@emilia-protocol/gate 0.15.2 → 0.16.1

package/CHANGELOG.md

@@ -4,6 +4,46 @@
 All notable changes to `@emilia-protocol/gate` are documented here.
 This package follows [Semantic Versioning](https://semver.org/).
 
+## 0.16.1 (2026-07-26)
+
+### Fixed
+
+- PostgreSQL 17 role-graph checks now distinguish provider-managed
+  administrative grants from executable `INHERIT` or `SET` authority, while
+  continuing to reject every usable owner/executor or privileged-role path.
+- Forward migrations remove their own temporary owner grant without deleting
+  a managed provider's non-usable administrative grant.
+- The protected npm publisher uses an explicit local tarball file spec.
+
+## 0.16.0 (2026-07-25)
+
+### Added
+
+- `./consequence-actuator`, a short-lived signed execution-envelope boundary
+  for separately deployed credential-owning actuators, with immutable tenant,
+  action, CAID, provider account, target, operation, attempt, idempotency,
+  nonce, and expiry bindings.
+- A PostgreSQL RPC-only permanent envelope store with tenant-principal
+  isolation, forced RLS, no direct runtime or `service_role` table authority,
+  and no release path after provider invocation.
+- `./discovery-permit-resolver`, which retrieves pinned action-control
+  discovery without redirect, network-boundary, freshness, or source drift.
+- A split managed reference deployment where the decision service owns policy
+  and envelope signing while the actuator alone owns provider credentials and
+  signs exact execution observations.
+
+### Security
+
+- A provider timeout consumes the execution envelope as `INDETERMINATE`; blind
+  replay is refused and only authenticated, attempt-bound evidence may
+  reconcile the Proposal-to-Effect lifecycle.
+- Production actuator construction requires an atomic, durable,
+  ownership-fenced, permanently consuming store. Process-local storage is
+  available only through an explicit test-only opt-in.
+- The decision process has no provider credential or provider API
+  implementation. Signed actuator observations are verified under a pinned key
+  and exact execution tuple before use as lifecycle evidence.
+
 ## 0.15.2 (2026-07-23)
 
 ### Fixed

package/README.md

@@ -733,3 +733,20 @@ The mechanism is specified in `draft-schrock-ep-enforcement-point` (the Receipt-
 `draft-schrock-ep-authorization-receipts`. Earn the **RR-1** conformance level via
 `receiptRequiredConformance()` in `@emilia-protocol/require-receipt`. Reference implementation;
 experimental. Apache-2.0. Fails closed.
+
+## Authority allocation
+
+`@emilia-protocol/gate/authority-allocation` provides the same-team runtime
+counterpart for Conservation of Authority. A relying party installs one
+authoritative allocation snapshot pinned to an exact authority head and epoch.
+The validator refuses child action or audience widening, budget or expiry
+widening, duplicate sibling branches, and aggregate cents or calls overspend.
+Reservations are atomic, replay-fenced, and can be finalized only with the
+winning owner token, monotonic fencing token, and exact authority head and
+epoch.
+
+`createMemoryAuthorityAllocationStore()` is deterministic, non-durable
+conformance infrastructure. `createPostgresAuthorityAllocationStore()` and
+`AUTHORITY_ALLOCATION_DDL` define the durable transactional boundary; they are
+reference code and a database contract, not evidence that any deployment uses
+or correctly operates that boundary.

package/authority-allocation.js

@@ -0,0 +1,2 @@
+// SPDX-License-Identifier: Apache-2.0
+export * from './dist/authority-allocation.js';

package/consequence-actuator.js

@@ -0,0 +1,3 @@
+// SPDX-License-Identifier: Apache-2.0
+// Compatibility entry point for the TypeScript consequence actuator module.
+export * from './dist/consequence-actuator.js';

package/discovery-permit-resolver.js

@@ -0,0 +1,3 @@
+// SPDX-License-Identifier: Apache-2.0
+// Compatibility entry point for the TypeScript discovery permit resolver.
+export * from './dist/discovery-permit-resolver.js';

package/dist/authority-allocation.d.ts

@@ -0,0 +1,200 @@
+/**
+ * Runtime counterpart for Conservation of Authority.
+ *
+ * This module keeps path containment and aggregate sibling conservation
+ * separate. A relying party pins one complete parent allocation snapshot to an
+ * exact authority head and epoch. Every sibling is checked against that parent,
+ * both resource dimensions are summed independently, and reservations cross a
+ * single atomic store boundary before they can be committed.
+ *
+ * The memory store is deterministic conformance infrastructure, not durable
+ * custody. The PostgreSQL adapter requires a real transaction callback and
+ * serializes every mutation for one relying-party/parent pair.
+ */
+export declare const AUTHORITY_ALLOCATION_VERSION = "EP-AUTHORITY-ALLOCATION-v1";
+export declare const AUTHORITY_ALLOCATION_CURRENT_TABLE = "ep_authority_allocation_current";
+export declare const AUTHORITY_ALLOCATION_SNAPSHOT_TABLE = "ep_authority_allocation_snapshots";
+export declare const AUTHORITY_ALLOCATION_BRANCH_TABLE = "ep_authority_allocation_branches";
+export declare const AUTHORITY_ALLOCATION_RESERVATION_TABLE = "ep_authority_allocation_reservations";
+export interface AuthorityAllocationBudget {
+    cents: number;
+    calls: number;
+}
+export interface AuthorityAllocationPin {
+    relying_party_id: string;
+    authority_head: string;
+    authority_epoch: number;
+}
+export interface AuthorityBranchAllocation {
+    allocation_id: string;
+    parent_id: string;
+    actions: readonly string[];
+    audiences: readonly string[];
+    budget: AuthorityAllocationBudget;
+    expires_at: string;
+}
+export interface AuthorityAllocationSnapshot {
+    version: typeof AUTHORITY_ALLOCATION_VERSION;
+    relying_party_id: string;
+    parent_id: string;
+    authority_head: string;
+    authority_epoch: number;
+    actions: readonly string[];
+    audiences: readonly string[];
+    budget: AuthorityAllocationBudget;
+    expires_at: string;
+    sibling_allocations: readonly AuthorityBranchAllocation[];
+}
+export interface AuthorityAllocationReservationRequest {
+    relying_party_id: string;
+    parent_id: string;
+    allocation_id: string;
+    reservation_id: string;
+    authority_head: string;
+    authority_epoch: number;
+    budget: AuthorityAllocationBudget;
+    /** Used by the deterministic memory adapter. PostgreSQL uses database time. */
+    now?: string | number | Date;
+}
+export interface AuthorityAllocationOwner {
+    owner_token: string;
+    fencing_token: number;
+    authority_head: string;
+    authority_epoch: number;
+}
+export interface AuthorityAllocationFinalizeRequest {
+    relying_party_id: string;
+    parent_id: string;
+    allocation_id: string;
+    reservation_id: string;
+    authority_head: string;
+    authority_epoch: number;
+    owner_token: string;
+    fencing_token: number;
+}
+export type AuthorityAllocationRefusalReason = 'allocation_not_found' | 'allocation_expired' | 'authority_pin_mismatch' | 'budget_exceeded' | 'reservation_replayed' | 'reservation_not_found' | 'reservation_owner_mismatch' | 'reservation_already_committed' | 'reservation_already_released' | 'snapshot_conflict' | 'stale_authority_epoch' | 'reservations_in_flight';
+export type AuthorityAllocationInstallResult = {
+    ok: true;
+    installed: boolean;
+    snapshot_fingerprint: string;
+} | {
+    ok: false;
+    reason: AuthorityAllocationRefusalReason;
+};
+export type AuthorityAllocationReservationResult = {
+    ok: true;
+    reservation_id: string;
+    allocation_id: string;
+    budget: AuthorityAllocationBudget;
+    remaining: AuthorityAllocationBudget;
+    owner: AuthorityAllocationOwner;
+} | {
+    ok: false;
+    reason: AuthorityAllocationRefusalReason;
+};
+export type AuthorityAllocationFinalizeResult = {
+    ok: true;
+    state: 'committed' | 'released';
+} | {
+    ok: false;
+    reason: AuthorityAllocationRefusalReason;
+};
+export interface AuthorityAllocationReservationView {
+    reservation_id: string;
+    allocation_id: string;
+    authority_head: string;
+    authority_epoch: number;
+    budget: AuthorityAllocationBudget;
+    state: 'reserved' | 'committed' | 'released';
+    fencing_token: number;
+}
+export interface AuthorityAllocationStateView {
+    snapshot: AuthorityAllocationSnapshot;
+    snapshot_fingerprint: string;
+    usage: {
+        parent: {
+            reserved: AuthorityAllocationBudget;
+            committed: AuthorityAllocationBudget;
+        };
+        branches: Record<string, {
+            reserved: AuthorityAllocationBudget;
+            committed: AuthorityAllocationBudget;
+        }>;
+    };
+    reservations: AuthorityAllocationReservationView[];
+}
+export interface AuthorityAllocationStore {
+    readonly durable: boolean;
+    installSnapshot(snapshot: AuthorityAllocationSnapshot, pin: AuthorityAllocationPin): Promise<AuthorityAllocationInstallResult>;
+    reserve(request: AuthorityAllocationReservationRequest): Promise<AuthorityAllocationReservationResult>;
+    commit(request: AuthorityAllocationFinalizeRequest): Promise<AuthorityAllocationFinalizeResult>;
+    release(request: AuthorityAllocationFinalizeRequest): Promise<AuthorityAllocationFinalizeResult>;
+    inspect(pin: AuthorityAllocationPin & {
+        parent_id: string;
+    }): Promise<AuthorityAllocationStateView | null>;
+}
+export declare class AuthorityAllocationValidationError extends TypeError {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+type QueryRow = Record<string, unknown>;
+export interface AuthorityAllocationPostgresQueryResult {
+    rowCount: number | null;
+    rows: QueryRow[];
+}
+export type AuthorityAllocationPostgresQuery = (text: string, params?: readonly unknown[]) => Promise<AuthorityAllocationPostgresQueryResult>;
+export interface AuthorityAllocationPostgresOptions {
+    /**
+     * Must run the callback in one PostgreSQL transaction. Database errors must
+     * reject the callback so the transaction is rolled back.
+     */
+    transaction<T>(callback: (query: AuthorityAllocationPostgresQuery) => Promise<T>): Promise<T>;
+}
+/**
+ * Validate and normalize a complete authoritative allocation snapshot.
+ * Throws AuthorityAllocationValidationError on every malformed or widening
+ * condition and returns a detached, deterministically ordered snapshot.
+ */
+export declare function validateAuthorityAllocationSnapshot(input: AuthorityAllocationSnapshot, pin: AuthorityAllocationPin): AuthorityAllocationSnapshot;
+/**
+ * Deterministic linearizable in-memory implementation for conformance tests.
+ * Owner capabilities and fences are deterministic and therefore unsuitable
+ * for production. The store is explicitly marked non-durable.
+ */
+export declare function createMemoryAuthorityAllocationStore(): AuthorityAllocationStore;
+/**
+ * PostgreSQL schema contract. Historical snapshots are append-only;
+ * ep_authority_allocation_current identifies the one exact head+epoch that can
+ * accept reservations. Reservation IDs are replay-fenced across all epochs for
+ * one relying-party/parent pair, and owner capabilities are stored only as
+ * domain-separated SHA-256 digests.
+ */
+export declare const AUTHORITY_ALLOCATION_DDL = "CREATE TABLE IF NOT EXISTS ep_authority_allocation_snapshots (\n  relying_party_id    TEXT NOT NULL CHECK (octet_length(relying_party_id) BETWEEN 1 AND 512),\n  parent_id           TEXT NOT NULL CHECK (octet_length(parent_id) BETWEEN 1 AND 512),\n  authority_head      TEXT NOT NULL CHECK (authority_head ~ '^sha256:[0-9a-f]{64}$'),\n  authority_epoch     BIGINT NOT NULL CHECK (authority_epoch >= 0),\n  snapshot_fingerprint TEXT NOT NULL CHECK (snapshot_fingerprint ~ '^sha256:[0-9a-f]{64}$'),\n  snapshot_json       JSONB NOT NULL CHECK (jsonb_typeof(snapshot_json) = 'object'),\n  installed_at        TIMESTAMPTZ NOT NULL DEFAULT transaction_timestamp(),\n  PRIMARY KEY (relying_party_id, parent_id, authority_head, authority_epoch)\n);\nCREATE TABLE IF NOT EXISTS ep_authority_allocation_current (\n  relying_party_id    TEXT NOT NULL,\n  parent_id           TEXT NOT NULL,\n  authority_head      TEXT NOT NULL,\n  authority_epoch     BIGINT NOT NULL,\n  snapshot_fingerprint TEXT NOT NULL,\n  next_fencing_token  BIGINT NOT NULL DEFAULT 1 CHECK (next_fencing_token > 0),\n  PRIMARY KEY (relying_party_id, parent_id),\n  FOREIGN KEY (relying_party_id, parent_id, authority_head, authority_epoch)\n    REFERENCES ep_authority_allocation_snapshots\n      (relying_party_id, parent_id, authority_head, authority_epoch)\n);\nCREATE TABLE IF NOT EXISTS ep_authority_allocation_branches (\n  relying_party_id TEXT NOT NULL,\n  parent_id        TEXT NOT NULL,\n  authority_head   TEXT NOT NULL,\n  authority_epoch  BIGINT NOT NULL,\n  allocation_id    TEXT NOT NULL CHECK (octet_length(allocation_id) BETWEEN 1 AND 512),\n  budget_cents     BIGINT NOT NULL CHECK (budget_cents >= 0),\n  budget_calls     BIGINT NOT NULL CHECK (budget_calls >= 0),\n  expires_at       TIMESTAMPTZ NOT NULL,\n  PRIMARY KEY (relying_party_id, parent_id, authority_head, authority_epoch, allocation_id),\n  FOREIGN KEY (relying_party_id, parent_id, authority_head, authority_epoch)\n    REFERENCES ep_authority_allocation_snapshots\n      (relying_party_id, parent_id, authority_head, authority_epoch)\n);\nCREATE TABLE IF NOT EXISTS ep_authority_allocation_reservations (\n  relying_party_id TEXT NOT NULL,\n  parent_id        TEXT NOT NULL,\n  authority_head   TEXT NOT NULL,\n  authority_epoch  BIGINT NOT NULL,\n  allocation_id    TEXT NOT NULL,\n  reservation_id   TEXT NOT NULL CHECK (octet_length(reservation_id) BETWEEN 1 AND 512),\n  budget_cents     BIGINT NOT NULL CHECK (budget_cents >= 0),\n  budget_calls     BIGINT NOT NULL CHECK (budget_calls >= 0),\n  state            TEXT NOT NULL CHECK (state IN ('reserved', 'committed', 'released')),\n  owner_digest     TEXT NOT NULL CHECK (owner_digest ~ '^sha256:[0-9a-f]{64}$'),\n  fencing_token    BIGINT NOT NULL CHECK (fencing_token > 0),\n  reserved_at      TIMESTAMPTZ NOT NULL DEFAULT transaction_timestamp(),\n  finalized_at     TIMESTAMPTZ NULL,\n  PRIMARY KEY (relying_party_id, parent_id, reservation_id),\n  UNIQUE (relying_party_id, parent_id, fencing_token),\n  FOREIGN KEY (relying_party_id, parent_id, authority_head, authority_epoch, allocation_id)\n    REFERENCES ep_authority_allocation_branches\n      (relying_party_id, parent_id, authority_head, authority_epoch, allocation_id),\n  CHECK (\n    (state = 'reserved' AND finalized_at IS NULL)\n    OR (state IN ('committed', 'released') AND finalized_at IS NOT NULL)\n  )\n);\nREVOKE ALL ON ep_authority_allocation_snapshots FROM PUBLIC;\nREVOKE ALL ON ep_authority_allocation_current FROM PUBLIC;\nREVOKE ALL ON ep_authority_allocation_branches FROM PUBLIC;\nREVOKE ALL ON ep_authority_allocation_reservations FROM PUBLIC;";
+/** Exact statements used by createPostgresAuthorityAllocationStore(). */
+export declare const AUTHORITY_ALLOCATION_SQL: Readonly<{
+    lockParent: "SELECT pg_advisory_xact_lock(pg_catalog.hashtextextended(pg_catalog.jsonb_build_array($1::text, $2::text)::text, 0))";
+    readCurrent: "SELECT authority_head, authority_epoch, snapshot_fingerprint, next_fencing_token, clock_timestamp() AS database_now FROM ep_authority_allocation_current WHERE relying_party_id = $1 AND parent_id = $2 FOR UPDATE";
+    activeReservations: "SELECT count(*)::bigint AS active FROM ep_authority_allocation_reservations WHERE relying_party_id = $1 AND parent_id = $2 AND state = 'reserved'";
+    insertSnapshot: "INSERT INTO ep_authority_allocation_snapshots (relying_party_id, parent_id, authority_head, authority_epoch, snapshot_fingerprint, snapshot_json) VALUES ($1, $2, $3, $4, $5, $6::jsonb)";
+    insertBranch: "INSERT INTO ep_authority_allocation_branches (relying_party_id, parent_id, authority_head, authority_epoch, allocation_id, budget_cents, budget_calls, expires_at) VALUES ($1, $2, $3, $4, $5, $6, $7, $8::timestamptz)";
+    insertCurrent: "INSERT INTO ep_authority_allocation_current (relying_party_id, parent_id, authority_head, authority_epoch, snapshot_fingerprint) VALUES ($1, $2, $3, $4, $5)";
+    advanceCurrent: "UPDATE ep_authority_allocation_current SET authority_head = $3, authority_epoch = $4, snapshot_fingerprint = $5 WHERE relying_party_id = $1 AND parent_id = $2 AND authority_epoch < $4";
+    readSnapshot: "SELECT snapshot_json, snapshot_fingerprint FROM ep_authority_allocation_snapshots WHERE relying_party_id = $1 AND parent_id = $2 AND authority_head = $3 AND authority_epoch = $4";
+    readBranch: "SELECT budget_cents, budget_calls, expires_at FROM ep_authority_allocation_branches WHERE relying_party_id = $1 AND parent_id = $2 AND authority_head = $3 AND authority_epoch = $4 AND allocation_id = $5";
+    readReservation: "SELECT allocation_id, authority_head, authority_epoch, budget_cents, budget_calls, state, owner_digest, fencing_token FROM ep_authority_allocation_reservations WHERE relying_party_id = $1 AND parent_id = $2 AND reservation_id = $3";
+    readUsage: "SELECT allocation_id, state, COALESCE(sum(budget_cents), 0)::bigint AS cents, COALESCE(sum(budget_calls), 0)::bigint AS calls FROM ep_authority_allocation_reservations WHERE relying_party_id = $1 AND parent_id = $2 AND authority_head = $3 AND authority_epoch = $4 AND state IN ('reserved', 'committed') GROUP BY allocation_id, state";
+    nextFence: "UPDATE ep_authority_allocation_current SET next_fencing_token = next_fencing_token + 1 WHERE relying_party_id = $1 AND parent_id = $2 AND authority_head = $3 AND authority_epoch = $4 RETURNING next_fencing_token - 1 AS fencing_token";
+    insertReservation: "INSERT INTO ep_authority_allocation_reservations (relying_party_id, parent_id, authority_head, authority_epoch, allocation_id, reservation_id, budget_cents, budget_calls, state, owner_digest, fencing_token) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, 'reserved', $9, $10)";
+    commitReservation: "UPDATE ep_authority_allocation_reservations SET state = 'committed', finalized_at = transaction_timestamp() WHERE relying_party_id = $1 AND parent_id = $2 AND reservation_id = $3 AND allocation_id = $4 AND authority_head = $5 AND authority_epoch = $6 AND state = 'reserved' AND owner_digest = $7 AND fencing_token = $8";
+    releaseReservation: "UPDATE ep_authority_allocation_reservations SET state = 'released', finalized_at = transaction_timestamp() WHERE relying_party_id = $1 AND parent_id = $2 AND reservation_id = $3 AND allocation_id = $4 AND authority_head = $5 AND authority_epoch = $6 AND state = 'reserved' AND owner_digest = $7 AND fencing_token = $8";
+    inspectReservations: "SELECT reservation_id, allocation_id, authority_head, authority_epoch, budget_cents, budget_calls, state, fencing_token FROM ep_authority_allocation_reservations WHERE relying_party_id = $1 AND parent_id = $2 ORDER BY fencing_token";
+}>;
+/**
+ * Durable adapter boundary for PostgreSQL. Atomicity depends on the supplied
+ * transaction callback actually using one PostgreSQL transaction; the adapter
+ * additionally takes a transaction-scoped advisory lock for every parent.
+ */
+export declare function createPostgresAuthorityAllocationStore(options: AuthorityAllocationPostgresOptions): AuthorityAllocationStore;
+export declare function isDurableAuthorityAllocationStore(store: unknown): store is AuthorityAllocationStore;
+export {};
+//# sourceMappingURL=authority-allocation.d.ts.map

package/dist/authority-allocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority-allocation.d.ts","sourceRoot":"","sources":["../src/authority-allocation.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;GAYG;AAIH,eAAO,MAAM,4BAA4B,+BAA+B,CAAC;AACzE,eAAO,MAAM,kCAAkC,oCAAoC,CAAC;AACpF,eAAO,MAAM,mCAAmC,sCAAsC,CAAC;AACvF,eAAO,MAAM,iCAAiC,qCAAqC,CAAC;AACpF,eAAO,MAAM,sCAAsC,yCAAyC,CAAC;AAS7F,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,sBAAsB;IACrC,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,MAAM,EAAE,yBAAyB,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,OAAO,4BAA4B,CAAC;IAC7C,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,MAAM,EAAE,yBAAyB,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,SAAS,yBAAyB,EAAE,CAAC;CAC3D;AAED,MAAM,WAAW,qCAAqC;IACpD,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,yBAAyB,CAAC;IAClC,+EAA+E;IAC/E,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,kCAAkC;IACjD,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,gCAAgC,GACxC,sBAAsB,GACtB,oBAAoB,GACpB,wBAAwB,GACxB,iBAAiB,GACjB,sBAAsB,GACtB,uBAAuB,GACvB,4BAA4B,GAC5B,+BAA+B,GAC/B,8BAA8B,GAC9B,mBAAmB,GACnB,uBAAuB,GACvB,wBAAwB,CAAC;AAE7B,MAAM,MAAM,gCAAgC,GACxC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,oBAAoB,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,gCAAgC,CAAA;CAAE,CAAC;AAE5D,MAAM,MAAM,oCAAoC,GAC5C;IACA,EAAE,EAAE,IAAI,CAAC;IACT,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,yBAAyB,CAAC;IAClC,SAAS,EAAE,yBAAyB,CAAC;IACrC,KAAK,EAAE,wBAAwB,CAAC;CACjC,GACC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,gCAAgC,CAAA;CAAE,CAAC;AAE5D,MAAM,MAAM,iCAAiC,GACzC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,WAAW,GAAG,UAAU,CAAA;CAAE,GAC7C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,gCAAgC,CAAA;CAAE,CAAC;AAE5D,MAAM,WAAW,kCAAkC;IACjD,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,yBAAyB,CAAC;IAClC,KAAK,EAAE,UAAU,GAAG,WAAW,GAAG,UAAU,CAAC;IAC7C,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,2BAA2B,CAAC;IACtC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,KAAK,EAAE;QACL,MAAM,EAAE;YACN,QAAQ,EAAE,yBAAyB,CAAC;YACpC,SAAS,EAAE,yBAAyB,CAAC;SACtC,CAAC;QACF,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE;YACvB,QAAQ,EAAE,yBAAyB,CAAC;YACpC,SAAS,EAAE,yBAAyB,CAAC;SACtC,CAAC,CAAC;KACJ,CAAC;IACF,YAAY,EAAE,kCAAkC,EAAE,CAAC;CACpD;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,eAAe,CACb,QAAQ,EAAE,2BAA2B,EACrC,GAAG,EAAE,sBAAsB,GAC1B,OAAO,CAAC,gCAAgC,CAAC,CAAC;IAC7C,OAAO,CACL,OAAO,EAAE,qCAAqC,GAC7C,OAAO,CAAC,oCAAoC,CAAC,CAAC;IACjD,MAAM,CACJ,OAAO,EAAE,kCAAkC,GAC1C,OAAO,CAAC,iCAAiC,CAAC,CAAC;IAC9C,OAAO,CACL,OAAO,EAAE,kCAAkC,GAC1C,OAAO,CAAC,iCAAiC,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,EAAE,sBAAsB,GAAG;QACpC,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC,CAAC;CAClD;AAED,qBAAa,kCAAmC,SAAQ,SAAS;IAC/D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEV,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK1C;AAaD,KAAK,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAExC,MAAM,WAAW,sCAAsC;IACrD,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,EAAE,QAAQ,EAAE,CAAC;CAClB;AAED,MAAM,MAAM,gCAAgC,GAAG,CAC7C,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,KACxB,OAAO,CAAC,sCAAsC,CAAC,CAAC;AAErD,MAAM,WAAW,kCAAkC;IACjD;;;OAGG;IACH,WAAW,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,gCAAgC,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC/F;AAsLD;;;;GAIG;AACH,wBAAgB,mCAAmC,CACjD,KAAK,EAAE,2BAA2B,EAClC,GAAG,EAAE,sBAAsB,GAC1B,2BAA2B,CA6E7B;AAuFD;;;;GAIG;AACH,wBAAgB,oCAAoC,IAAI,wBAAwB,CA8K/E;AAED;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,ijHA+DgC,CAAC;AAEtE,yEAAyE;AACzE,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;EAiCnC,CAAC;AA8FH;;;;GAIG;AACH,wBAAgB,sCAAsC,CACpD,OAAO,EAAE,kCAAkC,GAC1C,wBAAwB,CA6S1B;AAED,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,wBAAwB,CASnC"}