@ixo/decision-oracle 0.0.0-stage → 0.2.1

package/dist/lib/review/reviewer-grant.js

@@ -0,0 +1,359 @@
+/**
+ * Who may answer a chain claim's review (company authority D2; ownership review F1, F2, F12): a
+ * person the COMPANY named, never "whoever holds an evaluate grant". The grant is one `@ixo/ucan`
+ * delegation, `claims/review` on `ixo:oracle/<our did:web>/collection/<id>`, from a current
+ * controller of the collection's entity to the reviewer's `did:ixo` (docs/ENGINE-CONTRACT.md
+ * "Reviewer authority: `reviewerGrant`"). The owner files it here (`POST /v1/collections/:id/
+ * reviewers`), the reviewer sends it back with every answer, and the fold forwards it verbatim: the
+ * engine checks the root again itself and records it in the receipt.
+ *
+ * The gate runs at the answer AND inside the fold (workflows/review-complete.ts): a revoke, a
+ * controller removed, or an evaluate grant given to the reviewer between the two refuses the fold
+ * with no engine call. The revocation half is OURS alone this round (the engine checks only the
+ * root and the cap) — which is exactly why it must run at fold time too.
+ *
+ * Checks, in order — the cheap and deterministic first, the chain reads last:
+ *   1. the CAR (`parseReviewerGrant`): one delegation, no proofs, no extra block; the signature
+ *      verifies against the issuer's on-chain key; the capability is exactly `claims/review` on
+ *      this collection's resource (no wildcard); issuer and audience are distinct `did:ixo`
+ *      accounts; `nbf` and `exp` both set, `exp − nbf` ≤ 30 days (ucanto has no `iat`), and
+ *      `nbf ≤ now + 60 s < …`, `now < exp`                                         → 400 INVALID
+ *   2. the audience is the reviewer (the attestation issuer, the UCAN principal)  → 400 INVALID
+ *   3. revocation: the canonical CID is a `collection_reviewers` row, unrevoked  → 403
+ *   4. no identity of THIS oracle anywhere in the chain — its OWNER included        → 403
+ *   5. live root: the issuer is a current controller of the collection's entity  → 403
+ *   6. no `did:ixo` in the chain holds an `EvaluateClaimAuthorization` on the collection — read
+ *      uncached: an evaluator must not review (F12)                               → 403
+ * Blocksync, the chain or a DID resolver unreachable is a 503 (`AppError.unavailable`), never a pass;
+ * so is a collection with no entity — there is no controller to root a grant at (fail closed).
+ *
+ * Every refusal carries `details.reason` in the engine's CA4 vocabulary (`GrantRefusal`), so the
+ * Portal and the Console read one set whichever side refused. `revoked` is ours alone: the engine
+ * keeps no revocations this round.
+ */
+import { and, eq, gt, isNull } from "drizzle-orm";
+import { collectionResource, sourceResource } from "../../contracts/capabilities.js";
+import { collectionReviewers } from "../../db/schema.js";
+import { AppError } from "../errors.js";
+import { queryEvaluateGrant } from "../ixo/authz.js";
+import { getCollection, getEntityControllers } from "../ixo/blocksync/index.js";
+import { decode, finite, Invalid, proofsOf, Refused, summarize, verifyChain, verifySignedWith, } from "../ixo/grant-chain.js";
+import { oracleWebDid } from "../ixo/ucan.js";
+/** The one ability a reviewer grant carries. */
+export const REVIEW_CAN = "claims/review";
+/** The longest a reviewer grant may live (`exp − nbf`), as the engine enforces it. */
+export const REVIEWER_GRANT_MAX_SEC = 30 * 86_400;
+/** Clock skew allowed on `nbf`, as the engine allows it (CA4): a grant minted on a clock a little
+ *  ahead of ours stands at once. `exp` is strict on both sides. */
+export const REVIEWER_GRANT_SKEW_SEC = 60;
+const ACCOUNT_DID = /^did:ixo:ixo1[0-9a-z]+$/;
+export const invalid = (reason, why) => new AppError(`This reviewer grant can't be used: ${why}.`, {
+    code: "REVIEWER_GRANT_INVALID",
+    details: { reason },
+});
+export const notAuthorized = (reason, why) => new AppError(`This reviewer grant does not authorize a review: ${why}.`, {
+    code: "REVIEWER_NOT_AUTHORIZED",
+    details: { reason },
+});
+/** One check over the CAR, its token-level defects (`Invalid`/`Refused`) named `reason`. */
+async function check(reason, run) {
+    try {
+        return await run();
+    }
+    catch (err) {
+        if (err instanceof Invalid || err instanceof Refused)
+            throw invalid(reason, err.message);
+        throw err;
+    }
+}
+/** The collection's entity controllers, live. No entity (or no collection) is 503, never `[]`. */
+async function controllersOf(deps, collectionId) {
+    const collection = await getCollection(deps, collectionId);
+    if (!collection?.entity) {
+        throw AppError.unavailable(`Collection ${collectionId} has no entity to root reviewer grants at`);
+    }
+    return {
+        controllers: await getEntityControllers(deps, collection.entity),
+        admin: collection.admin,
+    };
+}
+/**
+ * One `claims/review` link on `resource`, read off its CAR: shape, signature (`verify`), the one
+ * capability, two IXO accounts, and the window. Who the accounts may be is the caller's.
+ */
+async function readGrant(car, resource, verify, renew, now) {
+    const leaf = await check("unparseable", () => decode(car));
+    await check("shape", () => proofsOf(leaf, {
+        max: 0,
+        message: "it must be one grant from the company, not a grant passed on",
+    }));
+    // The delegation and nothing else. The one block allowed beyond it IS the archive's variant root:
+    // `decode` (ucanto's extract) only reads a CAR whose root is that block, so it is always present
+    // and a smuggled block makes two. The engine's rule is the same count (blocks = links + 1).
+    const extra = [...leaf.blocks.keys()].filter((k) => k !== leaf.cid.toString());
+    if (extra.length > 1)
+        throw invalid("extra-block", "the CAR carries blocks beyond the one grant");
+    await check("signature", () => verify(leaf));
+    const link = await check("shape", () => summarize(leaf));
+    onlyReview(link, resource);
+    if (!ACCOUNT_DID.test(link.issuer) || !ACCOUNT_DID.test(link.audience)) {
+        throw invalid("identity", "it must be issued by an IXO account (did:ixo:ixo1…) to an IXO account");
+    }
+    inWindow(link, renew, now);
+    return link;
+}
+/** Exactly one capability: `claims/review` on `resource`. */
+function onlyReview(link, resource) {
+    const [cap, ...more] = link.caps;
+    const one = `it must carry exactly one capability, { with: "${resource}", can: "${REVIEW_CAN}" }`;
+    if (!cap || more.length > 0 || cap.can !== REVIEW_CAN)
+        throw invalid("capability", one);
+    if (cap.with !== resource)
+        throw invalid("resource", one);
+}
+/** The engine's window: `nbf` and `exp` both set, `exp − nbf` ≤ 30 days, `nbf ≤ now + skew`,
+ *  `now < exp`. */
+function inWindow(link, renew, now) {
+    if (link.nbf === null || link.exp === null) {
+        throw invalid("lifetime", "it must state when it starts (nbf) and when it ends (exp)");
+    }
+    if (link.exp - link.nbf > REVIEWER_GRANT_MAX_SEC) {
+        throw invalid("too-long", `it may last at most ${REVIEWER_GRANT_MAX_SEC / 86_400} days`);
+    }
+    if (link.nbf > now + REVIEWER_GRANT_SKEW_SEC)
+        throw invalid("not-yet-valid", "it has not started yet");
+    if (link.exp <= now)
+        throw invalid("expired", `it has expired — ${renew}`);
+}
+/** Check 1 — the CAR alone: shape, signature, capability, identities and window. */
+export async function parseReviewerGrant(config, car, collectionId, now = Math.floor(Date.now() / 1000)) {
+    // Chain claims: root → member, one link (an API-lane root signs its own: `parseSelfReviewGrant`).
+    const link = await readGrant(car, collectionResource(oracleWebDid(config), collectionId), (leaf) => verifyChain(config, [leaf]), "ask the collection's owner for a new one", now);
+    if (link.issuer === link.audience)
+        throw invalid("identity", "it must be issued to someone else");
+    return {
+        cid: link.cid,
+        rootDid: link.issuer,
+        memberDid: link.audience,
+        exp: link.exp,
+        delegation: car,
+    };
+}
+/**
+ * An API-lane root's grant to itself (owner 2026-10-10; the engine's `rootKind:
+ * company-controller`): an organisation's controller answering a review of one of its sources
+ * carries ONE self-link — issuer = audience = `controllerDid`, `claims/review` on
+ * `ixo:oracle/<our did:web>/source/<sourceId>`, the same window rules — signed with `keyDid`, the
+ * key its attestation was signed with (already proved to be on its IID). Its controller-ness is
+ * the console's live root check, and the engine re-reads it; no oracle identity may be the
+ * controller. Throws `REVIEWER_GRANT_INVALID` / `REVIEWER_NOT_AUTHORIZED` with `details.reason`.
+ */
+export async function parseSelfReviewGrant(config, car, scope, now = Math.floor(Date.now() / 1000)) {
+    const link = await readGrant(car, sourceResource(oracleWebDid(config), scope.sourceId), (leaf) => verifySignedWith(leaf, scope.keyDid), "sign a new one", now);
+    if (link.issuer !== scope.controllerDid || link.audience !== scope.controllerDid) {
+        throw invalid("audience", `it must be issued by ${scope.controllerDid} to itself, the controller answering`);
+    }
+    await assertNotOracle(config, [scope.controllerDid]);
+    return {
+        cid: link.cid,
+        rootDid: link.issuer,
+        memberDid: link.audience,
+        exp: link.exp,
+        delegation: car,
+    };
+}
+/**
+ * An API-lane MEMBER's reviewer grant (owner 2026-10-10, S1: the engine refuses a company
+ * decision's fold without one): ONE CAR of exactly two links, root first —
+ *   1. a current controller of the source's organisation → the member's did:ixo: the member's
+ *      STORED, unrevoked role grant, matched by canonical CID (`delegationCid`) — so `mayReview`'s
+ *      reading of that row (capabilities, `nb.protocols`, which the engine does not read) is the
+ *      protocol limit; any other first link is refused;
+ *   2. the member's did:ixo → `reviewerKey`, the did:key the member registered and the answers
+ *      are signed with: exactly `claims/review` on this source.
+ * Per link, as the engine: no wildcard in any `can` / `with`, a `claims/review` cap on
+ * `ixo:oracle/<our did:web>/source/<sourceId>`, the window (`inWindow`), and no oracle identity.
+ * Deterministic checks first; the two signatures (each against its issuer's IID) last.
+ */
+export async function parseMemberReviewGrant(config, car, scope, now = Math.floor(Date.now() / 1000)) {
+    const resource = sourceResource(oracleWebDid(config), scope.sourceId);
+    const two = "it must be two links: your access from the organisation, then your grant to your reviewer key";
+    const leaf = await check("unparseable", () => decode(car));
+    const [root] = await check("shape", () => proofsOf(leaf, { max: 1, message: two }));
+    if (!root)
+        throw invalid("shape", two);
+    // The two delegations and nothing else — the one block beyond them is the variant root (above).
+    const own = new Set([leaf.cid.toString(), root.cid.toString()]);
+    if ([...leaf.blocks.keys()].filter((k) => !own.has(k)).length > 1) {
+        throw invalid("extra-block", "the CAR carries blocks beyond the two grants");
+    }
+    const [access, key] = await check("shape", () => Promise.all([summarize(root), summarize(leaf)]));
+    // Link 1: what the member holds now, from a root that is one now.
+    for (const cap of access.caps) {
+        if (cap.can.includes("*") || cap.with.includes("*")) {
+            throw invalid("capability", "your access from the organisation grants everything (a wildcard) — a reviewer grant names claims/review; ask an admin to give you a role that reviews");
+        }
+    }
+    if (!access.caps.some((cap) => cap.can === REVIEW_CAN && cap.with === resource)) {
+        throw invalid("capability", `your access from the organisation does not include ${REVIEW_CAN}`);
+    }
+    if (access.cid !== scope.delegationCid) {
+        throw notAuthorized("revoked", "its first link is not your current access to this source — reload the console and answer again");
+    }
+    inWindow(access, "ask an admin of the organisation to grant your role again", now);
+    if (!ACCOUNT_DID.test(access.issuer) || !scope.roots.includes(access.issuer)) {
+        throw notAuthorized("root-not-controller", `${access.issuer} is not a current controller of this source's organisation`);
+    }
+    // Link 2: the member to the key that signed the answers.
+    onlyReview(key, resource);
+    if (access.audience !== scope.memberDid || key.issuer !== scope.memberDid) {
+        throw invalid("audience", `both links must name you, ${scope.memberDid}`);
+    }
+    if (key.audience !== scope.reviewerKey) {
+        throw invalid("audience", `it must be granted to ${scope.reviewerKey}, the reviewer key the answers are signed with`);
+    }
+    inWindow(key, "sign a new one", now);
+    await assertNotOracle(config, [access.issuer, scope.memberDid, scope.reviewerKey]);
+    await check("signature", () => verifyChain(config, [root, leaf]));
+    return {
+        cid: key.cid,
+        rootDid: access.issuer,
+        memberDid: scope.memberDid,
+        exp: Math.min(access.exp, key.exp),
+        delegation: car,
+    };
+}
+/** Every identity of THIS oracle — none may root, receive or self-sign a reviewer grant. */
+function oracleIdentities(config) {
+    return new Set([
+        config.ORACLE_DID,
+        `did:ixo:${config.ORACLE_ADDRESS}`,
+        oracleWebDid(config),
+        config.ORACLE_ENTITY_DID,
+    ].filter((did) => !!did));
+}
+/**
+ * Check 4: no identity of this oracle in `dids` — nor its OWNER, the account that signed
+ * `OWNER_DELEGATION_CAR`: the engine counts the owner among the oracle's identities and refuses its
+ * fold, so an answer that names it is refused here, before anything is stored (owner 2026-10-11).
+ */
+export async function assertNotOracle(config, dids) {
+    const oracle = oracleIdentities(config);
+    if (dids.some((did) => oracle.has(did))) {
+        throw notAuthorized("oracle", "this oracle may not review the claims it evaluates");
+    }
+    const owner = await oracleOwnerDid(config);
+    if (owner && dids.includes(owner)) {
+        throw notAuthorized("oracle-owner", "the oracle's owner may not review the claims it evaluates — another controller of the organisation reviews");
+    }
+}
+let ownerMemo;
+/**
+ * The oracle's owner: the issuer of `OWNER_DELEGATION_CAR` (the AuthHub session that registered the
+ * oracle with the engine — lib/engine/client.ts `register`). Null when none is configured. Read once
+ * per isolate per CAR; our own secret, so no signature check. One that does not parse is a broken
+ * config and throws, loud — the engine could not register this oracle with it either.
+ */
+export function oracleOwnerDid(config) {
+    const car = config.OWNER_DELEGATION_CAR;
+    if (!car)
+        return Promise.resolve(null);
+    if (ownerMemo?.car !== car) {
+        ownerMemo = {
+            car,
+            did: import("@ixo/ucan")
+                .then(({ parseDelegation }) => parseDelegation(car))
+                .then((d) => d.issuer.did(), (err) => {
+                throw AppError.internal("OWNER_DELEGATION_CAR is not a UCAN delegation", err);
+            }),
+        };
+    }
+    return ownerMemo.did;
+}
+/**
+ * Checks 4–6 — what the chain says about the people in a grant, now. Shared with the grant route,
+ * which runs it before filing a grant so an owner hears "that person evaluates this collection" at
+ * once rather than at their reviewer's first answer.
+ */
+export async function assertReviewerAuthority(deps, grant, collectionId) {
+    const { config } = deps;
+    const people = [grant.rootDid, grant.memberDid];
+    await assertNotOracle(config, people);
+    const { controllers, admin } = await controllersOf(deps, collectionId);
+    if (!controllers.includes(grant.rootDid)) {
+        throw notAuthorized("root-not-controller", `${grant.rootDid} is not a current controller of collection ${collectionId}'s entity`);
+    }
+    // An evaluate grant can sign MsgEvaluateClaim and move the collection's payments directly (F12);
+    // that power and review authority stay in different hands. Uncached: a grant given moments ago
+    // counts. No admin ⇒ no grant can exist.
+    if (admin) {
+        const evaluators = await Promise.all(people.map((did) => queryEvaluateGrant(config, admin, did.slice("did:ixo:".length), collectionId)));
+        const evaluator = people.find((_, i) => evaluators[i]);
+        if (evaluator) {
+            throw notAuthorized("evaluator", `${evaluator} holds an evaluate grant on collection ${collectionId} — an evaluator may not review`);
+        }
+    }
+}
+/**
+ * The whole gate (header): the grant the reviewer sent with an answer, for `reviewerDid` on
+ * `collectionId`. Throws the refusal; returns the verified grant.
+ */
+export async function checkReviewerGrant(deps, car, scope) {
+    const grant = await parseReviewerGrant(deps.config, car, scope.collectionId);
+    if (grant.memberDid !== scope.reviewerDid) {
+        throw invalid("audience", `it was granted to ${grant.memberDid}, not to the reviewer ${scope.reviewerDid}`);
+    }
+    const [row] = await deps.db
+        .select({ delegation: collectionReviewers.delegation })
+        .from(collectionReviewers)
+        .where(and(eq(collectionReviewers.collectionId, scope.collectionId), eq(collectionReviewers.delegationCid, grant.cid), isNull(collectionReviewers.revokedAt)));
+    if (!row) {
+        throw notAuthorized("revoked", "it is not a live reviewer grant of this collection (never filed, or revoked) — ask its owner");
+    }
+    await assertReviewerAuthority(deps, grant, scope.collectionId);
+    return { ...grant, delegation: row.delegation };
+}
+/**
+ * The collection's filed grants that stand NOW — the read gate's reviewer path (routes/v1/shared.ts)
+ * and the review room (lib/matrix/deliver.ts): unrevoked, inside their window (`nbf ≤ now + skew`, `now < exp`;
+ * the row keeps no `nbf`, so it is read off the filed CAR), and from a root that is STILL a current
+ * controller of the collection's entity. The standing half of the gate — no signature check, the
+ * row was verified when it was filed; an answer and a fold run the whole of `checkReviewerGrant`.
+ * Controllers are read uncached, and only once a row survives the table's own filter, so a caller
+ * who was never granted costs no chain read. Blocksync trouble throws (503), never an empty answer.
+ */
+export async function liveReviewerGrants(deps, db, collectionId, opts = {}) {
+    const now = opts.now ?? new Date();
+    const rows = await db
+        .select({
+        memberDid: collectionReviewers.memberDid,
+        rootDid: collectionReviewers.rootDid,
+        delegationCid: collectionReviewers.delegationCid,
+        delegation: collectionReviewers.delegation,
+    })
+        .from(collectionReviewers)
+        .where(and(eq(collectionReviewers.collectionId, collectionId), opts.memberDid ? eq(collectionReviewers.memberDid, opts.memberDid) : undefined, isNull(collectionReviewers.revokedAt), gt(collectionReviewers.expiresAt, now)));
+    const nowSec = Math.floor(now.getTime() / 1000);
+    const started = [];
+    for (const { delegation, ...row } of rows) {
+        if (await startedBy(delegation, nowSec))
+            started.push(row);
+    }
+    if (started.length === 0)
+        return [];
+    const { controllers } = await controllersOf(deps, collectionId);
+    return started.filter((row) => controllers.includes(row.rootDid));
+}
+/** The filed CAR's `nbf` has passed. One that no longer decodes stands for nothing (fail closed). */
+async function startedBy(car, nowSec) {
+    try {
+        const nbf = finite((await decode(car)).notBefore);
+        return nbf !== null && nbf <= nowSec + REVIEWER_GRANT_SKEW_SEC;
+    }
+    catch (err) {
+        if (err instanceof Invalid)
+            return false;
+        throw err;
+    }
+}
+//# sourceMappingURL=reviewer-grant.js.map

package/dist/lib/review/reviewer-grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reviewer-grant.js","sourceRoot":"","sources":["../../../src/lib/review/reviewer-grant.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAGH,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAElD,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAElF,OAAO,EAA2B,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EACL,MAAM,EACN,MAAM,EACN,OAAO,EAEP,QAAQ,EACR,OAAO,EACP,SAAS,EACT,WAAW,EACX,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,gDAAgD;AAChD,MAAM,CAAC,MAAM,UAAU,GAAG,eAAe,CAAC;AAC1C,sFAAsF;AACtF,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,MAAM,CAAC;AAClD;mEACmE;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAuB1C,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAwB9C,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,MAAoB,EAAE,GAAW,EAAE,EAAE,CAC3D,IAAI,QAAQ,CAAC,sCAAsC,GAAG,GAAG,EAAE;IACzD,IAAI,EAAE,wBAAwB;IAC9B,OAAO,EAAE,EAAE,MAAM,EAAE;CACpB,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAoB,EAAE,GAAW,EAAE,EAAE,CACjE,IAAI,QAAQ,CAAC,oDAAoD,GAAG,GAAG,EAAE;IACvE,IAAI,EAAE,yBAAyB;IAC/B,OAAO,EAAE,EAAE,MAAM,EAAE;CACpB,CAAC,CAAC;AAEL,4FAA4F;AAC5F,KAAK,UAAU,KAAK,CAAI,MAAoB,EAAE,GAAqB;IACjE,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,EAAE,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,OAAO,IAAI,GAAG,YAAY,OAAO;YAAE,MAAM,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACzF,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,kGAAkG;AAClG,KAAK,UAAU,aAAa,CAC1B,IAAmC,EACnC,YAAoB;IAEpB,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QACxB,MAAM,QAAQ,CAAC,WAAW,CACxB,cAAc,YAAY,2CAA2C,CACtE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,WAAW,EAAE,MAAM,oBAAoB,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC;QAChE,KAAK,EAAE,UAAU,CAAC,KAAK;KACxB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,SAAS,CACtB,GAAW,EACX,QAAgB,EAChB,MAA2C,EAC3C,KAAa,EACb,GAAW;IAEX,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,CACxB,QAAQ,CAAC,IAAI,EAAE;QACb,GAAG,EAAE,CAAC;QACN,OAAO,EAAE,8DAA8D;KACxE,CAAC,CACH,CAAC;IACF,kGAAkG;IAClG,iGAAiG;IACjG,4FAA4F;IAC5F,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC/E,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,OAAO,CAAC,aAAa,EAAE,6CAA6C,CAAC,CAAC;IAClG,MAAM,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAS,MAAM,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAE/D,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC3B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvE,MAAM,OAAO,CACX,UAAU,EACV,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IAC3B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6DAA6D;AAC7D,SAAS,UAAU,CAAC,IAAU,EAAE,QAAgB;IAC9C,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC;IACjC,MAAM,GAAG,GAAG,kDAAkD,QAAQ,YAAY,UAAU,KAAK,CAAC;IAClG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,KAAK,UAAU;QAAE,MAAM,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IACxF,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ;QAAE,MAAM,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED;mBACmB;AACnB,SAAS,QAAQ,CAAC,IAAU,EAAE,KAAa,EAAE,GAAW;IACtD,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QAC3C,MAAM,OAAO,CAAC,UAAU,EAAE,2DAA2D,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG,sBAAsB,EAAE,CAAC;QACjD,MAAM,OAAO,CAAC,UAAU,EAAE,uBAAuB,sBAAsB,GAAG,MAAM,OAAO,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,GAAG,GAAG,GAAG,uBAAuB;QAC1C,MAAM,OAAO,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;IAC3D,IAAI,IAAI,CAAC,GAAG,IAAI,GAAG;QAAE,MAAM,OAAO,CAAC,SAAS,EAAE,oBAAoB,KAAK,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,GAAW,EACX,YAAoB,EACpB,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAEnC,kGAAkG;IAClG,MAAM,IAAI,GAAG,MAAM,SAAS,CAC1B,GAAG,EACH,kBAAkB,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC,EACtD,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,EACrC,0CAA0C,EAC1C,GAAG,CACJ,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,QAAQ;QAAE,MAAM,OAAO,CAAC,UAAU,EAAE,mCAAmC,CAAC,CAAC;IAClG,OAAO;QACL,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,OAAO,EAAE,IAAI,CAAC,MAAM;QACpB,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,GAAG,EAAE,IAAI,CAAC,GAAa;QACvB,UAAU,EAAE,GAAG;KAChB,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAc,EACd,GAAW,EACX,KAAkE,EAClE,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAEnC,MAAM,IAAI,GAAG,MAAM,SAAS,CAC1B,GAAG,EACH,cAAc,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,EACpD,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAC9C,gBAAgB,EAChB,GAAG,CACJ,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;QACjF,MAAM,OAAO,CACX,UAAU,EACV,wBAAwB,KAAK,CAAC,aAAa,sCAAsC,CAClF,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;IACrD,OAAO;QACL,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,OAAO,EAAE,IAAI,CAAC,MAAM;QACpB,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,GAAG,EAAE,IAAI,CAAC,GAAa;QACvB,UAAU,EAAE,GAAG;KAChB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAc,EACd,GAAW,EACX,KAMC,EACD,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAEnC,MAAM,QAAQ,GAAG,cAAc,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtE,MAAM,GAAG,GACP,+FAA+F,CAAC;IAClG,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACpF,IAAI,CAAC,IAAI;QAAE,MAAM,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACvC,gGAAgG;IAChG,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,OAAO,CAAC,aAAa,EAAE,8CAA8C,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAElG,kEAAkE;IAClE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACpD,MAAM,OAAO,CACX,YAAY,EACZ,uJAAuJ,CACxJ,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,UAAU,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;QAChF,MAAM,OAAO,CAAC,YAAY,EAAE,sDAAsD,UAAU,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;QACvC,MAAM,aAAa,CACjB,SAAS,EACT,gGAAgG,CACjG,CAAC;IACJ,CAAC;IACD,QAAQ,CAAC,MAAM,EAAE,2DAA2D,EAAE,GAAG,CAAC,CAAC;IACnF,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7E,MAAM,aAAa,CACjB,qBAAqB,EACrB,GAAG,MAAM,CAAC,MAAM,4DAA4D,CAC7E,CAAC;IACJ,CAAC;IACD,yDAAyD;IACzD,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC1B,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;QAC1E,MAAM,OAAO,CAAC,UAAU,EAAE,6BAA6B,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;QACvC,MAAM,OAAO,CACX,UAAU,EACV,yBAAyB,KAAK,CAAC,WAAW,gDAAgD,CAC3F,CAAC;IACJ,CAAC;IACD,QAAQ,CAAC,GAAG,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;IACrC,MAAM,eAAe,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IACnF,MAAM,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO;QACL,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,OAAO,EAAE,MAAM,CAAC,MAAM;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAa,EAAE,GAAG,CAAC,GAAa,CAAC;QACtD,UAAU,EAAE,GAAG;KAChB,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,SAAS,gBAAgB,CAAC,MAAc;IACtC,OAAO,IAAI,GAAG,CACZ;QACE,MAAM,CAAC,UAAU;QACjB,WAAW,MAAM,CAAC,cAAc,EAAE;QAClC,YAAY,CAAC,MAAM,CAAC;QACpB,MAAM,CAAC,iBAAiB;KACzB,CAAC,MAAM,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CACxC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,IAAuB;IAC3E,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACxC,MAAM,aAAa,CAAC,QAAQ,EAAE,oDAAoD,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,aAAa,CACjB,cAAc,EACd,4GAA4G,CAC7G,CAAC;IACJ,CAAC;AACH,CAAC;AAED,IAAI,SAA4D,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,oBAAoB,CAAC;IACxC,IAAI,CAAC,GAAG;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,SAAS,EAAE,GAAG,KAAK,GAAG,EAAE,CAAC;QAC3B,SAAS,GAAG;YACV,GAAG;YACH,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC;iBACrB,IAAI,CAAC,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;iBACnD,IAAI,CACH,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,EACrB,CAAC,GAAG,EAAE,EAAE;gBACN,MAAM,QAAQ,CAAC,QAAQ,CAAC,+CAA+C,EAAE,GAAG,CAAC,CAAC;YAChF,CAAC,CACF;SACJ,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC,GAAG,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAmC,EACnC,KAAmD,EACnD,YAAoB;IAEpB,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEtC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACvE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,MAAM,aAAa,CACjB,qBAAqB,EACrB,GAAG,KAAK,CAAC,OAAO,8CAA8C,YAAY,WAAW,CACtF,CAAC;IACJ,CAAC;IACD,iGAAiG;IACjG,+FAA+F;IAC/F,yCAAyC;IACzC,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,CAClC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CACjB,kBAAkB,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC,CAC9E,CACF,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,aAAa,CACjB,WAAW,EACX,GAAG,SAAS,0CAA0C,YAAY,gCAAgC,CACnG,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAuB,EACvB,GAAW,EACX,KAAoD;IAEpD,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAC7E,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,OAAO,CACX,UAAU,EACV,qBAAqB,KAAK,CAAC,SAAS,yBAAyB,KAAK,CAAC,WAAW,EAAE,CACjF,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;SACxB,MAAM,CAAC,EAAE,UAAU,EAAE,mBAAmB,CAAC,UAAU,EAAE,CAAC;SACtD,IAAI,CAAC,mBAAmB,CAAC;SACzB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,mBAAmB,CAAC,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC,EACxD,EAAE,CAAC,mBAAmB,CAAC,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,EAChD,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,CACtC,CACF,CAAC;IACJ,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,aAAa,CACjB,SAAS,EACT,8FAA8F,CAC/F,CAAC;IACJ,CAAC;IACD,MAAM,uBAAuB,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAC/D,OAAO,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;AAClD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAmC,EACnC,EAAY,EACZ,YAAoB,EACpB,IAAI,GAAuC,EAAE;IAE7C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC;QACN,SAAS,EAAE,mBAAmB,CAAC,SAAS;QACxC,OAAO,EAAE,mBAAmB,CAAC,OAAO;QACpC,aAAa,EAAE,mBAAmB,CAAC,aAAa;QAChD,UAAU,EAAE,mBAAmB,CAAC,UAAU;KAC3C,CAAC;SACD,IAAI,CAAC,mBAAmB,CAAC;SACzB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,mBAAmB,CAAC,YAAY,EAAE,YAAY,CAAC,EAClD,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,EAC9E,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,EACrC,EAAE,CAAC,mBAAmB,CAAC,SAAS,EAAE,GAAG,CAAC,CACvC,CACF,CAAC;IACJ,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,EAAE,CAAC;IACnB,KAAK,MAAM,EAAE,UAAU,EAAE,GAAG,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;QAC1C,IAAI,MAAM,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAChE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,qGAAqG;AACrG,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,MAAc;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAClD,OAAO,GAAG,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,GAAG,uBAAuB,CAAC;IACjE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,OAAO;YAAE,OAAO,KAAK,CAAC;QACzC,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/lib/review/tasks.d.ts

@@ -0,0 +1,18 @@
+/**
+ * One pending review task as a reviewer is asked it: id, prompt, answer shape. The manifest's
+ * `review.taskDetails` says it (engine T9). Without an entry — an older engine, or a manifest read
+ * that failed — a rubric task falls back to its bare id and a boolean (the fold lane's default).
+ *
+ * The engine's SYNTHETIC tasks never do (engine #82): `unique:<ruleId>` (a possible duplicate) and
+ * `checks:held` (a claim held only by a failed check, on a rubric with no claim-level task) are
+ * answered `"approve"` / `"reject"`, and the engine refuses a boolean with a 400. So their fallback
+ * is the engine's own enum and prompt, never a boolean the reviewer could not send.
+ */
+import type { Manifest, ManifestReviewAnswer } from "../engine/types.js";
+export interface ReviewTaskShape {
+    id: string;
+    prompt: string;
+    answer: ManifestReviewAnswer;
+}
+export declare function reviewTaskOf(id: string, review: Manifest["review"]): ReviewTaskShape;
+//# sourceMappingURL=tasks.d.ts.map

package/dist/lib/review/tasks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tasks.d.ts","sourceRoot":"","sources":["../../../src/lib/review/tasks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEtE,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,oBAAoB,CAAC;CAC9B;AAuBD,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,eAAe,CAIpF"}

package/dist/lib/review/tasks.js

@@ -0,0 +1,36 @@
+/**
+ * One pending review task as a reviewer is asked it: id, prompt, answer shape. The manifest's
+ * `review.taskDetails` says it (engine T9). Without an entry — an older engine, or a manifest read
+ * that failed — a rubric task falls back to its bare id and a boolean (the fold lane's default).
+ *
+ * The engine's SYNTHETIC tasks never do (engine #82): `unique:<ruleId>` (a possible duplicate) and
+ * `checks:held` (a claim held only by a failed check, on a rubric with no claim-level task) are
+ * answered `"approve"` / `"reject"`, and the engine refuses a boolean with a 400. So their fallback
+ * is the engine's own enum and prompt, never a boolean the reviewer could not send.
+ */
+const APPROVE_REJECT = { type: "enum", options: ["approve", "reject"] };
+/** The engine's prompts for its synthetic tasks (engine #82), used only when no detail came. */
+function syntheticTask(id) {
+    if (id.startsWith("unique:")) {
+        return {
+            id,
+            prompt: "Is this a different job from the earlier claim shown?",
+            answer: { ...APPROVE_REJECT, options: [...APPROVE_REJECT.options] },
+        };
+    }
+    if (id === "checks:held") {
+        return {
+            id,
+            prompt: "An automatic check couldn't run. Approve or reject this claim?",
+            answer: { ...APPROVE_REJECT, options: [...APPROVE_REJECT.options] },
+        };
+    }
+    return null;
+}
+export function reviewTaskOf(id, review) {
+    const detail = review?.taskDetails?.find((t) => t.id === id);
+    if (detail)
+        return { id: detail.id, prompt: detail.prompt, answer: detail.answer };
+    return syntheticTask(id) ?? { id, prompt: id, answer: { type: "boolean" } };
+}
+//# sourceMappingURL=tasks.js.map

package/dist/lib/review/tasks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tasks.js","sourceRoot":"","sources":["../../../src/lib/review/tasks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAUH,MAAM,cAAc,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAW,CAAC;AAEjF,gGAAgG;AAChG,SAAS,aAAa,CAAC,EAAU;IAC/B,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,EAAE;YACF,MAAM,EAAE,uDAAuD;YAC/D,MAAM,EAAE,EAAE,GAAG,cAAc,EAAE,OAAO,EAAE,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,EAAE;SACpE,CAAC;IACJ,CAAC;IACD,IAAI,EAAE,KAAK,aAAa,EAAE,CAAC;QACzB,OAAO;YACL,EAAE;YACF,MAAM,EAAE,gEAAgE;YACxE,MAAM,EAAE,EAAE,GAAG,cAAc,EAAE,OAAO,EAAE,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,EAAE;SACpE,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,EAAU,EAAE,MAA0B;IACjE,MAAM,MAAM,GAAG,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,IAAI,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IACnF,OAAO,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC;AAC9E,CAAC"}

package/dist/lib/sentry.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Error reporting (OBS-02). One place that decides what leaves this service.
+ *
+ * The boundary is the SAME one the engine's signed receipts hold: **codes, scores and identifiers may
+ * leave; answer values, trace contents and credentials may not.** That is deliberately not "send
+ * nothing" — an issue you cannot debug is worse than no issue, so claim ids, collection ids, step
+ * names and error codes all ride along, and the log trail comes with them. What gets redacted is
+ * the short list in `SENSITIVE_KEYS` (lib/redact.ts, shared with the logger) plus auth headers.
+ *
+ * Two things this file exists to enforce:
+ *
+ * 1. **`withSentry` alone would report almost nothing.** This codebase catches by design — Hono's
+ *    `onError` converts every throw into the `AppError` envelope, and each side-effect lane
+ *    (chain-write, Matrix, cron) swallows its own failure so it can never fail a
+ *    workflow. An unhandled exception is the exception here, so the fail-soft catches call
+ *    `reportError` explicitly. Installing the SDK without those calls buys a green dashboard and
+ *    silent failures.
+ * 2. **Redaction is ours now.** Cloudflare's old dashboard integration scrubbed headers for you via
+ *    `BLOCKED_HEADERS`; that flow was removed in 2025, so the hooks below are the only thing
+ *    standing between a UCAN bearer token and Sentry.
+ *
+ * Unset `SENTRY_DSN` ⇒ every function here is a no-op (`captureException` with no client is safe),
+ * which is what keeps local dev and CI from shipping events.
+ */
+import * as Sentry from "@sentry/cloudflare";
+import type { Config } from "../config.js";
+import type { OracleEnv } from "../env.js";
+import type { Logger } from "./logger.js";
+/**
+ * The init options, shared by the fetch/scheduled wrapper and by every instrumented Workflow so a
+ * workflow event can never be less redacted than a request event.
+ */
+export declare function sentryOptions(env: OracleEnv): Sentry.CloudflareOptions;
+/** True when the lane is configured at all — lets callers skip building context for nothing. */
+export declare const sentryEnabled: (config: Pick<Config, "SENTRY_DSN">) => boolean;
+/**
+ * Identifiers that make an issue actionable. All become Sentry TAGS (indexed and searchable — you
+ * can filter the issue stream by `claimId`), not just context, because "which claim was this?" is
+ * the first question every one of these failures raises.
+ */
+export interface ErrorScope {
+    /** Which lane swallowed it: `chain-evaluate`, `notify`, `cron`, `review`, … */
+    lane: string;
+    /** The durable step, where one applies — retries of the same step group into one issue. */
+    step?: string;
+    claimId?: string;
+    collectionId?: string;
+    /** The Workflow instance id — paste straight into `wrangler workflows instances describe`. */
+    instanceId?: string;
+    /** Anything else: CODES AND IDENTIFIERS ONLY. Never answer values, never trace contents. */
+    context?: Record<string, string | number | boolean | null | undefined>;
+}
+/**
+ * Report a failure the code deliberately swallowed.
+ *
+ * `fingerprint` groups retries of the same durable step into ONE issue instead of one per attempt;
+ * Workflow steps retry by design, and without this a single stuck claim would page repeatedly.
+ * (The SDK already disables its own dedupe integration inside Workflows.) It is deliberately NOT
+ * keyed on claimId — one broken lane should be one issue with many events, not one issue per claim.
+ */
+export declare function reportError(err: unknown, scope: ErrorScope): void;
+/** What `reportAlert` needs — every lane that pages already carries these three on its deps. */
+export interface AlertDeps {
+    config: Partial<Pick<Config, "OPS_ALERT_WEBHOOK_URL" | "SERVICE_NAME" | "IXO_NETWORK">>;
+    /** `env.CACHE_KV` — the 30-minute dedupe. Absent ⇒ nothing is deduped. */
+    cache?: KVNamespace;
+    logger: Logger;
+}
+/** CODES, IDS AND NUMBERS ONLY — the same boundary as `ErrorScope.context`. */
+export type AlertFields = Record<string, string | number | boolean | null | undefined>;
+/**
+ * Page someone (observability spec §5.2): a condition a runbook says wakes a person, as opposed to
+ * a failure `reportError` records. The same contract in every IXO service:
+ *
+ * 1. Dedupe FIRST, on KV `ops-alert:<dedupeKey ?? event>` for 30 minutes — so both sinks see one
+ *    page per condition per window, not one per occurrence. That is why event names carry the
+ *    reason (`collection.paused.rubric-unusable`): the dedupe must never hide a different condition.
+ *    A KV that throws is no reason to stay silent: send anyway.
+ * 2. Sentry: one `captureMessage` at `error`, fingerprinted on `event`, so one condition is one
+ *    issue — the issue alert routes it to Slack. A no-op without `SENTRY_DSN`.
+ * 3. `OPS_ALERT_WEBHOOK_URL`, only when set: a Slack-compatible `{ text }` POST, under
+ *    `suppressTracing` so no span or breadcrumb records the URL (it is the credential). A POST that
+ *    fails frees the dedupe key, so the next occurrence tries again.
+ *
+ * Never throws — it sits beside the log line of a lane that is already failing, and must not be
+ * the thing that fails it. A webhook failure is one `ops-alert.failed` warn (no URL in it).
+ */
+export declare function reportAlert(deps: AlertDeps, event: string, fields?: AlertFields, dedupeKey?: string): Promise<void>;
+//# sourceMappingURL=sentry.d.ts.map

package/dist/lib/sentry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sentry.d.ts","sourceRoot":"","sources":["../../src/lib/sentry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,MAAM,MAAM,oBAAoB,CAAC;AAC7C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAiFvC;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAAC,iBAAiB,CAoEtE;AAED,gGAAgG;AAChG,eAAO,MAAM,aAAa,WAAY,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,KAAG,OAA8B,CAAC;AAElG;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,2FAA2F;IAC3F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8FAA8F;IAC9F,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4FAA4F;IAC5F,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;CACxE;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CAWjE;AAED,gGAAgG;AAChG,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,uBAAuB,GAAG,cAAc,GAAG,aAAa,CAAC,CAAC,CAAC;IACxF,0EAA0E;IAC1E,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,+EAA+E;AAC/E,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;AAMvF;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,SAAS,EACf,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,WAAgB,EACxB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAkDf"}