@cotal-ai/core 0.81.1 → 0.82.0

package/dist/delegated-recovery.d.ts

@@ -0,0 +1,220 @@
+import type { RetainedAgentAuthority } from "./auth-provider.js";
+import { type RemoteDelegatedUserIntentExecutionRequest, type RemoteManagerEnvelope } from "./remote-manager-authority.js";
+export interface DelegatedRecoveryTarget {
+    owner: string;
+    actor: string;
+    lifecycleUid: string;
+}
+export interface DelegatedRecoveryOrigin {
+    space: string;
+    accountPublicKey: string;
+    managerInstanceId: string;
+    managerLifecycleUid: string;
+    assignmentRevision: number;
+    enrollmentRegistrationRevision: number;
+    enrollmentRegistrationDigest: string;
+    enrollmentServeEpoch: number;
+    intentId: string;
+    target: DelegatedRecoveryTarget;
+}
+export interface DelegatedRecoveryLaunchPlan {
+    agent: string;
+    model?: string;
+    variant?: string;
+    events: boolean;
+    sourceDigest: string;
+}
+export interface DelegatedRecoveryDescriptor {
+    v: 1;
+    intentId: string;
+    origin: DelegatedRecoveryOrigin;
+    target: DelegatedRecoveryTarget;
+    runtimeKind: string;
+    runtimeKey: string;
+    launchIdentity: DelegatedRecoveryLaunchPlan & {
+        role?: string;
+        spawner: string;
+        authorityParent: string;
+    };
+    authorityDigest: string;
+    localStoreBindingDigest: string;
+    localStoreIdentityDigest: string;
+}
+export interface DelegatedRecoveryLocalProof {
+    storeBindingDigest: string;
+    storeIdentityDigest: string;
+    actorTokenDigest: string;
+    sentinelDigest: string;
+}
+export interface DelegatedRecoveryScanBinding {
+    scanId: string;
+    accountPublicKey: string;
+    managerInstanceId: string;
+    managerLifecycleUid: string;
+    assignmentRevision: number;
+    currentRegistrationRevision: number;
+    currentServeEpoch: number;
+    sourceRevision: number;
+    memberCount: number;
+    membersDigest: string;
+}
+export declare const DELEGATED_RECOVERY_REASONS: readonly ["provider-unknown", "store-unavailable", "authority-unavailable", "identity-unverified", "descriptor-incomplete", "retiring", "authority-drift", "identity-changed", "scope-changed"];
+export type DelegatedRecoveryReason = (typeof DELEGATED_RECOVERY_REASONS)[number];
+export interface DelegatedRecoveryRecord {
+    intentId: string;
+    intentRevision: number;
+    recoveryRevision: number;
+    target: DelegatedRecoveryTarget;
+    phase: "incomplete" | "prepared" | "create-unknown" | "eligible" | "bound" | "retiring" | "terminal";
+    descriptor: DelegatedRecoveryDescriptor | null;
+    descriptorDigest: string | null;
+    authority: RetainedAgentAuthority | null;
+    localProof: DelegatedRecoveryLocalProof | null;
+    startedAt: string | null;
+    executionIdentityDigest: string | null;
+    reasonCode: DelegatedRecoveryReason | null;
+}
+interface RecoveryEnvelope extends RemoteManagerEnvelope {
+    v: 1;
+    kind: "manager-delegated-recovery";
+    actor: "cli";
+    accountPublicKey: string;
+    assignmentRevision: number;
+    currentRegistrationRevision: number;
+    serveEpoch: number;
+}
+type RecoveryOperation = {
+    operation: "confirm";
+    body: {
+        intentId: string;
+        target: DelegatedRecoveryTarget;
+        expectedIntentRevision: number;
+        localProof: DelegatedRecoveryLocalProof;
+    };
+} | {
+    operation: "scan";
+    body: {
+        scanBinding?: DelegatedRecoveryScanBinding;
+        cursor?: string;
+    };
+} | {
+    operation: "claim";
+    body: {
+        intentId: string;
+        target: DelegatedRecoveryTarget;
+        expectedRecoveryRevision: number;
+        expectedOrigin: DelegatedRecoveryOrigin;
+        attemptId: string;
+        scanBinding: DelegatedRecoveryScanBinding;
+    };
+} | {
+    operation: "settle";
+    body: {
+        claimId: string;
+        expectedRecoveryRevision: number;
+        settleId: string;
+    } & ({
+        observation: "bound";
+        executionIdentityDigest: string;
+    } | {
+        observation: "held";
+        reasonCode: DelegatedRecoveryReason;
+    });
+} | {
+    operation: "finish";
+    body: {
+        scanBinding: DelegatedRecoveryScanBinding;
+        finishId: string;
+        expectedScopeRevision: number;
+    };
+} | {
+    operation: "watch";
+    body: {
+        afterRevision: number;
+    };
+};
+/** Contract only. A host must opt in; the existing authority dispatch does not admit this family. */
+export type RemoteDelegatedRecoveryRequest = RecoveryEnvelope & RecoveryOperation;
+type RecoveryResultEnvelope = Pick<RecoveryEnvelope, "v" | "kind" | "space" | "accountPublicKey" | "assignmentRevision" | "instanceId" | "managerLifecycleUid" | "currentRegistrationRevision" | "serveEpoch" | "requestId">;
+type RecoveryResult = {
+    operation: "confirm";
+    result: {
+        intentId: string;
+        target: DelegatedRecoveryTarget;
+        intentRevision: number;
+        recoveryRevision: number;
+        prepared: true;
+    };
+} | {
+    operation: "scan";
+    result: {
+        scanBinding: DelegatedRecoveryScanBinding;
+        records: DelegatedRecoveryRecord[];
+        nextCursor: string | null;
+        complete: boolean;
+    };
+} | {
+    operation: "claim";
+    result: {
+        claimId: string;
+        attemptId: string;
+        record: DelegatedRecoveryRecord;
+        claimEpoch: number;
+    };
+} | {
+    operation: "settle";
+    result: {
+        claimId: string;
+        settleId: string;
+        recoveryRevision: number;
+        observation: "bound" | "held";
+    };
+} | {
+    operation: "finish";
+    result: {
+        finishId: string;
+        scanId: string;
+        scopeRevision: number;
+        admission: "open";
+    };
+} | {
+    operation: "watch";
+    result: {
+        revision: number;
+        scanInvalidated: boolean;
+    };
+};
+export type RemoteDelegatedRecoveryResult = RecoveryResultEnvelope & (({
+    ok: true;
+} & RecoveryResult) | {
+    ok: false;
+    operation: RecoveryOperation["operation"];
+    error: {
+        code: "bad-request" | "permission-denied" | "conflict" | "unavailable" | "failed-precondition" | "unimplemented";
+        reasonCode?: DelegatedRecoveryReason;
+    };
+});
+/** The separate parser keeps legacy hosts rejecting the extended launch instead of ignoring it. */
+export type RemoteDelegatedRecoveryLaunchRequest = Omit<RemoteDelegatedUserIntentExecutionRequest, "execute"> & {
+    execute: {
+        operation: "launch";
+        target: {
+            actor: string;
+            tokenHash: string;
+        };
+        recoveryPlan: {
+            runtimeKind: string;
+            launch: DelegatedRecoveryLaunchPlan;
+            localStoreBindingDigest: string;
+            localStoreIdentityDigest: string;
+        };
+    };
+};
+export declare function parseDelegatedRecoveryDescriptor(raw: unknown): DelegatedRecoveryDescriptor;
+/** Parse structure and scope bindings; fresh host authority and durable CAS remain separate checks. */
+export declare function parseRemoteDelegatedRecoveryRequest(raw: unknown): RemoteDelegatedRecoveryRequest;
+export declare function parseRemoteDelegatedRecoveryLaunchRequest(raw: unknown): RemoteDelegatedRecoveryLaunchRequest;
+/** Bind every response to its request before a caller may act on any returned record. */
+export declare function parseRemoteDelegatedRecoveryResult(raw: unknown, request: RemoteDelegatedRecoveryRequest): RemoteDelegatedRecoveryResult;
+export {};
+//# sourceMappingURL=delegated-recovery.d.ts.map

package/dist/delegated-recovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegated-recovery.d.ts","sourceRoot":"","sources":["../src/delegated-recovery.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAKjE,OAAO,EAGL,KAAK,yCAAyC,EAC9C,KAAK,qBAAqB,EAC3B,MAAM,+BAA+B,CAAC;AAGvC,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,8BAA8B,EAAE,MAAM,CAAC;IACvC,4BAA4B,EAAE,MAAM,CAAC;IACrC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,uBAAuB,CAAC;CACjC;AAED,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,2BAA2B;IAC1C,CAAC,EAAE,CAAC,CAAC;IACL,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,uBAAuB,CAAC;IAChC,MAAM,EAAE,uBAAuB,CAAC;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,2BAA2B,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1G,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,MAAM,CAAC;IAChC,wBAAwB,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,2BAA2B;IAC1C,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,4BAA4B;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,2BAA2B,EAAE,MAAM,CAAC;IACpC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,eAAO,MAAM,0BAA0B,iMAG5B,CAAC;AACZ,MAAM,MAAM,uBAAuB,GAAG,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC;AAElF,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,uBAAuB,CAAC;IAChC,KAAK,EAAE,YAAY,GAAG,UAAU,GAAG,gBAAgB,GAAG,UAAU,GAAG,OAAO,GAAG,UAAU,GAAG,UAAU,CAAC;IACrG,UAAU,EAAE,2BAA2B,GAAG,IAAI,CAAC;IAC/C,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,SAAS,EAAE,sBAAsB,GAAG,IAAI,CAAC;IACzC,UAAU,EAAE,2BAA2B,GAAG,IAAI,CAAC;IAC/C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,UAAU,EAAE,uBAAuB,GAAG,IAAI,CAAC;CAC5C;AAED,UAAU,gBAAiB,SAAQ,qBAAqB;IACtD,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,4BAA4B,CAAC;IACnC,KAAK,EAAE,KAAK,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,2BAA2B,EAAE,MAAM,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,KAAK,iBAAiB,GAClB;IAAE,SAAS,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,uBAAuB,CAAC;QAAC,sBAAsB,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,2BAA2B,CAAA;KAAE,CAAA;CAAE,GAC9J;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE;QAAE,WAAW,CAAC,EAAE,4BAA4B,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAC5F;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,uBAAuB,CAAC;QAAC,wBAAwB,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,uBAAuB,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,4BAA4B,CAAA;KAAE,CAAA;CAAE,GAC5N;IAAE,SAAS,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,wBAAwB,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,CAAC;QAAE,WAAW,EAAE,OAAO,CAAC;QAAC,uBAAuB,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,uBAAuB,CAAA;KAAE,CAAC,CAAA;CAAE,GACnO;IAAE,SAAS,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE;QAAE,WAAW,EAAE,4BAA4B,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,qBAAqB,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAC7H;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAE5D,qGAAqG;AACrG,MAAM,MAAM,8BAA8B,GAAG,gBAAgB,GAAG,iBAAiB,CAAC;AAElF,KAAK,sBAAsB,GAAG,IAAI,CAAC,gBAAgB,EACjD,GAAG,GAAG,MAAM,GAAG,OAAO,GAAG,kBAAkB,GAAG,oBAAoB,GAAG,YAAY,GACjF,qBAAqB,GAAG,6BAA6B,GAAG,YAAY,GAAG,WAAW,CAAC,CAAC;AAEtF,KAAK,cAAc,GACf;IAAE,SAAS,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,uBAAuB,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAA;KAAE,CAAA;CAAE,GACzJ;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE;QAAE,WAAW,EAAE,4BAA4B,CAAC;QAAC,OAAO,EAAE,uBAAuB,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,GAC9J;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,uBAAuB,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAC3H;IAAE,SAAS,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,GAAG,MAAM,CAAA;KAAE,CAAA;CAAE,GAC/H;IAAE,SAAS,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAC/G;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,CAAC;AAEnF,MAAM,MAAM,6BAA6B,GAAG,sBAAsB,GAAG,CACjE,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG,cAAc,CAAC,GAC/B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,SAAS,EAAE,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAAC,KAAK,EAAE;QAAE,IAAI,EAAE,aAAa,GAAG,mBAAmB,GAAG,UAAU,GAAG,aAAa,GAAG,qBAAqB,GAAG,eAAe,CAAC;QAAC,UAAU,CAAC,EAAE,uBAAuB,CAAA;KAAE,CAAA;CAAE,CAC9N,CAAC;AAEF,mGAAmG;AACnG,MAAM,MAAM,oCAAoC,GAAG,IAAI,CAAC,yCAAyC,EAAE,SAAS,CAAC,GAAG;IAC9G,OAAO,EAAE;QACP,SAAS,EAAE,QAAQ,CAAC;QACpB,MAAM,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC;QAC7C,YAAY,EAAE;YACZ,WAAW,EAAE,MAAM,CAAC;YACpB,MAAM,EAAE,2BAA2B,CAAC;YACpC,uBAAuB,EAAE,MAAM,CAAC;YAChC,wBAAwB,EAAE,MAAM,CAAC;SAClC,CAAC;KACH,CAAC;CACH,CAAC;AA0EF,wBAAgB,gCAAgC,CAAC,GAAG,EAAE,OAAO,GAAG,2BAA2B,CAc1F;AAED,uGAAuG;AACvG,wBAAgB,mCAAmC,CAAC,GAAG,EAAE,OAAO,GAAG,8BAA8B,CA6ChG;AAED,wBAAgB,yCAAyC,CAAC,GAAG,EAAE,OAAO,GAAG,oCAAoC,CAQ5G;AA0BD,yFAAyF;AACzF,wBAAgB,kCAAkC,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,8BAA8B,GAAG,6BAA6B,CAuDvI"}

package/dist/delegated-recovery.js

@@ -0,0 +1,277 @@
+import { canonicalJson, contractDigest } from "./canonical.js";
+import { EpEnvelopeError } from "./endpoint-error.js";
+import { isAccountNkey } from "./identity.js";
+import { managedRuntimeKey } from "./managed-handoff.js";
+import { parseRemoteDelegatedUserIntentExecutionRequest, parseRemoteManagerEnvelope, } from "./remote-manager-authority.js";
+import { assertDerivedOwnerToken, assertLifecycleToken, assertValidOwnerToken, parsePrincipalKey } from "./subjects.js";
+export const DELEGATED_RECOVERY_REASONS = Object.freeze([
+    "provider-unknown", "store-unavailable", "authority-unavailable", "identity-unverified",
+    "descriptor-incomplete", "retiring", "authority-drift", "identity-changed", "scope-changed",
+]);
+function refuse(detail) {
+    throw new EpEnvelopeError("bad-request", `delegated recovery ${detail}`);
+}
+function object(raw, keys, required = keys) {
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw))
+        refuse("requires an object");
+    const value = raw;
+    if (Reflect.ownKeys(value).some(key => typeof key !== "string" || !keys.includes(key)))
+        refuse("carries an unknown field");
+    if (required.some(key => !Object.hasOwn(value, key)))
+        refuse("is missing a required field");
+    return value;
+}
+function text(raw) {
+    if (typeof raw !== "string" || raw.length === 0 || raw.length > 1024 || /[\x00-\x1f]/.test(raw))
+        refuse("requires a bounded nonempty string");
+    return raw;
+}
+function token(raw) { return assertLifecycleToken(text(raw), "delegated recovery id"); }
+function count(raw) {
+    if (typeof raw !== "number" || !Number.isSafeInteger(raw) || raw < 0)
+        refuse("requires a non-negative safe integer");
+    return raw;
+}
+function flag(raw) {
+    if (typeof raw !== "boolean")
+        refuse("requires a boolean");
+    return raw;
+}
+function digest(raw) {
+    if (typeof raw !== "string" || !/^[0-9a-f]{64}$/.test(raw))
+        refuse("requires a SHA-256 digest");
+    return raw;
+}
+function account(raw) {
+    if (!isAccountNkey(raw))
+        refuse("requires an account nkey");
+    return raw;
+}
+function choice(raw, choices) {
+    if (typeof raw !== "string" || !choices.includes(raw))
+        refuse("carries an unsupported value");
+    return raw;
+}
+function nullable(raw, parse) { return raw === null ? null : parse(raw); }
+function strings(raw) {
+    if (!Array.isArray(raw) || raw.length > 64)
+        refuse("requires a list of at most 64 strings");
+    return raw.map(text);
+}
+function sameTarget(a, b) {
+    if (a.owner !== b.owner || a.actor !== b.actor || a.lifecycleUid !== b.lifecycleUid)
+        refuse("target does not match its binding");
+}
+function target(raw) {
+    const o = object(raw, ["owner", "actor", "lifecycleUid"]);
+    return { owner: assertDerivedOwnerToken(text(o.owner)), actor: assertValidOwnerToken(text(o.actor)), lifecycleUid: token(o.lifecycleUid) };
+}
+function localProof(raw) {
+    const o = object(raw, ["storeBindingDigest", "storeIdentityDigest", "actorTokenDigest", "sentinelDigest"]);
+    return { storeBindingDigest: digest(o.storeBindingDigest), storeIdentityDigest: digest(o.storeIdentityDigest), actorTokenDigest: digest(o.actorTokenDigest), sentinelDigest: digest(o.sentinelDigest) };
+}
+function launchPlan(raw) {
+    const o = object(raw, ["agent", "model", "variant", "events", "sourceDigest"], ["agent", "events", "sourceDigest"]);
+    return { agent: text(o.agent), ...(Object.hasOwn(o, "model") ? { model: text(o.model) } : {}), ...(Object.hasOwn(o, "variant") ? { variant: text(o.variant) } : {}), events: flag(o.events), sourceDigest: digest(o.sourceDigest) };
+}
+function origin(raw) {
+    const o = object(raw, ["space", "accountPublicKey", "managerInstanceId", "managerLifecycleUid", "assignmentRevision", "enrollmentRegistrationRevision", "enrollmentRegistrationDigest", "enrollmentServeEpoch", "intentId", "target"]);
+    return { space: text(o.space), accountPublicKey: account(o.accountPublicKey), managerInstanceId: token(o.managerInstanceId), managerLifecycleUid: token(o.managerLifecycleUid), assignmentRevision: count(o.assignmentRevision), enrollmentRegistrationRevision: count(o.enrollmentRegistrationRevision), enrollmentRegistrationDigest: digest(o.enrollmentRegistrationDigest), enrollmentServeEpoch: count(o.enrollmentServeEpoch), intentId: token(o.intentId), target: target(o.target) };
+}
+function scanBinding(raw) {
+    const o = object(raw, ["scanId", "accountPublicKey", "managerInstanceId", "managerLifecycleUid", "assignmentRevision", "currentRegistrationRevision", "currentServeEpoch", "sourceRevision", "memberCount", "membersDigest"]);
+    return { scanId: token(o.scanId), accountPublicKey: account(o.accountPublicKey), managerInstanceId: token(o.managerInstanceId), managerLifecycleUid: token(o.managerLifecycleUid), assignmentRevision: count(o.assignmentRevision), currentRegistrationRevision: count(o.currentRegistrationRevision), currentServeEpoch: count(o.currentServeEpoch), sourceRevision: count(o.sourceRevision), memberCount: count(o.memberCount), membersDigest: digest(o.membersDigest) };
+}
+function scopeMatches(binding, request) {
+    if (binding.accountPublicKey !== request.accountPublicKey || binding.managerInstanceId !== request.instanceId || binding.managerLifecycleUid !== request.managerLifecycleUid || binding.assignmentRevision !== request.assignmentRevision || binding.currentRegistrationRevision !== request.currentRegistrationRevision || binding.currentServeEpoch !== request.serveEpoch)
+        refuse("scan belongs to another scope or epoch");
+}
+function originMatches(binding, request) {
+    if (binding.space !== request.space || binding.accountPublicKey !== request.accountPublicKey || binding.managerInstanceId !== request.instanceId || binding.managerLifecycleUid !== request.managerLifecycleUid || binding.assignmentRevision !== request.assignmentRevision)
+        refuse("origin belongs to another manager or assignment");
+}
+export function parseDelegatedRecoveryDescriptor(raw) {
+    const o = object(raw, ["v", "intentId", "origin", "target", "runtimeKind", "runtimeKey", "launchIdentity", "authorityDigest", "localStoreBindingDigest", "localStoreIdentityDigest"]);
+    if (o.v !== 1)
+        refuse("descriptor version is unsupported");
+    const enrolled = origin(o.origin), child = target(o.target), intentId = token(o.intentId);
+    sameTarget(enrolled.target, child);
+    if (enrolled.intentId !== intentId)
+        refuse("descriptor intent does not match its origin");
+    const identity = object(o.launchIdentity, ["agent", "model", "variant", "events", "sourceDigest", "role", "spawner", "authorityParent"], ["agent", "events", "sourceDigest", "spawner", "authorityParent"]);
+    const { role, spawner, authorityParent, ...plan } = identity;
+    const launch = launchPlan(plan);
+    const parent = text(authorityParent), principal = parsePrincipalKey(parent);
+    if (!principal || principal.owner !== child.owner || text(spawner) !== parent)
+        refuse("delegated spawner must be its original user's authority parent");
+    const runtimeKey = text(o.runtimeKey);
+    if (runtimeKey !== managedRuntimeKey({ space: enrolled.space, ...child }))
+        refuse("runtime key does not match the lifecycle");
+    return { v: 1, intentId, origin: enrolled, target: child, runtimeKind: text(o.runtimeKind), runtimeKey, launchIdentity: { ...launch, ...(Object.hasOwn(identity, "role") ? { role: text(role) } : {}), spawner: parent, authorityParent: parent }, authorityDigest: digest(o.authorityDigest), localStoreBindingDigest: digest(o.localStoreBindingDigest), localStoreIdentityDigest: digest(o.localStoreIdentityDigest) };
+}
+/** Parse structure and scope bindings; fresh host authority and durable CAS remain separate checks. */
+export function parseRemoteDelegatedRecoveryRequest(raw) {
+    const o = object(raw, ["v", "kind", "actor", "space", "accountPublicKey", "assignmentRevision", "instanceId", "managerLifecycleUid", "currentRegistrationRevision", "serveEpoch", "registrationProof", "requestId", "identities", "operation", "body"]);
+    const parsed = parseRemoteManagerEnvelope(o, "manager-delegated-recovery", "delegated recovery");
+    if (parsed.actor !== "cli")
+        refuse('actor must be "cli"');
+    const envelope = { ...parsed, v: 1, kind: "manager-delegated-recovery", actor: "cli", accountPublicKey: account(o.accountPublicKey), assignmentRevision: count(o.assignmentRevision), currentRegistrationRevision: count(o.currentRegistrationRevision), serveEpoch: count(o.serveEpoch) };
+    switch (o.operation) {
+        case "confirm": {
+            const b = object(o.body, ["intentId", "target", "expectedIntentRevision", "localProof"]);
+            return { ...envelope, operation: "confirm", body: { intentId: token(b.intentId), target: target(b.target), expectedIntentRevision: count(b.expectedIntentRevision), localProof: localProof(b.localProof) } };
+        }
+        case "scan": {
+            const b = object(o.body, ["scanBinding", "cursor"], []);
+            if (Object.hasOwn(b, "scanBinding") !== Object.hasOwn(b, "cursor"))
+                refuse("scan cursor and binding must occur together");
+            if (!Object.hasOwn(b, "scanBinding"))
+                return { ...envelope, operation: "scan", body: {} };
+            const binding = scanBinding(b.scanBinding);
+            scopeMatches(binding, envelope);
+            return { ...envelope, operation: "scan", body: { scanBinding: binding, cursor: text(b.cursor) } };
+        }
+        case "claim": {
+            const b = object(o.body, ["intentId", "target", "expectedRecoveryRevision", "expectedOrigin", "attemptId", "scanBinding"]);
+            const expectedOrigin = origin(b.expectedOrigin), child = target(b.target), intentId = token(b.intentId), binding = scanBinding(b.scanBinding);
+            originMatches(expectedOrigin, envelope);
+            scopeMatches(binding, envelope);
+            sameTarget(expectedOrigin.target, child);
+            if (expectedOrigin.intentId !== intentId)
+                refuse("claim intent does not match its origin");
+            return { ...envelope, operation: "claim", body: { intentId, target: child, expectedRecoveryRevision: count(b.expectedRecoveryRevision), expectedOrigin, attemptId: token(b.attemptId), scanBinding: binding } };
+        }
+        case "settle": {
+            const b = object(o.body, ["claimId", "expectedRecoveryRevision", "settleId", "observation", "executionIdentityDigest", "reasonCode"], ["claimId", "expectedRecoveryRevision", "settleId", "observation"]);
+            const common = { claimId: token(b.claimId), expectedRecoveryRevision: count(b.expectedRecoveryRevision), settleId: token(b.settleId) };
+            if (b.observation === "bound" && !Object.hasOwn(b, "reasonCode"))
+                return { ...envelope, operation: "settle", body: { ...common, observation: "bound", executionIdentityDigest: digest(b.executionIdentityDigest) } };
+            if (b.observation === "held" && !Object.hasOwn(b, "executionIdentityDigest"))
+                return { ...envelope, operation: "settle", body: { ...common, observation: "held", reasonCode: choice(b.reasonCode, DELEGATED_RECOVERY_REASONS) } };
+            return refuse("settle must report bound identity or held reason, not both");
+        }
+        case "finish": {
+            const b = object(o.body, ["scanBinding", "finishId", "expectedScopeRevision"]), binding = scanBinding(b.scanBinding);
+            scopeMatches(binding, envelope);
+            return { ...envelope, operation: "finish", body: { scanBinding: binding, finishId: token(b.finishId), expectedScopeRevision: count(b.expectedScopeRevision) } };
+        }
+        case "watch": {
+            const b = object(o.body, ["afterRevision"]);
+            return { ...envelope, operation: "watch", body: { afterRevision: count(b.afterRevision) } };
+        }
+        default: return refuse("operation is unsupported");
+    }
+}
+export function parseRemoteDelegatedRecoveryLaunchRequest(raw) {
+    const o = object(raw, ["v", "kind", "space", "actor", "accountPublicKey", "assignmentRevision", "instanceId", "managerLifecycleUid", "requestId", "registrationProof", "serveEpoch", "identities", "intentId", "execute"]);
+    const execute = object(o.execute, ["operation", "target", "recoveryPlan"]);
+    const { recoveryPlan, ...legacyExecute } = execute;
+    const legacy = parseRemoteDelegatedUserIntentExecutionRequest({ ...o, execute: legacyExecute });
+    if (legacy.execute.operation !== "launch")
+        refuse("recovery plan is only valid for a launch");
+    const plan = object(recoveryPlan, ["runtimeKind", "launch", "localStoreBindingDigest", "localStoreIdentityDigest"]);
+    return { ...legacy, execute: { ...legacy.execute, recoveryPlan: { runtimeKind: text(plan.runtimeKind), launch: launchPlan(plan.launch), localStoreBindingDigest: digest(plan.localStoreBindingDigest), localStoreIdentityDigest: digest(plan.localStoreIdentityDigest) } } };
+}
+function authority(raw) {
+    const o = object(raw, ["owner", "actor", "lifecycleUid", "scope", "allowSubscribe", "allowPublish", "role", "parent"], ["owner", "actor", "lifecycleUid", "scope", "allowSubscribe", "allowPublish"]);
+    return { owner: assertDerivedOwnerToken(text(o.owner)), actor: assertValidOwnerToken(text(o.actor)), lifecycleUid: token(o.lifecycleUid), scope: strings(o.scope), allowSubscribe: strings(o.allowSubscribe), allowPublish: strings(o.allowPublish), ...(Object.hasOwn(o, "role") ? { role: text(o.role) } : {}), ...(Object.hasOwn(o, "parent") ? { parent: text(o.parent) } : {}) };
+}
+function record(raw) {
+    const o = object(raw, ["intentId", "intentRevision", "recoveryRevision", "target", "phase", "descriptor", "descriptorDigest", "authority", "localProof", "startedAt", "executionIdentityDigest", "reasonCode"]);
+    const child = target(o.target), intentId = token(o.intentId), descriptor = nullable(o.descriptor, parseDelegatedRecoveryDescriptor), retained = nullable(o.authority, authority);
+    if (descriptor) {
+        sameTarget(descriptor.target, child);
+        if (descriptor.intentId !== intentId)
+            refuse("record intent does not match its descriptor");
+    }
+    if (retained)
+        sameTarget(retained, child);
+    const startedAt = nullable(o.startedAt, text), descriptorDigest = nullable(o.descriptorDigest, digest);
+    const proof = nullable(o.localProof, localProof), executionIdentityDigest = nullable(o.executionIdentityDigest, digest);
+    const phase = choice(o.phase, ["incomplete", "prepared", "create-unknown", "eligible", "bound", "retiring", "terminal"]);
+    if (startedAt !== null && (!Number.isFinite(Date.parse(startedAt)) || new Date(startedAt).toISOString() !== startedAt))
+        refuse("birth time must be a canonical ISO instant");
+    if ((descriptor === null) !== (descriptorDigest === null))
+        refuse("descriptor and its digest must occur together");
+    if (descriptor && descriptorDigest !== contractDigest(descriptor).slice("sha256:".length))
+        refuse("descriptor digest does not match its content");
+    if (descriptor && retained && (descriptor.authorityDigest !== contractDigest(retained).slice("sha256:".length) || retained.parent !== descriptor.launchIdentity.authorityParent || retained.role !== descriptor.launchIdentity.role))
+        refuse("retained authority does not match its descriptor");
+    if (descriptor && proof && (proof.storeBindingDigest !== descriptor.localStoreBindingDigest || proof.storeIdentityDigest !== descriptor.localStoreIdentityDigest))
+        refuse("local store proof does not match its descriptor");
+    if ((phase === "eligible" || phase === "bound") && [descriptor, retained, proof, startedAt, executionIdentityDigest].some(value => value === null))
+        refuse("eligible recovery lacks required evidence");
+    return { intentId, intentRevision: count(o.intentRevision), recoveryRevision: count(o.recoveryRevision), target: child, phase, descriptor, descriptorDigest, authority: retained, localProof: proof, startedAt, executionIdentityDigest, reasonCode: nullable(o.reasonCode, value => choice(value, DELEGATED_RECOVERY_REASONS)) };
+}
+/** Bind every response to its request before a caller may act on any returned record. */
+export function parseRemoteDelegatedRecoveryResult(raw, request) {
+    const keys = ["v", "kind", "space", "accountPublicKey", "assignmentRevision", "instanceId", "managerLifecycleUid", "currentRegistrationRevision", "serveEpoch", "requestId", "operation", "ok"];
+    const o = object(raw, [...keys, "result", "error"], keys);
+    const header = { v: request.v, kind: request.kind, space: request.space, accountPublicKey: request.accountPublicKey, assignmentRevision: request.assignmentRevision, instanceId: request.instanceId, managerLifecycleUid: request.managerLifecycleUid, currentRegistrationRevision: request.currentRegistrationRevision, serveEpoch: request.serveEpoch, requestId: request.requestId };
+    for (const key of Object.keys(header))
+        if (o[key] !== header[key])
+            refuse(`response ${key} does not match its request`);
+    if (o.operation !== request.operation)
+        refuse("response operation does not match its request");
+    if (o.ok === false && !Object.hasOwn(o, "result")) {
+        const e = object(o.error, ["code", "reasonCode"], ["code"]);
+        return { ...header, operation: request.operation, ok: false, error: { code: choice(e.code, ["bad-request", "permission-denied", "conflict", "unavailable", "failed-precondition", "unimplemented"]), ...(Object.hasOwn(e, "reasonCode") ? { reasonCode: choice(e.reasonCode, DELEGATED_RECOVERY_REASONS) } : {}) } };
+    }
+    if (o.ok !== true || Object.hasOwn(o, "error"))
+        refuse("response must contain one result or error");
+    switch (request.operation) {
+        case "confirm": {
+            const r = object(o.result, ["intentId", "target", "intentRevision", "recoveryRevision", "prepared"]), child = target(r.target);
+            sameTarget(child, request.body.target);
+            if (r.intentId !== request.body.intentId || r.prepared !== true)
+                refuse("preparation reply does not match its request");
+            return { ...header, ok: true, operation: "confirm", result: { intentId: request.body.intentId, target: child, intentRevision: count(r.intentRevision), recoveryRevision: count(r.recoveryRevision), prepared: true } };
+        }
+        case "scan": {
+            const r = object(o.result, ["scanBinding", "records", "nextCursor", "complete"]), binding = scanBinding(r.scanBinding);
+            scopeMatches(binding, request);
+            if (request.body.scanBinding && canonicalJson(binding) !== canonicalJson(request.body.scanBinding))
+                refuse("scan binding changed during pagination");
+            if (!Array.isArray(r.records) || r.records.length > 1024)
+                refuse("scan page exceeds its bound");
+            const records = r.records.map(record), nextCursor = nullable(r.nextCursor, text), complete = flag(r.complete);
+            if (complete !== (nextCursor === null) || records.length > binding.memberCount)
+                refuse("scan completeness is inconsistent");
+            const seen = new Set();
+            for (const item of records) {
+                if (seen.has(item.intentId))
+                    refuse("scan page repeats an intent");
+                seen.add(item.intentId);
+                if (item.descriptor)
+                    originMatches(item.descriptor.origin, request);
+            }
+            return { ...header, ok: true, operation: "scan", result: { scanBinding: binding, records, nextCursor, complete } };
+        }
+        case "claim": {
+            const r = object(o.result, ["claimId", "attemptId", "record", "claimEpoch"]), retained = record(r.record);
+            if (r.attemptId !== request.body.attemptId || r.claimEpoch !== request.serveEpoch || retained.intentId !== request.body.intentId)
+                refuse("claim reply does not match its request");
+            sameTarget(retained.target, request.body.target);
+            if (!retained.descriptor || canonicalJson(retained.descriptor.origin) !== canonicalJson(request.body.expectedOrigin))
+                refuse("claim origin differs from the expected origin");
+            return { ...header, ok: true, operation: "claim", result: { claimId: token(r.claimId), attemptId: request.body.attemptId, record: retained, claimEpoch: request.serveEpoch } };
+        }
+        case "settle": {
+            const r = object(o.result, ["claimId", "settleId", "recoveryRevision", "observation"]);
+            if (r.claimId !== request.body.claimId || r.settleId !== request.body.settleId || r.observation !== request.body.observation)
+                refuse("settlement reply does not match its request");
+            return { ...header, ok: true, operation: "settle", result: { claimId: request.body.claimId, settleId: request.body.settleId, recoveryRevision: count(r.recoveryRevision), observation: request.body.observation } };
+        }
+        case "finish": {
+            const r = object(o.result, ["finishId", "scanId", "scopeRevision", "admission"]);
+            if (r.finishId !== request.body.finishId || r.scanId !== request.body.scanBinding.scanId || r.admission !== "open")
+                refuse("finish reply does not match its request");
+            return { ...header, ok: true, operation: "finish", result: { finishId: request.body.finishId, scanId: request.body.scanBinding.scanId, scopeRevision: count(r.scopeRevision), admission: "open" } };
+        }
+        case "watch": {
+            const r = object(o.result, ["revision", "scanInvalidated"]);
+            return { ...header, ok: true, operation: "watch", result: { revision: count(r.revision), scanInvalidated: flag(r.scanInvalidated) } };
+        }
+    }
+}
+//# sourceMappingURL=delegated-recovery.js.map

package/dist/delegated-recovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegated-recovery.js","sourceRoot":"","sources":["../src/delegated-recovery.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EACL,8CAA8C,EAC9C,0BAA0B,GAG3B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AA8DxH,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAC,MAAM,CAAC;IACtD,kBAAkB,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,qBAAqB;IACvF,uBAAuB,EAAE,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,eAAe;CACnF,CAAC,CAAC;AAsEZ,SAAS,MAAM,CAAC,MAAc;IAC5B,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,sBAAsB,MAAM,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,MAAM,CAAC,GAAY,EAAE,IAAuB,EAAE,WAA8B,IAAI;IACvF,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAChG,MAAM,KAAK,GAAG,GAA8B,CAAC;IAC7C,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAE,MAAM,CAAC,0BAA0B,CAAC,CAAC;IAC3H,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAAE,MAAM,CAAC,6BAA6B,CAAC,CAAC;IAC5F,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,IAAI,CAAC,GAAY;IACxB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,IAAI,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,CAAC,oCAAoC,CAAC,CAAC;IAC9I,OAAO,GAAG,CAAC;AACb,CAAC;AACD,SAAS,KAAK,CAAC,GAAY,IAAY,OAAO,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC,CAAC,CAAC,CAAC;AACzG,SAAS,KAAK,CAAC,GAAY;IACzB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;QAAE,MAAM,CAAC,sCAAsC,CAAC,CAAC;IACrH,OAAO,GAAG,CAAC;AACb,CAAC;AACD,SAAS,IAAI,CAAC,GAAY;IACxB,IAAI,OAAO,GAAG,KAAK,SAAS;QAAE,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC3D,OAAO,GAAG,CAAC;AACb,CAAC;AACD,SAAS,MAAM,CAAC,GAAY;IAC1B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,CAAC,2BAA2B,CAAC,CAAC;IAChG,OAAO,GAAG,CAAC;AACb,CAAC;AACD,SAAS,OAAO,CAAC,GAAY;IAC3B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;QAAE,MAAM,CAAC,0BAA0B,CAAC,CAAC;IAC5D,OAAO,GAAG,CAAC;AACb,CAAC;AACD,SAAS,MAAM,CAAoC,GAAY,EAAE,OAAU;IACzE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,CAAC,8BAA8B,CAAC,CAAC;IAC9F,OAAO,GAAgB,CAAC;AAC1B,CAAC;AACD,SAAS,QAAQ,CAAI,GAAY,EAAE,KAA4B,IAAc,OAAO,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACvH,SAAS,OAAO,CAAC,GAAY;IAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,CAAC,uCAAuC,CAAC,CAAC;IAC5F,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC;AACD,SAAS,UAAU,CAAC,CAA0B,EAAE,CAA0B;IACxE,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,YAAY;QAAE,MAAM,CAAC,mCAAmC,CAAC,CAAC;AACnI,CAAC;AACD,SAAS,MAAM,CAAC,GAAY;IAC1B,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;IAC1D,OAAO,EAAE,KAAK,EAAE,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC;AAC7I,CAAC;AACD,SAAS,UAAU,CAAC,GAAY;IAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC3G,OAAO,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,mBAAmB,EAAE,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC;AAC1M,CAAC;AACD,SAAS,UAAU,CAAC,GAAY;IAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC;IACpH,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC;AACtO,CAAC;AACD,SAAS,MAAM,CAAC,GAAY;IAC1B,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,gCAAgC,EAAE,8BAA8B,EAAE,sBAAsB,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;IACvO,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,8BAA8B,EAAE,KAAK,CAAC,CAAC,CAAC,8BAA8B,CAAC,EAAE,4BAA4B,EAAE,MAAM,CAAC,CAAC,CAAC,4BAA4B,CAAC,EAAE,oBAAoB,EAAE,KAAK,CAAC,CAAC,CAAC,oBAAoB,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;AAC/d,CAAC;AACD,SAAS,WAAW,CAAC,GAAY;IAC/B,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC,CAAC;IAC9N,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,2BAA2B,EAAE,KAAK,CAAC,CAAC,CAAC,2BAA2B,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC;AAC7c,CAAC;AACD,SAAS,YAAY,CAAC,OAAqC,EAAE,OAAyB;IACpF,IAAI,OAAO,CAAC,gBAAgB,KAAK,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,iBAAiB,KAAK,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,mBAAmB,KAAK,OAAO,CAAC,mBAAmB,IAAI,OAAO,CAAC,kBAAkB,KAAK,OAAO,CAAC,kBAAkB,IAAI,OAAO,CAAC,2BAA2B,KAAK,OAAO,CAAC,2BAA2B,IAAI,OAAO,CAAC,iBAAiB,KAAK,OAAO,CAAC,UAAU;QAAE,MAAM,CAAC,wCAAwC,CAAC,CAAC;AACja,CAAC;AACD,SAAS,aAAa,CAAC,OAAgC,EAAE,OAAyB;IAChF,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,gBAAgB,KAAK,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,iBAAiB,KAAK,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,mBAAmB,KAAK,OAAO,CAAC,mBAAmB,IAAI,OAAO,CAAC,kBAAkB,KAAK,OAAO,CAAC,kBAAkB;QAAE,MAAM,CAAC,iDAAiD,CAAC,CAAC;AAC1U,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,GAAY;IAC3D,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,0BAA0B,CAAC,CAAC,CAAC;IACtL,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,MAAM,CAAC,mCAAmC,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC1F,UAAU,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACnC,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ;QAAE,MAAM,CAAC,6CAA6C,CAAC,CAAC;IAC1F,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC5M,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,IAAI,EAAE,GAAG,QAAQ,CAAC;IAC7D,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,EAAE,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC5E,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,MAAM;QAAE,MAAM,CAAC,gEAAgE,CAAC,CAAC;IACxJ,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACtC,IAAI,UAAU,KAAK,iBAAiB,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC;QAAE,MAAM,CAAC,0CAA0C,CAAC,CAAC;IAC9H,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,UAAU,EAAE,cAAc,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,uBAAuB,EAAE,MAAM,CAAC,CAAC,CAAC,uBAAuB,CAAC,EAAE,wBAAwB,EAAE,MAAM,CAAC,CAAC,CAAC,wBAAwB,CAAC,EAAE,CAAC;AAC5Z,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,mCAAmC,CAAC,GAAY;IAC9D,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,YAAY,EAAE,qBAAqB,EAAE,6BAA6B,EAAE,YAAY,EAAE,mBAAmB,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IACxP,MAAM,MAAM,GAAG,0BAA0B,CAAC,CAAC,EAAE,4BAA4B,EAAE,oBAAoB,CAAC,CAAC;IACjG,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK;QAAE,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAqB,EAAE,GAAG,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,2BAA2B,EAAE,KAAK,CAAC,CAAC,CAAC,2BAA2B,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;IAC7S,QAAQ,CAAC,CAAC,SAAS,EAAE,CAAC;QACpB,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,wBAAwB,EAAE,YAAY,CAAC,CAAC,CAAC;YACzF,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,sBAAsB,EAAE,KAAK,CAAC,CAAC,CAAC,sBAAsB,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QAC/M,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,aAAa,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;YACxD,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,aAAa,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,CAAC;gBAAE,MAAM,CAAC,6CAA6C,CAAC,CAAC;YAC1H,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,aAAa,CAAC;gBAAE,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;YAC1F,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YAC3C,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAChC,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACpG,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;YAC3H,MAAM,cAAc,GAAG,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YAC9I,aAAa,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;YACxC,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAChC,UAAU,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACzC,IAAI,cAAc,CAAC,QAAQ,KAAK,QAAQ;gBAAE,MAAM,CAAC,wCAAwC,CAAC,CAAC;YAC3F,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,wBAAwB,EAAE,KAAK,CAAC,CAAC,CAAC,wBAAwB,CAAC,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;QAClN,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,SAAS,EAAE,0BAA0B,EAAE,UAAU,EAAE,aAAa,EAAE,yBAAyB,EAAE,YAAY,CAAC,EAAE,CAAC,SAAS,EAAE,0BAA0B,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC;YAC1M,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,wBAAwB,EAAE,KAAK,CAAC,CAAC,CAAC,wBAAwB,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvI,IAAI,CAAC,CAAC,WAAW,KAAK,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,YAAY,CAAC;gBAAE,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,uBAAuB,EAAE,MAAM,CAAC,CAAC,CAAC,uBAAuB,CAAC,EAAE,EAAE,CAAC;YACrN,IAAI,CAAC,CAAC,WAAW,KAAK,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,yBAAyB,CAAC;gBAAE,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,EAAE,0BAA0B,CAAC,EAAE,EAAE,CAAC;YAClO,OAAO,MAAM,CAAC,4DAA4D,CAAC,CAAC;QAC9E,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,aAAa,EAAE,UAAU,EAAE,uBAAuB,CAAC,CAAC,EAAE,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YACrH,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAChC,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC,EAAE,EAAE,CAAC;QAClK,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC;YAC5C,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;QAC9F,CAAC;QACD,OAAO,CAAC,CAAC,OAAO,MAAM,CAAC,0BAA0B,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,yCAAyC,CAAC,GAAY;IACpE,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,YAAY,EAAE,qBAAqB,EAAE,WAAW,EAAE,mBAAmB,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;IAC3N,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC;IAC3E,MAAM,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,GAAG,OAAO,CAAC;IACnD,MAAM,MAAM,GAAG,8CAA8C,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;IAChG,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,KAAK,QAAQ;QAAE,MAAM,CAAC,0CAA0C,CAAC,CAAC;IAC9F,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC,aAAa,EAAE,QAAQ,EAAE,yBAAyB,EAAE,0BAA0B,CAAC,CAAC,CAAC;IACpH,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,uBAAuB,EAAE,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,EAAE,wBAAwB,EAAE,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,EAAE,CAAC;AAC/Q,CAAC;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC;IACtM,OAAO,EAAE,KAAK,EAAE,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACxX,CAAC;AACD,SAAS,MAAM,CAAC,GAAY;IAC1B,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,yBAAyB,EAAE,YAAY,CAAC,CAAC,CAAC;IAChN,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,gCAAgC,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACjL,IAAI,UAAU,EAAE,CAAC;QACf,UAAU,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACrC,IAAI,UAAU,CAAC,QAAQ,KAAK,QAAQ;YAAE,MAAM,CAAC,6CAA6C,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,QAAQ;QAAE,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,gBAAgB,GAAG,QAAQ,CAAC,CAAC,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;IACvG,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,uBAAuB,GAAG,QAAQ,CAAC,CAAC,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACxH,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;IACzH,IAAI,SAAS,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,KAAK,SAAS,CAAC;QAAE,MAAM,CAAC,4CAA4C,CAAC,CAAC;IAC7K,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC,KAAK,CAAC,gBAAgB,KAAK,IAAI,CAAC;QAAE,MAAM,CAAC,+CAA+C,CAAC,CAAC;IACnH,IAAI,UAAU,IAAI,gBAAgB,KAAK,cAAc,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC;QAAE,MAAM,CAAC,8CAA8C,CAAC,CAAC;IAClJ,IAAI,UAAU,IAAI,QAAQ,IAAI,CAAC,UAAU,CAAC,eAAe,KAAK,cAAc,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU,CAAC,cAAc,CAAC,eAAe,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU,CAAC,cAAc,CAAC,IAAI,CAAC;QAAE,MAAM,CAAC,kDAAkD,CAAC,CAAC;IACjS,IAAI,UAAU,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,kBAAkB,KAAK,UAAU,CAAC,uBAAuB,IAAI,KAAK,CAAC,mBAAmB,KAAK,UAAU,CAAC,wBAAwB,CAAC;QAAE,MAAM,CAAC,iDAAiD,CAAC,CAAC;IAC7N,IAAI,CAAC,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,uBAAuB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC;QAAE,MAAM,CAAC,2CAA2C,CAAC,CAAC;IACxM,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,uBAAuB,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,0BAA0B,CAAC,CAAC,EAAE,CAAC;AACpU,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,kCAAkC,CAAC,GAAY,EAAE,OAAuC;IACtG,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,YAAY,EAAE,qBAAqB,EAAE,6BAA6B,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;IAChM,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;IAC1D,MAAM,MAAM,GAA2B,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,EAAE,2BAA2B,EAAE,OAAO,CAAC,2BAA2B,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;IAChZ,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAqC;QAAE,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,YAAY,GAAG,6BAA6B,CAAC,CAAC;IAC5J,IAAI,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;QAAE,MAAM,CAAC,+CAA+C,CAAC,CAAC;IAC/F,IAAI,CAAC,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC;QAClD,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5D,OAAO,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,aAAa,EAAE,mBAAmB,EAAE,UAAU,EAAE,aAAa,EAAE,qBAAqB,EAAE,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,EAAE,0BAA0B,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;IACvT,CAAC;IACD,IAAI,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC;QAAE,MAAM,CAAC,2CAA2C,CAAC,CAAC;IACpG,QAAQ,OAAO,CAAC,SAAS,EAAE,CAAC;QAC1B,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,UAAU,CAAC,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAC/H,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvC,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI;gBAAE,MAAM,CAAC,8CAA8C,CAAC,CAAC;YACxH,OAAO,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;QACzN,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC,EAAE,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YACvH,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC/B,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,IAAI,aAAa,CAAC,OAAO,CAAC,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;gBAAE,MAAM,CAAC,wCAAwC,CAAC,CAAC;YACrJ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI;gBAAE,MAAM,CAAC,6BAA6B,CAAC,CAAC;YAChG,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YAC9G,IAAI,QAAQ,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,WAAW;gBAAE,MAAM,CAAC,mCAAmC,CAAC,CAAC;YAC5H,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;YAC/B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;gBAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;oBAAE,MAAM,CAAC,6BAA6B,CAAC,CAAC;gBACnE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACxB,IAAI,IAAI,CAAC,UAAU;oBAAE,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACtE,CAAC;YACD,OAAO,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,CAAC;QACrH,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAC1G,IAAI,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,QAAQ;gBAAE,MAAM,CAAC,wCAAwC,CAAC,CAAC;YACnL,UAAU,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACjD,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;gBAAE,MAAM,CAAC,+CAA+C,CAAC,CAAC;YAC9K,OAAO,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;QACjL,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,kBAAkB,EAAE,aAAa,CAAC,CAAC,CAAC;YACvF,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,WAAW;gBAAE,MAAM,CAAC,6CAA6C,CAAC,CAAC;YACpL,OAAO,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACtN,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC;YACjF,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,IAAI,CAAC,CAAC,SAAS,KAAK,MAAM;gBAAE,MAAM,CAAC,yCAAyC,CAAC,CAAC;YACtK,OAAO,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC;QACtM,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC,CAAC;YAC5D,OAAO,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC;QACxI,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/endpoint.d.ts

@@ -39,6 +39,8 @@ export interface EndpointOptions {
     card: Omit<AgentCard, "id"> & {
         id?: string;
     };
+    /** Opaque presence label. Omitted reads COTAL_ENVIRONMENT; null omits the label without reading it. */
+    environment?: string | null;
     /** This incarnation's lifecycle UID (SPEC §13.1), minted ONCE per lifecycle by the provisioning
      *  authority (manager/CLI: `mintLifecycleUid()`) and PERSISTED with the agent — never re-minted per
      *  process, or a supervised restart would abandon the durable inbox. REQUIRED to bind/create the