run402 4.24.0 → 4.25.0

package/sdk/dist/namespaces/wallets.js.map

@@ -1 +1 @@
-{"version":3,"file":"wallets.js","sourceRoot":"","sources":["../../src/namespaces/wallets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAOtD,sFAAsF;AACtF,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,OAAe;IACtD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAC9B,eAAe,kBAAkB,CAAC,OAAO,CAAC,QAAQ,EAClD,EAAE,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,KAAK,EAAE,CACrD,CAAC;QACF,OAAO,GAAG,EAAE,KAAK,IAAI,IAAI,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,KAAK,UAAU,QAAQ,CAAC,MAAc,EAAE,OAAe,EAAE,KAAa;IACpE,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAClB,eAAe,kBAAkB,CAAC,OAAO,CAAC,QAAQ,EAClD,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CACrF,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,OAAO,OAAO;IACW;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C;;;OAGG;IACH,KAAK,CAAC,QAAQ,CAAC,OAAe;QAC5B,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,QAAQ,CAAC,OAAe,EAAE,KAAa;QAC3C,mBAAmB,CAAC,kBAAkB,EAAE,uCAAuC,CAAC,CAAC;QACjF,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,YAAY;IACM;IAAiC;IAA9D,YAA6B,MAAc,EAAmB,OAAe;QAAhD,WAAM,GAAN,MAAM,CAAQ;QAAmB,YAAO,GAAP,OAAO,CAAQ;IAAG,CAAC;IAEjF,qDAAqD;IACrD,QAAQ;QACN,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,sEAAsE;IACtE,QAAQ,CAAC,KAAa;QACpB,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACpD,CAAC;CACF"}
+{"version":3,"file":"wallets.js","sourceRoot":"","sources":["../../src/namespaces/wallets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AASH,sFAAsF;AACtF,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,OAAe;IACtD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAC9B,eAAe,kBAAkB,CAAC,OAAO,CAAC,QAAQ,EAClD,EAAE,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,KAAK,EAAE,CACrD,CAAC;QACF,OAAO,GAAG,EAAE,KAAK,IAAI,IAAI,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,KAAK,UAAU,QAAQ,CAAC,MAAc,EAAE,OAAe,EAAE,KAAa;IACpE,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAClB,eAAe,kBAAkB,CAAC,OAAO,CAAC,QAAQ,EAClD,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CACrF,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,OAAO,OAAO;IACW;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C;;;OAGG;IACH,KAAK,CAAC,QAAQ,CAAC,OAAe;QAC5B,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,YAAY;IACM;IAAiC;IAA9D,YAA6B,MAAc,EAAmB,OAAe;QAAhD,WAAM,GAAN,MAAM,CAAQ;QAAmB,YAAO,GAAP,OAAO,CAAQ;IAAG,CAAC;IAEjF,qDAAqD;IACrD,QAAQ;QACN,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,sEAAsE;IACtE,QAAQ,CAAC,KAAa;QACpB,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACpD,CAAC;CACF"}

package/sdk/dist/node/gitvault-creation-journal.d.ts

@@ -0,0 +1,222 @@
+/**
+ * gitvault — the six-stage crash-safe creation journal (protocol rev 40 §5.2;
+ * task 5.3).
+ *
+ *   LOCAL_KEYS_PREPARED   identity + client_creation_id            (no ciphertext yet —
+ *   ALLOCATED             verified allocation: repo_id, nonce, gen   repo_id is a KDF input)
+ *   OBJECTS_PREPARED      exact object ids, nonces, framed bytes, hashes, sizes — fsynced BEFORE any PUT
+ *   OBJECTS_FINALIZED     server receipts, compared to the local manifest
+ *   GENESIS_PREPARED      exact genesis stored bytes + hash
+ *   ACTIVE                admitted; pin + recovery receipt recorded
+ *
+ * The ordering is the round-3 H5 invariant made structural: `K_repo` is
+ * generated and the creator's `key_envelope` is sealed ONLY in the
+ * OBJECTS_PREPARED step, which cannot run until ALLOCATED has journaled a
+ * `repo_id` — because `repo_id` is an HKDF input and an HPKE AAD member, no
+ * ciphertext can exist before allocation. Each stage is written to
+ * `journal/<client_creation_id>.json` with the keystore's atomic+fsync write
+ * before the next step starts.
+ *
+ * Restart reconciliation (`resume`) dispatches on the durable stage:
+ *   - OBJECTS_PREPARED with a PUT possibly in flight → read-and-compare the
+ *     object against the journaled bytes; equal → finalized; present-but-
+ *     different → `VAULT_CREATION_CONFLICT`; absent → PUT the SAME bytes.
+ *     Never re-encrypt under the same id (a fresh seal would be a second
+ *     ciphertext under a single-use key label).
+ *   - GENESIS_PREPARED → read the admitted genesis back; equal → ACTIVE;
+ *     foreign → `VAULT_CREATION_CONFLICT`, never overwritten.
+ *   - a `superseded` allocation anywhere → `ALLOCATION_SUPERSEDED`; the client
+ *     does not publish.
+ *   - anything the journal cannot explain → refuse the destructive retry.
+ *
+ * The control-plane calls ride an injectable {@link GitvaultCreationTransport}
+ * — task 5.4 wires the HTTP one; tests supply an in-memory bucket.
+ */
+import { GITVAULT_TERMINAL_LOSS_DOCTOR_TEXT, GITVAULT_TERMINAL_LOSS_STATEMENT } from "../namespaces/gitvault.crypto.js";
+import type { GitvaultAllocation, GitvaultKeyEnvelopeReceipt, GitvaultRecoveryReceipt, GitvaultVaultGenesis } from "../namespaces/gitvault.types.js";
+import { GitvaultKeystore } from "./gitvault-keystore.js";
+export declare const GITVAULT_CREATION_STAGES: readonly ["LOCAL_KEYS_PREPARED", "ALLOCATED", "OBJECTS_PREPARED", "OBJECTS_FINALIZED", "GENESIS_PREPARED", "ACTIVE"];
+export type GitvaultCreationStage = (typeof GITVAULT_CREATION_STAGES)[number];
+/** One prepared object: exact bytes + identity, durable before any PUT. */
+export interface GitvaultJournaledObject {
+    object_kind: "key_envelope";
+    /** Storage path relative to the vault root (`envelopes/<epoch>/<recipient_fingerprint>`). */
+    path: string;
+    /** The exact stored bytes, base64url (the §1 "base64url-jcs" convention). */
+    stored_bytes_b64u: string;
+    stored_bytes_sha256: string;
+    size_bytes: string;
+    /** The genesis receipt for this object. */
+    receipt: GitvaultKeyEnvelopeReceipt;
+    /** Set once the server receipt was compared equal to the local manifest. */
+    finalized: boolean;
+}
+/** `journal/<client_creation_id>.json`. Stage-monotonic; every field from an earlier stage survives. */
+export interface GitvaultCreationJournal {
+    version: 1;
+    stage: GitvaultCreationStage;
+    client_creation_id: string;
+    org_id: string;
+    project_id: string;
+    creator_signing_fingerprint: string;
+    creator_encryption_fingerprint: string;
+    created_at: string;
+    updated_at: string;
+    /** ALLOCATED — the verified allocation verbatim. */
+    allocation: GitvaultAllocation | null;
+    /** OBJECTS_PREPARED — K_repo (hex) lives ONLY here until ACTIVE moves it to the repo file. */
+    k_repo_hex: string | null;
+    objects: GitvaultJournaledObject[];
+    /** GENESIS_PREPARED — the exact signed genesis and its stored-bytes hash. */
+    genesis: GitvaultVaultGenesis | null;
+    genesis_sha256: string | null;
+    /** ACTIVE — the emitted recovery receipt. */
+    recovery_receipt: GitvaultRecoveryReceipt | null;
+    /** A terminal refusal, if reconciliation hit one (the journal is kept for diagnosis, never retried destructively). */
+    refusal: {
+        code: "VAULT_CREATION_CONFLICT" | "ALLOCATION_SUPERSEDED";
+        at: string;
+        details?: Record<string, unknown>;
+    } | null;
+}
+/**
+ * `POST /gitvault/v1/vaults` — the allocate REQUEST.
+ *
+ * READ THIS BEFORE CHANGING THESE FIELD NAMES. The request carries the raw
+ * PUBLIC KEYS; the signed `allocation` RECORD the gateway returns carries the
+ * FINGERPRINTS derived from them. The two shapes differ on exactly these two
+ * fields, so building the request from `schemas/allocation.json` — the obvious
+ * thing to do — produces a body the gateway ignores, and it answers
+ * `400 VALIDATION_FAILED field=creator_signing_pubkey` as if the field were
+ * simply missing. That is the production failure this comment exists to stop
+ * from recurring.
+ *
+ * Pubkeys, not fingerprints, because a fingerprint is one-way: every later head
+ * signature is verified against the stored creator signing key, and a hash
+ * cannot verify a signature. The gateway derives the fingerprints itself, and
+ * `checkAllocation` compares the record's fingerprints back against this
+ * principal's — which is what proves the keys we sent are the keys it stored.
+ */
+export interface GitvaultAllocateRequest {
+    client_creation_id: string;
+    org_id: string;
+    project_id: string;
+    /** Raw Ed25519 public key, canonical base64url (43 chars, decodes to 32 bytes). */
+    creator_signing_pubkey: string;
+    /** Raw X25519 public key, canonical base64url (43 chars, decodes to 32 bytes). */
+    creator_encryption_pubkey: string;
+}
+export interface GitvaultPutObjectRequest {
+    repo_id: string;
+    path: string;
+    bytes: Uint8Array;
+    /** What the client expects the server to acknowledge — the server's receipt is compared against it. */
+    expected_sha256: string;
+    expected_size_bytes: string;
+}
+export interface GitvaultObjectReceipt {
+    stored_bytes_sha256: string;
+    size_bytes: string;
+}
+export interface GitvaultAdmitGenesisRequest {
+    repo_id: string;
+    allocation_generation: string;
+    stored_bytes: Uint8Array;
+    stored_bytes_sha256: string;
+}
+export type GitvaultAdmitGenesisResult = {
+    outcome: "admitted";
+    admitted_sha256: string;
+}
+/** Someone already canonized generation zero — the resume path decides whether it is ours (read-back) or foreign. */
+ | {
+    outcome: "already_admitted";
+    admitted_sha256: string;
+} | {
+    outcome: "allocation_superseded";
+};
+/**
+ * The control-plane + bucket operations creation needs. Every method is
+ * idempotent from the journal's point of view; the journal never relies on a
+ * call having NOT happened.
+ */
+export interface GitvaultCreationTransport {
+    /** Idempotent on `client_creation_id`; returns the current representation (which may be `superseded`). */
+    allocate(request: GitvaultAllocateRequest): Promise<GitvaultAllocation>;
+    /** Create-only PUT; on a pre-existing object the server MAY return its receipt instead of overwriting. */
+    putObject(request: GitvaultPutObjectRequest): Promise<GitvaultObjectReceipt>;
+    /** Read an object back (`null` when absent) — the read-and-compare primitive. */
+    getObject(request: {
+        repo_id: string;
+        path: string;
+    }): Promise<Uint8Array | null>;
+    /** Generation-zero admission (the §5A machine at generation zero). */
+    admitGenesis(request: GitvaultAdmitGenesisRequest): Promise<GitvaultAdmitGenesisResult>;
+    /** Read the admitted genesis bytes back (`null` when none). */
+    getGenesis(request: {
+        repo_id: string;
+    }): Promise<Uint8Array | null>;
+}
+export interface GitvaultCreationOptions {
+    keystore: GitvaultKeystore;
+    transport: GitvaultCreationTransport;
+    org_id: string;
+    project_id: string;
+    /** Resume an existing journal, or pin the idempotency key (tests). Fresh CSPRNG when omitted. */
+    client_creation_id?: string;
+    /** Clock injection. */
+    now?: () => Date;
+    /** Optional pinned service public key for allocation-signature verification (5.4 supplies it from the registry). */
+    service_public_key?: Uint8Array | string;
+    /** Test hook: called after each stage is durable, BEFORE the next step — throw to simulate a crash. */
+    onStage?: (stage: GitvaultCreationStage, journal: GitvaultCreationJournal) => void | Promise<void>;
+}
+export interface GitvaultCreationResult {
+    repo_id: string;
+    genesis_sha256: string;
+    recovery_receipt: GitvaultRecoveryReceipt;
+    journal: GitvaultCreationJournal;
+    /** `created` on the first pass; `reconciled` when a restart completed an earlier attempt. */
+    how: "created" | "reconciled";
+}
+/** Journal file for one creation attempt. */
+export declare function gitvaultJournalPath(keystore: GitvaultKeystore, clientCreationId: string): string;
+export declare function readGitvaultJournal(keystore: GitvaultKeystore, clientCreationId: string): GitvaultCreationJournal | null;
+/** Every journal on disk that has not reached ACTIVE (what `doctor` lists as "creation in progress"). */
+export declare function listIncompleteGitvaultJournals(keystore: GitvaultKeystore): GitvaultCreationJournal[];
+export declare class GitvaultCreation {
+    private readonly keystore;
+    private readonly transport;
+    private readonly now;
+    private readonly options;
+    private journal;
+    private resumed;
+    private constructor();
+    /**
+     * Open a creation: resume the journal for `client_creation_id` when one
+     * exists, else write stage 1 (LOCAL_KEYS_PREPARED). Nothing here touches the
+     * network; no ciphertext exists yet.
+     */
+    static open(options: GitvaultCreationOptions): GitvaultCreation;
+    get current(): GitvaultCreationJournal;
+    private persist;
+    private advance;
+    private refuse;
+    /**
+     * Drive the journal to ACTIVE from whatever stage is durable. Safe to call
+     * again after any crash; a refused journal stays refused.
+     */
+    run(): Promise<GitvaultCreationResult>;
+    private verifyAllocation;
+}
+/** Convenience: open + run in one call. */
+export declare function createGitvault(options: GitvaultCreationOptions): Promise<GitvaultCreationResult>;
+/** What `doctor`/`status` print about V0-A recovery — the verbatim statement plus the pointers it must carry. */
+export interface GitvaultDoctorRecoveryText {
+    statement: typeof GITVAULT_TERMINAL_LOSS_STATEMENT;
+    doctor_text: typeof GITVAULT_TERMINAL_LOSS_DOCTOR_TEXT;
+    /** The platform's custodial restore of deployed artifacts (the deploy lane's CAS) — the support path when every principal envelope is lost. */
+    cas_restore_pointer: string;
+}
+export declare function gitvaultDoctorRecoveryText(): GitvaultDoctorRecoveryText;
+//# sourceMappingURL=gitvault-creation-journal.d.ts.map

package/sdk/dist/node/gitvault-creation-journal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitvault-creation-journal.d.ts","sourceRoot":"","sources":["../../src/node/gitvault-creation-journal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAKH,OAAO,EAEL,kCAAkC,EAClC,gCAAgC,EAajC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EACV,kBAAkB,EAElB,0BAA0B,EAC1B,uBAAuB,EAEvB,oBAAoB,EACrB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAyC,MAAM,wBAAwB,CAAC;AAIjG,eAAO,MAAM,wBAAwB,sHAO3B,CAAC;AAEX,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9E,2EAA2E;AAC3E,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,cAAc,CAAC;IAC5B,6FAA6F;IAC7F,IAAI,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,2CAA2C;IAC3C,OAAO,EAAE,0BAA0B,CAAC;IACpC,4EAA4E;IAC5E,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,wGAAwG;AACxG,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,CAAC,CAAC;IACX,KAAK,EAAE,qBAAqB,CAAC;IAC7B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,2BAA2B,EAAE,MAAM,CAAC;IACpC,8BAA8B,EAAE,MAAM,CAAC;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,oDAAoD;IACpD,UAAU,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACtC,8FAA8F;IAC9F,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,uBAAuB,EAAE,CAAC;IACnC,6EAA6E;IAC7E,OAAO,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,6CAA6C;IAC7C,gBAAgB,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACjD,sHAAsH;IACtH,OAAO,EAAE;QAAE,IAAI,EAAE,yBAAyB,GAAG,uBAAuB,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC;CAC9H;AAID;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,uBAAuB;IACtC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,mFAAmF;IACnF,sBAAsB,EAAE,MAAM,CAAC;IAC/B,kFAAkF;IAClF,yBAAyB,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,UAAU,CAAC;IAClB,uGAAuG;IACvG,eAAe,EAAE,MAAM,CAAC;IACxB,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,qBAAqB;IACpC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,YAAY,EAAE,UAAU,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,MAAM,0BAA0B,GAClC;IAAE,OAAO,EAAE,UAAU,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE;AAClD,qHAAqH;GACnH;IAAE,OAAO,EAAE,kBAAkB,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,OAAO,EAAE,uBAAuB,CAAA;CAAE,CAAC;AAEzC;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,0GAA0G;IAC1G,QAAQ,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACxE,0GAA0G;IAC1G,SAAS,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC7E,iFAAiF;IACjF,SAAS,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAClF,sEAAsE;IACtE,YAAY,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACxF,+DAA+D;IAC/D,UAAU,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;CACtE;AAID,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,SAAS,EAAE,yBAAyB,CAAC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,iGAAiG;IACjG,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,uBAAuB;IACvB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,oHAAoH;IACpH,kBAAkB,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;IACzC,uGAAuG;IACvG,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,qBAAqB,EAAE,OAAO,EAAE,uBAAuB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpG;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,uBAAuB,CAAC;IAC1C,OAAO,EAAE,uBAAuB,CAAC;IACjC,6FAA6F;IAC7F,GAAG,EAAE,SAAS,GAAG,YAAY,CAAC;CAC/B;AAUD,6CAA6C;AAC7C,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAGhG;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,GAAG,uBAAuB,GAAG,IAAI,CAQxH;AAED,yGAAyG;AACzG,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,gBAAgB,GAAG,uBAAuB,EAAE,CAWpG;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmB;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA4B;IACtD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0B;IAClD,OAAO,CAAC,OAAO,CAA0B;IACzC,OAAO,CAAC,OAAO,CAAS;IAExB,OAAO;IASP;;;;OAIG;IACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,uBAAuB,GAAG,gBAAgB;IA2C/D,IAAI,OAAO,IAAI,uBAAuB,CAErC;IAED,OAAO,CAAC,OAAO;YAMD,OAAO;IAMrB,OAAO,CAAC,MAAM;IAMd;;;OAGG;IACG,GAAG,IAAI,OAAO,CAAC,sBAAsB,CAAC;IAyJ5C,OAAO,CAAC,gBAAgB;CAmBzB;AAED,2CAA2C;AAC3C,wBAAsB,cAAc,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAEtG;AAID,iHAAiH;AACjH,MAAM,WAAW,0BAA0B;IACzC,SAAS,EAAE,OAAO,gCAAgC,CAAC;IACnD,WAAW,EAAE,OAAO,kCAAkC,CAAC;IACvD,+IAA+I;IAC/I,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,wBAAgB,0BAA0B,IAAI,0BAA0B,CAMvE"}

package/sdk/dist/node/gitvault-creation-journal.js

@@ -0,0 +1,365 @@
+/**
+ * gitvault — the six-stage crash-safe creation journal (protocol rev 40 §5.2;
+ * task 5.3).
+ *
+ *   LOCAL_KEYS_PREPARED   identity + client_creation_id            (no ciphertext yet —
+ *   ALLOCATED             verified allocation: repo_id, nonce, gen   repo_id is a KDF input)
+ *   OBJECTS_PREPARED      exact object ids, nonces, framed bytes, hashes, sizes — fsynced BEFORE any PUT
+ *   OBJECTS_FINALIZED     server receipts, compared to the local manifest
+ *   GENESIS_PREPARED      exact genesis stored bytes + hash
+ *   ACTIVE                admitted; pin + recovery receipt recorded
+ *
+ * The ordering is the round-3 H5 invariant made structural: `K_repo` is
+ * generated and the creator's `key_envelope` is sealed ONLY in the
+ * OBJECTS_PREPARED step, which cannot run until ALLOCATED has journaled a
+ * `repo_id` — because `repo_id` is an HKDF input and an HPKE AAD member, no
+ * ciphertext can exist before allocation. Each stage is written to
+ * `journal/<client_creation_id>.json` with the keystore's atomic+fsync write
+ * before the next step starts.
+ *
+ * Restart reconciliation (`resume`) dispatches on the durable stage:
+ *   - OBJECTS_PREPARED with a PUT possibly in flight → read-and-compare the
+ *     object against the journaled bytes; equal → finalized; present-but-
+ *     different → `VAULT_CREATION_CONFLICT`; absent → PUT the SAME bytes.
+ *     Never re-encrypt under the same id (a fresh seal would be a second
+ *     ciphertext under a single-use key label).
+ *   - GENESIS_PREPARED → read the admitted genesis back; equal → ACTIVE;
+ *     foreign → `VAULT_CREATION_CONFLICT`, never overwritten.
+ *   - a `superseded` allocation anywhere → `ALLOCATION_SUPERSEDED`; the client
+ *     does not publish.
+ *   - anything the journal cannot explain → refuse the destructive retry.
+ *
+ * The control-plane calls ride an injectable {@link GitvaultCreationTransport}
+ * — task 5.4 wires the HTTP one; tests supply an in-memory bucket.
+ */
+import { existsSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { LocalError } from "../errors.js";
+import { GITVAULT_GENESIS_EPOCH, GITVAULT_TERMINAL_LOSS_DOCTOR_TEXT, GITVAULT_TERMINAL_LOSS_STATEMENT, buildRecoveryReceipt, buildVaultGenesis, bytesToHex, checkAllocation, checkGenesisKeyBindings, formatGitvaultTimestamp, newHex32, parseGitvaultStrict, randomBytes, sealKeyEnvelope, sha256Hex, storedBytes, } from "../namespaces/gitvault.crypto.js";
+import { readFileNoFollow, writeFileAtomic0600 } from "./gitvault-keystore.js";
+// ─── Stages + journal shape ──────────────────────────────────────────────────
+export const GITVAULT_CREATION_STAGES = [
+    "LOCAL_KEYS_PREPARED",
+    "ALLOCATED",
+    "OBJECTS_PREPARED",
+    "OBJECTS_FINALIZED",
+    "GENESIS_PREPARED",
+    "ACTIVE",
+];
+function fail(code, message, context, details) {
+    throw new LocalError(message, context, { code, details });
+}
+function envelopePath(epoch, recipientFingerprint) {
+    return `envelopes/${epoch}/${recipientFingerprint}`;
+}
+/** Journal file for one creation attempt. */
+export function gitvaultJournalPath(keystore, clientCreationId) {
+    if (!/^[0-9a-f]{32}$/.test(clientCreationId))
+        fail("GITVAULT_BAD_ID", "client_creation_id must be 32 lowercase hex", "resolving gitvault journal path");
+    return join(keystore.journalDir, `${clientCreationId}.json`);
+}
+export function readGitvaultJournal(keystore, clientCreationId) {
+    const text = readFileNoFollow(gitvaultJournalPath(keystore, clientCreationId));
+    if (!text)
+        return null;
+    const journal = JSON.parse(text);
+    if (journal.version !== 1 || !GITVAULT_CREATION_STAGES.includes(journal.stage)) {
+        fail("GITVAULT_JOURNAL_CORRUPT", "creation journal is not a version-1 gitvault journal", "reading gitvault creation journal", { client_creation_id: clientCreationId });
+    }
+    return journal;
+}
+/** Every journal on disk that has not reached ACTIVE (what `doctor` lists as "creation in progress"). */
+export function listIncompleteGitvaultJournals(keystore) {
+    if (!existsSync(keystore.journalDir))
+        return [];
+    const out = [];
+    for (const entry of readdirSync(keystore.journalDir)) {
+        if (!entry.endsWith(".json"))
+            continue;
+        const id = entry.slice(0, -5);
+        if (!/^[0-9a-f]{32}$/.test(id))
+            continue;
+        const j = readGitvaultJournal(keystore, id);
+        if (j && j.stage !== "ACTIVE")
+            out.push(j);
+    }
+    return out;
+}
+export class GitvaultCreation {
+    keystore;
+    transport;
+    now;
+    options;
+    journal;
+    resumed = false;
+    constructor(options, journal, resumed) {
+        this.options = options;
+        this.keystore = options.keystore;
+        this.transport = options.transport;
+        this.now = options.now ?? (() => new Date());
+        this.journal = journal;
+        this.resumed = resumed;
+    }
+    /**
+     * Open a creation: resume the journal for `client_creation_id` when one
+     * exists, else write stage 1 (LOCAL_KEYS_PREPARED). Nothing here touches the
+     * network; no ciphertext exists yet.
+     */
+    static open(options) {
+        const ks = options.keystore;
+        const identity = ks.ensureIdentity();
+        const signing = ks.signingKeypair(identity);
+        const encryption = ks.encryptionKeypair(identity);
+        if (!signing || !encryption) {
+            fail("GITVAULT_READ_ONLY", "this principal cannot create a vault: a private key is missing from identity.json", "opening gitvault creation", { signing_key_present: Boolean(signing), encryption_key_present: Boolean(encryption) });
+        }
+        const id = options.client_creation_id ?? newHex32();
+        const existing = readGitvaultJournal(ks, id);
+        if (existing) {
+            if (existing.org_id !== options.org_id || existing.project_id !== options.project_id) {
+                fail("VAULT_CREATION_CONFLICT", "journal belongs to a different org/project", "resuming gitvault creation", { client_creation_id: id });
+            }
+            if (existing.creator_signing_fingerprint !== identity.signing_fingerprint || existing.creator_encryption_fingerprint !== identity.encryption_fingerprint) {
+                fail("VAULT_CREATION_CONFLICT", "journal was prepared by a different identity; refusing the destructive retry", "resuming gitvault creation", { client_creation_id: id });
+            }
+            return new GitvaultCreation(options, existing, true);
+        }
+        const at = formatGitvaultTimestamp((options.now ?? (() => new Date()))());
+        const journal = {
+            version: 1,
+            stage: "LOCAL_KEYS_PREPARED",
+            client_creation_id: id,
+            org_id: options.org_id,
+            project_id: options.project_id,
+            creator_signing_fingerprint: identity.signing_fingerprint,
+            creator_encryption_fingerprint: identity.encryption_fingerprint,
+            created_at: at,
+            updated_at: at,
+            allocation: null,
+            k_repo_hex: null,
+            objects: [],
+            genesis: null,
+            genesis_sha256: null,
+            recovery_receipt: null,
+            refusal: null,
+        };
+        const c = new GitvaultCreation(options, journal, false);
+        c.persist();
+        return c;
+    }
+    get current() {
+        return this.journal;
+    }
+    persist() {
+        this.journal = { ...this.journal, updated_at: formatGitvaultTimestamp(this.now()) };
+        writeFileAtomic0600(gitvaultJournalPath(this.keystore, this.journal.client_creation_id), JSON.stringify(this.journal, null, 2));
+        this.keystore.audit("journal_stage", this.journal.allocation?.repo_id, { client_creation_id: this.journal.client_creation_id, stage: this.journal.stage });
+    }
+    async advance(stage, patch) {
+        this.journal = { ...this.journal, ...patch, stage };
+        this.persist();
+        await this.options.onStage?.(stage, this.journal);
+    }
+    refuse(code, message, details) {
+        this.journal = { ...this.journal, refusal: { code, at: formatGitvaultTimestamp(this.now()), ...(details ? { details } : {}) } };
+        this.persist();
+        fail(code, message, "reconciling gitvault creation", { client_creation_id: this.journal.client_creation_id, ...details });
+    }
+    /**
+     * Drive the journal to ACTIVE from whatever stage is durable. Safe to call
+     * again after any crash; a refused journal stays refused.
+     */
+    async run() {
+        if (this.journal.refusal) {
+            fail(this.journal.refusal.code, "this creation attempt was refused earlier; start a new attempt (the journal is kept for diagnosis)", "resuming gitvault creation", {
+                client_creation_id: this.journal.client_creation_id,
+                refused_at: this.journal.refusal.at,
+                ...this.journal.refusal.details,
+            });
+        }
+        const identity = this.keystore.ensureIdentity();
+        const signing = this.keystore.signingKeypair(identity);
+        const encryption = this.keystore.encryptionKeypair(identity);
+        // ── 2. ALLOCATED ──
+        if (this.journal.stage === "LOCAL_KEYS_PREPARED") {
+            const allocation = await this.transport.allocate({
+                client_creation_id: this.journal.client_creation_id,
+                org_id: this.journal.org_id,
+                project_id: this.journal.project_id,
+                // PUBKEYS on the request; the returned record carries the fingerprints
+                // the gateway derives from them. See GitvaultAllocateRequest.
+                creator_signing_pubkey: identity.signing_pubkey,
+                creator_encryption_pubkey: identity.encryption_pubkey,
+            });
+            this.verifyAllocation(allocation);
+            await this.advance("ALLOCATED", { allocation });
+        }
+        const allocation = this.journal.allocation;
+        const repoId = allocation.repo_id;
+        const epoch = GITVAULT_GENESIS_EPOCH;
+        // ── 3. OBJECTS_PREPARED — the FIRST point at which ciphertext exists ──
+        if (this.journal.stage === "ALLOCATED") {
+            const kRepo = randomBytes(32);
+            const sealed = await sealKeyEnvelope({
+                k_repo: kRepo,
+                repo_id: repoId,
+                epoch,
+                recipient_public_key: encryption.public_key,
+                signer: signing,
+                created_at: formatGitvaultTimestamp(this.now()),
+            });
+            const object = {
+                object_kind: "key_envelope",
+                path: envelopePath(epoch, sealed.receipt.recipient_fingerprint),
+                stored_bytes_b64u: b64u(sealed.stored_bytes),
+                stored_bytes_sha256: sealed.stored_bytes_sha256,
+                size_bytes: sealed.size_bytes,
+                receipt: sealed.receipt,
+                finalized: false,
+            };
+            await this.advance("OBJECTS_PREPARED", { k_repo_hex: bytesToHex(kRepo), objects: [object] });
+        }
+        // ── 4. OBJECTS_FINALIZED — PUT (or read-and-compare after a crash), never re-encrypt ──
+        if (this.journal.stage === "OBJECTS_PREPARED") {
+            const objects = this.journal.objects.map((o) => ({ ...o }));
+            for (const object of objects) {
+                if (object.finalized)
+                    continue;
+                const bytes = unb64u(object.stored_bytes_b64u);
+                if (sha256Hex(bytes) !== object.stored_bytes_sha256 || String(bytes.length) !== object.size_bytes) {
+                    this.refuse("VAULT_CREATION_CONFLICT", "journaled object bytes do not match their journaled hash; refusing the destructive retry", { path: object.path });
+                }
+                const remote = await this.transport.getObject({ repo_id: repoId, path: object.path });
+                if (remote) {
+                    if (!bytesEqual(remote, bytes)) {
+                        this.refuse("VAULT_CREATION_CONFLICT", "an object already exists at this path with different bytes", { path: object.path, remote_sha256: sha256Hex(remote) });
+                    }
+                    object.finalized = true;
+                    continue;
+                }
+                const receipt = await this.transport.putObject({ repo_id: repoId, path: object.path, bytes, expected_sha256: object.stored_bytes_sha256, expected_size_bytes: object.size_bytes });
+                if (receipt.stored_bytes_sha256 !== object.stored_bytes_sha256 || receipt.size_bytes !== object.size_bytes) {
+                    this.refuse("VAULT_CREATION_CONFLICT", "the server's finalization receipt does not match the local manifest", { path: object.path, receipt });
+                }
+                object.finalized = true;
+            }
+            await this.advance("OBJECTS_FINALIZED", { objects });
+        }
+        // ── 5. GENESIS_PREPARED — exact stored bytes + hash journaled before the admission PUT ──
+        if (this.journal.stage === "OBJECTS_FINALIZED") {
+            const envelopeObject = this.journal.objects.find((o) => o.object_kind === "key_envelope");
+            if (!envelopeObject)
+                this.refuse("VAULT_CREATION_CONFLICT", "journal has no finalized key_envelope");
+            const genesis = buildVaultGenesis({
+                repo_id: repoId,
+                org_id: this.journal.org_id,
+                project_id: this.journal.project_id,
+                allocation_nonce: allocation.allocation_nonce,
+                creator_signing: signing,
+                creator_encryption_public_key: encryption.public_key,
+                envelope_receipt: envelopeObject.receipt,
+                created_at: formatGitvaultTimestamp(this.now()),
+            });
+            const storedEnvelope = parseGitvaultStrict(new TextDecoder().decode(unb64u(envelopeObject.stored_bytes_b64u)));
+            const bindings = checkGenesisKeyBindings(genesis, storedEnvelope);
+            if (bindings.length > 0)
+                this.refuse("VAULT_CREATION_CONFLICT", "prepared genesis fails its own key bindings", { problems: bindings });
+            await this.advance("GENESIS_PREPARED", { genesis, genesis_sha256: sha256Hex(storedBytes(genesis)) });
+        }
+        // ── 6. ACTIVE — admit; on resume read back; foreign genesis is a refusal ──
+        if (this.journal.stage === "GENESIS_PREPARED") {
+            const genesis = this.journal.genesis;
+            const bytes = storedBytes(genesis);
+            const hash = sha256Hex(bytes);
+            if (hash !== this.journal.genesis_sha256)
+                this.refuse("VAULT_CREATION_CONFLICT", "journaled genesis bytes do not match their journaled hash");
+            const existing = await this.transport.getGenesis({ repo_id: repoId });
+            if (existing) {
+                if (!bytesEqual(existing, bytes)) {
+                    this.refuse("VAULT_CREATION_CONFLICT", "a different genesis is already admitted for this repo_id (foreign genesis); never overwritten", { admitted_sha256: sha256Hex(existing) });
+                }
+            }
+            else {
+                const result = await this.transport.admitGenesis({ repo_id: repoId, allocation_generation: allocation.allocation_generation, stored_bytes: bytes, stored_bytes_sha256: hash });
+                if (result.outcome === "allocation_superseded") {
+                    this.refuse("ALLOCATION_SUPERSEDED", "the allocation was reclaimed by the owner; this client must not publish", { allocation_generation: allocation.allocation_generation });
+                }
+                if (result.admitted_sha256 !== hash) {
+                    this.refuse("VAULT_CREATION_CONFLICT", "admission canonized a different genesis than the one prepared here", { admitted_sha256: result.admitted_sha256 });
+                }
+            }
+            const receipt = buildRecoveryReceipt({
+                repo_id: repoId,
+                org_id: this.journal.org_id,
+                project_id: this.journal.project_id,
+                genesis_sha256: hash,
+                creator_signing: signing,
+                creator_encryption_public_key: encryption.public_key,
+            });
+            // Pin + K_repo move into the repo file, then the receipt, then the journal flips — so a
+            // crash between them leaves a GENESIS_PREPARED journal whose resume is an idempotent read-back.
+            this.keystore.saveRepo({
+                repo_id: repoId,
+                org_id: this.journal.org_id,
+                project_id: this.journal.project_id,
+                k_repo_hex: this.journal.k_repo_hex,
+                epoch,
+                genesis_sha256: hash,
+                head_pin: null,
+                last_ref_transaction: null,
+                provenance: "created",
+            });
+            this.keystore.saveRecoveryReceipt(receipt);
+            await this.advance("ACTIVE", { recovery_receipt: receipt });
+        }
+        return {
+            repo_id: repoId,
+            genesis_sha256: this.journal.genesis_sha256,
+            recovery_receipt: this.journal.recovery_receipt,
+            journal: this.journal,
+            how: this.resumed ? "reconciled" : "created",
+        };
+    }
+    verifyAllocation(allocation) {
+        const problems = checkAllocation(allocation, {
+            client_creation_id: this.journal.client_creation_id,
+            creator_signing_fingerprint: this.journal.creator_signing_fingerprint,
+            creator_encryption_fingerprint: this.journal.creator_encryption_fingerprint,
+            org_id: this.journal.org_id,
+            project_id: this.journal.project_id,
+        }, this.options.service_public_key);
+        if (problems.length > 0) {
+            fail("GITVAULT_ALLOCATION_INVALID", "allocation does not match this creation attempt", "verifying gitvault allocation", { problems });
+        }
+        if (allocation.status === "superseded") {
+            this.refuse("ALLOCATION_SUPERSEDED", "the allocation was reclaimed by the owner; this client must not resume", { allocation_generation: allocation.allocation_generation });
+        }
+    }
+}
+/** Convenience: open + run in one call. */
+export async function createGitvault(options) {
+    return GitvaultCreation.open(options).run();
+}
+export function gitvaultDoctorRecoveryText() {
+    return {
+        statement: GITVAULT_TERMINAL_LOSS_STATEMENT,
+        doctor_text: GITVAULT_TERMINAL_LOSS_DOCTOR_TEXT,
+        cas_restore_pointer: "The platform custodially holds the plaintext source artifacts of every DEPLOY in its CAS; ask support for a custodial restore of deployed artifacts. Vault HISTORY (commits never deployed) is not recoverable without a surviving principal keystore.",
+    };
+}
+// ─── helpers ────────────────────────────────────────────────────────────────
+function b64u(bytes) {
+    return Buffer.from(bytes).toString("base64url");
+}
+function unb64u(text) {
+    return new Uint8Array(Buffer.from(text, "base64url"));
+}
+function bytesEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a[i] ^ b[i];
+    return diff === 0;
+}
+//# sourceMappingURL=gitvault-creation-journal.js.map

package/sdk/dist/node/gitvault-creation-journal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitvault-creation-journal.js","sourceRoot":"","sources":["../../src/node/gitvault-creation-journal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EACL,sBAAsB,EACtB,kCAAkC,EAClC,gCAAgC,EAChC,oBAAoB,EACpB,iBAAiB,EACjB,UAAU,EACV,eAAe,EACf,uBAAuB,EACvB,uBAAuB,EACvB,QAAQ,EACR,mBAAmB,EACnB,WAAW,EACX,eAAe,EACf,SAAS,EACT,WAAW,GACZ,MAAM,kCAAkC,CAAC;AAS1C,OAAO,EAAoB,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAEjG,gFAAgF;AAEhF,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,qBAAqB;IACrB,WAAW;IACX,kBAAkB;IAClB,mBAAmB;IACnB,kBAAkB;IAClB,QAAQ;CACA,CAAC;AAiJX,SAAS,IAAI,CAAC,IAAY,EAAE,OAAe,EAAE,OAAe,EAAE,OAAiB;IAC7E,MAAM,IAAI,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,oBAA4B;IAC/D,OAAO,aAAa,KAAK,IAAI,oBAAoB,EAAE,CAAC;AACtD,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,mBAAmB,CAAC,QAA0B,EAAE,gBAAwB;IACtF,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,gBAAgB,CAAC;QAAE,IAAI,CAAC,iBAAiB,EAAE,6CAA6C,EAAE,iCAAiC,CAAC,CAAC;IACxJ,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,gBAAgB,OAAO,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAA0B,EAAE,gBAAwB;IACtF,MAAM,IAAI,GAAG,gBAAgB,CAAC,mBAAmB,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC/E,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;IAC5D,IAAI,OAAO,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/E,IAAI,CAAC,0BAA0B,EAAE,sDAAsD,EAAE,mCAAmC,EAAE,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC1K,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,8BAA8B,CAAC,QAA0B;IACvE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,CAAC;IAChD,MAAM,GAAG,GAA8B,EAAE,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACvC,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,SAAS;QACzC,MAAM,CAAC,GAAG,mBAAmB,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,OAAO,gBAAgB;IACV,QAAQ,CAAmB;IAC3B,SAAS,CAA4B;IACrC,GAAG,CAAa;IAChB,OAAO,CAA0B;IAC1C,OAAO,CAA0B;IACjC,OAAO,GAAG,KAAK,CAAC;IAExB,YAAoB,OAAgC,EAAE,OAAgC,EAAE,OAAgB;QACtG,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,IAAI,CAAC,OAAgC;QAC1C,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;QAC5B,MAAM,QAAQ,GAAG,EAAE,CAAC,cAAc,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;YAC5B,IAAI,CAAC,oBAAoB,EAAE,mFAAmF,EAAE,2BAA2B,EAAE,EAAE,mBAAmB,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,sBAAsB,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACvO,CAAC;QACD,MAAM,EAAE,GAAG,OAAO,CAAC,kBAAkB,IAAI,QAAQ,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC7C,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;gBACrF,IAAI,CAAC,yBAAyB,EAAE,4CAA4C,EAAE,4BAA4B,EAAE,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAAC,CAAC;YAC1I,CAAC;YACD,IAAI,QAAQ,CAAC,2BAA2B,KAAK,QAAQ,CAAC,mBAAmB,IAAI,QAAQ,CAAC,8BAA8B,KAAK,QAAQ,CAAC,sBAAsB,EAAE,CAAC;gBACzJ,IAAI,CAAC,yBAAyB,EAAE,8EAA8E,EAAE,4BAA4B,EAAE,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAAC,CAAC;YAC5K,CAAC;YACD,OAAO,IAAI,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,EAAE,GAAG,uBAAuB,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1E,MAAM,OAAO,GAA4B;YACvC,OAAO,EAAE,CAAC;YACV,KAAK,EAAE,qBAAqB;YAC5B,kBAAkB,EAAE,EAAE;YACtB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,2BAA2B,EAAE,QAAQ,CAAC,mBAAmB;YACzD,8BAA8B,EAAE,QAAQ,CAAC,sBAAsB;YAC/D,UAAU,EAAE,EAAE;YACd,UAAU,EAAE,EAAE;YACd,UAAU,EAAE,IAAI;YAChB,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE,EAAE;YACX,OAAO,EAAE,IAAI;YACb,cAAc,EAAE,IAAI;YACpB,gBAAgB,EAAE,IAAI;YACtB,OAAO,EAAE,IAAI;SACd,CAAC;QACF,MAAM,CAAC,GAAG,IAAI,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QACxD,CAAC,CAAC,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAEO,OAAO;QACb,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,uBAAuB,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;QACpF,mBAAmB,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAChI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAC7J,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,KAA4B,EAAE,KAAuC;QACzF,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC;QACpD,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACpD,CAAC;IAEO,MAAM,CAAC,IAAyD,EAAE,OAAe,EAAE,OAAiC;QAC1H,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,uBAAuB,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAChI,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,+BAA+B,EAAE,EAAE,kBAAkB,EAAE,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC5H,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,GAAG;QACP,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,oGAAoG,EAAE,4BAA4B,EAAE;gBAClK,kBAAkB,EAAE,IAAI,CAAC,OAAO,CAAC,kBAAkB;gBACnD,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;gBACnC,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO;aAChC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAE,CAAC;QACxD,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,QAAQ,CAAE,CAAC;QAE9D,qBAAqB;QACrB,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,qBAAqB,EAAE,CAAC;YACjD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;gBAC/C,kBAAkB,EAAE,IAAI,CAAC,OAAO,CAAC,kBAAkB;gBACnD,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;gBAC3B,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;gBACnC,uEAAuE;gBACvE,8DAA8D;gBAC9D,sBAAsB,EAAE,QAAQ,CAAC,cAAc;gBAC/C,yBAAyB,EAAE,QAAQ,CAAC,iBAAiB;aACtD,CAAC,CAAC;YACH,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAClC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,UAAW,CAAC;QAC5C,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC;QAClC,MAAM,KAAK,GAAG,sBAAsB,CAAC;QAErC,yEAAyE;QACzE,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;YAC9B,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;gBACnC,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,MAAM;gBACf,KAAK;gBACL,oBAAoB,EAAE,UAAU,CAAC,UAAU;gBAC3C,MAAM,EAAE,OAAO;gBACf,UAAU,EAAE,uBAAuB,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;aAChD,CAAC,CAAC;YACH,MAAM,MAAM,GAA4B;gBACtC,WAAW,EAAE,cAAc;gBAC3B,IAAI,EAAE,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC;gBAC/D,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;gBAC5C,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;gBAC/C,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,SAAS,EAAE,KAAK;aACjB,CAAC;YACF,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/F,CAAC;QAED,yFAAyF;QACzF,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,kBAAkB,EAAE,CAAC;YAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,MAAM,CAAC,SAAS;oBAAE,SAAS;gBAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;gBAC/C,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,mBAAmB,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;oBAClG,IAAI,CAAC,MAAM,CAAC,yBAAyB,EAAE,0FAA0F,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC5J,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;gBACtF,IAAI,MAAM,EAAE,CAAC;oBACX,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;wBAC/B,IAAI,CAAC,MAAM,CAAC,yBAAyB,EAAE,4DAA4D,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBAChK,CAAC;oBACD,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;oBACxB,SAAS;gBACX,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;gBACnL,IAAI,OAAO,CAAC,mBAAmB,KAAK,MAAM,CAAC,mBAAmB,IAAI,OAAO,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;oBAC3G,IAAI,CAAC,MAAM,CAAC,yBAAyB,EAAE,qEAAqE,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;gBAChJ,CAAC;gBACD,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;YAC1B,CAAC;YACD,MAAM,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACvD,CAAC;QAED,2FAA2F;QAC3F,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,mBAAmB,EAAE,CAAC;YAC/C,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,cAAc,CAAC,CAAC;YAC1F,IAAI,CAAC,cAAc;gBAAE,IAAI,CAAC,MAAM,CAAC,yBAAyB,EAAE,uCAAuC,CAAC,CAAC;YACrG,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,OAAO,EAAE,MAAM;gBACf,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;gBAC3B,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;gBACnC,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;gBAC7C,eAAe,EAAE,OAAO;gBACxB,6BAA6B,EAAE,UAAU,CAAC,UAAU;gBACpD,gBAAgB,EAAE,cAAc,CAAC,OAAO;gBACxC,UAAU,EAAE,uBAAuB,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;aAChD,CAAC,CAAC;YACH,MAAM,cAAc,GAAG,mBAAmB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC,CAAwB,CAAC;YACtI,MAAM,QAAQ,GAAG,uBAAuB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;YAClE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAAE,IAAI,CAAC,MAAM,CAAC,yBAAyB,EAAE,6CAA6C,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;YACvI,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,CAAC,WAAW,CAAC,OAA0C,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1I,CAAC;QAED,6EAA6E;QAC7E,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,kBAAkB,EAAE,CAAC;YAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAQ,CAAC;YACtC,MAAM,KAAK,GAAG,WAAW,CAAC,OAA0C,CAAC,CAAC;YACtE,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAC9B,IAAI,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,cAAc;gBAAE,IAAI,CAAC,MAAM,CAAC,yBAAyB,EAAE,2DAA2D,CAAC,CAAC;YAC9I,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YACtE,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;oBACjC,IAAI,CAAC,MAAM,CAAC,yBAAyB,EAAE,+FAA+F,EAAE,EAAE,eAAe,EAAE,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBACpL,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,qBAAqB,EAAE,UAAU,CAAC,qBAAqB,EAAE,YAAY,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC/K,IAAI,MAAM,CAAC,OAAO,KAAK,uBAAuB,EAAE,CAAC;oBAC/C,IAAI,CAAC,MAAM,CAAC,uBAAuB,EAAE,yEAAyE,EAAE,EAAE,qBAAqB,EAAE,UAAU,CAAC,qBAAqB,EAAE,CAAC,CAAC;gBAC/K,CAAC;gBACD,IAAI,MAAM,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;oBACpC,IAAI,CAAC,MAAM,CAAC,yBAAyB,EAAE,oEAAoE,EAAE,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;gBAC5J,CAAC;YACH,CAAC;YACD,MAAM,OAAO,GAAG,oBAAoB,CAAC;gBACnC,OAAO,EAAE,MAAM;gBACf,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;gBAC3B,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;gBACnC,cAAc,EAAE,IAAI;gBACpB,eAAe,EAAE,OAAO;gBACxB,6BAA6B,EAAE,UAAU,CAAC,UAAU;aACrD,CAAC,CAAC;YACH,wFAAwF;YACxF,gGAAgG;YAChG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBACrB,OAAO,EAAE,MAAM;gBACf,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;gBAC3B,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;gBACnC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAW;gBACpC,KAAK;gBACL,cAAc,EAAE,IAAI;gBACpB,QAAQ,EAAE,IAAI;gBACd,oBAAoB,EAAE,IAAI;gBAC1B,UAAU,EAAE,SAAS;aACtB,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAC3C,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,OAAO;YACL,OAAO,EAAE,MAAM;YACf,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,cAAe;YAC5C,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAiB;YAChD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;SAC7C,CAAC;IACJ,CAAC;IAEO,gBAAgB,CAAC,UAA8B;QACrD,MAAM,QAAQ,GAAG,eAAe,CAC9B,UAAU,EACV;YACE,kBAAkB,EAAE,IAAI,CAAC,OAAO,CAAC,kBAAkB;YACnD,2BAA2B,EAAE,IAAI,CAAC,OAAO,CAAC,2BAA2B;YACrE,8BAA8B,EAAE,IAAI,CAAC,OAAO,CAAC,8BAA8B;YAC3E,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;YAC3B,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;SACpC,EACD,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAChC,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC,6BAA6B,EAAE,iDAAiD,EAAE,+BAA+B,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxI,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,uBAAuB,EAAE,wEAAwE,EAAE,EAAE,qBAAqB,EAAE,UAAU,CAAC,qBAAqB,EAAE,CAAC,CAAC;QAC9K,CAAC;IACH,CAAC;CACF;AAED,2CAA2C;AAC3C,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAgC;IACnE,OAAO,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC;AAC9C,CAAC;AAYD,MAAM,UAAU,0BAA0B;IACxC,OAAO;QACL,SAAS,EAAE,gCAAgC;QAC3C,WAAW,EAAE,kCAAkC;QAC/C,mBAAmB,EAAE,wPAAwP;KAC9Q,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAS,IAAI,CAAC,KAAiB;IAC7B,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,UAAU,CAAC,CAAa,EAAE,CAAa;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACzD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC"}