@cotal-ai/auth 0.12.0 → 0.13.1

package/dist/admission-mediator.d.ts

@@ -0,0 +1,319 @@
+import type { NatsConnection } from "@nats-io/transport-node";
+import { type AcceptanceFact } from "@cotal-ai/core";
+import { type LifecycleRegistry } from "./lifecycle-registry.js";
+import { type RecordsScanner } from "./records-scanner.js";
+/** The sealed admission mediator for ONE endpoint (BRANDED, §13.12: a hand-assembled object
+ *  never authorizes). The endpoint bind is structural: every obligation this mediator touches
+ *  carries its own sealed endpoint token, so endpoint A can never obtain, settle, or replay
+ *  endpoint B's admission (§13.8's confined-reader identity bind, in-process form). */
+export interface AdmissionMediator {
+    readonly space: string;
+    readonly endpoint: string;
+}
+/** Open the sealed per-endpoint admission mediator over the space's PRIMARY records store —
+ *  shape-proved at bind exactly like every trusted consumer of that store (SPEC 13.12).
+ *  `now`/`proofTtlMs` are probe seams; the proof TTL defaults to the §13.8 reference call
+ *  deadline (15 s). `recordsScanner` is the SEALED records-obligation scanner the mediator's
+ *  drain-to-quiescence enumeration runs on (SPEC 13.9, site 3): the mediator's own credential holds
+ *  NO `CONSUMER.CREATE` on the records stream (a create-request body is not subject-ACL confinable —
+ *  nats-server#8274), so it can never build a durable+PUSH exporter of its `oblig.` subtree; the
+ *  CREATE lives only inside {@link ./records-scanner.ts}. Required: a mediator that cannot enumerate
+ *  cannot drain (SPEC 13.8), which is a composition bug, not a silent degrade. */
+export declare function openAdmissionMediator(nc: NatsConnection, space: string, endpoint: string, opts: {
+    now?: () => number;
+    proofTtlMs?: number;
+    recordsScanner: RecordsScanner;
+}): Promise<AdmissionMediator>;
+/** The §13.8 commit-value union (CLOSED): a canonical base64url JSON encoding of the committed
+ *  value, or an IMMUTABLE `policy`-kind records key whose stored value IS the commit value. */
+export type CommitValue = {
+    enc: "b64u";
+    bytes: string;
+} | {
+    enc: "ref";
+    key: string;
+};
+/** The complete `self`-class commit intent (§13.8): a crashed writer's commit is finishable from
+ *  this alone. `commitDigest` is the RFC-8785 CANONICAL content digest of the committed value,
+ *  `sha256:<hex>` (the same `*Digest` scalar shape §13.7 uses). `commitValue` is RESOLVED and
+ *  its canonical digest VERIFIED against `commitDigest` at obtain (before the row can accept),
+ *  so a mismatched value/digest can never reach `accepted` and wedge recovery. */
+export interface SelfCommitIntent {
+    commitKey: string;
+    commitBaseRevision: number;
+    commitValue: CommitValue;
+    commitDigest: string;
+}
+export type ObligationState = "provisional" | "accepted" | "rejected" | "terminal";
+/** One obligation row (CLOSED per-class schema, §13.8). The `decision` class is fixed by the
+ *  TRUSTED operation kind ({@link obtainEpfObligation} vs {@link obtainSelfObligation}), never
+ *  caller-selectable. */
+export interface ObligationRow {
+    state: ObligationState;
+    decision: "epf" | "self";
+    opId: string;
+    /** Present iff target-bound: the target head's store revision pinned at the create-fence. */
+    mappingRevision?: number;
+    /** Present iff policy-admitted: the enforced policy record's store revision. */
+    policyRevision?: number;
+    /** epf-class only: the canonical acceptance's identity. */
+    fingerprint?: string;
+    sourceSeq?: number;
+    route?: string;
+    /** self-class only: the complete commit intent. */
+    commit?: SelfCommitIntent;
+}
+/** A BRANDED mediated request (§13.8: "derives the coordinate from the broker-authenticated
+ *  request subject, never a body field"). The endpoint and caller triple come ONLY from parsing
+ *  an authenticated request/journal subject through {@link mediatedRequestFromSubject}; a caller
+ *  can never hand-assemble one, so the obligation coordinate's identity is structurally the
+ *  broker-authenticated identity, not a body-supplied `caller`. */
+export interface MediatedRequest {
+    readonly endpoint: string;
+    readonly caller: {
+        readonly owner: string;
+        readonly actor: string;
+        readonly uid: string;
+    };
+}
+/** Build the branded mediated request from the RAW authenticated request subject the broker
+ *  delivered (an `ep`-plane request or an `epj`-plane journal submission). Core's
+ *  {@link parseEpSubject} extracts the endpoint + caller triple STRUCTURALLY from the subject;
+ *  a malformed subject, or one that is not a request/journal, refuses. The `id` (the
+ *  caller-chosen request id, §13.4) is NOT in the subject and stays an explicit operation
+ *  argument; everything that identifies WHO the caller is comes from here. */
+export declare function mediatedRequestFromSubject(subject: string): MediatedRequest;
+/** The operation coordinates NOT carried by the authenticated identity: the target lifecycle
+ *  this admission binds to (omitted = the `ep` sentinel), whether it pins the enforced policy
+ *  (§13.6), and the caller-chosen request id (§13.4, a body field, legitimately caller-supplied
+ *  because it identifies the REQUEST, not WHO the caller is). At least one of target/policy. */
+export interface AdmissionOp {
+    target?: {
+        owner: string;
+        actor: string;
+        lifecycleUid: string;
+    };
+    policy?: boolean;
+    id: string;
+}
+/** Validate an obligation row at the consuming boundary: CLOSED per-class schema, at least one
+ *  currency pin, class-required fields present and class-foreign fields absent (SPEC 13.8). */
+export declare function parseObligationRow(raw: Uint8Array, key: string): ObligationRow;
+/** The govern head's normative policy selector fields (§13.6). The rest of the head value
+ *  (the binding map, the provisional registration slot) is the registration path's and is
+ *  PRESERVED verbatim by the selector CAS steps here. */
+export interface PolicySelector {
+    enforcedPolicyKey?: string;
+    enforcedPolicyRevision?: number;
+    pendingPolicyKey?: string;
+    pendingPolicyRevision?: number;
+}
+/** Publish ONE immutable policy version (§13.7 `policy.<endpoint>.<digest-hex>`): the key is the
+ *  RFC-8785 CANONICAL content digest of the value (property-order-insensitive, so a conforming
+ *  second implementation content-addresses the same policy to the same key), so publication is
+ *  content-addressed and idempotent; an existing key whose value does not re-digest to it is
+ *  corruption. Provisioner-registration authority (§13.9): takes the sealed registry, not the
+ *  mediator. */
+export declare function publishPolicyVersion(reg: LifecycleRegistry, endpoint: string, value: unknown): Promise<{
+    key: string;
+    revision: number;
+    digestHex: string;
+}>;
+/** STAGE a policy mutation (§13.6 step 1, provisioner authority): verify the NEW immutable
+ *  version exists and self-certifies, then CAS `pendingPolicy{Key,Revision}` onto the govern
+ *  head, preserving every other head field verbatim (the binding map and registration slot are
+ *  the registration path's). A virgin head is created with an empty binding map. A pending
+ *  already staged refuses (`conflict`: one mutation at a time; promote or abandon it first). */
+export declare function stagePolicySelector(reg: LifecycleRegistry, endpoint: string, policyKey: string): Promise<{
+    pendingPolicyKey: string;
+    pendingPolicyRevision: number;
+    mutationOpId: string;
+    governRevision: number;
+}>;
+/** The BRANDED drain-quiescence witness {@link drainEndpointPolicy} mints: proof that the
+ *  endpoint's POLICY-PINNED obligations enumerated quiescent for THIS exact staged mutation.
+ *  {@link promotePolicySelector} accepts nothing else, and binds it to the exact
+ *  `(space, endpoint, pendingKey, pendingRevision, mutationOpId, governStageRevision)` so a
+ *  witness cannot be replayed across spaces (the same content-addressed key elsewhere), across
+ *  re-stages (a new mutationOpId), or against a moved govern head (the promote CASes from
+ *  `governStageRevision`). A promote CONSUMES the witness (§13.6). */
+export interface DrainQuiescence {
+    readonly space: string;
+    readonly endpoint: string;
+    readonly pendingPolicyKey: string;
+    readonly pendingPolicyRevision: number;
+    readonly mutationOpId: string;
+    readonly governStageRevision: number;
+}
+/** PROMOTE a staged policy mutation (§13.6 step 2, provisioner authority): only under the
+ *  branded drain witness for the SAME endpoint and pending key. Moves `pendingPolicy…` into
+ *  `enforcedPolicy…` and clears the pending slot, preserving every other head field. */
+export declare function promotePolicySelector(reg: LifecycleRegistry, endpoint: string, quiescence: DrainQuiescence): Promise<{
+    enforcedPolicyKey: string;
+    enforcedPolicyRevision: number;
+}>;
+/** The confined policy read for a canonicalizer's capacity decision (§13.6/§13.8): the sealed
+ *  mediator IS the identity bind (it reads only its own endpoint's policy). Returns
+ *  `{ policy, revision }`; revision is what an admission pins. */
+export declare function readEnforcedPolicy(med: AdmissionMediator): Promise<{
+    policy: unknown;
+    revision: number;
+    key: string;
+}>;
+/** The opaque admission proof (§13.8): BRANDED, bounded-lived, bound to
+ *  `{ space, endpoint, obligation key, opId }`. Possession grants nothing to a caller that
+ *  cannot present it to ITS OWN endpoint's mediator before expiry; the durable obligation is
+ *  the authority, never the proof. */
+export interface AdmissionProof {
+    readonly space: string;
+    readonly endpoint: string;
+    readonly obligationKey: string;
+    readonly opId: string;
+    readonly exp: number;
+}
+/** The STRUCTURAL proof check: branded, unexpired, same space/endpoint/key (§13.8: endpoint A
+ *  can never replay endpoint B's proof). This is the fast pre-check; the AUTHORITATIVE gate that
+ *  admission requires is {@link verifyAdmissionProof}, which ALSO re-reads the CURRENT obligation
+ *  state (§13.8: a drained or settled row leaves a locally-valid-looking proof inert). */
+export declare function assertAdmissionProof(med: AdmissionMediator, proof: AdmissionProof, obligationKey: string): void;
+/** The COMPLETE proof gate (§13.8: "checked against the CURRENT obligation state"): the
+ *  structural check PLUS a leader-read of the row confirming it still exists, carries the
+ *  proof's opId, and is NOT settled (rejected/terminal). A proof whose row a drain settled after
+ *  issuance is refused here even though its brand/bind/expiry still look valid, so admission is
+ *  proof-gated on live state, never on stale possession. Every effect the proof authorizes (the
+ *  EPF acceptance publish, the self-class accept) gates on THIS, not the structural check alone. */
+export declare function verifyAdmissionProof(med: AdmissionMediator, proof: AdmissionProof, obligationKey: string): Promise<ObligationRow>;
+/** What an obtain returns: the durable obligation coordinates plus the bounded proof. `joined`
+ *  reports whether this call created the row or joined an existing winner. */
+export interface ObtainedObligation {
+    key: string;
+    row: ObligationRow;
+    revision: number;
+    proof: AdmissionProof;
+    joined: boolean;
+}
+/** Obtain an EPF-class obligation (a canonical acceptance's reservation, §13.8). The class is
+ *  fixed HERE, by the trusted operation kind. */
+export declare function obtainEpfObligation(med: AdmissionMediator, request: MediatedRequest, args: AdmissionOp & {
+    fingerprint: string;
+    sourceSeq: number;
+    route: string;
+}): Promise<ObtainedObligation>;
+/** Obtain a SELF-class obligation (a guarded record commit's reservation, e.g. the
+ *  restart-status CAS, §13.6/§13.8). The COMPLETE commit intent is pinned at obtain. */
+export declare function obtainSelfObligation(med: AdmissionMediator, request: MediatedRequest, args: AdmissionOp & {
+    commit: SelfCommitIntent;
+}): Promise<ObtainedObligation>;
+/** Public settle of one unresolved obligation (the drains call it; the recheck refusals call
+ *  it internally). Leader-reads the current row first. */
+export declare function settleEpfOrSelfObligation(med: AdmissionMediator, obligationKey: string, why: string): Promise<"accepted" | "rejected" | "already-settled">;
+/** Advance a `self`-class obligation `provisional → accepted` under an unexpired proof
+ *  (§13.8 step 3: the guarded commit is authorized only while the row is `accepted`). */
+export declare function acceptSelfObligation(med: AdmissionMediator, proof: AdmissionProof): Promise<{
+    revision: number;
+}>;
+/** The injected commit applier for {@link recoverSelfObligation}: the record write stays with
+ *  a principal that holds it (the mediator's own grant is the obligation family, §13.9). */
+export type ApplyCommit = (commitKey: string, valueBytes: Uint8Array, baseRevision: number) => Promise<void>;
+/** Drive an `accepted` `self`-class obligation to `terminal` deterministically from its pinned
+ *  intent alone (§13.8): landed (digest matches) / re-apply (still at base; via the injected
+ *  {@link ApplyCommit}) / superseded (moved past to a foreign value). The writer's own resume
+ *  AND the drain reconciler both use this — an accepted commit is never an unrecoverable
+ *  orphan. Returns what it found. */
+export declare function recoverSelfObligation(med: AdmissionMediator, obligationKey: string, deps: {
+    applyCommit: ApplyCommit;
+}): Promise<"landed" | "re-applied" | "superseded">;
+/** One enumerated obligation (its key, parsed row, and store revision). */
+export interface EnumeratedObligation {
+    key: string;
+    row: ObligationRow;
+    revision: number;
+}
+/** Enumerate an obligation filter through the SEALED records scanner (§13.9, site 3), turning each
+ *  raw entry into a parsed, closed-schema obligation row. Markers and parse failures abort LOUD: a
+ *  drain that skipped either would declare quiescence over rows it never read. The scanner holds the
+ *  ONLY `CONSUMER.CREATE` on the records stream (fence-free LastPerSubject; the caller — mediator or
+ *  §13.1 retirement barrier — holds none, so a compromise can never durable-export the `oblig.`
+ *  subtree, nats-server#8274). The barrier enumerates the target-wide `oblig.<targetUid>.>` (its
+ *  endpoint discovery + quiescence re-check) through the registry's records scanner; each mediator
+ *  enumerates its own endpoint's subtree through the scanner injected at open. INVARIANT: the
+ *  `scanner` argument MUST come from one of those brand-asserted seams (`med.recordsScanner`,
+ *  `registryRecordsScanner(reg)`), never a hand-passed instance; the brand assert lives at
+ *  INJECTION (openAdmissionMediator / openLifecycleRegistry), not here, so a new caller that
+ *  hand-passes a scanner bypasses the space bond. */
+export declare function enumerateObligationRows(scanner: RecordsScanner, filter: string): Promise<EnumeratedObligation[]>;
+/** A CLOSED, mediator-validated POOL-route repair command (§13.8; the confined-applier slice's
+ *  boundary): the MEDIATOR reads and validates the acceptance decision fact itself
+ *  (parse + row/decision binding + route + horizon), derives the exact EPW item subject and the
+ *  canonical acceptance-derived bytes ({@link workItemBytesOf}), and hands the executor ONLY this
+ *  command. The executor holds NO derivation authority — it can be granted exactly the one
+ *  create-publish row and executes the command verbatim (create-only; a lost create is benign,
+ *  the drain re-reads establishment either way). */
+export interface PoolRouteRepair {
+    kind: "pool";
+    /** The exact EPW item subject (`<space>.epw.<endpoint>.<pool>.<cO>.<cA>.<cUid>.<id>`). */
+    subject: string;
+    /** The canonical acceptance-derived stored bytes. */
+    bytes: Uint8Array;
+    /** The acceptance's identity-bound absolute horizon (context for the executor's logs/refusals). */
+    workExpiry: number;
+}
+/** The injected POOL-route reconciler (§13.8: a drain must complete accept-side reconciliation
+ *  for an accepted pool row before it declares quiescence; an accepted decision whose enqueue
+ *  never landed would otherwise be lost). Receives a closed {@link PoolRouteRepair}; idempotent. */
+export type ReconcilePoolRoute = (repair: PoolRouteRepair) => Promise<void>;
+/** A CLOSED, mediator-validated EFFECTS-CANCEL repair (§13.8 option (i)): the MEDIATOR reads and
+ *  row-binds the acceptance decision itself and derives the exact completion subject; the
+ *  executor stamps its own retirement identity through the CORE validated builders
+ *  (`effectCancelledFactOf` / `goalCancelledResultOf` — which refuse a foreign target) and
+ *  publishes CREATE-ONLY, so a racing real completion wins by landing first and a lost create is
+ *  benign. After the hook returns, the drain RE-READS the marker — a hook that neither
+ *  established a bound terminal nor threw still fails closed. */
+export interface EffectsCancelRepair {
+    kind: "effects-cancel";
+    /** The exact completion subject: the `eff` marker, or the goal's `result` coordinate. */
+    subject: string;
+    /** The obligation key (operator-facing messages only, never authority). */
+    key: string;
+    /** True when the acceptance is an ACTION (its terminal is the goal.result `cancelled` state —
+     *  a wire shape the goal union already carries); false: the {@link EffectCancelledFact} member. */
+    goal: boolean;
+    /** The mediator-parsed, row-bound acceptance decision. */
+    acceptance: AcceptanceFact;
+}
+/** The injected ACCEPTED-EFFECTS resolution hook (§13.8): called when an accepted `effects`
+ *  route has NO durable completion marker. A composition that wires no hook fails closed. */
+export type CancelEffectsRoute = (repair: EffectsCancelRepair) => Promise<void>;
+/** What one drain pass acted on. */
+export interface DrainResult {
+    passes: number;
+    settledProvisional: number;
+    recoveredSelf: number;
+    /** Accepted epf rows whose route reconciliation this drain drove (they do not BLOCK quiescence
+     *  — their route facts track them — but their accept-side reconciliation MUST run first). */
+    reconciledAcceptedEpf: number;
+}
+/** The POLICY drain (§13.6): settles ONLY the obligations pinned to the OLD enforced policy
+ *  revision (the one being replaced), across the endpoint's whole prefix. Target-only rows and
+ *  rows pinned to a different revision are NOT this drain's concern (settling them would burn a
+ *  target-bound acceptance the policy movement does not govern, and target-only traffic would
+ *  block convergence). Run AFTER {@link stagePolicySelector} (new policy-admitted proofs are
+ *  paused, so no new old-revision row appears and the drain converges); RE-READS the govern head
+ *  after draining to confirm the stage did not move, then mints the exact-revision-bound
+ *  quiescence witness {@link promotePolicySelector} consumes. */
+export declare function drainEndpointPolicy(med: AdmissionMediator, deps?: {
+    applyCommit?: ApplyCommit;
+    reconcilePoolRoute?: ReconcilePoolRoute;
+    cancelEffectsRoute?: CancelEffectsRoute;
+}): Promise<DrainResult & {
+    quiescence: DrainQuiescence;
+}>;
+/** The RETIREMENT-side drain for THIS endpoint's rows under one target
+ *  (`oblig.<targetUid>.<endpoint>.>`): the §13.1 terminal barrier (D13 (5)) runs one per
+ *  endpoint found under the target. Both coordinates stay inside this mediator's own grant. */
+export declare function drainTargetForEndpoint(med: AdmissionMediator, targetUid: string, deps?: {
+    applyCommit?: ApplyCommit;
+    reconcilePoolRoute?: ReconcilePoolRoute;
+    cancelEffectsRoute?: CancelEffectsRoute;
+}): Promise<DrainResult>;
+//# sourceMappingURL=admission-mediator.d.ts.map

package/dist/admission-mediator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admission-mediator.d.ts","sourceRoot":"","sources":["../src/admission-mediator.ts"],"names":[],"mappings":"AAiDA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAOL,KAAK,cAAc,EAEpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAEoB,KAAK,iBAAiB,EAChD,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAmCtF;;;uFAGuF;AACvF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAsBD;;;;;;;;kFAQkF;AAClF,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,cAAc,EAClB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,cAAc,CAAA;CAAE,GAChF,OAAO,CAAC,iBAAiB,CAAC,CA2B5B;AAID;+FAC+F;AAC/F,MAAM,MAAM,WAAW,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,GAAG,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvF;;;;kFAIkF;AAClF,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,WAAW,EAAE,WAAW,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,MAAM,eAAe,GAAG,aAAa,GAAG,UAAU,GAAG,UAAU,GAAG,UAAU,CAAC;AAEnF;;yBAEyB;AACzB,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,eAAe,CAAC;IACvB,QAAQ,EAAE,KAAK,GAAG,MAAM,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,6FAA6F;IAC7F,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gFAAgF;IAChF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,MAAM,CAAC,EAAE,gBAAgB,CAAC;CAC3B;AAED;;;;mEAImE;AACnE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3F;AAGD;;;;;8EAK8E;AAC9E,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,CAQ3E;AASD;;;gGAGgG;AAChG,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAChE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;CACZ;AAyBD;+FAC+F;AAC/F,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,aAAa,CAwC9E;AAUD;;yDAEyD;AACzD,MAAM,WAAW,cAAc;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAmBD;;;;;gBAKgB;AAChB,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,iBAAiB,EACtB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,OAAO,GACb,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAgB/D;AAqCD;;;;gGAIgG;AAChG,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,iBAAiB,EACtB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,gBAAgB,EAAE,MAAM,CAAC;IAAC,qBAAqB,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,CAqBpH;AAED;;;;;;sEAMsE;AACtE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;CACtC;AAGD;;wFAEwF;AACxF,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,iBAAiB,EACtB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,eAAe,GAC1B,OAAO,CAAC;IAAE,iBAAiB,EAAE,MAAM,CAAC;IAAC,sBAAsB,EAAE,MAAM,CAAA;CAAE,CAAC,CA+BxE;AA4BD;;kEAEkE;AAClE,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAE5H;AA0CD;;;sCAGsC;AACtC,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AASD;;;0FAG0F;AAC1F,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,CAU/G;AAED;;;;;oGAKoG;AACpG,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAWvI;AAID;8EAC8E;AAC9E,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,aAAa,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,cAAc,CAAC;IACtB,MAAM,EAAE,OAAO,CAAC;CACjB;AAsDD;iDACiD;AACjD,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,iBAAiB,EACtB,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,WAAW,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC5E,OAAO,CAAC,kBAAkB,CAAC,CAqB7B;AAED;wFACwF;AACxF,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,iBAAiB,EACtB,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,WAAW,GAAG;IAAE,MAAM,EAAE,gBAAgB,CAAA;CAAE,GAC/C,OAAO,CAAC,kBAAkB,CAAC,CAwB7B;AAyGD;0DAC0D;AAC1D,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,iBAAiB,EACtB,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,UAAU,GAAG,UAAU,GAAG,iBAAiB,CAAC,CAQtD;AAUD;yFACyF;AACzF,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAoBvH;AAED;4FAC4F;AAC5F,MAAM,MAAM,WAAW,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AA8D7G;;;;qCAIqC;AACrC,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,iBAAiB,EACtB,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE;IAAE,WAAW,EAAE,WAAW,CAAA;CAAE,GACjC,OAAO,CAAC,QAAQ,GAAG,YAAY,GAAG,YAAY,CAAC,CAEjD;AAkDD,2EAA2E;AAC3E,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,aAAa,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;qDAWqD;AACrD,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAQjC;AAMD;;;;;;oDAMoD;AACpD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,0FAA0F;IAC1F,OAAO,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,KAAK,EAAE,UAAU,CAAC;IAClB,mGAAmG;IACnG,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;oGAEoG;AACpG,MAAM,MAAM,kBAAkB,GAAG,CAAC,MAAM,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAE5E;;;;;;iEAMiE;AACjE,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,gBAAgB,CAAC;IACvB,yFAAyF;IACzF,OAAO,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,GAAG,EAAE,MAAM,CAAC;IACZ;uGACmG;IACnG,IAAI,EAAE,OAAO,CAAC;IACd,0DAA0D;IAC1D,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED;6FAC6F;AAC7F,MAAM,MAAM,kBAAkB,GAAG,CAAC,MAAM,EAAE,mBAAmB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAEhF,oCAAoC;AACpC,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,EAAE,MAAM,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB;iGAC6F;IAC7F,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAgKD;;;;;;;iEAOiE;AACjE,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,iBAAiB,EACtB,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,WAAW,CAAC;IAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;CAAO,GACzH,OAAO,CAAC,WAAW,GAAG;IAAE,UAAU,EAAE,eAAe,CAAA;CAAE,CAAC,CA+BxD;AAED;;+FAE+F;AAC/F,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,iBAAiB,EACtB,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,WAAW,CAAC;IAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;CAAO,GACzH,OAAO,CAAC,WAAW,CAAC,CAKtB"}