@agent-deck/backend 1.10.0 → 1.10.2

package/dist/execution-authority/ledger.js

@@ -0,0 +1,507 @@
+"use strict";
+/**
+ * In-memory execution-authority ledger (NOT-85 logic engine).
+ * Durable SQLite wrapper: `ExecutionAuthorityStore` (NOT-86).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ExecutionAuthorityLedger = void 0;
+const node_crypto_1 = require("node:crypto");
+const shared_1 = require("@agent-deck/shared");
+const store_1 = require("../trusted-session/store");
+function newId(kind) {
+    return (0, shared_1.prefixTrustedId)(kind, (0, node_crypto_1.randomUUID)());
+}
+function cloneAuthority(authority) {
+    return {
+        ...authority,
+        allowedServices: [...authority.allowedServices],
+        allowedTools: authority.allowedTools.map((t) => ({ ...t })),
+    };
+}
+function toolsEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    const key = (t) => `${t.serviceId}\0${t.toolName}`;
+    const sortedA = [...a].map(key).sort();
+    const sortedB = [...b].map(key).sort();
+    return sortedA.every((v, i) => v === sortedB[i]);
+}
+function mintParamsMatch(existing, input) {
+    const storedTtlMs = Date.parse(existing.expiresAt) - Date.parse(existing.issuedAt);
+    return (existing.runId === input.runId &&
+        existing.attemptId === input.attemptId &&
+        existing.deckId === input.deckId &&
+        existing.audience === input.audience &&
+        storedTtlMs === input.ttlMs &&
+        existing.allowedServices.length === input.allowedServices.length &&
+        existing.allowedServices.every((s) => input.allowedServices.includes(s)) &&
+        toolsEqual(existing.allowedTools, input.allowedTools));
+}
+/**
+ * Deck-side authorization ledger (skeleton). Authoritative for enrollment and
+ * execution authority; does not model Dealer run lifecycle.
+ */
+class ExecutionAuthorityLedger {
+    enrollments = new Map();
+    enrollmentSecretHashes = new Map();
+    authorities = new Map();
+    secretHashes = new Map();
+    mintIndex = new Map(); // enrollmentId\0idempotencyKey -> authorityId
+    audit = [];
+    now;
+    constructor(options = {}) {
+        this.now = options.now ?? (() => new Date());
+    }
+    exportState() {
+        return {
+            enrollments: [...this.enrollments.values()].map((e) => ({
+                ...e,
+                allowedDeckIds: [...e.allowedDeckIds],
+            })),
+            enrollmentSecretHashes: [...this.enrollmentSecretHashes.entries()].map(([enrollmentId, secretHash]) => ({ enrollmentId, secretHash })),
+            authorities: [...this.authorities.values()].map(cloneAuthority),
+            secretHashes: [...this.secretHashes.entries()].map(([authorityId, secretHash]) => ({
+                authorityId,
+                secretHash,
+            })),
+            mintIndex: [...this.mintIndex.entries()].map(([key, authorityId]) => {
+                const [enrollmentId, idempotencyKey] = key.split('\0');
+                return { enrollmentId, idempotencyKey, authorityId };
+            }),
+            audit: this.audit.map((event) => ({
+                ...event,
+                correlation: { ...event.correlation },
+                detail: event.detail ? { ...event.detail } : undefined,
+            })),
+        };
+    }
+    replaceState(state) {
+        this.enrollments.clear();
+        this.enrollmentSecretHashes.clear();
+        this.authorities.clear();
+        this.secretHashes.clear();
+        this.mintIndex.clear();
+        this.audit.length = 0;
+        for (const enrollment of state.enrollments) {
+            this.enrollments.set(enrollment.enrollmentId, {
+                ...enrollment,
+                allowedDeckIds: [...enrollment.allowedDeckIds],
+            });
+        }
+        for (const row of state.enrollmentSecretHashes) {
+            this.enrollmentSecretHashes.set(row.enrollmentId, row.secretHash);
+        }
+        for (const authority of state.authorities) {
+            this.authorities.set(authority.authorityId, cloneAuthority(authority));
+        }
+        for (const row of state.secretHashes) {
+            this.secretHashes.set(row.authorityId, row.secretHash);
+        }
+        for (const row of state.mintIndex) {
+            this.mintIndex.set(`${row.enrollmentId}\0${row.idempotencyKey}`, row.authorityId);
+        }
+        for (const event of state.audit) {
+            this.audit.push({
+                ...event,
+                correlation: { ...event.correlation },
+                detail: event.detail ? { ...event.detail } : undefined,
+            });
+        }
+    }
+    getEnrollment(enrollmentId) {
+        const enrollment = this.enrollments.get(enrollmentId);
+        if (!enrollment)
+            return undefined;
+        return { ...enrollment, allowedDeckIds: [...enrollment.allowedDeckIds] };
+    }
+    listEnrollments() {
+        return [...this.enrollments.values()].map((e) => ({
+            ...e,
+            allowedDeckIds: [...e.allowedDeckIds],
+        }));
+    }
+    verifyEnrollmentSecret(enrollmentId, secret) {
+        const hash = this.enrollmentSecretHashes.get(enrollmentId);
+        if (!hash)
+            return false;
+        return (0, store_1.verifyGrantSecret)(secret, hash);
+    }
+    verifyAuthoritySecret(authorityId, secret) {
+        const hash = this.secretHashes.get(authorityId);
+        if (!hash)
+            return false;
+        return (0, store_1.verifyGrantSecret)(secret, hash);
+    }
+    enrollCoordinator(input) {
+        const enrollment = {
+            enrollmentId: newId('enr'),
+            coordinatorId: input.coordinatorId,
+            status: 'active',
+            allowedDeckIds: [...input.allowedDeckIds],
+            createdAt: this.now().toISOString(),
+            revokedAt: null,
+        };
+        const enrollmentSecret = `enrs_${(0, node_crypto_1.randomUUID)().replace(/-/g, '')}${(0, node_crypto_1.randomUUID)().replace(/-/g, '')}`;
+        this.enrollments.set(enrollment.enrollmentId, enrollment);
+        this.enrollmentSecretHashes.set(enrollment.enrollmentId, (0, store_1.hashGrantSecret)(enrollmentSecret));
+        this.pushAudit('enrollment_created', {
+            enrollmentId: enrollment.enrollmentId,
+        }, { coordinatorId: input.coordinatorId });
+        return {
+            ok: true,
+            data: {
+                enrollment: {
+                    ...enrollment,
+                    allowedDeckIds: [...enrollment.allowedDeckIds],
+                },
+                enrollmentSecret,
+            },
+        };
+    }
+    revokeEnrollment(enrollmentId) {
+        const enrollment = this.enrollments.get(enrollmentId);
+        if (!enrollment) {
+            return {
+                ok: false,
+                error_code: 'COORDINATOR_NOT_ENROLLED',
+                message: 'Unknown enrollment',
+                correlation: { enrollmentId },
+            };
+        }
+        if (enrollment.status === 'revoked') {
+            return { ok: true, data: { enrollmentId } };
+        }
+        enrollment.status = 'revoked';
+        enrollment.revokedAt = this.now().toISOString();
+        this.pushAudit('enrollment_revoked', { enrollmentId });
+        for (const stored of this.authorities.values()) {
+            if (stored.enrollmentId !== enrollmentId)
+                continue;
+            const authority = this.refreshAuthorityStatus(stored.authorityId);
+            if (!authority || authority.status !== 'live')
+                continue;
+            authority.status = 'revoked';
+            this.pushAudit('authority_revoked', {
+                enrollmentId,
+                authorityId: authority.authorityId,
+                runId: authority.runId,
+                attemptId: authority.attemptId,
+                deckId: authority.deckId,
+            }, { reason: 'enrollment_revoked' });
+        }
+        return { ok: true, data: { enrollmentId } };
+    }
+    mintAuthority(input) {
+        if (!(input.ttlMs > 0)) {
+            return {
+                ok: false,
+                error_code: 'INVALID_MINT_REQUEST',
+                message: 'ttlMs must be positive',
+                reason: 'ttl_non_positive',
+                correlation: { enrollmentId: input.enrollmentId },
+            };
+        }
+        const enrollment = this.enrollments.get(input.enrollmentId);
+        if (!enrollment) {
+            return {
+                ok: false,
+                error_code: 'COORDINATOR_NOT_ENROLLED',
+                message: 'Unknown enrollment',
+                correlation: { enrollmentId: input.enrollmentId },
+            };
+        }
+        if (enrollment.status !== 'active') {
+            return {
+                ok: false,
+                error_code: 'ENROLLMENT_REVOKED',
+                message: 'Enrollment is revoked',
+                correlation: { enrollmentId: input.enrollmentId },
+            };
+        }
+        if (!enrollment.allowedDeckIds.includes(input.deckId)) {
+            return {
+                ok: false,
+                error_code: 'RESOURCE_OUT_OF_SCOPE',
+                message: 'Deck not permitted for this enrollment',
+                reason: 'deck_not_permitted',
+                correlation: { enrollmentId: input.enrollmentId, deckId: input.deckId },
+            };
+        }
+        const mintKey = `${input.enrollmentId}\0${input.idempotencyKey}`;
+        const existingId = this.mintIndex.get(mintKey);
+        if (existingId) {
+            const existing = this.refreshAuthorityStatus(existingId);
+            if (!mintParamsMatch(existing, input)) {
+                return {
+                    ok: false,
+                    error_code: 'IDEMPOTENCY_KEY_CONFLICT',
+                    message: 'Idempotency key reused with different mint parameters',
+                    reason: 'params_mismatch',
+                    correlation: {
+                        enrollmentId: existing.enrollmentId,
+                        authorityId: existing.authorityId,
+                        runId: existing.runId,
+                        attemptId: existing.attemptId,
+                        deckId: existing.deckId,
+                    },
+                };
+            }
+            if (existing.status === 'live') {
+                // Idempotent remint does not re-issue the secret (Dealer must retain launcher handle).
+                return {
+                    ok: true,
+                    data: {
+                        authority: cloneAuthority(existing),
+                        authoritySecret: null,
+                        secretIssued: false,
+                    },
+                };
+            }
+            return {
+                ok: false,
+                error_code: existing.status === 'expired' ? 'AUTHORITY_EXPIRED' : 'AUTHORITY_REVOKED',
+                message: `Authority already ${existing.status}`,
+                reason: existing.status === 'revoked' ? 'explicit_revoke' : undefined,
+                correlation: {
+                    enrollmentId: existing.enrollmentId,
+                    authorityId: existing.authorityId,
+                    runId: existing.runId,
+                    attemptId: existing.attemptId,
+                    deckId: existing.deckId,
+                },
+            };
+        }
+        const issuedAt = this.now();
+        const authority = {
+            authorityId: newId('authz'),
+            enrollmentId: input.enrollmentId,
+            runId: input.runId,
+            attemptId: input.attemptId,
+            deckId: input.deckId,
+            audience: input.audience,
+            allowedServices: [...input.allowedServices],
+            allowedTools: input.allowedTools.map((t) => ({ ...t })),
+            issuedAt: issuedAt.toISOString(),
+            expiresAt: new Date(issuedAt.getTime() + input.ttlMs).toISOString(),
+            status: 'live',
+            idempotencyKey: input.idempotencyKey,
+        };
+        const authoritySecret = `seas_${(0, node_crypto_1.randomUUID)().replace(/-/g, '')}${(0, node_crypto_1.randomUUID)().replace(/-/g, '')}`;
+        this.authorities.set(authority.authorityId, authority);
+        this.secretHashes.set(authority.authorityId, (0, store_1.hashGrantSecret)(authoritySecret));
+        this.mintIndex.set(mintKey, authority.authorityId);
+        this.pushAudit('authority_minted', {
+            enrollmentId: authority.enrollmentId,
+            authorityId: authority.authorityId,
+            runId: authority.runId,
+            attemptId: authority.attemptId,
+            deckId: authority.deckId,
+        });
+        return {
+            ok: true,
+            data: {
+                authority: cloneAuthority(authority),
+                authoritySecret,
+                secretIssued: true,
+            },
+        };
+    }
+    /**
+     * Non-auditing lookup for ownership / existence checks.
+     * Does not refresh expiry (avoids authority_expired side effects during probes).
+     */
+    peekAuthority(authorityId) {
+        const authority = this.authorities.get(authorityId);
+        return authority ? cloneAuthority(authority) : undefined;
+    }
+    inspectAuthority(authorityId) {
+        const authority = this.refreshAuthorityStatus(authorityId);
+        if (!authority) {
+            return {
+                ok: false,
+                error_code: 'AUTHORITY_UNKNOWN',
+                message: 'Unknown authority',
+                correlation: { authorityId },
+            };
+        }
+        this.pushAudit('authority_inspected', {
+            enrollmentId: authority.enrollmentId,
+            authorityId: authority.authorityId,
+            runId: authority.runId,
+            attemptId: authority.attemptId,
+            deckId: authority.deckId,
+        });
+        return { ok: true, data: cloneAuthority(authority) };
+    }
+    revokeAuthority(authorityId) {
+        const authority = this.authorities.get(authorityId);
+        if (!authority) {
+            return {
+                ok: false,
+                error_code: 'AUTHORITY_UNKNOWN',
+                message: 'Unknown authority',
+                correlation: { authorityId },
+            };
+        }
+        if (authority.status !== 'revoked') {
+            authority.status = 'revoked';
+            this.pushAudit('authority_revoked', {
+                enrollmentId: authority.enrollmentId,
+                authorityId: authority.authorityId,
+                runId: authority.runId,
+                attemptId: authority.attemptId,
+                deckId: authority.deckId,
+            }, { reason: 'explicit_revoke' });
+        }
+        return { ok: true, data: { authorityId } };
+    }
+    /**
+     * Simulate one authorized Deck tool call under execution authority.
+     * Never waits for human approval — returns INTERACTION_REQUIRED immediately.
+     */
+    invokeAuthorizedCall(input) {
+        const authority = this.refreshAuthorityStatus(input.authorityId);
+        const correlation = {
+            authorityId: input.authorityId,
+        };
+        if (!authority) {
+            return {
+                ok: false,
+                error_code: 'AUTHORITY_UNKNOWN',
+                message: 'Unknown authority',
+                correlation,
+            };
+        }
+        correlation.enrollmentId = authority.enrollmentId;
+        correlation.runId = authority.runId;
+        correlation.attemptId = authority.attemptId;
+        correlation.deckId = authority.deckId;
+        const expectedHash = this.secretHashes.get(authority.authorityId);
+        if (!expectedHash || !(0, store_1.verifyGrantSecret)(input.authoritySecret, expectedHash)) {
+            this.pushAudit('call_denied', correlation, { reason: 'bad_secret' });
+            return {
+                ok: false,
+                error_code: 'AUTHORITY_SECRET_INVALID',
+                message: 'Invalid authority secret',
+                correlation,
+            };
+        }
+        if (input.audience !== authority.audience) {
+            this.pushAudit('call_denied', correlation, {
+                reason: 'audience_mismatch',
+                expected: authority.audience,
+                actual: input.audience,
+            });
+            return {
+                ok: false,
+                error_code: 'AUDIENCE_MISMATCH',
+                message: 'Caller audience does not match authority audience',
+                correlation,
+            };
+        }
+        if (authority.status === 'expired') {
+            this.pushAudit('call_denied', correlation, { reason: 'expired' });
+            return {
+                ok: false,
+                error_code: 'AUTHORITY_EXPIRED',
+                message: 'Authority expired',
+                correlation,
+            };
+        }
+        if (authority.status === 'revoked') {
+            this.pushAudit('call_denied', correlation, { reason: 'revoked' });
+            return {
+                ok: false,
+                error_code: 'AUTHORITY_REVOKED',
+                message: 'Authority revoked',
+                reason: 'explicit_revoke',
+                correlation,
+            };
+        }
+        if (input.requiresInteraction) {
+            const requestId = newId('req');
+            correlation.requestId = requestId;
+            this.pushAudit('call_denied', correlation, { reason: 'interaction_required' });
+            return {
+                ok: false,
+                error_code: 'INTERACTION_REQUIRED',
+                message: 'Control-plane decision required; do not hold the worker',
+                correlation,
+            };
+        }
+        if (!this.toolAllowed(authority, input.serviceId, input.toolName)) {
+            this.pushAudit('call_denied', correlation, {
+                reason: 'tool_not_in_snapshot',
+                serviceId: input.serviceId,
+                toolName: input.toolName,
+            });
+            return {
+                ok: false,
+                error_code: 'RESOURCE_OUT_OF_SCOPE',
+                message: 'Tool not in authority snapshot',
+                reason: 'tool_not_in_snapshot',
+                correlation,
+            };
+        }
+        this.pushAudit('call_allowed', correlation, {
+            serviceId: input.serviceId,
+            toolName: input.toolName,
+        });
+        return {
+            ok: true,
+            data: {
+                serviceId: input.serviceId,
+                toolName: input.toolName,
+                result: 'ok',
+            },
+        };
+    }
+    listAuditEvents(filter = {}) {
+        return this.audit.filter((event) => {
+            const c = event.correlation;
+            if (filter.runId && c.runId !== filter.runId)
+                return false;
+            if (filter.attemptId && c.attemptId !== filter.attemptId)
+                return false;
+            if (filter.authorityId && c.authorityId !== filter.authorityId)
+                return false;
+            if (filter.enrollmentId && c.enrollmentId !== filter.enrollmentId)
+                return false;
+            if (filter.requestId && c.requestId !== filter.requestId)
+                return false;
+            return true;
+        });
+    }
+    toolAllowed(authority, serviceId, toolName) {
+        if (!authority.allowedServices.includes(serviceId))
+            return false;
+        return authority.allowedTools.some((t) => t.serviceId === serviceId && t.toolName === toolName);
+    }
+    refreshAuthorityStatus(authorityId) {
+        const authority = this.authorities.get(authorityId);
+        if (!authority)
+            return undefined;
+        if (authority.status === 'live' && Date.parse(authority.expiresAt) <= this.now().getTime()) {
+            authority.status = 'expired';
+            this.pushAudit('authority_expired', {
+                enrollmentId: authority.enrollmentId,
+                authorityId: authority.authorityId,
+                runId: authority.runId,
+                attemptId: authority.attemptId,
+                deckId: authority.deckId,
+            });
+        }
+        return authority;
+    }
+    pushAudit(kind, correlation, detail) {
+        this.audit.push({
+            eventId: newId('evt'),
+            at: this.now().toISOString(),
+            kind,
+            correlation: { ...correlation },
+            detail,
+        });
+    }
+}
+exports.ExecutionAuthorityLedger = ExecutionAuthorityLedger;
+//# sourceMappingURL=ledger.js.map

package/dist/execution-authority/ledger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger.js","sourceRoot":"","sources":["../../src/execution-authority/ledger.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEH,6CAAyC;AAEzC,+CAAqD;AAErD,oDAA8E;AAe9E,SAAS,KAAK,CAAC,IAAqC;IAClD,OAAO,IAAA,wBAAe,EAAC,IAAI,EAAE,IAAA,wBAAU,GAAE,CAAC,CAAC;AAC7C,CAAC;AAYD,SAAS,cAAc,CAAC,SAA6B;IACnD,OAAO;QACL,GAAG,SAAS;QACZ,eAAe,EAAE,CAAC,GAAG,SAAS,CAAC,eAAe,CAAC;QAC/C,YAAY,EAAE,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,CAAgB,EAAE,CAAgB;IACpD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,GAAG,GAAG,CAAC,CAAc,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;IAChE,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,eAAe,CAAC,QAA4B,EAAE,KAAyB;IAC9E,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnF,OAAO,CACL,QAAQ,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;QAC9B,QAAQ,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;QACtC,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAChC,QAAQ,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QACpC,WAAW,KAAK,KAAK,CAAC,KAAK;QAC3B,QAAQ,CAAC,eAAe,CAAC,MAAM,KAAK,KAAK,CAAC,eAAe,CAAC,MAAM;QAChE,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACxE,UAAU,CAAC,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC,CACtD,CAAC;AACJ,CAAC;AAOD;;;GAGG;AACH,MAAa,wBAAwB;IAClB,WAAW,GAAG,IAAI,GAAG,EAAiC,CAAC;IACvD,sBAAsB,GAAG,IAAI,GAAG,EAAkB,CAAC;IACnD,WAAW,GAAG,IAAI,GAAG,EAA8B,CAAC;IACpD,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,8CAA8C;IACrF,KAAK,GAAiB,EAAE,CAAC;IACzB,GAAG,CAAa;IAEjC,YAAY,UAA2C,EAAE;QACvD,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,WAAW;QACT,OAAO;YACL,WAAW,EAAE,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtD,GAAG,CAAC;gBACJ,cAAc,EAAE,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC;aACtC,CAAC,CAAC;YACH,sBAAsB,EAAE,CAAC,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CACpE,CAAC,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAC/D;YACD,WAAW,EAAE,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC;YAC/D,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;gBACjF,WAAW;gBACX,UAAU;aACX,CAAC,CAAC;YACH,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,EAAE;gBAClE,MAAM,CAAC,YAAY,EAAE,cAAc,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACvD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC;YACvD,CAAC,CAAC;YACF,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAChC,GAAG,KAAK;gBACR,WAAW,EAAE,EAAE,GAAG,KAAK,CAAC,WAAW,EAAE;gBACrC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS;aACvD,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;IAED,YAAY,CAAC,KAAkB;QAC7B,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,CAAC;QACpC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QACtB,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YAC3C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,EAAE;gBAC5C,GAAG,UAAU;gBACb,cAAc,EAAE,CAAC,GAAG,UAAU,CAAC,cAAc,CAAC;aAC/C,CAAC,CAAC;QACL,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,sBAAsB,EAAE,CAAC;YAC/C,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QACpE,CAAC;QACD,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YAC1C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC;QACzE,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YACrC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QACzD,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,YAAY,KAAK,GAAG,CAAC,cAAc,EAAE,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;QACpF,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;gBACd,GAAG,KAAK;gBACR,WAAW,EAAE,EAAE,GAAG,KAAK,CAAC,WAAW,EAAE;gBACrC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS;aACvD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,aAAa,CAAC,YAAoB;QAChC,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,CAAC,UAAU;YAAE,OAAO,SAAS,CAAC;QAClC,OAAO,EAAE,GAAG,UAAU,EAAE,cAAc,EAAE,CAAC,GAAG,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;IAC3E,CAAC;IAED,eAAe;QACb,OAAO,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChD,GAAG,CAAC;YACJ,cAAc,EAAE,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC;SACtC,CAAC,CAAC,CAAC;IACN,CAAC;IAED,sBAAsB,CAAC,YAAoB,EAAE,MAAc;QACzD,MAAM,IAAI,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,OAAO,IAAA,yBAAiB,EAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,qBAAqB,CAAC,WAAmB,EAAE,MAAc;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,OAAO,IAAA,yBAAiB,EAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,iBAAiB,CAAC,KAGjB;QACC,MAAM,UAAU,GAA0B;YACxC,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC;YAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,MAAM,EAAE,QAAQ;YAChB,cAAc,EAAE,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC;YACzC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;YACnC,SAAS,EAAE,IAAI;SAChB,CAAC;QACF,MAAM,gBAAgB,GAAG,QAAQ,IAAA,wBAAU,GAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAA,wBAAU,GAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;QACnG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAC1D,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,EAAE,IAAA,uBAAe,EAAC,gBAAgB,CAAC,CAAC,CAAC;QAC5F,IAAI,CAAC,SAAS,CAAC,oBAAoB,EAAE;YACnC,YAAY,EAAE,UAAU,CAAC,YAAY;SACtC,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC;QAC3C,OAAO;YACL,EAAE,EAAE,IAAI;YACR,IAAI,EAAE;gBACJ,UAAU,EAAE;oBACV,GAAG,UAAU;oBACb,cAAc,EAAE,CAAC,GAAG,UAAU,CAAC,cAAc,CAAC;iBAC/C;gBACD,gBAAgB;aACjB;SACF,CAAC;IACJ,CAAC;IAED,gBAAgB,CAAC,YAAoB;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,0BAA0B;gBACtC,OAAO,EAAE,oBAAoB;gBAC7B,WAAW,EAAE,EAAE,YAAY,EAAE;aAC9B,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,YAAY,EAAE,EAAE,CAAC;QAC9C,CAAC;QACD,UAAU,CAAC,MAAM,GAAG,SAAS,CAAC;QAC9B,UAAU,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QAChD,IAAI,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;QAEvD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/C,IAAI,MAAM,CAAC,YAAY,KAAK,YAAY;gBAAE,SAAS;YACnD,MAAM,SAAS,GAAG,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAClE,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM;gBAAE,SAAS;YACxD,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC;YAC7B,IAAI,CAAC,SAAS,CAAC,mBAAmB,EAAE;gBAClC,YAAY;gBACZ,WAAW,EAAE,SAAS,CAAC,WAAW;gBAClC,KAAK,EAAE,SAAS,CAAC,KAAK;gBACtB,SAAS,EAAE,SAAS,CAAC,SAAS;gBAC9B,MAAM,EAAE,SAAS,CAAC,MAAM;aACzB,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,YAAY,EAAE,EAAE,CAAC;IAC9C,CAAC;IAED,aAAa,CAAC,KAAyB;QACrC,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;YACvB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,sBAAsB;gBAClC,OAAO,EAAE,wBAAwB;gBACjC,MAAM,EAAE,kBAAkB;gBAC1B,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE;aAClD,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC5D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,0BAA0B;gBACtC,OAAO,EAAE,oBAAoB;gBAC7B,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE;aAClD,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,oBAAoB;gBAChC,OAAO,EAAE,uBAAuB;gBAChC,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE;aAClD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACtD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,uBAAuB;gBACnC,OAAO,EAAE,wCAAwC;gBACjD,MAAM,EAAE,oBAAoB;gBAC5B,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;aACxE,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,GAAG,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,cAAc,EAAE,CAAC;QACjE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAE,CAAC;YAC1D,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;gBACtC,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,UAAU,EAAE,0BAA0B;oBACtC,OAAO,EAAE,uDAAuD;oBAChE,MAAM,EAAE,iBAAiB;oBACzB,WAAW,EAAE;wBACX,YAAY,EAAE,QAAQ,CAAC,YAAY;wBACnC,WAAW,EAAE,QAAQ,CAAC,WAAW;wBACjC,KAAK,EAAE,QAAQ,CAAC,KAAK;wBACrB,SAAS,EAAE,QAAQ,CAAC,SAAS;wBAC7B,MAAM,EAAE,QAAQ,CAAC,MAAM;qBACxB;iBACF,CAAC;YACJ,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC/B,uFAAuF;gBACvF,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,IAAI,EAAE;wBACJ,SAAS,EAAE,cAAc,CAAC,QAAQ,CAAC;wBACnC,eAAe,EAAE,IAAI;wBACrB,YAAY,EAAE,KAAK;qBACpB;iBACF,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,mBAAmB;gBACrF,OAAO,EAAE,qBAAqB,QAAQ,CAAC,MAAM,EAAE;gBAC/C,MAAM,EAAE,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS;gBACrE,WAAW,EAAE;oBACX,YAAY,EAAE,QAAQ,CAAC,YAAY;oBACnC,WAAW,EAAE,QAAQ,CAAC,WAAW;oBACjC,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,SAAS,EAAE,QAAQ,CAAC,SAAS;oBAC7B,MAAM,EAAE,QAAQ,CAAC,MAAM;iBACxB;aACF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAuB;YACpC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC;YAC3B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,eAAe,EAAE,CAAC,GAAG,KAAK,CAAC,eAAe,CAAC;YAC3C,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YACvD,QAAQ,EAAE,QAAQ,CAAC,WAAW,EAAE;YAChC,SAAS,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE;YACnE,MAAM,EAAE,MAAM;YACd,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC;QACF,MAAM,eAAe,GAAG,QAAQ,IAAA,wBAAU,GAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAA,wBAAU,GAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;QAClG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACvD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,IAAA,uBAAe,EAAC,eAAe,CAAC,CAAC,CAAC;QAC/E,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC;QACnD,IAAI,CAAC,SAAS,CAAC,kBAAkB,EAAE;YACjC,YAAY,EAAE,SAAS,CAAC,YAAY;YACpC,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,MAAM,EAAE,SAAS,CAAC,MAAM;SACzB,CAAC,CAAC;QACH,OAAO;YACL,EAAE,EAAE,IAAI;YACR,IAAI,EAAE;gBACJ,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;gBACpC,eAAe;gBACf,YAAY,EAAE,IAAI;aACnB;SACF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,aAAa,CAAC,WAAmB;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACpD,OAAO,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3D,CAAC;IAED,gBAAgB,CAAC,WAAmB;QAClC,MAAM,SAAS,GAAG,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;QAC3D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,mBAAmB;gBAC/B,OAAO,EAAE,mBAAmB;gBAC5B,WAAW,EAAE,EAAE,WAAW,EAAE;aAC7B,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,qBAAqB,EAAE;YACpC,YAAY,EAAE,SAAS,CAAC,YAAY;YACpC,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,MAAM,EAAE,SAAS,CAAC,MAAM;SACzB,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;IACvD,CAAC;IAED,eAAe,CAAC,WAAmB;QACjC,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,mBAAmB;gBAC/B,OAAO,EAAE,mBAAmB;gBAC5B,WAAW,EAAE,EAAE,WAAW,EAAE;aAC7B,CAAC;QACJ,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACnC,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC;YAC7B,IAAI,CAAC,SAAS,CAAC,mBAAmB,EAAE;gBAClC,YAAY,EAAE,SAAS,CAAC,YAAY;gBACpC,WAAW,EAAE,SAAS,CAAC,WAAW;gBAClC,KAAK,EAAE,SAAS,CAAC,KAAK;gBACtB,SAAS,EAAE,SAAS,CAAC,SAAS;gBAC9B,MAAM,EAAE,SAAS,CAAC,MAAM;aACzB,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC;IAC7C,CAAC;IAED;;;OAGG;IACH,oBAAoB,CAClB,KAA0B;QAE1B,MAAM,SAAS,GAAG,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACjE,MAAM,WAAW,GAAqB;YACpC,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC;QAEF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,mBAAmB;gBAC/B,OAAO,EAAE,mBAAmB;gBAC5B,WAAW;aACZ,CAAC;QACJ,CAAC;QAED,WAAW,CAAC,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC;QAClD,WAAW,CAAC,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC;QACpC,WAAW,CAAC,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;QAC5C,WAAW,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;QAEtC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAClE,IAAI,CAAC,YAAY,IAAI,CAAC,IAAA,yBAAiB,EAAC,KAAK,CAAC,eAAe,EAAE,YAAY,CAAC,EAAE,CAAC;YAC7E,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YACrE,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,0BAA0B;gBACtC,OAAO,EAAE,0BAA0B;gBACnC,WAAW;aACZ,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,QAAQ,EAAE,CAAC;YAC1C,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,WAAW,EAAE;gBACzC,MAAM,EAAE,mBAAmB;gBAC3B,QAAQ,EAAE,SAAS,CAAC,QAAQ;gBAC5B,MAAM,EAAE,KAAK,CAAC,QAAQ;aACvB,CAAC,CAAC;YACH,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,mBAAmB;gBAC/B,OAAO,EAAE,mDAAmD;gBAC5D,WAAW;aACZ,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACnC,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAClE,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,mBAAmB;gBAC/B,OAAO,EAAE,mBAAmB;gBAC5B,WAAW;aACZ,CAAC;QACJ,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACnC,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAClE,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,mBAAmB;gBAC/B,OAAO,EAAE,mBAAmB;gBAC5B,MAAM,EAAE,iBAAiB;gBACzB,WAAW;aACZ,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;YAC9B,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YAC/B,WAAW,CAAC,SAAS,GAAG,SAAS,CAAC;YAClC,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC;YAC/E,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,sBAAsB;gBAClC,OAAO,EAAE,yDAAyD;gBAClE,WAAW;aACZ,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,WAAW,EAAE;gBACzC,MAAM,EAAE,sBAAsB;gBAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC,CAAC;YACH,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,uBAAuB;gBACnC,OAAO,EAAE,gCAAgC;gBACzC,MAAM,EAAE,sBAAsB;gBAC9B,WAAW;aACZ,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,WAAW,EAAE;YAC1C,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;QACH,OAAO;YACL,EAAE,EAAE,IAAI;YACR,IAAI,EAAE;gBACJ,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,MAAM,EAAE,IAAI;aACb;SACF,CAAC;IACJ,CAAC;IAED,eAAe,CAAC,SAMZ,EAAE;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YACjC,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC;YAC5B,IAAI,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK;gBAAE,OAAO,KAAK,CAAC;YAC3D,IAAI,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;gBAAE,OAAO,KAAK,CAAC;YACvE,IAAI,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;gBAAE,OAAO,KAAK,CAAC;YAC7E,IAAI,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY;gBAAE,OAAO,KAAK,CAAC;YAChF,IAAI,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;gBAAE,OAAO,KAAK,CAAC;YACvE,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,WAAW,CAAC,SAA6B,EAAE,SAAiB,EAAE,QAAgB;QACpF,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QACjE,OAAO,SAAS,CAAC,YAAY,CAAC,IAAI,CAChC,CAAC,CAAc,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CACzE,CAAC;IACJ,CAAC;IAEO,sBAAsB,CAAC,WAAmB;QAChD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC;QACjC,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;YAC3F,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC;YAC7B,IAAI,CAAC,SAAS,CAAC,mBAAmB,EAAE;gBAClC,YAAY,EAAE,SAAS,CAAC,YAAY;gBACpC,WAAW,EAAE,SAAS,CAAC,WAAW;gBAClC,KAAK,EAAE,SAAS,CAAC,KAAK;gBACtB,SAAS,EAAE,SAAS,CAAC,SAAS;gBAC9B,MAAM,EAAE,SAAS,CAAC,MAAM;aACzB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,SAAS,CACf,IAAoB,EACpB,WAA6B,EAC7B,MAAgC;QAEhC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YACd,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC;YACrB,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;YAC5B,IAAI;YACJ,WAAW,EAAE,EAAE,GAAG,WAAW,EAAE;YAC/B,MAAM;SACP,CAAC,CAAC;IACL,CAAC;CACF;AAlfD,4DAkfC"}

package/dist/execution-authority/store.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Durable SQLite-backed execution-authority store (NOT-86).
+ * Logic lives in ExecutionAuthorityLedger; this module hydrates/persists snapshots.
+ */
+import type Database from 'better-sqlite3';
+import type { AuthorizedCallInput, ContractResult, CoordinatorEnrollment, EnrollCoordinatorResult, ExecutionAuthority, MintAuthorityInput, MintAuthorityResult, AuditEvent } from './types';
+export type ExecutionAuthorityStoreOptions = {
+    now?: () => Date;
+};
+export declare class ExecutionAuthorityStore {
+    private readonly db;
+    private readonly ledger;
+    constructor(db: Database.Database, options?: ExecutionAuthorityStoreOptions);
+    /** Test helper: replace clock without losing durable state. */
+    withNow(now: () => Date): ExecutionAuthorityStore;
+    private ensureTables;
+    private hydrate;
+    private persist;
+    private runMutating;
+    enrollCoordinator(input: {
+        coordinatorId: string;
+        allowedDeckIds: string[];
+    }): ContractResult<EnrollCoordinatorResult>;
+    revokeEnrollment(enrollmentId: string): ContractResult<{
+        enrollmentId: string;
+    }>;
+    mintAuthority(input: MintAuthorityInput): ContractResult<MintAuthorityResult>;
+    /** Non-auditing existence/ownership lookup (see ledger.peekAuthority). */
+    peekAuthority(authorityId: string): ExecutionAuthority | undefined;
+    inspectAuthority(authorityId: string): ContractResult<ExecutionAuthority>;
+    revokeAuthority(authorityId: string): ContractResult<{
+        authorityId: string;
+    }>;
+    invokeAuthorizedCall(input: AuthorizedCallInput): ContractResult<{
+        serviceId: string;
+        toolName: string;
+        result: string;
+    }>;
+    listAuditEvents(filter?: {
+        runId?: string;
+        attemptId?: string;
+        authorityId?: string;
+        enrollmentId?: string;
+        requestId?: string;
+    }): AuditEvent[];
+    getEnrollment(enrollmentId: string): CoordinatorEnrollment | undefined;
+    listEnrollments(): CoordinatorEnrollment[];
+    verifyEnrollmentSecret(enrollmentId: string, secret: string): boolean;
+    verifyAuthoritySecret(authorityId: string, secret: string): boolean;
+    /**
+     * Validate authority id+secret and return current authority (may transition to expired).
+     */
+    authenticateAuthority(authorityId: string, authoritySecret: string): ContractResult<ExecutionAuthority>;
+}
+//# sourceMappingURL=store.d.ts.map

package/dist/execution-authority/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/execution-authority/store.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAG3C,OAAO,KAAK,EACV,mBAAmB,EACnB,cAAc,EACd,qBAAqB,EACrB,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,UAAU,EACX,MAAM,SAAS,CAAC;AAEjB,MAAM,MAAM,8BAA8B,GAAG;IAC3C,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB,CAAC;AAEF,qBAAa,uBAAuB;IAIhC,OAAO,CAAC,QAAQ,CAAC,EAAE;IAHrB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2B;gBAG/B,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACtC,OAAO,GAAE,8BAAmC;IAO9C,+DAA+D;IAC/D,OAAO,CAAC,GAAG,EAAE,MAAM,IAAI,GAAG,uBAAuB;IAKjD,OAAO,CAAC,YAAY;IA0CpB,OAAO,CAAC,OAAO;IAiGf,OAAO,CAAC,OAAO;IA+Ef,OAAO,CAAC,WAAW;IAMnB,iBAAiB,CAAC,KAAK,EAAE;QACvB,aAAa,EAAE,MAAM,CAAC;QACtB,cAAc,EAAE,MAAM,EAAE,CAAC;KAC1B,GAAG,cAAc,CAAC,uBAAuB,CAAC;IAI3C,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,cAAc,CAAC;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAMhF,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,cAAc,CAAC,mBAAmB,CAAC;IAI7E,0EAA0E;IAC1E,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAIlE,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,cAAc,CAAC,kBAAkB,CAAC;IAIzE,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,cAAc,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAM7E,oBAAoB,CAClB,KAAK,EAAE,mBAAmB,GACzB,cAAc,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAQ1E,eAAe,CAAC,MAAM,GAAE;QACtB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;KACf,GAAG,UAAU,EAAE;IAIrB,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS;IAItE,eAAe,IAAI,qBAAqB,EAAE;IAI1C,sBAAsB,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IAIrE,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IAInE;;OAEG;IACH,qBAAqB,CACnB,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,MAAM,GACtB,cAAc,CAAC,kBAAkB,CAAC;CA6CtC"}