@cotal-ai/auth 0.12.0 → 0.13.0

package/dist/lifecycle-registry.d.ts

@@ -0,0 +1,397 @@
+/**
+ * The D13 lifecycle registry, slice (1)+(2a) (SPEC §13.1, as amended): the sealed storage
+ * authority for lifecycle identity — the space-global UID reservation, the three-state alias
+ * head (`active | retiring | retired`), the activation saga over both stores, the leader-served
+ * mapping reader that backs the `readProcessEpoch` seam D11 (restart supervision, status
+ * commit) and D7 (session redemption) inject, and the issuance-gate CAS PRIMITIVES
+ * (create/observe/freeze/op-pinned reopen/retire) for the agent gate family `gate.<lifecycleUid>`.
+ *
+ * DELIBERATELY NOT HERE (the later gated slices, §13.1 barrier order):
+ *  - the (3) normative credential ledger and the (2b) takeover barrier live in the SIBLING
+ *    module `credential-ledger.ts` (the same authority over the same stores, reached through
+ *    {@link registryStores}); this module keeps only the barrier's module-internal epoch seam
+ *    ({@link advanceEpochWithinTakeover} — there is still NO public epoch advance);
+ *  - no head retirement: `active → retiring → retired` is a finalization step of the
+ *    RETIREMENT barrier (a later slice), and exposing it without the completed barrier would
+ *    recreate the half-fence D13 exists to remove;
+ *  - no reachable production activation wiring and no credential release (the head is written
+ *    WITHOUT `currentCredentialId` until production issuance mints under the reopened gate).
+ *
+ * SURFACE: the activation saga and the gate primitives are PACKAGE-INTERNAL (not exported from
+ * the package index) until the (3) ledger slice completes them into real operations; "no
+ * production callsite" is not the same as no reachable API, so the API is not reachable. The
+ * executor seam is the sealed registry itself: it is constructed only over the minting
+ * authority's own authenticated connection, so holding a gate's `opId` string grants nothing
+ * to a caller that cannot open the registry (the opId is an identifier, §13.1).
+ *
+ * The model (§13.1):
+ *  - the UID is entropy, never order: before anything else the minting authority WINS the
+ *    create-only, never-deleted, SPACE-GLOBAL reservation `uid.<lifecycleUid>`; a create
+ *    conflict burns the candidate (the alias head alone cannot reject the same UID under a
+ *    different alias), and a DEL/PURGE marker is corruption, never reusable absence;
+ *  - the head is a SINGLE unsplit key and `mappingRevision` IS its STORE revision (one leader
+ *    read returns `{ mapping, revision }`; the value carries no revision field);
+ *  - `active` is the ONLY current state: every currency seam (the epoch reader here) yields no
+ *    current mapping and no current epoch for `retiring` AND `retired` alike;
+ *  - activation is a CROSS-BUCKET SAGA with a durable op intent, in the normative order:
+ *    reserve UID → create the gate `frozen` carrying the activation op (unmintable from
+ *    birth) → CAS the alias head → reopen the gate LAST; a head-CAS loser terminalizes its own
+ *    orphan gate and its UID stays burned; a crash resumes the SAME op ({@link resumeActivation}),
+ *    never minting a second UID for one activation;
+ *  - the head and the reservation are NEVER-DELETED: a reader treats only TRUE ABSENCE as
+ *    virgin, and a deletion marker refuses LOUDLY as corruption;
+ *  - a `frozen` gate MUST carry its durable operation intent `{ opId, kind }`: a resumer
+ *    advances only the SAME `opId` (the opId is an identifier, never a bearer capability — the
+ *    op-pinned CAS plus the caller's own authenticated authority is what advances the gate),
+ *    and a stranger can neither reopen nor terminalize another operation's freeze.
+ */
+import { type JetStreamClient, type JetStreamManager } from "@nats-io/jetstream";
+import { type KV } from "@nats-io/kv";
+import type { NatsConnection } from "@nats-io/transport-node";
+import { type WorkPoolContext } from "@cotal-ai/core";
+import { type AuthLedgerScanner } from "./ledger-scanner.js";
+import { type RecordsScanner } from "./records-scanner.js";
+/** The minting authority's sealed registry over the space's PRIMARY records + auth stores. */
+export interface LifecycleRegistry {
+    readonly space: string;
+}
+/** The read-only sealed mapping reader (the confined reader profile holds ONLY the records
+ *  leader read; it cannot write a head or touch the auth store). */
+export interface LifecycleMappingReader {
+    readonly space: string;
+}
+/** The bucket-config fields the shape proofs inspect (wire names, per the JetStream API).
+ *  PACKAGE-INTERNAL (with {@link assertAuthorityStreamShape}) for the sibling trusted-path
+ *  modules; never re-exported from the package index. */
+export interface AuthorityStreamCfg {
+    allow_direct?: boolean;
+    retention?: string;
+    max_age?: number;
+    max_msgs?: number;
+    max_bytes?: number;
+    mirror?: unknown;
+    sources?: unknown;
+    subjects?: unknown;
+    storage?: string;
+}
+/** Prove an authority store's stream shape at bind (SPEC 13.12): PRIMARY (never a
+ *  mirror/sourced copy), LIMITS retention (an Interest/WorkQueue stream deletes a message once
+ *  consumers have interest/ack it — an authority row would silently vanish after a barrier's
+ *  point-in-time enumeration reads it), and NO silent-eviction limit — no age retention and no
+ *  finite global message/byte cap (under DiscardOld a finite global limit evicts a PRIOR
+ *  authority key's latest row the moment an unrelated key is written). A store that cannot be
+ *  proved never serves. (A per-subject cap is NOT a vector: NATS keeps at least the latest value
+ *  per subject for any cap ≥ 1, and 0/-1 mean unlimited, so no setting drops a key's own row.) */
+export declare function assertAuthorityStreamShape(cfg: AuthorityStreamCfg, bucket: string): void;
+/** Open the minting authority's sealed lifecycle registry: binds the space's primary records
+ *  bucket AND its auth bucket. BOTH are shape-proved at bind (SPEC 13.12): primary, un-aged,
+ *  no finite global eviction cap; the auth store additionally leader-only `allow_direct=false`. */
+export declare function openLifecycleRegistry(nc: NatsConnection, space: string, scanner?: AuthLedgerScanner, recordsScanner?: RecordsScanner): Promise<LifecycleRegistry>;
+/** Open the sealed read-only mapping reader. Its scoped credential holds EXACTLY the records
+ *  leader read (`STREAM.MSG.GET`) plus the records `STREAM.INFO` for the bind-time shape proof
+ *  (SPEC 13.9/13.12): a reader that cannot prove it is bound to the primary, non-evicting
+ *  records store refuses to serve authority reads (it could otherwise leader-read a MIRROR's
+ *  leader and call that the mapping). */
+export declare function openLifecycleMappingReader(nc: NatsConnection, space: string): Promise<LifecycleMappingReader>;
+/** The `lifecycle.<owner>.<actor>` head value (§13.1, amended). One incarnation of an alias.
+ *  `mappingRevision` is NOT here: it is the head key's STORE revision (§13.1), returned beside
+ *  the mapping by the leader read. `currentCredentialId` stays ABSENT until the (3) normative
+ *  ledger mints under the reopened gate (an active head naming a released credential before the
+ *  ledger exists would be exactly the unledgered mint §13.1 forbids). */
+export interface LifecycleMapping {
+    owner: string;
+    actor: string;
+    /** The never-reused, space-globally reserved lifecycle UID of THIS incarnation. */
+    lifecycleUid: string;
+    /** The minting/supervising authority. */
+    managerInstance: string;
+    /** The fenced process epoch (§13.1: live authority binds it; advanced only by the takeover
+     *  barrier, which this slice does not expose). */
+    processEpoch: number;
+    /** `active` is the ONLY current state. `retiring` = the terminal barrier's op-bound
+     *  containment phase (non-current, NOT replaceable). `retired` = terminal AND asserts the
+     *  completed barrier (only then may activation replace the alias, with a fresh UID). */
+    state: "active" | "retiring" | "retired";
+    /** The public credential fingerprint + authority epoch — absent until the ledger slice. */
+    currentCredentialId?: string;
+    /** The opId of the takeover operation that LAST advanced this epoch (SPEC 13.1: the epoch
+     *  advance and its op stamp are ONE CAS, so a completion is bound to exactly one operation).
+     *  A resuming barrier confirms the completed head carries ITS opId; a LOSING concurrent
+     *  takeover finds a foreign opId and refuses, never claiming the winner's completion. Absent
+     *  at initial activation (epoch 1), present from the first takeover. */
+    lastTakeoverOpId?: string;
+    /** REQUIRED at `retiring` (the retirement operation's durable intent); absent otherwise. */
+    op?: {
+        opId: string;
+        kind: "retirement";
+    };
+}
+/** PACKAGE-INTERNAL accessor for the trusted auth path's sibling modules (the credential
+ *  ledger + issuance barrier, which are the SAME authority over the SAME stores). Deliberately
+ *  never re-exported from the package index: a sealed registry stays the only door. */
+export declare function registryStores(reg: LifecycleRegistry): {
+    space: string;
+    recordsKv: KV;
+    authKv: KV;
+    jsm: JetStreamManager;
+    js: JetStreamClient;
+    work: WorkPoolContext;
+};
+/** PACKAGE-INTERNAL: the barrier's CLOSED enumeration seam (SPEC 13.9). Returns the sealed
+ *  auth-ledger scanner or throws — a registry constructed WITHOUT one (the mint writer) never
+ *  enumerates, so asking it to is a composition bug, not a silent degrade. Exposes only the closed
+ *  scan ops; the raw scanner/connection/credential stay inside {@link openAuthLedgerScanner}. */
+export declare function registryScanner(reg: LifecycleRegistry): AuthLedgerScanner;
+/** PACKAGE-INTERNAL: the retirement barrier's CLOSED obligation-enumeration seam (SPEC 13.9,
+ *  site 3). Returns the sealed records scanner or throws — a registry constructed WITHOUT one never
+ *  drains obligations, so asking it to is a composition bug, not a silent degrade. Exposes only the
+ *  closed scan op; the raw scanner/connection/credential stay inside {@link openRecordsScanner}. */
+export declare function registryRecordsScanner(reg: LifecycleRegistry): RecordsScanner;
+/** PACKAGE-INTERNAL: the barrier's candidate read of an alias head (the credential-ledger
+ *  takeover barrier captures its `fromEpoch` coordinate from it, and its epoch CAS re-reads
+ *  through {@link advanceEpochWithinTakeover}). Same never-deleted discipline as every head
+ *  read; never re-exported from the package index. */
+export declare function readLifecycleHeadForOperation(reg: LifecycleRegistry, owner: string, actor: string): Promise<{
+    mapping: LifecycleMapping;
+    revision: number;
+} | undefined>;
+/** The takeover barrier's epoch-advance head CAS (SPEC 13.1: NO public epoch advance exists;
+ *  this is a finalization step of the takeover barrier, module-internal for the credential
+ *  ledger's barrier only, and idempotent for the barrier's crash-resume). Advances the epoch by
+ *  exactly one, revision-pinned, only while the head is ACTIVE at the SAME uid. */
+export declare function advanceEpochWithinTakeover(reg: LifecycleRegistry, args: {
+    owner: string;
+    actor: string;
+    lifecycleUid: string;
+    fromEpoch: number;
+    opId: string;
+}): Promise<"advanced" | "already-advanced">;
+/**
+ * The issuance path's head CAS stamping the incarnation's ROOT credential (SPEC 13.1: the head's
+ * `currentCredentialId` is what the connect arm's root-path equality check reads, so a superseded
+ * root issuance is denied even while its old row still reads active). The mint protocol's
+ * RELEASE-LAST final step: the active `cred.` row is durable and its gate finalize has won BEFORE
+ * this runs, and the bearer bytes release only after it.
+ *
+ * ABSENT → value ONLY (idempotent for the SAME value): a head that already names a DIFFERENT root
+ * credential REFUSES — flipping `currentCredentialId` without the full family revoke would leave
+ * the old root's descendants connectable under the leaf check, so root ROTATION is exclusively a
+ * barrier's job (takeover/retirement), never this seam's. Revision-pinned; ACTIVE at the SAME uid
+ * only; a foreign head movement between the caller's read and this CAS loses fail-closed.
+ */
+export declare function setCurrentRootCredential(reg: LifecycleRegistry, args: {
+    owner: string;
+    actor: string;
+    lifecycleUid: string;
+    credentialId: string;
+}): Promise<void>;
+/** The retirement barrier's head CONTAINMENT CAS (SPEC 13.1: `active → retiring`, bound to the
+ *  retirement operation's durable intent — from this point every currency seam yields no current
+ *  mapping and no current epoch, and the alias is NOT replaceable). PACKAGE-INTERNAL for the
+ *  barrier only (no public retire seam exists); idempotent for the barrier's crash-resume. */
+export declare function beginHeadRetirementWithinBarrier(reg: LifecycleRegistry, args: {
+    owner: string;
+    actor: string;
+    lifecycleUid: string;
+    opId: string;
+}): Promise<"retiring" | "already-retiring">;
+/** The retirement barrier's TERMINAL head CAS (`retiring → retired`, op-pinned) — the barrier's
+ *  LAST step (SPEC 13.1: `retired` ASSERTS completed cleanup, which is what makes the alias
+ *  replaceable). The op intent is dropped (it belongs to `retiring` only); idempotence at
+ *  `retired` is decided by the CALLER against the gate's terminal op (the retired head itself
+ *  carries no retirement stamp). PACKAGE-INTERNAL for the barrier only. */
+export declare function completeHeadRetirementWithinBarrier(reg: LifecycleRegistry, args: {
+    owner: string;
+    actor: string;
+    lifecycleUid: string;
+    opId: string;
+}): Promise<"retired" | "already-retired">;
+/** PACKAGE-INTERNAL: read a UID reservation's audit `{ owner, actor }` (the minting authority
+ *  recorded it at {@link tryReserveUid}). The credential ledger uses it to BIND a mint's
+ *  `holderPrincipal` to the reserved identity, so a trusted caller cannot ledger a row that
+ *  names a foreign principal for the barrier to evict. A DEL/PURGE marker refuses loudly. */
+export declare function readUidReservation(reg: LifecycleRegistry, lifecycleUid: string): Promise<{
+    owner: string;
+    actor: string;
+} | undefined>;
+/** Try to reserve ONE explicit candidate UID (test/provisioning-internal; production paths use
+ *  {@link reserveLifecycleUid}). Create-only: `"won"` reserves it forever; `"burned"` means the
+ *  candidate already exists OR carries a deletion marker — either way it is unusable, per the
+ *  never-reuse rule. NOT exported from the package index: an explicit candidate is only for
+ *  probes and migration tooling, never a caller-chosen identity. */
+export declare function tryReserveUid(reg: LifecycleRegistry, lifecycleUid: string, audit: {
+    owner: string;
+    actor: string;
+    mintedBy: string;
+}): Promise<"won" | "burned">;
+/** Reserve a fresh lifecycle UID space-globally (§13.1): mint a CSPRNG candidate, win its
+ *  create-only reservation, and on a collision burn the candidate and draw another. At ≥128
+ *  bits a collision is effectively adversarial, so a handful of retries is a correctness
+ *  formality, not a capacity plan; exhausting them refuses loudly. */
+export declare function reserveLifecycleUid(reg: LifecycleRegistry, audit: {
+    owner: string;
+    actor: string;
+    mintedBy: string;
+}): Promise<string>;
+/** The agent-family issuance gate row (§13.1, amended): `frozen` MUST carry the durable op
+ *  intent; the embedded uid MUST agree with the key. (The disjoint ENDPOINT family
+ *  `epgate.<endpoint>.<instanceId>` and the full barrier land with the (3)/(2b) ledger slices.) */
+export interface EpGateRow {
+    lifecycleUid: string;
+    state: "open" | "frozen" | "retired";
+    /** Mint generation: born 0 under the activation freeze, first mintable generation is 1 (the
+     *  activation's reopen), and every barrier reopen advances it. */
+    generation: number;
+    /** REQUIRED at `frozen` (which operation owns this freeze and may advance it) AND at
+     *  `retired` (the terminalizing op, audit + same-op idempotence); absent at `open`.
+     *  `successor` is a per-kind summary token (SPEC 13.1): only `takeover`/`registration`
+     *  may carry one (their authoritative successor artifacts live under `stage.<opId>.`);
+     *  `activation`/`retirement` never do. */
+    op?: {
+        opId: string;
+        kind: "activation" | "takeover" | "registration" | "retirement";
+        successor?: string;
+    };
+}
+/** Observe the gate (the candidate read feeding a revision-pinned CAS; the auth store is
+ *  leader-only by shape, `allow_direct=false`). A DEL/PURGE marker refuses loudly. */
+export declare function observeGate(reg: LifecycleRegistry, lifecycleUid: string): Promise<{
+    row: EpGateRow;
+    revision: number;
+} | undefined>;
+/** Create the gate FROZEN under its operation's durable intent (create-only: conflicts on an
+ *  existing gate or a deletion marker). A gate is BORN only under an ACTIVATION intent (SPEC
+ *  13.1 per-kind transition sets: takeover/registration/retirement freeze an EXISTING open
+ *  gate), and only for a UID whose space-global reservation was already WON: a gate over an
+ *  unreserved UID would mint outside the never-reuse fence. Born unmintable at generation 0:
+ *  no credential can be released until the operation's own reopen (§13.1 activation saga). */
+export declare function createGateFrozen(reg: LifecycleRegistry, args: {
+    lifecycleUid: string;
+    op: {
+        opId: string;
+        kind: "activation";
+    };
+}): Promise<{
+    row: EpGateRow;
+    revision: number;
+}>;
+/** CAS the gate `open → frozen` carrying the freezing operation's durable intent, at the
+ *  observed revision. The bar of every barrier: a staged mint's own finalize CAS loses. */
+export declare function freezeGate(reg: LifecycleRegistry, args: {
+    lifecycleUid: string;
+    revision: number;
+    op: {
+        opId: string;
+        kind: "takeover" | "registration" | "retirement";
+        successor?: string;
+    };
+}): Promise<{
+    row: EpGateRow;
+    revision: number;
+}>;
+/** CAS the gate `frozen → open` at the NEXT generation — op-pinned: only the freeze's own
+ *  operation (the same `opId`) reopens, as its barrier's final step; a stranger or a stale
+ *  reconciler refuses before the CAS is even attempted. Per-kind (SPEC 13.1): a reopen
+ *  belongs to activation, takeover, and a registration abort — NEVER retirement (a
+ *  retirement freeze never reopens; its only exit is the terminal). */
+export declare function reopenGate(reg: LifecycleRegistry, args: {
+    lifecycleUid: string;
+    revision: number;
+    opId: string;
+}): Promise<{
+    row: EpGateRow;
+    revision: number;
+}>;
+/** CAS the gate `frozen → retired` (terminal; never reopened) — op-pinned like the reopen. The
+ *  activation saga uses it to terminalize a head-CAS loser's orphan gate; the retirement
+ *  barrier uses it as its own gate terminalization step. Per-kind (SPEC 13.1): only an
+ *  ACTIVATION orphan or a RETIREMENT terminalizes — a takeover/registration freeze aborts by
+ *  reopening, never by the terminal. Idempotence at `retired` is SAME-OP idempotence: a
+ *  stranger's retry on a terminal gate refuses, it does not "succeed". */
+export declare function retireGate(reg: LifecycleRegistry, args: {
+    lifecycleUid: string;
+    revision: number;
+    opId: string;
+}): Promise<{
+    row: EpGateRow;
+    revision: number;
+}>;
+/**
+ * Activate the alias `(owner, actor)`: the full §13.1 initial-activation saga. Refuses an
+ * `active` head (`already-exists`: a takeover advances the epoch through its barrier, never a
+ * new incarnation) and a `retiring` head (`failed-precondition`: a retiring alias is NOT
+ * replaceable until its barrier completes). A virgin alias activates by create-only head CAS; a
+ * `retired` predecessor is replaced by revision-pinned CAS with a FRESH reserved UID. The
+ * head-CAS loser terminalizes its own orphan gate (its UID stays burned forever) and rethrows
+ * the `conflict`. Returns the new mapping, its store revision (= `mappingRevision`), and the
+ * saga's `opId` (the durable intent a crashed caller resumes with, {@link resumeActivation}).
+ *
+ * NOT wired to any production spawn path in this slice; the ledger slice adds credential
+ * minting under the reopened gate before this becomes reachable.
+ */
+export declare function activateLifecycle(reg: LifecycleRegistry, args: {
+    owner: string;
+    actor: string;
+    managerInstance: string;
+}): Promise<{
+    mapping: LifecycleMapping;
+    revision: number;
+    opId: string;
+}>;
+/**
+ * Activate the alias `(owner, actor)` AT THE CALLER'S uid — the production ISSUANCE activation
+ * (SPEC 13.1). The grant row already minted the incarnation's uid and every bearer's
+ * lifecycle-equality is bound to it, so a fresh reservation ({@link activateLifecycle}) would
+ * strand the grant. Same saga order (reserve → gate frozen → head CAS → reopen LAST) with
+ * ADOPT-instead-of-burn resume semantics: a reservation or frozen ACTIVATION gate already carried
+ * by OUR alias at this uid is a prior attempt's durable progress and is adopted — burning the
+ * grant's uid would permanently brick the grant — and a CAS loss to a SIBLING (same alias, same
+ * uid) converges on the winner's state instead of refusing.
+ *
+ * Returns with the head ACTIVE at `lifecycleUid` and the issuance gate OPEN. Refuses loudly: an
+ * active head at a DIFFERENT uid (`already-exists` — retiring a live predecessor is the takeover
+ * barrier's job, which production issuance does not run in R1), a retiring head, a reservation
+ * held by a FOREIGN alias, a foreign-operation freeze, and a terminally retired gate.
+ */
+export declare function activateLifecycleAtUid(reg: LifecycleRegistry, args: {
+    owner: string;
+    actor: string;
+    lifecycleUid: string;
+    managerInstance: string;
+}): Promise<void>;
+/**
+ * Resume a crashed activation saga from its durable coordinates (`{alias, lifecycleUid, opId}`,
+ * the intent the minting authority persists before step 1 and the gate carries from step 2).
+ * Reads the durable state and finishes the SAME operation deterministically:
+ *  - head active at OUR uid → finish step 4 (reopen the gate) if it is still frozen by us;
+ *  - head absent / retired / owned by another uid → our head CAS never won (or never ran):
+ *    terminalize our orphan gate; the uid stays burned.
+ * Idempotent; never advances another operation's freeze (the op-pinned CAS refuses). Returns
+ * what it did.
+ */
+export declare function resumeActivation(reg: LifecycleRegistry, args: {
+    owner: string;
+    actor: string;
+    lifecycleUid: string;
+    opId: string;
+}): Promise<"completed" | "terminalized" | "already-settled">;
+/**
+ * The LEADER-SERVED mapping read (§13.1: `mappingRevision` IS the returned store revision; the
+ * records bucket allows Direct Get for non-fencing reads, but an authority read of the head is
+ * leader-served `STREAM.MSG.GET`, never a follower get). Returns the mapping REGARDLESS of
+ * state — currency is the CALLER's rule, and the epoch seam below applies it. A DEL/PURGE
+ * marker refuses loudly.
+ */
+export declare function readLifecycleMappingLeader(rd: LifecycleMappingReader, owner: string, actor: string): Promise<{
+    mapping: LifecycleMapping;
+    revision: number;
+} | undefined>;
+/**
+ * The `readProcessEpoch` PRODUCTION SEAM the D11/D7 paths inject: the CURRENT incarnation's
+ * fenced epoch, leader-served — and current means `state: "active"` ONLY (§13.1, amended):
+ * `retiring` and `retired` alike yield `undefined`, so a superseded process's status write, a
+ * containment-phase mint, or a leaked session grant all fail the epoch fence. Bind it as
+ * `readProcessEpoch: () => lifecycleProcessEpochReader(reader, owner, actor)`.
+ */
+export declare function lifecycleProcessEpochReader(rd: LifecycleMappingReader, owner: string, actor: string): Promise<number | undefined>;
+//# sourceMappingURL=lifecycle-registry.d.ts.map

package/dist/lifecycle-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle-registry.d.ts","sourceRoot":"","sources":["../src/lifecycle-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,OAAO,EAA+B,KAAK,eAAe,EAAE,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC9G,OAAO,EAAO,KAAK,EAAE,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAaL,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAsB,KAAK,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAatF,8FAA8F;AAC9F,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AACD;oEACoE;AACpE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAuCD;;yDAEyD;AACzD,MAAM,WAAW,kBAAkB;IACjC,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;kGAOkG;AAClG,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CA0BxF;AAED;;mGAEmG;AACnG,wBAAsB,qBAAqB,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,EAAE,cAAc,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAoCvK;AAED;;;;yCAIyC;AACzC,wBAAsB,0BAA0B,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAcnH;AAID;;;;yEAIyE;AACzE,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,YAAY,EAAE,MAAM,CAAC;IACrB,yCAAyC;IACzC,eAAe,EAAE,MAAM,CAAC;IACxB;sDACkD;IAClD,YAAY,EAAE,MAAM,CAAC;IACrB;;4FAEwF;IACxF,KAAK,EAAE,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;IACzC,2FAA2F;IAC3F,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;4EAIwE;IACxE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,4FAA4F;IAC5F,EAAE,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,YAAY,CAAA;KAAE,CAAC;CAC3C;AAoED;;uFAEuF;AACvF,wBAAgB,cAAc,CAAC,GAAG,EAAE,iBAAiB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,EAAE,CAAC;IAAC,MAAM,EAAE,EAAE,CAAC;IAAC,GAAG,EAAE,gBAAgB,CAAC;IAAC,EAAE,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,eAAe,CAAA;CAAE,CAEtK;AAED;;;iGAGiG;AACjG,wBAAgB,eAAe,CAAC,GAAG,EAAE,iBAAiB,GAAG,iBAAiB,CAKzE;AAED;;;oGAGoG;AACpG,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,iBAAiB,GAAG,cAAc,CAK7E;AAED;;;sDAGsD;AACtD,wBAAsB,6BAA6B,CACjD,GAAG,EAAE,iBAAiB,EACtB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC;IAAE,OAAO,EAAE,gBAAgB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CAEtE;AAED;;;mFAGmF;AACnF,wBAAsB,0BAA0B,CAC9C,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC5F,OAAO,CAAC,UAAU,GAAG,kBAAkB,CAAC,CA+B1C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACjF,OAAO,CAAC,IAAI,CAAC,CAWf;AAED;;;8FAG8F;AAC9F,wBAAsB,gCAAgC,CACpD,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzE,OAAO,CAAC,UAAU,GAAG,kBAAkB,CAAC,CAc1C;AAED;;;;2EAI2E;AAC3E,wBAAsB,mCAAmC,CACvD,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzE,OAAO,CAAC,SAAS,GAAG,iBAAiB,CAAC,CAWxC;AAED;;;6FAG6F;AAC7F,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,iBAAiB,EACtB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CAevD;AAID;;;;oEAIoE;AACpE,wBAAsB,aAAa,CACjC,GAAG,EAAE,iBAAiB,EACtB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACxD,OAAO,CAAC,KAAK,GAAG,QAAQ,CAAC,CAU3B;AAED;;;sEAGsE;AACtE,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,iBAAiB,EACtB,KAAK,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACxD,OAAO,CAAC,MAAM,CAAC,CAMjB;AAID;;mGAEmG;AACnG,MAAM,WAAW,SAAS;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;IACrC;sEACkE;IAClE,UAAU,EAAE,MAAM,CAAC;IACnB;;;;8CAI0C;IAC1C,EAAE,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,YAAY,GAAG,UAAU,GAAG,cAAc,GAAG,YAAY,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5G;AA8CD;sFACsF;AACtF,wBAAsB,WAAW,CAAC,GAAG,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CAQzI;AAYD;;;;;8FAK8F;AAC9F,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,YAAY,CAAA;KAAE,CAAA;CAAE,GACvE,OAAO,CAAC;IAAE,GAAG,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAY/C;AAED;2FAC2F;AAC3F,wBAAsB,UAAU,CAC9B,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,UAAU,GAAG,cAAc,GAAG,YAAY,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAC3I,OAAO,CAAC;IAAE,GAAG,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAe/C;AAED;;;;uEAIuE;AACvE,wBAAsB,UAAU,CAC9B,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC7D,OAAO,CAAC;IAAE,GAAG,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAa/C;AAED;;;;;0EAK0E;AAC1E,wBAAsB,UAAU,CAC9B,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC7D,OAAO,CAAC;IAAE,GAAG,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAkB/C;AAID;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,GAC9D,OAAO,CAAC;IAAE,OAAO,EAAE,gBAAgB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CA6CxE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,GACpF,OAAO,CAAC,IAAI,CAAC,CA4Ef;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzE,OAAO,CAAC,WAAW,GAAG,cAAc,GAAG,iBAAiB,CAAC,CA6B3D;AAID;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAC9C,EAAE,EAAE,sBAAsB,EAC1B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC;IAAE,OAAO,EAAE,gBAAgB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CAYtE;AAED;;;;;;GAMG;AACH,wBAAsB,2BAA2B,CAC/C,EAAE,EAAE,sBAAsB,EAC1B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAG7B"}