@agenticprimitives/fabric 0.0.0-alpha.1

package/dist/cloudflare/principal-gateway-do.d.ts

@@ -0,0 +1,234 @@
+import type { Vault, DekWrapper } from '@agenticprimitives/vault';
+import type { CanonicalAgentId } from '@agenticprimitives/types';
+import type { AuthorityTier } from '@agenticprimitives/tool-policy';
+import type { ExchangeRecordV1, ExchangeEventV1, ExchangeId } from '../exchange-record.js';
+import { type DeliveryEnvelopeV1 } from '../delivery-envelope.js';
+import { type OutboxEntry } from './outbox-store.js';
+import { type AuthorityVerdictCache, type AuthorityVerdict, type AuthorityVerdictKey } from './authority-verdict-cache.js';
+import { type DeliveryReceiptInput, type SignedDeliveryReceiptV1 } from './receipt-signer.js';
+import type { GatewayToolRegistry } from './gateway-tools.js';
+import type { Intent, Planner, RunResult } from '@agenticprimitives/orchestration';
+import { type ProvenanceRecordV1 } from '@agenticprimitives/provenance';
+import { type ChannelV1, type ConversationRoleProjection } from './channel-store.js';
+/** Bindings the gateway DO needs. Kept minimal; W2 follow-steps add the receipt-signing key + chain-state RPC. */
+export interface PrincipalGatewayEnv {
+    /** The chain id the gateway verifies authority against (for the T1 verdict + delivery). */
+    CHAIN_ID?: string;
+}
+/**
+ * Injected co-resident-MCP dependencies. INJECTED (not built in the fabric core) because they need
+ * deployment config — kept out of the transport-agnostic package (spec 316 §8). The real DO is an app
+ * subclass: `class Gateway extends PrincipalGatewayDO { constructor(s, e) { super(s, e, buildDeps(e)); } }`;
+ * tests pass fakes. Absent ⇒ the storage/guard methods still work, but the co-resident-MCP methods throw.
+ */
+export interface GatewayDeps {
+    /** Cold-path: FULL token verification → the args-independent verdict (A), or `null` if invalid. The app
+     *  wires `delegation.verifyDelegationToken` with its chainId / DelegationManager / RPC here. */
+    verifyToken(token: string): Promise<AuthorityVerdict | null>;
+    /** Resolve the per-owner DEK wrapper (the owner's KEK — KMS, cold-path). */
+    wrapperFor(owner: string): Promise<DekWrapper>;
+    /** The co-resident MCP tools this gateway serves (built-in vault tools + app tools). */
+    tools: GatewayToolRegistry;
+    /** The injected planner for the T2 orchestration loop (§15) — the LLM adapter in prod, the rule-based
+     *  planner in tests. Absent ⇒ `orchestrate()` throws (T2 unavailable), but T0/T1 still work. */
+    planner?: Planner;
+    /** Token-gated channel join (spec 318 C3): verify a `member`'s `credential` satisfies a channel's
+     *  `joinGate` requirement. Injected (the `entitlements`/`verifiable-credentials` resolver in prod, a fake in
+     *  tests) — the fabric core stays credential-mechanism-free. Absent ⇒ a gated channel cannot be joined. */
+    verifyEntitlement?: (requirement: string, credential: unknown, member: string) => Promise<boolean>;
+}
+export declare class PrincipalGatewayDO {
+    private readonly state;
+    private readonly env;
+    private readonly deps?;
+    private readonly sql;
+    private readonly exchanges;
+    private readonly verdicts;
+    private readonly requestIds;
+    private readonly receipts;
+    private readonly outbox;
+    private readonly provenance;
+    private readonly channels;
+    constructor(state: DurableObjectState, env: PrincipalGatewayEnv, deps?: GatewayDeps | undefined);
+    /** Create/rename a channel owned by this org gateway. */
+    createChannel(channel: ChannelV1): Promise<void>;
+    /**
+     * Add a member with a role (spec 318 C2 — the role IS the projection of an org-SA delegation caveat).
+     * TOKEN-GATED (C3): if the channel carries a `joinGate`, the join is admitted ONLY if `opts.credential`
+     * satisfies it via the injected `verifyEntitlement` (fail-closed — no credential / no verifier / invalid ⇒
+     * rejected). An ungated channel joins openly.
+     */
+    joinChannel(channelId: string, member: string, opts?: {
+        credential?: unknown;
+    }): Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        reason: string;
+    }>;
+    /** Remove a member — **kick = the org revokes** its role delegation (C2). */
+    leaveChannel(channelId: string, member: string): Promise<void>;
+    channelMembers(channelId: string): Promise<string[]>;
+    /** An agent's cached conversation-role projection, or `null` if none is projected (spec 324 §8). */
+    channelRoleProjection(channelId: string, agent: string): Promise<ConversationRoleProjection | null>;
+    /** AUTHORITATIVE projection (spec 324 §8): the org that OWNS this gateway caches a conversation-role it just
+     *  materialized (RoleAssignment + delegation). Ungated — the principal is authoritative over its own
+     *  conversations (this is the bootstrap + primary path). The `by`-gated variant is for delegated managers. */
+    projectConversationRole(channelId: string, projection: ConversationRoleProjection): Promise<void>;
+    /** MANAGE-gated (spec 324 §8): project a member's conversation role. `by` must hold a cached projection
+     *  authorizing `manage`. This CACHES an org-issued RoleAssignment + its materializing delegation — it does
+     *  not itself grant authority (ADR-0048 #4); the org issues the delegation, then the projection mirrors it. */
+    putConversationRoleProjection(channelId: string, projection: ConversationRoleProjection, by: string, at?: string): Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        reason: string;
+    }>;
+    /** MANAGE-gated: clear a member's conversation-role projection (the org revoked the underlying delegation). */
+    clearConversationRoleProjection(channelId: string, member: string, by: string, at?: string): Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        reason: string;
+    }>;
+    /** MODERATE-gated (spec 324 §8): remove a post from the channel board. `by` must hold a cached projection
+     *  authorizing `moderate`. The exchange itself is NOT deleted (immutable stream + provenance); only its
+     *  channel index entry is removed. */
+    removeChannelPost(channelId: string, exchangeId: string, by: string, at?: string): Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        reason: string;
+    }>;
+    /**
+     * Post to a channel — MEMBER-GATED, fail-closed: only a current member (`record.parties.from`) may post.
+     * The post is persisted on the org's exchange stream via `deliver()` (so it accretes a provenance trace like
+     * any exchange) and indexed into the channel. Fan-out to members is the org re-delivering (§4 / Blocker 6).
+     */
+    postToChannel(channelId: string, record: ExchangeRecordV1): Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        reason: string;
+    }>;
+    /** Admit a Service-SA bot to a channel (the org's scoped channel-participation delegation). */
+    addChannelBot(channelId: string, botSA: string): Promise<void>;
+    /** Remove a bot — revoke its channel participation. */
+    removeChannelBot(channelId: string, botSA: string): Promise<void>;
+    channelBots(channelId: string): Promise<string[]>;
+    /** The channel's shared board — its posts (full exchange records), newest first. */
+    channelFeed(channelId: string): Promise<ExchangeRecordV1[]>;
+    /** Adapt a persisted `ExchangeRecordV1` to the provenance projector's STRUCTURAL input (the projector is a
+     *  leaf — `fabric → provenance` §8 — so fabric does the mapping). `resourceOwner ≠ principal` ⇒ `onBehalfOf`
+     *  (private detail); authority refs go by `kind:hash`; the body VaultRef is the output ref (never plaintext). */
+    private exchangeToProvenanceInput;
+    /** The exchange's PRIVATE provenance A-box (PROV-O activity + P-Plan, §6/§15), or `null`. */
+    getProvenance(exchangeId: ExchangeId | string): Promise<ProvenanceRecordV1 | null>;
+    /** The DO-local delivery-receipt attestation pubkey — publish it so senders can verify receipts. */
+    receiptPubkey(): Promise<string>;
+    /** Sign a `DeliveryReceiptV1` with the DO-local key — the delivery-proof-under-authority-at-T the sender
+     *  gets, decoupled from body storage (spec 316 §3a receipt / Blocker 4). Verify with `verifyDeliveryReceipt`. */
+    signDeliveryReceipt(input: DeliveryReceiptInput): Promise<SignedDeliveryReceiptV1>;
+    /**
+     * RECIPIENT-side peer delivery (spec 316 §4 / W4). Transport-admits an inbound `DeliveryEnvelopeV1` (routing
+     * + addressing + structural), then persists the exchange, records the `delivered` fact, and returns a
+     * DO-signed `DeliveryReceiptV1`. Sender AUTHORITY (envelope signature) is re-verified separately by the gateway
+     * (ADR-0041) — admission here is transport-level only. `recipient` is this gateway's principal.
+     */
+    receiveDelivery(delivery: DeliveryEnvelopeV1, opts: {
+        recipient: CanonicalAgentId;
+        tier: AuthorityTier;
+        at: string;
+    }): Promise<{
+        ok: true;
+        receipt: SignedDeliveryReceiptV1;
+    } | {
+        ok: false;
+        reason: string;
+    }>;
+    /**
+     * T2 orchestrated lane (spec 316 §15) — a `request`/agent-task INTENT is fulfilled by the Ring-0
+     * orchestration loop running IN this gateway, with the co-resident MCP tools as the loop's ToolInvoker
+     * (in-process over the DO-local vault, under the verified `principal`). Only the LLM `planner` is injected;
+     * the loop, the tools, and the vault are the gateway's own. Returns the orchestration `RunResult`. (Absorbing
+     * `A2aTaskDO` + driving this from `alarm()` via a durable task queue is the remaining async-scheduling wrap.)
+     */
+    orchestrate(input: {
+        intent: Intent;
+        principal: string;
+        maxSteps?: number;
+        exchangeId?: string;
+        at?: string;
+    }): Promise<RunResult>;
+    /** SENDER-side store-and-forward (spec 316 §4): queue a peer delivery that could not be handed to the
+     *  recipient gateway now; `alarm()` retries with backoff until delivered (offline-first, §11a). */
+    enqueueOutbound(delivery: DeliveryEnvelopeV1, opts: {
+        nextAttemptAt: string;
+        at: string;
+    }): Promise<void>;
+    /** The due outbound deliveries to retry (the `alarm()` drain set). */
+    outboxDue(now: string): Promise<OutboxEntry[]>;
+    /** Mark an outbound delivery delivered (remove from the queue) after a successful peer hand-off. */
+    outboxDelivered(nonce: string): Promise<void>;
+    /**
+     * The co-resident vault for `wrapper`'s owner. The per-owner DEK `wrapper` (the owner's KEK) is resolved
+     * COLD-PATH by the caller (KMS, never on the warm lane — spec 316 §3/Blocker 4) and handed in, so this hot
+     * accessor stays key-material-free. Same `state.storage.sql` as the exchange stream — one trust domain.
+     */
+    vault(wrapper: DekWrapper): Vault;
+    /**
+     * T0 communication lane — persist a delivered exchange (sender-proof-only; no case, no RPC — §3). The
+     * record is built upstream (envelope validated + `bodyHash`-verified at ingress); the DO is the durable
+     * single writer. Idempotent by `exchangeId` (put overwrites the same id; a genuine redelivery is caught by
+     * the message event's `idempotencyKey` at the reducer). Receipt signing (`DeliveryReceiptV1`, DO-local
+     * software key) is a W2 follow-step.
+     */
+    deliver(record: ExchangeRecordV1): Promise<void>;
+    /** Append one event to an existing exchange (case transitions / transport moves), reduced fail-closed. */
+    applyEvent(exchangeId: ExchangeId | string, event: ExchangeEventV1): Promise<import("../exchange-reducer.js").ExchangeApplyResult | null>;
+    private requireDeps;
+    /** The verdict cache (revoke / epoch-sweep hooks + read for tests). */
+    get authority(): AuthorityVerdictCache;
+    /**
+     * COLD path (§3a): run the FULL injected `verifyToken` (establishes DEL-001 binding + ERC-1271 validity +
+     * `delegator===principal`) and, on success, cache the args-independent verdict (A) so the warm T1 lane can
+     * reuse it. Returns the verdict (or `null` if invalid). This is the ONLY place (A) is produced.
+     */
+    verifyAndCache(token: string): Promise<AuthorityVerdict | null>;
+    /**
+     * T1 execution-fast lane (§3a) — the co-resident MCP call. Authorization = **(A) PLUS (B) PLUS a single-use
+     * requestId**, never (A) alone:
+     *  (A) the CACHED args-independent verdict — a miss falls to the cold path (`verifyAndCache`);
+     *  (B) the per-call caveat pass against the concrete tool+args — injected `runCaveatPass`, run on EVERY
+     *      invoke, NEVER cached;
+     *  then a single-use `requestId` (argsHash-bound by the caller) guards replay.
+     * Only AFTER all three does the co-resident tool run IN-PROCESS over the DO-local vault (resolved under the
+     * verified `principal`'s KEK) — no cross-service hop. A failed invoke releases the requestId (retryable).
+     */
+    invokeFast(input: {
+        key: AuthorityVerdictKey;
+        requestId: string;
+        now: string;
+        tool: string;
+        args: Record<string, unknown>;
+        runCaveatPass: (verdict: AuthorityVerdict, tool: string, args: Record<string, unknown>) => Promise<boolean>;
+    }): Promise<{
+        ok: true;
+        principal: string;
+        result: unknown;
+    } | {
+        ok: false;
+        reason: string;
+    }>;
+    /** The principal's exchanges, newest first — the inbox-projection source (full `projectInboxItem` fold is
+     *  the W2 incremental-projection step; the durable stream it reads is here). */
+    inbox(): Promise<ExchangeRecordV1[]>;
+    fetch(request: Request): Promise<Response>;
+    /** Due-work processing (async). Drives two loops: (1) **outbox drain** — re-attempt `outboxDue(now)` peer
+     *  deliveries via the injected transport, `outboxDelivered` on success / `outbox.reschedule` with backoff on
+     *  failure; (2) T2 orchestration (the §15 loop + `A2aTaskDO` absorption). Both need injected effects (the
+     *  peer transport / the orchestration binding) — wired in the W2/W4 follow-steps; the durable queues they
+     *  read (`outbox`, exchange stream) are here. */
+    alarm(): Promise<void>;
+}
+//# sourceMappingURL=principal-gateway-do.d.ts.map

package/dist/cloudflare/principal-gateway-do.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal-gateway-do.d.ts","sourceRoot":"","sources":["../../src/cloudflare/principal-gateway-do.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAC3F,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAoD,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEvG,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACzB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC7B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAA4E,KAAK,SAAS,EAAE,KAAK,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAE/J,kHAAkH;AAClH,MAAM,WAAW,mBAAmB;IAClC,2FAA2F;IAC3F,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B;oGACgG;IAChG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC7D,4EAA4E;IAC5E,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/C,wFAAwF;IACxF,KAAK,EAAE,mBAAmB,CAAC;IAC3B;oGACgG;IAChG,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;+GAE2G;IAC3G,iBAAiB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACpG;AAMD,qBAAa,kBAAkB;IAW3B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;IAZxB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgB;IAC1C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwB;IACjD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkB;IAC7C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwB;IACjD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkB;IAC7C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAe;gBAGrB,KAAK,EAAE,kBAAkB,EACzB,GAAG,EAAE,mBAAmB,EACxB,IAAI,CAAC,EAAE,WAAW,YAAA;IAmBrC,yDAAyD;IACnD,aAAa,CAAC,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAItD;;;;;OAKG;IACG,WAAW,CACf,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,IAAI,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GAClC,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAcxD,6EAA6E;IACvE,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9D,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAI1D,oGAAoG;IAC9F,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC;IAIzG;;kHAE8G;IACxG,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvG;;mHAE+G;IACzG,6BAA6B,CACjC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,0BAA0B,EACtC,EAAE,EAAE,MAAM,EACV,EAAE,CAAC,EAAE,MAAM,GACV,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAMxD,+GAA+G;IACzG,+BAA+B,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAMxJ;;0CAEsC;IAChC,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAM9I;;;;OAIG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAiBvH,+FAA+F;IACzF,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpE,uDAAuD;IACjD,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjE,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAIvD,oFAAoF;IAC9E,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAUjE;;qHAEiH;IACjH,OAAO,CAAC,yBAAyB;IAiBjC,6FAA6F;IACvF,aAAa,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAIxF,oGAAoG;IAC9F,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC;IAItC;qHACiH;IAC3G,mBAAmB,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAIxF;;;;;OAKG;IACG,eAAe,CACnB,QAAQ,EAAE,kBAAkB,EAC5B,IAAI,EAAE;QAAE,SAAS,EAAE,gBAAgB,CAAC;QAAC,IAAI,EAAE,aAAa,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GACrE,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,OAAO,EAAE,uBAAuB,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAc1F;;;;;;OAMG;IACG,WAAW,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,CAAC;IAoBxI;uGACmG;IAC7F,eAAe,CAAC,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/G,sEAAsE;IAChE,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAIpD,oGAAoG;IAC9F,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInD;;;;OAIG;IACH,KAAK,CAAC,OAAO,EAAE,UAAU,GAAG,KAAK;IAIjC;;;;;;OAMG;IACG,OAAO,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAOtD,0GAA0G;IACpG,UAAU,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,EAAE,KAAK,EAAE,eAAe;IAIxE,OAAO,CAAC,WAAW;IAKnB,uEAAuE;IACvE,IAAI,SAAS,IAAI,qBAAqB,CAErC;IAED;;;;OAIG;IACG,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAMrE;;;;;;;;;OASG;IACG,UAAU,CAAC,KAAK,EAAE;QACtB,GAAG,EAAE,mBAAmB,CAAC;QACzB,SAAS,EAAE,MAAM,CAAC;QAClB,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9B,aAAa,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;KAC7G,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAoB7F;oFACgF;IAC1E,KAAK,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAIpC,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IA4BhD;;;;qDAIiD;IAC3C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B"}

package/dist/cloudflare/principal-gateway-do.js

@@ -0,0 +1,369 @@
+import { admitDeliveryEnvelope, deliveryToExchangeRecord, } from '../delivery-envelope.js';
+import { createDurableObjectSqlVault } from './sql-vault.js';
+import { createDurableObjectOutboxStore } from './outbox-store.js';
+import { createDurableObjectExchangeStore } from './exchange-store.js';
+import { createDurableObjectAuthorityVerdictCache, } from './authority-verdict-cache.js';
+import { createDurableObjectRequestIdLedger } from './request-id-ledger.js';
+import { createDurableObjectReceiptSigner, } from './receipt-signer.js';
+import { runGatewayOrchestration } from './orchestration-runtime.js';
+import { projectExchangeProvenance, projectRunProvenance, } from '@agenticprimitives/provenance';
+import { createDurableObjectProvenanceStore } from './provenance-store.js';
+import { createDurableObjectChannelStore, projectionAuthorizes } from './channel-store.js';
+function json(body, status = 200) {
+    return new Response(JSON.stringify(body), { status, headers: { 'content-type': 'application/json' } });
+}
+export class PrincipalGatewayDO {
+    state;
+    env;
+    deps;
+    sql;
+    exchanges;
+    verdicts;
+    requestIds;
+    receipts;
+    outbox;
+    provenance;
+    channels;
+    constructor(state, env, deps) {
+        this.state = state;
+        this.env = env;
+        this.deps = deps;
+        this.sql = state.storage.sql;
+        // Co-resident, DO-local: exchange stream + vault + T1 verdict cache + request-id ledger all share the
+        // one SQLite trust domain (L2, §4.0). The receipt signer holds a DO-local software key in DO KV storage.
+        this.exchanges = createDurableObjectExchangeStore(this.sql);
+        this.verdicts = createDurableObjectAuthorityVerdictCache(this.sql);
+        this.requestIds = createDurableObjectRequestIdLedger(this.sql);
+        this.receipts = createDurableObjectReceiptSigner(state.storage);
+        this.outbox = createDurableObjectOutboxStore(this.sql);
+        this.provenance = createDurableObjectProvenanceStore(this.sql);
+        this.channels = createDurableObjectChannelStore(this.sql);
+    }
+    // ─── Channels (spec 318 C1) — this gateway DO acts as an ORG SA's shared board ──────────────────────
+    //  A channel is a shared context on this org's exchange stream; membership is the org's policy (projected
+    //  from the app directory listing, spec 313); posting is member-gated fail-closed. Roles = delegations
+    //  (C2) and token-gated join (C3) layer on top; the org agent acting in-channel is `orchestrate()` (§15).
+    /** Create/rename a channel owned by this org gateway. */
+    async createChannel(channel) {
+        return this.channels.createChannel(channel);
+    }
+    /**
+     * Add a member with a role (spec 318 C2 — the role IS the projection of an org-SA delegation caveat).
+     * TOKEN-GATED (C3): if the channel carries a `joinGate`, the join is admitted ONLY if `opts.credential`
+     * satisfies it via the injected `verifyEntitlement` (fail-closed — no credential / no verifier / invalid ⇒
+     * rejected). An ungated channel joins openly.
+     */
+    async joinChannel(channelId, member, opts = {}) {
+        const channel = await this.channels.getChannel(channelId);
+        if (channel?.joinGate) {
+            const verify = this.deps?.verifyEntitlement;
+            if (!verify)
+                return { ok: false, reason: 'gate_unverifiable' };
+            if (opts.credential === undefined)
+                return { ok: false, reason: 'credential_required' };
+            if (!(await verify(channel.joinGate, opts.credential, member)))
+                return { ok: false, reason: 'entitlement_denied' };
+        }
+        // Joining establishes plain MEMBERSHIP only (spec 324 §8 — no mandatory role). In-conversation authority
+        // (moderate/manage) is a SEPARATE ConversationRoleProjection the org projects after issuing a RoleAssignment.
+        await this.channels.join(channelId, member);
+        return { ok: true };
+    }
+    /** Remove a member — **kick = the org revokes** its role delegation (C2). */
+    async leaveChannel(channelId, member) {
+        return this.channels.leave(channelId, member);
+    }
+    async channelMembers(channelId) {
+        return this.channels.members(channelId);
+    }
+    /** An agent's cached conversation-role projection, or `null` if none is projected (spec 324 §8). */
+    async channelRoleProjection(channelId, agent) {
+        return this.channels.roleProjection(channelId, agent);
+    }
+    /** AUTHORITATIVE projection (spec 324 §8): the org that OWNS this gateway caches a conversation-role it just
+     *  materialized (RoleAssignment + delegation). Ungated — the principal is authoritative over its own
+     *  conversations (this is the bootstrap + primary path). The `by`-gated variant is for delegated managers. */
+    async projectConversationRole(channelId, projection) {
+        await this.channels.putRoleProjection({ ...projection, conversationId: channelId });
+    }
+    /** MANAGE-gated (spec 324 §8): project a member's conversation role. `by` must hold a cached projection
+     *  authorizing `manage`. This CACHES an org-issued RoleAssignment + its materializing delegation — it does
+     *  not itself grant authority (ADR-0048 #4); the org issues the delegation, then the projection mirrors it. */
+    async putConversationRoleProjection(channelId, projection, by, at) {
+        if (!projectionAuthorizes(await this.channels.roleProjection(channelId, by), 'manage', at))
+            return { ok: false, reason: 'not_authorized' };
+        await this.channels.putRoleProjection({ ...projection, conversationId: channelId });
+        return { ok: true };
+    }
+    /** MANAGE-gated: clear a member's conversation-role projection (the org revoked the underlying delegation). */
+    async clearConversationRoleProjection(channelId, member, by, at) {
+        if (!projectionAuthorizes(await this.channels.roleProjection(channelId, by), 'manage', at))
+            return { ok: false, reason: 'not_authorized' };
+        await this.channels.clearRoleProjection(channelId, member);
+        return { ok: true };
+    }
+    /** MODERATE-gated (spec 324 §8): remove a post from the channel board. `by` must hold a cached projection
+     *  authorizing `moderate`. The exchange itself is NOT deleted (immutable stream + provenance); only its
+     *  channel index entry is removed. */
+    async removeChannelPost(channelId, exchangeId, by, at) {
+        if (!projectionAuthorizes(await this.channels.roleProjection(channelId, by), 'moderate', at))
+            return { ok: false, reason: 'not_authorized' };
+        await this.channels.removePost(channelId, exchangeId);
+        return { ok: true };
+    }
+    /**
+     * Post to a channel — MEMBER-GATED, fail-closed: only a current member (`record.parties.from`) may post.
+     * The post is persisted on the org's exchange stream via `deliver()` (so it accretes a provenance trace like
+     * any exchange) and indexed into the channel. Fan-out to members is the org re-delivering (§4 / Blocker 6).
+     */
+    async postToChannel(channelId, record) {
+        const from = record.parties.from;
+        // A poster is either a channel MEMBER (person/org, C1/C2) or an admitted channel BOT (Service SA, C4).
+        if (!(await this.channels.isMember(channelId, from)) && !(await this.channels.isBot(channelId, from))) {
+            return { ok: false, reason: 'not_a_member' };
+        }
+        await this.deliver(record);
+        await this.channels.addPost(channelId, String(record.exchangeId), record.updatedAt);
+        return { ok: true };
+    }
+    // ─── C4: channel bots ARE Service Smart Agents (spec 318 §8) ─────────────────────────────────────────
+    //  A bot is a DISTINCT Service SA admitted to the channel via a scoped org delegation (tracked here);
+    //  it may post like a member (`postToChannel`). Invocation is INTENT-NATIVE: an @-mention routes to the
+    //  bot's OWN gateway `orchestrate()` (§15), which posts the reply back via `postToChannel` under the bot's
+    //  authority — not a webhook. The bot holds ONLY its scoped delegation; removeChannelBot = revoke.
+    /** Admit a Service-SA bot to a channel (the org's scoped channel-participation delegation). */
+    async addChannelBot(channelId, botSA) {
+        return this.channels.addBot(channelId, botSA);
+    }
+    /** Remove a bot — revoke its channel participation. */
+    async removeChannelBot(channelId, botSA) {
+        return this.channels.removeBot(channelId, botSA);
+    }
+    async channelBots(channelId) {
+        return this.channels.bots(channelId);
+    }
+    /** The channel's shared board — its posts (full exchange records), newest first. */
+    async channelFeed(channelId) {
+        const ids = await this.channels.postIds(channelId);
+        const out = [];
+        for (const id of ids) {
+            const rec = await this.exchanges.get(id);
+            if (rec)
+                out.push(rec);
+        }
+        return out;
+    }
+    /** Adapt a persisted `ExchangeRecordV1` to the provenance projector's STRUCTURAL input (the projector is a
+     *  leaf — `fabric → provenance` §8 — so fabric does the mapping). `resourceOwner ≠ principal` ⇒ `onBehalfOf`
+     *  (private detail); authority refs go by `kind:hash`; the body VaultRef is the output ref (never plaintext). */
+    exchangeToProvenanceInput(record) {
+        const onBehalfOf = record.resourceOwner && record.resourceOwner.toLowerCase() !== record.principal.toLowerCase()
+            ? record.resourceOwner
+            : undefined;
+        return {
+            exchangeId: String(record.exchangeId),
+            tier: record.tier,
+            principal: record.principal,
+            from: record.parties.from,
+            at: record.updatedAt,
+            authorityRefs: (record.authorityRefs ?? []).map((r) => `${r.kind}:${r.hash}`),
+            onBehalfOf,
+            outputRef: record.envelopes[0]?.body?.resource,
+        };
+    }
+    /** The exchange's PRIVATE provenance A-box (PROV-O activity + P-Plan, §6/§15), or `null`. */
+    async getProvenance(exchangeId) {
+        return this.provenance.get(String(exchangeId));
+    }
+    /** The DO-local delivery-receipt attestation pubkey — publish it so senders can verify receipts. */
+    async receiptPubkey() {
+        return this.receipts.pubkey();
+    }
+    /** Sign a `DeliveryReceiptV1` with the DO-local key — the delivery-proof-under-authority-at-T the sender
+     *  gets, decoupled from body storage (spec 316 §3a receipt / Blocker 4). Verify with `verifyDeliveryReceipt`. */
+    async signDeliveryReceipt(input) {
+        return this.receipts.sign(input);
+    }
+    /**
+     * RECIPIENT-side peer delivery (spec 316 §4 / W4). Transport-admits an inbound `DeliveryEnvelopeV1` (routing
+     * + addressing + structural), then persists the exchange, records the `delivered` fact, and returns a
+     * DO-signed `DeliveryReceiptV1`. Sender AUTHORITY (envelope signature) is re-verified separately by the gateway
+     * (ADR-0041) — admission here is transport-level only. `recipient` is this gateway's principal.
+     */
+    async receiveDelivery(delivery, opts) {
+        const admission = admitDeliveryEnvelope(delivery, { recipient: opts.recipient });
+        if (!admission.ok)
+            return admission;
+        const rec = deliveryToExchangeRecord(delivery, { tier: opts.tier, at: opts.at });
+        await this.deliver(rec);
+        await this.applyEvent(rec.exchangeId, {
+            kind: 'message', seq: 0, at: opts.at, eventType: 'delivered', actor: delivery.envelope.from, messageId: delivery.envelope.id,
+        });
+        const receipt = await this.signDeliveryReceipt({
+            exchangeId: String(delivery.exchangeId), messageId: delivery.envelope.id, recipient: delivery.toGateway, at: opts.at,
+        });
+        return { ok: true, receipt };
+    }
+    /**
+     * T2 orchestrated lane (spec 316 §15) — a `request`/agent-task INTENT is fulfilled by the Ring-0
+     * orchestration loop running IN this gateway, with the co-resident MCP tools as the loop's ToolInvoker
+     * (in-process over the DO-local vault, under the verified `principal`). Only the LLM `planner` is injected;
+     * the loop, the tools, and the vault are the gateway's own. Returns the orchestration `RunResult`. (Absorbing
+     * `A2aTaskDO` + driving this from `alarm()` via a durable task queue is the remaining async-scheduling wrap.)
+     */
+    async orchestrate(input) {
+        const deps = this.requireDeps();
+        if (!deps.planner)
+            throw new Error('PrincipalGatewayDO: no planner configured for T2 orchestration');
+        const vault = this.vault(await deps.wrapperFor(input.principal));
+        const result = await runGatewayOrchestration(input.intent, {
+            planner: deps.planner,
+            registry: deps.tools,
+            vault,
+            principal: input.principal,
+            maxSteps: input.maxSteps,
+        });
+        // W5 — bridge the executed plan into the exchange's provenance A-box as a P-Plan (the SAME trace as the
+        // OrchestratedTask activity, §15). Merged by `exchangeId` when the caller ties the run to an exchange.
+        if (input.exchangeId && input.at) {
+            const { plan } = projectRunProvenance({ exchangeId: input.exchangeId, goal: input.intent.goal, steps: result.plan.steps.map((s) => ({ toolId: s.toolId })) });
+            await this.provenance.put(input.exchangeId, { version: 'ap.provenance.v1', agents: [], activities: [], entities: [], plans: [plan] }, input.at);
+        }
+        return result;
+    }
+    /** SENDER-side store-and-forward (spec 316 §4): queue a peer delivery that could not be handed to the
+     *  recipient gateway now; `alarm()` retries with backoff until delivered (offline-first, §11a). */
+    async enqueueOutbound(delivery, opts) {
+        return this.outbox.enqueue(delivery, opts);
+    }
+    /** The due outbound deliveries to retry (the `alarm()` drain set). */
+    async outboxDue(now) {
+        return this.outbox.due(now);
+    }
+    /** Mark an outbound delivery delivered (remove from the queue) after a successful peer hand-off. */
+    async outboxDelivered(nonce) {
+        return this.outbox.markDelivered(nonce);
+    }
+    /**
+     * The co-resident vault for `wrapper`'s owner. The per-owner DEK `wrapper` (the owner's KEK) is resolved
+     * COLD-PATH by the caller (KMS, never on the warm lane — spec 316 §3/Blocker 4) and handed in, so this hot
+     * accessor stays key-material-free. Same `state.storage.sql` as the exchange stream — one trust domain.
+     */
+    vault(wrapper) {
+        return createDurableObjectSqlVault(this.sql, wrapper);
+    }
+    /**
+     * T0 communication lane — persist a delivered exchange (sender-proof-only; no case, no RPC — §3). The
+     * record is built upstream (envelope validated + `bodyHash`-verified at ingress); the DO is the durable
+     * single writer. Idempotent by `exchangeId` (put overwrites the same id; a genuine redelivery is caught by
+     * the message event's `idempotencyKey` at the reducer). Receipt signing (`DeliveryReceiptV1`, DO-local
+     * software key) is a W2 follow-step.
+     */
+    async deliver(record) {
+        await this.exchanges.put(record);
+        // W5 — project the exchange into the PRIVATE provenance A-box (one trace, §15). Off the sender's hot path
+        // conceptually, but co-located here (demo-scale); a public row is derived SEPARATELY via the S1 firewall.
+        await this.provenance.put(String(record.exchangeId), projectExchangeProvenance(this.exchangeToProvenanceInput(record)), record.updatedAt);
+    }
+    /** Append one event to an existing exchange (case transitions / transport moves), reduced fail-closed. */
+    async applyEvent(exchangeId, event) {
+        return this.exchanges.append(exchangeId, event);
+    }
+    requireDeps() {
+        if (!this.deps)
+            throw new Error('PrincipalGatewayDO: co-resident MCP deps not configured (verifyToken/wrapperFor/tools)');
+        return this.deps;
+    }
+    /** The verdict cache (revoke / epoch-sweep hooks + read for tests). */
+    get authority() {
+        return this.verdicts;
+    }
+    /**
+     * COLD path (§3a): run the FULL injected `verifyToken` (establishes DEL-001 binding + ERC-1271 validity +
+     * `delegator===principal`) and, on success, cache the args-independent verdict (A) so the warm T1 lane can
+     * reuse it. Returns the verdict (or `null` if invalid). This is the ONLY place (A) is produced.
+     */
+    async verifyAndCache(token) {
+        const verdict = await this.requireDeps().verifyToken(token);
+        if (verdict)
+            await this.verdicts.put(verdict);
+        return verdict;
+    }
+    /**
+     * T1 execution-fast lane (§3a) — the co-resident MCP call. Authorization = **(A) PLUS (B) PLUS a single-use
+     * requestId**, never (A) alone:
+     *  (A) the CACHED args-independent verdict — a miss falls to the cold path (`verifyAndCache`);
+     *  (B) the per-call caveat pass against the concrete tool+args — injected `runCaveatPass`, run on EVERY
+     *      invoke, NEVER cached;
+     *  then a single-use `requestId` (argsHash-bound by the caller) guards replay.
+     * Only AFTER all three does the co-resident tool run IN-PROCESS over the DO-local vault (resolved under the
+     * verified `principal`'s KEK) — no cross-service hop. A failed invoke releases the requestId (retryable).
+     */
+    async invokeFast(input) {
+        const deps = this.requireDeps();
+        const verdict = await this.verdicts.get(input.key); // (A)
+        if (!verdict)
+            return { ok: false, reason: 'verdict_miss_cold_path_required' };
+        if (!(await input.runCaveatPass(verdict, input.tool, input.args)))
+            return { ok: false, reason: 'caveat_denied' }; // (B), never cached
+        const tool = deps.tools.get(input.tool);
+        if (!tool)
+            return { ok: false, reason: 'unknown_tool' }; // check before reserving — an unknown tool burns no id
+        const reservation = await this.requestIds.reserve(input.requestId, input.now);
+        if (!reservation)
+            return { ok: false, reason: 'replay' };
+        try {
+            const wrapper = await deps.wrapperFor(verdict.principal);
+            const result = await tool.run({ principal: verdict.principal, vault: this.vault(wrapper), args: input.args });
+            await reservation.commit();
+            return { ok: true, principal: verdict.principal, result };
+        }
+        catch (e) {
+            await reservation.release(); // a failed invoke frees the id for a legitimate retry (spec 290 §3)
+            throw e;
+        }
+    }
+    /** The principal's exchanges, newest first — the inbox-projection source (full `projectInboxItem` fold is
+     *  the W2 incremental-projection step; the durable stream it reads is here). */
+    async inbox() {
+        return this.exchanges.list();
+    }
+    async fetch(request) {
+        const url = new URL(request.url);
+        try {
+            if (request.method === 'POST' && url.pathname === '/deliver') {
+                await this.deliver((await request.json()));
+                return json({ ok: true });
+            }
+            if (request.method === 'POST' && url.pathname === '/event') {
+                const body = (await request.json());
+                const result = await this.applyEvent(body.exchangeId, body.event);
+                if (result === null)
+                    return json({ ok: false, error: 'unknown_exchange' }, 404);
+                return result.ok ? json({ ok: true }) : json({ ok: false, error: result.reason }, 409);
+            }
+            if (request.method === 'GET' && url.pathname === '/inbox') {
+                return json({ ok: true, exchanges: await this.inbox() });
+            }
+            // TODO (W2 follow-steps, spec 316 §3/§4/§15):
+            //  • T1 `invokeFast` — co-resident MCP `withDelegation` in-DO + `AuthorityVerdictCache` (full
+            //    `verifyDelegationToken` §3a) + `RequestIdLedger`; sensitive stays T2.
+            //  • T2 orchestrated — the `@agenticprimitives/orchestration` loop in this DO (intent alignment §15),
+            //    driven by `alarm()`; absorb `A2aTaskDO`.
+            //  • gatewayRoot delivery + signed `DeliveryReceiptV1` (DO-local software key).
+            return json({ ok: false, error: 'not_found' }, 404);
+        }
+        catch (e) {
+            return json({ ok: false, error: e instanceof Error ? e.message : String(e) }, 500);
+        }
+    }
+    /** Due-work processing (async). Drives two loops: (1) **outbox drain** — re-attempt `outboxDue(now)` peer
+     *  deliveries via the injected transport, `outboxDelivered` on success / `outbox.reschedule` with backoff on
+     *  failure; (2) T2 orchestration (the §15 loop + `A2aTaskDO` absorption). Both need injected effects (the
+     *  peer transport / the orchestration binding) — wired in the W2/W4 follow-steps; the durable queues they
+     *  read (`outbox`, exchange stream) are here. */
+    async alarm() {
+        // no-op until the peer transport + T2 orchestration bindings are injected
+    }
+}
+//# sourceMappingURL=principal-gateway-do.js.map

package/dist/cloudflare/principal-gateway-do.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal-gateway-do.js","sourceRoot":"","sources":["../../src/cloudflare/principal-gateway-do.ts"],"names":[],"mappings":"AAaA,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GAEzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,8BAA8B,EAAsC,MAAM,mBAAmB,CAAC;AACvG,OAAO,EAAE,gCAAgC,EAAsB,MAAM,qBAAqB,CAAC;AAC3F,OAAO,EACL,wCAAwC,GAIzC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,kCAAkC,EAAwB,MAAM,wBAAwB,CAAC;AAClG,OAAO,EACL,gCAAgC,GAIjC,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAErE,OAAO,EACL,yBAAyB,EACzB,oBAAoB,GAGrB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,kCAAkC,EAAwB,MAAM,uBAAuB,CAAC;AACjG,OAAO,EAAE,+BAA+B,EAAE,oBAAoB,EAAsE,MAAM,oBAAoB,CAAC;AA+B/J,SAAS,IAAI,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG;IACvC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;AACzG,CAAC;AAED,MAAM,OAAO,kBAAkB;IAWV;IACA;IACA;IAZF,GAAG,CAAa;IAChB,SAAS,CAAgB;IACzB,QAAQ,CAAwB;IAChC,UAAU,CAAkB;IAC5B,QAAQ,CAAwB;IAChC,MAAM,CAAc;IACpB,UAAU,CAAkB;IAC5B,QAAQ,CAAe;IAExC,YACmB,KAAyB,EACzB,GAAwB,EACxB,IAAkB;QAFlB,UAAK,GAAL,KAAK,CAAoB;QACzB,QAAG,GAAH,GAAG,CAAqB;QACxB,SAAI,GAAJ,IAAI,CAAc;QAEnC,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAC7B,sGAAsG;QACtG,yGAAyG;QACzG,IAAI,CAAC,SAAS,GAAG,gCAAgC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5D,IAAI,CAAC,QAAQ,GAAG,wCAAwC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnE,IAAI,CAAC,UAAU,GAAG,kCAAkC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/D,IAAI,CAAC,QAAQ,GAAG,gCAAgC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,GAAG,8BAA8B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvD,IAAI,CAAC,UAAU,GAAG,kCAAkC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/D,IAAI,CAAC,QAAQ,GAAG,+BAA+B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5D,CAAC;IAED,uGAAuG;IACvG,0GAA0G;IAC1G,uGAAuG;IACvG,0GAA0G;IAE1G,yDAAyD;IACzD,KAAK,CAAC,aAAa,CAAC,OAAkB;QACpC,OAAO,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CACf,SAAiB,EACjB,MAAc,EACd,OAAiC,EAAE;QAEnC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC1D,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC;YAC5C,IAAI,CAAC,MAAM;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;YAC/D,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;YACvF,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QACrH,CAAC;QACD,yGAAyG;QACzG,8GAA8G;QAC9G,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC5C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,YAAY,CAAC,SAAiB,EAAE,MAAc;QAClD,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,SAAiB;QACpC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;IAED,oGAAoG;IACpG,KAAK,CAAC,qBAAqB,CAAC,SAAiB,EAAE,KAAa;QAC1D,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACxD,CAAC;IAED;;kHAE8G;IAC9G,KAAK,CAAC,uBAAuB,CAAC,SAAiB,EAAE,UAAsC;QACrF,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,GAAG,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC;IACtF,CAAC;IAED;;mHAE+G;IAC/G,KAAK,CAAC,6BAA6B,CACjC,SAAiB,EACjB,UAAsC,EACtC,EAAU,EACV,EAAW;QAEX,IAAI,CAAC,oBAAoB,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QAC3I,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,GAAG,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC;QACpF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,+GAA+G;IAC/G,KAAK,CAAC,+BAA+B,CAAC,SAAiB,EAAE,MAAc,EAAE,EAAU,EAAE,EAAW;QAC9F,IAAI,CAAC,oBAAoB,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QAC3I,MAAM,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC3D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED;;0CAEsC;IACtC,KAAK,CAAC,iBAAiB,CAAC,SAAiB,EAAE,UAAkB,EAAE,EAAU,EAAE,EAAW;QACpF,IAAI,CAAC,oBAAoB,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QAC7I,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QACtD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CAAC,SAAiB,EAAE,MAAwB;QAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QACjC,uGAAuG;QACvG,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;YACtG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAC/C,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACpF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,wGAAwG;IACxG,sGAAsG;IACtG,wGAAwG;IACxG,2GAA2G;IAC3G,mGAAmG;IAEnG,+FAA+F;IAC/F,KAAK,CAAC,aAAa,CAAC,SAAiB,EAAE,KAAa;QAClD,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,uDAAuD;IACvD,KAAK,CAAC,gBAAgB,CAAC,SAAiB,EAAE,KAAa;QACrD,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,SAAiB;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;IAED,oFAAoF;IACpF,KAAK,CAAC,WAAW,CAAC,SAAiB;QACjC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACnD,MAAM,GAAG,GAAuB,EAAE,CAAC;QACnC,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzC,IAAI,GAAG;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;qHAEiH;IACzG,yBAAyB,CAAC,MAAwB;QACxD,MAAM,UAAU,GACd,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE;YAC3F,CAAC,CAAC,MAAM,CAAC,aAAa;YACtB,CAAC,CAAC,SAAS,CAAC;QAChB,OAAO;YACL,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;YACrC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;YACzB,EAAE,EAAE,MAAM,CAAC,SAAS;YACpB,aAAa,EAAE,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7E,UAAU;YACV,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ;SAC/C,CAAC;IACJ,CAAC;IAED,6FAA6F;IAC7F,KAAK,CAAC,aAAa,CAAC,UAA+B;QACjD,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,oGAAoG;IACpG,KAAK,CAAC,aAAa;QACjB,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;IAChC,CAAC;IAED;qHACiH;IACjH,KAAK,CAAC,mBAAmB,CAAC,KAA2B;QACnD,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CACnB,QAA4B,EAC5B,IAAsE;QAEtE,MAAM,SAAS,GAAG,qBAAqB,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACjF,IAAI,CAAC,SAAS,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;QACpC,MAAM,GAAG,GAAG,wBAAwB,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACjF,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE;YACpC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE;SAC7H,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC;YAC7C,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE;SACrH,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,WAAW,CAAC,KAAiG;QACjH,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACrG,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,MAAM,EAAE;YACzD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,QAAQ,EAAE,IAAI,CAAC,KAAK;YACpB,KAAK;YACL,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;QACH,wGAAwG;QACxG,uGAAuG;QACvG,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;YACjC,MAAM,EAAE,IAAI,EAAE,GAAG,oBAAoB,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;YAC9J,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;QAClJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;uGACmG;IACnG,KAAK,CAAC,eAAe,CAAC,QAA4B,EAAE,IAA2C;QAC7F,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,sEAAsE;IACtE,KAAK,CAAC,SAAS,CAAC,GAAW;QACzB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED,oGAAoG;IACpG,KAAK,CAAC,eAAe,CAAC,KAAa;QACjC,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAmB;QACvB,OAAO,2BAA2B,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CAAC,MAAwB;QACpC,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjC,0GAA0G;QAC1G,0GAA0G;QAC1G,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,yBAAyB,CAAC,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5I,CAAC;IAED,0GAA0G;IAC1G,KAAK,CAAC,UAAU,CAAC,UAA+B,EAAE,KAAsB;QACtE,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;IAEO,WAAW;QACjB,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;QAC1H,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,uEAAuE;IACvE,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,KAAa;QAChC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC5D,IAAI,OAAO;YAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,UAAU,CAAC,KAOhB;QACC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM;QAC1D,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;QAC9E,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC,oBAAoB;QACtI,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC,uDAAuD;QAChH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9E,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACzD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACzD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC9G,MAAM,WAAW,CAAC,MAAM,EAAE,CAAC;YAC3B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;QAC5D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,oEAAoE;YACjG,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAED;oFACgF;IAChF,KAAK,CAAC,KAAK;QACT,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAAgB;QAC1B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC;YACH,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;gBAC7D,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAqB,CAAC,CAAC;gBAC/D,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5B,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC3D,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAmD,CAAC;gBACtF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;gBAClE,IAAI,MAAM,KAAK,IAAI;oBAAE,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,GAAG,CAAC,CAAC;gBAChF,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;YACzF,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC1D,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC3D,CAAC;YACD,8CAA8C;YAC9C,8FAA8F;YAC9F,2EAA2E;YAC3E,sGAAsG;YACtG,8CAA8C;YAC9C,gFAAgF;YAChF,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IAED;;;;qDAIiD;IACjD,KAAK,CAAC,KAAK;QACT,0EAA0E;IAC5E,CAAC;CACF"}