@cotal-ai/manager 0.16.0 → 0.18.0

package/dist/session/plane.js

@@ -0,0 +1,327 @@
+/**
+ * The manager's SESSION PLANE (P2 item 6, 6b): offer mint + redeem ENFORCEMENT + PTY-bridge
+ * standup. Each live session serves on its OWN short-lived connection under its OWN per-session
+ * credential (SPEC 13.6); the standing connection this plane's ledger rides carries no session rail. The manager holds a single {@link ManagerSessionPlane} field; this module
+ * keeps manager.ts surgical — the wiring is a boot line, an attach-handler call, and a stop line.
+ *
+ * STATIC design (item-6, coordinator-ruled): the mint and the redeem COLLAPSE into
+ * {@link ManagerSessionPlane.establishAttach}, with the presenter fixed to the AUTHENTICATED attach
+ * caller (`ctx.subject.caller`). This is deliberate and buys three things: (1) no un-redeemed-offer
+ * window (the offer is born redeemed — a leaked grant releases nothing, and there is no dangling
+ * bearer-ish artifact); (2) no new ep command and no `manager-service-contract` churn (item-2 is
+ * live-editing that file); (3) redeem enforcement is still core's `redeemSession` — the one-use
+ * `issuing` create-CAS plus presenter-equality on the signed grant, unchanged. The WIRE
+ * offer/redeem SEPARATION (a second CLI presentation that mints the caller's per-session
+ * credential) is the USER-MODE #29 shape; that path stays out of item 6 and refuses loud here.
+ *
+ * The manager cannot import implementations/auth (implementations never import each other), so the
+ * durable ledger is a manager-local {@link kvManagerSessionLedger} over the SAME core row/key
+ * types. The full §13.1 lifecycle-gate fence (revision-pinned credential-row staging) belongs to
+ * the auth registry and is user-mode's; the static collapsed path fences on the one thing the
+ * manager authoritatively knows — its own serving epoch (a successor incarnation's differing epoch
+ * loses the finalize re-check) — plus the SERVING credential's own §13.1 gate-checked stage, which
+ * is real: the per-session serving credential is minted, staged revision-pinned, released only on
+ * the finalize CAS, and revoked by name at the terminal.
+ */
+import { Kvm } from "@nats-io/kv";
+import { assertSessionStateTransition, EpEnvelopeError, principalKey, sessionLedgerKey, } from "@cotal-ai/core";
+import { mintAttachOffer, staticRedemptionSeam, ManagerSessionRegistry } from "./establish.js";
+import { serveSessionBridge } from "./bridge.js";
+const TERMINAL = new Set(["closed", "expired", "superseded", "retired"]);
+/** A manager-local {@link SessionLedger} over `session.<id>` rows in the DEDICATED sessions bucket
+ *  KV (never the auth bucket — §13.9 subject-blindness confinement). Drives the SAME core row/key
+ *  types as implementations/auth's ledger with the manager's own KV CAS: the
+ *  one-use is `createIssuing`'s create-only CAS; finalize/terminal/revoke are revision-pinned
+ *  updates (a lost CAS returns false / retries on the next sweep, never a silent overwrite). */
+export function kvManagerSessionLedger(kv) {
+    const dec = (v) => JSON.parse(new TextDecoder().decode(v));
+    const enc = (r) => new TextEncoder().encode(JSON.stringify(r));
+    return {
+        async read(id) {
+            const e = await kv.get(sessionLedgerKey(id));
+            return e && e.operation === "PUT" ? dec(e.value) : undefined;
+        },
+        async createIssuing(row) {
+            try {
+                await kv.create(sessionLedgerKey(row.sessionId), enc(row));
+                return "created";
+            }
+            catch {
+                return "exists"; // the one-use is burned (create-only CAS lost)
+            }
+        },
+        async finalizeActive(id) {
+            const e = await kv.get(sessionLedgerKey(id));
+            if (!e || e.operation !== "PUT")
+                return false;
+            const row = dec(e.value);
+            if (row.state !== "issuing")
+                return false;
+            assertSessionStateTransition(row.state, "active");
+            row.state = "active";
+            try {
+                await kv.update(sessionLedgerKey(id), enc(row), e.revision);
+                return true;
+            }
+            catch {
+                return false;
+            }
+        },
+        async transitionTerminal(id, to) {
+            const e = await kv.get(sessionLedgerKey(id));
+            if (!e || e.operation !== "PUT")
+                return false;
+            const row = dec(e.value);
+            if (TERMINAL.has(row.state))
+                return false;
+            assertSessionStateTransition(row.state, to);
+            row.state = to;
+            try {
+                await kv.update(sessionLedgerKey(id), enc(row), e.revision);
+                return true;
+            }
+            catch {
+                return false;
+            }
+        },
+        async markRevoked(id, credId) {
+            const e = await kv.get(sessionLedgerKey(id));
+            if (!e || e.operation !== "PUT")
+                return;
+            const row = dec(e.value);
+            if (credId === row.credCaller)
+                row.revoked.caller = true;
+            else if (credId === row.credServing)
+                row.revoked.serving = true;
+            else
+                return;
+            try {
+                await kv.update(sessionLedgerKey(id), enc(row), e.revision);
+            }
+            catch { /* the next sweep retries */ }
+        },
+    };
+}
+/** The default global live-session ceiling. Configurable per manager
+ *  ({@link ManagerSessionPlaneDeps.maxSessions}) because the right number is deployment-shaped: the
+ *  browser console opens a session PER PANE, so a dashboard over a large mesh legitimately holds
+ *  many at once, and a ceiling low enough to feel like a bound would break it. */
+export const MAX_LIVE_SESSIONS_DEFAULT = 64;
+export class ManagerSessionPlane {
+    #deps;
+    #registry = new ManagerSessionRegistry();
+    #live = new Map();
+    #ledger;
+    #maxSessions;
+    /** In-flight establishments that have claimed a slot but are not yet live (see {@link claimSlot}). */
+    #reserved = 0;
+    constructor(deps) {
+        this.#deps = deps;
+        this.#ledger = kvManagerSessionLedger(deps.ledgerKv);
+        this.#maxSessions = deps.maxSessions ?? MAX_LIVE_SESSIONS_DEFAULT;
+        if (!Number.isSafeInteger(this.#maxSessions) || this.#maxSessions < 1)
+            throw new Error(`maxSessions must be a positive integer; got ${JSON.stringify(deps.maxSessions)}`);
+    }
+    /** Mint an offer for the authenticated attach caller, enforce its one-use redemption, and stand
+     *  up the PTY bridge — all atomically. Returns the HOLDER-BOUND grant (the attach reply): no URL,
+     *  and it must never be logged. Throws on a redeem refusal (a foreign presenter, an already-live
+     *  session, a stale serving epoch). */
+    async establishAttach(caller, target, session, 
+    /** A slot already claimed by an establisher in front of this one ({@link claimSlot}), so the
+     *  reservation covers ITS side effects too (the PTY attach above all). Omitted = claim here. */
+    claimed) {
+        // The ceiling slot is CLAIMED here — or by the establisher in front of us, which passes its
+        // claim in — and therefore before the offer mint and before any credential, connection or PTY
+        // attach exists: a refused establishment costs a signature verification, never a credential, a
+        // socket or an attach. The refusal names the ceiling and its value so an operator who hits it
+        // knows what to raise (see ManagerSessionPlaneDeps.maxSessions for the per-caller residual).
+        const slot = claimed ?? this.claimSlot();
+        try {
+            return await this.#establishClaimed(caller, target, session, slot);
+        }
+        finally {
+            // The leak-proof backstop: EVERY exit releases, so a throw from anywhere in the body — the
+            // mint included, which runs before the try below — can never strand capacity. Idempotent, so
+            // it never double-counts against the release at the live-occupancy hand-off.
+            slot.release();
+        }
+    }
+    /** {@link establishAttach}'s body, under an already-claimed slot. Split out ONLY so the claim has
+     *  a `finally` that covers the whole establishment, mint included. */
+    async #establishClaimed(caller, target, session, slot) {
+        const holderId = principalKey(caller.owner, caller.actor).key;
+        // Collapsed static path: the offer is redeemed at mint, so there is no un-redeemed window for a
+        // caller restart to invalidate — the holder process-epoch fence is a no-op here (user-mode #29
+        // wires the real lifecycle-registry read). serving epoch IS enforced (a successor loses).
+        const holder = { id: holderId, lifecycleUid: caller.uid, processEpoch: 0 };
+        const offer = mintAttachOffer({
+            space: this.#deps.space,
+            serving: this.#deps.serving,
+            holder,
+            target,
+            signer: this.#deps.signer,
+            ttlMs: this.#deps.ttlMs,
+            ...(this.#deps.window !== undefined ? { window: this.#deps.window } : {}),
+            ...(this.#deps.now ? { now: this.#deps.now() } : {}),
+        });
+        this.#registry.record(offer);
+        const sessionId = offer.grant.sessionId;
+        const serving = this.#deps.serving;
+        const seam = staticRedemptionSeam({
+            space: this.#deps.space,
+            resolveAnchor: this.#deps.resolveAnchor,
+            ledger: this.#ledger,
+            serving: this.#deps.servingCredential,
+            holderProcessEpoch: () => holder.processEpoch,
+            servingEpoch: () => serving.epoch,
+            // The HOLDER gate is a placeholder in the static path: the holder is an operator CLI, which
+            // has no §13.1 lifecycle gate to observe. It fences nothing, and is not described as if it
+            // does — user mode (#29) supplies the real lifecycle-registry read.
+            observeHolderGate: (h) => ({ key: `holder.${h.lifecycleUid}`, revision: 1 }),
+            // The SERVING gate is REAL: the credential seam observes this instance's own
+            // `epgate.manager.<instanceId>` leader-served, and the stage below is revision-pinned to it.
+            observeServingGate: (endpoint, instanceId) => this.#deps.servingCredential.observeGate(endpoint, instanceId),
+            ...(this.#deps.now ? { now: this.#deps.now } : {}),
+        });
+        let cred;
+        let nc;
+        try {
+            // One-use CAS + presenter-equality + the gate-pinned serving-credential stage + finalize.
+            await seam.redeem(offer.grant, { id: holder.id, lifecycleUid: holder.lifecycleUid });
+            // Only now is the row `active`, so only now is the credential authority (§13.6). Retrieved
+            // through the serving party's own authenticated path, never out of the redemption answer.
+            cred = await seam.serving(sessionId, { endpoint: offer.grant.endpoint, instanceId: serving.instanceId, epoch: serving.epoch });
+            nc = await this.#deps.servingCredential.open(cred); // fails loud; there is no shared connection to fall back to
+        }
+        catch (e) {
+            this.#registry.remove(sessionId);
+            // A failure anywhere after the one-use was burned leaves a row that must not stay live: mark
+            // it terminal and revoke whatever was staged. Best-effort — the §13.6 expiry sweep is the
+            // durable backstop, and the original refusal is what the caller must see.
+            await this.#collect(sessionId, "closed").catch(() => { });
+            throw e;
+        }
+        const bridge = serveSessionBridge({
+            nc,
+            grant: offer.grant,
+            session,
+            onEnd: () => { void this.#teardown(sessionId); },
+            ...(this.#deps.now ? { now: this.#deps.now } : {}),
+        });
+        // Occupancy transfers from the reservation to the live map with no `await` between, so the slot
+        // is counted exactly once throughout and a concurrent claim can never see it free twice.
+        this.#live.set(sessionId, { bridge, nc, credentialId: cred.id });
+        slot.release();
+        return { grant: offer.grant };
+    }
+    /**
+     * Retire one session's serving side. ORDER IS LOAD-BEARING: the connection closes FIRST and
+     * unconditionally, because closing it is the immediate kill and must not be contingent on a
+     * durable write succeeding. The ledger transition and the credential revoke follow; if either
+     * fails the rail is already dead, the row keeps its unmarked credential id, and §13.6's sweep
+     * retries exactly that id on every later pass. Idempotent.
+     */
+    async #teardown(sessionId, state = "closed") {
+        const live = this.#live.get(sessionId);
+        this.#live.delete(sessionId);
+        this.#registry.remove(sessionId);
+        if (live) {
+            try {
+                await live.nc.drain();
+            }
+            catch {
+                try {
+                    live.nc.close();
+                }
+                catch { /* already gone */ }
+            }
+        }
+        await this.#collect(sessionId, state);
+    }
+    /** Move the ledger row terminal and revoke the serving credential by name, marking the revoke
+     *  only when it SUCCEEDED (§13.6: an unmarked id is what makes the sweep's retry real). */
+    async #collect(sessionId, state) {
+        let row;
+        try {
+            row = await this.#ledger.read(sessionId);
+        }
+        catch { /* unreadable: the sweep still collects it */ }
+        try {
+            await this.#ledger.transitionTerminal(sessionId, state);
+        }
+        catch { /* sweep backstop */ }
+        if (!row)
+            return;
+        try {
+            await this.#deps.servingCredential.revoke(row.credServing);
+            await this.#ledger.markRevoked(sessionId, row.credServing);
+        }
+        catch {
+            /* the mark stays unset — the §13.6 sweep retries exactly this id */
+        }
+    }
+    /** End every session bound to a target incarnation, with a distinct reason — the despawn/restart
+     *  hook (the successor incarnation's differing epoch already refuses old-epoch redemptions; this
+     *  proactively tears the live bridges down and surfaces the reason to each client). The bridge's
+     *  own `onEnd` drives {@link #teardown}, so the connection and credential go with it. */
+    endForTarget(name, lifecycleUid, reason) {
+        for (const id of this.#registry.forTarget(name, lifecycleUid))
+            this.#live.get(id)?.bridge.end(reason);
+    }
+    /** End all live sessions (manager stop / drain). */
+    endAll(reason) {
+        for (const live of [...this.#live.values()])
+            live.bridge.end(reason);
+    }
+    /** Await every in-flight teardown (manager stop): the bridges' `onEnd` teardown is async, so a
+     *  synchronous `endAll` alone would let the process exit with connections still draining. */
+    async drain(reason) {
+        this.endAll(reason);
+        await Promise.all([...this.#live.keys()].map((id) => this.#teardown(id, "closed").catch(() => { })));
+    }
+    get liveSessions() {
+        return this.#live.size;
+    }
+    /** The configured global ceiling (surfaced so an operator-facing status can report it). */
+    get maxSessions() {
+        return this.#maxSessions;
+    }
+    /**
+     * CLAIM a session slot, or refuse loudly. ONE implementation, called by {@link establishAttach}
+     * and by every establisher in front of it, so the two cannot drift into disagreeing about
+     * capacity. It must run before ANY of: minting the offer, redeeming it, minting a per-session
+     * credential on either side, opening a connection, or attaching the target's PTY.
+     *
+     * THIS RESERVES, IT DOES NOT MERELY CHECK. A bare read of the live count would be check-then-act:
+     * establishment awaits a mint, a redemption and a connection before the session becomes live, so
+     * two concurrent establishes at `max - 1` would both observe room, both mint credentials, and
+     * both land — overshooting the ceiling by exactly the concurrency the HTTP face already has, and
+     * over-minting the seed-signed credentials the ceiling exists to bound. Occupancy is therefore
+     * live sessions PLUS in-flight reservations, and the increment happens with no `await` between
+     * the read and the write, so on a single-threaded runtime no second establishment can interleave.
+     *
+     * The returned release is idempotent: the caller releases on every failure path, and
+     * {@link establishAttach} releases at the same instant it records the live session, so a slot is
+     * counted once and never twice.
+     *
+     * The message names the ceiling and its current value: an operator who hits it should not have to
+     * read source to learn which knob to raise.
+     */
+    claimSlot() {
+        if (this.#live.size + this.#reserved >= this.#maxSessions)
+            throw new EpEnvelopeError("resource-exhausted", `the manager is already serving its maximum of ${this.#maxSessions} concurrent sessions (raise ManagerOptions.maxSessions); no session was established and no credential was minted (SPEC 13.6)`);
+        this.#reserved++;
+        let released = false;
+        return { release: () => { if (!released) {
+                released = true;
+                this.#reserved--;
+            } } };
+    }
+}
+/** Open the DEDICATED sessions-bucket KV a plane's ledger needs (the `session.<id>` rows live in
+ *  the §13.6 session store — {@link sessionsBucket}, NOT the auth bucket). Split out so the manager
+ *  can build the plane from its own bucket handle. */
+export async function openSessionLedgerKv(nc, bucket) {
+    return new Kvm(nc).open(bucket);
+}
+//# sourceMappingURL=plane.js.map

package/dist/session/plane.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plane.js","sourceRoot":"","sources":["../../src/session/plane.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAGlC,OAAO,EACL,4BAA4B,EAC5B,eAAe,EACf,YAAY,EACZ,gBAAgB,GAQjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,sBAAsB,EAA2C,MAAM,gBAAgB,CAAC;AACxI,OAAO,EAAE,kBAAkB,EAAsB,MAAM,aAAa,CAAC;AAGrE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC;AAEzE;;;;gGAIgG;AAChG,MAAM,UAAU,sBAAsB,CAAC,EAAM;IAC3C,MAAM,GAAG,GAAG,CAAC,CAAa,EAAoB,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAqB,CAAC;IAC7G,MAAM,GAAG,GAAG,CAAC,CAAmB,EAAc,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7F,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,EAAE;YACX,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC;YAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/D,CAAC;QACD,KAAK,CAAC,aAAa,CAAC,GAAG;YACrB,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC3D,OAAO,SAAS,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,QAAQ,CAAC,CAAC,+CAA+C;YAClE,CAAC;QACH,CAAC;QACD,KAAK,CAAC,cAAc,CAAC,EAAE;YACrB,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC;YAC7C,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,KAAK,KAAK;gBAAE,OAAO,KAAK,CAAC;YAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACzB,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YAC1C,4BAA4B,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAClD,GAAG,CAAC,KAAK,GAAG,QAAQ,CAAC;YACrB,IAAI,CAAC;gBAAC,MAAM,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;gBAAC,OAAO,IAAI,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,KAAK,CAAC;YAAC,CAAC;QAC3G,CAAC;QACD,KAAK,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE;YAC7B,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC;YAC7C,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,KAAK,KAAK;gBAAE,OAAO,KAAK,CAAC;YAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACzB,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC1C,4BAA4B,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC5C,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC;YACf,IAAI,CAAC;gBAAC,MAAM,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;gBAAC,OAAO,IAAI,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,KAAK,CAAC;YAAC,CAAC;QAC3G,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM;YAC1B,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC;YAC7C,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,KAAK,KAAK;gBAAE,OAAO;YACxC,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACzB,IAAI,MAAM,KAAK,GAAG,CAAC,UAAU;gBAAE,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;iBACpD,IAAI,MAAM,KAAK,GAAG,CAAC,WAAW;gBAAE,GAAG,CAAC,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;;gBAC3D,OAAO;YACZ,IAAI,CAAC;gBAAC,MAAM,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,4BAA4B,CAAC,CAAC;QAC7G,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;kFAGkF;AAClF,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AA6C5C,MAAM,OAAO,mBAAmB;IACrB,KAAK,CAA0B;IAC/B,SAAS,GAAG,IAAI,sBAAsB,EAAE,CAAC;IACzC,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IACvC,OAAO,CAAgB;IACvB,YAAY,CAAS;IAC9B,sGAAsG;IACtG,SAAS,GAAG,CAAC,CAAC;IAEd,YAAY,IAA6B;QACvC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,WAAW,IAAI,yBAAyB,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,YAAY,GAAG,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,+CAA+C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACvG,CAAC;IAED;;;2CAGuC;IACvC,KAAK,CAAC,eAAe,CACnB,MAAqD,EACrD,MAAqB,EACrB,OAAsB;IACtB;oGACgG;IAChG,OAA6B;QAE7B,4FAA4F;QAC5F,8FAA8F;QAC9F,+FAA+F;QAC/F,8FAA8F;QAC9F,6FAA6F;QAC7F,MAAM,IAAI,GAAG,OAAO,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACrE,CAAC;gBAAS,CAAC;YACT,2FAA2F;YAC3F,6FAA6F;YAC7F,6EAA6E;YAC7E,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;IAED;0EACsE;IACtE,KAAK,CAAC,iBAAiB,CACrB,MAAqD,EACrD,MAAqB,EACrB,OAAsB,EACtB,IAAyB;QAEzB,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC;QAC9D,gGAAgG;QAChG,+FAA+F;QAC/F,0FAA0F;QAC1F,MAAM,MAAM,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,GAAG,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;QAC3E,MAAM,KAAK,GAAG,eAAe,CAAC;YAC5B,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK;YACvB,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO;YAC3B,MAAM;YACN,MAAM;YACN,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK;YACvB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrD,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7B,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;QACxC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QACnC,MAAM,IAAI,GAAG,oBAAoB,CAAC;YAChC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK;YACvB,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa;YACvC,MAAM,EAAE,IAAI,CAAC,OAAO;YACpB,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,iBAAiB;YACrC,kBAAkB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,YAAY;YAC7C,YAAY,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK;YACjC,4FAA4F;YAC5F,2FAA2F;YAC3F,oEAAoE;YACpE,iBAAiB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;YAC5E,6EAA6E;YAC7E,6FAA6F;YAC7F,kBAAkB,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC;YAC5G,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnD,CAAC,CAAC;QACH,IAAI,IAAuB,CAAC;QAC5B,IAAI,EAAkB,CAAC;QACvB,IAAI,CAAC;YACH,0FAA0F;YAC1F,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;YACrF,2FAA2F;YAC3F,0FAA0F;YAC1F,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;YAC/H,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,4DAA4D;QAClH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACjC,6FAA6F;YAC7F,0FAA0F;YAC1F,0EAA0E;YAC1E,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACzD,MAAM,CAAC,CAAC;QACV,CAAC;QACD,MAAM,MAAM,GAAG,kBAAkB,CAAC;YAChC,EAAE;YACF,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,OAAO;YACP,KAAK,EAAE,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YAChD,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnD,CAAC,CAAC;QACH,gGAAgG;QAChG,yFAAyF;QACzF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IAChC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,SAAS,CAAC,SAAiB,EAAE,QAA8B,QAAQ;QACvE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC;gBAAC,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,IAAI,CAAC;oBAAC,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;YAAC,CAAC;QAChG,CAAC;QACD,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC;IAED;+FAC2F;IAC3F,KAAK,CAAC,QAAQ,CAAC,SAAiB,EAAE,KAA2B;QAC3D,IAAI,GAAiC,CAAC;QACtC,IAAI,CAAC;YAAC,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,6CAA6C,CAAC,CAAC;QACzG,IAAI,CAAC;YAAC,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;QAC/F,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC3D,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;QACtE,CAAC;IACH,CAAC;IAED;;;6FAGyF;IACzF,YAAY,CAAC,IAAY,EAAE,YAAoB,EAAE,MAAuB;QACtE,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,YAAY,CAAC;YAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxG,CAAC;IAED,oDAAoD;IACpD,MAAM,CAAC,MAAuB;QAC5B,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvE,CAAC;IAED;iGAC6F;IAC7F,KAAK,CAAC,KAAK,CAAC,MAAuB;QACjC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpB,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACtG,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACzB,CAAC;IAED,2FAA2F;IAC3F,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,SAAS;QACP,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,YAAY;YACvD,MAAM,IAAI,eAAe,CACvB,oBAAoB,EACpB,iDAAiD,IAAI,CAAC,YAAY,8HAA8H,CACjM,CAAC;QACJ,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAAC,QAAQ,GAAG,IAAI,CAAC;gBAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,CAAC;CACF;AAED;;sDAEsD;AACtD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EAAkB,EAAE,MAAc;IAC1E,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC"}

package/dist/static-lifecycle.d.ts

@@ -0,0 +1,97 @@
+/**
+ * The STATIC §13.1 lifecycle executor (Unit B): the manager-side adapter that drives the ONE
+ * shared core saga (`@cotal-ai/core` lifecycle-saga) over a direct-KV
+ * {@link LifecycleStateTransport}, plus the static executor's OWN orchestration — the durable
+ * slot mapping (F3 outer spawn intent + the F5-bind alias -> (owner, actor, uid) join), the
+ * static credential-ledger rows, and the F1 terminal sequence.
+ *
+ * Three-way split (the Unit B design note, panel-locked): the key/value GRAMMAR lives in core
+ * `lifecycle-state.ts`; the CAS SEQUENCING is the shared core saga this module DELEGATES to
+ * (never a hand-ordered local copy); the barrier ORCHESTRATION here is the static executor's
+ * own (revoke from the slot's recorded credentialIds, best-effort eviction = the child process
+ * kill the manager already did, footprint cleanup via the manager's deprovision hooks).
+ *
+ * F5-bind (the F4 restatement): the wire AUTHORITY coordinate is the incarnation-unique nkey
+ * (`actor`); the ALIAS is routing only, protected by the name-keyed slot row + uid reservation +
+ * the manager's freeSlot hold — never by the head CAS alone (the head is principal-keyed).
+ */
+import { type LifecycleStateTransport, type StaticManagedSlotRow } from "@cotal-ai/core";
+import type { KV } from "@nats-io/kv";
+/** The direct-KV transport over the two authority stores, bound per lifecycle OPERATION on an
+ *  ephemeral, key-pinned `lifecycle-executor` connection (the manager mints it; see
+ *  `withLifecycleExecutor`). Mirrors the auth implementation's sealed `transportOf` — a
+ *  transport carries no sequencing decisions of its own. */
+export declare function staticLifecycleTransport(recordsKv: KV, authKv: KV): LifecycleStateTransport;
+/** Read one slot row (DEL/PURGE marker = corruption, never absence — supervision state is
+ *  CASed over, never deleted). */
+export declare function readStaticSlot(t: LifecycleStateTransport, owner: string, alias: string): Promise<{
+    row: StaticManagedSlotRow;
+    revision: number;
+} | undefined>;
+/** Persist the F3 durable OUTER spawn intent — phase `provisioning`, written BEFORE the head
+ *  activation so a crash between them leaves a discoverable coordinate (the boot sweep or the
+ *  next same-alias spawn re-drives it). Create-only for a virgin alias; a CAS over the RETIRED
+ *  predecessor row for a reused alias; anything else is a live/terminalizing/crashed slot and
+ *  REFUSES loudly (the caller resolves it first — resume or terminal, never silent adoption). */
+export declare function writeStaticSlotIntent(t: LifecycleStateTransport, row: Omit<StaticManagedSlotRow, "phase" | "credentialIds">): Promise<{
+    revision: number;
+}>;
+/** CAS a slot row to a new phase/content at its observed revision. */
+export declare function casStaticSlot(t: LifecycleStateTransport, row: StaticManagedSlotRow, revision: number): Promise<number>;
+/** Record a credentialId on the slot BEFORE its ledger row is appended and BEFORE the cred is
+ *  minted (the crash-safe order: slot record -> ledger row -> mint/write; a credential never
+ *  exists without its id recorded and its row appended first). */
+export declare function recordSlotCredential(t: LifecycleStateTransport, owner: string, alias: string, lifecycleUid: string, credentialId: string): Promise<void>;
+/** Append this incarnation's credential-ledger row (`cred.<uid>.<credId>`, state `active`,
+ *  lineage `root` — the manager's seed IS the root authority in static mode). Create-only;
+ *  an existing SAME row is crash-resume idempotence, anything else refuses. */
+export declare function appendStaticCredentialRow(t: LifecycleStateTransport, args: {
+    lifecycleUid: string;
+    credentialId: string;
+    holderPrincipal: string;
+    exp: number;
+}): Promise<void>;
+/** The static terminal's B1 revoke: CAS every recorded row `active -> revoked`. Enumeration is
+ *  the SLOT's recorded credentialIds (recorded before every mint), never a store listing. An
+ *  ABSENT row is the legitimate crash window (id recorded, mint never reached) — no credential
+ *  exists for it, logged and skipped; a revoked row is idempotence. */
+export declare function revokeStaticCredentialRows(t: LifecycleStateTransport, lifecycleUid: string, credentialIds: readonly string[], log: (line: string) => void): Promise<void>;
+/** The static ACTIVATION: F3 intent FIRST (durable outer spawn intent, phase `provisioning`),
+ *  then the SHARED core activation saga at the spawn's uid (reserve -> gate frozen -> head CAS
+ *  -> reopen LAST). Returns the slot revision the spawn path later CASes to `active` once the
+ *  managed row owns the slot. */
+export declare function activateStaticLifecycle(t: LifecycleStateTransport, args: {
+    owner: string;
+    alias: string;
+    actor: string;
+    lifecycleUid: string;
+    managerInstance: string;
+    ownerInstanceId: string;
+}): Promise<{
+    slotRevision: number;
+}>;
+/** The static TERMINAL (F1, the (b2) order): freeze-under-the-retirement-op -> head
+ *  `active -> retiring` -> B1 ledger revoke -> cleanup (the injected footprint teardown; the
+ *  process kill — static "eviction" — already happened on the manager's stop path) -> gate
+ *  `frozen -> retired` -> head `retiring -> retired` LAST -> slot `retired` (the alias frees).
+ *  Every gate/head step DELEGATES to the shared core saga; recovery recognizes a SAME-OP
+ *  terminal gate and finishes the head (the lost-ack alias wedge the panel closed).
+ *
+ *  Total over partial durable state: an alias whose activation never reached the saga (slot
+ *  `provisioning`, no gate) terminalizes by slot alone; a crashed activation frozen by its own
+ *  activation op is terminalized THROUGH that op (gateRetire is op-pinned) — the exact-op static
+ *  retirement F3 requires. */
+export declare function runStaticTerminal(t: LifecycleStateTransport, args: {
+    owner: string;
+    alias: string;
+    actor: string;
+    lifecycleUid: string;
+    opId: string;
+}, hooks: {
+    cleanup: () => Promise<void>;
+    log: (line: string) => void;
+}): Promise<"retired">;
+/** The boot-sweep resume decision, TOTAL over the phase enum (F3): what the manager must do
+ *  with a durable slot it did not adopt from a live inventory. */
+export declare function planStaticSlotResume(row: StaticManagedSlotRow, adopted: boolean): "none" | "drive-terminal";
+//# sourceMappingURL=static-lifecycle.d.ts.map

package/dist/static-lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-lifecycle.d.ts","sourceRoot":"","sources":["../src/static-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAEL,KAAK,uBAAuB,EAE5B,KAAK,oBAAoB,EAkB1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAItC;;;4DAG4D;AAC5D,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,uBAAuB,CAU3F;AAED;kCACkC;AAClC,wBAAsB,cAAc,CAClC,CAAC,EAAE,uBAAuB,EAC1B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC;IAAE,GAAG,EAAE,oBAAoB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CAOtE;AAED;;;;iGAIiG;AACjG,wBAAsB,qBAAqB,CACzC,CAAC,EAAE,uBAAuB,EAC1B,GAAG,EAAE,IAAI,CAAC,oBAAoB,EAAE,OAAO,GAAG,eAAe,CAAC,GACzD,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAW/B;AAED,sEAAsE;AACtE,wBAAsB,aAAa,CACjC,CAAC,EAAE,uBAAuB,EAC1B,GAAG,EAAE,oBAAoB,EACzB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED;;kEAEkE;AAClE,wBAAsB,oBAAoB,CACxC,CAAC,EAAE,uBAAuB,EAC1B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAQf;AAED;;+EAE+E;AAC/E,wBAAsB,yBAAyB,CAC7C,CAAC,EAAE,uBAAuB,EAC1B,IAAI,EAAE;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACzF,OAAO,CAAC,IAAI,CAAC,CAmBf;AAED;;;uEAGuE;AACvE,wBAAsB,0BAA0B,CAC9C,CAAC,EAAE,uBAAuB,EAC1B,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,SAAS,MAAM,EAAE,EAChC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC1B,OAAO,CAAC,IAAI,CAAC,CAcf;AAED;;;iCAGiC;AACjC,wBAAsB,uBAAuB,CAC3C,CAAC,EAAE,uBAAuB,EAC1B,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,GAC5H,OAAO,CAAC;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CAWnC;AAED;;;;;;;;;;8BAU8B;AAC9B,wBAAsB,iBAAiB,CACrC,CAAC,EAAE,uBAAuB,EAC1B,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACzF,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,GACnE,OAAO,CAAC,SAAS,CAAC,CAoFpB;AAED;kEACkE;AAClE,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,oBAAoB,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,gBAAgB,CAsB3G"}