@cotal-ai/auth 0.11.6 → 0.13.0

package/dist/credential-ledger.d.ts

@@ -0,0 +1,343 @@
+/**
+ * The D13 NORMATIVE CREDENTIAL LEDGER + the full TAKEOVER ISSUANCE BARRIER, slices (3)+(2b)
+ * (SPEC §13.1, as amended). The sibling of `lifecycle-registry.ts`: the SAME minting authority
+ * over the SAME two stores, reached only through the sealed registry ({@link registryStores}),
+ * so a caller that cannot open the registry can neither write a ledger row nor run a barrier.
+ *
+ * What is here (all §13.1-normative):
+ *  - the AGENT-family ledger rows `cred.<lifecycleUid>.<credentialId>` — the closed row schema
+ *    `{ credentialId, holderPrincipal, lifecycleUid, sourceChain, state: active|revoked, exp }`
+ *    (monotonic state; revoked rows are never deleted), the per-ancestor lineage index
+ *    `bysrc.<issuerKeyId>.<id>.<lifecycleUid>.<credentialId>`, and the shared row codec the
+ *    ENDPOINT family `epcred.<endpoint>.<instanceId>.<credentialId>` reuses (same schema, same
+ *    discipline; the session adapter writes that family);
+ *  - the MINT PROTOCOL (observe gate → write rows → revision-pinned gate touch-CAS → release):
+ *    {@link stageAgentMint} + {@link finalizeAgentMint}. The touch is the §13.1 fence — a gate
+ *    (or any presented source gate) that moved since observation makes the pinned write LOSE,
+ *    the mint marks its OWN rows revoked and never releases. An unledgered mint cannot occur
+ *    through this module: release is gated on finalize, and finalize is gated on the staged
+ *    rows existing;
+ *  - SOURCE GATES `srcgate.<issuerKeyId>.<id>` (`{ state: open | frozen }`, CAS): every handle
+ *    in a presented chain is observed at stage and touch-CASed at finalize, and
+ *    {@link revokeHandleSource} is the handle-revocation walk — freeze the source gate FIRST,
+ *    enumerate `bysrc.`, revoke every descendant row, then VERIFIED cluster-wide eviction of
+ *    every revoked row's holder principal (fail-closed; the gate stays frozen forever);
+ *  - the TAKEOVER BARRIER {@link runAgentTakeoverBarrier} in the normative order: durable op
+ *    intent (`stage.<opId>`, create-only) → gate CAS `open → frozen` carrying the intent →
+ *    point-in-time enumeration of `cred.<lifecycleUid>.>` (the SEALED auth-ledger scanner's
+ *    fence-free LastPerSubject read — `ledger-scanner.ts`; the barrier profile holds NO auth-stream
+ *    `CONSUMER.CREATE`, whose body cannot be subject-confined, so the CREATE lives only in the
+ *    scanner's own sealed credential) → revoke EVERY row → VERIFIED
+ *    eviction of every holder principal (the injected `evictPrincipal` seam; `verifiedGone`
+ *    is the ONLY success — anything else throws and the gate STAYS frozen) → the epoch head
+ *    CAS LAST ({@link advanceEpochWithinTakeover}) → reopen the gate at generation G+1. Every
+ *    boundary is crash-resumable from the durable intent ({@link resumeAgentTakeover}), and
+ *    only the SAME operation resumes it.
+ *
+ * Deny-new vs kill-live, stated precisely (the two halves of revocation, §13.1):
+ *  - the ledger row CAS is the deny-new SUBSTRATE (rows live in a replicated, leader-served
+ *    JetStream KV, `allow_direct=false`, §13.12). The REDEEM arm is wired here: the session
+ *    release reads the normative row and refuses a `revoked` one, so a burned session
+ *    credential never re-releases. The CONNECT arm (the auth callout reading `cred.<uid>.<id>`
+ *    to refuse an OFFLINE credential's reconnect) is NOT wired in this slice: it needs the
+ *    ROOT credential ledgered (the head's `currentCredentialId`, which the activation saga
+ *    leaves absent until production issuance) and the presented credential to carry its id, so
+ *    it lands with production activation wiring. Until then, this barrier's deny-new covers the
+ *    REDEEM path and the LIVE connections it evicts; an offline root credential whose lifecycle
+ *    UID is preserved across takeover is NOT denied reconnect by the barrier alone (§13.1
+ *    requires takeover to FAIL LOUD where it cannot revoke + verified-evict, e.g. static
+ *    credentials — enforced at that connect-arm wiring, not here);
+ *  - the injected verified eviction is the cluster-wide kill-live with re-scan (core
+ *    `evictDeniedPrincipal`: CONNZ scan → per-server KICK → re-scan; partial scans fail
+ *    closed), which handles the LIVE half regardless of the connect-arm.
+ *
+ * SURFACE: NOTHING here is exported from the package index. The executor seam is the sealed
+ * registry itself (constructed only over the minting authority's authenticated connection);
+ * an `opId` is an identifier, never a bearer capability. Implementation staging lives in the
+ * `stage.` family only — never under a ledger prefix a barrier enumerates.
+ */
+import type { KV } from "@nats-io/kv";
+import { type EvictionResult } from "@cotal-ai/core";
+import { type LifecycleRegistry } from "./lifecycle-registry.js";
+export declare const SOURCE_ROOT = "root";
+/** Validate ONE sourceChain member — `root`, `handle.<issuerKeyId>.<id>`, or
+ *  `session.<sessionId>` (SPEC 13.1) — and return its parsed shape. */
+export declare function parseSourceMember(member: unknown): {
+    kind: "root";
+} | {
+    kind: "handle";
+    issuerKeyId: string;
+    id: string;
+} | {
+    kind: "session";
+    sessionId: string;
+};
+/** The agent-family ledger key `cred.<lifecycleUid>.<credentialId>`. */
+export declare function credRowKey(lifecycleUid: string, credentialId: string): string;
+/** The endpoint-family ledger key `epcred.<endpoint>.<instanceId>.<credentialId>` (disjoint by
+ *  explicit prefix, never arity, SPEC 13.1). */
+export declare function epcredRowKey(endpoint: string, instanceId: string, credentialId: string): string;
+/** The per-ancestor lineage index key `bysrc.<issuerKeyId>.<id>.<lifecycleUid>.<credentialId>`. */
+export declare function bysrcKey(issuerKeyId: string, id: string, lifecycleUid: string, credentialId: string): string;
+/** The per-handle source gate key `srcgate.<issuerKeyId>.<id>`. */
+export declare function srcgateKey(issuerKeyId: string, id: string): string;
+/** A takeover/registration operation's durable intent key `stage.<opId>` (the `stage.<opId>.`
+ *  staging family root — NEVER under a ledger prefix a barrier enumerates, SPEC 13.1). */
+export declare function stageIntentKey(opId: string): string;
+/** The §13.1 credential-ledger row, closed. `lifecycleUid` is the HOLDER's KEY identity
+ *  component: the managed agent's lifecycle UID in the `cred.` family, the endpoint instance's
+ *  `instanceId` in the `epcred.` family (SPEC 13.1: `instanceId` is to an endpoint what
+ *  `lifecycleUid` is to a managed agent). `endpoint` is present ONLY in the `epcred.` family
+ *  (it forms the key there and is absent in `cred.`), so the KEY identity is never conflated
+ *  with the eviction target. `holderPrincipal` is who the barrier KICKs: ALWAYS a CONNZ-
+ *  attributable `<owner>.<actor>` dot-form (the caller principal in the `cred.` family; the
+ *  serving instance's own connection principal in the `epcred.` family, recorded from the
+ *  endpoint gate), NEVER the endpoint name (which CONNZ cannot attribute). */
+export interface CredentialLedgerRow {
+    credentialId: string;
+    holderPrincipal: string;
+    lifecycleUid: string;
+    /** The endpoint NAME whose token forms the `epcred.` key; present iff this is an endpoint-
+     *  family row, absent in the `cred.` family (which the lifecycleUid keys). */
+    endpoint?: string;
+    /** The FULL verified lineage at mint: `root` | `handle.<issuerKeyId>.<id>`… |
+     *  `session.<sessionId>` (SPEC 13.1 — for a handle redemption EVERY handle in the presented
+     *  chain, never only the leaf). */
+    sourceChain: string[];
+    /** Monotonic: `active → revoked` only; a revoked row is never deleted. */
+    state: "active" | "revoked";
+    exp: number;
+}
+/** Parse + validate a ledger row at its consuming boundary — closed schema, and the embedded
+ *  identity MUST rebuild the row's own key, so a key-mismatched or family-swapped poison row
+ *  never authorizes (SPEC 13.1/13.3). */
+export declare function parseLedgerRow(raw: Uint8Array, key: string): CredentialLedgerRow;
+/** Create-only write of a ledger/index row with the BYTE-IDENTICAL retry (a crashed writer's
+ *  retry of its OWN deterministic row proceeds; foreign content under a staged name refuses —
+ *  a name never silently re-binds, SPEC 13.6 discipline). PACKAGE-INTERNAL: the session
+ *  adapter writes its `epcred.` rows through this. */
+export declare function createRowByteIdempotent(kv: KV, key: string, value: unknown): Promise<void>;
+/** Idempotent monotonic revocation mark on a ledger row (revision-pinned CAS; a lost pin
+ *  re-reads — terminal-now returns, still-active retries). An ABSENT key refuses: the ledger
+ *  is never-deleted, so "revoke a row that does not exist" is a caller bug or corruption,
+ *  never a silent success. PACKAGE-INTERNAL (the session adapter routes through this too). */
+export declare function markLedgerRowRevoked(kv: KV, key: string): Promise<"revoked" | "already-revoked">;
+/** A per-handle source gate: `open` mints, `frozen` is the revocation fence (terminal for a
+ *  revoked handle — a source gate never reopens; SPEC 13.1). */
+export interface SourceGateRow {
+    issuerKeyId: string;
+    id: string;
+    state: "open" | "frozen";
+}
+/** Observe a source gate (the candidate read feeding a pinned CAS/touch). A DEL/PURGE marker
+ *  refuses loudly — a gate is never deleted. */
+export declare function observeSourceGate(reg: LifecycleRegistry, args: {
+    issuerKeyId: string;
+    id: string;
+}): Promise<{
+    row: SourceGateRow;
+    revision: number;
+} | undefined>;
+/** Create a handle's source gate OPEN (at the handle's own provisioning). Create-only:
+ *  idempotent for the identical row; anything else (including a deletion marker) conflicts. */
+export declare function createSourceGateOpen(reg: LifecycleRegistry, args: {
+    issuerKeyId: string;
+    id: string;
+}): Promise<void>;
+/** CAS a source gate `open → frozen` at the observed revision — the handle-revocation fence
+ *  (SPEC 13.1: freeze BEFORE enumerating `bysrc.`; an in-flight redemption either finished
+ *  before the freeze, so its rows are in the enumeration, or loses its pinned touch). */
+export declare function freezeSourceGate(reg: LifecycleRegistry, args: {
+    issuerKeyId: string;
+    id: string;
+    revision: number;
+}): Promise<void>;
+/** What {@link stageAgentMint} durably staged, handed to {@link finalizeAgentMint}. BRANDED
+ *  (WeakMap membership): only {@link stageAgentMint} produces one, so a hand-assembled or
+ *  mutated object (e.g. an empty `pins` array that would finalize with no gate proof) can never
+ *  reach the touch-CAS. The finalize NEVER trusts fields read back from this object: the
+ *  authoritative pins/rowKey snapshot lives in the module-private WeakMap value (a
+ *  shallow-frozen public array left mutable pin OBJECTS a caller could rewrite to duplicate
+ *  the source-gate pin and skip the lifecycle gate). The public object is deep-frozen too,
+ *  but the snapshot is the authority. */
+export interface StagedAgentMint {
+    readonly lifecycleUid: string;
+    readonly credentialId: string;
+    /** The observed lifecycle-gate + source-gate pins the finalize touch-CASes, keyed by KV key. */
+    readonly pins: ReadonlyArray<{
+        readonly key: string;
+        readonly revision: number;
+    }>;
+    /** The staged row's own key (what a losing finalize revokes). */
+    readonly rowKey: string;
+}
+/**
+ * Stage an AGENT-family mint (SPEC 13.1 mint protocol, steps observe + write-rows): observe
+ * the lifecycle issuance gate (must exist and be `open` — a frozen gate is a barrier in
+ * flight, a retired one is terminal) and EVERY presented handle's source gate (must exist and
+ * be `open`), recording each revision; then create the ledger row (`state: "active"` — the
+ * row is authority only after finalize releases, and the barrier enumerates it either way)
+ * and one `bysrc.` index row per handle chain member. Returns the staged coordinates for
+ * {@link finalizeAgentMint}. Nothing is released here.
+ */
+export declare function stageAgentMint(reg: LifecycleRegistry, args: {
+    lifecycleUid: string;
+    credentialId: string;
+    holderPrincipal: string;
+    sourceChain: string[];
+    exp: number;
+}): Promise<StagedAgentMint>;
+/**
+ * Finalize an AGENT-family mint (SPEC 13.1 mint protocol, step gate-CAS): touch-CAS every
+ * observed gate — the lifecycle gate and each presented source gate — at its pinned revision,
+ * each DISTINCT key once, in CANONICAL (sorted) order (the same crossed-pair discipline as the
+ * session stage). The touch preserves the value and bumps only the revision: a barrier or a
+ * handle revocation that moved ANY of them since observation makes the pinned write LOSE, the
+ * mint marks its OWN row revoked, and throws `permission-denied` — it never releases. Only a
+ * finalize that returns cleanly permits the caller to release the credential bytes.
+ */
+export declare function finalizeAgentMint(reg: LifecycleRegistry, staged: StagedAgentMint): Promise<void>;
+/** One enumerated ledger row (its key, parsed value, and store revision). */
+export interface EnumeratedRow {
+    key: string;
+    row: CredentialLedgerRow;
+    revision: number;
+}
+/**
+ * Enumerate a lifecycle's FULL descendant family `cred.<lifecycleUid>.>` (SPEC 13.1/13.9) through
+ * the SEALED auth-ledger scanner ({@link registryScanner}). The scan is a fence-free LastPerSubject
+ * read: under the normative history=1 store a same-subject `active→revoked` overwrite EVICTS the
+ * pre-scan revision, so the scanner delivers each subject's CURRENT last (a concurrent revoke is
+ * SEEN, never dropped). The scanner holds the ONLY auth-stream `CONSUMER.CREATE` on its own sealed
+ * credential; the barrier profile holds none (a consumer-create body is not subject-ACL confinable,
+ * nats-server#8274 — ledger-scanner.ts).
+ */
+export declare function enumerateAgentFamily(reg: LifecycleRegistry, lifecycleUid: string): Promise<EnumeratedRow[]>;
+/** A durable operation intent under `stage.<opId>` (SINGLE segment: the session release pins
+ *  live at `stage.session.<sid>.<c|s>` and are not operations). */
+export interface OperationIntentRef {
+    opId: string;
+    kind: "takeover" | "retirement";
+    lifecycleUid: string;
+}
+/**
+ * Enumerate every durable OPERATION intent `stage.<opId>` (SPEC 13.1) — the boot-resume
+ * discovery: a barrier executor that crashed mid-operation finds what it may owe here (whether
+ * an intent is actually OWED is the gate's call: only a gate still frozen by that opId is —
+ * completed and lost operations leave their intent behind by design). Multi-segment `stage.`
+ * keys (the session release pins) are not operations and are skipped; a single-segment intent
+ * that carries a DEL/PURGE marker, fails to parse, or names an unknown kind THROWS — an intent
+ * is never deleted while resumable, and garbled trusted-path state never drives a barrier.
+ */
+export declare function enumerateOperationIntents(reg: LifecycleRegistry): Promise<OperationIntentRef[]>;
+/** The injected VERIFIED-EVICTION seam (§13.9: the barrier executor holds the deployment's
+ *  `evictPrincipal` capability for exactly this step). `verifiedGone` is the ONLY success. */
+export type EvictPrincipal = (principal: string) => Promise<EvictionResult>;
+/** The injected SESSION-PAIR reconciler (SPEC 13.1: a lifecycle barrier tears down BOTH halves
+ *  of a session, not just the caller credential under `cred.<uid>.>`). For each distinct
+ *  `session.<sessionId>` naming a revoked descendant, the barrier calls this to terminalize the
+ *  `session.<sessionId>` row and revoke the paired serving `epcred.` row, and it RETURNS the
+ *  serving row's CONNZ-attributable holder principal(s) so the barrier can UNION them into its
+ *  verified-eviction set (SPEC 13.6: a takeover on either side revokes BOTH credentials WITH
+ *  eviction — a row-only revocation would leave an already-connected serving session live).
+ *  Injected (not imported) so the credential ledger never depends on the session adapter.
+ *  Idempotent: an already-reconciled session still returns its principals (a resumed barrier
+ *  must still evict). */
+export type ReconcileSessionPair = (sessionId: string) => Promise<{
+    servingPrincipals: readonly string[];
+}>;
+/** The barrier's injected capabilities. `reconcileSessionPair` is optional: a deployment with
+ *  no sessions omits it, but a lifecycle that HAS session-derived credentials and omits it
+ *  fails loud (a torn-down half would be left live). */
+export interface TakeoverDeps {
+    evictPrincipal: EvictPrincipal;
+    reconcileSessionPair?: ReconcileSessionPair;
+}
+/** The durable takeover intent at `stage.<opId>` — captured BEFORE the freeze, so a crashed
+ *  barrier resumes the SAME operation from the SAME coordinates ({@link resumeAgentTakeover}). */
+export interface TakeoverIntent {
+    kind: "takeover";
+    lifecycleUid: string;
+    owner: string;
+    actor: string;
+    /** The head epoch the barrier supersedes (the epoch CAS advances fromEpoch → fromEpoch+1). */
+    fromEpoch: number;
+    /** The gate generation the barrier freezes at (the reopen advances it to fromGeneration+1). */
+    fromGeneration: number;
+}
+/** The barrier's outcome (durable facts, re-readable on resume). */
+export interface TakeoverResult {
+    opId: string;
+    lifecycleUid: string;
+    /** The successor's fenced epoch (fromEpoch + 1). */
+    toEpoch: number;
+    /** The gate's first mintable generation for the successor (fromGeneration + 1). */
+    toGeneration: number;
+    /** Ledger rows this run transitioned `active → revoked` (0 on a resume that found them done). */
+    revokedRows: number;
+    /** Every DISTINCT principal the barrier verified evicted (family holders + the alias itself). */
+    evictedPrincipals: string[];
+}
+/**
+ * The shared CONTAINMENT core of the lifecycle barriers (SPEC 13.1: takeover and terminal
+ * retirement run the SAME revoke + verified-evict discipline over the SAME family):
+ * point-in-time enumeration of `cred.<lifecycleUid>.>` → revoke EVERY row (idempotent — a
+ * resumed barrier finds some already revoked; the row CAS is the deny-new SUBSTRATE, module
+ * header) → reconcile BOTH halves of every session-derived credential (the reconciler
+ * terminalizes `session.<sessionId>` and revokes the paired serving `epcred.` row, returning
+ * the serving holders; a lifecycle that HAS session-derived credentials but no reconciler
+ * fails loud — the serving half would be left live) → VERIFIED cluster-wide eviction of every
+ * enumerated holder principal (revoked earlier runs included: their connections may still be
+ * live), the alias principal itself, and every session-serving principal. Fail-closed per
+ * principal: anything but `verifiedGone` throws and the calling barrier's gate stays frozen.
+ * PACKAGE-INTERNAL: both barriers reach it through the sealed registry only.
+ */
+export declare function containLifecycleFamily(reg: LifecycleRegistry, args: {
+    owner: string;
+    actor: string;
+    lifecycleUid: string;
+    barrier: "takeover" | "retirement";
+}, deps: TakeoverDeps): Promise<{
+    revokedRows: number;
+    evictedPrincipals: string[];
+}>;
+/**
+ * Run the FULL takeover issuance barrier for a managed-agent lifecycle (SPEC 13.1, in the
+ * normative order — see the module header). Idempotent/crash-resumable: every step re-checks
+ * durable state, so calling it again with the SAME `opId` (directly or via
+ * {@link resumeAgentTakeover}) finishes the same operation; a DIFFERENT operation's freeze,
+ * a foreign epoch/generation movement, or a stranger's opId refuses before any CAS.
+ *
+ * FAIL-CLOSED CONTRACT: any failure after the freeze leaves the gate FROZEN (nothing mints)
+ * and the epoch un-advanced; eviction failure (`verifiedGone !== true` for ANY principal)
+ * throws `unavailable` — takeover MUST fail loud rather than proceed over a live predecessor.
+ */
+export declare function runAgentTakeoverBarrier(reg: LifecycleRegistry, args: {
+    owner: string;
+    actor: string;
+    lifecycleUid: string;
+    opId: string;
+}, deps: TakeoverDeps): Promise<TakeoverResult>;
+/** Resume a crashed takeover from its durable intent alone (`{ opId }` — SPEC 13.1: the intent
+ *  decides WHICH operation a frozen gate belongs to; `{ opId, kind }` alone resumes
+ *  deterministically). Re-runs {@link runAgentTakeoverBarrier} with the intent's own
+ *  coordinates; a stranger's opId (no intent) is `not-found`. */
+export declare function resumeAgentTakeover(reg: LifecycleRegistry, opId: string, deps: TakeoverDeps): Promise<TakeoverResult>;
+/**
+ * Revoke a sturdy handle at its SOURCE (SPEC 13.1): CAS the source gate `open → frozen` FIRST
+ * (the fence — an in-flight redemption under this handle either finished before the freeze,
+ * so its rows are in the enumeration, or loses its pinned finalize touch and never releases),
+ * then enumerate `bysrc.<issuerKeyId>.<id>.>`, revoke EVERY descendant ledger row it indexes
+ * (credentials minted under this handle OR under any descendant handle that carried it in the
+ * chain), and run VERIFIED cluster-wide eviction of every revoked row's holder principal —
+ * fail-closed, exactly the takeover discipline. The source gate stays frozen forever (a
+ * revoked handle never mints again); an already-frozen gate resumes the walk idempotently.
+ */
+export declare function revokeHandleSource(reg: LifecycleRegistry, args: {
+    issuerKeyId: string;
+    id: string;
+}, deps: TakeoverDeps): Promise<{
+    revokedRows: number;
+    evictedPrincipals: string[];
+}>;
+//# sourceMappingURL=credential-ledger.d.ts.map

package/dist/credential-ledger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-ledger.d.ts","sourceRoot":"","sources":["../src/credential-ledger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AACH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAOL,KAAK,cAAc,EACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EASL,KAAK,iBAAiB,EACvB,MAAM,yBAAyB,CAAC;AAoCjC,eAAO,MAAM,WAAW,SAAS,CAAC;AAElC;uEACuE;AACvE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,OAAO,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAYlK;AASD,wEAAwE;AACxE,wBAAgB,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAE7E;AACD;gDACgD;AAChD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAE/F;AACD,mGAAmG;AACnG,wBAAgB,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAE5G;AACD,mEAAmE;AACnE,wBAAgB,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAElE;AACD;0FAC0F;AAC1F,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD;AAID;;;;;;;;8EAQ8E;AAC9E,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB;kFAC8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;uCAEmC;IACnC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,0EAA0E;IAC1E,KAAK,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC5B,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;yCAEyC;AACzC,wBAAgB,cAAc,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,mBAAmB,CA8ChF;AAED;;;sDAGsD;AACtD,wBAAsB,uBAAuB,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAWhG;AAED;;;8FAG8F;AAC9F,wBAAsB,oBAAoB,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,iBAAiB,CAAC,CAkBtG;AAID;gEACgE;AAChE,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,GAAG,QAAQ,CAAC;CAC1B;AAgBD;gDACgD;AAChD,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACxC,OAAO,CAAC;IAAE,GAAG,EAAE,aAAa,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CAQ/D;AAED;+FAC+F;AAC/F,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAI3H;AAED;;yFAEyF;AACzF,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAWzI;AA4BD;;;;;;;yCAOyC;AACzC,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,gGAAgG;IAChG,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClF,iEAAiE;IACjE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAOD;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAChH,OAAO,CAAC,eAAe,CAAC,CAkD1B;AAED;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,iBAAiB,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAmCtG;AAID,6EAA6E;AAC7E,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,mBAAmB,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAkBD;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAEjH;AAED;mEACmE;AACnE,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,UAAU,GAAG,YAAY,CAAC;IAChC,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CA2BrG;AAID;8FAC8F;AAC9F,MAAM,MAAM,cAAc,GAAG,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;AAE5E;;;;;;;;;yBASyB;AACzB,MAAM,MAAM,oBAAoB,GAAG,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC;AAE5G;;wDAEwD;AACxD,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,cAAc,CAAC;IAC/B,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;CAC7C;AAED;kGACkG;AAClG,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,UAAU,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,SAAS,EAAE,MAAM,CAAC;IAClB,+FAA+F;IAC/F,cAAc,EAAE,MAAM,CAAC;CACxB;AAuBD,oEAAoE;AACpE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,YAAY,EAAE,MAAM,CAAC;IACrB,iGAAiG;IACjG,WAAW,EAAE,MAAM,CAAC;IACpB,iGAAiG;IACjG,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B;AAWD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,UAAU,GAAG,YAAY,CAAA;CAAE,EAChG,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAgC/D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAC1E,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,cAAc,CAAC,CAiIzB;AAED;;;iEAGiE;AACjE,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAO3H;AAID;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,EACzC,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA6C/D"}