@agent-deck/backend 1.7.7 → 1.8.1

package/dist/routes/execution-authority.js

@@ -0,0 +1,506 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerExecutionAuthorityRoutes = exports.EnrollmentAuthError = void 0;
+const http_auth_1 = require("../lib/http-auth");
+const auth_1 = require("../trusted-session/auth");
+const bearer_1 = require("../execution-authority/bearer");
+const execution_authority_http_1 = require("../lib/execution-authority-http");
+class EnrollmentAuthError extends Error {
+    contract;
+    constructor(contract) {
+        super(contract.message);
+        this.contract = contract;
+        this.name = 'EnrollmentAuthError';
+    }
+}
+exports.EnrollmentAuthError = EnrollmentAuthError;
+function intersectTools(policy, hint) {
+    if (hint === undefined)
+        return policy;
+    const key = (t) => `${t.serviceId}\0${t.toolName}`;
+    const allowed = new Set(policy.map(key));
+    return hint.filter((t) => allowed.has(key(t)));
+}
+function requireEnrollmentAuth(request, store) {
+    const token = (0, http_auth_1.parseBearerToken)({ headers: request.headers });
+    if (!token) {
+        throw new EnrollmentAuthError({
+            ok: false,
+            error_code: 'COORDINATOR_NOT_ENROLLED',
+            message: 'Enrollment bearer required (enr_…:secret)',
+        });
+    }
+    const parsed = (0, bearer_1.parseEnrollmentBearer)(token);
+    if (!parsed) {
+        throw new EnrollmentAuthError({
+            ok: false,
+            error_code: 'COORDINATOR_NOT_ENROLLED',
+            message: 'Enrollment bearer required (enr_…:secret)',
+        });
+    }
+    const enrollment = store.getEnrollment(parsed.enrollmentId);
+    if (!enrollment) {
+        throw new EnrollmentAuthError({
+            ok: false,
+            error_code: 'COORDINATOR_NOT_ENROLLED',
+            message: 'Unknown enrollment',
+            correlation: { enrollmentId: parsed.enrollmentId },
+        });
+    }
+    if (enrollment.status !== 'active') {
+        throw new EnrollmentAuthError({
+            ok: false,
+            error_code: 'ENROLLMENT_REVOKED',
+            message: 'Enrollment is revoked',
+            reason: 'enrollment_revoked',
+            correlation: { enrollmentId: parsed.enrollmentId },
+        });
+    }
+    if (!store.verifyEnrollmentSecret(parsed.enrollmentId, parsed.secret)) {
+        throw new EnrollmentAuthError({
+            ok: false,
+            error_code: 'COORDINATOR_NOT_ENROLLED',
+            message: 'Invalid enrollment secret',
+            correlation: { enrollmentId: parsed.enrollmentId },
+        });
+    }
+    return { enrollmentId: parsed.enrollmentId };
+}
+/** Shared enrollment bearer resolve used by coordinator metadata + mint routes. */
+function resolveEnrollmentAuth(request, store) {
+    try {
+        const { enrollmentId } = requireEnrollmentAuth(request, store);
+        const enrollment = store.getEnrollment(enrollmentId);
+        if (!enrollment) {
+            return {
+                ok: false,
+                contract: {
+                    ok: false,
+                    error_code: 'COORDINATOR_NOT_ENROLLED',
+                    message: 'Unknown enrollment',
+                    correlation: { enrollmentId },
+                },
+            };
+        }
+        return { ok: true, enrollmentId, enrollment };
+    }
+    catch (error) {
+        if (error instanceof EnrollmentAuthError) {
+            return { ok: false, contract: error.contract };
+        }
+        throw error;
+    }
+}
+function deckNotPermittedError(enrollmentId, deckId) {
+    return {
+        ok: false,
+        error_code: 'RESOURCE_OUT_OF_SCOPE',
+        message: 'Deck is not in allowedDeckIds',
+        reason: 'deck_not_permitted',
+        correlation: { enrollmentId, deckId },
+    };
+}
+function deckNotFoundError(enrollmentId, deckId) {
+    return {
+        ok: false,
+        error_code: 'RESOURCE_OUT_OF_SCOPE',
+        message: 'Deck not found',
+        reason: 'deck_not_found',
+        correlation: { enrollmentId, deckId },
+    };
+}
+/**
+ * Fastify decodes path params, so `/decks/x%2Fy/playbooks` yields `deckId === "x/y"`
+ * while the route-policy `[^/]+` still matched one encoded segment. Reject before scope checks.
+ */
+function invalidDeckIdPathSegment(deckId) {
+    if (!deckId.includes('/'))
+        return null;
+    return {
+        ok: false,
+        error_code: 'INVALID_MINT_REQUEST',
+        message: 'deckId must be a single path segment',
+        correlation: { deckId },
+    };
+}
+/** Re-check enrollment after awaits so revoke cannot race a successful response. */
+function revalidateActiveEnrollment(store, enrollmentId, deckId) {
+    const enrollment = store.getEnrollment(enrollmentId);
+    if (!enrollment || enrollment.status !== 'active') {
+        return {
+            ok: false,
+            error_code: 'ENROLLMENT_REVOKED',
+            message: 'Enrollment is revoked',
+            reason: 'enrollment_revoked',
+            correlation: { enrollmentId },
+        };
+    }
+    if (deckId !== undefined && !enrollment.allowedDeckIds.includes(deckId)) {
+        return deckNotPermittedError(enrollmentId, deckId);
+    }
+    return null;
+}
+async function requireEnrollmentOrTrustedWriter(request, store) {
+    try {
+        return { kind: 'enrollment', ...requireEnrollmentAuth(request, store) };
+    }
+    catch (error) {
+        if (!(error instanceof EnrollmentAuthError))
+            throw error;
+        try {
+            await (0, auth_1.requireTrustedWriterBearer)(request);
+            return { kind: 'trusted-writer' };
+        }
+        catch {
+            throw error;
+        }
+    }
+}
+const registerExecutionAuthorityRoutes = async (fastify) => {
+    const store = () => fastify.executionAuthorityStore;
+    fastify.post('/enrollments', async (request, reply) => {
+        try {
+            await (0, auth_1.requireTrustedWriterBearer)(request);
+        }
+        catch (error) {
+            if (error instanceof auth_1.TrustedAuthError) {
+                return (0, auth_1.sendTrustedAuthError)(reply, error);
+            }
+            throw error;
+        }
+        const body = (request.body ?? {});
+        if (!body.coordinatorId?.trim() || !Array.isArray(body.allowedDeckIds) || body.allowedDeckIds.length === 0) {
+            return reply.status(400).send({
+                ok: false,
+                error_code: 'INVALID_MINT_REQUEST',
+                message: 'coordinatorId and allowedDeckIds are required',
+            });
+        }
+        const result = store().enrollCoordinator({
+            coordinatorId: body.coordinatorId.trim(),
+            allowedDeckIds: body.allowedDeckIds.map(String),
+        });
+        if (!result.ok) {
+            return (0, execution_authority_http_1.sendContractError)(reply, result, (0, execution_authority_http_1.statusForContract)(result));
+        }
+        return { ok: true, data: result.data };
+    });
+    fastify.get('/enrollments/:id', async (request, reply) => {
+        try {
+            await (0, auth_1.requireTrustedWriterBearer)(request);
+        }
+        catch (error) {
+            if (error instanceof auth_1.TrustedAuthError) {
+                return (0, auth_1.sendTrustedAuthError)(reply, error);
+            }
+            throw error;
+        }
+        const enrollment = store().getEnrollment(request.params.id);
+        if (!enrollment) {
+            return reply.status(404).send({
+                ok: false,
+                error_code: 'COORDINATOR_NOT_ENROLLED',
+                message: 'Unknown enrollment',
+            });
+        }
+        return { ok: true, data: enrollment };
+    });
+    fastify.post('/enrollments/:id/revoke', async (request, reply) => {
+        try {
+            await (0, auth_1.requireTrustedWriterBearer)(request);
+        }
+        catch (error) {
+            if (error instanceof auth_1.TrustedAuthError) {
+                return (0, auth_1.sendTrustedAuthError)(reply, error);
+            }
+            throw error;
+        }
+        const result = store().revokeEnrollment(request.params.id);
+        if (!result.ok) {
+            return (0, execution_authority_http_1.sendContractError)(reply, result, (0, execution_authority_http_1.statusForContract)(result));
+        }
+        return { ok: true, data: result.data };
+    });
+    fastify.get('/decks', async (request, reply) => {
+        const auth = resolveEnrollmentAuth(request, store());
+        if (!auth.ok) {
+            return (0, execution_authority_http_1.sendContractError)(reply, auth.contract, (0, execution_authority_http_1.statusForContract)(auth.contract));
+        }
+        const decks = [];
+        for (const id of auth.enrollment.allowedDeckIds) {
+            const deck = await fastify.db.getDeck(id);
+            if (deck) {
+                decks.push({ id: deck.id, name: deck.name });
+            }
+        }
+        const stale = revalidateActiveEnrollment(store(), auth.enrollmentId);
+        if (stale) {
+            return (0, execution_authority_http_1.sendContractError)(reply, stale, (0, execution_authority_http_1.statusForContract)(stale));
+        }
+        return { ok: true, data: { decks } };
+    });
+    fastify.get('/decks/:deckId/playbooks', async (request, reply) => {
+        const auth = resolveEnrollmentAuth(request, store());
+        if (!auth.ok) {
+            return (0, execution_authority_http_1.sendContractError)(reply, auth.contract, (0, execution_authority_http_1.statusForContract)(auth.contract));
+        }
+        const { deckId } = request.params;
+        const badSegment = invalidDeckIdPathSegment(deckId);
+        if (badSegment) {
+            return (0, execution_authority_http_1.sendContractError)(reply, badSegment, (0, execution_authority_http_1.statusForContract)(badSegment));
+        }
+        if (!auth.enrollment.allowedDeckIds.includes(deckId)) {
+            return (0, execution_authority_http_1.sendContractError)(reply, deckNotPermittedError(auth.enrollmentId, deckId));
+        }
+        // Fail closed for deleted-but-still-allowed decks (distinct from not-in-allowedDeckIds).
+        // Sibling GET /decks omits missing ids from the list; path-param discovery must not.
+        if (!(await fastify.db.hasDeck(deckId))) {
+            return (0, execution_authority_http_1.sendContractError)(reply, deckNotFoundError(auth.enrollmentId, deckId));
+        }
+        const playbooks = await fastify.playbookManager.listSummariesForDeck(deckId);
+        const stale = revalidateActiveEnrollment(store(), auth.enrollmentId, deckId);
+        if (stale) {
+            return (0, execution_authority_http_1.sendContractError)(reply, stale, (0, execution_authority_http_1.statusForContract)(stale));
+        }
+        return { ok: true, data: playbooks };
+    });
+    fastify.post('/authorities', async (request, reply) => {
+        const auth = resolveEnrollmentAuth(request, store());
+        if (!auth.ok) {
+            return (0, execution_authority_http_1.sendContractError)(reply, auth.contract, (0, execution_authority_http_1.statusForContract)(auth.contract));
+        }
+        const { enrollmentId } = auth;
+        const body = (request.body ?? {});
+        if (body.enrollmentId && body.enrollmentId !== enrollmentId) {
+            return reply.status(400).send({
+                ok: false,
+                error_code: 'INVALID_MINT_REQUEST',
+                message: 'enrollmentId does not match bearer',
+            });
+        }
+        if (!body.runId?.trim() ||
+            !body.attemptId?.trim() ||
+            !body.deckId?.trim() ||
+            !body.idempotencyKey?.trim() ||
+            body.audience !== 'dealer-worker' ||
+            !(body.ttlMs > 0)) {
+            return reply.status(400).send({
+                ok: false,
+                error_code: 'INVALID_MINT_REQUEST',
+                message: 'runId, attemptId, deckId, audience=dealer-worker, idempotencyKey, ttlMs>0 required',
+            });
+        }
+        const deckId = body.deckId.trim();
+        // Scope check before existence so missing out-of-scope ids stay deck_not_permitted.
+        if (!auth.enrollment.allowedDeckIds.includes(deckId)) {
+            return (0, execution_authority_http_1.sendContractError)(reply, deckNotPermittedError(enrollmentId, deckId));
+        }
+        const deck = await fastify.db.getDeck(deckId);
+        if (!deck) {
+            return (0, execution_authority_http_1.sendContractError)(reply, deckNotFoundError(enrollmentId, deckId));
+        }
+        const services = deck.services ?? [];
+        const allowedTools = [];
+        const allowedServices = [];
+        for (const service of services) {
+            allowedServices.push(service.id);
+            const discovered = await fastify.serviceManager.discoverServiceTools(service.id, {
+                forAgent: true,
+            });
+            if (Array.isArray(discovered)) {
+                for (const tool of discovered) {
+                    allowedTools.push({ serviceId: service.id, toolName: tool.name });
+                }
+            }
+        }
+        const narrowedTools = intersectTools(allowedTools, body.toolScopeHint);
+        const narrowedServiceIds = [...new Set(narrowedTools.map((t) => t.serviceId))];
+        // undefined hint → full deck services; explicit hint (incl. []) → services from snapshot only
+        const mintServices = body.toolScopeHint === undefined ? allowedServices : narrowedServiceIds;
+        const stale = revalidateActiveEnrollment(store(), enrollmentId, deckId);
+        if (stale) {
+            return (0, execution_authority_http_1.sendContractError)(reply, stale, (0, execution_authority_http_1.statusForContract)(stale));
+        }
+        const result = store().mintAuthority({
+            enrollmentId,
+            runId: body.runId.trim(),
+            attemptId: body.attemptId.trim(),
+            deckId,
+            audience: 'dealer-worker',
+            idempotencyKey: body.idempotencyKey.trim(),
+            allowedServices: mintServices,
+            allowedTools: narrowedTools,
+            ttlMs: body.ttlMs,
+        });
+        if (!result.ok) {
+            return (0, execution_authority_http_1.sendContractError)(reply, result, (0, execution_authority_http_1.statusForContract)(result));
+        }
+        return { ok: true, data: result.data };
+    });
+    fastify.get('/authorities/:id', async (request, reply) => {
+        let principal;
+        try {
+            principal = await requireEnrollmentOrTrustedWriter(request, store());
+        }
+        catch (error) {
+            if (error instanceof EnrollmentAuthError) {
+                return (0, execution_authority_http_1.sendContractError)(reply, error.contract, (0, execution_authority_http_1.statusForContract)(error.contract));
+            }
+            throw error;
+        }
+        const peeked = store().peekAuthority(request.params.id);
+        if (!peeked ||
+            (principal.kind === 'enrollment' && peeked.enrollmentId !== principal.enrollmentId)) {
+            return (0, execution_authority_http_1.sendContractError)(reply, {
+                ok: false,
+                error_code: 'AUTHORITY_UNKNOWN',
+                message: 'Unknown authority',
+                correlation: { authorityId: request.params.id },
+            }, 404);
+        }
+        const result = store().inspectAuthority(request.params.id);
+        if (!result.ok) {
+            return (0, execution_authority_http_1.sendContractError)(reply, result, (0, execution_authority_http_1.statusForContract)(result));
+        }
+        return { ok: true, data: result.data };
+    });
+    fastify.post('/authorities/:id/revoke', async (request, reply) => {
+        let principal;
+        try {
+            principal = await requireEnrollmentOrTrustedWriter(request, store());
+        }
+        catch (error) {
+            if (error instanceof EnrollmentAuthError) {
+                return (0, execution_authority_http_1.sendContractError)(reply, error.contract, (0, execution_authority_http_1.statusForContract)(error.contract));
+            }
+            throw error;
+        }
+        const peeked = store().peekAuthority(request.params.id);
+        if (!peeked ||
+            (principal.kind === 'enrollment' && peeked.enrollmentId !== principal.enrollmentId)) {
+            return (0, execution_authority_http_1.sendContractError)(reply, {
+                ok: false,
+                error_code: 'AUTHORITY_UNKNOWN',
+                message: 'Unknown authority',
+                correlation: { authorityId: request.params.id },
+            }, 404);
+        }
+        const result = store().revokeAuthority(request.params.id);
+        if (!result.ok) {
+            return (0, execution_authority_http_1.sendContractError)(reply, result, (0, execution_authority_http_1.statusForContract)(result));
+        }
+        return { ok: true, data: result.data };
+    });
+    fastify.get('/audit', async (request, reply) => {
+        let principal;
+        try {
+            principal = await requireEnrollmentOrTrustedWriter(request, store());
+        }
+        catch (error) {
+            if (error instanceof EnrollmentAuthError) {
+                return (0, execution_authority_http_1.sendContractError)(reply, error.contract, (0, execution_authority_http_1.statusForContract)(error.contract));
+            }
+            throw error;
+        }
+        const q = request.query;
+        if (principal.kind === 'enrollment') {
+            if (q.enrollmentId && q.enrollmentId !== principal.enrollmentId) {
+                return (0, execution_authority_http_1.sendContractError)(reply, {
+                    ok: false,
+                    error_code: 'RESOURCE_OUT_OF_SCOPE',
+                    message: 'Cannot query audit for another enrollment',
+                    correlation: { enrollmentId: principal.enrollmentId },
+                }, 403);
+            }
+            if (q.authorityId) {
+                const owned = store().peekAuthority(q.authorityId);
+                if (!owned || owned.enrollmentId !== principal.enrollmentId) {
+                    return (0, execution_authority_http_1.sendContractError)(reply, {
+                        ok: false,
+                        error_code: 'AUTHORITY_UNKNOWN',
+                        message: 'Unknown authority',
+                        correlation: { authorityId: q.authorityId },
+                    }, 404);
+                }
+            }
+        }
+        const events = store().listAuditEvents({
+            runId: q.runId,
+            attemptId: q.attemptId,
+            authorityId: q.authorityId,
+            enrollmentId: principal.kind === 'enrollment' ? principal.enrollmentId : q.enrollmentId,
+            requestId: q.requestId,
+        });
+        return { ok: true, data: { events } };
+    });
+    fastify.post('/mcp/connect', async (request, reply) => {
+        const body = (request.body ?? {});
+        const token = (0, http_auth_1.parseBearerToken)(request);
+        const fromBearer = token ? (0, bearer_1.parseAuthorityBearer)(token) : null;
+        const authorityId = fromBearer?.authorityId ?? body.authorityId?.trim();
+        const authoritySecret = fromBearer?.secret ?? body.authoritySecret?.trim();
+        const audience = body.audience?.trim() || 'dealer-worker';
+        if (!authorityId || !authoritySecret) {
+            return reply.status(401).send({
+                ok: false,
+                error_code: 'AUTHORITY_SECRET_INVALID',
+                message: 'authorityId and authoritySecret required',
+            });
+        }
+        const auth = store().authenticateAuthority(authorityId, authoritySecret);
+        if (!auth.ok) {
+            return (0, execution_authority_http_1.sendContractError)(reply, auth, (0, execution_authority_http_1.statusForContract)(auth));
+        }
+        if (audience !== auth.data.audience) {
+            return reply.status(403).send({
+                ok: false,
+                error_code: 'AUDIENCE_MISMATCH',
+                message: 'Caller audience does not match authority audience',
+                correlation: { authorityId },
+            });
+        }
+        return {
+            ok: true,
+            data: {
+                authorityId: auth.data.authorityId,
+                deckId: auth.data.deckId,
+                audience: auth.data.audience,
+                runId: auth.data.runId,
+                attemptId: auth.data.attemptId,
+                allowedServices: auth.data.allowedServices,
+                allowedTools: auth.data.allowedTools,
+                expiresAt: auth.data.expiresAt,
+                status: auth.data.status,
+            },
+        };
+    });
+    /** Authorize one tool call under execution authority (MCP / internal). */
+    fastify.post('/authorize-call', async (request, reply) => {
+        const body = (request.body ?? {});
+        if (!body.authorityId ||
+            !body.authoritySecret ||
+            !body.audience ||
+            !body.serviceId ||
+            !body.toolName) {
+            return reply.status(400).send({
+                ok: false,
+                error_code: 'INVALID_MINT_REQUEST',
+                message: 'authorityId, authoritySecret, audience, serviceId, toolName required',
+            });
+        }
+        const result = store().invokeAuthorizedCall({
+            authorityId: body.authorityId,
+            authoritySecret: body.authoritySecret,
+            audience: body.audience,
+            serviceId: body.serviceId,
+            toolName: body.toolName,
+            requiresInteraction: body.requiresInteraction,
+        });
+        if (!result.ok) {
+            return (0, execution_authority_http_1.sendContractError)(reply, result, (0, execution_authority_http_1.statusForContract)(result));
+        }
+        return { ok: true, data: result.data };
+    });
+};
+exports.registerExecutionAuthorityRoutes = registerExecutionAuthorityRoutes;
+//# sourceMappingURL=execution-authority.js.map

package/dist/routes/execution-authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-authority.js","sourceRoot":"","sources":["../../src/routes/execution-authority.ts"],"names":[],"mappings":";;;AAEA,gDAAoD;AACpD,kDAA6G;AAC7G,0DAA4F;AAE5F,8EAAuF;AAEvF,MAAa,mBAAoB,SAAQ,KAAK;IAChB;IAA5B,YAA4B,QAAuB;QACjD,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QADE,aAAQ,GAAR,QAAQ,CAAe;QAEjD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AALD,kDAKC;AAED,SAAS,cAAc,CAAC,MAAqB,EAAE,IAA+B;IAC5E,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACtC,MAAM,GAAG,GAAG,CAAC,CAAc,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;IAChE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjD,CAAC;AAqBD,SAAS,qBAAqB,CAC5B,OAA6C,EAC7C,KAAsB;IAEtB,MAAM,KAAK,GAAG,IAAA,4BAAgB,EAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,mBAAmB,CAAC;YAC5B,EAAE,EAAE,KAAK;YACT,UAAU,EAAE,0BAA0B;YACtC,OAAO,EAAE,2CAA2C;SACrD,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,8BAAqB,EAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,mBAAmB,CAAC;YAC5B,EAAE,EAAE,KAAK;YACT,UAAU,EAAE,0BAA0B;YACtC,OAAO,EAAE,2CAA2C;SACrD,CAAC,CAAC;IACL,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC5D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAmB,CAAC;YAC5B,EAAE,EAAE,KAAK;YACT,UAAU,EAAE,0BAA0B;YACtC,OAAO,EAAE,oBAAoB;YAC7B,WAAW,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE;SACnD,CAAC,CAAC;IACL,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,IAAI,mBAAmB,CAAC;YAC5B,EAAE,EAAE,KAAK;YACT,UAAU,EAAE,oBAAoB;YAChC,OAAO,EAAE,uBAAuB;YAChC,MAAM,EAAE,oBAAoB;YAC5B,WAAW,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE;SACnD,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,mBAAmB,CAAC;YAC5B,EAAE,EAAE,KAAK;YACT,UAAU,EAAE,0BAA0B;YACtC,OAAO,EAAE,2BAA2B;YACpC,WAAW,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE;SACnD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;AAC/C,CAAC;AAED,mFAAmF;AACnF,SAAS,qBAAqB,CAC5B,OAA6C,EAC7C,KAAsB;IAEtB,IAAI,CAAC;QACH,MAAM,EAAE,YAAY,EAAE,GAAG,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC/D,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QACrD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,QAAQ,EAAE;oBACR,EAAE,EAAE,KAAK;oBACT,UAAU,EAAE,0BAA0B;oBACtC,OAAO,EAAE,oBAAoB;oBAC7B,WAAW,EAAE,EAAE,YAAY,EAAE;iBAC9B;aACF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;YACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;QACjD,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,YAAoB,EAAE,MAAc;IACjE,OAAO;QACL,EAAE,EAAE,KAAK;QACT,UAAU,EAAE,uBAAuB;QACnC,OAAO,EAAE,+BAA+B;QACxC,MAAM,EAAE,oBAAoB;QAC5B,WAAW,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE;KACtC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,YAAoB,EAAE,MAAc;IAC7D,OAAO;QACL,EAAE,EAAE,KAAK;QACT,UAAU,EAAE,uBAAuB;QACnC,OAAO,EAAE,gBAAgB;QACzB,MAAM,EAAE,gBAAgB;QACxB,WAAW,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE;KACtC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,wBAAwB,CAAC,MAAc;IAC9C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO;QACL,EAAE,EAAE,KAAK;QACT,UAAU,EAAE,sBAAsB;QAClC,OAAO,EAAE,sCAAsC;QAC/C,WAAW,EAAE,EAAE,MAAM,EAAE;KACxB,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,SAAS,0BAA0B,CACjC,KAAsB,EACtB,YAAoB,EACpB,MAAe;IAEf,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;IACrD,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,UAAU,EAAE,oBAAoB;YAChC,OAAO,EAAE,uBAAuB;YAChC,MAAM,EAAE,oBAAoB;YAC5B,WAAW,EAAE,EAAE,YAAY,EAAE;SAC9B,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACxE,OAAO,qBAAqB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAMD,KAAK,UAAU,gCAAgC,CAC7C,OAAgG,EAChG,KAAsB;IAEtB,IAAI,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;IAC1E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,mBAAmB,CAAC;YAAE,MAAM,KAAK,CAAC;QACzD,IAAI,CAAC;YACH,MAAM,IAAA,iCAA0B,EAAC,OAAO,CAAC,CAAC;YAC1C,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAEM,MAAM,gCAAgC,GAAuB,KAAK,EAAE,OAAO,EAAE,EAAE;IACpF,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,uBAAuB,CAAC;IAEpD,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACpD,IAAI,CAAC;YACH,MAAM,IAAA,iCAA0B,EAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,uBAAgB,EAAE,CAAC;gBACtC,OAAO,IAAA,2BAAoB,EAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC5C,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAG/B,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3G,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,sBAAsB;gBAClC,OAAO,EAAE,+CAA+C;aACzD,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,KAAK,EAAE,CAAC,iBAAiB,CAAC;YACvC,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE;YACxC,cAAc,EAAE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;SAChD,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,IAAA,4CAAiB,EAAC,KAAK,EAAE,MAAM,EAAE,IAAA,4CAAiB,EAAC,MAAM,CAAC,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,CAA6B,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACnF,IAAI,CAAC;YACH,MAAM,IAAA,iCAA0B,EAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,uBAAgB,EAAE,CAAC;gBACtC,OAAO,IAAA,2BAAoB,EAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC5C,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,UAAU,GAAG,KAAK,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,0BAA0B;gBACtC,OAAO,EAAE,oBAAoB;aAC9B,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,IAAI,CAA6B,yBAAyB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC3F,IAAI,CAAC;YACH,MAAM,IAAA,iCAA0B,EAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,uBAAgB,EAAE,CAAC;gBACtC,OAAO,IAAA,2BAAoB,EAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC5C,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,IAAA,4CAAiB,EAAC,KAAK,EAAE,MAAM,EAAE,IAAA,4CAAiB,EAAC,MAAM,CAAC,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC7C,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,OAAO,IAAA,4CAAiB,EAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAA,4CAAiB,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,KAAK,GAAwC,EAAE,CAAC;QACtD,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC;YAChD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC1C,IAAI,IAAI,EAAE,CAAC;gBACT,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,0BAA0B,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACrE,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,IAAA,4CAAiB,EAAC,KAAK,EAAE,KAAK,EAAE,IAAA,4CAAiB,EAAC,KAAK,CAAC,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,CACT,0BAA0B,EAC1B,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,OAAO,IAAA,4CAAiB,EAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAA,4CAAiB,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;QAClC,MAAM,UAAU,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,IAAA,4CAAiB,EAAC,KAAK,EAAE,UAAU,EAAE,IAAA,4CAAiB,EAAC,UAAU,CAAC,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,OAAO,IAAA,4CAAiB,EAAC,KAAK,EAAE,qBAAqB,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;QACpF,CAAC;QAED,yFAAyF;QACzF,qFAAqF;QACrF,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACxC,OAAO,IAAA,4CAAiB,EAAC,KAAK,EAAE,iBAAiB,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC7E,MAAM,KAAK,GAAG,0BAA0B,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAC7E,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,IAAA,4CAAiB,EAAC,KAAK,EAAE,KAAK,EAAE,IAAA,4CAAiB,EAAC,KAAK,CAAC,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACvC,CAAC,CACF,CAAC;IAEF,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACpD,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,OAAO,IAAA,4CAAiB,EAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAA,4CAAiB,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;QAE9B,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAyB,CAAC;QAC1D,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;YAC5D,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,sBAAsB;gBAClC,OAAO,EAAE,oCAAoC;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,IACE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE;YACnB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE;YACvB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE;YACpB,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE;YAC5B,IAAI,CAAC,QAAQ,KAAK,eAAe;YACjC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,EACjB,CAAC;YACD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,sBAAsB;gBAClC,OAAO,EAAE,oFAAoF;aAC9F,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAClC,oFAAoF;QACpF,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,OAAO,IAAA,4CAAiB,EAAC,KAAK,EAAE,qBAAqB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,IAAA,4CAAiB,EAAC,KAAK,EAAE,iBAAiB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QACrC,MAAM,YAAY,GAAkB,EAAE,CAAC;QACvC,MAAM,eAAe,GAAa,EAAE,CAAC;QACrC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACjC,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,EAAE;gBAC/E,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;YACH,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9B,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;oBAC9B,YAAY,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;gBACpE,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,cAAc,CAAC,YAAY,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QACvE,MAAM,kBAAkB,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC/E,8FAA8F;QAC9F,MAAM,YAAY,GAChB,IAAI,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,kBAAkB,CAAC;QAE1E,MAAM,KAAK,GAAG,0BAA0B,CAAC,KAAK,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;QACxE,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,IAAA,4CAAiB,EAAC,KAAK,EAAE,KAAK,EAAE,IAAA,4CAAiB,EAAC,KAAK,CAAC,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,MAAM,GAAG,KAAK,EAAE,CAAC,aAAa,CAAC;YACnC,YAAY;YACZ,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;YACxB,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE;YAChC,MAAM;YACN,QAAQ,EAAE,eAAe;YACzB,cAAc,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE;YAC1C,eAAe,EAAE,YAAY;YAC7B,YAAY,EAAE,aAAa;YAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,IAAA,4CAAiB,EAAC,KAAK,EAAE,MAAM,EAAE,IAAA,4CAAiB,EAAC,MAAM,CAAC,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,CAA6B,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACnF,IAAI,SAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,gCAAgC,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;gBACzC,OAAO,IAAA,4CAAiB,EAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAA,4CAAiB,EAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;YACrF,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxD,IACE,CAAC,MAAM;YACP,CAAC,SAAS,CAAC,IAAI,KAAK,YAAY,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,YAAY,CAAC,EACnF,CAAC;YACD,OAAO,IAAA,4CAAiB,EACtB,KAAK,EACL;gBACE,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,mBAAmB;gBAC/B,OAAO,EAAE,mBAAmB;gBAC5B,WAAW,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE;aAChD,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,IAAA,4CAAiB,EAAC,KAAK,EAAE,MAAM,EAAE,IAAA,4CAAiB,EAAC,MAAM,CAAC,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,IAAI,CAA6B,yBAAyB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC3F,IAAI,SAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,gCAAgC,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;gBACzC,OAAO,IAAA,4CAAiB,EAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAA,4CAAiB,EAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;YACrF,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxD,IACE,CAAC,MAAM;YACP,CAAC,SAAS,CAAC,IAAI,KAAK,YAAY,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,YAAY,CAAC,EACnF,CAAC;YACD,OAAO,IAAA,4CAAiB,EACtB,KAAK,EACL;gBACE,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,mBAAmB;gBAC/B,OAAO,EAAE,mBAAmB;gBAC5B,WAAW,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE;aAChD,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,IAAA,4CAAiB,EAAC,KAAK,EAAE,MAAM,EAAE,IAAA,4CAAiB,EAAC,MAAM,CAAC,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC7C,IAAI,SAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,gCAAgC,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;gBACzC,OAAO,IAAA,4CAAiB,EAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAA,4CAAiB,EAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;YACrF,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,CAAC,GAAG,OAAO,CAAC,KAA2C,CAAC;QAC9D,IAAI,SAAS,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACpC,IAAI,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS,CAAC,YAAY,EAAE,CAAC;gBAChE,OAAO,IAAA,4CAAiB,EACtB,KAAK,EACL;oBACE,EAAE,EAAE,KAAK;oBACT,UAAU,EAAE,uBAAuB;oBACnC,OAAO,EAAE,2CAA2C;oBACpD,WAAW,EAAE,EAAE,YAAY,EAAE,SAAS,CAAC,YAAY,EAAE;iBACtD,EACD,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;gBAClB,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;gBACnD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,YAAY,EAAE,CAAC;oBAC5D,OAAO,IAAA,4CAAiB,EACtB,KAAK,EACL;wBACE,EAAE,EAAE,KAAK;wBACT,UAAU,EAAE,mBAAmB;wBAC/B,OAAO,EAAE,mBAAmB;wBAC5B,WAAW,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE;qBAC5C,EACD,GAAG,CACJ,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,EAAE,CAAC,eAAe,CAAC;YACrC,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,YAAY,EACV,SAAS,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY;YAC3E,SAAS,EAAE,CAAC,CAAC,SAAS;SACvB,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACpD,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAI/B,CAAC;QACF,MAAM,KAAK,GAAG,IAAA,4BAAgB,EAAC,OAAO,CAAC,CAAC;QACxC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,IAAA,6BAAoB,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9D,MAAM,WAAW,GAAG,UAAU,EAAE,WAAW,IAAI,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;QACxE,MAAM,eAAe,GAAG,UAAU,EAAE,MAAM,IAAI,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;QAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,eAAe,CAAC;QAE1D,IAAI,CAAC,WAAW,IAAI,CAAC,eAAe,EAAE,CAAC;YACrC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,0BAA0B;gBACtC,OAAO,EAAE,0CAA0C;aACpD,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,GAAG,KAAK,EAAE,CAAC,qBAAqB,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,OAAO,IAAA,4CAAiB,EAAC,KAAK,EAAE,IAAI,EAAE,IAAA,4CAAiB,EAAC,IAAI,CAAC,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,QAAQ,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,mBAAmB;gBAC/B,OAAO,EAAE,mDAAmD;gBAC5D,WAAW,EAAE,EAAE,WAAW,EAAE;aAC7B,CAAC,CAAC;QACL,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,IAAI,EAAE;gBACJ,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;gBAClC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;gBACxB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAC5B,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;gBACtB,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;gBAC9B,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe;gBAC1C,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY;gBACpC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;gBAC9B,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;aACzB;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,OAAO,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvD,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAO/B,CAAC;QACF,IACE,CAAC,IAAI,CAAC,WAAW;YACjB,CAAC,IAAI,CAAC,eAAe;YACrB,CAAC,IAAI,CAAC,QAAQ;YACd,CAAC,IAAI,CAAC,SAAS;YACf,CAAC,IAAI,CAAC,QAAQ,EACd,CAAC;YACD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,sBAAsB;gBAClC,OAAO,EAAE,sEAAsE;aAChF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,EAAE,CAAC,oBAAoB,CAAC;YAC1C,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;SAC9C,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,IAAA,4CAAiB,EAAC,KAAK,EAAE,MAAM,EAAE,IAAA,4CAAiB,EAAC,MAAM,CAAC,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAtZW,QAAA,gCAAgC,oCAsZ3C"}

package/dist/routes/scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../src/routes/scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAiC1C,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,eAAe,iBAoLjE"}
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../src/routes/scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAsE1C,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,eAAe,iBAyMjE"}

package/dist/routes/scope.js

@@ -5,6 +5,7 @@ const zod_1 = require("zod");
 const shared_1 = require("@agent-deck/shared");
 const agent_deck_context_1 = require("../lib/agent-deck-context");
 const client_scope_1 = require("../lib/client-scope");
+const execution_authority_http_1 = require("../lib/execution-authority-http");
 const display_1 = require("../scope/display");
 const LiveDisplayBodySchema = zod_1.z.object({
     mcpSessionId: zod_1.z.string().min(1),
@@ -24,6 +25,28 @@ const DeckWorkspaceBodySchema = zod_1.z.object({
     workspaceRoot: zod_1.z.string().min(1),
     deckId: zod_1.z.string().uuid(),
 });
+function assertAuthorityDeniedLiveDisplay(request) {
+    const principal = request.requestPrincipal;
+    if (principal?.kind === 'execution-authority') {
+        throw new execution_authority_http_1.AuthorityContractAuthError({
+            ok: false,
+            error_code: 'INTERACTION_REQUIRED',
+            message: 'Control-plane decision required; do not hold the worker',
+            correlation: principal.authority
+                ? { authorityId: principal.authority.authorityId }
+                : undefined,
+        });
+    }
+}
+function assertAuthorityLiveDisplayWrite(request, deckId) {
+    assertAuthorityDeniedLiveDisplay(request);
+    void deckId;
+    return undefined;
+}
+function assertAuthorityLiveDisplaySession(request, entry) {
+    assertAuthorityDeniedLiveDisplay(request);
+    void entry;
+}
 async function registerScopeRoutes(fastify) {
     fastify.get('/deck', async (request, reply) => {
         try {
@@ -95,10 +118,17 @@ async function registerScopeRoutes(fastify) {
                     error: parsed.error.issues.map((issue) => issue.message).join('; '),
                 });
             }
-            const entry = fastify.liveDisplayRegistry.upsert(parsed.data);
+            const authorityId = assertAuthorityLiveDisplayWrite(request, parsed.data.deckId);
+            const entry = fastify.liveDisplayRegistry.upsert({
+                ...parsed.data,
+                authorityId,
+            });
             return reply.send({ success: true, data: { badge: entry.badge } });
         }
         catch (error) {
+            if (error instanceof execution_authority_http_1.AuthorityContractAuthError) {
+                return (0, execution_authority_http_1.sendContractError)(reply, error.contract);
+            }
             return reply.status(403).send({
                 success: false,
                 error: error instanceof Error ? error.message : 'Forbidden',
@@ -115,10 +145,14 @@ async function registerScopeRoutes(fastify) {
                     error: 'mcpSessionId is required',
                 });
             }
+            assertAuthorityLiveDisplaySession(request, fastify.liveDisplayRegistry.get(mcpSessionId));
             fastify.liveDisplayRegistry.remove(mcpSessionId);
             return reply.send({ success: true });
         }
         catch (error) {
+            if (error instanceof execution_authority_http_1.AuthorityContractAuthError) {
+                return (0, execution_authority_http_1.sendContractError)(reply, error.contract);
+            }
             return reply.status(403).send({
                 success: false,
                 error: error instanceof Error ? error.message : 'Forbidden',
@@ -135,12 +169,16 @@ async function registerScopeRoutes(fastify) {
                     error: 'mcpSessionId is required',
                 });
             }
+            assertAuthorityLiveDisplaySession(request, fastify.liveDisplayRegistry.get(mcpSessionId));
             const parsed = LiveDisplayTouchSchema.safeParse(request.body ?? {});
             const at = parsed.success && parsed.data.at ? parsed.data.at : new Date().toISOString();
             fastify.liveDisplayRegistry.touch(mcpSessionId, at);
             return reply.send({ success: true });
         }
         catch (error) {
+            if (error instanceof execution_authority_http_1.AuthorityContractAuthError) {
+                return (0, execution_authority_http_1.sendContractError)(reply, error.contract);
+            }
             return reply.status(403).send({
                 success: false,
                 error: error instanceof Error ? error.message : 'Forbidden',