@cotal-ai/core 0.15.0 → 0.17.0

package/dist/endpoint-binding.js

@@ -9,7 +9,7 @@
  * created by exactly one trusted principal (provisioner or the owning infra principal) and the
  * §13.9 grant rows are generated against these same names and filters.
  */
-import { AckPolicy, DeliverPolicy, RetentionPolicy, StorageType, } from "@nats-io/jetstream";
+import { AckPolicy, DeliverPolicy, DiscardPolicy, RetentionPolicy, StorageType, } from "@nats-io/jetstream";
 import { nanos } from "@nats-io/transport-node";
 import { spacePrefix, token, assertInboxConnId } from "./subjects.js";
 import { endpointToken, assertIdToken, assertGrantId, assertPoolToken, assertLifecycleToken, callerTokens, } from "./endpoint-subjects.js";
@@ -44,6 +44,17 @@ export function retirementFrontierStreams(space) {
 export function epAuthBucket(space) {
     return `cotal_auth_${token(space)}`;
 }
+/** The per-space SESSION ledger store (P2 item 6, §13.6): the `session.<id>` rows the manager's
+ *  session plane CASes over. DEDICATED — split out of the auth bucket deliberately. KV reads are
+ *  subject-BLIND (a `STREAM.MSG.GET` on a bucket serves any key, the campaign's known vector class),
+ *  so co-locating session rows with credentials + gates would let the standing session-ledger cred read
+ *  the whole control plane. A dedicated bucket makes that blind read STRUCTURALLY confined to session
+ *  rows and nothing else. `allow_direct=false` for the SAME reason the auth bucket carries it: every
+ *  ledger fence is a leader-served revision-pinned CAS (the one-use `createIssuing`, the finalize +
+ *  terminal updates), and Direct Get's follower/mirror reads would defeat read-your-writes (§13.1). */
+export function sessionsBucket(space) {
+    return `cotal_sessions_${token(space)}`;
+}
 // ---- §13.12 retention knobs (documented defaults, overridable per space policy) ----
 /** EPJ duplicate window: the server MINIMUM (100 ms), set explicitly. A `0` is not accepted
  *  (it normalizes to the 120 s default), and native dedupe is deliberately NOT relied upon —
@@ -70,11 +81,14 @@ export const EP_TIMER_MAX_AGE_MS = 31 * 24 * 60 * 60 * 1000;
 export const EP_AUTH_MARKER_TTL_MS = 60 * 60 * 1000;
 /**
  * Create (idempotently) the §13.12 per-space control-surface resources: the seven JetStream
- * streams, the work-pool WorkQueue, and the two KV buckets. Privileged — runs at space setup.
- * `jsm.streams.add`/`kvm.create` are idempotent for an identical config and FAIL LOUD on a
- * config delta, which is wanted: a drifted resource is an operator error, never silently adopted.
+ * streams, the work-pool WorkQueue, and the KV buckets (records + auth + the §13.6 session ledger).
+ * Privileged — runs at space setup. `jsm.streams.add`/`kvm.create` are idempotent for an identical
+ * config and FAIL LOUD on a config delta, which is wanted: a drifted resource is an operator error,
+ * never silently adopted.
  *
- * Sessions (`eps`) are deliberately absent: core-only, never captured (§13.12).
+ * The session byte SUBJECTS (`eps`) are deliberately absent: core-only, never captured (§13.12).
+ * Only the durable `session.<id>` ledger rows are captured — in their own dedicated bucket
+ * ({@link createSessionsStore}), never the auth bucket.
  */
 export async function createEndpointStreams(jsm, kvm, space, opts = {}) {
     const p = spacePrefix(space);
@@ -148,24 +162,109 @@ export async function createEndpointStreams(jsm, kvm, space, opts = {}) {
         storage: StorageType.File,
         allow_direct: false,
     });
-    // EPC — content-addressed contract artifacts: one immutable message per digest subject,
-    // create-only mediated publication, NO age eviction (artifacts are permanent). allow_direct:
-    // the subject-scoped last-by-subject read IS the fetch path. Permanence is BROKER-ENFORCED,
-    // not just configured-by-omission: deny_delete/deny_purge reject the message-delete and purge
-    // APIs even from a stream-API-holding principal, so a digest subject cannot be emptied and
-    // re-created through them. Per §13.12 the flags alone are NOT the whole claim: permanence is
-    // their COMBINATION with the retention floor (no age eviction, no teardown), verify-on-read
-    // pinning WHAT a subject carries, and stream management held by no profile.
-    await jsm.streams.add({
-        name: epcStreamName(space),
-        subjects: [`${p}.epc.>`],
-        retention: RetentionPolicy.Limits,
-        storage: StorageType.File,
-        allow_direct: true,
-        deny_delete: true,
-        deny_purge: true,
-    });
+    await ensureContractStore(jsm, space);
     await ensureAuthorityStores(jsm, kvm, space);
+    // P2 item 6: the DEDICATED §13.6 session ledger bucket. The eps byte SUBJECTS stay core-only and
+    // uncaptured (above), but the `session.<id>` ledger rows are a captured authority KV — kept in
+    // their own bucket so the manager's standing session-ledger cred's bucket-blind STREAM.MSG.GET reads
+    // ONLY session rows (the §13.9 subject-blindness structural fix). Provisioned here so every mesh
+    // that ensures the endpoint streams (auth + open both run this at the manager's boot) has it.
+    await createSessionsStore(jsm, kvm, space);
+}
+/**
+ * Ensure the per-space CONTRACT store (EPC) exists with its normative shape (§13.7/§13.12) —
+ * content-addressed artifacts, one immutable message per digest subject, create-only mediated
+ * publication, NO age eviction (artifacts are permanent). allow_direct: the subject-scoped
+ * last-by-subject read IS the fetch path.
+ *
+ * PER-SUBJECT IMMUTABILITY is BROKER-ENFORCED, not left to publisher cooperation (the append-shadow
+ * blocker, live-confirmed by the panel). The create-only fence `Nats-Expected-Last-Subject-Sequence:
+ * 0` is a publisher-SET header the `epc.*` publish grant cannot compel, so a non-cooperative
+ * grant-holder could APPEND a second message to an already-published digest subject; `last_by_subj`
+ * would then return that shadow and a fail-closed read would make the honest artifact permanently
+ * unfetchable (deny_delete/deny_purge block recovery — an operator-reprovision-only DoS, and at
+ * §13.11's ep-only cut the SOLE contract path). The store closes this at the SOURCE:
+ * `max_msgs_per_subject: 1` + `discard: new` + `discard_new_per_subject: true` makes a second
+ * publish to an occupied digest subject BROKER-REJECTED (err 10077) regardless of headers, so a
+ * digest subject holds exactly one message forever. `deny_delete`/`deny_purge` then keep that one
+ * message from being removed. (The read path additionally defends itself version-agnostically —
+ * {@link fetchContractArtifact} prefers the create-only winner over any shadow — so a broker or a
+ * legacy stream that lacked the per-subject cap is still safe.)
+ *
+ * Create-or-verify-AND-harden, safe at every authority-daemon boot (the {@link
+ * ensureAuthorityStores} discipline): a fresh space gets the store created with the full shape; a
+ * CLEAN pre-existing store (incl. a pre-hardening one from an earlier release, OR the config-A
+ * footgun `max_msgs_per_subject:1` + `discard:old` that would DELETE the honest artifact) is UPDATED
+ * to the three config-B flags (idempotent, like the records store's rollup/deny update) and then
+ * VERIFIED - a shape that cannot be brought to config B FAILS LOUD, never silently adopted.
+ *
+ * The config-B upgrade ENFORCES per-subject immutability GOING FORWARD; it does NOT heal a shadow
+ * that predates it. Applying `max_msgs_per_subject:1` trims each subject to its newest message, so a
+ * legacy store that ALREADY holds a shadow (some digest subject with >1 message) would have the
+ * honest create-only winner trimmed away and the shadow cemented. Rather than silently cement it,
+ * the upgrade REFUSES LOUD on such a store (`messages > num_subjects`), so the operator reprovisions
+ * a clean store. This is a narrow guard: a fresh deploy is born at config B and never reaches it.
+ *
+ * FAIL-LOUD IS THE AGENT'S DEFENSE (critic completeness item): because this verify refuses to serve
+ * unless all three config-B flags are present, the manager NEVER serves an un-hardened EPC store —
+ * so a shadow-append cannot exist on any store an agent reads. That is why the ordinary agent
+ * baseline needs only the subject-scoped `last_by_subj` read (never the bare `next_by_subj` the
+ * shadow fallback uses): on every store the manager actually serves, `last_by_subj` always verifies
+ * and the fallback never triggers. The {@link fetchContractArtifact} create-only-winner fallback is
+ * defense-in-depth for the publisher path (the executor, which holds `next_by_subj`) and for a
+ * hypothetical un-hardened store the manager would refuse to serve anyway. On the pinned broker
+ * floor (nats-server >= 2.12, well past the 2.9 that added `discard_new_per_subject`) config B always
+ * lands; an older broker that ignores the flag is caught here and the daemon fails to start.
+ */
+export async function ensureContractStore(jsm, space) {
+    const name = epcStreamName(space);
+    const subject = `${spacePrefix(space)}.epc.>`;
+    const hardening = { max_msgs_per_subject: 1, discard: DiscardPolicy.New, discard_new_per_subject: true };
+    if (await jsm.streams.info(name).catch(() => undefined) === undefined) {
+        await jsm.streams.add({
+            name,
+            subjects: [subject],
+            retention: RetentionPolicy.Limits,
+            storage: StorageType.File,
+            allow_direct: true,
+            deny_delete: true,
+            deny_purge: true,
+            ...hardening,
+        });
+    }
+    else {
+        // Upgrade path: an EPC stream from a pre-hardening release lacks the per-subject cap. Add it
+        // idempotently (a live update of max_msgs_per_subject + discard settings is allowed and, tested,
+        // leaves a CLEAN store's artifacts intact). A stream that WON'T take the update surfaces at the
+        // verify below.
+        const info = await jsm.streams.info(name);
+        const cur = info.config;
+        if (cur.max_msgs_per_subject !== 1 || cur.discard !== DiscardPolicy.New || cur.discard_new_per_subject !== true) {
+            // HEAL-OR-FAIL, never cement (critic upgrade-trim residual): applying max_msgs_per_subject:1
+            // TRIMS each subject to its NEWEST message. On a CLEAN legacy store (create-only, ≤1 message
+            // per subject) that trims nothing. But if a legacy store ALREADY holds a shadow (a raw append
+            // left a subject with >1 message, from before this hardening existed), the trim would keep the
+            // NEWEST (the shadow) and DELETE the honest create-only winner - cementing the shadow
+            // permanently. `messages > num_subjects` is exactly "some subject has more than one message",
+            // so refuse the upgrade LOUD there: the operator reprovisions a clean store rather than the
+            // daemon silently trim-cementing a pre-existing shadow. (Fresh deploys are born at config B and
+            // never reach this; the check only guards a legacy store that was shadowed before its first
+            // config-B boot.)
+            const { messages, num_subjects } = info.state;
+            if (messages > 0 && (num_subjects === undefined || messages > num_subjects))
+                throw new Error(`the contract store ${name} is a pre-hardening stream that cannot be proven clean (${messages} messages across ${String(num_subjects)} subjects) - a subject holding more than one message means a shadow-append predates this immutability upgrade, and applying the per-subject cap would TRIM to the newest (shadow) message and delete the honest artifact; reprovision a clean store rather than cement the shadow (SPEC 13.7/13.12)`);
+            await jsm.streams.update(name, { ...cur, ...hardening });
+        }
+    }
+    const cfg = (await jsm.streams.info(name)).config;
+    if (cfg.allow_direct !== true || cfg.deny_delete !== true || cfg.deny_purge !== true)
+        throw new Error(`the contract store ${name} has a drifted shape (allow_direct=${String(cfg.allow_direct)}, deny_delete=${String(cfg.deny_delete)}, deny_purge=${String(cfg.deny_purge)}); an authority store is never silently adopted - reprovision it (SPEC 13.12)`);
+    if (cfg.max_msgs_per_subject !== 1 || cfg.discard !== DiscardPolicy.New || cfg.discard_new_per_subject !== true)
+        throw new Error(`the contract store ${name} does not enforce per-subject immutability (max_msgs_per_subject=${String(cfg.max_msgs_per_subject)}, discard=${String(cfg.discard)}, discard_new_per_subject=${String(cfg.discard_new_per_subject)}); a digest subject must hold exactly one broker-immutable message or an append-shadow can DoS the store - reprovision it (SPEC 13.7/13.12)`);
+    if (!Array.isArray(cfg.subjects) || cfg.subjects.length !== 1 || cfg.subjects[0] !== subject)
+        throw new Error(`the contract store ${name} does not carry exactly the subject ${subject} (got ${JSON.stringify(cfg.subjects)}); a stream that captures anything else is not the contract store - reprovision it (SPEC 13.12)`);
+    if (cfg.storage !== "file")
+        throw new Error(`the contract store ${name} has storage ${JSON.stringify(cfg.storage)}, not file; a non-durable contract store forgets permanent artifacts on restart - reprovision it (SPEC 13.12)`);
 }
 /**
  * Ensure the two per-space AUTHORITY stores exist with their normative shape (§13.12):
@@ -209,6 +308,27 @@ export async function ensureAuthorityStores(jsm, kvm, space) {
         throw new Error(`the auth store ${authBucket} has a drifted shape (allow_direct=${String(authCfg.allow_direct)}, allow_msg_ttl=${String(authCfg.allow_msg_ttl)}); an authority store is never silently adopted - reprovision it (SPEC 13.12)`);
     assertAuthorityStoreBinding(authCfg, authBucket);
 }
+/** Create (idempotently) the per-space SESSION ledger store (P2 item 6, §13.6): the DEDICATED
+ *  {@link sessionsBucket} the manager's session plane CASes `session.<id>` rows over. Kept OUT of
+ *  {@link ensureAuthorityStores} deliberately — the auth path never touches session rows, and the
+ *  manager provisions this store from its own boot — but it wears the SAME authority-store shape as
+ *  the auth bucket: `allow_direct=false` (every ledger fence is a leader-served revision-pinned CAS,
+ *  and Direct Get's follower reads would defeat read-your-writes, §13.1) plus the per-key TTL
+ *  machinery (a terminal/expired session row can carry a delete-marker TTL). The dedication is the
+ *  security substance: the standing session-ledger cred's `kv.get` is a bucket-blind body-selected read,
+ *  and a bucket holding ONLY `session.>` rows makes that read expose nothing but session state — the
+ *  structural fix for the §13.9 subject-blindness a shared auth bucket would carry (creds + gates).
+ *  Create-or-verify, safe at every manager boot; a drifted store FAILS LOUD (§13.12). */
+export async function createSessionsStore(jsm, kvm, space) {
+    const bucket = sessionsBucket(space);
+    const stream = `KV_${bucket}`;
+    if (await jsm.streams.info(stream).catch(() => undefined) === undefined)
+        await kvm.create(bucket, { allow_direct: false, markerTTL: EP_AUTH_MARKER_TTL_MS });
+    const cfg = (await jsm.streams.info(stream)).config;
+    if (cfg.allow_direct !== false || cfg.allow_msg_ttl !== true)
+        throw new Error(`the sessions store ${bucket} has a drifted shape (allow_direct=${String(cfg.allow_direct)}, allow_msg_ttl=${String(cfg.allow_msg_ttl)}); an authority store is never silently adopted - reprovision it (SPEC 13.12)`);
+    assertAuthorityStoreBinding(cfg, bucket);
+}
 /** The store-BINDING half of the verify (SPEC 13.12): a stream wearing an authority bucket's name
  *  must BE that KV bucket — exactly the one `$KV.<bucket>.>` subject (an extra captured subject
  *  would put foreign bodies inside every body-selected MSG.GET grant on the stream) and durable
@@ -712,6 +832,9 @@ export function commitPrincipalGrants(space, endpoint, connId) {
     const p = spacePrefix(space);
     const records = recordsBucket(space);
     const publish = [
+        // ONE terminal subject per goal (SPEC:1394, the §13.9 "Result/receipt/terminal/resume facts"
+        // row): the exact-arity `…result` leaf, never an `…result.*` epoch-scoped variant — a per-epoch
+        // subject hid a legitimate pre-restart winner from every reader.
         `${p}.epf.${e}.goal.*.*.*.*.result`,
         `${p}.epf.${e}.eff.>`,
         `${p}.epf.${e}.receipt.>`,
@@ -726,6 +849,84 @@ export function commitPrincipalGrants(space, endpoint, connId) {
     ];
     return { publish, subscribe: [`_INBOX_${assertInboxConnId(connId)}.>`] };
 }
+/** The SELF-MEDIATED GOAL-WRITER profile (P2 item 2 "spawn becomes an action"): a standing
+ *  connection that both BINDS a goal at accept AND COMMITS its terminal, for an endpoint that
+ *  accepts action goals INLINE on its ephemeral serve handler (Model B) rather than through a
+ *  separate canonicalizer + effects executor. It is exactly {@link commitPrincipalGrants} (the
+ *  `goal.*.*.*.*.result` terminal + `$KV.<records>.goal.<e>.>` record write + the two leader-served
+ *  `STREAM.MSG.GET` fencing reads the substrate uses) PLUS the ONE row commitPrincipalGrants
+ *  deliberately leaves to the canonicalizer — the goal `.bind` leaf
+ *  (`epf.<e>.goal.*.*.*.*.bind`) — so this single principal owns the whole `accepted → terminal`
+ *  goal-fact chain of its OWN endpoint. The endpoint's SERVE credential
+ *  ({@link import("./endpoint-grants.js").epServePublishRows}) holds NONE of these: a serve
+ *  connection is broker-DENIED every goal write, which is the item-2 privilege separation (the
+ *  dedicated writer is minted on a distinct connection, the serve rails stay serve-only). All of
+ *  commitPrincipalGrants' D32 residuals carry unchanged (payload-blind create-only publish; raw
+ *  `$KV` cannot enforce the per-key CAS the substrate layers on; the two body-selected
+ *  `STREAM.MSG.GET` reads expose EPF + records space-wide). The reply inbox is connection-scoped
+ *  (`_INBOX_<connId>.>`). The `eff`/`wrk`/`receipt`/`cp`/`lease` families in the commit-principal
+ *  base are inert for a goal-only endpoint (the manager writes none) but are the commit-principal
+ *  profile's standard ceiling; a tighter goal-only ceiling is a follow-up if the panel prefers it. */
+export function goalWriterGrants(space, endpoint, connId) {
+    const base = commitPrincipalGrants(space, endpoint, connId);
+    const e = endpointToken(endpoint);
+    const bindLeaf = `${spacePrefix(space)}.epf.${e}.goal.*.*.*.*.bind`;
+    // must-5 Q-B — the reconcile index: the goal-writer records each accepted goal under
+    // `goalidx.<e>.<caller triple>.<goalId>` (create-only) before the bind and deletes it at the
+    // terminal, so a successor incarnation can settle orphaned goals. Key-pinned to THIS endpoint's
+    // index subtree; the goal-writer holds NO records CONSUMER.CREATE (the boot sweep enumerates the
+    // index over the PROVISIONER, never this standing connection).
+    const indexRow = `$KV.${recordsBucket(space)}.goalidx.${e}.>`;
+    // must-5 (a) — the own-gate currency belt: the manager reads its OWN issuance gate
+    // (`epgate.<e>.<iid>`) over this connection before the first-terminal-fact CAS and skips a
+    // superseded commit. The auth store is `allow_direct=false`, so the read is a body-selected
+    // leader `STREAM.MSG.GET` that cannot be key-pinned to the single gate key — the SAME residual
+    // class the `endpoint-serve-executor` carries (reads any auth-bucket row = gate + ledger
+    // metadata, never bearer bytes), here on a standing rather than one-shot connection. The manager
+    // reads ONLY `epgate.<e>.<iid>`; (a) is the fast-fail belt, (b) barrier-revoke is the durable fence.
+    const gateRead = `${JSAPI}.STREAM.MSG.GET.KV_${epAuthBucket(space)}`;
+    return { publish: [bindLeaf, indexRow, gateRead, ...base.publish], subscribe: base.subscribe };
+}
+/** The manager's SESSION-LEDGER rows (P2 item 6): the standing connection that owns the §13.6
+ *  session ledger and NOTHING else. It holds NO session rail — not the wildcard it used to hold,
+ *  not an exact one. That is the whole point of the split.
+ *
+ *  §13.6 gives the ledger a job the byte rails do not have: it is "a DURABLE named authority that
+ *  survives the serving endpoint", the thing that still knows what to revoke after the endpoint
+ *  serving a session is gone. So it is standing and renewable, while the rails it records are
+ *  per-session, exact-subject, and die with their session ({@link import("./provision.js").Profile}
+ *  `session-serving` / `session-caller`). An earlier revision fused the two into one standing
+ *  credential carrying `eps.<endpoint>.*.<epoch>.{in,out}`, which contradicted §13.9:2526 ("no
+ *  standing EPS grant exists on either side") and let one credential read and write every live
+ *  session's bytes at that epoch. Splitting on the lifetime boundary is what removes the wildcard:
+ *  the standing half no longer has rails to widen.
+ *
+ *  Its store is the DEDICATED {@link sessionsBucket}, NOT the auth bucket. The write is
+ *  `$KV.<sessions>.session.*` (create-only CAS + revision-pinned update; `sessionLedgerKey` is the
+ *  single-token `session.<id>`). The read is a bucket-blind leader `STREAM.MSG.GET` (allow_direct=
+ *  false, so `kv.get` is a body-selected read that cannot be key-pinned) — but the dedicated bucket
+ *  holds ONLY `session.>` rows, so that blind read exposes nothing but session ledger state,
+ *  structurally closing the §13.9 subject-blindness the auth bucket carries (creds + gates). The
+ *  reply inbox is connection-scoped. NO auth-bucket, records-bucket, or messaging-plane grant.
+ *
+ *  NAMED RESIDUAL: `session.*` is one token wide and carries no endpoint component, because a
+ *  `sessionId` is an opaque unguessable token with no endpoint inside it. So this credential can
+ *  read and CAS any session row in its space, including another endpoint's. That was equally true
+ *  of the credential it replaces; it is not a regression, and it is confined to ledger STATE — row
+ *  state and credential ids — never to session bytes, which now require a per-session credential
+ *  this profile cannot mint. */
+export function sessionLedgerGrants(space, connId) {
+    const SESS = sessionsBucket(space);
+    return {
+        publish: [
+            `$KV.${SESS}.session.*`, // ledger create/update — single-token key (`session.<id>`)
+            `${JSAPI}.STREAM.MSG.GET.KV_${SESS}`, // kv.get: leader-served body-selected read, confined to the sessions bucket
+            `${JSAPI}.STREAM.INFO.KV_${SESS}`, // Kvm bind probe (§13.12)
+            `${JSAPI}.INFO`, // JS-API context info (KV client)
+        ],
+        subscribe: [`_INBOX_${assertInboxConnId(connId)}.>`], // connection-scoped reply inbox
+    };
+}
 /** The CONTRACT PUBLISHER principal's rows (§13.9 matrix "Contract-artifact publication" +
  *  the trusted-infra half of "Contract-artifact read"): publish `epc.*` (the digest-hex is ONE
  *  subject token; create-only rides `Nats-Expected-Last-Subject-Sequence: 0` at the typed path,
@@ -737,10 +938,16 @@ export function commitPrincipalGrants(space, endpoint, connId) {
  *  connection-scoped (`_INBOX_<connId>.>`, never the account-wide default).
  *
  *  D32 residuals, EXPLICIT: (1) the `epc.*` publish is payload-blind — a compromised publisher
- *  can flood NEW digest subjects with garbage artifacts (verify-on-read refuses to SERVE
- *  non-canonical or digest-mismatched bytes, and an existing digest subject is CAS-protected,
- *  so it can waste storage but never corrupt or replace a published artifact); (2) the raw JS
- *  API request carries a caller-selected reply subject (the same confused-deputy injection
+ *  can publish garbage artifacts at NEW (previously-unused) digest subjects (verify-on-read refuses
+ *  to SERVE non-canonical or digest-mismatched bytes, so this is a bounded storage flood carrying
+ *  no authority). It can NOT overwrite, shadow, or replace an EXISTING published artifact: the EPC
+ *  store's shape ({@link ensureContractStore}: `max_msgs_per_subject:1` + discard-new-per-subject)
+ *  makes a second publish to an occupied digest subject broker-REJECTED regardless of the
+ *  create-only header, so per-subject immutability is broker-enforced, not publisher-cooperative.
+ *  (Earlier revisions relied on the cooperative create-only header alone and a fail-closed read,
+ *  which the panel's live repro showed a non-cooperative publisher could defeat by raw append — a
+ *  permanent shadow-DoS; the stream shape + the create-only-winner read fallback close it.) (2) the
+ *  raw JS API request carries a caller-selected reply subject (the same confused-deputy injection
  *  class as every API-holding profile). */
 export function contractPublisherGrants(space, connId) {
     const publish = [

package/dist/endpoint-binding.js.map

@@ -1 +1 @@
-{"version":3,"file":"endpoint-binding.js","sourceRoot":"","sources":["../src/endpoint-binding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EACL,SAAS,EACT,aAAa,EACb,eAAe,EACf,WAAW,GAIZ,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAEhD,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EACL,aAAa,EACb,aAAa,EACb,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,YAAY,GAEb,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACtF,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAEtD,4FAA4F;AAC5F,kFAAkF;AAClF,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC;AAErE,+EAA+E;AAC/E,MAAM,UAAU,aAAa,CAAC,KAAa,IAAY,OAAO,OAAO,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AACtF,MAAM,UAAU,gBAAgB,CAAC,KAAa,IAAY,OAAO,WAAW,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AAC7F,MAAM,UAAU,aAAa,CAAC,KAAa,IAAY,OAAO,OAAO,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AACtF,MAAM,UAAU,aAAa,CAAC,KAAa,IAAY,OAAO,OAAO,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AACtF,MAAM,UAAU,aAAa,CAAC,KAAa,IAAY,OAAO,OAAO,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AACtF,MAAM,UAAU,aAAa,CAAC,KAAa,IAAY,OAAO,OAAO,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AAEtF;;;;;;;qFAOqF;AACrF,MAAM,UAAU,yBAAyB,CAAC,KAAa;IACrD,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;AACxG,CAAC;AAED;;;oFAGoF;AACpF,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,cAAc,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;AACtC,CAAC;AAED,uFAAuF;AAEvF;;;iGAGiG;AACjG,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAE3C;;4CAE4C;AAC5C,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE5D,qFAAqF;AACrF,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEvD;8DAC8D;AAC9D,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzD;;2DAE2D;AAC3D,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE5D;;;kDAGkD;AAClD,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAgBpD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAqB,EACrB,GAAQ,EACR,KAAa,EACb,OAA8B,EAAE;IAEhC,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAC7B,6FAA6F;IAC7F,+FAA+F;IAC/F,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC;QACpB,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC;QAC1B,QAAQ,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC;QACxB,SAAS,EAAE,eAAe,CAAC,MAAM;QACjC,OAAO,EAAE,WAAW,CAAC,IAAI;QACzB,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,kBAAkB,IAAI,wBAAwB,CAAC;QACnE,gBAAgB,EAAE,KAAK,CAAC,uBAAuB,CAAC;KACjD,CAAC,CAAC;IACH,sFAAsF;IACtF,uFAAuF;IACvF,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC;QACpB,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC;QAC1B,QAAQ,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC;QACxB,SAAS,EAAE,eAAe,CAAC,MAAM;QACjC,OAAO,EAAE,WAAW,CAAC,IAAI;QACzB,YAAY,EAAE,IAAI;QAClB,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAC,CAAC;IACH,yBAAyB;IACzB,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC;QACpB,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC;QAC1B,QAAQ,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC;QACxB,SAAS,EAAE,eAAe,CAAC,MAAM;QACjC,OAAO,EAAE,WAAW,CAAC,IAAI;QACzB,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,aAAa,IAAI,mBAAmB,CAAC;KAC1D,CAAC,CAAC;IACH,wFAAwF;IACxF,4FAA4F;IAC5F,wFAAwF;IACxF,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC;QACpB,IAAI,EAAE,gBAAgB,CAAC,KAAK,CAAC;QAC7B,QAAQ,EAAE,CAAC,GAAG,CAAC,uBAAuB,CAAC;QACvC,SAAS,EAAE,eAAe,CAAC,MAAM;QACjC,OAAO,EAAE,WAAW,CAAC,IAAI;QACzB,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,qBAAqB,CAAC;KAC9D,CAAC,CAAC;IACH,4EAA4E;IAC5E,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC;QACpB,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC;QAC1B,QAAQ,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC;QACxB,SAAS,EAAE,eAAe,CAAC,MAAM;QACjC,OAAO,EAAE,WAAW,CAAC,IAAI;QACzB,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,qBAAqB,CAAC;KAC9D,CAAC,CAAC;IACH,2FAA2F;IAC3F,2FAA2F;IAC3F,yFAAyF;IACzF,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC;QACpB,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC;QAC1B,QAAQ,EAAE,CAAC,GAAG,CAAC,oBAAoB,EAAE,GAAG,CAAC,mBAAmB,CAAC;QAC7D,SAAS,EAAE,eAAe,CAAC,MAAM;QACjC,OAAO,EAAE,WAAW,CAAC,IAAI;QACzB,mBAAmB,EAAE,IAAI;QACzB,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,aAAa,IAAI,mBAAmB,CAAC;KAC1D,CAAC,CAAC;IACH,0FAA0F;IAC1F,uFAAuF;IACvF,4FAA4F;IAC5F,8FAA8F;IAC9F,uFAAuF;IACvF,+DAA+D;IAC/D,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC;QACpB,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC;QAC1B,QAAQ,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC;QACxB,SAAS,EAAE,eAAe,CAAC,SAAS;QACpC,OAAO,EAAE,WAAW,CAAC,IAAI;QACzB,YAAY,EAAE,KAAK;KACpB,CAAC,CAAC;IACH,wFAAwF;IACxF,6FAA6F;IAC7F,4FAA4F;IAC5F,8FAA8F;IAC9F,2FAA2F;IAC3F,6FAA6F;IAC7F,4FAA4F;IAC5F,4EAA4E;IAC5E,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC;QACpB,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC;QAC1B,QAAQ,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC;QACxB,SAAS,EAAE,eAAe,CAAC,MAAM;QACjC,OAAO,EAAE,WAAW,CAAC,IAAI;QACzB,YAAY,EAAE,IAAI;QAClB,WAAW,EAAE,IAAI;QACjB,UAAU,EAAE,IAAI;KACjB,CAAC,CAAC;IACH,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,GAAqB,EAAE,GAAQ,EAAE,KAAa;IACxF,8FAA8F;IAC9F,iGAAiG;IACjG,2FAA2F;IAC3F,+FAA+F;IAC/F,gGAAgG;IAChG,4CAA4C;IAC5C,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,YAAY,GAAG,MAAM,YAAY,EAAE,CAAC;IAC1C,IAAI,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;QAC9E,MAAM,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,YAAY,GAAG,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;QACnE,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,GAAG,YAAY,EAAE,iBAAiB,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7H,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;IAChE,IAAI,SAAS,CAAC,YAAY,KAAK,IAAI,IAAI,SAAS,CAAC,iBAAiB,KAAK,KAAK,IAAI,SAAS,CAAC,WAAW,KAAK,IAAI,IAAI,SAAS,CAAC,UAAU,KAAK,IAAI;QAC7I,MAAM,IAAI,KAAK,CAAC,qBAAqB,YAAY,sCAAsC,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,uBAAuB,MAAM,CAAC,SAAS,CAAC,iBAAiB,CAAC,iBAAiB,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,gBAAgB,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,+EAA+E,CAAC,CAAC;IAC5V,2BAA2B,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAErD,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,MAAM,UAAU,EAAE,CAAC;IACtC,IAAI,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,SAAS;QACzE,MAAM,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAC1F,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAoD,CAAC;IAC1G,IAAI,OAAO,CAAC,YAAY,KAAK,KAAK,IAAI,OAAO,CAAC,aAAa,KAAK,IAAI;QAClE,MAAM,IAAI,KAAK,CAAC,kBAAkB,UAAU,sCAAsC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,mBAAmB,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,+EAA+E,CAAC,CAAC;IACjP,2BAA2B,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AACnD,CAAC;AAED;;;+EAG+E;AAC/E,SAAS,2BAA2B,CAAC,GAAiB,EAAE,MAAc;IACpE,MAAM,QAAQ,GAAG,OAAO,MAAM,IAAI,CAAC;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ;QAC3F,MAAM,IAAI,KAAK,CAAC,aAAa,MAAM,uCAAuC,QAAQ,SAAS,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,6FAA6F,CAAC,CAAC;IACxN,IAAI,GAAG,CAAC,OAAO,KAAK,MAAM;QACxB,MAAM,IAAI,KAAK,CAAC,aAAa,MAAM,gBAAgB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,mHAAmH,CAAC,CAAC;AACvM,CAAC;AAED,+FAA+F;AAE/F;4CAC4C;AAC5C,MAAM,UAAU,WAAW,CAAC,QAAgB,EAAE,IAAY;IACxD,OAAO,QAAQ,aAAa,CAAC,QAAQ,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,OAAO,UAAU,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;AAClC,CAAC;AAED;;;;;gEAKgE;AAChE,MAAM,UAAU,mBAAmB,CAAC,KAAa,EAAE,IAAY;IAC7D,OAAO,QAAQ,KAAK,CAAC,KAAK,CAAC,IAAI,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,OAAO,OAAO,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED;0EAC0E;AAC1E,MAAM,UAAU,qBAAqB,CAAC,GAAW,EAAE,QAAgB;IACjE,OAAO,OAAO,oBAAoB,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,iBAAiB,CAAC,GAAW,EAAE,QAAgB;IAC7D,OAAO,QAAQ,oBAAoB,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;AACxE,CAAC;AAED;;;;;;uFAMuF;AACvF,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,QAAgB,EAAE,OAAe,EAAE,CAAS;IAC1F,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,EAAE,CAAC,CAAC;IAC1H,OAAO,OAAO,oBAAoB,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;AACtG,CAAC;AAED;wGACwG;AACxG,MAAM,UAAU,mBAAmB,CAAC,GAAW,EAAE,OAAe,EAAE,CAAS;IACzE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,EAAE,CAAC,CAAC;IAC3H,OAAO,OAAO,oBAAoB,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3E,CAAC;AAgBD,MAAM,MAAM,GAAG,IAAI,OAAO,EAAuC,CAAC;AAClE,SAAS,MAAM,CAAC,MAAc,EAAE,GAA4B;IAC1D,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,YAAa,EAAE,MAAM,EAAE,GAAG,CAAC,cAAe,EAAE,CAAC,CAAC;IACrF,OAAO,GAAG,CAAC;AACb,CAAC;AACD,SAAS,gBAAgB,CAAC,MAAc,EAAE,GAA4B,EAAE,IAAY;IAClF,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,IAAI,KAAK,SAAS;QACpB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,2FAA2F,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;IAC/J,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;QACxB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,aAAa,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,mCAAmC,CAAC,CAAC;IACjM,IAAI,GAAG,CAAC,YAAY,KAAK,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,cAAc,KAAK,IAAI,CAAC,MAAM;QACzE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,2FAA2F,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,4CAA4C,CAAC,CAAC;IAC9T,wFAAwF;IACxF,+FAA+F;IAC/F,IAAI,GAAG,CAAC,eAAe,KAAK,SAAS;QACnC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,oHAAoH,CAAC,CAAC;AACjJ,CAAC;AAED;6FAC6F;AAC7F,MAAM,UAAU,mBAAmB,CACjC,KAAa,EACb,QAAgB,EAChB,OAAuD,EAAE;IAEzD,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE;QAClC,YAAY,EAAE,YAAY,CAAC,QAAQ,CAAC;QACpC,cAAc,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,aAAa,CAAC,QAAQ,CAAC,IAAI;QACxE,UAAU,EAAE,SAAS,CAAC,QAAQ;QAC9B,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;QACzC,cAAc,EAAE,aAAa,CAAC,GAAG;QACjC,eAAe,EAAE,IAAI,CAAC,aAAa,IAAI,IAAI;KAC5C,CAAC,CAAC;AACL,CAAC;AAED;;yEAEyE;AACzE,MAAM,UAAU,qBAAqB,CACnC,KAAa,EACb,QAAgB,EAChB,OAAuD,EAAE;IAEzD,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE;QAClC,YAAY,EAAE,cAAc,CAAC,QAAQ,CAAC;QACtC,cAAc,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,aAAa,CAAC,QAAQ,CAAC,QAAQ;QAC5E,UAAU,EAAE,SAAS,CAAC,QAAQ;QAC9B,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;QACzC,cAAc,EAAE,aAAa,CAAC,GAAG;QACjC,eAAe,EAAE,IAAI,CAAC,aAAa,IAAI,IAAI;KAC5C,CAAC,CAAC;AACL,CAAC;AAED;;;;;iGAKiG;AACjG,MAAM,UAAU,0BAA0B,CACxC,KAAa,EACb,GAAkB,EAClB,OAA+B,EAAE;IAEjC,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IACnE,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE;QAClC,YAAY,EAAE,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC;QAClD,cAAc,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,aAAa,IAAI,EAAE;QACxD,UAAU,EAAE,SAAS,CAAC,QAAQ;QAC9B,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;QACzC,cAAc,EAAE,aAAa,CAAC,GAAG;KAClC,CAAC,CAAC;AACL,CAAC;AAED;;qFAEqF;AACrF,MAAM,UAAU,yBAAyB,CACvC,KAAa,EACb,OAA+B,EAAE;IAEjC,OAAO,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE;QACrC,YAAY,EAAE,kBAAkB,CAAC,KAAK,CAAC;QACvC,cAAc,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,uBAAuB;QAC5D,UAAU,EAAE,SAAS,CAAC,QAAQ;QAC9B,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;QACzC,cAAc,EAAE,aAAa,CAAC,GAAG;KAClC,CAAC,CAAC;AACL,CAAC;AAED;;;;qCAIqC;AACrC,MAAM,UAAU,kBAAkB,CAChC,KAAa,EACb,QAAgB,EAChB,IAAY,EACZ,OAA+B,EAAE;IAEjC,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE;QAClC,YAAY,EAAE,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC;QACzC,cAAc,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,aAAa,CAAC,QAAQ,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI;QACjG,UAAU,EAAE,SAAS,CAAC,QAAQ;QAC9B,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;QACzC,4FAA4F;QAC5F,6FAA6F;QAC7F,2FAA2F;QAC3F,2FAA2F;QAC3F,0FAA0F;QAC1F,mCAAmC;QACnC,WAAW,EAAE,CAAC,CAAC;KAChB,CAAC,CAAC;AACL,CAAC;AAED;;qEAEqE;AACrE,MAAM,UAAU,oBAAoB,CAClC,KAAa,EACb,QAAgB,EAChB,MAAgB,EAChB,OAA+B,EAAE;IAEjC,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE;QAClC,YAAY,EAAE,qBAAqB,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC;QACzD,cAAc,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,aAAa,CAAC,QAAQ,CAAC,QAAQ,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI;QAC9G,UAAU,EAAE,SAAS,CAAC,QAAQ;QAC9B,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;QACzC,cAAc,EAAE,aAAa,CAAC,GAAG;KAClC,CAAC,CAAC;AACL,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,gBAAgB,CAC9B,KAAa,EACb,QAAgB,EAChB,MAAgB,EAChB,OAA+B,EAAE;IAEjC,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE;QAClC,YAAY,EAAE,iBAAiB,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC;QACrD,cAAc,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,aAAa,CAAC,QAAQ,CAAC,SAAS,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI;QAC/G,UAAU,EAAE,SAAS,CAAC,QAAQ;QAC9B,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;QACzC,cAAc,EAAE,aAAa,CAAC,GAAG;KAClC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;2DAO2D;AAC3D,SAAS,cAAc,CAAC,MAAc,EAAE,MAAc,EAAE,IAAY;IAClE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,WAAW,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,8BAA8B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC1H,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACpB,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO;QACtB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,sDAAsD;QAC/G,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,WAAW,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,wEAAwE,CAAC,CAAC;IACjK,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;sFAIsF;AACtF,MAAM,UAAU,iBAAiB,CAC/B,KAAa,EACb,IAAwF,EACxF,OAA+B,EAAE;IAEjC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAC/F,2FAA2F;IAC3F,4FAA4F;IAC5F,kDAAkD;IAClD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,kCAAkC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,oDAAoD,CAAC,CAAC;IAC1P,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE;QAClC,YAAY,EAAE,kBAAkB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC;QACnF,cAAc,EAAE,IAAI,CAAC,OAAO;QAC5B,UAAU,EAAE,SAAS,CAAC,QAAQ;QAC9B,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;QACzC,cAAc,EAAE,aAAa,CAAC,GAAG;KAClC,CAAC,CAAC;AACL,CAAC;AAED;;;;;2DAK2D;AAC3D,MAAM,oBAAoB,GAAgC,IAAI,GAAG,CAC/D,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAClE,CAAC;AAEF;;;0EAG0E;AAC1E,MAAM,UAAU,kBAAkB,CAChC,KAAa,EACb,IAAsE,EACtE,OAA+B,EAAE;IAEjC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,uBAAuB,CAAC,CAAC;IAClG,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,wFAAwF;IACxF,yFAAyF;IACzF,IAAI,IAAI,KAAK,GAAG;QACd,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,iFAAiF,CAAC,CAAC;IAC1J,gGAAgG;IAChG,8FAA8F;IAC9F,+FAA+F;IAC/F,iGAAiG;IACjG,+FAA+F;IAC/F,8FAA8F;IAC9F,gGAAgG;IAChG,8FAA8F;IAC9F,sDAAsD;IACtD,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,cAAc,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzH,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,uCAAuC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,8BAA8B,cAAc,0KAA0K,CAAC,CAAC;QAC1V,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,iJAAiJ,CAAC,CAAC;IAC1P,CAAC;IACD,kGAAkG;IAClG,iGAAiG;IACjG,8FAA8F;IAC9F,iGAAiG;IACjG,yFAAyF;IACzF,4FAA4F;IAC5F,4FAA4F;IAC5F,gFAAgF;IAChF,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;QAC/C,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;QAC7D,gGAAgG;QAChG,iGAAiG;QACjG,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAC,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC;QAChF,IAAI,YAAY;YACd,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,qCAAqC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,OAAO,GAAG,CAAC,wFAAwF,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QACzS,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,OAAO;YACpC,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,0BAA0B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,oBAAoB,OAAO,0LAA0L,CAAC,CAAC;IAC9U,CAAC;IACD,OAAO,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE;QACxC,YAAY,EAAE,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC;QACrE,cAAc,EAAE,IAAI,CAAC,OAAO;QAC5B,UAAU,EAAE,SAAS,CAAC,QAAQ;QAC9B,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;QACzC,cAAc,EAAE,aAAa,CAAC,GAAG;KAClC,CAAC,CAAC;AACL,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,mBAAmB,CAAC,KAAa,IAAY,OAAO,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AAEnG,sGAAsG;AACtG,8FAA8F;AAC9F,gGAAgG;AAChG,8FAA8F;AAC9F,+FAA+F;AAC/F,+EAA+E;AAE/E,MAAM,KAAK,GAAG,SAAS,CAAC;AAExB;;;8FAG8F;AAC9F,SAAS,eAAe,CAAC,CAAS,EAAE,IAAY;IAC9C,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,kEAAkE,CAAC,CAAC;IAClH,OAAO,CAAC,CAAC;AACX,CAAC;AACD;;;wEAGwE;AACxE,SAAS,iBAAiB,CAAC,MAAc,EAAE,IAAY;IACrD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACpB,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO;QACtB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,yBAAyB;QAClF,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,WAAW,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,gEAAgE,CAAC,CAAC;IACzJ,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc,EAAE,GAA4B;IACpE,4FAA4F;IAC5F,4FAA4F;IAC5F,6DAA6D;IAC7D,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;IACxD,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,GAAG,CAAC,cAAc;QAC1C,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,8FAA8F;IAC9F,wCAAwC;IACxC,OAAO,GAAG,KAAK,oBAAoB,eAAe,CAAC,MAAM,EAAE,cAAc,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC,IAAI,iBAAiB,CAAC,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC,EAAE,CAAC;AAChM,CAAC;AACD,SAAS,eAAe,CAAC,MAAc,EAAE,OAAe;IACtD,eAAe,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACxC,eAAe,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC1C,OAAO;QACL,GAAG,KAAK,kBAAkB,MAAM,IAAI,OAAO,EAAE;QAC7C,GAAG,KAAK,sBAAsB,MAAM,IAAI,OAAO,EAAE;QACjD,WAAW,MAAM,IAAI,OAAO,IAAI;KACjC,CAAC;AACJ,CAAC;AACD,SAAS,gBAAgB,CAAC,MAAc,EAAE,OAAe;IACvD,OAAO,GAAG,KAAK,oBAAoB,eAAe,CAAC,MAAM,EAAE,cAAc,CAAC,IAAI,eAAe,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,CAAC;AAC5H,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,mBAAmB,CAAC,KAAa,EAAE,QAAgB;IACjE,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,mBAAmB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACjD,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,eAAe,CAAC,MAAM,EAAE,GAAG,CAAC,YAAa,CAAC,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;;;;wEASwE;AACxE,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,QAAgB;IACrE,OAAO;QACL,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,aAAa,CAAC,QAAQ,CAAC,IAAI;QACxD,GAAG,KAAK,mBAAmB,aAAa,CAAC,KAAK,CAAC,EAAE;KAClD,CAAC;AACJ,CAAC;AAED;iGACiG;AACjG,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,QAAgB;IAC/D,OAAO,eAAe,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,GAAkB;IAClE,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,0BAA0B,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACnD,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,eAAe,CAAC,MAAM,EAAE,GAAG,CAAC,YAAa,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,eAAe,CAAC,MAAM,EAAE,GAAG,CAAC,YAAa,CAAC,CAAC,CAAC;AACxF,CAAC;AAED;uGACuG;AACvG,MAAM,UAAU,mBAAmB,CAAC,KAAa,EAAE,QAAgB,EAAE,IAAY;IAC/E,OAAO,eAAe,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED;4FAC4F;AAC5F,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,GAA4B;IAC3E,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC;IACrD,IAAI,CAAC,GAAG,CAAC,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACnF,OAAO,eAAe,CAAC,MAAM,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;AACnD,CAAC;AAKD;;;mGAGmG;AACnG,MAAM,UAAU,yBAAyB,CAAC,QAA6B;IACrE,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,YAAa,CAAC,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uEA+BuE;AACvE,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,QAAgB,EAAE,MAAc;IACrF,MAAM,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,OAAO,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC;IACjE,MAAM,OAAO,GAAG;QACd,WAAW;QACX,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ;QACtC,GAAG,KAAK,mBAAmB,MAAM,EAAE;QACnC,GAAG,KAAK,mBAAmB,aAAa,CAAC,KAAK,CAAC,EAAE;QACjD,GAAG,KAAK,mBAAmB,aAAa,CAAC,KAAK,CAAC,EAAE;QACjD,GAAG,KAAK,gBAAgB,MAAM,EAAE;QAChC,GAAG,KAAK,OAAO;KAChB,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,UAAU,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;;;;;;;;;;6FAc6F;AAC7F,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,QAAgB,EAAE,KAAe,EAAE,MAAc;IACtG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,uIAAuI,CAAC,CAAC;IAC3J,aAAa,CAAC,QAAQ,CAAC,CAAC;IACxB,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,mBAAmB,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC;IACjF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,UAAU,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;4FAuB4F;AAC5F,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,QAAgB,EAAE,MAAc;IACnF,MAAM,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG;QACd,GAAG,CAAC,QAAQ,CAAC,sBAAsB;QACnC,GAAG,CAAC,QAAQ,CAAC,QAAQ;QACrB,GAAG,CAAC,QAAQ,CAAC,YAAY;QACzB,GAAG,CAAC,QAAQ,CAAC,QAAQ;QACrB,GAAG,CAAC,QAAQ,CAAC,OAAO;QACpB,OAAO,OAAO,SAAS,CAAC,IAAI;QAC5B,OAAO,OAAO,OAAO,CAAC,IAAI;QAC1B,OAAO,OAAO,UAAU,CAAC,IAAI;QAC7B,GAAG,KAAK,mBAAmB,aAAa,CAAC,KAAK,CAAC,EAAE;QACjD,GAAG,KAAK,mBAAmB,mBAAmB,CAAC,KAAK,CAAC,EAAE;QACvD,GAAG,KAAK,OAAO;KAChB,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,UAAU,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;;;;;;;;;;;2CAe2C;AAC3C,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,MAAc;IACnE,MAAM,OAAO,GAAG;QACd,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ;QAC7B,GAAG,KAAK,eAAe,aAAa,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,QAAQ;QACzE,GAAG,KAAK,OAAO;KAChB,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,UAAU,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3E,CAAC"}
+{"version":3,"file":"endpoint-binding.js","sourceRoot":"","sources":["../src/endpoint-binding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EACL,SAAS,EACT,aAAa,EACb,aAAa,EACb,eAAe,EACf,WAAW,GAIZ,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAEhD,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EACL,aAAa,EACb,aAAa,EACb,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,YAAY,GAEb,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACtF,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAEtD,4FAA4F;AAC5F,kFAAkF;AAClF,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC;AAErE,+EAA+E;AAC/E,MAAM,UAAU,aAAa,CAAC,KAAa,IAAY,OAAO,OAAO,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AACtF,MAAM,UAAU,gBAAgB,CAAC,KAAa,IAAY,OAAO,WAAW,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AAC7F,MAAM,UAAU,aAAa,CAAC,KAAa,IAAY,OAAO,OAAO,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AACtF,MAAM,UAAU,aAAa,CAAC,KAAa,IAAY,OAAO,OAAO,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AACtF,MAAM,UAAU,aAAa,CAAC,KAAa,IAAY,OAAO,OAAO,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AACtF,MAAM,UAAU,aAAa,CAAC,KAAa,IAAY,OAAO,OAAO,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AAEtF;;;;;;;qFAOqF;AACrF,MAAM,UAAU,yBAAyB,CAAC,KAAa;IACrD,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;AACxG,CAAC;AAED;;;oFAGoF;AACpF,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,cAAc,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;AACtC,CAAC;AAED;;;;;;;uGAOuG;AACvG,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,kBAAkB,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED,uFAAuF;AAEvF;;;iGAGiG;AACjG,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAE3C;;4CAE4C;AAC5C,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE5D,qFAAqF;AACrF,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEvD;8DAC8D;AAC9D,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzD;;2DAE2D;AAC3D,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE5D;;;kDAGkD;AAClD,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAgBpD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAqB,EACrB,GAAQ,EACR,KAAa,EACb,OAA8B,EAAE;IAEhC,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAC7B,6FAA6F;IAC7F,+FAA+F;IAC/F,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC;QACpB,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC;QAC1B,QAAQ,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC;QACxB,SAAS,EAAE,eAAe,CAAC,MAAM;QACjC,OAAO,EAAE,WAAW,CAAC,IAAI;QACzB,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,kBAAkB,IAAI,wBAAwB,CAAC;QACnE,gBAAgB,EAAE,KAAK,CAAC,uBAAuB,CAAC;KACjD,CAAC,CAAC;IACH,sFAAsF;IACtF,uFAAuF;IACvF,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC;QACpB,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC;QAC1B,QAAQ,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC;QACxB,SAAS,EAAE,eAAe,CAAC,MAAM;QACjC,OAAO,EAAE,WAAW,CAAC,IAAI;QACzB,YAAY,EAAE,IAAI;QAClB,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAC,CAAC;IACH,yBAAyB;IACzB,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC;QACpB,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC;QAC1B,QAAQ,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC;QACxB,SAAS,EAAE,eAAe,CAAC,MAAM;QACjC,OAAO,EAAE,WAAW,CAAC,IAAI;QACzB,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,aAAa,IAAI,mBAAmB,CAAC;KAC1D,CAAC,CAAC;IACH,wFAAwF;IACxF,4FAA4F;IAC5F,wFAAwF;IACxF,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC;QACpB,IAAI,EAAE,gBAAgB,CAAC,KAAK,CAAC;QAC7B,QAAQ,EAAE,CAAC,GAAG,CAAC,uBAAuB,CAAC;QACvC,SAAS,EAAE,eAAe,CAAC,MAAM;QACjC,OAAO,EAAE,WAAW,CAAC,IAAI;QACzB,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,qBAAqB,CAAC;KAC9D,CAAC,CAAC;IACH,4EAA4E;IAC5E,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC;QACpB,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC;QAC1B,QAAQ,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC;QACxB,SAAS,EAAE,eAAe,CAAC,MAAM;QACjC,OAAO,EAAE,WAAW,CAAC,IAAI;QACzB,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,qBAAqB,CAAC;KAC9D,CAAC,CAAC;IACH,2FAA2F;IAC3F,2FAA2F;IAC3F,yFAAyF;IACzF,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC;QACpB,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC;QAC1B,QAAQ,EAAE,CAAC,GAAG,CAAC,oBAAoB,EAAE,GAAG,CAAC,mBAAmB,CAAC;QAC7D,SAAS,EAAE,eAAe,CAAC,MAAM;QACjC,OAAO,EAAE,WAAW,CAAC,IAAI;QACzB,mBAAmB,EAAE,IAAI;QACzB,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,aAAa,IAAI,mBAAmB,CAAC;KAC1D,CAAC,CAAC;IACH,0FAA0F;IAC1F,uFAAuF;IACvF,4FAA4F;IAC5F,8FAA8F;IAC9F,uFAAuF;IACvF,+DAA+D;IAC/D,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC;QACpB,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC;QAC1B,QAAQ,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC;QACxB,SAAS,EAAE,eAAe,CAAC,SAAS;QACpC,OAAO,EAAE,WAAW,CAAC,IAAI;QACzB,YAAY,EAAE,KAAK;KACpB,CAAC,CAAC;IACH,MAAM,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtC,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7C,iGAAiG;IACjG,+FAA+F;IAC/F,qGAAqG;IACrG,iGAAiG;IACjG,8FAA8F;IAC9F,MAAM,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,GAAqB,EAAE,KAAa;IAC5E,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC;IAC9C,MAAM,SAAS,GAAG,EAAE,oBAAoB,EAAE,CAAC,EAAE,OAAO,EAAE,aAAa,CAAC,GAAG,EAAE,uBAAuB,EAAE,IAAI,EAAW,CAAC;IAClH,IAAI,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;QACtE,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC;YACpB,IAAI;YACJ,QAAQ,EAAE,CAAC,OAAO,CAAC;YACnB,SAAS,EAAE,eAAe,CAAC,MAAM;YACjC,OAAO,EAAE,WAAW,CAAC,IAAI;YACzB,YAAY,EAAE,IAAI;YAClB,WAAW,EAAE,IAAI;YACjB,UAAU,EAAE,IAAI;YAChB,GAAG,SAAS;SACb,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,6FAA6F;QAC7F,iGAAiG;QACjG,gGAAgG;QAChG,gBAAgB;QAChB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;QACxB,IAAI,GAAG,CAAC,oBAAoB,KAAK,CAAC,IAAI,GAAG,CAAC,OAAO,KAAK,aAAa,CAAC,GAAG,IAAI,GAAG,CAAC,uBAAuB,KAAK,IAAI,EAAE,CAAC;YAChH,6FAA6F;YAC7F,6FAA6F;YAC7F,8FAA8F;YAC9F,+FAA+F;YAC/F,sFAAsF;YACtF,8FAA8F;YAC9F,4FAA4F;YAC5F,gGAAgG;YAChG,4FAA4F;YAC5F,kBAAkB;YAClB,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;YAC9C,IAAI,QAAQ,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,QAAQ,GAAG,YAAY,CAAC;gBACzE,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,2DAA2D,QAAQ,oBAAoB,MAAM,CAAC,YAAY,CAAC,qSAAqS,CAAC,CAAC;YAC9b,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAA8D,CAAC;IAC1G,IAAI,GAAG,CAAC,YAAY,KAAK,IAAI,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI;QAClF,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,sCAAsC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,iBAAiB,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,gBAAgB,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,+EAA+E,CAAC,CAAC;IACzQ,IAAI,GAAG,CAAC,oBAAoB,KAAK,CAAC,IAAI,GAAG,CAAC,OAAO,KAAK,aAAa,CAAC,GAAG,IAAI,GAAG,CAAC,uBAAuB,KAAK,IAAI;QAC7G,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,oEAAoE,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,aAAa,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,6BAA6B,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,6IAA6I,CAAC,CAAC;IAC/X,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,OAAO;QAC1F,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,uCAAuC,OAAO,SAAS,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,iGAAiG,CAAC,CAAC;IAClO,IAAI,GAAG,CAAC,OAAO,KAAK,MAAM;QACxB,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,gBAAgB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,+GAA+G,CAAC,CAAC;AAC1M,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,GAAqB,EAAE,GAAQ,EAAE,KAAa;IACxF,8FAA8F;IAC9F,iGAAiG;IACjG,2FAA2F;IAC3F,+FAA+F;IAC/F,gGAAgG;IAChG,4CAA4C;IAC5C,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,YAAY,GAAG,MAAM,YAAY,EAAE,CAAC;IAC1C,IAAI,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;QAC9E,MAAM,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,YAAY,GAAG,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;QACnE,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,GAAG,YAAY,EAAE,iBAAiB,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7H,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;IAChE,IAAI,SAAS,CAAC,YAAY,KAAK,IAAI,IAAI,SAAS,CAAC,iBAAiB,KAAK,KAAK,IAAI,SAAS,CAAC,WAAW,KAAK,IAAI,IAAI,SAAS,CAAC,UAAU,KAAK,IAAI;QAC7I,MAAM,IAAI,KAAK,CAAC,qBAAqB,YAAY,sCAAsC,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,uBAAuB,MAAM,CAAC,SAAS,CAAC,iBAAiB,CAAC,iBAAiB,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,gBAAgB,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,+EAA+E,CAAC,CAAC;IAC5V,2BAA2B,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAErD,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,MAAM,UAAU,EAAE,CAAC;IACtC,IAAI,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,SAAS;QACzE,MAAM,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAC1F,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAoD,CAAC;IAC1G,IAAI,OAAO,CAAC,YAAY,KAAK,KAAK,IAAI,OAAO,CAAC,aAAa,KAAK,IAAI;QAClE,MAAM,IAAI,KAAK,CAAC,kBAAkB,UAAU,sCAAsC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,mBAAmB,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,+EAA+E,CAAC,CAAC;IACjP,2BAA2B,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;;;yFAUyF;AACzF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,GAAqB,EAAE,GAAQ,EAAE,KAAa;IACtF,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,MAAM,EAAE,CAAC;IAC9B,IAAI,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,SAAS;QACrE,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,qBAAqB,EAAE,CAAC,CAAC;IACtF,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAoD,CAAC;IAClG,IAAI,GAAG,CAAC,YAAY,KAAK,KAAK,IAAI,GAAG,CAAC,aAAa,KAAK,IAAI;QAC1D,MAAM,IAAI,KAAK,CAAC,sBAAsB,MAAM,sCAAsC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,mBAAmB,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,+EAA+E,CAAC,CAAC;IACzO,2BAA2B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AAC3C,CAAC;AAED;;;+EAG+E;AAC/E,SAAS,2BAA2B,CAAC,GAAiB,EAAE,MAAc;IACpE,MAAM,QAAQ,GAAG,OAAO,MAAM,IAAI,CAAC;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ;QAC3F,MAAM,IAAI,KAAK,CAAC,aAAa,MAAM,uCAAuC,QAAQ,SAAS,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,6FAA6F,CAAC,CAAC;IACxN,IAAI,GAAG,CAAC,OAAO,KAAK,MAAM;QACxB,MAAM,IAAI,KAAK,CAAC,aAAa,MAAM,gBAAgB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,mHAAmH,CAAC,CAAC;AACvM,CAAC;AAED,+FAA+F;AAE/F;4CAC4C;AAC5C,MAAM,UAAU,WAAW,CAAC,QAAgB,EAAE,IAAY;IACxD,OAAO,QAAQ,aAAa,CAAC,QAAQ,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,OAAO,UAAU,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;AAClC,CAAC;AAED;;;;;gEAKgE;AAChE,MAAM,UAAU,mBAAmB,CAAC,KAAa,EAAE,IAAY;IAC7D,OAAO,QAAQ,KAAK,CAAC,KAAK,CAAC,IAAI,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,OAAO,OAAO,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED;0EAC0E;AAC1E,MAAM,UAAU,qBAAqB,CAAC,GAAW,EAAE,QAAgB;IACjE,OAAO,OAAO,oBAAoB,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,iBAAiB,CAAC,GAAW,EAAE,QAAgB;IAC7D,OAAO,QAAQ,oBAAoB,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;AACxE,CAAC;AAED;;;;;;uFAMuF;AACvF,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,QAAgB,EAAE,OAAe,EAAE,CAAS;IAC1F,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,EAAE,CAAC,CAAC;IAC1H,OAAO,OAAO,oBAAoB,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;AACtG,CAAC;AAED;wGACwG;AACxG,MAAM,UAAU,mBAAmB,CAAC,GAAW,EAAE,OAAe,EAAE,CAAS;IACzE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,EAAE,CAAC,CAAC;IAC3H,OAAO,OAAO,oBAAoB,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3E,CAAC;AAgBD,MAAM,MAAM,GAAG,IAAI,OAAO,EAAuC,CAAC;AAClE,SAAS,MAAM,CAAC,MAAc,EAAE,GAA4B;IAC1D,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,YAAa,EAAE,MAAM,EAAE,GAAG,CAAC,cAAe,EAAE,CAAC,CAAC;IACrF,OAAO,GAAG,CAAC;AACb,CAAC;AACD,SAAS,gBAAgB,CAAC,MAAc,EAAE,GAA4B,EAAE,IAAY;IAClF,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,IAAI,KAAK,SAAS;QACpB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,2FAA2F,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;IAC/J,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;QACxB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,aAAa,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,mCAAmC,CAAC,CAAC;IACjM,IAAI,GAAG,CAAC,YAAY,KAAK,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,cAAc,KAAK,IAAI,CAAC,MAAM;QACzE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,2FAA2F,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,4CAA4C,CAAC,CAAC;IAC9T,wFAAwF;IACxF,+FAA+F;IAC/F,IAAI,GAAG,CAAC,eAAe,KAAK,SAAS;QACnC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,oHAAoH,CAAC,CAAC;AACjJ,CAAC;AAED;6FAC6F;AAC7F,MAAM,UAAU,mBAAmB,CACjC,KAAa,EACb,QAAgB,EAChB,OAAuD,EAAE;IAEzD,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE;QAClC,YAAY,EAAE,YAAY,CAAC,QAAQ,CAAC;QACpC,cAAc,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,aAAa,CAAC,QAAQ,CAAC,IAAI;QACxE,UAAU,EAAE,SAAS,CAAC,QAAQ;QAC9B,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;QACzC,cAAc,EAAE,aAAa,CAAC,GAAG;QACjC,eAAe,EAAE,IAAI,CAAC,aAAa,IAAI,IAAI;KAC5C,CAAC,CAAC;AACL,CAAC;AAED;;yEAEyE;AACzE,MAAM,UAAU,qBAAqB,CACnC,KAAa,EACb,QAAgB,EAChB,OAAuD,EAAE;IAEzD,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE;QAClC,YAAY,EAAE,cAAc,CAAC,QAAQ,CAAC;QACtC,cAAc,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,aAAa,CAAC,QAAQ,CAAC,QAAQ;QAC5E,UAAU,EAAE,SAAS,CAAC,QAAQ;QAC9B,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;QACzC,cAAc,EAAE,aAAa,CAAC,GAAG;QACjC,eAAe,EAAE,IAAI,CAAC,aAAa,IAAI,IAAI;KAC5C,CAAC,CAAC;AACL,CAAC;AAED;;;;;iGAKiG;AACjG,MAAM,UAAU,0BAA0B,CACxC,KAAa,EACb,GAAkB,EAClB,OAA+B,EAAE;IAEjC,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IACnE,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE;QAClC,YAAY,EAAE,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC;QAClD,cAAc,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,aAAa,IAAI,EAAE;QACxD,UAAU,EAAE,SAAS,CAAC,QAAQ;QAC9B,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;QACzC,cAAc,EAAE,aAAa,CAAC,GAAG;KAClC,CAAC,CAAC;AACL,CAAC;AAED;;qFAEqF;AACrF,MAAM,UAAU,yBAAyB,CACvC,KAAa,EACb,OAA+B,EAAE;IAEjC,OAAO,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE;QACrC,YAAY,EAAE,kBAAkB,CAAC,KAAK,CAAC;QACvC,cAAc,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,uBAAuB;QAC5D,UAAU,EAAE,SAAS,CAAC,QAAQ;QAC9B,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;QACzC,cAAc,EAAE,aAAa,CAAC,GAAG;KAClC,CAAC,CAAC;AACL,CAAC;AAED;;;;qCAIqC;AACrC,MAAM,UAAU,kBAAkB,CAChC,KAAa,EACb,QAAgB,EAChB,IAAY,EACZ,OAA+B,EAAE;IAEjC,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE;QAClC,YAAY,EAAE,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC;QACzC,cAAc,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,aAAa,CAAC,QAAQ,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI;QACjG,UAAU,EAAE,SAAS,CAAC,QAAQ;QAC9B,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;QACzC,4FAA4F;QAC5F,6FAA6F;QAC7F,2FAA2F;QAC3F,2FAA2F;QAC3F,0FAA0F;QAC1F,mCAAmC;QACnC,WAAW,EAAE,CAAC,CAAC;KAChB,CAAC,CAAC;AACL,CAAC;AAED;;qEAEqE;AACrE,MAAM,UAAU,oBAAoB,CAClC,KAAa,EACb,QAAgB,EAChB,MAAgB,EAChB,OAA+B,EAAE;IAEjC,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE;QAClC,YAAY,EAAE,qBAAqB,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC;QACzD,cAAc,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,aAAa,CAAC,QAAQ,CAAC,QAAQ,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI;QAC9G,UAAU,EAAE,SAAS,CAAC,QAAQ;QAC9B,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;QACzC,cAAc,EAAE,aAAa,CAAC,GAAG;KAClC,CAAC,CAAC;AACL,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,gBAAgB,CAC9B,KAAa,EACb,QAAgB,EAChB,MAAgB,EAChB,OAA+B,EAAE;IAEjC,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE;QAClC,YAAY,EAAE,iBAAiB,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC;QACrD,cAAc,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,aAAa,CAAC,QAAQ,CAAC,SAAS,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI;QAC/G,UAAU,EAAE,SAAS,CAAC,QAAQ;QAC9B,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;QACzC,cAAc,EAAE,aAAa,CAAC,GAAG;KAClC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;2DAO2D;AAC3D,SAAS,cAAc,CAAC,MAAc,EAAE,MAAc,EAAE,IAAY;IAClE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,WAAW,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,8BAA8B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC1H,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACpB,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO;QACtB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,sDAAsD;QAC/G,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,WAAW,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,wEAAwE,CAAC,CAAC;IACjK,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;sFAIsF;AACtF,MAAM,UAAU,iBAAiB,CAC/B,KAAa,EACb,IAAwF,EACxF,OAA+B,EAAE;IAEjC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAC/F,2FAA2F;IAC3F,4FAA4F;IAC5F,kDAAkD;IAClD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,kCAAkC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,oDAAoD,CAAC,CAAC;IAC1P,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE;QAClC,YAAY,EAAE,kBAAkB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC;QACnF,cAAc,EAAE,IAAI,CAAC,OAAO;QAC5B,UAAU,EAAE,SAAS,CAAC,QAAQ;QAC9B,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;QACzC,cAAc,EAAE,aAAa,CAAC,GAAG;KAClC,CAAC,CAAC;AACL,CAAC;AAED;;;;;2DAK2D;AAC3D,MAAM,oBAAoB,GAAgC,IAAI,GAAG,CAC/D,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAClE,CAAC;AAEF;;;0EAG0E;AAC1E,MAAM,UAAU,kBAAkB,CAChC,KAAa,EACb,IAAsE,EACtE,OAA+B,EAAE;IAEjC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,uBAAuB,CAAC,CAAC;IAClG,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,wFAAwF;IACxF,yFAAyF;IACzF,IAAI,IAAI,KAAK,GAAG;QACd,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,iFAAiF,CAAC,CAAC;IAC1J,gGAAgG;IAChG,8FAA8F;IAC9F,+FAA+F;IAC/F,iGAAiG;IACjG,+FAA+F;IAC/F,8FAA8F;IAC9F,gGAAgG;IAChG,8FAA8F;IAC9F,sDAAsD;IACtD,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,cAAc,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzH,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,uCAAuC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,8BAA8B,cAAc,0KAA0K,CAAC,CAAC;QAC1V,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,iJAAiJ,CAAC,CAAC;IAC1P,CAAC;IACD,kGAAkG;IAClG,iGAAiG;IACjG,8FAA8F;IAC9F,iGAAiG;IACjG,yFAAyF;IACzF,4FAA4F;IAC5F,4FAA4F;IAC5F,gFAAgF;IAChF,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;QAC/C,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;QAC7D,gGAAgG;QAChG,iGAAiG;QACjG,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAC,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC;QAChF,IAAI,YAAY;YACd,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,qCAAqC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,OAAO,GAAG,CAAC,wFAAwF,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QACzS,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,OAAO;YACpC,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,0BAA0B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,oBAAoB,OAAO,0LAA0L,CAAC,CAAC;IAC9U,CAAC;IACD,OAAO,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE;QACxC,YAAY,EAAE,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC;QACrE,cAAc,EAAE,IAAI,CAAC,OAAO;QAC5B,UAAU,EAAE,SAAS,CAAC,QAAQ;QAC9B,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;QACzC,cAAc,EAAE,aAAa,CAAC,GAAG;KAClC,CAAC,CAAC;AACL,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,mBAAmB,CAAC,KAAa,IAAY,OAAO,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AAEnG,sGAAsG;AACtG,8FAA8F;AAC9F,gGAAgG;AAChG,8FAA8F;AAC9F,+FAA+F;AAC/F,+EAA+E;AAE/E,MAAM,KAAK,GAAG,SAAS,CAAC;AAExB;;;8FAG8F;AAC9F,SAAS,eAAe,CAAC,CAAS,EAAE,IAAY;IAC9C,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,kEAAkE,CAAC,CAAC;IAClH,OAAO,CAAC,CAAC;AACX,CAAC;AACD;;;wEAGwE;AACxE,SAAS,iBAAiB,CAAC,MAAc,EAAE,IAAY;IACrD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACpB,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO;QACtB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,yBAAyB;QAClF,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,WAAW,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,gEAAgE,CAAC,CAAC;IACzJ,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc,EAAE,GAA4B;IACpE,4FAA4F;IAC5F,4FAA4F;IAC5F,6DAA6D;IAC7D,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;IACxD,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,GAAG,CAAC,cAAc;QAC1C,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,8FAA8F;IAC9F,wCAAwC;IACxC,OAAO,GAAG,KAAK,oBAAoB,eAAe,CAAC,MAAM,EAAE,cAAc,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC,IAAI,iBAAiB,CAAC,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC,EAAE,CAAC;AAChM,CAAC;AACD,SAAS,eAAe,CAAC,MAAc,EAAE,OAAe;IACtD,eAAe,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACxC,eAAe,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC1C,OAAO;QACL,GAAG,KAAK,kBAAkB,MAAM,IAAI,OAAO,EAAE;QAC7C,GAAG,KAAK,sBAAsB,MAAM,IAAI,OAAO,EAAE;QACjD,WAAW,MAAM,IAAI,OAAO,IAAI;KACjC,CAAC;AACJ,CAAC;AACD,SAAS,gBAAgB,CAAC,MAAc,EAAE,OAAe;IACvD,OAAO,GAAG,KAAK,oBAAoB,eAAe,CAAC,MAAM,EAAE,cAAc,CAAC,IAAI,eAAe,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,CAAC;AAC5H,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,mBAAmB,CAAC,KAAa,EAAE,QAAgB;IACjE,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,mBAAmB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACjD,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,eAAe,CAAC,MAAM,EAAE,GAAG,CAAC,YAAa,CAAC,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;;;;wEASwE;AACxE,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,QAAgB;IACrE,OAAO;QACL,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,aAAa,CAAC,QAAQ,CAAC,IAAI;QACxD,GAAG,KAAK,mBAAmB,aAAa,CAAC,KAAK,CAAC,EAAE;KAClD,CAAC;AACJ,CAAC;AAED;iGACiG;AACjG,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,QAAgB;IAC/D,OAAO,eAAe,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,GAAkB;IAClE,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,0BAA0B,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACnD,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,eAAe,CAAC,MAAM,EAAE,GAAG,CAAC,YAAa,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,eAAe,CAAC,MAAM,EAAE,GAAG,CAAC,YAAa,CAAC,CAAC,CAAC;AACxF,CAAC;AAED;uGACuG;AACvG,MAAM,UAAU,mBAAmB,CAAC,KAAa,EAAE,QAAgB,EAAE,IAAY;IAC/E,OAAO,eAAe,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED;4FAC4F;AAC5F,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,GAA4B;IAC3E,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC;IACrD,IAAI,CAAC,GAAG,CAAC,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACnF,OAAO,eAAe,CAAC,MAAM,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;AACnD,CAAC;AAKD;;;mGAGmG;AACnG,MAAM,UAAU,yBAAyB,CAAC,QAA6B;IACrE,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,YAAa,CAAC,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uEA+BuE;AACvE,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,QAAgB,EAAE,MAAc;IACrF,MAAM,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,OAAO,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC;IACjE,MAAM,OAAO,GAAG;QACd,WAAW;QACX,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ;QACtC,GAAG,KAAK,mBAAmB,MAAM,EAAE;QACnC,GAAG,KAAK,mBAAmB,aAAa,CAAC,KAAK,CAAC,EAAE;QACjD,GAAG,KAAK,mBAAmB,aAAa,CAAC,KAAK,CAAC,EAAE;QACjD,GAAG,KAAK,gBAAgB,MAAM,EAAE;QAChC,GAAG,KAAK,OAAO;KAChB,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,UAAU,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;;;;;;;;;;6FAc6F;AAC7F,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,QAAgB,EAAE,KAAe,EAAE,MAAc;IACtG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,uIAAuI,CAAC,CAAC;IAC3J,aAAa,CAAC,QAAQ,CAAC,CAAC;IACxB,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,mBAAmB,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC;IACjF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,UAAU,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;4FAuB4F;AAC5F,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,QAAgB,EAAE,MAAc;IACnF,MAAM,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG;QACd,6FAA6F;QAC7F,gGAAgG;QAChG,iEAAiE;QACjE,GAAG,CAAC,QAAQ,CAAC,sBAAsB;QACnC,GAAG,CAAC,QAAQ,CAAC,QAAQ;QACrB,GAAG,CAAC,QAAQ,CAAC,YAAY;QACzB,GAAG,CAAC,QAAQ,CAAC,QAAQ;QACrB,GAAG,CAAC,QAAQ,CAAC,OAAO;QACpB,OAAO,OAAO,SAAS,CAAC,IAAI;QAC5B,OAAO,OAAO,OAAO,CAAC,IAAI;QAC1B,OAAO,OAAO,UAAU,CAAC,IAAI;QAC7B,GAAG,KAAK,mBAAmB,aAAa,CAAC,KAAK,CAAC,EAAE;QACjD,GAAG,KAAK,mBAAmB,mBAAmB,CAAC,KAAK,CAAC,EAAE;QACvD,GAAG,KAAK,OAAO;KAChB,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,UAAU,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;;;;;;;;;;;;;sGAiBsG;AACtG,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,QAAgB,EAAE,MAAc;IAC9E,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5D,MAAM,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC;IACpE,qFAAqF;IACrF,6FAA6F;IAC7F,gGAAgG;IAChG,iGAAiG;IACjG,+DAA+D;IAC/D,MAAM,QAAQ,GAAG,OAAO,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC;IAC9D,mFAAmF;IACnF,2FAA2F;IAC3F,4FAA4F;IAC5F,+FAA+F;IAC/F,yFAAyF;IACzF,iGAAiG;IACjG,qGAAqG;IACrG,MAAM,QAAQ,GAAG,GAAG,KAAK,sBAAsB,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACrE,OAAO,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;AACjG,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;gCA2BgC;AAChC,MAAM,UAAU,mBAAmB,CAAC,KAAa,EAAE,MAAc;IAC/D,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACnC,OAAO;QACL,OAAO,EAAE;YACP,OAAO,IAAI,YAAY,EAAe,2DAA2D;YACjG,GAAG,KAAK,sBAAsB,IAAI,EAAE,EAAE,4EAA4E;YAClH,GAAG,KAAK,mBAAmB,IAAI,EAAE,EAAK,0BAA0B;YAChE,GAAG,KAAK,OAAO,EAAwB,kCAAkC;SAC1E;QACD,SAAS,EAAE,CAAC,UAAU,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,gCAAgC;KACvF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;2CAqB2C;AAC3C,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,MAAc;IACnE,MAAM,OAAO,GAAG;QACd,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ;QAC7B,GAAG,KAAK,eAAe,aAAa,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,QAAQ;QACzE,GAAG,KAAK,OAAO;KAChB,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,UAAU,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3E,CAAC"}

package/dist/endpoint-contract-store.d.ts

@@ -46,7 +46,30 @@ export declare function publishContractArtifact(ctx: ContractStoreContext, bytes
 }>;
 /** Fetch one artifact by digest (`undefined` = not published). VERIFY-ON-READ is unconditional
  *  and TWO-PROOF: the fetched bytes must recompute the digest AND be strict canonical JSON —
- *  content addressing is the tamper boundary and a garbled store never serves (§13.7). */
+ *  content addressing is the tamper boundary (§13.7).
+ *
+ *  APPEND-SHADOW DEFENSE (critic, live-confirmed): the `epc.*` publish grant is a raw JS publish;
+ *  the create-only fence is a publisher-SET header (`Nats-Expected-Last-Subject-Sequence: 0`) the
+ *  grant cannot compel, so a non-cooperative grant-holder can APPEND garbage at an
+ *  already-published digest subject. `last_by_subj` would then return that shadow and a fail-closed
+ *  read would make the honest artifact permanently unfetchable (a total, operator-recovery-only
+ *  DoS once ep is the sole contract path). The subject IS the content digest and honest
+ *  publication is create-only, so the FIRST message at the subject is the unique verifying
+ *  artifact and every shadow is a strictly later append. The read therefore verifies `last_by_subj`
+ *  (the O(1) fast path, correct whenever nobody shadowed) and, on a verify-miss, FALLS BACK to the
+ *  create-only winner (`next_by_subj` from the stream start) and verifies THAT — so a shadow-append
+ *  is defeated by the reader, never relying on publisher cooperation. Only when NEITHER the last nor
+ *  the first message verifies is the store genuinely corrupt (fail loud). Pre-emptive garbage
+ *  BEFORE the honest publish is the already-loud case: the honest create-only publish then loses at
+ *  registration, so there is no honest artifact to recover.
+ *
+ *  GRANT NOTE (critic completeness item): the fallback issues `next_by_subj`, which rides the bare
+ *  `$JS.API.DIRECT.GET.<stream>` form — the executor publisher holds it, the ordinary agent baseline
+ *  does NOT (it holds only the subject-scoped `last_by_subj`, per the D32 read-grant bound). Sound
+ *  because {@link ensureContractStore} fails loud unless the store is config-B immutable, so the
+ *  manager never serves a store where an agent's `last_by_subj` could return a shadow — the fallback
+ *  never triggers on the agent path. Widening the agent grant to the bare form is unnecessary (and
+ *  would relax the D32 bound for no gain). */
 export declare function fetchContractArtifact(ctx: ContractStoreContext, digestHex: string): Promise<Uint8Array | undefined>;
 /** The §13.7 closure MANIFEST artifact: contract identity is THIS artifact's digest (the
  *  closure digest), never the root document digest alone. Digest fields carry the one scalar

package/dist/endpoint-contract-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"endpoint-contract-store.d.ts","sourceRoot":"","sources":["../src/endpoint-contract-store.ts"],"names":[],"mappings":"AAmCA,OAAO,EAA0B,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAOtF,4FAA4F;AAC5F,eAAO,MAAM,2BAA2B,QAAa,CAAC;AACtD,yFAAyF;AACzF,eAAO,MAAM,0BAA0B,QAAc,CAAC;AACtD,uEAAuE;AACvE,eAAO,MAAM,8BAA8B,KAAK,CAAC;AACjD,2FAA2F;AAC3F,eAAO,MAAM,8BAA8B,KAAK,CAAC;AAIjD;;;;4FAI4F;AAC5F,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAQD;;wEAEwE;AACxE,wBAAsB,oBAAoB,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAU3G;AAWD;;0FAE0F;AAC1F,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAEnE;AAED;0FAC0F;AAC1F,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAKpD;AAED;yEACyE;AACzE,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAGzE;AAED;;;;kEAIkE;AAClE,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAarF;AAED;;;;yFAIyF;AACzF,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,oBAAoB,EACzB,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,OAAO,CAAA;CAAE,CAAC,CAyB9C;AAED;;0FAE0F;AAC1F,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,oBAAoB,EACzB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAqBjC;AAID;;4BAE4B;AAC5B,MAAM,WAAW,uBAAuB;IACtC,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,MAAM,CAAC;IACb;8FAC0F;IAC1F,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAeD;;;2DAG2D;AAC3D,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,MAAM,EAAE,GAAG,uBAAuB,CAIpH;AAyBD;8BAC8B;AAC9B,wBAAsB,8BAA8B,CAClD,GAAG,EAAE,oBAAoB,EACzB,QAAQ,EAAE,uBAAuB,GAChC,OAAO,CAAC;IAAE,gBAAgB,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,OAAO,CAAA;CAAE,CAAC,CAKrD;AAED;;;;;;;;;;oEAUoE;AACpE,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,oBAAoB,EACzB,gBAAgB,EAAE,MAAM,EACxB,WAAW,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,KAAK,MAAM,EAAE,EAC/D,IAAI,GAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAO,GAC1D,OAAO,CAAC;IAAE,QAAQ,EAAE,uBAAuB,CAAC;IAAC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;CAAE,CAAC,CAoFpF"}
+{"version":3,"file":"endpoint-contract-store.d.ts","sourceRoot":"","sources":["../src/endpoint-contract-store.ts"],"names":[],"mappings":"AAmCA,OAAO,EAA0B,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAOtF,4FAA4F;AAC5F,eAAO,MAAM,2BAA2B,QAAa,CAAC;AACtD,yFAAyF;AACzF,eAAO,MAAM,0BAA0B,QAAc,CAAC;AACtD,uEAAuE;AACvE,eAAO,MAAM,8BAA8B,KAAK,CAAC;AACjD,2FAA2F;AAC3F,eAAO,MAAM,8BAA8B,KAAK,CAAC;AAIjD;;;;4FAI4F;AAC5F,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAQD;;wEAEwE;AACxE,wBAAsB,oBAAoB,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAa3G;AAWD;;0FAE0F;AAC1F,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAEnE;AAED;0FAC0F;AAC1F,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAKpD;AAED;yEACyE;AACzE,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAGzE;AAED;;;;kEAIkE;AAClE,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAarF;AAED;;;;yFAIyF;AACzF,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,oBAAoB,EACzB,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,OAAO,CAAA;CAAE,CAAC,CA8B9C;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;8CAyB8C;AAC9C,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,oBAAoB,EACzB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CA2BjC;AAID;;4BAE4B;AAC5B,MAAM,WAAW,uBAAuB;IACtC,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,MAAM,CAAC;IACb;8FAC0F;IAC1F,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAeD;;;2DAG2D;AAC3D,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,MAAM,EAAE,GAAG,uBAAuB,CAIpH;AAyBD;8BAC8B;AAC9B,wBAAsB,8BAA8B,CAClD,GAAG,EAAE,oBAAoB,EACzB,QAAQ,EAAE,uBAAuB,GAChC,OAAO,CAAC;IAAE,gBAAgB,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,OAAO,CAAA;CAAE,CAAC,CAKrD;AAED;;;;;;;;;;oEAUoE;AACpE,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,oBAAoB,EACzB,gBAAgB,EAAE,MAAM,EACxB,WAAW,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,KAAK,MAAM,EAAE,EAC/D,IAAI,GAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAO,GAC1D,OAAO,CAAC;IAAE,QAAQ,EAAE,uBAAuB,CAAC;IAAC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;CAAE,CAAC,CAoFpF"}

package/dist/endpoint-contract-store.js

@@ -60,7 +60,10 @@ export async function contractStoreContext(nc, space) {
     if (typeof space !== "string" || space.length === 0)
         throw new EpEnvelopeError("failed-precondition", "a contract-store context needs a space");
     const js = jetstream(nc);
-    const jsm = await jetstreamManager(nc);
+    // checkAPI:false - the manager construction otherwise probes `$JS.API.INFO`, a grant the
+    // minimal fetch-only callers (operator instruments: Direct Get + publish rows only) do not and
+    // should not hold; every real read/publish below still fails loud on its own denial.
+    const jsm = await jetstreamManager(nc, { checkAPI: false });
     const ctx = Object.freeze({ space });
     STORE_RESOURCES.set(ctx, { js, jsm });
     return ctx;
@@ -151,7 +154,12 @@ export async function publishContractArtifact(ctx, bytes) {
     }
     catch (e) {
         const code = e?.code;
-        if (code !== 10071 && code !== 10164)
+        // A publish to an ALREADY-OCCUPIED digest subject loses idempotently: the create-only header
+        // mismatch (10071/10164) OR — under the store's per-subject-immutability shape
+        // (ensureContractStore: max_msgs_per_subject:1 + discard-new) — the broker's per-subject reject
+        // (10077), which fires when a second publish reaches an occupied subject. All three mean "this
+        // digest is already published"; anything else is a real infra error.
+        if (code !== 10071 && code !== 10164 && code !== 10077)
             throw e;
         // The subject is the digest: a prior write with this address holds these bytes (verified
         // on fetch). The loss is idempotent; an unreadable prior write is loud.
@@ -161,37 +169,81 @@ export async function publishContractArtifact(ctx, bytes) {
         return { digestHex, won: false };
     }
 }
+/** Prove one fetched message IS the artifact for `digestHex` at `subject`: within the document
+ *  bound, recomputes its digest, and strict canonical JSON. `undefined` (never a throw) when it
+ *  does not verify — the caller decides whether a miss is fatal or a fallback. */
+function verifyStored(data, digestHex, subject) {
+    if (data.length > CONTRACT_ARTIFACT_MAX_BYTES)
+        return undefined; // an oversize plant never serves (distsys 8dcad72 M2)
+    if (contractArtifactDigestHex(data) !== digestHex)
+        return undefined;
+    try {
+        assertCanonicalArtifactBytes(data, `the artifact at ${subject}`);
+    }
+    catch {
+        return undefined;
+    }
+    return data;
+}
 /** Fetch one artifact by digest (`undefined` = not published). VERIFY-ON-READ is unconditional
  *  and TWO-PROOF: the fetched bytes must recompute the digest AND be strict canonical JSON —
- *  content addressing is the tamper boundary and a garbled store never serves (§13.7). */
+ *  content addressing is the tamper boundary (§13.7).
+ *
+ *  APPEND-SHADOW DEFENSE (critic, live-confirmed): the `epc.*` publish grant is a raw JS publish;
+ *  the create-only fence is a publisher-SET header (`Nats-Expected-Last-Subject-Sequence: 0`) the
+ *  grant cannot compel, so a non-cooperative grant-holder can APPEND garbage at an
+ *  already-published digest subject. `last_by_subj` would then return that shadow and a fail-closed
+ *  read would make the honest artifact permanently unfetchable (a total, operator-recovery-only
+ *  DoS once ep is the sole contract path). The subject IS the content digest and honest
+ *  publication is create-only, so the FIRST message at the subject is the unique verifying
+ *  artifact and every shadow is a strictly later append. The read therefore verifies `last_by_subj`
+ *  (the O(1) fast path, correct whenever nobody shadowed) and, on a verify-miss, FALLS BACK to the
+ *  create-only winner (`next_by_subj` from the stream start) and verifies THAT — so a shadow-append
+ *  is defeated by the reader, never relying on publisher cooperation. Only when NEITHER the last nor
+ *  the first message verifies is the store genuinely corrupt (fail loud). Pre-emptive garbage
+ *  BEFORE the honest publish is the already-loud case: the honest create-only publish then loses at
+ *  registration, so there is no honest artifact to recover.
+ *
+ *  GRANT NOTE (critic completeness item): the fallback issues `next_by_subj`, which rides the bare
+ *  `$JS.API.DIRECT.GET.<stream>` form — the executor publisher holds it, the ordinary agent baseline
+ *  does NOT (it holds only the subject-scoped `last_by_subj`, per the D32 read-grant bound). Sound
+ *  because {@link ensureContractStore} fails loud unless the store is config-B immutable, so the
+ *  manager never serves a store where an agent's `last_by_subj` could return a shadow — the fallback
+ *  never triggers on the agent path. Widening the agent grant to the bare form is unnecessary (and
+ *  would relax the D32 bound for no gain). */
 export async function fetchContractArtifact(ctx, digestHex) {
     const { jsm } = resources(ctx);
+    const stream = epcStreamName(ctx.space);
     const subject = epcSubject(ctx.space, digestHex); // validates the token
-    let stored;
-    try {
-        stored = await jsm.direct.getMessage(epcStreamName(ctx.space), { last_by_subj: subject });
-    }
-    catch (e) {
-        if (e?.code === 10037)
-            return undefined; // the ONLY "genuinely absent" result
-        throw new EpEnvelopeError("unavailable", `the contract-store read for ${digestHex} failed (a failed observation is never absence, SPEC 13.7): ${e?.message ?? String(e)}`);
-    }
-    if (stored === null)
+    const read = async (req) => {
+        try {
+            const stored = await jsm.direct.getMessage(stream, req);
+            return stored === null ? "absent" : stored.data;
+        }
+        catch (e) {
+            if (e?.code === 10037)
+                return "absent"; // the ONLY "genuinely absent" result
+            throw new EpEnvelopeError("unavailable", `the contract-store read for ${digestHex} failed (a failed observation is never absence, SPEC 13.7): ${e?.message ?? String(e)}`);
+        }
+    };
+    // Fast path: the last message at the subject. Verifies whenever nobody shadowed (the common case).
+    const last = await read({ last_by_subj: subject });
+    if (last === "absent")
         return undefined;
-    // The 256 KiB document bound is enforced on EVERY consuming read, not just publication (distsys
-    // 8dcad72 M2): a directly-planted oversize artifact (bypassing publishContractArtifact) must
-    // never be served, and the closure walk (which reads through here) inherits the per-document cap.
-    if (stored.data.length > CONTRACT_ARTIFACT_MAX_BYTES)
-        throw new EpEnvelopeError("internal", `the artifact at ${subject} is ${stored.data.length} bytes, above the ${CONTRACT_ARTIFACT_MAX_BYTES} document bound; a store that admitted an oversize artifact never serves it (SPEC 13.7)`);
-    if (contractArtifactDigestHex(stored.data) !== digestHex)
-        throw new EpEnvelopeError("internal", `the artifact at ${subject} does not recompute its digest; verify-on-read is the tamper boundary and fails loud (SPEC 13.7)`);
-    try {
-        assertCanonicalArtifactBytes(stored.data, `the artifact at ${subject}`);
-    }
-    catch {
-        throw new EpEnvelopeError("internal", `the artifact at ${subject} is not strict canonical JSON; a garbled store never serves (SPEC 13.7)`);
-    }
-    return stored.data;
+    const okLast = verifyStored(last, digestHex, subject);
+    if (okLast !== undefined)
+        return okLast;
+    // Shadow suspected: fall back to the create-only WINNER (the first message at the subject) — a
+    // valid artifact was published create-only, so it is first; anything after it is an append.
+    const first = await read({ seq: 0, next_by_subj: subject });
+    if (first === "absent")
+        return undefined;
+    const okFirst = verifyStored(first, digestHex, subject);
+    if (okFirst !== undefined)
+        return okFirst;
+    // Neither the last nor the create-only winner verifies: the store is genuinely corrupt for this
+    // subject (no honest artifact was ever published, or the first message is itself garbage).
+    throw new EpEnvelopeError("internal", `no message at ${subject} recomputes its digest as strict canonical JSON (checked both the last and the create-only winner); verify-on-read is the tamper boundary and a store with no verifying artifact never serves (SPEC 13.7)`);
 }
 const sha256Ref = (hex) => `sha256:${hex}`;
 /** A manifest digest field is EXACTLY `sha256:<64-hex>` (frozen SPEC 13.7:1858-1861), never a