@agentplat/inference-control 0.3.0-alpha.3 → 0.3.0-alpha.5

package/README.md

@@ -1,7 +1,7 @@
 # @agentplat/inference-control
 
 Opt-in, provider-neutral control boundaries for inference, released output,
-external actions and outbound messages. Alpha 3 is a developer preview.
+external actions and outbound messages. Alpha 4 is a developer preview.
 
 ```sh
 pnpm add @agentplat/inference-control@next
@@ -20,6 +20,8 @@ pnpm add @agentplat/inference-control@next
   ledger and gateway.
 - `@agentplat/inference-control/messages` — explicit outbound-message attempt
   ledger and gateway.
+- `@agentplat/inference-control/trust` — content-free outcome-to-Claim
+  conversion plus opt-in legacy and authenticated state-backed Trust gates.
 
 The root entry point has no Node runtime dependency and imports only
 `@agentplat/core`. Adapter subpaths depend only on public AgentPlat contracts
@@ -35,13 +37,13 @@ boundary to `ControlledModelExecutorV1`:
 import {
   CapabilityRegistryV1,
   createContextEntryV1,
-} from '@agentplat/inference-control';
-import { ControlledModelExecutorV1 } from '@agentplat/inference-control/model';
+} from "@agentplat/inference-control";
+import { ControlledModelExecutorV1 } from "@agentplat/inference-control/model";
 
 const registry = new CapabilityRegistryV1();
 const capability = registry.register({
   descriptor: localDescriptor,
-  wrapperInstanceId: 'instance:primary',
+  wrapperInstanceId: "instance:primary",
 });
 
 const executor = new ControlledModelExecutorV1({
@@ -51,26 +53,26 @@ const executor = new ControlledModelExecutorV1({
     capabilityRegistry: registry,
     resolvePolicy: (id, version) => localPolicies.get(`${id}:${version}`),
   },
-  mode: 'buffered',
-  outputRisk: 'high',
+  mode: "buffered",
+  outputRisk: "high",
   assessor: localAssessor,
 });
 
 const result = await executor.generate(
   {
     schemaVersion: 1,
-    runId: 'run:example',
-    tenantId: 'tenant:example',
-    policyId: 'policy:example',
+    runId: "run:example",
+    tenantId: "tenant:example",
+    policyId: "policy:example",
     policyVersion: 1,
     capabilityHandleId: capability.capabilityHandleId,
-    contextEntryIds: ['context:policy', 'context:user'],
+    contextEntryIds: ["context:policy", "context:user"],
     model: null,
     tools: [],
     options: null,
     scope: null,
   },
-  { tenant: { tenantId: 'tenant:example' } },
+  { tenant: { tenantId: "tenant:example" } },
 );
 ```
 
@@ -99,3 +101,31 @@ grant or message attempt. The gateway calls it once to consume the assessment
 and again at the final local pre-effect boundary; cancellation, generation
 advance or revocation between those checks must make the second call return
 `false`.
+
+## State-backed Trust gates
+
+The `./trust` subpath can restrict model, Action and outbound-message
+delegation using the current local Trust Profile. This path accepts only an
+opaque runtime token created by strict protected-snapshot restore. Its bound
+runtime source must return that token together with the exact current external
+rollback anchor on every synchronous check. Raw state, cloned tokens, replaced
+generations, clock rewind and stale dependency heads are unavailable.
+
+That current source is part of the application's trusted computing base. It
+must atomically read the durable Trust high-water anchor on every check and
+must not serve a cached head. A process cannot infer an unseen successor from a
+valid older anchor; returning one as the first sample is a source-boundary
+violation that must be prevented by the durable adapter.
+
+The full eligibility configuration is bound to the current
+`profile_resolver` and operation boundary, including policy, subject mapping,
+runtime-source identity, request template and the real base implementation
+digest. Model execution uses a captured model-boundary object that receives the
+same immutable target evaluated by Trust; Action and Message targets are
+derived from their real permits and inputs. `restrict` delegates only for
+`eligible`; `observe` preserves the base call and emits a redacted diagnostic.
+
+These gates remain opt-in and point-in-time. They do not issue assessments or
+grants, replace idempotency/fencing, or claim atomic revocation after an
+external effect has started. The legacy synchronous-resolver helpers remain
+available unchanged for Alpha 3 compatibility.

package/dist/trust.d.ts

@@ -0,0 +1,246 @@
+import { type EvidenceClaimV1, type EvidenceOutcomeV1, type EvidenceReferenceV1, type EvidenceScopeV1, type EvidenceTrustRestoreOptionsV1, type EvidenceTrustRollbackAnchorV1, type EvidenceTrustSnapshotProtectorV1, type EvidenceTrustSnapshotV1, type TrustEligibilityRequirementV1, type TrustReasonCodeV1, type TrustSubjectV1 } from "@agentplat/trust";
+import type { AssessmentRequestV1, InferenceAssessmentV1 } from "./types.js";
+import { type ActionBinding, type ActionDispatcher, type ActionGrant } from "./tools.js";
+import { type OutboundMessageAttempt, type OutboundMessageDispatcher } from "./messages.js";
+/**
+ * Local mapping from an accepted Inference Control outcome to a Trust Claim.
+ * It contains no model, action, or message content.
+ */
+export interface InferenceControlTrustClaimMappingV1 {
+    readonly schemaVersion: 1;
+    readonly mappingId: string;
+    readonly mappingVersion: number;
+    readonly mappingDigest: string;
+    readonly sourceId: string;
+    readonly subject: TrustSubjectV1;
+    readonly scope: EvidenceScopeV1;
+    readonly criterionId: string;
+    readonly outcome: EvidenceOutcomeV1;
+}
+export interface CreateInferenceControlTrustClaimMappingInputV1 {
+    readonly schemaVersion: 1;
+    readonly mappingId: string;
+    readonly mappingVersion: number;
+    readonly sourceId: string;
+    readonly subject: TrustSubjectV1;
+    readonly scope: EvidenceScopeV1;
+    readonly criterionId: string;
+    readonly outcome: EvidenceOutcomeV1;
+}
+export interface AcceptedInferenceOutcomeClaimInputV1 {
+    readonly schemaVersion: 1;
+    readonly assessmentRequest: AssessmentRequestV1;
+    readonly assessment: InferenceAssessmentV1;
+    readonly assessorBindingDigest: string;
+    readonly dependencyBindingDigest: string;
+    readonly mapping: InferenceControlTrustClaimMappingV1;
+    readonly observedAt: string | null;
+}
+export interface AcceptedActionDispatchClaimInputV1 extends AcceptedInferenceOutcomeClaimInputV1 {
+    readonly grant: ActionGrant;
+    readonly binding: ActionBinding;
+    readonly dispatcher: ActionDispatcher;
+}
+export interface AcceptedOutboundMessageClaimInputV1 extends AcceptedInferenceOutcomeClaimInputV1 {
+    readonly attempt: OutboundMessageAttempt;
+    readonly dispatcher: OutboundMessageDispatcher;
+}
+/**
+ * Returns an exact, content-free reference to the accepted assessment request.
+ * The reference digest commits to the whole request record, including its
+ * target and scope, but the Claim only carries this digest and identifiers.
+ */
+export declare function createAssessmentRequestReferenceV1(request: AssessmentRequestV1): EvidenceReferenceV1;
+/**
+ * Creates a local Claim candidate only; callers decide whether to admit it to
+ * Trust state. Candidate references intentionally bind identifiers and
+ * digests, never prompts, output, arguments, or message payloads.
+ */
+export declare function createClaimCandidateFromAcceptedInferenceOutcomeV1(input: AcceptedInferenceOutcomeClaimInputV1): EvidenceClaimV1;
+/**
+ * Converts a terminal, dispatched Action Gateway outcome to a local Claim
+ * candidate. It verifies an already accepted assessment; it never creates or
+ * consumes an Action Grant.
+ */
+export declare function createClaimCandidateFromAcceptedActionDispatchV1(input: AcceptedActionDispatchClaimInputV1): EvidenceClaimV1;
+/**
+ * Converts a terminal, sent outbound-message outcome to a local Claim
+ * candidate. It references digests only and never copies the message body.
+ */
+export declare function createClaimCandidateFromAcceptedOutboundMessageV1(input: AcceptedOutboundMessageClaimInputV1): EvidenceClaimV1;
+export declare function createInferenceControlTrustClaimMappingV1(input: CreateInferenceControlTrustClaimMappingInputV1): InferenceControlTrustClaimMappingV1;
+export type TrustEligibilityModeV1 = "observe" | "restrict";
+export type TrustEligibilityStatusV1 = "eligible" | "restricted" | "unavailable" | "stale" | "mismatch" | "quarantined";
+export type TrustEligibilityOperationV1 = "model" | "action" | "outbound_message";
+/** A content-free subject for an opt-in eligibility lookup. */
+export interface TrustEligibilityTargetV1 {
+    readonly schemaVersion: 1;
+    readonly operation: TrustEligibilityOperationV1;
+    readonly tenantId: string;
+    readonly runId: string;
+    readonly scopeDigest: string;
+    readonly targetDigest: string;
+}
+export interface TrustEligibilityDecisionV1 {
+    readonly schemaVersion: 1;
+    readonly status: TrustEligibilityStatusV1;
+    readonly policyDigest: string;
+    readonly resolverDigest: string;
+    readonly mappingDigest: string;
+    readonly scopeDigest: string;
+    readonly targetDigest: string;
+}
+/**
+ * This is deliberately synchronous. Wrappers invoke it immediately before
+ * delegation, leaving no asynchronous gap after their final revalidation.
+ */
+export interface TrustEligibilityResolverV1 {
+    readonly resolverId: string;
+    readonly resolverVersion: number;
+    readonly resolverDigest: string;
+    resolve(target: TrustEligibilityTargetV1): TrustEligibilityDecisionV1;
+}
+export interface TrustEligibilityPolicyBindingV1 {
+    readonly policyId: string;
+    readonly policyVersion: number;
+    readonly policyDigest: string;
+    readonly mode: TrustEligibilityModeV1;
+}
+export interface TrustEligibilityMappingBindingV1 {
+    readonly mappingId: string;
+    readonly mappingVersion: number;
+    readonly mappingDigest: string;
+}
+export interface TrustEligibilityIntegrationV1 {
+    readonly policy: TrustEligibilityPolicyBindingV1;
+    readonly resolver: TrustEligibilityResolverV1;
+    readonly mapping: TrustEligibilityMappingBindingV1;
+    readonly onDiagnostic?: (diagnostic: TrustEligibilityDiagnosticV1) => void;
+}
+/** Model-boundary bindings must be explicit because no dispatcher is present. */
+export interface TrustModelEligibilityIntegrationV1 extends TrustEligibilityIntegrationV1 {
+    readonly modelBindingDigest: string;
+}
+export interface TrustEligibilityDiagnosticV1 {
+    readonly schemaVersion: 1;
+    readonly operation: TrustEligibilityOperationV1;
+    readonly mode: TrustEligibilityModeV1;
+    readonly status: TrustEligibilityStatusV1;
+    readonly bindingDigest: string;
+}
+export interface TrustBoundActionDispatcherV1 extends ActionDispatcher {
+    readonly trustBindingDigest: string;
+}
+export interface TrustBoundOutboundMessageDispatcherV1 extends OutboundMessageDispatcher {
+    readonly trustBindingDigest: string;
+}
+export interface InferenceControlTrustModelBoundaryV1<T> {
+    readonly modelBoundaryId: string;
+    readonly modelBoundaryVersion: number;
+    readonly implementationDigest: string;
+    run(target: TrustEligibilityTargetV1): T;
+}
+export interface TrustBoundModelBoundaryV1<T> extends InferenceControlTrustModelBoundaryV1<T> {
+    readonly trustBindingDigest: string;
+}
+export interface InferenceControlTrustSubjectMappingInputV1 {
+    readonly controlTenantId: string;
+    readonly controlRunId: string;
+    readonly controlScopeDigest: string;
+    readonly trustSubject: TrustSubjectV1;
+    readonly trustScope: EvidenceScopeV1;
+}
+export interface InferenceControlTrustRuntimeSourceBindingInputV1 {
+    readonly sourceId: string;
+    readonly sourceVersion: number;
+    readonly protectorBindingDigest: string;
+}
+export interface InferenceControlTrustStateEligibilityConfigV1 extends InferenceControlTrustSubjectMappingInputV1 {
+    readonly schemaVersion: 1;
+    readonly operation: TrustEligibilityOperationV1;
+    readonly mode: TrustEligibilityModeV1;
+    readonly policyId: string;
+    readonly policyVersion: number;
+    readonly policyDigest: string;
+    readonly maximumProfileAgeMs: number;
+    readonly requirements: readonly TrustEligibilityRequirementV1[];
+    readonly subjectMappingDigest: string;
+    readonly runtimeSourceBindingDigest: string;
+    readonly profileResolverBindingDigest: string;
+    readonly boundaryBindingDigest: string;
+    readonly baseBindingDigest: string;
+}
+export interface InferenceControlTrustEligibilityRuntimeV1 {
+    readonly schemaVersion: 1;
+    readonly runtimeId: string;
+}
+export interface InferenceControlTrustEligibilityRuntimeSampleV1 {
+    readonly schemaVersion: 1;
+    readonly runtime: InferenceControlTrustEligibilityRuntimeV1;
+    readonly rollbackAnchor: EvidenceTrustRollbackAnchorV1;
+}
+/**
+ * Trusted-computing-base adapter for the application's durable Trust head.
+ * `current` must synchronously and atomically read the durable high-water
+ * anchor and return its exact restored token; it must not serve a cache.
+ */
+export interface InferenceControlTrustEligibilityRuntimeSourceV1 extends InferenceControlTrustRuntimeSourceBindingInputV1 {
+    readonly bindingDigest: string;
+    current(): InferenceControlTrustEligibilityRuntimeSampleV1;
+}
+export interface InferenceControlTrustStateIntegrationV1 {
+    readonly config: InferenceControlTrustStateEligibilityConfigV1;
+    readonly runtime: InferenceControlTrustEligibilityRuntimeSourceV1;
+    readonly onDiagnostic?: (diagnostic: TrustEligibilityDiagnosticV1) => void;
+}
+export interface InferenceControlTrustStateEligibilityResultV1 {
+    readonly status: "eligible" | "restricted" | "quarantined" | "unavailable";
+    readonly eligibilityDecisionId: string | null;
+    readonly reasonCodes: readonly TrustReasonCodeV1[];
+}
+export declare function digestInferenceControlTrustRuntimeSourceBindingV1(value: InferenceControlTrustRuntimeSourceBindingInputV1): string;
+export declare function digestInferenceControlTrustSubjectMappingV1(value: InferenceControlTrustSubjectMappingInputV1): string;
+export declare function createInferenceControlTrustStateEligibilityConfigV1(value: InferenceControlTrustStateEligibilityConfigV1): InferenceControlTrustStateEligibilityConfigV1;
+export declare function digestInferenceControlTrustStateEligibilityConfigV1(value: InferenceControlTrustStateEligibilityConfigV1): string;
+export declare function restoreInferenceControlTrustEligibilityRuntimeV1(snapshot: EvidenceTrustSnapshotV1, anchor: EvidenceTrustRollbackAnchorV1, protector: EvidenceTrustSnapshotProtectorV1, runtimeSourceBindingDigest: string, options?: EvidenceTrustRestoreOptionsV1): InferenceControlTrustEligibilityRuntimeV1;
+/**
+ * Evaluates an exact Inference Control target against a current, strictly
+ * restored Trust snapshot. Runtime failures are projected as unavailable;
+ * malformed construction-time configuration remains a caller error.
+ */
+export declare function evaluateInferenceControlTrustStateEligibilityV1(integration: InferenceControlTrustStateIntegrationV1, target: TrustEligibilityTargetV1): InferenceControlTrustStateEligibilityResultV1;
+/** Derives the model boundary binding from its local implementation identity. */
+export declare function digestInferenceControlTrustModelBoundaryV1(boundary: Pick<InferenceControlTrustModelBoundaryV1<unknown>, "modelBoundaryId" | "modelBoundaryVersion" | "implementationDigest">): string;
+/** Derives the real Action dispatcher binding from its public identity. */
+export declare function digestActionDispatcherBindingV1(dispatcher: Pick<ActionDispatcher, "dispatcherId" | "dispatcherVersion" | "fencingMode">): string;
+/** Derives the real Message dispatcher binding, including its dispatcher digest. */
+export declare function digestOutboundMessageDispatcherBindingV1(dispatcher: Pick<OutboundMessageDispatcher, "dispatcherId" | "dispatcherVersion" | "dispatcherDigest" | "fencingMode">): string;
+export declare function digestTrustEligibilityBindingV1(integration: TrustEligibilityIntegrationV1, baseBindingDigest: string): string;
+/**
+ * Runs a model-boundary eligibility check before starting the supplied model
+ * operation. Existing executors remain untouched unless this helper is used.
+ */
+export declare function runWithTrustEligibilityV1<T>(integration: TrustModelEligibilityIntegrationV1, target: TrustEligibilityTargetV1, run: () => T): T;
+export declare function wrapActionDispatcherWithTrustV1(dispatcher: ActionDispatcher, integration: TrustEligibilityIntegrationV1, mapTarget: (input: Parameters<ActionDispatcher["dispatch"]>[0]) => TrustEligibilityTargetV1): TrustBoundActionDispatcherV1;
+export declare function wrapOutboundMessageDispatcherWithTrustV1(dispatcher: OutboundMessageDispatcher, integration: TrustEligibilityIntegrationV1, mapTarget: (input: Parameters<OutboundMessageDispatcher["send"]>[0]) => TrustEligibilityTargetV1): TrustBoundOutboundMessageDispatcherV1;
+/**
+ * Runs a model operation only after sampling the current authenticated Trust
+ * runtime. No asynchronous gap is introduced between the final check and run.
+ */
+export declare function runWithTrustStateEligibilityV1<T>(integration: InferenceControlTrustStateIntegrationV1, target: TrustEligibilityTargetV1, boundary: InferenceControlTrustModelBoundaryV1<T>): T;
+/**
+ * Construction-binds the model implementation and passes the exact target
+ * checked by Trust to that same boundary.
+ */
+export declare function wrapModelBoundaryWithTrustStateV1<T>(boundary: InferenceControlTrustModelBoundaryV1<T>, integration: InferenceControlTrustStateIntegrationV1): TrustBoundModelBoundaryV1<T>;
+/**
+ * Adds a state-backed Trust predicate to an Action dispatcher without
+ * changing its grant, authority, reservation, or fencing contracts.
+ */
+export declare function wrapActionDispatcherWithTrustStateV1(dispatcher: ActionDispatcher, integration: InferenceControlTrustStateIntegrationV1): TrustBoundActionDispatcherV1;
+/**
+ * Adds a state-backed Trust predicate to an outbound Message dispatcher while
+ * preserving the base dispatcher's attempt and fencing behavior.
+ */
+export declare function wrapOutboundMessageDispatcherWithTrustStateV1(dispatcher: OutboundMessageDispatcher, integration: InferenceControlTrustStateIntegrationV1): TrustBoundOutboundMessageDispatcherV1;
+//# sourceMappingURL=trust.d.ts.map

package/dist/trust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust.d.ts","sourceRoot":"","sources":["../src/trust.ts"],"names":[],"mappings":"AAAA,OAAO,EAeL,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EAEpB,KAAK,6BAA6B,EAClC,KAAK,6BAA6B,EAClC,KAAK,gCAAgC,EACrC,KAAK,uBAAuB,EAG5B,KAAK,6BAA6B,EAClC,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EACV,mBAAmB,EAEnB,qBAAqB,EACtB,MAAM,YAAY,CAAC;AACpB,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAEjB,MAAM,YAAY,CAAC;AACpB,OAAO,EAGL,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EAC/B,MAAM,eAAe,CAAC;AAEvB;;;GAGG;AACH,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;CACrC;AAED,MAAM,WAAW,8CAA8C;IAC7D,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;CACrC;AAED,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1B,QAAQ,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;IAChD,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC;IAC3C,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,mCAAmC,CAAC;IACtD,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,kCAAmC,SAAQ,oCAAoC;IAC9F,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;CACvC;AAED,MAAM,WAAW,mCAAoC,SAAQ,oCAAoC;IAC/F,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,yBAAyB,CAAC;CAChD;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,CAChD,OAAO,EAAE,mBAAmB,GAC3B,mBAAmB,CAMrB;AAED;;;;GAIG;AACH,wBAAgB,kDAAkD,CAChE,KAAK,EAAE,oCAAoC,GAC1C,eAAe,CAEjB;AAED;;;;GAIG;AACH,wBAAgB,gDAAgD,CAC9D,KAAK,EAAE,kCAAkC,GACxC,eAAe,CAgDjB;AAED;;;GAGG;AACH,wBAAgB,iDAAiD,CAC/D,KAAK,EAAE,mCAAmC,GACzC,eAAe,CAyCjB;AAED,wBAAgB,yCAAyC,CACvD,KAAK,EAAE,8CAA8C,GACpD,mCAAmC,CAmBrC;AAED,MAAM,MAAM,sBAAsB,GAAG,SAAS,GAAG,UAAU,CAAC;AAC5D,MAAM,MAAM,wBAAwB,GAChC,UAAU,GACV,YAAY,GACZ,aAAa,GACb,OAAO,GACP,UAAU,GACV,aAAa,CAAC;AAClB,MAAM,MAAM,2BAA2B,GACrC,OAAO,GAAG,QAAQ,GAAG,kBAAkB,CAAC;AAE1C,+DAA+D;AAC/D,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,2BAA2B,CAAC;IAChD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;GAGG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,OAAO,CAAC,MAAM,EAAE,wBAAwB,GAAG,0BAA0B,CAAC;CACvE;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;CACvC;AAED,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,MAAM,EAAE,+BAA+B,CAAC;IACjD,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;IAC9C,QAAQ,CAAC,OAAO,EAAE,gCAAgC,CAAC;IACnD,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,4BAA4B,KAAK,IAAI,CAAC;CAC5E;AAED,iFAAiF;AACjF,MAAM,WAAW,kCAAmC,SAAQ,6BAA6B;IACvF,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,2BAA2B,CAAC;IAChD,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,4BAA6B,SAAQ,gBAAgB;IACpE,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,qCAAsC,SAAQ,yBAAyB;IACtF,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,oCAAoC,CAAC,CAAC;IACrD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,GAAG,CAAC,MAAM,EAAE,wBAAwB,GAAG,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,yBAAyB,CACxC,CAAC,CACD,SAAQ,oCAAoC,CAAC,CAAC,CAAC;IAC/C,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,0CAA0C;IACzD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,YAAY,EAAE,cAAc,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;CACtC;AAED,MAAM,WAAW,gDAAgD;IAC/D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;CACzC;AAED,MAAM,WAAW,6CAA8C,SAAQ,0CAA0C;IAC/G,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,2BAA2B,CAAC;IAChD,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,YAAY,EAAE,SAAS,6BAA6B,EAAE,CAAC;IAChE,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,0BAA0B,EAAE,MAAM,CAAC;IAC5C,QAAQ,CAAC,4BAA4B,EAAE,MAAM,CAAC;IAC9C,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,yCAAyC;IACxD,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,+CAA+C;IAC9D,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,yCAAyC,CAAC;IAC5D,QAAQ,CAAC,cAAc,EAAE,6BAA6B,CAAC;CACxD;AAED;;;;GAIG;AACH,MAAM,WAAW,+CAAgD,SAAQ,gDAAgD;IACvH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,OAAO,IAAI,+CAA+C,CAAC;CAC5D;AAED,MAAM,WAAW,uCAAuC;IACtD,QAAQ,CAAC,MAAM,EAAE,6CAA6C,CAAC;IAC/D,QAAQ,CAAC,OAAO,EAAE,+CAA+C,CAAC;IAClE,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,4BAA4B,KAAK,IAAI,CAAC;CAC5E;AAED,MAAM,WAAW,6CAA6C;IAC5D,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,YAAY,GAAG,aAAa,GAAG,aAAa,CAAC;IAC3E,QAAQ,CAAC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9C,QAAQ,CAAC,WAAW,EAAE,SAAS,iBAAiB,EAAE,CAAC;CACpD;AAqBD,wBAAgB,iDAAiD,CAC/D,KAAK,EAAE,gDAAgD,GACtD,MAAM,CAWR;AAED,wBAAgB,2CAA2C,CACzD,KAAK,EAAE,0CAA0C,GAChD,MAAM,CAgBR;AAuBD,wBAAgB,mDAAmD,CACjE,KAAK,EAAE,6CAA6C,GACnD,6CAA6C,CAyD/C;AAED,wBAAgB,mDAAmD,CACjE,KAAK,EAAE,6CAA6C,GACnD,MAAM,CAoBR;AAED,wBAAgB,gDAAgD,CAC9D,QAAQ,EAAE,uBAAuB,EACjC,MAAM,EAAE,6BAA6B,EACrC,SAAS,EAAE,gCAAgC,EAC3C,0BAA0B,EAAE,MAAM,EAClC,OAAO,GAAE,6BAAkC,GAC1C,yCAAyC,CAoD3C;AAED;;;;GAIG;AACH,wBAAgB,+CAA+C,CAC7D,WAAW,EAAE,uCAAuC,EACpD,MAAM,EAAE,wBAAwB,GAC/B,6CAA6C,CAM/C;AAED,iFAAiF;AACjF,wBAAgB,0CAA0C,CACxD,QAAQ,EAAE,IAAI,CACZ,oCAAoC,CAAC,OAAO,CAAC,EAC7C,iBAAiB,GAAG,sBAAsB,GAAG,sBAAsB,CACpE,GACA,MAAM,CASR;AAED,2EAA2E;AAC3E,wBAAgB,+BAA+B,CAC7C,UAAU,EAAE,IAAI,CACd,gBAAgB,EAChB,cAAc,GAAG,mBAAmB,GAAG,aAAa,CACrD,GACA,MAAM,CASR;AAED,oFAAoF;AACpF,wBAAgB,wCAAwC,CACtD,UAAU,EAAE,IAAI,CACd,yBAAyB,EACzB,cAAc,GAAG,mBAAmB,GAAG,kBAAkB,GAAG,aAAa,CAC1E,GACA,MAAM,CAUR;AAED,wBAAgB,+BAA+B,CAC7C,WAAW,EAAE,6BAA6B,EAC1C,iBAAiB,EAAE,MAAM,GACxB,MAAM,CAIR;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,CAAC,EACzC,WAAW,EAAE,kCAAkC,EAC/C,MAAM,EAAE,wBAAwB,EAChC,GAAG,EAAE,MAAM,CAAC,GACX,CAAC,CASH;AAED,wBAAgB,+BAA+B,CAC7C,UAAU,EAAE,gBAAgB,EAC5B,WAAW,EAAE,6BAA6B,EAC1C,SAAS,EAAE,CACT,KAAK,EAAE,UAAU,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,KAC/C,wBAAwB,GAC5B,4BAA4B,CAoB9B;AAED,wBAAgB,wCAAwC,CACtD,UAAU,EAAE,yBAAyB,EACrC,WAAW,EAAE,6BAA6B,EAC1C,SAAS,EAAE,CACT,KAAK,EAAE,UAAU,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KACpD,wBAAwB,GAC5B,qCAAqC,CAqBvC;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,CAAC,EAC9C,WAAW,EAAE,uCAAuC,EACpD,MAAM,EAAE,wBAAwB,EAChC,QAAQ,EAAE,oCAAoC,CAAC,CAAC,CAAC,GAChD,CAAC,CAEH;AAED;;;GAGG;AACH,wBAAgB,iCAAiC,CAAC,CAAC,EACjD,QAAQ,EAAE,oCAAoC,CAAC,CAAC,CAAC,EACjD,WAAW,EAAE,uCAAuC,GACnD,yBAAyB,CAAC,CAAC,CAAC,CAuB9B;AAED;;;GAGG;AACH,wBAAgB,oCAAoC,CAClD,UAAU,EAAE,gBAAgB,EAC5B,WAAW,EAAE,uCAAuC,GACnD,4BAA4B,CA+B9B;AAED;;;GAGG;AACH,wBAAgB,6CAA6C,CAC3D,UAAU,EAAE,yBAAyB,EACrC,WAAW,EAAE,uCAAuC,GACnD,qCAAqC,CAgCvC"}