@cotal-ai/core 0.12.0 → 0.13.0

package/dist/endpoint-traits.js

@@ -0,0 +1,469 @@
+/**
+ * v0.4 governed traits (SPEC §13.7 "Traits", §13.9 "Trait seam", §13.10) — the trait
+ * definition and attachment artifacts, their fail-closed verification, and the pre-effect
+ * enforcement gate the serve boundary runs for the two traits this revision governs,
+ * `ai.cotal.guarded` and `ai.cotal.priced`.
+ *
+ * The authority model has TWO distinct signatures (§13.7): a trait DEFINITION
+ * `{ urn, valueSchema, selector, breakingChanges, authority }` is content-addressed and
+ * signed by a key whose anchor's traits-scope covers the urn's reverse-DNS domain (the
+ * space-operator key carries `ai.cotal`; a third party registers under its own domain
+ * claim); every governed ATTACHMENT is SEPARATELY signed by the definition's NAMED
+ * authority over `{ endpoint, command, contractDigest, traitUrn, value }` — so a
+ * self-published descriptor cannot strip, forge, or downgrade a governed annotation
+ * (the annotation's authority is the attachment, bound to the cluster document's complete
+ * closure digest, never the descriptor's own bytes). Removal or downgrade is an authorized
+ * contract revision, enforced at the trusted registration write (registerServiceInstance's
+ * governed-continuity seam) against the registry's prior spec, so a surviving command cannot
+ * drop a governed trait.
+ *
+ * Core owns exactly the fail-closed verification interfaces (§13.9 trait seam): the guard
+ * call and priced-proof hooks are SEAMS — policy engines, token formats, and payment rails
+ * are extensions behind them, and the test implementations live in smokes, never here.
+ * Non-governed traits are unsigned vocabulary: declared in the cluster document, carried
+ * in describe, never gated here.
+ */
+import { canonicalJson, contractDigest, isContractDigest } from "./canonical.js";
+import { EpEnvelopeError } from "./endpoint-envelope.js";
+import { ContractInvalidError, compileContract } from "./schema-profile.js";
+import { verifyClusterManifest, isReverseDnsUrn, TRAIT_GUARDED, TRAIT_PRICED, GOVERNED_TRAIT_URNS } from "./endpoint-cluster.js";
+import { runGuardGate } from "./endpoint-guard.js";
+import { assertServeGrantAuthorized } from "./endpoint-service.js";
+import { resolveAnchorForUse, verifyArtifactSignature, assertAnchorScopeCovers, } from "./endpoint-signing.js";
+// The trait vocabulary constants (TRAIT_GUARDED / TRAIT_PRICED / GOVERNED_TRAIT_URNS) are
+// defined in endpoint-cluster.ts, the layer both this module and the trusted registrar depend
+// on, so the registrar pins the canonical governed set structurally without an import cycle
+// (this module imports endpoint-service for the serve-grant seam). Re-exported here: the trait
+// vocabulary remains part of this module's public surface.
+export { TRAIT_GUARDED, TRAIT_PRICED, GOVERNED_TRAIT_URNS };
+/** What a trait definition may attach to (§13.7). */
+export const TRAIT_SELECTORS = Object.freeze(["cluster", "command", "attribute", "event"]);
+const isRec = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+function deepFreeze(v) {
+    if (v !== null && typeof v === "object") {
+        for (const child of Object.values(v))
+            deepFreeze(child);
+        Object.freeze(v);
+    }
+    return v;
+}
+// Provenance brands (the compiled-contract / serve-grant pattern): the consuming seams check
+// the brand, never structure, so a hand-built artifact that skipped verification can never
+// enter an enforcement path.
+const VERIFIED_DEFINITIONS = new WeakSet();
+const VERIFIED_ATTACHMENTS = new WeakSet();
+function invalid(what) {
+    throw new ContractInvalidError(`trait artifact does not validate: ${what}`);
+}
+/** Deep-copy a received artifact into a PRIVATE, deep-frozen snapshot BEFORE any await: the
+ *  parse, the signature, the value-schema validation, and the brand must all attest the SAME
+ *  bytes. A parsed artifact that aliases caller-reachable objects (`att.value` ← `raw.value`)
+ *  can otherwise be mutated DURING the awaited anchor/schema reads AFTER the signature verified
+ *  — branding a value nobody signed (finding: signed "warden", branded "evil").
+ *
+ *  The snapshot is built through the STRICT RFC 8785 / I-JSON canonical path
+ *  ({@link canonicalJson}), NOT `JSON.stringify`: `JSON.stringify` is a LENIENT projection that
+ *  silently DROPS `undefined`/function/symbol object properties and coerces non-finite numbers
+ *  to `null`, so snapshotting through it would verify the signature over a NORMALIZED artifact
+ *  rather than the exact received bytes — the same D28 field-dropping class the 2c6d071 fold
+ *  closed for nested `{keyId}` (finding: an unsigned `value.unsignedExtra: undefined` that
+ *  refuses against the exact raw would ride once `JSON.stringify` drops it). `canonicalJson`
+ *  THROWS on any non-interchangeable value (undefined anywhere, non-finite number, lone
+ *  surrogate), so a non-I-JSON artifact REFUSES here instead of being normalized; and the
+ *  snapshot's canonical form is byte-identical to what {@link verifyArtifactSignature} checks. */
+function snapshotArtifact(raw, what) {
+    let copy;
+    try {
+        copy = JSON.parse(canonicalJson(raw));
+    }
+    catch (e) {
+        invalid(`${what} is not strict interchangeable JSON (${e?.message ?? String(e)}); a signed artifact must canonicalize exactly, never through a value-dropping projection (SPEC 13.10 D28)`);
+    }
+    if (!isRec(copy))
+        invalid(`${what} is not an object`);
+    return deepFreeze(copy);
+}
+/** A closed `{ keyId: <non-empty string> }` object, nothing else (§13.10, D28): the nested
+ *  signer/authority shapes are part of the signed artifact, so an UNKNOWN nested field must
+ *  refuse — otherwise it would ride UNSIGNED under a field-dropping projection and the recomputed
+ *  signature would still verify over the clean version. */
+function assertClosedKeyId(v, what) {
+    if (!isRec(v) || typeof v.keyId !== "string" || v.keyId === "")
+        invalid(`${what} is not { keyId } (a non-empty string)`);
+    const keys = Object.keys(v);
+    if (keys.length !== 1 || keys[0] !== "keyId")
+        invalid(`${what} carries fields other than keyId (${keys.sort().join(",")}); a nested object is a CLOSED shape so no unsigned field can ride under it (SPEC 13.10 D28)`);
+    return { keyId: v.keyId };
+}
+function parseTraitDefinitionShape(raw) {
+    const o = isRec(raw) ? raw : invalid("definition is not an object");
+    if (o.v !== 1)
+        invalid(`definition v ${JSON.stringify(o.v)} is not 1`);
+    if (typeof o.urn !== "string" || !isReverseDnsUrn(o.urn))
+        invalid(`definition urn ${JSON.stringify(o.urn)} is not a reverse-DNS trait URN`);
+    if (typeof o.valueSchema !== "string" || !isContractDigest(o.valueSchema))
+        invalid("definition valueSchema is not a sha256 closure digest");
+    if (!Array.isArray(o.selector) || o.selector.length === 0)
+        invalid("definition selector must be a non-empty array");
+    const seen = new Set();
+    for (const s of o.selector) {
+        if (typeof s !== "string" || !TRAIT_SELECTORS.includes(s))
+            invalid(`definition selector entry ${JSON.stringify(s)} is not one of ${TRAIT_SELECTORS.join("|")}`);
+        if (seen.has(s))
+            invalid(`definition selector lists "${s}" twice`);
+        seen.add(s);
+    }
+    if (typeof o.breakingChanges !== "boolean")
+        invalid("definition breakingChanges is not a boolean");
+    const authority = assertClosedKeyId(o.authority, "definition authority");
+    const signer = assertClosedKeyId(o.signer, "definition signer");
+    if (typeof o.sig !== "string")
+        invalid("definition sig is absent");
+    const keys = Object.keys(o).sort().join(",");
+    if (keys !== "authority,breakingChanges,selector,sig,signer,urn,v,valueSchema")
+        invalid(`definition carries unknown/missing fields (${keys}); the artifact is a closed discriminated schema (SPEC 13.10)`);
+    return {
+        v: 1, urn: o.urn, valueSchema: o.valueSchema, selector: [...o.selector],
+        breakingChanges: o.breakingChanges, authority, signer, sig: o.sig,
+    };
+}
+/**
+ * Verify a trait DEFINITION (§13.7/§13.10), fail closed: shape (closed schema), the signer
+ * resolved FRESH in the anchor registry (role `traits`, window at verification time — a
+ * definition is timeless content, its authority must be live), the signer's traits-scope
+ * covering the urn's reverse-DNS domain (this is what makes `ai.cotal.*` operator-only and
+ * a third-party urn its registered owner's), and the D28 signature. Returns the frozen,
+ * provenance-branded definition; every attachment verifier REQUIRES the brand.
+ */
+export async function verifyTraitDefinition(raw, opts) {
+    // Snapshot FIRST (before the anchor await): the parse, the signature, and the returned
+    // artifact all attest one immutable copy — a caller mutating `raw` mid-verification races
+    // nothing (§13.10 D28: the verified bytes ARE the branded bytes).
+    const artifact = snapshotArtifact(raw, "trait definition");
+    const def = parseTraitDefinitionShape(artifact); // closed schema incl. closed nested {keyId}
+    const anchor = await resolveAnchorForUse(opts.resolveAnchor, { keyId: def.signer.keyId, role: "traits", at: opts.now ?? Date.now() });
+    assertAnchorScopeCovers(anchor, "traits", def.urn, "trait definition urn");
+    // §13.10 D28: verify over the EXACT received artifact as snapshot at entry (minus sig),
+    // never a field-dropping reconstruction — the closed nested-shape checks above already
+    // guarantee the snapshot and the parsed projection agree, so an unsigned field can neither
+    // survive nor change the verified bytes.
+    verifyArtifactSignature(artifact, anchor);
+    const frozen = deepFreeze(def);
+    VERIFIED_DEFINITIONS.add(frozen);
+    return frozen;
+}
+/** True iff this exact object came out of {@link verifyTraitDefinition}. */
+export function isVerifiedTraitDefinition(def) {
+    return typeof def === "object" && def !== null && VERIFIED_DEFINITIONS.has(def);
+}
+/** The definition's content address (§13.7): the artifact digest over its FULL RFC 8785
+ *  canonical form, signature included — the value a by-digest reference names. */
+export function traitDefinitionDigest(def) {
+    return contractDigest(def);
+}
+function parseTraitAttachmentShape(raw) {
+    const o = isRec(raw) ? raw : invalid("attachment is not an object");
+    if (o.v !== 1)
+        invalid(`attachment v ${JSON.stringify(o.v)} is not 1`);
+    for (const f of ["space", "endpoint", "command", "traitUrn"])
+        if (typeof o[f] !== "string" || o[f] === "")
+            invalid(`attachment ${f} is not a non-empty string`);
+    if (typeof o.contractDigest !== "string" || !isContractDigest(o.contractDigest))
+        invalid("attachment contractDigest is not a sha256 closure digest");
+    if (!("value" in o) || o.value === undefined)
+        invalid("attachment value is absent (validate against the definition's value schema, even when void)");
+    const signer = assertClosedKeyId(o.signer, "attachment signer");
+    if (typeof o.ts !== "number" || !Number.isSafeInteger(o.ts) || o.ts <= 0)
+        invalid("attachment ts is not a positive integer timestamp");
+    if (typeof o.sig !== "string")
+        invalid("attachment sig is absent");
+    const keys = Object.keys(o).sort().join(",");
+    if (keys !== "command,contractDigest,endpoint,sig,signer,space,traitUrn,ts,v,value")
+        invalid(`attachment carries unknown/missing fields (${keys}); the artifact is a closed discriminated schema (SPEC 13.10)`);
+    return {
+        v: 1, space: o.space, endpoint: o.endpoint, command: o.command,
+        contractDigest: o.contractDigest, traitUrn: o.traitUrn, value: o.value,
+        signer, ts: o.ts, sig: o.sig,
+    };
+}
+/**
+ * Verify one governed trait ATTACHMENT against its verified definition and the EXPECTED
+ * binding coordinates (§13.7/§13.10), fail closed on every §13-acceptance adversarial class:
+ *  - substitute: `space`/`endpoint`/`command` must equal the expected target — an attachment
+ *    signed for one command can never gate (or satisfy) another;
+ *  - stale digest: `contractDigest` must equal the CURRENT declaring cluster's closure
+ *    digest — a prior revision's attachment is revision-bound evidence, never carried over;
+ *  - forge: the signer MUST BE the definition's NAMED authority, resolved fresh (role
+ *    `traits`, window checked at VERIFICATION time — never the signer-asserted `ts`, which is
+ *    self-attested and would let an expired predecessor key backdate or a not-yet-valid
+ *    successor future-date past rotation, §13.10 — revocation immediate), its traits-scope
+ *    must cover the urn, and the D28 signature must verify over the exact received bytes;
+ *  - downgrade: within a digest the value is signature-bound; a value the schema rejects
+ *    fails here, and cross-revision weakening is caught at the trusted registration write
+ *    (registerServiceInstance's governed-continuity seam), not from a caller-supplied prior;
+ *  - selector: the definition must admit a `command` target.
+ * The `value` is validated against the definition's `valueSchema` bundle, read and compiled
+ * through the SAME digest-verified path serve authorization uses.
+ */
+export async function verifyTraitAttachment(raw, opts) {
+    if (!isVerifiedTraitDefinition(opts.definition))
+        throw new EpEnvelopeError("failed-precondition", "the supplied trait definition is not a verified artifact (verifyTraitDefinition); an unverified definition carries no attachment authority (SPEC 13.7)");
+    // Snapshot FIRST (before any await): `att.value` below references the snapshot, so a caller
+    // mutating `raw.value` during the awaited anchor/schema reads cannot change what gets
+    // signature-verified, schema-validated, or branded (finding: signed "warden" branded as
+    // "evil" via the alias). The verified bytes ARE the branded bytes (§13.10 D28).
+    const artifact = snapshotArtifact(raw, "trait attachment");
+    const att = parseTraitAttachmentShape(artifact);
+    const def = opts.definition;
+    if (att.traitUrn !== def.urn)
+        throw new EpEnvelopeError("failed-precondition", `attachment traitUrn "${att.traitUrn}" is not the definition's "${def.urn}"; an attachment verifies only against its own trait's definition (SPEC 13.7)`);
+    if (!def.selector.includes("command"))
+        throw new EpEnvelopeError("failed-precondition", `trait "${def.urn}" selector [${def.selector.join(", ")}] does not admit a command target; an attachment outside its definition's selector never verifies (SPEC 13.7)`);
+    if (att.space !== opts.expect.space)
+        throw new EpEnvelopeError("failed-precondition", `attachment space "${att.space}" is not "${opts.expect.space}"; trust roots never merge across spaces (SPEC 13.10)`);
+    if (att.endpoint !== opts.expect.endpoint || att.command !== opts.expect.command)
+        throw new EpEnvelopeError("failed-precondition", `attachment is bound to ${att.endpoint}/${att.command}, not ${opts.expect.endpoint}/${opts.expect.command}; a substituted attachment never verifies (SPEC 13.7)`);
+    if (att.contractDigest !== opts.expect.contractDigest)
+        throw new EpEnvelopeError("failed-precondition", `attachment is bound to contractDigest ${att.contractDigest}, not the current declaring closure ${opts.expect.contractDigest}; a stale revision's attachment is evidence for ITS revision only (SPEC 13.10: replaced only by an authorized contract revision)`);
+    if (att.signer.keyId !== def.authority.keyId)
+        throw new EpEnvelopeError("permission-denied", `attachment is signed by ${att.signer.keyId}, not the definition's named authority ${def.authority.keyId}; attachment authority is the definition's to name (SPEC 13.7)`);
+    const anchor = await resolveAnchorForUse(opts.resolveAnchor, { keyId: att.signer.keyId, role: "traits", at: opts.now ?? Date.now() });
+    assertAnchorScopeCovers(anchor, "traits", att.traitUrn, "trait attachment urn");
+    // §13.10 D28: verify over the EXACT received artifact as snapshot at entry (minus sig),
+    // never a reconstruction — and never the caller's still-mutable `raw`.
+    verifyArtifactSignature(artifact, anchor);
+    // Value-schema validation through the digest-verified two-step read (§13.7): manifest at the
+    // closure digest, root at manifest.root, profile-compiled; the compiled closure digest must
+    // round-trip to the definition's valueSchema, so no unverified byte enters the validator.
+    const readSchema = async (digest, what) => {
+        let bytes;
+        try {
+            bytes = await opts.readArtifact(digest);
+        }
+        catch (e) {
+            throw new EpEnvelopeError("unavailable", `the contract-store read seam failed for the ${what} ${digest}; attachment verification fails closed (SPEC 13.7): ${e?.message ?? String(e)}`);
+        }
+        if (bytes === undefined)
+            throw new EpEnvelopeError("failed-precondition", `the ${what} ${digest} is not readable from the contract store; an unverifiable value schema never verifies an attachment (SPEC 13.7)`);
+        return bytes;
+    };
+    const manifestRaw = await readSchema(def.valueSchema, "trait value-schema manifest");
+    const { root } = verifyClusterManifest(def.valueSchema, manifestRaw);
+    const rootRaw = await readSchema(root, "trait value-schema document");
+    const compiled = compileContract({ root: rootRaw });
+    if (compiled.closureDigest !== def.valueSchema)
+        throw new EpEnvelopeError("internal", `the compiled value schema's closure digest ${compiled.closureDigest} does not round-trip to the definition's ${def.valueSchema}; a store/manifest inconsistency never verifies (SPEC 13.7)`);
+    if (!compiled.validate(att.value)) {
+        const first = compiled.validate.errors?.[0];
+        throw new EpEnvelopeError("failed-precondition", `attachment value does not validate against trait "${def.urn}"'s value schema${first ? `: ${first.instancePath || "/"} ${first.message ?? ""}` : ""} (SPEC 13.7)`);
+    }
+    const frozen = deepFreeze(att);
+    VERIFIED_ATTACHMENTS.add(frozen);
+    return frozen;
+}
+/** True iff this exact object came out of {@link verifyTraitAttachment}. */
+export function isVerifiedTraitAttachment(att) {
+    return typeof att === "object" && att !== null && VERIFIED_ATTACHMENTS.has(att);
+}
+const VERIFIED_GOVERNED = new WeakMap();
+/**
+ * Verify a serve grant's WHOLE governed surface (§13.7, fail closed, both strip directions):
+ * every granted command's DECLARED governed traits must each have exactly one verified
+ * attachment bound to that command's declaring closure digest (a declared-but-unattached
+ * governed trait is a strip or an unverifiable annotation — refuse before effect), and every
+ * supplied attachment must land on a command that DECLARES its trait (an attached-but-
+ * undeclared governed trait means the self-published descriptor dropped an authority's
+ * annotation — equally a strip). Duplicates, unknown commands, non-governed urns, and
+ * missing definitions all refuse. Returns the branded surface, bound to exactly this grant's
+ * identity coordinates; {@link assertGovernedSurfaceFor} is the serve-side check.
+ *
+ * This verifies the CURRENT surface's declaration<->attachment coherence (both strip directions
+ * WITHIN a revision). Cross-REVISION governed-continuity (a re-registration may not strip an
+ * authority-imposed trait from a surviving command, §13.7) is enforced at the TRUSTED registration
+ * write (registerServiceInstance's governed-continuity seam) against the registry's prior
+ * spec — NOT here, and NOT from a caller-supplied prior surface, which the owner could forge by
+ * claiming "first governance".
+ */
+export async function verifyGovernedSurface(args) {
+    assertServeGrantAuthorized(args.serve);
+    const defs = new Map();
+    for (const def of args.definitions) {
+        if (!isVerifiedTraitDefinition(def))
+            throw new EpEnvelopeError("failed-precondition", "a supplied trait definition is not a verified artifact (verifyTraitDefinition); fail closed (SPEC 13.7)");
+        if (!GOVERNED_TRAIT_URNS.includes(def.urn))
+            throw new EpEnvelopeError("failed-precondition", `definition "${def.urn}" is not a governed trait; this revision governs exactly ${GOVERNED_TRAIT_URNS.join(" and ")} (SPEC 13.7), and non-governed traits are unsigned vocabulary with no attachment surface`);
+        if (defs.has(def.urn))
+            throw new EpEnvelopeError("failed-precondition", `two definitions supplied for "${def.urn}"; a governed trait has one definition per verification (SPEC 13.7)`);
+        defs.set(def.urn, def);
+    }
+    // NULL-PROTOTYPE dictionaries at BOTH levels: a command is caller-named text under the
+    // `[a-z0-9-]{1,32}` grammar, and "constructor" is a valid token — on a plain `{}` it would
+    // resolve the inherited `Object.prototype.constructor` (truthy!), so the attachment would be
+    // written onto the GLOBAL `Object` function instead of an own frozen entry: coverage would
+    // pass via inherited state, another surface could observe/reuse it, and deleting the global
+    // property post-brand would un-govern the command (finding). `Object.create(null)` has no
+    // prototype, so every lookup is an own-property read.
+    const commands = Object.create(null);
+    for (const raw of args.attachments) {
+        // Route on minimally-read fields; full verification below binds them all over the signature.
+        const o = isRec(raw) ? raw : invalid("attachment is not an object");
+        const command = typeof o.command === "string" ? o.command : invalid("attachment command is not a string");
+        const urn = typeof o.traitUrn === "string" ? o.traitUrn : invalid("attachment traitUrn is not a string");
+        const decl = args.serve.surface[command];
+        if (decl === undefined)
+            throw new EpEnvelopeError("failed-precondition", `attachment names command "${command}", which is not on the granted registered surface (SPEC 13.7)`);
+        if (!GOVERNED_TRAIT_URNS.includes(urn))
+            throw new EpEnvelopeError("failed-precondition", `attachment names "${urn}", not a governed trait; this revision governs exactly ${GOVERNED_TRAIT_URNS.join(" and ")} (SPEC 13.7)`);
+        if (!decl.traits.includes(urn))
+            throw new EpEnvelopeError("failed-precondition", `command "${command}" carries a verified-authority attachment for "${urn}" that its registered declaration does not declare; a self-published descriptor cannot strip a governed annotation (SPEC 13.7)`);
+        const def = defs.get(urn);
+        if (def === undefined)
+            throw new EpEnvelopeError("failed-precondition", `no verified definition supplied for governed trait "${urn}"; an attachment without its definition is unverifiable and refuses (SPEC 13.7)`);
+        const att = await verifyTraitAttachment(raw, {
+            definition: def,
+            expect: { space: args.serve.space, endpoint: args.serve.endpoint, command, contractDigest: decl.clusterDigest },
+            resolveAnchor: args.resolveAnchor,
+            readArtifact: args.readArtifact,
+            ...(args.now !== undefined ? { now: args.now } : {}),
+        });
+        const per = commands[command] ?? (commands[command] = Object.create(null));
+        if (per[urn] !== undefined)
+            throw new EpEnvelopeError("failed-precondition", `two attachments supplied for ${command}/${urn}; the governed surface is one attachment per (command, trait) (SPEC 13.7)`);
+        per[urn] = att;
+    }
+    for (const cmd of args.serve.commands) {
+        for (const urn of args.serve.surface[cmd].traits) {
+            if (!GOVERNED_TRAIT_URNS.includes(urn))
+                continue; // vocabulary: unsigned, ungated
+            if (commands[cmd]?.[urn] === undefined)
+                throw new EpEnvelopeError("failed-precondition", `command "${cmd}" declares governed trait "${urn}" with no verified attachment for the current contract digest; missing, unverifiable, or stale governed attachments refuse before effect (SPEC 13.7)`);
+        }
+    }
+    // Deep-frozen: the attachments are already frozen; this locks the nested records too, so the
+    // brand below attests an object no caller can mutate after verification (finding: a frozen Map
+    // is still mutable; a frozen plain record is not).
+    const surface = deepFreeze({ commands });
+    VERIFIED_GOVERNED.set(surface, {
+        space: args.serve.space, endpoint: args.serve.endpoint, instanceId: args.serve.instanceId,
+        epoch: args.serve.epoch, registrationRevision: args.serve.registrationRevision,
+        grantCommands: new Set(args.serve.commands),
+    });
+    return surface;
+}
+/** Refuse a governed surface that {@link verifyGovernedSurface} did not produce FOR THIS
+ *  grant: brand first (structure carries no verification), then the identity bond — a
+ *  surface verified for another instance, epoch, or registration revision never gates this
+ *  one (a re-registration re-verifies; the fresh grant demands a fresh surface). */
+export function assertGovernedSurfaceFor(surface, serve) {
+    const bond = VERIFIED_GOVERNED.get(surface);
+    if (bond === undefined)
+        throw new Error("the traits surface is not a verified governed surface (verifyGovernedSurface); a structural value carries no verification (SPEC 13.7)");
+    if (bond.space !== serve.space || bond.endpoint !== serve.endpoint || bond.instanceId !== serve.instanceId
+        || bond.epoch !== serve.epoch || bond.registrationRevision !== serve.registrationRevision)
+        throw new Error(`the governed surface was verified for ${bond.endpoint}/${bond.instanceId}@${bond.epoch} rev ${bond.registrationRevision}, not this grant (${serve.endpoint}/${serve.instanceId}@${serve.epoch} rev ${serve.registrationRevision}); a re-registration demands a fresh verification (SPEC 13.7)`);
+}
+// §13.7 downgrade/removal continuity — "removal or downgrade is an AUTHORIZED contract
+// revision" — is enforced at the TRUSTED registration write (registerServiceInstance's
+// governed-continuity seam), against the registry's own prior spec. It is deliberately NOT a
+// serve-side check over two caller-supplied branded surfaces: the owner controls the descriptor,
+// so a caller-supplied "previous" (or a claimed first-governance) is forgeable, whereas the prior
+// registered spec is not. See registerServiceInstance.
+// ---- the pre-effect enforcement gate (§13.9 trait seam) ------------------------------------------
+/** The reference guard/proof seam deadline (§13.8: reference default call deadline 15s;
+ *  overridable, never removable) when the request carries no tighter budget. A governed gate
+ *  MUST be bounded — a never-settling seam is timeout→deny, never a hung request. */
+export const REFERENCE_GOVERNED_SEAM_DEADLINE_MS = 15_000;
+/** Race a fail-closed seam against its deadline: a never-settling guard/proof becomes DENY
+ *  (`permission-denied`) at the bound, so it can never hold the request or `serveEndpoint.stop()`
+ *  open (§13.6: timeout or unreachable is deny). The seam's own throw is re-raised for the
+ *  caller to map; only the timeout is synthesized here. */
+async function raceSeam(work, ms, what) {
+    let timer;
+    try {
+        return await Promise.race([
+            Promise.resolve(work),
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new EpEnvelopeError("permission-denied", `${what} did not answer within the ${ms}ms bound; timeout is deny (SPEC 13.6: fail closed, never a hung request)`)), ms);
+            }),
+        ]);
+    }
+    finally {
+        if (timer !== undefined)
+            clearTimeout(timer);
+    }
+}
+/**
+ * The fail-closed pre-effect gate (§13.7/§13.9): run once per accepted request, AFTER args
+ * validation, target currency, and mode authorization, immediately BEFORE the handler — for
+ * calls and casts alike (casts have effects too). Guard FIRST, then priced (deliberate: a
+ * guard deny must never burn a one-use payment proof). Every anomalous answer refuses:
+ *  - guarded: THE gate is {@link runGuardGate} — the guard's raw answer is parsed CLOSED and
+ *    every obligation is VERIFIED (D28 signature, anchor role/scope, validity window,
+ *    space + request binding) before it can reach a handler; wiring absent, seam throw,
+ *    timeout, garbled answer, or an unverifiable obligation = DENY (`permission-denied`);
+ *    `deny` = `permission-denied`; `hold` = `failed-precondition` on THIS rail (hold converts
+ *    an ACTION to waiting on a guard-owned checkpoint, §13.6 — the ephemeral rail cannot
+ *    wait; the action composite's own gate, `gateGoalExecution`, routes hold);
+ *  - priced: absent `auth` slot, seam absent, seam throw, non-boolean or false answer =
+ *    `permission-denied`; a proof is verified, never assumed.
+ * Both gates are BOUNDED by `deadlineMs` (the request budget, or the §13.8 reference
+ * default): a never-settling extension becomes deny at the bound, never a hung request.
+ * Returns the guard's VERIFIED obligations for the handler context. Receipt emission for
+ * priced commands is the §13.10 receipts slice (D9), not gated here.
+ */
+export async function assertGovernedPreEffect(args) {
+    const governed = args.enforcement.governed.commands[args.command];
+    if (governed === undefined)
+        return {};
+    const seamMs = args.deadlineMs !== undefined && Number.isSafeInteger(args.deadlineMs) && args.deadlineMs > 0
+        ? args.deadlineMs : REFERENCE_GOVERNED_SEAM_DEADLINE_MS;
+    let obligations;
+    const guarded = governed[TRAIT_GUARDED];
+    if (guarded !== undefined) {
+        const guard = args.enforcement.guard;
+        if (guard === undefined)
+            throw new EpEnvelopeError("permission-denied", `command "${args.command}" is guarded and this instance wired no guard seam; an unreachable guard is deny (SPEC 13.6: fail closed)`);
+        // The VERIFIED trait value names the guard endpoint; an unroutable guard is deny.
+        const guardEndpoint = isRec(guarded.value) ? guarded.value.guard : undefined;
+        if (typeof guardEndpoint !== "string" || guardEndpoint.length === 0)
+            throw new EpEnvelopeError("permission-denied", `command "${args.command}" carries a guarded trait whose value names no guard endpoint; an unroutable guard is deny (SPEC 13.6: fail closed)`);
+        // ONE gate: runGuardGate owns the call, the closed parse, and the D28 obligation
+        // verification. It throws permission-denied on deny/timeout/garble/unverifiable
+        // obligation (fail closed); its only returns are a VERIFIED allow or a VERIFIED hold.
+        const verdict = await runGuardGate({
+            guardEndpoint,
+            request: { endpoint: args.endpoint, command: args.command, id: args.requestId, caller: args.caller },
+            callGuard: guard.call,
+            deadlineMs: seamMs,
+            now: guard.now !== undefined ? guard.now() : Date.now(),
+            space: args.space,
+            resolveAnchor: guard.resolveAnchor,
+        });
+        if (verdict.decision === "hold")
+            throw new EpEnvelopeError("failed-precondition", `the guard held "${args.command}": hold converts an ACTION to waiting on a guard-owned checkpoint (SPEC 13.6), and the ephemeral rail cannot wait; submit the work as an action, whose gate (gateGoalExecution) routes hold; refusing pre-effect`);
+        obligations = verdict.obligations;
+    }
+    const priced = governed[TRAIT_PRICED];
+    if (priced !== undefined) {
+        if (args.auth === undefined)
+            throw new EpEnvelopeError("permission-denied", `command "${args.command}" is priced and the request carries no auth-slot payment proof; a priced command verifies an independently verifiable proof before effect, never a bare assertion (SPEC 13.10)`);
+        const verify = args.enforcement.verifyPaymentProof;
+        if (verify === undefined)
+            throw new EpEnvelopeError("permission-denied", `command "${args.command}" is priced and this instance wired no proof verifier; an unverifiable proof never effects (SPEC 13.10: fail closed)`);
+        let ok;
+        try {
+            ok = await raceSeam(verify({ endpoint: args.endpoint, command: args.command, caller: args.caller, requestId: args.requestId, proof: args.auth, value: priced.value }), seamMs, `the payment-proof verifier for "${args.command}"`);
+        }
+        catch (e) {
+            if (e instanceof EpEnvelopeError)
+                throw e; // the bound's deny, already fail-closed
+            throw new EpEnvelopeError("permission-denied", `the payment-proof verifier failed (${e?.message ?? String(e)}); verification fails closed (SPEC 13.10)`);
+        }
+        if (typeof ok !== "boolean")
+            throw new EpEnvelopeError("permission-denied", "the payment-proof verifier returned a non-boolean; a malformed answer fails closed (SPEC 13.10)");
+        if (!ok)
+            throw new EpEnvelopeError("permission-denied", `the payment proof did not verify for "${args.command}" (SPEC 13.10: valid proof in the slot or reject)`);
+    }
+    return obligations !== undefined ? { obligations } : {};
+}
+//# sourceMappingURL=endpoint-traits.js.map

package/dist/endpoint-traits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint-traits.js","sourceRoot":"","sources":["../src/endpoint-traits.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACjI,OAAO,EAAE,YAAY,EAA4C,MAAM,qBAAqB,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAqB,MAAM,uBAAuB,CAAC;AAEtF,OAAO,EACL,mBAAmB,EAAE,uBAAuB,EAAE,uBAAuB,GACtE,MAAM,uBAAuB,CAAC;AAE/B,0FAA0F;AAC1F,8FAA8F;AAC9F,4FAA4F;AAC5F,+FAA+F;AAC/F,2DAA2D;AAC3D,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,mBAAmB,EAAE,CAAC;AAE5D,qDAAqD;AACrD,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,CAAU,CAAC,CAAC;AAyCpG,MAAM,KAAK,GAAG,CAAC,CAAU,EAAgC,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAErH,SAAS,UAAU,CAAI,CAAI;IACzB,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QACxC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,CAA4B,CAAC;YAAE,UAAU,CAAC,KAAK,CAAC,CAAC;QACnF,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,6FAA6F;AAC7F,2FAA2F;AAC3F,6BAA6B;AAC7B,MAAM,oBAAoB,GAAG,IAAI,OAAO,EAAmB,CAAC;AAC5D,MAAM,oBAAoB,GAAG,IAAI,OAAO,EAAmB,CAAC;AAE5D,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,IAAI,oBAAoB,CAAC,qCAAqC,IAAI,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;;;;kGAekG;AAClG,SAAS,gBAAgB,CAAC,GAAY,EAAE,IAAY;IAClD,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,IAAI,wCAAyC,CAAW,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,4GAA4G,CAAC,CAAC;IACzM,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,GAAG,IAAI,mBAAmB,CAAC,CAAC;IACtD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;2DAG2D;AAC3D,SAAS,iBAAiB,CAAC,CAAU,EAAE,IAAY;IACjD,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,OAAQ,CAA6B,CAAC,KAAK,KAAK,QAAQ,IAAK,CAA6B,CAAC,KAAK,KAAK,EAAE;QACtH,OAAO,CAAC,GAAG,IAAI,wCAAwC,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAA4B,CAAC,CAAC;IACvD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO;QAC1C,OAAO,CAAC,GAAG,IAAI,qCAAqC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,8FAA8F,CAAC,CAAC;IAC3K,OAAO,EAAE,KAAK,EAAG,CAAuB,CAAC,KAAK,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,yBAAyB,CAAC,GAAY;IAC7C,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC;IACpE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACvE,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,kBAAkB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;IAC5I,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,WAAW,CAAC;QAAE,OAAO,CAAC,uDAAuD,CAAC,CAAC;IAC5I,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,+CAA+C,CAAC,CAAC;IACpH,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAE,eAAqC,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,6BAA6B,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvL,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,8BAA8B,CAAC,SAAS,CAAC,CAAC;QACnE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,CAAC,6CAA6C,CAAC,CAAC;IACnG,MAAM,SAAS,GAAG,iBAAiB,CAAC,CAAC,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,IAAI,KAAK,iEAAiE;QAC5E,OAAO,CAAC,8CAA8C,IAAI,+DAA+D,CAAC,CAAC;IAC7H,OAAO;QACL,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC,GAAI,CAAC,CAAC,QAA4B,CAAC;QAC5F,eAAe,EAAE,CAAC,CAAC,eAAe,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG;KAClE,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAY,EACZ,IAAqD;IAErD,uFAAuF;IACvF,0FAA0F;IAC1F,kEAAkE;IAClE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC,CAAC,4CAA4C;IAC7F,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACtI,uBAAuB,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;IAC3E,wFAAwF;IACxF,uFAAuF;IACvF,2FAA2F;IAC3F,yCAAyC;IACzC,uBAAuB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,yBAAyB,CAAC,GAAY;IACpD,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,oBAAoB,CAAC,GAAG,CAAC,GAAsB,CAAC,CAAC;AACrG,CAAC;AAED;kFACkF;AAClF,MAAM,UAAU,qBAAqB,CAAC,GAAoB;IACxD,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,yBAAyB,CAAC,GAAY;IAC7C,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC;IACpE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACvE,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,CAAU;QACnE,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE;YAAE,OAAO,CAAC,cAAc,CAAC,4BAA4B,CAAC,CAAC;IACpG,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,cAAc,CAAC;QAAE,OAAO,CAAC,0DAA0D,CAAC,CAAC;IACrJ,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,6FAA6F,CAAC,CAAC;IACrJ,MAAM,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC;QAAE,OAAO,CAAC,mDAAmD,CAAC,CAAC;IACvI,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,IAAI,KAAK,sEAAsE;QACjF,OAAO,CAAC,8CAA8C,IAAI,+DAA+D,CAAC,CAAC;IAC7H,OAAO;QACL,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAe,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAkB,EAAE,OAAO,EAAE,CAAC,CAAC,OAAiB;QAC5F,cAAc,EAAE,CAAC,CAAC,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAkB,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK;QAChF,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG;KAC7B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAY,EACZ,IASC;IAED,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,UAAU,CAAC;QAC7C,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,wJAAwJ,CAAC,CAAC;IAC7M,4FAA4F;IAC5F,sFAAsF;IACtF,wFAAwF;IACxF,gFAAgF;IAChF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC;IAC5B,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,GAAG;QAC1B,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,wBAAwB,GAAG,CAAC,QAAQ,8BAA8B,GAAG,CAAC,GAAG,+EAA+E,CAAC,CAAC;IAC7M,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QACnC,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,UAAU,GAAG,CAAC,GAAG,eAAe,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,+GAA+G,CAAC,CAAC;IAC3N,IAAI,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK;QACjC,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,qBAAqB,GAAG,CAAC,KAAK,aAAa,IAAI,CAAC,MAAM,CAAC,KAAK,uDAAuD,CAAC,CAAC;IACxK,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO;QAC9E,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,0BAA0B,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,OAAO,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,uDAAuD,CAAC,CAAC;IACrN,IAAI,GAAG,CAAC,cAAc,KAAK,IAAI,CAAC,MAAM,CAAC,cAAc;QACnD,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,yCAAyC,GAAG,CAAC,cAAc,uCAAuC,IAAI,CAAC,MAAM,CAAC,cAAc,kIAAkI,CAAC,CAAC;IACnT,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,GAAG,CAAC,SAAS,CAAC,KAAK;QAC1C,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,2BAA2B,GAAG,CAAC,MAAM,CAAC,KAAK,0CAA0C,GAAG,CAAC,SAAS,CAAC,KAAK,gEAAgE,CAAC,CAAC;IAC3N,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACtI,uBAAuB,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC;IAChF,wFAAwF;IACxF,uEAAuE;IACvE,uBAAuB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,6FAA6F;IAC7F,4FAA4F;IAC5F,0FAA0F;IAC1F,MAAM,UAAU,GAAG,KAAK,EAAE,MAAc,EAAE,IAAY,EAAoB,EAAE;QAC1E,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,+CAA+C,IAAI,IAAI,MAAM,uDAAwD,CAAW,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrM,CAAC;QACD,IAAI,KAAK,KAAK,SAAS;YACrB,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,OAAO,IAAI,IAAI,MAAM,iHAAiH,CAAC,CAAC;QAC3L,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,6BAA6B,CAAC,CAAC;IACrF,MAAM,EAAE,IAAI,EAAE,GAAG,qBAAqB,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACpD,IAAI,QAAQ,CAAC,aAAa,KAAK,GAAG,CAAC,WAAW;QAC5C,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,8CAA8C,QAAQ,CAAC,aAAa,4CAA4C,GAAG,CAAC,WAAW,6DAA6D,CAAC,CAAC;IACtO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,qDAAqD,GAAG,CAAC,GAAG,mBAAmB,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,YAAY,IAAI,GAAG,IAAI,KAAK,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;IACtN,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,yBAAyB,CAAC,GAAY;IACpD,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,oBAAoB,CAAC,GAAG,CAAC,GAAsB,CAAC,CAAC;AACrG,CAAC;AA4BD,MAAM,iBAAiB,GAAG,IAAI,OAAO,EAAmC,CAAC;AAEzE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAO3C;IACC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,GAAG,EAA2B,CAAC;IAChD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACnC,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC;YACjC,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,yGAAyG,CAAC,CAAC;QAC9J,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YACxC,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,eAAe,GAAG,CAAC,GAAG,4DAA4D,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,0FAA0F,CAAC,CAAC;QAClQ,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;YACnB,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,iCAAiC,GAAG,CAAC,GAAG,qEAAqE,CAAC,CAAC;QAClK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACzB,CAAC;IACD,uFAAuF;IACvF,2FAA2F;IAC3F,6FAA6F;IAC7F,2FAA2F;IAC3F,4FAA4F;IAC5F,0FAA0F;IAC1F,sDAAsD;IACtD,MAAM,QAAQ,GAAoD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtF,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACnC,6FAA6F;QAC7F,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,oCAAoC,CAAC,CAAC;QAC1G,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC;QACzG,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,IAAI,KAAK,SAAS;YACpB,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,6BAA6B,OAAO,+DAA+D,CAAC,CAAC;QACxJ,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC;YACpC,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,qBAAqB,GAAG,0DAA0D,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACtL,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC5B,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,YAAY,OAAO,kDAAkD,GAAG,gIAAgI,CAAC,CAAC;QAC7P,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,GAAG,KAAK,SAAS;YACnB,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,uDAAuD,GAAG,iFAAiF,CAAC,CAAC;QAChM,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE;YAC3C,UAAU,EAAE,GAAG;YACf,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,aAAa,EAAE;YAC/G,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrD,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAoC,CAAC,CAAC;QAC9G,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS;YACxB,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,gCAAgC,OAAO,IAAI,GAAG,2EAA2E,CAAC,CAAC;QAC9K,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACjB,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACtC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;YACjD,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,SAAS,CAAC,gCAAgC;YAClF,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,SAAS;gBACpC,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,YAAY,GAAG,8BAA8B,GAAG,sJAAsJ,CAAC,CAAC;QAC7P,CAAC;IACH,CAAC;IACD,6FAA6F;IAC7F,+FAA+F;IAC/F,mDAAmD;IACnD,MAAM,OAAO,GAAsB,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC5D,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE;QAC7B,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU;QACzF,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,oBAAoB,EAAE,IAAI,CAAC,KAAK,CAAC,oBAAoB;QAC9E,aAAa,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;KAC5C,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;oFAGoF;AACpF,MAAM,UAAU,wBAAwB,CAAC,OAA0B,EAAE,KAAmB;IACtF,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,IAAI,KAAK,SAAS;QACpB,MAAM,IAAI,KAAK,CAAC,uIAAuI,CAAC,CAAC;IAC3J,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;WACrG,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,oBAAoB,KAAK,KAAK,CAAC,oBAAoB;QACzF,MAAM,IAAI,KAAK,CAAC,yCAAyC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,oBAAoB,qBAAqB,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,KAAK,QAAQ,KAAK,CAAC,oBAAoB,+DAA+D,CAAC,CAAC;AACrT,CAAC;AAED,uFAAuF;AACvF,uFAAuF;AACvF,6FAA6F;AAC7F,iGAAiG;AACjG,kGAAkG;AAClG,uDAAuD;AAEvD,qGAAqG;AAErG;;qFAEqF;AACrF,MAAM,CAAC,MAAM,mCAAmC,GAAG,MAAM,CAAC;AAE1D;;;2DAG2D;AAC3D,KAAK,UAAU,QAAQ,CAAI,IAAoB,EAAE,EAAU,EAAE,IAAY;IACvE,IAAI,KAAgD,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACxB,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YACrB,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAC/B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,mBAAmB,EAAE,GAAG,IAAI,8BAA8B,EAAE,0EAA0E,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpM,CAAC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AA2CD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAW7C;IACC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,GAAG,CAAC;QAC1G,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,mCAAmC,CAAC;IAC1D,IAAI,WAAmD,CAAC;IAExD,MAAM,OAAO,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;IACxC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;QACrC,IAAI,KAAK,KAAK,SAAS;YACrB,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,YAAY,IAAI,CAAC,OAAO,2GAA2G,CAAC,CAAC;QACtL,kFAAkF;QAClF,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,OAAO,CAAC,KAAiC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1G,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;YACjE,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,YAAY,IAAI,CAAC,OAAO,qHAAqH,CAAC,CAAC;QAChM,iFAAiF;QACjF,gFAAgF;QAChF,sFAAsF;QACtF,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC;YACjC,aAAa;YACb,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;YACpG,SAAS,EAAE,KAAK,CAAC,IAAI;YACrB,UAAU,EAAE,MAAM;YAClB,GAAG,EAAE,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;YACvD,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,aAAa,EAAE,KAAK,CAAC,aAAa;SACnC,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM;YAC7B,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,mBAAmB,IAAI,CAAC,OAAO,kNAAkN,CAAC,CAAC;QACtS,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IACpC,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;IACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YACzB,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,YAAY,IAAI,CAAC,OAAO,gLAAgL,CAAC,CAAC;QAC3P,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC;QACnD,IAAI,MAAM,KAAK,SAAS;YACtB,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,YAAY,IAAI,CAAC,OAAO,sHAAsH,CAAC,CAAC;QACjM,IAAI,EAAW,CAAC;QAChB,IAAI,CAAC;YACH,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,mCAAmC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;QACrO,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,eAAe;gBAAE,MAAM,CAAC,CAAC,CAAC,wCAAwC;YACnF,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,sCAAuC,CAAW,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC;QACtK,CAAC;QACD,IAAI,OAAO,EAAE,KAAK,SAAS;YACzB,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,iGAAiG,CAAC,CAAC;QACpJ,IAAI,CAAC,EAAE;YACL,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,yCAAyC,IAAI,CAAC,OAAO,mDAAmD,CAAC,CAAC;IAC7J,CAAC;IAED,OAAO,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1D,CAAC"}