@cotal-ai/auth 0.90.0 → 0.91.0

package/dist/chat-session-store.d.ts

@@ -0,0 +1,126 @@
+import type { KV } from "@nats-io/kv";
+import type { JetStreamManager } from "@nats-io/jetstream";
+import { EpEnvelopeError } from "@cotal-ai/core";
+export declare const CHAT_HOLDER_PREFIX = "chatholder";
+export declare const CHAT_OWNER_PREFIX = "chatowner";
+export declare const CHAT_SWEEP_CURSOR_KEY = "chatsweep.cursor";
+/** At most 16 non-retired sessions per owner. */
+export declare const CHAT_LIVE_MAX = 16;
+/** At most 10 admissions per fixed 60 s window, never refunded. */
+export declare const CHAT_WINDOW_MS = 60000;
+export declare const CHAT_WINDOW_MAX = 10;
+/** Bounded reservation attempts, each from a fresh leader read. */
+export declare const CHAT_QUOTA_ATTEMPTS = 3;
+/** Draw a fresh server-side chat actor `chat_<26 base32>` (130 bits). The caller never chooses it. */
+export declare function drawChatActor(): string;
+export declare function chatHolderKey(owner: string, holderHash: string): string;
+export declare function chatOwnerKey(owner: string): string;
+/** The closed set of KV publish subjects the chat writer needs (for the trusted writer's grant
+ *  builder). Exact-arity wildcards only: never `.>` on a family that could later gain children. */
+export declare function chatAuthorityWriteSubjects(space: string): string[];
+export type ChatHolderState = "reserved" | "provisioning" | "active" | "retired";
+export type ChatRetiredBy = "sweep" | "close" | "rollback";
+export interface ChatCeiling {
+    read: string[];
+    post: string[];
+}
+/** The closed `IDX` value. `parentPinDigest` is null ONLY on the sweep's S1 fence of an
+ *  absent index, which is born `retired` with a null UID. */
+export interface ChatHolderIndex {
+    v: 1;
+    state: ChatHolderState;
+    actor: string;
+    lifecycleUid: string | null;
+    reservedAt: number;
+    expiresAt: number;
+    ceiling: ChatCeiling;
+    parentPinDigest: string | null;
+    retiredBy?: ChatRetiredBy;
+}
+export interface Versioned<T> {
+    value: T;
+    revision: number;
+}
+export declare function parseChatHolderIndex(raw: unknown, key: string): ChatHolderIndex;
+export interface ChatQuotaEntry {
+    holderHash: string;
+    actor: string;
+    reservedAt: number;
+}
+export interface ChatOwnerQuota {
+    v: 1;
+    live: ChatQuotaEntry[];
+    window: {
+        startMs: number;
+        count: number;
+    };
+}
+export declare function parseChatOwnerQuota(raw: unknown, key: string): ChatOwnerQuota;
+export interface ChatSweepCursor {
+    v: 1;
+    /** The last fully classified chat-session row file name ("" = start). */
+    rowName: string;
+    /** The auth-stream sequence of the last fully classified holder index (0 = start). */
+    holderSeq: number;
+}
+export declare function parseChatSweepCursor(raw: unknown): ChatSweepCursor;
+/** An outcome the caller must resolve by re-reading: the write may or may not have landed. */
+export declare function unknownOutcome(what: string, cause: unknown): EpEnvelopeError;
+export interface QuotaReservation {
+    actor: string;
+    reservedAt: number;
+    /** True when an existing entry for this holderHash was found and reused. */
+    reused: boolean;
+}
+/** One scanned record from a bounded leader-served discovery page. */
+export interface ScannedChatRecord {
+    key: string;
+    seq: number;
+}
+/**
+ * The sealed chat authority store. Constructed only over the trusted auth path's own auth-store KV
+ * (`registryStores(reg).authKv`) and its JetStream manager; it adds no connection or grant.
+ */
+export interface ChatAuthorityStore {
+    readHolder(owner: string, holderHash: string): Promise<Versioned<ChatHolderIndex> | undefined>;
+    /** a2: create-only `reserved`. `lost` = another writer's index exists (the retry path). */
+    createHolderReserved(owner: string, holderHash: string, value: ChatHolderIndex): Promise<{
+        created: true;
+        revision: number;
+    } | {
+        created: false;
+    }>;
+    /** S1 for an absent index: create-only `retired`, null UID. `lost` = an admission created it first. */
+    createHolderFence(owner: string, holderHash: string, entry: ChatQuotaEntry): Promise<{
+        created: true;
+        revision: number;
+    } | {
+        created: false;
+    }>;
+    /** Pinned CAS on an existing index; checks the transition table first. `conflict` on a
+     *  moved revision; an unknown broker outcome throws `unknownOutcome`. */
+    casHolder(owner: string, holderHash: string, from: Versioned<ChatHolderIndex>, to: ChatHolderIndex): Promise<Versioned<ChatHolderIndex>>;
+    readQuota(owner: string): Promise<Versioned<ChatOwnerQuota> | undefined>;
+    /** a1: reserve or reuse this holder's live entry. Refuses `conflict` (16 live) or
+     *  `resource-exhausted` (window); exhausted attempts are UNKNOWN, never a refusal. */
+    reserveQuota(owner: string, holderHash: string, now: number): Promise<QuotaReservation>;
+    /** S3: remove this holder's entry, pinned on the revision whose entry the caller classified. */
+    releaseQuotaEntry(owner: string, holderHash: string, observed: Versioned<ChatOwnerQuota>): Promise<"released" | "absent">;
+    /** Reconcile: rewrite this holder's entry actor to the index actor; the slot stays counted. */
+    rewriteQuotaEntryActor(owner: string, holderHash: string, actor: string, observed: Versioned<ChatOwnerQuota>): Promise<"rewritten" | "absent">;
+    readCursor(): Promise<Versioned<ChatSweepCursor> | undefined>;
+    /** Pinned CAS (create-only when `observed` is undefined). `conflict` = a peer advanced it. */
+    casCursor(observed: Versioned<ChatSweepCursor> | undefined, next: ChatSweepCursor): Promise<number>;
+    /** A bounded leader-served discovery page (`STREAM.MSG.GET next_by_subj`, no consumer: none may
+     *  be created on the auth stream). Returns at most `limit` live keys after `afterSeq`. */
+    scanPage(family: "holder" | "owner", afterSeq: number, limit: number): Promise<ScannedChatRecord[]>;
+}
+export declare function openChatAuthorityStore(kv: KV, jsm: JetStreamManager, space: string): ChatAuthorityStore;
+/** Parse a scanned holder key back to its coordinates; anything else refuses. */
+export declare function parseChatHolderKey(key: string): {
+    owner: string;
+    holderHash: string;
+};
+/** Parse a scanned owner-quota key back to its owner; anything else refuses. */
+export declare function parseChatOwnerKey(key: string): string;
+//# sourceMappingURL=chat-session-store.d.ts.map

package/dist/chat-session-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chat-session-store.d.ts","sourceRoot":"","sources":["../src/chat-session-store.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,EAAE,EAAW,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,gBAAgB,EAAc,MAAM,oBAAoB,CAAC;AACvE,OAAO,EACL,eAAe,EAMhB,MAAM,gBAAgB,CAAC;AAGxB,eAAO,MAAM,kBAAkB,eAAe,CAAC;AAC/C,eAAO,MAAM,iBAAiB,cAAc,CAAC;AAC7C,eAAO,MAAM,qBAAqB,qBAAqB,CAAC;AAExD,iDAAiD;AACjD,eAAO,MAAM,aAAa,KAAK,CAAC;AAChC,mEAAmE;AACnE,eAAO,MAAM,cAAc,QAAS,CAAC;AACrC,eAAO,MAAM,eAAe,KAAK,CAAC;AAClC,mEAAmE;AACnE,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAUrC,sGAAsG;AACtG,wBAAgB,aAAa,IAAI,MAAM,CAatC;AAID,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAElD;AAED;mGACmG;AACnG,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAGlE;AAID,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,cAAc,GAAG,QAAQ,GAAG,SAAS,CAAC;AACjF,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,CAAC;AAI3D,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED;6DAC6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,CAAC,EAAE,CAAC,CAAC;IACL,KAAK,EAAE,eAAe,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,WAAW,CAAC;IACrB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED,MAAM,WAAW,SAAS,CAAC,CAAC;IAC1B,KAAK,EAAE,CAAC,CAAC;IACT,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,eAAe,CAgC/E;AA2BD,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,cAAc,EAAE,CAAC;IACvB,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5C;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,cAAc,CAmB7E;AAID,MAAM,WAAW,eAAe;IAC9B,CAAC,EAAE,CAAC,CAAC;IACL,yEAAyE;IACzE,OAAO,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,eAAe,CAIlE;AAID,8FAA8F;AAC9F,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,eAAe,CAI5E;AAaD,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,sEAAsE;AACtE,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,eAAe,CAAC,GAAG,SAAS,CAAC,CAAC;IAC/F,2FAA2F;IAC3F,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAC,CAAC;IACnJ,uGAAuG;IACvG,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CAAC,CAAC;IAC/I;6EACyE;IACzE,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,eAAe,GAAG,OAAO,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,CAAC;IACzI,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,cAAc,CAAC,GAAG,SAAS,CAAC,CAAC;IACzE;0FACsF;IACtF,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACxF,gGAAgG;IAChG,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,cAAc,CAAC,GAAG,OAAO,CAAC,UAAU,GAAG,QAAQ,CAAC,CAAC;IAC1H,+FAA+F;IAC/F,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,cAAc,CAAC,GAAG,OAAO,CAAC,WAAW,GAAG,QAAQ,CAAC,CAAC;IAC/I,UAAU,IAAI,OAAO,CAAC,SAAS,CAAC,eAAe,CAAC,GAAG,SAAS,CAAC,CAAC;IAC9D,8FAA8F;IAC9F,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,eAAe,CAAC,GAAG,SAAS,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpG;8FAC0F;IAC1F,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;CACrG;AAED,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,GAAG,kBAAkB,CA2JvG;AAED,iFAAiF;AACjF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAIrF;AAED,gFAAgF;AAChF,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAIrD"}

package/dist/chat-session-store.js

@@ -0,0 +1,392 @@
+/**
+ * The chat-session AUTHORITY RECORDS in the ep-auth KV (`KV_cotal_auth_<space>`, `allow_direct=false`,
+ * so every `kv.get` here is the leader-served `STREAM.MSG.GET last_by_subj` read): the holder index, owner quota and sweep cursor.
+ *
+ *  - holder index `IDX` = `chatholder.<owner>.<holderHash>`: create-only, then revision-pinned CAS for
+ *    every state change, NEVER deleted (one holderHash admits at most once for the life of the
+ *    space);
+ *  - owner quota `Q` = `chatowner.<owner>`: create-only when absent, then revision-pinned CAS; at
+ *    most one `live` entry per holderHash; a fixed 60 s rate window that is never refunded;
+ *  - sweep cursor = `chatsweep.cursor`: discovery position only, revision-pinned CAS.
+ *
+ * Writers: chat admission and the sweep, both inside the trusted auth process. No leaf, agent,
+ * endpoint or operator credential holds any grant on these keys.
+ *
+ * Every value is a CLOSED schema: unknown fields, a DEL/PURGE marker or a key/value mismatch refuse
+ * loudly (garbled trusted-path state never authorizes, SPEC 13.1). Every write uses core's
+ * `createRecordEntry`/`updateRecordEntry` (the §13.8 create-only/pinned-CAS discipline), so a CAS
+ * loss is a typed `conflict`, and every other broker failure is an UNKNOWN outcome that the caller
+ * resolves by re-reading, never by assuming.
+ */
+import { randomBytes } from "node:crypto";
+import { EpEnvelopeError, assertDerivedOwnerToken, assertLifecycleToken, createRecordEntry, epAuthBucket, updateRecordEntry, } from "@cotal-ai/core";
+import { assertChatActor, assertChatList, assertHolderHash, CHAT_SESSION_MAX_TTL_MS } from "./chat-session-row.js";
+export const CHAT_HOLDER_PREFIX = "chatholder";
+export const CHAT_OWNER_PREFIX = "chatowner";
+export const CHAT_SWEEP_CURSOR_KEY = "chatsweep.cursor";
+/** At most 16 non-retired sessions per owner. */
+export const CHAT_LIVE_MAX = 16;
+/** At most 10 admissions per fixed 60 s window, never refunded. */
+export const CHAT_WINDOW_MS = 60_000;
+export const CHAT_WINDOW_MAX = 10;
+/** Bounded reservation attempts, each from a fresh leader read. */
+export const CHAT_QUOTA_ATTEMPTS = 3;
+const HEX64 = /^[0-9a-f]{64}$/;
+const B32 = "abcdefghijklmnopqrstuvwxyz234567";
+const isRec = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+const epochMs = (v) => typeof v === "number" && Number.isSafeInteger(v) && v > 0;
+const uint = (v) => typeof v === "number" && Number.isSafeInteger(v) && v >= 0;
+const closedKeys = (o, required, optional = []) => required.every((k) => k in o) && Object.keys(o).every((k) => required.includes(k) || optional.includes(k));
+/** Draw a fresh server-side chat actor `chat_<26 base32>` (130 bits). The caller never chooses it. */
+export function drawChatActor() {
+    const bytes = randomBytes(17);
+    let bits = 0, acc = 0, out = "";
+    for (const b of bytes) {
+        acc = (acc << 8) | b;
+        bits += 8;
+        while (bits >= 5 && out.length < 26) {
+            out += B32[(acc >>> (bits - 5)) & 31];
+            bits -= 5;
+        }
+        acc &= (1 << bits) - 1;
+    }
+    return assertChatActor(`chat_${out}`);
+}
+// ---- keys ----------------------------------------------------------------------------------
+export function chatHolderKey(owner, holderHash) {
+    return `${CHAT_HOLDER_PREFIX}.${assertDerivedOwnerToken(owner)}.${assertHolderHash(holderHash)}`;
+}
+export function chatOwnerKey(owner) {
+    return `${CHAT_OWNER_PREFIX}.${assertDerivedOwnerToken(owner)}`;
+}
+/** The closed set of KV publish subjects the chat writer needs (for the trusted writer's grant
+ *  builder). Exact-arity wildcards only: never `.>` on a family that could later gain children. */
+export function chatAuthorityWriteSubjects(space) {
+    const b = epAuthBucket(space);
+    return [`$KV.${b}.${CHAT_HOLDER_PREFIX}.*.*`, `$KV.${b}.${CHAT_OWNER_PREFIX}.*`, `$KV.${b}.${CHAT_SWEEP_CURSOR_KEY}`];
+}
+const HOLDER_STATES = new Set(["reserved", "provisioning", "active", "retired"]);
+const RETIRED_BY = new Set(["sweep", "close", "rollback"]);
+export function parseChatHolderIndex(raw, key) {
+    const bad = (why) => {
+        throw new EpEnvelopeError("internal", `the chat holder index ${key} ${why}; garbled trusted-path state never authorizes`);
+    };
+    if (!isRec(raw))
+        bad("is not an object");
+    const o = raw;
+    if (!closedKeys(o, ["v", "state", "actor", "lifecycleUid", "reservedAt", "expiresAt", "ceiling", "parentPinDigest"], ["retiredBy"]))
+        bad(`carries fields ${JSON.stringify(Object.keys(o).sort())} outside the closed set`);
+    if (o.v !== 1)
+        bad("has an unknown version");
+    if (typeof o.state !== "string" || !HOLDER_STATES.has(o.state))
+        bad("has an unknown state");
+    try {
+        assertChatActor(o.actor);
+    }
+    catch {
+        bad("names a malformed actor");
+    }
+    if (o.lifecycleUid !== null) {
+        if (typeof o.lifecycleUid !== "string")
+            bad("has a malformed lifecycleUid");
+        try {
+            assertLifecycleToken(o.lifecycleUid);
+        }
+        catch {
+            bad("has a malformed lifecycleUid");
+        }
+    }
+    if (!epochMs(o.reservedAt) || !epochMs(o.expiresAt) || o.expiresAt < o.reservedAt ||
+        o.expiresAt - o.reservedAt > CHAT_SESSION_MAX_TTL_MS)
+        bad("has malformed reservedAt/expiresAt");
+    if (!isRec(o.ceiling) || !closedKeys(o.ceiling, ["read", "post"]))
+        bad("has a malformed ceiling");
+    try {
+        assertChatList(o.ceiling.read, "ceiling.read");
+        assertChatList(o.ceiling.post, "ceiling.post");
+    }
+    catch {
+        bad("has a malformed ceiling list");
+    }
+    if (o.state === "retired") {
+        if (typeof o.retiredBy !== "string" || !RETIRED_BY.has(o.retiredBy))
+            bad("is retired without retiredBy");
+    }
+    else if (o.retiredBy !== undefined)
+        bad(`is ${String(o.state)} but carries retiredBy`);
+    if (o.state === "provisioning" || o.state === "active") {
+        if (o.lifecycleUid === null)
+            bad(`is ${String(o.state)} without a lifecycleUid`);
+    }
+    if (o.parentPinDigest === null) {
+        if (!(o.state === "retired" && o.retiredBy === "sweep" && o.lifecycleUid === null))
+            bad("has a null parentPinDigest outside the sweep fence");
+    }
+    else if (typeof o.parentPinDigest !== "string" || !HEX64.test(o.parentPinDigest))
+        bad("has a malformed parentPinDigest");
+    return o;
+}
+/** The holder-index transition table, plus the immutables every CAS preserves. */
+function assertHolderTransition(from, to, key) {
+    const refuse = (why) => {
+        throw new EpEnvelopeError("failed-precondition", `chat holder index ${key}: ${from.state} -> ${to.state} refused (${why})`);
+    };
+    if (from.actor !== to.actor || from.reservedAt !== to.reservedAt || from.expiresAt !== to.expiresAt ||
+        from.parentPinDigest !== to.parentPinDigest || JSON.stringify(from.ceiling) !== JSON.stringify(to.ceiling))
+        refuse("an immutable field changed");
+    if (from.state === "retired")
+        refuse("retired is terminal");
+    if (to.state === "retired") {
+        if (to.lifecycleUid !== from.lifecycleUid)
+            refuse("retirement keeps the bound UID");
+        return;
+    }
+    if (from.state === "reserved" && to.state === "reserved") {
+        if (from.lifecycleUid !== null || to.lifecycleUid === null)
+            refuse("lifecycleUid is set once, from null");
+        return;
+    }
+    if (to.lifecycleUid !== from.lifecycleUid)
+        refuse("the UID never changes after it is bound");
+    if (from.state === "reserved" && to.state === "provisioning")
+        return;
+    if (from.state === "provisioning" && to.state === "active")
+        return;
+    refuse("not an allowed transition");
+}
+export function parseChatOwnerQuota(raw, key) {
+    const bad = (why) => {
+        throw new EpEnvelopeError("internal", `the chat owner quota ${key} ${why}; garbled trusted-path state never authorizes`);
+    };
+    if (!isRec(raw) || !closedKeys(raw, ["v", "live", "window"]) || raw.v !== 1)
+        bad("is not the closed v1 record");
+    const o = raw;
+    if (!Array.isArray(o.live) || o.live.length > CHAT_LIVE_MAX)
+        bad(`live must hold at most ${CHAT_LIVE_MAX} entries`);
+    const seen = new Set();
+    for (const e of o.live) {
+        if (!isRec(e) || !closedKeys(e, ["holderHash", "actor", "reservedAt"]) || typeof e.holderHash !== "string" || !HEX64.test(e.holderHash) || !epochMs(e.reservedAt))
+            bad("carries a malformed live entry");
+        try {
+            assertChatActor(e.actor);
+        }
+        catch {
+            bad("carries a live entry with a malformed actor");
+        }
+        const h = e.holderHash;
+        if (seen.has(h))
+            bad("carries two live entries for one holderHash");
+        seen.add(h);
+    }
+    if (!isRec(o.window) || !closedKeys(o.window, ["startMs", "count"]) || !uint(o.window.startMs) || !uint(o.window.count) || o.window.count > CHAT_WINDOW_MAX)
+        bad("has a malformed window");
+    return o;
+}
+export function parseChatSweepCursor(raw) {
+    if (!isRec(raw) || !closedKeys(raw, ["v", "rowName", "holderSeq"]) || raw.v !== 1 || typeof raw.rowName !== "string" || raw.rowName.length > 256 || !uint(raw.holderSeq))
+        throw new EpEnvelopeError("internal", `the chat sweep cursor ${CHAT_SWEEP_CURSOR_KEY} is not the closed v1 record`);
+    return raw;
+}
+// ---- the store ------------------------------------------------------------------------------
+/** An outcome the caller must resolve by re-reading: the write may or may not have landed. */
+export function unknownOutcome(what, cause) {
+    const err = new EpEnvelopeError("unavailable", `${what}: the write's outcome is unknown (${cause?.message ?? String(cause)}); retry with the same holder to resolve it`, undefined, "unknown");
+    err.cause = cause;
+    return err;
+}
+const isConflict = (e) => e instanceof EpEnvelopeError && e.code === "conflict";
+function decode(entry, key, parse) {
+    if (entry === null)
+        return undefined;
+    if (entry.operation !== "PUT")
+        throw new EpEnvelopeError("failed-precondition", `${key} carries a ${entry.operation} marker; a chat authority record is never deleted, so this is corruption (SPEC 13.12)`);
+    let raw;
+    try {
+        raw = JSON.parse(new TextDecoder().decode(entry.value));
+    }
+    catch {
+        throw new EpEnvelopeError("internal", `${key} is not JSON`);
+    }
+    return { value: parse(raw, key), revision: entry.revision };
+}
+export function openChatAuthorityStore(kv, jsm, space) {
+    const readHolder = async (owner, h) => {
+        const key = chatHolderKey(owner, h);
+        return decode(await kv.get(key), key, parseChatHolderIndex);
+    };
+    const readQuota = async (owner) => {
+        const key = chatOwnerKey(owner);
+        return decode(await kv.get(key), key, parseChatOwnerQuota);
+    };
+    const createOnly = async (key, value) => {
+        try {
+            return { created: true, revision: await createRecordEntry(kv, key, value) };
+        }
+        catch (e) {
+            if (isConflict(e))
+                return { created: false };
+            throw unknownOutcome(`create of ${key}`, e);
+        }
+    };
+    const writeQuota = async (owner, observed, next) => {
+        const key = chatOwnerKey(owner);
+        parseChatOwnerQuota(next, key);
+        try {
+            return observed === undefined ? await createRecordEntry(kv, key, next) : await updateRecordEntry(kv, key, next, observed.revision);
+        }
+        catch (e) {
+            if (isConflict(e))
+                throw e;
+            throw unknownOutcome(`write of ${key}`, e);
+        }
+    };
+    return {
+        readHolder,
+        readQuota,
+        async createHolderReserved(owner, h, value) {
+            const key = chatHolderKey(owner, h);
+            if (value.state !== "reserved" || value.lifecycleUid !== null || value.retiredBy !== undefined)
+                throw new EpEnvelopeError("internal", `${key}: an admission index is born reserved with a null UID`);
+            parseChatHolderIndex(value, key);
+            return createOnly(key, value);
+        },
+        async createHolderFence(owner, h, entry) {
+            const key = chatHolderKey(owner, h);
+            if (entry.holderHash !== h)
+                throw new EpEnvelopeError("internal", `${key}: the fence names another holder`);
+            const fence = {
+                v: 1, state: "retired", actor: entry.actor, lifecycleUid: null, reservedAt: entry.reservedAt, expiresAt: entry.reservedAt,
+                ceiling: { read: [], post: [] }, parentPinDigest: null, retiredBy: "sweep",
+            };
+            parseChatHolderIndex(fence, key);
+            return createOnly(key, fence);
+        },
+        async casHolder(owner, h, from, to) {
+            const key = chatHolderKey(owner, h);
+            parseChatHolderIndex(to, key);
+            assertHolderTransition(from.value, to, key);
+            try {
+                return { value: to, revision: await updateRecordEntry(kv, key, to, from.revision) };
+            }
+            catch (e) {
+                if (isConflict(e))
+                    throw e;
+                throw unknownOutcome(`CAS of ${key}`, e);
+            }
+        },
+        async reserveQuota(owner, h, now) {
+            assertHolderHash(h);
+            if (!epochMs(now))
+                throw new EpEnvelopeError("internal", "reserveQuota needs the authority clock");
+            let lastUnknown;
+            for (let attempt = 0; attempt < CHAT_QUOTA_ATTEMPTS; attempt++) {
+                const observed = await readQuota(owner);
+                const q = observed?.value ?? { v: 1, live: [], window: { startMs: 0, count: 0 } };
+                const mine = q.live.find((e) => e.holderHash === h);
+                // The reservation landed (this attempt's predecessor, an unknown ack, or a concurrent same-
+                // holder admission): reuse it, never add a second entry, never count it twice.
+                if (mine)
+                    return { actor: mine.actor, reservedAt: mine.reservedAt, reused: true };
+                if (q.live.length >= CHAT_LIVE_MAX) {
+                    const oldest = [...q.live].sort((a, b) => a.reservedAt - b.reservedAt)[0];
+                    throw new EpEnvelopeError("conflict", `owner ${owner} already holds ${CHAT_LIVE_MAX} chat sessions; the oldest is ${oldest.actor} (reserved ${new Date(oldest.reservedAt).toISOString()}). Close one, or wait for it to expire, then open again`);
+                }
+                const current = now - q.window.startMs < CHAT_WINDOW_MS && q.window.startMs <= now;
+                if (current && q.window.count >= CHAT_WINDOW_MAX)
+                    throw new EpEnvelopeError("resource-exhausted", `owner ${owner} opened ${CHAT_WINDOW_MAX} chat sessions in this minute; retry after ${new Date(q.window.startMs + CHAT_WINDOW_MS).toISOString()}`);
+                const entry = { holderHash: h, actor: drawChatActor(), reservedAt: now };
+                const next = {
+                    v: 1,
+                    live: [...q.live, entry],
+                    window: current ? { startMs: q.window.startMs, count: q.window.count + 1 } : { startMs: now, count: 1 },
+                };
+                try {
+                    await writeQuota(owner, observed, next);
+                    return { actor: entry.actor, reservedAt: entry.reservedAt, reused: false };
+                }
+                catch (e) {
+                    if (isConflict(e))
+                        continue; // a peer moved Q: re-read and re-decide
+                    lastUnknown = e; // unknown ack: the next leader read decides whether it landed
+                }
+            }
+            // Exhausted. Never a refusal that could hide a landed reservation.
+            throw unknownOutcome(`chat quota reservation for owner ${owner}`, lastUnknown ?? new Error("the quota record kept moving"));
+        },
+        async releaseQuotaEntry(owner, h, observed) {
+            const live = observed.value.live.filter((e) => e.holderHash !== h);
+            if (live.length === observed.value.live.length)
+                return "absent";
+            await writeQuota(owner, observed, { ...observed.value, live });
+            return "released";
+        },
+        async rewriteQuotaEntryActor(owner, h, actor, observed) {
+            assertChatActor(actor);
+            const at = observed.value.live.findIndex((e) => e.holderHash === h);
+            if (at < 0)
+                return "absent";
+            const live = observed.value.live.map((e, i) => (i === at ? { ...e, actor } : e));
+            await writeQuota(owner, observed, { ...observed.value, live });
+            return "rewritten";
+        },
+        async readCursor() {
+            return decode(await kv.get(CHAT_SWEEP_CURSOR_KEY), CHAT_SWEEP_CURSOR_KEY, (raw) => parseChatSweepCursor(raw));
+        },
+        async casCursor(observed, next) {
+            parseChatSweepCursor(next);
+            try {
+                return observed === undefined
+                    ? await createRecordEntry(kv, CHAT_SWEEP_CURSOR_KEY, next)
+                    : await updateRecordEntry(kv, CHAT_SWEEP_CURSOR_KEY, next, observed.revision);
+            }
+            catch (e) {
+                if (isConflict(e))
+                    throw e;
+                throw unknownOutcome(`CAS of ${CHAT_SWEEP_CURSOR_KEY}`, e);
+            }
+        },
+        async scanPage(family, afterSeq, limit) {
+            if (!uint(afterSeq) || !Number.isSafeInteger(limit) || limit < 1)
+                throw new EpEnvelopeError("bad-request", "scanPage needs a sequence and a positive limit");
+            const bucket = epAuthBucket(space);
+            const prefix = `$KV.${bucket}.`;
+            const filter = family === "holder" ? `${prefix}${CHAT_HOLDER_PREFIX}.*.*` : `${prefix}${CHAT_OWNER_PREFIX}.*`;
+            const out = [];
+            let seq = afterSeq + 1;
+            while (out.length < limit) {
+                let m;
+                try {
+                    m = await jsm.streams.getMessage(`KV_${bucket}`, { seq, next_by_subj: filter });
+                }
+                catch (e) {
+                    if (e.code === 10037)
+                        break; // no further message on the filter
+                    throw e;
+                }
+                if (!m)
+                    break;
+                seq = m.seq + 1;
+                const op = m.header?.get("KV-Operation");
+                if (op)
+                    throw new EpEnvelopeError("failed-precondition", `${m.subject} carries a ${op} marker; chat authority records are never deleted (SPEC 13.12)`);
+                out.push({ key: m.subject.slice(prefix.length), seq: m.seq });
+            }
+            return out;
+        },
+    };
+}
+/** Parse a scanned holder key back to its coordinates; anything else refuses. */
+export function parseChatHolderKey(key) {
+    const parts = key.split(".");
+    if (parts.length !== 3 || parts[0] !== CHAT_HOLDER_PREFIX)
+        throw new EpEnvelopeError("internal", `${key} is not a chat holder key`);
+    return { owner: assertDerivedOwnerToken(parts[1]), holderHash: assertHolderHash(parts[2]) };
+}
+/** Parse a scanned owner-quota key back to its owner; anything else refuses. */
+export function parseChatOwnerKey(key) {
+    const parts = key.split(".");
+    if (parts.length !== 2 || parts[0] !== CHAT_OWNER_PREFIX)
+        throw new EpEnvelopeError("internal", `${key} is not a chat owner key`);
+    return assertDerivedOwnerToken(parts[1]);
+}
+//# sourceMappingURL=chat-session-store.js.map

package/dist/chat-session-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chat-session-store.js","sourceRoot":"","sources":["../src/chat-session-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAEnH,MAAM,CAAC,MAAM,kBAAkB,GAAG,YAAY,CAAC;AAC/C,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAC;AAC7C,MAAM,CAAC,MAAM,qBAAqB,GAAG,kBAAkB,CAAC;AAExD,iDAAiD;AACjD,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC;AAChC,mEAAmE;AACnE,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AACrC,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAClC,mEAAmE;AACnE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC,MAAM,KAAK,GAAG,gBAAgB,CAAC;AAC/B,MAAM,GAAG,GAAG,kCAAkC,CAAC;AAC/C,MAAM,KAAK,GAAG,CAAC,CAAU,EAAgC,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACrH,MAAM,OAAO,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvG,MAAM,IAAI,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrG,MAAM,UAAU,GAAG,CAAC,CAA0B,EAAE,QAAkB,EAAE,WAAqB,EAAE,EAAW,EAAE,CACtG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAE7G,sGAAsG;AACtG,MAAM,UAAU,aAAa;IAC3B,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC9B,IAAI,IAAI,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACrB,IAAI,IAAI,CAAC,CAAC;QACV,OAAO,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACpC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YACtC,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;QACD,GAAG,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,eAAe,CAAC,QAAQ,GAAG,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,+FAA+F;AAE/F,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,UAAkB;IAC7D,OAAO,GAAG,kBAAkB,IAAI,uBAAuB,CAAC,KAAK,CAAC,IAAI,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC;AACnG,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,GAAG,iBAAiB,IAAI,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;AAClE,CAAC;AAED;mGACmG;AACnG,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACtD,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,CAAC,OAAO,CAAC,IAAI,kBAAkB,MAAM,EAAE,OAAO,CAAC,IAAI,iBAAiB,IAAI,EAAE,OAAO,CAAC,IAAI,qBAAqB,EAAE,CAAC,CAAC;AACxH,CAAC;AAMD,MAAM,aAAa,GAAwB,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AACtG,MAAM,UAAU,GAAwB,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;AA0BhF,MAAM,UAAU,oBAAoB,CAAC,GAAY,EAAE,GAAW;IAC5D,MAAM,GAAG,GAAG,CAAC,GAAW,EAAS,EAAE;QACjC,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,yBAAyB,GAAG,IAAI,GAAG,+CAA+C,CAAC,CAAC;IAC5H,CAAC,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;QAAE,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACzC,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,iBAAiB,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC;QACjI,GAAG,CAAC,kBAAkB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,yBAAyB,CAAC,CAAC;IACxF,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,GAAG,CAAC,wBAAwB,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAC5F,IAAI,CAAC;QAAC,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAAC,CAAC;IAC3E,IAAI,CAAC,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ;YAAE,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAC5E,IAAI,CAAC;YAAC,oBAAoB,CAAC,CAAC,CAAC,YAAsB,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAAC,CAAC;IACxG,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,IAAK,CAAC,CAAC,SAAoB,GAAI,CAAC,CAAC,UAAqB;QACtG,CAAC,CAAC,SAAoB,GAAI,CAAC,CAAC,UAAqB,GAAG,uBAAuB;QAAE,GAAG,CAAC,oCAAoC,CAAC,CAAC;IAC1H,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAkC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAE,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAC7H,IAAI,CAAC;QACH,cAAc,CAAE,CAAC,CAAC,OAAmC,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAC5E,cAAc,CAAE,CAAC,CAAC,OAAmC,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAAC,CAAC;IAChD,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;YAAE,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC3G,CAAC;SAAM,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;QAAE,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACzF,IAAI,CAAC,CAAC,KAAK,KAAK,cAAc,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvD,IAAI,CAAC,CAAC,YAAY,KAAK,IAAI;YAAE,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,KAAK,OAAO,IAAI,CAAC,CAAC,YAAY,KAAK,IAAI,CAAC;YAAE,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAChJ,CAAC;SAAM,IAAI,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC;QAAE,GAAG,CAAC,iCAAiC,CAAC,CAAC;IAC3H,OAAO,CAA+B,CAAC;AACzC,CAAC;AAED,kFAAkF;AAClF,SAAS,sBAAsB,CAAC,IAAqB,EAAE,EAAmB,EAAE,GAAW;IACrF,MAAM,MAAM,GAAG,CAAC,GAAW,EAAS,EAAE;QACpC,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,qBAAqB,GAAG,KAAK,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC,KAAK,aAAa,GAAG,GAAG,CAAC,CAAC;IAC9H,CAAC,CAAC;IACF,IAAI,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,UAAU,KAAK,EAAE,CAAC,UAAU,IAAI,IAAI,CAAC,SAAS,KAAK,EAAE,CAAC,SAAS;QACjG,IAAI,CAAC,eAAe,KAAK,EAAE,CAAC,eAAe,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC;QAC1G,MAAM,CAAC,4BAA4B,CAAC,CAAC;IACvC,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAC5D,IAAI,EAAE,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,EAAE,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY;YAAE,MAAM,CAAC,gCAAgC,CAAC,CAAC;QACpF,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,UAAU,IAAI,EAAE,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QACzD,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,IAAI,EAAE,CAAC,YAAY,KAAK,IAAI;YAAE,MAAM,CAAC,qCAAqC,CAAC,CAAC;QAC1G,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY;QAAE,MAAM,CAAC,yCAAyC,CAAC,CAAC;IAC7F,IAAI,IAAI,CAAC,KAAK,KAAK,UAAU,IAAI,EAAE,CAAC,KAAK,KAAK,cAAc;QAAE,OAAO;IACrE,IAAI,IAAI,CAAC,KAAK,KAAK,cAAc,IAAI,EAAE,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO;IACnE,MAAM,CAAC,2BAA2B,CAAC,CAAC;AACtC,CAAC;AAgBD,MAAM,UAAU,mBAAmB,CAAC,GAAY,EAAE,GAAW;IAC3D,MAAM,GAAG,GAAG,CAAC,GAAW,EAAS,EAAE;QACjC,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,wBAAwB,GAAG,IAAI,GAAG,+CAA+C,CAAC,CAAC;IAC3H,CAAC,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC;QAAE,GAAG,CAAC,6BAA6B,CAAC,CAAC;IAChH,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,aAAa;QAAE,GAAG,CAAC,0BAA0B,aAAa,UAAU,CAAC,CAAC;IACpH,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,IAAiB,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,YAAY,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;YAC/J,GAAG,CAAC,gCAAgC,CAAC,CAAC;QACxC,IAAI,CAAC;YAAC,eAAe,CAAE,CAA6B,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;QAAC,CAAC;QAC5H,MAAM,CAAC,GAAI,CAA6B,CAAC,UAAoB,CAAC;QAC9D,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,6CAA6C,CAAC,CAAC;QACpE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAK,CAAC,CAAC,MAAM,CAAC,KAAgB,GAAG,eAAe;QACrK,GAAG,CAAC,wBAAwB,CAAC,CAAC;IAChC,OAAO,CAA8B,CAAC;AACxC,CAAC;AAYD,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;QACtK,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,yBAAyB,qBAAqB,8BAA8B,CAAC,CAAC;IACtH,OAAO,GAAiC,CAAC;AAC3C,CAAC;AAED,gGAAgG;AAEhG,8FAA8F;AAC9F,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,KAAc;IACzD,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,aAAa,EAAE,GAAG,IAAI,qCAAsC,KAAe,EAAE,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IACzM,GAAmC,CAAC,KAAK,GAAG,KAAK,CAAC;IACnD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,CAAU,EAAW,EAAE,CAAC,CAAC,YAAY,eAAe,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC;AAElG,SAAS,MAAM,CAAI,KAAqB,EAAE,GAAW,EAAE,KAAuC;IAC5F,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACrC,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK;QAC3B,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,GAAG,GAAG,cAAc,KAAK,CAAC,SAAS,uFAAuF,CAAC,CAAC;IAC/K,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,GAAG,GAAG,cAAc,CAAC,CAAC;IAAC,CAAC;IACvI,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;AAC9D,CAAC;AA4CD,MAAM,UAAU,sBAAsB,CAAC,EAAM,EAAE,GAAqB,EAAE,KAAa;IACjF,MAAM,UAAU,GAAG,KAAK,EAAE,KAAa,EAAE,CAAS,EAAE,EAAE;QACpD,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACpC,OAAO,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAC9D,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,KAAK,EAAE,KAAa,EAAE,EAAE;QACxC,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAC7D,CAAC,CAAC;IACF,MAAM,UAAU,GAAG,KAAK,EAAE,GAAW,EAAE,KAAc,EAAqE,EAAE;QAC1H,IAAI,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;QAC9E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,UAAU,CAAC,CAAC,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC7C,MAAM,cAAc,CAAC,aAAa,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC;IACF,MAAM,UAAU,GAAG,KAAK,EAAE,KAAa,EAAE,QAA+C,EAAE,IAAoB,EAAmB,EAAE;QACjI,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QAChC,mBAAmB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC;YACH,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACrI,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,UAAU,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,CAAC;YAC3B,MAAM,cAAc,CAAC,YAAY,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,UAAU;QACV,SAAS;QAET,KAAK,CAAC,oBAAoB,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK;YACxC,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACpC,IAAI,KAAK,CAAC,KAAK,KAAK,UAAU,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;gBAC5F,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,GAAG,GAAG,uDAAuD,CAAC,CAAC;YACvG,oBAAoB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACjC,OAAO,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAChC,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK;YACrC,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACpC,IAAI,KAAK,CAAC,UAAU,KAAK,CAAC;gBAAE,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,GAAG,GAAG,kCAAkC,CAAC,CAAC;YAC5G,MAAM,KAAK,GAAoB;gBAC7B,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,UAAU;gBACzH,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO;aAC3E,CAAC;YACF,oBAAoB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACjC,OAAO,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAChC,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YAChC,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACpC,oBAAoB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YAC9B,sBAAsB,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;YAC5C,IAAI,CAAC;gBACH,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtF,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,UAAU,CAAC,CAAC,CAAC;oBAAE,MAAM,CAAC,CAAC;gBAC3B,MAAM,cAAc,CAAC,UAAU,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG;YAC9B,gBAAgB,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,wCAAwC,CAAC,CAAC;YACnG,IAAI,WAAoB,CAAC;YACzB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,mBAAmB,EAAE,OAAO,EAAE,EAAE,CAAC;gBAC/D,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;gBACxC,MAAM,CAAC,GAAmB,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;gBAClG,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC;gBACpD,4FAA4F;gBAC5F,+EAA+E;gBAC/E,IAAI,IAAI;oBAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;gBAClF,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,aAAa,EAAE,CAAC;oBACnC,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC1E,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,SAAS,KAAK,kBAAkB,aAAa,iCAAiC,MAAM,CAAC,KAAK,cAAc,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,yDAAyD,CAAC,CAAC;gBACpP,CAAC;gBACD,MAAM,OAAO,GAAG,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,GAAG,cAAc,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,GAAG,CAAC;gBACnF,IAAI,OAAO,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,eAAe;oBAC9C,MAAM,IAAI,eAAe,CAAC,oBAAoB,EAAE,SAAS,KAAK,WAAW,eAAe,8CAA8C,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,GAAG,cAAc,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;gBACrM,MAAM,KAAK,GAAmB,EAAE,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;gBACzF,MAAM,IAAI,GAAmB;oBAC3B,CAAC,EAAE,CAAC;oBACJ,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC;oBACxB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE;iBACxG,CAAC;gBACF,IAAI,CAAC;oBACH,MAAM,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;oBACxC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;gBAC7E,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAI,UAAU,CAAC,CAAC,CAAC;wBAAE,SAAS,CAAC,wCAAwC;oBACrE,WAAW,GAAG,CAAC,CAAC,CAAC,8DAA8D;gBACjF,CAAC;YACH,CAAC;YACD,mEAAmE;YACnE,MAAM,cAAc,CAAC,oCAAoC,KAAK,EAAE,EAAE,WAAW,IAAI,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC;QAC9H,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC,EAAE,QAAQ;YACxC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC;YACnE,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM;gBAAE,OAAO,QAAQ,CAAC;YAChE,MAAM,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/D,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,KAAK,CAAC,sBAAsB,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ;YACpD,eAAe,CAAC,KAAK,CAAC,CAAC;YACvB,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC;YACpE,IAAI,EAAE,GAAG,CAAC;gBAAE,OAAO,QAAQ,CAAC;YAC5B,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACjF,MAAM,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/D,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,KAAK,CAAC,UAAU;YACd,OAAO,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC;QAChH,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI;YAC5B,oBAAoB,CAAC,IAAI,CAAC,CAAC;YAC3B,IAAI,CAAC;gBACH,OAAO,QAAQ,KAAK,SAAS;oBAC3B,CAAC,CAAC,MAAM,iBAAiB,CAAC,EAAE,EAAE,qBAAqB,EAAE,IAAI,CAAC;oBAC1D,CAAC,CAAC,MAAM,iBAAiB,CAAC,EAAE,EAAE,qBAAqB,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAClF,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,UAAU,CAAC,CAAC,CAAC;oBAAE,MAAM,CAAC,CAAC;gBAC3B,MAAM,cAAc,CAAC,UAAU,qBAAqB,EAAE,EAAE,CAAC,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK;YACpC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;gBAAE,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,gDAAgD,CAAC,CAAC;YAC7J,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,OAAO,MAAM,GAAG,CAAC;YAChC,MAAM,MAAM,GAAG,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,kBAAkB,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,iBAAiB,IAAI,CAAC;YAC9G,MAAM,GAAG,GAAwB,EAAE,CAAC;YACpC,IAAI,GAAG,GAAG,QAAQ,GAAG,CAAC,CAAC;YACvB,OAAO,GAAG,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;gBAC1B,IAAI,CAAC,CAAC;gBACN,IAAI,CAAC;oBACH,CAAC,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAA2B,CAAC,CAAC;gBAC3G,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAK,CAAwB,CAAC,IAAI,KAAK,KAAK;wBAAE,MAAM,CAAC,mCAAmC;oBACxF,MAAM,CAAC,CAAC;gBACV,CAAC;gBACD,IAAI,CAAC,CAAC;oBAAE,MAAM;gBACd,GAAG,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;gBAChB,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;gBACzC,IAAI,EAAE;oBAAE,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC,OAAO,cAAc,EAAE,gEAAgE,CAAC,CAAC;gBACvJ,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,kBAAkB;QAAE,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,GAAG,GAAG,2BAA2B,CAAC,CAAC;IACpI,OAAO,EAAE,KAAK,EAAE,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9F,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,iBAAiB;QAAE,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,GAAG,GAAG,0BAA0B,CAAC,CAAC;IAClI,OAAO,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3C,CAAC"}

package/dist/commands.d.ts

@@ -1,2 +1,4 @@
-export {};
+/** Record one `agent-bearer` attempt in the manager-composed health file, 0o600 and never through a
+ *  symlink ({@link writePrivateRecord}). */
+export declare function writeAgentAuthHealth(path: string, state: "ok" | "failed", reason?: string): void;
 //# sourceMappingURL=commands.d.ts.map

package/dist/commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../src/commands.ts"],"names":[],"mappings":""}
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../src/commands.ts"],"names":[],"mappings":"AA0ZA;4CAC4C;AAC5C,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,GAAG,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAEhG"}