@decionis/agent-safe-pipeline 0.3.7 → 0.4.0

package/dist/execution/AuthorizationVerifier.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import { z } from "zod";
 import { AuthorityBaseUrl } from "../http/AuthorityBaseUrl.js";
+import { AuthorityPaths } from "../http/AuthorityPaths.js";
 import { credentialReader } from "../http/Credential.js";
 import { BoundedResponseBody } from "../http/BoundedResponseBody.js";
 import { CanonicalIntentHasher } from "../intent/CanonicalIntentHasher.js";
@@ -132,11 +133,15 @@ const FinalizeResponseSchema = z.looseObject({
 /** The contract's bound on a forwarded receipt: three base64url segments, at most this long. */
 const MAX_RECEIPT_LENGTH = 20_000;
 const MAX_RESPONSE_BYTES = 100 * 1024;
+/** How many claims finalized `INDETERMINATE` a verifier keeps for their reconciliation. */
+const MAX_INDETERMINATE_CLAIMS = 1_000;
 /**
- * Claims a Decionis execution grant through `/v1/execution/claim-token`
- * immediately before dispatch and finalizes the attempt through
- * `/v1/execution/finalize-token` afterwards, so commit evidence joins the
- * Decision Dossier chain.
+ * Claims a Decionis execution grant through its claims resource
+ * (`POST /v1/authority/grants/{grantId}/claims`) immediately before dispatch,
+ * records the attempt through its receipts resource afterwards, and reports a
+ * proven reconciliation through its reconciliations resource, so commit
+ * evidence joins the Decision Dossier chain. A token whose grant id cannot be
+ * read falls back to the deprecated verb routes (`AuthorityPaths.LEGACY`).
  */
 export class DecionisGrantVerifier {
     baseUrl;
@@ -147,6 +152,8 @@ export class DecionisGrantVerifier {
     claims = new WeakMap();
     /** The authority's own answer about an observation, keyed by the frozen authorization. */
     reports = new WeakMap();
+    /** Claims finalized `INDETERMINATE`, by grant id, for the reconciliation that resolves them. */
+    indeterminate = new Map();
     /**
      * The digest the authority binds over the action parameters: SHA-256 of
      * their RFC 8785 canonical form, the same canonicalization the intent hash
@@ -175,7 +182,7 @@ export class DecionisGrantVerifier {
         const controller = new AbortController();
         const timeout = setTimeout(() => controller.abort(), this.timeoutMs);
         try {
-            const response = await this.fetchImpl(`${this.baseUrl}/v1/execution/claim-token`, {
+            const response = await this.fetchImpl(`${this.baseUrl}${AuthorityPaths.claimFor(decision.authorization.token)}`, {
                 method: "POST",
                 headers: {
                     authorization: `Bearer ${this.apiKey()}`,
@@ -296,7 +303,7 @@ export class DecionisGrantVerifier {
         const claim = this.claims.get(input.authorization);
         if (claim === undefined)
             return "PENDING";
-        const evidence = DecionisGrantVerifier.bindableEffectEvidence(input, claim);
+        const evidence = DecionisGrantVerifier.bindableEffectEvidence(input.effectEvidence, claim);
         const receipt = DecionisGrantVerifier.bindableEffectReceipt(input);
         const first = await this.post(input, claim, evidence, receipt, false);
         if (first === "RECORDED")
@@ -312,6 +319,57 @@ export class DecionisGrantVerifier {
         const second = await this.post(input, claim, undefined, receipt, true);
         return second === "RECORDED" ? "RECORDED" : "PENDING";
     }
+    /**
+     * Reports a proven reconciliation of an attempt this verifier finalized
+     * `INDETERMINATE`, to the grant's reconciliations resource. Evidence, never
+     * authority: nothing is retried, a transport failure or refusal is
+     * `PENDING`, and an attempt whose claim this process no longer holds (a
+     * restart, an eviction) is `PENDING` without a request.
+     */
+    async reconcile(input) {
+        const claim = this.indeterminate.get(input.authorization.grantId);
+        const grantId = AuthorityPaths.grantIdOf(claim?.executionToken ?? "");
+        if (claim === undefined || grantId === null || grantId !== input.authorization.grantId) {
+            return "PENDING";
+        }
+        const evidence = DecionisGrantVerifier.bindableEffectEvidence(input.effectEvidence, claim);
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), this.timeoutMs);
+        try {
+            const response = await this.fetchImpl(`${this.baseUrl}${AuthorityPaths.reconciliations(grantId)}`, {
+                method: "POST",
+                headers: {
+                    authorization: `Bearer ${this.apiKey()}`,
+                    "content-type": "application/json",
+                },
+                body: JSON.stringify({
+                    execution_token: claim.executionToken,
+                    claim_token: claim.claimToken,
+                    commit_correlation_id: claim.commitCorrelationId,
+                    outcome: input.outcome,
+                    ...(evidence === undefined ? {} : { effect_evidence: evidence }),
+                }),
+                signal: controller.signal,
+            });
+            if (!response.ok)
+                return "PENDING";
+            this.indeterminate.delete(grantId);
+            return "RECORDED";
+        }
+        catch {
+            return "PENDING";
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    }
+    rememberIndeterminate(authorization, claim) {
+        if (this.indeterminate.size >= MAX_INDETERMINATE_CLAIMS) {
+            const oldest = this.indeterminate.keys().next().value;
+            this.indeterminate.delete(oldest);
+        }
+        this.indeterminate.set(authorization.grantId, claim);
+    }
     /**
      * What the authority reported about effect evidence for an authorization this
      * verifier finalized. `null` until a finalization was recorded. This is the
@@ -330,7 +388,7 @@ export class DecionisGrantVerifier {
         const controller = new AbortController();
         const timeout = setTimeout(() => controller.abort(), this.timeoutMs);
         try {
-            const response = await this.fetchImpl(`${this.baseUrl}/v1/execution/finalize-token`, {
+            const response = await this.fetchImpl(`${this.baseUrl}${AuthorityPaths.receiptFor(claim.executionToken)}`, {
                 method: "POST",
                 headers: {
                     authorization: `Bearer ${this.apiKey()}`,
@@ -371,6 +429,12 @@ export class DecionisGrantVerifier {
                     : null,
             });
             this.claims.delete(input.authorization);
+            // An attempt nobody can yet account for keeps its claim, by grant, so
+            // the reconciliation that later proves it can be reported against the
+            // same claim. Bounded: the oldest is forgotten first, and a forgotten
+            // claim only means its reconciliation is reported as pending.
+            if (input.outcome === "INDETERMINATE")
+                this.rememberIndeterminate(input.authorization, claim);
             return "RECORDED";
         }
         catch {
@@ -393,11 +457,11 @@ export class DecionisGrantVerifier {
      * serialised, so a caller object with accessors cannot present one value to
      * the drop rule and another to the wire.
      */
-    static bindableEffectEvidence(input, claim) {
-        if (input.effectEvidence === undefined || claim.expectedEffectDigest === undefined) {
+    static bindableEffectEvidence(effectEvidence, claim) {
+        if (effectEvidence === undefined || claim.expectedEffectDigest === undefined) {
             return undefined;
         }
-        const parsed = EffectEvidenceSchema.safeParse(input.effectEvidence);
+        const parsed = EffectEvidenceSchema.safeParse(effectEvidence);
         if (!parsed.success)
             return undefined;
         const evidence = parsed.data;

package/dist/execution/AuthorizationVerifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthorizationVerifier.js","sourceRoot":"","sources":["../../src/execution/AuthorizationVerifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAmB,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAkK3E,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,MAAM,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC;AACrE,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;AAC/D,MAAM,UAAU,GAAG,YAAY,CAAC;AAChC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAC9C,kGAAkG;AAClG,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IAC3B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;IAC7C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC;IAClD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACjD,sBAAsB,EAAE,YAAY,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AACH,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AACvD,iFAAiF;AACjF,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAE3D;;;;;;;;GAQG;AACH,MAAM,oBAAoB,GAAG,CAAC,CAAC,YAAY,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACzB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAC5C,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC;QACzB,gBAAgB;QAChB,kBAAkB;QAClB,oBAAoB;QACpB,sBAAsB;QACtB,gBAAgB;QAChB,sBAAsB;QACtB,kBAAkB;KACnB,CAAC;IACF,QAAQ,EAAE,CAAC;SACR,YAAY,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,CAAC,QAAQ,EAAE,EAAE,CAAC;SAC5E,QAAQ,EAAE;IACb,sBAAsB,EAAE,YAAY;IACpC,sBAAsB,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,eAAe,EAAE,YAAY,CAAC,QAAQ,EAAE;IACxC,kBAAkB,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IAC/C,wBAAwB,EAAE,gBAAgB;CAC3C,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAC,WAAW,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACtB,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3D,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACtC,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC;QACpB,GAAG,EAAE,iBAAiB;QACtB,GAAG,EAAE,iBAAiB,CAAC,QAAQ,EAAE;QACjC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QAC1C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;QACzB,UAAU,EAAE,iBAAiB;QAC7B,WAAW,EAAE,iBAAiB;QAC9B,MAAM,EAAE,iBAAiB;QACzB,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QAC5B,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC3B,OAAO,EAAE,CAAC,CAAC,WAAW,CAAC;YACrB,WAAW,EAAE,UAAU;YACvB,0EAA0E;YAC1E,yEAAyE;YACzE,wEAAwE;YACxE,0EAA0E;YAC1E,yEAAyE;YACzE,yEAAyE;YACzE,yEAAyE;YACzE,sBAAsB,EAAE,YAAY,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;YAC/D,sEAAsE;YACtE,qEAAqE;YACrE,yCAAyC;YACzC,wBAAwB,EAAE,YAAY,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;YACjE,0CAA0C,EAAE,CAAC;iBAC1C,MAAM,EAAE;iBACR,GAAG,CAAC,CAAC,CAAC;iBACN,GAAG,CAAC,GAAG,CAAC;iBACR,OAAO,EAAE;iBACT,KAAK,CAAC,SAAS,CAAC;SACpB,CAAC;QACF,GAAG,EAAE,iBAAiB;QACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;QACrB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;QACrB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC;IACF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxE,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACnE,0EAA0E;IAC1E,wEAAwE;IACxE,2EAA2E;IAC3E,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;CAC/F,CAAC,CAAC;AAEH,6FAA6F;AAC7F,MAAM,WAAW,GAAG,aAAa,CAAC;AAElC;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,CAAC,CAAC,WAAW,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3D,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IACjE,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IACrF,cAAc,EAAE,CAAC;SACd,WAAW,CAAC;QACX,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;QACrB,iBAAiB,EAAE,iBAAiB,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;KAC5E,CAAC;SACD,QAAQ,EAAE;SACV,KAAK,CAAC,SAAS,CAAC;CACpB,CAAC,CAAC;AAEH,gGAAgG;AAChG,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,MAAM,kBAAkB,GAAG,GAAG,GAAG,IAAI,CAAC;AAmBtC;;;;;GAKG;AACH,MAAM,OAAO,qBAAqB;IACf,OAAO,CAAS;IAChB,MAAM,CAAe;IACrB,SAAS,CAAS;IAClB,SAAS,CAAe;IACzC,2FAA2F;IAC1E,MAAM,GAAG,IAAI,OAAO,EAAsC,CAAC;IAC5E,0FAA0F;IACzE,OAAO,GAAG,IAAI,OAAO,EAAgD,CAAC;IAEvF;;;;;OAKG;IACI,MAAM,CAAC,gBAAgB,CAAC,UAAsB;QACnD,MAAM,SAAS,GAAG,qBAAqB,CAAC,SAAS,CAAC,UAAuB,CAAC,CAAC;QAC3E,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAClF,CAAC;IAED,YAAmB,OAAqC;QACtD,IAAI,CAAC,OAAO,GAAG,gBAAgB,CAAC,SAAS,CACvC,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,qBAAqB,KAAK,IAAI,CACvC,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3E,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IAC1C,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAC3B,QAAwB,EACxB,QAAsB;QAEtB,IACE,QAAQ,CAAC,OAAO,KAAK,OAAO;YAC5B,QAAQ,CAAC,UAAU;YACnB,QAAQ,CAAC,aAAa,KAAK,IAAI;YAC/B,QAAQ,CAAC,SAAS,KAAK,IAAI;YAC3B,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAC3C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,mBAAmB,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC;QACrD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO,2BAA2B,EAAE;gBAChF,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE;oBACxC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,eAAe,EAAE,QAAQ,CAAC,aAAa,CAAC,KAAK;oBAC7C,WAAW,EAAE,QAAQ,CAAC,UAAU;oBAChC,MAAM,EAAE,qBAAqB,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACxD,qEAAqE;oBACrE,kEAAkE;oBAClE,mEAAmE;oBACnE,iEAAiE;oBACjE,2DAA2D;oBAC3D,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,aAAa,EAAE,QAAQ,KAAK,UAAU;wBAC3D,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;wBACjC,CAAC,CAAC,EAAE,CAAC;oBACP,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;oBACrC,qBAAqB,EAAE,mBAAmB;iBAC3C,CAAC;gBACF,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YAC9B,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;YAC1E,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAC/B,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC7B,yEAAyE;YACzE,MAAM,qBAAqB,GAAG,MAAM,CAAC,OAAO,CAAC,sBAAsB,IAAI,SAAS,CAAC;YACjF,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC;YACzC,MAAM,qBAAqB,GAAG,IAAI,CAAC,KAAK,CACtC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,SAAS,CAAC,GAAG,KAAK,CACrD,CAAC;YACF,MAAM,QAAQ,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,CAAC;YAC5G,qEAAqE;YACrE,uEAAuE;YACvE,kEAAkE;YAClE,sEAAsE;YACtE,kEAAkE;YAClE,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,wBAAwB,IAAI,SAAS,CAAC;YAC3E,MAAM,sBAAsB,GAC1B,aAAa,KAAK,SAAS;gBAC3B,CAAC,MAAM,CAAC,OAAO,CAAC,0CAA0C,KAAK,WAAW;oBACxE,aAAa,KAAK,qBAAqB,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;YAC1F,IACE,MAAM,CAAC,cAAc,KAAK,KAAK;gBAC/B,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;gBACtC,MAAM,CAAC,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,UAAU;gBAClD,qBAAqB,KAAK,QAAQ,CAAC,MAAM,CAAC,oBAAoB;gBAC9D,sBAAsB;gBACtB,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,UAAU;gBAC1C,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,SAAS;gBACxC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC,QAAQ;gBAC1C,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;gBACvC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM;gBACxC,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC;gBACrD,MAAM,CAAC,GAAG,KAAK,qBAAqB;gBACpC,aAAa,IAAI,IAAI,CAAC,GAAG,EAAE;gBAC3B,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EACrD,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,sEAAsE;YACtE,mEAAmE;YACnE,iEAAiE;YACjE,uDAAuD;YACvD,MAAM,KAAK,GAAG,MAAM,CAAC,sBAAsB,CAAC;YAC5C,MAAM,WAAW,GAAG,MAAM,CAAC,iBAAiB,IAAI,SAAS,CAAC;YAC1D,MAAM,aAAa,GAA0B,MAAM,CAAC,MAAM,CAAC;gBACzD,UAAU,EAAE,MAAM,CAAC,WAAW;gBAC9B,SAAS,EAAE,MAAM,CAAC,UAAU;gBAC5B,OAAO,EAAE,MAAM,CAAC,GAAG;gBACnB,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW;gBACtC,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE;gBACrD,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/D,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC;gBACzD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,WAAW,EAAE,CAAC;aACxE,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE;gBAC7B,cAAc,EAAE,QAAQ,CAAC,aAAa,CAAC,KAAK;gBAC5C,UAAU,EAAE,MAAM,CAAC,WAAW;gBAC9B,mBAAmB;gBACnB,oBAAoB,EAAE,qBAAqB;aAC5C,CAAC,CAAC;YACH,OAAO,aAAa,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAEM,aAAa,CAAC,aAAoC;QACvD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC7C,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACrC,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,eAAe,EAAE,KAAK,CAAC,cAAc;YACrC,WAAW,EAAE,KAAK,CAAC,UAAU;YAC7B,qBAAqB,EAAE,KAAK,CAAC,mBAAmB;YAChD,GAAG,CAAC,KAAK,CAAC,oBAAoB,KAAK,SAAS;gBAC1C,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,sBAAsB,EAAE,KAAK,CAAC,oBAAoB,EAAE,CAAC;SAC5D,CAAC;IACJ,CAAC;IAEM,UAAU,CAAC,aAAoC,EAAE,QAAoB;QAC1E,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE;YAC7B,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe;YAC3C,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;YACnC,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB;YACtD,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,sBAAsB;SACzD,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,QAAQ,CAAC,KAAqC;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACnD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC1C,MAAM,QAAQ,GAAG,qBAAqB,CAAC,sBAAsB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG,qBAAqB,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QACtE,IAAI,KAAK,KAAK,UAAU;YAAE,OAAO,UAAU,CAAC;QAC5C,IAAI,KAAK,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACpE,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,wEAAwE;QACxE,sEAAsE;QACtE,wEAAwE;QACxE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACvE,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IACxD,CAAC;IAED;;;;OAIG;IACI,YAAY,CAAC,aAAoC;QACtD,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC;IACjD,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,IAAI,CAChB,KAAqC,EACrC,KAAkB,EAClB,QAA6C,EAC7C,OAA2B,EAC3B,eAAwB;QAExB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO,8BAA8B,EAAE;gBACnF,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE;oBACxC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,eAAe,EAAE,KAAK,CAAC,cAAc;oBACrC,WAAW,EAAE,KAAK,CAAC,UAAU;oBAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,qBAAqB,EAAE,KAAK,CAAC,mBAAmB;oBAChD,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;oBAChE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;iBAC9D,CAAC;gBACF,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YACzE,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;YAC1E,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YACpC,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,MAAM,CAAC,SAAS;gBAAE,OAAO,SAAS,CAAC;YACxC,uEAAuE;YACvE,oEAAoE;YACpE,wCAAwC;YACxC,MAAM,IAAI,GAAG,QAAQ,KAAK,SAAS,CAAC;YACpC,MAAM,WAAW,GAAG,OAAO,KAAK,SAAS,CAAC;YAC1C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE;gBACpC,kBAAkB,EAAE,IAAI;gBACxB,qBAAqB,EAAE,eAAe;gBACtC,sBAAsB,EAAE,IAAI,IAAI,MAAM,CAAC,wBAAwB,KAAK,IAAI;gBACxE,kBAAkB,EAChB,IAAI,IAAI,MAAM,CAAC,mBAAmB,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa;gBAClF,iBAAiB,EAAE,WAAW;gBAC9B,qBAAqB,EAAE,WAAW,IAAI,MAAM,CAAC,cAAc,EAAE,QAAQ,KAAK,IAAI;gBAC9E,yBAAyB,EAAE,WAAW;oBACpC,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,iBAAiB,IAAI,IAAI,CAAC;oBACpD,CAAC,CAAC,IAAI;aACT,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YACxC,OAAO,UAAU,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,MAAM,CAAC,sBAAsB,CACnC,KAAqC,EACrC,KAAkB;QAElB,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,KAAK,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACnF,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QACtC,MAAM,QAAQ,GAA4B,MAAM,CAAC,IAAI,CAAC;QACtD,IAAI,QAAQ,CAAC,sBAAsB,KAAK,KAAK,CAAC,oBAAoB;YAAE,OAAO,SAAS,CAAC;QACrF,IAAI,QAAQ,CAAC,wBAAwB,KAAK,KAAK,CAAC,mBAAmB;YAAE,OAAO,SAAS,CAAC;QACtF,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,qBAAqB,CAAC,KAAqC;QACxE,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa,CAAC;QACpC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,kBAAkB;YAAE,OAAO,SAAS,CAAC;QACzF,OAAO,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,CAAC;CACF;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,QAAQ,IAAI,IAAI,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"AuthorizationVerifier.js","sourceRoot":"","sources":["../../src/execution/AuthorizationVerifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAmB,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAmL3E,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,MAAM,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC;AACrE,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;AAC/D,MAAM,UAAU,GAAG,YAAY,CAAC;AAChC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAC9C,kGAAkG;AAClG,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IAC3B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;IAC7C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC;IAClD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACjD,sBAAsB,EAAE,YAAY,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AACH,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AACvD,iFAAiF;AACjF,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAE3D;;;;;;;;GAQG;AACH,MAAM,oBAAoB,GAAG,CAAC,CAAC,YAAY,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACzB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAC5C,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC;QACzB,gBAAgB;QAChB,kBAAkB;QAClB,oBAAoB;QACpB,sBAAsB;QACtB,gBAAgB;QAChB,sBAAsB;QACtB,kBAAkB;KACnB,CAAC;IACF,QAAQ,EAAE,CAAC;SACR,YAAY,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,CAAC,QAAQ,EAAE,EAAE,CAAC;SAC5E,QAAQ,EAAE;IACb,sBAAsB,EAAE,YAAY;IACpC,sBAAsB,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,eAAe,EAAE,YAAY,CAAC,QAAQ,EAAE;IACxC,kBAAkB,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IAC/C,wBAAwB,EAAE,gBAAgB;CAC3C,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAC,WAAW,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACtB,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3D,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACtC,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC;QACpB,GAAG,EAAE,iBAAiB;QACtB,GAAG,EAAE,iBAAiB,CAAC,QAAQ,EAAE;QACjC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QAC1C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;QACzB,UAAU,EAAE,iBAAiB;QAC7B,WAAW,EAAE,iBAAiB;QAC9B,MAAM,EAAE,iBAAiB;QACzB,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QAC5B,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC3B,OAAO,EAAE,CAAC,CAAC,WAAW,CAAC;YACrB,WAAW,EAAE,UAAU;YACvB,0EAA0E;YAC1E,yEAAyE;YACzE,wEAAwE;YACxE,0EAA0E;YAC1E,yEAAyE;YACzE,yEAAyE;YACzE,yEAAyE;YACzE,sBAAsB,EAAE,YAAY,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;YAC/D,sEAAsE;YACtE,qEAAqE;YACrE,yCAAyC;YACzC,wBAAwB,EAAE,YAAY,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;YACjE,0CAA0C,EAAE,CAAC;iBAC1C,MAAM,EAAE;iBACR,GAAG,CAAC,CAAC,CAAC;iBACN,GAAG,CAAC,GAAG,CAAC;iBACR,OAAO,EAAE;iBACT,KAAK,CAAC,SAAS,CAAC;SACpB,CAAC;QACF,GAAG,EAAE,iBAAiB;QACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;QACrB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;QACrB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC;IACF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxE,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACnE,0EAA0E;IAC1E,wEAAwE;IACxE,2EAA2E;IAC3E,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;CAC/F,CAAC,CAAC;AAEH,6FAA6F;AAC7F,MAAM,WAAW,GAAG,aAAa,CAAC;AAElC;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,CAAC,CAAC,WAAW,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3D,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IACjE,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IACrF,cAAc,EAAE,CAAC;SACd,WAAW,CAAC;QACX,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;QACrB,iBAAiB,EAAE,iBAAiB,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;KAC5E,CAAC;SACD,QAAQ,EAAE;SACV,KAAK,CAAC,SAAS,CAAC;CACpB,CAAC,CAAC;AAEH,gGAAgG;AAChG,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,MAAM,kBAAkB,GAAG,GAAG,GAAG,IAAI,CAAC;AACtC,2FAA2F;AAC3F,MAAM,wBAAwB,GAAG,KAAK,CAAC;AAmBvC;;;;;;;GAOG;AACH,MAAM,OAAO,qBAAqB;IACf,OAAO,CAAS;IAChB,MAAM,CAAe;IACrB,SAAS,CAAS;IAClB,SAAS,CAAe;IACzC,2FAA2F;IAC1E,MAAM,GAAG,IAAI,OAAO,EAAsC,CAAC;IAC5E,0FAA0F;IACzE,OAAO,GAAG,IAAI,OAAO,EAAgD,CAAC;IACvF,gGAAgG;IAC/E,aAAa,GAAG,IAAI,GAAG,EAAuB,CAAC;IAEhE;;;;;OAKG;IACI,MAAM,CAAC,gBAAgB,CAAC,UAAsB;QACnD,MAAM,SAAS,GAAG,qBAAqB,CAAC,SAAS,CAAC,UAAuB,CAAC,CAAC;QAC3E,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAClF,CAAC;IAED,YAAmB,OAAqC;QACtD,IAAI,CAAC,OAAO,GAAG,gBAAgB,CAAC,SAAS,CACvC,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,qBAAqB,KAAK,IAAI,CACvC,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3E,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IAC1C,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAC3B,QAAwB,EACxB,QAAsB;QAEtB,IACE,QAAQ,CAAC,OAAO,KAAK,OAAO;YAC5B,QAAQ,CAAC,UAAU;YACnB,QAAQ,CAAC,aAAa,KAAK,IAAI;YAC/B,QAAQ,CAAC,SAAS,KAAK,IAAI;YAC3B,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAC3C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,mBAAmB,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC;QACrD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CACnC,GAAG,IAAI,CAAC,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,EACzE;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE;oBACxC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,eAAe,EAAE,QAAQ,CAAC,aAAa,CAAC,KAAK;oBAC7C,WAAW,EAAE,QAAQ,CAAC,UAAU;oBAChC,MAAM,EAAE,qBAAqB,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACxD,qEAAqE;oBACrE,kEAAkE;oBAClE,mEAAmE;oBACnE,iEAAiE;oBACjE,2DAA2D;oBAC3D,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,aAAa,EAAE,QAAQ,KAAK,UAAU;wBAC3D,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;wBACjC,CAAC,CAAC,EAAE,CAAC;oBACP,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;oBACrC,qBAAqB,EAAE,mBAAmB;iBAC3C,CAAC;gBACF,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CACF,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YAC9B,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;YAC1E,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAC/B,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC7B,yEAAyE;YACzE,MAAM,qBAAqB,GAAG,MAAM,CAAC,OAAO,CAAC,sBAAsB,IAAI,SAAS,CAAC;YACjF,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC;YACzC,MAAM,qBAAqB,GAAG,IAAI,CAAC,KAAK,CACtC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,SAAS,CAAC,GAAG,KAAK,CACrD,CAAC;YACF,MAAM,QAAQ,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,CAAC;YAC5G,qEAAqE;YACrE,uEAAuE;YACvE,kEAAkE;YAClE,sEAAsE;YACtE,kEAAkE;YAClE,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,wBAAwB,IAAI,SAAS,CAAC;YAC3E,MAAM,sBAAsB,GAC1B,aAAa,KAAK,SAAS;gBAC3B,CAAC,MAAM,CAAC,OAAO,CAAC,0CAA0C,KAAK,WAAW;oBACxE,aAAa,KAAK,qBAAqB,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;YAC1F,IACE,MAAM,CAAC,cAAc,KAAK,KAAK;gBAC/B,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;gBACtC,MAAM,CAAC,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,UAAU;gBAClD,qBAAqB,KAAK,QAAQ,CAAC,MAAM,CAAC,oBAAoB;gBAC9D,sBAAsB;gBACtB,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,UAAU;gBAC1C,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,SAAS;gBACxC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC,QAAQ;gBAC1C,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;gBACvC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM;gBACxC,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC;gBACrD,MAAM,CAAC,GAAG,KAAK,qBAAqB;gBACpC,aAAa,IAAI,IAAI,CAAC,GAAG,EAAE;gBAC3B,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EACrD,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,sEAAsE;YACtE,mEAAmE;YACnE,iEAAiE;YACjE,uDAAuD;YACvD,MAAM,KAAK,GAAG,MAAM,CAAC,sBAAsB,CAAC;YAC5C,MAAM,WAAW,GAAG,MAAM,CAAC,iBAAiB,IAAI,SAAS,CAAC;YAC1D,MAAM,aAAa,GAA0B,MAAM,CAAC,MAAM,CAAC;gBACzD,UAAU,EAAE,MAAM,CAAC,WAAW;gBAC9B,SAAS,EAAE,MAAM,CAAC,UAAU;gBAC5B,OAAO,EAAE,MAAM,CAAC,GAAG;gBACnB,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW;gBACtC,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE;gBACrD,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/D,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC;gBACzD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,WAAW,EAAE,CAAC;aACxE,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE;gBAC7B,cAAc,EAAE,QAAQ,CAAC,aAAa,CAAC,KAAK;gBAC5C,UAAU,EAAE,MAAM,CAAC,WAAW;gBAC9B,mBAAmB;gBACnB,oBAAoB,EAAE,qBAAqB;aAC5C,CAAC,CAAC;YACH,OAAO,aAAa,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAEM,aAAa,CAAC,aAAoC;QACvD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC7C,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACrC,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,eAAe,EAAE,KAAK,CAAC,cAAc;YACrC,WAAW,EAAE,KAAK,CAAC,UAAU;YAC7B,qBAAqB,EAAE,KAAK,CAAC,mBAAmB;YAChD,GAAG,CAAC,KAAK,CAAC,oBAAoB,KAAK,SAAS;gBAC1C,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,sBAAsB,EAAE,KAAK,CAAC,oBAAoB,EAAE,CAAC;SAC5D,CAAC;IACJ,CAAC;IAEM,UAAU,CAAC,aAAoC,EAAE,QAAoB;QAC1E,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE;YAC7B,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe;YAC3C,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;YACnC,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB;YACtD,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,sBAAsB;SACzD,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,QAAQ,CAAC,KAAqC;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACnD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC1C,MAAM,QAAQ,GAAG,qBAAqB,CAAC,sBAAsB,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;QAC3F,MAAM,OAAO,GAAG,qBAAqB,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QACtE,IAAI,KAAK,KAAK,UAAU;YAAE,OAAO,UAAU,CAAC;QAC5C,IAAI,KAAK,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACpE,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,wEAAwE;QACxE,sEAAsE;QACtE,wEAAwE;QACxE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACvE,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IACxD,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,SAAS,CAAC,KAAuC;QAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,cAAc,CAAC,SAAS,CAAC,KAAK,EAAE,cAAc,IAAI,EAAE,CAAC,CAAC;QACtE,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;YACvF,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,sBAAsB,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;QAC3F,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CACnC,GAAG,IAAI,CAAC,OAAO,GAAG,cAAc,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,EAC3D;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE;oBACxC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,eAAe,EAAE,KAAK,CAAC,cAAc;oBACrC,WAAW,EAAE,KAAK,CAAC,UAAU;oBAC7B,qBAAqB,EAAE,KAAK,CAAC,mBAAmB;oBAChD,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;iBACjE,CAAC;gBACF,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CACF,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,SAAS,CAAC;YACnC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACnC,OAAO,UAAU,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAEO,qBAAqB,CAAC,aAAoC,EAAE,KAAkB;QACpF,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,IAAI,wBAAwB,EAAE,CAAC;YACxD,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,CAAC;YAChE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;IAED;;;;OAIG;IACI,YAAY,CAAC,aAAoC;QACtD,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC;IACjD,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,IAAI,CAChB,KAAqC,EACrC,KAAkB,EAClB,QAA6C,EAC7C,OAA2B,EAC3B,eAAwB;QAExB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CACnC,GAAG,IAAI,CAAC,OAAO,GAAG,cAAc,CAAC,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,EACnE;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE;oBACxC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,eAAe,EAAE,KAAK,CAAC,cAAc;oBACrC,WAAW,EAAE,KAAK,CAAC,UAAU;oBAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,qBAAqB,EAAE,KAAK,CAAC,mBAAmB;oBAChD,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;oBAChE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;iBAC9D,CAAC;gBACF,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CACF,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YACzE,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;YAC1E,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YACpC,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,MAAM,CAAC,SAAS;gBAAE,OAAO,SAAS,CAAC;YACxC,uEAAuE;YACvE,oEAAoE;YACpE,wCAAwC;YACxC,MAAM,IAAI,GAAG,QAAQ,KAAK,SAAS,CAAC;YACpC,MAAM,WAAW,GAAG,OAAO,KAAK,SAAS,CAAC;YAC1C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE;gBACpC,kBAAkB,EAAE,IAAI;gBACxB,qBAAqB,EAAE,eAAe;gBACtC,sBAAsB,EAAE,IAAI,IAAI,MAAM,CAAC,wBAAwB,KAAK,IAAI;gBACxE,kBAAkB,EAChB,IAAI,IAAI,MAAM,CAAC,mBAAmB,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa;gBAClF,iBAAiB,EAAE,WAAW;gBAC9B,qBAAqB,EAAE,WAAW,IAAI,MAAM,CAAC,cAAc,EAAE,QAAQ,KAAK,IAAI;gBAC9E,yBAAyB,EAAE,WAAW;oBACpC,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,iBAAiB,IAAI,IAAI,CAAC;oBACpD,CAAC,CAAC,IAAI;aACT,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YACxC,sEAAsE;YACtE,sEAAsE;YACtE,sEAAsE;YACtE,8DAA8D;YAC9D,IAAI,KAAK,CAAC,OAAO,KAAK,eAAe;gBAAE,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;YAC9F,OAAO,UAAU,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,MAAM,CAAC,sBAAsB,CACnC,cAAmD,EACnD,KAAkB;QAElB,IAAI,cAAc,KAAK,SAAS,IAAI,KAAK,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;YAC7E,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QACtC,MAAM,QAAQ,GAA4B,MAAM,CAAC,IAAI,CAAC;QACtD,IAAI,QAAQ,CAAC,sBAAsB,KAAK,KAAK,CAAC,oBAAoB;YAAE,OAAO,SAAS,CAAC;QACrF,IAAI,QAAQ,CAAC,wBAAwB,KAAK,KAAK,CAAC,mBAAmB;YAAE,OAAO,SAAS,CAAC;QACtF,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,qBAAqB,CAAC,KAAqC;QACxE,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa,CAAC;QACpC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,kBAAkB;YAAE,OAAO,SAAS,CAAC;QACzF,OAAO,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,CAAC;CACF;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,QAAQ,IAAI,IAAI,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/execution/EffectAdapter.d.ts

@@ -0,0 +1,117 @@
+import type { JsonObject, JsonValue } from "../intent/JsonValue.js";
+import type { VerifiedAuthorization } from "./AuthorizationVerifier.js";
+import type { MonotonicDeadline } from "./ExecutionDeadline.js";
+import type { Sha256Digest } from "./NativeExecutor.js";
+/**
+ * What an effect adapter worked out before anything left the process.
+ *
+ * @deprecated The dispatch-style `NativeExecutor` (`agent-safe.executors.native/1`)
+ * is the contract; `@decionis/agentsafe` re-exports this as `PreparedAction`
+ * for existing adapters.
+ */
+export interface EffectPreparedAction {
+    /** The effect the action asks for, as the profile's projection of it. */
+    readonly expectedEffect: JsonObject;
+    readonly expectedEffectDigest: Sha256Digest;
+    /** The digest of the canonical action itself, for the authority's binding. */
+    readonly intentDigest: Sha256Digest;
+    /** The digest of what will be sent, so a later reader can tell what was asked. */
+    readonly requestDigest: Sha256Digest;
+    /** The resource the effect lands on, as the profile names it. */
+    readonly resourceRef: string;
+    readonly effectType: string;
+    readonly domain: string;
+    readonly actionType: string;
+}
+/** What the provider said, as the adapter read it. Never a body, never a credential. */
+export interface ProviderResult {
+    readonly status: "COMMITTED" | "FAILED";
+    readonly providerStatus: string | null;
+    readonly providerReference: string | null;
+    readonly responseDigest: Sha256Digest | null;
+    /** A profile reason code when the provider refused; null when it accepted. */
+    readonly failureReason: string | null;
+    /** The observed effect as the adapter could read it, or null when it could not. */
+    readonly observed: JsonObject | null;
+    readonly observationMethod: ObservationMethod;
+    readonly providerGenerated: boolean;
+    readonly source: string;
+    /**
+     * The provider's effect receipt (VP-3), verbatim, when its answer carried
+     * one in `x-agent-safe-effect-receipt`. Forwarded to the authority
+     * unread; its statement is compared with this executor's own account.
+     */
+    readonly receipt?: string | null;
+}
+export type ObservationMethod = "DOWNSTREAM_ACK" | "READ_AFTER_WRITE" | "EVENT_CONFIRMATION" | "STATE_RECONCILIATION" | "SIGNED_RECEIPT" | "EXTERNAL_ATTESTATION" | "HUMAN_VALIDATION";
+/**
+ * A provider that neither committed nor refused. Thrown from `execute`
+ * after the request left the process, so the runner reports an unknown
+ * outcome and nothing interprets silence as success.
+ *
+ * A provider can answer an indeterminate status with its signed receipt of
+ * the effect all the same. `receipt` carries it to the finalization, where
+ * the authority verifies it, instead of it being dropped with the answer.
+ */
+export declare class IndeterminateOutcome extends Error {
+    readonly reason: string;
+    readonly providerStatus: string | null;
+    readonly receipt: string | null;
+    constructor(reason: string, providerStatus?: string | null, receipt?: string | null);
+}
+export interface AdapterExecution<TAction> {
+    readonly action: TAction;
+    readonly prepared: EffectPreparedAction;
+    readonly authorization: VerifiedAuthorization;
+    readonly idempotencyKey: string;
+    /** The budget left for this dispatch: the smaller of the timeout and the grant. */
+    readonly deadline: MonotonicDeadline;
+}
+export interface AdapterReconciliation {
+    readonly idempotencyKey: string;
+    readonly providerReference: string | null;
+    readonly intentHash: string;
+    readonly prepared: EffectPreparedAction;
+}
+export type ProviderReconciliationResult = {
+    readonly status: "COMPLETED";
+    readonly result: ProviderResult;
+} | {
+    readonly status: "NOT_EXECUTED";
+} | {
+    readonly status: "UNKNOWN";
+};
+/**
+ * The first contract for a family of consequential actions: four small
+ * methods, three of them pure. It is the dispatch style of
+ * `agent-safe.executors.native/1` under its earlier name, and
+ * `@decionis/agentsafe`'s `EffectAdapterExecutor` runs any implementation of
+ * it as a dispatch-style `NativeExecutor`, so an adapter written against it
+ * keeps working unchanged.
+ *
+ * - `prepare` works out what the action asks for and what its effect should
+ *   be. It reaches nothing and may be called before the authority is asked.
+ * - `execute` performs the side effect, once, inside the dispatch the
+ *   pipeline opened. A provider that neither committed nor refused is an
+ *   `IndeterminateOutcome`, never a guess.
+ * - `observeEffect` reads what the provider said into the profile's
+ *   projection. Pure: no second call, no interpretation of silence.
+ * - `reconcile` asks the provider what it did with an idempotency key,
+ *   read-only, and may never initiate anything.
+ *
+ * @deprecated Implement `NativeExecutor` with `style: "dispatch"`. This
+ * interface stays, unchanged, for the adapters already written against it.
+ */
+export interface EffectAdapter<TAction> {
+    readonly id: string;
+    readonly version: string;
+    /** The transport action names this adapter answers for. */
+    readonly actionTypes: readonly string[];
+    prepare(action: TAction): EffectPreparedAction;
+    execute(execution: AdapterExecution<TAction>): Promise<ProviderResult>;
+    observeEffect(result: ProviderResult, prepared: EffectPreparedAction): JsonObject | null;
+    reconcile(context: AdapterReconciliation): Promise<ProviderReconciliationResult>;
+}
+/** A value the projection can hold, narrowed for comparison. */
+export type ProjectionValue = JsonValue;
+//# sourceMappingURL=EffectAdapter.d.ts.map

package/dist/execution/EffectAdapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EffectAdapter.d.ts","sourceRoot":"","sources":["../../src/execution/EffectAdapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,yEAAyE;IACzE,QAAQ,CAAC,cAAc,EAAE,UAAU,CAAC;IACpC,QAAQ,CAAC,oBAAoB,EAAE,YAAY,CAAC;IAC5C,8EAA8E;IAC9E,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,kFAAkF;IAClF,QAAQ,CAAC,aAAa,EAAE,YAAY,CAAC;IACrC,iEAAiE;IACjE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,wFAAwF;AACxF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,QAAQ,CAAC;IACxC,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,cAAc,EAAE,YAAY,GAAG,IAAI,CAAC;IAC7C,8EAA8E;IAC9E,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,EAAE,UAAU,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;IAC9C,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,MAAM,iBAAiB,GACzB,gBAAgB,GAChB,kBAAkB,GAClB,oBAAoB,GACpB,sBAAsB,GACtB,gBAAgB,GAChB,sBAAsB,GACtB,kBAAkB,CAAC;AAEvB;;;;;;;;GAQG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;aAE3B,MAAM,EAAE,MAAM;aACd,cAAc,EAAE,MAAM,GAAG,IAAI;aAC7B,OAAO,EAAE,MAAM,GAAG,IAAI;gBAFtB,MAAM,EAAE,MAAM,EACd,cAAc,GAAE,MAAM,GAAG,IAAW,EACpC,OAAO,GAAE,MAAM,GAAG,IAAW;CAKhD;AAED,MAAM,WAAW,gBAAgB,CAAC,OAAO;IACvC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;IAC9C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;CACtC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;CACzC;AAED,MAAM,MAAM,4BAA4B,GACpC;IAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAA;CAAE,GACjE;IAAE,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAA;CAAE,GACnC;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAEnC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,aAAa,CAAC,OAAO;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2DAA2D;IAC3D,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,OAAO,CAAC,MAAM,EAAE,OAAO,GAAG,oBAAoB,CAAC;IAC/C,OAAO,CAAC,SAAS,EAAE,gBAAgB,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACvE,aAAa,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,oBAAoB,GAAG,UAAU,GAAG,IAAI,CAAC;IACzF,SAAS,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAAC;CAClF;AAED,gEAAgE;AAChE,MAAM,MAAM,eAAe,GAAG,SAAS,CAAC"}

package/dist/execution/EffectAdapter.js

@@ -0,0 +1,22 @@
+/**
+ * A provider that neither committed nor refused. Thrown from `execute`
+ * after the request left the process, so the runner reports an unknown
+ * outcome and nothing interprets silence as success.
+ *
+ * A provider can answer an indeterminate status with its signed receipt of
+ * the effect all the same. `receipt` carries it to the finalization, where
+ * the authority verifies it, instead of it being dropped with the answer.
+ */
+export class IndeterminateOutcome extends Error {
+    reason;
+    providerStatus;
+    receipt;
+    constructor(reason, providerStatus = null, receipt = null) {
+        super(reason);
+        this.reason = reason;
+        this.providerStatus = providerStatus;
+        this.receipt = receipt;
+        this.name = "IndeterminateOutcome";
+    }
+}
+//# sourceMappingURL=EffectAdapter.js.map

package/dist/execution/EffectAdapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EffectAdapter.js","sourceRoot":"","sources":["../../src/execution/EffectAdapter.ts"],"names":[],"mappings":"AAyDA;;;;;;;;GAQG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAE3B;IACA;IACA;IAHlB,YACkB,MAAc,EACd,iBAAgC,IAAI,EACpC,UAAyB,IAAI;QAE7C,KAAK,CAAC,MAAM,CAAC,CAAC;QAJE,WAAM,GAAN,MAAM,CAAQ;QACd,mBAAc,GAAd,cAAc,CAAsB;QACpC,YAAO,GAAP,OAAO,CAAsB;QAG7C,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF"}

package/dist/execution/ExecutionDeadline.d.ts

@@ -0,0 +1,35 @@
+/**
+ * A deadline that a change to the wall clock cannot move. Dispatch bounds
+ * are read from `process.hrtime.bigint()`, so an operator correcting the
+ * clock, or an authority whose time differs, cannot extend the window in
+ * which a provider may be called.
+ */
+export declare class MonotonicDeadline {
+    private readonly startedAt;
+    readonly budgetMs: number;
+    private readonly now;
+    private constructor();
+    static after(budgetMs: number, now?: () => bigint): MonotonicDeadline;
+    get elapsedMs(): number;
+    get remainingMs(): number;
+    get expired(): boolean;
+    /** A signal that aborts when the remaining budget runs out. */
+    signal(): AbortSignal;
+}
+/**
+ * The budget for one dispatch: the smallest of what the configuration
+ * allows, what is left of the grant, and what is left of the authority's
+ * claim lease when it named one.
+ *
+ * A provider is never called with more time than the authorization has, so a
+ * slow call cannot outlive the permission it was made under. The lease is
+ * the tighter bound and the one that matters more: a commit the authority
+ * will no longer record leaves an outcome nobody can reconcile from the
+ * record, however successful the dispatch was. A window that has already
+ * closed is a budget of zero, so the dispatch is refused rather than started.
+ */
+export declare function dispatchBudgetMs(timeoutMs: number, authorization: {
+    readonly expiresAt: string;
+    readonly leaseExpiresAt?: string;
+}, now?: () => number): number;
+//# sourceMappingURL=ExecutionDeadline.d.ts.map

package/dist/execution/ExecutionDeadline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExecutionDeadline.d.ts","sourceRoot":"","sources":["../../src/execution/ExecutionDeadline.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,qBAAa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,SAAS;aACV,QAAQ,EAAE,MAAM;IAChC,OAAO,CAAC,QAAQ,CAAC,GAAG;IAHtB,OAAO;WAMO,KAAK,CACjB,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,MAAM,MAA8B,GACxC,iBAAiB;IAIpB,IAAW,SAAS,IAAI,MAAM,CAE7B;IAED,IAAW,WAAW,IAAI,MAAM,CAE/B;IAED,IAAW,OAAO,IAAI,OAAO,CAE5B;IAED,+DAA+D;IACxD,MAAM,IAAI,WAAW;CAG7B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,EAC/E,GAAG,GAAE,MAAM,MAAyB,GACnC,MAAM,CAMR"}

package/dist/execution/ExecutionDeadline.js

@@ -0,0 +1,52 @@
+/**
+ * A deadline that a change to the wall clock cannot move. Dispatch bounds
+ * are read from `process.hrtime.bigint()`, so an operator correcting the
+ * clock, or an authority whose time differs, cannot extend the window in
+ * which a provider may be called.
+ */
+export class MonotonicDeadline {
+    startedAt;
+    budgetMs;
+    now;
+    constructor(startedAt, budgetMs, now) {
+        this.startedAt = startedAt;
+        this.budgetMs = budgetMs;
+        this.now = now;
+    }
+    static after(budgetMs, now = process.hrtime.bigint) {
+        return new MonotonicDeadline(now(), Math.max(Math.trunc(budgetMs), 0), now);
+    }
+    get elapsedMs() {
+        return Number((this.now() - this.startedAt) / 1000000n);
+    }
+    get remainingMs() {
+        return Math.max(this.budgetMs - this.elapsedMs, 0);
+    }
+    get expired() {
+        return this.remainingMs === 0;
+    }
+    /** A signal that aborts when the remaining budget runs out. */
+    signal() {
+        return AbortSignal.timeout(this.remainingMs);
+    }
+}
+/**
+ * The budget for one dispatch: the smallest of what the configuration
+ * allows, what is left of the grant, and what is left of the authority's
+ * claim lease when it named one.
+ *
+ * A provider is never called with more time than the authorization has, so a
+ * slow call cannot outlive the permission it was made under. The lease is
+ * the tighter bound and the one that matters more: a commit the authority
+ * will no longer record leaves an outcome nobody can reconcile from the
+ * record, however successful the dispatch was. A window that has already
+ * closed is a budget of zero, so the dispatch is refused rather than started.
+ */
+export function dispatchBudgetMs(timeoutMs, authorization, now = () => Date.now()) {
+    const windows = [authorization.expiresAt, authorization.leaseExpiresAt]
+        .filter((at) => at !== undefined)
+        .map((at) => Date.parse(at) - now())
+        .filter((remaining) => Number.isFinite(remaining));
+    return Math.max(Math.min(timeoutMs, ...windows), 0);
+}
+//# sourceMappingURL=ExecutionDeadline.js.map

package/dist/execution/ExecutionDeadline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExecutionDeadline.js","sourceRoot":"","sources":["../../src/execution/ExecutionDeadline.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,OAAO,iBAAiB;IAET;IACD;IACC;IAHnB,YACmB,SAAiB,EAClB,QAAgB,EACf,GAAiB;QAFjB,cAAS,GAAT,SAAS,CAAQ;QAClB,aAAQ,GAAR,QAAQ,CAAQ;QACf,QAAG,GAAH,GAAG,CAAc;IACjC,CAAC;IAEG,MAAM,CAAC,KAAK,CACjB,QAAgB,EAChB,MAAoB,OAAO,CAAC,MAAM,CAAC,MAAM;QAEzC,OAAO,IAAI,iBAAiB,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9E,CAAC;IAED,IAAW,SAAS;QAClB,OAAO,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,QAAU,CAAC,CAAC;IAC5D,CAAC;IAED,IAAW,WAAW;QACpB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,IAAW,OAAO;QAChB,OAAO,IAAI,CAAC,WAAW,KAAK,CAAC,CAAC;IAChC,CAAC;IAED,+DAA+D;IACxD,MAAM;QACX,OAAO,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/C,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAC9B,SAAiB,EACjB,aAA+E,EAC/E,MAAoB,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;IAEpC,MAAM,OAAO,GAAG,CAAC,aAAa,CAAC,SAAS,EAAE,aAAa,CAAC,cAAc,CAAC;SACpE,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,EAAE,KAAK,SAAS,CAAC;SAC9C,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC;SACnC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACrD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;AACtD,CAAC"}

package/dist/execution/ExecutionJournal.d.ts

@@ -0,0 +1,148 @@
+import { z } from "zod";
+export declare const JOURNAL_VERSION = "agent-safe.attempts/1";
+/**
+ * What the journal records about one attempt, in the order it happens:
+ * opened before the executor runs, claimed after the grant is consumed and
+ * before the provider is touched, closed once the outcome is known, and
+ * reconciled when a lost outcome is resolved later. The intent is stored
+ * whole on `ATTEMPT_OPENED`, because reconciliation needs the exact intent
+ * it was and nothing less will re-hash to the same value.
+ */
+export declare const JournalRecordSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    record: z.ZodLiteral<"ATTEMPT_OPENED">;
+    at: z.ZodString;
+    intent_id: z.ZodString;
+    intent_hash: z.ZodString;
+    idempotency_key: z.ZodString;
+    decision_id: z.ZodString;
+    dossier_id: z.ZodString;
+    caller_principal: z.ZodNullable<z.ZodString>;
+    intent: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+}, z.core.$strict>, z.ZodObject<{
+    record: z.ZodLiteral<"GRANT_CLAIMED">;
+    at: z.ZodString;
+    intent_id: z.ZodString;
+    intent_hash: z.ZodString;
+    idempotency_key: z.ZodString;
+    grant_id: z.ZodString;
+    expires_at: z.ZodString;
+    request_digest: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    record: z.ZodLiteral<"ATTEMPT_CLOSED">;
+    at: z.ZodString;
+    intent_id: z.ZodString;
+    intent_hash: z.ZodString;
+    outcome: z.ZodString;
+    executed: z.ZodNullable<z.ZodBoolean>;
+    finalization: z.ZodNullable<z.ZodEnum<{
+        RECORDED: "RECORDED";
+        PENDING: "PENDING";
+        UNSUPPORTED: "UNSUPPORTED";
+    }>>;
+}, z.core.$strict>, z.ZodObject<{
+    record: z.ZodLiteral<"RECONCILED">;
+    at: z.ZodString;
+    intent_id: z.ZodString;
+    intent_hash: z.ZodString;
+    status: z.ZodEnum<{
+        BLOCKED: "BLOCKED";
+        COMPLETED: "COMPLETED";
+        UNKNOWN_AFTER_DISPATCH: "UNKNOWN_AFTER_DISPATCH";
+        DEFINITELY_NOT_EXECUTED: "DEFINITELY_NOT_EXECUTED";
+    }>;
+    source: z.ZodEnum<{
+        STARTUP: "STARTUP";
+        CALLER: "CALLER";
+    }>;
+}, z.core.$strict>], "record">;
+export type JournalRecord = z.infer<typeof JournalRecordSchema>;
+export type JournalRecordKind = JournalRecord["record"];
+/** An attempt whose outcome the journal does not know, as the reconciler finds it. */
+export interface OpenAttempt {
+    readonly intentId: string;
+    readonly intentHash: string;
+    readonly idempotencyKey: string;
+    readonly openedAt: string;
+    readonly decisionId: string;
+    readonly dossierId: string;
+    readonly grantId: string | null;
+    readonly expiresAt: string | null;
+    readonly callerPrincipal: string | null;
+    /** `CLAIMED`: a grant was consumed, so the provider may have acted. `OPENED`: it never was. */
+    readonly state: "OPENED" | "CLAIMED";
+    readonly intent: Readonly<Record<string, unknown>>;
+}
+/**
+ * What one attempt was dispatched under: the decision it was opened for and
+ * the grant it claimed before the provider was touched. The shape is the
+ * pipeline's `VerifiedAuthorization`, so a reconciliation can be held
+ * against it field for field.
+ */
+export interface DispatchedAuthorization {
+    readonly decisionId: string;
+    readonly dossierId: string;
+    readonly grantId: string;
+    readonly intentHash: string;
+    readonly expiresAt: string;
+}
+/** A refusal by the journal: the code, never a path or a value. */
+export declare class JournalError extends Error {
+    readonly code: string;
+    constructor(code: string);
+}
+/**
+ * Where the executor writes what it is about to do, before it does it: the
+ * port `GovernedExecutionRunner` journals through. The contract is
+ * deliberately small: append a record, and read back the attempts whose
+ * outcome is not yet known. Nothing here reaches the audit stream or an
+ * evidence export; the journal holds the request's own parameters, which the
+ * evidence planes never carry.
+ *
+ * Two properties make a claim durable and a key single-use, and the runner
+ * relies on both: `append` throws rather than lose a `GRANT_CLAIMED` record,
+ * so nothing is dispatched without one; and a journal that answers
+ * `dispatchedUnder` lets the runner refuse a second dispatch under an
+ * idempotency key that was already claimed, before a grant is spent on it.
+ * A journal shared by replicas (`PostgresExecutionJournal`) also refuses the
+ * second `GRANT_CLAIMED` for a key itself, so two replicas racing on one key
+ * dispatch once.
+ */
+export interface ExecutionJournal {
+    /** Appends one record durably. It must throw rather than lose a record. */
+    append(record: JournalRecord): Promise<void>;
+    /** Attempts opened and not closed or reconciled, oldest first. */
+    openAttempts(): Promise<readonly OpenAttempt[]>;
+    /**
+     * Every authorization one intent was dispatched under, however the attempt
+     * ended, oldest first: what a caller's reconciliation is held against.
+     */
+    authorizationsOf(intentId: string): Promise<readonly DispatchedAuthorization[]>;
+    /**
+     * Every authorization a grant was claimed under for this idempotency key,
+     * across intents, oldest first. Optional: a journal without it leaves the
+     * key's single use to the provider's own idempotency facility.
+     */
+    dispatchedUnder?(idempotencyKey: string): Promise<readonly DispatchedAuthorization[]>;
+    close(): void;
+}
+/** The journal's refusal of a second claim under one idempotency key. */
+export declare const IDEMPOTENCY_KEY_DISPATCHED = "IDEMPOTENCY_KEY_DISPATCHED";
+/** Folds a stream of records into the attempts still open, oldest first. */
+export declare function openAttemptsFrom(records: Iterable<JournalRecord>): readonly OpenAttempt[];
+/**
+ * Folds a stream of records into the authorizations one intent was
+ * dispatched under, oldest first. Only a claimed attempt was dispatched: one
+ * opened and never claimed consumed no grant, and a claim with no opening
+ * record names no decision, so neither is anything to reconcile. Closing and
+ * reconciling records are ignored, because what an attempt was dispatched
+ * under does not change when its outcome becomes known.
+ */
+export declare function authorizationsFrom(records: Iterable<JournalRecord>, intentId: string): readonly DispatchedAuthorization[];
+/**
+ * Folds a stream of records into the authorizations claimed under one
+ * idempotency key, oldest first, whichever intent each was opened for. The
+ * claim record names the key it was claimed under; the decision comes from
+ * the opening record of the same intent, as in `authorizationsFrom`.
+ */
+export declare function dispatchedUnderFrom(records: Iterable<JournalRecord>, idempotencyKey: string): readonly DispatchedAuthorization[];
+//# sourceMappingURL=ExecutionJournal.d.ts.map

package/dist/execution/ExecutionJournal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExecutionJournal.d.ts","sourceRoot":"","sources":["../../src/execution/ExecutionJournal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,eAAe,0BAA0B,CAAC;AAKvD;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAyC9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,iBAAiB,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;AAExD,sFAAsF;AACtF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,+FAA+F;IAC/F,QAAQ,CAAC,KAAK,EAAE,QAAQ,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACpD;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,mEAAmE;AACnE,qBAAa,YAAa,SAAQ,KAAK;aACF,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM;CAIhD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,gBAAgB;IAC/B,2EAA2E;IAC3E,MAAM,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,kEAAkE;IAClE,YAAY,IAAI,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC,CAAC;IAChD;;;OAGG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,uBAAuB,EAAE,CAAC,CAAC;IAChF;;;;OAIG;IACH,eAAe,CAAC,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,uBAAuB,EAAE,CAAC,CAAC;IACtF,KAAK,IAAI,IAAI,CAAC;CACf;AAED,yEAAyE;AACzE,eAAO,MAAM,0BAA0B,+BAA+B,CAAC;AAEvE,4EAA4E;AAC5E,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,aAAa,CAAC,GAAG,SAAS,WAAW,EAAE,CAkCzF;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,QAAQ,CAAC,aAAa,CAAC,EAChC,QAAQ,EAAE,MAAM,GACf,SAAS,uBAAuB,EAAE,CAiBpC;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,QAAQ,CAAC,aAAa,CAAC,EAChC,cAAc,EAAE,MAAM,GACrB,SAAS,uBAAuB,EAAE,CAiBpC"}