@claudexor/core 1.0.0 → 2.1.1

package/dist/adapter.d.ts

@@ -1,10 +1,16 @@
-import type { AuthPreference, ConformanceReport, HarnessEvent, HarnessManifest, HarnessModel, HarnessRunSpec, InteractionAnswerSet, InteractionRequest } from "@claudexor/schema";
+import type { AuthPreference, AuthSourceKind, ConformanceReport, CredentialProfile, CredentialProfileStatus, HarnessEvent, HarnessManifest, HarnessModel, HarnessRunSpec, InteractionAnswerSet, InteractionRequest } from "@claudexor/schema";
 export interface DoctorSpec {
     cwd: string;
     /** Optional scoped env for probes that must mirror a concrete run route. */
     env?: Record<string, string | null | undefined>;
     /** Optional auth route preference for probes that must mirror a concrete run route. */
     authPreference?: AuthPreference;
+    /** Bypass every readiness cache for this probe without reading, writing, or clearing shared cache state. */
+    fresh?: boolean;
+    /** Probe only this concrete auth source; adapters must not verify unrelated routes. */
+    authSource?: AuthSourceKind;
+    /** Cancels active vendor probes. This runtime-only value is never part of a cache key. */
+    abortSignal?: AbortSignal;
 }
 /**
  * The contract every harness adapter implements. Adapters translate a native
@@ -30,6 +36,13 @@ export interface HarnessAdapter {
     models?(spec?: DoctorSpec): Promise<HarnessModel[]>;
     /** Optional cancellation. */
     cancel?(sessionId: string): Promise<void>;
+    /**
+     * Optional per-profile readiness probe (INV-135): the doctor projection for
+     * one credential profile, without asserting anything about other routes.
+     * Adapters that support no profile transport simply omit it — the service
+     * layer reports `unknown` availability for their profiles.
+     */
+    probeCredentialProfile?(profile: CredentialProfile, abortSignal?: AbortSignal): Promise<CredentialProfileStatus>;
 }
 /** A registry of available adapters keyed by harness id. */
 export type AdapterRegistry = Map<string, HarnessAdapter>;

package/dist/adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,cAAc,EACd,oBAAoB,EACpB,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,4EAA4E;IAC5E,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IAChD,uFAAuF;IACvF,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB,iEAAiE;IACjE,QAAQ,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IAErC,yEAAyE;IACzE,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAErD,+CAA+C;IAC/C,GAAG,CAAC,IAAI,EAAE,cAAc,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;IAEvD,2EAA2E;IAC3E,MAAM,CAAC,CAAC,IAAI,EAAE,cAAc,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;IAE3D;;;;;OAKG;IACH,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAEpD,6BAA6B;IAC7B,MAAM,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3C;AAED,4DAA4D;AAC5D,MAAM,MAAM,eAAe,GAAG,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;AAE1D;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IACvE;kFAC8E;IAC9E,YAAY,CAAC,IAAI,MAAM,CAAC;CACzB;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,cAAc,GAAG,kBAAkB,GAAG,SAAS,CAK/F"}
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,uBAAuB,EACvB,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,cAAc,EACd,oBAAoB,EACpB,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,4EAA4E;IAC5E,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IAChD,uFAAuF;IACvF,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,4GAA4G;IAC5G,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,uFAAuF;IACvF,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,0FAA0F;IAC1F,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB,iEAAiE;IACjE,QAAQ,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IAErC,yEAAyE;IACzE,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAErD,+CAA+C;IAC/C,GAAG,CAAC,IAAI,EAAE,cAAc,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;IAEvD,2EAA2E;IAC3E,MAAM,CAAC,CAAC,IAAI,EAAE,cAAc,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;IAE3D;;;;;OAKG;IACH,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAEpD,6BAA6B;IAC7B,MAAM,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1C;;;;;OAKG;IACH,sBAAsB,CAAC,CACrB,OAAO,EAAE,iBAAiB,EAC1B,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACrC;AAED,4DAA4D;AAC5D,MAAM,MAAM,eAAe,GAAG,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;AAE1D;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IACvE;kFAC8E;IAC9E,YAAY,CAAC,IAAI,MAAM,CAAC;CACzB;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,cAAc,GAAG,kBAAkB,GAAG,SAAS,CAK/F"}

package/dist/adapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AA0EA,MAAM,UAAU,0BAA0B,CAAC,IAAoB;IAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,oBAAoB,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9D,MAAM,SAAS,GAAG,OAAsC,CAAC;IACzD,OAAO,OAAO,SAAS,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAE,OAA8B,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/F,CAAC"}
+{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AA8FA,MAAM,UAAU,0BAA0B,CAAC,IAAoB;IAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,oBAAoB,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9D,MAAM,SAAS,GAAG,OAAsC,CAAC;IACzD,OAAO,OAAO,SAAS,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAE,OAA8B,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/F,CAAC"}

package/dist/answer-assembly.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Answer assembly with TYPED finality (W-C1): a harness's `final` message
+ * (claude/cursor terminal `result`, codex's finalized last agent message) IS
+ * the answer, verbatim — mid-run narration never bleeds into it. The joined
+ * narration remains the fallback for adapters/versions without the marker.
+ */
+export declare class AnswerAssembly {
+    private readonly parts;
+    private finalText?;
+    /** Feed one already-sanitized harness event; non-answer events are ignored. */
+    observe(ev: {
+        type: string;
+        text?: string;
+        final?: boolean;
+        payload?: Record<string, unknown>;
+    }): void;
+    /** Whether a typed final answer has been accepted. */
+    hasFinal(): boolean;
+    /** The assembled answer: the typed final verbatim, else joined narration. */
+    text(): string;
+}
+//# sourceMappingURL=answer-assembly.d.ts.map

package/dist/answer-assembly.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"answer-assembly.d.ts","sourceRoot":"","sources":["../src/answer-assembly.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgB;IACtC,OAAO,CAAC,SAAS,CAAC,CAAS;IAE3B,+EAA+E;IAC/E,OAAO,CAAC,EAAE,EAAE;QACV,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACnC,GAAG,IAAI;IAiBR,sDAAsD;IACtD,QAAQ,IAAI,OAAO;IAInB,6EAA6E;IAC7E,IAAI,IAAI,MAAM;CAGf"}

package/dist/answer-assembly.js

@@ -0,0 +1,55 @@
+/**
+ * Answer assembly with TYPED finality (W-C1): a harness's `final` message
+ * (claude/cursor terminal `result`, codex's finalized last agent message) IS
+ * the answer, verbatim — mid-run narration never bleeds into it. The joined
+ * narration remains the fallback for adapters/versions without the marker.
+ */
+export class AnswerAssembly {
+    parts = [];
+    finalText;
+    /** Feed one already-sanitized harness event; non-answer events are ignored. */
+    observe(ev) {
+        if (ev.type !== "message" || !ev.text)
+            return;
+        if (ev.payload?.["auth_switched"] === true)
+            return;
+        // Live deltas are DISPLAY-stream chunks (W-C4): the complete message
+        // always follows — joining chunks here would shred the answer.
+        if (ev.payload?.["delta"] === true)
+            return;
+        if (ev.final === true) {
+            // A whitespace-only final is NOT an answer: ignore it, never let it
+            // erase an earlier real final (review sol #3). The accepted final is
+            // kept VERBATIM (the documented contract) — no trimming.
+            if (ev.text.trim().length === 0)
+                return;
+            this.finalText = ev.text;
+        }
+        else {
+            pushUniqueText(this.parts, ev.text);
+        }
+    }
+    /** Whether a typed final answer has been accepted. */
+    hasFinal() {
+        return this.finalText !== undefined;
+    }
+    /** The assembled answer: the typed final verbatim, else joined narration. */
+    text() {
+        return this.finalText ?? this.parts.join("\n").trim();
+    }
+}
+/**
+ * Deduplicate the known "final result repeats the last streamed message" shape
+ * (adjacent only). Legitimately repeated earlier messages are preserved — a
+ * whole-array dedupe would silently merge real output.
+ */
+function pushUniqueText(parts, text) {
+    const normalized = text.trim();
+    if (!normalized)
+        return;
+    const last = parts[parts.length - 1]?.trim();
+    if (last === normalized)
+        return;
+    parts.push(normalized);
+}
+//# sourceMappingURL=answer-assembly.js.map

package/dist/answer-assembly.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"answer-assembly.js","sourceRoot":"","sources":["../src/answer-assembly.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,OAAO,cAAc;IACR,KAAK,GAAa,EAAE,CAAC;IAC9B,SAAS,CAAU;IAE3B,+EAA+E;IAC/E,OAAO,CAAC,EAKP;QACC,IAAI,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,EAAE,CAAC,IAAI;YAAE,OAAO;QAC9C,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,eAAe,CAAC,KAAK,IAAI;YAAE,OAAO;QACnD,qEAAqE;QACrE,+DAA+D;QAC/D,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI;YAAE,OAAO;QAC3C,IAAI,EAAE,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACtB,oEAAoE;YACpE,qEAAqE;YACrE,yDAAyD;YACzD,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YACxC,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC,IAAI,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED,sDAAsD;IACtD,QAAQ;QACN,OAAO,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC;IACtC,CAAC;IAED,6EAA6E;IAC7E,IAAI;QACF,OAAO,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IACxD,CAAC;CACF;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,KAAe,EAAE,IAAY;IACnD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,UAAU;QAAE,OAAO;IACxB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAC7C,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO;IAChC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AACzB,CAAC"}

package/dist/attachment-integrity.d.ts

@@ -0,0 +1,4 @@
+import type { Attachment } from "@claudexor/schema";
+/** Read once and bind the adapter payload to the finalized daemon resource digest. */
+export declare function readVerifiedAttachmentBytes(attachment: Attachment): Buffer;
+//# sourceMappingURL=attachment-integrity.d.ts.map

package/dist/attachment-integrity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachment-integrity.d.ts","sourceRoot":"","sources":["../src/attachment-integrity.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,sFAAsF;AACtF,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,CAU1E"}

package/dist/attachment-integrity.js

@@ -0,0 +1,12 @@
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+/** Read once and bind the adapter payload to the finalized daemon resource digest. */
+export function readVerifiedAttachmentBytes(attachment) {
+    const bytes = readFileSync(attachment.path);
+    const digest = `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
+    if (bytes.length !== attachment.size_bytes || digest !== attachment.sha256) {
+        throw Object.assign(new Error(`attachment bytes no longer match resource ${attachment.resource_id}`), { code: "attachment_digest_mismatch" });
+    }
+    return bytes;
+}
+//# sourceMappingURL=attachment-integrity.js.map

package/dist/attachment-integrity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachment-integrity.js","sourceRoot":"","sources":["../src/attachment-integrity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAGvC,sFAAsF;AACtF,MAAM,UAAU,2BAA2B,CAAC,UAAsB;IAChE,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5E,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,CAAC,UAAU,IAAI,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;QAC3E,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CAAC,6CAA6C,UAAU,CAAC,WAAW,EAAE,CAAC,EAChF,EAAE,IAAI,EAAE,4BAA4B,EAAE,CACvC,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/auth-capability-verifier.d.ts

@@ -0,0 +1,42 @@
+import { type AuthCapabilityBinding as AuthCapabilityBindingType, type AuthCapabilityReceipt as AuthCapabilityReceiptType, type AuthRequest, type AuthSmokeDisclosure as AuthSmokeDisclosureType, type AuthSourceKind, type CredentialRoute } from "@claudexor/schema";
+import type { AdapterRegistry, HarnessAdapter } from "./adapter.js";
+export interface AuthCapabilityPreparationRequest {
+    attemptId: string;
+    harness: string;
+    requested: AuthRequest;
+    requiredRoute: CredentialRoute;
+    requiredSource: AuthSourceKind;
+}
+export interface AuthCapabilityPreparation {
+    binding: AuthCapabilityBindingType;
+}
+export interface AuthCapabilityVerificationRequest {
+    binding: AuthCapabilityBindingType;
+    startedAt: string;
+    abortSignal?: AbortSignal;
+}
+export interface AuthCapabilityVerifierDeps {
+    now?: () => Date;
+    receiptId?: () => string;
+    scratchRoot?: string;
+}
+/**
+ * Executes one ordinary adapter run and reduces only typed normalized events
+ * into a redacted exact-route receipt. It owns an external scratch tree, never
+ * discovers a second adapter, and never persists model output.
+ */
+export declare class AuthCapabilityVerifier {
+    private readonly adapter;
+    private readonly now;
+    private readonly receiptId;
+    private readonly scratchRoot;
+    constructor(adapter: (id: string) => HarnessAdapter | undefined, deps?: AuthCapabilityVerifierDeps);
+    static fromRegistry(registry: AdapterRegistry, deps?: AuthCapabilityVerifierDeps): AuthCapabilityVerifier;
+    disclosure(harness: string, requested: AuthRequest, requiredRoute: CredentialRoute, requiredSource: AuthSourceKind): AuthSmokeDisclosureType;
+    prepare(request: AuthCapabilityPreparationRequest): AuthCapabilityPreparation;
+    verify(request: AuthCapabilityVerificationRequest): Promise<AuthCapabilityReceiptType>;
+    /** Remove only the verifier-owned directory for a validated durable attempt. */
+    cleanup(attemptId: string): void;
+    private createScratch;
+}
+//# sourceMappingURL=auth-capability-verifier.d.ts.map

package/dist/auth-capability-verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-capability-verifier.d.ts","sourceRoot":"","sources":["../src/auth-capability-verifier.ts"],"names":[],"mappings":"AAgBA,OAAO,EAML,KAAK,qBAAqB,IAAI,yBAAyB,EACvD,KAAK,qBAAqB,IAAI,yBAAyB,EACvD,KAAK,WAAW,EAChB,KAAK,mBAAmB,IAAI,uBAAuB,EACnD,KAAK,cAAc,EACnB,KAAK,eAAe,EAErB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAMpE,MAAM,WAAW,gCAAgC;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,WAAW,CAAC;IACvB,aAAa,EAAE,eAAe,CAAC;IAC/B,cAAc,EAAE,cAAc,CAAC;CAChC;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,yBAAyB,CAAC;CACpC;AAED,MAAM,WAAW,iCAAiC;IAChD,OAAO,EAAE,yBAAyB,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,MAAM,WAAW,0BAA0B;IACzC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,qBAAa,sBAAsB;IAM/B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAL1B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;gBAGlB,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,cAAc,GAAG,SAAS,EACpE,IAAI,GAAE,0BAA+B;IASvC,MAAM,CAAC,YAAY,CACjB,QAAQ,EAAE,eAAe,EACzB,IAAI,GAAE,0BAA+B,GACpC,sBAAsB;IAIzB,UAAU,CACR,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,WAAW,EACtB,aAAa,EAAE,eAAe,EAC9B,cAAc,EAAE,cAAc,GAC7B,uBAAuB;IAgB1B,OAAO,CAAC,OAAO,EAAE,gCAAgC,GAAG,yBAAyB;IAmBvE,MAAM,CAAC,OAAO,EAAE,iCAAiC,GAAG,OAAO,CAAC,yBAAyB,CAAC;IA2P5F,gFAAgF;IAChF,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAkBhC,OAAO,CAAC,aAAa;CAYtB"}

package/dist/auth-capability-verifier.js

@@ -0,0 +1,417 @@
+import { createHash, randomUUID } from "node:crypto";
+import { chmodSync, existsSync, lstatSync, mkdirSync, openSync, readSync, readdirSync, readlinkSync, realpathSync, rmSync, closeSync, } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, relative, resolve, sep } from "node:path";
+import { AuthCapabilityBinding, AuthCapabilityReceipt, AuthSmokeDisclosure, HarnessEvent, HarnessRunSpec as HarnessRunSpecSchema, } from "@claudexor/schema";
+import { ensureCanonicalPrivateDirectory } from "@claudexor/util";
+import { AnswerAssembly } from "./answer-assembly.js";
+const MAX_RESPONSE_CHARS = 4_096;
+const ATTEMPT_ID = /^[A-Za-z0-9-]+$/;
+/**
+ * Executes one ordinary adapter run and reduces only typed normalized events
+ * into a redacted exact-route receipt. It owns an external scratch tree, never
+ * discovers a second adapter, and never persists model output.
+ */
+export class AuthCapabilityVerifier {
+    adapter;
+    now;
+    receiptId;
+    scratchRoot;
+    constructor(adapter, deps = {}) {
+        this.adapter = adapter;
+        this.now = deps.now ?? (() => new Date());
+        this.receiptId = deps.receiptId ?? (() => `authcap-${randomUUID()}`);
+        this.scratchRoot = resolve(deps.scratchRoot ?? join(realpathSync(tmpdir()), "claudexor-auth-smokes"));
+    }
+    static fromRegistry(registry, deps = {}) {
+        return new AuthCapabilityVerifier((id) => registry.get(id), deps);
+    }
+    disclosure(harness, requested, requiredRoute, requiredSource) {
+        return AuthSmokeDisclosure.parse({
+            schemaVersion: 1,
+            protocolVersion: 1,
+            harness,
+            requested,
+            requiredRoute,
+            requiredSource,
+            networkScope: "selected_harness_only",
+            billingKnowledge: "unknown",
+            incrementalCostKnowledge: "unknown",
+            mayConsumeQuota: true,
+            generatedAt: this.now().toISOString(),
+        });
+    }
+    prepare(request) {
+        if (!ATTEMPT_ID.test(request.attemptId))
+            throw new Error("invalid auth capability attempt id");
+        const disclosure = this.disclosure(request.harness, request.requested, request.requiredRoute, request.requiredSource);
+        const challengeDigest = sha256(challengeFor(request.attemptId));
+        return {
+            binding: AuthCapabilityBinding.parse({
+                attemptId: request.attemptId,
+                challengeDigest,
+                requestDigest: capabilityRequestDigest(disclosure, challengeDigest),
+                disclosure,
+            }),
+        };
+    }
+    async verify(request) {
+        const binding = AuthCapabilityBinding.parse(request.binding);
+        const disclosure = binding.disclosure;
+        const expected = challengeFor(binding.attemptId);
+        const requestMismatch = binding.challengeDigest !== sha256(expected) ||
+            binding.requestDigest !== capabilityRequestDigest(disclosure, binding.challengeDigest);
+        const streamHash = createHash("sha256");
+        // The challenge answer follows the engine's typed-finality semantics
+        // (AnswerAssembly, W-C1): harnesses narrate the answer mid-run and then
+        // repeat it as their typed `final` message — concatenating both would
+        // false-fail every compliant run with "expected+expected".
+        const answer = new AnswerAssembly();
+        let narrationChars = 0;
+        let narrationTruncated = false;
+        let effective = null;
+        let effectiveSource = null;
+        let routeConflict = false;
+        let sourceConflict = false;
+        let startedEvents = 0;
+        let completedEvents = 0;
+        let errorEvents = 0;
+        let unexpectedToolEvents = 0;
+        let interactionEvents = 0;
+        let sessionMismatchEvents = 0;
+        let eventsAfterCompleted = 0;
+        let protocolViolation = false;
+        let adapterFailed = false;
+        let adapterMissing = false;
+        let adapterIdentityMismatch = false;
+        let cancelled = request.abortSignal?.aborted === true;
+        let terminalSeen = false;
+        const evidence = new Set();
+        const noScratchDigest = sha256("scratch:not-created");
+        let scratchBeforeDigest = noScratchDigest;
+        let scratchAfterDigest = noScratchDigest;
+        let scratchPath = null;
+        let adapter;
+        if (!requestMismatch) {
+            try {
+                adapter = this.adapter(disclosure.harness);
+            }
+            catch {
+                adapterFailed = true;
+                evidence.add("adapter:lookup_threw");
+            }
+            if (!adapter && !adapterFailed)
+                adapterMissing = true;
+            if (adapter && adapter.id !== disclosure.harness) {
+                adapterIdentityMismatch = true;
+                evidence.add("adapter:identity_mismatch");
+            }
+        }
+        if (adapter && !adapterIdentityMismatch && !adapterFailed && !requestMismatch && !cancelled) {
+            try {
+                scratchPath = this.createScratch(binding.attemptId);
+                scratchBeforeDigest = fingerprintTree(scratchPath);
+                const spec = HarnessRunSpecSchema.parse({
+                    session_id: `auth-smoke-${binding.attemptId}`,
+                    intent: "explain",
+                    prompt: `Return exactly ${expected} and no other text. Do not call tools.`,
+                    cwd: scratchPath,
+                    access: "readonly",
+                    external_context_policy: "off",
+                    tool_permission_policy: { web: "off", allow: [], deny: [] },
+                    model_hint: null,
+                    effort_hint: null,
+                    max_turns: 1,
+                    auth_preference: disclosure.requested,
+                    // The capability smoke proves the DEFAULT credential ladder's route;
+                    // profile readiness has its own probe (probeCredentialProfile).
+                    credential_profile: null,
+                    resume_session_id: null,
+                    env_inheritance: "clean",
+                    evidence_policy: "stream_only",
+                    env: {},
+                    attachments: [],
+                    browser: null,
+                    stream_deltas: false,
+                    extra: request.abortSignal ? { abortSignal: request.abortSignal } : {},
+                });
+                for await (const raw of adapter.run(spec)) {
+                    const event = HarnessEvent.parse(raw);
+                    streamHash.update(JSON.stringify({
+                        type: event.type,
+                        session: event.session_id,
+                        route: event.credential_route ?? null,
+                        source: event.credential_source ?? null,
+                        aborted: event.aborted ?? false,
+                        textDigest: event.text === undefined ? null : sha256(event.text),
+                    }));
+                    if (terminalSeen)
+                        eventsAfterCompleted += 1;
+                    if (event.session_id !== spec.session_id) {
+                        sessionMismatchEvents += 1;
+                        evidence.add("event:session_mismatch");
+                        continue;
+                    }
+                    if (startedEvents === 0 && event.type !== "started")
+                        protocolViolation = true;
+                    switch (event.type) {
+                        case "started":
+                            startedEvents += 1;
+                            if (startedEvents !== 1 || terminalSeen)
+                                protocolViolation = true;
+                            evidence.add("event:started");
+                            if (event.credential_route) {
+                                if (effective && effective !== event.credential_route)
+                                    routeConflict = true;
+                                effective ??= event.credential_route;
+                                evidence.add(`credential-route:${event.credential_route}`);
+                            }
+                            if (event.credential_source) {
+                                if (effectiveSource && effectiveSource !== event.credential_source)
+                                    sourceConflict = true;
+                                effectiveSource ??= event.credential_source;
+                                evidence.add(`credential-source:${event.credential_source}`);
+                            }
+                            break;
+                        case "message": {
+                            // Bound only the retained NARRATION (the no-final fallback); a
+                            // typed final is a single already-materialized event text and
+                            // makes narration irrelevant to the comparison.
+                            const text = event.text ?? "";
+                            if (event.final !== true) {
+                                if (narrationChars + text.length > MAX_RESPONSE_CHARS) {
+                                    narrationTruncated = true;
+                                    break;
+                                }
+                                narrationChars += text.length;
+                            }
+                            answer.observe(event);
+                            break;
+                        }
+                        case "error":
+                            errorEvents += 1;
+                            evidence.add("event:error");
+                            break;
+                        case "interaction_requested":
+                            interactionEvents += 1;
+                            evidence.add("event:unexpected_interaction");
+                            break;
+                        case "tool_call":
+                        case "tool_result":
+                        case "file_change":
+                            unexpectedToolEvents += 1;
+                            evidence.add("event:unexpected_tool_activity");
+                            break;
+                        case "completed":
+                            completedEvents += 1;
+                            terminalSeen = true;
+                            if (completedEvents !== 1 || event.aborted)
+                                protocolViolation = true;
+                            cancelled ||= event.aborted === true;
+                            evidence.add("event:completed");
+                            break;
+                        default:
+                            break;
+                    }
+                }
+                cancelled ||= request.abortSignal?.aborted === true;
+            }
+            catch {
+                cancelled ||= request.abortSignal?.aborted === true;
+                adapterFailed = !cancelled;
+                evidence.add(cancelled ? "adapter:cancelled" : "adapter:threw");
+            }
+            finally {
+                if (scratchPath) {
+                    try {
+                        scratchAfterDigest = fingerprintTree(scratchPath);
+                    }
+                    catch {
+                        scratchAfterDigest = sha256("scratch:missing-or-unreadable");
+                    }
+                }
+            }
+        }
+        // The digest binds the receipt to the response that was actually COMPARED
+        // (typed final verbatim, else joined narration) — the per-event text
+        // digests remain visible in streamDigest.
+        const response = answer.text();
+        const responseOverflow = !answer.hasFinal() && narrationTruncated;
+        const responseDigest = sha256(response);
+        const streamDigest = streamHash.digest("hex");
+        evidence.add(`response:sha256:${responseDigest}`);
+        evidence.add(`stream:sha256:${streamDigest}`);
+        let selectionReason;
+        if (requestMismatch)
+            selectionReason = "request_mismatch";
+        else if (adapterIdentityMismatch)
+            selectionReason = "adapter_identity_mismatch";
+        else if (adapterMissing)
+            selectionReason = "adapter_unavailable";
+        else if (cancelled)
+            selectionReason = "cancelled";
+        else if (adapterFailed)
+            selectionReason = "adapter_error";
+        else if (startedEvents === 0 || effective === null)
+            selectionReason = "route_missing";
+        else if (routeConflict || effective !== disclosure.requiredRoute)
+            selectionReason = "route_mismatch";
+        else if (effectiveSource === null)
+            selectionReason = "source_missing";
+        else if (sourceConflict || effectiveSource !== disclosure.requiredSource)
+            selectionReason = "source_mismatch";
+        else if (protocolViolation ||
+            startedEvents !== 1 ||
+            completedEvents > 1 ||
+            eventsAfterCompleted > 0)
+            selectionReason = "protocol_violation";
+        else if (errorEvents > 0 ||
+            unexpectedToolEvents > 0 ||
+            interactionEvents > 0 ||
+            sessionMismatchEvents > 0)
+            selectionReason = "harness_error";
+        else if (completedEvents === 0)
+            selectionReason = "missing_completion";
+        else if (scratchBeforeDigest !== scratchAfterDigest)
+            selectionReason = "scratch_mutated";
+        else if (responseOverflow || response !== expected)
+            selectionReason = "response_mismatch";
+        else
+            selectionReason = "exact_requested_route";
+        const passed = selectionReason === "exact_requested_route";
+        return AuthCapabilityReceipt.parse({
+            receiptId: this.receiptId(),
+            attemptId: binding.attemptId,
+            harness: disclosure.harness,
+            requested: disclosure.requested,
+            requiredRoute: disclosure.requiredRoute,
+            requiredSource: disclosure.requiredSource,
+            effective,
+            effectiveSource,
+            selectionReason,
+            availability: effective && effectiveSource ? "available" : adapterMissing ? "unavailable" : "unknown",
+            verification: passed ? "passed" : "failed",
+            billingKnowledge: "unknown",
+            costKnowledge: "unknown",
+            startedAt: request.startedAt,
+            completedAt: this.now().toISOString(),
+            challengeDigest: binding.challengeDigest,
+            requestDigest: binding.requestDigest,
+            responseDigest,
+            streamDigest,
+            scratchBeforeDigest,
+            scratchAfterDigest,
+            stream: {
+                startedEvents,
+                completedEvents,
+                errorEvents,
+                unexpectedToolEvents,
+                interactionEvents,
+                sessionMismatchEvents,
+                eventsAfterCompleted,
+                aborted: cancelled,
+            },
+            evidenceRefs: [...evidence],
+        });
+    }
+    /** Remove only the verifier-owned directory for a validated durable attempt. */
+    cleanup(attemptId) {
+        if (!ATTEMPT_ID.test(attemptId))
+            throw new Error("invalid auth capability attempt id");
+        if (!existsSync(this.scratchRoot))
+            return;
+        const root = realpathSync(this.scratchRoot);
+        const path = join(root, attemptId);
+        if (!existsSync(path))
+            return;
+        const stat = lstatSync(path);
+        if (stat.isSymbolicLink() ||
+            !stat.isDirectory() ||
+            realpathSync(path) !== path ||
+            !path.startsWith(root + sep)) {
+            throw new Error("refusing unsafe auth capability scratch cleanup");
+        }
+        rmSync(path, { recursive: true, force: false });
+    }
+    createScratch(attemptId) {
+        if (!ATTEMPT_ID.test(attemptId))
+            throw new Error("invalid auth capability attempt id");
+        ensureCanonicalPrivateDirectory(this.scratchRoot);
+        const root = realpathSync(this.scratchRoot);
+        const path = join(root, attemptId);
+        if (existsSync(path))
+            throw new Error("auth capability scratch already exists");
+        mkdirSync(path, { recursive: false, mode: 0o700 });
+        chmodSync(path, 0o700);
+        if (realpathSync(path) !== path || !path.startsWith(root + sep))
+            throw new Error("unsafe auth capability scratch path");
+        return path;
+    }
+}
+function challengeFor(attemptId) {
+    return `claudexor-auth-capability-v1-${sha256(`auth-capability-v1:${attemptId}`).slice(0, 32)}`;
+}
+function capabilityRequestDigest(disclosure, challengeDigest) {
+    return sha256(JSON.stringify({
+        schemaVersion: 1,
+        protocolVersion: 1,
+        harness: disclosure.harness,
+        requested: disclosure.requested,
+        requiredRoute: disclosure.requiredRoute,
+        requiredSource: disclosure.requiredSource,
+        networkScope: disclosure.networkScope,
+        cwdPolicy: "owned_external_scratch_v1",
+        intent: "explain",
+        access: "readonly",
+        externalContextPolicy: "off",
+        maxTurns: 1,
+        envInheritance: "clean",
+        evidencePolicy: "stream_only",
+        challengeDigest,
+    }));
+}
+function fingerprintTree(root) {
+    const hash = createHash("sha256");
+    const walk = (directory) => {
+        for (const name of readdirSync(directory).sort()) {
+            const path = join(directory, name);
+            const rel = relative(root, path);
+            const stat = lstatSync(path);
+            const type = stat.isDirectory()
+                ? "directory"
+                : stat.isFile()
+                    ? "file"
+                    : stat.isSymbolicLink()
+                        ? "symlink"
+                        : "other";
+            hash.update(JSON.stringify({ rel, type, mode: stat.mode, size: stat.size }));
+            if (stat.isDirectory())
+                walk(path);
+            else if (stat.isSymbolicLink())
+                hash.update(readlinkSync(path));
+            else if (stat.isFile())
+                hashFile(path, hash);
+        }
+    };
+    walk(root);
+    return hash.digest("hex");
+}
+function hashFile(path, hash) {
+    const fd = openSync(path, "r");
+    const buffer = Buffer.allocUnsafe(64 * 1024);
+    try {
+        for (;;) {
+            const bytes = readSync(fd, buffer, 0, buffer.length, null);
+            if (bytes === 0)
+                break;
+            hash.update(buffer.subarray(0, bytes));
+        }
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+function sha256(value) {
+    return createHash("sha256").update(value, "utf8").digest("hex");
+}
+//# sourceMappingURL=auth-capability-verifier.js.map

package/dist/auth-capability-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-capability-verifier.js","sourceRoot":"","sources":["../src/auth-capability-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,MAAM,EACN,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACZ,cAAc,IAAI,oBAAoB,GAQvC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,+BAA+B,EAAE,MAAM,iBAAiB,CAAC;AAElE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,UAAU,GAAG,iBAAiB,CAAC;AA0BrC;;;;GAIG;AACH,MAAM,OAAO,sBAAsB;IAMd;IALF,GAAG,CAAa;IAChB,SAAS,CAAe;IACxB,WAAW,CAAS;IAErC,YACmB,OAAmD,EACpE,OAAmC,EAAE;QADpB,YAAO,GAAP,OAAO,CAA4C;QAGpE,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,UAAU,EAAE,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,WAAW,GAAG,OAAO,CACxB,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,uBAAuB,CAAC,CAC1E,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,CACjB,QAAyB,EACzB,OAAmC,EAAE;QAErC,OAAO,IAAI,sBAAsB,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IACpE,CAAC;IAED,UAAU,CACR,OAAe,EACf,SAAsB,EACtB,aAA8B,EAC9B,cAA8B;QAE9B,OAAO,mBAAmB,CAAC,KAAK,CAAC;YAC/B,aAAa,EAAE,CAAC;YAChB,eAAe,EAAE,CAAC;YAClB,OAAO;YACP,SAAS;YACT,aAAa;YACb,cAAc;YACd,YAAY,EAAE,uBAAuB;YACrC,gBAAgB,EAAE,SAAS;YAC3B,wBAAwB,EAAE,SAAS;YACnC,eAAe,EAAE,IAAI;YACrB,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,OAAyC;QAC/C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC/F,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAChC,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,aAAa,EACrB,OAAO,CAAC,cAAc,CACvB,CAAC;QACF,MAAM,eAAe,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QAChE,OAAO;YACL,OAAO,EAAE,qBAAqB,CAAC,KAAK,CAAC;gBACnC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,eAAe;gBACf,aAAa,EAAE,uBAAuB,CAAC,UAAU,EAAE,eAAe,CAAC;gBACnE,UAAU;aACX,CAAC;SACH,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAA0C;QACrD,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7D,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACtC,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,eAAe,GACnB,OAAO,CAAC,eAAe,KAAK,MAAM,CAAC,QAAQ,CAAC;YAC5C,OAAO,CAAC,aAAa,KAAK,uBAAuB,CAAC,UAAU,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;QACzF,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACxC,qEAAqE;QACrE,wEAAwE;QACxE,sEAAsE;QACtE,2DAA2D;QAC3D,MAAM,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACpC,IAAI,cAAc,GAAG,CAAC,CAAC;QACvB,IAAI,kBAAkB,GAAG,KAAK,CAAC;QAC/B,IAAI,SAAS,GAA2B,IAAI,CAAC;QAC7C,IAAI,eAAe,GAA0B,IAAI,CAAC;QAClD,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,IAAI,oBAAoB,GAAG,CAAC,CAAC;QAC7B,IAAI,iBAAiB,GAAG,CAAC,CAAC;QAC1B,IAAI,qBAAqB,GAAG,CAAC,CAAC;QAC9B,IAAI,oBAAoB,GAAG,CAAC,CAAC;QAC7B,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAC9B,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,IAAI,uBAAuB,GAAG,KAAK,CAAC;QACpC,IAAI,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,OAAO,KAAK,IAAI,CAAC;QACtD,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,MAAM,eAAe,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACtD,IAAI,mBAAmB,GAAG,eAAe,CAAC;QAC1C,IAAI,kBAAkB,GAAG,eAAe,CAAC;QACzC,IAAI,WAAW,GAAkB,IAAI,CAAC;QACtC,IAAI,OAAmC,CAAC;QAExC,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAC7C,CAAC;YAAC,MAAM,CAAC;gBACP,aAAa,GAAG,IAAI,CAAC;gBACrB,QAAQ,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;YACvC,CAAC;YACD,IAAI,CAAC,OAAO,IAAI,CAAC,aAAa;gBAAE,cAAc,GAAG,IAAI,CAAC;YACtD,IAAI,OAAO,IAAI,OAAO,CAAC,EAAE,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;gBACjD,uBAAuB,GAAG,IAAI,CAAC;gBAC/B,QAAQ,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,IAAI,OAAO,IAAI,CAAC,uBAAuB,IAAI,CAAC,aAAa,IAAI,CAAC,eAAe,IAAI,CAAC,SAAS,EAAE,CAAC;YAC5F,IAAI,CAAC;gBACH,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBACpD,mBAAmB,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;gBACnD,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC;oBACtC,UAAU,EAAE,cAAc,OAAO,CAAC,SAAS,EAAE;oBAC7C,MAAM,EAAE,SAAS;oBACjB,MAAM,EAAE,kBAAkB,QAAQ,wCAAwC;oBAC1E,GAAG,EAAE,WAAW;oBAChB,MAAM,EAAE,UAAU;oBAClB,uBAAuB,EAAE,KAAK;oBAC9B,sBAAsB,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;oBAC3D,UAAU,EAAE,IAAI;oBAChB,WAAW,EAAE,IAAI;oBACjB,SAAS,EAAE,CAAC;oBACZ,eAAe,EAAE,UAAU,CAAC,SAAS;oBACrC,qEAAqE;oBACrE,gEAAgE;oBAChE,kBAAkB,EAAE,IAAI;oBACxB,iBAAiB,EAAE,IAAI;oBACvB,eAAe,EAAE,OAAO;oBACxB,eAAe,EAAE,aAAa;oBAC9B,GAAG,EAAE,EAAE;oBACP,WAAW,EAAE,EAAE;oBACf,OAAO,EAAE,IAAI;oBACb,aAAa,EAAE,KAAK;oBACpB,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE;iBAC9C,CAAC,CAAC;gBAC5B,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1C,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBACtC,UAAU,CAAC,MAAM,CACf,IAAI,CAAC,SAAS,CAAC;wBACb,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,OAAO,EAAE,KAAK,CAAC,UAAU;wBACzB,KAAK,EAAE,KAAK,CAAC,gBAAgB,IAAI,IAAI;wBACrC,MAAM,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI;wBACvC,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,KAAK;wBAC/B,UAAU,EAAE,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;qBACjE,CAAC,CACH,CAAC;oBACF,IAAI,YAAY;wBAAE,oBAAoB,IAAI,CAAC,CAAC;oBAC5C,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;wBACzC,qBAAqB,IAAI,CAAC,CAAC;wBAC3B,QAAQ,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;wBACvC,SAAS;oBACX,CAAC;oBACD,IAAI,aAAa,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;wBAAE,iBAAiB,GAAG,IAAI,CAAC;oBAC9E,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;wBACnB,KAAK,SAAS;4BACZ,aAAa,IAAI,CAAC,CAAC;4BACnB,IAAI,aAAa,KAAK,CAAC,IAAI,YAAY;gCAAE,iBAAiB,GAAG,IAAI,CAAC;4BAClE,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;4BAC9B,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;gCAC3B,IAAI,SAAS,IAAI,SAAS,KAAK,KAAK,CAAC,gBAAgB;oCAAE,aAAa,GAAG,IAAI,CAAC;gCAC5E,SAAS,KAAK,KAAK,CAAC,gBAAgB,CAAC;gCACrC,QAAQ,CAAC,GAAG,CAAC,oBAAoB,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;4BAC7D,CAAC;4BACD,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;gCAC5B,IAAI,eAAe,IAAI,eAAe,KAAK,KAAK,CAAC,iBAAiB;oCAChE,cAAc,GAAG,IAAI,CAAC;gCACxB,eAAe,KAAK,KAAK,CAAC,iBAAiB,CAAC;gCAC5C,QAAQ,CAAC,GAAG,CAAC,qBAAqB,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC;4BAC/D,CAAC;4BACD,MAAM;wBACR,KAAK,SAAS,CAAC,CAAC,CAAC;4BACf,+DAA+D;4BAC/D,8DAA8D;4BAC9D,gDAAgD;4BAChD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;4BAC9B,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;gCACzB,IAAI,cAAc,GAAG,IAAI,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;oCACtD,kBAAkB,GAAG,IAAI,CAAC;oCAC1B,MAAM;gCACR,CAAC;gCACD,cAAc,IAAI,IAAI,CAAC,MAAM,CAAC;4BAChC,CAAC;4BACD,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;4BACtB,MAAM;wBACR,CAAC;wBACD,KAAK,OAAO;4BACV,WAAW,IAAI,CAAC,CAAC;4BACjB,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;4BAC5B,MAAM;wBACR,KAAK,uBAAuB;4BAC1B,iBAAiB,IAAI,CAAC,CAAC;4BACvB,QAAQ,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;4BAC7C,MAAM;wBACR,KAAK,WAAW,CAAC;wBACjB,KAAK,aAAa,CAAC;wBACnB,KAAK,aAAa;4BAChB,oBAAoB,IAAI,CAAC,CAAC;4BAC1B,QAAQ,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;4BAC/C,MAAM;wBACR,KAAK,WAAW;4BACd,eAAe,IAAI,CAAC,CAAC;4BACrB,YAAY,GAAG,IAAI,CAAC;4BACpB,IAAI,eAAe,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO;gCAAE,iBAAiB,GAAG,IAAI,CAAC;4BACrE,SAAS,KAAK,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC;4BACrC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;4BAChC,MAAM;wBACR;4BACE,MAAM;oBACV,CAAC;gBACH,CAAC;gBACD,SAAS,KAAK,OAAO,CAAC,WAAW,EAAE,OAAO,KAAK,IAAI,CAAC;YACtD,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,KAAK,OAAO,CAAC,WAAW,EAAE,OAAO,KAAK,IAAI,CAAC;gBACpD,aAAa,GAAG,CAAC,SAAS,CAAC;gBAC3B,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;YAClE,CAAC;oBAAS,CAAC;gBACT,IAAI,WAAW,EAAE,CAAC;oBAChB,IAAI,CAAC;wBACH,kBAAkB,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;oBACpD,CAAC;oBAAC,MAAM,CAAC;wBACP,kBAAkB,GAAG,MAAM,CAAC,+BAA+B,CAAC,CAAC;oBAC/D,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,qEAAqE;QACrE,0CAA0C;QAC1C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,gBAAgB,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,kBAAkB,CAAC;QAClE,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9C,QAAQ,CAAC,GAAG,CAAC,mBAAmB,cAAc,EAAE,CAAC,CAAC;QAClD,QAAQ,CAAC,GAAG,CAAC,iBAAiB,YAAY,EAAE,CAAC,CAAC;QAC9C,IAAI,eAA6D,CAAC;QAClE,IAAI,eAAe;YAAE,eAAe,GAAG,kBAAkB,CAAC;aACrD,IAAI,uBAAuB;YAAE,eAAe,GAAG,2BAA2B,CAAC;aAC3E,IAAI,cAAc;YAAE,eAAe,GAAG,qBAAqB,CAAC;aAC5D,IAAI,SAAS;YAAE,eAAe,GAAG,WAAW,CAAC;aAC7C,IAAI,aAAa;YAAE,eAAe,GAAG,eAAe,CAAC;aACrD,IAAI,aAAa,KAAK,CAAC,IAAI,SAAS,KAAK,IAAI;YAAE,eAAe,GAAG,eAAe,CAAC;aACjF,IAAI,aAAa,IAAI,SAAS,KAAK,UAAU,CAAC,aAAa;YAC9D,eAAe,GAAG,gBAAgB,CAAC;aAChC,IAAI,eAAe,KAAK,IAAI;YAAE,eAAe,GAAG,gBAAgB,CAAC;aACjE,IAAI,cAAc,IAAI,eAAe,KAAK,UAAU,CAAC,cAAc;YACtE,eAAe,GAAG,iBAAiB,CAAC;aACjC,IACH,iBAAiB;YACjB,aAAa,KAAK,CAAC;YACnB,eAAe,GAAG,CAAC;YACnB,oBAAoB,GAAG,CAAC;YAExB,eAAe,GAAG,oBAAoB,CAAC;aACpC,IACH,WAAW,GAAG,CAAC;YACf,oBAAoB,GAAG,CAAC;YACxB,iBAAiB,GAAG,CAAC;YACrB,qBAAqB,GAAG,CAAC;YAEzB,eAAe,GAAG,eAAe,CAAC;aAC/B,IAAI,eAAe,KAAK,CAAC;YAAE,eAAe,GAAG,oBAAoB,CAAC;aAClE,IAAI,mBAAmB,KAAK,kBAAkB;YAAE,eAAe,GAAG,iBAAiB,CAAC;aACpF,IAAI,gBAAgB,IAAI,QAAQ,KAAK,QAAQ;YAAE,eAAe,GAAG,mBAAmB,CAAC;;YACrF,eAAe,GAAG,uBAAuB,CAAC;QAE/C,MAAM,MAAM,GAAG,eAAe,KAAK,uBAAuB,CAAC;QAC3D,OAAO,qBAAqB,CAAC,KAAK,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;YAC3B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,aAAa,EAAE,UAAU,CAAC,aAAa;YACvC,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,SAAS;YACT,eAAe;YACf,eAAe;YACf,YAAY,EACV,SAAS,IAAI,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;YACzF,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;YAC1C,gBAAgB,EAAE,SAAS;YAC3B,aAAa,EAAE,SAAS;YACxB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;YACrC,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,cAAc;YACd,YAAY;YACZ,mBAAmB;YACnB,kBAAkB;YAClB,MAAM,EAAE;gBACN,aAAa;gBACb,eAAe;gBACf,WAAW;gBACX,oBAAoB;gBACpB,iBAAiB;gBACjB,qBAAqB;gBACrB,oBAAoB;gBACpB,OAAO,EAAE,SAAS;aACnB;YACD,YAAY,EAAE,CAAC,GAAG,QAAQ,CAAC;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,gFAAgF;IAChF,OAAO,CAAC,SAAiB;QACvB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACvF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,OAAO;QAC1C,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO;QAC9B,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7B,IACE,IAAI,CAAC,cAAc,EAAE;YACrB,CAAC,IAAI,CAAC,WAAW,EAAE;YACnB,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI;YAC3B,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,EAC5B,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,CAAC;IAEO,aAAa,CAAC,SAAiB;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACvF,+BAA+B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACnC,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAChF,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvB,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,SAAS,YAAY,CAAC,SAAiB;IACrC,OAAO,gCAAgC,MAAM,CAAC,sBAAsB,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AAClG,CAAC;AAED,SAAS,uBAAuB,CAC9B,UAAmC,EACnC,eAAuB;IAEvB,OAAO,MAAM,CACX,IAAI,CAAC,SAAS,CAAC;QACb,aAAa,EAAE,CAAC;QAChB,eAAe,EAAE,CAAC;QAClB,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,SAAS,EAAE,2BAA2B;QACtC,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,UAAU;QAClB,qBAAqB,EAAE,KAAK;QAC5B,QAAQ,EAAE,CAAC;QACX,cAAc,EAAE,OAAO;QACvB,cAAc,EAAE,aAAa;QAC7B,eAAe;KAChB,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,SAAiB,EAAQ,EAAE;QACvC,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACjD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACnC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACjC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE;gBAC7B,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE;oBACb,CAAC,CAAC,MAAM;oBACR,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE;wBACrB,CAAC,CAAC,SAAS;wBACX,CAAC,CAAC,OAAO,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC7E,IAAI,IAAI,CAAC,WAAW,EAAE;gBAAE,IAAI,CAAC,IAAI,CAAC,CAAC;iBAC9B,IAAI,IAAI,CAAC,cAAc,EAAE;gBAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;iBAC3D,IAAI,IAAI,CAAC,MAAM,EAAE;gBAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,CAAC;IACX,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,IAAmC;IACjE,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC3D,IAAI,KAAK,KAAK,CAAC;gBAAE,MAAM;YACvB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC"}