@cuna_labs/cli 0.1.0

package/dist/journey/workspace-effects.d.ts

@@ -0,0 +1,30 @@
+import type { CunaApiClient } from "../api/client.js";
+import type { ContinuousSyncSnapshot } from "../sync/continuous-sync-supervisor.js";
+import { type AuthenticatedWorkspaceSyncTransport } from "../sync/workspace-sync-product-service.js";
+import type { FilesystemCapabilities } from "../workspace/paths.js";
+import type { AgentJourneyEffects } from "./orchestrator.js";
+export interface WorkspaceJourneyEffectsInput {
+    readonly client: CunaApiClient;
+    readonly transport: AuthenticatedWorkspaceSyncTransport;
+    readonly profileId: string;
+    readonly userId: string;
+    readonly workspaceId: string;
+    readonly stateDirectory: string;
+    readonly filesystemCapabilities: FilesystemCapabilities;
+    /**
+     * One human-readable line about a decision the journey took on the person's
+     * behalf (today: the folder was rebound to another Machine). Absent in
+     * structured or non-interactive runs; the decision is taken either way.
+     */
+    readonly onNotice?: (line: string) => void;
+}
+/** Local binding facts are only hints until the complete tuple is re-read from the API. */
+export interface WorkspaceJourneyEffects extends Pick<AgentJourneyEffects, "inspectWorkspace" | "synchronizeWorkspace"> {
+    readonly continuousSyncSnapshot: () => ContinuousSyncSnapshot | undefined;
+    readonly subscribeContinuousSync: (listener: (snapshot: ContinuousSyncSnapshot) => void) => () => void;
+    readonly stopContinuousSync: () => Promise<void>;
+}
+export declare function createWorkspaceJourneyEffects(input: WorkspaceJourneyEffectsInput): WorkspaceJourneyEffects;
+/** Safe under-claims never become guessed remote capabilities. */
+export declare function conservativeFilesystemCapabilities(platform: FilesystemCapabilities["platform"]): FilesystemCapabilities;
+//# sourceMappingURL=workspace-effects.d.ts.map

package/dist/journey/workspace-effects.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-effects.d.ts","sourceRoot":"","sources":["../../src/journey/workspace-effects.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGtD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AACpF,OAAO,EAKL,KAAK,mCAAmC,EACzC,MAAM,2CAA2C,CAAC;AAEnD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAEpE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAE7D,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,mCAAmC,CAAC;IACxD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,sBAAsB,EAAE,sBAAsB,CAAC;IACxD;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC5C;AAwED,2FAA2F;AAC3F,MAAM,WAAW,uBAAwB,SAAQ,IAAI,CAAC,mBAAmB,EAAE,kBAAkB,GAAG,sBAAsB,CAAC;IACrH,QAAQ,CAAC,sBAAsB,EAAE,MAAM,sBAAsB,GAAG,SAAS,CAAC;IAC1E,QAAQ,CAAC,uBAAuB,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,sBAAsB,KAAK,IAAI,KAAK,MAAM,IAAI,CAAC;IACvG,QAAQ,CAAC,kBAAkB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAClD;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,4BAA4B,GAAG,uBAAuB,CAoS1G;AAED,kEAAkE;AAClE,wBAAgB,kCAAkC,CAAC,QAAQ,EAAE,sBAAsB,CAAC,UAAU,CAAC,GAAG,sBAAsB,CAEvH"}

package/dist/journey/workspace-effects.js

@@ -0,0 +1,348 @@
+import { createHash } from "node:crypto";
+import { mkdir } from "node:fs/promises";
+import { join } from "node:path";
+import { EXIT_CODES, CunaError } from "../core/errors.js";
+import { inspectWorkspaceSyncPolicy, startContinuousWorkspaceSync, computeWorkspaceManifestRoot, synchronizeLocalWorkspace, } from "../sync/workspace-sync-product-service.js";
+import { loadWorkspaceBindingIntent, persistWorkspaceBinding, workspaceBindingCompareAndSwap } from "../workspace/binding-store.js";
+import { stableUuid } from "./derived-identity.js";
+function fail(code, message, exitCode = EXIT_CODES.conflict) {
+    return new CunaError({ code, message, exitCode });
+}
+/**
+ * Whether the Machine a folder is bound to still exists, read from the Machine
+ * authority itself rather than inferred from a listing.
+ *
+ * Two answers mean "gone": a 404 (`cuna.remote.not_found`, the row is absent)
+ * and a row the server still returns in state `deleted` (the list endpoint
+ * hides those, the read does not). Everything else is not evidence of absence:
+ * a transient failure stays the retryable error it already is, and a 404
+ * without an API body (`operation_not_served`) says this deployment lacks the
+ * route, not that the Machine is gone.
+ */
+async function observeBoundMachine(client, machineId, signal) {
+    let machine;
+    try {
+        machine = await client.getMachine(machineId, signal);
+    }
+    catch (error) {
+        if (error instanceof CunaError && error.code === "cuna.remote.not_found")
+            return Object.freeze({ kind: "absent" });
+        throw error;
+    }
+    if (machine.state === "deleted")
+        return Object.freeze({ kind: "absent" });
+    return Object.freeze({ kind: "present", machine });
+}
+/** The Machine's name when it can be read, its id otherwise. Never throws: this only decorates a message. */
+async function machineDisplayName(client, machineId, signal) {
+    try {
+        const machine = await client.getMachine(machineId, signal);
+        return machine.name.trim().length > 0 ? machine.name : machineId;
+    }
+    catch {
+        return machineId;
+    }
+}
+function bindingKey(workspaceId, userId, canonicalRoot) {
+    return createHash("sha256").update(`${workspaceId}\0${userId}\0${canonicalRoot}`, "utf8").digest("hex");
+}
+function workspaceBindingCreateKey(request) {
+    // Version the namespace as well as hashing the complete producer body. Old
+    // builds keyed only the local root, so a later machine selection could reuse
+    // a key already bound to another request and fail forever with
+    // workspace_binding_idempotency_conflict. A v2 key can adopt an existing
+    // canonical binding without colliding with those spent legacy keys.
+    const canonicalIntent = JSON.stringify({
+        workspace_id: request.workspaceId,
+        project_id: request.projectId,
+        local_instance_id: request.localInstanceId,
+        machine_id: request.machineId,
+        exclusion_policy_digest: request.exclusionPolicyDigest,
+        excluded_prefixes: request.excludedPrefixes,
+    });
+    const digest = createHash("sha256").update(canonicalIntent, "utf8").digest("hex");
+    return `cuna-workspace-binding-v2-${digest}`;
+}
+export function createWorkspaceJourneyEffects(input) {
+    let supervisor;
+    const syncListeners = new Set();
+    let unsubscribeSupervisor;
+    const inspect = async (localPath) => {
+        const policy = await inspectWorkspaceSyncPolicy({ localRoot: localPath, filesystemCapabilities: input.filesystemCapabilities });
+        const local = await loadWorkspaceBindingIntent({
+            startPath: policy.canonicalRoot,
+            profileId: input.profileId,
+            userId: input.userId,
+            workspaceId: input.workspaceId,
+        });
+        return local === undefined ? Object.freeze({ policy }) : Object.freeze({ policy, local });
+    };
+    const effects = {
+        continuousSyncSnapshot: () => supervisor?.snapshot,
+        subscribeContinuousSync(listener) {
+            syncListeners.add(listener);
+            const snapshot = supervisor?.snapshot;
+            if (snapshot !== undefined) {
+                try {
+                    listener(snapshot);
+                }
+                catch { /* Status observers never own synchronization correctness. */ }
+            }
+            return () => syncListeners.delete(listener);
+        },
+        async stopContinuousSync() {
+            const current = supervisor;
+            supervisor = undefined;
+            unsubscribeSupervisor?.();
+            unsubscribeSupervisor = undefined;
+            await current?.stop();
+        },
+        async inspectWorkspace({ localPath, syncMode, signal }) {
+            signal.throwIfAborted();
+            const inspected = await inspect(localPath);
+            if (syncMode !== "disabled") {
+                // Reject local content before provisioning. This result is deliberately
+                // discarded: synchronization must scan again against current files.
+                await computeWorkspaceManifestRoot({
+                    localRoot: inspected.policy.canonicalRoot,
+                    filesystemCapabilities: input.filesystemCapabilities,
+                    signal,
+                });
+            }
+            signal.throwIfAborted();
+            // The canonical root leaves this layer because the machine-create request
+            // identity is derived from it. Recomputing it in the orchestrator would
+            // make two answers to "which project is this", and the create identity
+            // and the binding identity would drift apart under symlinks or case.
+            return Object.freeze({
+                canonicalLocalRoot: inspected.policy.canonicalRoot,
+                ...(inspected.local === undefined ? {} : { projectMachineId: inspected.local.record.machineId }),
+            });
+        },
+        async synchronizeWorkspace({ machineId, localPath, syncMode, signal }) {
+            const inspected = await inspect(localPath);
+            // The local record this run will compare-and-swap against. A rebind
+            // replaces it below, so every later persist must swap against the
+            // rebound record, not the one that named the vanished Machine.
+            let localRecord = inspected.local?.record;
+            let authority;
+            if (inspected.local !== undefined) {
+                const record = inspected.local.record;
+                if (record.policyDigest !== inspected.policy.exclusionPolicyDigest) {
+                    throw fail("cuna.journey.workspace_binding_conflict", "The local project binding does not authorize the selected exclusion policy.");
+                }
+                if (record.machineId !== machineId) {
+                    // The folder is the project; a Machine is disposable (PRD-PM-008
+                    // §H, E14-D1). Decide from the Machine authority, not the listing:
+                    // gone means rebind, present means the typed refusal, anything else
+                    // is not evidence and keeps its own error.
+                    const bound = await observeBoundMachine(input.client, record.machineId, signal);
+                    if (bound.kind === "present") {
+                        const boundName = bound.machine.name.trim().length > 0 ? bound.machine.name : record.machineId;
+                        const selectedName = await machineDisplayName(input.client, machineId, signal);
+                        throw new CunaError({
+                            code: "cuna.journey.workspace_binding_conflict",
+                            message: `This folder is bound to Machine ${boundName}, not ${selectedName}.`,
+                            exitCode: EXIT_CODES.conflict,
+                            hint: `Run the same command with \`--machine ${boundName}\` to use the Machine this folder is bound to, or delete \`.cuna/workspace.json\` in this folder to bind it to ${selectedName} on the next run. Neither touches the Workspace on either Machine.`,
+                            details: {
+                                bound_machine_id: record.machineId,
+                                bound_machine_name: boundName,
+                                selected_machine_id: machineId,
+                                selected_machine_name: selectedName,
+                            },
+                        });
+                    }
+                    const createRequest = Object.freeze({
+                        workspaceId: input.workspaceId,
+                        projectId: record.projectId,
+                        localInstanceId: record.localInstanceId,
+                        machineId,
+                        exclusionPolicyDigest: inspected.policy.exclusionPolicyDigest,
+                        excludedPrefixes: Object.freeze([]),
+                    });
+                    authority = await input.client.createWorkspaceBinding(createRequest, workspaceBindingCreateKey(createRequest), signal);
+                    // Commit the rebind before any synchronization so the receipt is
+                    // truthful even if this run stops here: the next run finds the new
+                    // Machine, not a second vanished one.
+                    localRecord = await persistWorkspaceBinding({
+                        root: inspected.policy.canonicalRoot,
+                        binding: {
+                            profileId: input.profileId,
+                            userId: input.userId,
+                            workspaceId: input.workspaceId,
+                            bindingId: authority.bindingId,
+                            projectId: authority.projectId,
+                            ...(authority.executionWorkspaceId == null ? {} : { executionWorkspaceId: authority.executionWorkspaceId }),
+                            localInstanceId: authority.localInstanceId,
+                            machineId,
+                            remoteRoot: authority.remoteRoot,
+                            policyDigest: authority.exclusionPolicyDigest,
+                            generation: authority.activeGeneration,
+                            bindingCreatedAt: authority.createdAt,
+                            bindingUpdatedAt: authority.updatedAt,
+                        },
+                        expected: workspaceBindingCompareAndSwap(record),
+                        rebind: true,
+                    });
+                    input.onNotice?.(`Rebound this folder to ${await machineDisplayName(input.client, machineId, signal)} · the previous Machine no longer exists`);
+                }
+                else {
+                    authority = await input.client.getWorkspaceBinding(record.bindingId, {
+                        ...(record.executionWorkspaceId === undefined ? {} : { executionWorkspaceId: record.executionWorkspaceId }),
+                        workspaceId: input.workspaceId,
+                        projectId: record.projectId,
+                        localInstanceId: record.localInstanceId,
+                        machineId,
+                        exclusionPolicyDigest: inspected.policy.exclusionPolicyDigest,
+                    }, signal);
+                    if ((authority.executionWorkspaceId ?? null) !== (record.executionWorkspaceId ?? null) || authority.remoteRoot !== record.remoteRoot) {
+                        throw fail("cuna.journey.workspace_binding_conflict", "The server Workspace identity differs from this folder's recorded binding.");
+                    }
+                }
+            }
+            else {
+                if (syncMode === "disabled") {
+                    throw fail("cuna.journey.workspace_binding_required", "--no-sync requires an existing remotely committed workspace binding.", EXIT_CODES.policy);
+                }
+                const intentDigest = bindingKey(input.workspaceId, input.userId, inspected.policy.canonicalRoot);
+                // These identities are stable for this owner/root and installation.
+                // Therefore a crash after the remote create but before local commit
+                // retries the identical tuple and idempotency key, never a duplicate.
+                const projectId = stableUuid("cuna.workspace.project.v1", intentDigest);
+                const localInstanceId = stableUuid("cuna.workspace.local-instance.v1", `${intentDigest}\0${input.stateDirectory}`);
+                const createRequest = Object.freeze({
+                    workspaceId: input.workspaceId,
+                    projectId,
+                    localInstanceId,
+                    machineId,
+                    exclusionPolicyDigest: inspected.policy.exclusionPolicyDigest,
+                    excludedPrefixes: Object.freeze([]),
+                });
+                authority = await input.client.createWorkspaceBinding(createRequest, workspaceBindingCreateKey(createRequest), signal);
+            }
+            if (syncMode === "disabled") {
+                if (authority.activeGeneration < 1) {
+                    throw fail("cuna.journey.workspace_generation_unavailable", "--no-sync cannot attach until the binding has a committed workspace generation.", EXIT_CODES.policy);
+                }
+                return Object.freeze({ ...(authority.executionWorkspaceId == null ? {} : { executionWorkspaceId: authority.executionWorkspaceId }), bindingId: authority.bindingId, workspaceIdentity: authority.bindingId, generation: authority.activeGeneration, remoteCwd: authority.remoteRoot });
+            }
+            // A generation is a witness to workspace content. If the content has not
+            // changed there is nothing to witness, so do not commit one.
+            //
+            // This is not an optimisation. `workspaceGeneration` is part of the
+            // AgentSession identity key (`journey/selection.ts:596-604`), so a
+            // generation committed for identical content makes the previous session
+            // stop being "exact" and forces a sibling with a new process epoch.
+            // Measured in production 2026-08-30 on binding dab40ec9: generations 1,
+            // 2 and 3 all carry manifest root d4313d11…, entry_count 1,
+            // content_bytes 28 — three generations, one manifest, no file touched.
+            // Two runs against one Machine left two live OpenCode processes where the
+            // owner expected to reconnect to one.
+            //
+            // The manifest is recomputed inside `synchronizeLocalWorkspace` when the
+            // content HAS changed, which is the only case that pays for it. Skipping
+            // returns exactly the shape the proven `--no-sync` branch above returns.
+            const currentManifestRoot = await computeWorkspaceManifestRoot({
+                localRoot: inspected.policy.canonicalRoot,
+                filesystemCapabilities: input.filesystemCapabilities,
+            });
+            if (authority.activeGeneration >= 1 &&
+                authority.activeManifestRoot === currentManifestRoot) {
+                if (localRecord === undefined || localRecord.generation !== authority.activeGeneration) {
+                    await persistWorkspaceBinding({
+                        root: inspected.policy.canonicalRoot,
+                        binding: {
+                            profileId: input.profileId, userId: input.userId, workspaceId: input.workspaceId,
+                            bindingId: authority.bindingId, projectId: authority.projectId,
+                            ...(authority.executionWorkspaceId == null ? {} : { executionWorkspaceId: authority.executionWorkspaceId }),
+                            localInstanceId: authority.localInstanceId, machineId, remoteRoot: authority.remoteRoot,
+                            policyDigest: authority.exclusionPolicyDigest, generation: authority.activeGeneration,
+                            bindingCreatedAt: authority.createdAt, bindingUpdatedAt: authority.updatedAt,
+                        },
+                        expected: localRecord === undefined ? null : workspaceBindingCompareAndSwap(localRecord),
+                    });
+                }
+                return Object.freeze({
+                    bindingId: authority.bindingId,
+                    ...(authority.executionWorkspaceId == null ? {} : { executionWorkspaceId: authority.executionWorkspaceId }),
+                    workspaceIdentity: authority.bindingId,
+                    generation: authority.activeGeneration,
+                    remoteCwd: authority.remoteRoot,
+                });
+            }
+            const checkpointRoot = join(input.stateDirectory, "workspace-sync");
+            await mkdir(checkpointRoot, { recursive: true, mode: 0o700 });
+            const receipt = await synchronizeLocalWorkspace({
+                localRoot: inspected.policy.canonicalRoot,
+                workspaceId: input.workspaceId,
+                workspaceBindingId: authority.bindingId,
+                machineId,
+                baseGeneration: authority.activeGeneration,
+                transport: input.transport,
+                checkpointRoot,
+                filesystemCapabilities: input.filesystemCapabilities,
+                signal,
+            });
+            const committedAuthority = await input.client.getWorkspaceBinding(authority.bindingId, {
+                ...(authority.executionWorkspaceId == null ? {} : { executionWorkspaceId: authority.executionWorkspaceId }),
+                workspaceId: input.workspaceId,
+                projectId: authority.projectId,
+                localInstanceId: authority.localInstanceId,
+                machineId,
+                exclusionPolicyDigest: authority.exclusionPolicyDigest,
+            }, signal);
+            if ((committedAuthority.executionWorkspaceId ?? null) !== (authority.executionWorkspaceId ?? null) ||
+                committedAuthority.remoteRoot !== authority.remoteRoot ||
+                committedAuthority.activeGeneration !== receipt.generation ||
+                committedAuthority.activeManifestRoot !== receipt.manifest_root) {
+                throw fail("cuna.journey.workspace_commit_unproven", "The WorkspaceBinding authority does not confirm the committed synchronization receipt.", EXIT_CODES.remote);
+            }
+            const persisted = await persistWorkspaceBinding({
+                root: inspected.policy.canonicalRoot,
+                binding: {
+                    profileId: input.profileId,
+                    userId: input.userId,
+                    workspaceId: input.workspaceId,
+                    bindingId: committedAuthority.bindingId,
+                    projectId: committedAuthority.projectId,
+                    ...(committedAuthority.executionWorkspaceId == null ? {} : { executionWorkspaceId: committedAuthority.executionWorkspaceId }),
+                    localInstanceId: committedAuthority.localInstanceId,
+                    machineId,
+                    remoteRoot: committedAuthority.remoteRoot,
+                    policyDigest: committedAuthority.exclusionPolicyDigest,
+                    generation: receipt.generation,
+                    bindingCreatedAt: committedAuthority.createdAt,
+                    bindingUpdatedAt: committedAuthority.updatedAt,
+                },
+                expected: localRecord === undefined ? null : workspaceBindingCompareAndSwap(localRecord),
+            });
+            supervisor = await startContinuousWorkspaceSync({
+                localRoot: inspected.policy.canonicalRoot,
+                workspaceId: input.workspaceId,
+                workspaceBindingId: persisted.bindingId,
+                machineId,
+                baseGeneration: authority.activeGeneration,
+                transport: input.transport,
+                checkpointRoot,
+                filesystemCapabilities: input.filesystemCapabilities,
+                initialReceipt: receipt,
+            });
+            unsubscribeSupervisor = supervisor.subscribe((snapshot) => {
+                for (const listener of syncListeners) {
+                    try {
+                        listener(snapshot);
+                    }
+                    catch { /* Status observers never own synchronization correctness. */ }
+                }
+            });
+            return Object.freeze({ ...(persisted.executionWorkspaceId === undefined ? {} : { executionWorkspaceId: persisted.executionWorkspaceId }), bindingId: persisted.bindingId, workspaceIdentity: persisted.bindingId, generation: persisted.generation, remoteCwd: persisted.remoteRoot });
+        },
+    };
+    return Object.freeze(effects);
+}
+/** Safe under-claims never become guessed remote capabilities. */
+export function conservativeFilesystemCapabilities(platform) {
+    return Object.freeze({ platform, caseSensitive: false, unicodeNormalization: "nfc", symlinks: false, atomicRename: false, maximumComponentBytes: 255, maximumPathBytes: 4_096 });
+}
+//# sourceMappingURL=workspace-effects.js.map

package/dist/journey/workspace-effects.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-effects.js","sourceRoot":"","sources":["../../src/journey/workspace-effects.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAIjC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAiB,MAAM,mBAAmB,CAAC;AAEzE,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,4BAA4B,EAC5B,yBAAyB,GAE1B,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,0BAA0B,EAAE,uBAAuB,EAAE,8BAA8B,EAA+B,MAAM,+BAA+B,CAAC;AAEjK,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAmBnD,SAAS,IAAI,CAAC,IAAY,EAAE,OAAe,EAAE,WAAqB,UAAU,CAAC,QAAQ;IACnF,OAAO,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,mBAAmB,CAChC,MAAqB,EACrB,SAAiB,EACjB,MAAmB;IAEnB,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,uBAAuB;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAiB,EAAE,CAAC,CAAC;QAC5H,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAiB,EAAE,CAAC,CAAC;IACnF,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAkB,EAAE,OAAO,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,6GAA6G;AAC7G,KAAK,UAAU,kBAAkB,CAAC,MAAqB,EAAE,SAAiB,EAAE,MAAmB;IAC7F,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC3D,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,WAAmB,EAAE,MAAc,EAAE,aAAqB;IAC5E,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,WAAW,KAAK,MAAM,KAAK,aAAa,EAAE,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1G,CAAC;AAED,SAAS,yBAAyB,CAAC,OAOlC;IACC,2EAA2E;IAC3E,6EAA6E;IAC7E,+DAA+D;IAC/D,yEAAyE;IACzE,oEAAoE;IACpE,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC;QACrC,YAAY,EAAE,OAAO,CAAC,WAAW;QACjC,UAAU,EAAE,OAAO,CAAC,SAAS;QAC7B,iBAAiB,EAAE,OAAO,CAAC,eAAe;QAC1C,UAAU,EAAE,OAAO,CAAC,SAAS;QAC7B,uBAAuB,EAAE,OAAO,CAAC,qBAAqB;QACtD,iBAAiB,EAAE,OAAO,CAAC,gBAAgB;KAC5C,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClF,OAAO,6BAA6B,MAAM,EAAE,CAAC;AAC/C,CAAC;AASD,MAAM,UAAU,6BAA6B,CAAC,KAAmC;IAC/E,IAAI,UAAgF,CAAC;IACrF,MAAM,aAAa,GAAG,IAAI,GAAG,EAA8C,CAAC;IAC5E,IAAI,qBAA+C,CAAC;IACpD,MAAM,OAAO,GAAG,KAAK,EAAE,SAAiB,EAGrC,EAAE;QACH,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,sBAAsB,EAAE,KAAK,CAAC,sBAAsB,EAAE,CAAC,CAAC;QAChI,MAAM,KAAK,GAAG,MAAM,0BAA0B,CAAC;YAC7C,SAAS,EAAE,MAAM,CAAC,aAAa;YAC/B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC,CAAC;QACH,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5F,CAAC,CAAC;IAEF,MAAM,OAAO,GAA4B;QACvC,sBAAsB,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,QAAQ;QAClD,uBAAuB,CAAC,QAAoD;YAC1E,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC5B,MAAM,QAAQ,GAAG,UAAU,EAAE,QAAQ,CAAC;YACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,6DAA6D,CAAC,CAAC;YACrG,CAAC;YACD,OAAO,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC9C,CAAC;QACD,KAAK,CAAC,kBAAkB;YACtB,MAAM,OAAO,GAAG,UAAU,CAAC;YAC3B,UAAU,GAAG,SAAS,CAAC;YACvB,qBAAqB,EAAE,EAAE,CAAC;YAC1B,qBAAqB,GAAG,SAAS,CAAC;YAClC,MAAM,OAAO,EAAE,IAAI,EAAE,CAAC;QACxB,CAAC;QACD,KAAK,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE;YACpD,MAAM,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC;YAC3C,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;gBAC5B,wEAAwE;gBACxE,oEAAoE;gBACpE,MAAM,4BAA4B,CAAC;oBACjC,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,aAAa;oBACzC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;oBACpD,MAAM;iBACP,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CAAC,cAAc,EAAE,CAAC;YACxB,0EAA0E;YAC1E,wEAAwE;YACxE,uEAAuE;YACvE,qEAAqE;YACrE,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,kBAAkB,EAAE,SAAS,CAAC,MAAM,CAAC,aAAa;gBAClD,GAAG,CAAC,SAAS,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;aACjG,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,oBAAoB,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE;YACnE,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC;YAC3C,oEAAoE;YACpE,kEAAkE;YAClE,+DAA+D;YAC/D,IAAI,WAAW,GAAG,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC;YAC1C,IAAI,SAAS,CAAC;YACd,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAClC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;gBACtC,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC;oBACnE,MAAM,IAAI,CAAC,yCAAyC,EAAE,6EAA6E,CAAC,CAAC;gBACvI,CAAC;gBACD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;oBACnC,iEAAiE;oBACjE,mEAAmE;oBACnE,oEAAoE;oBACpE,2CAA2C;oBAC3C,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;oBAChF,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;wBAC7B,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;wBAC/F,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;wBAC/E,MAAM,IAAI,SAAS,CAAC;4BAClB,IAAI,EAAE,yCAAyC;4BAC/C,OAAO,EAAE,mCAAmC,SAAS,SAAS,YAAY,GAAG;4BAC7E,QAAQ,EAAE,UAAU,CAAC,QAAQ;4BAC7B,IAAI,EAAE,yCAAyC,SAAS,kHAAkH,YAAY,oEAAoE;4BAC1P,OAAO,EAAE;gCACP,gBAAgB,EAAE,MAAM,CAAC,SAAS;gCAClC,kBAAkB,EAAE,SAAS;gCAC7B,mBAAmB,EAAE,SAAS;gCAC9B,qBAAqB,EAAE,YAAY;6BACpC;yBACF,CAAC,CAAC;oBACL,CAAC;oBACD,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;wBAClC,WAAW,EAAE,KAAK,CAAC,WAAW;wBAC9B,SAAS,EAAE,MAAM,CAAC,SAAS;wBAC3B,eAAe,EAAE,MAAM,CAAC,eAAe;wBACvC,SAAS;wBACT,qBAAqB,EAAE,SAAS,CAAC,MAAM,CAAC,qBAAqB;wBAC7D,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,EAAc,CAAC;qBAChD,CAAC,CAAC;oBACH,SAAS,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,sBAAsB,CACnD,aAAa,EACb,yBAAyB,CAAC,aAAa,CAAC,EACxC,MAAM,CACP,CAAC;oBACF,iEAAiE;oBACjE,mEAAmE;oBACnE,sCAAsC;oBACtC,WAAW,GAAG,MAAM,uBAAuB,CAAC;wBAC1C,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,aAAa;wBACpC,OAAO,EAAE;4BACP,SAAS,EAAE,KAAK,CAAC,SAAS;4BAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;4BACpB,WAAW,EAAE,KAAK,CAAC,WAAW;4BAC9B,SAAS,EAAE,SAAS,CAAC,SAAS;4BAC9B,SAAS,EAAE,SAAS,CAAC,SAAS;4BAC9B,GAAG,CAAC,SAAS,CAAC,oBAAoB,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,SAAS,CAAC,oBAAoB,EAAE,CAAC;4BAC3G,eAAe,EAAE,SAAS,CAAC,eAAe;4BAC1C,SAAS;4BACT,UAAU,EAAE,SAAS,CAAC,UAAU;4BAChC,YAAY,EAAE,SAAS,CAAC,qBAAqB;4BAC7C,UAAU,EAAE,SAAS,CAAC,gBAAgB;4BACtC,gBAAgB,EAAE,SAAS,CAAC,SAAS;4BACrC,gBAAgB,EAAE,SAAS,CAAC,SAAS;yBACtC;wBACD,QAAQ,EAAE,8BAA8B,CAAC,MAAM,CAAC;wBAChD,MAAM,EAAE,IAAI;qBACb,CAAC,CAAC;oBACH,KAAK,CAAC,QAAQ,EAAE,CAAC,0BAA0B,MAAM,kBAAkB,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,0CAA0C,CAAC,CAAC;gBAClJ,CAAC;qBAAM,CAAC;oBACN,SAAS,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,SAAS,EAAE;wBACnE,GAAG,CAAC,MAAM,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,EAAE,CAAC;wBAC3G,WAAW,EAAE,KAAK,CAAC,WAAW;wBAC9B,SAAS,EAAE,MAAM,CAAC,SAAS;wBAC3B,eAAe,EAAE,MAAM,CAAC,eAAe;wBACvC,SAAS;wBACT,qBAAqB,EAAE,SAAS,CAAC,MAAM,CAAC,qBAAqB;qBAC9D,EAAE,MAAM,CAAC,CAAC;oBACX,IAAI,CAAC,SAAS,CAAC,oBAAoB,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,oBAAoB,IAAI,IAAI,CAAC,IAAI,SAAS,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;wBACrI,MAAM,IAAI,CAAC,yCAAyC,EAAE,4EAA4E,CAAC,CAAC;oBACtI,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;oBAC5B,MAAM,IAAI,CAAC,yCAAyC,EAAE,sEAAsE,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;gBACnJ,CAAC;gBACD,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;gBACjG,oEAAoE;gBACpE,oEAAoE;gBACpE,sEAAsE;gBACtE,MAAM,SAAS,GAAG,UAAU,CAAC,2BAA2B,EAAE,YAAY,CAAC,CAAC;gBACxE,MAAM,eAAe,GAAG,UAAU,CAAC,kCAAkC,EAAE,GAAG,YAAY,KAAK,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC;gBACnH,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;oBAClC,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,SAAS;oBACT,eAAe;oBACf,SAAS;oBACT,qBAAqB,EAAE,SAAS,CAAC,MAAM,CAAC,qBAAqB;oBAC7D,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,EAAc,CAAC;iBAChD,CAAC,CAAC;gBACH,SAAS,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,sBAAsB,CACnD,aAAa,EACb,yBAAyB,CAAC,aAAa,CAAC,EACxC,MAAM,CACP,CAAC;YACJ,CAAC;YAED,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;gBAC5B,IAAI,SAAS,CAAC,gBAAgB,GAAG,CAAC,EAAE,CAAC;oBACnC,MAAM,IAAI,CAAC,+CAA+C,EAAE,iFAAiF,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;gBACpK,CAAC;gBACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,oBAAoB,IAAE,IAAI,CAAA,CAAC,CAAA,EAAE,CAAA,CAAC,CAAA,EAAC,oBAAoB,EAAC,SAAS,CAAC,oBAAoB,EAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,iBAAiB,EAAE,SAAS,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,gBAAgB,EAAE,SAAS,EAAE,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC;YAChR,CAAC;YAED,yEAAyE;YACzE,6DAA6D;YAC7D,EAAE;YACF,oEAAoE;YACpE,mEAAmE;YACnE,wEAAwE;YACxE,oEAAoE;YACpE,wEAAwE;YACxE,4DAA4D;YAC5D,uEAAuE;YACvE,0EAA0E;YAC1E,sCAAsC;YACtC,EAAE;YACF,yEAAyE;YACzE,yEAAyE;YACzE,yEAAyE;YACzE,MAAM,mBAAmB,GAAG,MAAM,4BAA4B,CAAC;gBAC7D,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,aAAa;gBACzC,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;aACrD,CAAC,CAAC;YACH,IACE,SAAS,CAAC,gBAAgB,IAAI,CAAC;gBAC/B,SAAS,CAAC,kBAAkB,KAAK,mBAAmB,EACpD,CAAC;gBACD,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,UAAU,KAAK,SAAS,CAAC,gBAAgB,EAAE,CAAC;oBACvF,MAAM,uBAAuB,CAAC;wBAC5B,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,aAAa;wBACpC,OAAO,EAAE;4BACP,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW;4BAChF,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS;4BAC9D,GAAG,CAAC,SAAS,CAAC,oBAAoB,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,SAAS,CAAC,oBAAoB,EAAE,CAAC;4BAC3G,eAAe,EAAE,SAAS,CAAC,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU;4BACvF,YAAY,EAAE,SAAS,CAAC,qBAAqB,EAAE,UAAU,EAAE,SAAS,CAAC,gBAAgB;4BACrF,gBAAgB,EAAE,SAAS,CAAC,SAAS,EAAE,gBAAgB,EAAE,SAAS,CAAC,SAAS;yBAC7E;wBACD,QAAQ,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,8BAA8B,CAAC,WAAW,CAAC;qBACzF,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,MAAM,CAAC,MAAM,CAAC;oBACnB,SAAS,EAAE,SAAS,CAAC,SAAS;oBAC9B,GAAG,CAAC,SAAS,CAAC,oBAAoB,IAAE,IAAI,CAAA,CAAC,CAAA,EAAE,CAAA,CAAC,CAAA,EAAC,oBAAoB,EAAC,SAAS,CAAC,oBAAoB,EAAC,CAAC;oBAClG,iBAAiB,EAAE,SAAS,CAAC,SAAS;oBACtC,UAAU,EAAE,SAAS,CAAC,gBAAgB;oBACtC,SAAS,EAAE,SAAS,CAAC,UAAU;iBAChC,CAAC,CAAC;YACL,CAAC;YAED,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;YACpE,MAAM,KAAK,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC;gBAC9C,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,aAAa;gBACzC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,kBAAkB,EAAE,SAAS,CAAC,SAAS;gBACvC,SAAS;gBACT,cAAc,EAAE,SAAS,CAAC,gBAAgB;gBAC1C,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,cAAc;gBACd,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;gBACpD,MAAM;aACP,CAAC,CAAC;YACH,MAAM,kBAAkB,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,SAAS,EAAE;gBACrF,GAAG,CAAC,SAAS,CAAC,oBAAoB,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,SAAS,CAAC,oBAAoB,EAAE,CAAC;gBAC3G,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,SAAS,EAAE,SAAS,CAAC,SAAS;gBAC9B,eAAe,EAAE,SAAS,CAAC,eAAe;gBAC1C,SAAS;gBACT,qBAAqB,EAAE,SAAS,CAAC,qBAAqB;aACvD,EAAE,MAAM,CAAC,CAAC;YACX,IACE,CAAC,kBAAkB,CAAC,oBAAoB,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,oBAAoB,IAAI,IAAI,CAAC;gBAC9F,kBAAkB,CAAC,UAAU,KAAK,SAAS,CAAC,UAAU;gBACtD,kBAAkB,CAAC,gBAAgB,KAAK,OAAO,CAAC,UAAU;gBAC1D,kBAAkB,CAAC,kBAAkB,KAAK,OAAO,CAAC,aAAa,EAC/D,CAAC;gBACD,MAAM,IAAI,CACR,wCAAwC,EACxC,wFAAwF,EACxF,UAAU,CAAC,MAAM,CAClB,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC;gBAC9C,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,aAAa;gBACpC,OAAO,EAAE;oBACP,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,SAAS,EAAE,kBAAkB,CAAC,SAAS;oBACvC,SAAS,EAAE,kBAAkB,CAAC,SAAS;oBACvC,GAAG,CAAC,kBAAkB,CAAC,oBAAoB,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,kBAAkB,CAAC,oBAAoB,EAAE,CAAC;oBAC7H,eAAe,EAAE,kBAAkB,CAAC,eAAe;oBACnD,SAAS;oBACT,UAAU,EAAE,kBAAkB,CAAC,UAAU;oBACzC,YAAY,EAAE,kBAAkB,CAAC,qBAAqB;oBACtD,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,gBAAgB,EAAE,kBAAkB,CAAC,SAAS;oBAC9C,gBAAgB,EAAE,kBAAkB,CAAC,SAAS;iBAC/C;gBACD,QAAQ,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,8BAA8B,CAAC,WAAW,CAAC;aACzF,CAAC,CAAC;YACH,UAAU,GAAG,MAAM,4BAA4B,CAAC;gBAC9C,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,aAAa;gBACzC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,kBAAkB,EAAE,SAAS,CAAC,SAAS;gBACvC,SAAS;gBACT,cAAc,EAAE,SAAS,CAAC,gBAAgB;gBAC1C,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,cAAc;gBACd,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;gBACpD,cAAc,EAAE,OAAO;aACxB,CAAC,CAAC;YACH,qBAAqB,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,EAAE;gBACxD,KAAK,MAAM,QAAQ,IAAI,aAAa,EAAE,CAAC;oBACrC,IAAI,CAAC;wBAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC,CAAC,6DAA6D,CAAC,CAAC;gBACrG,CAAC;YACH,CAAC,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,oBAAoB,KAAG,SAAS,CAAA,CAAC,CAAA,EAAE,CAAA,CAAC,CAAA,EAAC,oBAAoB,EAAC,SAAS,CAAC,oBAAoB,EAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,iBAAiB,EAAE,SAAS,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC;QAChR,CAAC;KACF,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,kCAAkC,CAAC,QAA4C;IAC7F,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,qBAAqB,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAC;AACnL,CAAC"}

package/dist/local-actions/broker.d.ts

@@ -0,0 +1,32 @@
+import { type LocalActionRequest, type LocalActionResult, type LocalActionSafeReason, type LocalActionSessionIdentity, type LocalActionSnapshot } from "./contracts.js";
+import { LocalActionPolicyEvaluator } from "./policy.js";
+export interface LocalActionBrokerOptions {
+    readonly policy?: LocalActionPolicyEvaluator;
+    readonly clock?: () => number;
+    readonly maximumQueuedRequests?: number;
+    readonly onChange?: (snapshot: LocalActionSnapshot) => void;
+    /** Synchronous authority check backed by the currently attached, fenced runtime binding. */
+    readonly isIdentityLive: (identity: LocalActionSessionIdentity) => boolean;
+    readonly onObserverError?: (error: unknown) => void;
+}
+export declare class LocalActionBroker {
+    #private;
+    constructor(options: LocalActionBrokerOptions);
+    submit(request: LocalActionRequest): LocalActionSnapshot;
+    current(): LocalActionSnapshot | undefined;
+    get(requestId: string): LocalActionSnapshot | undefined;
+    decide(requestId: string, allow: boolean, grantedScope?: string | null): LocalActionSnapshot;
+    awaitingRemoteCompletion(requestId: string): LocalActionSnapshot;
+    complete(requestId: string, identity: LocalActionSessionIdentity, status: LocalActionResult["status"], safeData?: LocalActionResult["safeData"], safeReason?: LocalActionSafeReason): LocalActionSnapshot;
+    cancelBinding(identity: LocalActionSessionIdentity, reason?: LocalActionSafeReason): readonly LocalActionSnapshot[];
+    cancelStaleForIdentity(identity: LocalActionSessionIdentity, reason?: LocalActionSafeReason): readonly LocalActionSnapshot[];
+    expire(): readonly LocalActionSnapshot[];
+}
+export declare class LocalActionBrokerError extends Error {
+    readonly code: "duplicate_request" | "replayed_nonce" | "replay_registry_full" | "queue_full" | "unknown_request" | "identity_mismatch" | "stale_identity" | "scope_widening" | "illegal_transition" | "invalid_request" | "invalid_result" | "provider_action_unavailable";
+    readonly requestId: string;
+    constructor(code: "duplicate_request" | "replayed_nonce" | "replay_registry_full" | "queue_full" | "unknown_request" | "identity_mismatch" | "stale_identity" | "scope_widening" | "illegal_transition" | "invalid_request" | "invalid_result" | "provider_action_unavailable", requestId: string);
+}
+export declare function digestLocalActionArguments(value: Readonly<Record<string, unknown>>): `sha256:${string}`;
+export declare function validateRequest(request: LocalActionRequest, now?: number): void;
+//# sourceMappingURL=broker.d.ts.map

package/dist/local-actions/broker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker.d.ts","sourceRoot":"","sources":["../../src/local-actions/broker.ts"],"names":[],"mappings":"AAEA,OAAO,EAQL,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,mBAAmB,EAIzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AAUzD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,0BAA0B,CAAC;IAC7C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IAC9B,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,mBAAmB,KAAK,IAAI,CAAC;IAC5D,4FAA4F;IAC5F,QAAQ,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,0BAA0B,KAAK,OAAO,CAAC;IAC3E,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;CACrD;AAED,qBAAa,iBAAiB;;gBAahB,OAAO,EAAE,wBAAwB;IAa7C,MAAM,CAAC,OAAO,EAAE,kBAAkB,GAAG,mBAAmB;IAyCxD,OAAO,IAAI,mBAAmB,GAAG,SAAS;IAK1C,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS;IAIvD,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,GAAE,MAAM,GAAG,IAAW,GAAG,mBAAmB;IAoBlG,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,mBAAmB;IAQhE,QAAQ,CACN,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,0BAA0B,EACpC,MAAM,EAAE,iBAAiB,CAAC,QAAQ,CAAC,EACnC,QAAQ,CAAC,EAAE,iBAAiB,CAAC,UAAU,CAAC,EACxC,UAAU,CAAC,EAAE,qBAAqB,GACjC,mBAAmB;IAyCtB,aAAa,CAAC,QAAQ,EAAE,0BAA0B,EAAE,MAAM,GAAE,qBAAkD,GAAG,SAAS,mBAAmB,EAAE;IAU/I,sBAAsB,CAAC,QAAQ,EAAE,0BAA0B,EAAE,MAAM,GAAE,qBAAkD,GAAG,SAAS,mBAAmB,EAAE;IAaxJ,MAAM,IAAI,SAAS,mBAAmB,EAAE;CAiHzC;AAED,qBAAa,sBAAuB,SAAQ,KAAK;IAE7C,QAAQ,CAAC,IAAI,EAAE,mBAAmB,GAAG,gBAAgB,GAAG,sBAAsB,GAAG,YAAY,GAAG,iBAAiB,GAAG,mBAAmB,GAAG,gBAAgB,GAAG,gBAAgB,GAAG,oBAAoB,GAAG,iBAAiB,GAAG,gBAAgB,GAAG,6BAA6B;IAC3Q,QAAQ,CAAC,SAAS,EAAE,MAAM;gBADjB,IAAI,EAAE,mBAAmB,GAAG,gBAAgB,GAAG,sBAAsB,GAAG,YAAY,GAAG,iBAAiB,GAAG,mBAAmB,GAAG,gBAAgB,GAAG,gBAAgB,GAAG,oBAAoB,GAAG,iBAAiB,GAAG,gBAAgB,GAAG,6BAA6B,EAClQ,SAAS,EAAE,MAAM;CAK7B;AAED,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACvC,UAAU,MAAM,EAAE,CAEpB;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,kBAAkB,EAAE,GAAG,SAAa,GAAG,IAAI,CAuCnF"}