@dharma-ai-labs/agent-fabric 0.2.106 → 0.2.108

package/dist/cooperativeInboxSession.test.js

@@ -0,0 +1,354 @@
+import assert from 'node:assert/strict';
+import { generateKeyPairSync, randomBytes } from 'node:crypto';
+import { mkdtemp } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import test from 'node:test';
+import { signCanonicalObject } from '@dharma-ai-labs/agent-fabric-contracts';
+import { LocalVault } from '@dharma-ai-labs/agent-fabric-local-vault';
+import { openCooperativeInboxSession } from './cooperativeInboxSession.js';
+import { openCodexBoundSession } from './codexBoundSession.js';
+import { openCooperativeInboxSession as publicConsumer } from './index.js';
+const { privateKey, publicKey } = generateKeyPairSync('ed25519');
+const uuid = (last) => `50000000-0000-4000-8000-${String(last).padStart(12, '0')}`;
+test('the owning runtime may import the cooperative consumer through the public package surface', () => {
+    assert.equal(publicConsumer, openCooperativeInboxSession);
+});
+async function fixture(owner = 'cooperative_session') {
+    const root = await mkdtemp(join(tmpdir(), 'dharma-cooperative-'));
+    const masterKey = randomBytes(32), now = new Date();
+    const binding = {
+        schema: 'dharma.local-provider-session-binding/v1', owner,
+        organizationId: 'org_test', repositoryBindingId: uuid(1), workspaceId: uuid(2), endpointId: uuid(3),
+        membershipId: uuid(4), deviceId: uuid(5), bindingId: uuid(6), provider: 'codex', sessionId: uuid(7),
+        workspaceRoot: resolve(root, 'repo'), createdAt: now.toISOString(),
+        expiresAt: new Date(now.getTime() + 3600000).toISOString(), maximumProviderCostCents: 25,
+    };
+    const identity = { organizationId: binding.organizationId, repositoryBindingId: binding.repositoryBindingId,
+        workspaceId: binding.workspaceId, endpointId: binding.endpointId, membershipId: binding.membershipId,
+        deviceId: binding.deviceId, provider: binding.provider };
+    const vault = await LocalVault.open({ root, masterKey });
+    vault.saveProviderSessionBinding(binding);
+    let context = {
+        provider: 'codex', sessionId: binding.sessionId, workspaceRoot: binding.workspaceRoot, active: true,
+    };
+    const unsigned = { schema: 'dharma.session-question/v1', questionId: uuid(10), taskId: uuid(11),
+        organizationId: binding.organizationId, repositoryBindingId: binding.repositoryBindingId,
+        source: { workspaceId: uuid(12), endpointId: uuid(13), membershipId: uuid(14), deviceId: uuid(15) },
+        target: { workspaceId: binding.workspaceId, endpointId: binding.endpointId, membershipId: binding.membershipId,
+            deviceId: binding.deviceId, bindingId: binding.bindingId, provider: 'codex' },
+        category: 'architecture', question: 'Which signed catalog applies?',
+        authority: { mode: 'read_only', readPaths: ['.'], network: 'deny', maximumProviderCostCents: 25 },
+        createdAt: now.toISOString(), expiresAt: new Date(now.getTime() + 60000).toISOString(),
+        nonce: uuid(16), signerKeyVersion: 'test-key',
+    };
+    const question = { ...unsigned, signature: signCanonicalObject(unsigned, privateKey) };
+    const actions = [], used = new Set();
+    let state = 'queued', answer = null, revision = 0, fail = null;
+    let after, disclosed = true, reserved = true;
+    const transport = { async signedPost(route, payload) {
+            const body = payload, action = String(body.action);
+            actions.push(action);
+            after?.(action);
+            if (fail === action)
+                throw new Error('synthetic acknowledgement lost');
+            const envelope = { ok: true, organizationId: binding.organizationId, correlationId: uuid(90) };
+            if (route.endsWith('provider-sessions')) {
+                if (action !== 'inspect')
+                    revision++;
+                return { ...envelope, registration: revision === 0 ? null : {
+                        bindingId: binding.bindingId, workspaceId: binding.workspaceId, endpointId: binding.endpointId,
+                        repositoryBindingId: binding.repositoryBindingId, membershipId: binding.membershipId,
+                        deviceId: binding.deviceId, provider: 'codex', mode: 'cooperative', revision,
+                        state: action === 'detach' ? 'detached' : 'attached',
+                        leaseUntil: new Date(Date.now() + 60000).toISOString(), replay: false,
+                    } };
+            }
+            if (action === 'inbox')
+                return { ...envelope, result: { offers: state === 'queued' ? [question] : [] } };
+            if (action === 'accept')
+                state = 'accepted';
+            if (action === 'reply') {
+                state = String(body.outcome);
+                answer = state === 'answered' ? String(body.answer) : null;
+            }
+            if (action === 'read')
+                return { ...envelope, result: {
+                        questionId: question.questionId, taskId: question.taskId, targetBindingId: binding.bindingId,
+                        state, answer, failureCode: state === 'failed' ? 'execution_failed' : null,
+                        replyReceiptHash: ['answered', 'failed'].includes(state) ? `sha256:${'a'.repeat(64)}` : null,
+                    } };
+            return { ...envelope, result: { questionId: question.questionId, taskId: question.taskId,
+                    targetBindingId: binding.bindingId, state, replay: false } };
+        } };
+    let reserveCalls = 0;
+    const input = { vault, bindingId: binding.bindingId, identity, channelTransport: transport,
+        currentSession: async () => context,
+        verifier: { resolvePublicKey: () => publicKey,
+            consume: async (id) => { if (used.has(id))
+                return false; used.add(id); return true; } },
+        authorizeContent: async () => disclosed,
+        budget: { reserve: async () => { reserveCalls++; return reserved; } }, };
+    return { ...input, binding, root, masterKey, question, actions, used, input,
+        setContext: (value) => { context = value; }, getContext: () => context,
+        setFail: (action) => { fail = action; }, onAction: (fn) => { after = fn; },
+        setDisclosure: (value) => { disclosed = value; }, setReservation: (value) => { reserved = value; },
+        reserves: () => reserveCalls, };
+}
+test('cooperative bindings cannot be driven by a bridge-owned app-server', async () => {
+    const f = await fixture();
+    let spawned = 0;
+    try {
+        await assert.rejects(openCodexBoundSession({ ...f.input,
+            openTransport: async () => { spawned++; throw new Error('must not spawn'); } }), /binding_unavailable/);
+        assert.equal(spawned, 0);
+    }
+    finally {
+        f.vault.close();
+    }
+});
+test('only the exact active cooperative session may attach; bridge bindings remain separate', async (t) => {
+    for (const wrong of ['missing', 'inactive', 'thread', 'workspace', 'bridge'])
+        await t.test(wrong, async () => {
+            const f = await fixture(wrong === 'bridge' ? 'dharma_bridge' : 'cooperative_session');
+            if (wrong === 'missing')
+                f.setContext(null);
+            if (wrong === 'inactive')
+                f.setContext({ ...f.getContext(), active: false });
+            if (wrong === 'thread')
+                f.setContext({ ...f.getContext(), sessionId: uuid(50) });
+            if (wrong === 'workspace')
+                f.setContext({ ...f.getContext(), workspaceRoot: resolve(f.root, 'other') });
+            try {
+                await assert.rejects(openCooperativeInboxSession(f.input), /cooperative_session_(binding_unavailable|owner_lost)/);
+                assert.equal(f.actions.length, 0);
+                const lease = f.vault.tryAcquireProviderSessionLease(f.binding.bindingId, f.identity);
+                assert.ok(lease);
+                lease.release();
+            }
+            finally {
+                f.vault.close();
+            }
+        });
+});
+test('in-session handler receives a verified bounded offer and returns an attributed immutable answer', async () => {
+    const f = await fixture(), owner = await openCooperativeInboxSession(f.input);
+    try {
+        let handlers = 0;
+        const result = await owner.runNext(async (offer) => {
+            handlers++;
+            assert.deepEqual(offer, f.question);
+            assert.throws(() => { offer.taskId = uuid(50); }, TypeError);
+            assert.throws(() => { offer.authority.readPaths.push('.'); }, TypeError);
+            return 'Consult signed catalog generation 13; preserve its source references.';
+        });
+        assert.equal(result.state, 'answered');
+        assert.equal(handlers, 1);
+        assert.equal(f.reserves(), 1);
+        assert.equal(f.used.size, 1);
+        assert.deepEqual(f.actions, ['inspect', 'attach', 'inbox', 'accept', 'reply']);
+        assert.equal(f.vault.listProviderSessionReplies(f.binding.bindingId, f.identity).length, 0);
+        const idle = await owner.runNext(async () => { throw new Error('must not execute'); });
+        assert.equal(idle.state, 'idle');
+    }
+    finally {
+        await owner.close();
+        f.vault.close();
+    }
+});
+test('budget denial neither accepts nor consumes nor invokes the chat handler', async () => {
+    const f = await fixture();
+    f.setReservation(false);
+    const owner = await openCooperativeInboxSession(f.input);
+    try {
+        assert.equal((await owner.runNext(async () => { throw new Error('must not execute'); })).state, 'budget_denied');
+        assert.equal(f.actions.includes('accept'), false);
+        assert.equal(f.used.size, 0);
+    }
+    finally {
+        await owner.close();
+        f.vault.close();
+    }
+});
+test('owner changes during asynchronous budget or acceptance cannot reach the handler', async (t) => {
+    for (const boundary of ['budget', 'accept'])
+        await t.test(boundary, async () => {
+            const f = await fixture();
+            const input = boundary === 'budget' ? { ...f.input, budget: { reserve: async () => {
+                        f.setContext({ ...f.getContext(), sessionId: uuid(51) });
+                        return true;
+                    } } } : f.input;
+            if (boundary === 'accept')
+                f.onAction(action => { if (action === 'accept')
+                    f.setContext(null); });
+            const owner = await openCooperativeInboxSession(input);
+            try {
+                await assert.rejects(owner.runNext(async () => { throw new Error('must not execute'); }), /owner_lost/);
+                assert.equal(f.actions.includes('reply'), false);
+            }
+            finally {
+                await owner.close();
+                f.vault.close();
+            }
+        });
+});
+test('loss of current session after computation suppresses disclosure', async () => {
+    const f = await fixture(), owner = await openCooperativeInboxSession(f.input);
+    try {
+        await assert.rejects(owner.runNext(async () => { f.setContext(null); return 'An answer that must not escape.'; }), /owner_lost/);
+        assert.equal(f.actions.includes('reply'), false);
+    }
+    finally {
+        await owner.close();
+        f.vault.close();
+    }
+});
+test('lost answer acknowledgement is recovered from the vault without another handler or reservation', async () => {
+    const f = await fixture();
+    f.setFail('reply');
+    const owner = await openCooperativeInboxSession(f.input);
+    let handlers = 0;
+    try {
+        assert.equal((await owner.runNext(async () => { handlers++; return 'Retain catalog generation 13.'; })).state, 'reply_pending');
+        assert.equal(f.vault.listProviderSessionReplies(f.binding.bindingId, f.identity).length, 1);
+    }
+    finally {
+        await owner.close();
+        f.vault.close();
+    }
+    const reopened = await LocalVault.open({ root: f.root, masterKey: f.masterKey });
+    f.setFail(null);
+    const successor = await openCooperativeInboxSession({ ...f.input, vault: reopened });
+    try {
+        assert.equal((await successor.runNext(async () => { handlers++; throw new Error('must not rerun'); })).state, 'reply_reconciled');
+        assert.equal(handlers, 1);
+        assert.equal(f.reserves(), 1);
+        assert.equal(reopened.listProviderSessionReplies(f.binding.bindingId, f.identity).length, 0);
+    }
+    finally {
+        await successor.close();
+        reopened.close();
+    }
+});
+test('disclosure denial leaves encrypted completion pending instead of rerunning work', async () => {
+    const f = await fixture(), owner = await openCooperativeInboxSession(f.input);
+    try {
+        const result = await owner.runNext(async () => { f.setDisclosure(false); return 'Retain the approved catalog.'; });
+        assert.equal(result.state, 'reply_pending');
+        assert.equal(f.actions.includes('reply'), false);
+        assert.equal(f.vault.listProviderSessionReplies(f.binding.bindingId, f.identity).length, 1);
+    }
+    finally {
+        await owner.close();
+        f.vault.close();
+    }
+});
+test('local fence rejects another consumer and explicit retirement is terminal', async () => {
+    const f = await fixture(), owner = await openCooperativeInboxSession(f.input);
+    try {
+        await assert.rejects(openCooperativeInboxSession(f.input), /lease_unavailable/);
+        assert.equal((await owner.retire()).serverDetached, true);
+        assert.equal(f.vault.getProviderSessionBinding(f.binding.bindingId, f.identity), null);
+        await assert.rejects(owner.runNext(async () => 'No.'), /unavailable/);
+    }
+    finally {
+        await owner.close();
+        f.vault.close();
+    }
+});
+test('a second question handler cannot overlap the current session turn', async () => {
+    const f = await fixture(), owner = await openCooperativeInboxSession(f.input);
+    let started, finish;
+    const began = new Promise(resolve => { started = resolve; });
+    const gate = new Promise(resolve => { finish = resolve; });
+    const first = owner.runNext(async () => { started(); await gate; return 'Use the approved catalog.'; });
+    await began;
+    try {
+        await assert.rejects(owner.runNext(async () => 'No.'), /busy/);
+        finish();
+        assert.equal((await first).state, 'answered');
+    }
+    finally {
+        finish();
+        await first.catch(() => undefined);
+        await owner.close();
+        f.vault.close();
+    }
+});
+test('expiry during a reservation wait prevents acceptance and current-chat execution', async (t) => {
+    const f = await fixture();
+    f.question.expiresAt = new Date(Date.now() + 30000).toISOString();
+    const { signature: _signature, ...unsigned } = f.question;
+    f.question.signature = signCanonicalObject(unsigned, privateKey);
+    t.mock.timers.enable({ apis: ['Date'], now: Date.now() });
+    const owner = await openCooperativeInboxSession({ ...f.input,
+        budget: { reserve: async () => { t.mock.timers.tick(31000); return true; } },
+    });
+    try {
+        await assert.rejects(owner.runNext(async () => { throw new Error('must not execute expired work'); }), /expired|unavailable/);
+        assert.equal(f.actions.includes('accept'), false);
+    }
+    finally {
+        await owner.close();
+        f.vault.close();
+    }
+});
+test('current-chat execution failure emits a typed failed receipt without disclosing exception text', async () => {
+    const f = await fixture(), owner = await openCooperativeInboxSession(f.input);
+    try {
+        const result = await owner.runNext(async () => { throw new Error('private internal exception'); });
+        assert.equal(result.state, 'failed');
+        assert.equal(f.actions.includes('reply'), true);
+        assert.equal(JSON.stringify(result).includes('private internal exception'), false);
+    }
+    finally {
+        await owner.close();
+        f.vault.close();
+    }
+});
+test('close keeps the fence until the current handler settles and suppresses its answer', async () => {
+    const f = await fixture(), owner = await openCooperativeInboxSession(f.input);
+    let started, finish;
+    const began = new Promise(resolve => { started = resolve; });
+    const gate = new Promise(resolve => { finish = resolve; });
+    const turn = owner.runNext(async () => { started(); await gate; return 'This answer must be withheld.'; });
+    await began;
+    const closing = owner.close();
+    assert.equal(f.vault.tryAcquireProviderSessionLease(f.binding.bindingId, f.identity), null);
+    finish();
+    await assert.rejects(turn, /owner_lost/);
+    await closing;
+    assert.equal(f.actions.includes('reply'), false);
+    const successor = f.vault.tryAcquireProviderSessionLease(f.binding.bindingId, f.identity);
+    assert.ok(successor);
+    successor.release();
+    f.vault.close();
+});
+test('revocation during replay claim prevents execution', async () => {
+    const f = await fixture();
+    const owner = await openCooperativeInboxSession({ ...f.input, verifier: { ...f.input.verifier,
+            consume: async () => { f.vault.revokeProviderSessionBinding(f.binding.bindingId, f.identity); return true; },
+        } });
+    try {
+        await assert.rejects(owner.runNext(async () => { throw new Error('must not execute'); }), /owner_lost/);
+        assert.equal(f.actions.includes('reply'), false);
+    }
+    finally {
+        await owner.close();
+        f.vault.close();
+    }
+});
+test('secret answers stay encrypted locally and are never transmitted', async () => {
+    const f = await fixture(), owner = await openCooperativeInboxSession(f.input);
+    try {
+        const result = await owner.runNext(async () => 'api_key=synthetic-do-not-disclose');
+        assert.equal(result.state, 'reply_pending');
+        assert.equal(f.actions.includes('reply'), false);
+        assert.equal(JSON.stringify(result).includes('synthetic-do-not-disclose'), false);
+    }
+    finally {
+        await owner.close();
+        f.vault.close();
+    }
+});
+//# sourceMappingURL=cooperativeInboxSession.test.js.map

package/dist/cooperativeInboxSession.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cooperativeInboxSession.test.js","sourceRoot":"","sources":["../src/cooperativeInboxSession.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,EAAE,UAAU,EAAoC,MAAM,0CAA0C,CAAC;AACxG,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,2BAA2B,IAAI,cAAc,EAAE,MAAM,YAAY,CAAC;AAE3E,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;AACjE,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,2BAA2B,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;AAE3F,IAAI,CAAC,2FAA2F,EAAE,GAAG,EAAE;IACrG,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;AAC5D,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,OAAO,CAAC,QAAiD,qBAAqB;IAC3F,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACpD,MAAM,OAAO,GAAgC;QAC3C,MAAM,EAAE,0CAA0C,EAAE,KAAK;QACzD,cAAc,EAAE,UAAU,EAAE,mBAAmB,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;QACnG,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;QACnG,aAAa,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;QAClE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,wBAAwB,EAAE,EAAE;KACzF,CAAC;IACF,MAAM,QAAQ,GAAG,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QACzG,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;QACpG,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC3D,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IAAC,KAAK,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC;IACpG,IAAI,OAAO,GAA4F;QACrG,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI;KACpG,CAAC;IACF,MAAM,QAAQ,GAAG,EAAE,MAAM,EAAE,4BAA4B,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;QAC7F,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QACxF,MAAM,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE;QACnG,MAAM,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;YAC5G,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE;QAC/E,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,+BAA+B;QACnE,SAAS,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,wBAAwB,EAAE,EAAE,EAAE;QACjG,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE;QACtF,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,gBAAgB,EAAE,UAAU;KAC9C,CAAC;IACF,MAAM,QAAQ,GAAG,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,mBAAmB,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;IACvF,MAAM,OAAO,GAAa,EAAE,EAAE,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IACvD,IAAI,KAAK,GAAG,QAAQ,EAAE,MAAM,GAAkB,IAAI,EAAE,QAAQ,GAAG,CAAC,EAAE,IAAI,GAAkB,IAAI,CAAC;IAC7F,IAAI,KAA6C,EAAE,SAAS,GAAG,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC;IACrF,MAAM,SAAS,GAAG,EAAE,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,OAAgB;YAClE,MAAM,IAAI,GAAG,OAAkC,EAAE,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC9E,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAAC,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC;YACtC,IAAI,IAAI,KAAK,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACvE,MAAM,QAAQ,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAC/F,IAAI,KAAK,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBACxC,IAAI,MAAM,KAAK,SAAS;oBAAE,QAAQ,EAAE,CAAC;gBACrC,OAAO,EAAE,GAAG,QAAQ,EAAE,YAAY,EAAE,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;wBAC1D,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU;wBAC9F,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;wBACpF,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ;wBAC5E,KAAK,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;wBACpD,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,KAAK;qBACtE,EAAE,CAAC;YACN,CAAC;YACD,IAAI,MAAM,KAAK,OAAO;gBAAE,OAAO,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;YACzG,IAAI,MAAM,KAAK,QAAQ;gBAAE,KAAK,GAAG,UAAU,CAAC;YAC5C,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;gBAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAAC,MAAM,GAAG,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAAC,CAAC;YACrH,IAAI,MAAM,KAAK,MAAM;gBAAE,OAAO,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE;wBACnD,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,SAAS;wBAC5F,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI;wBAC1E,gBAAgB,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;qBAC7F,EAAE,CAAC;YACJ,OAAO,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACtF,eAAe,EAAE,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACjE,CAAC,EAAE,CAAC;IACJ,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,gBAAgB,EAAE,SAAS;QACxF,cAAc,EAAE,KAAK,IAAI,EAAE,CAAC,OAAO;QACnC,QAAQ,EAAE,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,SAAS;YAC3C,OAAO,EAAE,KAAK,EAAE,EAAU,EAAE,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,OAAO,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE;QACjG,gBAAgB,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS;QACvC,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,GAAG,YAAY,EAAE,CAAC,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,GACtE,CAAC;IACF,OAAO,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK;QACzE,UAAU,EAAE,CAAC,KAAqB,EAAE,EAAE,GAAG,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO;QACtF,OAAO,EAAE,CAAC,MAAqB,EAAE,EAAE,GAAG,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAgB,EAAE,EAAE,GAAG,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC;QACvG,aAAa,EAAE,CAAC,KAAc,EAAE,EAAE,GAAG,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,KAAc,EAAE,EAAE,GAAG,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC;QACpH,QAAQ,EAAE,GAAG,EAAE,CAAC,YAAY,GAC7B,CAAC;AACJ,CAAC;AAED,IAAI,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;IACpF,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IAC1B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK;YACrD,aAAa,EAAE,KAAK,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,qBAAqB,CAAC,CAAC;QAC1G,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC3B,CAAC;YAAS,CAAC;QAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AAChC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uFAAuF,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IACtG,KAAK,MAAM,KAAK,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAU;QAAE,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;YACpH,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC;YACtF,IAAI,KAAK,KAAK,SAAS;gBAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,KAAK,KAAK,UAAU;gBAAE,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC,UAAU,EAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9E,IAAI,KAAK,KAAK,QAAQ;gBAAE,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC,UAAU,EAAG,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAClF,IAAI,KAAK,KAAK,WAAW;gBAAE,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC,UAAU,EAAG,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YACzG,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,sDAAsD,CAAC,CAAC;gBACnH,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;gBAClC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;gBACtF,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;gBAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACpC,CAAC;oBAAS,CAAC;gBAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;QAChC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iGAAiG,EAAE,KAAK,IAAI,EAAE;IACjH,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,EAAE,KAAK,GAAG,MAAM,2BAA2B,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC9E,IAAI,CAAC;QACH,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,EAAC,KAAK,EAAC,EAAE;YAC/C,QAAQ,EAAE,CAAC;YAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;YAChD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YAC7D,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YACzE,OAAO,uEAAuE,CAAC;QACjF,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAClE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;QAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC5D,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/E,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC5F,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;YAAS,CAAC;QAAC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AACrD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;IACzF,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,MAAM,2BAA2B,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QACjH,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;QAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAClF,CAAC;YAAS,CAAC;QAAC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AACrD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iFAAiF,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IAChG,KAAK,MAAM,QAAQ,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAU;QAAE,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;YACtF,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE;wBAChF,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC,UAAU,EAAG,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;wBAAC,OAAO,IAAI,CAAC;oBACzE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YAChB,IAAI,QAAQ,KAAK,QAAQ;gBAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,MAAM,KAAK,QAAQ;oBAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAClG,MAAM,KAAK,GAAG,MAAM,2BAA2B,CAAC,KAAK,CAAC,CAAC;YACvD,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;gBACxG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;YACnD,CAAC;oBAAS,CAAC;gBAAC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;gBAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;QACrD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;IACjF,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,EAAE,KAAK,GAAG,MAAM,2BAA2B,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC9E,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,iCAAiC,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;QACjI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;IACnD,CAAC;YAAS,CAAC;QAAC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AACrD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gGAAgG,EAAE,KAAK,IAAI,EAAE;IAChH,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,MAAM,2BAA2B,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACzD,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC,OAAO,+BAA+B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QAChI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9F,CAAC;YAAS,CAAC;QAAC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IACjF,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAChB,MAAM,SAAS,GAAG,MAAM,2BAA2B,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrF,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;QAClI,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC/F,CAAC;YAAS,CAAC;QAAC,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AAC1D,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;IACjG,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,EAAE,KAAK,GAAG,MAAM,2BAA2B,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC9E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,GAAG,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,8BAA8B,CAAC,CAAC,CAAC,CAAC,CAAC;QACnH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;QAC9F,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9F,CAAC;YAAS,CAAC;QAAC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AACrD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;IAC1F,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,EAAE,KAAK,GAAG,MAAM,2BAA2B,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC9E,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,mBAAmB,CAAC,CAAC;QAChF,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;QAC1D,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;QACvF,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,CAAC;IACxE,CAAC;YAAS,CAAC;QAAC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AACrD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;IACnF,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,EAAE,KAAK,GAAG,MAAM,2BAA2B,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC9E,IAAI,OAAoB,EAAE,MAAmB,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,GAAG,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC;IACxG,MAAM,KAAK,CAAC;IACZ,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;QAC/D,MAAM,EAAE,CAAC;QAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC1D,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC;QAAC,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAAC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AACnG,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iFAAiF,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;IAChG,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IAC1B,CAAC,CAAC,QAAQ,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAClE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,QAAQ,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC1D,CAAC,CAAC,QAAQ,CAAC,SAAS,GAAG,mBAAmB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACjE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,MAAM,2BAA2B,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK;QAC1D,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE;KAC7E,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;QAC9H,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;IACpD,CAAC;YAAS,CAAC;QAAC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AACrD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,+FAA+F,EAAE,KAAK,IAAI,EAAE;IAC/G,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,EAAE,KAAK,GAAG,MAAM,2BAA2B,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC9E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;QAChD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,4BAA4B,CAAC,EAAE,KAAK,CAAC,CAAC;IACrF,CAAC;YAAS,CAAC;QAAC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AACrD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;IACnG,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,EAAE,KAAK,GAAG,MAAM,2BAA2B,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC9E,IAAI,OAAoB,EAAE,MAAmB,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,GAAG,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,+BAA+B,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3G,MAAM,KAAK,CAAC;IACZ,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;IAC9B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5F,MAAM,EAAE,CAAC;IACT,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAAC,MAAM,OAAO,CAAC;IACxD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC1F,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;IAAC,SAAS,CAAC,OAAO,EAAE,CAAC;IAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;AAC7D,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;IACnE,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAG,MAAM,2BAA2B,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ;YAC3F,OAAO,EAAE,KAAK,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;SAC7G,EAAE,CAAC,CAAC;IACL,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;QACxG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;IACnD,CAAC;YAAS,CAAC;QAAC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AACrD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;IACjF,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,EAAE,KAAK,GAAG,MAAM,2BAA2B,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC9E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,mCAAmC,CAAC,CAAC;QACpF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;QAC9F,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,KAAK,CAAC,CAAC;IACpF,CAAC;YAAS,CAAC;QAAC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AACrD,CAAC,CAAC,CAAC"}

package/dist/demoPackage.d.ts

@@ -57,6 +57,7 @@ export declare function demoRepositoryPackage(input: {
         alreadyInstalled: boolean;
         policyTransition?: undefined;
         policyHash?: undefined;
+        retainedKnowledge?: undefined;
     };
     acknowledgement: {
         receiptHash: string;

package/dist/demoPackage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"demoPackage.d.ts","sourceRoot":"","sources":["../src/demoPackage.ts"],"names":[],"mappings":"AAIA,OAAO,EAAuC,KAAK,UAAU,EAAE,MAAM,wCAAwC,CAAC;AAC9G,OAAO,EAE+B,KAAK,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAGhH,OAAO,EAAqD,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAuB9G,MAAM,WAAW,uBAAuB;IAAG,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAAE;AAmflH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,KAAK,EAAE,eAAe,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,EAAE,IAAI,GAAE,uBAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+GpC"}
+{"version":3,"file":"demoPackage.d.ts","sourceRoot":"","sources":["../src/demoPackage.ts"],"names":[],"mappings":"AAIA,OAAO,EAAuC,KAAK,UAAU,EAAE,MAAM,wCAAwC,CAAC;AAC9G,OAAO,EAE+B,KAAK,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAGhH,OAAO,EAAqD,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAyB9G,MAAM,WAAW,uBAAuB;IAAG,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAAE;AA6flH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,KAAK,EAAE,eAAe,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,EAAE,IAAI,GAAE,uBAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4GpC"}

package/dist/demoPackage.js

@@ -8,7 +8,7 @@ import { getActiveSkillBundleAuthorization, installSkillBundle, rollbackUnconfir
 import { loadDemoSigningTrust, scopePath, verifyDemoDevice } from './demoEnrollment.js';
 import { receiveRepositoryPackageDelivery } from './repositoryPackageDelivery.js';
 import { inventoryRepositoryPackage, readRepositoryPackageSnapshot, rebuildRepositoryPackageSnapshot, writeRepositoryPackageSnapshot } from './repositoryPackage.js';
-import { initializeRepositoryKnowledge } from './repositoryKnowledge.js';
+import { initializeRepositoryKnowledge, REPOSITORY_KNOWLEDGE_CATALOG_PATH, REPOSITORY_KNOWLEDGE_RELEASE_MANIFEST_PATH } from './repositoryKnowledge.js';
 import { assertRepositoryInstallerOwnership, writeRepositoryInstallerFile } from './repositoryInstallerFiles.js';
 import { pollRepositoryCandidate, synchronizeRepositoryCandidate } from './repositoryCandidateSync.js';
 import { validateRepositorySourceAuthorization } from './repositorySourceAuthorization.js';
@@ -202,9 +202,6 @@ async function installActiveDemoPackage(input, deps) {
     if (!signingKey)
         throw new Error('Demo release is not signed by a currently trusted organization key.');
     const releaseId = String(published.releaseId);
-    if (descriptor.policyHash !== input.authorization.policyHash) {
-        return { policyTransition: true, releaseId, policyHash: descriptor.policyHash };
-    }
     const delivery = await receiveRepositoryPackageDelivery({
         envelope, bundle, serverPublicKey: signingKey,
         scope: { organizationId: scope.organizationId, repositoryBindingId: scope.repositoryId,
@@ -219,6 +216,19 @@ async function installActiveDemoPackage(input, deps) {
             return response.chunk;
         },
     });
+    if (descriptor.policyHash !== input.authorization.policyHash) {
+        // Retain verified history for a replacement candidate, never activate stale authority.
+        delivery.assertCurrent();
+        const bytes = (path) => {
+            const file = delivery.files.find(row => row.path === path);
+            if (!file)
+                throw new Error('Demo policy transition is missing its verified knowledge.');
+            return Buffer.from(file.contentBase64, 'base64');
+        };
+        return { policyTransition: true, releaseId, policyHash: descriptor.policyHash,
+            retainedKnowledge: { catalogBytes: bytes(REPOSITORY_KNOWLEDGE_CATALOG_PATH),
+                manifestBytes: bytes(REPOSITORY_KNOWLEDGE_RELEASE_MANIFEST_PATH) } };
+    }
     const installerWorkspaceId = scope.repositoryId;
     const config = { hqUrl: normalizeHqUrl(scope.hqUrl), organizationId: scope.organizationId,
         deviceId: trust.deviceId };
@@ -367,7 +377,7 @@ async function syncPublishedDemoSource(input, deps) {
     const snapshot = await inventoryRepositoryPackage({ workspace: input.workspace,
         organizationId: scope.organizationId, workspaceId: input.workspaceId,
         repositoryBindingId: scope.repositoryId, repositoryAgentId: scope.repositoryId,
-        sourceAuthorization: input.authorization });
+        sourceAuthorization: input.authorization, retainedKnowledge: input.retainedKnowledge });
     const fingerprint = snapshot.manifest.sourceFingerprint;
     if (!fingerprint)
         throw new Error('Demo source inventory has no fingerprint.');
@@ -569,16 +579,12 @@ export async function demoRepositoryPackage(input, deps = {}) {
             if (!policyCoversPrior(previous, sourceAuthorization)) {
                 throw new Error('Demo current source policy narrows the active release policy; suspend or replace the release before synchronization.');
             }
-            if (ownership !== 'signed')
-                return { ok: true,
-                    stage: 'demo_repository_package_policy_transition', repositoryId: scope.repositoryId,
-                    repositoryPackageState: 'published', candidate: null, ready: false,
-                    activationState: 'signed_delivery_pending' };
             const sourceSync = await syncPublishedDemoSource({ scope, workspace: input.workspace,
                 workspaceId: view.workspaceId, authorization: sourceAuthorization,
                 publishedSourceFingerprint: view.publishedSourceFingerprint,
                 activeReleaseId: view.activeReleaseId, candidateTransport, outboxRoot,
-                priorPolicyHash: previous.policyHash, publishedAuthorization: previous }, deps);
+                priorPolicyHash: previous.policyHash, publishedAuthorization: previous,
+                retainedKnowledge: ownership === 'signed' ? undefined : installed.retainedKnowledge }, deps);
             return { ok: true, stage: 'demo_repository_package_policy_transition',
                 repositoryId: scope.repositoryId, repositoryPackageState: 'published',
                 candidate: null, sourceSync, ready: false, activationState: 'candidate_pending' };