@cotal-ai/core 0.12.0 → 0.13.1

package/dist/endpoint-envelope.js

@@ -0,0 +1,346 @@
+import { rawDigest, isContractDigest, isWellFormedUnicode } from "./canonical.js";
+import { assertCommandToken, assertIdToken, assertLifecycleToken, endpointToken } from "./endpoint-subjects.js";
+import { SCHEMA_PROFILE } from "./schema-profile.js";
+/** The envelope schema version — independent of the wire `protocolVersion`; starts at its own
+ *  v1 inside the v0.4 revision. Other values are rejected (`unsupported-version`). */
+export const EP_ENVELOPE_V = 1;
+// ---- structured errors (§13.3 error catalog) ------------------------------------------------
+/** The §13.3 error catalog. Extensions add codes only under reverse-DNS; any code (catalog or
+ *  extension) is one token of at most 64 bytes. */
+export const EP_ERROR_CODES = Object.freeze([
+    "bad-request", "unsupported-version", "op-mismatch", "class-mismatch", "target-mismatch",
+    "sender-mismatch", "unauthenticated", "permission-denied", "not-found", "already-exists",
+    "conflict", "contract-mismatch", "contract-invalid", "failed-precondition",
+    "deadline-exceeded", "cancelled", "expired", "unavailable", "unimplemented",
+    "resource-exhausted", "internal",
+]);
+const EP_ERROR_SET = new Set(EP_ERROR_CODES);
+const LABEL = "[a-z0-9]([a-z0-9-]*[a-z0-9])?";
+/** Reverse-DNS extension token: three or more DNS-shaped labels (`com.acme.throttled`). */
+const EXTENSION_CODE = new RegExp(`^${LABEL}(\\.${LABEL}){2,}$`);
+/** True iff `code` is a catalog token or a reverse-DNS extension token within the 64-byte bound. */
+export function isEpErrorCode(code) {
+    if (typeof code !== "string" || Buffer.byteLength(code, "utf8") > 64)
+        return false;
+    return EP_ERROR_SET.has(code) || EXTENSION_CODE.test(code);
+}
+/** A consuming-boundary rejection: the catalog code plus a human message. Boundaries convert it
+ *  to an `EndpointReply` error via {@link EpEnvelopeError.toEpError} (or, on reply-less planes,
+ *  to the §13.4 decision/quarantine fact carrying the same code). */
+export class EpEnvelopeError extends Error {
+    code;
+    details;
+    constructor(code, message, details) {
+        super(message);
+        this.code = code;
+        this.details = details;
+        this.name = "EpEnvelopeError";
+    }
+    toEpError() {
+        return { code: this.code, message: this.message, ...(this.details ? { details: this.details } : {}) };
+    }
+}
+function fail(code, message) {
+    throw new EpEnvelopeError(code, message);
+}
+// ---- signed-artifact binding (§13.3/§13.7) --------------------------------------------------
+/** `authDigest`: `sha256:<hex>` over the UTF-8 bytes of the `auth` slot EXACTLY as carried. The
+ *  slot is already a canonical signed artifact, so it is digested as bytes, never
+ *  re-canonicalized; absent from the §13.4 fingerprint iff `auth` is absent. A malformed-UTF-16
+ *  slot is refused (`bad-request`): a lone surrogate has no UTF-8 encoding, so its "digest"
+ *  would be over a substituted value and two distinct slots could share one fingerprint. */
+export function authDigest(auth) {
+    if (typeof auth !== "string" || !isWellFormedUnicode(auth))
+        throw new EpEnvelopeError("bad-request", "auth slot is not a well-formed Unicode string");
+    return rawDigest(auth);
+}
+// ---- consuming-boundary validators ----------------------------------------------------------
+function asRecord(v, what) {
+    if (v === null || typeof v !== "object" || Array.isArray(v))
+        fail("bad-request", `${what} is not a JSON object`);
+    return v;
+}
+function asString(v, what) {
+    if (typeof v !== "string" || v.length === 0)
+        fail("bad-request", `${what} is not a non-empty string`);
+    return v;
+}
+/** Wire integers are I-JSON interoperable: non-negative safe integers (§13.7). */
+function asWireInt(v, what) {
+    if (typeof v !== "number" || !Number.isSafeInteger(v) || v < 0)
+        fail("bad-request", `${what} is not a non-negative integer within the I-JSON range`);
+    return v;
+}
+/** Rewrap a grammar validator's plain throw as the catalog code the boundary owes. */
+function grammar(fn) {
+    try {
+        return fn();
+    }
+    catch (e) {
+        fail("bad-request", e.message);
+    }
+}
+/** W3C `traceparent`: version, 32-hex trace-id, 16-hex parent-id, 2-hex flags. Version `00` is
+ *  EXACTLY this 55-character form — no extension tail. A higher version may carry additional
+ *  printable-ASCII fields after the flags (the W3C forward-compatibility rule), bounded to a
+ *  finite profile size so nothing unbounded is retained for propagation. Version `ff` and
+ *  all-zero ids are invalid per the spec. */
+const TRACEPARENT = /^([0-9a-f]{2})-([0-9a-f]{32})-([0-9a-f]{16})-[0-9a-f]{2}(-[\x21-\x7e]+)?$/;
+const MAX_TRACEPARENT_BYTES = 256;
+const CORRELATION_BYTE_BOUNDS = { tracestate: 512, baggage: 8192 };
+/** Correlation is validated, never trusted opaque (§13.3 "per W3C Trace Context"): these fields
+ *  are PROPAGATED downstream (calls, events, facts, receipts), so an unvalidated value becomes
+ *  header injection or amplification wherever they are re-emitted. `traceparent` is checked
+ *  against the W3C grammar; `tracestate`/`baggage` stay content-opaque but are bounded to the
+ *  W3C size limits and refused any control character (no CR/LF crosses the boundary). */
+function pickCorrelation(v) {
+    if (v === undefined)
+        return undefined;
+    const o = asRecord(v, "correlation");
+    const out = {};
+    if (o.traceparent !== undefined) {
+        const tp = asString(o.traceparent, "correlation.traceparent");
+        if (Buffer.byteLength(tp, "utf8") > MAX_TRACEPARENT_BYTES)
+            fail("bad-request", `correlation.traceparent exceeds ${MAX_TRACEPARENT_BYTES} bytes`);
+        const m = TRACEPARENT.exec(tp);
+        if (!m || m[1] === "ff" || /^0+$/.test(m[2]) || /^0+$/.test(m[3]))
+            fail("bad-request", "correlation.traceparent is not a valid W3C Trace Context traceparent");
+        if (m[1] === "00" && m[4] !== undefined)
+            fail("bad-request", "correlation.traceparent version 00 is exactly 55 characters; it carries no extension fields");
+        out.traceparent = tp;
+    }
+    for (const k of ["tracestate", "baggage"]) {
+        if (o[k] === undefined)
+            continue;
+        const s = asString(o[k], `correlation.${k}`);
+        if (Buffer.byteLength(s, "utf8") > CORRELATION_BYTE_BOUNDS[k])
+            fail("bad-request", `correlation.${k} exceeds ${CORRELATION_BYTE_BOUNDS[k]} bytes`);
+        // eslint-disable-next-line no-control-regex
+        if (/[\x00-\x1f\x7f]/.test(s))
+            fail("bad-request", `correlation.${k} carries a control character`);
+        out[k] = s;
+    }
+    return out;
+}
+/** Validate the version discriminant first: any `v !== 1` is `unsupported-version`, before any
+ *  other field is looked at, so version skew never masquerades as a shape error. */
+function assertVersion(o, what) {
+    if (o.v !== EP_ENVELOPE_V)
+        fail("unsupported-version", `${what} envelope version ${JSON.stringify(o.v)} is not ${EP_ENVELOPE_V}`);
+}
+/** Shape-validate an incoming request envelope (the pre-subject half of the consuming boundary;
+ *  {@link checkRequestSubjectAgreement} is the other half). Throws {@link EpEnvelopeError} with
+ *  the exact catalog code; returns a picked copy with exactly the §13.3 fields. */
+export function parseEndpointRequest(raw) {
+    const o = asRecord(raw, "request");
+    assertVersion(o, "request");
+    const id = grammar(() => assertIdToken(asString(o.id, "id"), "id"));
+    const op = asRecord(o.op, "op");
+    const endpoint = asString(op.endpoint, "op.endpoint");
+    grammar(() => endpointToken(endpoint));
+    const command = grammar(() => assertCommandToken(asString(op.command, "op.command")));
+    const digests = {};
+    for (const k of ["inputDigest", "outputDigest"]) {
+        const d = op[k];
+        if (d === undefined) {
+            if (command !== "describe")
+                fail("contract-mismatch", `op.${k} is required on every command except describe (a payload-free side pins the void schema digest)`);
+            continue;
+        }
+        if (typeof d !== "string" || !isContractDigest(d))
+            fail("bad-request", `op.${k} is not a sha256:<hex> digest`);
+        digests[k] = d;
+    }
+    const cls = o.class;
+    if (cls !== "ephemeral" && cls !== "journal")
+        fail("bad-request", `class ${JSON.stringify(cls)} is not "ephemeral" | "journal" (record is a state contract, never a request class)`);
+    if (typeof o.replyExpected !== "boolean")
+        fail("bad-request", "replyExpected is not a boolean");
+    const replyExpected = o.replyExpected;
+    if (cls === "journal" && replyExpected)
+        fail("bad-request", "a journal-class submission sets replyExpected: false; the decision is observed on the caller's decision subtree (SPEC 13.4)");
+    let deadlineMs;
+    if (o.deadlineMs !== undefined) {
+        deadlineMs = asWireInt(o.deadlineMs, "deadlineMs");
+        if (deadlineMs === 0)
+            fail("bad-request", "deadlineMs must be a positive budget, never zero");
+    }
+    else if (replyExpected || cls === "journal") {
+        fail("bad-request", `deadlineMs is required for ${replyExpected ? "a call" : "a journal-class submission (the decision deadline)"}`);
+    }
+    const goalId = o.goalId === undefined ? undefined : grammar(() => assertIdToken(asString(o.goalId, "goalId"), "goalId"));
+    let target;
+    if (o.target !== undefined) {
+        const t = asRecord(o.target, "target");
+        target = {
+            owner: asString(t.owner, "target.owner"),
+            actor: asString(t.actor, "target.actor"),
+            lifecycleUid: grammar(() => assertLifecycleToken(asString(t.lifecycleUid, "target.lifecycleUid"), "target.lifecycleUid")),
+            ...(t.mappingRevision !== undefined ? { mappingRevision: asWireInt(t.mappingRevision, "target.mappingRevision") } : {}),
+        };
+    }
+    // §13.7: explicit `null` is a VALID canonical-void payload and must reach the command's own
+    // schema validator, so only non-null args are shape-gated here.
+    const args = o.args === undefined || o.args === null ? o.args : asRecord(o.args, "args");
+    const f = asRecord(o.from, "from");
+    const from = {
+        id: asString(f.id, "from.id"),
+        name: asString(f.name, "from.name"),
+        ...(f.role !== undefined ? { role: asString(f.role, "from.role") } : {}),
+    };
+    const auth = o.auth === undefined ? undefined : asString(o.auth, "auth");
+    if (auth !== undefined && !isWellFormedUnicode(auth))
+        fail("bad-request", "auth slot is not well-formed Unicode (a lone surrogate has no UTF-8 encoding, so it cannot be digested as carried)");
+    const correlation = pickCorrelation(o.correlation);
+    return {
+        v: EP_ENVELOPE_V, id, op: { endpoint, command, ...digests }, class: cls, replyExpected,
+        ...(goalId !== undefined ? { goalId } : {}),
+        ...(target !== undefined ? { target } : {}),
+        ...(args !== undefined ? { args } : {}),
+        from,
+        ...(deadlineMs !== undefined ? { deadlineMs } : {}),
+        ...(correlation !== undefined ? { correlation } : {}),
+        ...(auth !== undefined ? { auth } : {}),
+    };
+}
+/** The body↔subject agreement half of the consuming boundary (§13.3): `op` MUST agree with the
+ *  subject (`op-mismatch`); the body target is ABSENT for `self`/untargeted forms (a supplied
+ *  one is `target-mismatch`, never ignored) and REQUIRED with a subject-equal owner (and, in
+ *  `handle` mode, subject-equal actor + lifecycleUid) for the targeted forms; `from.id` MUST
+ *  equal the subject sender principal (`sender-mismatch`). Currency of `target.actor`/
+ *  `target.lifecycleUid` against the live mapping is the handler's fresh-read (`expired`),
+ *  deliberately not checkable here. */
+export function checkRequestSubjectAgreement(env, subject) {
+    if (env.op.endpoint !== subject.endpoint)
+        fail("op-mismatch", `op.endpoint "${env.op.endpoint}" does not agree with the subject endpoint "${subject.endpoint}"`);
+    if (env.op.command !== subject.command)
+        fail("op-mismatch", `op.command "${env.op.command}" does not agree with the subject command "${subject.command}"`);
+    // §13.3: deadlineMs is a MUST for call, SCATTER, and journal submissions. Call and journal
+    // are enforced at parse time; scatter is only knowable here, where the route is in hand.
+    if (subject.route === "all" && env.deadlineMs === undefined)
+        fail("bad-request", "deadlineMs is required on the scatter rail (SPEC 13.3: MUST for call/scatter and journal submissions)");
+    const t = subject.target;
+    if (!t || t.mode === "self") {
+        if (env.target !== undefined)
+            fail("target-mismatch", `a body target on ${t ? `a "self"-mode` : "an untargeted"} request is target-mismatch, never ignored (SPEC 13.3)`);
+    }
+    else {
+        if (!env.target)
+            fail("target-mismatch", `the "${t.mode}" form requires a body target (SPEC 13.3)`);
+        if (env.target.owner !== t.tOwner)
+            fail("target-mismatch", `target.owner "${env.target.owner}" does not equal the subject target owner "${t.tOwner}"`);
+        if (t.mode === "handle" && (env.target.actor !== t.tActor || env.target.lifecycleUid !== t.tUid))
+            fail("target-mismatch", "in handle mode the body target actor and lifecycleUid must equal the subject redemption triple");
+    }
+    const sender = `${subject.caller.owner}.${subject.caller.actor}`;
+    if (env.from.id !== sender)
+        fail("sender-mismatch", `from.id "${env.from.id}" does not equal the subject sender principal "${sender}"`);
+}
+/** The contract-class agreement check (`class-mismatch`): the envelope's declared class MUST
+ *  equal the command's contract class. Split out because it needs the contract in hand. */
+export function assertClassMatches(env, declaredClass) {
+    if (env.class !== declaredClass)
+        fail("class-mismatch", `class "${env.class}" does not equal the command's contract class "${declaredClass}"`);
+}
+function pickError(v) {
+    const e = asRecord(v, "error");
+    const code = asString(e.code, "error.code");
+    if (!isEpErrorCode(code))
+        fail("bad-request", `error.code ${JSON.stringify(code)} is neither a catalog token nor a reverse-DNS extension token within 64 bytes`);
+    const message = typeof e.message === "string" ? e.message : fail("bad-request", "error.message is not a string");
+    let details;
+    if (e.details !== undefined) {
+        if (!Array.isArray(e.details))
+            fail("bad-request", "error.details is not an array");
+        details = e.details.map((d, i) => {
+            const o = asRecord(d, `error.details[${i}]`);
+            const kind = asString(o.kind, `error.details[${i}].kind`);
+            if (!EXTENSION_CODE.test(kind))
+                fail("bad-request", `error.details[${i}].kind "${kind}" is not reverse-DNS namespaced`);
+            return o;
+        });
+    }
+    return { code, message, ...(details ? { details } : {}) };
+}
+/** Shape-validate a reply at the caller's consuming boundary. `data` is schema-validated by the
+ *  caller against its PINNED output digest (§13.7), not here. */
+export function parseEndpointReply(raw) {
+    const o = asRecord(raw, "reply");
+    assertVersion(o, "reply");
+    const id = grammar(() => assertIdToken(asString(o.id, "id"), "id"));
+    if (typeof o.ok !== "boolean")
+        fail("bad-request", "ok is not a boolean");
+    if (o.ok && o.error !== undefined)
+        fail("bad-request", "an ok reply must not carry an error");
+    if (!o.ok && o.data !== undefined)
+        fail("bad-request", "a failed reply must not carry data");
+    const error = o.ok ? undefined : pickError(o.error);
+    const receipt = o.receipt === undefined ? undefined : asString(o.receipt, "receipt");
+    return {
+        v: EP_ENVELOPE_V, id, ok: o.ok,
+        ...(o.ok && o.data !== undefined ? { data: o.data } : {}),
+        ...(error ? { error } : {}),
+        ...(receipt !== undefined ? { receipt } : {}),
+    };
+}
+/** Shape-validate an event at its consuming boundary (§13.3: every plane is runtime-validated).
+ *  The publishing instance and epoch come from the SUBJECT; payload claims are display data. */
+export function parseEndpointEvent(raw) {
+    const o = asRecord(raw, "event");
+    assertVersion(o, "event");
+    const topic = asString(o.topic, "topic");
+    if (Buffer.byteLength(topic, "utf8") > 256)
+        fail("bad-request", "topic exceeds 256 bytes");
+    const ts = asWireInt(o.ts, "ts");
+    if (!("data" in o))
+        fail("bad-request", "event carries no data field");
+    const correlation = pickCorrelation(o.correlation);
+    return { v: EP_ENVELOPE_V, topic, ts, data: o.data, ...(correlation !== undefined ? { correlation } : {}) };
+}
+// ---- invocation-time contract validation (§13.7, distinct from registration time) -----------
+/** Validate `args` against the command's compiled input schema BEFORE any effect: failure is the
+ *  invocation-time `bad-request` (registration-time violations are `contract-invalid`,
+ *  {@link import("./schema-profile.js").ContractInvalidError}). Against the void schema the
+ *  payload is absent or `null` (§13.7), so `undefined` args validate as `null` here and only
+ *  here; an explicit `null` passes through unchanged, and it is the SCHEMA (an object-typed
+ *  input contract) that rejects null for non-void commands. The §13.8 validation budget is the
+ *  PROFILE's fixed 10ms, read internally so no caller
+ *  can tune it away, and is enforced post-hoc, fail-loud as `bad-request` (the spec's
+ *  over-budget code for validate time, distinct from compile's `contract-invalid`). Post-hoc
+ *  measurement classifies, it cannot preempt — the pre-emptive defense is the registration-time
+ *  bounded-pattern gate (schema-profile), which keeps the exponential backtracking class out of
+ *  registered contracts in the first place. */
+export function assertArgsValid(validate, args) {
+    const value = args === undefined ? null : args;
+    const started = Date.now();
+    const okValid = validate(value);
+    const elapsed = Date.now() - started;
+    if (elapsed > SCHEMA_PROFILE.validateBudgetMs)
+        fail("bad-request", `args validation took ${elapsed}ms (budget ${SCHEMA_PROFILE.validateBudgetMs}ms; over budget is bad-request, SPEC 13.8)`);
+    if (!okValid) {
+        const first = validate.errors?.[0];
+        fail("bad-request", `args do not validate against the input schema${first ? `: ${first.instancePath || "/"} ${first.message ?? ""}` : ""}`);
+    }
+    return value;
+}
+/** Validate an output payload against the command's compiled output schema at EITHER §13.7
+ *  boundary — the responder's, before the success publish, or the caller's, on the consumed
+ *  reply — the symmetric budgeted half of {@link assertArgsValid}, under the SAME fixed
+ *  §13.8 `validateBudgetMs` (read internally, never caller-tunable). Both failure classes are
+ *  structured `internal`: an invalid output is a responder bug (§13.3/§13.7) whichever side
+ *  detects it, and an over-budget output validation is the same bug class, never the caller's
+ *  `bad-request`. A void output is `undefined`, validated as `null` against the void schema,
+ *  mirroring the args side. */
+export function assertOutputValid(validate, data) {
+    const value = data === undefined ? null : data;
+    const started = Date.now();
+    const okValid = validate(value);
+    const elapsed = Date.now() - started;
+    if (elapsed > SCHEMA_PROFILE.validateBudgetMs)
+        fail("internal", `output validation took ${elapsed}ms (budget ${SCHEMA_PROFILE.validateBudgetMs}ms; an over-budget output validation is a responder bug, SPEC 13.7/13.8)`);
+    if (!okValid) {
+        const first = validate.errors?.[0];
+        fail("internal", `output does not validate against the pinned output schema; an invalid reply is a responder bug, never success (SPEC 13.7)${first ? `: ${first.instancePath || "/"} ${first.message ?? ""}` : ""}`);
+    }
+}
+//# sourceMappingURL=endpoint-envelope.js.map

package/dist/endpoint-envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint-envelope.js","sourceRoot":"","sources":["../src/endpoint-envelope.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,oBAAoB,EAAE,aAAa,EAAwB,MAAM,wBAAwB,CAAC;AACtI,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAGrD;sFACsF;AACtF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC;AAE/B,gGAAgG;AAEhG;mDACmD;AACnD,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1C,aAAa,EAAE,qBAAqB,EAAE,aAAa,EAAE,gBAAgB,EAAE,iBAAiB;IACxF,iBAAiB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,WAAW,EAAE,gBAAgB;IACxF,UAAU,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,qBAAqB;IAC1E,mBAAmB,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe;IAC3E,oBAAoB,EAAE,UAAU;CACxB,CAAC,CAAC;AAEZ,MAAM,YAAY,GAAG,IAAI,GAAG,CAAS,cAAc,CAAC,CAAC;AAErD,MAAM,KAAK,GAAG,+BAA+B,CAAC;AAC9C,2FAA2F;AAC3F,MAAM,cAAc,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,KAAK,QAAQ,CAAC,CAAC;AAEjE,oGAAoG;AACpG,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IACnF,OAAO,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC7D,CAAC;AAeD;;qEAEqE;AACrE,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACnB;IAA6C;IAAlE,YAAqB,IAAiB,EAAE,OAAe,EAAW,OAAyB;QACzF,KAAK,CAAC,OAAO,CAAC,CAAC;QADI,SAAI,GAAJ,IAAI,CAAa;QAA4B,YAAO,GAAP,OAAO,CAAkB;QAEzF,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;IACD,SAAS;QACP,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACxG,CAAC;CACF;AAED,SAAS,IAAI,CAAC,IAAiB,EAAE,OAAe;IAC9C,MAAM,IAAI,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC;AAgFD,gGAAgG;AAEhG;;;;4FAI4F;AAC5F,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;QACxD,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,+CAA+C,CAAC,CAAC;IAC5F,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,gGAAgG;AAEhG,SAAS,QAAQ,CAAC,CAAU,EAAE,IAAY;IACxC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACzD,IAAI,CAAC,aAAa,EAAE,GAAG,IAAI,uBAAuB,CAAC,CAAC;IACtD,OAAO,CAA4B,CAAC;AACtC,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU,EAAE,IAAY;IACxC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,IAAI,CAAC,aAAa,EAAE,GAAG,IAAI,4BAA4B,CAAC,CAAC;IACtG,OAAO,CAAC,CAAC;AACX,CAAC;AAED,kFAAkF;AAClF,SAAS,SAAS,CAAC,CAAU,EAAE,IAAY;IACzC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAC5D,IAAI,CAAC,aAAa,EAAE,GAAG,IAAI,wDAAwD,CAAC,CAAC;IACvF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,sFAAsF;AACtF,SAAS,OAAO,CAAI,EAAW;IAC7B,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,aAAa,EAAG,CAAW,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED;;;;6CAI6C;AAC7C,MAAM,WAAW,GAAG,2EAA2E,CAAC;AAChG,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,MAAM,uBAAuB,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAW,CAAC;AAE5E;;;;yFAIyF;AACzF,SAAS,eAAe,CAAC,CAAU;IACjC,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IACrC,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;QAC9D,IAAI,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,qBAAqB;YACvD,IAAI,CAAC,aAAa,EAAE,mCAAmC,qBAAqB,QAAQ,CAAC,CAAC;QACxF,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/D,IAAI,CAAC,aAAa,EAAE,sEAAsE,CAAC,CAAC;QAC9F,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;YACrC,IAAI,CAAC,aAAa,EAAE,6FAA6F,CAAC,CAAC;QACrH,GAAG,CAAC,WAAW,GAAG,EAAE,CAAC;IACvB,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,CAAU,EAAE,CAAC;QACnD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,SAAS;QACjC,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC;QAC7C,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,uBAAuB,CAAC,CAAC,CAAC;YAC3D,IAAI,CAAC,aAAa,EAAE,eAAe,CAAC,YAAY,uBAAuB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACtF,4CAA4C;QAC5C,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,aAAa,EAAE,eAAe,CAAC,8BAA8B,CAAC,CAAC;QACnG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACb,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;oFACoF;AACpF,SAAS,aAAa,CAAC,CAA0B,EAAE,IAAY;IAC7D,IAAI,CAAC,CAAC,CAAC,KAAK,aAAa;QAAE,IAAI,CAAC,qBAAqB,EAAE,GAAG,IAAI,qBAAqB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,aAAa,EAAE,CAAC,CAAC;AACpI,CAAC;AAED;;mFAEmF;AACnF,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACnC,aAAa,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAC5B,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAEpE,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAG,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IACtF,MAAM,OAAO,GAA+C,EAAE,CAAC;IAC/D,KAAK,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAU,EAAE,CAAC;QACzD,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACpB,IAAI,OAAO,KAAK,UAAU;gBACxB,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,iGAAiG,CAAC,CAAC;YACtI,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,+BAA+B,CAAC,CAAC;QAC/G,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAED,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC;IACpB,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,SAAS;QAC1C,IAAI,CAAC,aAAa,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,qFAAqF,CAAC,CAAC;IACzI,IAAI,OAAO,CAAC,CAAC,aAAa,KAAK,SAAS;QAAE,IAAI,CAAC,aAAa,EAAE,gCAAgC,CAAC,CAAC;IAChG,MAAM,aAAa,GAAG,CAAC,CAAC,aAAa,CAAC;IACtC,IAAI,GAAG,KAAK,SAAS,IAAI,aAAa;QACpC,IAAI,CAAC,aAAa,EAAE,6HAA6H,CAAC,CAAC;IAErJ,IAAI,UAA8B,CAAC;IACnC,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC/B,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QACnD,IAAI,UAAU,KAAK,CAAC;YAAE,IAAI,CAAC,aAAa,EAAE,kDAAkD,CAAC,CAAC;IAChG,CAAC;SAAM,IAAI,aAAa,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QAC9C,IAAI,CAAC,aAAa,EAAE,8BAA8B,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,oDAAoD,EAAE,CAAC,CAAC;IACvI,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IAEzH,IAAI,MAAiC,CAAC;IACtC,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACvC,MAAM,GAAG;YACP,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,cAAc,CAAC;YACxC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,cAAc,CAAC;YACxC,YAAY,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,EAAE,qBAAqB,CAAC,EAAE,qBAAqB,CAAC,CAAC;YACzH,GAAG,CAAC,CAAC,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC,CAAC,eAAe,EAAE,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxH,CAAC;IACJ,CAAC;IAED,4FAA4F;IAC5F,gEAAgE;IAChE,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,IAAyB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAA4B,CAAC;IAE1I,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,MAAM,IAAI,GAAgB;QACxB,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC;QAC7B,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC;QACnC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzE,CAAC;IAEF,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzE,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;QAClD,IAAI,CAAC,aAAa,EAAE,oHAAoH,CAAC,CAAC;IAC5I,MAAM,WAAW,GAAG,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAEnD,OAAO;QACL,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,aAAa;QACtF,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,IAAI;QACJ,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC;AACJ,CAAC;AAED;;;;;;uCAMuC;AACvC,MAAM,UAAU,4BAA4B,CAAC,GAAoB,EAAE,OAAwB;IACzF,IAAI,GAAG,CAAC,EAAE,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ;QACtC,IAAI,CAAC,aAAa,EAAE,gBAAgB,GAAG,CAAC,EAAE,CAAC,QAAQ,+CAA+C,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACzH,IAAI,GAAG,CAAC,EAAE,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO;QACpC,IAAI,CAAC,aAAa,EAAE,eAAe,GAAG,CAAC,EAAE,CAAC,OAAO,8CAA8C,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC;IAErH,2FAA2F;IAC3F,yFAAyF;IACzF,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS;QACzD,IAAI,CAAC,aAAa,EAAE,uGAAuG,CAAC,CAAC;IAE/H,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC5B,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;YAC1B,IAAI,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,wDAAwD,CAAC,CAAC;IAC/I,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,IAAI,2CAA2C,CAAC,CAAC;QACpG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM;YAC/B,IAAI,CAAC,iBAAiB,EAAE,iBAAiB,GAAG,CAAC,MAAM,CAAC,KAAK,8CAA8C,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACtH,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,CAAC,CAAC,IAAI,CAAC;YAC9F,IAAI,CAAC,iBAAiB,EAAE,gGAAgG,CAAC,CAAC;IAC9H,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACjE,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM;QACxB,IAAI,CAAC,iBAAiB,EAAE,YAAY,GAAG,CAAC,IAAI,CAAC,EAAE,kDAAkD,MAAM,GAAG,CAAC,CAAC;AAChH,CAAC;AAED;2FAC2F;AAC3F,MAAM,UAAU,kBAAkB,CAAC,GAAoB,EAAE,aAAsB;IAC7E,IAAI,GAAG,CAAC,KAAK,KAAK,aAAa;QAC7B,IAAI,CAAC,gBAAgB,EAAE,UAAU,GAAG,CAAC,KAAK,kDAAkD,aAAa,GAAG,CAAC,CAAC;AAClH,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC5C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,aAAa,EAAE,cAAc,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;IACjK,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,+BAA+B,CAAC,CAAC;IACjH,IAAI,OAAoC,CAAC;IACzC,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,IAAI,CAAC,aAAa,EAAE,+BAA+B,CAAC,CAAC;QACpF,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YAC/B,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC;YAC7C,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAC1D,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,aAAa,EAAE,iBAAiB,CAAC,WAAW,IAAI,iCAAiC,CAAC,CAAC;YACxH,OAAO,CAAkB,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED;iEACiE;AACjE,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACjC,aAAa,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,SAAS;QAAE,IAAI,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC;IAC1E,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;QAAE,IAAI,CAAC,aAAa,EAAE,qCAAqC,CAAC,CAAC;IAC9F,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;QAAE,IAAI,CAAC,aAAa,EAAE,oCAAoC,CAAC,CAAC;IAC7F,MAAM,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACrF,OAAO;QACL,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE;QAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED;gGACgG;AAChG,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACjC,aAAa,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACzC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,GAAG;QAAE,IAAI,CAAC,aAAa,EAAE,yBAAyB,CAAC,CAAC;IAC3F,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;QAAE,IAAI,CAAC,aAAa,EAAE,6BAA6B,CAAC,CAAC;IACvE,MAAM,WAAW,GAAG,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACnD,OAAO,EAAE,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC9G,CAAC;AAED,gGAAgG;AAEhG;;;;;;;;;;;+CAW+C;AAC/C,MAAM,UAAU,eAAe,CAAC,QAA0B,EAAE,IAAgD;IAC1G,MAAM,KAAK,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;IACrC,IAAI,OAAO,GAAG,cAAc,CAAC,gBAAgB;QAC3C,IAAI,CAAC,aAAa,EAAE,wBAAwB,OAAO,cAAc,cAAc,CAAC,gBAAgB,4CAA4C,CAAC,CAAC;IAChJ,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,aAAa,EAAE,gDAAgD,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,YAAY,IAAI,GAAG,IAAI,KAAK,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9I,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;+BAO+B;AAC/B,MAAM,UAAU,iBAAiB,CAAC,QAA0B,EAAE,IAAa;IACzE,MAAM,KAAK,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;IACrC,IAAI,OAAO,GAAG,cAAc,CAAC,gBAAgB;QAC3C,IAAI,CAAC,UAAU,EAAE,0BAA0B,OAAO,cAAc,cAAc,CAAC,gBAAgB,0EAA0E,CAAC,CAAC;IAC7K,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,EAAE,4HAA4H,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,YAAY,IAAI,GAAG,IAAI,KAAK,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvN,CAAC;AACH,CAAC"}

package/dist/endpoint-grants.d.ts

@@ -0,0 +1,123 @@
+import { type EpCaller, type EpTarget } from "./endpoint-subjects.js";
+/** A minted request capability: one endpoint command a caller may invoke, on the named rails.
+ *  `routes` defaults to `["one"]`; `instanceId` additionally pins the instance form to exactly
+ *  that instance. A TARGETED capability carries its authorization mode with the target tokens
+ *  LITERAL as minted (§13.2): `owner`/`child` pin the caller's own owner; `any`/`ledger` may pin
+ *  `"*"` (mintable only under operator/admin policy — enforced by the minting authority, not
+ *  here); `handle` pins the full redemption triple and is never a standing capability (the
+ *  standing rollup {@link epCallerGrantRows} refuses it; only the §13.6 redemption path builds
+ *  handle rows, through {@link epRequestGrantRows} directly). */
+export interface EpCapability {
+    endpoint: string;
+    command: string;
+    routes?: ("one" | "all")[];
+    instanceId?: string;
+    target?: EpTarget;
+    /** Also grant the matching journal-submission append row (`epj`, §13.9 matrix). */
+    journal?: boolean;
+}
+/** Request-publish rows for one capability (§13.9 "Request publish"): per route,
+ *  `ep.{one,all}.<endpoint>.<command>[.<mode>[.<target…>]].<cO>.<cA>.<cUid>.*` and the
+ *  instance-pinned form when `instanceId` is set. The nonce is the only wildcard token. */
+export declare function epRequestGrantRows(space: string, cap: EpCapability, caller: EpCaller): string[];
+/** Journal-submission append row (§13.9 "Journal submission append"): the same authz/target
+ *  block as the request forms, caller-pinned, no nonce. Explicitly untrusted input (§13.4). */
+export declare function epJournalGrantRow(space: string, cap: EpCapability, caller: EpCaller): string;
+/** The caller's reply-rail read row (§13.9 "Reply subscribe"): its own rail only, exact arity. */
+export declare function epCallerReplyGrantRow(space: string, caller: EpCaller): string;
+/** Per-goal live progress read row (§13.9 "Live event progress", reserved `goal` topic):
+ *  `epe.<endpoint>.*.*.goal.<cO>.<cA>.<cUid>.>` — the caller identity in the subject gives
+ *  mint-time read containment; delivered on the caller's own core subscription only. */
+export declare function epGoalProgressGrantRow(space: string, endpoint: string, caller: EpCaller): string;
+/** All caller-side rows for a capability set: request-publish (+ optional journal) into
+ *  `pub.allow`, the reply rail into `sub.allow`. This is the STANDING rollup (`permissionsFor`
+ *  mints long-lived credentials from it), so a `handle`-mode capability is refused here:
+ *  handle rows are redemption-minted only (§13.2/§13.6), built by the redemption path through
+ *  {@link epRequestGrantRows} directly. Deliberately NOT included: `epe` event
+ *  subtrees beyond the per-goal row — read grants are minted per read capability by the
+ *  granting authority (Appendix B), not implied by an invoke capability. */
+export declare function epCallerGrantRows(space: string, caps: EpCapability[], caller: EpCaller): {
+    pub: string[];
+    sub: string[];
+};
+/** The delivery endpoint's baseline command names (Appendix B: "durable join/leave/list").
+ *  All four command vocabularies below are RUNTIME-frozen (TS `as const` is type-level only)
+ *  and the capability builders consult PRIVATE module-load snapshots, never these live
+ *  exports: a post-import `push("attach")` here would otherwise widen every subsequently
+ *  minted agent grant (the afa715b identity-vs-integrity class, executed repro). */
+export declare const BASELINE_DELIVERY_ENDPOINT = "delivery";
+export declare const BASELINE_DELIVERY_COMMANDS: readonly ["join", "leave", "list"];
+/** The manager endpoint's self-lifecycle baseline (the v0.3 self-service tier serves exactly
+ *  no-name self stop) and the spawn-capability owner-mode lifecycle set. */
+export declare const BASELINE_LIFECYCLE_ENDPOINT = "manager";
+export declare const BASELINE_SELF_LIFECYCLE_COMMANDS: readonly ["stop"];
+/** `spawn` is CREATION: a virgin spawn has no target lifecycle UID or current mapping yet, so it
+ *  CANNOT ride owner mode (§13.2 owner mode resolves a body `{owner, actor, lifecycleUid}` against
+ *  the CURRENT mapping — there is nothing to resolve for a not-yet-existing child). It is minted
+ *  UNTARGETED; the child-owner ceiling is the authenticated caller's own owner, carried by the
+ *  pinned caller triple. `despawn` (terminal) and `attach` (interactive) act on an EXISTING agent,
+ *  so they ride owner mode. Owner-mode `stop` is DELIBERATELY ABSENT: on the v0.3 surface a named
+ *  stop and a despawn both free-slot + deprovision, so an owner-mode `stop` would be a wire synonym
+ *  of `despawn` (distsys) — one owner-mode terminal command keeps the vocabulary single. Self-`stop`
+ *  stays in the BASELINE (the v0.3 self-service tier's only op); it is the lighter self-halt. */
+export declare const SPAWN_CREATE_COMMANDS: readonly ["spawn"];
+export declare const SPAWN_OWNER_LIFECYCLE_COMMANDS: readonly ["despawn", "attach"];
+/** `describe` on ALL endpoints (Appendix B / §13.9 "describe by default"): the ONE
+ *  subject-wildcard request form in the caller grammar,
+ *  `ep.one.*.describe.<cO>.<cA>.<cUid>.*` — the endpoint token is the wildcard, the command is
+ *  the literal reserved `describe`, and the caller triple stays pinned. DELIBERATELY not an
+ *  {@link EpCapability} (whose endpoint is a validated literal): a wildcard-endpoint capability
+ *  would generalize to arbitrary commands, and the baseline is the only place the wildcard form
+ *  is normative. Untargeted only — describe is constructed untargeted on every serve
+ *  (§13.7), so no authz/target block ever appears in the row. */
+export declare function epDescribeAllGrantRow(space: string, caller: EpCaller): string;
+/** The baseline {@link EpCapability} set every agent holds (Appendix B) beyond the wildcard
+ *  describe row: delivery join/leave/list (untargeted) + self-mode lifecycle. */
+export declare function baselineCallerCapabilities(): EpCapability[];
+/** The `spawn` capability's addition (Appendix B): the manager endpoint's lifecycle commands.
+ *  `spawn` (creation) is UNTARGETED — a virgin child has no lifecycle UID to resolve against the
+ *  current mapping, so an owner-mode row would be un-invokable under the verb grammar (§13.2). The
+ *  three that act on an existing agent ride owner mode, target owner pinned to the CALLER's own
+ *  (§13.2: an owner-mode standing mint never names a foreign owner). */
+export declare function spawnCallerCapabilities(callerOwner: string): EpCapability[];
+/** All BASELINE caller rows (Appendix B): the wildcard describe form + the baseline capability
+ *  rollup into `pub.allow`, and the caller's reply rail into `sub.allow` — ALWAYS present (the
+ *  baseline implies the reply read even when no per-capability rows are minted). */
+export declare function epBaselineGrantRows(space: string, caller: EpCaller): {
+    pub: string[];
+    sub: string[];
+};
+/** One registered command's serve-subscribe rows (§13.9 "Serve subscribe"), per registered
+ *  command and never a cross-command `>`:
+ *   - class rail: `"ep.one.<endpoint>.<command>.> <queue>"` — QUEUE-QUALIFIED ONLY (the NATS
+ *     `subject queue` grant form): no credential can plain-subscribe the class rail, which is
+ *     what keeps per-request nonces visible only to the queue-selected instance;
+ *   - scatter rail: `ep.all.<endpoint>.<command>.>` plain;
+ *   - instance rail: `ep.inst.<endpoint>.<instanceId>.<command>.>` exact.
+ *  The epoch is deliberately absent from serve subscriptions (§13.1's barrier is the fence). */
+export declare function epServeSubscribeRows(space: string, endpoint: string, instanceId: string, command: string): string[];
+/** A serving instance's egress rows (§13.9 matrix): reply publish (attribution-pinned instance
+ *  triple + epoch), events, timer SCHEDULE requests (never `.armed`/`.fire`), and the epoch-pinned
+ *  record-write ingress. Every row pins the instance's own identity and epoch. */
+export declare function epServePublishRows(space: string, endpoint: string, instanceId: string, epoch: number): string[];
+/** All serve-credential subject-space rows for an instance. `ephemeralCommands` is the
+ *  RAIL-SERVED (ephemeral) subset only — journal commands stay in the credential's descriptor
+ *  surface but ride `epj` submissions, never the §13.2 request rails, so they take no rail
+ *  subscribe row here (their effects/pool durable binds ride the §13.12 stream binding). The
+ *  reserved `describe` is DERIVED here — every endpoint serves it (§13.7), so this ONE assembly
+ *  seam emits its rails for every serve credential (even a journal-only endpoint, whose
+ *  `ephemeralCommands` is empty) and an explicit `describe` refuses (mirroring
+ *  {@link import("./endpoint-serve.js").serveEndpoint}'s construction rule: there is no custom
+ *  describe). The subscribe side also carries the instance's OWN epoch-pinned timer FIRE row
+ *  (§13.9 "Timer fire consume": `ept.<e>.<i>.<epoch>.*.fire` — consume only; the publish side
+ *  stays `.schedule`-only, no credential publishes `.armed`/`.fire`). */
+export declare function epServeGrantRows(space: string, serve: {
+    endpoint: string;
+    instanceId: string;
+    epoch: number;
+    ephemeralCommands: string[];
+}): {
+    pub: string[];
+    sub: string[];
+};
+//# sourceMappingURL=endpoint-grants.d.ts.map

package/dist/endpoint-grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint-grants.d.ts","sourceRoot":"","sources":["../src/endpoint-grants.ts"],"names":[],"mappings":"AAYA,OAAO,EAEL,KAAK,QAAQ,EAAE,KAAK,QAAQ,EAE7B,MAAM,wBAAwB,CAAC;AAEhC;;;;;;;iEAOiE;AACjE,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,CAAC,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,mFAAmF;IACnF,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAwBD;;2FAE2F;AAC3F,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,GAAG,MAAM,EAAE,CAS/F;AAED;+FAC+F;AAC/F,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,GAAG,MAAM,CAG5F;AAED,kGAAkG;AAClG,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,MAAM,CAE7E;AAED;;wFAEwF;AACxF,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,MAAM,CAEhG;AAED;;;;;;4EAM4E;AAC5E,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,YAAY,EAAE,EACpB,MAAM,EAAE,QAAQ,GACf;IAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,EAAE,CAAA;CAAE,CASlC;AAcD;;;;oFAIoF;AACpF,eAAO,MAAM,0BAA0B,aAAa,CAAC;AACrD,eAAO,MAAM,0BAA0B,oCAAoD,CAAC;AAC5F;4EAC4E;AAC5E,eAAO,MAAM,2BAA2B,YAAY,CAAC;AACrD,eAAO,MAAM,gCAAgC,mBAAmC,CAAC;AACjF;;;;;;;;iGAQiG;AACjG,eAAO,MAAM,qBAAqB,oBAAoC,CAAC;AACvE,eAAO,MAAM,8BAA8B,gCAAgD,CAAC;AAU5F;;;;;;;iEAOiE;AACjE,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,MAAM,CAE7E;AAED;iFACiF;AACjF,wBAAgB,0BAA0B,IAAI,YAAY,EAAE,CAK3D;AAED;;;;wEAIwE;AACxE,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,YAAY,EAAE,CAQ3E;AAED;;oFAEoF;AACpF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG;IAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,EAAE,CAAA;CAAE,CAGrG;AAED;;;;;;;gGAOgG;AAChG,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAQnH;AAED;;kFAEkF;AAClF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAU/G;AAED;;;;;;;;;;yEAUyE;AACzE,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAA;CAAE,GAC1F;IAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,EAAE,CAAA;CAAE,CAQlC"}