@ixo/decision-oracle 0.0.0-stage → 0.2.0

package/dist/workflows/review-complete.js

@@ -0,0 +1,455 @@
+/**
+ * Review completion (README "How a claim flows" step 6): fold a human's answers into the SAME decision — the
+ * engine replays its frozen facts with one more fact (`POST /v1/reviews/:claimId`, docs/
+ * ENGINE-CONTRACT.md "Human review"), never a second evaluation — then act on the now-terminal
+ * verdict. One instance per claim (id = `reviewInstanceIdFor(claimId)`, lib/ids.ts), spawned by
+ * the review route:
+ *   step "fold"            → load the decision + the answers → RE-PULL the claim body → the engine
+ *                            folds them → the `decisions` row becomes the folded decision (new
+ *                            verdict, digest, receipt; `chainStatus` back to `pending`) and the
+ *                            review is stamped `foldedAt` — one atomic batch, so a retry can never
+ *                            see one without the other. Replayed after completion ⇒ a no-op: the
+ *                            folded row stands
+ *   step "act"             → the same act step as the ingest lane (workflows/steps.ts), fail-soft
+ *   terminal catch         → `claim_reviews.foldError` on the answer the fold read (surfaced by
+ *                            `GET /v1/reviews/:claimId`); the answers are KEPT — the reviewer's
+ *                            "try again" re-POSTs, which clears the error and re-spawns this
+ *                            workflow
+ *
+ * The re-pull is the contract's (docs/ENGINE-CONTRACT.md "Human review"): the engine's `decide()`
+ * reads the claim answers, which neither side persists, so the fold sends them again and the
+ * engine rebuilds its FactSet from the stored trace + `claim.answers`, refusing unless
+ * `factsDigest` matches. The same claim source as `evaluate` (chain: `pullClaim` — the VFS, the
+ * bot via the owner delegation, IPFS or a cellnode, every store but the bot CID-verified) returns
+ * the byte-identical body and the same `claimContent`, which every fold carries (company authority:
+ * the engine holds it to the decision's content) — and, as in `evaluate`, neither leaves the step:
+ * only the small fold summary is a step result.
+ *
+ * The engine's deterministic refusals — `STALE_REVIEW` (it no longer holds the digest the answers
+ * were folded against), `FACTS_MISMATCH` (the rebuilt digest ≠ the stored one: a bug on one side,
+ * a CID-addressed body cannot change), `REVIEW_INCOMPLETE` (its pending-task set ≠ the row's;
+ * `details.pendingTasks` names what is still owed), `CONTENT_MISMATCH` / `PAYLOAD_TOO_LARGE` (the
+ * content is not the decision's, or the body is over the engine's cap; `details.reason` goes into
+ * the text), a 400 (the engine's row is not pending), a
+ * 403/404 (the engine holds this claim under another oracle, or not at all) — are NonRetryable,
+ * logged, and surfaced as `foldError` as `CODE (details.reason): message`; the reviewer answers again against the
+ * current decision. A fail-closed pull (403/404) takes the same path through `stepError`; a
+ * transient one (503) is left to the runtime's retries — and so is a final fold answered without
+ * its receipt (`RECEIPT_MISSING`, steps.ts `requireReceipt`): never stamped, retried, paged once
+ * the retries run out.
+ *
+ * The reviewer's authority (company authority D2) is re-checked HERE, before the pull: the chain
+ * lane's gate (lib/review/reviewer-grant.ts) over the grant stored with the answer, so a revoke, a
+ * controller removed, or an evaluate grant given to the reviewer since the answer refuses the fold
+ * with no engine call — `foldError` `REVIEWER_GRANT_INVALID` / `REVIEWER_NOT_AUTHORIZED`, the
+ * engine's own codes; a chain or Blocksync blip (503) retries. An API claim's answer gets the
+ * same treatment from `recheckApiReviewer` (lib/api-lane/review.ts): a member whose role grant was
+ * revoked, narrowed or replaced, or a root no longer a controller, since the answer is refused the
+ * same way. The grant then rides the fold as its controller filed it (or as the API answer sent
+ * it), and the engine's own refusal of it (the same two codes) lands on
+ * `foldError` too.
+ *
+ * And the fold's own "no" that is not an error: the protocol's `#vct` drifted between the decision
+ * and the fold, so the pinned rubric no longer binds — a `200` with `decision.status = "unusable"`,
+ * FINAL on the engine (persisted, receipted). Recorded exactly as the evaluate step records an
+ * engine `unusable` (the folded row, its receipt, `foldedAt`), the collection pauses
+ * `rubric-unusable` (steps.ts `pauseUnusable`) and `act` skips the non-terminal verdict.
+ */
+import { WorkflowEntrypoint } from "cloudflare:workers";
+import { NonRetryableError } from "cloudflare:workflows";
+import * as Sentry from "@sentry/cloudflare";
+import { and, eq, isNull, sql } from "drizzle-orm";
+import { getDb } from "../db/client.js";
+import { claimIngests, claimReviews, decisions } from "../db/schema.js";
+import { recheckApiReviewer } from "../lib/api-lane/review.js";
+import { archiveAnswer } from "../lib/archive.js";
+import { createEngineClient } from "../lib/engine/client.js";
+import { EngineError } from "../lib/engine/types.js";
+import { AppError } from "../lib/errors.js";
+import { finalVerdictUpdate, registryVerdictToken } from "../lib/facts/stock/unique-store.js";
+import { depsFromEnv } from "../lib/ixo/index.js";
+import { scopedStep, withMetrics } from "../lib/metrics.js";
+import { settleClaim } from "../lib/payments/settle.js";
+import { payoutRequestFor, payoutsConfigured } from "../lib/payouts.js";
+import { checkReviewerGrant } from "../lib/review/reviewer-grant.js";
+import { reportAlert, reportError } from "../lib/sentry.js";
+import { getOracle } from "../oracle.js";
+import { isChain, sourceFor } from "./claim-source.js";
+import { actStep, erroredFactsOf, pauseUnusable, RECEIPT_MISSING, reasonOf, requireReceipt, stepError, } from "./steps.js";
+/** `foldError` for an answer that arrived while an earlier answer's fold failed (terminal catch). */
+const RETRY_ANSWER = "RETRY_ANSWER: your answer arrived while an earlier attempt to apply a review failed — send your answer again to apply it";
+export class ReviewComplete extends WorkflowEntrypoint {
+    async run(event, step) {
+        const deps = depsFromEnv(this.env, {
+            claimId: event.payload?.claimId,
+            instanceId: event.instanceId,
+            workflow: "review-complete",
+        });
+        // Ambient for the run AND inside every step callback (`scopedStep`), so the fetch client and
+        // the cache reads record into `deps.metrics`.
+        const scope = { metrics: deps.metrics, logger: deps.logger };
+        return withMetrics(scope, () => this.complete(event, scopedStep(step, scope, "review-complete"), deps));
+    }
+    async complete(event, step, deps) {
+        const claimId = event.payload?.claimId;
+        if (!claimId)
+            throw new NonRetryableError("Missing claimId param");
+        Sentry.setTags({ claimId, instanceId: event.instanceId, workflow: "review-complete" });
+        // The answer the fold read, by its `attestationJws` (an answer's identity — the fold marker is
+        // scoped the same way): the terminal catch writes `foldError` onto that answer only. A re-POST
+        // landing mid-fold replaces the row, and that newer answer must not inherit this attempt's
+        // failure — it would read as refused and never be folded. Absent until a fold read the row.
+        const seen = {};
+        try {
+            const folded = await step.do("fold", 
+            // One pull + one engine round trip — no connectors, no model calls happen here.
+            {
+                retries: { limit: 5, delay: "10 seconds", backoff: "exponential" },
+                timeout: "2 minutes",
+            }, async () => {
+                try {
+                    // The re-pull goes through the lane the claim came in by (§7.1).
+                    const ingest = await getDb(this.env).query.claimIngests.findFirst({
+                        columns: { lane: true },
+                        where: eq(claimIngests.claimId, claimId),
+                    });
+                    const lane = ingest?.lane ?? "chain";
+                    return {
+                        ...(await this.fold(deps, sourceFor(lane, this.env, deps), claimId, seen)),
+                        lane,
+                    };
+                }
+                catch (err) {
+                    throw stepError(err);
+                }
+            });
+            const source = sourceFor(folded.lane ?? "chain", this.env, deps);
+            // Only a `decided` fold can act (chain-write.ts step 1) — a fold-time `unusable` never does.
+            if (source.after.act && folded.status === "decided") {
+                await actStep(this.env, deps, step, {
+                    claimId,
+                    collectionId: folded.collectionId,
+                    instanceId: event.instanceId,
+                    workflow: "review-complete",
+                });
+            }
+            // The source's notify lane for the folded claim (chain: the `m.replace` edit that completes
+            // the review card sent at ingest time). Its own step, fail-soft like `act` above:
+            // self-contained (reads the folded decision + the answered review off the DB) and a no-op
+            // when there is nothing to tell (no token, no prior send, already edited).
+            try {
+                await step.do("notify-folded", {
+                    retries: { limit: 3, delay: "5 seconds", backoff: "exponential" },
+                    timeout: "1 minute",
+                }, () => source.after.notify(claimId));
+            }
+            catch (err) {
+                deps.logger.error("notify-folded.failed", { claimId, detail: String(err) });
+                reportError(err, { lane: "notify", step: "notify-folded", claimId });
+            }
+            // The lane rode the step result for the steps above; the run's result is unchanged by it.
+            const { lane: _lane, ...summary } = folded;
+            return { claimId, ...summary };
+        }
+        catch (err) {
+            // Terminal failure — say why on the review row (never over a completed fold) and rethrow so
+            // the instance shows Errored. Recovery is the same POST again. The reason belongs to the
+            // answer the fold read (`seen`); a newer answer re-POSTed mid-fold found this instance
+            // running, so its spawn did nothing and — now that the instance has errored — nothing will
+            // ever fold it. It gets `RETRY_ANSWER` instead: the re-POST it asks for restarts the
+            // instance. One statement, so the two rows can never be told different stories.
+            const message = err instanceof Error ? err.message : String(err);
+            const foldError = seen.attestationJws === undefined
+                ? message
+                : sql `case when ${claimReviews.attestationJws} is ${seen.attestationJws} then ${message} else ${RETRY_ANSWER} end`;
+            await getDb(this.env)
+                .update(claimReviews)
+                .set({ foldError })
+                .where(and(eq(claimReviews.claimId, claimId), isNull(claimReviews.foldedAt)))
+                .catch(() => { });
+            reportError(err, { lane: "review", step: "terminal", claimId, instanceId: event.instanceId });
+            // The retries ran out with the engine's fold still receipt-less — page it, like evaluate.
+            if (message.startsWith(RECEIPT_MISSING)) {
+                await reportAlert(deps, "engine.receipt-missing", { claimId, code: RECEIPT_MISSING }, `engine.receipt-missing:${claimId}`);
+            }
+            throw err;
+        }
+    }
+    async fold(deps, source, claimId, seen) {
+        const db = getDb(this.env);
+        const [decision, review] = await Promise.all([
+            db.query.decisions.findFirst({ where: (t, { eq: eqOp }) => eqOp(t.claimId, claimId) }),
+            db.query.claimReviews.findFirst({ where: (t, { eq: eqOp }) => eqOp(t.claimId, claimId) }),
+        ]);
+        if (!decision || !review) {
+            throw new NonRetryableError(`No pending review recorded for claim ${claimId}`);
+        }
+        seen.attestationJws = review.attestationJws;
+        // A replayed/duplicate instance after completion is a no-op — the folded decision stands.
+        if (review.foldedAt)
+            return summary(decision);
+        if (decision.status !== "pending_review" || !decision.resultDigest) {
+            throw new NonRetryableError(`Claim ${claimId} is not awaiting review (${decision.status})`);
+        }
+        // Every review answer is signed (routes/v1/reviews.ts), so a row without one was written by an
+        // older kit and can never fold: the engine requires the attestation too. Said HERE, loudly, on
+        // the review row — the reviewer answers again, signed, which is the only recovery.
+        if (!review.attestationJws) {
+            throw new NonRetryableError(`Review for ${claimId} carries no signed attestation — answer again with a signed review`);
+        }
+        // The reviewer's authority, NOW (header): the chain lane's gate, or the API lane's re-check of
+        // a member's live role grant / a root's controller standing (lib/api-lane/review.ts).
+        const reviewerGrant = await this.gate(deps, source, decision.collectionId, review);
+        const engine = createEngineClient({
+            config: deps.config,
+            logger: deps.logger,
+            trace: deps.trace,
+            cache: deps.cache,
+        });
+        // The body the engine needs back (header comment): the same source `evaluate` pulled through,
+        // verified, so these are the bytes `facts.answers` carried. `frozenAt` is deliberately not
+        // sent — the kit always freezes with `frozenAt === ctx.now` (builder.ts), which is exactly the
+        // engine's default (`trace.ctx.now`). A fail-closed pull throws out of the step (stepError).
+        const { content, ...pulled } = await source.pull(claimId);
+        // S16 — the same block the decide call sent (payouts design §4.7); resolved only when some
+        // protocol is configured, so a fold without payouts costs no extra read.
+        const payout = payoutsConfigured()
+            ? payoutRequestFor(await source.protocolDid(decision.collectionId))
+            : undefined;
+        let response;
+        try {
+            response = await engine.review(claimId, {
+                answeredAgainst: decision.resultDigest,
+                answers: review.answers,
+                reviewerDid: review.reviewerDid,
+                // Verbatim — the signature is over exact bytes, and the engine verifies them again itself.
+                // An attestation error from the engine would therefore be a bug on one side (or a kit
+                // deployed ahead of its engine): it falls through the `switch` below to `default: throw
+                // err`, which the terminal catch pages.
+                attestation: review.attestationJws,
+                claim: { answers: pulled.body },
+                ...(payout ? { payout } : {}),
+                claimContent: content,
+                // The CAR the gate just passed, as its controller filed it: the engine verifies it itself.
+                ...(reviewerGrant ? { reviewerGrant } : {}),
+            });
+        }
+        catch (err) {
+            if (!(err instanceof EngineError))
+                throw err;
+            const scope = {
+                claimId,
+                collectionId: decision.collectionId,
+                answeredAgainst: decision.resultDigest,
+                requestId: err.requestId ?? null,
+            };
+            switch (err.code) {
+                case "STALE_REVIEW":
+                    deps.logger.warn("review.stale", scope);
+                    throw new NonRetryableError(`Review answers are stale — answer again: ${err.message}`);
+                case "FACTS_MISMATCH":
+                    // A CID-addressed body cannot change, so this is a bug on one side (ours: the pulled
+                    // body ≠ what the facts lane froze; theirs: the rebuild) — the terminal catch pages it.
+                    deps.logger.error("review.facts-mismatch", scope);
+                    throw new NonRetryableError(`FACTS_MISMATCH: ${err.message}`);
+                case "REVIEW_INCOMPLETE": {
+                    // The route made the answers cover exactly the row's `pendingTasks`; the engine
+                    // disagreeing means its pending set drifted from ours — the reviewer re-reads and
+                    // answers. `details.pendingTasks` says what is still owed: on the review row, so the
+                    // GET shows it.
+                    const pending = pendingTasksOf(err.details);
+                    deps.logger.error("review.incomplete", { ...scope, pendingTasks: pending });
+                    throw new NonRetryableError(`REVIEW_INCOMPLETE: ${err.message}${pending.length > 0 ? ` (still pending: ${pending.join(", ")})` : ""}`);
+                }
+                case "CONTENT_MISMATCH":
+                case "PAYLOAD_TOO_LARGE": {
+                    // Not the decision's content, or a body over the engine's cap: a fold never changes
+                    // content, so no retry fixes it — on the review row with the engine's reason.
+                    const reason = reasonOf(err.details);
+                    deps.logger.error("review.content-refused", { ...scope, code: err.code, reason });
+                    throw new NonRetryableError(refusal(err));
+                }
+                case "REVIEWER_GRANT_INVALID":
+                case "REVIEWER_NOT_AUTHORIZED": {
+                    // The engine read the grant otherwise than our gate did (a root it no longer sees as a
+                    // controller, an oracle it knows of): no retry changes it — the reviewer answers again
+                    // with a grant from a current controller.
+                    const reason = reasonOf(err.details);
+                    deps.logger.warn("review.grant-refused", { ...scope, code: err.code, reason });
+                    throw new NonRetryableError(refusal(err));
+                }
+                case "BAD_REQUEST":
+                    // The engine's row is not pending (already final there) or the answers' values don't
+                    // fit the rubric's tasks: nothing a retry changes — the reviewer re-reads the decision.
+                    deps.logger.error("review.rejected", { ...scope, code: err.code });
+                    throw new NonRetryableError(refusal(err));
+                case "FORBIDDEN":
+                case "NOT_FOUND":
+                    // The engine holds this claim under a different oracle (403) or not at all (404) while
+                    // we hold a pending decision for it — an identity/config fault worth paging, never a retry.
+                    deps.logger.error("review.not-ours", { ...scope, code: err.code });
+                    reportError(err, {
+                        lane: "review",
+                        step: "fold",
+                        claimId,
+                        collectionId: scope.collectionId,
+                    });
+                    throw new NonRetryableError(refusal(err));
+                default:
+                    throw err;
+            }
+        }
+        // A fold is final, so its answer carries the receipt the fold minted: one without it is never
+        // stamped `foldedAt` — the retry re-POSTs the identical fold, and the engine's stored fold comes
+        // back with it (steps.ts `requireReceipt`).
+        requireReceipt(response, "fold");
+        const folded = {
+            verdict: response.decision.verdict,
+            status: response.decision.status,
+            resultDigest: response.resultDigest,
+            receiptCid: response.receipt?.cid ?? null,
+            receiptJws: response.receipt?.jws ?? null,
+            decision: response.decision,
+            explanation: response.explanation,
+            // The fold's answer names the same errored facts (they never move on a fold); an engine
+            // that sent none leaves the decide's list standing.
+            ...(response.erroredFacts ? { erroredFacts: erroredFactsOf(response) } : {}),
+            // `facts` is deliberately NOT in this set: the fold replays the SAME frozen facts (the
+            // engine rebuilds the FactSet from its trace), so the row's copy — what the act policy reads
+            // at signing time — must survive the fold untouched.
+            // The folded verdict is a NEW thing to act on — whatever the pre-fold row said about delivery
+            // — unless the source never acts (the API lane, §7.1).
+            chainStatus: source.after.act ? "pending" : "skipped",
+            chainError: null,
+        };
+        // One atomic batch (schema.ts header): the decision, its fold marker and — the fold made it
+        // final — the verdict on the claim's duplicate registry rows (stock/unique-store.ts; a no-op
+        // for a rubric without `unique`) land together or not at all.
+        const token = registryVerdictToken(folded.status, folded.verdict);
+        // The fold marker lands only on the answer that was folded: an answer re-POSTed while this
+        // fold was in flight must not be stamped as the one the engine folded.
+        const [, stamped] = await db.batch([
+            db.update(decisions).set(folded).where(eq(decisions.claimId, claimId)),
+            db
+                .update(claimReviews)
+                .set({ foldedAt: new Date(), foldError: null })
+                .where(and(eq(claimReviews.claimId, claimId), eq(claimReviews.attestationJws, review.attestationJws)))
+                .returning({ claimId: claimReviews.claimId }),
+            ...(token
+                ? [finalVerdictUpdate(db, { collectionId: decision.collectionId, claimId, token })]
+                : []),
+        ]);
+        // A `pending_review` decision has no receipt (ENGINE-CONTRACT): the fold mints it, so its
+        // reservation is settled here (payments spec §4 step 6) — an API claim's, or a chain claim's a
+        // per-review collection reserved — fail-soft, the reconcile re-settles a lost one.
+        if (folded.receiptJws && deps.config.X402_FACILITATOR_URL) {
+            await settleClaim({ ...deps, db }, claimId, folded.receiptJws);
+        }
+        if (stamped.length === 0) {
+            // A newer answer replaced the one folded: the decision is final on the folded one, so the
+            // newer answer can only be stale — say so on its row, where the GET shows it.
+            await db
+                .update(claimReviews)
+                .set({ foldError: "STALE_REVIEW: another answer was folded first — re-read the decision" })
+                .where(and(eq(claimReviews.claimId, claimId), isNull(claimReviews.foldedAt)));
+            deps.logger.warn("review.answer-replaced-during-fold", { claimId });
+        }
+        deps.metrics.count("review.folded", 1);
+        // The answer archive's `answer.json`, re-written with the folded decision (lib/archive.ts) —
+        // fail-soft, from the body this step re-pulled; nothing of it leaves the step.
+        if (this.env.ANSWERS_ARCHIVE) {
+            await archiveAnswer(this.env, deps, {
+                lane: source.lane,
+                claim: pulled,
+                content,
+                submitter: await source.submitterKey(pulled).catch(() => null),
+                response,
+                facts: decision.facts ?? null,
+                hooks: getOracle().config.archive,
+                reviewerDid: review.reviewerDid,
+            });
+        }
+        // A payout scope whose claim names no payee: folded, its receipt without a payment binding
+        // (ENGINE-CONTRACT "Payee").
+        if (response.decisionToPayRefused) {
+            deps.logger.warn("payout.refused", {
+                claimId,
+                collectionId: decision.collectionId,
+                code: response.decisionToPayRefused,
+            });
+        }
+        deps.logger.info("review.folded", {
+            claimId,
+            collectionId: decision.collectionId,
+            reviewerDid: review.reviewerDid,
+            status: folded.status,
+            verdict: folded.verdict,
+            resultDigest: folded.resultDigest,
+            receiptCid: folded.receiptCid,
+            traceId: response.traceId ?? null,
+        });
+        // `#vct` drifted since the decision (header): a final, receipted `unusable` for THIS claim —
+        // and the same answer for every other claim of the collection, exactly as at evaluate time.
+        if (response.decision.status === "unusable") {
+            await pauseUnusable(source, deps.logger, "review", {
+                claimId,
+                collectionId: decision.collectionId,
+                rubricId: decision.rubricId,
+                issues: response.decision.reasons,
+                receiptCid: folded.receiptCid,
+            });
+        }
+        return summary({ ...decision, ...folded });
+    }
+    /**
+     * The answer's grant as things stand now — a chain claim's against the chain
+     * (lib/review/reviewer-grant.ts), an API claim's against the source's members and controllers
+     * (`recheckApiReviewer`); answers the CAR the fold forwards. A refusal is the reviewer's to fix,
+     * so NonRetryable with the engine's code and nothing forwarded; a 503 propagates and retries.
+     */
+    async gate(deps, source, collectionId, review) {
+        const db = getDb(this.env);
+        try {
+            if (!isChain(source)) {
+                return await recheckApiReviewer({ db, chain: { config: deps.config, trace: deps.trace } }, { scopeId: collectionId, ...review });
+            }
+            if (!review.reviewerGrant) {
+                throw new NonRetryableError("REVIEWER_GRANT_INVALID (absent): the answer carries no reviewer grant — answer again with the grant the collection's owner gave you");
+            }
+            const grant = await checkReviewerGrant({ config: deps.config, trace: deps.trace, db }, review.reviewerGrant, { collectionId, reviewerDid: review.reviewerDid });
+            return grant.delegation;
+        }
+        catch (err) {
+            if (!(err instanceof AppError) || err.status === 503)
+                throw err;
+            deps.logger.warn("review.grant-refused", {
+                claimId: review.claimId,
+                collectionId,
+                code: err.code,
+                reason: reasonOf(err.details),
+            });
+            throw new NonRetryableError(refusal(err));
+        }
+    }
+}
+/**
+ * `foldError` for a refusal, ours or the engine's: `CODE (reason): message` — `details.reason` (the
+ * CA4 vocabulary for grants) in the one place the Portal and the Console read it from either side.
+ */
+function refusal(err) {
+    const reason = reasonOf(err.details);
+    return `${err.code}${reason ? ` (${reason})` : ""}: ${err.message}`;
+}
+/** The 422's `details.pendingTasks` (contract "Human review"), or nothing if the engine sent none. */
+function pendingTasksOf(details) {
+    const tasks = details?.pendingTasks;
+    return Array.isArray(tasks) ? tasks.filter((t) => typeof t === "string") : [];
+}
+const summary = (row) => ({
+    collectionId: row.collectionId,
+    status: row.status,
+    verdict: row.verdict,
+    resultDigest: row.resultDigest,
+    receiptCid: row.receiptCid,
+});
+//# sourceMappingURL=review-complete.js.map

package/dist/workflows/review-complete.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-complete.js","sourceRoot":"","sources":["../../src/workflows/review-complete.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAEH,OAAO,EAAE,kBAAkB,EAAyC,MAAM,oBAAoB,CAAC;AAC/F,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,MAAM,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAEnD,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAErE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAuB,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAC3F,OAAO,EAAE,WAAW,EAAiB,MAAM,YAAY,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,OAAO,EAAmB,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EACL,OAAO,EACP,cAAc,EACd,aAAa,EACb,eAAe,EACf,QAAQ,EACR,cAAc,EACd,SAAS,GACV,MAAM,SAAS,CAAC;AAEjB,qGAAqG;AACrG,MAAM,YAAY,GAChB,0HAA0H,CAAC;AAoB7H,MAAM,OAAO,cAAe,SAAQ,kBAAmD;IAC5E,KAAK,CAAC,GAAG,CAAC,KAA0C,EAAE,IAAkB;QAC/E,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE;YACjC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO;YAC/B,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,iBAAiB;SAC5B,CAAC,CAAC;QACH,6FAA6F;QAC7F,8CAA8C;QAC9C,MAAM,KAAK,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7D,OAAO,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,CAC7B,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,iBAAiB,CAAC,EAAE,IAAI,CAAC,CACvE,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,KAA0C,EAC1C,IAAkB,EAClB,IAAc;QAEd,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC;QACvC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;QACnE,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACvF,+FAA+F;QAC/F,+FAA+F;QAC/F,2FAA2F;QAC3F,4FAA4F;QAC5F,MAAM,IAAI,GAAuC,EAAE,CAAC;QAEpD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAC1B,MAAM;YACN,gFAAgF;YAChF;gBACE,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE;gBAClE,OAAO,EAAE,WAAW;aACrB,EACD,KAAK,IAAI,EAAE;gBACT,IAAI,CAAC;oBACH,iEAAiE;oBACjE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC;wBAChE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;wBACvB,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC;qBACzC,CAAC,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,IAAI,OAAO,CAAC;oBACrC,OAAO;wBACL,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;wBAC1E,IAAI;qBACL,CAAC;gBACJ,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;gBACvB,CAAC;YACH,CAAC,CACF,CAAC;YACF,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,IAAI,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAEjE,6FAA6F;YAC7F,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACpD,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE;oBAClC,OAAO;oBACP,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,QAAQ,EAAE,iBAAiB;iBAC5B,CAAC,CAAC;YACL,CAAC;YAED,4FAA4F;YAC5F,kFAAkF;YAClF,0FAA0F;YAC1F,2EAA2E;YAC3E,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,EAAE,CACX,eAAe,EACf;oBACE,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,EAAE;oBACjE,OAAO,EAAE,UAAU;iBACpB,EACD,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CACnC,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC5E,WAAW,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC;YACvE,CAAC;YAED,0FAA0F;YAC1F,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,GAAG,MAAM,CAAC;YAC3C,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,4FAA4F;YAC5F,yFAAyF;YACzF,uFAAuF;YACvF,2FAA2F;YAC3F,qFAAqF;YACrF,gFAAgF;YAChF,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,SAAS,GACb,IAAI,CAAC,cAAc,KAAK,SAAS;gBAC/B,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,GAAG,CAAA,aAAa,YAAY,CAAC,cAAc,OAAO,IAAI,CAAC,cAAc,SAAS,OAAO,SAAS,YAAY,MAAM,CAAC;YACvH,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;iBAClB,MAAM,CAAC,YAAY,CAAC;iBACpB,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC;iBAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;iBAC5E,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACnB,WAAW,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;YAC9F,0FAA0F;YAC1F,IAAI,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBACxC,MAAM,WAAW,CACf,IAAI,EACJ,wBAAwB,EACxB,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,EAClC,0BAA0B,OAAO,EAAE,CACpC,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,IAAI,CAChB,IAAc,EACd,MAAkB,EAClB,OAAe,EACf,IAAwC;QAExC,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC3C,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;YACtF,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;SAC1F,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YACzB,MAAM,IAAI,iBAAiB,CAAC,wCAAwC,OAAO,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QAC5C,0FAA0F;QAC1F,IAAI,MAAM,CAAC,QAAQ;YAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,QAAQ,CAAC,MAAM,KAAK,gBAAgB,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;YACnE,MAAM,IAAI,iBAAiB,CAAC,SAAS,OAAO,4BAA4B,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QAC9F,CAAC;QACD,+FAA+F;QAC/F,+FAA+F;QAC/F,mFAAmF;QACnF,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAC3B,MAAM,IAAI,iBAAiB,CACzB,cAAc,OAAO,oEAAoE,CAC1F,CAAC;QACJ,CAAC;QAED,+FAA+F;QAC/F,sFAAsF;QACtF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAEnF,MAAM,MAAM,GAAG,kBAAkB,CAAC;YAChC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QACH,8FAA8F;QAC9F,2FAA2F;QAC3F,+FAA+F;QAC/F,6FAA6F;QAC7F,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE1D,2FAA2F;QAC3F,yEAAyE;QACzE,MAAM,MAAM,GAAG,iBAAiB,EAAE;YAChC,CAAC,CAAC,gBAAgB,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YACnE,CAAC,CAAC,SAAS,CAAC;QAEd,IAAI,QAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE;gBACtC,eAAe,EAAE,QAAQ,CAAC,YAAY;gBACtC,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,2FAA2F;gBAC3F,sFAAsF;gBACtF,wFAAwF;gBACxF,wCAAwC;gBACxC,WAAW,EAAE,MAAM,CAAC,cAAc;gBAClC,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE;gBAC/B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7B,YAAY,EAAE,OAAO;gBACrB,2FAA2F;gBAC3F,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,YAAY,WAAW,CAAC;gBAAE,MAAM,GAAG,CAAC;YAC7C,MAAM,KAAK,GAAG;gBACZ,OAAO;gBACP,YAAY,EAAE,QAAQ,CAAC,YAAY;gBACnC,eAAe,EAAE,QAAQ,CAAC,YAAY;gBACtC,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;aACjC,CAAC;YACF,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;gBACjB,KAAK,cAAc;oBACjB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;oBACxC,MAAM,IAAI,iBAAiB,CAAC,4CAA4C,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACzF,KAAK,gBAAgB;oBACnB,qFAAqF;oBACrF,wFAAwF;oBACxF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;oBAClD,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAChE,KAAK,mBAAmB,EAAE,CAAC;oBACzB,gFAAgF;oBAChF,kFAAkF;oBAClF,qFAAqF;oBACrF,gBAAgB;oBAChB,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBAC5C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAAE,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;oBAC5E,MAAM,IAAI,iBAAiB,CACzB,sBAAsB,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,oBAAoB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC1G,CAAC;gBACJ,CAAC;gBACD,KAAK,kBAAkB,CAAC;gBACxB,KAAK,mBAAmB,EAAE,CAAC;oBACzB,oFAAoF;oBACpF,8EAA8E;oBAC9E,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBACrC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;oBAClF,MAAM,IAAI,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC5C,CAAC;gBACD,KAAK,wBAAwB,CAAC;gBAC9B,KAAK,yBAAyB,EAAE,CAAC;oBAC/B,uFAAuF;oBACvF,uFAAuF;oBACvF,0CAA0C;oBAC1C,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBACrC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;oBAC/E,MAAM,IAAI,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC5C,CAAC;gBACD,KAAK,aAAa;oBAChB,qFAAqF;oBACrF,wFAAwF;oBACxF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;oBACnE,MAAM,IAAI,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC5C,KAAK,WAAW,CAAC;gBACjB,KAAK,WAAW;oBACd,uFAAuF;oBACvF,4FAA4F;oBAC5F,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;oBACnE,WAAW,CAAC,GAAG,EAAE;wBACf,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,MAAM;wBACZ,OAAO;wBACP,YAAY,EAAE,KAAK,CAAC,YAAY;qBACjC,CAAC,CAAC;oBACH,MAAM,IAAI,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC5C;oBACE,MAAM,GAAG,CAAC;YACd,CAAC;QACH,CAAC;QACD,8FAA8F;QAC9F,iGAAiG;QACjG,4CAA4C;QAC5C,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAEjC,MAAM,MAAM,GAAG;YACb,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO;YAClC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM;YAChC,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,UAAU,EAAE,QAAQ,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI;YACzC,UAAU,EAAE,QAAQ,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI;YACzC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,wFAAwF;YACxF,oDAAoD;YACpD,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,uFAAuF;YACvF,6FAA6F;YAC7F,qDAAqD;YACrD,8FAA8F;YAC9F,uDAAuD;YACvD,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAE,SAAmB,CAAC,CAAC,CAAE,SAAmB;YAC3E,UAAU,EAAE,IAAI;SACjB,CAAC;QACF,4FAA4F;QAC5F,6FAA6F;QAC7F,8DAA8D;QAC9D,MAAM,KAAK,GAAG,oBAAoB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAClE,2FAA2F;QAC3F,uEAAuE;QACvE,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC;YACjC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACtE,EAAE;iBACC,MAAM,CAAC,YAAY,CAAC;iBACpB,GAAG,CAAC,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;iBAC9C,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,EACjC,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,MAAM,CAAC,cAAc,CAAC,CACvD,CACF;iBACA,SAAS,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,CAAC;YAC/C,GAAG,CAAC,KAAK;gBACP,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;gBACnF,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QAEH,0FAA0F;QAC1F,+FAA+F;QAC/F,mFAAmF;QACnF,IAAI,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;YAC1D,MAAM,WAAW,CAAC,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,0FAA0F;YAC1F,8EAA8E;YAC9E,MAAM,EAAE;iBACL,MAAM,CAAC,YAAY,CAAC;iBACpB,GAAG,CAAC,EAAE,SAAS,EAAE,sEAAsE,EAAE,CAAC;iBAC1F,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAChF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;QACvC,6FAA6F;QAC7F,+EAA+E;QAC/E,IAAI,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;YAC7B,MAAM,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE;gBAClC,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,KAAK,EAAE,MAAM;gBACb,OAAO;gBACP,SAAS,EAAE,MAAM,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;gBAC9D,QAAQ;gBACR,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,IAAI;gBAC7B,KAAK,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,OAAO;gBACjC,WAAW,EAAE,MAAM,CAAC,WAAW;aAChC,CAAC,CAAC;QACL,CAAC;QACD,2FAA2F;QAC3F,6BAA6B;QAC7B,IAAI,QAAQ,CAAC,oBAAoB,EAAE,CAAC;YAClC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE;gBACjC,OAAO;gBACP,YAAY,EAAE,QAAQ,CAAC,YAAY;gBACnC,IAAI,EAAE,QAAQ,CAAC,oBAAoB;aACpC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE;YAChC,OAAO;YACP,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,IAAI;SAClC,CAAC,CAAC;QAEH,6FAA6F;QAC7F,4FAA4F;QAC5F,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAC5C,MAAM,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE;gBACjD,OAAO;gBACP,YAAY,EAAE,QAAQ,CAAC,YAAY;gBACnC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO;gBACjC,UAAU,EAAE,MAAM,CAAC,UAAU;aAC9B,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,IAAI,CAChB,IAAc,EACd,MAAkB,EAClB,YAAoB,EACpB,MAA2F;QAE3F,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrB,OAAO,MAAM,kBAAkB,CAC7B,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,EACzD,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,MAAM,EAAE,CACrC,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;gBAC1B,MAAM,IAAI,iBAAiB,CACzB,qIAAqI,CACtI,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,kBAAkB,CACpC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,EAC9C,MAAM,CAAC,aAAa,EACpB,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAClD,CAAC;YACF,OAAO,KAAK,CAAC,UAAU,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,YAAY,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,MAAM,GAAG,CAAC;YAChE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE;gBACvC,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,YAAY;gBACZ,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;aAC9B,CAAC,CAAC;YACH,MAAM,IAAI,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;CACF;AAED;;;GAGG;AACH,SAAS,OAAO,CAAC,GAAyD;IACxE,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACrC,OAAO,GAAG,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC;AACtE,CAAC;AAED,sGAAsG;AACtG,SAAS,cAAc,CAAC,OAAgB;IACtC,MAAM,KAAK,GAAI,OAA6C,EAAE,YAAY,CAAC;IAC3E,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7F,CAAC;AAED,MAAM,OAAO,GAAG,CACd,GAGC,EACW,EAAE,CAAC,CAAC;IAChB,YAAY,EAAE,GAAG,CAAC,YAAY;IAC9B,MAAM,EAAE,GAAG,CAAC,MAAM;IAClB,OAAO,EAAE,GAAG,CAAC,OAAO;IACpB,YAAY,EAAE,GAAG,CAAC,YAAY;IAC9B,UAAU,EAAE,GAAG,CAAC,UAAU;CAC3B,CAAC,CAAC"}

package/dist/workflows/steps.d.ts

@@ -0,0 +1,125 @@
+/**
+ * What the two workflows share (README "How a claim flows" step 6): the `act` step that follows a final decision
+ * — after `evaluate` in ClaimIngest, after `fold` in ReviewComplete — the one rule for turning a
+ * thrown error into "retry" vs "stop", and the pause that follows an `unusable` rubric (said at
+ * evaluate time or, when `#vct` drifted before the fold, at fold time).
+ *
+ * Also `pauseCollection`/`notifyCollectionResumed` — the collection-status side of the notice
+ * lane: a chat message in the collection's review room (Matrix, the PRIMARY channel) and its email
+ * twin, both from the ONE `Notice` (lib/email/template.ts). Told once PER COLLECTION (not per
+ * reason, and not pooled per owner — there is one `status` column and no shared
+ * subscription/payout account to group by), via an alternating marker on `matrix_deliveries`: a
+ * `notice_paused`/`notice_resumed` pair per collection, and a state is announced only when its own
+ * marker is not already the newer of the two. That one rule gives both properties needed: a step
+ * retry inside one pause re-sends nothing, and a pause that follows a recovery is a fresh notice
+ * rather than a silently suppressed one.
+ */
+import type { WorkflowStep } from "cloudflare:workers";
+import type { Config } from "../config.js";
+import type { ClaimSource } from "../contracts/index.js";
+import { type Database } from "../db/client.js";
+import type { OracleEnv } from "../env.js";
+import { type AdminUnfundedDetail, type CollectionPausedReason } from "../lib/email/template.js";
+import { type DecideResponse, type ErroredFact } from "../lib/engine/types.js";
+import type { PullDeps } from "../lib/ixo/index.js";
+import { type ChainWriteOutcome } from "../lib/ixo/chain-write.js";
+import type { Logger } from "../lib/logger.js";
+import type { Metrics } from "../lib/metrics.js";
+import type { TraceContext } from "../lib/tracing.js";
+/**
+ * Retry or stop? Transient trouble (a 503 from any lane, the engine's own `UNAVAILABLE`, its 429
+ * `RATE_LIMITED` throttle, anything unclassified) is left as-is so the runtime retries the step;
+ * every deterministic negative — a fail-closed 404/403 from the pull, a config or contract-drift
+ * 500, any other 4xx from the engine — is rethrown NonRetryable so a real "no" never burns the
+ * retry budget. `EngineError.retryable` is that line for the engine. A NonRetryableError passes
+ * through untouched.
+ */
+export declare function stepError(err: unknown): unknown;
+/** The prefix of the error {@link requireReceipt} throws — how a terminal catch knows to page it. */
+export declare const RECEIPT_MISSING = "RECEIPT_MISSING";
+/**
+ * A final answer (`decided` / `unusable`) always carries its receipt (ENGINE-CONTRACT "Response"),
+ * and the receipt is the ONE credential act and the payout spend. One without it (the engine's
+ * mint failed) is never recorded — a receipt-less row is a payout nothing heals. Retryable
+ * instead: the step's retry asks again (the evaluate recovery's GET, a decide's or fold's identical
+ * re-POST), and the engine's stored row comes back with the receipt. `pending_review` has none by
+ * contract (the fold mints it).
+ */
+export declare function requireReceipt(answer: {
+    decision: {
+        status: string;
+    };
+    receipt: unknown;
+}, what: "decision" | "fold"): void;
+/**
+ * What the decision row keeps of the engine's `erroredFacts` (engine/types.ts): each detail capped
+ * (an older or looser engine is not trusted to have done it), null when the engine sent none or an
+ * empty list — so a clean decision and an older engine store the same nothing. Written in the same
+ * statement as the rest of the decision (record / fold); never logged.
+ */
+export declare function erroredFactsOf(answer: Pick<DecideResponse, "erroredFacts">): ErroredFact[] | null;
+/** The engine's `details.reason` on a company-authority refusal — a check's name, never a value. */
+export declare function reasonOf(details: unknown): string | null;
+/**
+ * The rubric cannot be bound — said by the manifest before a producer ran, by the engine at decide
+ * time, or by the fold (the pinned rubric no longer binds against the live `#vct`) — and every
+ * other claim of the scope would be refused the same way until the catalog is fixed, so stop
+ * taking claims and say why (codes and paths, never answer values), through the claim's source
+ * (a chain collection or an API source, Go Prod §7.1). The scope's row stands (a chain collection
+ * keeps its delegation); `POST /v1/collections/:id/resume` lifts a collection's pause. Logged as
+ * `<lane>.rubric-unusable`.
+ */
+export declare function pauseUnusable(source: Pick<ClaimSource, "pause">, logger: Logger, lane: "evaluate" | "review", scope: {
+    claimId: string;
+    collectionId: string;
+    rubricId: string | null;
+    issues: unknown;
+    receiptCid?: string | null;
+}): Promise<void>;
+/**
+ * The engine's `402 INSUFFICIENT_CREDITS` — the oracle OWNER's credits, shared by every scope this
+ * oracle serves — so EVERY active collection AND every active API source pauses at once (not per
+ * claim source: seam header, src/contracts/claim-source.ts). `cron/billing.ts` resumes the
+ * collections when the engine's `/me` says ok (sources: `cron/api-lane.ts`).
+ */
+export declare function pauseForEngineCredits(db: Database, deps: CollectionNoticeDeps): Promise<void>;
+export interface CollectionNoticeDeps {
+    logger: Logger;
+    metrics: Metrics;
+    config: Config;
+    trace: TraceContext;
+    /** `env.CACHE_KV` — the Matrix identity guard's cache (lib/matrix/deliver.ts). */
+    cache: KVNamespace;
+    /** `env.EMAIL` — absent ⇒ the notice email lane no-ops (lib/email/send.ts). */
+    email?: SendEmail;
+}
+/**
+ * Pause a collection AND tell its owner once. Writes `status`/`pausedReason` unconditionally — a
+ * step retry, or a new reason landing while already paused (e.g. `engine-credits` after
+ * `rubric-unusable`), must still record the latest reason — then fires the paused notice, which is
+ * told-once per collection regardless (see the header comment on the alternating-marker rule).
+ * `detail` is the `admin-unfunded` notice's account + amount (lib/email/template.ts). `alert` false
+ * is for a caller that pages once for many rows (`pauseForEngineCredits`).
+ */
+export declare function pauseCollection(db: Database, deps: CollectionNoticeDeps, collectionId: string, reason: CollectionPausedReason, detail?: AdminUnfundedDetail, alert?: boolean): Promise<void>;
+/**
+ * The resume twin. Does NOT write `status` — the caller (`routes/v1/collections.ts`'s pause/resume
+ * route and its re-register upsert, and `cron/billing.ts`'s `resumeEngineCredits`) has already
+ * flipped the row on a REAL paused→active transition, which is the only time any call site invokes
+ * this.
+ */
+export declare function notifyCollectionResumed(db: Database, deps: CollectionNoticeDeps, collectionId: string): Promise<void>;
+/**
+ * Act on the claim's recorded decision (lib/ixo/chain-write.ts) as its own durable step. Delivery
+ * has its own state (`decisions.chainStatus`) and its own retries; a delivery failure NEVER fails
+ * the workflow — the decision is recorded, and an operator rerun re-enters delivery idempotently
+ * (the delivered-once guard). The swallow is reported: a decision that never reached the chain is
+ * otherwise invisible to everyone but this log line, and `withSentry` cannot see a caught throw.
+ */
+export declare function actStep(env: OracleEnv, deps: PullDeps, step: WorkflowStep, scope: {
+    claimId: string;
+    collectionId?: string;
+    instanceId: string;
+    workflow: string;
+}): Promise<ChainWriteOutcome | "failed">;
+//# sourceMappingURL=steps.d.ts.map

package/dist/workflows/steps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"steps.d.ts","sourceRoot":"","sources":["../../src/workflows/steps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,KAAK,QAAQ,EAAS,MAAM,cAAc,CAAC;AAOpD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAIxC,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAQ5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,KAAK,cAAc,EAEnB,KAAK,WAAW,EAEjB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,KAAK,iBAAiB,EAA0B,MAAM,wBAAwB,CAAC;AACxF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE5C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAE9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAGnD;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAO/C;AAED,qGAAqG;AACrG,eAAO,MAAM,eAAe,oBAAoB,CAAC;AAEjD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE;IAAE,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,EAC1D,IAAI,EAAE,UAAU,GAAG,MAAM,GACxB,IAAI,CAKN;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,cAAc,CAAC,GAAG,WAAW,EAAE,GAAG,IAAI,CAMjG;AAED,oGAAoG;AACpG,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAGxD;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,EAClC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,UAAU,GAAG,QAAQ,EAC3B,KAAK,EAAE;IACL,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,GACA,OAAO,CAAC,IAAI,CAAC,CAGf;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,QAAQ,EACZ,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,IAAI,CAAC,CAoDf;AAOD,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,YAAY,CAAC;IACpB,kFAAkF;IAClF,KAAK,EAAE,WAAW,CAAC;IACnB,+EAA+E;IAC/E,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB;AAMD;;;;;;;GAOG;AACH,wBAAsB,eAAe,CACnC,EAAE,EAAE,QAAQ,EACZ,IAAI,EAAE,oBAAoB,EAC1B,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,sBAAsB,EAC9B,MAAM,CAAC,EAAE,mBAAmB,EAC5B,KAAK,UAAO,GACX,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,EAAE,EAAE,QAAQ,EACZ,IAAI,EAAE,oBAAoB,EAC1B,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAEf;AA0HD;;;;;;GAMG;AACH,wBAAsB,OAAO,CAC3B,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,QAAQ,EACd,IAAI,EAAE,YAAY,EAClB,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACtF,OAAO,CAAC,iBAAiB,GAAG,QAAQ,CAAC,CAyCvC"}