@jinn-network/client 0.1.2 → 0.1.3-canary.24b69ea4

package/dist/harnesses/capability/index.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Capability handles passed to a {@link Harness} via
+ * {@link HarnessContext}. The daemon mints these per-call and
+ * enforces the impl's manifest allow-list before delegating to the
+ * underlying signer / RPC client.
+ *
+ * Spec: `spec/2026-05-executor-trust-boundary.md` §3.
+ */
+import type { Address, Hex } from 'viem';
+/**
+ * EIP-712 typed-data signing payload. Mirrors viem's signTypedData
+ * input but with `account` removed — the daemon binds the signer to
+ * its master EOA before delegation.
+ */
+export interface SignTypedDataArgs {
+    domain: {
+        name?: string;
+        version?: string;
+        chainId?: number;
+        verifyingContract?: Address;
+    };
+    types: Record<string, Array<{
+        name: string;
+        type: string;
+    }>>;
+    primaryType: string;
+    message: Record<string, unknown>;
+}
+/**
+ * Allow-listed transaction shape. Each call's `(chainId, to, selector)`
+ * triple must match the impl's manifest capability allow-list; the
+ * daemon refuses calls outside the list.
+ */
+export interface SendAllowedCallArgs {
+    to: Address;
+    data: Hex;
+    value?: bigint;
+}
+/**
+ * Scoped signer — an impl never sees a raw private key. The daemon
+ * issues this handle per `run()` call, validates each request against
+ * the manifest allow-list, and discards it on return.
+ */
+export interface ScopedSigner {
+    /** EOA address the daemon will sign as. Read-only. */
+    readonly address: Address;
+    /** Sign EIP-712 typed data for an allow-listed domain. */
+    signTypedData(args: SignTypedDataArgs): Promise<Hex>;
+    /** Send a tx whose (chainId, to, selector) is on the impl allow-list. */
+    sendAllowedCall(call: SendAllowedCallArgs): Promise<Hex>;
+}
+/**
+ * Scoped RPC — read-only subset of viem's PublicClient interface.
+ * The daemon enforces method allow-list, rate limiting, and chain
+ * filtering per `spec/2026-05-executor-trust-boundary.md` §3.3.
+ */
+export interface ScopedRpc {
+    readContract(args: {
+        address: Address;
+        abi: readonly unknown[];
+        functionName: string;
+        args?: readonly unknown[];
+    }): Promise<unknown>;
+    getBlockNumber(): Promise<bigint>;
+    getBalance(args: {
+        address: Address;
+    }): Promise<bigint>;
+    getCode(args: {
+        address: Address;
+    }): Promise<Hex | undefined>;
+    getChainId(): Promise<number>;
+}
+/**
+ * Per-impl secret bag. Populated by the impl's own `onEnable` flow
+ * and persisted under `implStateDir/<impl>/secrets/`. Read-only.
+ */
+export type ScopedSecrets = Readonly<Record<string, string>>;
+export { createScopedSigner } from './scoped-signer.js';
+export type { CapabilityAllowEntry, CreateScopedSignerArgs, TypedDataAllowEntry, } from './scoped-signer.js';
+export { createScopedRpc } from './scoped-rpc.js';
+export type { CreateScopedRpcArgs } from './scoped-rpc.js';
+export { freezeSecrets } from './scoped-secrets.js';

package/dist/harnesses/capability/index.js

@@ -0,0 +1,12 @@
+/**
+ * Capability handles passed to a {@link Harness} via
+ * {@link HarnessContext}. The daemon mints these per-call and
+ * enforces the impl's manifest allow-list before delegating to the
+ * underlying signer / RPC client.
+ *
+ * Spec: `spec/2026-05-executor-trust-boundary.md` §3.
+ */
+export { createScopedSigner } from './scoped-signer.js';
+export { createScopedRpc } from './scoped-rpc.js';
+export { freezeSecrets } from './scoped-secrets.js';
+//# sourceMappingURL=index.js.map

package/dist/harnesses/capability/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/harnesses/capability/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAsEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAMxD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/harnesses/capability/scoped-rpc.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Scoped RPC constructor — wraps an upstream public RPC client and
+ * enforces a chain-id allow-list before delegating.
+ */
+import type { ScopedRpc } from './index.js';
+export interface CreateScopedRpcArgs {
+    /** A viem PublicClient (or compatible read-only RPC) the daemon owns. */
+    upstream: ScopedRpc;
+    /** Chain ids this impl is allowed to read. Empty array = none. */
+    chainIdAllowList: readonly number[];
+}
+export declare function createScopedRpc({ upstream, chainIdAllowList, }: CreateScopedRpcArgs): ScopedRpc;

package/dist/harnesses/capability/scoped-rpc.js

@@ -0,0 +1,34 @@
+/**
+ * Scoped RPC constructor — wraps an upstream public RPC client and
+ * enforces a chain-id allow-list before delegating.
+ */
+export function createScopedRpc({ upstream, chainIdAllowList, }) {
+    async function ensureChainAllowed() {
+        const chainId = await upstream.getChainId();
+        if (!chainIdAllowList.includes(chainId)) {
+            throw new Error(`chain ${chainId} not in allow-list ${JSON.stringify(chainIdAllowList)}`);
+        }
+    }
+    return {
+        async readContract(args) {
+            await ensureChainAllowed();
+            return upstream.readContract(args);
+        },
+        async getBlockNumber() {
+            await ensureChainAllowed();
+            return upstream.getBlockNumber();
+        },
+        async getBalance(args) {
+            await ensureChainAllowed();
+            return upstream.getBalance(args);
+        },
+        async getCode(args) {
+            await ensureChainAllowed();
+            return upstream.getCode(args);
+        },
+        async getChainId() {
+            return upstream.getChainId();
+        },
+    };
+}
+//# sourceMappingURL=scoped-rpc.js.map

package/dist/harnesses/capability/scoped-rpc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoped-rpc.js","sourceRoot":"","sources":["../../../src/harnesses/capability/scoped-rpc.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAWH,MAAM,UAAU,eAAe,CAAC,EAC9B,QAAQ,EACR,gBAAgB,GACI;IACpB,KAAK,UAAU,kBAAkB;QAC/B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;QAC5C,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,SAAS,OAAO,sBAAsB,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,CACzE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,IAAI;YACrB,MAAM,kBAAkB,EAAE,CAAC;YAC3B,OAAO,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;QACD,KAAK,CAAC,cAAc;YAClB,MAAM,kBAAkB,EAAE,CAAC;YAC3B,OAAO,QAAQ,CAAC,cAAc,EAAE,CAAC;QACnC,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,IAAI;YACnB,MAAM,kBAAkB,EAAE,CAAC;YAC3B,OAAO,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,MAAM,kBAAkB,EAAE,CAAC;YAC3B,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QACD,KAAK,CAAC,UAAU;YACd,OAAO,QAAQ,CAAC,UAAU,EAAE,CAAC;QAC/B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/harnesses/capability/scoped-secrets.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Scoped secrets helper — produces a read-only view over a secrets
+ * bag. The daemon stores the underlying map and re-issues a fresh
+ * frozen view per `run()` call so revoked secrets stop reaching impls
+ * promptly.
+ */
+import type { ScopedSecrets } from './index.js';
+export declare function freezeSecrets(source: Record<string, string>): ScopedSecrets;

package/dist/harnesses/capability/scoped-secrets.js

@@ -0,0 +1,10 @@
+/**
+ * Scoped secrets helper — produces a read-only view over a secrets
+ * bag. The daemon stores the underlying map and re-issues a fresh
+ * frozen view per `run()` call so revoked secrets stop reaching impls
+ * promptly.
+ */
+export function freezeSecrets(source) {
+    return Object.freeze({ ...source });
+}
+//# sourceMappingURL=scoped-secrets.js.map

package/dist/harnesses/capability/scoped-secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoped-secrets.js","sourceRoot":"","sources":["../../../src/harnesses/capability/scoped-secrets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,UAAU,aAAa,CAAC,MAA8B;IAC1D,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;AACtC,CAAC"}

package/dist/harnesses/capability/scoped-signer.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Scoped signer constructor — Phase 1 implementation. The (chainId,
+ * to, selector) allow-list is enforced before `sendAllowedCall`
+ * delegates, and the EIP-712 domain allow-list is enforced before
+ * `signTypedData` delegates. Actual transaction signing is wired in a
+ * follow-up plan (the daemon plan that owns the wallet); the typed-data
+ * delegation hits the master account immediately.
+ *
+ * Spec: `spec/2026-05-executor-trust-boundary.md` §3.
+ */
+import type { Account, Address, Hex } from 'viem';
+import type { ScopedSigner } from './index.js';
+export interface CapabilityAllowEntry {
+    chainId: number;
+    to: Address;
+    /** Lower-case 4-byte selector with `0x` prefix (e.g. `0xdeadbeef`). */
+    selector: Hex;
+}
+/**
+ * EIP-712 typed-data domain allow-list entry. See
+ * `client/src/harnesses/manifest/types.ts:TypedDataAllowEntry` and
+ * the manifest-schema field `capabilities.signer.typedDataDomains`.
+ *
+ * - `chainId` MUST match exactly.
+ * - `verifyingContract` / `name` / `version` match only when set on
+ *   the entry; an unset field on the entry means "any value".
+ */
+export interface TypedDataAllowEntry {
+    chainId: number;
+    name?: string;
+    version?: string;
+    verifyingContract?: Address;
+}
+export interface CreateScopedSignerArgs {
+    account: Account;
+    allowList: readonly CapabilityAllowEntry[];
+    /**
+     * Domain allow-list for `signTypedData`. The daemon refuses any
+     * `signTypedData` call whose domain does not match an entry here.
+     * Default-deny: an empty array means EVERY `signTypedData` call
+     * throws (matches the "no typedDataDomains in the manifest" case).
+     */
+    typedDataAllowList: readonly TypedDataAllowEntry[];
+    chainId: number;
+}
+export declare function createScopedSigner({ account, allowList, typedDataAllowList, chainId, }: CreateScopedSignerArgs): ScopedSigner;

package/dist/harnesses/capability/scoped-signer.js

@@ -0,0 +1,73 @@
+/**
+ * Scoped signer constructor — Phase 1 implementation. The (chainId,
+ * to, selector) allow-list is enforced before `sendAllowedCall`
+ * delegates, and the EIP-712 domain allow-list is enforced before
+ * `signTypedData` delegates. Actual transaction signing is wired in a
+ * follow-up plan (the daemon plan that owns the wallet); the typed-data
+ * delegation hits the master account immediately.
+ *
+ * Spec: `spec/2026-05-executor-trust-boundary.md` §3.
+ */
+function eqLowerOrUndef(a, b) {
+    if (a === undefined || b === undefined)
+        return false;
+    return a.toLowerCase() === b.toLowerCase();
+}
+function matchesEntry(entry, domain) {
+    if (domain.chainId !== entry.chainId)
+        return false;
+    if (entry.verifyingContract !== undefined) {
+        if (!domain.verifyingContract)
+            return false;
+        if (!eqLowerOrUndef(entry.verifyingContract, domain.verifyingContract)) {
+            return false;
+        }
+    }
+    if (entry.name !== undefined) {
+        if (domain.name !== entry.name)
+            return false;
+    }
+    if (entry.version !== undefined) {
+        if (domain.version !== entry.version)
+            return false;
+    }
+    return true;
+}
+export function createScopedSigner({ account, allowList, typedDataAllowList, chainId, }) {
+    return {
+        get address() {
+            return account.address;
+        },
+        async signTypedData(args) {
+            // Default-deny: empty allow-list refuses everything. Operators
+            // who need typed-data signing MUST declare a
+            // `capabilities.signer.typedDataDomains` entry on the manifest.
+            // Finding 3.
+            const allowed = typedDataAllowList.some((entry) => matchesEntry(entry, args.domain));
+            if (!allowed) {
+                throw new Error(`signTypedData domain not in allow-list (chainId=${args.domain.chainId ?? 'unspecified'}, ` +
+                    `verifyingContract=${args.domain.verifyingContract ?? 'unspecified'})`);
+            }
+            if (typeof account.signTypedData !== 'function') {
+                throw new Error('master account does not support signTypedData');
+            }
+            return account.signTypedData(args);
+        },
+        async sendAllowedCall(call) {
+            const selector = call.data.slice(0, 10).toLowerCase();
+            const entry = allowList.find((e) => e.chainId === chainId &&
+                e.to.toLowerCase() === call.to.toLowerCase() &&
+                e.selector.toLowerCase() === selector);
+            if (!entry) {
+                const haveContract = allowList.some((e) => e.chainId === chainId && e.to.toLowerCase() === call.to.toLowerCase());
+                if (!haveContract) {
+                    throw new Error(`to ${call.to} not in allow-list for chain ${chainId}`);
+                }
+                throw new Error(`selector ${selector} not in allow-list for ${call.to} on chain ${chainId}`);
+            }
+            // Phase 1: shape only — actual signing is wired in the daemon plan.
+            throw new Error('sendAllowedCall is allow-list-validated but signing is wired in the daemon plan');
+        },
+    };
+}
+//# sourceMappingURL=scoped-signer.js.map

package/dist/harnesses/capability/scoped-signer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoped-signer.js","sourceRoot":"","sources":["../../../src/harnesses/capability/scoped-signer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAyCH,SAAS,cAAc,CAAC,CAAqB,EAAE,CAAqB;IAClE,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACrD,OAAO,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,YAAY,CACnB,KAA0B,EAC1B,MAAmC;IAEnC,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IACnD,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,iBAAiB;YAAE,OAAO,KAAK,CAAC;QAC5C,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACvE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;IAC/C,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,EACjC,OAAO,EACP,SAAS,EACT,kBAAkB,EAClB,OAAO,GACgB;IACvB,OAAO;QACL,IAAI,OAAO;YACT,OAAO,OAAO,CAAC,OAAO,CAAC;QACzB,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,IAAuB;YACzC,+DAA+D;YAC/D,6CAA6C;YAC7C,gEAAgE;YAChE,aAAa;YACb,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAChD,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CACjC,CAAC;YACF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CACb,mDAAmD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,aAAa,IAAI;oBACzF,qBAAqB,IAAI,CAAC,MAAM,CAAC,iBAAiB,IAAI,aAAa,GAAG,CACzE,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,OAAO,CAAC,aAAa,KAAK,UAAU,EAAE,CAAC;gBAChD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACnE,CAAC;YACD,OAAO,OAAO,CAAC,aAAa,CAAC,IAAa,CAAC,CAAC;QAC9C,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,IAAyB;YAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAS,CAAC;YAC7D,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAC1B,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,OAAO,KAAK,OAAO;gBACrB,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE;gBAC5C,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,QAAQ,CACxC,CAAC;YACF,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CACjC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,CAC7E,CAAC;gBACF,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,MAAM,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,gCAAgC,OAAO,EAAE,CAAC,CAAC;gBAC1E,CAAC;gBACD,MAAM,IAAI,KAAK,CACb,YAAY,QAAQ,0BAA0B,IAAI,CAAC,EAAE,aAAa,OAAO,EAAE,CAC5E,CAAC;YACJ,CAAC;YACD,oEAAoE;YACpE,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/harnesses/engine/artifact-scrub.d.ts

@@ -0,0 +1,12 @@
+import { type IdentityScrubConfig } from '../../trajectory/processors/identity-scrub.js';
+import { type PathScrubConfig } from '../../trajectory/processors/path-scrub.js';
+export declare const DONATION_ARTIFACT_ENCODING: "jinn.artifact.donation.v1";
+export interface ArtifactScrubConfig {
+    identity?: IdentityScrubConfig;
+    path?: PathScrubConfig;
+}
+export interface ArtifactScrubResult {
+    bytes: Buffer;
+    redactedKeys: string[];
+}
+export declare function scrubArtifactBytes(bytes: Buffer, cfg?: ArtifactScrubConfig): ArtifactScrubResult;

package/dist/harnesses/engine/artifact-scrub.js

@@ -0,0 +1,104 @@
+import { scrubIdentityString, } from '../../trajectory/processors/identity-scrub.js';
+import { CREDENTIAL_REDACTED, isSensitiveCredentialKey, } from '../../trajectory/processors/credential-scrub.js';
+import { scrubPathString, } from '../../trajectory/processors/path-scrub.js';
+export const DONATION_ARTIFACT_ENCODING = 'jinn.artifact.donation.v1';
+const CREDENTIAL_VALUE_PATTERNS = [
+    /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}/gi,
+    /\bsk-[A-Za-z0-9_-]{16,}\b/g,
+    /\bsk-ant-[A-Za-z0-9_-]{16,}\b/g,
+    /\bgh[pousr]_[A-Za-z0-9_]{16,}\b/g,
+    /\bxox[baprs]-[A-Za-z0-9-]{16,}\b/g,
+    /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+];
+function isUtf8Text(bytes) {
+    if (bytes.includes(0))
+        return false;
+    const text = bytes.toString('utf8');
+    return Buffer.from(text, 'utf8').equals(bytes);
+}
+function scrubCredentialValues(value) {
+    let out = value;
+    for (const pattern of CREDENTIAL_VALUE_PATTERNS) {
+        out = out.replace(pattern, CREDENTIAL_REDACTED);
+    }
+    return out;
+}
+function scrubTextValue(value, cfg) {
+    let out = value;
+    if (cfg.path)
+        out = scrubPathString(out, cfg.path);
+    if (cfg.identity)
+        out = scrubIdentityString(out, cfg.identity);
+    return scrubCredentialValues(out);
+}
+function scrubJsonValue(value, cfg, redactedKeys) {
+    if (typeof value === 'string')
+        return scrubTextValue(value, cfg);
+    if (Array.isArray(value))
+        return value.map((entry) => scrubJsonValue(entry, cfg, redactedKeys));
+    if (value && typeof value === 'object') {
+        const out = {};
+        for (const [key, raw] of Object.entries(value)) {
+            if (isSensitiveCredentialKey(key)) {
+                out[key] = CREDENTIAL_REDACTED;
+                redactedKeys.add(key);
+            }
+            else {
+                out[key] = scrubJsonValue(raw, cfg, redactedKeys);
+            }
+        }
+        return out;
+    }
+    return value;
+}
+function scrubJsonText(text, cfg) {
+    try {
+        const parsed = JSON.parse(text);
+        const redactedKeys = new Set();
+        const scrubbed = scrubJsonValue(parsed, cfg, redactedKeys);
+        if (JSON.stringify(scrubbed) === JSON.stringify(parsed))
+            return null;
+        const out = `${JSON.stringify(scrubbed, null, 2)}\n`;
+        return {
+            bytes: Buffer.from(out, 'utf8'),
+            redactedKeys: Array.from(redactedKeys).sort(),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function scrubCredentialLines(text, redactedKeys) {
+    return text
+        .split('\n')
+        .map((line) => {
+        const match = line.match(/^(\s*["']?)([A-Za-z0-9_.-]+)(["']?\s*[:=]\s*)(.*)$/);
+        if (!match)
+            return line;
+        const [, prefix, key, sep] = match;
+        if (!isSensitiveCredentialKey(key))
+            return line;
+        redactedKeys.add(key);
+        return `${prefix}${key}${sep}${CREDENTIAL_REDACTED}`;
+    })
+        .join('\n');
+}
+export function scrubArtifactBytes(bytes, cfg = {}) {
+    if (!isUtf8Text(bytes))
+        return { bytes, redactedKeys: [] };
+    const text = bytes.toString('utf8');
+    const jsonResult = scrubJsonText(text, cfg);
+    if (jsonResult)
+        return jsonResult;
+    const redactedKeys = new Set();
+    let scrubbed = scrubTextValue(text, cfg);
+    scrubbed = scrubCredentialLines(scrubbed, redactedKeys);
+    if (scrubbed === text && redactedKeys.size === 0) {
+        return { bytes, redactedKeys: [] };
+    }
+    return {
+        bytes: Buffer.from(scrubbed, 'utf8'),
+        redactedKeys: Array.from(redactedKeys).sort(),
+    };
+}
+//# sourceMappingURL=artifact-scrub.js.map

package/dist/harnesses/engine/artifact-scrub.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-scrub.js","sourceRoot":"","sources":["../../../src/harnesses/engine/artifact-scrub.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,mBAAmB,GACpB,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACL,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAEL,eAAe,GAChB,MAAM,2CAA2C,CAAC;AAEnD,MAAM,CAAC,MAAM,0BAA0B,GAAG,2BAAoC,CAAC;AAY/E,MAAM,yBAAyB,GAAsB;IACnD,sCAAsC;IACtC,4BAA4B;IAC5B,gCAAgC;IAChC,kCAAkC;IAClC,mCAAmC;IACnC,6EAA6E;CAC9E,CAAC;AAEF,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC1C,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,MAAM,OAAO,IAAI,yBAAyB,EAAE,CAAC;QAChD,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,GAAwB;IAC7D,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,IAAI,GAAG,CAAC,IAAI;QAAE,GAAG,GAAG,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,GAAG,CAAC,QAAQ;QAAE,GAAG,GAAG,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/D,OAAO,qBAAqB,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,cAAc,CACrB,KAAc,EACd,GAAwB,EACxB,YAAyB;IAEzB,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACjE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC;IAChG,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/C,IAAI,wBAAwB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClC,GAAG,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC;gBAC/B,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACxB,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,GAAwB;IAC3D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;QAC3C,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;QACvC,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;QAC3D,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACrE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;QACrD,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;YAC/B,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE;SAC9C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,YAAyB;IACnE,OAAO,IAAI;SACR,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;QAC/E,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC;QACnC,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAChD,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtB,OAAO,GAAG,MAAM,GAAG,GAAG,GAAG,GAAG,GAAG,mBAAmB,EAAE,CAAC;IACvD,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,KAAa,EACb,MAA2B,EAAE;IAE7B,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IAE3D,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC5C,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAElC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,IAAI,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACzC,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACxD,IAAI,QAAQ,KAAK,IAAI,IAAI,YAAY,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACjD,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IACrC,CAAC;IACD,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC;QACpC,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE;KAC9C,CAAC;AACJ,CAAC"}

package/dist/harnesses/engine/canonical-json.d.ts

@@ -0,0 +1 @@
+export declare function canonicalJson(value: unknown): string;

package/dist/harnesses/engine/canonical-json.js

@@ -0,0 +1,66 @@
+/**
+ * Canonical JSON serialisation — RFC 8785 JCS.
+ *
+ * Uses the `canonicalize` npm package (≈30 LOC, zero deps) so third-party
+ * verifiers can reproduce our signing input with any standard JCS library.
+ *
+ * Rules per RFC 8785:
+ * - Object keys sorted lexicographically by UTF-16 code-unit order.
+ * - No insignificant whitespace.
+ * - I-JSON number formatting per ECMAScript `Number.prototype.toString(10)`
+ *   (integer-preferred; scientific notation when |x| ≥ 1e21 or |x| < 5e-7;
+ *   -0 serialises as 0).
+ * - String escape rules per JSON spec (control chars as \\uXXXX; only ", \
+ *   and control chars must be escaped).
+ * - `undefined` values in objects are dropped (matches JSON.stringify).
+ * - `NaN` / `Infinity` serialise to `null` (matches JSON.stringify).
+ *
+ * BigInt is **not** supported — JCS is a canonicalization of standard JSON,
+ * which has no BigInt type. Callers must convert BigInt to string or number
+ * before calling. Passing BigInt throws.
+ *
+ * Used for manifest signing: produce a deterministic byte string that two
+ * independent parties can reproduce from the same object graph.
+ */
+import { createRequire } from 'node:module';
+const require = createRequire(import.meta.url);
+const canonicalize = require('canonicalize');
+/**
+ * Recursively replace NaN / ±Infinity with null so that canonicalize does not
+ * throw — matching the JSON.stringify behaviour that the rest of the codebase
+ * expects. BigInt is intentionally left unhandled so that canonicalize throws
+ * a clear error when a caller passes one.
+ */
+function coerceNonFinite(value) {
+    if (typeof value === 'number' && !isFinite(value))
+        return null;
+    if (Array.isArray(value))
+        return value.map(coerceNonFinite);
+    if (value !== null && typeof value === 'object') {
+        // Preserve toJSON() — canonicalize would otherwise call it itself;
+        // by pre-processing we must not strip it. Invoke it here and recurse
+        // on its return value so NaN/Infinity inside toJSON results are still
+        // coerced.
+        const toJson = value.toJSON;
+        if (typeof toJson === 'function') {
+            return coerceNonFinite(toJson.call(value));
+        }
+        const out = {};
+        for (const [k, v] of Object.entries(value))
+            out[k] = coerceNonFinite(v);
+        return out;
+    }
+    return value;
+}
+export function canonicalJson(value) {
+    const coerced = coerceNonFinite(value);
+    const result = canonicalize(coerced);
+    if (result === undefined) {
+        // canonicalize returns undefined for top-level undefined input (matches
+        // JSON.stringify). Match Jinn's previous behaviour: emit "null" so the
+        // return type is always a string.
+        return 'null';
+    }
+    return result;
+}
+//# sourceMappingURL=canonical-json.js.map

package/dist/harnesses/engine/canonical-json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-json.js","sourceRoot":"","sources":["../../../src/harnesses/engine/canonical-json.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,YAAY,GAAG,OAAO,CAAC,cAAc,CAA2C,CAAC;AAEvF;;;;;GAKG;AACH,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC5D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,mEAAmE;QACnE,qEAAqE;QACrE,sEAAsE;QACtE,WAAW;QACX,MAAM,MAAM,GAAI,KAAoC,CAAC,MAAM,CAAC;QAC5D,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;QACxE,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAEvC,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,wEAAwE;QACxE,uEAAuE;QACvE,kCAAkC;QAClC,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/harnesses/engine/delivery.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Harness engine — mech delivery + JinnRouter delivery settlement.
+ *
+ * §6.1 DELIVERING phase.
+ *
+ * Steps:
+ *   1. Encode manifest CID as bytes32 digest (cidToDigestHex).
+ *   2. Call mech.deliverToMarketplace(requestId, deliveryDigest) via the Safe.
+ *   3. Call the configured router delivery settlement method. V3 settles
+ *      Solution requests through `claimSolutionDelivery(requestId, evidenceHash)`.
+ */
+import type { Hex, PublicClient, WalletClient, Address } from 'viem';
+import type { EvictionRecoveryConfig } from '../../adapters/mech/types.js';
+export interface DeliveryDeps {
+    publicClient: PublicClient;
+    walletClient: WalletClient;
+    safeAddress: Address;
+    mechContractAddress: Address;
+    routerAddress: Address;
+    /** Router delivery settlement encoding — matches chain config. */
+    claimDeliveryVariant: 'v1' | 'v2' | 'v3';
+    evictionRecovery?: EvictionRecoveryConfig;
+}
+/**
+ * Callback invoked after deliverToMarketplace lands on-chain but BEFORE
+ * claimDelivery is called. Callers use this to durably persist the tx hash so
+ * that a crash between the two steps can be recovered without re-submitting the
+ * deliver transaction.
+ */
+export type OnDeliveryTxLanded = (deliveryTxHash: Hex) => void | Promise<void>;
+export interface DeliveryResult {
+    deliveryTxHash: Hex;
+    claimTxHash: Hex;
+}
+export interface DeliveryClaimOptions {
+    kind?: 'solution' | 'verdict';
+    verdictCode?: number;
+}
+/**
+ * Deliver the manifest to the marketplace and claim the delivery on JinnRouter.
+ *
+ * Crash-recovery safe: if `preExistingDeliveryTxHash` is provided, the
+ * deliverToMarketplace step is skipped entirely — the function resumes from
+ * the claimDelivery step only. This handles the case where the process crashed
+ * after deliver landed on-chain but before the COMPLETE transition was persisted.
+ *
+ * @param requestId                 The on-chain request ID (bytes32 hex).
+ * @param manifestCid               IPFS CID of the signed manifest.
+ * @param evidenceHash              keccak256 hash of the canonical manifest JSON
+ *   (from manifest assembly) — used as evidenceHash in claimDelivery V2.
+ * @param deps                      Viem clients + contract addresses.
+ * @param preExistingDeliveryTxHash If set, skip deliverToMarketplace and use
+ *   this as the deliveryTxHash in the result.
+ * @param onDeliveryTxLanded        Optional callback invoked after
+ *   deliverToMarketplace succeeds, before claimDelivery. Use this to persist the
+ *   tx hash so recovery can skip the deliver step on restart.
+ */
+export declare function deliverAndClaim(requestId: Hex, manifestCid: string, evidenceHash: Hex, deps: DeliveryDeps, preExistingDeliveryTxHash?: Hex, onDeliveryTxLanded?: OnDeliveryTxLanded, claimOptions?: DeliveryClaimOptions): Promise<DeliveryResult>;

package/dist/harnesses/engine/delivery.js

@@ -0,0 +1,67 @@
+/**
+ * Harness engine — mech delivery + JinnRouter delivery settlement.
+ *
+ * §6.1 DELIVERING phase.
+ *
+ * Steps:
+ *   1. Encode manifest CID as bytes32 digest (cidToDigestHex).
+ *   2. Call mech.deliverToMarketplace(requestId, deliveryDigest) via the Safe.
+ *   3. Call the configured router delivery settlement method. V3 settles
+ *      Solution requests through `claimSolutionDelivery(requestId, evidenceHash)`.
+ */
+import { cidToDigestHex, } from '../../adapters/mech/ipfs.js';
+import { callDeliverToMarketplace, claimDelivery, } from '../../adapters/mech/contracts.js';
+/**
+ * Deliver the manifest to the marketplace and claim the delivery on JinnRouter.
+ *
+ * Crash-recovery safe: if `preExistingDeliveryTxHash` is provided, the
+ * deliverToMarketplace step is skipped entirely — the function resumes from
+ * the claimDelivery step only. This handles the case where the process crashed
+ * after deliver landed on-chain but before the COMPLETE transition was persisted.
+ *
+ * @param requestId                 The on-chain request ID (bytes32 hex).
+ * @param manifestCid               IPFS CID of the signed manifest.
+ * @param evidenceHash              keccak256 hash of the canonical manifest JSON
+ *   (from manifest assembly) — used as evidenceHash in claimDelivery V2.
+ * @param deps                      Viem clients + contract addresses.
+ * @param preExistingDeliveryTxHash If set, skip deliverToMarketplace and use
+ *   this as the deliveryTxHash in the result.
+ * @param onDeliveryTxLanded        Optional callback invoked after
+ *   deliverToMarketplace succeeds, before claimDelivery. Use this to persist the
+ *   tx hash so recovery can skip the deliver step on restart.
+ */
+export async function deliverAndClaim(requestId, manifestCid, evidenceHash, deps, preExistingDeliveryTxHash, onDeliveryTxLanded, claimOptions = {}) {
+    let deliveryTxHash;
+    if (preExistingDeliveryTxHash) {
+        // Recovery path: deliverToMarketplace already landed on a previous run.
+        console.log(`[harness-engine] deliverToMarketplace already done (recovery), tx=${preExistingDeliveryTxHash}`);
+        deliveryTxHash = preExistingDeliveryTxHash;
+    }
+    else {
+        // 1. Convert manifest CID to 32-byte digest for on-chain delivery data
+        const deliveryDigest = cidToDigestHex(manifestCid);
+        // 2. deliverToMarketplace via Safe
+        console.log(`[harness-engine] deliverToMarketplace requestId=${requestId}`);
+        deliveryTxHash = await callDeliverToMarketplace(deps.publicClient, deps.walletClient, deps.safeAddress, deps.mechContractAddress, [requestId], [deliveryDigest], deps.evictionRecovery);
+        console.log(`[harness-engine] deliverToMarketplace tx=${deliveryTxHash}`);
+        // Persist the tx hash before proceeding to claimDelivery. If the process
+        // crashes between here and the COMPLETE transition, recovery will read this
+        // hash and skip the deliver step.
+        if (onDeliveryTxLanded) {
+            await onDeliveryTxLanded(deliveryTxHash);
+        }
+    }
+    // 3. claim delivery on JinnRouter
+    console.log(`[harness-engine] claimDelivery requestId=${requestId}`);
+    const claimTxHash = await claimDelivery(deps.publicClient, deps.walletClient, deps.safeAddress, deps.routerAddress, requestId, {
+        variant: deps.claimDeliveryVariant,
+        kind: claimOptions.kind ?? 'solution',
+        evidenceHash: deps.claimDeliveryVariant === 'v2' || deps.claimDeliveryVariant === 'v3'
+            ? evidenceHash
+            : undefined,
+        verdictCode: claimOptions.verdictCode,
+    }, deps.evictionRecovery);
+    console.log(`[harness-engine] claimDelivery tx=${claimTxHash}`);
+    return { deliveryTxHash, claimTxHash };
+}
+//# sourceMappingURL=delivery.js.map

package/dist/harnesses/engine/delivery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delivery.js","sourceRoot":"","sources":["../../../src/harnesses/engine/delivery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EACL,cAAc,GACf,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,wBAAwB,EACxB,aAAa,GACd,MAAM,kCAAkC,CAAC;AAmC1C;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,SAAc,EACd,WAAmB,EACnB,YAAiB,EACjB,IAAkB,EAClB,yBAA+B,EAC/B,kBAAuC,EACvC,eAAqC,EAAE;IAEvC,IAAI,cAAmB,CAAC;IAExB,IAAI,yBAAyB,EAAE,CAAC;QAC9B,wEAAwE;QACxE,OAAO,CAAC,GAAG,CAAC,qEAAqE,yBAAyB,EAAE,CAAC,CAAC;QAC9G,cAAc,GAAG,yBAAyB,CAAC;IAC7C,CAAC;SAAM,CAAC;QACN,uEAAuE;QACvE,MAAM,cAAc,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;QAEnD,mCAAmC;QACnC,OAAO,CAAC,GAAG,CAAC,mDAAmD,SAAS,EAAE,CAAC,CAAC;QAC5E,cAAc,GAAG,MAAM,wBAAwB,CAC7C,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,mBAAmB,EACxB,CAAC,SAAS,CAAC,EACX,CAAC,cAAc,CAAC,EAChB,IAAI,CAAC,gBAAgB,CACtB,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,4CAA4C,cAAc,EAAE,CAAC,CAAC;QAE1E,yEAAyE;QACzE,4EAA4E;QAC5E,kCAAkC;QAClC,IAAI,kBAAkB,EAAE,CAAC;YACvB,MAAM,kBAAkB,CAAC,cAAc,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,OAAO,CAAC,GAAG,CAAC,4CAA4C,SAAS,EAAE,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,MAAM,aAAa,CACrC,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,aAAa,EAClB,SAAS,EACT;QACE,OAAO,EAAE,IAAI,CAAC,oBAAoB;QAClC,IAAI,EAAE,YAAY,CAAC,IAAI,IAAI,UAAU;QACrC,YAAY,EAAE,IAAI,CAAC,oBAAoB,KAAK,IAAI,IAAI,IAAI,CAAC,oBAAoB,KAAK,IAAI;YACpF,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,SAAS;QACb,WAAW,EAAE,YAAY,CAAC,WAAW;KACtC,EACD,IAAI,CAAC,gBAAgB,CACtB,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,qCAAqC,WAAW,EAAE,CAAC,CAAC;IAEhE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC;AACzC,CAAC"}