usertrust 1.5.0 → 2.0.0

package/dist/cli/anchor.js

@@ -0,0 +1,626 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 Usertools, Inc.
+/**
+ * CLI: usertrust anchor — external audit anchoring
+ *
+ * init           Mint the vault's anchor identity (Ed25519 key OUTSIDE the vault)
+ * now            One snapshot → sign → mirror → publish cycle
+ * status         Last anchor, unanchored tail, outbox depth
+ * export         Print mirror records (JSONL) for pull-mode shipping
+ * export-bundle  Records + transparency-log receipts as one auditor artifact
+ * doctor         Probe what this identity can delete/overwrite in the store
+ * rotate         Cross-signed key rotation (spec §6)
+ * resume         Re-seed a lost mirror from the store's newest record
+ *
+ * Spec: docs/superpowers/specs/2026-07-26-external-anchoring-design.md
+ */
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import pc from "picocolors";
+import { anchorsDir, createAnchorEmitter, initAnchorIdentity, mintSuccessorKey, readAnchorIdentity, recordRotatedIdentity, resumeAnchorMirror, } from "../audit/anchor.js";
+import { doctorFileSink, doctorS3Sink } from "../audit/anchor-doctor.js";
+import { parseAnchorsContent } from "../audit/anchor-verify.js";
+import { DEFAULT_REKOR_URL } from "../audit/rekor.js";
+import { parseRekorReceipt } from "../audit/rekor-verify.js";
+import { VAULT_DIR } from "../shared/constants.js";
+const REKOR_FLAG = "--sink-rekor";
+const S3_KEYS = new Set(["bucket", "region", "prefix", "endpoint"]);
+/** Sink flags that take the following argv token as their operand. */
+const VALUE_SINK_FLAGS = new Set(["--sink-file", "--sink-url", "--sink-s3"]);
+/** Same cap the verify CLI enforces on `--bundle` — never export what it refuses. */
+const MAX_BUNDLE_ITEMS = 10_000;
+function sinksFromArgs(args) {
+    const sinks = [];
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (VALUE_SINK_FLAGS.has(arg)) {
+            // A missing operand used to drop the flag on the floor, so
+            // `anchor now --sink-s3` ran with ZERO sinks, published nowhere and
+            // still exited 0 — a skipped publication an operator would only
+            // discover at audit time. Refuse the run instead.
+            const value = args[i + 1];
+            if (value === undefined)
+                throw new Error(`${arg} requires a value`);
+            i++;
+            if (arg === "--sink-file") {
+                sinks.push({ type: "file", path: value });
+            }
+            else if (arg === "--sink-url") {
+                sinks.push({ type: "https", url: value });
+            }
+            else {
+                sinks.push(s3SinkFromSpec(value));
+            }
+        }
+        else if (arg === REKOR_FLAG) {
+            // Delta D8: this flag never consumes the token after it, so
+            // `--sink-rekor --sink-file /mnt/worm/a.jsonl` keeps its file sink. A
+            // URL parked there was meant as the log address, and defaulting to
+            // the public log instead would publish somewhere the operator never
+            // named — refuse rather than reinterpret.
+            const stray = args[i + 1];
+            if (stray !== undefined && /^https?:\/\//.test(stray)) {
+                throw new Error(`${REKOR_FLAG} takes no separate value — use ${REKOR_FLAG}=<url>`);
+            }
+            sinks.push({ type: "rekor" });
+        }
+        else if (arg.startsWith(`${REKOR_FLAG}=`)) {
+            const url = arg.slice(REKOR_FLAG.length + 1);
+            if (url === "")
+                throw new Error(`${REKOR_FLAG}=<url> requires a URL`);
+            sinks.push({ type: "rekor", url });
+        }
+    }
+    return sinks;
+}
+/** `bucket=B,region=R[,prefix=P][,endpoint=E]` — every key is explicit, none inferred. */
+function s3SinkFromSpec(spec) {
+    const fields = {};
+    for (const part of spec.split(",")) {
+        if (part.trim() === "")
+            continue;
+        const eq = part.indexOf("=");
+        if (eq <= 0) {
+            throw new Error(`--sink-s3: expected key=value, got "${part.slice(0, 60)}"`);
+        }
+        const key = part.slice(0, eq).trim();
+        const value = part.slice(eq + 1).trim();
+        if (!S3_KEYS.has(key)) {
+            throw new Error(`--sink-s3: unknown key "${key.slice(0, 40)}" (bucket, region, prefix, endpoint)`);
+        }
+        if (value === "")
+            throw new Error(`--sink-s3: ${key} requires a value`);
+        fields[key] = value;
+    }
+    const { bucket, region, prefix, endpoint } = fields;
+    if (bucket === undefined || region === undefined) {
+        throw new Error("--sink-s3 requires bucket=<name>,region=<region>");
+    }
+    return {
+        type: "s3",
+        bucket,
+        region,
+        ...(prefix !== undefined ? { prefix } : {}),
+        ...(endpoint !== undefined ? { endpoint } : {}),
+    };
+}
+function flagValue(args, flag) {
+    const idx = args.indexOf(flag);
+    if (idx === -1 || args[idx + 1] === undefined)
+        return undefined;
+    return args[idx + 1];
+}
+/**
+ * `--since <anchorSeq>`, or null when the operand is not a non-negative
+ * integer. Both `export` and `export-bundle` validate here: a bare parseInt
+ * turns `--since abc` into NaN, every `anchorSeq > NaN` comparison is false,
+ * and the command prints nothing while exiting 0 — indistinguishable from a
+ * vault with nothing left to ship.
+ */
+function sinceFromArgs(args) {
+    const raw = flagValue(args, "--since") ?? "0";
+    return /^(0|[1-9][0-9]*)$/.test(raw) ? Number.parseInt(raw, 10) : null;
+}
+function emitterConfig(args) {
+    const keyFile = flagValue(args, "--key-file");
+    const retriesRaw = flagValue(args, "--publish-retries");
+    const retries = retriesRaw !== undefined ? Number.parseInt(retriesRaw, 10) : undefined;
+    if (retriesRaw !== undefined && (!Number.isSafeInteger(retries) || retries < 1)) {
+        // Silently ignoring a bad value would fall back to the default and
+        // mask the operator's intent — fail loudly instead.
+        throw new Error(`Invalid --publish-retries: ${retriesRaw} (integer >= 1 required)`);
+    }
+    return {
+        signer: { type: "pem", ...(keyFile !== undefined ? { file: keyFile } : {}) },
+        sinks: sinksFromArgs(args),
+        ...(retries !== undefined ? { publishRetries: retries } : {}),
+    };
+}
+// ── doctor ──
+/** A sink the doctor cannot probe without writing to someone else's store. */
+function notProbed(sink, detail) {
+    return { sink, checks: [{ name: "probe", status: "info", detail }], failed: false };
+}
+async function doctorReports(args) {
+    const sinks = sinksFromArgs(args);
+    if (sinks.length === 0) {
+        throw new Error("anchor doctor: no sink configured — pass --sink-file, --sink-s3, --sink-url or --sink-rekor");
+    }
+    const reports = [];
+    for (const sink of sinks) {
+        switch (sink.type) {
+            case "file":
+                reports.push(doctorFileSink(sink.path));
+                break;
+            case "s3":
+                reports.push(await doctorS3Sink({
+                    bucket: sink.bucket,
+                    region: sink.region,
+                    ...(sink.prefix !== undefined ? { prefix: sink.prefix } : {}),
+                    ...(sink.endpoint !== undefined ? { endpoint: sink.endpoint } : {}),
+                }));
+                break;
+            case "https":
+                reports.push(notProbed(`https:${sink.url}`, "not probed: an ingest endpoint is append-only for this credential by " +
+                    "construction — probe the store BEHIND it with its own credentials"));
+                break;
+            case "rekor":
+                reports.push(notProbed(`rekor:${sink.url ?? DEFAULT_REKOR_URL}`, "not probed: a transparency log is append-only by construction — its " +
+                    "inclusion receipts under audit/anchors/rekor/ are the evidence"));
+                break;
+            case "command":
+                reports.push(notProbed(`command:${sink.argv[0] ?? ""}`, "not probed: the store behind a command " +
+                    "sink is opaque from here — probe it with its own tooling"));
+                break;
+        }
+    }
+    return reports;
+}
+function printDoctor(reports) {
+    const paint = { pass: pc.green, fail: pc.red, info: pc.yellow };
+    console.log(pc.bold("anchor doctor — permission probe (NOT proof of immutability)"));
+    for (const report of reports) {
+        console.log("");
+        console.log(report.sink);
+        for (const check of report.checks) {
+            console.log(`  ${paint[check.status](check.status.toUpperCase())} ${check.name}: ${check.detail}`);
+        }
+    }
+    console.log("");
+    console.log("Each verdict describes what these credentials could do at this location right now.");
+    console.log("Durable immutability comes from the store's own configuration (S3 Object Lock");
+    console.log("retention, POSIX directory permissions, an appliance's WORM mode).");
+}
+/**
+ * Build the auditor bundle `{v:1, records, rekorReceipts}` consumed by
+ * `usertrust verify --bundle`.
+ *
+ * Fail-closed by construction (delta D9): a bundle is what an auditor receives
+ * INSTEAD of the vault, so a partial one — records present, a receipt quietly
+ * dropped because its file did not parse — is worse than no bundle at all. Every
+ * failure path returns `bundle: null`, and callers print diagnostics to stderr
+ * so stdout is either one complete bundle or empty.
+ *
+ * A receipt whose record is absent from the mirror is the one exception, and it
+ * is not a parse failure: `anchor resume` re-seeds the mirror from the store's
+ * newest record alone, leaving the receipts for every earlier anchor on disk
+ * with nothing to pair against. Shipping them would hard-fail the verifier
+ * ("receipt for unknown anchorSeq"), so they are excluded with a warning and
+ * the bundle stays valid.
+ */
+function buildBundle(root, args) {
+    const errors = [];
+    const warnings = [];
+    try {
+        const since = sinceFromArgs(args);
+        if (since === null) {
+            return {
+                bundle: null,
+                errors: ["export-bundle: --since must be an integer >= 0"],
+                warnings,
+            };
+        }
+        const mirrorPath = join(anchorsDir(root), "anchors.jsonl");
+        if (!existsSync(mirrorPath)) {
+            return { bundle: null, errors: ["export-bundle: no anchor mirror found"], warnings };
+        }
+        const mirror = parseAnchorsContent(readFileSync(mirrorPath, "utf-8"));
+        for (const err of mirror.errors)
+            errors.push(`export-bundle: mirror: ${err}`);
+        const records = mirror.records
+            .filter((r) => r.anchorSeq > since)
+            .sort((a, b) => a.anchorSeq - b.anchorSeq);
+        const found = readReceipts(root, errors)
+            .filter((r) => r.anchorSeq > since)
+            .sort((a, b) => a.anchorSeq - b.anchorSeq);
+        if (errors.length > 0)
+            return { bundle: null, errors, warnings };
+        const bundledSeqs = new Set(records.map((r) => r.anchorSeq));
+        const receipts = found.filter((r) => {
+            if (bundledSeqs.has(r.anchorSeq))
+                return true;
+            warnings.push(`export-bundle: excluding receipt for anchorSeq ${r.anchorSeq} (no matching record ` +
+                "in mirror — re-fetch the full history to include it)");
+            return false;
+        });
+        for (const [what, count] of [
+            ["records", records.length],
+            ["rekorReceipts", receipts.length],
+        ]) {
+            if (count > MAX_BUNDLE_ITEMS) {
+                errors.push(`export-bundle: ${count} ${what} exceeds the ${MAX_BUNDLE_ITEMS} cap the verifier ` +
+                    "accepts — export in slices with --since");
+            }
+        }
+        if (errors.length > 0)
+            return { bundle: null, errors, warnings };
+        return {
+            bundle: JSON.stringify({ v: 1, records, rekorReceipts: receipts }),
+            errors,
+            warnings,
+        };
+    }
+    catch (err) {
+        errors.push(`export-bundle: ${err instanceof Error ? err.message : String(err)}`);
+        return { bundle: null, errors, warnings };
+    }
+}
+/**
+ * Every receipt the Rekor sink persisted; unparseable ones become errors, never
+ * gaps. Any `*.json` under the receipts directory is a candidate and each one is
+ * keyed by the `anchorSeq` INSIDE it — the filename is an index for humans, not
+ * a fact about the receipt.
+ */
+function readReceipts(root, errors) {
+    const dir = join(anchorsDir(root), "rekor");
+    if (!existsSync(dir))
+        return [];
+    const receipts = [];
+    for (const name of readdirSync(dir)
+        .filter((f) => f.endsWith(".json"))
+        .sort()) {
+        let raw;
+        try {
+            raw = readFileSync(join(dir, name), "utf-8");
+        }
+        catch (err) {
+            errors.push(`export-bundle: ${name}: unreadable (${err instanceof Error ? err.message : String(err)})`);
+            continue;
+        }
+        const { receipt, error } = parseRekorReceipt(raw);
+        if (receipt === null) {
+            errors.push(`export-bundle: ${name}: ${error}`);
+            continue;
+        }
+        receipts.push(receipt);
+    }
+    return receipts;
+}
+export async function run(args = [], opts) {
+    const json = opts?.json === true;
+    const root = process.cwd();
+    const action = args[0];
+    try {
+        switch (action) {
+            case "init": {
+                const keyFile = flagValue(args, "--key-file");
+                const { identity, publicKeyPem, keyFile: writtenKeyFile, } = initAnchorIdentity(root, keyFile !== undefined ? { keyFile } : undefined);
+                if (json) {
+                    console.log(JSON.stringify({
+                        command: "anchor init",
+                        success: true,
+                        data: { vaultId: identity.vaultId, keyId: identity.keyId, keyFile: writtenKeyFile },
+                    }));
+                    return;
+                }
+                console.log(pc.green("Anchor identity created."));
+                console.log(`  vaultId: ${identity.vaultId}`);
+                console.log(`  keyId:   ${identity.keyId}`);
+                console.log(`  private key: ${writtenKeyFile} (mode 0600 — NEVER inside the vault)`);
+                console.log("");
+                console.log("Public key (PEM) — PIN THIS OUT-OF-BAND:");
+                console.log(publicKeyPem.trim());
+                console.log("");
+                console.log(pc.bold("Next steps:"));
+                console.log("  1. Give the PEM + keyId to whoever will audit this vault (their records,");
+                console.log("     not the vault). Verification: usertrust-verify <vault> --anchor <file> --pubkey pub.pem");
+                console.log("  2. Configure an APPEND-ONLY store and publish anchors to it:");
+                console.log("     usertrust anchor now --sink-file /mnt/worm/anchors.jsonl");
+                console.log("     Deployment invariant: the identity that writes the vault has");
+                console.log("     append-only (no delete/overwrite) access to the store.");
+                return;
+            }
+            case "now": {
+                const emitter = createAnchorEmitter(root, emitterConfig(args));
+                const result = await emitter.anchorNow();
+                await emitter.stop();
+                const status = emitter.status();
+                if (json) {
+                    // Delivery-gated: emitted-but-undelivered (all sinks failed,
+                    // outbox retained) is a FAILURE in the mode cron/CI consumes —
+                    // mirror the non-JSON contract exactly (spec §5.3).
+                    const delivered = status.outboxDepth === 0;
+                    console.log(JSON.stringify({
+                        command: "anchor now",
+                        success: result.emitted && delivered,
+                        data: { ...result, outboxDepth: status.outboxDepth, delivered },
+                    }));
+                    if ((!result.emitted && result.reason !== "no-new-events") ||
+                        (result.emitted && !delivered)) {
+                        process.exitCode = 1;
+                    }
+                    return;
+                }
+                if (result.emitted && result.record) {
+                    console.log(pc.green(`Anchored: #${result.record.anchorSeq} treeSize ${result.record.treeSize} root ${result.record.merkleRoot.slice(0, 16)}…`));
+                    if (status.outboxDepth > 0) {
+                        console.log(pc.yellow(`Outbox: ${status.outboxDepth} record(s) not yet acknowledged by sinks.`));
+                        process.exitCode = 1;
+                    }
+                }
+                else if (result.reason === "no-new-events") {
+                    console.log("Nothing to anchor (no new events since the last anchor).");
+                }
+                else {
+                    console.log(pc.red(`Anchor skipped: ${result.reason}`));
+                    process.exitCode = 1;
+                }
+                return;
+            }
+            case "status": {
+                const identity = readAnchorIdentity(root);
+                if (identity === null) {
+                    console.log(json
+                        ? JSON.stringify({
+                            command: "anchor status",
+                            success: false,
+                            data: { message: "no anchor identity" },
+                        })
+                        : "No anchor identity. Run `usertrust anchor init` first.");
+                    process.exitCode = 1;
+                    return;
+                }
+                const mirrorPath = join(anchorsDir(root), "anchors.jsonl");
+                const mirror = existsSync(mirrorPath)
+                    ? parseAnchorsContent(readFileSync(mirrorPath, "utf-8"))
+                    : { records: [], errors: [] };
+                const tail = mirror.records.sort((a, b) => a.anchorSeq - b.anchorSeq).at(-1) ?? null;
+                const metaPath = join(root, VAULT_DIR, "audit", "events.jsonl.meta");
+                let headSeq = 0;
+                try {
+                    headSeq = JSON.parse(readFileSync(metaPath, "utf-8")).sequence;
+                }
+                catch {
+                    /* legacy / empty vault */
+                }
+                const tailEvents = Math.max(0, headSeq - (tail?.treeSize ?? 0));
+                const outboxDir = join(anchorsDir(root), "outbox");
+                let outboxDepth = 0;
+                try {
+                    outboxDepth = existsSync(outboxDir)
+                        ? (await import("node:fs")).readdirSync(outboxDir).filter((f) => f.endsWith(".json"))
+                            .length
+                        : 0;
+                }
+                catch {
+                    /* ignore */
+                }
+                if (json) {
+                    console.log(JSON.stringify({
+                        command: "anchor status",
+                        success: true,
+                        data: {
+                            vaultId: identity.vaultId,
+                            keyId: identity.keyId,
+                            lastAnchor: tail,
+                            eventsSinceLastAnchor: tailEvents,
+                            outboxDepth,
+                            mirrorErrors: mirror.errors,
+                        },
+                    }));
+                    return;
+                }
+                console.log(`vaultId: ${identity.vaultId}`);
+                console.log(`keyId:   ${identity.keyId}`);
+                if (tail) {
+                    console.log(`Last anchor: #${tail.anchorSeq} treeSize ${tail.treeSize} (${tail.timestamp})`);
+                }
+                else {
+                    console.log("Last anchor: none");
+                }
+                console.log(`Unanchored tail: ${tailEvents} event(s)`);
+                console.log(`Outbox: ${outboxDepth} pending`);
+                if (mirror.errors.length > 0) {
+                    console.log(pc.red(`Mirror parse errors: ${mirror.errors.length}`));
+                    process.exitCode = 1;
+                }
+                return;
+            }
+            case "export": {
+                const since = sinceFromArgs(args);
+                if (since === null) {
+                    console.error("export: --since must be an integer >= 0");
+                    process.exitCode = 1;
+                    return;
+                }
+                const mirrorPath = join(anchorsDir(root), "anchors.jsonl");
+                if (!existsSync(mirrorPath)) {
+                    console.error("No anchor mirror found.");
+                    process.exitCode = 1;
+                    return;
+                }
+                const { records, errors } = parseAnchorsContent(readFileSync(mirrorPath, "utf-8"));
+                for (const err of errors) {
+                    console.error(`# ${err}`);
+                }
+                for (const r of records.filter((r) => r.anchorSeq > since)) {
+                    // Records were persisted canonically; re-serialize the parsed
+                    // object canonically for byte-stable output.
+                    console.log(JSON.stringify(r));
+                }
+                if (errors.length > 0)
+                    process.exitCode = 1;
+                return;
+            }
+            case "export-bundle": {
+                const { bundle, errors, warnings } = buildBundle(root, args);
+                for (const warning of warnings) {
+                    console.error(warning);
+                }
+                if (bundle === null) {
+                    for (const err of errors) {
+                        console.error(err);
+                    }
+                    console.error("export-bundle: refusing to emit a partial bundle");
+                    process.exitCode = 1;
+                    return;
+                }
+                // Deliberately NOT wrapped in the {command, success, data} envelope
+                // under --json: a bundle is an interchange artifact fed straight to
+                // `usertrust verify --bundle -`, not a status report.
+                console.log(bundle);
+                return;
+            }
+            case "doctor": {
+                const reports = await doctorReports(args);
+                const failed = reports.some((r) => r.failed);
+                if (json) {
+                    console.log(JSON.stringify({
+                        command: "anchor doctor",
+                        success: !failed,
+                        data: { failed, reports },
+                    }));
+                }
+                else {
+                    printDoctor(reports);
+                }
+                if (failed)
+                    process.exitCode = 1;
+                return;
+            }
+            case "rotate": {
+                const identity = readAnchorIdentity(root);
+                if (identity === null) {
+                    console.log("No anchor identity. Run `usertrust anchor init` first.");
+                    process.exitCode = 1;
+                    return;
+                }
+                const successor = mintSuccessorKey(identity.vaultId);
+                const emitter = createAnchorEmitter(root, emitterConfig(args));
+                const result = await emitter.rotate({
+                    keyId: successor.keyId,
+                    publicKeySpki: successor.publicKeySpki,
+                });
+                await emitter.stop();
+                const rotateStatus = emitter.status();
+                if (!result.emitted) {
+                    if (json) {
+                        console.log(JSON.stringify({
+                            command: "anchor rotate",
+                            success: false,
+                            data: { reason: result.reason },
+                        }));
+                    }
+                    else {
+                        console.log(pc.red(`Rotation not emitted: ${result.reason}`));
+                    }
+                    process.exitCode = 1;
+                    return;
+                }
+                // The cross-signed record is already fsync'd into the local mirror,
+                // so identity.json MUST advance in lockstep — rolling it back would
+                // desync mirror vs identity. Undelivered-to-sink is surfaced loudly
+                // (exit 1 + recovery path) instead.
+                recordRotatedIdentity(root, {
+                    keyId: successor.keyId,
+                    publicKeySpki: successor.publicKeySpki,
+                });
+                const rotateDelivered = rotateStatus.outboxDepth === 0;
+                if (json) {
+                    console.log(JSON.stringify({
+                        command: "anchor rotate",
+                        success: rotateDelivered,
+                        data: {
+                            newKeyId: successor.keyId,
+                            keyFile: successor.keyFile,
+                            outboxDepth: rotateStatus.outboxDepth,
+                            delivered: rotateDelivered,
+                        },
+                    }));
+                    if (!rotateDelivered)
+                        process.exitCode = 1;
+                    return;
+                }
+                console.log(pc.green(`Rotation anchored (#${result.record?.anchorSeq}).`));
+                console.log(`  new keyId: ${successor.keyId}`);
+                console.log(`  new private key: ${successor.keyFile}`);
+                console.log("");
+                console.log("New public key (PEM) — distribute the fingerprint OUT-OF-BAND:");
+                console.log(successor.publicKeyPem.trim());
+                console.log("");
+                console.log(pc.bold("IMPORTANT:"));
+                console.log("  - Point USERTRUST_ANCHOR_KEY (or --key-file) at the NEW private key.");
+                console.log("  - Auditors keep pinning the ORIGINAL root key; give them this new");
+                console.log("    fingerprint as a --successor-pin so a hijacked rotation cannot pass.");
+                if (!rotateDelivered) {
+                    console.log("");
+                    console.log(pc.yellow(`WARNING: the rotation record was NOT delivered to any sink (outbox: ${rotateStatus.outboxDepth} pending).`));
+                    console.log(pc.yellow("  The store lacks the trust-chain handoff — anchors signed by the new key will not verify until it ships."));
+                    console.log(pc.yellow(`  Ship it: usertrust anchor export --since ${(result.record?.anchorSeq ?? 1) - 1}  (then re-run with a reachable sink)`));
+                    process.exitCode = 1;
+                }
+                return;
+            }
+            case "resume": {
+                const latest = flagValue(args, "--latest");
+                if (latest === undefined) {
+                    console.log("Usage: usertrust anchor resume --latest <record.json|->");
+                    process.exitCode = 1;
+                    return;
+                }
+                const raw = latest === "-" ? readFileSync(0, "utf-8") : readFileSync(latest, "utf-8");
+                const record = resumeAnchorMirror(root, raw);
+                console.log(json
+                    ? JSON.stringify({
+                        command: "anchor resume",
+                        success: true,
+                        data: { anchorSeq: record.anchorSeq },
+                    })
+                    : pc.green(`Mirror re-seeded at anchorSeq ${record.anchorSeq}.`));
+                return;
+            }
+            default: {
+                console.log(`Usage: usertrust anchor <init|now|status|export|export-bundle|doctor|rotate|resume>
+
+  init          [--key-file <path>]     Mint identity + Ed25519 key (outside the vault)
+  now           [sink flags]            Snapshot, sign, mirror, publish
+  status                                Last anchor, unanchored tail, outbox
+  export        [--since <anchorSeq>]   Print mirror records (pull-mode shipping)
+  export-bundle [--since <anchorSeq>]   Records + Rekor receipts for \`verify --bundle\`
+  doctor        [sink flags]            What can this identity delete/overwrite in the store?
+  rotate        [--key-file <path>]     Cross-signed key rotation
+  resume        --latest <record|->     Re-seed a lost mirror from the store
+
+Sink flags:
+  --sink-file <path>                    Append-only file store
+  --sink-url <url>                      Ingest endpoint (POST per record)
+  --sink-s3 bucket=B,region=R[,prefix=P][,endpoint=E]
+  --sink-rekor[=<url>]                  Rekor transparency log (default ${DEFAULT_REKOR_URL})`);
+                if (action !== undefined)
+                    process.exitCode = 1;
+                return;
+            }
+        }
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        if (json) {
+            console.log(JSON.stringify({ command: `anchor ${action ?? ""}`, success: false, data: { message } }));
+        }
+        else {
+            console.log(pc.red(message));
+        }
+        process.exitCode = 1;
+    }
+}
+//# sourceMappingURL=anchor.js.map

package/dist/cli/anchor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anchor.js","sourceRoot":"","sources":["../../src/cli/anchor.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAEN,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,GAElB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAqB,cAAc,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC5F,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAqB,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAGnD,MAAM,UAAU,GAAG,cAAc,CAAC;AAClC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;AACpE,sEAAsE;AACtE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC;AAC7E,qFAAqF;AACrF,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC,SAAS,aAAa,CAAC,IAAc;IACpC,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QAC9B,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,2DAA2D;YAC3D,oEAAoE;YACpE,gEAAgE;YAChE,kDAAkD;YAClD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1B,IAAI,KAAK,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,mBAAmB,CAAC,CAAC;YACpE,CAAC,EAAE,CAAC;YACJ,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;gBAC3B,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC3C,CAAC;iBAAM,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;gBACjC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;YAC3C,CAAC;iBAAM,CAAC;gBACP,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;YACnC,CAAC;QACF,CAAC;aAAM,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YAC/B,4DAA4D;YAC5D,sEAAsE;YACtE,mEAAmE;YACnE,oEAAoE;YACpE,0CAA0C;YAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvD,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,kCAAkC,UAAU,QAAQ,CAAC,CAAC;YACpF,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/B,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC,EAAE,CAAC;YAC7C,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC7C,IAAI,GAAG,KAAK,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,uBAAuB,CAAC,CAAC;YACtE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QACpC,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,0FAA0F;AAC1F,SAAS,cAAc,CAAC,IAAY;IACnC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,SAAS;QACjC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,uCAAuC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACd,2BAA2B,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,sCAAsC,CACjF,CAAC;QACH,CAAC;QACD,IAAI,KAAK,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,cAAc,GAAG,mBAAmB,CAAC,CAAC;QACxE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACrB,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IACpD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO;QACN,IAAI,EAAE,IAAI;QACV,MAAM;QACN,MAAM;QACN,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/C,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAc,EAAE,IAAY;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAChE,OAAO,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;AACtB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,IAAc;IACpC,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,GAAG,CAAC;IAC9C,OAAO,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACxE,CAAC;AAED,SAAS,aAAa,CAAC,IAAc;IACpC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvF,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAK,OAAkB,GAAG,CAAC,CAAC,EAAE,CAAC;QAC7F,mEAAmE;QACnE,oDAAoD;QACpD,MAAM,IAAI,KAAK,CAAC,8BAA8B,UAAU,0BAA0B,CAAC,CAAC;IACrF,CAAC;IACD,OAAO;QACN,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QAC5E,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC;QAC1B,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7D,CAAC;AACH,CAAC;AAED,eAAe;AAEf,8EAA8E;AAC9E,SAAS,SAAS,CAAC,IAAY,EAAE,MAAc;IAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AACrF,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAc;IAC1C,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACd,6FAA6F,CAC7F,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YACnB,KAAK,MAAM;gBACV,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;gBACxC,MAAM;YACP,KAAK,IAAI;gBACR,OAAO,CAAC,IAAI,CACX,MAAM,YAAY,CAAC;oBAClB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7D,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACnE,CAAC,CACF,CAAC;gBACF,MAAM;YACP,KAAK,OAAO;gBACX,OAAO,CAAC,IAAI,CACX,SAAS,CACR,SAAS,IAAI,CAAC,GAAG,EAAE,EACnB,uEAAuE;oBACtE,mEAAmE,CACpE,CACD,CAAC;gBACF,MAAM;YACP,KAAK,OAAO;gBACX,OAAO,CAAC,IAAI,CACX,SAAS,CACR,SAAS,IAAI,CAAC,GAAG,IAAI,iBAAiB,EAAE,EACxC,sEAAsE;oBACrE,gEAAgE,CACjE,CACD,CAAC;gBACF,MAAM;YACP,KAAK,SAAS;gBACb,OAAO,CAAC,IAAI,CACX,SAAS,CACR,WAAW,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAC/B,yCAAyC;oBACxC,0DAA0D,CAC3D,CACD,CAAC;gBACF,MAAM;QACR,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,OAAuB;IAC3C,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAW,CAAC;IACzE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC,CAAC;IACrF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,CACV,KAAK,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,EAAE,CACrF,CAAC;QACH,CAAC;IACF,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,oFAAoF,CAAC,CAAC;IAClG,OAAO,CAAC,GAAG,CAAC,+EAA+E,CAAC,CAAC;IAC7F,OAAO,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;AACnF,CAAC;AAYD;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,WAAW,CAAC,IAAY,EAAE,IAAc;IAChD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO;gBACN,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,CAAC,gDAAgD,CAAC;gBAC1D,QAAQ;aACR,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC,CAAC;QAC3D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,uCAAuC,CAAC,EAAE,QAAQ,EAAE,CAAC;QACtF,CAAC;QACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;QACtE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,0BAA0B,GAAG,EAAE,CAAC,CAAC;QAE9E,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO;aAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,KAAK,CAAC;aAClC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC;aACtC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,KAAK,CAAC;aAClC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAEjE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACnC,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC9C,QAAQ,CAAC,IAAI,CACZ,kDAAkD,CAAC,CAAC,SAAS,uBAAuB;gBACnF,sDAAsD,CACvD,CAAC;YACF,OAAO,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI;YAC3B,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC;YAC3B,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC;SACzB,EAAE,CAAC;YACZ,IAAI,KAAK,GAAG,gBAAgB,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CACV,kBAAkB,KAAK,IAAI,IAAI,gBAAgB,gBAAgB,oBAAoB;oBAClF,yCAAyC,CAC1C,CAAC;YACH,CAAC;QACF,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACjE,OAAO;YACN,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;YAClE,MAAM;YACN,QAAQ;SACR,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,kBAAkB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClF,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC3C,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,IAAY,EAAE,MAAgB;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC;SACjC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;SAClC,IAAI,EAAE,EAAE,CAAC;QACV,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACJ,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CACV,kBAAkB,IAAI,iBAAiB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAC1F,CAAC;YACF,SAAS;QACV,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,kBAAkB,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC;YAChD,SAAS;QACV,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAiB,EAAE,EAAE,IAAiB;IAC/D,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;IACjC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAEvB,IAAI,CAAC;QACJ,QAAQ,MAAM,EAAE,CAAC;YAChB,KAAK,MAAM,CAAC,CAAC,CAAC;gBACb,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;gBAC9C,MAAM,EACL,QAAQ,EACR,YAAY,EACZ,OAAO,EAAE,cAAc,GACvB,GAAG,kBAAkB,CAAC,IAAI,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBAC9E,IAAI,IAAI,EAAE,CAAC;oBACV,OAAO,CAAC,GAAG,CACV,IAAI,CAAC,SAAS,CAAC;wBACd,OAAO,EAAE,aAAa;wBACtB,OAAO,EAAE,IAAI;wBACb,IAAI,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE;qBACnF,CAAC,CACF,CAAC;oBACF,OAAO;gBACR,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC;gBAClD,OAAO,CAAC,GAAG,CAAC,cAAc,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC9C,OAAO,CAAC,GAAG,CAAC,cAAc,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC5C,OAAO,CAAC,GAAG,CAAC,kBAAkB,cAAc,uCAAuC,CAAC,CAAC;gBACrF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAChB,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;gBACxD,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;gBACjC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAChB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;gBACpC,OAAO,CAAC,GAAG,CAAC,4EAA4E,CAAC,CAAC;gBAC1F,OAAO,CAAC,GAAG,CACV,8FAA8F,CAC9F,CAAC;gBACF,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;gBAC9E,OAAO,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC;gBAC7E,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;gBACjF,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;gBAC3E,OAAO;YACR,CAAC;YACD,KAAK,KAAK,CAAC,CAAC,CAAC;gBACZ,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC/D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE,CAAC;gBACzC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;gBACrB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;gBAChC,IAAI,IAAI,EAAE,CAAC;oBACV,6DAA6D;oBAC7D,+DAA+D;oBAC/D,oDAAoD;oBACpD,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,KAAK,CAAC,CAAC;oBAC3C,OAAO,CAAC,GAAG,CACV,IAAI,CAAC,SAAS,CAAC;wBACd,OAAO,EAAE,YAAY;wBACrB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,SAAS;wBACpC,IAAI,EAAE,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE;qBAC/D,CAAC,CACF,CAAC;oBACF,IACC,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,KAAK,eAAe,CAAC;wBACtD,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,EAC7B,CAAC;wBACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;oBACtB,CAAC;oBACD,OAAO;gBACR,CAAC;gBACD,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;oBACrC,OAAO,CAAC,GAAG,CACV,EAAE,CAAC,KAAK,CACP,cAAc,MAAM,CAAC,MAAM,CAAC,SAAS,aAAa,MAAM,CAAC,MAAM,CAAC,QAAQ,SAAS,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CACzH,CACD,CAAC;oBACF,IAAI,MAAM,CAAC,WAAW,GAAG,CAAC,EAAE,CAAC;wBAC5B,OAAO,CAAC,GAAG,CACV,EAAE,CAAC,MAAM,CAAC,WAAW,MAAM,CAAC,WAAW,2CAA2C,CAAC,CACnF,CAAC;wBACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;oBACtB,CAAC;gBACF,CAAC;qBAAM,IAAI,MAAM,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;oBAC9C,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;gBACzE,CAAC;qBAAM,CAAC;oBACP,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;oBACxD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;gBACtB,CAAC;gBACD,OAAO;YACR,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACf,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;gBAC1C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;oBACvB,OAAO,CAAC,GAAG,CACV,IAAI;wBACH,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;4BACf,OAAO,EAAE,eAAe;4BACxB,OAAO,EAAE,KAAK;4BACd,IAAI,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE;yBACvC,CAAC;wBACH,CAAC,CAAC,wDAAwD,CAC3D,CAAC;oBACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;oBACrB,OAAO;gBACR,CAAC;gBACD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC,CAAC;gBAC3D,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC;oBACpC,CAAC,CAAC,mBAAmB,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;oBACxD,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;gBAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;gBACrF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAC;gBACrE,IAAI,OAAO,GAAG,CAAC,CAAC;gBAChB,IAAI,CAAC;oBACJ,OAAO,GAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAA0B,CAAC,QAAQ,CAAC;gBAC1F,CAAC;gBAAC,MAAM,CAAC;oBACR,0BAA0B;gBAC3B,CAAC;gBACD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChE,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;gBACnD,IAAI,WAAW,GAAG,CAAC,CAAC;gBACpB,IAAI,CAAC;oBACJ,WAAW,GAAG,UAAU,CAAC,SAAS,CAAC;wBAClC,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;6BAClF,MAAM;wBACT,CAAC,CAAC,CAAC,CAAC;gBACN,CAAC;gBAAC,MAAM,CAAC;oBACR,YAAY;gBACb,CAAC;gBACD,IAAI,IAAI,EAAE,CAAC;oBACV,OAAO,CAAC,GAAG,CACV,IAAI,CAAC,SAAS,CAAC;wBACd,OAAO,EAAE,eAAe;wBACxB,OAAO,EAAE,IAAI;wBACb,IAAI,EAAE;4BACL,OAAO,EAAE,QAAQ,CAAC,OAAO;4BACzB,KAAK,EAAE,QAAQ,CAAC,KAAK;4BACrB,UAAU,EAAE,IAAI;4BAChB,qBAAqB,EAAE,UAAU;4BACjC,WAAW;4BACX,YAAY,EAAE,MAAM,CAAC,MAAM;yBAC3B;qBACD,CAAC,CACF,CAAC;oBACF,OAAO;gBACR,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,YAAY,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC5C,OAAO,CAAC,GAAG,CAAC,YAAY,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC1C,IAAI,IAAI,EAAE,CAAC;oBACV,OAAO,CAAC,GAAG,CACV,iBAAiB,IAAI,CAAC,SAAS,aAAa,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,SAAS,GAAG,CAC/E,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACP,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;gBAClC,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,oBAAoB,UAAU,WAAW,CAAC,CAAC;gBACvD,OAAO,CAAC,GAAG,CAAC,WAAW,WAAW,UAAU,CAAC,CAAC;gBAC9C,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC9B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;oBACpE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;gBACtB,CAAC;gBACD,OAAO;YACR,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACf,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;gBAClC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;oBACpB,OAAO,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;oBACzD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;oBACrB,OAAO;gBACR,CAAC;gBACD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC,CAAC;gBAC3D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC7B,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;oBACzC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;oBACrB,OAAO;gBACR,CAAC;gBACD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;gBACnF,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;oBAC1B,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;gBAC3B,CAAC;gBACD,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,KAAK,CAAC,EAAE,CAAC;oBAC5D,8DAA8D;oBAC9D,6CAA6C;oBAC7C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;gBAChC,CAAC;gBACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;gBAC5C,OAAO;YACR,CAAC;YACD,KAAK,eAAe,CAAC,CAAC,CAAC;gBACtB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBAC7D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;oBAChC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACxB,CAAC;gBACD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;oBACrB,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;wBAC1B,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBACpB,CAAC;oBACD,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;oBAClE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;oBACrB,OAAO;gBACR,CAAC;gBACD,oEAAoE;gBACpE,oEAAoE;gBACpE,sDAAsD;gBACtD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACpB,OAAO;YACR,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACf,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;gBAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBAC7C,IAAI,IAAI,EAAE,CAAC;oBACV,OAAO,CAAC,GAAG,CACV,IAAI,CAAC,SAAS,CAAC;wBACd,OAAO,EAAE,eAAe;wBACxB,OAAO,EAAE,CAAC,MAAM;wBAChB,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;qBACzB,CAAC,CACF,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACP,WAAW,CAAC,OAAO,CAAC,CAAC;gBACtB,CAAC;gBACD,IAAI,MAAM;oBAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;gBACjC,OAAO;YACR,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACf,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;gBAC1C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;oBACvB,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;oBACtE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;oBACrB,OAAO;gBACR,CAAC;gBACD,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACrD,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC/D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC;oBACnC,KAAK,EAAE,SAAS,CAAC,KAAK;oBACtB,aAAa,EAAE,SAAS,CAAC,aAAa;iBACtC,CAAC,CAAC;gBACH,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;gBACrB,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;gBACtC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBACrB,IAAI,IAAI,EAAE,CAAC;wBACV,OAAO,CAAC,GAAG,CACV,IAAI,CAAC,SAAS,CAAC;4BACd,OAAO,EAAE,eAAe;4BACxB,OAAO,EAAE,KAAK;4BACd,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;yBAC/B,CAAC,CACF,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACP,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,yBAAyB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;oBAC/D,CAAC;oBACD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;oBACrB,OAAO;gBACR,CAAC;gBACD,oEAAoE;gBACpE,oEAAoE;gBACpE,oEAAoE;gBACpE,oCAAoC;gBACpC,qBAAqB,CAAC,IAAI,EAAE;oBAC3B,KAAK,EAAE,SAAS,CAAC,KAAK;oBACtB,aAAa,EAAE,SAAS,CAAC,aAAa;iBACtC,CAAC,CAAC;gBACH,MAAM,eAAe,GAAG,YAAY,CAAC,WAAW,KAAK,CAAC,CAAC;gBACvD,IAAI,IAAI,EAAE,CAAC;oBACV,OAAO,CAAC,GAAG,CACV,IAAI,CAAC,SAAS,CAAC;wBACd,OAAO,EAAE,eAAe;wBACxB,OAAO,EAAE,eAAe;wBACxB,IAAI,EAAE;4BACL,QAAQ,EAAE,SAAS,CAAC,KAAK;4BACzB,OAAO,EAAE,SAAS,CAAC,OAAO;4BAC1B,WAAW,EAAE,YAAY,CAAC,WAAW;4BACrC,SAAS,EAAE,eAAe;yBAC1B;qBACD,CAAC,CACF,CAAC;oBACF,IAAI,CAAC,eAAe;wBAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;oBAC3C,OAAO;gBACR,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,uBAAuB,MAAM,CAAC,MAAM,EAAE,SAAS,IAAI,CAAC,CAAC,CAAC;gBAC3E,OAAO,CAAC,GAAG,CAAC,gBAAgB,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC/C,OAAO,CAAC,GAAG,CAAC,sBAAsB,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;gBACvD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAChB,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;gBAC9E,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC3C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAChB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;gBACnC,OAAO,CAAC,GAAG,CAAC,wEAAwE,CAAC,CAAC;gBACtF,OAAO,CAAC,GAAG,CAAC,qEAAqE,CAAC,CAAC;gBACnF,OAAO,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAC;gBACxF,IAAI,CAAC,eAAe,EAAE,CAAC;oBACtB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAChB,OAAO,CAAC,GAAG,CACV,EAAE,CAAC,MAAM,CACR,uEAAuE,YAAY,CAAC,WAAW,YAAY,CAC3G,CACD,CAAC;oBACF,OAAO,CAAC,GAAG,CACV,EAAE,CAAC,MAAM,CACR,2GAA2G,CAC3G,CACD,CAAC;oBACF,OAAO,CAAC,GAAG,CACV,EAAE,CAAC,MAAM,CACR,8CAA8C,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,IAAI,CAAC,CAAC,GAAG,CAAC,uCAAuC,CACxH,CACD,CAAC;oBACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;gBACtB,CAAC;gBACD,OAAO;YACR,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACf,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;gBAC3C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBAC1B,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;oBACvE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;oBACrB,OAAO;gBACR,CAAC;gBACD,MAAM,GAAG,GAAG,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBACtF,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBAC7C,OAAO,CAAC,GAAG,CACV,IAAI;oBACH,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;wBACf,OAAO,EAAE,eAAe;wBACxB,OAAO,EAAE,IAAI;wBACb,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE;qBACrC,CAAC;oBACH,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,iCAAiC,MAAM,CAAC,SAAS,GAAG,CAAC,CACjE,CAAC;gBACF,OAAO;YACR,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACT,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;0EAe0D,iBAAiB,GAAG,CAAC,CAAC;gBAC5F,IAAI,MAAM,KAAK,SAAS;oBAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;gBAC/C,OAAO;YACR,CAAC;QACF,CAAC;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CACV,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,UAAU,MAAM,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CACxF,CAAC;QACH,CAAC;aAAM,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACtB,CAAC;AACF,CAAC"}