@cotal-ai/core 0.12.0 → 0.13.0

package/dist/endpoint-grants.js

@@ -0,0 +1,215 @@
+/**
+ * v0.4 endpoint control-surface grant grammar (SPEC §13.9 matrix, caller + serve rows) — the
+ * capability → exact allow-list builders `permissionsFor` mints from. Default-deny throughout:
+ * every row is an exact-arity literal form from the §13.9 matrix; no builder emits a wildcard
+ * that admits subjects outside the §13.2 grammar.
+ *
+ * SCOPE: the SUBJECT-space rows (core publish/subscribe grants). The `$JS.API` rows of the
+ * matrix (canonicalizer/effects/pool/reader durables) bind to the §13.12 stream names and land
+ * with that binding; the serve PROFILE that carries these rows to an endpoint daemon lands with
+ * the service registry machinery.
+ */
+import { spacePrefix } from "./subjects.js";
+import { endpointToken, assertCommandToken, assertLifecycleToken, assertBoundedOwner, epCallerReplyFilter, epResponderReplyPattern, epClassQueueGroup, } from "./endpoint-subjects.js";
+/** Grant-row token block for a capability's authz/target segment, enforcing the §13.2 minting
+ *  rules per mode: `owner`/`child` standing mints pin `<tOwner>` to the caller's own owner
+ *  (never a wildcard, never a foreign owner); `any`/`ledger` accept a literal `"*"` (mintable
+ *  only under operator/admin policy — enforced by the minting authority, not here) or a
+ *  validated owner token; `handle` validates the full redemption triple. Every concrete token
+ *  routes through the same validator the subject builders use, so a grant row can never carry
+ *  a smuggled `.`/`*`/`>` that widens the minted permission beyond the grammar. */
+function targetGrantTokens(target, caller) {
+    if (target.mode === "self")
+        return ["self"];
+    if (target.mode === "handle")
+        return ["handle", assertBoundedOwner(target.tOwner, "target owner"), assertBoundedOwner(target.tActor, "target actor"), assertLifecycleToken(target.tUid, "target lifecycleUid")];
+    if (target.mode === "any" || target.mode === "ledger")
+        return [target.mode, target.tOwner === "*" ? "*" : assertBoundedOwner(target.tOwner, "target owner")];
+    if (target.tOwner !== caller.owner)
+        throw new Error(`an "${target.mode}"-mode grant pins the target owner to the caller's own owner (SPEC 13.2); got "${target.tOwner}" for caller owner "${caller.owner}"`);
+    return [target.mode, assertBoundedOwner(target.tOwner, "target owner")];
+}
+function callerBlock(caller) {
+    return `${assertBoundedOwner(caller.owner, "caller owner")}.${assertBoundedOwner(caller.actor, "caller actor")}.${assertLifecycleToken(caller.uid, "caller lifecycleUid")}`;
+}
+/** Request-publish rows for one capability (§13.9 "Request publish"): per route,
+ *  `ep.{one,all}.<endpoint>.<command>[.<mode>[.<target…>]].<cO>.<cA>.<cUid>.*` and the
+ *  instance-pinned form when `instanceId` is set. The nonce is the only wildcard token. */
+export function epRequestGrantRows(space, cap, caller) {
+    const e = endpointToken(cap.endpoint);
+    const cmd = assertCommandToken(cap.command);
+    const mid = cap.target ? `.${targetGrantTokens(cap.target, caller).join(".")}` : "";
+    const tail = `${mid}.${callerBlock(caller)}.*`;
+    const rows = (cap.routes ?? ["one"]).map((r) => `${spacePrefix(space)}.ep.${r}.${e}.${cmd}${tail}`);
+    if (cap.instanceId)
+        rows.push(`${spacePrefix(space)}.ep.inst.${e}.${assertLifecycleToken(cap.instanceId, "instanceId")}.${cmd}${tail}`);
+    return rows;
+}
+/** Journal-submission append row (§13.9 "Journal submission append"): the same authz/target
+ *  block as the request forms, caller-pinned, no nonce. Explicitly untrusted input (§13.4). */
+export function epJournalGrantRow(space, cap, caller) {
+    const mid = cap.target ? `.${targetGrantTokens(cap.target, caller).join(".")}` : "";
+    return `${spacePrefix(space)}.epj.${endpointToken(cap.endpoint)}.${assertCommandToken(cap.command)}${mid}.${callerBlock(caller)}`;
+}
+/** The caller's reply-rail read row (§13.9 "Reply subscribe"): its own rail only, exact arity. */
+export function epCallerReplyGrantRow(space, caller) {
+    return epCallerReplyFilter(space, caller);
+}
+/** Per-goal live progress read row (§13.9 "Live event progress", reserved `goal` topic):
+ *  `epe.<endpoint>.*.*.goal.<cO>.<cA>.<cUid>.>` — the caller identity in the subject gives
+ *  mint-time read containment; delivered on the caller's own core subscription only. */
+export function epGoalProgressGrantRow(space, endpoint, caller) {
+    return `${spacePrefix(space)}.epe.${endpointToken(endpoint)}.*.*.goal.${callerBlock(caller)}.>`;
+}
+/** All caller-side rows for a capability set: request-publish (+ optional journal) into
+ *  `pub.allow`, the reply rail into `sub.allow`. This is the STANDING rollup (`permissionsFor`
+ *  mints long-lived credentials from it), so a `handle`-mode capability is refused here:
+ *  handle rows are redemption-minted only (§13.2/§13.6), built by the redemption path through
+ *  {@link epRequestGrantRows} directly. Deliberately NOT included: `epe` event
+ *  subtrees beyond the per-goal row — read grants are minted per read capability by the
+ *  granting authority (Appendix B), not implied by an invoke capability. */
+export function epCallerGrantRows(space, caps, caller) {
+    const pub = [];
+    for (const cap of caps) {
+        if (cap.target?.mode === "handle")
+            throw new Error(`a "handle"-mode capability on "${cap.endpoint}.${cap.command}" is redemption-minted only (SPEC 13.2), never a standing capability`);
+        pub.push(...epRequestGrantRows(space, cap, caller));
+        if (cap.journal)
+            pub.push(epJournalGrantRow(space, cap, caller));
+    }
+    return { pub, sub: caps.length ? [epCallerReplyGrantRow(space, caller)] : [] };
+}
+// ---- the Appendix-B BASELINE capability set (SPEC Appendix B "Agent", §13.9 agent row) ------------
+// "every agent gets the baseline set (`describe` on all endpoints; the delivery endpoint's durable
+// join/leave/list commands; self-targeted lifecycle commands with authz-mode `self`); the `spawn`
+// capability adds the manager endpoint's lifecycle commands with authz-mode `owner`". The v0.4
+// command NAMES map the served v0.3 ops 1:1: ctl.delivery durableJoin/durableLeave/listMemberships
+// → delivery `join`/`leave`/`list` (untargeted: they act on the caller's own memberships, carried
+// by the pinned caller triple, no target block); the self-service control tier serves exactly
+// no-name self `stop` → manager `stop` with mode `self`; the privileged tier's spawn/stop/despawn/
+// attach → the owner-mode spawn set. These names become the served v0.4 endpoint surfaces when the
+// daemons register them; minting them ahead of serving is default-deny-safe (an unserved request
+// form is a no-responder, never authority).
+/** The delivery endpoint's baseline command names (Appendix B: "durable join/leave/list").
+ *  All four command vocabularies below are RUNTIME-frozen (TS `as const` is type-level only)
+ *  and the capability builders consult PRIVATE module-load snapshots, never these live
+ *  exports: a post-import `push("attach")` here would otherwise widen every subsequently
+ *  minted agent grant (the afa715b identity-vs-integrity class, executed repro). */
+export const BASELINE_DELIVERY_ENDPOINT = "delivery";
+export const BASELINE_DELIVERY_COMMANDS = Object.freeze(["join", "leave", "list"]);
+/** The manager endpoint's self-lifecycle baseline (the v0.3 self-service tier serves exactly
+ *  no-name self stop) and the spawn-capability owner-mode lifecycle set. */
+export const BASELINE_LIFECYCLE_ENDPOINT = "manager";
+export const BASELINE_SELF_LIFECYCLE_COMMANDS = Object.freeze(["stop"]);
+/** `spawn` is CREATION: a virgin spawn has no target lifecycle UID or current mapping yet, so it
+ *  CANNOT ride owner mode (§13.2 owner mode resolves a body `{owner, actor, lifecycleUid}` against
+ *  the CURRENT mapping — there is nothing to resolve for a not-yet-existing child). It is minted
+ *  UNTARGETED; the child-owner ceiling is the authenticated caller's own owner, carried by the
+ *  pinned caller triple. `despawn` (terminal) and `attach` (interactive) act on an EXISTING agent,
+ *  so they ride owner mode. Owner-mode `stop` is DELIBERATELY ABSENT: on the v0.3 surface a named
+ *  stop and a despawn both free-slot + deprovision, so an owner-mode `stop` would be a wire synonym
+ *  of `despawn` (distsys) — one owner-mode terminal command keeps the vocabulary single. Self-`stop`
+ *  stays in the BASELINE (the v0.3 self-service tier's only op); it is the lighter self-halt. */
+export const SPAWN_CREATE_COMMANDS = Object.freeze(["spawn"]);
+export const SPAWN_OWNER_LIFECYCLE_COMMANDS = Object.freeze(["despawn", "attach"]);
+// PRIVATE module-load snapshots of the command vocabularies: the builders below map over THESE,
+// never the live exports, so the minted surface survives even a hypothetical defeat of the
+// freezes above (the seam-snapshot half of the afa715b closure pattern).
+const DELIVERY_COMMANDS_SNAP = Object.freeze([...BASELINE_DELIVERY_COMMANDS]);
+const SELF_LIFECYCLE_SNAP = Object.freeze([...BASELINE_SELF_LIFECYCLE_COMMANDS]);
+const SPAWN_CREATE_SNAP = Object.freeze([...SPAWN_CREATE_COMMANDS]);
+const SPAWN_OWNER_SNAP = Object.freeze([...SPAWN_OWNER_LIFECYCLE_COMMANDS]);
+/** `describe` on ALL endpoints (Appendix B / §13.9 "describe by default"): the ONE
+ *  subject-wildcard request form in the caller grammar,
+ *  `ep.one.*.describe.<cO>.<cA>.<cUid>.*` — the endpoint token is the wildcard, the command is
+ *  the literal reserved `describe`, and the caller triple stays pinned. DELIBERATELY not an
+ *  {@link EpCapability} (whose endpoint is a validated literal): a wildcard-endpoint capability
+ *  would generalize to arbitrary commands, and the baseline is the only place the wildcard form
+ *  is normative. Untargeted only — describe is constructed untargeted on every serve
+ *  (§13.7), so no authz/target block ever appears in the row. */
+export function epDescribeAllGrantRow(space, caller) {
+    return `${spacePrefix(space)}.ep.one.*.describe.${callerBlock(caller)}.*`;
+}
+/** The baseline {@link EpCapability} set every agent holds (Appendix B) beyond the wildcard
+ *  describe row: delivery join/leave/list (untargeted) + self-mode lifecycle. */
+export function baselineCallerCapabilities() {
+    return [
+        ...DELIVERY_COMMANDS_SNAP.map((command) => ({ endpoint: BASELINE_DELIVERY_ENDPOINT, command })),
+        ...SELF_LIFECYCLE_SNAP.map((command) => ({ endpoint: BASELINE_LIFECYCLE_ENDPOINT, command, target: { mode: "self" } })),
+    ];
+}
+/** The `spawn` capability's addition (Appendix B): the manager endpoint's lifecycle commands.
+ *  `spawn` (creation) is UNTARGETED — a virgin child has no lifecycle UID to resolve against the
+ *  current mapping, so an owner-mode row would be un-invokable under the verb grammar (§13.2). The
+ *  three that act on an existing agent ride owner mode, target owner pinned to the CALLER's own
+ *  (§13.2: an owner-mode standing mint never names a foreign owner). */
+export function spawnCallerCapabilities(callerOwner) {
+    return [
+        ...SPAWN_CREATE_SNAP.map((command) => ({ endpoint: BASELINE_LIFECYCLE_ENDPOINT, command })),
+        ...SPAWN_OWNER_SNAP.map((command) => ({
+            endpoint: BASELINE_LIFECYCLE_ENDPOINT, command,
+            target: { mode: "owner", tOwner: callerOwner },
+        })),
+    ];
+}
+/** All BASELINE caller rows (Appendix B): the wildcard describe form + the baseline capability
+ *  rollup into `pub.allow`, and the caller's reply rail into `sub.allow` — ALWAYS present (the
+ *  baseline implies the reply read even when no per-capability rows are minted). */
+export function epBaselineGrantRows(space, caller) {
+    const base = epCallerGrantRows(space, baselineCallerCapabilities(), caller);
+    return { pub: [epDescribeAllGrantRow(space, caller), ...base.pub], sub: [epCallerReplyGrantRow(space, caller)] };
+}
+/** One registered command's serve-subscribe rows (§13.9 "Serve subscribe"), per registered
+ *  command and never a cross-command `>`:
+ *   - class rail: `"ep.one.<endpoint>.<command>.> <queue>"` — QUEUE-QUALIFIED ONLY (the NATS
+ *     `subject queue` grant form): no credential can plain-subscribe the class rail, which is
+ *     what keeps per-request nonces visible only to the queue-selected instance;
+ *   - scatter rail: `ep.all.<endpoint>.<command>.>` plain;
+ *   - instance rail: `ep.inst.<endpoint>.<instanceId>.<command>.>` exact.
+ *  The epoch is deliberately absent from serve subscriptions (§13.1's barrier is the fence). */
+export function epServeSubscribeRows(space, endpoint, instanceId, command) {
+    const e = endpointToken(endpoint);
+    const cmd = assertCommandToken(command);
+    return [
+        `${spacePrefix(space)}.ep.one.${e}.${cmd}.> ${epClassQueueGroup(endpoint)}`,
+        `${spacePrefix(space)}.ep.all.${e}.${cmd}.>`,
+        `${spacePrefix(space)}.ep.inst.${e}.${assertLifecycleToken(instanceId, "instanceId")}.${cmd}.>`,
+    ];
+}
+/** A serving instance's egress rows (§13.9 matrix): reply publish (attribution-pinned instance
+ *  triple + epoch), events, timer SCHEDULE requests (never `.armed`/`.fire`), and the epoch-pinned
+ *  record-write ingress. Every row pins the instance's own identity and epoch. */
+export function epServePublishRows(space, endpoint, instanceId, epoch) {
+    const e = endpointToken(endpoint);
+    const iId = assertLifecycleToken(instanceId, "instanceId");
+    if (!Number.isSafeInteger(epoch) || epoch < 0)
+        throw new Error(`epoch ${epoch} is not an unsigned integer`);
+    return [
+        epResponderReplyPattern(space, endpoint, instanceId, epoch),
+        `${spacePrefix(space)}.epe.${e}.${iId}.${epoch}.>`,
+        `${spacePrefix(space)}.ept.${e}.${iId}.${epoch}.*.schedule`,
+        `${spacePrefix(space)}.epr.${e}.${iId}.${epoch}.>`,
+    ];
+}
+/** All serve-credential subject-space rows for an instance. `ephemeralCommands` is the
+ *  RAIL-SERVED (ephemeral) subset only — journal commands stay in the credential's descriptor
+ *  surface but ride `epj` submissions, never the §13.2 request rails, so they take no rail
+ *  subscribe row here (their effects/pool durable binds ride the §13.12 stream binding). The
+ *  reserved `describe` is DERIVED here — every endpoint serves it (§13.7), so this ONE assembly
+ *  seam emits its rails for every serve credential (even a journal-only endpoint, whose
+ *  `ephemeralCommands` is empty) and an explicit `describe` refuses (mirroring
+ *  {@link import("./endpoint-serve.js").serveEndpoint}'s construction rule: there is no custom
+ *  describe). The subscribe side also carries the instance's OWN epoch-pinned timer FIRE row
+ *  (§13.9 "Timer fire consume": `ept.<e>.<i>.<epoch>.*.fire` — consume only; the publish side
+ *  stays `.schedule`-only, no credential publishes `.armed`/`.fire`). */
+export function epServeGrantRows(space, serve) {
+    if (serve.ephemeralCommands.includes("describe"))
+        throw new Error(`"describe" is not a mintable serve command: it is reserved and derived here for every serve credential (SPEC 13.7/13.9)`);
+    const sub = [];
+    for (const cmd of [...serve.ephemeralCommands, "describe"])
+        sub.push(...epServeSubscribeRows(space, serve.endpoint, serve.instanceId, cmd));
+    const pub = epServePublishRows(space, serve.endpoint, serve.instanceId, serve.epoch); // validates the tuple's tokens + epoch
+    sub.push(`${spacePrefix(space)}.ept.${endpointToken(serve.endpoint)}.${assertLifecycleToken(serve.instanceId, "instanceId")}.${serve.epoch}.*.fire`);
+    return { pub, sub };
+}
+//# sourceMappingURL=endpoint-grants.js.map

package/dist/endpoint-grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint-grants.js","sourceRoot":"","sources":["../src/endpoint-grants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EACL,aAAa,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,kBAAkB,EAE3E,mBAAmB,EAAE,uBAAuB,EAAE,iBAAiB,GAChE,MAAM,wBAAwB,CAAC;AAoBhC;;;;;;mFAMmF;AACnF,SAAS,iBAAiB,CAAC,MAAgB,EAAE,MAAgB;IAC3D,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;QAC1B,OAAO,CAAC,QAAQ,EAAE,kBAAkB,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,kBAAkB,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,oBAAoB,CAAC,MAAM,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC,CAAC;IACpL,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;QACnD,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;IACxG,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,KAAK;QAChC,MAAM,IAAI,KAAK,CAAC,OAAO,MAAM,CAAC,IAAI,kFAAkF,MAAM,CAAC,MAAM,uBAAuB,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC;IAC3K,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,WAAW,CAAC,MAAgB;IACnC,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC,IAAI,oBAAoB,CAAC,MAAM,CAAC,GAAG,EAAE,qBAAqB,CAAC,EAAE,CAAC;AAC9K,CAAC;AAED;;2FAE2F;AAC3F,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,GAAiB,EAAE,MAAgB;IACnF,MAAM,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpF,MAAM,IAAI,GAAG,GAAG,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC;IAC/C,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC,CAAC;IACpG,IAAI,GAAG,CAAC,UAAU;QAChB,IAAI,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,oBAAoB,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC,CAAC;IACtH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;+FAC+F;AAC/F,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,GAAiB,EAAE,MAAgB;IAClF,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpF,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;AACpI,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,MAAgB;IACnE,OAAO,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAC5C,CAAC;AAED;;wFAEwF;AACxF,MAAM,UAAU,sBAAsB,CAAC,KAAa,EAAE,QAAgB,EAAE,MAAgB;IACtF,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,aAAa,CAAC,QAAQ,CAAC,aAAa,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC;AAClG,CAAC;AAED;;;;;;4EAM4E;AAC5E,MAAM,UAAU,iBAAiB,CAC/B,KAAa,EACb,IAAoB,EACpB,MAAgB;IAEhB,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,MAAM,EAAE,IAAI,KAAK,QAAQ;YAC/B,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,OAAO,sEAAsE,CAAC,CAAC;QACvJ,GAAG,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;QACpD,IAAI,GAAG,CAAC,OAAO;YAAE,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACjF,CAAC;AAED,sGAAsG;AACtG,mGAAmG;AACnG,kGAAkG;AAClG,+FAA+F;AAC/F,mGAAmG;AACnG,kGAAkG;AAClG,8FAA8F;AAC9F,mGAAmG;AACnG,mGAAmG;AACnG,iGAAiG;AACjG,4CAA4C;AAE5C;;;;oFAIoF;AACpF,MAAM,CAAC,MAAM,0BAA0B,GAAG,UAAU,CAAC;AACrD,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAU,CAAC,CAAC;AAC5F;4EAC4E;AAC5E,MAAM,CAAC,MAAM,2BAA2B,GAAG,SAAS,CAAC;AACrD,MAAM,CAAC,MAAM,gCAAgC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAU,CAAC,CAAC;AACjF;;;;;;;;iGAQiG;AACjG,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAU,CAAC,CAAC;AACvE,MAAM,CAAC,MAAM,8BAA8B,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAU,CAAC,CAAC;AAE5F,gGAAgG;AAChG,2FAA2F;AAC3F,yEAAyE;AACzE,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,0BAA0B,CAAC,CAAC,CAAC;AAC9E,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,gCAAgC,CAAC,CAAC,CAAC;AACjF,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,qBAAqB,CAAC,CAAC,CAAC;AACpE,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,8BAA8B,CAAC,CAAC,CAAC;AAE5E;;;;;;;iEAOiE;AACjE,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,MAAgB;IACnE,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,sBAAsB,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC;AAC5E,CAAC;AAED;iFACiF;AACjF,MAAM,UAAU,0BAA0B;IACxC,OAAO;QACL,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,0BAA0B,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/F,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,2BAA2B,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAW,EAAE,CAAC,CAAC;KACjI,CAAC;AACJ,CAAC;AAED;;;;wEAIwE;AACxE,MAAM,UAAU,uBAAuB,CAAC,WAAmB;IACzD,OAAO;QACL,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,2BAA2B,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3F,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACpC,QAAQ,EAAE,2BAA2B,EAAE,OAAO;YAC9C,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAc;SAC3D,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED;;oFAEoF;AACpF,MAAM,UAAU,mBAAmB,CAAC,KAAa,EAAE,MAAgB;IACjE,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,EAAE,0BAA0B,EAAE,EAAE,MAAM,CAAC,CAAC;IAC5E,OAAO,EAAE,GAAG,EAAE,CAAC,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;AACnH,CAAC;AAED;;;;;;;gGAOgG;AAChG,MAAM,UAAU,oBAAoB,CAAC,KAAa,EAAE,QAAgB,EAAE,UAAkB,EAAE,OAAe;IACvG,MAAM,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,OAAO;QACL,GAAG,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,EAAE;QAC3E,GAAG,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,GAAG,IAAI;QAC5C,GAAG,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,oBAAoB,CAAC,UAAU,EAAE,YAAY,CAAC,IAAI,GAAG,IAAI;KAChG,CAAC;AACJ,CAAC;AAED;;kFAEkF;AAClF,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,QAAgB,EAAE,UAAkB,EAAE,KAAa;IACnG,MAAM,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,oBAAoB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,6BAA6B,CAAC,CAAC;IAC5G,OAAO;QACL,uBAAuB,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC;QAC3D,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,KAAK,IAAI;QAClD,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,KAAK,aAAa;QAC3D,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,KAAK,IAAI;KACnD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;yEAUyE;AACzE,MAAM,UAAU,gBAAgB,CAC9B,KAAa,EACb,KAA2F;IAE3F,IAAI,KAAK,CAAC,iBAAiB,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,yHAAyH,CAAC,CAAC;IAC7I,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,iBAAiB,EAAE,UAAU,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5I,MAAM,GAAG,GAAG,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,uCAAuC;IAC7H,GAAG,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,oBAAoB,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,IAAI,KAAK,CAAC,KAAK,SAAS,CAAC,CAAC;IACrJ,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACtB,CAAC"}

package/dist/endpoint-guard.d.ts

@@ -0,0 +1,222 @@
+import type { EpCaller } from "./endpoint-subjects.js";
+import { type AnchorResolver } from "./endpoint-signing.js";
+import { type CheckpointSettleFact } from "./endpoint-checkpoint.js";
+import { type ActionContext, type GoalRef, type GoalStatusValue, type GoalResultFact } from "./endpoint-action.js";
+/** A signed guard OBLIGATION (§13.6/§13.10): attenuations the effecting endpoint MUST apply,
+ *  bound to its goal/request id, reusable within it. Verified against the anchor registry
+ *  (role `obligations`, scope = the endpoints the key may attest for). */
+export interface GuardObligation {
+    v: 1;
+    space: string;
+    /** The guarded goal/request id this obligation binds to (§13.10: bound to its goal/request). */
+    requestId: string;
+    signer: {
+        keyId: string;
+    };
+    /** The monotonic attenuations the endpoint MUST apply; opaque to this wiring (the effecting
+     *  handler interprets them), validated as non-empty structured entries and signed. */
+    attenuations: unknown[];
+    iat: number;
+    exp: number;
+    sig: string;
+}
+/** The guard endpoint's parsed answer (closed per decision): `hold` carries the checkpoint
+ *  coordinates; `deny` carries an optional reason; obligations ride `allow`/`hold` only. */
+export type GuardAnswer = {
+    decision: "allow";
+    obligations: GuardObligation[];
+} | {
+    decision: "deny";
+    reason?: string;
+} | {
+    decision: "hold";
+    token: string;
+    holdDeadlineMs: number;
+    obligations: GuardObligation[];
+};
+/** The injected class-call seam: invoke the guard endpoint's decision command and return its
+ *  raw answer body PLUS the broker-authenticated responder identity (derived from the reply
+ *  subject by the caller's transport layer, never from the body). The seam receives the
+ *  guarded request's coordinates so the guard knows WHAT it is deciding; the GATE owns all
+ *  parsing and verification of the answer, so no wiring can surface an unverified obligation. */
+export type GuardCallSeam = (q: {
+    /** The guard endpoint the VERIFIED trait value names. */
+    guardEndpoint: string;
+    /** The guarded request's broker-authenticated coordinates. */
+    endpoint: string;
+    command?: string;
+    requestId: string;
+    caller: EpCaller;
+}) => Promise<{
+    answer: unknown;
+    responder: {
+        id: string;
+        lifecycleUid: string;
+    };
+}>;
+/** The gate's verdict for the effecting handler. */
+export type GuardVerdict = {
+    decision: "allow";
+    obligations: GuardObligation[];
+} | {
+    decision: "hold";
+    token: string;
+    holdDeadlineMs: number;
+    obligations: GuardObligation[];
+    responder: {
+        id: string;
+        lifecycleUid: string;
+    };
+};
+/** Run the §13.6 guard gate for one guarded request: call the guard endpoint (via the injected
+ *  seam) within `deadlineMs`, and classify FAIL-CLOSED — the ONLY outcomes are a verified
+ *  ALLOW, a verified HOLD (the caller then wires the pause via {@link holdGuardedGoal}), or a
+ *  `permission-denied` throw. A timeout, transport failure, garbled answer, cross-variant
+ *  fields, or an obligation that does not verify (signature, scope, window, request binding)
+ *  all DENY. Ordering is guard-then-effect: call this BEFORE any effect. */
+export declare function runGuardGate(opts: {
+    /** The guard endpoint named by the VERIFIED `ai.cotal.guarded` trait value (the D6 governed
+     *  attachment verification is the caller's step; this seam trusts its output only). */
+    guardEndpoint: string;
+    /** The guarded request's coordinates (broker-authenticated at the serve boundary). */
+    request: {
+        endpoint: string;
+        command?: string;
+        id: string;
+        caller: EpCaller;
+    };
+    callGuard: GuardCallSeam;
+    /** The guard budget: past it the gate DENIES (never hangs, never allows). */
+    deadlineMs: number;
+    now: number;
+    space: string;
+    resolveAnchor: AnchorResolver;
+}): Promise<GuardVerdict>;
+/** The ACTION composite's guard gate (§13.6): run by the OWNING instance for a guarded goal
+ *  BEFORE any execution effect — the counterpart of the ephemeral rail's
+ *  `assertGovernedPreEffect`, with hold ROUTED instead of refused. {@link runGuardGate} does
+ *  the calling, parsing, and obligation verification; this seam projects the verdict onto the
+ *  goal:
+ *   - ALLOW: the goal transitions accepted → running under the owner's construction-bound
+ *     proof (this projection is the owner's admission to execute) and the VERIFIED
+ *     obligations return for the executor, which MUST apply them;
+ *   - HOLD: {@link holdGuardedGoal} mints the guard-holder-bound checkpoint and projects
+ *     `waiting`;
+ *   - DENY (or ANY fail-closed gate refusal: timeout, garble, unverifiable obligation): the
+ *     goal commits terminal `failed` at the shared commit point under the OWNER's
+ *     construction-bound proof — the owner runs this gate, so the deny predicate is the
+ *     owner's own refusal to execute, carrying the gate's reason in the terminal payload.
+ *  Obligations bind to the GOAL id (§13.10: bound to its goal/request, reusable within it). */
+export declare function gateGoalExecution(ctx: ActionContext, args: {
+    goal: GoalRef;
+    /** The guard endpoint named by the goal's VERIFIED `ai.cotal.guarded` trait value. */
+    guardEndpoint: string;
+    callGuard: GuardCallSeam;
+    resolveAnchor: AnchorResolver;
+    deadlineMs: number;
+    now: number;
+    /** The OWNING instance arming a hold's timer (its identity/epoch subject, §13.12). */
+    instanceId: string;
+    epoch: number;
+}): Promise<{
+    outcome: "running";
+    obligations: GuardObligation[];
+    status: GoalStatusValue;
+} | {
+    outcome: "waiting";
+    hold: {
+        token: string;
+        holdDeadlineMs: number;
+    };
+    obligations: GuardObligation[];
+    status: GoalStatusValue;
+} | {
+    outcome: "denied";
+    won: boolean;
+    fact: GoalResultFact;
+    status: GoalStatusValue;
+}>;
+/** The durable HOLD reconciler (§13.6): converge a goal whose guard-hold checkpoint SETTLED
+ *  while the goal projection lags (a release or expiry crashed mid-flight, or the timer fire
+ *  settled the checkpoint and the owner's projection is still owed). For a goal `waiting` on
+ *  checkpoint T whose spec binds THIS goal:
+ *   - settle RESUMED: finish the projection to `running` (idempotent);
+ *   - settle EXPIRED: drive the terminal deny via {@link expireGuardHold} (idempotent);
+ *   - still live: nothing to do — the timer plane owns the deadline.
+ *  A goal not waiting, or waiting on a token whose checkpoint does not bind it, is left
+ *  untouched: this reconciler converges exactly the holds this module minted. (The
+ *  mint-then-no-wait partial state is recovered by RETRYING the gate — the mint is
+ *  idempotent-if-identical and the transition completes; a dedicated repair arm was
+ *  panel-adjudicated as insurance ahead of composition and deliberately not built.)
+ *  A converged `running` carries the hold's RECORDED verified obligations (§13.6/§13.10:
+ *  MUST-apply, reusable within the goal — the pause never launders them away). */
+export declare function reconcileGuardHold(ctx: ActionContext, args: {
+    goal: GoalRef;
+    now: number;
+}): Promise<{
+    converged: "running" | "denied" | "none";
+    obligations?: GuardObligation[];
+}>;
+/** Convert a HELD action to `waiting` on a checkpoint OWNED BY THE GUARD DECISION (§13.6): the
+ *  checkpoint's holder is the guard's authenticated responder (only IT may resume), the
+ *  deadline is the hold's (mandatory), and the goal's status projects `waiting` carrying the
+ *  checkpoint coordinate. The mint is idempotent and the timer is armed through the mediated
+ *  plane by the checkpoint module. */
+export declare function holdGuardedGoal(ctx: ActionContext, args: {
+    goal: GoalRef;
+    hold: {
+        token: string;
+        holdDeadlineMs: number;
+        responder: {
+            id: string;
+            lifecycleUid: string;
+        };
+        obligations?: GuardObligation[];
+    };
+    /** The OWNING instance arming the hold's timer (its identity/epoch subject, §13.12). */
+    instanceId: string;
+    epoch: number;
+    now: number;
+}): Promise<GoalStatusValue>;
+/** Release a guard hold: the GUARD (the checkpoint's holder, presenting as itself) resumes the
+ *  one-use checkpoint, and the goal leaves `waiting` back to `running`. The token is first bound
+ *  to THIS goal (a valid token for another goal never releases it), THEN the resume seam
+ *  enforces holder binding, one-use, and the deadline fence (a hold past its deadline drives
+ *  the EXPIRED settlement there and refuses; an expired hold never releases).
+ *
+ *  CRASH CONVERGENCE (the checkpoint settlement is the arbiter; the goal transition is its
+ *  derived projection): a crash between the one-use resume and the goal transition leaves the
+ *  checkpoint `resumed` and the goal `waiting` — the RETRY's resume loses `conflict`, so it
+ *  OBSERVES the recorded settlement, requires it to be THIS presenter's own `resumed` (a
+ *  foreign or expired settlement rethrows), and finishes the projection idempotently (a goal
+ *  already `running` is the converged state, not an error). */
+export declare function releaseGuardHold(ctx: ActionContext, args: {
+    goal: GoalRef;
+    token: string;
+    presenter: {
+        id: string;
+        lifecycleUid: string;
+    };
+    now: number;
+}): Promise<{
+    settle: CheckpointSettleFact;
+    status: GoalStatusValue;
+    obligations: GuardObligation[];
+}>;
+/** Settle an EXPIRED guard hold onto the goal: an expired hold is DENY (fail closed). The token
+ *  is first bound to THIS goal (an arbitrary token never terminal-fails an unrelated goal), then
+ *  the CHECKPOINT is owner-expired (settling its status and stopping its timers, so no orphaned
+ *  schedule lingers until the checkpoint's own deadline), and finally the goal commits terminal
+ *  `failed` (permission-denied) at the shared commit point — where a racing completion or cancel
+ *  may lawfully have won first (the caller observes the winner; the projection converges either
+ *  way). Idempotent: an already-terminal goal returns its winner. */
+export declare function expireGuardHold(ctx: ActionContext, args: {
+    goal: GoalRef;
+    token: string;
+    now: number;
+}): Promise<{
+    won: boolean;
+    fact: GoalResultFact;
+    status: GoalStatusValue;
+}>;
+//# sourceMappingURL=endpoint-guard.d.ts.map

package/dist/endpoint-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint-guard.d.ts","sourceRoot":"","sources":["../src/endpoint-guard.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAyE,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACnI,OAAO,EAAgG,KAAK,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACnK,OAAO,EAA+J,KAAK,aAAa,EAAE,KAAK,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAwBhR;;0EAE0E;AAC1E,MAAM,WAAW,eAAe;IAC9B,CAAC,EAAE,CAAC,CAAC;IACL,KAAK,EAAE,MAAM,CAAC;IACd,gGAAgG;IAChG,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1B;0FACsF;IACtF,YAAY,EAAE,OAAO,EAAE,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED;4FAC4F;AAC5F,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,eAAe,EAAE,CAAA;CAAE,GACrD;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,eAAe,EAAE,CAAA;CAAE,CAAC;AAwFhG;;;;iGAIiG;AACjG,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,EAAE;IAC9B,yDAAyD;IACzD,aAAa,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,QAAQ,CAAC;CAClB,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC,CAAC;AAEpF,oDAAoD;AACpD,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,eAAe,EAAE,CAAA;CAAE,GACrD;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,eAAe,EAAE,CAAC;IAAC,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAEjJ;;;;;4EAK4E;AAC5E,wBAAsB,YAAY,CAAC,IAAI,EAAE;IACvC;2FACuF;IACvF,aAAa,EAAE,MAAM,CAAC;IACtB,sFAAsF;IACtF,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,QAAQ,CAAA;KAAE,CAAC;IAC9E,SAAS,EAAE,aAAa,CAAC;IACzB,6EAA6E;IAC7E,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,cAAc,CAAC;CAC/B,GAAG,OAAO,CAAC,YAAY,CAAC,CA2DxB;AAED;;;;;;;;;;;;;;+FAc+F;AAC/F,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE;IACJ,IAAI,EAAE,OAAO,CAAC;IACd,sFAAsF;IACtF,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,aAAa,CAAC;IACzB,aAAa,EAAE,cAAc,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,sFAAsF;IACtF,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf,GACA,OAAO,CACN;IAAE,OAAO,EAAE,SAAS,CAAC;IAAC,WAAW,EAAE,eAAe,EAAE,CAAC;IAAC,MAAM,EAAE,eAAe,CAAA;CAAE,GAC/E;IAAE,OAAO,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,WAAW,EAAE,eAAe,EAAE,CAAC;IAAC,MAAM,EAAE,eAAe,CAAA;CAAE,GAChI;IAAE,OAAO,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,eAAe,CAAA;CAAE,CACrF,CA2CA;AAED;;;;;;;;;;;;;kFAakF;AAClF,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACnC,OAAO,CAAC;IAAE,SAAS,EAAE,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,eAAe,EAAE,CAAA;CAAE,CAAC,CAkBxF;AAED;;;;sCAIsC;AACtC,wBAAsB,eAAe,CACnC,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE;IACJ,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,WAAW,CAAC,EAAE,eAAe,EAAE,CAAA;KAAE,CAAC;IAClI,wFAAwF;IACxF,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb,GACA,OAAO,CAAC,eAAe,CAAC,CAsB1B;AAqBD;;;;;;;;;;;+DAW+D;AAC/D,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACnG,OAAO,CAAC;IAAE,MAAM,EAAE,oBAAoB,CAAC;IAAC,MAAM,EAAE,eAAe,CAAC;IAAC,WAAW,EAAE,eAAe,EAAE,CAAA;CAAE,CAAC,CAmCpG;AAED;;;;;;qEAMqE;AACrE,wBAAsB,eAAe,CACnC,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAClD,OAAO,CAAC;IAAE,GAAG,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,eAAe,CAAA;CAAE,CAAC,CAmC1E"}