@cotal-ai/workspace 0.50.0 → 0.51.0

package/dist/seat-checkpoint.js

@@ -0,0 +1,413 @@
+/**
+ * Seat checkpoints: the durable description of one preserved seat, sufficient to start it on
+ * another host, plus the admission gates a destination runs before it launches anything.
+ *
+ * This is the machine-local half of `docs/design/session-recovery.md` sections 1.3 (steps 7 and 8),
+ * 2.2 and 5.4. It lives in `@cotal-ai/workspace` because both the CLI (which cuts and admits) and
+ * the manager (which owns the resume entry) depend on this package and never on each other.
+ *
+ * Two rules shape everything below. A checkpoint is content-addressed: every captured file is
+ * recorded by path, byte size and sha256, and the record is written last, after the digests are
+ * computed over the bytes that landed. And a checkpoint is non-secret by construction: it carries
+ * credential REFERENCES (a path, and for the two credential files a digest) exactly as
+ * `ManagerResumeIdentity` already does, never credential values, never the manager's own launch
+ * material, and never a seat whose launch options could not be resolved.
+ */
+import { closeSync, constants, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { createHash, randomUUID } from "node:crypto";
+import { hardenPrivate } from "@cotal-ai/core";
+export const SEAT_CHECKPOINT_FORMAT = "cotal-seat-checkpoint/v1";
+export const SEAT_CHECKPOINT_RECORD = "checkpoint.json";
+/** The record is a bounded document like the resume document it carries, and for the same reason:
+ *  a reader must be able to size its buffer before it trusts anything in the file. */
+export const MAX_SEAT_CHECKPOINT_BYTES = 1024 * 1024;
+/**
+ * Where one cut's seat checkpoints live: `.cotal/maintenance/v<N>/checkpoints/<attempt>/<seat>/`.
+ *
+ * Scoped by the preservation attempt, not shared across cuts. The writer refuses a destination
+ * that already exists, which is what makes a checkpoint immutable once sealed; without the attempt
+ * in the path the second cut in a root would refuse on the first seat's leftover directory, and
+ * deleting the old one to make room would destroy the artifact a rollback still needs.
+ */
+export function seatCheckpointDir(root, attemptId, version = 1) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,200}$/.test(attemptId))
+        fail(`invalid preservation attempt id for a checkpoint path: ${JSON.stringify(attemptId)}`);
+    return join(root, ".cotal", "maintenance", `v${version}`, "checkpoints", attemptId);
+}
+/** Thrown by every refusal in this module. Each message names what the reader actually saw. */
+export class SeatCheckpointError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "SeatCheckpointError";
+    }
+}
+function fail(message) {
+    throw new SeatCheckpointError(message);
+}
+function fsyncDirectory(path) {
+    let fd;
+    try {
+        fd = openSync(path, constants.O_RDONLY);
+        fsyncSync(fd);
+    }
+    catch (error) {
+        // Windows cannot fsync a directory handle. A POSIX failure here is a durability failure.
+        if (process.platform !== "win32")
+            throw error;
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
+}
+function assertCapturedName(name) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,200}$/.test(name) || name === SEAT_CHECKPOINT_RECORD)
+        fail(`invalid checkpoint file name ${JSON.stringify(name)}`);
+}
+/**
+ * Open a checkpoint destination. The disposition is `createArtifactWriter`'s in
+ * `implementations/cli/src/lib/backup-artifact.ts`: refuse a destination that already exists, and
+ * harden the directory to 0700 before anything lands in it.
+ */
+export function createSeatCheckpointWriter(destination) {
+    const directory = resolve(destination);
+    try {
+        mkdirSync(directory, { mode: 0o700 });
+    }
+    catch (error) {
+        if (error.code === "EEXIST")
+            fail(`seat checkpoint destination already exists: ${directory}`);
+        throw error;
+    }
+    try {
+        hardenPrivate(directory, "dir");
+        fsyncDirectory(dirname(directory));
+    }
+    catch (error) {
+        // Exclusively created and still empty: a failed post-create step must not leak the directory
+        // and block a same-destination retry.
+        try {
+            rmSync(directory, { recursive: true });
+        }
+        catch { /* already absent */ }
+        throw error;
+    }
+    let sealed = false;
+    return {
+        directory,
+        captureFile(name, kind, source, restore) {
+            if (sealed)
+                fail("seat checkpoint is already sealed");
+            assertCapturedName(name);
+            // Validated where it is WRITTEN as well as where it is read: a destination this reader would
+            // refuse must never reach a sealed record, or the cut produces an artifact no resume admits.
+            if (restore !== undefined && !isRestoreDestination(restore))
+                fail(`invalid restore destination for ${name}: ${JSON.stringify(restore)}`);
+            const from = resolve(source);
+            const stat = lstatSync(from);
+            if (!stat.isFile() || stat.isSymbolicLink())
+                fail(`refusing to capture a non-regular or symlinked file: ${from}`);
+            const bytes = readFileSync(from);
+            const path = join(directory, name);
+            const fd = openSync(path, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY, 0o600);
+            try {
+                writeFileSync(fd, bytes);
+                fsyncSync(fd);
+                // The digest must describe the bytes that LANDED, not the bytes we meant to write.
+                if (fstatSync(fd).size !== bytes.byteLength)
+                    fail(`seat checkpoint size mismatch after writing ${name}`);
+            }
+            finally {
+                closeSync(fd);
+            }
+            return {
+                path: name,
+                size: bytes.byteLength,
+                sha256: createHash("sha256").update(bytes).digest("hex"),
+                kind,
+                ...(restore ? { restore } : {}),
+            };
+        },
+        seal(checkpoint) {
+            if (sealed)
+                fail("seat checkpoint is already sealed");
+            const record = { format: SEAT_CHECKPOINT_FORMAT, ...checkpoint };
+            const data = `${JSON.stringify(record, null, 2)}\n`;
+            if (Buffer.byteLength(data) > MAX_SEAT_CHECKPOINT_BYTES)
+                fail(`seat checkpoint record exceeds ${MAX_SEAT_CHECKPOINT_BYTES} bytes`);
+            // The record is the completion marker, so it appears atomically: durable bytes at a temp
+            // name, then one rename. A crash can never leave a truncated checkpoint.json.
+            const path = join(directory, SEAT_CHECKPOINT_RECORD);
+            const tmp = join(directory, `${SEAT_CHECKPOINT_RECORD}.${process.pid}.${randomUUID()}.tmp`);
+            const fd = openSync(tmp, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY, 0o600);
+            try {
+                writeFileSync(fd, data);
+                fsyncSync(fd);
+                closeSync(fd);
+            }
+            catch (error) {
+                try {
+                    closeSync(fd);
+                }
+                catch { /* already closed */ }
+                try {
+                    rmSync(tmp);
+                }
+                catch { /* best effort for the exclusively-created temp */ }
+                throw error;
+            }
+            renameSync(tmp, path);
+            fsyncDirectory(directory);
+            sealed = true;
+            return record;
+        },
+        cleanup() {
+            if (sealed)
+                return;
+            try {
+                rmSync(directory, { recursive: true });
+            }
+            catch { /* already absent */ }
+            fsyncDirectory(dirname(directory));
+        },
+    };
+}
+/**
+ * A restore destination that cannot escape its anchor.
+ *
+ * Relative, non-empty, no leading slash, no `.` or `..` segment, no NUL and no backslash. The
+ * checkpoint is an artifact carried from another host, so this path is untrusted input that names
+ * a file the destination is about to WRITE: without this a record could place a file anywhere the
+ * resuming user can reach.
+ */
+function isRestoreDestination(value) {
+    const destination = value;
+    if (!destination || typeof destination !== "object")
+        return false;
+    if (!["workspace-root", "home", "cwd"].includes(destination.anchor))
+        return false;
+    const path = destination.path;
+    if (typeof path !== "string" || !path || path.length > 1024)
+        return false;
+    if (path.startsWith("/") || path.includes("\\") || path.includes("\0"))
+        return false;
+    return path.split("/").every((segment) => segment && segment !== "." && segment !== "..");
+}
+function isCapturedFile(value) {
+    const file = value;
+    return Boolean(file && typeof file === "object" &&
+        typeof file.path === "string" && /^[A-Za-z0-9][A-Za-z0-9_.-]{0,200}$/.test(file.path) &&
+        Number.isInteger(file.size) && file.size >= 0 &&
+        typeof file.sha256 === "string" && /^[0-9a-f]{64}$/.test(file.sha256) &&
+        (file.restore === undefined || isRestoreDestination(file.restore)));
+}
+/** Parse a checkpoint record, refusing anything a gate would otherwise have to guess about. */
+export function parseSeatCheckpoint(value) {
+    const record = value;
+    if (!record || typeof record !== "object" || Array.isArray(record))
+        fail("seat checkpoint record is not an object");
+    if (record.format !== SEAT_CHECKPOINT_FORMAT)
+        fail(`seat checkpoint format is ${JSON.stringify(record.format)}, expected ${SEAT_CHECKPOINT_FORMAT}`);
+    if (typeof record.space !== "string" || !record.space)
+        fail("seat checkpoint record has no space");
+    if (typeof record.name !== "string" || !record.name)
+        fail("seat checkpoint record has no seat name");
+    // The same token shape `resume.ts` enforces on every identity mode: the uid is recovered, never
+    // minted, so a malformed one must not reach a launch.
+    if (typeof record.lifecycleUid !== "string" || !/^[a-z0-9]{26,32}$/.test(record.lifecycleUid))
+        fail(`seat checkpoint lifecycleUid is not a valid lifecycle token: ${JSON.stringify(record.lifecycleUid)}`);
+    if (!Number.isInteger(record.generation) || record.generation < 0)
+        fail(`seat checkpoint generation is not a non-negative integer: ${JSON.stringify(record.generation)}`);
+    if (typeof record.recencyHorizonMs !== "number" || !Number.isFinite(record.recencyHorizonMs) || record.recencyHorizonMs <= 0)
+        fail(`seat checkpoint recency horizon is not a positive duration: ${JSON.stringify(record.recencyHorizonMs)}`);
+    // An unreadable capturedAt is refused with no override: a freshness gate that fails open is not
+    // a gate.
+    if (typeof record.capturedAt !== "string" || Number.isNaN(Date.parse(record.capturedAt)))
+        fail(`seat checkpoint capturedAt is not a readable instant: ${JSON.stringify(record.capturedAt)}`);
+    const session = record.session;
+    if (!session || typeof session !== "object")
+        fail("seat checkpoint record has no session block");
+    if (!["exact", "fork", "fresh", "drain-only"].includes(session.continuity))
+        fail(`seat checkpoint continuity class is unknown: ${JSON.stringify(session.continuity)}`);
+    if (!Array.isArray(session.store) || !session.store.every(isCapturedFile))
+        fail("seat checkpoint session store is not a list of captured files");
+    if (session.pointer !== undefined && !isCapturedFile(session.pointer))
+        fail("seat checkpoint session pointer is not a captured file");
+    // A session file with nowhere to land is a file a restore would silently drop, and the class it
+    // supports would then promise a session the destination never received.
+    if (session.pointer && !session.pointer.restore)
+        fail("seat checkpoint session pointer records no restore destination");
+    for (const file of session.store) {
+        if (!file.restore)
+            fail(`seat checkpoint session store file ${file.path} records no restore destination`);
+    }
+    const repository = record.repository;
+    if (!repository || typeof repository !== "object")
+        fail("seat checkpoint record has no repository block");
+    if (typeof repository.base !== "string" || !/^[0-9a-f]{40,64}$/.test(repository.base))
+        fail(`seat checkpoint repository base is not a full object id: ${JSON.stringify(repository.base)}`);
+    if (typeof repository.untrackedSelection !== "string" || !repository.untrackedSelection)
+        fail("seat checkpoint repository does not state the untracked selection rule it was produced under");
+    // The empty string is a valid status (a clean tree), so this checks the TYPE and refuses an
+    // absent field: a restore with nothing to compare against would verify nothing.
+    if (typeof repository.status !== "string")
+        fail("seat checkpoint repository does not record the working tree status it was captured from");
+    for (const key of ["bundle", "indexDiff", "worktreeDiff", "untracked"]) {
+        if (!isCapturedFile(repository[key]))
+            fail(`seat checkpoint repository.${key} is not a captured file`);
+    }
+    return record;
+}
+/** Every file a checkpoint names, in one list, so gate 1 cannot miss one by walking the shape. */
+export function seatCheckpointFiles(record) {
+    return [
+        record.repository.bundle,
+        record.repository.indexDiff,
+        record.repository.worktreeDiff,
+        record.repository.untracked,
+        ...(record.session.pointer ? [record.session.pointer] : []),
+        ...record.session.store,
+    ];
+}
+/** Read and parse the record itself, under the same discipline the resume document reader uses:
+ *  no symlink, bounded read, and a re-stat after the read so a file that moved under us is a
+ *  refusal rather than a value. */
+export function readSeatCheckpoint(directory) {
+    const path = join(resolve(directory), SEAT_CHECKPOINT_RECORD);
+    const noFollow = constants.O_NOFOLLOW ?? 0;
+    let fd;
+    try {
+        fd = openSync(path, constants.O_RDONLY | noFollow);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "ENOENT")
+            fail(`seat checkpoint record is missing: ${path}`);
+        if (code === "ELOOP")
+            fail(`seat checkpoint record must not be a symlink: ${path}`);
+        fail(`seat checkpoint record cannot be inspected: ${path}`);
+    }
+    let text;
+    try {
+        const before = fstatSync(fd, { bigint: true });
+        if (!before.isFile())
+            fail(`seat checkpoint record is not a regular file: ${path}`);
+        if (before.size > BigInt(MAX_SEAT_CHECKPOINT_BYTES))
+            fail(`seat checkpoint record exceeds ${MAX_SEAT_CHECKPOINT_BYTES} bytes: ${path}`);
+        const buffer = Buffer.alloc(Number(before.size));
+        let length = 0;
+        while (length < buffer.length) {
+            const count = readSync(fd, buffer, length, buffer.length - length, null);
+            if (count === 0)
+                break;
+            length += count;
+        }
+        const after = fstatSync(fd, { bigint: true });
+        if (before.dev !== after.dev || before.ino !== after.ino || before.size !== after.size ||
+            before.mtimeNs !== after.mtimeNs || before.ctimeNs !== after.ctimeNs)
+            fail(`seat checkpoint record changed while it was being read: ${path}`);
+        text = buffer.subarray(0, length).toString("utf8");
+    }
+    finally {
+        closeSync(fd);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch (error) {
+        fail(`seat checkpoint record is not valid JSON: ${path} (${error.message})`);
+    }
+    return parseSeatCheckpoint(parsed);
+}
+/**
+ * Gate 1, integrity. Every file the checkpoint names must be present, be a regular non-symlink
+ * file, match its recorded byte size, and match its recorded sha256. The file is re-stat'd after
+ * the read and a move is a refusal, which is the standard `readMaintenanceResumeDocument` holds
+ * itself to. Failure here is a refusal and no other gate is consulted.
+ */
+export function assertSeatCheckpointIntegrity(directory, record) {
+    const root = resolve(directory);
+    for (const file of seatCheckpointFiles(record)) {
+        const path = join(root, file.path);
+        const noFollow = constants.O_NOFOLLOW ?? 0;
+        let fd;
+        try {
+            fd = openSync(path, constants.O_RDONLY | noFollow);
+        }
+        catch (error) {
+            const code = error.code;
+            if (code === "ENOENT")
+                fail(`checkpoint integrity: ${file.path} is missing from ${root}`);
+            if (code === "ELOOP")
+                fail(`checkpoint integrity: ${file.path} is a symlink`);
+            fail(`checkpoint integrity: ${file.path} cannot be inspected (${code})`);
+        }
+        try {
+            const before = fstatSync(fd, { bigint: true });
+            if (!before.isFile())
+                fail(`checkpoint integrity: ${file.path} is not a regular file`);
+            if (before.size !== BigInt(file.size))
+                fail(`checkpoint integrity: ${file.path} is ${before.size} bytes, the record says ${file.size}`);
+            const hash = createHash("sha256");
+            const buffer = Buffer.alloc(Math.min(file.size, 1024 * 1024) || 1);
+            let read = 0;
+            while (read < file.size) {
+                const count = readSync(fd, buffer, 0, Math.min(buffer.length, file.size - read), null);
+                if (count === 0)
+                    break;
+                hash.update(buffer.subarray(0, count));
+                read += count;
+            }
+            const after = fstatSync(fd, { bigint: true });
+            if (before.dev !== after.dev || before.ino !== after.ino || before.size !== after.size ||
+                before.mtimeNs !== after.mtimeNs || before.ctimeNs !== after.ctimeNs)
+                fail(`checkpoint integrity: ${file.path} changed while it was being read`);
+            if (read !== file.size)
+                fail(`checkpoint integrity: ${file.path} ended after ${read} of ${file.size} bytes`);
+            const digest = hash.digest("hex");
+            if (digest !== file.sha256)
+                fail(`checkpoint integrity: ${file.path} hashes to ${digest}, the record says ${file.sha256}`);
+        }
+        finally {
+            closeSync(fd);
+        }
+    }
+}
+/**
+ * Gate 2, identity. Authority, not usefulness: this gate has no override, which is the only reason
+ * gate 3 may have one.
+ */
+export function assertSeatCheckpointIdentity(record, admission) {
+    if (record.space !== admission.space)
+        fail(`checkpoint identity: record is for space ${JSON.stringify(record.space)}, this destination is ${JSON.stringify(admission.space)}`);
+    if (admission.lifecycleUidIsLive)
+        fail(`checkpoint identity: lifecycle ${record.lifecycleUid} is already live and this runtime cannot authoritatively adopt it`);
+    const current = admission.profileConfigSha256;
+    // No override. The checkpoint carries the recorded DIGEST, not the config bytes, so nothing here
+    // could run the seat under the recorded revision even if an operator consented; the manager
+    // re-digests the same file and refuses drift on its own. A flag that admitted here and was
+    // refused there would be consent that changes no outcome, so the refusal names the remedy.
+    if (current !== undefined && current !== record.profile.configSha256)
+        fail(`checkpoint identity: this destination's profile revision is ${current}, the checkpoint was cut at ${record.profile.configSha256}; restore the launch config to its recorded revision, then resume`);
+}
+/**
+ * Gate 3, recency. Whether the transcript and the tree are close enough to the world for the
+ * resumed seat's next turn to be sensible. Refused by default outside the horizon, with all three
+ * values in the message; an explicit operator flag overrides and the caller records that it did.
+ */
+export function admitSeatCheckpointRecency(record, admission) {
+    const capturedAt = Date.parse(record.capturedAt);
+    if (Number.isNaN(capturedAt))
+        fail(`checkpoint recency: capturedAt ${JSON.stringify(record.capturedAt)} is not a readable instant`);
+    if (!Number.isFinite(admission.now))
+        fail("checkpoint recency: the destination clock did not read as a finite instant");
+    const ageMs = admission.now - capturedAt;
+    if (ageMs <= record.recencyHorizonMs)
+        return { ageMs, admitted: "inside-horizon" };
+    if (!admission.acceptStale)
+        fail(`checkpoint recency: captured at ${record.capturedAt}, this destination reads ${new Date(admission.now).toISOString()}, horizon is ${record.recencyHorizonMs}ms`);
+    return { ageMs, admitted: "override" };
+}
+//# sourceMappingURL=seat-checkpoint.js.map

package/dist/seat-checkpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seat-checkpoint.js","sourceRoot":"","sources":["../src/seat-checkpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,SAAS,EACT,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,QAAQ,EACR,UAAU,EACV,MAAM,EACN,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,MAAM,CAAC,MAAM,sBAAsB,GAAG,0BAAmC,CAAC;AAC1E,MAAM,CAAC,MAAM,sBAAsB,GAAG,iBAAiB,CAAC;AACxD;sFACsF;AACtF,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,GAAG,IAAI,CAAC;AAErD;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,SAAiB,EAAE,OAAO,GAAG,CAAC;IAC5E,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,SAAS,CAAC;QACvD,IAAI,CAAC,0DAA0D,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC9F,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;AACtF,CAAC;AA0FD,+FAA+F;AAC/F,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,SAAS,IAAI,CAAC,OAAe;IAC3B,MAAM,IAAI,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;QACxC,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,yFAAyF;QACzF,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,MAAM,KAAK,CAAC;IAChD,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,SAAS;YAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,sBAAsB;QACrF,IAAI,CAAC,gCAAgC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACjE,CAAC;AAkBD;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,WAAmB;IAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,SAAS,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YACpD,IAAI,CAAC,+CAA+C,SAAS,EAAE,CAAC,CAAC;QACnE,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAChC,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,6FAA6F;QAC7F,sCAAsC;QACtC,IAAI,CAAC;YAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;QAC9E,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,OAAO;QACL,SAAS;QACT,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO;YACrC,IAAI,MAAM;gBAAE,IAAI,CAAC,mCAAmC,CAAC,CAAC;YACtD,kBAAkB,CAAC,IAAI,CAAC,CAAC;YACzB,6FAA6F;YAC7F,6FAA6F;YAC7F,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC;gBACzD,IAAI,CAAC,mCAAmC,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC9E,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;YAC7B,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE;gBACzC,IAAI,CAAC,wDAAwD,IAAI,EAAE,CAAC,CAAC;YACvE,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACnC,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC5F,IAAI,CAAC;gBACH,aAAa,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;gBACzB,SAAS,CAAC,EAAE,CAAC,CAAC;gBACd,mFAAmF;gBACnF,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,UAAU;oBACzC,IAAI,CAAC,+CAA+C,IAAI,EAAE,CAAC,CAAC;YAChE,CAAC;oBAAS,CAAC;gBACT,SAAS,CAAC,EAAE,CAAC,CAAC;YAChB,CAAC;YACD,OAAO;gBACL,IAAI,EAAE,IAAI;gBACV,IAAI,EAAE,KAAK,CAAC,UAAU;gBACtB,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBACxD,IAAI;gBACJ,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChC,CAAC;QACJ,CAAC;QACD,IAAI,CAAQ,UAAiD;YAC3D,IAAI,MAAM;gBAAE,IAAI,CAAC,mCAAmC,CAAC,CAAC;YACtD,MAAM,MAAM,GAA0B,EAAE,MAAM,EAAE,sBAAsB,EAAE,GAAG,UAAU,EAAE,CAAC;YACxF,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;YACpD,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,yBAAyB;gBACrD,IAAI,CAAC,kCAAkC,yBAAyB,QAAQ,CAAC,CAAC;YAC5E,yFAAyF;YACzF,8EAA8E;YAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;YACrD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,sBAAsB,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,MAAM,CAAC,CAAC;YAC5F,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC3F,IAAI,CAAC;gBACH,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;gBACxB,SAAS,CAAC,EAAE,CAAC,CAAC;gBACd,SAAS,CAAC,EAAE,CAAC,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC;oBAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;gBACrD,IAAI,CAAC;oBAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,kDAAkD,CAAC,CAAC;gBACjF,MAAM,KAAK,CAAC;YACd,CAAC;YACD,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACtB,cAAc,CAAC,SAAS,CAAC,CAAC;YAC1B,MAAM,GAAG,IAAI,CAAC;YACd,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO;YACL,IAAI,MAAM;gBAAE,OAAO;YACnB,IAAI,CAAC;gBAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;YAC9E,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QACrC,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,KAAc;IAC1C,MAAM,WAAW,GAAG,KAAkC,CAAC;IACvD,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClE,IAAI,CAAC,CAAC,gBAAgB,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAClF,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC;IAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI;QAAE,OAAO,KAAK,CAAC;IAC1E,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACrF,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,MAAM,IAAI,GAAG,KAA2B,CAAC;IACzC,OAAO,OAAO,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAC7C,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QACrF,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC;QAC7C,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;QACrE,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,MAAM,MAAM,GAAG,KAAuB,CAAC;IACvC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAChE,IAAI,CAAC,yCAAyC,CAAC,CAAC;IAClD,IAAI,MAAM,CAAC,MAAM,KAAK,sBAAsB;QAC1C,IAAI,CAAC,6BAA6B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,sBAAsB,EAAE,CAAC,CAAC;IACzG,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK;QACnD,IAAI,CAAC,qCAAqC,CAAC,CAAC;IAC9C,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI;QACjD,IAAI,CAAC,yCAAyC,CAAC,CAAC;IAClD,gGAAgG;IAChG,sDAAsD;IACtD,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;QAC3F,IAAI,CAAC,gEAAgE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC9G,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,UAAU,GAAG,CAAC;QAC/D,IAAI,CAAC,6DAA6D,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACzG,IAAI,OAAO,MAAM,CAAC,gBAAgB,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,MAAM,CAAC,gBAAgB,IAAI,CAAC;QAC1H,IAAI,CAAC,+DAA+D,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACjH,gGAAgG;IAChG,UAAU;IACV,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACtF,IAAI,CAAC,yDAAyD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACrG,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QACzC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IACtD,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC;QACxE,IAAI,CAAC,gDAAgD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC7F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC;QACvE,IAAI,CAAC,+DAA+D,CAAC,CAAC;IACxE,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC;QACnE,IAAI,CAAC,wDAAwD,CAAC,CAAC;IACjE,gGAAgG;IAChG,wEAAwE;IACxE,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO;QAC7C,IAAI,CAAC,gEAAgE,CAAC,CAAC;IACzE,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,sCAAsC,IAAI,CAAC,IAAI,iCAAiC,CAAC,CAAC;IAC5G,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACrC,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ;QAC/C,IAAI,CAAC,gDAAgD,CAAC,CAAC;IACzD,IAAI,OAAO,UAAU,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QACnF,IAAI,CAAC,4DAA4D,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtG,IAAI,OAAO,UAAU,CAAC,kBAAkB,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,kBAAkB;QACrF,IAAI,CAAC,8FAA8F,CAAC,CAAC;IACvG,4FAA4F;IAC5F,gFAAgF;IAChF,IAAI,OAAO,UAAU,CAAC,MAAM,KAAK,QAAQ;QACvC,IAAI,CAAC,yFAAyF,CAAC,CAAC;IAClG,KAAK,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,CAAU,EAAE,CAAC;QAChF,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,CAAC,8BAA8B,GAAG,yBAAyB,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,mBAAmB,CAAC,MAAsB;IACxD,OAAO;QACL,MAAM,CAAC,UAAU,CAAC,MAAM;QACxB,MAAM,CAAC,UAAU,CAAC,SAAS;QAC3B,MAAM,CAAC,UAAU,CAAC,YAAY;QAC9B,MAAM,CAAC,UAAU,CAAC,SAAS;QAC3B,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK;KACxB,CAAC;AACJ,CAAC;AAED;;mCAEmC;AACnC,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,sBAAsB,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC;IAC3C,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,QAAQ,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;QACnD,IAAI,IAAI,KAAK,QAAQ;YAAE,IAAI,CAAC,sCAAsC,IAAI,EAAE,CAAC,CAAC;QAC1E,IAAI,IAAI,KAAK,OAAO;YAAE,IAAI,CAAC,iDAAiD,IAAI,EAAE,CAAC,CAAC;QACpF,IAAI,CAAC,+CAA+C,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,EAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;YAClB,IAAI,CAAC,iDAAiD,IAAI,EAAE,CAAC,CAAC;QAChE,IAAI,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,yBAAyB,CAAC;YACjD,IAAI,CAAC,kCAAkC,yBAAyB,WAAW,IAAI,EAAE,CAAC,CAAC;QACrF,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACjD,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,OAAO,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC;YAC1E,IAAI,KAAK,KAAK,CAAC;gBAAE,MAAM;YACvB,MAAM,IAAI,KAAK,CAAC;QAClB,CAAC;QACD,MAAM,KAAK,GAAG,SAAS,CAAC,EAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;YAClF,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;YACtE,IAAI,CAAC,2DAA2D,IAAI,EAAE,CAAC,CAAC;QAC1E,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAG,CAAC,CAAC;IACjB,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,6CAA6C,IAAI,KAAM,KAAe,CAAC,OAAO,GAAG,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAAC,SAAiB,EAAE,MAAsB;IACrF,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC;QAC3C,IAAI,EAAU,CAAC;QACf,IAAI,CAAC;YACH,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,QAAQ,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;YACnD,IAAI,IAAI,KAAK,QAAQ;gBAAE,IAAI,CAAC,yBAAyB,IAAI,CAAC,IAAI,oBAAoB,IAAI,EAAE,CAAC,CAAC;YAC1F,IAAI,IAAI,KAAK,OAAO;gBAAE,IAAI,CAAC,yBAAyB,IAAI,CAAC,IAAI,eAAe,CAAC,CAAC;YAC9E,IAAI,CAAC,yBAAyB,IAAI,CAAC,IAAI,yBAAyB,IAAI,GAAG,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,SAAS,CAAC,EAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;gBAAE,IAAI,CAAC,yBAAyB,IAAI,CAAC,IAAI,wBAAwB,CAAC,CAAC;YACvF,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;gBACnC,IAAI,CAAC,yBAAyB,IAAI,CAAC,IAAI,OAAO,MAAM,CAAC,IAAI,2BAA2B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACnG,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YAClC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACnE,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,OAAO,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBACxB,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAG,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;gBACxF,IAAI,KAAK,KAAK,CAAC;oBAAE,MAAM;gBACvB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;gBACvC,IAAI,IAAI,KAAK,CAAC;YAChB,CAAC;YACD,MAAM,KAAK,GAAG,SAAS,CAAC,EAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/C,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;gBAClF,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;gBACtE,IAAI,CAAC,yBAAyB,IAAI,CAAC,IAAI,kCAAkC,CAAC,CAAC;YAC7E,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI;gBACpB,IAAI,CAAC,yBAAyB,IAAI,CAAC,IAAI,gBAAgB,IAAI,OAAO,IAAI,CAAC,IAAI,QAAQ,CAAC,CAAC;YACvF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAClC,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM;gBACxB,IAAI,CAAC,yBAAyB,IAAI,CAAC,IAAI,cAAc,MAAM,qBAAqB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACnG,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,EAAG,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;AACH,CAAC;AAaD;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAAsB,EAAE,SAAgC;IACnG,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,KAAK;QAClC,IAAI,CAAC,4CAA4C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3I,IAAI,SAAS,CAAC,kBAAkB;QAC9B,IAAI,CAAC,kCAAkC,MAAM,CAAC,YAAY,mEAAmE,CAAC,CAAC;IACjI,MAAM,OAAO,GAAG,SAAS,CAAC,mBAAmB,CAAC;IAC9C,iGAAiG;IACjG,4FAA4F;IAC5F,2FAA2F;IAC3F,2FAA2F;IAC3F,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,MAAM,CAAC,OAAO,CAAC,YAAY;QAClE,IAAI,CAAC,+DAA+D,OAAO,+BAA+B,MAAM,CAAC,OAAO,CAAC,YAAY,mEAAmE,CAAC,CAAC;AAC9M,CAAC;AAkBD;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAAsB,EAAE,SAA+B;IAChG,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;QAC1B,IAAI,CAAC,kCAAkC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,4BAA4B,CAAC,CAAC;IACxG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC;QACjC,IAAI,CAAC,4EAA4E,CAAC,CAAC;IACrF,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,GAAG,UAAU,CAAC;IACzC,IAAI,KAAK,IAAI,MAAM,CAAC,gBAAgB;QAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IACnF,IAAI,CAAC,SAAS,CAAC,WAAW;QACxB,IAAI,CAAC,mCAAmC,MAAM,CAAC,UAAU,4BAA4B,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,gBAAgB,MAAM,CAAC,gBAAgB,IAAI,CAAC,CAAC;IACzK,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;AACzC,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cotal-ai/workspace",
   "description": "Cotal machine-local workstation layer: the ~/.cotal mesh registry, target resolution, preflight, on-disk auth-path I/O, and the command-copy renderer — operator concerns over a local checkout, kept separate from the wire protocol in @cotal-ai/core.",
-  "version": "0.50.0",
+  "version": "0.51.0",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -18,7 +18,7 @@
     }
   },
   "dependencies": {
-    "@cotal-ai/core": "0.50.0"
+    "@cotal-ai/core": "0.51.0"
   },
   "devDependencies": {
     "@cotal-ai/smoke-kit": "0.0.0"