@agenticprimitives/fabric 0.0.0-alpha.4 → 0.0.0-alpha.41

package/dist/cloudflare/principal-gateway-do.d.ts

@@ -2,10 +2,16 @@ import type { Vault, DekWrapper } from '@agenticprimitives/vault';
 import type { CanonicalAgentId } from '@agenticprimitives/types';
 import type { AuthorityTier } from '@agenticprimitives/tool-policy';
 import type { ExchangeRecordV1, ExchangeEventV1, ExchangeId } from '../exchange-record.js';
+import { type InteractionState } from '../interaction-machines.js';
 import { type DeliveryEnvelopeV1 } from '../delivery-envelope.js';
 import { type OutboxEntry } from './outbox-store.js';
+import { type ExchangeStore } from './exchange-store.js';
+import { type InteractionStore } from './interaction-store.js';
+import type { CommitmentRecordV1 } from '../interaction-machines.js';
+import type { InteractionRecordV1, InteractionId, ProfileVersion, ParticipationV1 } from '../interaction-record.js';
+import type { ProtocolBindingV1 } from '../protocol-binding.js';
 import { type AuthorityVerdictCache, type AuthorityVerdict, type AuthorityVerdictKey } from './authority-verdict-cache.js';
-import { type DeliveryReceiptInput, type SignedDeliveryReceiptV1 } from './receipt-signer.js';
+import { type SignedDeliveryReceiptV1 } from './receipt-signer.js';
 import type { GatewayToolRegistry } from './gateway-tools.js';
 import type { Intent, Planner, RunResult } from '@agenticprimitives/orchestration';
 import { type ProvenanceRecordV1 } from '@agenticprimitives/provenance';
@@ -14,6 +20,10 @@ import { type ChannelV1, type ConversationRoleProjection } from './channel-store
 export interface PrincipalGatewayEnv {
     /** The chain id the gateway verifies authority against (for the T1 verdict + delivery). */
     CHAIN_ID?: string;
+    /** The CAIP-10 of the principal THIS gateway belongs to. Optional so every existing deployment keeps
+     *  working, but required by `openInteraction`: an interaction is custodied by the gateway holding it,
+     *  and a gateway that cannot name itself cannot be a custodian. Fails closed rather than defaulting. */
+    PRINCIPAL_SA?: string;
 }
 /**
  * Injected co-resident-MCP dependencies. INJECTED (not built in the fabric core) because they need
@@ -22,6 +32,17 @@ export interface PrincipalGatewayEnv {
  * tests pass fakes. Absent ⇒ the storage/guard methods still work, but the co-resident-MCP methods throw.
  */
 export interface GatewayDeps {
+    /**
+     * WHO IS CALLING (spec 445 §3.4, audit DATA-3). The embedding Worker has admitted the request
+     * (application authentication → canonical resolution → Admission, ADR-0057); this port hands that
+     * verdict to the gateway. It is the ONLY source of `principal`, `tier` and `actor` on every ingress —
+     * `fetch` and the RPC-style methods alike — and it is REQUIRED for them: with no authenticator
+     * configured every ingress is refused. `null` ⇒ not admitted.
+     *
+     * A Durable Object is reachable only through its Worker, and this class does not rely on that: a
+     * fronting Worker that forwards without its own gate, or any code holding the binding, gets nothing.
+     */
+    authenticate?: GatewayAuthenticator;
     /** Cold-path: FULL token verification → the args-independent verdict (A), or `null` if invalid. The app
      *  wires `delegation.verifyDelegationToken` with its chainId / DelegationManager / RPC here. */
     verifyToken(token: string): Promise<AuthorityVerdict | null>;
@@ -32,25 +53,147 @@ export interface GatewayDeps {
     /** The injected planner for the T2 orchestration loop (§15) — the LLM adapter in prod, the rule-based
      *  planner in tests. Absent ⇒ `orchestrate()` throws (T2 unavailable), but T0/T1 still work. */
     planner?: Planner;
+    /**
+     * THE THREE STORAGE SEAMS (ADR-0055 amendment). Omit them and this DO constructs its own DO-SQL
+     * stores, which is right for tests and for a self-hosted single-tenant gateway. A deployment whose
+     * records already live in an owner's vault MUST inject instead — because otherwise adopting this DO
+     * moves person data out of the vault as a SIDE EFFECT of a runtime change, decided by a constructor
+     * rather than by anyone.
+     *
+     * `vault` is the one that carries durable private records, so it is the one that matters most.
+     * `exchangeStore` / `interactionStore` may stay DO-local ONLY as ordering + index over exchanges
+     * whose records live in the vault — and only if they are genuinely rebuildable from it: the durable
+     * fact written to the vault first, an explicit rebuild in code, and a test that wipes the DO and
+     * rebuilds. An untested rebuild path is indistinguishable from an absent one, which is how a
+     * projection silently becomes the only copy.
+     */
+    vault?(wrapper: DekWrapper): Vault;
+    exchangeStore?: ExchangeStore;
+    interactionStore?: InteractionStore;
     /** Token-gated channel join (spec 318 C3): verify a `member`'s `credential` satisfies a channel's
      *  `joinGate` requirement. Injected (the `entitlements`/`verifiable-credentials` resolver in prod, a fake in
      *  tests) — the fabric core stays credential-mechanism-free. Absent ⇒ a gated channel cannot be joined. */
     verifyEntitlement?: (requirement: string, credential: unknown, member: string) => Promise<boolean>;
 }
+/** What the embedding Worker's admission established about one request. */
+export interface GatewayCallerIdentity {
+    /** The principal the request is FOR — this gateway's own (refused otherwise when `PRINCIPAL_SA` is set). */
+    principal: CanonicalAgentId;
+    /** The lane, server-classified at admission (`ExchangeRecordV1.tier` is never client-asserted). */
+    tier: AuthorityTier;
+    /** The agent PRESENTING the request: the sender of a delivery, the poster, the party moving a case. */
+    actor: CanonicalAgentId;
+}
+/** The authenticator port: an admitted request's identity, or `null`. Supplied by the embedding Worker. */
+export type GatewayAuthenticator = (request: Request) => Promise<GatewayCallerIdentity | null>;
+declare const authenticatedCallerBrand: unique symbol;
+/**
+ * A caller identity MINTED by `PrincipalGatewayDO.admitCaller` from the authenticator's result. The
+ * RPC-style methods take this, never loose `principal`/`tier`/`actor` fields: an object literal of the
+ * same shape was not minted and is refused. In-process only — it does not survive serialization, so a
+ * caller on the far side of a stub goes through `fetch`, which authenticates each request itself.
+ */
+export type AuthenticatedCaller = Readonly<GatewayCallerIdentity> & {
+    readonly [authenticatedCallerBrand]: true;
+};
+export type GatewayAuthReason = 'authenticator_not_configured' | 'unauthenticated'
+/** The authenticated principal is not this gateway's. */
+ | 'principal_mismatch';
+/** An ingress was refused before anything was read or written (spec 445 §3.4, DATA-3). */
+export declare class GatewayAuthError extends Error {
+    readonly reason: GatewayAuthReason;
+    constructor(reason: GatewayAuthReason);
+}
+/** `openInteraction` was asked to open an interaction that already exists as something else — a
+ *  different shape, or one that has ended (spec 445 §3.4, DATB-2). Nothing was written. */
+export declare class InteractionExistsError extends Error {
+    readonly interactionId: string;
+    readonly state: InteractionState;
+    readonly reason: "interaction-exists";
+    constructor(interactionId: string, state: InteractionState);
+}
+export type GatewayOrchestrationResult = {
+    ok: true;
+    principal: string;
+    result: RunResult;
+} | {
+    ok: false;
+    reason: 'verdict_miss_cold_path_required'
+    /** The verdict's principal is not this gateway's (or not the one the caller named). */
+     | 'principal_mismatch'
+    /** `requestId` given without `now`, or the reverse. */
+     | 'request_id_incomplete' | 'replay';
+};
+/** What ingress observed about an exchange's place in a governed situation (spec 340 W7). */
+export type DeliveryNote = 
+/** No `interactionId`: this is a message, not part of a governed situation. The common case. */
+{
+    kind: 'unpinned-exchange';
+}
+/** Pinned an older profile version than the interaction now runs. Legal — and the signal that
+ *  survives a downgrade, which is why it is reported rather than refused. */
+ | {
+    kind: 'profile-downgrade';
+    pinned: string;
+    inForce: string;
+}
+/** The pinned ContextSnapshot is not on this gateway — normal for an inbound delivery, where it
+ *  lives on the sender's. Recorded so nobody reads the exchange as replayable here. */
+ | {
+    kind: 'context-unavailable';
+    digest: string;
+};
+export type DeliveryOutcome = {
+    ok: true;
+    interactionId?: InteractionId;
+    notes: readonly DeliveryNote[];
+} | {
+    ok: false;
+    reason: 
+    /** No minted caller was presented (spec 445 §3.4, DATA-3). */
+    'unauthenticated'
+    /** The record names a `principal` other than the authenticated one. */
+     | 'principal-mismatch'
+    /** The record's `parties.from` (or an event's `actor`) is not the authenticated actor. */
+     | 'actor-mismatch' | 'unknown-interaction'
+    /** The interaction is suspended, concluded, abandoned or still forming (DATB-2). `state` says which. */
+     | 'interaction-not-active' | 'not-a-participant'
+    /** An unpinned exchange whose envelope sender is not its `from`, or which does not name this
+     *  gateway's principal as a party (spec 445 §3.4). */
+     | 'not-a-party'
+    /** Something is already held under this exchange id and the offer is not the same one
+     *  (spec 445 §3.4). Nothing was written. */
+     | 'exchange-exists';
+    state?: InteractionState;
+};
 export declare class PrincipalGatewayDO {
     private readonly state;
     private readonly env;
     private readonly deps?;
     private readonly sql;
     private readonly exchanges;
+    private readonly interactionStore;
     private readonly verdicts;
     private readonly requestIds;
     private readonly receipts;
     private readonly outbox;
     private readonly provenance;
     private readonly channels;
-    constructor(state: DurableObjectState, env: PrincipalGatewayEnv, deps?: GatewayDeps | undefined);
-    /** Create/rename a channel owned by this org gateway. */
+    /** The callers `admitCaller` minted. Membership IS the proof of minting — nothing else is. */
+    private readonly minted;
+    constructor(state: DurableObjectState, env: PrincipalGatewayEnv, deps?: Partial<GatewayDeps> | undefined);
+    /**
+     * Create/rename a channel owned by this org gateway, and open the Interaction it IS (spec 340 W11).
+     *
+     * A topic was already a governed situation in everything but name: the org owns the board, members
+     * join and leave, `facilitator`/`contributor` are its roles, and it opens and closes. Opening the
+     * Interaction alongside it names that rather than adding a parallel object — the id is DERIVED
+     * (`ixn_topic_<channelId>`), so the two cannot drift and no join table exists to go stale.
+     *
+     * `participationMode: 'derived'`. Membership belongs to the channel (and, for an open topic, to the
+     * organization behind it), so the Interaction stores NO member list. Copying one per topic is what
+     * `apmsg:openParticipation` forbids, and a stale copy is how a removed member keeps posting.
+     */
     createChannel(channel: ChannelV1): Promise<void>;
     /**
      * Add a member with a role (spec 318 C2 — the role IS the projection of an org-SA delegation caveat).
@@ -58,7 +201,7 @@ export declare class PrincipalGatewayDO {
      * satisfies it via the injected `verifyEntitlement` (fail-closed — no credential / no verifier / invalid ⇒
      * rejected). An ungated channel joins openly.
      */
-    joinChannel(channelId: string, member: string, opts?: {
+    joinChannel(channelId: string, member: string, caller: AuthenticatedCaller, opts?: {
         credential?: unknown;
     }): Promise<{
         ok: true;
@@ -67,7 +210,12 @@ export declare class PrincipalGatewayDO {
         reason: string;
     }>;
     /** Remove a member — **kick = the org revokes** its role delegation (C2). */
-    leaveChannel(channelId: string, member: string): Promise<void>;
+    leaveChannel(channelId: string, member: string, caller: AuthenticatedCaller): Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        reason: string;
+    }>;
     channelMembers(channelId: string): Promise<string[]>;
     /** An agent's cached conversation-role projection, or `null` if none is projected (spec 324 §8). */
     channelRoleProjection(channelId: string, agent: string): Promise<ConversationRoleProjection | null>;
@@ -75,37 +223,41 @@ export declare class PrincipalGatewayDO {
      *  materialized (RoleAssignment + delegation). Ungated — the principal is authoritative over its own
      *  conversations (this is the bootstrap + primary path). The `by`-gated variant is for delegated managers. */
     projectConversationRole(channelId: string, projection: ConversationRoleProjection): Promise<void>;
-    /** MANAGE-gated (spec 324 §8): project a member's conversation role. `by` must hold a cached projection
+    /** MANAGE-gated (spec 324 §8): project a member's conversation role. The AUTHENTICATED actor (never a
+     *  caller-named `by`, DATA-3) must hold a cached projection
      *  authorizing `manage`. This CACHES an org-issued RoleAssignment + its materializing delegation — it does
      *  not itself grant authority (ADR-0048 #4); the org issues the delegation, then the projection mirrors it. */
-    putConversationRoleProjection(channelId: string, projection: ConversationRoleProjection, by: string, at?: string): Promise<{
+    putConversationRoleProjection(channelId: string, projection: ConversationRoleProjection, caller: AuthenticatedCaller, at?: string): Promise<{
         ok: true;
     } | {
         ok: false;
         reason: string;
     }>;
     /** MANAGE-gated: clear a member's conversation-role projection (the org revoked the underlying delegation). */
-    clearConversationRoleProjection(channelId: string, member: string, by: string, at?: string): Promise<{
+    clearConversationRoleProjection(channelId: string, member: string, caller: AuthenticatedCaller, at?: string): Promise<{
         ok: true;
     } | {
         ok: false;
         reason: string;
     }>;
-    /** MODERATE-gated (spec 324 §8): remove a post from the channel board. `by` must hold a cached projection
+    /** MODERATE-gated (spec 324 §8): remove a post from the channel board. The AUTHENTICATED actor must hold a cached projection
      *  authorizing `moderate`. The exchange itself is NOT deleted (immutable stream + provenance); only its
      *  channel index entry is removed. */
-    removeChannelPost(channelId: string, exchangeId: string, by: string, at?: string): Promise<{
+    removeChannelPost(channelId: string, exchangeId: string, caller: AuthenticatedCaller, at?: string): Promise<{
         ok: true;
     } | {
         ok: false;
         reason: string;
     }>;
     /**
-     * Post to a channel — MEMBER-GATED, fail-closed: only a current member (`record.parties.from`) may post.
+     * Post to a channel — MEMBER-GATED, fail-closed: only a current member may post, and the poster is the
+     * AUTHENTICATED actor: `record.parties.from` must be `caller.actor` (DATA-3), so membership is asked
+     * about who is actually posting, never about a name in the record. A topic whose interaction is not
+     * `active` takes no posts (`interaction-not-active`, DATB-2).
      * The post is persisted on the org's exchange stream via `deliver()` (so it accretes a provenance trace like
      * any exchange) and indexed into the channel. Fan-out to members is the org re-delivering (§4 / Blocker 6).
      */
-    postToChannel(channelId: string, record: ExchangeRecordV1): Promise<{
+    postToChannel(channelId: string, record: ExchangeRecordV1, caller: AuthenticatedCaller): Promise<{
         ok: true;
     } | {
         ok: false;
@@ -126,18 +278,34 @@ export declare class PrincipalGatewayDO {
     getProvenance(exchangeId: ExchangeId | string): Promise<ProvenanceRecordV1 | null>;
     /** The DO-local delivery-receipt attestation pubkey — publish it so senders can verify receipts. */
     receiptPubkey(): Promise<string>;
-    /** Sign a `DeliveryReceiptV1` with the DO-local key — the delivery-proof-under-authority-at-T the sender
-     *  gets, decoupled from body storage (spec 316 §3a receipt / Blocker 4). Verify with `verifyDeliveryReceipt`. */
-    signDeliveryReceipt(input: DeliveryReceiptInput): Promise<SignedDeliveryReceiptV1>;
+    /** Sign a `DeliveryReceiptV1` with the DO-local key. PRIVATE: a receipt attests to a delivery this
+     *  gateway RECORDED, so the only callers are the two delivery paths, after the `delivered` fact is in
+     *  the stream. A public signer would be a receipt oracle for any fields a caller cared to name. Verify
+     *  with `verifyDeliveryReceipt`. */
+    private signDeliveryReceipt;
     /**
      * RECIPIENT-side peer delivery (spec 316 §4 / W4). Transport-admits an inbound `DeliveryEnvelopeV1` (routing
      * + addressing + structural), then persists the exchange, records the `delivered` fact, and returns a
      * DO-signed `DeliveryReceiptV1`. Sender AUTHORITY (envelope signature) is re-verified separately by the gateway
-     * (ADR-0041) — admission here is transport-level only. `recipient` is this gateway's principal.
+     * (ADR-0041) — admission here is transport-level only.
+     *
+     * `recipient` and `tier` are the AUTHENTICATED caller's `principal` and `tier`, and the envelope's `from`
+     * must be its `actor` (spec 445 §3.4, DATA-3): who a delivery is for, which lane it rides and who
+     * sent it are admission's findings, never fields of the call.
+     *
+     * A DELIVERY NEVER OVERWRITES (spec 445 §3.4, audit H-10 / DATA-1). The exchange id comes from the
+     * peer and is known to every counterparty, so it identifies nothing about who is sending. If a record
+     * is already held under it, exactly two things can be true:
+     *
+     *   · the offered envelope IS the stored one (`isSameSignedEnvelope` — full canonical bytes, signature
+     *     included) → an idempotent redelivery. Nothing is rewritten and no second `delivered` event is
+     *     appended; the receipt returned is for the ORIGINAL delivery. Receipts are not stored, so it is
+     *     re-signed over the original `delivered` event's time — same exchange, message, recipient and
+     *     `at`, hence the same attested fact, never a fresh claim that it arrived again now.
+     *   · anything else → refused `exchange-exists`, and NO receipt is signed: a receipt for a delivery
+     *     we did not store would attest to something false.
      */
-    receiveDelivery(delivery: DeliveryEnvelopeV1, opts: {
-        recipient: CanonicalAgentId;
-        tier: AuthorityTier;
+    receiveDelivery(delivery: DeliveryEnvelopeV1, caller: AuthenticatedCaller, opts: {
         at: string;
     }): Promise<{
         ok: true;
@@ -146,20 +314,48 @@ export declare class PrincipalGatewayDO {
         ok: false;
         reason: string;
     }>;
+    /**
+     * The receipt for a redelivery of an envelope this gateway already holds (spec 445 §3.4).
+     *
+     * The time attested is the ORIGINAL `delivered` event's. One case needs a write: a first attempt that
+     * stored the record and stopped before recording `delivered`. The redelivery then completes that
+     * delivery — one event, through the reducer — rather than signing for a fact the stream does not hold.
+     */
+    private redeliveryReceipt;
     /**
      * T2 orchestrated lane (spec 316 §15) — a `request`/agent-task INTENT is fulfilled by the Ring-0
      * orchestration loop running IN this gateway, with the co-resident MCP tools as the loop's ToolInvoker
-     * (in-process over the DO-local vault, under the verified `principal`). Only the LLM `planner` is injected;
-     * the loop, the tools, and the vault are the gateway's own. Returns the orchestration `RunResult`. (Absorbing
-     * `A2aTaskDO` + driving this from `alarm()` via a durable task queue is the remaining async-scheduling wrap.)
+     * (in-process over the DO-local vault). Only the LLM `planner` is injected; the loop, the tools, and the
+     * vault are the gateway's own. (Absorbing `A2aTaskDO` + driving this from `alarm()` via a durable task
+     * queue is the remaining async-scheduling wrap.)
+     *
+     * THE SAME §3a GATE AS `invokeFast`, PER STEP (spec 445 §3.4, audit DATA-4). A T2 intent is by design
+     * a peer's request and its text reaches the planner, so nothing here trusts the plan:
+     *
+     *  (A) the cached args-independent verdict for `key` — a miss runs NOTHING (cold path first). The
+     *      principal the tools run as, and whose KEK is resolved, is the VERDICT's. It must be this
+     *      gateway's principal when the deployment names one, and the one the caller says it expects
+     *      (`principal`) when it says: a verdict for A never reaches B's records.
+     *  (B) `runCaveatPass(verdict, tool, args)` for EVERY planned step against the concrete tool and
+     *      arguments — never cached; a denied step throws inside the loop and its tool does not run.
+     *  (C) a single-use `requestId` (+ `now`) for the run. A WRITE tool does not run without one — it is
+     *      not even offered to the planner — and a replayed id is refused before anything runs, so a
+     *      retried intent is not applied twice. The id is released only when no step ran (a legitimate
+     *      retry); once any tool ran it stays consumed, whatever the outcome.
      */
     orchestrate(input: {
         intent: Intent;
-        principal: string;
+        key: AuthorityVerdictKey;
+        runCaveatPass: (verdict: AuthorityVerdict, tool: string, args: Record<string, unknown>) => Promise<boolean>;
+        /** Required for any write; with it, `now` is required too. */
+        requestId?: string;
+        now?: string;
+        /** Optional cross-check: refuse unless the verdict is for this principal. Never the source of it. */
+        principal?: string;
         maxSteps?: number;
         exchangeId?: string;
         at?: string;
-    }): Promise<RunResult>;
+    }): Promise<GatewayOrchestrationResult>;
     /** SENDER-side store-and-forward (spec 316 §4): queue a peer delivery that could not be handed to the
      *  recipient gateway now; `alarm()` retries with backoff until delivered (offline-first, §11a). */
     enqueueOutbound(delivery: DeliveryEnvelopeV1, opts: {
@@ -179,13 +375,139 @@ export declare class PrincipalGatewayDO {
     /**
      * T0 communication lane — persist a delivered exchange (sender-proof-only; no case, no RPC — §3). The
      * record is built upstream (envelope validated + `bodyHash`-verified at ingress); the DO is the durable
-     * single writer. Idempotent by `exchangeId` (put overwrites the same id; a genuine redelivery is caught by
-     * the message event's `idempotencyKey` at the reducer). Receipt signing (`DeliveryReceiptV1`, DO-local
-     * software key) is a W2 follow-step.
+     * single writer.
+     *
+     * AUTHENTICATED (spec 445 §3.4, audit DATA-3): `caller` is minted by `admitCaller`; the record's
+     * `principal` must be the caller's, its `parties.from` the caller's `actor`, and its `tier` is the
+     * caller's whatever the record says.
+     *
+     * INSERT-ONLY (spec 445 §3.4, audit H-10 / DATA-1). Every way into this method carries an exchange id
+     * somebody else chose — a peer's delivery, a member's channel post, a `/deliver` body — so it never
+     * overwrites: the store's `insert` either writes a new record or returns the one already held. An
+     * offer that is canonically identical to the held record is a retry and succeeds without writing;
+     * anything else under a held id is refused `exchange-exists`. (An exchange that has since accrued
+     * events no longer equals its seed, so a late retry of the seed is refused — `receiveDelivery`
+     * decides redelivery by the signed envelope instead, which is the identity that survives.) Changing a
+     * held exchange is the reducer's job (`applyEvent`), never a second delivery's.
+     */
+    deliver(record: ExchangeRecordV1, caller: AuthenticatedCaller): Promise<DeliveryOutcome>;
+    /** The store half of `deliver`, after the caller has been established. */
+    private ingest;
+    /**
+     * The interaction-aware half of ingress (spec 340 W7).
+     *
+     * THREE OUTCOMES, and which is which is the whole design:
+     *
+     * 1. NO `interactionId` → delivered, with an `unpinned-exchange` note. An Exchange without an
+     *    Interaction is a MESSAGE (ADR-0058 §12) — a legitimate state, and the overwhelmingly common
+     *    one. Auto-creating an interaction per message would make "a thread is a projection, not a
+     *    container" false by turning every message into a container.
+     *
+     *    Not unconditionally, though (spec 445 §3.4): with no interaction there is no membership to ask,
+     *    so the record must at least be true about its own parties — `admitUnpinned`. Like outcome 3
+     *    this is the record's shape, never authority.
+     *
+     * 2. UNKNOWN `interactionId` → REFUSED. Interactions are opened by their custodian
+     *    (`openInteraction`), never conjured by a sender. If ingress created one from a sender-supplied
+     *    id, any peer could seed arbitrary interactions with arbitrary participations on someone else's
+     *    gateway, then post into them — inventing a governed situation the owner never entered.
+     *
+     * 3. KNOWN `interactionId` → the interaction must be `active` (DATB-2), and the sender must be a
+     *    current participant. An exchange claiming to occur
+     *    in an interaction whose membership does not include its sender is a record that misrepresents
+     *    the situation. This is an integrity check on the record's shape, NOT authority: being a
+     *    participant is not permission to do anything (ADR-0048 §4).
+     *
+     * Two conditions are NOTED rather than refused, because refusing them would lose true records:
+     *   · a profile-version mismatch — a mid-flight profile bump is legal, and the per-exchange pin is
+     *     the signal that survives, so this reports (spec 340 §6);
+     *   · a pinned context digest we do not hold — normal for an INBOUND delivery, where the snapshot
+     *     lives on the sender's gateway. Dropping the message would be fail-closed in the wrong place;
+     *     the digest stays pinned and resolvable later. What we must not do is pretend it is replayable.
+     */
+    private admitIntoInteraction;
+    /**
+     * An exchange with no interaction is admitted only if its sender is a party of the record it
+     * delivers (spec 445 §3.4, audit H-10 / DATA-1). Two checks, both fail-closed:
+     *
+     *   · the delivered envelope's `from` IS the record's `parties.from` — a record cannot attribute
+     *     somebody's envelope to somebody else;
+     *   · this gateway's principal is a party (`from`, or in `to`/`cc`) — a gateway stores its own
+     *     principal's exchanges, as sender or as recipient, and nobody else's.
+     *
+     * The principal is `PRINCIPAL_SA` when the deployment names it, else the record's own `principal`
+     * (a gateway that cannot name itself can only check the record against itself).
+     */
+    private admitUnpinned;
+    /**
+     * Membership for a `derived` interaction.
+     *
+     * Topic interactions carry `ixn_topic_<channelId>`, so the channel is recoverable from the id and the
+     * answer comes from the channel store — the same member-or-bot test `postToChannel` already applies.
+     * That is the point of doing this: the gate stops being a second check that could drift from the
+     * first, and becomes the same check asked once.
+     *
+     * Fail-closed by construction: an id that names no known derivation source resolves to `false`, so a
+     * `derived` interaction with no resolver admits nobody rather than everybody.
+     */
+    private resolveDerivedParticipation;
+    /**
+     * Open a governed situation on this gateway. The custodian is always THIS principal — an interaction
+     * is custodied by the gateway that holds it, and accepting a caller-supplied principal would let a
+     * peer name someone else as custodian of a situation on our storage.
+     *
+     * CREATE-ONLY (spec 445 §3.4, audit DATB-2). Opening never overwrites: an interaction already held
+     * under this id is returned as it stands when it is LIVE and was opened with the same profile,
+     * participation mode, participations and bindings (a retry); anything else — a different shape, or
+     * an interaction that has ended — throws `InteractionExistsError` and writes nothing. In particular
+     * there is no reopening a concluded interaction: the machine has no transition out of a terminal
+     * state, and `open` is not a way round it. (`suspended → active` is `resume`, via
+     * `interactions.transitionInteraction`, custodial and counted in `rev`.)
+     */
+    openInteraction(input: {
+        interactionId: InteractionId;
+        profileVersion: ProfileVersion;
+        /** Omit for a `derived` interaction — see `InteractionRecordV1.participationMode`. */
+        participations?: readonly ParticipationV1[];
+        participationMode?: 'asserted' | 'derived';
+        at: string;
+        protocolBindings?: readonly ProtocolBindingV1[];
+    }): Promise<InteractionRecordV1>;
+    /**
+     * Append one event to an existing exchange (case transitions / transport moves), reduced fail-closed.
+     *
+     * The case machine authorizes a transition by comparing `event.actor` with the record's parties, so
+     * the actor must not be the caller's to choose (DATA-3): `event.actor` must be the AUTHENTICATED
+     * actor, on a minted caller for this gateway's principal. `null` ⇒ no such exchange. (`event.at` is
+     * still the caller's — audit DATB-11, open: the embedder stamps it.)
+     */
+    applyEvent(exchangeId: ExchangeId | string, event: ExchangeEventV1, caller: AuthenticatedCaller): Promise<import("../exchange-reducer.js").ExchangeApplyResult | null>;
+    /**
+     * Mint the caller for one admitted request (spec 445 §3.4, audit DATA-3) — the ONLY way to obtain an
+     * `AuthenticatedCaller`. Runs the injected authenticator; throws `GatewayAuthError` when none is
+     * configured (fail closed), when the request is not admitted, or when it was admitted for a
+     * principal other than this gateway's (`PRINCIPAL_SA`). A gateway that does not name itself takes the
+     * authenticator's principal — the embedder that built the port is the one that addressed this DO.
+     */
+    admitCaller(request: Request): Promise<AuthenticatedCaller>;
+    private isMinted;
+    /** `member` is the authenticated actor, or the actor is this gateway's own principal acting on it. */
+    private selfOrPrincipal;
+    /** Interactions, context snapshots, decisions, commitments, per-viewer inbox state. */
+    get interactions(): InteractionStore;
+    /**
+     * Everything still owed on this gateway — the query the single `case` field could not answer.
+     *
+     * A case could be `denied` while an obligation stayed outstanding with nowhere to record it, because
+     * one field was serving three machines (spec 340 §R). Concluding an interaction deliberately does NOT
+     * appear here as a discharge: closing a conversation ends the conversation, never the promise made
+     * inside it.
      */
-    deliver(record: ExchangeRecordV1): Promise<void>;
-    /** Append one event to an existing exchange (case transitions / transport moves), reduced fail-closed. */
-    applyEvent(exchangeId: ExchangeId | string, event: ExchangeEventV1): Promise<import("../exchange-reducer.js").ExchangeApplyResult | null>;
+    openCommitments(): Promise<CommitmentRecordV1[]>;
+    /** The gateway's own SA. Throws rather than defaulting: a wrong custodian on a governed situation is
+     *  worse than a refused write, and empty-string config is treated as unset (a wrangler `VAR = ""`
+     *  binds an empty string, which `??` would happily accept). */
+    private requirePrincipal;
     private requireDeps;
     /** The verdict cache (revoke / epoch-sweep hooks + read for tests). */
     get authority(): AuthorityVerdictCache;
@@ -223,6 +545,13 @@ export declare class PrincipalGatewayDO {
     /** The principal's exchanges, newest first — the inbox-projection source (full `projectInboxItem` fold is
      *  the W2 incremental-projection step; the durable stream it reads is here). */
     inbox(): Promise<ExchangeRecordV1[]>;
+    /**
+     * The HTTP surface. EVERY route authenticates first (spec 445 §3.4, audit DATA-3): `admitCaller`
+     * runs the injected authenticator before the path is even looked at, so with no authenticator the
+     * answer is 503 for everything, and an unadmitted request is 401 whatever it asked for. `principal`,
+     * `tier` and `actor` then come from that result alone — a body naming another principal or another
+     * actor is 403, and a body's `tier` is ignored.
+     */
     fetch(request: Request): Promise<Response>;
     /** Due-work processing (async). Drives two loops: (1) **outbox drain** — re-attempt `outboxDue(now)` peer
      *  deliveries via the injected transport, `outboxDelivered` on success / `outbox.reschedule` with backoff on
@@ -231,4 +560,5 @@ export declare class PrincipalGatewayDO {
      *  read (`outbox`, exchange stream) are here. */
     alarm(): Promise<void>;
 }
+export {};
 //# sourceMappingURL=principal-gateway-do.d.ts.map

package/dist/cloudflare/principal-gateway-do.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"principal-gateway-do.d.ts","sourceRoot":"","sources":["../../src/cloudflare/principal-gateway-do.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAC3F,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAoD,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEvG,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACzB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC7B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAA4E,KAAK,SAAS,EAAE,KAAK,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAE/J,kHAAkH;AAClH,MAAM,WAAW,mBAAmB;IAClC,2FAA2F;IAC3F,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B;oGACgG;IAChG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC7D,4EAA4E;IAC5E,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/C,wFAAwF;IACxF,KAAK,EAAE,mBAAmB,CAAC;IAC3B;oGACgG;IAChG,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;+GAE2G;IAC3G,iBAAiB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACpG;AAMD,qBAAa,kBAAkB;IAW3B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;IAZxB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgB;IAC1C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwB;IACjD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkB;IAC7C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwB;IACjD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkB;IAC7C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAe;gBAGrB,KAAK,EAAE,kBAAkB,EACzB,GAAG,EAAE,mBAAmB,EACxB,IAAI,CAAC,EAAE,WAAW,YAAA;IAmBrC,yDAAyD;IACnD,aAAa,CAAC,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAItD;;;;;OAKG;IACG,WAAW,CACf,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,IAAI,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GAClC,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAcxD,6EAA6E;IACvE,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9D,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAI1D,oGAAoG;IAC9F,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC;IAIzG;;kHAE8G;IACxG,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvG;;mHAE+G;IACzG,6BAA6B,CACjC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,0BAA0B,EACtC,EAAE,EAAE,MAAM,EACV,EAAE,CAAC,EAAE,MAAM,GACV,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAMxD,+GAA+G;IACzG,+BAA+B,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAMxJ;;0CAEsC;IAChC,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAM9I;;;;OAIG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAiBvH,+FAA+F;IACzF,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpE,uDAAuD;IACjD,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjE,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAIvD,oFAAoF;IAC9E,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAUjE;;qHAEiH;IACjH,OAAO,CAAC,yBAAyB;IAiBjC,6FAA6F;IACvF,aAAa,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAIxF,oGAAoG;IAC9F,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC;IAItC;qHACiH;IAC3G,mBAAmB,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAIxF;;;;;OAKG;IACG,eAAe,CACnB,QAAQ,EAAE,kBAAkB,EAC5B,IAAI,EAAE;QAAE,SAAS,EAAE,gBAAgB,CAAC;QAAC,IAAI,EAAE,aAAa,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GACrE,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,OAAO,EAAE,uBAAuB,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAc1F;;;;;;OAMG;IACG,WAAW,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,CAAC;IAoBxI;uGACmG;IAC7F,eAAe,CAAC,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/G,sEAAsE;IAChE,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAIpD,oGAAoG;IAC9F,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInD;;;;OAIG;IACH,KAAK,CAAC,OAAO,EAAE,UAAU,GAAG,KAAK;IAIjC;;;;;;OAMG;IACG,OAAO,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAOtD,0GAA0G;IACpG,UAAU,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,EAAE,KAAK,EAAE,eAAe;IAIxE,OAAO,CAAC,WAAW;IAKnB,uEAAuE;IACvE,IAAI,SAAS,IAAI,qBAAqB,CAErC;IAED;;;;OAIG;IACG,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAMrE;;;;;;;;;OASG;IACG,UAAU,CAAC,KAAK,EAAE;QACtB,GAAG,EAAE,mBAAmB,CAAC;QACzB,SAAS,EAAE,MAAM,CAAC;QAClB,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9B,aAAa,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;KAC7G,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAoB7F;oFACgF;IAC1E,KAAK,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAIpC,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IA4BhD;;;;qDAIiD;IAC3C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B"}
+{"version":3,"file":"principal-gateway-do.d.ts","sourceRoot":"","sources":["../../src/cloudflare/principal-gateway-do.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,UAAU,EAAsB,MAAM,uBAAuB,CAAC;AAC/G,OAAO,EAA+B,KAAK,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAChG,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAoD,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACvG,OAAO,EAAoC,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC3F,OAAO,EAAuC,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACpG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,KAAK,EAAE,mBAAmB,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AACpH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAGhE,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACzB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAIL,KAAK,uBAAuB,EAC7B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAA4E,KAAK,SAAS,EAAE,KAAK,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAE/J,kHAAkH;AAClH,MAAM,WAAW,mBAAmB;IAClC,2FAA2F;IAC3F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;4GAEwG;IACxG,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,oBAAoB,CAAC;IACpC;oGACgG;IAChG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC7D,4EAA4E;IAC5E,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/C,wFAAwF;IACxF,KAAK,EAAE,mBAAmB,CAAC;IAC3B;oGACgG;IAChG,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,CAAC,OAAO,EAAE,UAAU,GAAG,KAAK,CAAC;IACnC,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC;;+GAE2G;IAC3G,iBAAiB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACpG;AAED,2EAA2E;AAC3E,MAAM,WAAW,qBAAqB;IACpC,4GAA4G;IAC5G,SAAS,EAAE,gBAAgB,CAAC;IAC5B,mGAAmG;IACnG,IAAI,EAAE,aAAa,CAAC;IACpB,uGAAuG;IACvG,KAAK,EAAE,gBAAgB,CAAC;CACzB;AAED,2GAA2G;AAC3G,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;AAE/F,OAAO,CAAC,MAAM,wBAAwB,EAAE,OAAO,MAAM,CAAC;AACtD;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC,qBAAqB,CAAC,GAAG;IAAE,QAAQ,CAAC,CAAC,wBAAwB,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC;AAElH,MAAM,MAAM,iBAAiB,GACzB,8BAA8B,GAC9B,iBAAiB;AACnB,yDAAyD;GACvD,oBAAoB,CAAC;AAEzB,0FAA0F;AAC1F,qBAAa,gBAAiB,SAAQ,KAAK;IAC7B,QAAQ,CAAC,MAAM,EAAE,iBAAiB;gBAAzB,MAAM,EAAE,iBAAiB;CAI/C;AAED;2FAC2F;AAC3F,qBAAa,sBAAuB,SAAQ,KAAK;IAEnC,QAAQ,CAAC,aAAa,EAAE,MAAM;IAAE,QAAQ,CAAC,KAAK,EAAE,gBAAgB;IAD5E,QAAQ,CAAC,MAAM,EAAG,oBAAoB,CAAU;gBAC3B,aAAa,EAAE,MAAM,EAAW,KAAK,EAAE,gBAAgB;CAI7E;AAED,MAAM,MAAM,0BAA0B,GAClC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,CAAA;CAAE,GAClD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EACF,iCAAiC;IACnC,uFAAuF;OACrF,oBAAoB;IACtB,uDAAuD;OACrD,uBAAuB,GACvB,QAAQ,CAAC;CACd,CAAC;AAMN,6FAA6F;AAC7F,MAAM,MAAM,YAAY;AACtB,gGAAgG;AAC9F;IAAE,IAAI,EAAE,mBAAmB,CAAA;CAAE;AAC/B;6EAC6E;GAC3E;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAChE;uFACuF;GACrF;IAAE,IAAI,EAAE,qBAAqB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpD,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAA;CAAE,GAC3E;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM;IACJ,8DAA8D;IAC5D,iBAAiB;IACnB,uEAAuE;OACrE,oBAAoB;IACtB,0FAA0F;OACxF,gBAAgB,GAChB,qBAAqB;IACvB,wGAAwG;OACtG,wBAAwB,GACxB,mBAAmB;IACrB;0DACsD;OACpD,aAAa;IACf;gDAC4C;OAC1C,iBAAiB,CAAC;IACtB,KAAK,CAAC,EAAE,gBAAgB,CAAC;CAC1B,CAAC;AAyBN,qBAAa,kBAAkB;IAc3B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;IAfxB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgB;IAC1C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAmB;IACpD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwB;IACjD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkB;IAC7C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwB;IACjD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkB;IAC7C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAe;IACxC,8FAA8F;IAC9F,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyB;gBAG7B,KAAK,EAAE,kBAAkB,EACzB,GAAG,EAAE,mBAAmB,EACxB,IAAI,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,YAAA;IAqB9C;;;;;;;;;;;OAWG;IACG,aAAa,CAAC,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAetD;;;;;OAKG;IACG,WAAW,CACf,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,mBAAmB,EAC3B,IAAI,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GAClC,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAqBxD,6EAA6E;IACvE,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAOnI,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAI1D,oGAAoG;IAC9F,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC;IAIzG;;kHAE8G;IACxG,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvG;;;mHAG+G;IACzG,6BAA6B,CACjC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,0BAA0B,EACtC,MAAM,EAAE,mBAAmB,EAC3B,EAAE,CAAC,EAAE,MAAM,GACV,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAOxD,+GAA+G;IACzG,+BAA+B,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAOzK;;0CAEsC;IAChC,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAO/J;;;;;;;OAOG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IA+BpJ,+FAA+F;IACzF,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpE,uDAAuD;IACjD,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjE,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAIvD,oFAAoF;IAC9E,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAUjE;;qHAEiH;IACjH,OAAO,CAAC,yBAAyB;IAiBjC,6FAA6F;IACvF,aAAa,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAIxF,oGAAoG;IAC9F,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC;IAItC;;;wCAGoC;YACtB,mBAAmB;IAIjC;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,eAAe,CACnB,QAAQ,EAAE,kBAAkB,EAC5B,MAAM,EAAE,mBAAmB,EAC3B,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GACnB,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,OAAO,EAAE,uBAAuB,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IA8B1F;;;;;;OAMG;YACW,iBAAiB;IAqB/B;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,WAAW,CAAC,KAAK,EAAE;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,mBAAmB,CAAC;QACzB,aAAa,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5G,8DAA8D;QAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,qGAAqG;QACrG,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,EAAE,CAAC,EAAE,MAAM,CAAC;KACb,GAAG,OAAO,CAAC,0BAA0B,CAAC;IA8CvC;uGACmG;IAC7F,eAAe,CAAC,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/G,sEAAsE;IAChE,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAIpD,oGAAoG;IAC9F,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInD;;;;OAIG;IACH,KAAK,CAAC,OAAO,EAAE,UAAU,GAAG,KAAK;IASjC;;;;;;;;;;;;;;;;;OAiBG;IACG,OAAO,CAAC,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,eAAe,CAAC;IAS9F,0EAA0E;YAC5D,MAAM;IAgBpB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;YACW,oBAAoB;IAmClC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,aAAa;IAUrB;;;;;;;;;;OAUG;YACW,2BAA2B;IAMzC;;;;;;;;;;;;OAYG;IACG,eAAe,CAAC,KAAK,EAAE;QAC3B,aAAa,EAAE,aAAa,CAAC;QAC7B,cAAc,EAAE,cAAc,CAAC;QAC/B,sFAAsF;QACtF,cAAc,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;QAC5C,iBAAiB,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;QAC3C,EAAE,EAAE,MAAM,CAAC;QACX,gBAAgB,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;KACjD,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAmChC;;;;;;;OAOG;IACG,UAAU,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,mBAAmB;IASrG;;;;;;OAMG;IACG,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAYjE,OAAO,CAAC,QAAQ;IAIhB,sGAAsG;IACtG,OAAO,CAAC,eAAe;IAYvB,uFAAuF;IACvF,IAAI,YAAY,IAAI,gBAAgB,CAEnC;IAED;;;;;;;OAOG;IACG,eAAe,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAItD;;mEAE+D;IAC/D,OAAO,CAAC,gBAAgB;IAMxB,OAAO,CAAC,WAAW;IAQnB,uEAAuE;IACvE,IAAI,SAAS,IAAI,qBAAqB,CAErC;IAED;;;;OAIG;IACG,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAMrE;;;;;;;;;OASG;IACG,UAAU,CAAC,KAAK,EAAE;QACtB,GAAG,EAAE,mBAAmB,CAAC;QACzB,SAAS,EAAE,MAAM,CAAC;QAClB,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9B,aAAa,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;KAC7G,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAuB7F;oFACgF;IAC1E,KAAK,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAI1C;;;;;;OAMG;IACG,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IA4ChD;;;;qDAIiD;IAC3C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B"}