@harrylabsj/kiwi 0.6.0

package/dist/handoff/package.d.ts

@@ -0,0 +1,102 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Kiwi v0.7.0 Transaction Handoff — HandoffPackage（WP1 交接工件）。
+ *
+ * HandoffPackage 是把一个 KNP/1.0 `AcceptedNonbindingAgreement`（基线 §15/§16）
+ * 交给外部交易系统（UCP Checkout / AP2）前的安全交接工件。它携带协商达成所需的
+ * 全部商业事实，并做一次独立的内容寻址校验：
+ *
+ *   terms_digest = RFC 8785 JCS + SHA-256 重算（src/negotiation/jcs.ts）
+ *                  MUST 等于 agreement 携带的 terms_digest
+ *   重算不一致 → 构造 fail-closed（HandoffError code=terms_digest_mismatch）
+ *
+ * 明确语义（基线 §3.4 / §15 / §16）：HandoffPackage 不是订单、不含支付授权、
+ * 不代表库存预留。它只是「非绑定共识 → 交易系统」的交接载体；订单/支付/预留等
+ * 副作用必须发生在外部交易系统，且没有用户显式授权绝不 complete 任何 checkout。
+ */
+import { KNP_PROTOCOL_VERSION } from "../negotiation/domain/common.js";
+import type { TermSet } from "../negotiation/domain/common.js";
+import type { AcceptedNonbindingAgreement } from "../negotiation/domain/objects.js";
+/** WP1 交接工件版本。能力版本（capability_version）与它正交。 */
+export declare const HANDOFF_PACKAGE_VERSION: "1.0";
+/** 双侧身份快照：agreement 只表达 buyer|merchant 角色，身份字符串由构造方提供。 */
+export interface HandoffIdentitySnapshot {
+    buyer_identity: string;
+    merchant_identity: string;
+}
+/**
+ * HandoffPackage 承载字段。
+ *
+ * - agreed_terms：完整 TermSet（结构校验过，非引用）；terms_digest 是对它的
+ *   内容寻址，两者必须一致。
+ * - semantics：显式复述 KNP/1.0 无副作用约束 —— 交易系统必须把它当「交接工件」
+ *   而非订单/支付指令。
+ */
+export interface HandoffPackage {
+    type: "handoff_package";
+    package_version: typeof HANDOFF_PACKAGE_VERSION;
+    agreement_id: string;
+    negotiation_id: string;
+    accepted_offer_id: string;
+    agreed_terms: TermSet;
+    /** contentDigest(agreed_terms)，必须等于 agreement.terms_digest。 */
+    terms_digest: string;
+    identity: HandoffIdentitySnapshot;
+    /** 交易侧能力版本（如 UCP checkout capability 版本），opaque 字符串。 */
+    capability_version: string;
+    protocol_version: typeof KNP_PROTOCOL_VERSION;
+    /** 交接工件创建时间（可注入时钟），RFC 3339。 */
+    created_at: string;
+    semantics: {
+        /** 交接工件不是订单（基线 §15：creates_order=false）。 */
+        creates_order: false;
+        /** 交接工件不含支付授权（authorizes_payment=false）。 */
+        authorizes_payment: false;
+        /** 交接工件不代表库存预留（reserves_inventory=false）。 */
+        reserves_inventory: false;
+    };
+}
+export interface HandoffPackageInput {
+    agreement: AcceptedNonbindingAgreement;
+    identity: HandoffIdentitySnapshot;
+    /** 交易侧能力版本，如 `ucp.checkout/1`。 */
+    capability_version: string;
+    /** 覆盖 KNP protocol_version（缺省 1.0）。 */
+    protocol_version?: string;
+    /** 可注入时钟（RFC 3339）；缺省 new Date().toISOString()。 */
+    created_at?: string;
+}
+/**
+ * 从 AcceptedNonbindingAgreement 构造 HandoffPackage。
+ *
+ * 构造即校验（fail-closed）：
+ *   1. agreement 结构字段逐一校验；
+ *   2. 副作用 flag 必须为 false（KNP/1.0 §16，防御性复核）；
+ *   3. 用 agreed_terms 重算 JCS+SHA-256 digest，必须等于 agreement.terms_digest，
+ *      否则抛 HandoffError(terms_digest_mismatch)。
+ *
+ * 返回值是独立拷贝 —— agreed_terms 经 validateTermSet 归一化，调用方后续改动
+ * agreement 不会污染 package。
+ */
+export declare function createHandoffPackage(input: HandoffPackageInput): HandoffPackage;
+/** 从已构造的 package 重算 terms_digest 并比对；false 表示工件被篡改。 */
+export declare function verifyHandoffPackageDigest(pkg: HandoffPackage): boolean;
+/**
+ * 基础结构守卫：从不可信输入解析 HandoffPackage 前的形状检查（对齐 ledger 的
+ * isLedgerEvent 做法）。内容一致性由 verifyHandoffPackageDigest 单独校验。
+ */
+export declare function isHandoffPackage(value: unknown): value is HandoffPackage;

package/dist/handoff/package.js

@@ -0,0 +1,132 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Kiwi v0.7.0 Transaction Handoff — HandoffPackage（WP1 交接工件）。
+ *
+ * HandoffPackage 是把一个 KNP/1.0 `AcceptedNonbindingAgreement`（基线 §15/§16）
+ * 交给外部交易系统（UCP Checkout / AP2）前的安全交接工件。它携带协商达成所需的
+ * 全部商业事实，并做一次独立的内容寻址校验：
+ *
+ *   terms_digest = RFC 8785 JCS + SHA-256 重算（src/negotiation/jcs.ts）
+ *                  MUST 等于 agreement 携带的 terms_digest
+ *   重算不一致 → 构造 fail-closed（HandoffError code=terms_digest_mismatch）
+ *
+ * 明确语义（基线 §3.4 / §15 / §16）：HandoffPackage 不是订单、不含支付授权、
+ * 不代表库存预留。它只是「非绑定共识 → 交易系统」的交接载体；订单/支付/预留等
+ * 副作用必须发生在外部交易系统，且没有用户显式授权绝不 complete 任何 checkout。
+ */
+import { KNP_PROTOCOL_VERSION, requireNonEmptyString, requireObject, requireDigest, requireIsoTimestamp, validateTermSet, } from "../negotiation/domain/common.js";
+import { validateIdentifier } from "../negotiation/domain/identifiers.js";
+import { contentDigest } from "../negotiation/jcs.js";
+import { HandoffError } from "./errors.js";
+/** WP1 交接工件版本。能力版本（capability_version）与它正交。 */
+export const HANDOFF_PACKAGE_VERSION = "1.0";
+function validateIdentitySnapshot(value) {
+    const obj = requireObject(value, "identity");
+    return {
+        buyer_identity: validateIdentifier(obj.buyer_identity, "identity/buyer_identity"),
+        merchant_identity: validateIdentifier(obj.merchant_identity, "identity/merchant_identity"),
+    };
+}
+/**
+ * 从 AcceptedNonbindingAgreement 构造 HandoffPackage。
+ *
+ * 构造即校验（fail-closed）：
+ *   1. agreement 结构字段逐一校验；
+ *   2. 副作用 flag 必须为 false（KNP/1.0 §16，防御性复核）；
+ *   3. 用 agreed_terms 重算 JCS+SHA-256 digest，必须等于 agreement.terms_digest，
+ *      否则抛 HandoffError(terms_digest_mismatch)。
+ *
+ * 返回值是独立拷贝 —— agreed_terms 经 validateTermSet 归一化，调用方后续改动
+ * agreement 不会污染 package。
+ */
+export function createHandoffPackage(input) {
+    const agreement = input.agreement;
+    const agreementId = validateIdentifier(agreement.agreement_id, "agreement.agreement_id");
+    const negotiationId = validateIdentifier(agreement.negotiation_id, "agreement.negotiation_id");
+    const acceptedOfferId = validateIdentifier(agreement.accepted_offer_id, "agreement.accepted_offer_id");
+    const agreedTerms = validateTermSet(agreement.agreed_terms, "agreement.agreed_terms");
+    const agreementDigest = requireDigest(agreement.terms_digest, "agreement.terms_digest");
+    // KNP/1.0 §16：Agreement 不得带任何交易副作用（防御性复核，防类型绕过）。
+    if (agreement.creates_order !== false ||
+        agreement.reserves_inventory !== false ||
+        agreement.authorizes_payment !== false) {
+        throw new HandoffError("invalid_agreement", "agreement MUST carry creates_order=false / reserves_inventory=false / authorizes_payment=false (KNP/1.0 §16)");
+    }
+    const identity = validateIdentitySnapshot(input.identity);
+    const capabilityVersion = requireNonEmptyString(input.capability_version, "capability_version");
+    const protocolVersion = input.protocol_version ?? KNP_PROTOCOL_VERSION;
+    if (protocolVersion !== KNP_PROTOCOL_VERSION) {
+        throw new HandoffError("invalid_input", `unsupported protocol_version ${protocolVersion}; handoff binds to ${KNP_PROTOCOL_VERSION}`, "protocol_version");
+    }
+    const createdAt = input.created_at ?? new Date().toISOString();
+    requireIsoTimestamp(createdAt, "created_at");
+    // 重算 digest：contentDigest 走 RFC 8785 JCS + SHA-256（与 agreement 同源）。
+    const recomputed = contentDigest(agreedTerms);
+    if (recomputed !== agreementDigest) {
+        throw new HandoffError("terms_digest_mismatch", `agreed_terms digest mismatch: recomputed ${recomputed}, agreement carries ${agreementDigest}`, "terms_digest");
+    }
+    return {
+        type: "handoff_package",
+        package_version: HANDOFF_PACKAGE_VERSION,
+        agreement_id: agreementId,
+        negotiation_id: negotiationId,
+        accepted_offer_id: acceptedOfferId,
+        agreed_terms: agreedTerms,
+        terms_digest: recomputed,
+        identity,
+        capability_version: capabilityVersion,
+        protocol_version: KNP_PROTOCOL_VERSION,
+        created_at: createdAt,
+        semantics: {
+            creates_order: false,
+            authorizes_payment: false,
+            reserves_inventory: false,
+        },
+    };
+}
+/** 从已构造的 package 重算 terms_digest 并比对；false 表示工件被篡改。 */
+export function verifyHandoffPackageDigest(pkg) {
+    if (pkg.type !== "handoff_package" || pkg.package_version !== HANDOFF_PACKAGE_VERSION) {
+        return false;
+    }
+    return contentDigest(pkg.agreed_terms) === pkg.terms_digest;
+}
+/**
+ * 基础结构守卫：从不可信输入解析 HandoffPackage 前的形状检查（对齐 ledger 的
+ * isLedgerEvent 做法）。内容一致性由 verifyHandoffPackageDigest 单独校验。
+ */
+export function isHandoffPackage(value) {
+    if (value === null || typeof value !== "object")
+        return false;
+    const obj = value;
+    const semantics = obj.semantics;
+    return (obj.type === "handoff_package" &&
+        obj.package_version === HANDOFF_PACKAGE_VERSION &&
+        typeof obj.agreement_id === "string" &&
+        typeof obj.negotiation_id === "string" &&
+        typeof obj.terms_digest === "string" &&
+        typeof obj.capability_version === "string" &&
+        typeof obj.created_at === "string" &&
+        obj.identity !== null &&
+        typeof obj.identity === "object" &&
+        semantics !== null &&
+        typeof semantics === "object" &&
+        semantics.creates_order === false &&
+        semantics.authorizes_payment === false &&
+        semantics.reserves_inventory === false);
+}
+//# sourceMappingURL=package.js.map

package/dist/handoff/package.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package.js","sourceRoot":"","sources":["../../src/handoff/package.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,aAAa,EACb,aAAa,EACb,mBAAmB,EACnB,eAAe,GAChB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAE1E,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,+CAA+C;AAC/C,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAc,CAAC;AAoDtD,SAAS,wBAAwB,CAAC,KAAc;IAC9C,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC7C,OAAO;QACL,cAAc,EAAE,kBAAkB,CAAC,GAAG,CAAC,cAAc,EAAE,yBAAyB,CAAC;QACjF,iBAAiB,EAAE,kBAAkB,CAAC,GAAG,CAAC,iBAAiB,EAAE,4BAA4B,CAAC;KAC3F,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAA0B;IAC7D,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IAClC,MAAM,WAAW,GAAG,kBAAkB,CAAC,SAAS,CAAC,YAAY,EAAE,wBAAwB,CAAC,CAAC;IACzF,MAAM,aAAa,GAAG,kBAAkB,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;IAC/F,MAAM,eAAe,GAAG,kBAAkB,CACxC,SAAS,CAAC,iBAAiB,EAC3B,6BAA6B,CAC9B,CAAC;IACF,MAAM,WAAW,GAAG,eAAe,CAAC,SAAS,CAAC,YAAY,EAAE,wBAAwB,CAAC,CAAC;IACtF,MAAM,eAAe,GAAG,aAAa,CAAC,SAAS,CAAC,YAAY,EAAE,wBAAwB,CAAC,CAAC;IAExF,iDAAiD;IACjD,IACE,SAAS,CAAC,aAAa,KAAK,KAAK;QACjC,SAAS,CAAC,kBAAkB,KAAK,KAAK;QACtC,SAAS,CAAC,kBAAkB,KAAK,KAAK,EACtC,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,mBAAmB,EACnB,8GAA8G,CAC/G,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,wBAAwB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC1D,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,KAAK,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,CAAC;IAChG,MAAM,eAAe,GAAG,KAAK,CAAC,gBAAgB,IAAI,oBAAoB,CAAC;IACvE,IAAI,eAAe,KAAK,oBAAoB,EAAE,CAAC;QAC7C,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,gCAAgC,eAAe,sBAAsB,oBAAoB,EAAE,EAC3F,kBAAkB,CACnB,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/D,mBAAmB,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAE7C,oEAAoE;IACpE,MAAM,UAAU,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;IAC9C,IAAI,UAAU,KAAK,eAAe,EAAE,CAAC;QACnC,MAAM,IAAI,YAAY,CACpB,uBAAuB,EACvB,4CAA4C,UAAU,uBAAuB,eAAe,EAAE,EAC9F,cAAc,CACf,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,eAAe,EAAE,uBAAuB;QACxC,YAAY,EAAE,WAAW;QACzB,cAAc,EAAE,aAAa;QAC7B,iBAAiB,EAAE,eAAe;QAClC,YAAY,EAAE,WAAW;QACzB,YAAY,EAAE,UAAU;QACxB,QAAQ;QACR,kBAAkB,EAAE,iBAAiB;QACrC,gBAAgB,EAAE,oBAAoB;QACtC,UAAU,EAAE,SAAS;QACrB,SAAS,EAAE;YACT,aAAa,EAAE,KAAK;YACpB,kBAAkB,EAAE,KAAK;YACzB,kBAAkB,EAAE,KAAK;SAC1B;KACF,CAAC;AACJ,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,0BAA0B,CAAC,GAAmB;IAC5D,IAAI,GAAG,CAAC,IAAI,KAAK,iBAAiB,IAAI,GAAG,CAAC,eAAe,KAAK,uBAAuB,EAAE,CAAC;QACtF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,GAAG,CAAC,YAAY,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,SAAS,GAAG,GAAG,CAAC,SAAgD,CAAC;IACvE,OAAO,CACL,GAAG,CAAC,IAAI,KAAK,iBAAiB;QAC9B,GAAG,CAAC,eAAe,KAAK,uBAAuB;QAC/C,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ;QACpC,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ;QACtC,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ;QACpC,OAAO,GAAG,CAAC,kBAAkB,KAAK,QAAQ;QAC1C,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ;QAClC,GAAG,CAAC,QAAQ,KAAK,IAAI;QACrB,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAChC,SAAS,KAAK,IAAI;QAClB,OAAO,SAAS,KAAK,QAAQ;QAC7B,SAAS,CAAC,aAAa,KAAK,KAAK;QACjC,SAAS,CAAC,kBAAkB,KAAK,KAAK;QACtC,SAAS,CAAC,kBAAkB,KAAK,KAAK,CACvC,CAAC;AACJ,CAAC"}

package/dist/handoff/transaction.d.ts

@@ -0,0 +1,96 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { LedgerCapabilitySnapshot, LedgerIdentitySnapshot } from "../negotiation/ledger/event.js";
+import type { HandoffCandidate, HandoffDisplaySummary } from "./candidate.js";
+import type { HandoffEventStore } from "./ledger.js";
+import type { HandoffIdempotencyStore } from "./idempotency.js";
+import { type SafeDestinationUrl } from "./url-safety.js";
+import { type DestinationType } from "./destination.js";
+/** TransactionHandoff（KTH rev0.3 §6）。不可变；digest 覆盖全部内容。 */
+export interface TransactionHandoff {
+    readonly handoff_id: string;
+    readonly source_candidate_id: string;
+    readonly source_candidate_digest: string;
+    readonly agreement_id: string;
+    readonly negotiation_id: string;
+    readonly terms_digest: string;
+    readonly merchant_identity_ref: string;
+    readonly destination_type: DestinationType;
+    readonly destination_ref: string;
+    readonly display_summary: HandoffDisplaySummary;
+    readonly created_at: string;
+    readonly expires_at: string;
+    readonly requires_user_action: boolean;
+    readonly creates_order: false;
+    readonly authorizes_payment: false;
+    readonly reserves_inventory: false;
+    readonly handoff_digest: string;
+}
+/** 执行结果（判别联合；调用方不得把 stale/rejected 当成功）。 */
+export type ExecuteHandoffResult = {
+    kind: "delivered";
+    handoff: TransactionHandoff;
+    final_url?: string;
+} | {
+    kind: "already_delivered";
+    handoff_id: string;
+} | {
+    kind: "stale";
+    reason: string;
+}
+/** 目的地探测瞬时失败（超时/网络/HEAD 405）：候选保持 READY，可重试。 */
+ | {
+    kind: "probe_failed";
+    reason: string;
+} | {
+    kind: "rejected";
+    reason: string;
+} | {
+    kind: "expired";
+    reason: string;
+};
+export interface AgreementReadResult {
+    agreement_id: string;
+    negotiation_id: string;
+    agreed_terms: unknown;
+}
+export interface ExecuteHandoffInput {
+    candidate: HandoffCandidate;
+    ledger: HandoffEventStore;
+    idempotency: HandoffIdempotencyStore;
+    identity: LedgerIdentitySnapshot;
+    capability: LedgerCapabilitySnapshot;
+    /** 策略/批准门（KTH §1 flow 的 Policy/Approval；返回拒绝则不执行）。 */
+    approval: (candidate: HandoffCandidate) => Promise<{
+        approved: boolean;
+        reason?: string;
+        evidence?: Record<string, unknown>;
+    }>;
+    /** 重读 agreement 的权威源（§10 pre-execution revalidation）。 */
+    agreementReader: (agreementId: string) => Promise<AgreementReadResult | undefined>;
+    /** 目的地 URL 安全策略（缺省 HTTPS-only + expectedHost 校验）。 */
+    urlSafety?: (url: string) => Promise<SafeDestinationUrl>;
+    now?: () => string;
+}
+/**
+ * 从 Ledger 事件流驱动执行（含生命周期/重验/幂等/落链）。
+ * 整个流程以候选为粒度互斥（§10.1 并发保护）：lookup→(await)→record 的
+ * check-then-act 在无锁时两个并发执行会双双通过幂等检查、同一候选交付两次。
+ * 锁在幂等存储上（JSONL 与锁文件同目录，跨进程共享 dir 时同样互斥）。
+ */
+export declare function executeHandoff(input: ExecuteHandoffInput): Promise<ExecuteHandoffResult>;
+/** 供调用方构造缺省 URL 安全策略（HTTPS-only + merchant 域绑定）。 */
+export declare function defaultUrlSafety(expectedHost?: string): (url: string) => Promise<SafeDestinationUrl>;

package/dist/handoff/transaction.js

@@ -0,0 +1,263 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * TransactionHandoff + executeHandoff（KTH rev0.3 §6/§10；完成定义 #9-16、
+ * #18-19）。
+ *
+ * executeHandoff 流程：
+ *   1. 生命周期门：候选必须 READY（PROPOSED 时先走 approval：通过 →
+ *      ready 事件；拒绝 → rejected 事件并返回）；
+ *   2. pre-execution revalidation（§10）：重读 agreement / 重算 terms_digest /
+ *      验 merchant identity / 验 destination（URL 安全）/ 验 expiry ——
+ *      任一变化 → handoff_candidate_stale → 返回 stale（不执行）；
+ *   3. 幂等（§10.1）：(source_candidate_id, source_candidate_digest) 已交付
+ *      → 返回已交付结果（重试不重复交付）；冲突 → fail-closed；
+ *   4. consumed（候选）+ delivered（handoff）事件落链，构造 TransactionHandoff
+ *      （handoff_digest = JCS 去除自身）。
+ *
+ * 三副作用不变量（§16/§36-25）：本模块绝不创建订单/授权支付/预留库存。
+ */
+import { contentDigest } from "../negotiation/jcs.js";
+import { assertNoForbiddenContent } from "../negotiation/ledger/event.js";
+import { generateId } from "../negotiation/domain/identifiers.js";
+import { CommerceError } from "../commerce/data-source.js";
+import { foldCandidateLifecycle, transitionCandidateLifecycle } from "./lifecycle.js";
+import { validateExternalDestinationUrl } from "./url-safety.js";
+import { isUrlDestinationType } from "./destination.js";
+function computeHandoffDigest(handoff) {
+    return contentDigest(handoff);
+}
+/**
+ * 从 Ledger 事件流驱动执行（含生命周期/重验/幂等/落链）。
+ * 整个流程以候选为粒度互斥（§10.1 并发保护）：lookup→(await)→record 的
+ * check-then-act 在无锁时两个并发执行会双双通过幂等检查、同一候选交付两次。
+ * 锁在幂等存储上（JSONL 与锁文件同目录，跨进程共享 dir 时同样互斥）。
+ */
+export async function executeHandoff(input) {
+    return input.idempotency.withCandidateLock(input.candidate.handoff_candidate_id, () => executeHandoffUnlocked(input));
+}
+async function executeHandoffUnlocked(input) {
+    const { candidate, ledger, idempotency } = input;
+    // 惰性清理（评审项 L2）：prune 此前无调用方——幂等行永久保留，磁盘随
+    // 候选数无界增长。执行是低频操作，顺带清理过期行（保留期 ≥7 天不变）。
+    try {
+        idempotency.prune();
+    }
+    catch {
+        // 清理失败不影响执行（fail-safe 方向；下次执行再试）。
+    }
+    const negotiationId = candidate.negotiation_id;
+    const events = ledger.events(negotiationId);
+    const candidateEvents = events.filter((e) => e.handoff_candidate_id === candidate.handoff_candidate_id);
+    const state = foldCandidateLifecycle(candidateEvents);
+    const now = input.now ?? (() => new Date().toISOString());
+    // ── 0.5 协议级去重（评审项 H3）──────────────────────────────────────
+    // 同一 (agreement_id, destination_type, destination_ref) 已交付过 →
+    // already_delivered。创建期检查（buyer-tools priorDelivery）拦不住双候选
+    // 双批准：候选 A 创建时 B 尚未交付，两者都通过创建期检查；执行期幂等键
+    // (candidate_id, digest) 对每个候选都是新键。以链上事实为准——第一个
+    // 交付落链后，任何后续候选执行（含不同候选并发执行）都命中此检查，
+    // 且不触发无谓的 approval/重验。
+    const priorDestination = events.find((e) => e.event_kind === "handoff_delivered" &&
+        e.agreement_id === candidate.agreement_id &&
+        e.destination?.type === candidate.destination_type &&
+        e.destination?.ref === candidate.destination_ref);
+    if (priorDestination !== undefined) {
+        return { kind: "already_delivered", handoff_id: priorDestination.handoff_id ?? "unknown" };
+    }
+    // ── 1. 生命周期门 ────────────────────────────────────────────────────
+    if (state === "REJECTED")
+        return { kind: "rejected", reason: "candidate was rejected" };
+    if (state === "STALE")
+        return { kind: "stale", reason: "candidate is stale" };
+    if (state === "EXPIRED")
+        return { kind: "expired", reason: "candidate already expired" };
+    if (state === "CONSUMED") {
+        const consumed = events.find((e) => e.handoff_candidate_id === candidate.handoff_candidate_id && e.handoff_id !== undefined);
+        const handoffId = consumed?.handoff_id ?? "unknown";
+        // 中间态恢复（评审项 M1）：consumed 已落、delivered 缺失（两次 append
+        // 之间崩溃）时，补落 delivered + 幂等记录——否则重试永远报"已交付"
+        // 但审计链上无交付证据（deliveryState 投影 undefined、metrics 缺失、
+        // TUI 列表显示 delivery "?"）。恢复的 delivered 以候选 destination_ref
+        // 为兜底（首次执行的 URL 探测结果已不可得；type/ref 是候选审计事实，
+        // final_url 是展示字段，缺失可接受）。
+        const deliveredExists = events.some((e) => e.event_kind === "handoff_delivered" && e.handoff_id === handoffId);
+        if (!deliveredExists && handoffId !== "unknown") {
+            ledger.appendDeliveryEvent({
+                kind: "handoff_delivered",
+                candidate,
+                handoff_id: handoffId,
+                identity: input.identity,
+                capability: input.capability,
+                destination: { final_url: candidate.destination_ref },
+                occurred_at: now(),
+            });
+            idempotency.record(candidate.handoff_candidate_id, candidate.candidate_digest, handoffId);
+        }
+        return { kind: "already_delivered", handoff_id: handoffId };
+    }
+    if (state === "PROPOSED" || state === undefined) {
+        // PROPOSED：先走策略/批准。通过 → ready（附批准证据）；拒绝 → rejected。
+        const approvalResult = await input.approval(candidate);
+        if (!approvalResult.approved) {
+            ledger.appendCandidateEvent({
+                kind: "handoff_candidate_rejected",
+                candidate,
+                identity: input.identity,
+                capability: input.capability,
+                evidence: { reason: approvalResult.reason ?? "approval rejected" },
+                occurred_at: now(),
+            });
+            return { kind: "rejected", reason: approvalResult.reason ?? "approval rejected" };
+        }
+        transitionCandidateLifecycle(state, "handoff_candidate_ready");
+        ledger.appendCandidateEvent({
+            kind: "handoff_candidate_ready",
+            candidate,
+            identity: input.identity,
+            capability: input.capability,
+            evidence: approvalResult.evidence,
+            occurred_at: now(),
+        });
+    }
+    else if (state !== "READY") {
+        return { kind: "stale", reason: `unexpected lifecycle state ${String(state)}` };
+    }
+    // ── 2. pre-execution revalidation（§10）──────────────────────────────
+    const agreement = await input.agreementReader(candidate.agreement_id);
+    if (agreement === undefined) {
+        return stale(input, candidate, now, "agreement no longer exists");
+    }
+    if (agreement.agreement_id !== candidate.agreement_id || agreement.negotiation_id !== candidate.negotiation_id) {
+        return stale(input, candidate, now, "agreement identity changed");
+    }
+    const recomputedTerms = contentDigest(agreement.agreed_terms);
+    if (recomputedTerms !== candidate.terms_digest) {
+        return stale(input, candidate, now, "terms_digest mismatch on revalidation");
+    }
+    // fail-closed 过期门：不可解析的时间戳（Date.parse 为 NaN）绝不视为
+    // "未过期"——NaN < x 恒 false 会让候选永不过期直接交付。与 completion.ts
+    // 的守卫一致：NaN 一律按过期处理。
+    const expiresMs = Date.parse(candidate.expires_at);
+    const nowMs = Date.parse(now());
+    if (!Number.isFinite(expiresMs) || !Number.isFinite(nowMs) || expiresMs < nowMs) {
+        ledger.appendCandidateEvent({
+            kind: "handoff_candidate_expired",
+            candidate,
+            identity: input.identity,
+            capability: input.capability,
+            occurred_at: now(),
+        });
+        return { kind: "expired", reason: "candidate expired before execution" };
+    }
+    let finalUrl;
+    // URL 安全只适用于 URL 承载类目的地（quote/PO/contact 等 opaque ref
+    // 不做 URL 探测——它们不是可点击链接，KTH §7 类型语义）。
+    if (input.urlSafety !== undefined && isUrlDestinationType(candidate.destination_type)) {
+        try {
+            const safe = await input.urlSafety(candidate.destination_ref);
+            finalUrl = safe.finalUrl;
+        }
+        catch (err) {
+            // 瞬时探测失败（超时/网络/HEAD 405）可重试，不置终态 STALE（评审项
+            // M2：此前一次 15s 超时即永久废掉候选——目的地内容并未变化，断网期间
+            // 每次重试都新建候选再置 stale，候选/事件堆积）。安全拒绝（scheme/
+            // host/DNS 保留网段 → invalid_input）仍是终态——内容确实不可用。
+            if (err instanceof CommerceError && err.code === "request_failed") {
+                return { kind: "probe_failed", reason: err.message };
+            }
+            return stale(input, candidate, now, `destination invalid: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    // ── 3. 幂等（§10.1）─────────────────────────────────────────────────
+    const prior = idempotency.lookup(candidate.handoff_candidate_id, candidate.candidate_digest);
+    if (prior !== undefined) {
+        return { kind: "already_delivered", handoff_id: prior.handoff_id };
+    }
+    // ── 4. 交付：consumed + delivered 落链 ──────────────────────────────
+    const handoffId = generateId("handoff");
+    const base = {
+        handoff_id: handoffId,
+        source_candidate_id: candidate.handoff_candidate_id,
+        source_candidate_digest: candidate.candidate_digest,
+        agreement_id: candidate.agreement_id,
+        negotiation_id: candidate.negotiation_id,
+        terms_digest: candidate.terms_digest,
+        merchant_identity_ref: candidate.merchant_identity_ref,
+        destination_type: candidate.destination_type,
+        destination_ref: candidate.destination_ref,
+        display_summary: candidate.display_summary,
+        created_at: now(),
+        expires_at: candidate.expires_at,
+        requires_user_action: candidate.requires_user_action,
+        creates_order: false,
+        authorizes_payment: false,
+        reserves_inventory: false,
+    };
+    const handoff = {
+        ...base,
+        handoff_digest: computeHandoffDigest(base),
+    };
+    // 预检（评审项 M1 加固）：consumed 落链前先验证 delivered 内容可落账
+    //（禁词扫描）。若 delivered 因 ledger_forbidden_content 失败，此时 consumed
+    // 已落链，会形成"已消费但无交付证据"的中间态（恢复路径虽能补，但可预
+    // 见的失败应发生在 consumed 之前）。
+    const deliveredDestination = {
+        type: candidate.destination_type,
+        ref: candidate.destination_ref,
+        ...(finalUrl !== undefined ? { final_url: finalUrl } : {}),
+    };
+    assertNoForbiddenContent(deliveredDestination, "destination");
+    ledger.appendCandidateEvent({
+        kind: "handoff_candidate_consumed",
+        candidate,
+        identity: input.identity,
+        capability: input.capability,
+        handoff_id: handoffId,
+        occurred_at: now(),
+    });
+    ledger.appendDeliveryEvent({
+        kind: "handoff_delivered",
+        candidate,
+        handoff_id: handoffId,
+        identity: input.identity,
+        capability: input.capability,
+        destination: { final_url: finalUrl ?? candidate.destination_ref },
+        occurred_at: now(),
+    });
+    idempotency.record(candidate.handoff_candidate_id, candidate.candidate_digest, handoffId);
+    return { kind: "delivered", handoff, ...(finalUrl !== undefined ? { final_url: finalUrl } : {}) };
+}
+// 用模块级函数而非 this（避免丢失 this 的调用方踩坑）。
+function stale(input, candidate, now, reason) {
+    input.ledger.appendCandidateEvent({
+        kind: "handoff_candidate_stale",
+        candidate,
+        identity: input.identity,
+        capability: input.capability,
+        evidence: { reason },
+        occurred_at: now(),
+    });
+    return { kind: "stale", reason };
+}
+/** 供调用方构造缺省 URL 安全策略（HTTPS-only + merchant 域绑定）。 */
+export function defaultUrlSafety(expectedHost) {
+    return (url) => validateExternalDestinationUrl(url, {
+        ...(expectedHost !== undefined ? { expectedHost } : {}),
+        allowHttp: false,
+    });
+}
+//# sourceMappingURL=transaction.js.map

package/dist/handoff/transaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transaction.js","sourceRoot":"","sources":["../../src/handoff/transaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAM3D,OAAO,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAC;AAGtF,OAAO,EAAE,8BAA8B,EAA2B,MAAM,iBAAiB,CAAC;AAC1F,OAAO,EAAE,oBAAoB,EAAwB,MAAM,kBAAkB,CAAC;AAsD9E,SAAS,oBAAoB,CAAC,OAAmD;IAC/E,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAA0B;IAC7D,OAAO,KAAK,CAAC,WAAW,CAAC,iBAAiB,CACxC,KAAK,CAAC,SAAS,CAAC,oBAAoB,EACpC,GAAG,EAAE,CAAC,sBAAsB,CAAC,KAAK,CAAC,CACpC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,KAA0B;IAC9D,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IACjD,yCAAyC;IACzC,uCAAuC;IACvC,IAAI,CAAC;QACH,WAAW,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,kCAAkC;IACpC,CAAC;IACD,MAAM,aAAa,GAAG,SAAS,CAAC,cAAc,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC5C,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,oBAAoB,KAAK,SAAS,CAAC,oBAAoB,CAAC,CAAC;IACxG,MAAM,KAAK,GAAG,sBAAsB,CAAC,eAAe,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAE1D,6DAA6D;IAC7D,8DAA8D;IAC9D,2DAA2D;IAC3D,wCAAwC;IACxC,gDAAgD;IAChD,mCAAmC;IACnC,uBAAuB;IACvB,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAClC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,UAAU,KAAK,mBAAmB;QACpC,CAAC,CAAC,YAAY,KAAK,SAAS,CAAC,YAAY;QACxC,CAAC,CAAC,WAA8C,EAAE,IAAI,KAAK,SAAS,CAAC,gBAAgB;QACrF,CAAC,CAAC,WAA6C,EAAE,GAAG,KAAK,SAAS,CAAC,eAAe,CACtF,CAAC;IACF,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,UAAU,EAAE,gBAAgB,CAAC,UAAU,IAAI,SAAS,EAAE,CAAC;IAC7F,CAAC;IAED,mEAAmE;IACnE,IAAI,KAAK,KAAK,UAAU;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IACxF,IAAI,KAAK,KAAK,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC9E,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IACzF,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAC1B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,oBAAoB,KAAK,SAAS,CAAC,oBAAoB,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,CAC/F,CAAC;QACF,MAAM,SAAS,GAAG,QAAQ,EAAE,UAAU,IAAI,SAAS,CAAC;QACpD,mDAAmD;QACnD,2CAA2C;QAC3C,oDAAoD;QACpD,2DAA2D;QAC3D,2CAA2C;QAC3C,0BAA0B;QAC1B,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CACjC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,mBAAmB,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,CAC1E,CAAC;QACF,IAAI,CAAC,eAAe,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAChD,MAAM,CAAC,mBAAmB,CAAC;gBACzB,IAAI,EAAE,mBAAmB;gBACzB,SAAS;gBACT,UAAU,EAAE,SAAS;gBACrB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,WAAW,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,eAAe,EAAE;gBACrD,WAAW,EAAE,GAAG,EAAE;aACnB,CAAC,CAAC;YACH,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,oBAAoB,EAAE,SAAS,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAChD,oDAAoD;QACpD,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACvD,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC;YAC7B,MAAM,CAAC,oBAAoB,CAAC;gBAC1B,IAAI,EAAE,4BAA4B;gBAClC,SAAS;gBACT,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,QAAQ,EAAE,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,IAAI,mBAAmB,EAAE;gBAClE,WAAW,EAAE,GAAG,EAAE;aACnB,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,IAAI,mBAAmB,EAAE,CAAC;QACpF,CAAC;QACD,4BAA4B,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC;QAC/D,MAAM,CAAC,oBAAoB,CAAC;YAC1B,IAAI,EAAE,yBAAyB;YAC/B,SAAS;YACT,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,cAAc,CAAC,QAAQ;YACjC,WAAW,EAAE,GAAG,EAAE;SACnB,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QAC7B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,8BAA8B,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IAClF,CAAC;IAED,sEAAsE;IACtE,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IACtE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,4BAA4B,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,SAAS,CAAC,YAAY,KAAK,SAAS,CAAC,YAAY,IAAI,SAAS,CAAC,cAAc,KAAK,SAAS,CAAC,cAAc,EAAE,CAAC;QAC/G,OAAO,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,4BAA4B,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,eAAe,GAAG,aAAa,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAC9D,IAAI,eAAe,KAAK,SAAS,CAAC,YAAY,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,uCAAuC,CAAC,CAAC;IAC/E,CAAC;IACD,iDAAiD;IACjD,sDAAsD;IACtD,qBAAqB;IACrB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,GAAG,KAAK,EAAE,CAAC;QAChF,MAAM,CAAC,oBAAoB,CAAC;YAC1B,IAAI,EAAE,2BAA2B;YACjC,SAAS;YACT,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,WAAW,EAAE,GAAG,EAAE;SACnB,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;IAC3E,CAAC;IACD,IAAI,QAA4B,CAAC;IACjC,sDAAsD;IACtD,qCAAqC;IACrC,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,oBAAoB,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACtF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;YAC9D,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,2CAA2C;YAC3C,wCAAwC;YACxC,0CAA0C;YAC1C,+CAA+C;YAC/C,IAAI,GAAG,YAAY,aAAa,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBAClE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;YACvD,CAAC;YACD,OAAO,KAAK,CACV,KAAK,EACL,SAAS,EACT,GAAG,EACH,wBAAwB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC3E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,oBAAoB,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC7F,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;IACrE,CAAC;IAED,kEAAkE;IAClE,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,IAAI,GAA+C;QACvD,UAAU,EAAE,SAAS;QACrB,mBAAmB,EAAE,SAAS,CAAC,oBAAoB;QACnD,uBAAuB,EAAE,SAAS,CAAC,gBAAgB;QACnD,YAAY,EAAE,SAAS,CAAC,YAAY;QACpC,cAAc,EAAE,SAAS,CAAC,cAAc;QACxC,YAAY,EAAE,SAAS,CAAC,YAAY;QACpC,qBAAqB,EAAE,SAAS,CAAC,qBAAqB;QACtD,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;QAC5C,eAAe,EAAE,SAAS,CAAC,eAAe;QAC1C,eAAe,EAAE,SAAS,CAAC,eAAe;QAC1C,UAAU,EAAE,GAAG,EAAE;QACjB,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,oBAAoB,EAAE,SAAS,CAAC,oBAAoB;QACpD,aAAa,EAAE,KAAK;QACpB,kBAAkB,EAAE,KAAK;QACzB,kBAAkB,EAAE,KAAK;KAC1B,CAAC;IACF,MAAM,OAAO,GAAuB;QAClC,GAAG,IAAI;QACP,cAAc,EAAE,oBAAoB,CAAC,IAAI,CAAC;KAC3C,CAAC;IAEF,gDAAgD;IAChD,8DAA8D;IAC9D,qCAAqC;IACrC,yBAAyB;IACzB,MAAM,oBAAoB,GAA4B;QACpD,IAAI,EAAE,SAAS,CAAC,gBAAgB;QAChC,GAAG,EAAE,SAAS,CAAC,eAAe;QAC9B,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3D,CAAC;IACF,wBAAwB,CAAC,oBAAoB,EAAE,aAAa,CAAC,CAAC;IAE9D,MAAM,CAAC,oBAAoB,CAAC;QAC1B,IAAI,EAAE,4BAA4B;QAClC,SAAS;QACT,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,UAAU,EAAE,SAAS;QACrB,WAAW,EAAE,GAAG,EAAE;KACnB,CAAC,CAAC;IACH,MAAM,CAAC,mBAAmB,CAAC;QACzB,IAAI,EAAE,mBAAmB;QACzB,SAAS;QACT,UAAU,EAAE,SAAS;QACrB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,WAAW,EAAE,EAAE,SAAS,EAAE,QAAQ,IAAI,SAAS,CAAC,eAAe,EAAE;QACjE,WAAW,EAAE,GAAG,EAAE;KACnB,CAAC,CAAC;IACH,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,oBAAoB,EAAE,SAAS,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;IAE1F,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACpG,CAAC;AAED,mCAAmC;AACnC,SAAS,KAAK,CACZ,KAA0B,EAC1B,SAA2B,EAC3B,GAAiB,EACjB,MAAc;IAEd,KAAK,CAAC,MAAM,CAAC,oBAAoB,CAAC;QAChC,IAAI,EAAE,yBAAyB;QAC/B,SAAS;QACT,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,EAAE,MAAM,EAAE;QACpB,WAAW,EAAE,GAAG,EAAE;KACnB,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACnC,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,gBAAgB,CAAC,YAAqB;IACpD,OAAO,CAAC,GAAW,EAAE,EAAE,CACrB,8BAA8B,CAAC,GAAG,EAAE;QAClC,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC;AACP,CAAC"}