@cotal-ai/core 0.12.0 → 0.13.1

package/dist/endpoint-subjects.js

@@ -0,0 +1,381 @@
+/**
+ * v0.4 endpoint control-surface subject grammar (SPEC §13.2) — builders, parsers, and token
+ * validators for the `ep` request/reply rails and the endpoint-published planes
+ * (`epe`/`epf`/`epj`/`ept`/`epr`/`epc`/`epw`/`eps`).
+ *
+ * Builders validate FAIL-LOUD (the spec's build-time boundary: bad token or an over-1024-byte
+ * subject throws, never truncates). The parser mirrors {@link parseSubject}'s trust model: it
+ * SPLITS AND DISPATCHES only — the broker already forge-locked the identity slots via the minted
+ * grant, so a reader recovers tokens, it does not re-prove their grammar. What the parser DOES
+ * enforce is SHAPE: prefix, plane, exact arity, and the §13.2 explicit-discrimination rule (the
+ * token after `<command>` is either one of the six reserved authorization-mode tokens or the
+ * caller's owner token). §2's owner grammar (`local` or `u_`+base32) keeps those sets disjoint
+ * for every spec-conformant mint; this module's owner validator is deliberately wider (it admits
+ * legacy principal tokens), so the dispatch additionally rests on each mode's pinned arity — a
+ * colliding token parses to `null`, never to a confused identity. A subject matching no defined
+ * shape returns `null` and MUST NOT be handled.
+ */
+import { ROOT, spacePrefix, assertValidOwnerToken, assertLifecycleToken } from "./subjects.js";
+// One grammar bounds both `lifecycleUid` and `instanceId` (§13.1) — the definition lives in
+// subjects.ts (the messaging plane lifecycle-keys resource names with it); re-exported here so the
+// endpoint rails keep their import surface.
+export { assertLifecycleToken, mintLifecycleUid } from "./subjects.js";
+/** The v0.4 wire version this surface targets. Advertised (§6 `protocolVersion`) only at the
+ *  §13.11 cutover — a change signal, not negotiation; nothing pre-cut should flip the card. */
+export const PROTOCOL_VERSION_V04 = "0.4";
+/** Reserved command names (§13.2): every endpoint serves `describe` (§13.7); `cancel` is the
+ *  action-composite control command (§13.6). */
+export const RESERVED_COMMANDS = Object.freeze(["describe", "cancel"]);
+// ---- token grammars (§13.2 "Token bounds", §13.1) -----------------------------------------
+const ENDPOINT_LABEL = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
+const COMMAND = /^[a-z0-9-]{1,32}$/;
+const NONCE = /^[A-Za-z0-9_-]{22,64}$/;
+const ID = /^[A-Za-z0-9_-]{1,64}$/; // <id>, <goalId>, <timerId>, <token>, <sessionId>
+const GRANT_ID = /^[a-z0-9]{1,32}$/; // <gid>: separator-free, so multi-soft-component durable names stay injective (§13.9)
+const DIGEST_HEX = /^[a-f0-9]{64}$/;
+const EPOCH = /^(0|[1-9][0-9]*)$/;
+/** Maximum total subject size (bytes) on the endpoint rails; builders throw above it. */
+export const MAX_EP_SUBJECT_BYTES = 1024;
+/** Validate a dotted endpoint NAME (one or more DNS-shaped labels; `_` never appears in a label)
+ *  and return its wire TOKEN (`.` → `_`, bijective because labels cannot contain `_`). Single-label
+ *  names are reserved for reference-implementation endpoints; a third-party name MUST be
+ *  reverse-DNS — that is an AUTHORITY rule enforced at mint (§13.9), not a shape difference, so
+ *  both build here. */
+export function endpointToken(name) {
+    const labels = name.split(".");
+    for (const l of labels) {
+        if (!ENDPOINT_LABEL.test(l))
+            throw new Error(`endpoint name label "${l}" in "${name}" is not DNS-shaped ([a-z0-9]([a-z0-9-]*[a-z0-9])?)`);
+    }
+    const tok = labels.join("_");
+    if (tok.length > 64)
+        throw new Error(`endpoint name token "${tok}" exceeds 64 characters`);
+    return tok;
+}
+/** Inverse of {@link endpointToken}: recover the dotted endpoint name from its wire token. */
+export function endpointNameOf(token) {
+    return token.split("_").join(".");
+}
+export function assertCommandToken(command) {
+    if (!COMMAND.test(command))
+        throw new Error(`command "${command}" is not a valid command token ([a-z0-9-]{1,32})`);
+    return command;
+}
+export function assertNonce(nonce) {
+    if (!NONCE.test(nonce))
+        throw new Error(`nonce is not a valid nonce token ([A-Za-z0-9_-]{22,64}; >=128 bits of CSPRNG entropy)`);
+    return nonce;
+}
+export function assertIdToken(v, what = "id") {
+    if (!ID.test(v))
+        throw new Error(`${what} "${v}" is not a valid id token ([A-Za-z0-9_-]{1,64})`);
+    return v;
+}
+/** The provisioner-assigned grant id `<gid>` (§13.9). Deliberately SEPARATOR-FREE ([a-z0-9]):
+ *  the `eve_<uid>-<e>-<gid>-<n>` and `rec_<uid>-<gid>-<n>` reader-durable names carry it adjacent
+ *  to other soft components across `-`, so a `-` (or `_`) inside `<gid>` would make the name
+ *  non-injective (`eve_<uid>-a-b-c-0` could be endpoint `a-b`/gid `c` OR endpoint `a`/gid `b-c`).
+ *  Constraining `<gid>` to a separator-free grammar keeps the tuple encoding unambiguous while
+ *  `<uid>` is `-`-free (leading) and `<n>` is digits (trailing). */
+export function assertGrantId(v, what = "grantId") {
+    if (!GRANT_ID.test(v))
+        throw new Error(`${what} "${v}" is not a valid grant id ([a-z0-9]{1,32}; separator-free so reader-durable names stay injective)`);
+    return v;
+}
+/** `<pool>` uses the command-token grammar (§13.2). */
+export function assertPoolToken(pool) {
+    if (!COMMAND.test(pool))
+        throw new Error(`pool "${pool}" is not a valid pool token ([a-z0-9-]{1,32})`);
+    return pool;
+}
+function assertEpoch(epoch) {
+    if (!Number.isSafeInteger(epoch) || epoch < 0)
+        throw new Error(`epoch ${epoch} is not an unsigned integer`);
+    return String(epoch);
+}
+/** The shared owner/actor token validator for this grammar (§13.2 token bounds): the base
+ *  owner-token grammar plus the 64-character rail bound. Grant builders MUST route through the
+ *  same validator as subject builders, so the two can never diverge on what they admit. */
+export function assertBoundedOwner(v, what) {
+    assertValidOwnerToken(v);
+    if (v.length > 64)
+        throw new Error(`${what} "${v}" exceeds 64 characters`);
+    return v;
+}
+function assertSized(subject) {
+    if (new TextEncoder().encode(subject).length > MAX_EP_SUBJECT_BYTES)
+        throw new Error(`subject exceeds ${MAX_EP_SUBJECT_BYTES} bytes: ${subject.slice(0, 80)}…`);
+    return subject;
+}
+/** The six reserved authorization-mode tokens. Disjoint from every spec-conformant owner token
+ *  (`local` or `u_`+base32 per §2, never a bare mode word); the implementation's owner validator
+ *  also admits legacy principal tokens, so the parser's discrimination rests on membership in
+ *  this set PLUS each mode's pinned arity, not on the owner grammar alone. */
+export const EP_AUTHZ_MODES = Object.freeze(["self", "owner", "any", "child", "ledger", "handle"]);
+const AUTHZ_SET = new Set(EP_AUTHZ_MODES);
+/** Is `m` a registered targeted-command authorization mode? Consults the PRIVATE module-load set,
+ *  never the live export, so a post-import mutation of {@link EP_AUTHZ_MODES} cannot widen the
+ *  modes a cluster document may declare (the afa715b integrity class). */
+export function isEpAuthzMode(m) { return AUTHZ_SET.has(m); }
+const TARGET_ARITY = { self: 0, owner: 1, any: 1, child: 1, ledger: 1, handle: 3 };
+function targetTokens(target) {
+    if (target.mode === "self")
+        return ["self"];
+    if (target.mode === "handle")
+        return ["handle", assertBoundedOwner(target.tOwner, "target owner"), assertBoundedOwner(target.tActor, "target actor"), assertLifecycleToken(target.tUid, "target lifecycleUid")];
+    return [target.mode, assertBoundedOwner(target.tOwner, "target owner")];
+}
+/** The caller triple as validated subject tokens — the ONE validation every caller-scoped
+ *  subject and filter goes through. */
+export function callerTokens(caller) {
+    return [
+        assertBoundedOwner(caller.owner, "caller owner"),
+        assertBoundedOwner(caller.actor, "caller actor"),
+        assertLifecycleToken(caller.uid, "caller lifecycleUid"),
+    ];
+}
+/** Build a request subject (class, scatter, or instance form; targeted iff `target` is given). */
+export function epRequestSubject(space, req) {
+    const parts = [spacePrefix(space), "ep", req.route.mode, endpointToken(req.endpoint)];
+    if (req.route.mode === "inst")
+        parts.push(assertLifecycleToken(req.route.instanceId, "instanceId"));
+    parts.push(assertCommandToken(req.command));
+    if (req.target)
+        parts.push(...targetTokens(req.target));
+    parts.push(...callerTokens(req.caller), assertNonce(req.nonce));
+    return assertSized(parts.join("."));
+}
+/** Build a reply subject: the responder's own endpoint/instance/epoch prefix plus the caller
+ *  triple and nonce. Use {@link deriveReplySubject} to answer a request — replies MUST derive
+ *  from the authenticated request subject, never from a transport- or payload-supplied target. */
+export function epReplySubject(space, r) {
+    return assertSized([
+        spacePrefix(space), "ep", "reply", endpointToken(r.endpoint), assertLifecycleToken(r.instanceId, "instanceId"),
+        assertEpoch(r.epoch), ...callerTokens(r.caller), assertNonce(r.nonce),
+    ].join("."));
+}
+/** Deterministic reply derivation (§13.2 "Replies"): copy the caller triple + nonce off the
+ *  broker-authenticated PARSED request and prefix the responder's own instance identity. Taking
+ *  a {@link ParsedEpRequest} (not a raw string) makes the confused-deputy boundary structural:
+ *  there is no argument through which a payload-supplied reply target could arrive. */
+export function deriveReplySubject(space, request, responder) {
+    return epReplySubject(space, {
+        endpoint: request.endpoint,
+        instanceId: responder.instanceId,
+        epoch: responder.epoch,
+        caller: request.caller,
+        nonce: request.nonce,
+    });
+}
+// ---- serve / read filters (§13.2, §13.9) ----------------------------------------------------
+/** The class rail's canonical queue group: the endpoint-name token. Serve subscriptions to the
+ *  `one` rail are queue-qualified ONLY (§13.9) — no credential may plain-subscribe it, which is
+ *  what keeps per-request nonces visible only to the queue-selected instance. */
+export function epClassQueueGroup(endpoint) {
+    return endpointToken(endpoint);
+}
+/** Subscription filter for a class (`one`) or scatter (`all`) serve. */
+export function epServeFilter(space, mode, endpoint) {
+    return `${spacePrefix(space)}.ep.${mode}.${endpointToken(endpoint)}.>`;
+}
+/** Subscription filter for one instance's own request rail. */
+export function epInstanceServeFilter(space, endpoint, instanceId) {
+    return `${spacePrefix(space)}.ep.inst.${endpointToken(endpoint)}.${assertLifecycleToken(instanceId, "instanceId")}.>`;
+}
+/** A caller's reply-read filter — its OWN rail only, exact arity (no `>` tail admits subjects
+ *  outside the grammar): `ep.reply.*.*.*.<owner>.<actor>.<uid>.*`. */
+export function epCallerReplyFilter(space, caller) {
+    return `${spacePrefix(space)}.ep.reply.*.*.*.${callerTokens(caller).join(".")}.*`;
+}
+/** A responder's reply-publish pattern — its own instance triple and epoch pinned, all caller
+ *  suffixes spanned (addressing is confined by nonce possession, §13.2): exact arity. */
+export function epResponderReplyPattern(space, endpoint, instanceId, epoch) {
+    return `${spacePrefix(space)}.ep.reply.${endpointToken(endpoint)}.${assertLifecycleToken(instanceId, "instanceId")}.${assertEpoch(epoch)}.*.*.*.*`;
+}
+function topicPath(topic, what) {
+    if (topic.length === 0)
+        throw new Error(`${what} topic must have at least one token`);
+    for (const t of topic)
+        if (t.length === 0 || t.includes("."))
+            throw new Error(`${what} topic token "${t}" is empty or dotted`);
+    return topic.join(".");
+}
+/** Events: `epe.<endpoint>.<instanceId>.<epoch>.<topic…>` — the publishing instance's identity
+ *  and epoch are forge-locked subject tokens (stale-epoch events are attributably stale). */
+export function epeSubject(space, endpoint, instanceId, epoch, topic) {
+    return assertSized(`${spacePrefix(space)}.epe.${endpointToken(endpoint)}.${assertLifecycleToken(instanceId, "instanceId")}.${assertEpoch(epoch)}.${topicPath(topic, "event")}`);
+}
+/** Canonical facts: `epf.<endpoint>.<topic…>` — publishable only by the mediated writer (§13.9). */
+export function epfSubject(space, endpoint, topic) {
+    return assertSized(`${spacePrefix(space)}.epf.${endpointToken(endpoint)}.${topicPath(topic, "fact")}`);
+}
+/** Journal submissions: `epj.<endpoint>.<command>[.<authz>[.<target…>]].<owner>.<actor>.<uid>` —
+ *  directly publishable by capability holders and explicitly UNTRUSTED (§13.4); a targeted
+ *  command carries the same authz/target block as its request forms, no nonce. */
+export function epjSubject(space, j) {
+    const parts = [spacePrefix(space), "epj", endpointToken(j.endpoint), assertCommandToken(j.command)];
+    if (j.target)
+        parts.push(...targetTokens(j.target));
+    parts.push(...callerTokens(j.caller));
+    return assertSized(parts.join("."));
+}
+/** Timers: `ept.<endpoint>.<instanceId>.<epoch>.<timerId>.<schedule|armed|fire>` (§13.2). */
+export function eptSubject(space, endpoint, instanceId, epoch, timerId, phase) {
+    return assertSized(`${spacePrefix(space)}.ept.${endpointToken(endpoint)}.${assertLifecycleToken(instanceId, "instanceId")}.${assertEpoch(epoch)}.${assertIdToken(timerId, "timerId")}.${phase}`);
+}
+/** Record writes: `epr.<endpoint>.<instanceId>.<epoch>.<kind>.<qualifier…>` — the instance's
+ *  epoch-pinned mediated record-writer ingress (§13.9 reads the epoch off this subject). */
+export function eprSubject(space, endpoint, instanceId, epoch, kind, qualifier = []) {
+    const tail = qualifier.length ? `.${topicPath(qualifier, "record qualifier")}` : "";
+    return assertSized(`${spacePrefix(space)}.epr.${endpointToken(endpoint)}.${assertLifecycleToken(instanceId, "instanceId")}.${assertEpoch(epoch)}.${assertIdToken(kind, "record kind")}${tail}`);
+}
+/** Contract artifacts: `epc.<digest-hex>` — one immutable artifact per subject; the token is the
+ *  SHA-256 hex (the `sha256:` prefix is not a subject token, §13.7). */
+export function epcSubject(space, digestHex) {
+    if (!DIGEST_HEX.test(digestHex))
+        throw new Error(`contract digest "${digestHex}" is not 64 lowercase hex chars`);
+    return `${spacePrefix(space)}.epc.${digestHex}`;
+}
+/** Work pools: `epw.<endpoint>.<pool>.<cOwner>.<cActor>.<cUid>.<id>` — the trailing four tokens
+ *  are the item's ACCEPTANCE IDENTITY (the accepted submission's caller triple + request id). */
+export function epwSubject(space, endpoint, pool, acceptance) {
+    return assertSized(`${spacePrefix(space)}.epw.${endpointToken(endpoint)}.${assertPoolToken(pool)}.${callerTokens(acceptance).join(".")}.${assertIdToken(acceptance.id)}`);
+}
+/** Sessions: `eps.<endpoint>.<sessionId>.<epoch>.<in|out>` (§13.6). */
+export function epsSubject(space, endpoint, sessionId, epoch, dir) {
+    return assertSized(`${spacePrefix(space)}.eps.${endpointToken(endpoint)}.${assertIdToken(sessionId, "sessionId")}.${assertEpoch(epoch)}.${dir}`);
+}
+/** Read the `[.<authz>[.<target…>]].<owner>.<actor>.<uid>` tail (plus `withNonce` trailing
+ *  token) starting at `i`. Dispatches on the token at `i`: a reserved mode token opens a
+ *  target block of that mode's pinned arity; anything else is the caller's owner token (the
+ *  two sets are disjoint by construction — never arity counting). Exact arity: returns null
+ *  unless the tokens run out exactly at the end. */
+function parseTail(parts, i, withNonce) {
+    let target = null;
+    const disc = parts[i];
+    if (disc !== undefined && AUTHZ_SET.has(disc)) {
+        const mode = disc;
+        const arity = TARGET_ARITY[mode];
+        const t = parts.slice(i + 1, i + 1 + arity);
+        if (t.length !== arity)
+            return null;
+        target =
+            mode === "self" ? { mode }
+                : mode === "handle" ? { mode, tOwner: t[0], tActor: t[1], tUid: t[2] }
+                    : { mode, tOwner: t[0] };
+        i += 1 + arity;
+    }
+    const want = i + 3 + (withNonce ? 1 : 0);
+    if (parts.length !== want)
+        return null;
+    const caller = { owner: parts[i], actor: parts[i + 1], uid: parts[i + 2] };
+    return withNonce ? { target, caller, nonce: parts[i + 3] } : { target, caller };
+}
+function parseEpoch(tok) {
+    if (!EPOCH.test(tok))
+        return null;
+    const n = Number(tok);
+    // Mirror assertEpoch's build-side bound: past 2^53 distinct tokens would Number()-collapse
+    // into one value, and epoch is the fence on every plane that carries it.
+    return Number.isSafeInteger(n) ? n : null;
+}
+/**
+ * Parse a v0.4 endpoint-surface subject into its typed shape, or `null` for anything that is not
+ * one — including the retired v0 `ctl.>`/`control.>` planes, which this parser deliberately does
+ * not know. `null` means the subject has no sender and MUST NOT be handled (§13.2).
+ */
+export function parseEpSubject(subject) {
+    if (new TextEncoder().encode(subject).length > MAX_EP_SUBJECT_BYTES)
+        return null;
+    const parts = subject.split(".");
+    if (parts[0] !== ROOT || parts.length < 4)
+        return null; // cotal.<space>.<plane>.…
+    const plane = parts[2];
+    if (plane === "ep") {
+        const route = parts[3];
+        if (route === "one" || route === "all") {
+            if (parts.length < 10)
+                return null;
+            const tail = parseTail(parts, 6, true);
+            if (!tail)
+                return null;
+            return { plane: "request", route, endpoint: endpointNameOf(parts[4]), command: parts[5], target: tail.target, caller: tail.caller, nonce: tail.nonce };
+        }
+        if (route === "inst") {
+            if (parts.length < 11)
+                return null;
+            const tail = parseTail(parts, 7, true);
+            if (!tail)
+                return null;
+            return { plane: "request", route, endpoint: endpointNameOf(parts[4]), instanceId: parts[5], command: parts[6], target: tail.target, caller: tail.caller, nonce: tail.nonce };
+        }
+        if (route === "reply") {
+            if (parts.length !== 11)
+                return null;
+            const epoch = parseEpoch(parts[6]);
+            if (epoch === null)
+                return null;
+            return { plane: "reply", endpoint: endpointNameOf(parts[4]), instanceId: parts[5], epoch, caller: { owner: parts[7], actor: parts[8], uid: parts[9] }, nonce: parts[10] };
+        }
+        return null;
+    }
+    if (plane === "epe") {
+        if (parts.length < 7)
+            return null;
+        const epoch = parseEpoch(parts[5]);
+        if (epoch === null)
+            return null;
+        return { plane: "event", endpoint: endpointNameOf(parts[3]), instanceId: parts[4], epoch, topic: parts.slice(6) };
+    }
+    if (plane === "epf") {
+        if (parts.length < 5)
+            return null;
+        return { plane: "fact", endpoint: endpointNameOf(parts[3]), topic: parts.slice(4) };
+    }
+    if (plane === "epj") {
+        if (parts.length < 8)
+            return null;
+        const tail = parseTail(parts, 5, false);
+        if (!tail)
+            return null;
+        return { plane: "journal", endpoint: endpointNameOf(parts[3]), command: parts[4], target: tail.target, caller: tail.caller };
+    }
+    if (plane === "ept") {
+        if (parts.length !== 8)
+            return null;
+        const epoch = parseEpoch(parts[5]);
+        const phase = parts[7];
+        if (epoch === null || (phase !== "schedule" && phase !== "armed" && phase !== "fire"))
+            return null;
+        return { plane: "timer", endpoint: endpointNameOf(parts[3]), instanceId: parts[4], epoch, timerId: parts[6], phase };
+    }
+    if (plane === "epr") {
+        if (parts.length < 7)
+            return null;
+        const epoch = parseEpoch(parts[5]);
+        if (epoch === null)
+            return null;
+        return { plane: "record", endpoint: endpointNameOf(parts[3]), instanceId: parts[4], epoch, kind: parts[6], qualifier: parts.slice(7) };
+    }
+    if (plane === "epc") {
+        if (parts.length !== 4 || !DIGEST_HEX.test(parts[3]))
+            return null;
+        return { plane: "contract", digestHex: parts[3] };
+    }
+    if (plane === "epw") {
+        if (parts.length !== 9)
+            return null;
+        return { plane: "work", endpoint: endpointNameOf(parts[3]), pool: parts[4], acceptance: { owner: parts[5], actor: parts[6], uid: parts[7], id: parts[8] } };
+    }
+    if (plane === "eps") {
+        if (parts.length !== 7)
+            return null;
+        const epoch = parseEpoch(parts[5]);
+        const dir = parts[6];
+        if (epoch === null || (dir !== "in" && dir !== "out"))
+            return null;
+        return { plane: "session", endpoint: endpointNameOf(parts[3]), sessionId: parts[4], epoch, dir };
+    }
+    return null;
+}
+//# sourceMappingURL=endpoint-subjects.js.map

package/dist/endpoint-subjects.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint-subjects.js","sourceRoot":"","sources":["../src/endpoint-subjects.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAE/F,4FAA4F;AAC5F,mGAAmG;AACnG,4CAA4C;AAC5C,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEvE;+FAC+F;AAC/F,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAE1C;gDACgD;AAChD,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAU,CAAC,CAAC;AAEhF,8FAA8F;AAE9F,MAAM,cAAc,GAAG,iCAAiC,CAAC;AACzD,MAAM,OAAO,GAAG,mBAAmB,CAAC;AACpC,MAAM,KAAK,GAAG,wBAAwB,CAAC;AACvC,MAAM,EAAE,GAAG,uBAAuB,CAAC,CAAC,kDAAkD;AACtF,MAAM,QAAQ,GAAG,kBAAkB,CAAC,CAAC,sFAAsF;AAC3H,MAAM,UAAU,GAAG,gBAAgB,CAAC;AACpC,MAAM,KAAK,GAAG,mBAAmB,CAAC;AAElC,yFAAyF;AACzF,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAEzC;;;;uBAIuB;AACvB,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,SAAS,IAAI,qDAAqD,CAAC,CAAC;IAC5I,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,yBAAyB,CAAC,CAAC;IAC3F,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,OAAO,kDAAkD,CAAC,CAAC;IACnH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC,CAAC;IACjI,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,CAAS,EAAE,IAAI,GAAG,IAAI;IAClD,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACjG,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;oEAKoE;AACpE,MAAM,UAAU,aAAa,CAAC,CAAS,EAAE,IAAI,GAAG,SAAS;IACvD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,mGAAmG,CAAC,CAAC;IACzJ,OAAO,CAAC,CAAC;AACX,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,+CAA+C,CAAC,CAAC;IACvG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,6BAA6B,CAAC,CAAC;IAC5G,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED;;2FAE2F;AAC3F,MAAM,UAAU,kBAAkB,CAAC,CAAS,EAAE,IAAY;IACxD,qBAAqB,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC3E,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,oBAAoB;QACjE,MAAM,IAAI,KAAK,CAAC,mBAAmB,oBAAoB,WAAW,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;IAC7F,OAAO,OAAO,CAAC;AACjB,CAAC;AAYD;;;8EAG8E;AAC9E,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC,CAAC;AAE5G,MAAM,SAAS,GAAG,IAAI,GAAG,CAAS,cAAc,CAAC,CAAC;AAClD;;0EAE0E;AAC1E,MAAM,UAAU,aAAa,CAAC,CAAS,IAAa,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAU9E,MAAM,YAAY,GAAgC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AAEhH,SAAS,YAAY,CAAC,MAAgB;IACpC,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;QAC1B,OAAO,CAAC,QAAQ,EAAE,kBAAkB,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,kBAAkB,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,oBAAoB,CAAC,MAAM,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC,CAAC;IACpL,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED;uCACuC;AACvC,MAAM,UAAU,YAAY,CAAC,MAAgB;IAC3C,OAAO;QACL,kBAAkB,CAAC,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC;QAChD,kBAAkB,CAAC,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC;QAChD,oBAAoB,CAAC,MAAM,CAAC,GAAG,EAAE,qBAAqB,CAAC;KACxD,CAAC;AACJ,CAAC;AAUD,kGAAkG;AAClG,MAAM,UAAU,gBAAgB,CAC9B,KAAa,EACb,GAA8G;IAE9G,MAAM,KAAK,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtF,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;IACpG,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5C,IAAI,GAAG,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD,KAAK,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE,OAAO,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACtC,CAAC;AAED;;kGAEkG;AAClG,MAAM,UAAU,cAAc,CAC5B,KAAa,EACb,CAA2F;IAE3F,OAAO,WAAW,CAAC;QACjB,WAAW,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,oBAAoB,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC;QAC9G,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC;KACtE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACf,CAAC;AAED;;;uFAGuF;AACvF,MAAM,UAAU,kBAAkB,CAChC,KAAa,EACb,OAAwB,EACxB,SAAgD;IAEhD,OAAO,cAAc,CAAC,KAAK,EAAE;QAC3B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC,CAAC;AACL,CAAC;AAED,gGAAgG;AAEhG;;iFAEiF;AACjF,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,OAAO,aAAa,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,IAAmB,EAAE,QAAgB;IAChF,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC;AACzE,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,QAAgB,EAAE,UAAkB;IACvF,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,YAAY,aAAa,CAAC,QAAQ,CAAC,IAAI,oBAAoB,CAAC,UAAU,EAAE,YAAY,CAAC,IAAI,CAAC;AACxH,CAAC;AAED;sEACsE;AACtE,MAAM,UAAU,mBAAmB,CAAC,KAAa,EAAE,MAAgB;IACjE,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,mBAAmB,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;AACpF,CAAC;AAED;yFACyF;AACzF,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,QAAgB,EAAE,UAAkB,EAAE,KAAa;IACxG,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,aAAa,aAAa,CAAC,QAAQ,CAAC,IAAI,oBAAoB,CAAC,UAAU,EAAE,YAAY,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC;AACrJ,CAAC;AAOD,SAAS,SAAS,CAAC,KAAe,EAAE,IAAY;IAC9C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,qCAAqC,CAAC,CAAC;IACtF,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,iBAAiB,CAAC,sBAAsB,CAAC,CAAC;IAC/H,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED;6FAC6F;AAC7F,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,QAAgB,EAAE,UAAkB,EAAE,KAAa,EAAE,KAAe;IAC5G,OAAO,WAAW,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,aAAa,CAAC,QAAQ,CAAC,IAAI,oBAAoB,CAAC,UAAU,EAAE,YAAY,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;AAClL,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,QAAgB,EAAE,KAAe;IACzE,OAAO,WAAW,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,aAAa,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;AACzG,CAAC;AAED;;kFAEkF;AAClF,MAAM,UAAU,UAAU,CACxB,KAAa,EACb,CAA6E;IAE7E,MAAM,KAAK,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACpG,IAAI,CAAC,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,KAAK,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACtC,OAAO,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,QAAgB,EAAE,UAAkB,EAAE,KAAa,EAAE,OAAe,EAAE,KAAmB;IACjI,OAAO,WAAW,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,aAAa,CAAC,QAAQ,CAAC,IAAI,oBAAoB,CAAC,UAAU,EAAE,YAAY,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;AACnM,CAAC;AAED;4FAC4F;AAC5F,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,QAAgB,EAAE,UAAkB,EAAE,KAAa,EAAE,IAAY,EAAE,YAAsB,EAAE;IACnI,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,SAAS,EAAE,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpF,OAAO,WAAW,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,aAAa,CAAC,QAAQ,CAAC,IAAI,oBAAoB,CAAC,UAAU,EAAE,YAAY,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;AAClM,CAAC;AAED;wEACwE;AACxE,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,SAAiB;IACzD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,SAAS,iCAAiC,CAAC,CAAC;IACjH,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,SAAS,EAAE,CAAC;AAClD,CAAC;AAED;iGACiG;AACjG,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,QAAgB,EAAE,IAAY,EAAE,UAAqC;IAC7G,OAAO,WAAW,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,aAAa,CAAC,QAAQ,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AAC5K,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,QAAgB,EAAE,SAAiB,EAAE,KAAa,EAAE,GAAiB;IAC7G,OAAO,WAAW,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,aAAa,CAAC,QAAQ,CAAC,IAAI,aAAa,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;AACnJ,CAAC;AA6BD;;;;oDAIoD;AACpD,SAAS,SAAS,CAAC,KAAe,EAAE,CAAS,EAAE,SAAkB;IAC/D,IAAI,MAAM,GAAoB,IAAI,CAAC;IACnC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,IAAI,KAAK,SAAS,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,IAAmB,CAAC;QACjC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM;YACJ,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;gBAC1B,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;oBACtE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACjB,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,MAAM,GAAa,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;IACrF,OAAO,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAClF,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,2FAA2F;IAC3F,yEAAyE;IACzE,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,oBAAoB;QAAE,OAAO,IAAI,CAAC;IACjF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,0BAA0B;IAClF,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAEvB,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;YACvC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE;gBAAE,OAAO,IAAI,CAAC;YACnC,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;YACvC,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YACvB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAM,EAAE,CAAC;QAC1J,CAAC;QACD,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACrB,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE;gBAAE,OAAO,IAAI,CAAC;YACnC,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;YACvC,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YACvB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAM,EAAE,CAAC;QAChL,CAAC;QACD,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YACtB,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;gBAAE,OAAO,IAAI,CAAC;YACrC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACnC,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAChC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;QAC5K,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAClC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAChC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACpH,CAAC;IACD,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAClC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,CAAC;IACD,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAClC,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IAC/H,CAAC;IACD,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACnG,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;IACvH,CAAC;IACD,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAClC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAChC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACzI,CAAC;IACD,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAClE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC9J,CAAC;IACD,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACnE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IACnG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/endpoint-supervisor.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The §13.6 SUPERVISOR-WRITE authority — the capability to ORIGINATE supervisor-owned service
+ * status (the restart history, the retirement mark, the `escalated` state) through
+ * {@link writeServiceStatus}. This module is DELIBERATELY NOT re-exported from the package
+ * index: only the in-package §13.6 supervisor seams (`noteInstanceRestart`, the escalation
+ * reconciler in endpoint-virtual, and the writer check in endpoint-service) import it, so the
+ * mint is NOT ambiently obtainable by an arbitrary `@cotal-ai/core` consumer. A brand that any
+ * caller can mint is not an authority boundary (that was the flaw a public zero-argument
+ * factory had); keeping the mint package-private makes possession of the grant proof that the
+ * write came from a supervisor seam.
+ */
+export interface SupervisorWriteGrant {
+    readonly __supervisorWrite: true;
+}
+/** Mint the supervisor-write authority. INTERNAL: import only from the §13.6 supervisor seams. */
+export declare function mintSupervisorWrite(): SupervisorWriteGrant;
+/** True iff `g` is a genuine mint (WeakSet membership; a structural look-alike is not). */
+export declare function isSupervisorWrite(g: unknown): boolean;
+//# sourceMappingURL=endpoint-supervisor.d.ts.map

package/dist/endpoint-supervisor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint-supervisor.d.ts","sourceRoot":"","sources":["../src/endpoint-supervisor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,iBAAiB,EAAE,IAAI,CAAC;CAClC;AAID,kGAAkG;AAClG,wBAAgB,mBAAmB,IAAI,oBAAoB,CAI1D;AAED,2FAA2F;AAC3F,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAErD"}

package/dist/endpoint-supervisor.js

@@ -0,0 +1,12 @@
+const SUPERVISOR_WRITE_GRANTS = new WeakSet();
+/** Mint the supervisor-write authority. INTERNAL: import only from the §13.6 supervisor seams. */
+export function mintSupervisorWrite() {
+    const g = Object.freeze({ __supervisorWrite: true });
+    SUPERVISOR_WRITE_GRANTS.add(g);
+    return g;
+}
+/** True iff `g` is a genuine mint (WeakSet membership; a structural look-alike is not). */
+export function isSupervisorWrite(g) {
+    return typeof g === "object" && g !== null && SUPERVISOR_WRITE_GRANTS.has(g);
+}
+//# sourceMappingURL=endpoint-supervisor.js.map

package/dist/endpoint-supervisor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint-supervisor.js","sourceRoot":"","sources":["../src/endpoint-supervisor.ts"],"names":[],"mappings":"AAeA,MAAM,uBAAuB,GAAG,IAAI,OAAO,EAAU,CAAC;AAEtD,kGAAkG;AAClG,MAAM,UAAU,mBAAmB;IACjC,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,iBAAiB,EAAE,IAAa,EAAE,CAAC,CAAC;IAC9D,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/B,OAAO,CAAC,CAAC;AACX,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,iBAAiB,CAAC,CAAU;IAC1C,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,uBAAuB,CAAC,GAAG,CAAC,CAAW,CAAC,CAAC;AACzF,CAAC"}