@ixo/decision-oracle 0.0.0-stage → 0.2.1

package/dist/cli/lib/chain.js

@@ -0,0 +1,584 @@
+/**
+ * Chain plumbing for the CLI's authoring commands (`oracle init`, `create-deed`,
+ * `create-collection`, `publish-protocol`, `submit-claim`, `delegation`). Everything here can sign
+ * REAL transactions and spend REAL funds — safety and clarity are the whole point, so this file
+ * owns the ONE confirm-or-dry-run gate every signing path goes through, and every endpoint it uses
+ * comes from `networks.ts` (so a typo can't send a mainnet tx to devnet's fee or vice versa).
+ *
+ * Deliberately NOT reusing `src/lib/ixo/*`: those are typed for the Worker's `deps.config`/
+ * `AppError`/`fetchClient` request lifecycle. These commands run as a plain bun/node program (plain
+ * `fetch`, dumb errors, chain failures surface raw).
+ */
+import { createHash } from "node:crypto";
+import process from "node:process";
+import { cidForBytes } from "../../lib/hash.js";
+import { NETWORKS } from "../../networks.js";
+import { matrixPassword } from "./matrix-account.js";
+/**
+ * `network` comes ONLY from the `--network` flag, NEVER from an env file's `NETWORK` var — an env
+ * file crafted for one network must never silently redirect a run to another. Omitting the flag is
+ * the safe default (devnet); every other network must be named explicitly on the command line.
+ */
+export function resolveNetwork(flag) {
+    const name = flag ?? "devnet";
+    if (name !== "devnet" && name !== "testnet" && name !== "mainnet") {
+        fail(`unknown --network '${name}' (devnet|testnet|mainnet)`);
+    }
+    return name;
+}
+/**
+ * `process` is typed `any` in this project (the Worker runtime's global declarations win over
+ * @types/node's, which is fine for the Worker and unhelpful here), so the two paths that end the
+ * process name the signature they rely on: `exit` never returns.
+ */
+const exit = process.exit;
+/**
+ * An expected failure: one line, no stack, exit 1. Ends the PROCESS rather than returning a code to
+ * the dispatcher because it is called from deep inside a signing sequence — every caller in between
+ * would otherwise have to thread a failure back up through half-finished chain state.
+ */
+export function fail(message) {
+    console.error(`\n✗ ${message}\n`);
+    exit(1);
+}
+export async function gqlFetch(blocksyncUrl, query, variables) {
+    const res = await fetch(blocksyncUrl, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ query, variables }),
+    });
+    if (!res.ok)
+        throw new Error(`blocksync returned ${res.status}: ${await res.text()}`);
+    const json = (await res.json());
+    if (json.errors)
+        throw new Error(`blocksync errors: ${JSON.stringify(json.errors)}`);
+    if (json.data === undefined)
+        throw new Error("blocksync returned no data");
+    return json.data;
+}
+const ENTITY_RESOLVE_QUERY = `
+  query EntityResolve($id: String!) {
+    entity(id: $id) { id owner type accounts linkedResource service linkedEntity linkedClaim }
+  }`;
+/** One round trip: owner, entity type, the entity-module `admin` account, every LinkedResource,
+ *  every service, every linkedEntity edge. */
+export async function resolveEntity(blocksyncUrl, did) {
+    const data = await gqlFetch(blocksyncUrl, ENTITY_RESOLVE_QUERY, { id: did });
+    const e = data.entity;
+    return {
+        owner: e?.owner ?? null,
+        adminAccount: e?.accounts?.find((a) => a.name === "admin")?.address ?? null,
+        type: e?.type ?? null,
+        linkedResources: e?.linkedResource ?? [],
+        services: e?.service ?? [],
+        linkedEntities: e?.linkedEntity ?? [],
+        linkedClaims: e?.linkedClaim ?? [],
+    };
+}
+const COLLECTION_QUERY = `
+  query Collection($entity: String!, $protocol: String!) {
+    claimCollections(
+      filter: { entity: { equalTo: $entity }, protocol: { equalTo: $protocol } }
+    ) {
+      nodes { id admin protocol entity startDate endDate payments }
+    }
+  }`;
+/** The (at most one) collection a deed holds for a protocol — how `create-collection` resumes every
+ *  phase from `--entity` + `--protocol`, with no state file. Keyed on the PAIR: one protocol backs
+ *  many deeds (each with its own collection), so `protocol` alone is not an identity. */
+export async function resolveCollection(blocksyncUrl, entityDid, protocolDid) {
+    const data = await gqlFetch(blocksyncUrl, COLLECTION_QUERY, { entity: entityDid, protocol: protocolDid });
+    return data.claimCollections.nodes[0] ?? null;
+}
+const COLLECTION_BY_ID_QUERY = `
+  query CollectionById($id: String!) {
+    claimCollection(id: $id) { id admin protocol entity startDate endDate payments }
+  }`;
+/** One collection by its numeric id — what a SUBMITTER starts from (`submit-claim`): the `entity`
+ *  whose room the body goes to and the `admin` that `MsgSubmitClaim` names. */
+export async function resolveCollectionById(blocksyncUrl, collectionId) {
+    const data = await gqlFetch(blocksyncUrl, COLLECTION_BY_ID_QUERY, { id: collectionId });
+    return data.claimCollection;
+}
+const OWNED_ORACLE_ENTITY_QUERY = `
+  query OwnedOracleEntity($owner: String!, $types: [String!]) {
+    entities(filter: { owner: { equalTo: $owner }, type: { in: $types } }) {
+      nodes { id type }
+    }
+  }`;
+/** Every oracle entity a wallet address owns. NOT "the" oracle: one AuthHub session can own the
+ *  entities of several oracles, so `oracle init` picks its own from this list by what binds an
+ *  entity to THIS oracle (`resolveOracleEntity` there). `type in [...]` covers both the plain
+ *  `oracle` entityType and the more specific `oracle/evaluation` one. */
+export async function ownedOracleEntities(blocksyncUrl, ownerAddress) {
+    const data = await gqlFetch(blocksyncUrl, OWNED_ORACLE_ENTITY_QUERY, { owner: ownerAddress, types: ["oracle", "oracle/evaluation"] });
+    return data.entities.nodes;
+}
+// --- signing ------------------------------------------------------------------------------------
+/** One flat fee for every step (1–3 msgs) — generous gas, never refused. */
+export const STANDARD_FEE = {
+    amount: [{ denom: "uixo", amount: "150000" }],
+    gas: "1500000",
+};
+/**
+ * THE safety gate. Prints exactly what is about to be signed/sent, on which network, as whom — and
+ * REQUIRES `--yes` to proceed. Without it: print the plan and exit 0. Nothing is ever signed on the
+ * strength of this function alone; every chain write (and every other signing path — Matrix uploads,
+ * UCAN delegation minting) calls this immediately before the write.
+ *
+ * A dry run ends the PROCESS here: "stop, successfully, half way through a sequence" is not
+ * something a command's return value can say, and every caller in between is mid-sequence.
+ */
+export function confirm(plan, yes, opts = {}) {
+    const print = opts.print ?? console.log;
+    print(`\n── ${plan.action} ──`);
+    print(`  network : ${plan.network}`);
+    print(`  signer  : ${plan.signer}`);
+    for (const line of plan.lines)
+        print(`  ${line}`);
+    if (plan.fee) {
+        const amount = plan.fee.amount.map((c) => `${c.amount}${c.denom}`).join(",");
+        print(`  fee     : ${amount} (gas ${plan.fee.gas})`);
+    }
+    if (!yes) {
+        print("\n  DRY RUN — nothing signed, nothing broadcast. Re-run with --yes to execute.\n");
+        exit(0);
+    }
+    print(`  --yes given — ${opts.proceeding ?? "signing and broadcasting…"}\n`);
+}
+/** Signs + broadcasts `msgs` as `signer`, returns the tx hash, throws with the raw log on failure. */
+export async function broadcast(signer, msgs, memo, fee = STANDARD_FEE) {
+    const res = (await signer.client.signAndBroadcast(signer.address, msgs, fee, memo));
+    if (res.code !== 0)
+        throw new Error(`tx failed (code ${res.code}): ${res.rawLog}`);
+    return { hash: res.transactionHash, res };
+}
+// --- iid message builders -------------------------------------------------------------------------
+/** `MsgAddService`. Async: `@ixo/impactxclient-sdk` is lazy-imported (heavy proto/crypto deps). */
+export async function addServiceMsg(entityDid, service, signer) {
+    const { ixo } = await import("@ixo/impactxclient-sdk");
+    return {
+        typeUrl: "/ixo.iid.v1beta1.MsgAddService",
+        value: ixo.iid.v1beta1.MsgAddService.fromPartial({
+            id: entityDid,
+            serviceData: ixo.iid.v1beta1.Service.fromPartial(service),
+            signer,
+        }),
+    };
+}
+/**
+ * `MsgAddLinkedResource` — the one builder behind every anchored document (`#vct`/`#rub` from
+ * `publish-protocol`, `#orz`/`#pro` from `oracle init`). The caller passes the resource whole: every
+ * field is part of what the chain records permanently, so none of them gets a default here.
+ *
+ * Refused by the chain when the id already exists (`duplicated resource id`, x/iid/types/iid.go) —
+ * replacing one means `deleteLinkedResourceMsg` FIRST, same tx.
+ */
+export async function addLinkedResourceMsg(entityDid, resource, signer) {
+    const { ixo } = await import("@ixo/impactxclient-sdk");
+    return {
+        typeUrl: "/ixo.iid.v1beta1.MsgAddLinkedResource",
+        value: ixo.iid.v1beta1.MsgAddLinkedResource.fromPartial({
+            id: entityDid,
+            linkedResource: ixo.iid.v1beta1.LinkedResource.fromPartial(resource),
+            signer,
+        }),
+    };
+}
+/**
+ * `MsgDeleteLinkedResource`. `resourceId` must be the id EXACTLY as the chain stores it — which is
+ * the UNEXPANDED `{id}#rub` literal (blocksync reports it that way, and the keeper matches
+ * `s.Id == resourceID` with no expansion). Pass the id straight off the resolved entity; never
+ * rebuild it from the DID.
+ */
+export async function deleteLinkedResourceMsg(entityDid, resourceId, signer) {
+    const { ixo } = await import("@ixo/impactxclient-sdk");
+    return {
+        typeUrl: "/ixo.iid.v1beta1.MsgDeleteLinkedResource",
+        value: ixo.iid.v1beta1.MsgDeleteLinkedResource.fromPartial({
+            id: entityDid,
+            resourceId,
+            signer,
+        }),
+    };
+}
+/**
+ * `MsgDeleteService`. The counterpart of `addServiceMsg`, and only ever broadcast in the SAME tx as
+ * the add that replaces it — qiforge's `updateOracleDomain` (`src/utils/entity.ts:199-256`) is the
+ * same pair, because an entity between the two is an entity with no API endpoint at all. `serviceId`
+ * is the `{id}#frag` form the chain stores, not the expanded DID.
+ */
+export async function deleteServiceMsg(entityDid, serviceId, signer) {
+    const { ixo } = await import("@ixo/impactxclient-sdk");
+    return {
+        typeUrl: "/ixo.iid.v1beta1.MsgDeleteService",
+        value: ixo.iid.v1beta1.MsgDeleteService.fromPartial({ id: entityDid, serviceId, signer }),
+    };
+}
+/** The AuthHub session as a `DocSigner` — the entity OWNER for every doc this CLI anchors. */
+export function sessionDocSigner(signer) {
+    return {
+        did: signer.did,
+        edMnemonic: signer.session.edSigningMnemonic ??
+            fail("AuthHub session has no edSigningMnemonic — re-run login"),
+    };
+}
+/** The one Vault subtree this CLI writes, and the scope of every token it mints for it. */
+const VAULT_SCOPE = "/eval-oracle";
+/**
+ * Store a public document and return where it lives, by content address: the IXO Vault first
+ * (`POST {vfs}/api/fs/files?public=true` under a one-write UCAN from `signer`'s ed25519 key, into
+ * its own namespace — served to anyone at `{vfs}/public/cid/<cid>`), else IXO's IPFS gateway
+ * (`POST {gateway}/upload`, open — `{gateway}/ipfs/<cid>`). OpenHands 2f7857a (`chain/store.ts`
+ * `uploadDoc`) is the same two doors. Nothing is written to Matrix media any more (its
+ * unauthenticated reads may stop answering one day); reading it stays supported (`readLinkedDoc`).
+ * A Vault refusal is printed, never fatal: the gateway takes the doc.
+ *
+ * `cid` is the raw-sha256 CIDv1 of `bytes` (both stores address a ≤1 MiB file that way), checked
+ * against what the store answered. The caller still picks the resource's `proof` (CLAUDE.md):
+ * sha256 hex for `#vct`/`#rub`/`#orz`, this CID for `#pro`/`#dmn`/`#acard`.
+ */
+export async function uploadDoc(network, signer, bytes, filename, contentType) {
+    const cid = await cidForBytes(bytes);
+    const { vfs, ipfsGateway } = NETWORKS[network];
+    const vault = vfs.replace(/\/+$/, "");
+    let refused;
+    try {
+        const path = `${VAULT_SCOPE}/${network}/${Date.now().toString(36)}-${filename}`;
+        const res = await fetch(`${vault}/api/fs/files?path=${encodeURIComponent(path)}&public=true`, {
+            method: "POST",
+            headers: {
+                authorization: `Bearer ${await vaultWriteToken(signer, vault)}`,
+                "content-type": contentType,
+            },
+            body: bytes,
+        });
+        if (res.ok) {
+            const stored = (await res.json()).cid;
+            if (stored === cid)
+                return { url: `${vault}/public/cid/${cid}`, cid };
+            refused = `stored as ${stored}, not ${cid}`;
+        }
+        else {
+            refused = `${res.status} ${(await res.text()).slice(0, 200)}`;
+        }
+    }
+    catch (err) {
+        refused = String(err);
+    }
+    console.error(`⚠ the Vault refused ${filename} for ${signer.did} (${refused}) — using the IPFS gateway`);
+    const gateway = ipfsGateway.replace(/\/+$/, "");
+    const res = await fetch(`${gateway}/upload`, {
+        method: "POST",
+        headers: { "content-type": contentType, "x-file-name": filename },
+        body: bytes,
+    });
+    if (!res.ok)
+        fail(`IPFS gateway upload ${filename}: ${res.status} ${await res.text()}`);
+    const stored = (await res.json()).cid;
+    if (stored !== cid)
+        fail(`IPFS gateway stored ${filename} as ${stored}, not ${cid}`);
+    return { url: `${gateway}/ipfs/${cid}`, cid };
+}
+/** A single-use `fs/write` UCAN for `signer`'s own `VAULT_SCOPE` subtree, addressed to the Vault's
+ *  did:web — the nonce because the Vault refuses a token it has seen (Ed25519 is deterministic). */
+async function vaultWriteToken(signer, vault) {
+    const ucan = await import("@ixo/ucan");
+    const { signer: key } = await ucan.signerFromMnemonic(signer.edMnemonic, signer.did);
+    const invocation = await ucan.createInvocation({
+        issuer: key,
+        audience: `did:web:${new URL(vault).host}`,
+        capability: { can: "fs/write", with: `ixo:filesystem${VAULT_SCOPE}` },
+        proofs: [],
+        expiration: Math.floor(Date.now() / 1000) + 300,
+        facts: [{ nonce: crypto.randomUUID() }],
+    });
+    return ucan.serializeInvocation(invocation);
+}
+/**
+ * `MsgAddLinkedEntity` — a ~10-line port of impacts-x-web's `helpers/signX.ts`
+ * (`generateAddLinkedEntityTrx`), the portal's own builder for this exact message. `oracle init`
+ * uses it to anchor the oracle→protocol `relationship: "protocol"` edge the marketplace query reads.
+ */
+export async function addLinkedEntityMsg(entityDid, linkedEntity, signer) {
+    const { ixo } = await import("@ixo/impactxclient-sdk");
+    return {
+        typeUrl: "/ixo.iid.v1beta1.MsgAddLinkedEntity",
+        value: ixo.iid.v1beta1.MsgAddLinkedEntity.fromPartial({
+            id: entityDid,
+            linkedEntity: ixo.iid.v1beta1.LinkedEntity.fromPartial(linkedEntity),
+            signer,
+        }),
+    };
+}
+// --- misc ---------------------------------------------------------------------------------------
+/** sha256 hex of bytes — the rubric/#vct proof convention. */
+export async function sha256Hex(bytes) {
+    return createHash("sha256").update(bytes).digest("hex");
+}
+/**
+ * A Matrix access token for the AuthHub session's OWN Matrix user, minted the way the portal does on
+ * every AuthHub sign-in (impacts-x-web `hooks/useAuthHubLogin.ts` → `utils/matrix.ts`
+ * `generatePasswordFromMnemonic`): the hub hands back `matrixMnemonic` in the clear, never a token,
+ * and the account's password is `matrixPassword`'s derivation — the SAME one the oracle's own
+ * account is created with (matrix-account.ts), which is why it lives there and not here.
+ *
+ * It MUST be this user, not an oracle's bot token: the rooms-bot invites the UCAN issuer (the session
+ * DID) into a sourced room, and the claim-bot invite sets power levels — both need the entity
+ * OWNER's Matrix account (an oracle's token fails the join with `M_FORBIDDEN You are not invited to
+ * this room`). The homeserver is `NETWORKS[network].matrix`, the ONE endpoint source — asserted
+ * against the session's, so a session from another network fails here with a clear message instead
+ * of a 403 later.
+ */
+export async function matrixLoginFromSession(signer) {
+    const { session } = signer;
+    const mnemonic = session.matrixMnemonic ?? fail("AuthHub session has no matrixMnemonic — re-run login");
+    const userId = session.matrixUserId ?? fail("AuthHub session has no matrixUserId — re-run login");
+    const homeserver = NETWORKS[signer.network].matrix.replace(/\/+$/, "");
+    const sessionHome = session.matrixHomeserver?.replace(/\/+$/, "");
+    if (sessionHome && sessionHome !== homeserver) {
+        fail(`AuthHub session's Matrix home ${sessionHome} is not ${signer.network}'s ${homeserver}`);
+    }
+    const password = matrixPassword(mnemonic);
+    const res = await fetch(`${homeserver}/_matrix/client/v3/login`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+            type: "m.login.password",
+            identifier: { type: "m.id.user", user: userId },
+            password,
+            initial_device_display_name: "decision-oracle CLI",
+        }),
+    });
+    if (!res.ok)
+        fail(`Matrix login as ${userId} failed: ${res.status} ${await res.text()}`);
+    const { access_token } = (await res.json());
+    return access_token;
+}
+// --- entities + their Matrix rooms (shared by publish-protocol and create-deed) ------------------
+/** Pulls the first `did:ixo:entity:…` string out of a MsgCreateEntity tx's events. */
+export function entityDidFromEvents(events) {
+    return events
+        ?.flatMap((e) => e.attributes)
+        .map((a) => {
+        try {
+            return JSON.parse(a.value);
+        }
+        catch {
+            return a.value;
+        }
+    })
+        .flatMap((v) => (typeof v === "object" && v !== null ? Object.values(v) : [v]))
+        .find((v) => typeof v === "string" && v.startsWith("did:ixo:entity:"));
+}
+/**
+ * `MsgCreateEntity` of the given `entityType` (`protocol/verifiableClaim`, `deed`, …), owned and
+ * controlled by the AuthHub session's DID. Plan-print (dry run) never needs the message built —
+ * only after the `--yes` gate returns do we touch `signer.getPubkey()` (session-mnemonic
+ * derivation), so a dry run stays wallet-free even for entity creation. See
+ * `PublishSigner.getPubkey`'s doc comment.
+ *
+ * `opts.linkedResources` is built only past the gate too (`org create` uploads its `#pro` there),
+ * and `opts.print` takes the plan and the result line where a caller's stdout must stay JSON.
+ */
+export async function createEntity(signer, entityType, yes, opts = {}) {
+    const print = opts.print ?? console.log;
+    confirm({
+        network: signer.network,
+        signer: signer.address,
+        action: `MsgCreateEntity (${entityType})`,
+        lines: [
+            `owner: ${signer.did}`,
+            `relayerNode: ${NETWORKS[signer.network].relayerNodeDid}`,
+            ...(opts.lines ?? []),
+        ],
+        fee: STANDARD_FEE,
+    }, yes, { print });
+    const linkedResource = (await opts.linkedResources?.()) ?? [];
+    const { customMessages, ixo } = await import("@ixo/impactxclient-sdk");
+    const msg = {
+        typeUrl: "/ixo.entity.v1beta1.MsgCreateEntity",
+        value: ixo.entity.v1beta1.MsgCreateEntity.fromPartial({
+            entityType,
+            entityStatus: 0,
+            context: [],
+            verification: customMessages.iid.createIidVerificationMethods({
+                did: signer.did,
+                pubkey: await signer.getPubkey(),
+                address: signer.address,
+                controller: signer.did,
+                type: "secp",
+            }),
+            controller: [signer.did],
+            ownerAddress: signer.address,
+            ownerDid: signer.did,
+            relayerNode: NETWORKS[signer.network].relayerNodeDid,
+            linkedResource: linkedResource.map((r) => ixo.iid.v1beta1.LinkedResource.fromPartial(r)),
+        }),
+    };
+    const { hash, res } = await broadcast(signer, [msg], opts.memo ?? `create-entity: ${entityType}`);
+    const entityDid = entityDidFromEvents(res.events);
+    if (!entityDid)
+        fail(`entity created (tx ${hash}) but the DID could not be read from tx events`);
+    print(`✓ entity created: ${entityDid} (tx ${hash})`);
+    return entityDid;
+}
+/** The UCAN `with` each bot checks — the same resources the portal and qiforge mint for. */
+const BOT_RESOURCES = {
+    stateBot: "ixo:matrix-state-bot",
+    roomsBot: "ixo:matrix-rooms-bot",
+    claimBot: "ixo:matrix-claims-bot",
+};
+/**
+ * The homeserver an entity names in its `MatrixHomeServer` service, else the network's own — and
+ * the bot hosts derived from it (`<bot>.bot.<homeserver host>`), exactly as the portal resolves them.
+ */
+export async function matrixUrlsForDid(network, did) {
+    const { services } = await resolveEntity(NETWORKS[network].blocksync, did);
+    const endpoint = services
+        .find((s) => s.type === "MatrixHomeServer")
+        ?.serviceEndpoint.replace(/\s+/g, "");
+    const homeServer = (endpoint
+        ? /^https?:\/\//.test(endpoint)
+            ? endpoint
+            : `https://${endpoint}`
+        : NETWORKS[network].matrix).replace(/\/+$/, "");
+    const host = new URL(homeServer).hostname;
+    return {
+        homeServer,
+        homeServerCropped: host,
+        stateBot: `https://state.bot.${host}`,
+        roomsBot: `https://rooms.bot.${host}`,
+        claimBot: `https://claim.bot.${host}`,
+    };
+}
+/**
+ * The rooms/claim/state bots for this session, addressed by entity DID: every bot call carries a
+ * self-signed UCAN from the session's `edSigningMnemonic` (audience = the bot's own did.json, one
+ * token per bot for the run), and — when `matrixToken` is given — Matrix itself (join, invite,
+ * power levels) runs as the session's own user.
+ */
+export async function matrixBots(signer, matrixToken) {
+    const edSigningMnemonic = signer.session.edSigningMnemonic ??
+        fail("AuthHub session has no edSigningMnemonic — re-run login");
+    const [sdk, ucanLib] = await Promise.all([import("@ixo/matrixclient-sdk"), import("@ixo/ucan")]);
+    const accessToken = matrixToken ? await matrixToken() : undefined;
+    const ucanSigner = ucanLib
+        .signerFromMnemonic(edSigningMnemonic, signer.did)
+        .then((s) => s.signer);
+    const tokens = new Map();
+    const urlsFor = (did) => matrixUrlsForDid(signer.network, did);
+    /** A UCAN for `bot` of `did`'s homeserver — minted once per bot per run (1h, the CLI is short-lived). */
+    async function ucan(did, bot) {
+        const botUrl = (await urlsFor(did))[bot];
+        let token = tokens.get(botUrl);
+        if (!token) {
+            token = (async () => {
+                const res = await fetch(`${botUrl}/.well-known/did.json`);
+                if (!res.ok)
+                    throw new Error(`${botUrl}/.well-known/did.json returned ${res.status}`);
+                const { id } = (await res.json());
+                const invocation = await ucanLib.createInvocation({
+                    issuer: await ucanSigner,
+                    audience: id,
+                    capability: { can: "*", with: BOT_RESOURCES[bot] },
+                    proofs: [],
+                    expiration: Math.floor(Date.now() / 1000) + 3600,
+                });
+                return ucanLib.serializeInvocation(invocation);
+            })();
+            tokens.set(botUrl, token);
+            // A failed did.json read is not remembered: the next call for this bot tries again.
+            token.catch(() => tokens.delete(botUrl));
+        }
+        return token;
+    }
+    return {
+        urls: urlsFor,
+        ucan,
+        /** The entity's room, by its alias `#<did with : → ->:<homeserver host>`. */
+        async roomId(did) {
+            const urls = await urlsFor(did);
+            const alias = `#${did.replaceAll(":", "-")}:${urls.homeServerCropped}`;
+            const { room_id } = await sdk
+                .createMatrixApiClient({ homeServerUrl: urls.homeServer })
+                .room.v1beta1.queryId(alias);
+            return room_id;
+        },
+        /** One room-state value through the state bot (`queryState`). */
+        async readState(did, roomId, key, path) {
+            const urls = await urlsFor(did);
+            const stateBot = sdk.createMatrixStateBotClient({
+                botUrl: urls.stateBot,
+                accessToken,
+                homeServerUrl: urls.homeServer,
+            });
+            return (await stateBot.state.v1beta1.queryState(roomId, key, path, await ucan(did, "stateBot"))).data;
+        },
+        /** Rooms-bot `sourceRoomAndJoin` (created iff missing), then the claim bot invited into it. */
+        async sourceRoom(did) {
+            const urls = await urlsFor(did);
+            const { roomId } = await sdk
+                .createMatrixRoomBotClient({
+                botUrl: urls.roomsBot,
+                accessToken: accessToken ?? "",
+                homeServerUrl: urls.homeServer,
+            })
+                .room.v1beta1.sourceRoomAndJoin(did, await ucan(did, "roomsBot"));
+            await sdk
+                .createMatrixClaimBotClient({
+                botUrl: urls.claimBot,
+                accessToken,
+                homeServerUrl: urls.homeServer,
+            })
+                .bot.v1beta1.invite(roomId);
+            return roomId;
+        },
+        /** A claim body saved into `collectionId` via the claim bot — the returned `data.cid` IS the claimId. */
+        async saveClaim(did, collectionId, claim) {
+            const urls = await urlsFor(did);
+            return sdk
+                .createMatrixClaimBotClient({
+                botUrl: urls.claimBot,
+                accessToken,
+                homeServerUrl: urls.homeServer,
+            })
+                .claim.v1beta1.saveClaim(collectionId, JSON.stringify(claim), await ucan(did, "claimBot"));
+        },
+    };
+}
+/**
+ * Source the entity's Matrix room (idempotent — created iff missing) and invite BOTH bots into it,
+ * the way the portal's `setupMatrixRoom` does (impacts-x-webapp `storage/matrix.ts`
+ * `sourceRoomAndJoin`): the claim bot, or every submission against the entity is
+ * IXO_ROOM_NOT_FOUND; and the state bot, or nothing can read or write the room's state — which is
+ * where a deed's claims-config doc lives (`create-deed`; without it the state-bot answers "You do
+ * not have permission to edit state"). Each invite also raises the bot's power level, so both run
+ * as the session's own Matrix user — the room's creator — which is why `matrixToken` must be
+ * `matrixLoginFromSession`'s.
+ */
+export async function sourceEntityRoom(signer, entityDid, matrixToken, yes) {
+    confirm({
+        network: signer.network,
+        signer: signer.did,
+        action: "source Matrix room (rooms-bot) + invite the claim bot and the state bot",
+        lines: [
+            `entity: ${entityDid}`,
+            "mints a self-signed UCAN (the AuthHub session's edSigningMnemonic) to call the rooms-bot",
+        ],
+    }, yes);
+    const bots = await matrixBots(signer, matrixToken);
+    const roomId = await bots.sourceRoom(entityDid);
+    // `sourceRoom` invites only the claim bot; the state bot's invite is the same SDK call against
+    // the state bot's URL.
+    const { createMatrixStateBotClient } = await import("@ixo/matrixclient-sdk");
+    const urls = await bots.urls(entityDid);
+    await createMatrixStateBotClient({
+        botUrl: urls.stateBot,
+        accessToken: await matrixToken(),
+        homeServerUrl: urls.homeServer,
+    }).bot.v1beta1.invite(roomId);
+    console.log(`✓ room sourced for ${entityDid}: ${roomId} (claim bot + state bot invited)`);
+    return roomId;
+}
+//# sourceMappingURL=chain.js.map

package/dist/cli/lib/chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain.js","sourceRoot":"","sources":["../../../src/cli/lib/chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,OAAO,MAAM,cAAc,CAAC;AAGnC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAmB,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGlD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAAwB;IACrD,MAAM,IAAI,GAAG,IAAI,IAAI,QAAQ,CAAC;IAC9B,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAClE,IAAI,CAAC,sBAAsB,IAAI,4BAA4B,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,IAAI,GAA4B,OAAO,CAAC,IAAI,CAAC;AAEnD;;;;GAIG;AACH,MAAM,UAAU,IAAI,CAAC,OAAe;IAClC,OAAO,CAAC,KAAK,CAAC,OAAO,OAAO,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,CAAC,CAAC,CAAC;AACV,CAAC;AA2CD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,YAAoB,EACpB,KAAa,EACb,SAAkC;IAElC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE;QACpC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;KAC3C,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,CAAC,MAAM,KAAK,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACtF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqC,CAAC;IACpE,IAAI,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACrF,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC3E,OAAO,IAAI,CAAC,IAAI,CAAC;AACnB,CAAC;AAuBD,MAAM,oBAAoB,GAAG;;;IAGzB,CAAC;AAEL;8CAC8C;AAC9C,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,YAAoB,EAAE,GAAW;IACnE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAUxB,YAAY,EAAE,oBAAoB,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACpD,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IACtB,OAAO;QACL,KAAK,EAAE,CAAC,EAAE,KAAK,IAAI,IAAI;QACvB,YAAY,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,EAAE,OAAO,IAAI,IAAI;QAC3E,IAAI,EAAE,CAAC,EAAE,IAAI,IAAI,IAAI;QACrB,eAAe,EAAE,CAAC,EAAE,cAAc,IAAI,EAAE;QACxC,QAAQ,EAAE,CAAC,EAAE,OAAO,IAAI,EAAE;QAC1B,cAAc,EAAE,CAAC,EAAE,YAAY,IAAI,EAAE;QACrC,YAAY,EAAE,CAAC,EAAE,WAAW,IAAI,EAAE;KACnC,CAAC;AACJ,CAAC;AAED,MAAM,gBAAgB,GAAG;;;;;;;IAOrB,CAAC;AAEL;;yFAEyF;AACzF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,YAAoB,EACpB,SAAiB,EACjB,WAAmB;IAEnB,MAAM,IAAI,GAAG,MAAM,QAAQ,CACzB,YAAY,EACZ,gBAAgB,EAChB,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC7C,CAAC;IACF,OAAO,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAChD,CAAC;AAED,MAAM,sBAAsB,GAAG;;;IAG3B,CAAC;AAEL;+EAC+E;AAC/E,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,YAAoB,EACpB,YAAoB;IAEpB,MAAM,IAAI,GAAG,MAAM,QAAQ,CACzB,YAAY,EACZ,sBAAsB,EACtB,EAAE,EAAE,EAAE,YAAY,EAAE,CACrB,CAAC;IACF,OAAO,IAAI,CAAC,eAAe,CAAC;AAC9B,CAAC;AAOD,MAAM,yBAAyB,GAAG;;;;;IAK9B,CAAC;AAEL;;;yEAGyE;AACzE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,YAAoB,EACpB,YAAoB;IAEpB,MAAM,IAAI,GAAG,MAAM,QAAQ,CACzB,YAAY,EACZ,yBAAyB,EACzB,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,mBAAmB,CAAC,EAAE,CAChE,CAAC;IACF,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;AAC7B,CAAC;AAED,mGAAmG;AAEnG,4EAA4E;AAC5E,MAAM,CAAC,MAAM,YAAY,GAAW;IAClC,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC7C,GAAG,EAAE,SAAS;CACf,CAAC;AAcF;;;;;;;;GAQG;AACH,MAAM,UAAU,OAAO,CAAC,IAAiB,EAAE,GAAY,EAAE,IAAI,GAAmB,EAAE;IAChF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC;IACxC,KAAK,CAAC,QAAQ,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;IAChC,KAAK,CAAC,eAAe,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACrC,KAAK,CAAC,eAAe,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK;QAAE,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAClD,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7E,KAAK,CAAC,eAAe,MAAM,SAAS,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,KAAK,CAAC,kFAAkF,CAAC,CAAC;QAC1F,IAAI,CAAC,CAAC,CAAC,CAAC;IACV,CAAC;IACD,KAAK,CAAC,mBAAmB,IAAI,CAAC,UAAU,IAAI,2BAA2B,IAAI,CAAC,CAAC;AAC/E,CAAC;AASD,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAqB,EACrB,IAAoB,EACpB,IAAY,EACZ,GAAG,GAAW,YAAY;IAE1B,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAC/C,MAAM,CAAC,OAAO,EACd,IAAI,EACJ,GAAG,EACH,IAAI,CACL,CAAsB,CAAC;IACxB,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACnF,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC;AAC5C,CAAC;AAED,qGAAqG;AAErG,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,SAAiB,EACjB,OAA8D,EAC9D,MAAc;IAEd,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;IACvD,OAAO;QACL,OAAO,EAAE,gCAAgC;QACzC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,WAAW,CAAC;YAC/C,EAAE,EAAE,SAAS;YACb,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC;YACzD,MAAM;SACP,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,SAAiB,EACjB,QAAwB,EACxB,MAAc;IAEd,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;IACvD,OAAO;QACL,OAAO,EAAE,uCAAuC;QAChD,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAC,WAAW,CAAC;YACtD,EAAE,EAAE,SAAS;YACb,cAAc,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,QAAQ,CAAC;YACpE,MAAM;SACP,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,SAAiB,EACjB,UAAkB,EAClB,MAAc;IAEd,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;IACvD,OAAO;QACL,OAAO,EAAE,0CAA0C;QACnD,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,uBAAuB,CAAC,WAAW,CAAC;YACzD,EAAE,EAAE,SAAS;YACb,UAAU;YACV,MAAM;SACP,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,SAAiB,EACjB,SAAiB,EACjB,MAAc;IAEd,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;IACvD,OAAO;QACL,OAAO,EAAE,mCAAmC;QAC5C,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;KAC1F,CAAC;AACJ,CAAC;AAQD,8FAA8F;AAC9F,MAAM,UAAU,gBAAgB,CAAC,MAAqB;IACpD,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,UAAU,EACR,MAAM,CAAC,OAAO,CAAC,iBAAiB;YAChC,IAAI,CAAC,yDAAyD,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,2FAA2F;AAC3F,MAAM,WAAW,GAAG,cAAc,CAAC;AAEnC;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAAmB,EACnB,MAAiB,EACjB,KAAiB,EACjB,QAAgB,EAChB,WAAmB;IAEnB,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtC,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,WAAW,IAAI,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,QAAQ,EAAE,CAAC;QAChF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,KAAK,sBAAsB,kBAAkB,CAAC,IAAI,CAAC,cAAc,EAAE;YAC5F,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,MAAM,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE;gBAC/D,cAAc,EAAE,WAAW;aAC5B;YACD,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,MAAM,MAAM,GAAI,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsB,CAAC,GAAG,CAAC;YAC5D,IAAI,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK,eAAe,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC;YACtE,OAAO,GAAG,aAAa,MAAM,SAAS,GAAG,EAAE,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QAChE,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,CAAC,KAAK,CACX,uBAAuB,QAAQ,QAAQ,MAAM,CAAC,GAAG,KAAK,OAAO,4BAA4B,CAC1F,CAAC;IACF,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,SAAS,EAAE;QAC3C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,aAAa,EAAE,QAAQ,EAAE;QACjE,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,IAAI,CAAC,uBAAuB,QAAQ,KAAK,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACxF,MAAM,MAAM,GAAI,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsB,CAAC,GAAG,CAAC;IAC5D,IAAI,MAAM,KAAK,GAAG;QAAE,IAAI,CAAC,uBAAuB,QAAQ,OAAO,MAAM,SAAS,GAAG,EAAE,CAAC,CAAC;IACrF,OAAO,EAAE,GAAG,EAAE,GAAG,OAAO,SAAS,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC;AAChD,CAAC;AAED;oGACoG;AACpG,KAAK,UAAU,eAAe,CAAC,MAAiB,EAAE,KAAa;IAC7D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CACnD,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,GAA0B,CAClC,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC;QAC7C,MAAM,EAAE,GAAG;QACX,QAAQ,EAAE,WAAW,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE;QAC1C,UAAU,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB,WAAW,EAAE,EAAE;QACrE,MAAM,EAAE,EAAE;QACV,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG;QAC/C,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;KACO,CAAC,CAAC;IAClD,OAAO,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAAiB,EACjB,YAAiF,EACjF,MAAc;IAEd,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;IACvD,OAAO;QACL,OAAO,EAAE,qCAAqC;QAC9C,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,WAAW,CAAC;YACpD,EAAE,EAAE,SAAS;YACb,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,WAAW,CAAC,YAAY,CAAC;YACpE,MAAM;SACP,CAAC;KACH,CAAC;AACJ,CAAC;AAED,mGAAmG;AAEnG,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAiB;IAC/C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,MAAqB;IAChE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IAC3B,MAAM,QAAQ,GACZ,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC,sDAAsD,CAAC,CAAC;IACzF,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,oDAAoD,CAAC,CAAC;IAClG,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvE,MAAM,WAAW,GAAG,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClE,IAAI,WAAW,IAAI,WAAW,KAAK,UAAU,EAAE,CAAC;QAC9C,IAAI,CAAC,iCAAiC,WAAW,WAAW,MAAM,CAAC,OAAO,MAAM,UAAU,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,0BAA0B,EAAE;QAC/D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,IAAI,EAAE,kBAAkB;YACxB,UAAU,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE;YAC/C,QAAQ;YACR,2BAA2B,EAAE,qBAAqB;SACnD,CAAC;KACH,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,IAAI,CAAC,mBAAmB,MAAM,YAAY,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACzF,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA6B,CAAC;IACxE,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,oGAAoG;AAEpG,sFAAsF;AACtF,MAAM,UAAU,mBAAmB,CAAC,MAAoC;IACtE,OAAO,MAAM;QACX,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;SAC7B,GAAG,CAAC,CAAC,CAAC,EAAW,EAAE;QAClB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,KAAK,CAAC;QACjB,CAAC;IACH,CAAC,CAAC;SACD,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAC9E,IAAI,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAqB,EACrB,UAAkB,EAClB,GAAY,EACZ,IAAI,GAKA,EAAE;IAEN,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC;IACxC,OAAO,CACL;QACE,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM,EAAE,MAAM,CAAC,OAAO;QACtB,MAAM,EAAE,oBAAoB,UAAU,GAAG;QACzC,KAAK,EAAE;YACL,UAAU,MAAM,CAAC,GAAG,EAAE;YACtB,gBAAgB,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,cAAc,EAAE;YACzD,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;SACtB;QACD,GAAG,EAAE,YAAY;KAClB,EACD,GAAG,EACH,EAAE,KAAK,EAAE,CACV,CAAC;IAEF,MAAM,cAAc,GAAG,CAAC,MAAM,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IAC9D,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG;QACV,OAAO,EAAE,qCAAqC;QAC9C,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,WAAW,CAAC;YACpD,UAAU;YACV,YAAY,EAAE,CAAC;YACf,OAAO,EAAE,EAAE;YACX,YAAY,EAAE,cAAc,CAAC,GAAG,CAAC,4BAA4B,CAAC;gBAC5D,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,MAAM,EAAE,MAAM,MAAM,CAAC,SAAS,EAAE;gBAChC,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,UAAU,EAAE,MAAM,CAAC,GAAG;gBACtB,IAAI,EAAE,MAAM;aACb,CAAC;YACF,UAAU,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC;YACxB,YAAY,EAAE,MAAM,CAAC,OAAO;YAC5B,QAAQ,EAAE,MAAM,CAAC,GAAG;YACpB,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,cAAc;YACpD,cAAc,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;SACzF,CAAC;KACH,CAAC;IACF,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,kBAAkB,UAAU,EAAE,CAAC,CAAC;IAClG,MAAM,SAAS,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,CAAC,SAAS;QAAE,IAAI,CAAC,sBAAsB,IAAI,gDAAgD,CAAC,CAAC;IACjG,KAAK,CAAC,qBAAqB,SAAS,QAAQ,IAAI,GAAG,CAAC,CAAC;IACrD,OAAO,SAAS,CAAC;AACnB,CAAC;AAcD,4FAA4F;AAC5F,MAAM,aAAa,GAA6C;IAC9D,QAAQ,EAAE,sBAAsB;IAChC,QAAQ,EAAE,sBAAsB;IAChC,QAAQ,EAAE,uBAAuB;CAClC,CAAC;AAQF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAmB,EAAE,GAAW;IACrE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,QAAQ;SACtB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC;QAC3C,EAAE,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,CACjB,QAAQ;QACN,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC7B,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,WAAW,QAAQ,EAAE;QACzB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,CAC7B,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC;IAC1C,OAAO;QACL,UAAU;QACV,iBAAiB,EAAE,IAAI;QACvB,QAAQ,EAAE,qBAAqB,IAAI,EAAE;QACrC,QAAQ,EAAE,qBAAqB,IAAI,EAAE;QACrC,QAAQ,EAAE,qBAAqB,IAAI,EAAE;KACtC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAqB,EAAE,WAAmC;IACzF,MAAM,iBAAiB,GACrB,MAAM,CAAC,OAAO,CAAC,iBAAiB;QAChC,IAAI,CAAC,yDAAyD,CAAC,CAAC;IAClE,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACjG,MAAM,WAAW,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,MAAM,UAAU,GAAG,OAAO;SACvB,kBAAkB,CAAC,iBAAiB,EAAE,MAAM,CAAC,GAA0B,CAAC;SACxE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;IAClD,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAEvE,yGAAyG;IACzG,KAAK,UAAU,IAAI,CAAC,GAAW,EAAE,GAAc;QAC7C,MAAM,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE;gBAClB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,uBAAuB,CAAC,CAAC;gBAC1D,IAAI,CAAC,GAAG,CAAC,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,kCAAkC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;gBACtF,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmB,CAAC;gBACpD,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC;oBAChD,MAAM,EAAE,MAAM,UAAU;oBACxB,QAAQ,EAAE,EAAE;oBACZ,UAAU,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE;oBAClD,MAAM,EAAE,EAAE;oBACV,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI;iBACjD,CAAC,CAAC;gBACH,OAAO,OAAO,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC;YACjD,CAAC,CAAC,EAAE,CAAC;YACL,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC1B,oFAAoF;YACpF,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO;QACL,IAAI,EAAE,OAAO;QACb,IAAI;QACJ,6EAA6E;QAC7E,KAAK,CAAC,MAAM,CAAC,GAAW;YACtB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;YAChC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG;iBAC1B,qBAAqB,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;iBACzD,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC/B,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,iEAAiE;QACjE,KAAK,CAAC,SAAS,CAAC,GAAW,EAAE,MAAc,EAAE,GAAW,EAAE,IAAY;YACpE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;YAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,0BAA0B,CAAC;gBAC9C,MAAM,EAAE,IAAI,CAAC,QAAQ;gBACrB,WAAW;gBACX,aAAa,EAAE,IAAI,CAAC,UAAU;aAC/B,CAAC,CAAC;YACH,OAAO,CACL,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CACxF,CAAC,IAAI,CAAC;QACT,CAAC;QACD,+FAA+F;QAC/F,KAAK,CAAC,UAAU,CAAC,GAAW;YAC1B,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;YAChC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG;iBACzB,yBAAyB,CAAC;gBACzB,MAAM,EAAE,IAAI,CAAC,QAAQ;gBACrB,WAAW,EAAE,WAAW,IAAI,EAAE;gBAC9B,aAAa,EAAE,IAAI,CAAC,UAAU;aAC/B,CAAC;iBACD,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC;YACpE,MAAM,GAAG;iBACN,0BAA0B,CAAC;gBAC1B,MAAM,EAAE,IAAI,CAAC,QAAQ;gBACrB,WAAW;gBACX,aAAa,EAAE,IAAI,CAAC,UAAU;aAC/B,CAAC;iBACD,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9B,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,yGAAyG;QACzG,KAAK,CAAC,SAAS,CAAC,GAAW,EAAE,YAAoB,EAAE,KAAc;YAC/D,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;YAChC,OAAO,GAAG;iBACP,0BAA0B,CAAC;gBAC1B,MAAM,EAAE,IAAI,CAAC,QAAQ;gBACrB,WAAW;gBACX,aAAa,EAAE,IAAI,CAAC,UAAU;aAC/B,CAAC;iBACD,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC;QAC/F,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAqB,EACrB,SAAiB,EACjB,WAAkC,EAClC,GAAY;IAEZ,OAAO,CACL;QACE,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM,EAAE,MAAM,CAAC,GAAG;QAClB,MAAM,EAAE,yEAAyE;QACjF,KAAK,EAAE;YACL,WAAW,SAAS,EAAE;YACtB,0FAA0F;SAC3F;KACF,EACD,GAAG,CACJ,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAChD,+FAA+F;IAC/F,uBAAuB;IACvB,MAAM,EAAE,0BAA0B,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,0BAA0B,CAAC;QAC/B,MAAM,EAAE,IAAI,CAAC,QAAQ;QACrB,WAAW,EAAE,MAAM,WAAW,EAAE;QAChC,aAAa,EAAE,IAAI,CAAC,UAAU;KAC/B,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,OAAO,CAAC,GAAG,CAAC,sBAAsB,SAAS,KAAK,MAAM,kCAAkC,CAAC,CAAC;IAC1F,OAAO,MAAM,CAAC;AAChB,CAAC"}