@cotal-ai/core 0.16.0 → 0.18.0

package/dist/endpoint-envelope.js

@@ -1,19 +1,15 @@
 import { rawDigest, isContractDigest, isWellFormedUnicode } from "./canonical.js";
 import { assertCommandToken, assertIdToken, assertLifecycleToken, endpointToken } from "./endpoint-subjects.js";
 import { SCHEMA_PROFILE } from "./schema-profile.js";
+// The error catalog + EpEnvelopeError live in a node-free module so the browser session bundle can
+// use them without dragging in schema-profile's load-time digest (node:crypto). Re-exported here so
+// every existing `@cotal-ai/core` consumer keeps its import path.
+import { EP_ERROR_CODES, EpEnvelopeError } from "./endpoint-error.js";
+export { EP_ERROR_CODES, EpEnvelopeError } from "./endpoint-error.js";
 /** The envelope schema version — independent of the wire `protocolVersion`; starts at its own
  *  v1 inside the v0.4 revision. Other values are rejected (`unsupported-version`). */
 export const EP_ENVELOPE_V = 1;
 // ---- structured errors (§13.3 error catalog) ------------------------------------------------
-/** The §13.3 error catalog. Extensions add codes only under reverse-DNS; any code (catalog or
- *  extension) is one token of at most 64 bytes. */
-export const EP_ERROR_CODES = Object.freeze([
-    "bad-request", "unsupported-version", "op-mismatch", "class-mismatch", "target-mismatch",
-    "sender-mismatch", "unauthenticated", "permission-denied", "not-found", "already-exists",
-    "conflict", "contract-mismatch", "contract-invalid", "failed-precondition",
-    "deadline-exceeded", "cancelled", "expired", "unavailable", "unimplemented",
-    "resource-exhausted", "internal",
-]);
 const EP_ERROR_SET = new Set(EP_ERROR_CODES);
 const LABEL = "[a-z0-9]([a-z0-9-]*[a-z0-9])?";
 /** Reverse-DNS extension token: three or more DNS-shaped labels (`com.acme.throttled`). */
@@ -24,22 +20,6 @@ export function isEpErrorCode(code) {
         return false;
     return EP_ERROR_SET.has(code) || EXTENSION_CODE.test(code);
 }
-/** A consuming-boundary rejection: the catalog code plus a human message. Boundaries convert it
- *  to an `EndpointReply` error via {@link EpEnvelopeError.toEpError} (or, on reply-less planes,
- *  to the §13.4 decision/quarantine fact carrying the same code). */
-export class EpEnvelopeError extends Error {
-    code;
-    details;
-    constructor(code, message, details) {
-        super(message);
-        this.code = code;
-        this.details = details;
-        this.name = "EpEnvelopeError";
-    }
-    toEpError() {
-        return { code: this.code, message: this.message, ...(this.details ? { details: this.details } : {}) };
-    }
-}
 function fail(code, message) {
     throw new EpEnvelopeError(code, message);
 }
@@ -298,25 +278,96 @@ export function parseEndpointEvent(raw) {
     return { v: EP_ENVELOPE_V, topic, ts, data: o.data, ...(correlation !== undefined ? { correlation } : {}) };
 }
 // ---- invocation-time contract validation (§13.7, distinct from registration time) -----------
+/**
+ * Report — never refuse on — an over-budget validation on the REQUEST path.
+ *
+ * §13.8's validate budget used to throw: `bad-request` for args, `internal` for output. It cannot
+ * be measured soundly enough to justify that. Elapsed time counts the whole machine (it refused an
+ * 82ms cold-JIT validation of a small, schema-VALID object during a gate run). `process.cpuUsage()`
+ * counts every thread in the process, so V8's background optimizing-compiler threads and any
+ * sibling Worker land in the number too — measured at 16.4ms of process CPU against 0.18ms on the
+ * measuring thread, already over this 10ms ceiling with almost no work done here. Node exposes no
+ * per-thread CPU below 22.19 and the package floor is `>=22`, so there is no third instrument.
+ *
+ * A false refusal HERE answers the CALLER: a manager on a loaded or Worker-using host would tell
+ * clients their valid arguments are malformed and silently degrade a live control plane. That is
+ * strictly worse than the DoS this was guarding, which needs an attacker able to register a
+ * contract. So enforcement stays where the attack actually lives — the REGISTRATION path, where
+ * {@link import("./schema-profile.js").compileContract} still refuses `contract-invalid`, a false
+ * positive fails a boot loudly rather than lying to a caller.
+ *
+ * WHAT THIS COMMENT USED TO CLAIM, AND WHY IT WAS WRONG. It said the deterministic profile bounds
+ * "do the pre-emptive work", i.e. that registration-time bounds REPLACE request-path enforcement.
+ * They do not, and that was disproved by execution rather than argued: a four-node schema —
+ * trivially inside every byte, depth, ref-chain, node and closure bound — declaring
+ * `uniqueItems: true` over an array of OBJECTS makes validation QUADRATIC IN THE CALLER'S DATA.
+ * 3,000 valid objects measured 75ms and 5,000 measured 227ms, from ~54KB of entirely legitimate
+ * input. No registration power, no oversized payload, no forgery. The profile bounds the SIZE and
+ * SHAPE of a schema and the BACKTRACKING class via `maxPatternChars`; it has nothing for keywords
+ * whose cost is non-linear in the VALUE being validated.
+ *
+ * BE PRECISE ABOUT WHAT THE DEMOTION DID AND DID NOT COST, because the obvious reading is wrong.
+ * The gap is real and it PRE-DATES the demotion. The old code was
+ *
+ *     const okValid = validate(value);          // the whole cost is ALREADY PAID here
+ *     const cpu = process.cpuUsage(startedCpu); // measured afterwards
+ *     if (cpuMs > budget) fail("bad-request", …)
+ *
+ * so the refusal fired AFTER validation ran to completion. On a quadratic payload the enforcing
+ * build burns exactly the same CPU as this one; it merely answers with an error instead of a
+ * result. AGAINST RESOURCE EXHAUSTION, POST-HOC ENFORCEMENT BOUGHT NOTHING — an authorized caller
+ * repeating the call cost the host the same before this change as after. What was removed was a
+ * post-hoc classification, never a fence.
+ *
+ * AN INSTRUMENT ONLY GUARDS WHAT HAPPENS AFTER IT. That is the whole rule, and it is why the
+ * reply-payload case is genuinely different: THAT throw preceded a downstream publish, so removing
+ * it really did let an oversized reply through. Position, not intent, decides whether a check is a
+ * fence or a verdict.
+ *
+ * So the honest statement is that this path has ALWAYS been unbounded for validation cost, and a
+ * deterministic PRE-EMPTIVE defence is owed: a bound on argument bytes and items checked BEFORE
+ * `validate` runs, refused as `resource-exhausted` (the caller's arguments are not malformed, they
+ * are too expensive to admit — see `assertFactFits` in endpoint-journal.ts for the same shape), plus
+ * a registration-time refusal of keywords whose cost is non-linear in the value. `max_payload` is
+ * NOT that bound: at ~1 MiB it admits thousands of small objects, which is deep into the quadratic.
+ *
+ * The transferable lesson stands and is worth more than the incident: one unsound timer was standing
+ * in for three jobs and was removed having enumerated one. REMOVING A GUARD REQUIRES ENUMERATING
+ * WHAT IT WAS HOLDING UP — and then checking, for each, whether the guard actually PRECEDED the
+ * thing it appeared to hold up. Two of the three here did not.
+ *
+ * The number stays, as an approximate observation, because it is still the only signal that a
+ * registered contract is costing more than the profile intended. Treat it as a hint to go look at
+ * the contract, never as a verdict about this request.
+ */
+function reportValidateBudget(what, startedCpu, startedMs) {
+    const cpu = process.cpuUsage(startedCpu);
+    const cpuMs = Math.round((cpu.user + cpu.system) / 1000);
+    if (cpuMs <= SCHEMA_PROFILE.validateBudgetMs)
+        return;
+    console.error(`! schema: ${what} validation took ~${cpuMs}ms of process CPU (§13.8 reference budget ${SCHEMA_PROFILE.validateBudgetMs}ms; ` +
+        `${Date.now() - startedMs}ms elapsed). Approximate - process-wide CPU includes JIT/Worker threads. ` +
+        `Not a refusal - and note that refusing HERE would not have helped: this fires after validate() completed, so the cost is already paid. Validation cost on this path is bounded by nothing pre-emptively; a byte/item bound before validate is owed.`);
+}
 /** Validate `args` against the command's compiled input schema BEFORE any effect: failure is the
  *  invocation-time `bad-request` (registration-time violations are `contract-invalid`,
  *  {@link import("./schema-profile.js").ContractInvalidError}). Against the void schema the
  *  payload is absent or `null` (§13.7), so `undefined` args validate as `null` here and only
  *  here; an explicit `null` passes through unchanged, and it is the SCHEMA (an object-typed
- *  input contract) that rejects null for non-void commands. The §13.8 validation budget is the
- *  PROFILE's fixed 10ms, read internally so no caller
- *  can tune it away, and is enforced post-hoc, fail-loud as `bad-request` (the spec's
- *  over-budget code for validate time, distinct from compile's `contract-invalid`). Post-hoc
- *  measurement classifies, it cannot preempt — the pre-emptive defense is the registration-time
- *  bounded-pattern gate (schema-profile), which keeps the exponential backtracking class out of
- *  registered contracts in the first place. */
+ *  input contract) that rejects null for non-void commands.
+ *
+ *  The §13.8 validation budget is REPORTED here, not enforced — see {@link reportValidateBudget}
+ *  for why no available instrument can justify refusing a request on it. The only `bad-request`
+ *  this raises is the schema's own verdict. Enforcement lives at registration
+ *  ({@link import("./schema-profile.js").compileContract}), which is where the COMPILE-time DoS
+ *  lives - not the only place a DoS lives, see the note on `reportValidateBudget` - and where
+ *  a false positive fails loudly instead of lying to a caller. */
 export function assertArgsValid(validate, args) {
     const value = args === undefined ? null : args;
+    const startedCpu = process.cpuUsage();
     const started = Date.now();
     const okValid = validate(value);
-    const elapsed = Date.now() - started;
-    if (elapsed > SCHEMA_PROFILE.validateBudgetMs)
-        fail("bad-request", `args validation took ${elapsed}ms (budget ${SCHEMA_PROFILE.validateBudgetMs}ms; over budget is bad-request, SPEC 13.8)`);
+    reportValidateBudget("args", startedCpu, started);
     if (!okValid) {
         const first = validate.errors?.[0];
         fail("bad-request", `args do not validate against the input schema${first ? `: ${first.instancePath || "/"} ${first.message ?? ""}` : ""}`);
@@ -325,19 +376,17 @@ export function assertArgsValid(validate, args) {
 }
 /** Validate an output payload against the command's compiled output schema at EITHER §13.7
  *  boundary — the responder's, before the success publish, or the caller's, on the consumed
- *  reply — the symmetric budgeted half of {@link assertArgsValid}, under the SAME fixed
- *  §13.8 `validateBudgetMs` (read internally, never caller-tunable). Both failure classes are
- *  structured `internal`: an invalid output is a responder bug (§13.3/§13.7) whichever side
- *  detects it, and an over-budget output validation is the same bug class, never the caller's
- *  `bad-request`. A void output is `undefined`, validated as `null` against the void schema,
- *  mirroring the args side. */
+ *  reply — the symmetric half of {@link assertArgsValid}. An invalid output is a responder bug
+ *  (§13.3/§13.7) whichever side detects it, so it is structured `internal`, never the caller's
+ *  `bad-request`. The §13.8 budget is REPORTED, not enforced, for the same reason as the args side
+ *  ({@link reportValidateBudget}). A void output is `undefined`, validated as `null` against the
+ *  void schema, mirroring the args side. */
 export function assertOutputValid(validate, data) {
     const value = data === undefined ? null : data;
+    const startedCpu = process.cpuUsage();
     const started = Date.now();
     const okValid = validate(value);
-    const elapsed = Date.now() - started;
-    if (elapsed > SCHEMA_PROFILE.validateBudgetMs)
-        fail("internal", `output validation took ${elapsed}ms (budget ${SCHEMA_PROFILE.validateBudgetMs}ms; an over-budget output validation is a responder bug, SPEC 13.7/13.8)`);
+    reportValidateBudget("output", startedCpu, started);
     if (!okValid) {
         const first = validate.errors?.[0];
         fail("internal", `output does not validate against the pinned output schema; an invalid reply is a responder bug, never success (SPEC 13.7)${first ? `: ${first.instancePath || "/"} ${first.message ?? ""}` : ""}`);

package/dist/endpoint-envelope.js.map

@@ -1 +1 @@
-{"version":3,"file":"endpoint-envelope.js","sourceRoot":"","sources":["../src/endpoint-envelope.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,oBAAoB,EAAE,aAAa,EAAwB,MAAM,wBAAwB,CAAC;AACtI,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAGrD;sFACsF;AACtF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC;AAE/B,gGAAgG;AAEhG;mDACmD;AACnD,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1C,aAAa,EAAE,qBAAqB,EAAE,aAAa,EAAE,gBAAgB,EAAE,iBAAiB;IACxF,iBAAiB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,WAAW,EAAE,gBAAgB;IACxF,UAAU,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,qBAAqB;IAC1E,mBAAmB,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe;IAC3E,oBAAoB,EAAE,UAAU;CACxB,CAAC,CAAC;AAEZ,MAAM,YAAY,GAAG,IAAI,GAAG,CAAS,cAAc,CAAC,CAAC;AAErD,MAAM,KAAK,GAAG,+BAA+B,CAAC;AAC9C,2FAA2F;AAC3F,MAAM,cAAc,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,KAAK,QAAQ,CAAC,CAAC;AAEjE,oGAAoG;AACpG,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IACnF,OAAO,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC7D,CAAC;AAeD;;qEAEqE;AACrE,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACnB;IAA6C;IAAlE,YAAqB,IAAiB,EAAE,OAAe,EAAW,OAAyB;QACzF,KAAK,CAAC,OAAO,CAAC,CAAC;QADI,SAAI,GAAJ,IAAI,CAAa;QAA4B,YAAO,GAAP,OAAO,CAAkB;QAEzF,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;IACD,SAAS;QACP,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACxG,CAAC;CACF;AAED,SAAS,IAAI,CAAC,IAAiB,EAAE,OAAe;IAC9C,MAAM,IAAI,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC;AAgFD,gGAAgG;AAEhG;;;;4FAI4F;AAC5F,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;QACxD,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,+CAA+C,CAAC,CAAC;IAC5F,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,gGAAgG;AAEhG,SAAS,QAAQ,CAAC,CAAU,EAAE,IAAY;IACxC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACzD,IAAI,CAAC,aAAa,EAAE,GAAG,IAAI,uBAAuB,CAAC,CAAC;IACtD,OAAO,CAA4B,CAAC;AACtC,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU,EAAE,IAAY;IACxC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,IAAI,CAAC,aAAa,EAAE,GAAG,IAAI,4BAA4B,CAAC,CAAC;IACtG,OAAO,CAAC,CAAC;AACX,CAAC;AAED,kFAAkF;AAClF,SAAS,SAAS,CAAC,CAAU,EAAE,IAAY;IACzC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAC5D,IAAI,CAAC,aAAa,EAAE,GAAG,IAAI,wDAAwD,CAAC,CAAC;IACvF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,sFAAsF;AACtF,SAAS,OAAO,CAAI,EAAW;IAC7B,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,aAAa,EAAG,CAAW,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED;;;;6CAI6C;AAC7C,MAAM,WAAW,GAAG,2EAA2E,CAAC;AAChG,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,MAAM,uBAAuB,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAW,CAAC;AAE5E;;;;yFAIyF;AACzF,SAAS,eAAe,CAAC,CAAU;IACjC,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IACrC,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;QAC9D,IAAI,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,qBAAqB;YACvD,IAAI,CAAC,aAAa,EAAE,mCAAmC,qBAAqB,QAAQ,CAAC,CAAC;QACxF,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/D,IAAI,CAAC,aAAa,EAAE,sEAAsE,CAAC,CAAC;QAC9F,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;YACrC,IAAI,CAAC,aAAa,EAAE,6FAA6F,CAAC,CAAC;QACrH,GAAG,CAAC,WAAW,GAAG,EAAE,CAAC;IACvB,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,CAAU,EAAE,CAAC;QACnD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,SAAS;QACjC,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC;QAC7C,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,uBAAuB,CAAC,CAAC,CAAC;YAC3D,IAAI,CAAC,aAAa,EAAE,eAAe,CAAC,YAAY,uBAAuB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACtF,4CAA4C;QAC5C,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,aAAa,EAAE,eAAe,CAAC,8BAA8B,CAAC,CAAC;QACnG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACb,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;oFACoF;AACpF,SAAS,aAAa,CAAC,CAA0B,EAAE,IAAY;IAC7D,IAAI,CAAC,CAAC,CAAC,KAAK,aAAa;QAAE,IAAI,CAAC,qBAAqB,EAAE,GAAG,IAAI,qBAAqB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,aAAa,EAAE,CAAC,CAAC;AACpI,CAAC;AAED;;mFAEmF;AACnF,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACnC,aAAa,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAC5B,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAEpE,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAG,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IACtF,MAAM,OAAO,GAA+C,EAAE,CAAC;IAC/D,KAAK,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAU,EAAE,CAAC;QACzD,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACpB,IAAI,OAAO,KAAK,UAAU;gBACxB,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,iGAAiG,CAAC,CAAC;YACtI,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,+BAA+B,CAAC,CAAC;QAC/G,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAED,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC;IACpB,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,SAAS;QAC1C,IAAI,CAAC,aAAa,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,qFAAqF,CAAC,CAAC;IACzI,IAAI,OAAO,CAAC,CAAC,aAAa,KAAK,SAAS;QAAE,IAAI,CAAC,aAAa,EAAE,gCAAgC,CAAC,CAAC;IAChG,MAAM,aAAa,GAAG,CAAC,CAAC,aAAa,CAAC;IACtC,IAAI,GAAG,KAAK,SAAS,IAAI,aAAa;QACpC,IAAI,CAAC,aAAa,EAAE,6HAA6H,CAAC,CAAC;IAErJ,IAAI,UAA8B,CAAC;IACnC,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC/B,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QACnD,IAAI,UAAU,KAAK,CAAC;YAAE,IAAI,CAAC,aAAa,EAAE,kDAAkD,CAAC,CAAC;IAChG,CAAC;SAAM,IAAI,aAAa,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QAC9C,IAAI,CAAC,aAAa,EAAE,8BAA8B,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,oDAAoD,EAAE,CAAC,CAAC;IACvI,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IAEzH,IAAI,MAAiC,CAAC;IACtC,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACvC,MAAM,GAAG;YACP,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,cAAc,CAAC;YACxC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,cAAc,CAAC;YACxC,YAAY,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,EAAE,qBAAqB,CAAC,EAAE,qBAAqB,CAAC,CAAC;YACzH,GAAG,CAAC,CAAC,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC,CAAC,eAAe,EAAE,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxH,CAAC;IACJ,CAAC;IAED,4FAA4F;IAC5F,gEAAgE;IAChE,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,IAAyB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAA4B,CAAC;IAE1I,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,MAAM,IAAI,GAAgB;QACxB,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC;QAC7B,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC;QACnC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzE,CAAC;IAEF,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzE,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;QAClD,IAAI,CAAC,aAAa,EAAE,oHAAoH,CAAC,CAAC;IAC5I,MAAM,WAAW,GAAG,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAEnD,OAAO;QACL,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,aAAa;QACtF,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,IAAI;QACJ,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC;AACJ,CAAC;AAED;;;;;;uCAMuC;AACvC,MAAM,UAAU,4BAA4B,CAAC,GAAoB,EAAE,OAAwB;IACzF,IAAI,GAAG,CAAC,EAAE,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ;QACtC,IAAI,CAAC,aAAa,EAAE,gBAAgB,GAAG,CAAC,EAAE,CAAC,QAAQ,+CAA+C,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACzH,IAAI,GAAG,CAAC,EAAE,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO;QACpC,IAAI,CAAC,aAAa,EAAE,eAAe,GAAG,CAAC,EAAE,CAAC,OAAO,8CAA8C,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC;IAErH,2FAA2F;IAC3F,yFAAyF;IACzF,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS;QACzD,IAAI,CAAC,aAAa,EAAE,uGAAuG,CAAC,CAAC;IAE/H,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC5B,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;YAC1B,IAAI,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,wDAAwD,CAAC,CAAC;IAC/I,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,IAAI,2CAA2C,CAAC,CAAC;QACpG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM;YAC/B,IAAI,CAAC,iBAAiB,EAAE,iBAAiB,GAAG,CAAC,MAAM,CAAC,KAAK,8CAA8C,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACtH,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,CAAC,CAAC,IAAI,CAAC;YAC9F,IAAI,CAAC,iBAAiB,EAAE,gGAAgG,CAAC,CAAC;IAC9H,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACjE,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM;QACxB,IAAI,CAAC,iBAAiB,EAAE,YAAY,GAAG,CAAC,IAAI,CAAC,EAAE,kDAAkD,MAAM,GAAG,CAAC,CAAC;AAChH,CAAC;AAED;2FAC2F;AAC3F,MAAM,UAAU,kBAAkB,CAAC,GAAoB,EAAE,aAAsB;IAC7E,IAAI,GAAG,CAAC,KAAK,KAAK,aAAa;QAC7B,IAAI,CAAC,gBAAgB,EAAE,UAAU,GAAG,CAAC,KAAK,kDAAkD,aAAa,GAAG,CAAC,CAAC;AAClH,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC5C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,aAAa,EAAE,cAAc,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;IACjK,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,+BAA+B,CAAC,CAAC;IACjH,IAAI,OAAoC,CAAC;IACzC,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,IAAI,CAAC,aAAa,EAAE,+BAA+B,CAAC,CAAC;QACpF,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YAC/B,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC;YAC7C,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAC1D,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,aAAa,EAAE,iBAAiB,CAAC,WAAW,IAAI,iCAAiC,CAAC,CAAC;YACxH,OAAO,CAAkB,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED;iEACiE;AACjE,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACjC,aAAa,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,SAAS;QAAE,IAAI,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC;IAC1E,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;QAAE,IAAI,CAAC,aAAa,EAAE,qCAAqC,CAAC,CAAC;IAC9F,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;QAAE,IAAI,CAAC,aAAa,EAAE,oCAAoC,CAAC,CAAC;IAC7F,MAAM,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACrF,OAAO;QACL,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE;QAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED;gGACgG;AAChG,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACjC,aAAa,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACzC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,GAAG;QAAE,IAAI,CAAC,aAAa,EAAE,yBAAyB,CAAC,CAAC;IAC3F,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;QAAE,IAAI,CAAC,aAAa,EAAE,6BAA6B,CAAC,CAAC;IACvE,MAAM,WAAW,GAAG,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACnD,OAAO,EAAE,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC9G,CAAC;AAED,gGAAgG;AAEhG;;;;;;;;;;;+CAW+C;AAC/C,MAAM,UAAU,eAAe,CAAC,QAA0B,EAAE,IAAgD;IAC1G,MAAM,KAAK,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;IACrC,IAAI,OAAO,GAAG,cAAc,CAAC,gBAAgB;QAC3C,IAAI,CAAC,aAAa,EAAE,wBAAwB,OAAO,cAAc,cAAc,CAAC,gBAAgB,4CAA4C,CAAC,CAAC;IAChJ,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,aAAa,EAAE,gDAAgD,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,YAAY,IAAI,GAAG,IAAI,KAAK,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9I,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;+BAO+B;AAC/B,MAAM,UAAU,iBAAiB,CAAC,QAA0B,EAAE,IAAa;IACzE,MAAM,KAAK,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;IACrC,IAAI,OAAO,GAAG,cAAc,CAAC,gBAAgB;QAC3C,IAAI,CAAC,UAAU,EAAE,0BAA0B,OAAO,cAAc,cAAc,CAAC,gBAAgB,0EAA0E,CAAC,CAAC;IAC7K,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,EAAE,4HAA4H,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,YAAY,IAAI,GAAG,IAAI,KAAK,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvN,CAAC;AACH,CAAC"}
+{"version":3,"file":"endpoint-envelope.js","sourceRoot":"","sources":["../src/endpoint-envelope.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,oBAAoB,EAAE,aAAa,EAAwB,MAAM,wBAAwB,CAAC;AACtI,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,mGAAmG;AACnG,oGAAoG;AACpG,kEAAkE;AAClE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAsD,MAAM,qBAAqB,CAAC;AAC1H,OAAO,EAAE,cAAc,EAAE,eAAe,EAAsD,MAAM,qBAAqB,CAAC;AAE1H;sFACsF;AACtF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC;AAE/B,gGAAgG;AAEhG,MAAM,YAAY,GAAG,IAAI,GAAG,CAAS,cAAc,CAAC,CAAC;AAErD,MAAM,KAAK,GAAG,+BAA+B,CAAC;AAC9C,2FAA2F;AAC3F,MAAM,cAAc,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,KAAK,QAAQ,CAAC,CAAC;AAEjE,oGAAoG;AACpG,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IACnF,OAAO,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,IAAI,CAAC,IAAiB,EAAE,OAAe;IAC9C,MAAM,IAAI,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC;AAgFD,gGAAgG;AAEhG;;;;4FAI4F;AAC5F,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;QACxD,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,+CAA+C,CAAC,CAAC;IAC5F,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,gGAAgG;AAEhG,SAAS,QAAQ,CAAC,CAAU,EAAE,IAAY;IACxC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACzD,IAAI,CAAC,aAAa,EAAE,GAAG,IAAI,uBAAuB,CAAC,CAAC;IACtD,OAAO,CAA4B,CAAC;AACtC,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU,EAAE,IAAY;IACxC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,IAAI,CAAC,aAAa,EAAE,GAAG,IAAI,4BAA4B,CAAC,CAAC;IACtG,OAAO,CAAC,CAAC;AACX,CAAC;AAED,kFAAkF;AAClF,SAAS,SAAS,CAAC,CAAU,EAAE,IAAY;IACzC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAC5D,IAAI,CAAC,aAAa,EAAE,GAAG,IAAI,wDAAwD,CAAC,CAAC;IACvF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,sFAAsF;AACtF,SAAS,OAAO,CAAI,EAAW;IAC7B,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,aAAa,EAAG,CAAW,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED;;;;6CAI6C;AAC7C,MAAM,WAAW,GAAG,2EAA2E,CAAC;AAChG,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,MAAM,uBAAuB,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAW,CAAC;AAE5E;;;;yFAIyF;AACzF,SAAS,eAAe,CAAC,CAAU;IACjC,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IACrC,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;QAC9D,IAAI,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,qBAAqB;YACvD,IAAI,CAAC,aAAa,EAAE,mCAAmC,qBAAqB,QAAQ,CAAC,CAAC;QACxF,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/D,IAAI,CAAC,aAAa,EAAE,sEAAsE,CAAC,CAAC;QAC9F,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;YACrC,IAAI,CAAC,aAAa,EAAE,6FAA6F,CAAC,CAAC;QACrH,GAAG,CAAC,WAAW,GAAG,EAAE,CAAC;IACvB,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,CAAU,EAAE,CAAC;QACnD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,SAAS;QACjC,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC;QAC7C,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,uBAAuB,CAAC,CAAC,CAAC;YAC3D,IAAI,CAAC,aAAa,EAAE,eAAe,CAAC,YAAY,uBAAuB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACtF,4CAA4C;QAC5C,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,aAAa,EAAE,eAAe,CAAC,8BAA8B,CAAC,CAAC;QACnG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACb,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;oFACoF;AACpF,SAAS,aAAa,CAAC,CAA0B,EAAE,IAAY;IAC7D,IAAI,CAAC,CAAC,CAAC,KAAK,aAAa;QAAE,IAAI,CAAC,qBAAqB,EAAE,GAAG,IAAI,qBAAqB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,aAAa,EAAE,CAAC,CAAC;AACpI,CAAC;AAED;;mFAEmF;AACnF,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACnC,aAAa,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAC5B,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAEpE,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAG,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IACtF,MAAM,OAAO,GAA+C,EAAE,CAAC;IAC/D,KAAK,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAU,EAAE,CAAC;QACzD,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACpB,IAAI,OAAO,KAAK,UAAU;gBACxB,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,iGAAiG,CAAC,CAAC;YACtI,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,+BAA+B,CAAC,CAAC;QAC/G,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAED,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC;IACpB,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,SAAS;QAC1C,IAAI,CAAC,aAAa,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,qFAAqF,CAAC,CAAC;IACzI,IAAI,OAAO,CAAC,CAAC,aAAa,KAAK,SAAS;QAAE,IAAI,CAAC,aAAa,EAAE,gCAAgC,CAAC,CAAC;IAChG,MAAM,aAAa,GAAG,CAAC,CAAC,aAAa,CAAC;IACtC,IAAI,GAAG,KAAK,SAAS,IAAI,aAAa;QACpC,IAAI,CAAC,aAAa,EAAE,6HAA6H,CAAC,CAAC;IAErJ,IAAI,UAA8B,CAAC;IACnC,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC/B,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QACnD,IAAI,UAAU,KAAK,CAAC;YAAE,IAAI,CAAC,aAAa,EAAE,kDAAkD,CAAC,CAAC;IAChG,CAAC;SAAM,IAAI,aAAa,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QAC9C,IAAI,CAAC,aAAa,EAAE,8BAA8B,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,oDAAoD,EAAE,CAAC,CAAC;IACvI,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IAEzH,IAAI,MAAiC,CAAC;IACtC,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACvC,MAAM,GAAG;YACP,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,cAAc,CAAC;YACxC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,cAAc,CAAC;YACxC,YAAY,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,EAAE,qBAAqB,CAAC,EAAE,qBAAqB,CAAC,CAAC;YACzH,GAAG,CAAC,CAAC,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC,CAAC,eAAe,EAAE,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxH,CAAC;IACJ,CAAC;IAED,4FAA4F;IAC5F,gEAAgE;IAChE,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,IAAyB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAA4B,CAAC;IAE1I,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,MAAM,IAAI,GAAgB;QACxB,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC;QAC7B,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC;QACnC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzE,CAAC;IAEF,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzE,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;QAClD,IAAI,CAAC,aAAa,EAAE,oHAAoH,CAAC,CAAC;IAC5I,MAAM,WAAW,GAAG,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAEnD,OAAO;QACL,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,aAAa;QACtF,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,IAAI;QACJ,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC;AACJ,CAAC;AAED;;;;;;uCAMuC;AACvC,MAAM,UAAU,4BAA4B,CAAC,GAAoB,EAAE,OAAwB;IACzF,IAAI,GAAG,CAAC,EAAE,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ;QACtC,IAAI,CAAC,aAAa,EAAE,gBAAgB,GAAG,CAAC,EAAE,CAAC,QAAQ,+CAA+C,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACzH,IAAI,GAAG,CAAC,EAAE,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO;QACpC,IAAI,CAAC,aAAa,EAAE,eAAe,GAAG,CAAC,EAAE,CAAC,OAAO,8CAA8C,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC;IAErH,2FAA2F;IAC3F,yFAAyF;IACzF,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS;QACzD,IAAI,CAAC,aAAa,EAAE,uGAAuG,CAAC,CAAC;IAE/H,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC5B,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;YAC1B,IAAI,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,wDAAwD,CAAC,CAAC;IAC/I,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,IAAI,2CAA2C,CAAC,CAAC;QACpG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM;YAC/B,IAAI,CAAC,iBAAiB,EAAE,iBAAiB,GAAG,CAAC,MAAM,CAAC,KAAK,8CAA8C,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACtH,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,CAAC,CAAC,IAAI,CAAC;YAC9F,IAAI,CAAC,iBAAiB,EAAE,gGAAgG,CAAC,CAAC;IAC9H,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACjE,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM;QACxB,IAAI,CAAC,iBAAiB,EAAE,YAAY,GAAG,CAAC,IAAI,CAAC,EAAE,kDAAkD,MAAM,GAAG,CAAC,CAAC;AAChH,CAAC;AAED;2FAC2F;AAC3F,MAAM,UAAU,kBAAkB,CAAC,GAAoB,EAAE,aAAsB;IAC7E,IAAI,GAAG,CAAC,KAAK,KAAK,aAAa;QAC7B,IAAI,CAAC,gBAAgB,EAAE,UAAU,GAAG,CAAC,KAAK,kDAAkD,aAAa,GAAG,CAAC,CAAC;AAClH,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC5C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,aAAa,EAAE,cAAc,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;IACjK,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,+BAA+B,CAAC,CAAC;IACjH,IAAI,OAAoC,CAAC;IACzC,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,IAAI,CAAC,aAAa,EAAE,+BAA+B,CAAC,CAAC;QACpF,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YAC/B,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC;YAC7C,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAC1D,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,aAAa,EAAE,iBAAiB,CAAC,WAAW,IAAI,iCAAiC,CAAC,CAAC;YACxH,OAAO,CAAkB,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED;iEACiE;AACjE,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACjC,aAAa,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,SAAS;QAAE,IAAI,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC;IAC1E,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;QAAE,IAAI,CAAC,aAAa,EAAE,qCAAqC,CAAC,CAAC;IAC9F,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;QAAE,IAAI,CAAC,aAAa,EAAE,oCAAoC,CAAC,CAAC;IAC7F,MAAM,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACrF,OAAO;QACL,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE;QAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED;gGACgG;AAChG,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACjC,aAAa,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACzC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,GAAG;QAAE,IAAI,CAAC,aAAa,EAAE,yBAAyB,CAAC,CAAC;IAC3F,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;QAAE,IAAI,CAAC,aAAa,EAAE,6BAA6B,CAAC,CAAC;IACvE,MAAM,WAAW,GAAG,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACnD,OAAO,EAAE,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC9G,CAAC;AAED,gGAAgG;AAEhG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,SAAS,oBAAoB,CAAC,IAAuB,EAAE,UAA2B,EAAE,SAAiB;IACnG,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;IACzD,IAAI,KAAK,IAAI,cAAc,CAAC,gBAAgB;QAAE,OAAO;IACrD,OAAO,CAAC,KAAK,CACX,aAAa,IAAI,qBAAqB,KAAK,6CAA6C,cAAc,CAAC,gBAAgB,MAAM;QAC7H,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,2EAA2E;QACpG,qPAAqP,CACtP,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;kEAYkE;AAClE,MAAM,UAAU,eAAe,CAAC,QAA0B,EAAE,IAAgD;IAC1G,MAAM,KAAK,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChC,oBAAoB,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IAClD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,aAAa,EAAE,gDAAgD,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,YAAY,IAAI,GAAG,IAAI,KAAK,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9I,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;4CAM4C;AAC5C,MAAM,UAAU,iBAAiB,CAAC,QAA0B,EAAE,IAAa;IACzE,MAAM,KAAK,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChC,oBAAoB,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,EAAE,4HAA4H,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,YAAY,IAAI,GAAG,IAAI,KAAK,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvN,CAAC;AACH,CAAC"}

package/dist/endpoint-error.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The §13.3 endpoint ERROR primitives, split out NODE-FREE (P2 item 6): the catalog codes + the
+ * {@link EpEnvelopeError} a consuming boundary throws. The §13.6 session rail + terminal-frame codec
+ * need ONLY these, and they run in the browser console bundle — so the error must not drag in the
+ * envelope's schema/digest machinery (endpoint-envelope → schema-profile computes a digest at module
+ * load, i.e. `node:crypto`). `endpoint-envelope.ts` re-exports everything here, so no consumer's
+ * import path changes; the browser-safe modules (rail + codec) import EpEnvelopeError from HERE.
+ */
+/** The §13.3 error catalog. Extensions add codes only under reverse-DNS; any code (catalog or
+ *  extension) is one token of at most 64 bytes. */
+export declare const EP_ERROR_CODES: readonly ["bad-request", "unsupported-version", "op-mismatch", "class-mismatch", "target-mismatch", "sender-mismatch", "unauthenticated", "permission-denied", "not-found", "already-exists", "conflict", "contract-mismatch", "contract-invalid", "failed-precondition", "deadline-exceeded", "cancelled", "expired", "unavailable", "unimplemented", "resource-exhausted", "internal"];
+export type EpErrorCode = (typeof EP_ERROR_CODES)[number];
+/** One `details[]` entry: `kind` is reverse-DNS-namespaced (§13.3), the rest is open. */
+export interface EpErrorDetail {
+    kind: string;
+    [key: string]: unknown;
+}
+/** The `EndpointReply.error` shape. */
+export interface EpError {
+    code: string;
+    message: string;
+    details?: EpErrorDetail[];
+}
+/** A consuming-boundary rejection: the catalog code plus a human message. Boundaries convert it
+ *  to an `EndpointReply` error via {@link EpEnvelopeError.toEpError} (or, on reply-less planes,
+ *  to the §13.4 decision/quarantine fact carrying the same code). */
+export declare class EpEnvelopeError extends Error {
+    readonly code: EpErrorCode;
+    readonly details?: EpErrorDetail[] | undefined;
+    constructor(code: EpErrorCode, message: string, details?: EpErrorDetail[] | undefined);
+    toEpError(): EpError;
+}
+//# sourceMappingURL=endpoint-error.d.ts.map

package/dist/endpoint-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint-error.d.ts","sourceRoot":"","sources":["../src/endpoint-error.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;mDACmD;AACnD,eAAO,MAAM,cAAc,0XAMhB,CAAC;AACZ,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1D,yFAAyF;AACzF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,uCAAuC;AACvC,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;CAC3B;AAED;;qEAEqE;AACrE,qBAAa,eAAgB,SAAQ,KAAK;IAC5B,QAAQ,CAAC,IAAI,EAAE,WAAW;IAAmB,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE;gBAAtE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAW,OAAO,CAAC,EAAE,aAAa,EAAE,YAAA;IAI3F,SAAS,IAAI,OAAO;CAGrB"}

package/dist/endpoint-error.js

@@ -0,0 +1,34 @@
+/**
+ * The §13.3 endpoint ERROR primitives, split out NODE-FREE (P2 item 6): the catalog codes + the
+ * {@link EpEnvelopeError} a consuming boundary throws. The §13.6 session rail + terminal-frame codec
+ * need ONLY these, and they run in the browser console bundle — so the error must not drag in the
+ * envelope's schema/digest machinery (endpoint-envelope → schema-profile computes a digest at module
+ * load, i.e. `node:crypto`). `endpoint-envelope.ts` re-exports everything here, so no consumer's
+ * import path changes; the browser-safe modules (rail + codec) import EpEnvelopeError from HERE.
+ */
+/** The §13.3 error catalog. Extensions add codes only under reverse-DNS; any code (catalog or
+ *  extension) is one token of at most 64 bytes. */
+export const EP_ERROR_CODES = Object.freeze([
+    "bad-request", "unsupported-version", "op-mismatch", "class-mismatch", "target-mismatch",
+    "sender-mismatch", "unauthenticated", "permission-denied", "not-found", "already-exists",
+    "conflict", "contract-mismatch", "contract-invalid", "failed-precondition",
+    "deadline-exceeded", "cancelled", "expired", "unavailable", "unimplemented",
+    "resource-exhausted", "internal",
+]);
+/** A consuming-boundary rejection: the catalog code plus a human message. Boundaries convert it
+ *  to an `EndpointReply` error via {@link EpEnvelopeError.toEpError} (or, on reply-less planes,
+ *  to the §13.4 decision/quarantine fact carrying the same code). */
+export class EpEnvelopeError extends Error {
+    code;
+    details;
+    constructor(code, message, details) {
+        super(message);
+        this.code = code;
+        this.details = details;
+        this.name = "EpEnvelopeError";
+    }
+    toEpError() {
+        return { code: this.code, message: this.message, ...(this.details ? { details: this.details } : {}) };
+    }
+}
+//# sourceMappingURL=endpoint-error.js.map

package/dist/endpoint-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint-error.js","sourceRoot":"","sources":["../src/endpoint-error.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;mDACmD;AACnD,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1C,aAAa,EAAE,qBAAqB,EAAE,aAAa,EAAE,gBAAgB,EAAE,iBAAiB;IACxF,iBAAiB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,WAAW,EAAE,gBAAgB;IACxF,UAAU,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,qBAAqB;IAC1E,mBAAmB,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe;IAC3E,oBAAoB,EAAE,UAAU;CACxB,CAAC,CAAC;AAgBZ;;qEAEqE;AACrE,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACnB;IAA6C;IAAlE,YAAqB,IAAiB,EAAE,OAAe,EAAW,OAAyB;QACzF,KAAK,CAAC,OAAO,CAAC,CAAC;QADI,SAAI,GAAJ,IAAI,CAAa;QAA4B,YAAO,GAAP,OAAO,CAAkB;QAEzF,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;IACD,SAAS;QACP,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACxG,CAAC;CACF"}

package/dist/endpoint-grants.d.ts

@@ -30,12 +30,15 @@ export declare function epCallerReplyGrantRow(space: string, caller: EpCaller):
  *  mint-time read containment; delivered on the caller's own core subscription only. */
 export declare function epGoalProgressGrantRow(space: string, endpoint: string, caller: EpCaller): string;
 /** All caller-side rows for a capability set: request-publish (+ optional journal) into
- *  `pub.allow`, the reply rail into `sub.allow`. This is the STANDING rollup (`permissionsFor`
- *  mints long-lived credentials from it), so a `handle`-mode capability is refused here:
- *  handle rows are redemption-minted only (§13.2/§13.6), built by the redemption path through
- *  {@link epRequestGrantRows} directly. Deliberately NOT included: `epe` event
- *  subtrees beyond the per-goal row — read grants are minted per read capability by the
- *  granting authority (Appendix B), not implied by an invoke capability. */
+ *  `pub.allow`, the reply rail (+ the per-goal progress read for GOAL-BEARING capabilities) into
+ *  `sub.allow`. This is the STANDING rollup (`permissionsFor` mints long-lived credentials from
+ *  it), so a `handle`-mode capability is refused here: handle rows are redemption-minted only
+ *  (§13.2/§13.6), built by the redemption path through {@link epRequestGrantRows} directly.
+ *  A goal-bearing capability ({@link GOAL_BEARING_COMMANDS}: spawn/launch) adds ONE per-endpoint
+ *  {@link epGoalProgressGrantRow} — the caller may follow its OWN goal to terminal (P2 item 2, Q1);
+ *  it is the one read an invoke implies, because the subject pins the caller's own triple. Still
+ *  NOT included: any OTHER `epe` subtree — those are minted per read capability by the granting
+ *  authority (Appendix B), not implied by an invoke. */
 export declare function epCallerGrantRows(space: string, caps: EpCapability[], caller: EpCaller): {
     pub: string[];
     sub: string[];
@@ -62,6 +65,23 @@ export declare const BASELINE_SELF_LIFECYCLE_COMMANDS: readonly ["stop"];
  *  stays in the BASELINE (the v0.3 self-service tier's only op); it is the lighter self-halt. */
 export declare const SPAWN_CREATE_COMMANDS: readonly ["spawn"];
 export declare const SPAWN_OWNER_LIFECYCLE_COMMANDS: readonly ["despawn", "attach"];
+/** The spawn capability's UNTARGETED additions (the 1c grant-migration table): the connector's
+ *  persona write (`define-persona`, caller-scoped by the pinned triple) and per-agent status read
+ *  (`inspect` - the responder narrows the view to the caller's owner domain, like `ps`). These
+ *  ride the v0.3 privileged tier today; minting them with `spawn` keeps that tier's surface 1:1. */
+export declare const SPAWN_SERVICE_COMMANDS: readonly ["define-persona", "inspect"];
+/** The manager endpoint's read commands (`manager.read` class). */
+export declare const MANAGER_READ_COMMANDS: readonly ["status", "ps", "inspect", "models"];
+/** The manager endpoint's admin-class commands (`manager.admin`): capability-only + untargeted -
+ *  the broker grant (who holds the row) IS the boundary; minted ONLY into operator instruments,
+ *  NEVER an agent/spawn profile (the ratified 1c pin). */
+export declare const MANAGER_ADMIN_COMMANDS: readonly ["purge", "launch", "resume-preserved", "commit-resume", "finalize-resume", "prepare-preservation", "commit-preservation", "abort-preservation"];
+/** The ACTION commands (§13.6): submitting one accepts a GOAL, so the caller may follow its OWN
+ *  goal progress (P2 item 2). `spawn` (create) and `launch` (manifest) both serve as actions on
+ *  the manager endpoint since 2a; a caller holding one of these capabilities is granted the
+ *  per-goal live-progress read for that endpoint ({@link epGoalProgressGrantRow}), the one read an
+ *  invoke DOES imply because it is bounded to the caller's OWN goal subtree. */
+export declare const GOAL_BEARING_COMMANDS: readonly ["spawn", "launch"];
 /** `describe` on ALL endpoints (Appendix B / §13.9 "describe by default"): the ONE
  *  subject-wildcard request form in the caller grammar,
  *  `ep.one.*.describe.<cO>.<cA>.<cUid>.*` — the endpoint token is the wildcard, the command is
@@ -80,9 +100,45 @@ export declare function baselineCallerCapabilities(): EpCapability[];
  *  three that act on an existing agent ride owner mode, target owner pinned to the CALLER's own
  *  (§13.2: an owner-mode standing mint never names a foreign owner). */
 export declare function spawnCallerCapabilities(callerOwner: string): EpCapability[];
+/** An operator INSTRUMENT's capability set (the 1c grant-migration table's admin row), per the
+ *  instrument's v0.3 control tier - the SAME mint sites that grant a `ctl.<tier>` row today
+ *  (`control-caller-*` / `deployer`) consume this for the ep rails; no new minting authority.
+ *
+ *  `privileged` (the ps/start instrument): the manager reads + untargeted `spawn` +
+ *  `define-persona` - structurally barred from cross-agent reach, exactly like its ctl row.
+ *
+ *  `admin` (the stop/attach/deploy instrument): everything above plus ANY-mode `despawn`/`attach`
+ *  (tOwner `"*"`) and the `manager.admin` command family. The 1c admin-reach decision: operator
+ *  cross-agent terminal/interactive ops ride authz-mode `any` on the SAME commands (no wire
+ *  synonym) - the any-mode subject row is minted ONLY into operator-authorized credentials: the
+ *  `control-caller-admin`/`deployer`/`teardown` instruments AND an agent credential explicitly
+ *  granted the `admin` capability (which by design mirrors the full admin instrument set - its
+ *  ctl-tier equivalent already held `ctl.<admin>`, so this is parity, not a new escalation). An
+ *  ordinary agent, incl. the `spawn` capability, never carries it. So the broker grant is the tier boundary exactly as
+ *  `ctl.<admin>` is today, and the responder maps mode `any` to its admin authorization path. */
+export declare function operatorInstrumentCapabilities(tier: "privileged" | "admin"): EpCapability[];
+/** The SAME tier set, pinned to ONE instance — the issuance `--on <instanceId>` was always meant to
+ *  get. These instruments are ONE-SHOT, minted per control call, and the resolve that chose the
+ *  instance runs BEFORE the mint, so the exact id can be handed down and the emitter's
+ *  `if (cap.instanceId)` branch produces exactly `ep.inst.<endpoint>.<iid>.<command>` for THIS
+ *  invocation and nothing else. No wildcard instance is minted anywhere, which is what keeps the
+ *  `inst-route-grant` boundary intact: instance addressing stays with the per-invocation operator
+ *  instruments that already hold it, and a plain, spawn-capable, or observer credential still gets
+ *  no instance route at all.
+ *
+ *  `describe` is included EXPLICITLY. The baseline describe row is class-rail only
+ *  ({@link epDescribeAllGrantRow}), so without this the pinned RESOLVE that must precede a pinned
+ *  invoke is refused at the broker — and refused invisibly, because the client renders that refusal
+ *  as a describe timeout. Here it is a concrete endpoint+instance capability, not the normative
+ *  wildcard form, so the exact-arity discipline of the caller grammar is preserved. */
+export declare function instancePinnedInstrumentCapabilities(tier: "privileged" | "admin", instanceId: string): EpCapability[];
 /** All BASELINE caller rows (Appendix B): the wildcard describe form + the baseline capability
  *  rollup into `pub.allow`, and the caller's reply rail into `sub.allow` — ALWAYS present (the
- *  baseline implies the reply read even when no per-capability rows are minted). */
+ *  baseline implies the reply read even when no per-capability rows are minted). The §13.7
+ *  contract-store FETCH (the Direct Get API on the EPC stream) rides the baseline too: describe
+ *  answers digests, and a caller that may describe may fetch-verify-compile the schemas those
+ *  digests name (content-addressed public artifacts — a digest is the read capability; the
+ *  per-caller authorization surface is the describe VIEW, never the schema bytes). */
 export declare function epBaselineGrantRows(space: string, caller: EpCaller): {
     pub: string[];
     sub: string[];

package/dist/endpoint-grants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"endpoint-grants.d.ts","sourceRoot":"","sources":["../src/endpoint-grants.ts"],"names":[],"mappings":"AAYA,OAAO,EAEL,KAAK,QAAQ,EAAE,KAAK,QAAQ,EAE7B,MAAM,wBAAwB,CAAC;AAEhC;;;;;;;iEAOiE;AACjE,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,CAAC,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,mFAAmF;IACnF,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAwBD;;2FAE2F;AAC3F,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,GAAG,MAAM,EAAE,CAS/F;AAED;+FAC+F;AAC/F,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,GAAG,MAAM,CAG5F;AAED,kGAAkG;AAClG,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,MAAM,CAE7E;AAED;;wFAEwF;AACxF,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,MAAM,CAEhG;AAED;;;;;;4EAM4E;AAC5E,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,YAAY,EAAE,EACpB,MAAM,EAAE,QAAQ,GACf;IAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,EAAE,CAAA;CAAE,CASlC;AAcD;;;;oFAIoF;AACpF,eAAO,MAAM,0BAA0B,aAAa,CAAC;AACrD,eAAO,MAAM,0BAA0B,oCAAoD,CAAC;AAC5F;4EAC4E;AAC5E,eAAO,MAAM,2BAA2B,YAAY,CAAC;AACrD,eAAO,MAAM,gCAAgC,mBAAmC,CAAC;AACjF;;;;;;;;iGAQiG;AACjG,eAAO,MAAM,qBAAqB,oBAAoC,CAAC;AACvE,eAAO,MAAM,8BAA8B,gCAAgD,CAAC;AAU5F;;;;;;;iEAOiE;AACjE,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,MAAM,CAE7E;AAED;iFACiF;AACjF,wBAAgB,0BAA0B,IAAI,YAAY,EAAE,CAK3D;AAED;;;;wEAIwE;AACxE,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,YAAY,EAAE,CAQ3E;AAED;;oFAEoF;AACpF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG;IAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,EAAE,CAAA;CAAE,CAGrG;AAED;;;;;;;gGAOgG;AAChG,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAQnH;AAED;;kFAEkF;AAClF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAU/G;AAED;;;;;;;;;;yEAUyE;AACzE,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAA;CAAE,GAC1F;IAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,EAAE,CAAA;CAAE,CAQlC"}
+{"version":3,"file":"endpoint-grants.d.ts","sourceRoot":"","sources":["../src/endpoint-grants.ts"],"names":[],"mappings":"AAaA,OAAO,EAEL,KAAK,QAAQ,EAAE,KAAK,QAAQ,EAE7B,MAAM,wBAAwB,CAAC;AAEhC;;;;;;;iEAOiE;AACjE,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,CAAC,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,mFAAmF;IACnF,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAwBD;;2FAE2F;AAC3F,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,GAAG,MAAM,EAAE,CAS/F;AAED;+FAC+F;AAC/F,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,GAAG,MAAM,CAG5F;AAED,kGAAkG;AAClG,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,MAAM,CAE7E;AAED;;wFAEwF;AACxF,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,MAAM,CAEhG;AAED;;;;;;;;;wDASwD;AACxD,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,YAAY,EAAE,EACpB,MAAM,EAAE,QAAQ,GACf;IAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,EAAE,CAAA;CAAE,CAalC;AAcD;;;;oFAIoF;AACpF,eAAO,MAAM,0BAA0B,aAAa,CAAC;AACrD,eAAO,MAAM,0BAA0B,oCAAoD,CAAC;AAC5F;4EAC4E;AAC5E,eAAO,MAAM,2BAA2B,YAAY,CAAC;AACrD,eAAO,MAAM,gCAAgC,mBAAmC,CAAC;AACjF;;;;;;;;iGAQiG;AACjG,eAAO,MAAM,qBAAqB,oBAAoC,CAAC;AACvE,eAAO,MAAM,8BAA8B,gCAAgD,CAAC;AAC5F;;;oGAGoG;AACpG,eAAO,MAAM,sBAAsB,wCAAwD,CAAC;AAG5F,mEAAmE;AACnE,eAAO,MAAM,qBAAqB,gDAAgE,CAAC;AACnG;;0DAE0D;AAC1D,eAAO,MAAM,sBAAsB,2JAIxB,CAAC;AAEZ;;;;gFAIgF;AAChF,eAAO,MAAM,qBAAqB,8BAA8C,CAAC;AAcjF;;;;;;;iEAOiE;AACjE,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,MAAM,CAE7E;AAED;iFACiF;AACjF,wBAAgB,0BAA0B,IAAI,YAAY,EAAE,CAK3D;AAED;;;;wEAIwE;AACxE,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,YAAY,EAAE,CAS3E;AAED;;;;;;;;;;;;;;;iGAeiG;AACjG,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,GAAG,YAAY,EAAE,CAsB3F;AAED;;;;;;;;;;;;;uFAauF;AACvF,wBAAgB,oCAAoC,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,YAAY,EAAE,CAMrH;AAED;;;;;;sFAMsF;AACtF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG;IAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,EAAE,CAAA;CAAE,CAcrG;AAED;;;;;;;gGAOgG;AAChG,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAQnH;AAED;;kFAEkF;AAClF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAU/G;AAED;;;;;;;;;;yEAUyE;AACzE,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,EAAE,CAAA;CAAE,GAC1F;IAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,EAAE,CAAA;CAAE,CAQlC"}

package/dist/endpoint-grants.js

@@ -10,6 +10,7 @@
  * the service registry machinery.
  */
 import { spacePrefix } from "./subjects.js";
+import { epcStreamName } from "./endpoint-binding.js";
 import { endpointToken, assertCommandToken, assertLifecycleToken, assertBoundedOwner, epCallerReplyFilter, epResponderReplyPattern, epClassQueueGroup, } from "./endpoint-subjects.js";
 /** Grant-row token block for a capability's authz/target segment, enforcing the §13.2 minting
  *  rules per mode: `owner`/`child` standing mints pin `<tOwner>` to the caller's own owner
@@ -62,22 +63,31 @@ export function epGoalProgressGrantRow(space, endpoint, caller) {
     return `${spacePrefix(space)}.epe.${endpointToken(endpoint)}.*.*.goal.${callerBlock(caller)}.>`;
 }
 /** All caller-side rows for a capability set: request-publish (+ optional journal) into
- *  `pub.allow`, the reply rail into `sub.allow`. This is the STANDING rollup (`permissionsFor`
- *  mints long-lived credentials from it), so a `handle`-mode capability is refused here:
- *  handle rows are redemption-minted only (§13.2/§13.6), built by the redemption path through
- *  {@link epRequestGrantRows} directly. Deliberately NOT included: `epe` event
- *  subtrees beyond the per-goal row — read grants are minted per read capability by the
- *  granting authority (Appendix B), not implied by an invoke capability. */
+ *  `pub.allow`, the reply rail (+ the per-goal progress read for GOAL-BEARING capabilities) into
+ *  `sub.allow`. This is the STANDING rollup (`permissionsFor` mints long-lived credentials from
+ *  it), so a `handle`-mode capability is refused here: handle rows are redemption-minted only
+ *  (§13.2/§13.6), built by the redemption path through {@link epRequestGrantRows} directly.
+ *  A goal-bearing capability ({@link GOAL_BEARING_COMMANDS}: spawn/launch) adds ONE per-endpoint
+ *  {@link epGoalProgressGrantRow} — the caller may follow its OWN goal to terminal (P2 item 2, Q1);
+ *  it is the one read an invoke implies, because the subject pins the caller's own triple. Still
+ *  NOT included: any OTHER `epe` subtree — those are minted per read capability by the granting
+ *  authority (Appendix B), not implied by an invoke. */
 export function epCallerGrantRows(space, caps, caller) {
     const pub = [];
+    const progressEndpoints = [];
     for (const cap of caps) {
         if (cap.target?.mode === "handle")
             throw new Error(`a "handle"-mode capability on "${cap.endpoint}.${cap.command}" is redemption-minted only (SPEC 13.2), never a standing capability`);
         pub.push(...epRequestGrantRows(space, cap, caller));
         if (cap.journal)
             pub.push(epJournalGrantRow(space, cap, caller));
+        if (GOAL_BEARING_SET.has(cap.command) && !progressEndpoints.includes(cap.endpoint))
+            progressEndpoints.push(cap.endpoint);
     }
-    return { pub, sub: caps.length ? [epCallerReplyGrantRow(space, caller)] : [] };
+    const sub = caps.length ? [epCallerReplyGrantRow(space, caller)] : [];
+    for (const e of progressEndpoints)
+        sub.push(epGoalProgressGrantRow(space, e, caller));
+    return { pub, sub };
 }
 // ---- the Appendix-B BASELINE capability set (SPEC Appendix B "Agent", §13.9 agent row) ------------
 // "every agent gets the baseline set (`describe` on all endpoints; the delivery endpoint's durable
@@ -112,6 +122,29 @@ export const BASELINE_SELF_LIFECYCLE_COMMANDS = Object.freeze(["stop"]);
  *  stays in the BASELINE (the v0.3 self-service tier's only op); it is the lighter self-halt. */
 export const SPAWN_CREATE_COMMANDS = Object.freeze(["spawn"]);
 export const SPAWN_OWNER_LIFECYCLE_COMMANDS = Object.freeze(["despawn", "attach"]);
+/** The spawn capability's UNTARGETED additions (the 1c grant-migration table): the connector's
+ *  persona write (`define-persona`, caller-scoped by the pinned triple) and per-agent status read
+ *  (`inspect` - the responder narrows the view to the caller's owner domain, like `ps`). These
+ *  ride the v0.3 privileged tier today; minting them with `spawn` keeps that tier's surface 1:1. */
+export const SPAWN_SERVICE_COMMANDS = Object.freeze(["define-persona", "inspect"]);
+// ---- operator INSTRUMENT capability sets (the 1c grant-migration table's admin row) --------------
+/** The manager endpoint's read commands (`manager.read` class). */
+export const MANAGER_READ_COMMANDS = Object.freeze(["status", "ps", "inspect", "models"]);
+/** The manager endpoint's admin-class commands (`manager.admin`): capability-only + untargeted -
+ *  the broker grant (who holds the row) IS the boundary; minted ONLY into operator instruments,
+ *  NEVER an agent/spawn profile (the ratified 1c pin). */
+export const MANAGER_ADMIN_COMMANDS = Object.freeze([
+    "purge", "launch",
+    "resume-preserved", "commit-resume", "finalize-resume",
+    "prepare-preservation", "commit-preservation", "abort-preservation",
+]);
+/** The ACTION commands (§13.6): submitting one accepts a GOAL, so the caller may follow its OWN
+ *  goal progress (P2 item 2). `spawn` (create) and `launch` (manifest) both serve as actions on
+ *  the manager endpoint since 2a; a caller holding one of these capabilities is granted the
+ *  per-goal live-progress read for that endpoint ({@link epGoalProgressGrantRow}), the one read an
+ *  invoke DOES imply because it is bounded to the caller's OWN goal subtree. */
+export const GOAL_BEARING_COMMANDS = Object.freeze(["spawn", "launch"]);
+const GOAL_BEARING_SET = new Set(GOAL_BEARING_COMMANDS);
 // PRIVATE module-load snapshots of the command vocabularies: the builders below map over THESE,
 // never the live exports, so the minted surface survives even a hypothetical defeat of the
 // freezes above (the seam-snapshot half of the afa715b closure pattern).
@@ -119,6 +152,9 @@ const DELIVERY_COMMANDS_SNAP = Object.freeze([...BASELINE_DELIVERY_COMMANDS]);
 const SELF_LIFECYCLE_SNAP = Object.freeze([...BASELINE_SELF_LIFECYCLE_COMMANDS]);
 const SPAWN_CREATE_SNAP = Object.freeze([...SPAWN_CREATE_COMMANDS]);
 const SPAWN_OWNER_SNAP = Object.freeze([...SPAWN_OWNER_LIFECYCLE_COMMANDS]);
+const SPAWN_SERVICE_SNAP = Object.freeze([...SPAWN_SERVICE_COMMANDS]);
+const MANAGER_READ_SNAP = Object.freeze([...MANAGER_READ_COMMANDS]);
+const MANAGER_ADMIN_SNAP = Object.freeze([...MANAGER_ADMIN_COMMANDS]);
 /** `describe` on ALL endpoints (Appendix B / §13.9 "describe by default"): the ONE
  *  subject-wildcard request form in the caller grammar,
  *  `ep.one.*.describe.<cO>.<cA>.<cUid>.*` — the endpoint token is the wildcard, the command is
@@ -150,14 +186,87 @@ export function spawnCallerCapabilities(callerOwner) {
             endpoint: BASELINE_LIFECYCLE_ENDPOINT, command,
             target: { mode: "owner", tOwner: callerOwner },
         })),
+        ...SPAWN_SERVICE_SNAP.map((command) => ({ endpoint: BASELINE_LIFECYCLE_ENDPOINT, command })),
+    ];
+}
+/** An operator INSTRUMENT's capability set (the 1c grant-migration table's admin row), per the
+ *  instrument's v0.3 control tier - the SAME mint sites that grant a `ctl.<tier>` row today
+ *  (`control-caller-*` / `deployer`) consume this for the ep rails; no new minting authority.
+ *
+ *  `privileged` (the ps/start instrument): the manager reads + untargeted `spawn` +
+ *  `define-persona` - structurally barred from cross-agent reach, exactly like its ctl row.
+ *
+ *  `admin` (the stop/attach/deploy instrument): everything above plus ANY-mode `despawn`/`attach`
+ *  (tOwner `"*"`) and the `manager.admin` command family. The 1c admin-reach decision: operator
+ *  cross-agent terminal/interactive ops ride authz-mode `any` on the SAME commands (no wire
+ *  synonym) - the any-mode subject row is minted ONLY into operator-authorized credentials: the
+ *  `control-caller-admin`/`deployer`/`teardown` instruments AND an agent credential explicitly
+ *  granted the `admin` capability (which by design mirrors the full admin instrument set - its
+ *  ctl-tier equivalent already held `ctl.<admin>`, so this is parity, not a new escalation). An
+ *  ordinary agent, incl. the `spawn` capability, never carries it. So the broker grant is the tier boundary exactly as
+ *  `ctl.<admin>` is today, and the responder maps mode `any` to its admin authorization path. */
+export function operatorInstrumentCapabilities(tier) {
+    const caps = [
+        ...MANAGER_READ_SNAP.map((command) => ({
+            endpoint: BASELINE_LIFECYCLE_ENDPOINT, command,
+            // `ps` is the CLASS-SCATTER read (P2 item 3, `cotal ps` default): the instrument publishes it
+            // on the `all` scatter rail to gather every instance's rows in a multi-manager space. The
+            // other reads stay `one`-only (anycast, or `inst` when a resolve pins `--on`).
+            ...(command === "ps" ? { routes: ["one", "all"] } : {}),
+        })),
+        ...SPAWN_CREATE_SNAP.map((command) => ({ endpoint: BASELINE_LIFECYCLE_ENDPOINT, command })),
+        { endpoint: BASELINE_LIFECYCLE_ENDPOINT, command: "define-persona" },
+    ];
+    if (tier === "admin") {
+        caps.push(...SPAWN_OWNER_SNAP.map((command) => ({
+            endpoint: BASELINE_LIFECYCLE_ENDPOINT, command,
+            target: { mode: "any", tOwner: "*" },
+        })), ...MANAGER_ADMIN_SNAP.map((command) => ({ endpoint: BASELINE_LIFECYCLE_ENDPOINT, command })));
+    }
+    return caps;
+}
+/** The SAME tier set, pinned to ONE instance — the issuance `--on <instanceId>` was always meant to
+ *  get. These instruments are ONE-SHOT, minted per control call, and the resolve that chose the
+ *  instance runs BEFORE the mint, so the exact id can be handed down and the emitter's
+ *  `if (cap.instanceId)` branch produces exactly `ep.inst.<endpoint>.<iid>.<command>` for THIS
+ *  invocation and nothing else. No wildcard instance is minted anywhere, which is what keeps the
+ *  `inst-route-grant` boundary intact: instance addressing stays with the per-invocation operator
+ *  instruments that already hold it, and a plain, spawn-capable, or observer credential still gets
+ *  no instance route at all.
+ *
+ *  `describe` is included EXPLICITLY. The baseline describe row is class-rail only
+ *  ({@link epDescribeAllGrantRow}), so without this the pinned RESOLVE that must precede a pinned
+ *  invoke is refused at the broker — and refused invisibly, because the client renders that refusal
+ *  as a describe timeout. Here it is a concrete endpoint+instance capability, not the normative
+ *  wildcard form, so the exact-arity discipline of the caller grammar is preserved. */
+export function instancePinnedInstrumentCapabilities(tier, instanceId) {
+    assertLifecycleToken(instanceId, "instanceId"); // fail loud at mint on a malformed id, never widen a subject
+    return [
+        { endpoint: BASELINE_LIFECYCLE_ENDPOINT, command: "describe", instanceId },
+        ...operatorInstrumentCapabilities(tier).map((cap) => ({ ...cap, instanceId })),
     ];
 }
 /** All BASELINE caller rows (Appendix B): the wildcard describe form + the baseline capability
  *  rollup into `pub.allow`, and the caller's reply rail into `sub.allow` — ALWAYS present (the
- *  baseline implies the reply read even when no per-capability rows are minted). */
+ *  baseline implies the reply read even when no per-capability rows are minted). The §13.7
+ *  contract-store FETCH (the Direct Get API on the EPC stream) rides the baseline too: describe
+ *  answers digests, and a caller that may describe may fetch-verify-compile the schemas those
+ *  digests name (content-addressed public artifacts — a digest is the read capability; the
+ *  per-caller authorization surface is the describe VIEW, never the schema bytes). */
 export function epBaselineGrantRows(space, caller) {
     const base = epCallerGrantRows(space, baselineCallerCapabilities(), caller);
-    return { pub: [epDescribeAllGrantRow(space, caller), ...base.pub], sub: [epCallerReplyGrantRow(space, caller)] };
+    return {
+        pub: [
+            epDescribeAllGrantRow(space, caller),
+            // ONE subject-scoped Direct Get row (the `DIRECT.GET.<stream>.<subject>` form the client's
+            // last_by_subj read rides), pinned to the epc subject space — never the bare/stream-wide
+            // form. The D32 matrix audit exempts exactly this row shape from the untrusted-profile
+            // control-surface prohibition (the store is public content-addressed artifacts).
+            `$JS.API.DIRECT.GET.${epcStreamName(space)}.${spacePrefix(space)}.epc.>`,
+            ...base.pub,
+        ],
+        sub: [epCallerReplyGrantRow(space, caller)],
+    };
 }
 /** One registered command's serve-subscribe rows (§13.9 "Serve subscribe"), per registered
  *  command and never a cross-command `>`: