@claudexor/orchestrator 3.1.2 → 3.3.7-rc.0

package/dist/credential-profiles.d.ts

@@ -1,4 +1,6 @@
-import type { CredentialProfile, HarnessEvent, HarnessRunSpec, QuotaSnapshot } from "@claudexor/schema";
+import type { AuthPreference, AuthSourceReadiness, CredentialProfile, CredentialProfileStatus, HarnessEvent, QuotaAbsence, QuotaSnapshot } from "@claudexor/schema";
+import { type ProfilePolicy } from "./credential-profile-rotation.js";
+export { nextEligibleProfile, planReactiveRotation, preflightCredentialProfile, preflightDefaultSubject, profileHeadroomBreach, rotateSpecOnTypedLimit, rotationRetryEligible, staticRotationCandidates, type ProfilePolicy, } from "./credential-profile-rotation.js";
 /**
  * The ONE resolve owner for credential profiles (INV-135): explicit id →
  * durable registry entry for exactly this harness. Unknown, disabled, or
@@ -10,58 +12,104 @@ export declare function selectedProfileAvailability(input: {
     registry: readonly CredentialProfile[];
     profileId?: string | null;
     harnessId: string;
-    probe?: (profile: CredentialProfile) => Promise<{
-        availability: string;
-        verification: string;
-        detail?: string | null;
-    }>;
+    probe?: (profile: CredentialProfile) => Promise<CredentialProfileStatus>;
+    /** The quota poller's authenticated vendor evidence, when the caller holds
+     * it. Omitting it admits on the LOCAL store alone — which is the reading of
+     * `verification: passed` that let a run dispatch into a revoked token. */
+    quota?: VendorQuotaObservations | null;
 }): Promise<string | null>;
-export interface ProfilePolicy {
-    limit_action: "fail" | "ask" | "rotate";
-    rotation_eligible: string[];
-    headroom_threshold: number;
-}
-/** Typed quota evidence for a profile over its headroom bound (provenance). */
-export interface HeadroomBreach {
-    constraint_id: string;
-    used_ratio: number;
-    threshold: number;
-    resets_at: string | null;
-}
+/** What the quota poller's last authenticated vendor contact says about ONE
+ * credential subject's liveness. Null = the poller has no verdict to offer. */
+export type VendorCredentialObservation = {
+    outcome: "honored";
+    observed_at: string;
+} | {
+    outcome: "revoked";
+    observed_at: string;
+    detail: string;
+};
+/**
+ * The poller's verdict for one profile, if it has one (INV-135 honesty).
+ *
+ * The quota poller ALREADY calls the vendor once a minute with each profile's
+ * own token; a fresh snapshot from such a call means the credential was
+ * honored, and a typed `auth_revoked` absence means it was rejected. Reading
+ * that existing evidence is why profile verification can be live without a
+ * probe run — a config-dir login has no cheaper liveness test than spending
+ * quota on a mini-run, so building one would cost exactly what it measures.
+ */
+export declare function vendorCredentialObservation(quota: {
+    snapshots: readonly QuotaSnapshot[];
+    absences: readonly QuotaAbsence[];
+}, harnessId: string, profileId: string): VendorCredentialObservation | null;
 /**
- * Proactive headroom check (W5.4 `profile_headroom_preflight`): the SELECTED
- * profile's freshest snapshot windows against the policy threshold. Unknown
- * usage is NOT a breach — rotation never triggers on missing data.
+ * Overlay the vendor's verdict onto a locally-probed profile status, so
+ * `verification` means what a router assumes it means.
+ *
+ * The overlay may DOWNGRADE freely — a rejected credential is a fact the local
+ * store cannot see, and it is exactly the case that made a `passed` profile
+ * fail a run one minute later. It may not UPGRADE: a local probe that already
+ * said "this dir is logged in under the wrong method" knows something the usage
+ * endpoint does not, so a successful vendor call only re-stamps provenance on
+ * an already-passing verdict. Absent a verdict the status is returned
+ * untouched, still declaring `local_store`.
  */
-export declare function profileHeadroomBreach(snapshots: readonly QuotaSnapshot[], harnessId: string, profileId: string | null, threshold: number): HeadroomBreach | null;
+export declare function withVendorCredentialObservation(status: CredentialProfileStatus, observation: VendorCredentialObservation | null): CredentialProfileStatus;
+/** The quota poller's evidence for every subject: what an authenticated vendor
+ *  call last returned, and which subjects it could not answer for. */
+export interface VendorQuotaObservations {
+    snapshots: readonly QuotaSnapshot[];
+    absences: readonly QuotaAbsence[];
+}
 /**
- * The next rotation target after `currentProfileId` (W5.4): policy order wins
- * (`rotation_eligible`), else every enabled profile of the harness in registry
- * order. The current profile and disabled/unknown ids never come back; a
- * profile already over the headroom bound is skipped (rotating INTO a spent
- * subscription is not a failover). Cross-subscription rotation of one vendor
- * is allowed by owner decision — but rotation NEVER crosses credential kinds
- * (release wave round-16 BLOCK): a subscription→API-key swap silently changes
- * the payment model mid-attempt, and the attempt's first-wins auth-route
- * receipt (decided once before spawn) would misvalue metered usage as
- * subscription entitlement, bypassing a finite cash cap.
+ * The vendor-verified reading of ONE probed profile status — the single
+ * composition behind every consumer of `profileStatusAdmits`: run admission,
+ * rotation readiness, and the accounts projection. Keeping the overlay in one
+ * place is the point: applying it on the listing branch alone is what let the
+ * Accounts card say `revoked` while the router dispatched into the same token.
+ *
+ * `probeCredentialProfileStatus` guarantees the status carries its own
+ * profile's identity, so the subject is read from the status itself. Without
+ * quota evidence the local verdict stands untouched.
  */
-export declare function nextEligibleProfile(registry: readonly CredentialProfile[], harnessId: string, policy: ProfilePolicy, current: Pick<CredentialProfile, "profile_id" | "credential_kind"> | null, snapshots: readonly QuotaSnapshot[], excluded?: ReadonlySet<string>): CredentialProfile | null;
+export declare function vendorVerifiedProfileStatus(status: CredentialProfileStatus, quota: VendorQuotaObservations | null | undefined): CredentialProfileStatus;
+/** One readiness predicate shared by run admission and accounts projection. */
+export declare function profileStatusAdmits(profile: Pick<CredentialProfile, "credential_kind">, result: {
+    availability: string;
+    verification: string;
+}): boolean;
+/** One fail-closed profile doctor wrapper shared by Accounts and runtime
+ * selection. Probe failures are readiness facts, never selector exceptions. */
+export declare function probeCredentialProfileStatus(profile: CredentialProfile, probe?: (profile: CredentialProfile) => Promise<CredentialProfileStatus>): Promise<CredentialProfileStatus>;
+/** Same precedence used by run admission: the first explicit route wins;
+ * `auto` means fall through rather than shadow a more general setting. */
+export declare function effectiveAuthPreference(...values: Array<AuthPreference | null | undefined>): AuthPreference;
+/** Fresh effective route for the unprofiled/default subject in Accounts. The
+ * gateway status proves aggregate intent readiness; the schema auth estimator
+ * then chooses the exact usable source under the same configured preference as
+ * run admission. Returning the route (not merely a bool) keeps next_up labels
+ * truthful when a native-capable harness falls back to an API key. */
+export declare function defaultCredentialRoute(status: {
+    status: "ok" | "degraded" | "unavailable";
+    routableIntents: readonly unknown[];
+    authSources: readonly AuthSourceReadiness[];
+}, requested: AuthPreference): "local_session" | "api_key" | null;
 /** The informational identity an UNPINNED run of a harness would route to next
  * (INV-135 `next_up`) — the same routing owner that admits and rotates runs,
  * exposed for the accounts projection so no surface re-derives it. Never gates
  * routing: explicit control is a per-run `--profile` / per-thread pin.
  *
  * Semantics mirror run-time admission: an unpinned run's default subject is the
- * native/CLI login when it participates in the ladder; enabled profiles route
+ * unprofiled/default credential when it participates in the ladder; enabled profiles route
  * only by explicit pin or, under `rotate`, as the quota-failover target when the
- * native default is already over headroom. A disabled CLI login leaves an
+ * default subject is already over headroom. A disabled default leaves an
  * unpinned run with nothing routable. */
 export type NextUpIdentity = {
     kind: "profile";
     profileId: string;
 } | {
     kind: "native";
+    route: "local_session" | "api_key";
 } | {
     kind: "none";
     reason: string;
@@ -71,76 +119,14 @@ export declare function nextUpIdentity(args: {
     harnessId: string;
     policy: ProfilePolicy;
     snapshots: readonly QuotaSnapshot[];
-    nativeEnabled: boolean;
+    defaultEnabled: boolean;
+    /** Fresh doctor/admission truth for the unprofiled default subject. */
+    defaultReady: boolean;
+    /** Effective source route of that default subject under configured auth preference. */
+    defaultRoute: "local_session" | "api_key" | null;
+    /** Profiles admitted by their fresh profile doctor probe in this snapshot. */
+    readyProfileIds: ReadonlySet<string>;
 }): NextUpIdentity;
-/**
- * `rotation_retry_eligible` (sol #30): a failover retry is allowed ONLY when
- * the attempt saw a TYPED vendor limit AND produced no deliverable and no
- * workspace mutation — a partially-acted attempt never silently reruns.
- */
-export declare function rotationRetryEligible(input: {
-    sawTypedLimit: boolean;
-    deliverableEmpty: boolean;
-}): boolean;
-type EmitFn = (type: "route.profile.headroom_exceeded" | "route.profile.rotated" | "route.profile.rotation_exhausted", payload: Record<string, unknown>) => void;
-/**
- * `profile_headroom_preflight` (W5.4): BEFORE spawn, the selected profile's
- * freshest quota windows are checked against the policy threshold. A breach
- * is always a typed event; `rotate` swaps to the next eligible profile with
- * provenance, `ask`/`fail` proceed on the selected profile — the runtime
- * `vendor_limit_rejected` evidence stays the terminating truth.
- */
-export declare function preflightCredentialProfile(args: {
-    profile: CredentialProfile;
-    harnessId: string;
-    policy: ProfilePolicy;
-    registry: readonly CredentialProfile[];
-    snapshots: readonly QuotaSnapshot[];
-    emit: EmitFn;
-}): CredentialProfile;
-/**
- * Default-subject start selection (INV-135, owner scope "auto-balance"): when
- * NO profile is pinned, the policy is `rotate`, and the DEFAULT store's own
- * fresh quota window is at/over the headroom bound, pick the first eligible
- * SUBSCRIPTION profile instead of spawning into a near-certain vendor limit.
- * Strictly opt-in: `fail`/`ask` keep today's default-user behavior untouched
- * (the profile engine's fail action governs PINNED profiles only — throwing
- * here would brick every default user at 90% quota). Unknown or stale usage
- * never rotates.
- */
-export declare function preflightDefaultSubject(args: {
-    harnessId: string;
-    policy: ProfilePolicy;
-    registry: readonly CredentialProfile[];
-    snapshots: readonly QuotaSnapshot[];
-    emit: EmitFn;
-}): CredentialProfile | null;
-/**
- * Reactive failover plan (`vendor_limit_rejected`, W5.4): rotation fires ONLY
- * on the typed predicate under a `rotate` policy, marks the current profile
- * tried (at most once per attempt each), and returns the next target with
- * provenance already emitted — or null when the attempt must fail as-is.
- * `currentProfile: null` is the DEFAULT subject: allowed ONLY when the caller
- * proves the attempt's pre-spawn route was vendor_native (a metered default
- * hitting a limit is a budget fact, not a subscription to fail over from).
- */
-export declare function planReactiveRotation(args: {
-    currentProfile: CredentialProfile | null;
-    defaultRouteWasVendorNative?: boolean;
-    harnessId: string;
-    attemptId: string;
-    policy: ProfilePolicy;
-    registry: readonly CredentialProfile[];
-    snapshots: readonly QuotaSnapshot[];
-    triedProfiles: Set<string>;
-    sawTypedLimit: boolean;
-    deliverableEmpty: boolean;
-    lastLimit: {
-        retryDelayMs: number | null;
-        resetsAt: string | null;
-    } | null;
-    emit: EmitFn;
-}): CredentialProfile | null;
 /**
  * INV-135 at the engine boundary: a cached vendor session resumes ONLY under
  * exactly the profile it was recorded with (null-default equality included) —
@@ -159,30 +145,4 @@ export declare function resumeSessionForProfile(cached: {
 export declare function observeNativeSessionEvent(input: {
     onSessionObserved?: (harnessId: string, nativeSessionId: string, observedModel?: string | null, profileId?: string | null) => void;
 } | undefined, harnessId: string, ev: HarnessEvent): void;
-/**
- * Shared reactive-failover step for BOTH lanes: given the attempt's typed
- * evidence, plan a rotation and rebuild the spec on a NEW vendor session
- * under the next profile — or return null when the attempt must fail as-is.
- */
-export declare function rotateSpecOnTypedLimit(args: {
-    spec: HarnessRunSpec;
-    harnessId: string;
-    attemptId: string;
-    policy: ProfilePolicy;
-    registry: readonly CredentialProfile[];
-    snapshots: readonly QuotaSnapshot[];
-    triedProfiles: Set<string>;
-    sawTypedLimit: boolean;
-    deliverableEmpty: boolean;
-    lastLimit: {
-        retryDelayMs: number | null;
-        resetsAt: string | null;
-    } | null;
-    emit: EmitFn;
-    newSessionId: () => string;
-    /** Pre-spawn route estimate for a profile-less spec: default-subject
-     * rotation is allowed ONLY off a vendor_native attempt. */
-    defaultRouteWasVendorNative?: boolean;
-}): HarnessRunSpec | null;
-export {};
 //# sourceMappingURL=credential-profiles.d.ts.map

package/dist/credential-profiles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-profiles.d.ts","sourceRoot":"","sources":["../src/credential-profiles.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,aAAa,EACd,MAAM,mBAAmB,CAAC;AAG3B;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,EACtC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,iBAAiB,CASnB;AAED,wBAAsB,2BAA2B,CAAC,KAAK,EAAE;IACvD,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC;QAC9C,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,MAAM,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACxB,CAAC,CAAC;CACJ,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAgBzB;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;IACxC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,SAAS,aAAa,EAAE,EACnC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,SAAS,EAAE,MAAM,GAChB,cAAc,GAAG,IAAI,CAmBvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,EACtC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,YAAY,GAAG,iBAAiB,CAAC,GAAG,IAAI,EACzE,SAAS,EAAE,SAAS,aAAa,EAAE,EACnC,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,GACxC,iBAAiB,GAAG,IAAI,CA2B1B;AAED;;;;;;;;;yCASyC;AACzC,MAAM,MAAM,cAAc,GACxB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjG,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,aAAa,CAAC;IACtB,SAAS,EAAE,SAAS,aAAa,EAAE,CAAC;IACpC,aAAa,EAAE,OAAO,CAAC;CACxB,GAAG,cAAc,CAmBjB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAEV;AAED,KAAK,MAAM,GAAG,CACZ,IAAI,EACA,iCAAiC,GACjC,uBAAuB,GACvB,kCAAkC,EACtC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC7B,IAAI,CAAC;AAuDV;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE;IAC/C,OAAO,EAAE,iBAAiB,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,aAAa,CAAC;IACtB,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,SAAS,EAAE,SAAS,aAAa,EAAE,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,iBAAiB,CAoDpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,aAAa,CAAC;IACtB,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,SAAS,EAAE,SAAS,aAAa,EAAE,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,iBAAiB,GAAG,IAAI,CAqC3B;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,cAAc,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACzC,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,aAAa,CAAC;IACtB,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,SAAS,EAAE,SAAS,aAAa,EAAE,CAAC;IACpC,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,SAAS,EAAE;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,iBAAiB,GAAG,IAAI,CAqC3B;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,SAAS,EACnE,OAAO,EAAE,iBAAiB,GAAG,IAAI,GAChC,MAAM,GAAG,IAAI,CAGf;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EACD;IACE,iBAAiB,CAAC,EAAE,CAClB,SAAS,EAAE,MAAM,EACjB,eAAe,EAAE,MAAM,EACvB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,EAC7B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,KACtB,IAAI,CAAC;CACX,GACD,SAAS,EACb,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,YAAY,GACf,IAAI,CAeN;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,IAAI,EAAE,cAAc,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,aAAa,CAAC;IACtB,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,SAAS,EAAE,SAAS,aAAa,EAAE,CAAC;IACpC,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,SAAS,EAAE;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,MAAM,CAAC;IAC3B;+DAC2D;IAC3D,2BAA2B,CAAC,EAAE,OAAO,CAAC;CACvC,GAAG,cAAc,GAAG,IAAI,CAsBxB"}
+{"version":3,"file":"credential-profiles.d.ts","sourceRoot":"","sources":["../src/credential-profiles.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,YAAY,EACZ,YAAY,EACZ,aAAa,EACd,MAAM,mBAAmB,CAAC;AAI3B,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,KAAK,aAAa,GACnB,MAAM,kCAAkC,CAAC;AAE1C;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,EACtC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,iBAAiB,CASnB;AAED,wBAAsB,2BAA2B,CAAC,KAAK,EAAE;IACvD,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACzE;;8EAE0E;IAC1E,KAAK,CAAC,EAAE,uBAAuB,GAAG,IAAI,CAAC;CACxC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAgBzB;AAgBD;+EAC+E;AAC/E,MAAM,MAAM,2BAA2B,GACnC;IAAE,OAAO,EAAE,SAAS,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,OAAO,EAAE,SAAS,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhE;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE;IAAE,SAAS,EAAE,SAAS,aAAa,EAAE,CAAC;IAAC,QAAQ,EAAE,SAAS,YAAY,EAAE,CAAA;CAAE,EACjF,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,2BAA2B,GAAG,IAAI,CAkBpC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,uBAAuB,EAC/B,WAAW,EAAE,2BAA2B,GAAG,IAAI,GAC9C,uBAAuB,CAiBzB;AAED;sEACsE;AACtE,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,SAAS,aAAa,EAAE,CAAC;IACpC,QAAQ,EAAE,SAAS,YAAY,EAAE,CAAC;CACnC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,uBAAuB,EAC/B,KAAK,EAAE,uBAAuB,GAAG,IAAI,GAAG,SAAS,GAChD,uBAAuB,CAMzB;AAED,+EAA+E;AAC/E,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,EACnD,MAAM,EAAE;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACrD,OAAO,CAKT;AAED;+EAC+E;AAC/E,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,iBAAiB,EAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,uBAAuB,CAAC,GACvE,OAAO,CAAC,uBAAuB,CAAC,CAkClC;AAED;0EAC0E;AAC1E,wBAAgB,uBAAuB,CACrC,GAAG,MAAM,EAAE,KAAK,CAAC,cAAc,GAAG,IAAI,GAAG,SAAS,CAAC,GAClD,cAAc,CAIhB;AAED;;;;sEAIsE;AACtE,wBAAgB,sBAAsB,CACpC,MAAM,EAAE;IACN,MAAM,EAAE,IAAI,GAAG,UAAU,GAAG,aAAa,CAAC;IAC1C,eAAe,EAAE,SAAS,OAAO,EAAE,CAAC;IACpC,WAAW,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAC7C,EACD,SAAS,EAAE,cAAc,GACxB,eAAe,GAAG,SAAS,GAAG,IAAI,CAGpC;AAED;;;;;;;;;yCASyC;AACzC,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,eAAe,GAAG,SAAS,CAAA;CAAE,GACtD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAErC,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,aAAa,CAAC;IACtB,SAAS,EAAE,SAAS,aAAa,EAAE,CAAC;IACpC,cAAc,EAAE,OAAO,CAAC;IACxB,uEAAuE;IACvE,YAAY,EAAE,OAAO,CAAC;IACtB,uFAAuF;IACvF,YAAY,EAAE,eAAe,GAAG,SAAS,GAAG,IAAI,CAAC;IACjD,8EAA8E;IAC9E,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACtC,GAAG,cAAc,CA+CjB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,SAAS,EACnE,OAAO,EAAE,iBAAiB,GAAG,IAAI,GAChC,MAAM,GAAG,IAAI,CAGf;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EACD;IACE,iBAAiB,CAAC,EAAE,CAClB,SAAS,EAAE,MAAM,EACjB,eAAe,EAAE,MAAM,EACvB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,EAC7B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,KACtB,IAAI,CAAC;CACX,GACD,SAAS,EACb,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,YAAY,GACf,IAAI,CAeN"}