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,EACxC,wBAAwB,CAAC;oBACvB,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW;oBAC3G,OAAO,EAAE,uBAAuB,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1F,WAAW,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE;iBAC7B,CAAC,CACH,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;gBACrC,KAAK,GAAG,SAAS,CAAC;gBAClB,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAClE,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI;YACrC,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC;SAChG,EAAE,CAAC;YACX,IAAI,QAAQ,IAAI,QAAQ,KAAK,MAAM;gBAAE,MAAM,IAAI,iBAAiB,CAAC,OAAO,CACtE,yBAAyB,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,yCAAyC,EAClH,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAC9C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,eAAe,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,gBAAgB,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpF,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;QAClE,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QAC/D,MAAM,SAAS,CAAC,gBAAgB,EAAE,eAAe,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,MAAM,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;QACrC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;QAC1G,MAAM,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC;YAC5B,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC;YAC7F,GAAG,EAAE,qBAAqB,CAAC,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI;YACrF,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC,UAAU,EAAE,cAAc,EAAE,UAAU,CAAC,gBAAgB;YAClG,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAM,CAAC,aAAa,CAAC,GAAG,CAAC;SAC5C,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC;QACzB,aAAa,GAAG,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC;QAC5H,oGAAoG;QACpG,uGAAuG;QACvG,sGAAsG;QACtG,mEAAmE;QACnE,IAAI,MAAM,CAAC,UAAU;YAAE,MAAM,IAAI,iBAAiB,CAAC,OAAO,CACxD,sBAAsB,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,2CAA2C,EACzG,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,CAC5B,CAAC,CAAC;QACH,IAAI,SAAS;YAAE,MAAM,IAAI,iBAAiB,CAAC,OAAO,CAChD,uBAAuB,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,yCAAyC,EACxG,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,CAC5B,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,2BAA2B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACjE,IAAI,SAAS;YAAE,MAAM,IAAI,iBAAiB,CAAC,OAAO,CAChD,uBAAuB,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,0CAA0C,EACzG,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,CAC5B,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;YACzE,MAAM,IAAI,iBAAiB,CAAC,OAAO,CACjC,yBAAyB,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,iCAAiC,EAClG,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,CAC5B,CAAC,CAAC;QACL,CAAC;QACD,qGAAqG;QACrG,oGAAoG;QACpG,mGAAmG;QACnG,sGAAsG;QACtG,uGAAuG;QACvG,uEAAuE;QACvE,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC1D,KAAK,GAAG,SAAS,CAAC;QAClB,IAAI,SAAS;YAAE,MAAM,IAAI,iBAAiB,CAAC,OAAO,CAChD,uBAAuB,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,0CAA0C,EACzG,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,CAC5B,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,UAAU;YAAE,MAAM,iBAAiB,CAC3C,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,EACxC,wBAAwB,CAAC;gBACvB,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW;gBAC3G,OAAO,EAAE,yBAAyB,CAAC,cAAc,EAAE,aAAa,CAAC,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE;aAC/G,CAAC,CACH,CAAC;QACF,MAAM,IAAI,GAAqC;YAC7C,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,gBAAgB;YAC/F,IAAI,EAAE,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS;YACrG,UAAU,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI;YACxF,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS;YAC/G,aAAa,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC7E,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,gBAAgB,EAAE,MAAM;YACnE,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5F,CAAC;QACF,MAAM,OAAO,GAAiB,EAAE,UAAU,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC;QACvE,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,KAAK,GAA4B;gBACrC,aAAa,EAAE,cAAc,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,OAAO;gBAChG,SAAS,EAAE,OAAO,CAAC,UAAU,EAAE,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO;gBAC/F,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnE,CAAC;YACF,MAAM,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI,EAAE,OAAO,EAAE,CAAC;IAChG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,+FAA+F;QAC/F,mGAAmG;QACnG,qGAAqG;QACrG,mEAAmE;QACnE,IAAI,aAAa,KAAK,WAAW;YAAE,aAAa,GAAG,SAAS,CAAC;QAC7D,qGAAqG;QACrG,8FAA8F;QAC9F,gGAAgG;QAChG,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,iBAAiB,CACrB;gBACE,IAAI,EAAE,KAAK,CAAC,UAAU;gBACtB,8FAA8F;gBAC9F,2FAA2F;gBAC3F,0CAA0C;gBAC1C,MAAM,EAAE,KAAK;gBACb,+FAA+F;gBAC/F,4FAA4F;gBAC5F,6FAA6F;gBAC7F,4EAA4E;gBAC5E,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,gCAAgC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;aACvF,EACD,wBAAwB,CAAC;gBACvB,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW;gBAC3G,OAAO,EAAE,SAAS;gBAClB,OAAO,EAAE,KAAK,YAAY,iBAAiB;oBACzC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;oBACpG,CAAC,CAAC,OAAO,CAAC,4BAA4B,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;gBAC7G,WAAW,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE;aAC7B,CAAC,CACH,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,IAAI,SAAS;YAAE,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,IAAI,KAAK,EAAE,CAAC;YACV,8FAA8F;YAC9F,gGAAgG;YAChG,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YACnD,IAAI,KAAK,CAAC,UAAU;gBAAE,MAAM,iBAAiB,CAC3C;oBACE,IAAI,EAAE,KAAK,CAAC,UAAU;oBACtB,MAAM,EAAE,KAAK;oBACb,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,sCAAsC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;iBAC7F,EACD,wBAAwB,CAAC;oBACvB,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW;oBAC3G,OAAO,EAAE,OAAO,KAAK,MAAM;wBACzB,CAAC,CAAC,MAAM;wBACR,CAAC,CAAC,OAAO,KAAK,qBAAqB;4BACjC,CAAC,CAAC,qBAAqB;4BACvB,CAAC,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;oBAC1D,aAAa,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE;iBAC5C,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/correlation.d.ts

@@ -0,0 +1,90 @@
+import type { DefinitionDigest } from "./definitions.ts";
+import type { Capability } from "./resolve.ts";
+export type JsonPrimitive = string | number | boolean | null;
+export type JsonValue = JsonPrimitive | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+/**
+ * Non-authoritative workflow metadata copied onto runtime and ledger events.
+ *
+ * pi-daddy deliberately does not interpret assurance labels, sources, scope selectors, timestamps or
+ * sequence floors. In particular, a digest-looking value here never substitutes for a digest computed by
+ * the planner. The snake_case names are the wire vocabulary used by external controllers.
+ */
+export interface CorrelationMetadata {
+    schema_version?: string;
+    run_id?: string;
+    task_id?: string;
+    workspace_id?: string;
+    context_id?: string;
+    phase?: string;
+    assurance?: string;
+    assurance_effective?: string;
+    policy_label?: string;
+    assurance_source?: string;
+    assurance_scope?: JsonValue;
+    activated_at?: string;
+    plan_digest?: string;
+    definition_digest?: string;
+    task_digest?: string;
+    base_sha?: string;
+    head_sha?: string;
+    tree_sha?: string;
+    event_seq?: number;
+    last_change_seq?: number;
+    last_authority_seq?: number;
+    check_receipt_id?: string;
+}
+/**
+ * Snapshot bounded JSON metadata so a caller cannot mutate a record after planning, and so nothing
+ * unbounded or undeclared can reach the ledger through it.
+ *
+ * Refuses with a stable code rather than a bare `Error`: this is reachable from a model-facing tool
+ * parameter on all three delegation tools, and it used to throw outside every try, producing a governed
+ * refusal with no code and no ledger line at all (R-112).
+ */
+export declare function normaliseCorrelation(input: CorrelationMetadata | undefined): CorrelationMetadata | undefined;
+export declare function digestTask(task: string): string;
+export declare function digestCapabilities(capabilities: readonly Capability[]): string;
+/** Trusted, internally-computed scope of one gated approval. */
+export interface ApprovalBinding {
+    version: "1";
+    task_sha256: string;
+    requested_sha256: string;
+    effective_sha256: string;
+    requested: Capability[];
+    effective: Capability[];
+    definition_sha256?: string;
+    workspace_id?: string;
+    context_id?: string;
+    parent_id: string;
+}
+/**
+ * Builds the binding from TRUSTED values only. It deliberately does not take a `CorrelationMetadata`.
+ *
+ * It used to read `workspace_id` and `context_id` straight out of caller-supplied correlation into what
+ * the comment above calls the trusted scope, and a bound approval could then be spent outside the
+ * workspace it named (R-110): approve a delegation carrying a real, registry-validated `workspace` spec,
+ * then re-issue the identical task with `correlation.workspace_id` set and NO `workspace` field — no
+ * registry lookup, no lease, the parent's own cwd, and every digest still matching. The guard that would
+ * have caught it can only fire when there is a spec to disagree with.
+ *
+ * `workspaceId` must therefore be the id of a workspace that was actually resolved and leased.
+ * `contextId` is a caller-declared label that nothing validates; it is included because it can only
+ * ever NARROW a binding, and a mismatch fails closed.
+ */
+export declare function buildApprovalBinding(input: {
+    task: string;
+    requested: readonly Capability[];
+    effective: readonly Capability[];
+    definitionSha256?: DefinitionDigest["sha256"] | string;
+    parentId: string;
+    /** Id of a workspace this delegation was actually routed to and holds a lease for. */
+    workspaceId?: string;
+    /** Caller-declared label. Narrows only; never a claim that anything was enforced. */
+    contextId?: string;
+}): ApprovalBinding;
+export declare function approvalBindingDigest(binding: ApprovalBinding): string;
+export declare function isApprovalBinding(value: unknown): value is ApprovalBinding;
+export declare function approvalBindingsEqual(a: ApprovalBinding | undefined, b: ApprovalBinding | undefined): boolean;
+//# sourceMappingURL=correlation.d.ts.map

package/dist/correlation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"correlation.d.ts","sourceRoot":"","sources":["../src/correlation.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAG/C,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;AAC7D,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,SAAS,EAAE,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAEnF;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,SAAS,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAiDD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,mBAAmB,GAAG,SAAS,GAAG,mBAAmB,GAAG,SAAS,CAyD5G;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,SAAS,UAAU,EAAE,GAAG,MAAM,CAG9E;AAED,gEAAgE;AAChE,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,GAAG,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,UAAU,EAAE,CAAC;IACxB,SAAS,EAAE,UAAU,EAAE,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,SAAS,UAAU,EAAE,CAAC;IACjC,SAAS,EAAE,SAAS,UAAU,EAAE,CAAC;IACjC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,sFAAsF;IACtF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qFAAqF;IACrF,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,eAAe,CAelB;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,eAAe,GAAG,MAAM,CActE;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CAmB1E;AAED,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,eAAe,GAAG,SAAS,EAAE,CAAC,EAAE,eAAe,GAAG,SAAS,GAAG,OAAO,CAI7G"}

package/dist/correlation.js

@@ -0,0 +1,183 @@
+import { createHash } from "node:crypto";
+import { GovernanceRefusal, refusal } from "./refusals.js";
+const MAX_CORRELATION_BYTES = 32 * 1024;
+/**
+ * Per-field bound on the STRING fields — most are an id, a digest, a label or a timestamp. It does not
+ * apply to the three sequence numbers or to `assurance_scope`, which are checked separately; an earlier
+ * version of this comment claimed it covered every declared field.
+ */
+const MAX_CORRELATION_FIELD_CHARS = 512;
+/** `assurance_scope` is the one structured field, so it gets its own, larger bound. */
+const MAX_CORRELATION_SCOPE_BYTES = 4 * 1024;
+/**
+ * The exact field set of the pinned schema 1.0 contract. Anything else is refused by name.
+ *
+ * This is a whitelist rather than a size cap because `correlation` is a MODEL-FACING tool parameter that
+ * is copied verbatim onto every append-only ledger event. `src/ledger.ts` states the invariant — capability
+ * ids, counts and identifiers only, never prompts, tool arguments or results — and ADR-0034 repeats that the
+ * ledger must never carry task text. A 32 KB "bounded JSON object" with no key whitelist and no per-field
+ * length bound satisfied neither: `assurance_scope` was declared `Type.Any()`, undeclared keys survived the
+ * round trip, and every string was unbounded, so a model could write 32 KB of arbitrary text into the
+ * ledger through it (R-111). Refusing an unknown key is also the loud option: if upstream adds a field, the
+ * refusal names it, which is an actionable break rather than a silent secrets sink.
+ */
+const CORRELATION_FIELDS = new Set([
+    "schema_version", "run_id", "task_id", "workspace_id", "context_id", "phase", "assurance",
+    "assurance_effective", "policy_label", "assurance_source", "assurance_scope", "activated_at",
+    "plan_digest", "definition_digest", "task_digest", "base_sha", "head_sha", "tree_sha",
+    "event_seq", "last_change_seq", "last_authority_seq", "check_receipt_id",
+]);
+const CORRELATION_NUMERIC = new Set([
+    "event_seq", "last_change_seq", "last_authority_seq",
+]);
+function correlationRefusal(message, details) {
+    return new GovernanceRefusal(refusal("CORRELATION_INVALID", `correlation metadata: ${message}`, details));
+}
+/**
+ * Size refusals get their own code, because they call for a different response: "you sent too much" is
+ * retryable by truncating, "you sent a field we do not recognise" is not. `CORRELATION_TOO_LARGE` was
+ * declared in the taxonomy and constructed nowhere, so the union advertised a distinction the code did not
+ * make — and the enumeration test kept the dead member green.
+ */
+function correlationTooLarge(message, details) {
+    return new GovernanceRefusal(refusal("CORRELATION_TOO_LARGE", `correlation metadata: ${message}`, details));
+}
+/**
+ * Snapshot bounded JSON metadata so a caller cannot mutate a record after planning, and so nothing
+ * unbounded or undeclared can reach the ledger through it.
+ *
+ * Refuses with a stable code rather than a bare `Error`: this is reachable from a model-facing tool
+ * parameter on all three delegation tools, and it used to throw outside every try, producing a governed
+ * refusal with no code and no ledger line at all (R-112).
+ */
+export function normaliseCorrelation(input) {
+    if (input === undefined)
+        return undefined;
+    let encoded;
+    try {
+        encoded = JSON.stringify(input);
+    }
+    catch (error) {
+        throw correlationRefusal(`must be JSON serializable (${String(error)})`);
+    }
+    if (encoded === undefined)
+        throw correlationRefusal("must be a JSON object");
+    if (Buffer.byteLength(encoded) > MAX_CORRELATION_BYTES) {
+        throw correlationTooLarge(`exceeds ${MAX_CORRELATION_BYTES} bytes`, { limit: MAX_CORRELATION_BYTES });
+    }
+    const parsed = JSON.parse(encoded);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw correlationRefusal("must be a JSON object");
+    }
+    const source = parsed;
+    const undeclared = Object.keys(source).filter((key) => !CORRELATION_FIELDS.has(key));
+    if (undeclared.length > 0) {
+        throw correlationRefusal(`carries fields outside the pinned schema 1.0 contract: ${undeclared.sort().join(", ")}`, { undeclared: undeclared.sort().join(",") });
+    }
+    const output = {};
+    for (const [key, value] of Object.entries(source)) {
+        if (value === undefined || value === null)
+            continue;
+        if (key === "assurance_scope") {
+            const size = Buffer.byteLength(JSON.stringify(value) ?? "");
+            if (size > MAX_CORRELATION_SCOPE_BYTES) {
+                throw correlationTooLarge(`assurance_scope exceeds ${MAX_CORRELATION_SCOPE_BYTES} bytes`, { limit: MAX_CORRELATION_SCOPE_BYTES, actual: size });
+            }
+            output[key] = value;
+            continue;
+        }
+        if (CORRELATION_NUMERIC.has(key)) {
+            if (typeof value !== "number" || !Number.isFinite(value)) {
+                throw correlationRefusal(`${key} must be a finite number`, { field: key });
+            }
+            output[key] = value;
+            continue;
+        }
+        if (typeof value !== "string")
+            throw correlationRefusal(`${key} must be a string`, { field: key });
+        if (value.length > MAX_CORRELATION_FIELD_CHARS) {
+            throw correlationTooLarge(`${key} exceeds ${MAX_CORRELATION_FIELD_CHARS} characters`, { field: key, limit: MAX_CORRELATION_FIELD_CHARS, actual: value.length });
+        }
+        output[key] = value;
+    }
+    return output;
+}
+export function digestTask(task) {
+    return createHash("sha256").update(task, "utf8").digest("hex");
+}
+export function digestCapabilities(capabilities) {
+    const canonical = [...new Set(capabilities)].sort();
+    return createHash("sha256").update(JSON.stringify(canonical), "utf8").digest("hex");
+}
+/**
+ * Builds the binding from TRUSTED values only. It deliberately does not take a `CorrelationMetadata`.
+ *
+ * It used to read `workspace_id` and `context_id` straight out of caller-supplied correlation into what
+ * the comment above calls the trusted scope, and a bound approval could then be spent outside the
+ * workspace it named (R-110): approve a delegation carrying a real, registry-validated `workspace` spec,
+ * then re-issue the identical task with `correlation.workspace_id` set and NO `workspace` field — no
+ * registry lookup, no lease, the parent's own cwd, and every digest still matching. The guard that would
+ * have caught it can only fire when there is a spec to disagree with.
+ *
+ * `workspaceId` must therefore be the id of a workspace that was actually resolved and leased.
+ * `contextId` is a caller-declared label that nothing validates; it is included because it can only
+ * ever NARROW a binding, and a mismatch fails closed.
+ */
+export function buildApprovalBinding(input) {
+    const requested = [...new Set(input.requested)].sort();
+    const effective = [...new Set(input.effective)].sort();
+    return {
+        version: "1",
+        task_sha256: digestTask(input.task),
+        requested_sha256: digestCapabilities(requested),
+        effective_sha256: digestCapabilities(effective),
+        requested,
+        effective,
+        ...(input.definitionSha256 ? { definition_sha256: input.definitionSha256 } : {}),
+        ...(input.workspaceId ? { workspace_id: input.workspaceId } : {}),
+        ...(input.contextId ? { context_id: input.contextId } : {}),
+        parent_id: input.parentId,
+    };
+}
+export function approvalBindingDigest(binding) {
+    const ordered = {
+        version: binding.version,
+        task_sha256: binding.task_sha256,
+        requested_sha256: binding.requested_sha256,
+        effective_sha256: binding.effective_sha256,
+        requested: binding.requested,
+        effective: binding.effective,
+        definition_sha256: binding.definition_sha256 ?? null,
+        workspace_id: binding.workspace_id ?? null,
+        context_id: binding.context_id ?? null,
+        parent_id: binding.parent_id,
+    };
+    return createHash("sha256").update(JSON.stringify(ordered), "utf8").digest("hex");
+}
+export function isApprovalBinding(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const binding = value;
+    return binding.version === "1" &&
+        [binding.task_sha256, binding.requested_sha256, binding.effective_sha256].every((digest) => typeof digest === "string" && /^[a-f0-9]{64}$/i.test(digest)) &&
+        Array.isArray(binding.requested) && binding.requested.every((item) => typeof item === "string") &&
+        Array.isArray(binding.effective) && binding.effective.every((item) => typeof item === "string") &&
+        typeof binding.parent_id === "string" &&
+        ["definition_sha256", "workspace_id", "context_id"].every((key) => {
+            const value = binding[key];
+            return value === undefined || typeof value === "string";
+        }) &&
+        // Self-consistency. This guard's only trust boundary is a binding parsed off DISK
+        // (`approval-store.ts`), so an internally contradictory record — digests that do not match the
+        // capability arrays sitting beside them — must be unrepresentable rather than merely unlikely.
+        binding.requested_sha256 === digestCapabilities(binding.requested) &&
+        binding.effective_sha256 === digestCapabilities(binding.effective);
+}
+export function approvalBindingsEqual(a, b) {
+    if (a === undefined || b === undefined)
+        return a === b;
+    if (!isApprovalBinding(a) || !isApprovalBinding(b))
+        return false;
+    return approvalBindingDigest(a) === approvalBindingDigest(b);
+}
+//# sourceMappingURL=correlation.js.map

package/dist/correlation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"correlation.js","sourceRoot":"","sources":["../src/correlation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAqC3D,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC;AACxC;;;;GAIG;AACH,MAAM,2BAA2B,GAAG,GAAG,CAAC;AACxC,uFAAuF;AACvF,MAAM,2BAA2B,GAAG,CAAC,GAAG,IAAI,CAAC;AAE7C;;;;;;;;;;;GAWG;AACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAA4B;IAC5D,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW;IACzF,qBAAqB,EAAE,cAAc,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,cAAc;IAC5F,aAAa,EAAE,mBAAmB,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;IACrF,WAAW,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,kBAAkB;CACzE,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAA4B;IAC7D,WAAW,EAAE,iBAAiB,EAAE,oBAAoB;CACrD,CAAC,CAAC;AAEH,SAAS,kBAAkB,CAAC,OAAe,EAAE,OAAyC;IACpF,OAAO,IAAI,iBAAiB,CAAC,OAAO,CAAC,qBAAqB,EAAE,yBAAyB,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;AAC5G,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,OAAe,EAAE,OAAyC;IACrF,OAAO,IAAI,iBAAiB,CAAC,OAAO,CAAC,uBAAuB,EAAE,yBAAyB,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;AAC9G,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAsC;IACzE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,kBAAkB,CAAC,8BAA8B,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IAC7E,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,qBAAqB,EAAE,CAAC;QACvD,MAAM,mBAAmB,CAAC,WAAW,qBAAqB,QAAQ,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;IACxG,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAY,CAAC;IAC9C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,MAAM,GAAG,MAAiC,CAAC;IACjD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAgC,CAAC,CAAC,CAAC;IAClH,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,kBAAkB,CACtB,0DAA0D,UAAU,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACxF,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAC5C,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QACpD,IAAI,GAAG,KAAK,iBAAiB,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5D,IAAI,IAAI,GAAG,2BAA2B,EAAE,CAAC;gBACvC,MAAM,mBAAmB,CACvB,2BAA2B,2BAA2B,QAAQ,EAC9D,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,IAAI,EAAE,CACrD,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACpB,SAAS;QACX,CAAC;QACD,IAAI,mBAAmB,CAAC,GAAG,CAAC,GAAgC,CAAC,EAAE,CAAC;YAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzD,MAAM,kBAAkB,CAAC,GAAG,GAAG,0BAA0B,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACpB,SAAS;QACX,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,MAAM,kBAAkB,CAAC,GAAG,GAAG,mBAAmB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACnG,IAAI,KAAK,CAAC,MAAM,GAAG,2BAA2B,EAAE,CAAC;YAC/C,MAAM,mBAAmB,CACvB,GAAG,GAAG,YAAY,2BAA2B,aAAa,EAC1D,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CACzE,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,OAAO,MAA6B,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,YAAmC;IACpE,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACtF,CAAC;AAgBD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAUpC;IACC,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACvD,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACvD,OAAO;QACL,OAAO,EAAE,GAAG;QACZ,WAAW,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC;QACnC,gBAAgB,EAAE,kBAAkB,CAAC,SAAS,CAAC;QAC/C,gBAAgB,EAAE,kBAAkB,CAAC,SAAS,CAAC;QAC/C,SAAS;QACT,SAAS;QACT,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,SAAS,EAAE,KAAK,CAAC,QAAQ;KAC1B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAwB;IAC5D,MAAM,OAAO,GAAG;QACd,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,IAAI;QACpD,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI;QAC1C,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;QACtC,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC;IACF,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,OAAO,GAAG,KAAiC,CAAC;IAClD,OAAO,OAAO,CAAC,OAAO,KAAK,GAAG;QAC5B,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAC7E,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CACzE;QACD,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QAC/F,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QAC/F,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ;QACrC,CAAC,mBAAmB,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAChE,MAAM,KAAK,GAAI,OAAmC,CAAC,GAAG,CAAC,CAAC;YACxD,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC;QAC1D,CAAC,CAAC;QACF,kFAAkF;QAClF,+FAA+F;QAC/F,+FAA+F;QAC/F,OAAO,CAAC,gBAAgB,KAAK,kBAAkB,CAAC,OAAO,CAAC,SAAyB,CAAC;QAClF,OAAO,CAAC,gBAAgB,KAAK,kBAAkB,CAAC,OAAO,CAAC,SAAyB,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,CAA8B,EAAE,CAA8B;IAClG,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACvD,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACjE,OAAO,qBAAqB,CAAC,CAAC,CAAC,KAAK,qBAAqB,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC"}