@agenticprimitives/orchestration 0.0.0-alpha.1 → 0.0.0-alpha.2

package/dist/authority.d.ts

@@ -0,0 +1,431 @@
+import type { Intent, PlanStep, ToolSpec } from './types.js';
+import type { StepRiskClass } from '@agenticprimitives/tool-policy';
+/** What the caller presented as its authority. OPAQUE to the loop — it is handed to the verifier and
+ *  never inspected here. A `delegation` wire, a session leaf, anything the verifier understands. */
+export interface MandatePresentation {
+    /** A stable reference the receipt carries (normally the delegation hash). */
+    ref: string;
+    /** The wire itself. The loop passes it through untouched. */
+    wire: unknown;
+}
+/** A step as the authority layer sees it: the plan's step joined to its tool's DECLARATION. Capability and
+ *  risk come from the tool, not the plan — a planner cannot lower a risk by describing a step differently. */
+export interface ResolvedStep {
+    runRef: string;
+    stepRef: string;
+    index: number;
+    step: PlanStep;
+    tool: ToolSpec;
+    /** Args with `{ $ref }` placeholders resolved. */
+    args: Record<string, unknown>;
+    /** The capability the step exercises, from `tool.capability`, with `resource` and `authority` read out
+     *  of args. `authority` is the party whose mandate this step needs — the payer, the parent — when that
+     *  is not the resource itself. */
+    capability: {
+        id: string;
+        action: string;
+        resource?: string;
+        authority?: string;
+    };
+    /** `tool-policy.StepRiskClass` — informational when the tool declares no capability. */
+    risk: StepRiskClass;
+    /** Present when the risk class demands one (medium+). Defaults to `${runRef}:${stepRef}`. */
+    idempotencyKey?: string;
+}
+export interface StepAuthorityRequest {
+    intent: Intent;
+    presented: MandatePresentation | null;
+    step: ResolvedStep;
+    /** Whether this check follows an approval. A verifier may not need to know; a receipt does. */
+    afterApproval: boolean;
+}
+/** An UNSATISFIED condition attached to the authority. Not a UI prompt. */
+export interface Obligation {
+    kind: 'second-party-approval' | 'quorum' | 'fresh-authorization' | 'disclosure' | (string & {});
+    dischargeableBy: {
+        role?: string;
+        agents?: string[];
+        threshold?: number;
+    };
+    /** What imposed it, by reference — the caveat, the policy, the risk class. */
+    imposedBy: string;
+}
+export interface DecisionReason {
+    code: string;
+    message: string;
+}
+/** Inspectable evidence for the receipt. Shape mirrors `delegation.DecisionEvidence` so an adapter can
+ *  pass it straight through. */
+export interface DecisionEvidence {
+    mandateRef: string;
+    intentDigest: string;
+    evaluatedAt: number;
+    verdicts: Array<{
+        enforcer: string;
+        allowed: boolean;
+        reason?: string;
+    }>;
+    /** Spec 383 — the authority chain the leaf descends from, verified whole by the verifier (structural mirror
+     *  of `delegation.AuthorityChainV1`): every grant by reference, leaf first; the accountability root; the
+     *  acting agent. A receipt three hops away names each actor and grant from this, never from the last link. */
+    chain?: {
+        profile: string;
+        links: Array<{
+            ref: string;
+            delegator: string;
+            delegate: string;
+            parentRef: string | null;
+        }>;
+        accountabilityRoot: string;
+        actingAgent: string;
+        depth: number;
+        chainDigest: string;
+    };
+}
+export type MandateDecision = {
+    decision: 'allow';
+    obligations: Obligation[];
+    evidence: DecisionEvidence;
+} | {
+    decision: 'approval-required';
+    obligations: Obligation[];
+    evidence: DecisionEvidence;
+} | {
+    decision: 'deny';
+    reasons: DecisionReason[];
+    evidence: DecisionEvidence;
+};
+export interface MandateVerifier {
+    verify(req: StepAuthorityRequest): Promise<MandateDecision>;
+}
+/** Policy: WHAT RULES govern exercising authority the mandate grants. Distinct from the mandate (what was
+ *  granted) and from approval (what remains unsatisfied). Returns obligations to ADD; it never removes one
+ *  the verifier attached. */
+export interface PolicyEvaluator {
+    evaluate(req: StepAuthorityRequest & {
+        decision: MandateDecision;
+    }): Promise<{
+        obligations: Obligation[];
+    }>;
+}
+export interface ApprovalRequest {
+    runRef: string;
+    stepRef: string;
+    intent: Intent;
+    step: ResolvedStep;
+    obligations: Obligation[];
+    /** The evidence the verifier produced — so the approver sees the EFFECTIVE authority, never a summary. */
+    evidence: DecisionEvidence;
+}
+export type ApprovalOutcome = {
+    status: 'discharged';
+    records: string[];
+} | {
+    status: 'refused';
+    by?: string;
+    reason?: string;
+} | {
+    status: 'pending';
+    resumeToken: string;
+    prompt?: import('./input.js').InputRequestV1;
+};
+/** Discharge obligations. A durable implementation checkpoints and returns `pending`; the run suspends and
+ *  resumes later — through the verifier AGAIN, because an approval is an input to it, not a bypass. */
+export interface ApprovalPort {
+    request(req: ApprovalRequest): Promise<ApprovalOutcome>;
+}
+export type StepReceiptStatus = 'authorized' | 'executed' | 'failed' | 'denied' | 'cancelled' | 'compensated' | 'suspended' | 'authority-required' | 'skipped';
+/** The loop's record of one step. A sink turns it into signed evidence (`service-agent.ExecutionReceiptV2`,
+ *  `verification-receipts`); the loop only guarantees the binding is complete. */
+/**
+ * Spec 367 §5 — THE EXECUTION BINDING: what the operation was admitted AS, pinned onto its receipt so the
+ * executor cannot silently substitute a different organization, treasury, recipient or operation after
+ * admission. Evidence only (capability-architecture §8 invariant 13): no gate reads it.
+ */
+export interface ExecutionBindingV1 {
+    /** keccak256 of the ExecutionIntent (goal + context) this step served. */
+    intentDigest: string;
+    /** The person the run acts for, and the role they act in when the harness knows it. */
+    principal?: string;
+    actingRole?: string;
+    /** The agent this step is ABOUT (the tool's `subject` argument, resolved), when it declares one. */
+    subject?: string;
+    /** The resource the capability acts on and whose authority it spends, read from the resolved args. */
+    resource?: string;
+    authority?: string;
+    /** The outcome class this step was expected to establish (`ToolSpec.establishes`). */
+    expectedOutcome: import('./types.js').OutcomeClass;
+    /** The stable logical operation identity — a retry must locate THIS, never perform it again (§8). */
+    operationId: string;
+    /** WHERE each bound party came from (spec 367 §3): the person's words, application context, a decision rule, memory, the resolver. */
+    argSources?: Record<string, 'said' | 'context' | 'standing' | 'decision' | 'memory' | 'resolver' | 'disclosed'>;
+    /** Spec 367 §8 — the causal chain across agents. `inResponseTo` on the receiver's receipt names the request
+     *  it answered (R → S); `delegatedTo` on the sender's names the answer it got back (S → T). Never circular. */
+    correlation?: {
+        inResponseTo?: {
+            agent: string;
+            operationId: string;
+            runRef: string;
+            stepRef: string;
+        };
+        delegatedTo?: {
+            agent: string;
+            runRef: string;
+        };
+    };
+    /** Spec 383 (ADR-0052 roles) — WHO IS ACTING, FOR WHOM, and who started it: the actor context of this hop,
+     *  so a receipt reads "alice's agent, for Missio Nexus, run at runtime-c3s0.svc". `rootPrincipal` is the
+     *  person the run acts for; `originatingAgent` the agent that started the overall task (the requester of
+     *  a routed step, else the principal's own agent); `actingAgent` the agent whose harness ran this hop.
+     *  The accountability root — whose authority was spent — is the verified chain's root delegator, on the
+     *  decision's evidence, never restated here. Evidence only; no gate reads it. */
+    /** Spec 383 W2 — the STANDING this hop ran under, as a named link: for whom (`subject`), by whom
+  
+     *  (`principal`), the relation the receiver derived, and — for a steward — the stewardship wire it verified,
+  
+     *  by digest. Evidence beside the mandate chain; no verifier reads it. */
+    standing?: {
+        relation: 'self' | 'steward' | 'member' | 'none';
+        subject: string;
+        principal: string;
+        because: string;
+        wireRef?: string;
+    };
+    actor?: {
+        rootPrincipal?: string;
+        originatingAgent?: string;
+        actingAgent: string;
+    };
+}
+export interface StepReceipt {
+    /** Spec 367 §5 — the admitted binding this step ran under. */
+    binding?: ExecutionBindingV1;
+    /** Spec 360 — what followed the act, per declared effect. `ok:false` is a disclosure that failed while
+     *  the act stood: visible evidence, never a reason to unwind the step (the loop isolates the throw). */
+    effects?: Array<{
+        produces: string;
+        ok: boolean;
+        error?: string;
+    }>;
+    runRef: string;
+    stepRef: string;
+    index: number;
+    toolId: string;
+    capability?: {
+        id: string;
+        action: string;
+        resource?: string;
+    };
+    risk: ResolvedStep['risk'];
+    status: StepReceiptStatus;
+    /** From the verifier. Absent for informational steps (nothing was verified — and that is recorded). */
+    authority?: {
+        presentedRef: string | null;
+        decision: MandateDecision;
+        afterApproval: boolean;
+    };
+    /**
+     * Spec 363 W6 — WHAT THIS STEP DECIDED FOR THE PERSON, and on what basis.
+     *
+     * A receipt already says what authorized an act. It said nothing about the choices made on the way to
+     * it: which of six accounts paid, which Sarah was meant. Those were decided by rules over modelled
+     * facts, and a run that can be audited for its authority but not its DECISIONS is half-legible —
+     * "why did it pay from that one" was answerable only by re-deriving it and hoping nothing had changed.
+     *
+     * Display and audit only. No verifier reads it, and recording a decision grants nothing: the mandate
+     * still decided what may happen (spec 363 §2).
+     */
+    decisions?: Array<{
+        /** The decision point (`payment.sourceAccount`). */
+        point: string;
+        /** The rule that answered (`marked-primary-payer`). */
+        ruleId: string;
+        /** The argument it filled. */
+        arg: string;
+        /** What it chose. */
+        chose: string;
+        /** The rule's own words — never composed. */
+        because: string;
+    }>;
+    approvalRecords?: string[];
+    idempotencyKey?: string;
+    inputDigest?: string;
+    outputDigest?: string;
+    error?: string;
+    /** Spec 350 §3.4 — set when `status === 'suspended'` because the tool asked the person for something: the
+     *  kind of prompt and, for a signature, what must be signed by whom. Never the answers. */
+    pendingInput?: {
+        kind: 'data' | 'signature' | 'confirmation' | 'commitment' | 'authority';
+        digest?: string;
+        signer?: string;
+        fields?: string[];
+    };
+    /** Spec 354 §4.5 — the playbook (skill/archetype) that shaped this step: canonical id + version +
+     *  content commitment (the definition digest). Absent when the agent runs the bare harness (no
+     *  archetype assigned). Names WHICH PROCEDURE the step followed — the behavior dimension of the
+     *  receipt chain, verifiable against the corpus. Grants nothing; a playbook is never authority. */
+    skillRef?: {
+        skillId: string;
+        version: string;
+        commitment: string;
+    };
+    startedAt: number;
+    completedAt: number;
+}
+export interface ReceiptSink {
+    record(receipt: StepReceipt): Promise<void>;
+}
+/** Spec 390 W3 — every event carries WHEN (ms since the epoch), stamped by the loop as it emits, so the
+ *  authority stages, the planner's call and the outcome can be projected as spans AFTER the fact from the
+ *  record alone (no inline instrumentation). Optional on the type because records written before this
+ *  wave carry none; a projection that needs two stamps and has one emits nothing for that stage. */
+export type RunEventStamp = {
+    at?: number;
+};
+export type RunEvent = RunEventStamp & ({
+    type: 'RunStarted';
+    runRef: string;
+    intent: Intent;
+    presentedRef: string | null;
+} | {
+    type: 'PlanCreated';
+    runRef: string;
+    steps: number;
+    rationale?: string;
+}
+/** Spec 367 W1 — admission refused the plan; `replanning` says whether one more plan will be tried. */
+ | {
+    type: 'PlanRefused';
+    runRef: string;
+    violations: Array<{
+        code: string;
+        message: string;
+        stepIndex?: number;
+        toolId?: string;
+    }>;
+    replanning: boolean;
+} | {
+    type: 'StepProposed';
+    runRef: string;
+    stepRef: string;
+    toolId: string;
+    risk: ResolvedStep['risk'];
+} | {
+    type: 'MandateChecked';
+    runRef: string;
+    stepRef: string;
+    decision: MandateDecision['decision'];
+    afterApproval: boolean;
+} | {
+    type: 'MandateDenied';
+    runRef: string;
+    stepRef: string;
+    reasons: DecisionReason[];
+} | {
+    type: 'ApprovalRequested';
+    runRef: string;
+    stepRef: string;
+    obligations: Obligation[];
+} | {
+    type: 'ApprovalDischarged';
+    runRef: string;
+    stepRef: string;
+    records: string[];
+} | {
+    type: 'ApprovalRefused';
+    runRef: string;
+    stepRef: string;
+    reason?: string;
+} | {
+    type: 'RunSuspended';
+    runRef: string;
+    stepRef: string;
+    resumeToken: string;
+} | {
+    type: 'ToolInvoked';
+    runRef: string;
+    stepRef: string;
+    toolId: string;
+    ok: boolean;
+}
+/** Spec 370 P1 — a completed step's recorded outcome stood in for running it again (a resume). */
+ | {
+    type: 'StepReplayed';
+    runRef: string;
+    stepRef: string;
+    toolId: string;
+}
+/** Spec 370 P3 — a declared branch was not taken: the step's `when` did not hold. */
+ | {
+    type: 'StepSkipped';
+    runRef: string;
+    stepRef: string;
+    toolId: string;
+    because: string;
+} | {
+    type: 'StepCompensated';
+    runRef: string;
+    stepRef: string;
+    by: string;
+    ok: boolean;
+} | {
+    type: 'ReceiptCreated';
+    runRef: string;
+    stepRef: string;
+    status: StepReceiptStatus;
+}
+/** Spec 360 — a declared effect could not be discharged. Its OWN fact: the step it followed stands. */
+ | {
+    type: 'EffectFailed';
+    runRef: string;
+    stepRef: string;
+    error: string;
+} | {
+    type: 'RunCompleted';
+    runRef: string;
+} | {
+    type: 'RunFailed';
+    runRef: string;
+    error: string;
+});
+export type RunEventSink = (event: RunEvent) => void;
+/**
+ * WHAT FOLLOWS A SUCCESSFUL STEP — spec 360. The playbook DECLARES a consequence (a payment leaves a
+ * receipt the parties hold); this discharges it.
+ *
+ * The loop stays domain-free: it knows THAT a definition declared an effect and WHEN to discharge it. It
+ * does not know what a PaymentReceipt is, who a payee is, or where a record lives — the app binds that,
+ * exactly as it binds invokers.
+ *
+ * MAY NOT FAIL THE STEP. The act already happened, possibly on chain. A receipt that could un-do a
+ * payment would be worse than no receipt, so the loop isolates a throw here and records it as its own
+ * fact: the step stays `executed`, and the failure to disclose is reported separately.
+ */
+export interface EffectSink {
+    discharge(e: {
+        runRef: string;
+        stepRef: string;
+        /** The effect as the definition declared it. Opaque to the loop beyond being passed through. */
+        effect: unknown;
+        step: ResolvedStep;
+        /** What the invoker returned — the receipt is built from THIS, never from model prose. */
+        result: unknown;
+        receipt: StepReceipt;
+    }): Promise<void>;
+}
+export interface OrchestrationPorts {
+    /** REQUIRED once any tool declares a capability. A run that reaches such a step without one fails closed. */
+    mandateVerifier?: MandateVerifier;
+    policyEvaluator?: PolicyEvaluator;
+    approvalPort?: ApprovalPort;
+    /** Every step emits a receipt; absent ⇒ receipts are kept on the RunResult only. */
+    receiptSink?: ReceiptSink;
+    /** Spec 360 — discharges a playbook's declared consequences after a step succeeds. Absent ⇒ declared
+     *  effects are not discharged, and that is visible: the promise is in the definition either way. */
+    effectSink?: EffectSink;
+    /** Spec 367 W1 — judges the plan's SHAPE before any step runs (the verifier judges authority). Absent ⇒
+     *  every well-formed plan is executed, which is the behaviour every run had before the port existed. */
+    planAdmission?: import('./admission.js').PlanAdmission;
+    events?: RunEventSink;
+}
+//# sourceMappingURL=authority.d.ts.map

package/dist/authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority.d.ts","sourceRoot":"","sources":["../src/authority.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAEpE;oGACoG;AACpG,MAAM,WAAW,mBAAmB;IAClC,6EAA6E;IAC7E,GAAG,EAAE,MAAM,CAAC;IACZ,6DAA6D;IAC7D,IAAI,EAAE,OAAO,CAAC;CACf;AAED;8GAC8G;AAC9G,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,QAAQ,CAAC;IACf,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B;;sCAEkC;IAClC,UAAU,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAClF,wFAAwF;IACxF,IAAI,EAAE,aAAa,CAAC;IACpB,6FAA6F;IAC7F,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACtC,IAAI,EAAE,YAAY,CAAC;IACnB,+FAA+F;IAC/F,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,2EAA2E;AAC3E,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,uBAAuB,GAAG,QAAQ,GAAG,qBAAqB,GAAG,YAAY,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAChG,eAAe,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1E,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAEjE;gCACgC;AAChC,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzE;;kHAE8G;IAC9G,KAAK,CAAC,EAAE;QACN,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,KAAK,CAAC;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAC,CAAC;QAC7F,kBAAkB,EAAE,MAAM,CAAC;QAC3B,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,UAAU,EAAE,CAAC;IAAC,QAAQ,EAAE,gBAAgB,CAAA;CAAE,GAC5E;IAAE,QAAQ,EAAE,mBAAmB,CAAC;IAAC,WAAW,EAAE,UAAU,EAAE,CAAC;IAAC,QAAQ,EAAE,gBAAgB,CAAA;CAAE,GACxF;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,cAAc,EAAE,CAAC;IAAC,QAAQ,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAEhF,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC7D;AAED;;6BAE6B;AAC7B,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,oBAAoB,GAAG;QAAE,QAAQ,EAAE,eAAe,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC,CAAC;CAC7G;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,YAAY,CAAC;IACnB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,0GAA0G;IAC1G,QAAQ,EAAE,gBAAgB,CAAC;CAC5B;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GAC3C;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAInD;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,YAAY,EAAE,cAAc,CAAA;CAAE,CAAC;AAE7F;uGACuG;AACvG,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CACzD;AAED,MAAM,MAAM,iBAAiB,GAAG,YAAY,GAAG,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,GAAG,aAAa,GAAG,WAAW,GAAG,oBAAoB,GAAG,SAAS,CAAC;AAE/J;kFACkF;AAClF;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,0EAA0E;IAC1E,YAAY,EAAE,MAAM,CAAC;IACrB,uFAAuF;IACvF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oGAAoG;IACpG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sGAAsG;IACtG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sFAAsF;IACtF,eAAe,EAAE,OAAO,YAAY,EAAE,YAAY,CAAC;IACnD,qGAAqG;IACrG,WAAW,EAAE,MAAM,CAAC;IACpB,sIAAsI;IACtI,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,UAAU,GAAG,WAAW,CAAC,CAAC;IAChH;mHAC+G;IAC/G,WAAW,CAAC,EAAE;QACZ,YAAY,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC;QACvF,WAAW,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC;KACjD,CAAC;IACF;;;;;qFAKiF;IACjF;;;;8EAI0E;IAE1E,QAAQ,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACvI,KAAK,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;CACpF;AAED,MAAM,WAAW,WAAW;IAC1B,8DAA8D;IAC9D,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B;4GACwG;IACxG,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/D,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;IAC3B,MAAM,EAAE,iBAAiB,CAAC;IAC1B,uGAAuG;IACvG,SAAS,CAAC,EAAE;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,EAAE,eAAe,CAAC;QAAC,aAAa,EAAE,OAAO,CAAA;KAAE,CAAC;IAC/F;;;;;;;;;;OAUG;IACH,SAAS,CAAC,EAAE,KAAK,CAAC;QAChB,oDAAoD;QACpD,KAAK,EAAE,MAAM,CAAC;QACd,uDAAuD;QACvD,MAAM,EAAE,MAAM,CAAC;QACf,8BAA8B;QAC9B,GAAG,EAAE,MAAM,CAAC;QACZ,qBAAqB;QACrB,KAAK,EAAE,MAAM,CAAC;QACd,6CAA6C;QAC7C,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;+FAC2F;IAC3F,YAAY,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,cAAc,GAAG,YAAY,GAAG,WAAW,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACjJ;;;uGAGmG;IACnG,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7C;AAID;;;oGAGoG;AACpG,MAAM,MAAM,aAAa,GAAG;IAAE,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5C,MAAM,MAAM,QAAQ,GAAG,aAAa,GAAG,CACnC;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACnF;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE;AAC5E,uGAAuG;GACrG;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,GACvJ;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,CAAA;CAAE,GACrG;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,eAAe,CAAC,UAAU,CAAC,CAAC;IAAC,aAAa,EAAE,OAAO,CAAA;CAAE,GAC1H;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,cAAc,EAAE,CAAA;CAAE,GACrF;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,UAAU,EAAE,CAAA;CAAE,GACzF;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GAClF;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7E;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC9E;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,OAAO,CAAA;CAAE;AACvF,kGAAkG;GAChG;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AAC3E,qFAAqF;GACnF;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACzF;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,OAAO,CAAA;CAAE,GACrF;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAA;CAAE;AACxF,uGAAuG;GACrG;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACxE;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CACvD,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;AAErD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,UAAU;IACzB,SAAS,CAAC,CAAC,EAAE;QACX,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,gGAAgG;QAChG,MAAM,EAAE,OAAO,CAAC;QAChB,IAAI,EAAE,YAAY,CAAC;QACnB,0FAA0F;QAC1F,MAAM,EAAE,OAAO,CAAC;QAChB,OAAO,EAAE,WAAW,CAAC;KACtB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,6GAA6G;IAC7G,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,oFAAoF;IACpF,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;wGACoG;IACpG,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;4GACwG;IACxG,aAAa,CAAC,EAAE,OAAO,gBAAgB,EAAE,aAAa,CAAC;IACvD,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB"}

package/dist/authority.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=authority.js.map

package/dist/authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority.js","sourceRoot":"","sources":["../src/authority.ts"],"names":[],"mappings":""}

package/dist/durable.d.ts

@@ -0,0 +1,44 @@
+type Hex = `0x${string}`;
+/**
+ * A vendor-neutral view of a durable engine's step machinery. No `WorkflowStep`, no bindings, no DO
+ * storage APIs — a binding adapts one engine to this and nothing in Ring 0 knows which.
+ */
+export interface DurableStepPort {
+    /** Persist-on-success execution of ONE WHOLE ATTEMPT. The name must be deterministic (the engine
+     *  keys its checkpoint by it); the callback must be reconcile→verify→act, indivisible. */
+    attempt<T>(name: string, fn: () => Promise<T>): Promise<T>;
+    /** Durable suspension until a matching external event, or throw on timeout. The event carries an
+     *  EVIDENCE REFERENCE ("relevant evidence may now be available") — never permission. */
+    waitForEvent<T>(name: string, opts: {
+        type: string;
+        timeoutMs: number;
+    }): Promise<T>;
+    /** Durable suspension until a wall-clock time. */
+    sleepUntil(name: string, at: Date): Promise<void>;
+}
+/**
+ * An authority DENIAL is not weather. Retrying a revocation as though it were an intermittent network
+ * error is the anti-pattern by name; a binding maps this to its engine's non-retry mechanism
+ * (Cloudflare `NonRetryableError`) or a terminal domain outcome. Only a NEW authorization decision —
+ * a fresh mandate, a discharged obligation — makes another attempt meaningful.
+ */
+export declare class TerminalDenial extends Error {
+    readonly reason: 'denied' | 'revoked' | 'expired' | 'intent-mismatch';
+    constructor(message: string, reason?: 'denied' | 'revoked' | 'expired' | 'intent-mismatch');
+}
+/** ONE EXECUTOR PER RUN. The run record pins which engine advances it; the other entry path refuses.
+ *  Never a fallback pair: "Workflows looked unavailable so the DO path started the same action" is two
+ *  executors later advancing one operation. Migration is an explicit ownership transfer, not discovery. */
+export type RunExecutor = 'client' | 'workflow';
+/** What an approval event may carry: a REFERENCE to evidence the resume then verifies through the same
+ *  ports as ever (ERC-1271, digest binding, deadline). Anything more — `{ approved: true }` — is a
+ *  client-submitted assertion, and the resume must treat it as exactly that. */
+export interface ApprovalEventV1 {
+    type: 'custodian-decision';
+    /** The approval record's digest/reference — located and VERIFIED on resume, never trusted. */
+    approvalRef: Hex | string;
+    /** Who claims to have decided. Display until verified. */
+    approver?: string;
+}
+export {};
+//# sourceMappingURL=durable.d.ts.map

package/dist/durable.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"durable.d.ts","sourceRoot":"","sources":["../src/durable.ts"],"names":[],"mappings":"AAiBA,KAAK,GAAG,GAAG,KAAK,MAAM,EAAE,CAAC;AAEzB;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B;8FAC0F;IAC1F,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3D;4FACwF;IACxF,YAAY,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACrF,kDAAkD;IAClD,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD;AAED;;;;;GAKG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACV,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,iBAAiB;gBAAtF,OAAO,EAAE,MAAM,EAAW,MAAM,GAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,iBAA4B;CAI9G;AAED;;2GAE2G;AAC3G,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,UAAU,CAAC;AAEhD;;gFAEgF;AAChF,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,oBAAoB,CAAC;IAC3B,8FAA8F;IAC9F,WAAW,EAAE,GAAG,GAAG,MAAM,CAAC;IAC1B,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB"}

package/dist/durable.js

@@ -0,0 +1,15 @@
+/**
+ * An authority DENIAL is not weather. Retrying a revocation as though it were an intermittent network
+ * error is the anti-pattern by name; a binding maps this to its engine's non-retry mechanism
+ * (Cloudflare `NonRetryableError`) or a terminal domain outcome. Only a NEW authorization decision —
+ * a fresh mandate, a discharged obligation — makes another attempt meaningful.
+ */
+export class TerminalDenial extends Error {
+    reason;
+    constructor(message, reason = 'denied') {
+        super(message);
+        this.reason = reason;
+        this.name = 'TerminalDenial';
+    }
+}
+//# sourceMappingURL=durable.js.map

package/dist/durable.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"durable.js","sourceRoot":"","sources":["../src/durable.ts"],"names":[],"mappings":"AAkCA;;;;;GAKG;AACH,MAAM,OAAO,cAAe,SAAQ,KAAK;IACD;IAAtC,YAAY,OAAe,EAAW,SAA+D,QAAQ;QAC3G,KAAK,CAAC,OAAO,CAAC,CAAC;QADqB,WAAM,GAAN,MAAM,CAAiE;QAE3G,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF"}

package/dist/flow-trace.d.ts

@@ -0,0 +1,105 @@
+import type { RunEvent } from './authority.js';
+export interface FlowStepV1 {
+    stepRef?: string;
+    toolId: string;
+    ok: boolean;
+    replayed?: boolean;
+    skipped?: string;
+    args?: Record<string, unknown>;
+    /** What the step returned, summarized: a catalog read's count/total/source, a refusal, an error. */
+    output?: Record<string, unknown>;
+}
+export interface FlowTraceV1 {
+    kind: 'ap.flow-trace.v1';
+    hop: 'agent';
+    flowId: string | null;
+    /** Spec 390 W2 — the W3C trace id this run's spans belong to (the caller's `traceparent`), or null when it derived its own. */
+    traceId?: string | null;
+    runRef: string;
+    agent: string;
+    asker: string;
+    playbook: {
+        archetypeId: string;
+        archetypeVersion: string;
+        digest: string;
+    } | null;
+    planner: {
+        kind: string;
+        model?: string;
+        toolsExposed: string[];
+        plan: Array<{
+            toolId: string;
+            args: Record<string, unknown>;
+        }>;
+        admission?: unknown[]; /** Spec 388 — which provider carried the planner and the composer, and why. */
+        route?: unknown;
+    } | null;
+    steps: FlowStepV1[];
+    reply: {
+        kind: string;
+        chars: number;
+        artifacts: string[];
+    };
+    /** Spec 387 W3 — how the caller found this agent: the registry and its receipt, as the caller said it. Evidence, never authority. */
+    referral?: ReferralV1;
+    /** Spec 387 W3 — this turn continued a parked run rather than starting one. */
+    continued?: boolean;
+    events: Array<{
+        type: string;
+        stepRef?: string;
+        toolId?: string;
+        ok?: boolean;
+        because?: string;
+        error?: string;
+    }>;
+    ms: number;
+}
+export interface ReferralV1 {
+    registry: string;
+    receipt?: string;
+}
+/** The caller's referral from the message metadata: which registry pointed it here and the receipt it cites — echoed as
+ *  said (short strings only), verified by nobody here: how a caller found an agent grants nothing. */
+export declare function referralOf(message: {
+    metadata?: Record<string, unknown>;
+} | undefined): ReferralV1 | null;
+/** The caller's flow id from the message metadata, or null — never a value we would not echo verbatim. */
+export declare function flowIdOf(message: {
+    metadata?: Record<string, unknown>;
+} | undefined): string | null;
+/** A result's summary: numbers, flags and sources, never the rows (those are the `results` artifact's). */
+export declare function summarizeOutput(result: unknown): Record<string, unknown> | undefined;
+export declare function buildFlowTrace(input: {
+    flowId: string | null;
+    runRef: string;
+    agent: string;
+    asker: string;
+    startedAt: number;
+    reply: {
+        kind: string;
+        text?: string;
+        plannerTrace?: {
+            planner?: string;
+            model?: string;
+            toolsExposed?: string[];
+            plan?: Array<{
+                toolId: string;
+                args: Record<string, unknown>;
+            }>;
+            playbook?: FlowTraceV1['playbook'];
+            admission?: unknown[];
+            route?: unknown;
+        };
+        results?: Array<{
+            toolId: string;
+            result: unknown;
+        }>;
+    };
+    events?: RunEvent[];
+    artifacts: string[];
+    referral?: ReferralV1;
+    continued?: boolean;
+    /** Spec 390 W2 — the W3C trace id the request arrived with (the caller's), when one did. Correlation only. */
+    traceId?: string | null;
+}): FlowTraceV1;
+//# sourceMappingURL=flow-trace.d.ts.map

package/dist/flow-trace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow-trace.d.ts","sourceRoot":"","sources":["../src/flow-trace.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,MAAM,WAAW,UAAU;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IACpF,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,oGAAoG;IACpG,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AACD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,kBAAkB,CAAC;IACzB,GAAG,EAAE,OAAO,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,+HAA+H;IAC/H,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACnF,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,EAAE,KAAK,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,CAAC,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,+EAA+E;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IACjQ,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC5D,qIAAqI;IACrI,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,+EAA+E;IAC/E,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnH,EAAE,EAAE,MAAM,CAAC;CACZ;AAGD,MAAM,WAAW,UAAU;IAAG,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE;AAClE;sGACsG;AACtG,wBAAgB,UAAU,CAAC,OAAO,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAAG,SAAS,GAAG,UAAU,GAAG,IAAI,CAIzG;AACD,0GAA0G;AAC1G,wBAAgB,QAAQ,CAAC,OAAO,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAGnG;AAED,2GAA2G;AAC3G,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAQpF;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE;IACpC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IACvF,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;YAAC,IAAI,CAAC,EAAE,KAAK,CAAC;gBAAE,MAAM,EAAE,MAAM,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;aAAE,CAAC,CAAC;YAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC;YAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;YAAC,KAAK,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;QAAC,OAAO,CAAC,EAAE,KAAK,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,OAAO,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;IACxT,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,EAAE,UAAU,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IACrF,8GAA8G;IAC9G,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,GAAG,WAAW,CAuBd"}